proc_forbid(): extensively document why we don't need locking