This method:

void Flag::unlock_diagnostic() {
  assert(is_diagnostic(), "sanity");
  _flags = Flags(_flags & ~KIND_DIAGNOSTIC);
}

doesn't "unlock" anything but clears the "diagnostic" bit so the flag is no longer considered diagnostic. It should be renamed to clear_diagnostic to make that clear and avoid any confusion relating to UnlockDiagnosticVMOptions