fix(breadcrumb): enforce close, lifetime, broadcast and lease invariants (#501, #462, #500, #502)

[drmoisan]

Summary

Fixes four ordering and lifetime defects in the QuickFiler breadcrumb coordinator and messenger hub. Each defect is a case of an invariant the code stated but did not enforce.

Issue	Defect	Fix
#462	CloseCore never cleared _closePending on the successful-close path, so a later RequestOpen silently returned the closed sentinel	Replaced the single flag with _closeInFlight and _closeCompleted, cleared on the paths that legitimately reopen the host
#500	TryRunCurrent invoked the guarded action inside _sync, so a WebView2 post ran under nested re-entrant locks and the currency check was not atomic with the action	Narrowed the lock scope so the guarded action, and any PostJson it reaches, runs outside the lifetime lock
#501	PostJson wrote the replay cache before broadcasting and wrapped the broadcast in no try/catch, so one throwing surface starved later attachments while the cache recorded delivery	Broadcast to every attached surface before caching, and log a per-surface failure through log4net instead of propagating it
#502	RunSynchronous discarded TryRunCurrent's bool, so a superseded lease silently skipped the guarded action and SuggestionsUpgrade retained a stale handle	RunSynchronous now returns its skip verdict and both callers consume it; a superseded population settles its lease and replaces the stale handle

Base

Targets epic/quickfiler-bug-family-integration, not main. The integration tip 69e83171 (which added merged siblings #493 and #444) is merged in; the branch is 0 behind.

Changed files

Twelve files, all within this feature's Viewers\Breadcrumb* ownership region:

• Production (5): BreadcrumbBridgeCoordinator.cs, BreadcrumbBridgeCoordinator.Suggestions.cs, BreadcrumbCoordinatorUpgradeLifetime.cs, BreadcrumbDropDownOpenCoordinator.cs, BreadcrumbMessengerHub.cs
• Test (5): BreadcrumbBridgeCoordinatorSupersessionTests.cs, BreadcrumbCoordinatorUpgradeLifetimeTests.cs, BreadcrumbDropDownOpenCoordinatorTests.Part2.cs, BreadcrumbMessengerHubTests.cs, BreadcrumbSelectorCoordinatorTests.cs
• Project files (2): exactly one <Compile Include> line added to each, both under Viewers\Breadcrumb*. Sibling Bug: uithread-dispatcher-static-swap-no-restore #493's two entries and sibling Bug: kbdactions-enumerable-ctor-bypasses-duplicate-guard #444's ten entries are preserved verbatim and unmoved.

BreadcrumbBridgeCoordinator.cs shows as a pure 50-line deletion. That is the SR-1 partial split, not lost content: the base never touched any Viewers/Breadcrumb* file, and the split pair retains 295/295 covered lines.

Toolchain

All four steps passed in one uninterrupted pass on the merged tree, using /t:Rebuild (never /t:Build) with 0 Skipping target "CoreCompile" lines, so the analyzer and nullable gates were live rather than skipped.

Step	Command	Result
Format	dotnet tool run csharpier format . / check .	EXIT 0, 0 files rewritten in the final pass
Analyze	msbuild TaskMaster.sln /t:Rebuild /m ... /p:EnableNETAnalyzers=true /p:EnforceCodeStyleInBuild=true	EXIT 0, 0 errors
Type-check	msbuild TaskMaster.sln /t:Rebuild /m ... /p:TreatWarningsAsErrors=true	EXIT 0, 0 errors
Test	Invoke-MSTestWithCoverage.ps1 full suite	6730 passed, 0 failed, 0 skipped

Coverage

Metric	Baseline	Post-change	Delta
Repository line rate	85.1380%	85.1448%	+0.0068 pp
Repository branch rate	79.2096%	79.2202%	+0.0106 pp
New/changed lines	—	89/89 = 100.0000%	—

All four per-file deltas are at or above 0.00 pp. Coverage moved up, not down.

Review

Feature review returned 0 Blocking findings: 29 of 32 acceptance criteria PASS, 3 PARTIAL, 0 FAIL. All 32 criteria in spec.md are checked off against named evidence artifacts, and all 115 plan tasks are complete. 93 evidence artifacts are indexed in the handoff index, every one verified present.

Five non-blocking findings were dispositioned. Two were documentation defects fixed in place (a dangling-path table, and full-suite run counts that rested on prose rather than captured output — now backed by a committed run ledger). Three were filed as #657 rather than left as folder prose.

Deviations worth a reviewer's attention

1. A plan acceptance condition was amended, not satisfied. Plan task P5-T8 required citing the test project as carrying no log4net reference to justify verifying AC-11's logging half at source level. That premise is false — the reference is at QuickFiler.Test.csproj:209-210. The plan was amended to record the true reason (file budget) rather than write a false claim into the audit trail. The review judged the replacement reason still somewhat overstated; that is tracked as Refactor: breadcrumb-501-review-residuals #657 R-1.
2. An AddItemsCore seam was added mid-run. The coverage gate found the superseded-AddItems skip path was unreachable by any deterministic test, putting the split pair 1.03 pp below its floor. A seam mirroring the already-ratified SetSuggestionsCore pattern was extracted. The review noted the branch it covers is inert, so the new test raises coverage without fully discriminating that branch; tracked as Refactor: breadcrumb-501-review-residuals #657 R-2.
3. 13 tests failed on one run and passed on the re-run. All carried the timed out after 60000ms pump-host signature in sibling-owned files, on a host running three concurrent agents. Both runs are transcribed in the committed run ledger. A re-run that passes proves the failure is non-deterministic, not that it was environmental; the residual risk belongs to those files' owners.

Follow-ups filed

Issue	Subject
#655	Non-re-entrant upgrade-lifetime guard (research 6.2 option C)
#656	SR-4 _closeCompleted residual, owned by feature #488
#657	Three review residuals: source-level log assertion, inert skip branch, uncovered CloseCore line

CI

ci.yml triggers pull_request only on [main, development], so this PR into the epic integration branch receives no automatic checks. CI was dispatched explicitly against the branch head and is recorded in the checkpoint's ci_gate.

Closes #501
Closes #462
Closes #500
Closes #502