fix(quickfiler): itemviewer breadcrumb lifecycle defects D1-D5 and #475

.claude/agent-memory/feature-review/MEMORY.md

@@ -63,6 +63,7 @@
 - [449-review-residuals](project_449-review-residuals.md) — PASS/0 blocking; untracked #584 promotion doc owed a non-child route; unused usings in base test file; AC-supersession-via-plan-provision pattern validated
 - [511-rescope-review-residuals](project_511-rescope-review-residuals.md) — 2026-08-24 re-audit PASS/0 blocking; residuals CR-1 stale RCA narrative + CR-2 AC-vs-deleted-TRX wording; PR must not close #511/#571 (#592/#594/#597 carry the real defects)
 
+- [488-review-residuals](project_488-review-residuals.md) — PASS/0 blocking; TRX host tokens (runUser+storage) partial-sanitize precedent non-blocking; 21.4MB Cobertura + C6-stale promotions owed at fan-in; #670 filed
 - [614-review-residuals](project_614-review-residuals.md) — cycle-2 exit NO-GO/1 blocking: RC-1 widened filing guard admits archive-root-exact row that RequireArchiveRelativeStem throws on, post-Hide async-void crash; CR-1 closed
 - [493-review-residuals + msbuild-log gate adjudication](project_493-review-residuals-and-msbuild-log-gate-adjudication.md) — PASS/0 blocking; how a structurally unsatisfiable msbuild-log byte-equality gate was adjudicated without downgrading the AC
 

.claude/agent-memory/feature-review/project_488-review-residuals.md

@@ -0,0 +1,19 @@
+---
+name: 488-review-residuals
+description: '#488/#475 review PASS/0 blocking at d9ed9eb2; fan-in owes: TRX host-token sanitization (partial-sanitize precedent adjudicated non-blocking), 21.4MB Cobertura pair maintainer decision, C6 stale-enumeration promotion; #670 filed for D5 unobserved fault'
+metadata:
+  type: project
+---
+
+2026-08-28 review of `bug/itemviewer-breadcrumb-lifecycle-defects-488` (base = epic integration `12465043`): PASS, 0 Blocking, 6 Non-blocking, all 54 AC verified. Artifacts at `docs/features/active/itemviewer-breadcrumb-lifecycle-defects-488/*.2026-08-28T06-44.md`.
+
+**Why:** residuals transfer to the quickfiler-bug-family fan-in and later reviews on this surface.
+
+**How to apply:**
+- **Host-token adjudication precedent:** 488's 19 committed TRX embed `c:\users\<account>\...` in `storage`/`codeBase` and `Megalodon4` in `runUser` while name/user/computerName were placeholder-sanitized. Adjudicated **Non-blocking** because identical tokens already exist in merged sibling evidence (501, 608, 439) on the integration branch — the branch neither introduces nor can cure the class. Sibling 489 achieved FULL sanitization, so full is the current standard; check `runUser` and lowercase `storage` paths specifically, sanitizers miss them. Fan-in owes one sed pass over `evidence/**/*.trx` + a repo-wide cleanup entry.
+- **Cobertura pair:** two 10.7 MB raw XMLs committed plan-faithfully (P0-T14/P8-T6 named the paths); they are what enabled independent per-(filename,line) re-derivation. Maintainer decision owed at fan-in; replacement if removed = derived md + root element + per-file hit tables.
+- **C6 stale:** the D4 construction-site enumeration is 19 executable sites, not 13; `EfcItemController.CleanupTests.cs:41` installs no sync context (file names no guarded member; suite green). `ItemViewer` ctor no longer calls `TaskScheduler.FromCurrentSynchronizationContext()` (489 removed `UiScheduler`), so null-`UiSyncContext` viewers are constructible without reflection. Promotion of a test-hygiene note owed.
+- **#670** (OPEN): QFC `InitializeWebViewAsync` fault unobserved at 3 of 4 call sites; D5 guard delivered unweakened. Watch for it in 484-surface reviews.
+- D1/D2 accepted residual: `SetTheme` landing between D1's synchronous dispose and the ConfigureHost post throws ObjectDisposedException — documented, intended, unreachable on the inline-post UI thread.
+- `BreadcrumbItemViewerLifecycleCoordinator.cs` is at 497/500; next edit there needs a split.
+- Hook note: absent `artifacts/pr_context.summary.txt` was hand-authored per the #269 fallback (`- path (+N/-N)` bullets); hook simulation via dot-source passed with the C# PASS row reading figures from committed feature-evidence Cobertura ([[project_feature-evidence-cobertura-counts-as-coverage-artifact]]).

QuickFiler.Test/QuickFiler.Test.csproj

@@ -85,6 +85,7 @@
     <Compile Include="Viewers\BreadcrumbPendingOpenCloseTests.cs" />
     <Compile Include="Viewers\BreadcrumbDropDownLifecycleTests.cs" />
     <Compile Include="Viewers\ItemViewerBreadcrumbDropDownContractTests.cs" />
+    <Compile Include="Viewers\ItemViewerBreadcrumbLifecycleRegressionTests.cs" />
     <Compile Include="Viewers\BreadcrumbDropDownOpenCoordinatorTests.cs" />
     <Compile Include="Viewers\BreadcrumbDropDownOpenCoordinatorTests.Part2.cs" />
     <Compile Include="Viewers\BreadcrumbDropDownOpenCoordinatorTests.Part3.cs" />

QuickFiler.Test/Viewers/BreadcrumbItemViewerLifecycleCoordinatorTests.cs

@@ -252,6 +252,38 @@ public void PresentSearchResults_NoBridgeCoordinator_IsDeterministicNoOp()
             }
         }
 
+        /// <summary>
+        /// Issue #488 defect D2: a theme set while the host-configuration post is still queued must
+        /// not be lost. The coordinator retains the last theme and replays it onto the host in
+        /// <c>ConfigureHost</c>'s newly-adopted branch, so the theme reaches the host that is
+        /// ultimately adopted rather than the null host that was current when it was set.
+        /// </summary>
+        /// <remarks>
+        /// Deterministic and single-threaded. <c>ConfigureHost</c> is queued and deliberately not
+        /// drained before <c>SetTheme</c> runs, which is the state that makes the defect observable:
+        /// at that moment <c>DropDownHost</c> is null, so the coordinator's direct forward reaches
+        /// nothing. The assertion is an exact-sequence equality rather than a containment check, so a
+        /// duplicated or additional replay would also fail it. No second thread, no sleep, no timer
+        /// delay, and no wall-clock wait is used.
+        /// </remarks>
+        [TestMethod]
+        public void ConfigureHostQueued_SetThemeBeforeDrain_ReplaysThemeOntoAdoptedHost()
+        {
+            // Arrange
+            using (var fixture = new LifecycleFixture())
+            {
+                var host = new RecordingHost();
+                fixture.Coordinator.ConfigureHost(host, FixtureAnchor, FixtureWorkingArea);
+
+                // Act
+                fixture.Coordinator.SetTheme("dark");
+                fixture.Queue.DrainOnCreatorThread();
+
+                // Assert
+                host.ThemesApplied.Should().Equal("dark");
+            }
+        }
+
         private static Rectangle FixtureAnchor() => new Rectangle(10, 20, 30, 40);
 
         private static Rectangle FixtureWorkingArea() => new Rectangle(0, 0, 1920, 1080);
@@ -298,6 +330,11 @@ private sealed class RecordingHost : IBreadcrumbDropDownHost
             internal List<string> EventOperations { get; } = new List<string>();
             internal IWebViewMessenger PopupMessengerValue { get; set; }
 
+            /// <summary>
+            /// Issue #488 defect D2: the themes this host received, in the order received.
+            /// </summary>
+            internal List<string> ThemesApplied { get; } = new List<string>();
+
             public bool IsOpen => false;
             public IWebViewMessenger PopupMessenger => PopupMessengerValue;
 
@@ -341,7 +378,7 @@ bool takeFocus
 
             public bool Close(BreadcrumbDropDownCloseReason reason) => true;
 
-            public void SetTheme(string theme) { }
+            public void SetTheme(string theme) => ThemesApplied.Add(theme);
 
             public void Reset() { }
 

QuickFiler.Test/Viewers/BreadcrumbPopupBoundaryCoverageTests.Part2.cs

@@ -167,29 +167,32 @@ public void Readiness_DetachFailure_IsContainedAndCompletionSucceeds()
             readiness.Dispose();
         }
 
+        /// <summary>
+        /// Issue #475: <c>CaptureCurrent</c> fails fast under a null ambient context instead of
+        /// silently substituting a test dispatcher, and still captures a controlled context normally.
+        /// Replaces the deleted ambient-probing selector's boundary test, retaining its
+        /// controlled-context half.
+        /// </summary>
         [TestMethod]
-        public void CaptureCurrentOrTests_NullAndControlledContexts_SelectExpectedBoundaries()
+        public void CaptureCurrent_NullAndControlledContexts_FailFastAndCapture()
         {
             var context = new PumpSynchronizationContext();
-            int testThread = 0;
             int capturedThread = 0;
-            BreadcrumbPopupUiOperations testOperations = WithContext(
-                null,
-                BreadcrumbPopupUiOperations.CaptureCurrentOrTests
-            );
-            testOperations
-                .PostAsync(() => testThread = Environment.CurrentManagedThreadId)
-                .GetAwaiter()
-                .GetResult();
+            Action underNullContext = () =>
+                WithContext(null, BreadcrumbPopupUiOperations.CaptureCurrent);
+            underNullContext
+                .Should()
+                .Throw<InvalidOperationException>(
+                    "capturing without an owning boundary must fail fast rather than degrade"
+                );
             BreadcrumbPopupUiOperations captured = WithContext(
                 context,
-                BreadcrumbPopupUiOperations.CaptureCurrentOrTests
+                BreadcrumbPopupUiOperations.CaptureCurrent
             );
             Task post = Task.Run(() =>
                 captured.PostAsync(() => capturedThread = Environment.CurrentManagedThreadId)
             );
             context.Drain(post);
-            testThread.Should().Be(context.OwnerThreadId);
             capturedThread.Should().Be(context.OwnerThreadId);
             context.PostCount.Should().Be(1);
         }