fix(epic): clear the eight review residuals left by the bugs-2026-09-06 run

[drmoisan]

Suggested title

fix(epic): clear the eight review residuals left by the bugs-2026-09-06 run

Summary

• Closes out eight known, located, and previously unowned defects that the reviews of the
  bugs-2026-09-06 parallel run filed on 2026-09-08: issues 813, 815, 817, 821, 823, 824, 825
  and 826. Each was deliberately excluded from the item that surfaced it to hold that item's blast
  radius to a bugfix.
• Fixes two QuickFiler teardown defects: a second Cleanup on QfcHomeController invoked the
  ribbon-release callback again, and ProgressViewer cancellation threw when the shared token
  source was null or already disposed.
• Fixes an unsynchronised static-initialisation race in ILGlobals.LoadOpcodes.
• Corrects the first-party coverage aggregation, which double-counted method rows, so the reported
  figure again equals an independent de-duplicated recomputation from the same Cobertura report.
• Guards an unguarded archive-root read in QfcItemController.FolderHandling, which threw on the
  UI dispatcher when the archive root was unset; it now degrades to no preselection.
• Tightens ETL deadline mechanics in OlTableExtensions and TimeOutTask, and restores
  Console.Out hygiene across test classes that installed a writer and never restored it.
• Extends BannedSymbols.txt from seven entries to fifteen. RS0030 deliberately stays at
  suggestion — see Backward Compatibility.

17 production C# files change. The remainder of the diff is tests, evidence, and feature
documentation.

Why

These eight issues were promoted from potential records captured on 2026-09-08 during the reviews
and executions of items 809, 810, 811 and 812. Every one of them was already known and already
located; none had an owner. Left alone they would be rediscovered by every future review of the
QuickFiler teardown, UtilitiesCS concurrency, and coverage-tooling subsystems.

The coverage item is the one with leverage beyond its own defect: while first-party aggregation
double-counted method rows, every quality gate downstream of it was measuring something other than
the quantity it claimed to measure.

All nine promoted records existed only on an unpushed local session branch and were absent from
origin/main; they were restored onto the integration branch so each child could resolve a
promotion source.

What Changed

QuickFiler teardown and UI robustness

• QuickFiler/Controllers/QfcHomeController.cs, EfcHomeController.cs — parent cleanup no longer
  releases the ribbon twice.
• UtilitiesCS/Threading/ProgressViewer.cs, ProgressPane.cs — cancellation is safe when the
  shared token source is null or disposed.
• QuickFiler/Controllers/QfcItemController.FolderHandling.cs — guarded archive-root read.
• QuickFiler/Viewers/BreadcrumbDropDownHost.Open.cs, BreadcrumbPopupOwnerRegistry.cs,
  QfcFormViewer.cs, and UtilitiesCS/OutlookObjects/Store/StoreWrapper*.cs — teardown residuals.

UtilitiesCS concurrency and ETL

• UtilitiesCS/NewtonsoftHelpers/SDIL Reader/ILGlobals.cs — synchronised opcode initialisation.
• UtilitiesCS/OutlookObjects/Table/OlTableExtensions.Etl.cs, .TableAccess.cs,
  UtilitiesCS/Threading/TimeOutTask.cs — deadline and retry mechanics.
• UtilitiesCS/Extensions/DfDeedle*.cs.

Tooling

• scripts/vscode/Invoke-MSTestWithCoverage*.ps1 — first-party coverage aggregation no longer
  double-counts method rows, with a new 271-line Pester suite covering the corrected arithmetic.

Policy configuration

• BannedSymbols.txt — adds CancelAfter (both overloads), both deadline
  CancellationTokenSource constructors, and all four timed WaitOne overloads.
• .editorconfig — RS0030 documented and held at suggestion.

Tests and documentation

• 70 .cs files total, including Console.Out restoration across test classes in six test
  projects; 434 Markdown files of specs, plans, audits and gate evidence.

Architecture / How It Fits Together

Delivered as an epic across two waves on a shared integration branch, one independently mergeable
child feature per issue. Wave 0 carried seven features with no dependency edges. Wave 1 carried
issue 826 alone, which depends on 825 because both edit GetTableInViewAsync in
OlTableExtensions.TableAccess.cs.

That single edge is load-bearing at execution time rather than merely declarative: 826's [P1-T1]
re-measures Console.WriteLine reachability against the post-825 tree and records a branch
selection from that measurement, so 826 could not correctly start before 825 had merged.

Verification

Completed

• Every child ran the full four-step C# toolchain in its own worktree in the mandated order —
  CSharpier, MSBuild analyzers, MSBuild nullable, then vstest — using /t:Rebuild throughout,
  because a warm /t:Build returns exit 0 having skipped every compile.
• The integrated tree was gated by dispatched CI runs after each fan-in, not only per child. Seven
  runs concluded, all successful. The authoritative final run
  (34420821429) targeted
  86caef4a, the exact head this pull request carries, and concluded success.
• Feature 825's test gate was independently re-run at its unchanged head: 7213 tests, 7213 passed,
  85.67% line and 79.84% branch coverage, clearing the repository floors of 85% and 75%.
• Every fan-in was checked with git diff --diff-filter=D against the previous integration tip and
  was additions-only, so no merge silently dropped work the branch had gained.
• Each child merge was confirmed from gh pr view state and from the remote tip, not from the
  child's own report.

A gap worth stating plainly: .github/workflows/ci.yml triggers pull_request only on
[main, development]. Every child pull request here was based on the integration branch and
therefore received zero CI runs. Merge-on-green would have silently become merge-on-nothing.
The dispatched integration runs above are the compensating gate. No workflow file was edited to
obtain a trigger. This pull request, targeting main, is the first in the epic to receive CI
automatically.

Recommended

• dotnet tool run csharpier check .
• msbuild TaskMaster.sln /t:Rebuild /m /p:Configuration=Debug "/p:Platform=Any CPU" /p:EnableNETAnalyzers=true /p:EnforceCodeStyleInBuild=true
• msbuild TaskMaster.sln /t:Rebuild /m /p:Configuration=Debug "/p:Platform=Any CPU" /p:TreatWarningsAsErrors=true
• vstest.console.exe <test-assembly-paths> /EnableCodeCoverage

Backward Compatibility / Migration Notes

No public API is removed or renamed. The behavioural changes are all defect corrections in the
direction of not throwing and not double-releasing.

RS0030 is deliberately NOT promoted, and issue #181 stays open. Feature 826 was authorized to
promote dotnet_diagnostic.RS0030.severity from suggestion to warning, but that authorization
explicitly did not extend to breaking the build to obtain it. Toolchain step 3 promotes every
warning to a build error, so promotion remains blocked until the pre-existing call sites are
cleared. The feature delivered the reachable subset — the BannedSymbols.txt extension — and
recorded the blocking precondition in .editorconfig.

That comment also corrects a figure carried in the epic manifest. The manifest cited roughly 143
pre-existing usages. Re-measured at implementation time the surface is 153 textual hits
(DateTime.Now 53, DateTime.UtcNow 20, Random.Shared 5, Thread.Sleep 15, Task.Delay 60).
Textual hits are not diagnostics and the earlier figure was a diagnostic count, so the two numbers
are not comparable.

Because the new BannedSymbols.txt entries are analysed at suggestion, they surface as
suggestions rather than build breaks.

Risks and Mitigations

• Teardown and cancellation paths are hard to exercise headlessly. Mitigated by regression
  tests added per feature, with fail-before evidence recorded before each fix.
• An intermittent test, Transaction_SecondCallerCannotInstallUntilTheFirstRestores, is known
  to fail roughly one run in four. It was deliberately not stabilised with a sleep, a retry, or
  a timing tolerance, which the epic lists as a prohibited remedy; it is recorded as a flake watch.
• The corrected coverage figure may move reported numbers. By design: the arithmetic was wrong
  before. No threshold was lowered to accommodate the corrected denominator, and no production file
  was added to a coverage exclusion list.
• Rollback is a single revert of this merge commit; each child is independently revertible on
  the integration branch.

Review Guide

1. The 17 production .cs files listed under What Changed — the actual behavioural surface.
2. scripts/vscode/Invoke-MSTestWithCoverage*.ps1 and its new Pester suite — the corrected
   coverage arithmetic.
3. .editorconfig and BannedSymbols.txt — the two authorized configuration edits.
4. Everything else is tests, gate evidence, and feature documentation, and is mechanical bulk: 434
   of the 536 changed files are Markdown.

Follow-ups

Four defects were surfaced during preparation but fall outside this epic's blast radius, and are to
be filed through the promotion lifecycle once this merges:

1. GetTableInViewAsync silently returns null on timeout instead of throwing. It calls
   TimeOutTask.RunWithTimeout with maxAttempts: 1 and strict: false; on the ordinary timeout
   path RunWithTimeout absorbs the TaskCanceledException, exhausts its internal retry, and
   returns default(TResult), so neither catch block is entered and the method returns table! as
   null to its caller.
2. QfcHomeController.CreateCancellationToken() has no production caller, so the synchronous
   Init() path passes a null _tokenSource to QfcFormControllerLoader and LoadItems /
   LoadItemsAsync silently do nothing.
3. Cancellation token sources constructed at SubjectMapSco.Orchestration.cs:228 and
   ProgressPackage.cs:25 are never disposed by any holder.
4. ProgressTrackerAsync is dormant production code with no construction site outside its own
   tests.

Also outstanding:

• Issue Feature: csharp-analyzer-stack-hardening #181 remains open, as described above.
• Eight epic child worktrees under C:/Users/DanMoisan/repos/TaskMaster-wt/rr0908-* could not be
  removed: the parallel worktree-removal gate requires a parallel checkpoint items[] record,
  which an epic run does not maintain, so it has no jurisdiction here yet fails closed. They are
  clean and fully merged; reclaim with scripts/bash/cleanup-worktrees.sh.
• docs/features/epics/review-residuals-2026-09-08/epic-status.md records the final state, but its
  closing entry for this merge necessarily lands in a follow-up commit, since a document cannot
  record the merge commit of the pull request that carries it.

GitHub Auto-close

None. The PR-context bundle reports GitHub CLI validation unavailable and no verified closing
issues, so no Closes keyword is emitted here.

This is the safe outcome rather than merely a procedural one. The bundle's author-asserted list
over-collects by scraping issue numbers from commit messages and feature documentation, and
includes #181 — which this work explicitly does not resolve. Close issues 813, 815, 817, 821,
823, 824, 825 and 826 manually after merge, and leave the rest open.