fix(#743): route ItemViewer control assignment through an injectable UI-thread dispatcher seam

[drmoisan]

fix(#743): route ItemViewer control assignment through an injectable UI-thread dispatcher seam

Issue #743. QuickFiler's QfcItemController viewer setup drove ItemViewer control assignment
directly, so the pump-hosted tests that exercise it were exposed to UI-thread marshalling timing.
This delivery introduces an injectable dispatcher seam and routes the affected assignment through
it, and adds a deterministic regression test with no sleep, no retry and no timing tolerance.

Verification

• Plan executed to completion: 64 of 64 tasks.
• Full C# toolchain, single clean pass in the order CLAUDE.md prescribes: CSharpier over 1628
  files exit 0; msbuild /t:Rebuild with analyzers 0 warnings / 0 errors; msbuild /t:Rebuild
  with nullable warnings as errors 0 warnings / 0 errors; vstest serial 1401 / 1401.
• Coverage on the file under change moved 0.904762 → 0.906103, with no regression on changed
  lines.
• AC2's regression test was recorded fail-before and pass-after, three runs each.
• AC3(b) recorded 62 targeted runs with zero failures.

Acceptance criteria: 4 of 5 checked, and AC1 is deliberately not one of them

Criterion	Status
AC1	RATIFIED NEGATIVE RESULT — NOT A PASS. Checkbox remains unchecked.
AC2	PASS
AC3 (a + b)	PASS
AC4	PASS
AC5	PASS

AC1 is recorded as a ratified negative result rather than as a pass, and the distinction is
load-bearing. The instrumented runs recorded timeout=0: no expiry occurred in either regime.
AC1's own final sentence defines that as a negative result. Because no expiry occurred, neither
H-COST nor H-LEAK was discriminated — there was no expiry event in which to observe whether the
one-permit TransactionGate was held with no live holder. A hypothesis cannot be rejected by the
absence of observations.

Sharper still, and recorded in the evidence: the specification defines H-LEAK as conditional on a
prior expiry, so with timeout=0 no leak could occur under either hypothesis. The
contended=0 reading was therefore predetermined and carries no information at all.

The maintainer ratified this negative result on 2026-09-13 — accepting the item despite it, which is
a different statement from finding that the result was positive. The checkbox records what was
measured; this section records the acceptance. Both belong in the record, and collapsing them would
destroy the distinction the ratification rests on.

An earlier amendment to the verdict artifact asserted that H-LEAK had been "rejected by direct
observation of the pre-declared counter observable". That claim was wrong and has been withdrawn.
Both superseded texts are retained verbatim in the artifact's correction history rather than being
overwritten, so a reader can see that the artifact was wrong twice and how.

The unresolved question is tracked, not closed: issue #882

H-LEAK was never excluded, only never observed. This delivery's seam routes the affected tests
around the question rather than answering it. If the mechanism was in fact H-LEAK, that defect still
exists and has been avoided rather than fixed.

Issue #882 carries it forward. Its scope is whether QuickFiler's one-permit TransactionGate
can leak or late-release a permit. The evidence it carries is correction C2 of this item's own
specification: TransactionGate remains a SemaphoreSlim(1, 1), still awaited without timeout or
cancellation token, still held from acquisition to disposal — issue #493 changed the owner of the
serialization, not its shape.

Closing this item without #882 would retire the symptom and lose the open question.

Statistical caveat on AC3(b)

The 62-run figure derives from a base rate that is a point estimate from a single observed
failure, roughly 1 in 21, with a 95% interval of approximately [0.0012, 0.2382]. If the true
rate sits near the low end of that interval, 62 clean runs establish little. The record does not
imply more confidence than the measurement supports.

Disclosed residual: review finding R-1 and repository history

Review finding R-1 was an absolute host path in a preparation-session evidence artifact. The token
was substituted for a repository-relative path, and a sweep confirmed no host path remains
anywhere in the feature folder.

The original blob remains reachable in repository history at commit fca5396e8. This residual is
accepted rather than purged: squash merges are disallowed repository-wide, so the only way to remove
the blob would be rewriting an already-pushed branch's history, which the maintainer judged more
dangerous than a user-profile path persisting in one evidence file's history. It is disclosed here
rather than left to be discovered.

Autoclose

No closing keyword is emitted, and none should be added. The context collection tool asserted
twelve candidate issues — #230, #489, #493, #511, #571, #592, #648, #671, #711, #729, #743 and
#823 — harvested from prose citations inside this item's own feature documents rather than from
closure intent. Eleven of the twelve are references, not work this delivery closes. Emitting that
list would close eleven unrelated issues on merge. That harvesting defect is tracked as issue #886.

Issue #743 must be closed manually after this merge.