fix(796): keep the QuickFiler folder drop-down open and commit row selection before cancel

[drmoisan]

Summary

• Fixes the QuickFiler folder drop-down closing immediately on open, whether opened by clicking the arrow or by pressing Down in the search box.
• Root cause, read from instrumentation rather than inferred: focusing the popup's WebView2 deactivates the QuickFiler form, and the deactivate handler's cancel loop runs before the open can finish. A self-inflicted-deactivation seam now distinguishes that case from a genuine deactivation.
• Adds a pending-commit latch so a close arriving while a selection commit is in flight does not cancel the commit.
• Extends the issue 680 leave-handoff latch to cover the mouse open path, not only the Down-arrow path.
• Five of six acceptance criteria are delivered and verified. AC3 is partially delivered and is deliberately left unchecked; see Verification.
• Feature review returned PASS with zero blocking findings.

Why

In the QuickFiler item view the folder drop-down flashed open and closed on every gesture. Typing did keep the list open, but clicking a row closed it without selecting; only Up and Down changed the selection.

The drop-down is not a ComboBox. It is a WebView2 breadcrumb page hosted by ItemViewer, plus a ToolStripDropDown popup hosting a second WebView2. That structure is what makes the defect possible: a ToolStripDropDown is not a Form, so giving focus to the popup's WebView2 deactivates the owning QuickFiler form, and the existing deactivate handler treats every deactivation as a reason to cancel the pending selector session.

The specification imposed an ordering constraint: the first implementation step had to be instrumentation, not a fix, so that the choice among three candidate close paths was made from evidence rather than from an assumption about Win32 activation ordering. That constraint was honoured. The instrumentation landed first, the reproduction was run against it, and the ordering was read off the log. Candidate 1 was confirmed and candidates 2 and 3 refuted on all three gestures.

What Changed

Core behaviour

• QuickFiler/Controllers/QfcFormController.Deactivate.cs — gates the cancel loop on a self-inflicted-deactivation seam, so a deactivation caused by this add-in's own popup no longer cancels the selector session. A deactivation caused by any other window still does, preserving the issue 677 contract.
• QuickFiler/Viewers/BreadcrumbDropDownHost.cs — FinishClose consults a pending-commit latch, so an uncommitted-reason close does not cancel while a commit is in flight.
• QuickFiler/Controllers/QfcItemController.EventHandlers.cs — the search-leave dismissal latch is now also set on the mouse open path.
• QuickFiler/Viewers/QfcFormViewer.cs, QuickFiler/Interfaces/IQfcFormViewer.cs — the intent member the deactivate handler reads, implemented at the one site that reads non-injectable activation state.
• QuickFiler/Viewers/BreadcrumbDropDownHost.Open.cs, QuickFiler/Viewers/ItemViewer.Breadcrumb.cs — open-path and wiring changes supporting the above.

Diagnostics

• QuickFiler/Viewers/BreadcrumbDropDownHost.Diagnostics.cs — new partial part carrying the AC6 instrumentation. OnDropDownClosed was relocated into it rather than duplicated, because the host file sits close to the repository's 500-line ceiling and declares no logger.

Tests

• New: QuickFiler.Test/Viewers/BreadcrumbDropDownCloseOrderingTests.cs, QuickFiler.Test/Controllers/QfcItemController.SearchLeaveLatchTests.cs.
• Updated: QuickFiler.Test/Controllers/QfcFormControllerDeactivateTests.cs, QuickFiler.Test/Viewers/BreadcrumbPendingOpenCloseTests.cs, QuickFiler.Test/Controllers/QfcItemController.SearchDismissalTests.cs.

One pre-existing test was deliberately re-pinned rather than weakened. TextBoxSearchLeave_WhileDropDownOpen_RoutesExactlyOneCloseIntent came from the issue 680 fix and asserted that a search-box leave dismisses an open drop-down regardless of which gesture opened it. That is precisely the state AC4 requires to stop being dismissed. Its method name and its Times.Once() assertion are retained and one Arrange line establishing a search-driven open was added; the case it no longer covers is covered by a new test asserting Times.Never(). The class still declares six test methods.

Architecture / How It Fits Together

The selector session spans three components. ItemViewer hosts the collapsed breadcrumb; BreadcrumbDropDownHost owns the popup and its open/close lifetime; QfcFormController owns form-level deactivation. The defect lived in the seam between the third and the second: deactivation is a form-level event, but whether it should cancel depends on popup-level state.

The fix adds that missing information flow. QfcFormViewer exposes whether the current deactivation was caused by this add-in's own popup; QfcFormController.Deactivate consults it before cancelling; and BreadcrumbDropDownHost separately tracks whether a commit is in flight so that close ordering cannot lose a selection. No public API changed.

Verification

Completed

All commands were run against the branch head in the item worktree.

• Formatting: dotnet tool run csharpier check . — exit 0 over 1608 files, empty unformatted list.
• Analyzers: msbuild TaskMaster.sln /t:Rebuild ... /p:EnableNETAnalyzers=true /p:EnforceCodeStyleInBuild=true — exit 0, 0 warnings, 0 errors, against a baseline of 0 and 0. Non-vacuity established by 36 Csc task invocations and 36 csc.exe tool invocations with both touched assemblies rebuilt after the recorded run start.
• Nullable: msbuild TaskMaster.sln /t:Rebuild ... /p:TreatWarningsAsErrors=true — exit 0, 0 warnings, 0 errors.
• Tests: QuickFiler.Test assembly, Total 1380, Passed 1380, Failed 0, against a baseline of Total 1370 with an empty failure set.
• Coverage: repository line coverage 24.1387 percent before (14867/61590) and 24.1857 percent after (14925/61710), so no regression. Changed-code coverage 40/41 = 97.5610 percent, above the 90 percent floor for changed code.
• File sizes: all 15 audited paths at or under the 500-line ceiling, maximum 496.
• Scope boundary: 84 paths against the merge base, none under UtilitiesCS/, UtilitiesCS.Test/, .claude/, .codex/, .agents/, config/ or .github/, and TaskMaster.sln untouched.

AC6 required a runtime ordering observation that needs a live Outlook process, a real WebView2 surface, a real ToolStripDropDown and human gestures. Repository unit-test policy forbids external processes and shown windows, so no automated test can produce it. It was handled as an approved human-interaction exception with a runbook and a recorded observation artifact, following the precedent of issues 400 and 438. Every acceptance criterion also retains at least one automatable managed-seam assertion.

AC3 is partially delivered

AC3 has two clauses. The second, that the selection is committed before any auto-close cancel runs, is delivered and pinned by tests in both polarities.

The first, that a mouse click on a row selects that row, has no post-fix observation behind it. The row-activation path was deliberately left unchanged, because the evidence did not support changing it, and the decision record states expressly that this establishes only that the evidence does not support the page change and not that the change is unnecessary. The claim that closing the deactivation-cancel path also removes the click-without-select symptom is a causal argument, and it has not been confirmed against a build carrying the fix.

AC3 is therefore left unchecked in spec.md and issue.md. This is a verification gap rather than a known defect, and feature review classified it as non-blocking. Closing it requires either one post-fix observation of the click gesture or a maintainer's acceptance of the causal argument.

Recommended

• Exercise the three gestures against a live Outlook: arrow click, Down in the search box, and a mouse click on a row in the expanded list. The third is the one that closes the AC3 gap.

Backward Compatibility / Migration Notes

No breaking changes. No public API was changed, no file was renamed or removed, and no dependency was added. The issue 677 contract that a genuine deactivation cancels the selector session is preserved and pinned by tests in both polarities. The issue 438 regression guard on row-set refreshes is retained.

Risks and Mitigations

• The deactivation seam reads non-injectable activation state, so its correctness rests on the observed framework behaviour rather than on a unit test of the framework itself. Mitigated by keeping that read at a single site and by testing every consumer through the interface.
• The AC2 guard is sited in a method with two callers. The second is the Cancel teardown path, where no deactivation is in progress, so the guard degenerates there to "is a popup open?" and the teardown's selector-cancel stage is skipped when one is. Review traced the mitigation chain and found responsibility is retained through the group-cleanup stage, but it moves later and onto a fire-and-forget path. Recorded as a follow-up rather than fixed here, because narrowing the guard's siting is a behavioural change outside this item's write set.
• Rollback is a straight revert. The diagnostics part is independently revertable and log-only.

Review Guide

Suggested order:

1. QuickFiler/Controllers/QfcFormController.Deactivate.cs — the AC2 seam, the substance of the fix.
2. QuickFiler/Viewers/BreadcrumbDropDownHost.cs — the AC3 commit-before-cancel ordering.
3. QuickFiler/Controllers/QfcItemController.EventHandlers.cs — the AC4 latch.
4. QuickFiler.Test/Controllers/QfcItemController.SearchDismissalTests.cs — the deliberate re-pinning, worth reading against the Test Strategy section of spec.md.
5. Remaining tests and the diagnostics part.

QuickFiler/Viewers/BreadcrumbDropDownHost.Diagnostics.cs is largely a relocation of OnDropDownClosed and reads as new code in the diff without being new behaviour.

The documentation footprint is large relative to the code footprint. The feature folder carries the plan, specification, research, runbook, decision record and the per-task evidence artifacts. None of it is product code.

Follow-ups

• Narrow the AC2 guard so it applies only to the deactivation caller, for example by passing an explicit flag from the deactivate handler and not from the Cancel teardown stage.
• Remove or consume SearchOwnsDropDownDismissal in QfcItemController.EventHandlers.cs. The underlying field is live and is the AC4 latch; only this exposing property has no reader.
• Correct the comment in BreadcrumbDropDownHost.cs stating that only the focus step is gated, which the new guard placement has falsified.
• Reset the commit-pending latch on close as well as on show, so a restore after a failed open cannot consume a latch left from a previous popup lifetime.
• Close the AC3 verification gap with one post-fix observation of the mouse-click gesture.

GitHub Auto-close

• Closes Bug: quickfiler-folder-dropdown-closes-on-open-and-click-does-not-select #796