Bug: breadcrumb-suggestions-upgrade-silently-stale-on-superseded-lease

[drmoisan]

• Work Mode: full-bug

Summary

BreadcrumbCoordinatorUpgradeLifetime.RunSynchronous discards the bool that TryRunCurrent
returns, so when a lease has been superseded the guarded action is skipped silently. In
BreadcrumbBridgeCoordinator.SetSuggestions the assignment to the public SuggestionsUpgrade handle
lives inside that skipped action, so the method returns normally while SuggestionsUpgrade still
holds its previous value and the caller awaits an upgrade that will never run.

Environment

• OS/version: Windows 11 Pro 10.0.26200
• Python version: n/a (C# / .NET Framework 4.8.1 WinForms VSTO add-in with Microsoft WebView2)
• Command/flags used: n/a - reached through the QuickFiler ItemViewer breadcrumb selector
• Data source or fixture: two breadcrumb suggestion populations issued close enough together that the
  first lease is superseded before its guarded action runs

Steps to Reproduce

This is a concurrency and ordering defect established by code inspection. No existing test reproduces
it, because nothing in the suite supersedes a lease between BeginPopulation and RunSynchronous.

1. Call BreadcrumbBridgeCoordinator.SetSuggestions to begin a suggestion population.
2. Arrange for the lease to be invalidated between BeginPopulation
   (QuickFiler/Viewers/BreadcrumbBridgeCoordinator.cs:104) and RunSynchronous (:105) - nothing
   spans the two atomically.
3. Await the coordinator's SuggestionsUpgrade handle.

Expected Behavior

Either the caller learns that the population was superseded - via a return value, an exception, or a
SuggestionsUpgrade set to a completed or cancelled task - or SuggestionsUpgrade is left in a state
that cannot be mistaken for a fresh in-flight upgrade.

Actual Behavior

SetSuggestions returns normally. SuggestionsUpgrade silently retains its previous value, so a
caller awaiting it either waits on a stale completed task or believes a new upgrade is in flight when
none is. Nothing observable distinguishes this from a successful population.

Logs / Screenshots

• Attached minimal logs or screenshot
• Snippet: n/a - the defect is a silent no-op with no error text.

Impact / Severity

• Blocker
• High
• Medium
• Low

Rationale: reachable only under a supersession race that current call patterns make narrow, and the
observable consequence is a stale suggestion set rather than data loss. Recorded for traceability
because the silent-skip mechanism is general and would become more reachable if suggestion population
were made more concurrent.

Source

From: docs/features/potential/2026-08-08-breadcrumb-suggestions-upgrade-silently-stale-on-superseded-lease.md