gui: adopt CallbackScope across the ladder, fixing an unguarded this-capture bug in bookmarks

[Yaraslaut]

Summary

Addresses part of #304 (§B2: CallbackScope adoption).

Migrates all four remaining hand-rolled liveness-token sites to morph::async::CallbackScope, which per its own doc comment "replaces the per-class 'token must stay last-declared' convention that used to be re-derived and re-documented in every class that hand-rolled the pattern." The framework itself (bridge.hpp) and pastebin's FormsBridge (#315) had already adopted it; polls, kanban, ledger and bookmarks had not.

Correctness fix, not just cleanup

bookmarks::gui::FormsBridge::submitIfValid captured a bare this with no guard at all, confirming the issue's (unverified) claim. Both reply callbacks passed to BookmarkFormsController::submitIfValid captured raw this and were attached completely unguarded. This path goes through neither Presenter::track()'s QPointer re-check nor Qt's signal/slot auto-disconnect (the completion is a plain std::function, not a QObject::connect). A FormsBridge destroyed while a Completion is still in flight — which always resolves through the executor, never inline, even in Local mode — runs emit against freed storage.

Per TDD discipline, I first wrote a test that reproduces the exact destroy-mid-flight window deterministically (Mode::LocalSingleThread, so ordering is guaranteed, not timing-dependent), mirroring pastebin's own regression test for the identical bug fixed in #315. Then fixed it by giving FormsBridge a last-declared CallbackScope and wrapping both callbacks in _callbacks.guard(...) — the exact shape pastebin's already-fixed FormsBridge uses.

pastebin was independently confirmed already fixed (#315, merged before this branch was cut) — no changes needed there.

Pure adoption (already correctly guarded, migrated for consistency)

• polls::gui::PollBridge — replaced its hand-rolled std::shared_ptr<const void> _liveness + weak_ptr<const void>{_liveness}/.expired() re-derivation (6 sites across openPoll/refresh/submitVotes/updateVotes/submitIfValid/startPolling) with CallbackScope's .then(scope, fn)/.onError(scope, fn)/.guard(fn).
• kanban::gui::BoardBridge — same migration across 9 sites: startPolling's Dispatch/ApplyEvent/OnFatalError, uploadAttachment/downloadAttachment's QNetworkReply::finished handlers, and enableOfflineQueue's two-layer NetworkMonitor probe-thread callbacks (probe thread → _executor->post() → Qt thread, each layer re-gated).
• ledger::gui::ReportJobPoller (not a QObject) — same hand-rolled token, migrated the same way; composes as a plain data member exactly as it would on a QObject.

Net effect: ~50 lines of re-derived weak_ptr/.expired() boilerplate removed, one confirmed use-after-free window closed.

Testing

• docs/spec/core/callback_scope.md and bridge.hpp's own _callbacks/liveness() usage read as the canonical adoption pattern before touching any rung.
• New test: examples/bookmarks/tests/test_bookmark_qml_bridges.cpp — "A FormsBridge destroyed with a submit in flight has its reply suppressed, not delivered" (mirrors pastebin's identical case).
• New test: examples/ledger/tests/test_report_job_poller.cpp — "A ReportJobPoller destroyed with a dispatch in flight has its reply suppressed, not delivered" (this class had no destroy-mid-flight coverage before; added as a regression guard for the refactor even though it was already correctly guarded).
• Built under MSVC (cl-qt-debug preset, /W4, MORPH_BUILD_LADDER=ON, MORPH_BUILD_OFFLINE_SQLITE=ON to exercise kanban's offline stack) — zero warnings.
• ctest results per rung (SQLite backend; the default ODBC_CONNECTION_STRING in this environment points at an unreachable SQL Server and was unset to use the fast local fallback):
  • bookmarks: 121 tests, 120 pass; the 1 reported failure is a Windows-console-codepage artifact in ctest's -R argument marshaling of an em-dash in an unrelated test name (test_app.cpp's RecordMetadata...) — confirmed passing when run directly through the Catch2 binary.
  • kanban: 135/135 pass.
  • ledger: 106 tests, 105 pass; the 1 failure (test_ledger_qml_surface.cpp, a stale busyChanged exemption list tracked as morph#239) is pre-existing on master and untouched by this branch.
  • polls: 70/70 pass.
• clang-format clean (clang-format --dry-run --Werror) on every changed file.

Scope

Stays scoped to gui_lib/*.{hpp,cpp} in bookmarks, polls, kanban and ledger, plus their two test files, per the issue's PR breakdown (§D.4). Does not touch §A (already fixed), §B1/§B3/§B4/§C, or any QML/doc files other agents may be working on in parallel.

🤖 Generated with Claude Code

[codecov]

Codecov Report

❌ Patch coverage is 76.00000% with 24 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
examples/kanban/gui_lib/board_qml_bridge.cpp	67.34%	11 Missing and 5 partials ⚠️
examples/ledger/gui_lib/report_job_poller.cpp	65.21%	2 Missing and 6 partials ⚠️

📢 Thoughts on this report? Let us know!