[4/4] Save pending chat preferences within a bounded shutdown budget

[Sheng Chen (jdneo)]

Stack and scope

Final layer of the nonblocking chat preferences stack for #408. Depends on #454 and targets jdneo-preferences-03-lifecycle-recovery (176cd589cd7a7bb10fba6aa368e2ab42804c40b0). Preceding layers: #452, #453, #454. This PR changes preference shutdown only; it does not rewrite conversation persistence or general workbench shutdown.

Behavior

• ChatServiceManager registers PreferenceShutdown for UIEvents.UILifeCycle.APP_SHUTDOWN_STARTED. Eclipse 4.31 synchronously publishes this event after all veto opportunities and before service disposal. We never veto or reissue a close request, so another participant's canceled exit is respected.
• The synchronous lifecycle callback runs a bounded nested SWT event loop while the existing serialized writer saves accepted account-bound snapshots. Ordinary preference updates, loading, and mode-discovery recovery are quiesced first. No UI-thread future wait/join or lock across file I/O is introduced.
• PreferenceStorage.beginShutdown() returns a read-only completion for pending accepted saves, including old-account writes when the current account is clean/unresolved. It uses already captured destinations and never resolves another CLS persistence path. Newer same-destination successes supersede earlier failures; failures for other destinations remain represented.
• Clean/unavailable-with-no-accepted-write exits do not wait. Successful saves release exit promptly. Failure or the two-second budget logs applicable unsaved preferences and continues without a prompt. Repeated/reentrant events and disposal cannot duplicate the flush or continuation.
• The budget bounds application waiting, not arbitrary OS I/O or unrelated SWT handlers. An already executing write may outlive the wait or disposal; unsaved changes may be lost. Existing atomic complete-file replacement, account isolation, and cross-instance last-completed-save semantics remain unchanged. No temp file used by an active writer is deleted by shutdown.

The inherited protection decision is unchanged: Windows ACLs are preserved; on POSIX without a supported ACL view, preserve owner/group and owner bits while intentionally removing group/other permissions. No full extended-POSIX-ACL preservation claim.

Validation

TDD at the agreed public storage lifecycle and actual shutdown-adapter registration/SWT boundaries. Controlled time verifies the exact logical 2,000 ms cap without sleeps; real SWT dispatch and temporary-directory file writes cover early completion, clean/unresolved paths, failures, older in-flight revisions/accounts, reentrancy, disposal, and late completion. JUnit-thread fixture cleanup now waits for accepted writes before deleting its temporary directory.

All final commands passed with Java 21.0.11:

.\mvnw.cmd -B '-Dtycho.disableP2Mirrors=true' clean verify
.\mvnw.cmd -B '-Dtycho.disableP2Mirrors=true' checkstyle:check
.\mvnw.cmd -B '-Dtycho.disableP2Mirrors=true' test

clean verify: 10,831 tests, 0 failures, 0 errors, 8 POSIX skips on Windows (core 10,212; UI 615; Jobs 4). SWTBot probes remain skipped by default; no Linux/probe run is claimed. Missing generated pinned CLS assets were restored with the existing npm install workflow, without dependency/configuration changes.

Review

Parallel Standards/Spec review against the exact layer-03 base: Standards had no findings. Spec's old-account pending-save accounting and superseded same-path failure findings were reproduced with red regressions, fixed, and confirmed resolved. No outstanding review findings.