fix(opl): refuse property list invalidation raised from inside GetProperties (#2555)

## The bug

Any property getter reached from `GetProperties` that calls `InvalidateProperties` takes the tooltip build down with it:

```
System.ArgumentNullException: Value cannot be null. (Parameter 'array')
   at Server.ObjectPropertyList.AppendStringDirect(String value)
   at Server.Mobiles.PlayerMobile.GetProperties(IPropertyList list)
```

`InvalidateProperties` rebuilds **in place** — `Reset()`, then `GetProperties()` again on the same instance — and `Reset()` does two destructive things to a build already in flight:

1. **It returns the pooled interpolation buffer.** The compiler rents it in the handler ctor and returns it in the closing `Add`, so *every hole is evaluated while it is live*:

```csharp
var handler = new InterpolatedStringHandler(1, 2, list); // InitializeInterpolation() RENTS
handler.AppendFormatted(pl.Rank.Title);                  // <-- getter runs HERE
handler.AppendLiteral("\t");
handler.AppendFormatted(faction.Definition.PropName);
list.Add(1060776, ref handler);                          // consumes span, RETURNS
```

```
GetProperties(list)
├─ InitializeInterpolation()  -> _arrayToReturnToPool = Rent(256)     buffer LIVE
├─ « hole 1: pl.Rank.Title »
│  └─ PlayerState.Rank.get   (lazy recompute)
│     └─ Invalidate() -> InvalidateProperties() -> m_PropertyList.Reset()
│        └─ Dispose(): Return(buf); _arrayToReturnToPool = null        buffer GONE
└─ handler.AppendFormatted("Knight")
   └─ _arrayToReturnToPool.AsSpan(_pos..)
      └─ ArgumentNullException (Parameter 'array')
```

It surfaces as `ArgumentNullException` rather than `NullReferenceException` because the `Range` overload of `AsSpan` must read `array.Length`, so the BCL null-checks and names the parameter `array`.

2. **It rewinds the packet cursor**, so properties already written are overwritten by the nested pass — a silently corrupted tooltip even where the buffer survives.

## The fix: refuse, don't recover

There is no correct recovery, and retrying the build would only hide the defect. A nested invalidation now logs an error with a stack trace, **throws in `DEBUG`** so it gets found and fixed, and in `RELEASE` returns without touching the list — a possibly stale tooltip, but no crash, no corrupted packet, and nothing leaked back to the pool. Getters that genuinely must invalidate should defer:

```csharp
Timer.DelayCall(InvalidateProperties);
```

The guard flag lives on the `ObjectPropertyList`, not the entity: it is that list's own lifecycle, it costs nothing (both `Item` and `ObjectPropertyList` absorb it in existing padding, and the list is allocated lazily), and it stays correct when builds for different entities nest.

Base instance sizes are unchanged from `main`: Item 128 B, Mobile 792 B, ObjectPropertyList 72 B, PlayerMobile 1216 B.

`PropertyList` also publishes the list into `m_PropertyList` **before** building it rather than assigning through `??=` afterwards, so a nested `InvalidateProperties` sees the build in progress instead of recursing into a second throwaway list whose work is discarded.

`ObjectPropertyList` re-rents its scratch buffer instead of spanning a null array, so a stray `Reset()` from any other caller degrades rather than aborting `GetProperties`.

## Factions `PlayerState`: maintained, not lazily computed

The getter that surfaced this is now a plain field read — the whole `if (m_InvalidateRank)` block and the flag itself are gone:

```csharp
public RankDefinition Rank => m_Rank;
```

`UpdateRank()` recomputes at each point an input actually changes:

| Site | Why |
|---|---|
| `RankIndex` setter | this player's index changed |
| end of `KillPoints` setter | two paths write `m_RankIndex` directly, bypassing the setter; runs once the swap bookkeeping and `ZeroRankOffset` have settled |
| `Faction.AddMember` | *after* the insert — the member count is not settled during the ctor |
| `FactionState` load | once ordering and `ZeroRankOffset` are final |

Supporting fixes this forced out:

- **Both ctors seed the lowest rank.** Nothing recomputes on read any more, so `Rank` has to be usable immediately — including for members that never get a `RankIndex` assigned, which is *every member with no kill points*. Without this, `Rank.Title` NREs.
- **`Rank` always resolves.** Ranks are ordered by `Required` descending ending at `0`, so a *negative* percent (`RankIndex` out of sync with `ZeroRankOffset`) matched nothing and left `m_Rank` null. It no longer divides by a zero `ZeroRankOffset` either.
- **A pre-existing staleness bug.** The `KillPoints` setter writes `m_RankIndex` directly in two places, so the cached rank was never refreshed when a player crossed zero kill points.

All six readers of `Rank` were checked; none relied on the old side effect.

One behaviour change worth flagging: rank refreshes are now **eager** where they used to be lazy, so a `KillPoints` change invalidates each swapped player as it happens. The swap loops break as soon as ordering is satisfied — typically 0–2 swaps — but it is on the path that runs on every faction kill.

## Documentation

The rule is written down so it is enforceable rather than folklore:

- **CLAUDE.md** audit rule 19
- **`dev-docs/property-lists.md`** — new "Never Invalidate From Inside `GetProperties`" section with the failing/passing pattern
- **`dev-docs/claude-skills/modernuo-property-lists.md`** — key rule + anti-pattern
- **`dev-docs/claude-skills/modernuo-code-audit.md`** — rule 19, ERROR severity

## Tests

- `ObjectPropertyListReentrancyTests` — `Reset()` and `Dispose()` re-entered mid-hole (both red against `main` with the exact exception above), nesting behaviour, and the new contract: `DEBUG` throws, `RELEASE` survives, and the build is never retried into a loop.
- `FactionRankTests` — `Rank` is populated before anything reads it, tracks `RankIndex` without a read, is stable across reads, and still resolves when `RankIndex` is out of sync with `ZeroRankOffset`. Red-verified: removing the ctor seed fails the first one.

793/793 `Server.Tests` and 608/608 `UOContent.Tests` pass.

## Noted, not addressed here

`~ObjectPropertyList()` returns the rented array to `STArrayPool<char>.Shared` from the **finalizer thread**, and that pool is single-threaded by design. Left alone as a separate concern.

Projects/UOContent/Engines/Factions/Core/Faction.cs

@@ -242,7 +242,11 @@ public abstract class Faction : IComparable<Faction>, ISpanParsable<Faction>
 
     public virtual void AddMember(Mobile mob)
     {
-        Members.Insert(ZeroRankOffset, new PlayerState(mob, this, Members));
+        var state = new PlayerState(mob, this, Members);
+        Members.Insert(ZeroRankOffset, state);
+
+        // Ranked after the insert: the ctor ran while Owner was still short a member.
+        state.UpdateRank();
 
         mob.AddToBackpack(FactionItem.Imbue(new Robe(), this, false, Definition.HuePrimary));
         mob.SendLocalizedMessage(1010374); // You have been granted a robe which signifies your faction

Projects/UOContent/Engines/Factions/Core/FactionState.cs

@@ -114,6 +114,13 @@ public class FactionState
                         }
                     }
 
+                    // The loop above only assigns RankIndex to members with kill points, and nothing
+                    // computes rank on read, so rank everyone now that the ordering has settled.
+                    foreach (var player in Members)
+                    {
+                        player.UpdateRank();
+                    }
+
                     FactionItems = [];
 
                     if (version >= 2)

Projects/UOContent/Engines/Factions/Core/PlayerState.cs

@@ -8,7 +8,6 @@ public class PlayerState : IComparable<PlayerState>
 {
     private Town m_Finance;
 
-    private bool m_InvalidateRank = true;
     private int m_KillPoints;
     private MerchantTitle m_MerchantTitle;
     private RankDefinition m_Rank;
@@ -22,6 +21,10 @@ public class PlayerState : IComparable<PlayerState>
         Faction = faction;
         Owner = owner;
 
+        // Owner does not contain this state yet, so the count is short by one; the caller ranks it
+        // after inserting.
+        SeedLowestRank();
+
         Attach();
         Invalidate();
     }
@@ -54,6 +57,9 @@ public class PlayerState : IComparable<PlayerState>
                 }
         }
 
+        // Members are still being read; FactionState ranks everyone once the ordering settles.
+        SeedLowestRank();
+
         Attach();
     }
 
@@ -116,6 +122,8 @@ public class PlayerState : IComparable<PlayerState>
                         Owner.Remove(this);
                         Owner.Insert(Faction.ZeroRankOffset, this);
 
+                        // Direct, not through RankIndex: ZeroRankOffset is mid-update. The
+                        // UpdateRank() at the end of this setter covers it.
                         m_RankIndex = Faction.ZeroRankOffset;
                         Faction.ZeroRankOffset++;
                     }
@@ -180,6 +188,7 @@ public class PlayerState : IComparable<PlayerState>
                 }
 
                 m_KillPoints = value;
+                UpdateRank();
                 Invalidate();
             }
         }
@@ -193,49 +202,72 @@ public class PlayerState : IComparable<PlayerState>
             if (m_RankIndex != value)
             {
                 m_RankIndex = value;
-                m_InvalidateRank = true;
+
+                UpdateRank();
+                Invalidate();
             }
         }
     }
 
-    public RankDefinition Rank
+    /// <summary>
+    /// Read from PlayerMobile.GetProperties, so it must stay a plain field read -- recomputing or
+    /// invalidating here re-enters the property list build. Maintained by <see cref="UpdateRank"/>.
+    /// </summary>
+    public RankDefinition Rank => m_Rank;
+
+    // Lowest rank (Required 0): correct for an unranked member, and never null, so Rank.Title
+    // cannot NRE before the first UpdateRank().
+    private void SeedLowestRank()
     {
-        get
+        var ranks = Faction.Definition.Ranks;
+
+        if (ranks.Length > 0)
         {
-            if (m_InvalidateRank)
+            m_Rank = ranks[^1];
+        }
+    }
+
+    /// <summary>
+    /// Recomputes the cached rank. Call whenever <see cref="RankIndex"/>, the faction's
+    /// ZeroRankOffset, or the member count changes -- and only once they have settled.
+    /// </summary>
+    public void UpdateRank()
+    {
+        var ranks = Faction.Definition.Ranks;
+
+        if (ranks.Length == 0)
+        {
+            return;
+        }
+
+        int percent;
+
+        if (Owner.Count == 1)
+        {
+            percent = 1000;
+        }
+        else if (m_RankIndex == -1 || Faction.ZeroRankOffset <= 0)
+        {
+            percent = 0;
+        }
+        else
+        {
+            percent = (Faction.ZeroRankOffset - m_RankIndex) * 1000 / Faction.ZeroRankOffset;
+        }
+
+        // Ranks run Required-descending ending at 0, so anything >= 0 matches below. A negative
+        // percent (RankIndex out of sync with ZeroRankOffset) would otherwise leave it null.
+        m_Rank = ranks[^1];
+
+        for (var i = 0; i < ranks.Length; i++)
+        {
+            var check = ranks[i];
+
+            if (percent >= check.Required)
             {
-                var ranks = Faction.Definition.Ranks;
-                int percent;
-
-                if (Owner.Count == 1)
-                {
-                    percent = 1000;
-                }
-                else if (m_RankIndex == -1)
-                {
-                    percent = 0;
-                }
-                else
-                {
-                    percent = (Faction.ZeroRankOffset - m_RankIndex) * 1000 / Faction.ZeroRankOffset;
-                }
-
-                for (var i = 0; i < ranks.Length; i++)
-                {
-                    var check = ranks[i];
-
-                    if (percent >= check.Required)
-                    {
-                        m_Rank = check;
-                        m_InvalidateRank = false;
-                        break;
-                    }
-                }
-
-                Invalidate();
+                m_Rank = check;
+                break;
             }
-
-            return m_Rank;
         }
     }