PT Run: cancel previous query on empty pluginQueryPairs + defer CTS dispose on CancelAndWait timeout

Two fixes spotted while doing a follow-up read of the cancellation refactor for
an unrelated review:

1. MainViewModel.cs — previous session was only cancelled when pluginQueryPairs
   had at least one entry. A non-empty QueryText whose QueryBuilder.Build() returns
   an empty dictionary (e.g. all global plugins disabled, no keyword match) fell
   through both cancellation paths and left the in-flight session running. The
   pre-refactor code cancelled _updateSource unconditionally before the Count
   check; this restores that invariant by hoisting previousSession.Cancel() +
   DisposeWhenComplete() out of the Count > 0 block while keeping _currentSession
   bound to the just-cancelled session (so late IResultUpdated events continue to
   suppress via their captured token rather than falling back to
   CancellationToken.None).

2. QuerySession.CancelAndWait — on timeout, the CTS was disposed unconditionally
   while the tracked task may still have been running. That violates the
   refactor's own "tasks never observe a disposed CTS" invariant: any future
   plugin path that touches token WaitHandles (Register, WaitOne) after timeout
   would crash with ObjectDisposedException. The fix gates dispose on the
   completed flag and, on timeout, defers disposal via ContinueWith with
   DenyChildAttach (mirroring DisposeWhenComplete's pattern).

Also softens the QuerySession remarks: the "structural guarantee" only holds for
callers that capture Token into a local. The class can't prevent a future author
from re-reading _currentSession.Token inside a body, which would reintroduce the
original bug.

Added regression test CancelAndWait_DoesNotDisposeCtsWhileTaskStillRuns covering
the new deferred-disposal behavior; all 10 Wox.Test QuerySessionTest cases pass.

---

ADO: https://microsoft.visualstudio.com/DefaultCollection/OS/_workitems/edit/55588441/

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: crutkas

src/modules/launcher/PowerLauncher/ViewModel/MainViewModel.cs

@@ -803,12 +803,23 @@ private void QueryResults(bool? delayedExecution)
                     });
 
                     _currentSession = currentSession;
+                }
 
-                    if (previousSession != null)
-                    {
-                        previousSession.Cancel();
-                        _ = previousSession.DisposeWhenComplete();
-                    }
+                // Cancel the prior in-flight query for ANY non-empty query, even one
+                // that produced zero plugin pairs (e.g. all globals disabled + no
+                // keyword match, so QueryBuilder.Build returns an empty dictionary).
+                // The pre-refactor code cancelled _updateSource unconditionally before
+                // the Count check; this restores that invariant so a non-empty query
+                // whose Build() yields zero pairs still tears down the previous
+                // fan-out instead of leaking it. Cancel() and DisposeWhenComplete()
+                // are idempotent, and Token is a stored snapshot, so leaving
+                // _currentSession bound to the just-cancelled session keeps late
+                // IResultUpdated events suppressed via their captured token rather
+                // than falling back to CancellationToken.None and slipping through.
+                if (previousSession != null)
+                {
+                    previousSession.Cancel();
+                    _ = previousSession.DisposeWhenComplete();
                 }
             }
             else

src/modules/launcher/PowerLauncher/ViewModel/QuerySession.cs

@@ -29,6 +29,12 @@ namespace PowerLauncher.ViewModel
     /// captures the token as a local cannot be tricked by a later
     /// <c>_currentSession = new QuerySession()</c> reassignment into observing a
     /// fresh (non-cancelled) token.
+    /// <para>
+    /// Note: "structural" applies only to callers that capture <see cref="Token"/>
+    /// into a local before passing it into a task body. <see cref="QuerySession"/>
+    /// cannot prevent a future author from re-reading <c>_currentSession.Token</c>
+    /// inside a loop / continuation, which would reintroduce the original bug
+    /// shape — code review of every observer site is still required.
     /// </para>
     /// </remarks>
     internal sealed class QuerySession : IDisposable
@@ -147,7 +153,24 @@ public bool CancelAndWait(TimeSpan timeout)
 
             if (Interlocked.Exchange(ref _disposed, 1) == 0)
             {
-                _cts.Dispose();
+                if (completed)
+                {
+                    _cts.Dispose();
+                }
+                else
+                {
+                    // The tracked task outlived our timeout; disposing _cts under
+                    // it would risk ObjectDisposedException if the task later
+                    // touches token WaitHandles. Defer disposal until the task
+                    // actually completes. DenyChildAttach so an attached child
+                    // task cannot delay disposal past the parent's completion.
+                    _ = Completion.ContinueWith(
+                        static (_, state) => ((CancellationTokenSource)state).Dispose(),
+                        _cts,
+                        CancellationToken.None,
+                        TaskContinuationOptions.DenyChildAttach,
+                        TaskScheduler.Default);
+                }
             }
 
             return completed;

src/modules/launcher/Wox.Test/QuerySessionTest.cs

@@ -135,6 +135,40 @@ public void CancelAndWait_ReturnsFalseWhenTaskExceedsTimeout()
             session.Completion.Wait(WaitBudget);
         }
 
+        [TestMethod]
+        public void CancelAndWait_DoesNotDisposeCtsWhileTaskStillRuns()
+        {
+            // Regression: CancelAndWait used to dispose the underlying CTS unconditionally
+            // on timeout, leaving any still-running task body holding a disposed source —
+            // a future code path that touches token WaitHandles (e.g. Register, WaitOne)
+            // would crash with ObjectDisposedException, violating the PR's own
+            // "tasks never observe a disposed CTS" invariant. The fix defers disposal
+            // until the task actually completes.
+            var release = new ManualResetEventSlim(initialState: false);
+            CancellationToken capturedToken = default;
+
+            var session = QuerySession.Start(token =>
+            {
+                capturedToken = token;
+                return Task.Run(() => release.Wait(WaitBudget));
+            });
+
+            bool completed = session.CancelAndWait(TimeSpan.FromMilliseconds(50));
+            Assert.IsFalse(completed, "Sanity: task must outlive the timeout.");
+
+            // While the task is still running with the CTS undisposed,
+            // CancellationToken.Register must succeed (would throw ODE if disposed).
+            using (capturedToken.Register(() => { }))
+            {
+                // no-op; just proves Register didn't throw
+            }
+
+            // Allow the task to complete; the deferred ContinueWith should then dispose
+            // the CTS, and a subsequent Register attempt is allowed to throw ODE.
+            release.Set();
+            session.Completion.Wait(WaitBudget);
+        }
+
         [TestMethod]
         public void Dispose_IsIdempotent_AndSafeAfterCancel()
         {