Fix runner APPLICATION_HANG_QUIESCE: handle WM_ENDSESSION and skip blocking shutdown cleanup

[crutkas]

Summary

The runner WndProc (tray_icon_window_proc) does not handle WM_QUERYENDSESSION / WM_ENDSESSION, and its WM_DESTROY teardown performs blocking cross-process cleanup. Both contribute to the Watson failure APPLICATION_HANG_QUIESCE_cfffffff_PowerToys.exe!run_message_loop on OS shutdown, sign-out, or restart:

1. Without a WM_ENDSESSION handler, DefWindowProc returns 0 without posting a quit message, so run_message_loop stays parked in GetMessageW until the OS quiesce timeout (~5 s) force-terminates the process.
2. Even once teardown starts, WM_DESTROY calls close_settings_window(), which blocks up to 1.5 s on WaitForSingleObject against PowerToys.Settings.exe (src/runner/settings_window.cpp:712), plus Shell_NotifyIcon(NIM_DELETE) during explorer teardown. The Windows shutdown guidance is explicit that handlers must not block — that wait eats the limited quiesce budget.

This PR addresses both: a reusable helper makes the runner unwind promptly, and the runner skips the blocking cleanup the OS is already reaping in parallel.

Supersedes #48378 (same Watson bucket) by combining its no-blocking-cleanup fix with a reusable helper + unit tests. The cleanup-skip insight is credited to @yeelam-gordon.

Related (same failure class, different binary): #41260.

Root cause

src/runner/tray_icon.cpp → tray_icon_window_proc had no case for WM_QUERYENDSESSION / WM_ENDSESSION, and WM_DESTROY unconditionally ran cross-process cleanup. On an OS-initiated shutdown the OS delivers WM_ENDSESSION to PowerToys.Settings.exe directly and reaps it independently, so the runner's 1.5 s wait on it is pure dead time against the quiesce clock.

Fix

1. Reusable helper in src/common/utils/window.h

handle_session_end_message:

• WM_QUERYENDSESSION → returns TRUE (the runner has no unsaved user state to negotiate over).
• WM_ENDSESSION with wparam == TRUE → sets the optional out_session_ending flag, then DestroyWindow(window), which drives the existing WM_DESTROY → PostQuitMessage(0) path and lets run_message_loop unwind cleanly.
• WM_ENDSESSION with wparam == FALSE (another app vetoed shutdown) → leaves the window alone.

The optional bool* out_session_ending out-param lets each caller decide whether to skip its own blocking teardown on shutdown, without baking module-specific cleanup semantics into the shared helper.

tray_icon_window_proc calls the helper at the top of its dispatch and returns early when the message is handled.

2. Skip blocking cleanup on shutdown in src/runner/tray_icon.cpp

WM_DESTROY now branches on g_session_ending:

• User-initiated close (tray → Exit): unchanged — full graceful cleanup (Shell_NotifyIcon(NIM_DELETE) + close_settings_window()).
• OS-initiated shutdown: PostQuitMessage(0) only; the OS reaps Settings.exe and the tray icon for us. The loop unwinds in milliseconds instead of waiting on a 1.5 s cross-process handle.

Why a helper instead of inline cases?

There are 9 other places in PowerToys with the same pattern (separate run_message_loop / GetMessageW callers, no WM_ENDSESSION handling): FancyZones, AlwaysOnTop, KeyboardManagerEngine, WorkspacesWindowArranger, MeasureTool overlay, CropAndLock, GrabAndMove, ZoomIt SelectRectangle, and the notifications COM activator. They can be migrated to the same helper in follow-up PRs scoped per-module — each opts into the out_session_ending skip based on its own cleanup semantics. This PR is intentionally limited to the highest-volume contributor (the always-on runner).

Why not centralize handling inside run_message_loop?

WM_QUERYENDSESSION / WM_ENDSESSION are delivered via SendMessage and invoke the WndProc directly during the GetMessage call — they never appear as a MSG returned to the loop, so the loop cannot observe them. The handler must live in (or be reachable from) the WndProc.

Tests

7 tests in src/common/UnitTests-CommonUtils/Window.Tests.cpp (all green — 18/18 in the WindowTests class):

Test	Guards
HandleSessionEndMessage_QueryEndSession_AllowsShutdown	WM_QUERYENDSESSION returns TRUE.
HandleSessionEndMessage_EndSessionCancelled_DoesNotTearDown	WM_ENDSESSION(FALSE) must not destroy the window.
HandleSessionEndMessage_EndSessionConfirmed_TearsDownAndExitsLoop	WM_ENDSESSION(TRUE) destroys the window and run_message_loop exits < 500 ms.
HandleSessionEndMessage_UnrelatedMessage_NotHandled	Unrelated messages fall through untouched.
HandleSessionEndMessage_EndSessionConfirmed_SignalsSessionEnding	WM_ENDSESSION(TRUE) sets out_session_ending so WM_DESTROY can skip blocking cleanup.
HandleSessionEndMessage_EndSessionCancelled_DoesNotSignalSessionEnding	A cancelled shutdown does not flag session-ending.
HandleSessionEndMessage_QueryEndSession_DoesNotSignalSessionEnding	The query phase does not flag teardown.

Build: runner.vcxproj and UnitTests-CommonUtils both build clean (x64|Debug, 0 warnings / 0 errors).

Manual validation

1. Build PowerToys Debug|x64 and start the runner.
2. Initiate a sign-off (logoff) or restart.
3. Confirm Event Viewer (Windows Logs → Application) shows no Application Hang event for PowerToys.exe.
4. Right-click tray → Exit: confirm Settings.exe shuts down gracefully and no ghost tray icon remains (the user-close path is unchanged).

(#48378 additionally captured real logoff/restart runs showing WM_ENDSESSION → WM_DESTROY completing in 1–8 ms with 0 hang events — the same code path this PR takes.)

Quality checklist

• Linked work item: AB#55588441
• Cross-references CmdPal: Extensions created from the default template hang on OS-initiated shutdown #41260; supersedes Fix runner APPLICATION_HANG_QUIESCE without bypassing WM_CLOSE or blocking on shutdown #48378
• Unit tests (7 in Window.Tests.cpp)
• No new binaries
• Localization: no end-user strings changed
• Doc: helper has a full doc comment in window.h

Co-authored-by: Copilot 223556219+Copilot@users.noreply.github.com