Bug: qfcformcontroller-cleanup-disposal-ordering #621

• Work Mode: minor-audit

Summary

QfcFormController.Cleanup() tears down state the undo consumer is still using, without first stopping that consumer. QuickFiler/Controllers/QfcFormController.SetupDisposal.cs:216-220 disposes _undoQueue and nulls _globals and _groups while never cancelling or awaiting _undoConsumerTask. A consumer iteration still in flight can therefore observe a disposed queue or a null global, producing an ObjectDisposedException or a NullReferenceException on a background task during teardown.

Environment

• OS/version:
• Python version:
• Command/flags used:
• Data source or fixture:

Steps to Reproduce

1. Start the undo consumer so _undoConsumerTask is running and blocked on a take.
2. Invoke Cleanup() while that iteration is in flight.
3. Observe the consumer touching _undoQueue, _globals or _groups after QuickFiler/Controllers/QfcFormController.SetupDisposal.cs:216-220 has disposed or nulled them.

Expected Behavior

Cleanup cancels the consumer, awaits _undoConsumerTask to a terminal state, and only then disposes the queue and releases _globals and _groups.

Actual Behavior

Cleanup disposes and nulls first and never awaits the task, so teardown races the consumer.

Logs / Screenshots

• Attached minimal logs or screenshot
• Snippet:

Impact / Severity

• Medium

Race confined to teardown, but it can surface as an unobserved background task exception.

Source

From: docs/features/potential/2026-08-26-qfcformcontroller-cleanup-disposal-ordering.md