[Tom Plant (pl4nty)]

📖 Description

FoldResults builds its candidate list from NonPrimaryPackageIndices. Those lists aren't updated after the folds, so they can point at stale entries:

• An entry that already folded into a primary match has a null Package. It's still a candidate for its other available packages, so a later entry dereferences it and crashes (c0000005).
• If the primary match comes later in the list, it gets moved into the folded entry's index. That index is still a candidate, so a later entry with the same number of available packages folds the tracked package into itself. Instead of a crash, winget list shows a wrong result.

This PR skips both kinds of candidate when filtering candidateMatches.

🔗 References

Fixes microsoft#6624
Originally reported by KarbitsCode (@KarbitsCode) in pl4nty/winget-extras#2428

🔍 Validation

Added CompositeSource_SxS_FoldedResultIsNonPrimaryCandidate, which follows the repro in the issue. It has one section for each order: the tracked result first (the crash), and the tracked result moved forward (the wrong fold).

Before the fix (Debug x64, test only):

CompositeSource.cpp(2116): FAILED:
due to a fatal error condition:
  SIGSEGV - Segmentation violation signal

-c "Tracked result moved forward"
CompositeSource.cpp(2131): FAILED:
  REQUIRE( result.Matches.size() == 2 )
with expansion:
  1 == 2

After the fix:

AppInstallerCLITests.exe CompositeSource_SxS_FoldedResultIsNonPrimaryCandidate
All tests passed (20 assertions in 1 test case)

AppInstallerCLITests.exe [CompositeSource]
All tests passed (807 assertions in 49 test cases)

AppInstallerCLITests.exe [UpdateFlow],[ListFlow],[SearchFlow]
All tests passed (144 assertions in 38 test cases)

✅ Checklist

• Signed the Contributor License Agreement
• Linked to an issue
• Added a release note fragment (if applicable)
• Updated documentation (if applicable)
• Added or updated tests (or noted why not applicable)
• Updated Copilot instructions (if build, architecture, or conventions changed)

🤖 AI Assistance

• AI assistance was used and has been disclosed in this PR
• No AI assistance was used

📋 Issue Type

• Bug fix
• Feature
• Task

---

Generated by Claude Code