Harden modal navigation seam lifecycle and threading

Second review pass found four issues in the seam's lifecycle and threading,
all on paths that only open up during teardown or a handler swap.

RequestSync resolved IDispatcher through _window.Handler.MauiContext. During
handler teardown that context — and the IDispatcher registered in its scope —
is already gone, so the lookup returned null and the documented any-thread
guarantee silently degraded to inline execution at exactly the moment a
backend is most likely to be finishing work off the UI thread. It now uses
Window.Dispatcher, which is public, non-null and handler-independent.

A marshalled RequestSync could also be overtaken by teardown: the callback
ran after Window.Destroying and repopulated modal state on a torn-down
window, driving presentation through disconnected resources. Requests are now
tagged with a scope generation and dropped when the window has been destroyed
or its handler replaced in the meantime.

HandlerChanging cleared the resolution latch while _window.Handler still
pointed at the OUTGOING handler, so a reentrant sync during the transition
could build and latch an override from the DI scope that was going away.
Resolution now stays blocked through the transition and is re-enabled from
HandlerChanged, once the new handler is actually installed.

A failed pop lost the caller's animation intent. The metadata was cleared
before the dismissal was attempted (and, on the inline path, only recorded
when the pop was deferred at all), so the retry after a failure always fell
back to unanimated. It is now recorded unconditionally and cleared only once
the dismissal succeeds, covering the inline and deferred failure paths.

Also narrows PageAttached delivery. It previously fell back to the built-in
platform whenever the override was not yet resolvable, which for a window
without a service scope meant an external backend could end up with the
built-in hook installed (on Tizen, the back-button handler) in addition to
its own. The notification is now withheld until resolution has completed and
routed to exactly one of the two, still at most once per page handler.

Adds regressions for background-thread marshalling with a null handler,
destroy-queued and handler-swap-queued sync being dropped, no resolution from
the outgoing scope during a handler swap, and failed-pop retry preserving the
animation flag. Each was verified to fail against a mutation of its fix.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Author: Redth

src/Controls/src/Core/Platform/ModalNavigationManager/IModalNavigationHost.cs

@@ -143,6 +143,12 @@ public interface IModalNavigationHost
 		/// this method returns. Do not call it while holding a lock, and finish mutating your own state
 		/// before calling it.
 		/// </para>
+		/// <para>
+		/// A marshalled request is bound to the window's current handler scope. If the window is
+		/// destroyed, or its handler is replaced, before the request runs, the request is dropped rather
+		/// than executed against a torn-down window or a service scope that no longer exists. Calling
+		/// this after disposal is therefore harmless but has no effect.
+		/// </para>
 		/// </remarks>
 		void RequestSync();
 	}

src/Controls/src/Core/Platform/ModalNavigationManager/IModalNavigationPlatform.cs

@@ -137,10 +137,10 @@ public interface IModalNavigationPlatform : IDisposable
 		/// <see cref="IModalNavigationHost.PlatformModalStack"/>, because a failed dismissal means the
 		/// modal is presumed to still be on screen and dropping it would leave a visible modal that no
 		/// stack knows about. The cross-platform modal stack is left without the page, so the next
-		/// reconciliation pass retries the dismissal. As with
-		/// <see cref="PushModalAsync(Page, bool)"/>, the fault is rethrown to the caller of
-		/// <c>Navigation.PopModalAsync</c> only when the pop was applied inline; a deferred pop that
-		/// faults is logged instead.
+		/// reconciliation pass retries the dismissal — and <paramref name="animated"/> is preserved
+		/// across that retry. As with <see cref="PushModalAsync(Page, bool)"/>, the fault is rethrown to
+		/// the caller of <c>Navigation.PopModalAsync</c> only when the pop was applied inline; a
+		/// deferred pop that faults is logged instead.
 		/// </para>
 		/// </remarks>
 		Task PopModalAsync(Page modal, bool animated);
@@ -156,7 +156,11 @@ public interface IModalNavigationPlatform : IDisposable
 		/// a handler, so a backend that resolves late does not miss the notification.
 		/// </para>
 		/// <para>
-		/// The framework guarantees it is never delivered twice for the same page-handler attachment.
+		/// The framework guarantees it is never delivered twice for the same page-handler attachment,
+		/// and that the built-in platform is never notified for an attachment that this instance
+		/// handles. Notification is withheld until the window has a service scope — until then the
+		/// framework cannot tell whether a factory is registered, and notifying the built-in platform
+		/// early would leave its hooks installed alongside this instance's.
 		/// </para>
 		/// </remarks>
 		void PageAttached();

src/Controls/src/Core/Platform/ModalNavigationManager/ModalNavigationManager.cs

@@ -63,40 +63,46 @@ public ModalNavigationManager(Window window)
 			InitializePlatform();
 
 			_window.HandlerChanging += OnWindowHandlerChanging;
+			_window.HandlerChanged += OnWindowHandlerChanged;
 			_window.Destroying += (_, _) =>
 			{
 				ClearModalPages(platform: true);
 
 				// Teardown is terminal for the override: it must not come back to life on the next lazy
 				// access while the window is being torn down. Only attaching a new handler (which brings
 				// a new service scope, e.g. an Android activity recreation) re-enables resolution.
-				DisposePlatformOverride(allowRecreate: false);
+				_destroyed = true;
+				DisposePlatformOverride();
+				InvalidateWindowScope();
 			};
 		}
 
 		IModalNavigationPlatform? _platformOverride;
 
-		// Latched once resolution has been attempted so the factory is consulted exactly once per
-		// window scope. Also used as the terminal marker after teardown: it stays true with a null
-		// override so nothing can lazily recreate one.
+		// Latched once resolution has been attempted, so the factory is consulted exactly once per
+		// window scope. It is also set (with a null override) to *block* resolution while the window is
+		// between handlers, because during that window _window.Handler still points at the outgoing
+		// handler and resolving would latch the scope that is going away.
 		bool _platformOverrideResolved;
 
-		// The page handler the current override instance has already been notified about.
+		// Terminal after Window.Destroying. Cleared only when a new handler is installed.
+		bool _destroyed;
+
+		// Bumped whenever the window's service scope changes or goes away. Work queued against an older
+		// generation is stale and must be dropped rather than run against a disconnected scope.
+		int _scopeGeneration;
+
+		// The page handler the current override (or the built-in platform) has been notified about.
 		IElementHandler? _pageAttachedNotifiedForHandler;
 
-		// Delivers PageAttached at most once per (override instance, page handler) pair. Both the
-		// creation path and PageAttachedHandler can reach this, and the reconciliation triggered by a
-		// page change can resolve the override before PageAttachedHandler runs, so keying on the handler
-		// instance is what keeps the notification from being doubled or lost.
-		void NotifyPageAttached(IModalNavigationPlatform platformOverride)
+		void InvalidateWindowScope()
 		{
-			var pageHandler = _window.Page?.Handler;
+			_scopeGeneration++;
 
-			if (pageHandler is null || ReferenceEquals(_pageAttachedNotifiedForHandler, pageHandler))
-				return;
-
-			_pageAttachedNotifiedForHandler = pageHandler;
-			platformOverride.PageAttached();
+			// Block resolution until a new handler is actually installed.
+			_platformOverride = null;
+			_platformOverrideResolved = true;
+			_pageAttachedNotifiedForHandler = null;
 		}
 
 		// Resolved lazily because a Window is constructed long before it has a handler, and therefore
@@ -106,7 +112,7 @@ void NotifyPageAttached(IModalNavigationPlatform platformOverride)
 		{
 			get
 			{
-				if (_platformOverrideResolved)
+				if (_platformOverrideResolved || _destroyed)
 					return _platformOverride;
 
 				// The window handler's IMauiContext is the per-window service scope, so the platform
@@ -138,26 +144,52 @@ void NotifyPageAttached(IModalNavigationPlatform platformOverride)
 				}
 
 				// The page handler may already have been attached before the window had a service scope
-				// to resolve from, in which case PageAttached was never delivered to this instance.
-				if (_platformOverride is not null)
-					NotifyPageAttached(_platformOverride);
+				// to resolve from, in which case PageAttached was never delivered.
+				DeliverPageAttached();
 
 				return _platformOverride;
 			}
 		}
 
-		void DisposePlatformOverride(bool allowRecreate)
+		// Delivers PageAttached at most once per page handler: to the override when one is registered,
+		// and to the built-in platform otherwise.
+		//
+		// The built-in notification is deliberately withheld until resolution has completed. Before the
+		// window has a service scope we cannot yet tell whether a factory is registered, and running the
+		// built-in hook then would leave an external backend with the built-in platform's hook installed
+		// (on Tizen, the back-button handler) in addition to its own. Resolution re-delivers.
+		void DeliverPageAttached()
+		{
+			var pageHandler = _window.Page?.Handler;
+
+			if (pageHandler is null || ReferenceEquals(_pageAttachedNotifiedForHandler, pageHandler))
+				return;
+
+			// Resolving calls back into this method, so re-check afterwards to avoid delivering twice.
+			var platformOverride = PlatformOverride;
+
+			if (ReferenceEquals(_pageAttachedNotifiedForHandler, pageHandler))
+				return;
+
+			if (platformOverride is null && !_platformOverrideResolved)
+				return;
+
+			_pageAttachedNotifiedForHandler = pageHandler;
+
+			if (platformOverride is not null)
+				platformOverride.PageAttached();
+			else
+				OnPageAttachedHandler();
+		}
+
+		void DisposePlatformOverride()
 		{
 			var platformOverride = _platformOverride;
 			_platformOverride = null;
 
 			// A replacement instance has to be told about the current page handler itself.
 			_pageAttachedNotifiedForHandler = null;
 
-			// When recreation isn't allowed the resolved latch stays set with a null override, which is
-			// what makes the destroyed state terminal.
-			_platformOverrideResolved = !allowRecreate;
-
 			platformOverride?.Dispose();
 		}
 
@@ -184,22 +216,51 @@ void DisposePlatformOverride(bool allowRecreate)
 
 		void IModalNavigationHost.RequestSync()
 		{
+			// Snapshot the scope this request belongs to. A request that is queued and then overtaken by
+			// teardown or a handler swap must not run against the replaced or disconnected scope.
+			var generation = _scopeGeneration;
+
 			// Documented as callable from any thread. The whole reconciliation entry — readiness checks,
 			// page lifecycle events and the platform push/pop calls — must run on the UI thread, so
 			// marshal the entire entry point when the caller isn't already there.
-			var dispatcher = _window.Handler?.MauiContext?.Services?.GetService<IDispatcher>();
+			var dispatcher = TryGetWindowDispatcher();
 
 			if (dispatcher is not null && dispatcher.IsDispatchRequired)
 			{
-				dispatcher.Dispatch(SyncModalStackFromPlatformRequest);
+				dispatcher.Dispatch(() => SyncModalStackFromPlatformRequest(generation));
 				return;
 			}
 
-			SyncModalStackFromPlatformRequest();
+			SyncModalStackFromPlatformRequest(generation);
+		}
+
+		// Window.Dispatcher is public, non-null and independent of the window handler, so the any-thread
+		// guarantee still holds during handler teardown — at which point the handler's MauiContext, and
+		// the IDispatcher registered in its scope, are already gone.
+		IDispatcher? TryGetWindowDispatcher()
+		{
+			try
+			{
+				return _window.Dispatcher;
+			}
+			catch (InvalidOperationException)
+			{
+				// The window was created on a thread without a dispatcher and there is no application
+				// dispatcher to fall back to. Run inline rather than dropping the request.
+				return null;
+			}
 		}
 
-		// Named wrapper so the fire-and-forget logging reports a stable, meaningful caller.
-		void SyncModalStackFromPlatformRequest() => SyncModalStackWhenPlatformIsReady();
+		void SyncModalStackFromPlatformRequest(int generation)
+		{
+			// Drop callbacks that were queued before the window was destroyed, or before its handler was
+			// replaced. Running them would repopulate modal state on a torn-down window, or drive
+			// presentation through resources belonging to a scope that no longer exists.
+			if (_destroyed || generation != _scopeGeneration)
+				return;
+
+			SyncModalStackWhenPlatformIsReady();
+		}
 
 		void OnWindowHandlerChanging(object? sender, HandlerChangingEventArgs e)
 		{
@@ -211,18 +272,29 @@ void OnWindowHandlerChanging(object? sender, HandlerChangingEventArgs e)
 
 				// The override was created against the old handler's service scope and most likely holds
 				// platform views owned by it, so drop it.
-				DisposePlatformOverride(allowRecreate: false);
+				DisposePlatformOverride();
 			}
 
-			// Attaching a new handler brings a new service scope, so a fresh override may be resolved
-			// from it. This is the only path that lifts the terminal state left behind by teardown.
-			if (e.NewHandler is not null)
-			{
-				_platformOverride = null;
-				_platformOverrideResolved = false;
-			}
+			// _window.Handler is still the OUTGOING handler at this point, so resolution stays blocked
+			// until OnWindowHandlerChanged confirms the new one is installed. Without this a reentrant
+			// sync could latch an override built from the scope that is going away.
+			InvalidateWindowScope();
 		}
 
+		void OnWindowHandlerChanged(object? sender, EventArgs e)
+		{
+			_scopeGeneration++;
+
+			if (_window.Handler is null)
+				return;
+
+			// A new handler brings a new service scope. This is the only path that lifts the blocked
+			// state set by OnWindowHandlerChanging, and the terminal state set by teardown.
+			_destroyed = false;
+			_platformOverride = null;
+			_platformOverrideResolved = false;
+			_pageAttachedNotifiedForHandler = null;
+		}
 		public Task<Page?> PopModalAsync()
 		{
 			return PopModalAsync(true);
@@ -392,9 +464,13 @@ async Task SyncPlatformModalStackAsync()
 						animated = pendingAnimated;
 					}
 
-					_pendingPopAnimations.Remove(platformModal);
+					// Record the intent for the duration of the attempt. It is only cleared once the
+					// dismissal actually succeeds, so a failed pop that gets retried by a later pass still
+					// animates the way the caller asked.
+					_pendingPopAnimations[platformModal] = animated;
 
 					var page = await PopModalPlatformAsync(animated);
+					_pendingPopAnimations.Remove(page);
 					page.Parent?.RemoveLogicalChild(page);
 					syncAgain = true;
 				}
@@ -474,17 +550,19 @@ async Task SyncPlatformModalStackAsync()
 			bool isPlatformReady = IsModalReady;
 			bool applyNow = isPlatformReady && !syncing;
 
-			if (!applyNow)
-			{
-				// The request has already been taken off the logical stack above, so reconciliation would
-				// have no way to recover how the caller wanted this dismissal animated. Remember it until
-				// the platform actually dismisses the modal.
-				_pendingPopAnimations[modal] = animated;
-			}
+			// The request has already been taken off the logical stack above, so reconciliation would
+			// otherwise have no way to recover how the caller wanted this dismissal animated. Record it
+			// unconditionally and only clear it once the platform has actually dismissed the modal, so
+			// both a deferred pop and a retry after a failed pop keep the caller's intent.
+			_pendingPopAnimations[modal] = animated;
 
 			Task popTask = applyNow ? PopModalPlatformAsync(animated) : Task.CompletedTask;
 
 			await popTask;
+
+			if (applyNow)
+				_pendingPopAnimations.Remove(modal);
+
 			modal.Parent?.RemoveLogicalChild(modal);
 			_window.OnModalPopped(modal);
 
@@ -602,20 +680,7 @@ void OnCurrentPageHandlerChanged(object? sender, EventArgs e)
 
 		partial void OnPageAttachedHandler();
 
-		public void PageAttachedHandler()
-		{
-			// Resolving may create the override, and creation delivers PageAttached itself. NotifyPageAttached
-			// is idempotent per page handler, so calling it again here is a no-op in that case.
-			var platformOverride = PlatformOverride;
-
-			if (platformOverride is not null)
-			{
-				NotifyPageAttached(platformOverride);
-				return;
-			}
-
-			OnPageAttachedHandler();
-		}
+		public void PageAttachedHandler() => DeliverPageAttached();
 
 		void ClearModalPages(bool xplat = false, bool platform = false)
 		{