[kubaflo]

Note

Are you waiting for the changes in this PR to be merged?
It would be very helpful if you could test the resulting artifacts from this PR and let us know in a comment if this change resolves your issue. Thank you!

Description of Change

Forward-ports #35068 from inflight/current to net11.0. During MauiApp initialization, DI-registered Essentials implementations become the backing implementations for their existing static facades. No public API is added.

Core behavior

• Bridges registered Essentials services to their existing Default/Current/SetDefault facades while preserving lazy platform defaults for unregistered services.
• Tracks predecessor values and active-owner edges in synchronized per-facade assignment graphs. Overlapping MauiApp lifetimes can dispose in any order without restoring disposed services, clobbering newer apps, or losing external replacements.
• Keeps ConfigureEssentials delegates, DI factory execution, and facade reads outside a process-global lock; each facade graph is serialized by its own FacadeBridgeState<T>.SyncRoot, while map-token state and per-app cleanup use dedicated locks.
• Makes MauiApp explicitly own cleanup before configuration/provider disposal, including custom non-disposable providers and partially initialized apps.
• Makes app disposal an atomic one-shot operation across repeated, mixed, concurrent, and reentrant Dispose() / DisposeAsync() calls. Concurrent callers wait for the winning teardown and observe the same exception; reentrant calls in the active logical flow return without self-deadlocking.
• Appends complete cleanup batches across repeated public InitializeAppServices() calls, including every repeated AppActions event subscription.
• Runs every cleanup best-effort and preserves simultaneous initialization, unsubscription, facade-restoration, configuration-disposal, and provider-disposal failures.
• Disposes async-only providers from a context-free ThreadPool hop so synchronous app disposal does not capture the caller's synchronization context. Providers that explicitly require the caller/UI thread during disposal must use MauiApp.DisposeAsync().
• Uses non-initializing backing-field access during cleanup so disposal never creates a lazy platform default.

VersionTracking ownership

• Wraps lazy VersionTracking.Default creation when DI supplies Preferences or AppInfo, reusing the exact resolved instances while their facade owners remain active and deferring unregistered fallbacks.
• Stores DI-backed Preferences and AppInfo dependencies through weak, owner-aware sources. After an owner is removed, dependency resolution falls back to the surviving static facade instead of dereferencing a disposed service.
• Refreshes the inner VersionTrackingImplementation when a fallback facade identity or active owner changes, preventing overlapping apps from retaining another app's disposed services.
• Proactively invalidates every active lazy VersionTracking state when a Preferences or AppInfo owner is removed, releasing stale DI dependencies immediately rather than waiting for the next VersionTracking access.
• When multiple apps call UseVersionTracking(), later apps take successor ownership of an already initialized app-owned default. Disposing an earlier app therefore cannot clear the facade while a later app is still alive.
• Direct DI-registered IVersionTracking implementations remain owned exclusively by the app/provider that resolved them. A later UseVersionTracking() app does not shadow-own that service, preventing the static facade from retaining it after the original provider disposes it.
• Facade assignments explicitly mark whether ownership can be shared: framework-created defaults and owner-aware lazy wrappers can transfer across overlapping app lifetimes; direct DI assignments cannot.
• Pre-existing unowned/external VersionTracking.Default instances remain outside app cleanup.

Platform and lifecycle behavior

• Bridges IPermissions. Android IActivityStateManager intentionally remains DI-only because its lifecycle callback registration has no teardown contract.
• Preserves native callback contracts for IAppActions and IWebAuthenticator; incompatible registrations are skipped with a warning.
• Starts configured AppActions setup without blocking synchronous MauiApp.Build(), allowing custom implementations to await native dispatchers while setup failures are observed and logged.
• For Windows and Tizen, forwards configured map tokens to IPlatformGeocoding.
• Tracks per-geocoder token ownership separately from the Windows process-global MapService.ServiceToken chain.
• Represents Windows process-global predecessors by assignment identity. When an older applied owner is disposed before newer registrations have reached the native token, direct successors are reparented in registration order and the native token advances to the latest surviving assignment.
• When a newer Windows token owner disposes while an older active assignment has not yet pushed its token natively, restores that latest still-active older assignment before falling back to the captured pre-app token.
• Restores geocoder and Windows process-global tokens independently during cleanup. If either restore fails, the other is still attempted; one failure is rethrown and multiple failures are aggregated in order.
• Rolls back a just-added token assignment when a custom geocoder rejects the configured token during startup.
• Uses global::Windows.Services.Maps to avoid WinAppSDK namespace shadowing and an internal accessor so tests never assign fake credentials to the native Bing Maps property.

Test infrastructure hardening

• Static-state unit/device collections do not run in parallel.
• The default UseEssentials() plus explicit ConfigureEssentials() path resolves exactly one EssentialsCleanup service, proving TryAddEnumerable deduplication.
• Dispatcher tests cache providers per live Thread through weak keys.
• Concurrent app-build coverage uses dedicated threads and bounded barriers.
• The AppActions non-blocking build regression uses a shared 10-second timeout so contended CI does not create a false failure.

What not to do

• Do not bridge Android IActivityStateManager to its static facade without first adding a real lifecycle unregistration contract.
• Do not synchronously block or pump MauiApp.Build() waiting for AppActions setup; custom implementations may need the native UI dispatcher.
• Do not retain strong DI dependencies inside the process-global lazy VersionTracking wrapper after their app owner is removed.
• Do not defer stale VersionTracking cleanup until the next access; invalidation must release disposed dependencies immediately.
• Do not transfer facade ownership for a direct DI IVersionTracking implementation to another app; its lifetime belongs to the original service provider.
• Do not infer Windows process-global map-token predecessor ownership from token text alone; duplicate/unapplied values require explicit assignment ownership.
• Do not assign fake strings directly to Windows.Services.Maps.MapService.ServiceToken; the native setter validates real Bing Maps keys. Use the internal accessor in tests.
• Do not replace the atomic disposal gate with a plain boolean; disposal can be concurrent or reentrant.
• Do not hold a process-global bridge lock across ConfigureEssentials delegates, DI factories, or facade reads; use the per-facade ownership lock for each static mutation.
• Do not use public lazy Default/Current getters to capture prior facade state because that initializes unregistered platform defaults. A future accessor migration must be complete across every bridged facade.

Issues Fixed

Fixes #34100
Part of #34099

Validation

Updated-head focused validation (26d7b935)

• 165/165 focused Core Hosting tests pass, including concurrent sync/async disposal completion and exception propagation, cross-thread reentrant cleanup, concurrent Essentials delegates, and nested reentrant app builds.
• The update commit has tested head 29f3a313 plus net11.0 cbb408ff as parents; the updated-head Hosting suite still passes 165/165.
• 15/15 MainThreadBridgeTests pass in final improved review.
• An independent final code review found no significant correctness issue; all GitHub review threads are resolved and current-head improved review/CI are retriggered.
• Windows Core.DeviceTests-packaged and Core.DeviceTests-unpackaged pass. NewerMapServiceTokenCleanupRestoresOlderUnpushedPlatformToken is present in packaged testResults.xml with result="Pass".

Final sequential platform reviews

• Android 14771088: 0 errors; prior disposal and map-token findings resolved. NEEDS_DISCUSSION was only the CI confidence cap.
• iOS 14771292: 0 errors and zero threads; one non-blocking maintenance-coupling warning, with no complete replacement superior to the tested PR.
• Mac Catalyst 14771461: 0 errors / 0 warnings / 0 suggestions; expert findings [].
• Windows 14771636: 0 errors / 0 warnings / 0 suggestions; deep UI 1/1 passed.

Prior-head required CI reconciliation

• Main 1527086: 24/26; only independently reproduced Debug/Release .buildtasks file locks.
• Device 1527087: six exact-base Controls/HybridWebView failures. Windows Core work items and the new map-token regression pass.
• UI 1527088: 93/99; all six failures are exact-base Picker/Material3/Shell/CollectionView/CV1 failures or unrelated drag/drop instability.
• No further rerun adds signal. The red required contexts need maintainer policy bypass after human approval.

Current-head concurrency fix (81f1066d8c)

• TrackInitializedOrOwned now verifies the facade still references the implementation under its per-type lock and derives ownership from that implementation, preventing a concurrent app from adopting another apps exclusive IVersionTracking.
• User-implementable IPlatformGeocoding.MapServiceToken access runs outside the process-static bookkeeping lock; assignment graph mutation and Windows platform-token owner rebasing remain serialized and rollback-safe.
• Added deterministic regressions for exclusive VersionTracking adoption and a map-token setter waiting on a concurrent app build. The portable Hosting suite passes 166/166; Windows-specific execution is covered by replacement device CI.
• Full current-head CI builds 1530642 / 1530643 / 1530644 and improved review are active; all review threads are resolved and auto-merge remains armed.

Current-head lifecycle fix (c6b28946b4)

• MauiApp.InitializeAppServices() now participates in the app disposal lifecycle: new calls are rejected after disposal begins, disposal waits for already-running initialization, and disposal from the active initialization flow fails fast instead of self-deadlocking.
• EssentialsCleanup synchronizes facade-cleanup and AppActions subscription registration and refuses registration after cleanup.
• Non-reentrant Dispose/DisposeAsync calls made after a failed teardown now rethrow the recorded exception instead of missing the completion window.
• Five deterministic lifecycle/exception regressions were added; the complete Hosting suite passes 171/171. Full current-head CI builds 1530730 / 1530731 / 1530732 and improved review are active; auto-merge remains armed.

Windows device-test correction (f0718f4e24)

• The map-token concurrency regression now builds no-default MauiApp instances and explicitly registers Essentials, isolating the intended lock behavior from the Windows MauiCoreInitializer UI-dispatcher requirement on Task.Run.
• The prior Windows device failure occurred before either custom map-token setter ran; all adjacent map-token cleanup/restoration tests passed. Production behavior is unchanged by this follow-up.
• Full replacement CI builds 1530799 / 1530800 / 1530801 and improved review are active; auto-merge remains armed.

Final static-state hardening (98909ead59)

• Shared map-token implementations now use versioned desired-state reconciliation with state rooting across getter, rollback, removal, and cleanup; concurrent stale writers loop to the latest assignment/base token.
• A deterministic same-instance concurrent-disposal regression verifies original-token restoration and assignment/state eviction.
• VersionTracking.Default and SetDefault now share an initialization lock, with a 12-thread identity regression preventing concurrent lazy instances from clobbering a DI bridge.
• The expanded Hosting suite passes 172/172. Final CI builds 1530938 / 1530941 / 1530942 and improved review are active; all review threads are resolved and auto-merge remains armed.

VersionTracking publication hardening (3f2c472e61)

• Lazy initialization and SetDefault now pair the existing Volatile.Read fast paths with Volatile.Write, safely publishing fully initialized VersionTracking implementations to concurrent readers.
• The concurrency regression executed successfully in current-head main CI.

Child-flow initialization scope fix (9564e650b6)

• Replaces the mutable AsyncLocal depth object with per-entry linked scope frames, preventing a Task.Run child initialization from mutating the parent flow's disposal guard.
• Disposal scans inherited scope ancestors so it still rejects a child-flow dispose while any captured parent initialization remains active, but waits normally after the parent scope has exited.
• The exact regression failed before the fix and passes afterward; both child-flow lifecycle regressions pass, along with all 174 Hosting-category tests.
• Current-head improved review and full replacement CI are active; all review threads remain resolved and auto-merge remains armed.

Windows geocoding cleanup correction (994581549c)

• RestoreGeocoding now restores the private static backing field directly instead of building and disposing a temporary MauiApp that could restore the leaked predecessor again.
• A Windows device regression seeds a leaked geocoder and verifies cleanup restores the original facade.
• The Windows device project is locally blocked by unavailable WinUI references on macOS; current-head Windows device CI is the execution authority for this conditional test.

Bridged facade publication hardening (23a2d386d7d)

• Replaces unsynchronized lazy ??= publication and plain setters across every DI-bridged Essentials static facade with one shared per-interface synchronization helper. Initialized reads retain a Volatile.Read fast path; first construction and all setter writes serialize on the same lock.
• Holds that facade lock together with FacadeBridgeState<T>.SyncRoot across predecessor capture, DI installation, current-owner verification, and cleanup restoration. A concurrent fallback can no longer clobber DI, and cleanup cannot restore a stale predecessor over an external replacement.
• Migrates VersionTracking to the same helper so its bridge lock now protects the actual backing field rather than a separate synchronization domain. Factory construction is non-speculative and preserves a value installed reentrantly during construction.
• Adds deterministic Preferences regressions for both the direct setter lost-write and the bridge predecessor race. The direct regression fails with the original unsafe ??= pattern; the bridge regression rejects the speculative CAS design that could capture a stale predecessor.
• A full constructor/lock-order audit found no current cycle, including Windows AppInfo and DeviceDisplay dependencies on WindowStateManager; the helper documents that constructor-time facade dependencies must remain acyclic. Independent MAUI expert and adversarial reviews found no blocking issue.
• Final local validation: Hosting 176/176, Essentials 464/464, and all locally available Essentials TFMs build with 0 warnings and 0 errors. Full current-head CI builds 1532455 / 1532456 / 1532457 and improved review are active; auto-merge is armed with the required merge-commit method.

Windows WebAuthenticator lifecycle guard (98ed841d415)

• Extends the native IWebAuthenticator lifecycle-contract guard to Windows. Platform.OnAppInstanceActivated calls WebAuthenticator.Default.OnAppInstanceActivated, which casts through AsPlatformCallback; a DI implementation without IPlatformWebAuthenticatorCallback must therefore not replace the static default.
• Adds a Windows device regression proving incompatible implementations are skipped, callback-capable implementations are bridged, and disposal restores the original facade.
• Portable validation remains green: Hosting 176/176, Essentials 464/464, and all locally available Essentials TFMs build with zero warnings and errors. The Windows device project cannot build on this macOS host because WinUI/Win2D references are unavailable, so fresh Windows CI is the execution authority for the conditional regression.
• Current-head main CI 1532636 succeeded. Device CI 1532638 executed WebAuthenticatorBridgeRequiresWindowsLifecycleContract successfully in packaged and unpackaged Core work items; all Windows Core, Essentials, Graphics, and MauiBlazorWebView work items passed. Remaining device reds are baseline Controls failures plus an isolated Mac tooltip sibling-pass. UI 1532637 is fully classified: persistent failures are exact-base Controls failures, and the final WinUI shard failed Appium fixture reset before test bodies ran. Android review 14813672 is code-clean; Windows review 14814569 remains active. Auto-merge remains armed with the merge-commit method.

Async disposal responsiveness (cc1107edfab)

• Keeps synchronous Dispose() semantics unchanged, but prevents the winning DisposeAsync() caller from blocking synchronously in Monitor.Wait while app-service initialization is in flight. DisposeAsync() now returns an incomplete operation and awaits initialization from a context-free worker before cleanup/provider disposal.
• Preserves the one-shot disposal gate, reentrant initialization rejection, loser completion/exception propagation, and cleanup ordering.
• Adds regressions proving DisposeAsync() returns promptly while initialization remains blocked and that reentrant async disposal from InitializeAppServices() throws instead of deadlocking. The responsiveness regression fails against the prior implementation and passes with the fix.
• Final local validation: targeted async/sync lifecycle slice 4/4, Hosting 178/178, Essentials 464/464, and all locally available Essentials TFMs build with zero warnings and errors. Independent adversarial review found no blocking issue across wakeup races, sync/async winner/loser interleavings, reentrancy, and completion publication.
• Exact improved review and full current-head CI builds 1532809 / 1532810 / 1532811 were triggered; auto-merge remains armed with the merge-commit method.

Map-token recipient ownership (3c0b84c7b00)

• Removes the post-bridge Geocoding.Default read that allowed a concurrent MauiApp.Build() to redirect this app map token to another app geocoder. Windows/Tizen now pre-resolve the DI geocoder and apply explicit tokens only to the geocoder owned by this initialization.
• Captures fallback geocoding under the facade ownership/implementation locks only when needed. Inherited tokens are accepted only from direct, unowned fallback implementations; map-token epoch/state and facade ownership checks prevent adopting another app active or bridged token.
• Preserves the previous null-token behavior: UseMapServiceToken(null!) remains equivalent to no configured token.
• Adds a deterministic Windows concurrency regression that pauses app A after its geocoder bridge, lets app B replace the process-global facade, and proves app A token still applies to app A while app B remains untouched.
• Portable validation remains green: Hosting 178/178, Essentials 464/464, and all locally available Essentials TFMs build with zero warnings and errors. Independent adversarial review found no blocking ownership, epoch, lock-order, cleanup, or test issue.
• Pending base-token capture now uses Monitor.Wait/PulseAll on the existing token lock instead of busy-spinning if a user geocoder getter stalls. Exact improved review and full current-head CI builds 1533049 / 1533050 / 1533051 were triggered; auto-merge remains armed with the merge-commit method.

MainThread facade synchronization (74503fab322)

• Routes direct custom MainThread replacements through the same per-type synchronization used by DI bridge capture and cleanup, preventing a disposal-time predecessor restore from clobbering a concurrent external setter.
• Adds a deterministic regression that fails against the prior volatile-only setter and passes with the synchronized setter; the full MainThread bridge slice passes 16/16.
• Exact improved review and full current-head CI builds 1533086 / 1533087 / 1533088 were triggered; auto-merge remains armed with the merge-commit method.

Windows device analyzer compatibility (0cc58f52337)

• Fixes the PR-specific xUnit2031 build failure from device CI 1533088 by using Assert.Single(collection, predicate) in the new Windows map-token concurrency helper. The diagnostic points directly to this PR-added test; the prior head’s Windows leg had succeeded, while the current merge build surfaced the analyzer failure.
• Local Windows publish cannot run on this macOS host because the Win ARM64 runtime pack is unavailable. Fresh current-head CI builds 1533131 / 1533132 / 1533133 and exact improved review 14817673 are active; the Windows device build is the authoritative validation. Auto-merge remains armed with the merge-commit method.

Current-head CI and Android review (0cc58f52337)

• Windows device build and execution are validated in CI 1533133: packaged and unpackaged Core.DeviceTests passed with 0 failures. ConcurrentBuildAppliesMapServiceTokenToOwningGeocoder, NullMapServiceTokenBehavesAsUnconfigured, and WebAuthenticatorBridgeRequiresWindowsLifecycleContract each passed in both modes. All Essentials, Graphics, and MauiBlazorWebView Windows work items also passed.
• Device failures are unrelated Controls-only baseline failures: the same six InvokeJavaScriptMethodThatThrows* message expectations fail on iOS CoreCLR/Mono, MacCatalyst, and Windows. Main 1533131 failed after execution in the Azure PublishTestResults Node task (libuv assertion, exit 57005); UI 1533132 includes a checkout DNS/RPC reset. UI replacement is 1533240; main replacement 1533241 hit a cross-PR transient .buildtasks staging failure, so main was rerun as 1533276. Device is not being rerun.
• Android improved review 14817673 found no actionable code findings and selected the reviewed PR as the best candidate. Its gate was inconclusive only because XHarness reported APP_CRASH; the with-fix unit slices passed. Windows review 14818091 materialized an unrelated CI-script diff and was discarded; a direct Windows review of the actual PR head identified the rollback race fixed below. Auto-merge remains armed with the merge-commit method.

Failed map-token apply rollback (35eb31006dc)

• Fixes a Windows ownership hole when a successor geocoder publishes its global token, blocks, and then throws after the predecessor app disposes and rebases the owner graph. The old failed-apply rollback removed the successor assignment but could leave its process-global token orphaned.
• Failed-apply rollback now removes/rebases the assignment and restores the guarded Windows token atomically under s_mapTokenLock, using the same restoration helper as normal cleanup. Platform-restore and instance-reconcile failures are preserved alongside the original apply exception.
• Adds a deterministic Windows regression for the predecessor-dispose/failing-successor interleaving. Portable Hosting validation passes 179/179; Windows CI is the execution authority for the conditional regression.
• Exact improved review 14819460 and full current-head CI builds 1533460 / 1533461 / 1533462 are active. Auto-merge remains armed with the merge-commit method.

Dispatcher test-provider null-cache hardening (4df7a324e37)

• Makes SkipDispatcherCreation a transient test option: while set, the provider returns null without publishing a null holder for the pooled thread. Once reset, the same thread can create and cache its dispatcher normally.
• Strengthens the existing pooled-thread regression; it fails against the old null-caching behavior and the full Dispatcher slice passes 9/9.
• Exact current-head improved review 14820481 and CI builds 1533544 / 1533546 / 1533548 are active; prior-head reviews were canceled after the documentation-only follow-up. Auto-merge remains armed with the merge-commit method.

Initialization and provider-teardown lifetime fixes (65f01d6a6cf)

• Failed repeated InitializeAppServices() calls now rollback only their local pre/post cleanup batch, leaving prior successful registrations intact and allowing later retries.
• AppActions unsubscription and map-token cleanup run before provider disposal; DI-backed static facades remain available to provider-owned services during Dispose/DisposeAsync and restore through a separate post-provider phase afterward.
• Failed synchronous Build() disposes async-only providers from a context-free ThreadPool hop and waits for provider disposal plus post-provider cleanup before rethrowing, so no bridged facade remains published after failure returns.
• Deterministic regressions cover retry after failed repeated initialization, sync/async facade use during provider teardown, post-provider cleanup ordering, and failed-build rollback visibility.
• Exact improved review 14823516 and current-head CI builds 1533747 / 1533748 / 1533749 are active. Auto-merge remains armed with the merge-commit method.

VersionTracking package isolation (28b6707ce2d)

• Makes the VersionTracking preferences shared name instance-owned from the injected IAppInfo.PackageName, preventing overlapping apps from storing history under the first app package namespace.
• Adds a deterministic two-app regression using one preferences store and distinct package IDs; it fails against the former static namespace and passes with the fix.
• Full Hosting validation passes 185/185. Exact improved review is active; fresh CI will validate the new head. Auto-merge remains armed with the merge-commit method.

App-owned SecureStorage and MediaPicker namespaces (b972b8685c6)

• SecureStorage aliases are instance-owned instead of process-static. An app that bridges IAppInfo but not ISecureStorage gets a lazy app-owned SecureStorage facade keyed to its package; overlapping apps remain isolated and fallback state restores correctly. A registered custom ISecureStorage remains authoritative.
• Android MediaPicker recovery uses the immutable Android application package for its durable preferences namespace, so bridged IAppInfo changes cannot redirect an in-flight recovery operation.
• Deterministic regressions cover preinitialized/overlapping SecureStorage facades and changing MediaPicker package identities. The SecureStorage regression fails against the prior bridge and passes with the fix.
• Validation: Hosting 186/186, Essentials 464/464, all locally available Essentials TFMs build with zero warnings/errors, Android device build succeeds, and the new MediaPicker plus updated SecureStorage tests pass. Exact improved review and fresh current-head CI are active; auto-merge remains armed with the merge-commit method.

SecureStorage lifecycle hardening (057d6675d72)

• Preserves Apple DefaultAccessible across app-owned facade replacement without eagerly constructing the inner implementation or invoking user code under facade locks.
• Makes unpackaged Windows SecureStorage state process-shared and synchronized so restored/overlapping facade instances cannot overwrite secrets from stale snapshots; the existing file format and location remain unchanged.
• Confirms a registered custom ISecureStorage remains authoritative when IAppInfo is also registered, and tests the alias actually used by the materialized implementation.
• Serializes Android MediaPicker recovery tests that mutate AppInfo.Current, eliminating cross-collection static-state races.
• Migration contract: SecureStorage namespace follows the bridged IAppInfo.PackageName. Apps changing that value must migrate existing secrets or register their own ISecureStorage; prior records are not automatically copied between package namespaces.
• Validation: Hosting 187/187, Essentials 464/464, all local Essentials TFMs build with zero warnings/errors, and the Android device test project builds successfully. Exact improved review and fresh CI are active; auto-merge remains armed with the merge-commit method.

SecureStorage concurrency and retry hardening (7a64a6f82b7)

• Resolves bridged IAppInfo.PackageName before entering process-static facade locks, preserving the no-user-code-under-global-lock invariant.
• Materializes Apple SecureStorage under the accessibility lock, eliminating the Lazy<T>.IsValueCreated publication window and preserving updates on the actual inner implementation.
• Loads unpackaged Windows shared state lazily under its process lock; transient path/open failures leave the state uninitialized so later SecureStorage calls can retry instead of hitting a cached TypeInitializationException.
• Adds Apple device regressions for implementation/wrapper predecessor carry-forward and post-materialization updates, plus Windows device coverage proving unpackaged instances share current state.
• Validation: Hosting 187/187, Essentials 464/464, all local Essentials TFMs build clean, and Android/iOS/MacCatalyst Essentials device-test projects build successfully. Exact improved review and fresh CI are active; auto-merge remains armed with the merge-commit method.

Windows SecureStorage path binding (a67b721269a)

• Binds the process-shared unpackaged SecureStorage snapshot to the exact app-data path from which it was loaded. A bridged IFileSystem path change now loads that location before any write instead of serializing a snapshot from another path over it.
• Failed path loads leave the existing cached path and state unchanged, with the requested path retryable on the next call.
• Adds a Windows device regression that switches between two app-data roots and verifies independent persisted state; SecureStorage device tests now use the globally non-parallel Essentials static-state collection.
• All locally available Essentials TFMs continue to build with zero warnings and errors. Exact improved review and fresh CI are active; auto-merge remains armed with the merge-commit method.

Stable Android MediaPicker recovery namespace (05ba44d990f)

• Uses Application.Context.PackageName for the durable MediaPicker recovery store. AndroidX callbacks and recovery or clear paths therefore remain on one namespace even if another MauiApp temporarily bridges a different IAppInfo.
• Updates the Android regression to change AppInfo.Current twice and assert the store namespace remains the immutable Android application package.
• All local Essentials TFMs and the Android device project build clean; the new namespace test and full MediaPicker recovery collection pass at runtime. Exact improved review and fresh CI are active; auto-merge remains armed with the merge-commit method.

Final async ownership hardening (9fad299a58f)

• Replaces the disposal AsyncLocal<bool> with a shared mutable scope frame. Reentrant child flows still avoid self-deadlock while teardown is active, but child flows that outlive teardown now observe completion and replay the recorded exception.
• Serializes configured AppActions publication through an app-owned assignment queue. Superseded or disposed writes are skipped, and removing a newer owner reapplies the surviving predecessor so completion order cannot publish stale global shortcuts.
• Stores Android MediaPicker recovery records directly in native app-private SharedPreferences instead of the bridged IPreferences facade, preserving process-death recovery across custom/in-memory preference registrations and overlapping app lifetimes.
• Captures the unpackaged Windows SecureStorage write path before DPAPI encryption awaits, preventing a concurrent IFileSystem bridge from redirecting ciphertext to another app-data directory.
• Keeps Apple accessibility carry-forward limited to framework-owned predecessors because wrapper construction holds the SecureStorage facade locks; arbitrary custom platform getters are not invoked under those locks. Explicitly registered ISecureStorage implementations remain authoritative.
• Retains the explicit SecureStorage migration contract. Automatic native-alias fallback was rejected because it exposes records across intentionally distinct namespaces and its mutation cleanup deletes newly written values on unpackaged Windows, where aliases share the physical store.
• Validation: hosting suites 93/93; Essentials unit tests 464/464; Android, iOS, and MacCatalyst Essentials device projects build; Windows Essentials C# builds with zero warnings/errors; the new Android durable-recovery regression passes on-device. The local Android runner still executes four unrelated Launcher mailto: failures despite the MediaPicker category filter.

AppInfo / VersionTracking reentrancy ownership (37c4516b8a2)

• Installs the owner-aware lazy VersionTracking facade before invoking the DI-provided IAppInfo.PackageName getter for AppInfo-owned SecureStorage.
• Prevents a reentrant PackageName getter from materializing an unowned VersionTrackingImplementation that captures app-owned Preferences / AppInfo and could be restored after those services are disposed.
• Returns the explicitly resolved ISecureStorage from the bridge so a registered custom implementation still wins exactly; AppInfo-owned fallback is created only when no DI ISecureStorage exists.
• Adds AppInfoPackageNameReentrancyUsesOwnedVersionTrackingFacade. A surgical verification that reverts only this production ordering delta makes the test fail by observing a stale VersionTrackingImplementation; restoring the fix passes.
• Validation: Core netstandard2.0 Release builds with zero warnings/errors; full hosting suites pass 94/94; focused red/green verification passes.

Custom Apple SecureStorage accessibility inheritance (1045188fcd0)

• Preserves IPlatformSecureStorage.DefaultAccessible when an AppInfo-owned wrapper replaces an unowned custom Apple SecureStorage predecessor.
• Captures predecessor identity under framework ownership/facade locks, invokes the custom accessibility getter only after releasing those locks, and revalidates identity plus unowned status inside TrackAndSet before applying the captured value.
• Keeps direct DI ISecureStorage precedence unchanged and retains framework-owned predecessor inheritance in AppInfoSecureStorage.
• Adds AppInfo_Bridge_Inherits_Custom_Platform_Default_Accessible_Outside_Facade_Lock, which asserts both the inherited WhenUnlockedThisDeviceOnly value and that app code is not invoked under the SecureStorage facade lock.
• Validation: clean iOS run executes the regression and passes 245/245; surgically reverting only the production accessibility delta makes exactly this test fail with AfterFirstUnlock; shared netstandard2.0 and hosting 94/94 remain green.

AppInfo / SecureStorage stale-owner handoff gate (bdc0f26e054)

• Adds a dedicated narrow handoff gate around the dependent AppInfo-derived SecureStorage publication.
• Captures the exact FacadeAssignment<IAppInfo> owner while publishing DI AppInfo, resolves user PackageName outside all facade locks, then revalidates that the same owner is still current before publishing SecureStorage.
• Prevents an older app blocked in PackageName from overwriting a newer app’s SecureStorage namespace after the newer app wins AppInfo ownership.
• Preserves the previously added SecureStorage predecessor ownership and Apple accessibility capture/revalidation logic.
• Adds ConcurrentAppInfoPackageNameCannotStalePublishSecureStorage; surgical verification fails without the gate and passes with it. Core netstandard2.0 and full hosting 96/96 remain green.

Final AppInfo/SecureStorage ownership reconciliation (28619959685)

• Unifies immediate and deferred AppInfo-derived SecureStorage publication through one owner-validated installation path. If IAppInfo.PackageName yields while another app or direct facade writer wins, the original app keeps a lifetime-scoped pending installation instead of permanently skipping its namespace.
• Captures and revalidates the exact SecureStorage predecessor before publishing AppInfo, keeps app-provided PackageName and custom Apple accessibility getters outside process/facade locks, and serializes the no-user-code paired publication against direct setters.
• Preserves newer bridge-owned and unowned SecureStorage replacements. AppInfo and SecureStorage cleanup retry only eligible pending work, while out-of-order disposal rebases pending predecessor ownership.
• Releases disposed predecessor assignments after rebasing or successful installation, preventing a live successor app from rooting a disposed provider-owned SecureStorage service.
• Carries the unowned Apple platform predecessor's DefaultAccessible through intermediate wrapper disposal, preserving keychain accessibility during deferred reconciliation.
• Adds deterministic coverage for both app-disposal orders, immediate/deferred direct writers, newer secure-only apps, nested predecessor disposal, GC release, and Apple accessibility inheritance.
• Final local validation: Core Hosting 182/182, Essentials 464/464, Core netstandard2.0 clean, Android and MacCatalyst builds clean, and final iOS device XML reports 249 total / 248 passed / 0 failed / 1 skipped. Current-head improved review and maui-pr CI are active; merge-commit auto-merge remains armed.

SecureStorage and AppActions lifecycle completion (ffbe5cd36e6)

• Windows unpackaged SecureStorage now captures one immutable owning app-data path and uses it for reads, writes, removes, and clear operations. App-owned IFileSystem participates in derived SecureStorage ownership only when the backend is actually file-backed; packaged Windows remains alias/container-based and is not affected by FileSystem-only registrations.
• AppInfo/FileSystem dependency assignments and the SecureStorage predecessor are established and validated together. The app-data path is captured before potentially reentrant IAppInfo.PackageName, then carried through lazy/deferred wrapper creation.
• AppActions setup remains non-blocking but is no longer globally wedged by a hung custom SetAsync: removed queued assignments abort promptly, each assignment is single-flight, and stale late completion records exactly one replay request for the surviving current assignment.
• Adds deterministic AppActions regressions for hung disposal, queued removal, and in-flight replay ordering, plus Windows device coverage for immutable path ownership, FileSystem-only packaged/unpackaged behavior, and PackageName reentrancy.
• Final local validation: Core Hosting 184/184, AppActions 8/8, Essentials 464/464, Core/Essentials netstandard2.0 clean, Windows Essentials C# build clean, and iOS/MacCatalyst/Android Essentials+Core builds clean. Current-head Android improved review 14844761 and maui-pr build 1536225 are active; merge-commit auto-merge remains armed.

Strict AppActions publication and Windows storage migration (aa32792df60)

• AppActions now uses one coalescing process-global worker. It strictly waits for each physical native SetAsync to complete before starting the latest surviving pending assignment, preventing overlapping OS-global shortcut writes while retaining only the unavoidable in-flight assignment plus one pending owner.
• Worker exit is exception-safe and restarts if work arrives during shutdown. Failure-logging exceptions are surfaced through Trace without wedging future assignments; disposed queued implementations can be collected behind a hung predecessor.
• AppInfo-derived unpackaged Windows SecureStorage uses Settings/<SHA256(alias)>/securestorage.dat, isolating distinct package identities that share one app-data root. Default/unbridged construction keeps the historical Settings/securestorage.dat path.
• On first alias-scoped access, existing legacy data is copied forward atomically using a unique temporary file and same-volume replace, while the legacy file remains intact for default callers.
• Adds deterministic no-overlap, GC-retention, throwing-logger, alias-isolation, historical-path, and migration regressions.
• Final local validation: Core Hosting 185/185, AppActions 9/9, Essentials 464/464, Core/Essentials netstandard2.0 clean, Windows Essentials C# build clean, and iOS/MacCatalyst/Android Essentials+Core builds clean. Current-head Android review 14845391 and maui-pr build 1536315 are active.

Current-base integration and Passkeys coverage (fb98862d5c5, 2297fca0c38)

• Merges current net11.0 normally into the PR branch (no rebase or history rewrite), bringing the newly shipped Passkeys API and latest base changes into local/CI validation.
• Adds IPasskeys to the owner-aware DI-to-static facade bridge and updates Passkeys.Default / SetDefault to the shared synchronized EssentialsImplementation.GetOrCreate/Set pattern.
• Adds direct identity coverage proving a DI-registered IPasskeys backs Passkeys.Default; lazy default behavior remains unchanged when unregistered.
• Validation on the merged base: Core Hosting 188/188, Passkeys bridge regression 1/1, Essentials 472/472, Core/Essentials netstandard2.0 clean, Windows Essentials C# build clean, and iOS/MacCatalyst/Android Essentials+Core builds clean. Current-head Android review 14845706 and maui-pr build 1536345 are active.

Final ownership and teardown review follow-up (4cdbf75b561)

• Failed initialization now preserves bridged Essentials facades through asynchronous provider disposal and restores them only after provider-owned async disposables complete, matching normal MauiApp.DisposeAsync() ordering.
• Implicit SecureStorage retains the platform's native package identity. A custom DI IAppInfo.PackageName no longer changes the alias or hides secrets written before the bridge existed; apps that intentionally need a custom namespace must register ISecureStorage.
• On unpackaged Windows, an AppInfo-only bridge uses the native app-data directory instead of an ambient FileSystem.Current owned by another app. A FileSystem-only bridge still uses its explicitly registered directory, with owner validation before publication.
• AppActions keeps one physical writer attached through each uncancellable SetAsync. Later owners do not start until the prior write completes, so an in-flight stale operation can never overwrite a newer publication.
• The process-global bridge fixture now resets Passkeys.Default, preventing state leakage between tests.
• This section supersedes the earlier custom-PackageName SecureStorage migration/handoff and detached stale-AppActions-worker statements in the chronological history above.
• Final local validation: Core unit tests 946 total / 943 passed / 0 failed / 3 skipped; focused hosting tests 109/109; iOS and Android Essentials device-test apps build successfully; Windows Essentials C# builds cleanly. Windows device execution remains CI-only.

Human re-review deterministic cleanup follow-up (6f384a337b3)

• Failures inside the first EssentialsInitializer pass now run pre-provider cleanup immediately but register partial facade ownership for post-provider restoration. Failed repeated InitializeAppServices() calls still rollback their local batch immediately.
• Failed MauiAppBuilder.Build() no longer leaves async-only disposal fire-and-forget: synchronous disposal uses the existing context-free ThreadPool hop, completes provider teardown, restores facades, and preserves initialization/cleanup exception aggregation before returning failure.
• IAppActions.SetAsync now documents that custom implementations must complete their returned task. Because the interface has no cancellation token, strict non-overlapping publication intentionally keeps successors queued behind an incomplete physical write; a deterministic regression proves successor build/disposal remains live without claiming cancellation.
• Final local validation: Core Hosting 210/210; Core and Essentials netstandard2.0 builds succeeded with 0 warnings and 0 errors.

[github-actions]

🚀 Dogfood this PR with:

⚠️ WARNING: Do not do this without first carefully reviewing the code of this PR to satisfy yourself it is safe.

curl -fsSL https://raw.githubusercontent.com/dotnet/maui/main/eng/scripts/get-maui-pr.sh | bash -s -- 36657

Or

• Run remotely in PowerShell:

iex "& { $(irm https://raw.githubusercontent.com/dotnet/maui/main/eng/scripts/get-maui-pr.ps1) } 36657"

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

Pull request overview

This PR forward-ports the “Essentials DI bridge” behavior to net11.0, allowing platform/backend authors to register Essentials implementations in DI and have them automatically assigned to the corresponding static facades (e.g., Preferences.Default, AppInfo.Current) during MauiApp initialization. It also updates Core unit tests to serialize MauiApp-building tests to avoid static-state disposal races.

Changes:

• Register EssentialsInitializer unconditionally and bridge DI-registered Essentials services to static Default/Current facades at startup.
• Ensure initialization ordering on external TFMs by registering MainThreadBridgeInitializer before the Essentials bridge.
• Add/adjust Core unit tests (including a new EssentialsDIBridgeTests) and serialize relevant test classes via a shared xUnit collection to prevent parallel static-state interference.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
src/Core/src/Hosting/EssentialsMauiAppBuilderExtensions.cs	Adds DI-to-static facade bridging during app initialization; adjusts initializer registration order and event subscription behavior.
src/Core/tests/UnitTests/Hosting/EssentialsDIBridgeTests.cs	New unit tests validating DI-registered Essentials implementations are bridged to static facades and that no-registration preserves lazy defaults.
src/Core/tests/UnitTests/Dispatching/DispatcherTests.cs	Serializes tests that mutate DispatcherProvider.Current to avoid cross-test ObjectDisposedException races.
src/Core/tests/UnitTests/Hosting/MainThreadBridgeTests.cs	Serializes MauiApp-building tests that interact with MainThread/dispatcher static state.
src/Core/tests/UnitTests/Hosting/HostBuilderServicesTests.cs	Serializes MauiApp-building tests that capture dispatcher provider state via DI.

[MauiBot]

Expert Review — 4 findings

See inline comments for details.

[kubaflo]

Addressed the latest Copilot review in adb69a8d85:

• annotated the optional internal write path as nullable using the repository's scoped nullable-annotations pattern;
• serialized first alias migration with the legacy storage mutex and re-checked fallback existence under that lock;
• added regression coverage for a concurrent legacy writer.

The Windows Essentials target compiles cleanly. @copilot, this is ready for re-review.

[Copilot]

@kubaflo Unfortunately I hit an unexpected error while processing your comment. I've automatically reported this to GitHub.

You can ask me to try again later by mentioning me in a new comment.

If you want to contact GitHub about this error, please mention the following identifier so they can better serve you: b19d9086-6316-4d52-ae01-70b38354de76

Sorry for the inconvenience!

[Copilot]

@kubaflo Unfortunately I hit an unexpected error while processing your comment. I've automatically reported this to GitHub.

You can ask me to try again later by mentioning me in a new comment.

If you want to contact GitHub about this error, please mention the following identifier so they can better serve you: b19d9086-6316-4d52-ae01-70b38354de76

Sorry for the inconvenience!

[Copilot]

@kubaflo Unfortunately I hit an unexpected error while processing your comment. I've automatically reported this to GitHub.

You can ask me to try again later by mentioning me in a new comment.

If you want to contact GitHub about this error, please mention the following identifier so they can better serve you: b19d9086-6316-4d52-ae01-70b38354de76

Sorry for the inconvenience!

[Copilot]

@kubaflo Unfortunately I hit an unexpected error while processing your comment. I've automatically reported this to GitHub.

You can ask me to try again later by mentioning me in a new comment.

If you want to contact GitHub about this error, please mention the following identifier so they can better serve you: b19d9086-6316-4d52-ae01-70b38354de76

Sorry for the inconvenience!

[Copilot]

@kubaflo Unfortunately I hit an unexpected error while processing your comment. I've automatically reported this to GitHub.

You can ask me to try again later by mentioning me in a new comment.

If you want to contact GitHub about this error, please mention the following identifier so they can better serve you: b19d9086-6316-4d52-ae01-70b38354de76

Sorry for the inconvenience!

[Copilot]

@kubaflo Unfortunately I hit an unexpected error while processing your comment. I've automatically reported this to GitHub.

You can ask me to try again later by mentioning me in a new comment.

If you want to contact GitHub about this error, please mention the following identifier so they can better serve you: b19d9086-6316-4d52-ae01-70b38354de76

Sorry for the inconvenience!

[kubaflo]

@copilot-pull-request-reviewer, the feedback from review 4926076672 and inline thread 3774592426 is addressed in adb69a8d85; the inline thread is resolved and the PR is ready for re-review.

[Copilot]

@kubaflo Unfortunately I hit an unexpected error while processing your comment. I've automatically reported this to GitHub.

You can ask me to try again later by mentioning me in a new comment.

If you want to contact GitHub about this error, please mention the following identifier so they can better serve you: 96d347c9-5c37-4b88-9fe6-a5e095b19c79

Sorry for the inconvenience!

[Copilot]

@kubaflo Unfortunately I hit an unexpected error while processing your comment. I've automatically reported this to GitHub.

You can ask me to try again later by mentioning me in a new comment.

If you want to contact GitHub about this error, please mention the following identifier so they can better serve you: 96d347c9-5c37-4b88-9fe6-a5e095b19c79

Sorry for the inconvenience!

[Copilot]

@kubaflo Unfortunately I hit an unexpected error while processing your comment. I've automatically reported this to GitHub.

You can ask me to try again later by mentioning me in a new comment.

If you want to contact GitHub about this error, please mention the following identifier so they can better serve you: 96d347c9-5c37-4b88-9fe6-a5e095b19c79

Sorry for the inconvenience!

[Copilot]

@kubaflo Unfortunately I hit an unexpected error while processing your comment. I've automatically reported this to GitHub.

You can ask me to try again later by mentioning me in a new comment.

If you want to contact GitHub about this error, please mention the following identifier so they can better serve you: 96d347c9-5c37-4b88-9fe6-a5e095b19c79

Sorry for the inconvenience!

[Copilot]

@kubaflo Unfortunately I hit an unexpected error while processing your comment. I've automatically reported this to GitHub.

You can ask me to try again later by mentioning me in a new comment.

If you want to contact GitHub about this error, please mention the following identifier so they can better serve you: 96d347c9-5c37-4b88-9fe6-a5e095b19c79

Sorry for the inconvenience!

[Copilot]

@kubaflo Unfortunately I hit an unexpected error while processing your comment. I've automatically reported this to GitHub.

You can ask me to try again later by mentioning me in a new comment.

If you want to contact GitHub about this error, please mention the following identifier so they can better serve you: 96d347c9-5c37-4b88-9fe6-a5e095b19c79

Sorry for the inconvenience!

[Copilot]

Pull request overview

Copilot reviewed 67 out of 68 changed files in this pull request and generated no new comments.

[PureWeen]

Adversarial review — PR #36657

One consensus-validated test-isolation warning is included inline. Existing review bodies, inline threads, and issue comments were checked; earlier DispatcherProvider disposal feedback was addressed by retaining captured stubs, but the current collection no longer disables cross-collection parallelization. The PR adds broad lifecycle and bridge coverage, but its default-builder tests remain exposed to this process-wide static-state overlap.

Methodology: 3 independent reviewers with adversarial consensus + repo domain specialist.

[Copilot]

Pull request overview

Copilot reviewed 69 out of 70 changed files in this pull request and generated no new comments.

[kubaflo]

@PureWeen addressed the test-isolation finding in 209f690 by restoring the non-parallel MainThreadStaticState collection definition and using its shared name constant. The 160 focused tests passed across six runs and the thread is resolved. Ready for re-review — thanks!

[PureWeen]

Adversarial review

No new actionable code-quality findings were identified at 209f690e.

• Methodology: 3 independent reviewers with adversarial consensus + repo domain specialist.
• Consensus: Two reviewers found no new issues. Three single-source candidates (test-collection isolation, Android recovery-write durability, and initialization-failure teardown) were rejected by both independent adjudicators after verifying current source and applicable framework contracts.
• Test coverage: The change includes focused Core unit coverage for facade ownership, static-state isolation, build/disposal failure paths, and concurrency, plus Essentials/Core device-test coverage for platform behavior.
• Prior feedback: Previously raised lifecycle, storage-migration, and static-state isolation concerns were rechecked at this head and were not duplicated.