fix(reconciler): dedupe ToggleSwitch.Toggled wiring via EventHandlerState (#113)

* fix(reconciler): dedupe ToggleSwitch.Toggled wiring via EventHandlerState

The wire-dedupe flag for ToggleSwitch.Toggled lived in
ConditionalWeakTable<FrameworkElement, PoolableWireFlags>, keyed by
managed RCW identity. WinRT projection can produce two RCWs over the
same underlying DependencyObject; each gets its own CWT entry, both
pass the dedupe check, and toggle.Toggled += subscribes the trampoline
twice. One IsOn change then fans into multiple user-callback invocations.

Symptom: EchoSuppress_ToggleSwitch_NoEchoCall flaked in ~8% of
full-suite selftest runs but never in isolation. The first subscription
consumed the BeginSuppress token; the second subscription saw counter=0
and invoked the user OnChanged with the value Reactor had just written.

Fix: store the trampoline on EventHandlerState (attached via
ReactorAttached.StateProperty, keyed by native DO identity) — the same
pattern already used for SizeChanged, PointerPressed, Tapped, etc. The
comment on GetOrCreateEventState (Reconciler.cs:2590) explicitly notes
this is the safe key.

Validation: 60/60 full-suite runs clean across two fix iterations
(baseline expected ~4.8 flakes at 8%).

Follow-up: PoolableWireFlags.ButtonClick / TextBoxTextChanged /
TextBoxSelectionChanged share the same CWT-by-RCW vulnerability and
should be migrated to EventHandlerState.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* docs(reconciler): clarify which dedupe scheme covers which control

Address PR #113 review: the comment block above PoolableWireFlags
described the CWT approach as covering ToggleSwitch, but that's now
out of date — ToggleSwitch dedupes via EventHandlerState (DP keyed by
native DO identity). Spell out which scheme each control uses, point at
issue #114 for the planned migration of the remaining CWT entries, and
direct future contributors at the EventHandlerState pattern.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: codemonkeychris

src/Reactor/Core/Reconciler.Mount.cs

@@ -675,23 +675,22 @@ private WinUI.ToggleSwitch MountToggleSwitch(ToggleSwitchElement ts)
         return toggle;
     }
 
-    /// <summary>
-    /// Wires ToggleSwitch.Toggled trampoline only when the element has a
-    /// handler AND the control hasn't been wired yet. The CWT flag survives
-    /// pool round-trips (ToggleSwitch is a poolable type).
-    /// </summary>
+    // Dedupe via EventHandlerState (attached on ReactorAttached.StateProperty,
+    // keyed by native DependencyObject identity). A plain CWT keyed by managed
+    // RCW identity is unsafe — two RCWs over the same DO miss the dedupe and
+    // double-subscribe, fanning one Toggled into multiple user-callback invocations.
     internal static void EnsureToggleSwitchWiring(WinUI.ToggleSwitch toggle, ToggleSwitchElement ts)
     {
         if (ts.OnChanged is null) return;
-        var flags = GetPoolableWireFlags(toggle);
-        if (flags.ToggleSwitchToggled) return;
-        flags.ToggleSwitchToggled = true;
-        toggle.Toggled += (s, _) =>
+        var state = GetOrCreateEventState(toggle);
+        if (state.ToggleSwitchToggledTrampoline is not null) return;
+        state.ToggleSwitchToggledTrampoline = (s, _) =>
         {
             var t = (WinUI.ToggleSwitch)s!;
             if (ChangeEchoSuppressor.ShouldSuppress(t)) return;
             (GetElementTag(t) as ToggleSwitchElement)?.OnChanged?.Invoke(t.IsOn);
         };
+        toggle.Toggled += state.ToggleSwitchToggledTrampoline;
     }
 
     private WinUI.RatingControl MountRatingControl(RatingControlElement rc)

src/Reactor/Core/Reconciler.cs

@@ -360,15 +360,25 @@ internal static void DetachReactorState(FrameworkElement fe)
     // ElementPool.CleanElement), but clears Tag. So "Tag is null" on rent does
     // NOT mean "unwired" — the control may already have a trampoline attached.
     // We need a per-control flag that survives pool cycles to avoid double-
-    // subscription. A ConditionalWeakTable gives us that with zero cross-ABI
-    // cost and weak keys so GC isn't blocked.
+    // subscription.
+    //
+    // Two dedupe schemes coexist:
+    //   - Button.Click and TextBox.TextChanged/SelectionChanged use the CWT
+    //     below, keyed by managed FrameworkElement identity. This is fragile
+    //     when WinRT projection produces a second RCW over the same native
+    //     DependencyObject (each RCW gets its own entry, both pass dedupe,
+    //     trampoline subscribed twice). See issue #114 for the migration.
+    //   - ToggleSwitch.Toggled uses EventHandlerState (attached on
+    //     ReactorAttached.StateProperty), which is keyed by native DO identity
+    //     and so is RCW-stable. New poolable wiring should follow this pattern
+    //     — see EnsureToggleSwitchWiring and the EnsureXxxSubscribed helpers
+    //     for the input events.
 
     internal sealed class PoolableWireFlags
     {
         public bool ButtonClick;
         public bool TextBoxTextChanged;
         public bool TextBoxSelectionChanged;
-        public bool ToggleSwitchToggled;
     }
 
     private static readonly global::System.Runtime.CompilerServices.ConditionalWeakTable<FrameworkElement, PoolableWireFlags> _poolableWireFlags = new();
@@ -2554,6 +2564,7 @@ internal sealed class EventHandlerState
         public global::Windows.Foundation.TypedEventHandler<UIElement, Microsoft.UI.Xaml.Input.CharacterReceivedRoutedEventArgs>? CharacterReceivedTrampoline;
         public RoutedEventHandler? GotFocusTrampoline;
         public RoutedEventHandler? LostFocusTrampoline;
+        public RoutedEventHandler? ToggleSwitchToggledTrampoline;
         public global::Windows.Foundation.TypedEventHandler<UIElement, Microsoft.UI.Xaml.Input.AccessKeyDisplayRequestedEventArgs>? AccessKeyDisplayRequestedTrampoline;
 
         /// <summary>