diff --git a/‎src/pythonnative/hot_reload.py‎
Lines changed: 153 additions & 3 deletions b/‎src/pythonnative/hot_reload.py‎
Lines changed: 153 additions & 3 deletions
diff --git a/‎src/pythonnative/native_views/__init__.py‎
Lines changed: 72 additions & 0 deletions b/‎src/pythonnative/native_views/__init__.py‎
Lines changed: 72 additions & 0 deletions
diff --git a/‎src/pythonnative/native_views/ios.py‎
Lines changed: 49 additions & 5 deletions b/‎src/pythonnative/native_views/ios.py‎
Lines changed: 49 additions & 5 deletions
@@ -196,10 +196,19 @@ class ModuleReloader:
     """Reload changed Python modules on device and trigger a re-render.
 
     Designed to be invoked from device-side glue when a hot-reload
-    push completes. The class itself holds no state; all methods are
-    static.
+    push completes. All public methods are static; the class holds a
+    single piece of process-wide state — the manifest version that
+    has most recently been applied to ``sys.modules`` — so that
+    multiple screen hosts polling the same manifest do not each
+    re-execute the user-app modules. The first host to see a new
+    version pays the ``reload_modules`` cost; subsequent hosts on the
+    same version refresh only their own reconciler tree against the
+    already-fresh modules.
     """
 
+    _last_reloaded_version: Optional[str] = None
+    _reload_lock = threading.Lock()
+
     @staticmethod
     def reload_module(module_name: str) -> bool:
         """Reload a single module by its dotted name.
@@ -254,6 +263,139 @@ def reload_modules(module_names: Sequence[str]) -> List[str]:
                 reloaded.append(module_name)
         return reloaded
 
+    @staticmethod
+    def reload_modules_for_version(
+        module_names: Sequence[str],
+        version: Optional[str],
+    ) -> List[str]:
+        """Reload ``module_names`` for ``version``, deduping across hosts.
+
+        Each native screen host on iOS / Android runs its own poll
+        loop and would otherwise call
+        [`reload_modules`][pythonnative.hot_reload.ModuleReloader.reload_modules]
+        independently for the same manifest version. That re-executes
+        every user-app module N times (once per host) per file change,
+        producing N different generations of the same function objects
+        in ``sys.modules`` and leaving each host's reconciler tree
+        pointing at a different generation. Beyond the wasted work,
+        the inconsistent state has been observed to crash UIKit on iOS
+        with ``CALayerInvalidGeometry`` (NaN values fed into ``setFrame_:``
+        during the interleaved renders).
+
+        This helper serializes on
+        [`_reload_lock`][pythonnative.hot_reload.ModuleReloader] and uses
+        [`_last_reloaded_version`][pythonnative.hot_reload.ModuleReloader]
+        to ensure only the *first* host to see a given ``version``
+        actually re-executes the modules. Subsequent hosts on the same
+        version get back the already-fresh entries from ``sys.modules``
+        so their own
+        [`refresh_in_place`][pythonnative.hot_reload.ModuleReloader.refresh_in_place]
+        pass can still rewrite their tree against the same generation.
+
+        Args:
+            module_names: Dotted module names to reload.
+            version: Manifest version this reload is processing. When
+                ``None`` (e.g. tests calling reload directly) the call
+                falls back to the unconditional
+                [`reload_modules`][pythonnative.hot_reload.ModuleReloader.reload_modules]
+                behavior.
+
+        Returns:
+            The list of module names that are currently fresh in
+            ``sys.modules`` — either freshly reloaded by this call, or
+            already reloaded by an earlier host for the same version.
+        """
+        with ModuleReloader._reload_lock:
+            if version is not None and version == ModuleReloader._last_reloaded_version:
+                return [name for name in module_names if name in sys.modules]
+            reloaded = ModuleReloader.reload_modules(module_names)
+            if reloaded and version is not None:
+                ModuleReloader._last_reloaded_version = version
+            return reloaded
+
+    @staticmethod
+    def expand_reload_targets(changed_modules: Sequence[str], component_path: str) -> List[str]:
+        """Expand a manifest of changed modules into the full reload order.
+
+        When a user edits ``app/screens/home.py``, only that file is in
+        the manifest. But the entry-point module ``app.main`` has
+        bindings like ``from app.screens.home import HomeScreen`` that
+        need to be re-evaluated against the freshly-loaded
+        ``app.screens.home``; likewise other user-app modules may carry
+        transitive bindings (e.g. through a shared ``app/theme.py``)
+        that go stale if only the changed file is reloaded.
+
+        This helper computes the full ordered reload list:
+
+        1. Explicitly changed modules first (in the order given), so
+           their fresh source replaces the cached version in
+           ``sys.modules`` before any dependent modules re-execute.
+        2. All other currently-imported modules under the entry-point's
+           top-level package, deepest first. The depth heuristic biases
+           toward leaves so re-executing a screen file picks up the
+           newest shared utilities before the file that imports it does.
+        3. The entry-point module itself, last, so its
+           ``from ... import`` bindings rebind against everything that
+           was refreshed in steps 1 and 2.
+
+        Modules outside the entry-point's top-level package
+        (``pythonnative.*``, stdlib, third-party) are never included;
+        framework code is not reloaded.
+
+        Args:
+            changed_modules: Modules reported as changed by the host
+                file-watcher (already in dotted form).
+            component_path: The host's entry-point identifier, either a
+                module path (``"app.main"``) or a dotted attribute path
+                (``"app.main.RootScreen"``).
+
+        Returns:
+            The ordered list of modules to feed to
+            [`reload_modules`][pythonnative.hot_reload.ModuleReloader.reload_modules].
+        """
+        entry_module: Optional[str] = None
+        if component_path in sys.modules:
+            entry_module = component_path
+        elif "." in component_path:
+            parent = component_path.rsplit(".", 1)[0]
+            if parent in sys.modules:
+                entry_module = parent
+
+        app_prefix: Optional[str] = None
+        if entry_module:
+            app_prefix = entry_module.split(".")[0]
+        else:
+            for m in changed_modules:
+                if m:
+                    app_prefix = m.split(".")[0]
+                    break
+
+        app_modules: Set[str] = set()
+        if app_prefix:
+            for name in list(sys.modules):
+                if name == app_prefix or name.startswith(app_prefix + "."):
+                    app_modules.add(name)
+
+        ordered: List[str] = []
+        seen: Set[str] = set()
+        for m in changed_modules:
+            if m and m not in seen:
+                ordered.append(m)
+                seen.add(m)
+
+        others = [m for m in app_modules if m not in seen and m != entry_module]
+        others.sort(key=lambda m: (-m.count("."), m))
+        for m in others:
+            ordered.append(m)
+            seen.add(m)
+
+        if entry_module:
+            if entry_module in seen:
+                ordered.remove(entry_module)
+            ordered.append(entry_module)
+
+        return ordered
+
     @staticmethod
     def file_to_module(file_path: str, base_dir: str = "") -> Optional[str]:
         """Convert a file path to a dotted module name.
@@ -491,5 +633,13 @@ def reload_from_manifest(
             files = manifest.get("files", [])
             modules = ModuleReloader.modules_from_files(files if isinstance(files, list) else [])
 
-        ModuleReloader.reload_screen(screen_instance, [str(module) for module in modules])
+        # Stash the version on the host so `_reload_host` can dedupe
+        # `reload_modules` across multiple hosts polling the same
+        # manifest. See `reload_modules_for_version`.
+        previous_pending = getattr(screen_instance, "_hot_reload_pending_version", None)
+        try:
+            screen_instance._hot_reload_pending_version = version
+            ModuleReloader.reload_screen(screen_instance, [str(module) for module in modules])
+        finally:
+            screen_instance._hot_reload_pending_version = previous_pending
         return version
@@ -23,10 +23,67 @@
 reconciler with no real native views.
 """
 
+import math
+import sys
+import threading
+import time
 from typing import Any, Dict, Optional, Tuple
 
 from .base import ViewHandler
 
+# ======================================================================
+# Tripwire log rate limiter
+# ======================================================================
+#
+# Defensive NaN/Inf guards in ``set_frame`` and ``_apply_transform`` log
+# a single line per occurrence. That's fine for one-off events, but
+# ``Animated.View`` drives transforms at ~60 Hz; once an
+# ``Animated.Value`` enters a stuck NaN state (e.g., a spring tick
+# corrupted across a Fast Refresh), the tripwire would otherwise emit
+# thousands of identical lines per second and drown the dev console.
+#
+# We instead log the first occurrence immediately, then suppress
+# further messages with the same ``label`` for
+# ``_TRIPWIRE_RATE_LIMIT_S`` seconds, and append a
+# ``(+N similar in last Xs)`` suffix to the next message that escapes
+# the window. The first sample plus a count is enough to diagnose; the
+# bounded log keeps the dev console usable.
+
+_TRIPWIRE_RATE_LIMIT_S: float = 1.0
+_TRIPWIRE_LOG_LOCK = threading.Lock()
+_TRIPWIRE_LAST_LOG_TIME: Dict[str, float] = {}
+_TRIPWIRE_SUPPRESSED_COUNT: Dict[str, int] = {}
+
+
+def _tripwire_log(label: str, message: str) -> None:
+    """Emit ``message`` to stderr, rate-limited per ``label``.
+
+    The first call for a given ``label`` always emits. Calls within
+    ``_TRIPWIRE_RATE_LIMIT_S`` seconds are silently counted. The next
+    call after the window appends ``(+N similar in last Xs)`` and
+    resets the counter.
+    """
+    now = time.monotonic()
+    write = False
+    suppressed = 0
+    with _TRIPWIRE_LOG_LOCK:
+        last = _TRIPWIRE_LAST_LOG_TIME.get(label)
+        if last is None or now - last >= _TRIPWIRE_RATE_LIMIT_S:
+            write = True
+            suppressed = _TRIPWIRE_SUPPRESSED_COUNT.get(label, 0)
+            _TRIPWIRE_SUPPRESSED_COUNT[label] = 0
+            _TRIPWIRE_LAST_LOG_TIME[label] = now
+        else:
+            _TRIPWIRE_SUPPRESSED_COUNT[label] = _TRIPWIRE_SUPPRESSED_COUNT.get(label, 0) + 1
+    if not write:
+        return
+    if suppressed > 0:
+        message = f"{message} (+{suppressed} similar in last {_TRIPWIRE_RATE_LIMIT_S:g}s)"
+    try:
+        print(message, file=sys.stderr, flush=True)
+    except Exception:
+        pass
+
 
 class NativeViewRegistry:
     """Map element type names to platform-specific view handlers.
@@ -136,6 +193,21 @@ def set_frame(
         coordinates computed by ``pythonnative.layout`` in points
         relative to the parent's content origin.
         """
+        # Tripwire: log non-finite layout values so we can diagnose
+        # crashes like iOS `CALayerInvalidGeometry` without losing the
+        # repro. Handlers are responsible for clamping before applying.
+        # Rate-limited via ``_tripwire_log`` to avoid 60 Hz floods when
+        # an animated value is stuck at NaN.
+        try:
+            finite = math.isfinite(x) and math.isfinite(y) and math.isfinite(width) and math.isfinite(height)
+        except (TypeError, ValueError):
+            finite = False
+        if not finite:
+            _tripwire_log(
+                "set_frame:nan",
+                f"[set_frame:nan] type={type_name!r} " f"x={x!r} y={y!r} w={width!r} h={height!r}",
+            )
+
         handler = self._handlers.get(type_name)
         if handler is not None:
             handler.set_frame(native_view, x, y, width, height)
 
@@ -28,8 +28,28 @@
 
 from rubicon.objc import SEL, ObjCClass, objc_method
 
+from . import _tripwire_log
 from .base import ViewHandler, _safe_max, parse_color_int
 
+
+def _safe_finite(value: Any, default: float = 0.0) -> float:
+    """Coerce ``value`` to a finite float, falling back to ``default``.
+
+    Used as a defensive guard around every call into UIKit that takes a
+    geometry value. Without this, a single NaN or inf produced upstream
+    (layout edge case, stale prop during a reload, etc.) crashes the
+    process via `CALayerInvalidGeometry`. Clamping to ``default``
+    converts that into a recoverable visual glitch and lets the
+    `[set_frame:nan]` / `[set_transform:nan]` tripwire logs surface
+    where the bad value came from.
+    """
+    try:
+        f = float(value)
+    except (TypeError, ValueError):
+        return default
+    return f if math.isfinite(f) else default
+
+
 NSObject = ObjCClass("NSObject")
 UIColor = ObjCClass("UIColor")
 UIFont = ObjCClass("UIFont")
@@ -350,8 +370,32 @@ def _apply_transform(view: Any, props: Dict[str, Any]) -> None:
         return
     try:
         transform = _make_transform(spec)
+        a = float(transform.a)
+        b = float(transform.b)
+        c = float(transform.c)
+        d = float(transform.d)
+        tx = float(transform.tx)
+        ty = float(transform.ty)
+        if not (
+            math.isfinite(a)
+            and math.isfinite(b)
+            and math.isfinite(c)
+            and math.isfinite(d)
+            and math.isfinite(tx)
+            and math.isfinite(ty)
+        ):
+            # Tripwire: a NaN/inf transform crashes UIKit. Log
+            # (rate-limited to avoid 60 Hz spam from stuck Animated
+            # values) and fall back to identity so the app keeps
+            # running.
+            _tripwire_log(
+                "set_transform:nan",
+                f"[set_transform:nan] spec={spec!r} -> " f"(a={a!r}, b={b!r}, c={c!r}, d={d!r}, tx={tx!r}, ty={ty!r})",
+            )
+            view.setTransform_((1.0, 0.0, 0.0, 1.0, 0.0, 0.0))
+            return
         # rubicon-objc accepts the C struct as a tuple of its fields.
-        view.setTransform_((transform.a, transform.b, transform.c, transform.d, transform.tx, transform.ty))
+        view.setTransform_((a, b, c, d, tx, ty))
     except Exception:
         pass
 
@@ -450,10 +494,10 @@ def set_frame(self, native_view: Any, x: float, y: float, width: float, height:
         if native_view is None:
             return
         try:
-            frame_x = float(x)
-            frame_y = float(y)
-            frame_w = float(max(0.0, width))
-            frame_h = float(max(0.0, height))
+            frame_x = _safe_finite(x, 0.0)
+            frame_y = _safe_finite(y, 0.0)
+            frame_w = max(0.0, _safe_finite(width, 0.0))
+            frame_h = max(0.0, _safe_finite(height, 0.0))
             native_view.setTranslatesAutoresizingMaskIntoConstraints_(True)
             native_view.setFrame_(((frame_x, frame_y), (frame_w, frame_h)))
             _clamp_view_corner_radius(native_view, frame_w, frame_h)