@@ -16,6 +16,19 @@ import io.sentry.SpanStatus
  * Note: "Owner" below refers to the `LifecycleOwner` whose lifecycle events the candidate's
  * `NavScopes` relays.
  *
+ * **Exception semantics**
+ *
+ * Every method in this class with an `IScope` parameter can throw arbitrary exceptions due to:
+ *
+ * 1. the [onPublishData][registerCandidate] and [onClearPublishedData][registerCandidate] callbacks
+ *    supplied at registration;
+ * 2. the `IScope` the method is handed, whose mutators notify every observer registered through
+ *    `SentryOptions.addScopeObserver` – including the host app's – in an unguarded loop; and
+ * 3. `finish()` on a retained nav transaction, which may run the host app's event processors.
+ *
+ * This class restores its own bookkeeping before the exception leaves, so the coordinator remains
+ * usable.
+ *
  * **Thread safety**
  *
  * This class is ***not*** thread-safe. All `NavScopes` instances using this coordinator must
@@ -83,6 +96,8 @@ internal class NavLeaseCoordinator {
    *
    * A `null` scope (e.g., the SDK is disabled) still records the lifecycle transition so the
    * candidate remains eligible for fallback once a scope becomes available.
+   *
+   * Can throw arbitrary exceptions. See "Exception semantics" in the class KDoc.
    */
   fun resumeCandidate(owner: Any, scope: IScope?) {
     findCandidate(owner)?.let {
@@ -104,6 +119,8 @@ internal class NavLeaseCoordinator {
    *
    * A `null` scope (e.g., the SDK is disabled) still records the lifecycle transition so the
    * candidate remains eligible for fallback once a scope becomes available.
+   *
+   * Can throw arbitrary exceptions. See "Exception semantics" in the class KDoc.
    */
   fun pauseCandidate(owner: Any, scope: IScope?) {
     findCandidate(owner)?.let {
@@ -132,6 +149,8 @@ internal class NavLeaseCoordinator {
    *
    * A `null` scope (e.g., the SDK is disabled) still records the lifecycle transition so the
    * candidate remains eligible for fallback once a scope becomes available.
+   *
+   * Can throw arbitrary exceptions. See "Exception semantics" in the class KDoc.
    */
   fun stopCandidate(owner: Any, scope: IScope?) {
     findCandidate(owner)?.let {
@@ -156,36 +175,34 @@ internal class NavLeaseCoordinator {
    * left to time out, its published data is left in place, and the lease is released rather than
    * handed off.
    *
-   * Coordinator references are released even if scope cleanup or lease handoff throws. The
-   * exception is left to the caller to handle; remaining scope cleanup may be incomplete.
+   * Coordinator references are released even if scope cleanup or lease handoff throws. See
+   * "Exception semantics" in the class KDoc. The remaining scope cleanup is then skipped.
    */
   fun unregisterCandidate(owner: Any, scope: IScope?) {
-    findCandidate(owner)?.let {
-      try {
-        finishTransaction(it, scope)
-        candidates.remove(it)
+    val candidate = findCandidate(owner) ?: return
 
-        if (publishedDataCandidate === it) {
-          publishedDataCandidate = null
-          if (scope != null) {
-            it.onClearPublishedData(scope)
-          }
-        }
+    try {
+      finishTransaction(candidate, scope)
+      candidates.remove(candidate)
 
-        if (leaseHolder === it) {
-          handOffLease(mostRecentlyResumedCandidate(), scope)
-        }
-      } finally {
-        // Scope observers and transaction callbacks can throw. Never retain a departing owner
-        // just because cleanup failed, and preserve any successor selected during handoff.
-        candidates.remove(it)
-        it.transaction = null
-        if (publishedDataCandidate === it) {
-          publishedDataCandidate = null
-        }
-        if (leaseHolder === it) {
-          leaseHolder = null
-        }
+      if (publishedDataCandidate === candidate) {
+        publishedDataCandidate = null
+        scope?.let { candidate.onClearPublishedData(it) }
+      }
+
+      if (leaseHolder === candidate) {
+        handOffLease(mostRecentlyResumedCandidate(), scope)
+      }
+    } finally {
+      // Scope observers and transaction callbacks can throw. Never retain a departing owner
+      // just because cleanup failed, and preserve any successor selected during handoff.
+      candidates.remove(candidate)
+      candidate.transaction = null
+      if (publishedDataCandidate === candidate) {
+        publishedDataCandidate = null
+      }
+      if (leaseHolder === candidate) {
+        leaseHolder = null
       }
     }
   }
@@ -203,6 +220,8 @@ internal class NavLeaseCoordinator {
    * If the lease transfers, ownership and transaction binding are updated before the candidate's
    * staged nav data is published. Publication completes before this method returns, so the caller
    * can then apply the back-stack update. Later calls for the same [owner] do nothing.
+   *
+   * Can throw arbitrary exceptions. See "Exception semantics" in the class KDoc.
    */
   fun onBackStackUpdate(owner: Any, scope: IScope) {
     val candidate = findCandidate(owner) ?: return
@@ -293,6 +312,14 @@ internal class NavLeaseCoordinator {
     }
   }
 
+  /**
+   * Hands the lease to [candidate], or releases it given `null`.
+   *
+   * Maintains the invariant that, while a lease is held, the leaseholder is also the candidate
+   * recorded as having published the shared scope's nav data. The invariant holds even when a
+   * publish or clear callback throws part way through the handoff. See "Exception semantics" in the
+   * class KDoc.
+   */
   private fun transferLeaseTo(candidate: Candidate?, scope: IScope) {
     if (leaseHolder === candidate) {
       return
@@ -330,11 +357,20 @@ internal class NavLeaseCoordinator {
       // previous owner's values don't linger where the candidate has nothing staged to replace
       // them.
       val previousPublisher = publishedDataCandidate
-      if (previousPublisher != null && previousPublisher !== candidate) {
-        previousPublisher.onClearPublishedData(scope)
+      try {
+        if (previousPublisher != null && previousPublisher !== candidate) {
+          previousPublisher.onClearPublishedData(scope)
+        }
+        publishedDataCandidate = candidate
+        candidate.onPublishData(scope)
+      } finally {
+        // Scope observers can throw. A candidate owns the scope's nav data from the moment it
+        // takes the lease, so record it as the publisher even if clearing the previous owner's
+        // data threw. Leaving the previous owner recorded here would strand both owners' values
+        // b/c the next handoff would clear data the candidate may have already replaced, and would
+        // never clear the candidate's own.
+        publishedDataCandidate = candidate
       }
-      publishedDataCandidate = candidate
-      candidate.onPublishData(scope)
     }
   }
 
 
@@ -15,7 +15,6 @@ import io.sentry.Breadcrumb
 import io.sentry.Hint
 import io.sentry.IScope
 import io.sentry.IScopes
-import io.sentry.ITransaction
 import io.sentry.Scope
 import io.sentry.ScopeCallback
 import io.sentry.SentryOptions
@@ -550,13 +549,6 @@ class SentryNavEffectTest {
     return navigationContext[BACKSTACK_KEY] as? List<Map<String, Any?>>
   }
 
-  private fun ITransaction.navigationBackStack(): List<Map<String, Any?>>? {
-    val navigationContext = contexts[NAVIGATION_CONTEXT_KEY] as? Map<*, *> ?: return null
-
-    @Suppress("UNCHECKED_CAST")
-    return navigationContext[BACKSTACK_KEY] as? List<Map<String, Any?>>
-  }
-
   private companion object {
     const val NAVIGATION_CONTEXT_KEY = "Navigation"
     const val BACKSTACK_KEY = "Back Stack"
 
@@ -17,6 +17,7 @@ import org.mockito.kotlin.verify
 import org.mockito.kotlin.verifyNoInteractions
 import org.mockito.kotlin.whenever
 
+@Suppress("LargeClass")
 class NavLeaseCoordinatorTest {
 
   private val owner = Any()
@@ -267,6 +268,126 @@ class NavLeaseCoordinatorTest {
     assertThat(fixture.cleared).isEmpty()
   }
 
+  /**
+   * An owner that leaves must not leave its nav data behind on the shared scope.
+   *
+   * The coordinator records which owner last published nav data. Each handoff uses that record to
+   * clear the previous owner's screen and back stack, then publishes the incoming owner's. If the
+   * clear attempt throws, the coordinator must still record the incoming owner as the one that last
+   * published.
+   *
+   * This test runs two handoffs over three owners. The first owner publishes; the second takes the
+   * lease; and then the first owner's clear attempt throws. The third then takes the lease. The
+   * test verifies that third handoff clears the second owner's data, and not the first's. That lets
+   * us ensure the second problem listed below doesn't happen.
+   *
+   * In the setup above, if the coordinator didn't record the second owner's data after the first
+   * owner's clear attempt threw, two things would happen when handing off to the third owner:
+   *
+   * 1. Harmless: The handoff logic would try to clear the first owner's data again. That'd remove
+   *    nothing because the scope no longer holds the values the first owner published.
+   * 2. Problematic: The handoff would never clear the second owner's data. Instead, the second
+   *    owner's data would stay on the scope, so later events would report stale nav data.
+   */
+  @Test
+  fun `if a clear attempt throws during a handoff, the next handoff clears the new leaseholder's nav data`() {
+    val fixture = Fixture.create()
+    val navLeaseCoordinator = fixture.navLeaseCoordinator
+    val failure = IllegalStateException("clear failed")
+    var failClear = true
+    val firstOwner = previous
+    val secondOwner = incoming
+    val thirdOwner = owner
+    fixture.acquireLease(
+      firstOwner,
+      onClearPublishedData = {
+        if (failClear) {
+          failClear = false
+          throw failure
+        }
+        fixture.cleared += firstOwner
+      },
+    )
+    fixture.register(secondOwner, Lifecycle.State.RESUMED)
+
+    val thrown =
+      assertThrows(IllegalStateException::class.java) {
+        navLeaseCoordinator.onBackStackUpdate(secondOwner, fixture.scope)
+      }
+
+    assertThat(thrown).isSameInstanceAs(failure)
+    assertThat(navLeaseCoordinator.hasLease(secondOwner)).isTrue()
+
+    fixture.acquireLease(thirdOwner)
+
+    assertThat(fixture.cleared).containsExactly(secondOwner)
+  }
+
+  /**
+   * The same guarantee as
+   * [if a clear attempt throws during a handoff, the next handoff clears the new leaseholder's nav data],
+   * but for a failure while publishing instead of while clearing.
+   *
+   * This case already worked before the fix, because the coordinator records the incoming owner
+   * before it publishes. The test exists to catch a future change that moves the record after the
+   * publish.
+   */
+  @Test
+  fun `if a publish attempt throws during a handoff, the next handoff clears the new leaseholder's nav data`() {
+    val fixture = Fixture.create()
+    val navLeaseCoordinator = fixture.navLeaseCoordinator
+    val failure = IllegalStateException("publish failed")
+    val firstOwner = previous
+    val secondOwner = incoming
+    val thirdOwner = owner
+    fixture.acquireLease(firstOwner)
+    navLeaseCoordinator.registerCandidate(
+      secondOwner,
+      Lifecycle.State.RESUMED,
+      onPublishData = { throw failure },
+      onClearPublishedData = { fixture.cleared += secondOwner },
+    )
+
+    val thrown =
+      assertThrows(IllegalStateException::class.java) {
+        navLeaseCoordinator.onBackStackUpdate(secondOwner, fixture.scope)
+      }
+
+    assertThat(thrown).isSameInstanceAs(failure)
+    assertThat(navLeaseCoordinator.hasLease(secondOwner)).isTrue()
+
+    fixture.acquireLease(thirdOwner)
+
+    assertThat(fixture.cleared).containsExactly(firstOwner, secondOwner).inOrder()
+  }
+
+  @Test
+  fun `unregistering an owner that threw while clearing its nav data preserves the new leaseholder's nav data`() {
+    val fixture = Fixture.create()
+    val navLeaseCoordinator = fixture.navLeaseCoordinator
+    val failure = IllegalStateException("clear failed")
+    var failClear = true
+    fixture.acquireLease(
+      previous,
+      onClearPublishedData = {
+        if (failClear) {
+          failClear = false
+          throw failure
+        }
+        fixture.cleared += previous
+      },
+    )
+    fixture.register(incoming, Lifecycle.State.RESUMED)
+    assertThrows(IllegalStateException::class.java) {
+      navLeaseCoordinator.onBackStackUpdate(incoming, fixture.scope)
+    }
+
+    navLeaseCoordinator.unregisterCandidate(previous, fixture.scope)
+
+    assertThat(navLeaseCoordinator.hasLease(incoming)).isTrue()
+    assertThat(fixture.cleared).isEmpty()
+  }
+
   @Test
   fun `later back stack updates do not republish nav data or reclaim the nav lease`() {
     val fixture = Fixture.create()