fix(iOS): harden moreNavigationController push interceptor

- Clear OBJC_ASSOCIATION_ASSIGN back-reference in dealloc to avoid
  potential dangling pointer if moreNavigationController ever outlives
  the tab bar controller.
- Derive dynamic subclass name from runtime class of
  moreNavigationController (e.g. RNS_UIMoreNavigationController)
  instead of using a static name, so each distinct original class
  gets its own correct subclass.
- Move experimental_controlNavigationStateInJS check above
  preventNativeSelection to avoid firing onTabSelectionPrevented
  for the experimental controlled-mode path.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: kkafar

ios/tabs/host/RNSTabBarController.mm

@@ -70,6 +70,10 @@ @implementation RNSTabBarController {
 
   RNSTabsNavigationState *_Nullable _pendingOperation;
 
+#if RNS_MORE_NAVIGATION_CONTROLLER_AVAILABLE
+  BOOL _didInstallPushInterceptor;
+#endif // RNS_MORE_NAVIGATION_CONTROLLER_AVAILABLE
+
 #if !RCT_NEW_ARCH_ENABLED
   BOOL _isControllerFlushBlockScheduled;
 #endif // !RCT_NEW_ARCH_ENABLED
@@ -102,6 +106,19 @@ - (instancetype)initWithTabsHostComponentView:(nullable RNSTabsHostComponentView
   return self;
 }
 
+- (void)dealloc
+{
+#if RNS_MORE_NAVIGATION_CONTROLLER_AVAILABLE
+  // Clear the OBJC_ASSOCIATION_ASSIGN back-reference to self stored on moreNavigationController.
+  // This is a safety measure — moreNavigationController should never outlive us, but if it ever does
+  // (e.g. due to UIKit lifecycle changes), we avoid leaving a dangling pointer behind.
+  if (_didInstallPushInterceptor) {
+    objc_setAssociatedObject(
+        self.moreNavigationController, kRNSTabBarControllerAssociationKey, nil, OBJC_ASSOCIATION_ASSIGN);
+  }
+#endif // RNS_MORE_NAVIGATION_CONTROLLER_AVAILABLE
+}
+
 #pragma mark - UIKit callbacks
 
 - (void)didMoveToParentViewController:(UIViewController *)parent
@@ -278,11 +295,6 @@ - (void)onDidPreventUserFromSelectingViewControllerWithKey:(nonnull NSString *)s
 
 - (BOOL)shouldPreventNativeTabSelection:(nonnull UIViewController *)nextViewController
 {
-  // This handles the tabsHostComponentView nullability
-  if ([self.tabsHostComponentView experimental_controlNavigationStateInJS]) {
-    return YES;
-  }
-
   if (![nextViewController isKindOfClass:RNSTabsScreenViewController.class]) {
     // Allow for more view controller selection
     return NO;
@@ -324,6 +336,13 @@ - (BOOL)tabBarController:(UITabBarController *)tabBarController
     return NO;
   }
 
+  // This handles the tabsHostComponentView nullability
+  // TODO: This if is likely to be removed, since we want to roll back the support
+  // for "controlled mode", at least initially.
+  if ([self.tabsHostComponentView experimental_controlNavigationStateInJS]) {
+    return NO;
+  }
+
   BOOL shouldPreventTabSelection = [self shouldPreventNativeTabSelection:viewController];
 
   if (shouldPreventTabSelection) {
@@ -729,17 +748,30 @@ - (void)setupMoreNavigationControllerDelegateIfNeeded
 
 /// Creates a dynamic subclass of the runtime class of `moreNavigationController`
 /// (which is the private `UIMoreNavigationController`) and overrides `pushViewController:animated:`
-/// with our gating implementation. The dynamic subclass is created once and reused.
+/// with our gating implementation.
+///
+/// The subclass name is derived from the actual runtime class of `moreNavigationController`
+/// (e.g. `RNS_UIMoreNavigationController`), so if another library ISA-swizzles it first or Apple
+/// changes the private class, each distinct original class gets its own correct dynamic subclass.
 - (void)installPushInterceptorOnMoreNavigationController
 {
 #if RNS_MORE_NAVIGATION_CONTROLLER_AVAILABLE
-  static const char *kDynamicSubclassName = "RNS_UIMoreNavigationController";
-  Class dynamicSubclass = objc_getClass(kDynamicSubclassName);
+  RCTAssert(
+      _didInstallPushInterceptor == NO,
+      @"[RNScreens] installPushInterceptorOnMoreNavigationController MUST NOT be called twice");
+
+  Class originalClass = object_getClass(self.moreNavigationController);
+  const char *originalClassName = class_getName(originalClass);
+
+  // Build a unique subclass name per original runtime class: "RNS_<originalClassName>"
+  char dynamicSubclassName[256];
+  snprintf(dynamicSubclassName, sizeof(dynamicSubclassName), "RNS_%s", originalClassName);
+
+  Class dynamicSubclass = objc_getClass(dynamicSubclassName);
 
   if (dynamicSubclass == nil) {
-    Class originalClass = object_getClass(self.moreNavigationController);
-    dynamicSubclass = objc_allocateClassPair(originalClass, kDynamicSubclassName, 0);
-    RCTAssert(dynamicSubclass != nil, @"[RNScreens] Failed to allocate dynamic subclass of %@", originalClass);
+    dynamicSubclass = objc_allocateClassPair(originalClass, dynamicSubclassName, 0);
+    RCTAssert(dynamicSubclass != nil, @"[RNScreens] Failed to allocate dynamic subclass of %s", originalClassName);
 
     Method pushMethod = class_getInstanceMethod(originalClass, @selector(pushViewController:animated:));
     class_addMethod(
@@ -757,6 +789,7 @@ - (void)installPushInterceptorOnMoreNavigationController
   // OBJC_ASSOCIATION_ASSIGN: no retain cycle — self owns moreNavigationController and outlives it.
   objc_setAssociatedObject(
       self.moreNavigationController, kRNSTabBarControllerAssociationKey, self, OBJC_ASSOCIATION_ASSIGN);
+  _didInstallPushInterceptor = YES;
 #endif // RNS_MORE_NAVIGATION_CONTROLLER_AVAILABLE
 }