topo_recovery_callback: detach cb on UP handoff and close handle on DOWN/TIMEOUT so no handle with cb_arg==ctx outlives ctx (ASAN heap-buffer-overflow in topo_recovery_callback). tgi_to_channel_cb: force_close handle on NCD_EVENT_TIMEOUT so a late UP cannot fire into the freed tgi_conn_ctx. Also: android chatgui reverseLayout scroll + msg order/stable pagination.