Route the handoff return through reconfigure()

Returning from a handoff installed margins by hand, which skipped two things
reconfigure() already does.

It never rebound the adapter. In the shrink-then-handoff-then-grow sequence the
shrink had cleared it, so the terminal came back reserved while callers held the
plain backend: display.output reported 24 rows with row 24 reserved, and erases
through it were unbounded ED over the reserved row -- the exact destruction the
bounded erase exists to prevent.

It also never re-checked backend capability. A refused acquisition still holds a
lease, so the handoff flag can be set for a backend that was never eligible; a
DummyOutput that had just been refused received ESC[1;39r and reported itself
reserved on return. That bypassed the compatibility protection for legacy Win32
and unknown backends too.

Coming back is an ordinary reconfiguration, so it now goes through that one path:
capability re-checked, geometry measured afresh, margins installed only if the
result is eligible, adapter rebound. Reverting it fails three of the new tests.

Author: tleonhardt

cmd2/terminal_display.py

@@ -371,8 +371,10 @@ def _teardown(self) -> None:
     def reconfigure(self) -> bool:
         """Resample the terminal and re-establish the reservation for the new geometry.
 
-        Used after a resize. A terminal that has shrunk below the floor releases rather than
-        narrowing, and one that has grown back above it reacquires.
+        Used after a resize, and on the way back from a handoff. A terminal that has shrunk
+        below the floor releases rather than narrowing, and one that has grown back above it
+        reacquires. An unqualified backend never installs anything: a refused acquisition
+        still holds a lease, so capability is re-checked here rather than assumed settled.
 
         :return: whether a reservation is installed after this call
         """
@@ -428,15 +430,12 @@ def reacquire_region_after_handoff(self) -> None:
         if not self._handoff_active or self._depth == 0:
             return
         self._handoff_active = False
-        geometry = self._measure()
-        if not geometry.is_eligible:
-            # The terminal shrank while the guest had it. Nothing is installed, so callers
-            # go back to the plain backend -- which they do by way of the geometry check in
-            # `output`, rather than by unbinding the adapter here, so that a terminal which
-            # grows again reuses the same object.
-            return
-        self._terminal.install_region(geometry)
-        self._geometry = geometry
+        # Coming back is an ordinary reconfiguration, so it goes through the one path that
+        # does the whole job: re-check backend capability, measure, install only if the
+        # result is eligible, and rebind the adapter. Reinstalling margins here directly
+        # would leave a reserved terminal whose callers still hold the plain backend, and
+        # therefore unbounded erases running over the reserved row.
+        self.reconfigure()
 
     def revalidate_viewport(self) -> bool:
         """Re-check the viewport origin and rebuild the region if it moved.

tests/test_terminal_display.py

@@ -700,3 +700,57 @@ def test_a_handoff_without_a_lease_is_not_recorded(self) -> None:
         display.release_region_for_handoff()
         assert display.acquire()
         assert display.is_reserved
+
+
+class TestHandoffReturnRestoresEverything:
+    """Coming back is an ordinary reconfiguration. Installing margins without rebinding the
+    adapter leaves a reserved terminal whose callers hold the plain backend -- and therefore
+    unbounded erases running over the reserved row."""
+
+    def test_the_adapter_is_rebound_when_the_region_comes_back(self) -> None:
+        output, _stream, screen = make_resizable_output(rows=24, columns=80)
+        display = TerminalDisplay(output)
+        display.acquire()
+        adapter = display.output
+        screen.rows = 2
+        display.reconfigure()
+        adapter.enter_alternate_screen()
+        screen.rows = 24
+        adapter.quit_alternate_screen()
+
+        assert display.is_reserved
+        assert isinstance(display.output, ReservedOutput), "callers were left on the backend"
+        assert display.output.get_size() == Size(rows=23, columns=80)
+
+    def test_erases_through_the_returned_output_are_bounded(self) -> None:
+        """The failure this guards against destroys the reserved row outright."""
+        output, stream, screen = make_resizable_output(rows=24, columns=80)
+        display = TerminalDisplay(output)
+        display.acquire()
+        adapter = display.output
+        screen.rows = 2
+        display.reconfigure()
+        adapter.enter_alternate_screen()
+        screen.rows = 24
+        adapter.quit_alternate_screen()
+
+        display.output.flush()
+        stream.truncate(0), stream.seek(0)
+        display.output.erase_down()
+        display.output.flush()
+        assert stream.getvalue() == "\x1b[23M"
+        assert "\x1b[J" not in stream.getvalue()
+
+    def test_an_unqualified_backend_is_still_unqualified_after_a_handoff(self) -> None:
+        """A refused acquisition still holds a lease, so the handoff flag can be set for a
+        backend that was never eligible. Capability has to be re-checked, not assumed."""
+        display = TerminalDisplay(DummyOutput())
+        assert not display.acquire()
+        assert display.lease_depth == 1
+
+        display.release_region_for_handoff()
+        display.reacquire_region_after_handoff()
+
+        assert not display.is_reserved
+        assert display.geometry is None
+        assert display.output is display.terminal.output