fix: prune per-monitor windows on monitor removal (v0.6.15)

Resume-unlock SIGSEGV: connect_monitor only adds windows to all_handles,
never removes them when a monitor powers off on suspend. gtk4-session-lock
unmaps and drops its own ref, but the GtkApplication and all_handles keep
theirs, so the orphaned window survives until unlock — where destroying it
dereferences its now-NULL monitor association and crashes.

Watch display.monitors() and prune handles whose monitor is no longer
valid, releasing the app ref via remove_window (the lib already unmapped
and dereffed the window — we must not destroy it ourselves).

Revert the earlier idle_add_local_once deferral: the logs proved it
ineffective (crash happens inside the idle trampoline). Diagnostic unlock
logging kept until a suspend/resume cycle confirms the fix.

src/main.rs

@@ -59,7 +59,7 @@ fn activate(app: &gtk::Application) {
 
 fn activate_with_session_lock(
     app: &gtk::Application,
-    _display: &gdk::Display,
+    display: &gdk::Display,
     config: &config::Config,
 ) {
     let lock = gtk4_session_lock::Instance::new();
@@ -72,18 +72,39 @@ fn activate_with_session_lock(
             .and_then(|path| lockscreen::load_background_texture(&path)),
     );
 
+    // Shared handles list — populated by connect_monitor, read by fingerprint init.
+    // Declared before unlock_callback so the callback can inspect window state on unlock.
+    let all_handles: Rc<RefCell<Vec<lockscreen::LockscreenHandles>>> =
+        Rc::new(RefCell::new(Vec::new()));
+
     // Shared unlock callback — unlocks session and quits.
     // Guard prevents double-unlock if PAM and fingerprint succeed simultaneously.
     let lock_clone = lock.clone();
     let app_clone = app.clone();
     let already_unlocked = Rc::new(Cell::new(false));
     let au = already_unlocked.clone();
+    let all_handles_dbg = all_handles.clone();
     let unlock_callback: Rc<dyn Fn()> = Rc::new(move || {
         if au.get() {
             log::debug!("Unlock already triggered, ignoring duplicate");
             return;
         }
         au.set(true);
+        // DIAGNOSTIC: log lock-window state at unlock to confirm whether a stale
+        // window (unrealized / dead surface) remains in all_handles after a monitor
+        // power-off/resume. Remove once the resume-unlock crash is fixed.
+        {
+            let handles = all_handles_dbg.borrow();
+            log::info!("UNLOCK: {} window(s) in all_handles", handles.len());
+            for (i, h) in handles.iter().enumerate() {
+                log::info!(
+                    "UNLOCK:   window[{i}] realized={} mapped={} visible={}",
+                    h.window.is_realized(),
+                    h.window.is_mapped(),
+                    h.window.is_visible(),
+                );
+            }
+        }
         lock_clone.unlock();
         app_clone.quit();
     });
@@ -95,10 +116,6 @@ fn activate_with_session_lock(
     // Shared config for use in the monitor signal handler
     let config = Rc::new(config.clone());
 
-    // Shared handles list — populated by connect_monitor, read by fingerprint init
-    let all_handles: Rc<RefCell<Vec<lockscreen::LockscreenHandles>>> =
-        Rc::new(RefCell::new(Vec::new()));
-
     // Shared fingerprint listener — None until async init completes.
     // The monitor handler checks this to wire up FP labels on hotplugged monitors.
     let shared_fp: Rc<RefCell<Option<Rc<RefCell<FingerprintListener>>>>> =
@@ -127,7 +144,7 @@ fn activate_with_session_lock(
         shared_fp,
         move |_instance, monitor| {
             log::debug!("Monitor signal: creating lockscreen window");
-            let handles = lockscreen::create_lockscreen_window(
+            let mut handles = lockscreen::create_lockscreen_window(
                 bg_texture.as_ref().as_ref(),
                 &config,
                 &app,
@@ -137,6 +154,7 @@ fn activate_with_session_lock(
             );
             lock_for_signal.assign_window_to_monitor(&handles.window, monitor);
             handles.window.present();
+            handles.monitor = Some(monitor.clone());
 
             // If fingerprint is already initialized, wire up the label
             if let Some(ref fp_rc) = *shared_fp.borrow() {
@@ -147,6 +165,31 @@ fn activate_with_session_lock(
         }
     ));
 
+    // connect_monitor only ADDS — it never tells us when a monitor powers off on
+    // suspend. gtk4-session-lock then unmaps and drops its own ref to that monitor's
+    // window, but the GtkApplication and all_handles still hold refs, so the orphaned
+    // window survives until unlock — where gtk_window_destroy dereferences its now-NULL
+    // monitor association and segfaults. Watch the display's monitor list and prune any
+    // window whose monitor is no longer valid, releasing our refs (the lib doc points to
+    // "GTK APIs" for exactly this). We release refs, not destroy — the lib already
+    // unmapped+dereffed the window.
+    display.monitors().connect_items_changed(glib::clone!(
+        #[weak]
+        app,
+        #[strong]
+        all_handles,
+        move |_, _, _, _| {
+            all_handles.borrow_mut().retain(|h| {
+                let alive = h.monitor.as_ref().is_none_or(gdk::Monitor::is_valid);
+                if !alive {
+                    log::info!("Monitor removed — pruning its lockscreen window");
+                    app.remove_window(&h.window);
+                }
+                alive
+            });
+        }
+    ));
+
     lock.lock();
 
     // Async fprintd initialization — runs after windows are visible