CLAUDE.md

@@ -19,7 +19,7 @@ Teil des Moonarch-Ökosystems.
 ## Projektstruktur
 
 - `src/` — Rust-Quellcode (main.rs, lockscreen.rs, auth.rs, fingerprint.rs, config.rs, i18n.rs, users.rs, power.rs)
-- `resources/` — GResource-Assets (style.css, default-avatar.svg)
+- `resources/` — GResource-Assets (style.css, wallpaper.jpg, default-avatar.svg)
 - `config/` — PAM-Konfiguration und Beispiel-Config
 
 ## Kommandos
@@ -38,24 +38,22 @@ LD_PRELOAD=/usr/lib/libgtk4-layer-shell.so ./target/release/moonlock
 ## Architektur
 
 - `auth.rs` — PAM-Authentifizierung via Raw FFI (unsafe extern "C" conv callback, msg_style-aware, Zeroizing<Vec<u8>>)
-- `fingerprint.rs` — fprintd D-Bus Listener, async init/claim/verify via gio futures, sender-validated signal handler, cleanup_dbus() für sauberen D-Bus-Lifecycle, running_flag für Race-Safety in async restarts, on_exhausted callback after MAX_FP_ATTEMPTS
+- `fingerprint.rs` — fprintd D-Bus Listener, async init/claim/verify via gio futures, async fire-and-forget stop, on_exhausted callback after MAX_FP_ATTEMPTS
 - `users.rs` — Aktuellen User via nix getuid, Avatar-Loading mit Symlink-Rejection
 - `power.rs` — Reboot/Shutdown via /usr/bin/systemctl
 - `i18n.rs` — Locale-Erkennung (OnceLock-cached) und String-Tabellen (DE/EN), faillock_warning mit konfigurierbarem max_attempts
-- `config.rs` — TOML-Config (background_path, background_blur, fingerprint_enabled als Option<bool>) + Wallpaper-Fallback + Symlink-Rejection für background_path + Parse-Error-Logging
-- `lockscreen.rs` — GTK4 UI via LockscreenHandles, PAM-Auth via gio::spawn_blocking, FP-Label/Start separat verdrahtet, Zeroizing<String> für Passwort, Power-Confirm, GPU-Blur via GskBlurNode, Blur/Avatar-Cache für Multi-Monitor
-- `main.rs` — Entry Point, Panic-Hook (vor Logging), Root-Check, ext-session-lock-v1 (Pflicht in Release), Multi-Monitor mit shared Blur/Avatar-Caches, systemd-Journal-Logging, Debug-Level per `MOONLOCK_DEBUG` Env-Var, async fprintd-Init nach window.present()
+- `config.rs` — TOML-Config (background_path, background_blur, fingerprint_enabled als Option<bool>) + Wallpaper-Fallback
+- `lockscreen.rs` — GTK4 UI via LockscreenHandles, PAM-Auth via gio::spawn_blocking, FP-Label/Start separat verdrahtet, Zeroizing<String> für Passwort, Power-Confirm, GPU-Blur via GskBlurNode
+- `main.rs` — Entry Point, Panic-Hook, Root-Check, ext-session-lock-v1 (Pflicht in Release), Multi-Monitor, systemd-Journal-Logging, async fprintd-Init nach window.present()
 
 ## Sicherheit
 
 - ext-session-lock-v1 garantiert: Compositor sperrt alle Surfaces bei lock()
 - Release-Build: Ohne ext-session-lock-v1 wird `exit(1)` aufgerufen — kein Fenster-Fallback
-- Panic-Hook: Bei Crash wird geloggt, aber NIEMALS unlock() aufgerufen — Screen bleibt schwarz. Hook wird vor Logging installiert.
-- PAM-Callback: msg_style-aware (Passwort nur bei PAM_PROMPT_ECHO_OFF), strdup-OOM-sicher, num_msg-Guard gegen negative Werte
-- fprintd: D-Bus Signal-Sender wird gegen fprintd's unique bus name validiert (Anti-Spoofing)
+- Panic-Hook: Bei Crash wird geloggt, aber NIEMALS unlock() aufgerufen — Screen bleibt schwarz
+- PAM-Callback: msg_style-aware (Passwort nur bei PAM_PROMPT_ECHO_OFF), strdup-OOM-sicher
 - Passwort: Zeroizing<String> ab GTK-Entry-Extraktion, Zeroizing<Vec<u8>> im PAM-FFI-Layer (bekannte Einschränkung: GLib-GString und CString werden nicht gezeroized — inhärente GTK/libc-Limitierung)
 - Root-Check: Exit mit Fehler wenn als root gestartet
 - Faillock: UI-Warnung nach 3 Fehlversuchen, aber PAM entscheidet über Lockout (Entry bleibt aktiv)
 - Kein Schließen per Escape/Alt-F4 — nur durch erfolgreiche PAM-Auth oder Fingerprint
-- Kein Peek-Icon am Passwortfeld (Shoulder-Surfing-Schutz)
 - GResource-Bundle: CSS/Assets in der Binary kompiliert

Cargo.lock

@@ -575,7 +575,7 @@ dependencies = [
 
 [[package]]
 name = "moonlock"
-version = "0.6.3"
+version = "0.5.0"
 dependencies = [
  "gdk-pixbuf",
  "gdk4",

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "moonlock"
-version = "0.6.3"
+version = "0.5.1"
 edition = "2024"
 description = "A secure Wayland lockscreen with GTK4, PAM and fingerprint support"
 license = "MIT"
@@ -26,8 +26,3 @@ tempfile = "3"
 
 [build-dependencies]
 glib-build-tools = "0.22"
-
-[profile.release]
-lto = "thin"
-codegen-units = 1
-strip = true

DECISIONS.md

@@ -2,20 +2,6 @@
 
 Architectural and design decisions for Moonlock, in reverse chronological order.
 
-## 2026-03-28 – Remove embedded wallpaper from binary
-
-- **Who**: Nyx, Dom
-- **Why**: Wallpaper is installed by moonarch to /usr/share/moonarch/wallpaper.jpg. Embedding a 374K JPEG in the binary is redundant. GTK background color (Catppuccin Mocha base) is a clean fallback.
-- **Tradeoffs**: Without moonarch installed AND without config, lockscreen shows plain dark background instead of wallpaper. Acceptable — that's the expected minimal state.
-- **How**: Remove wallpaper.jpg from GResources, return None from resolve_background_path when no file found, skip background picture creation when no texture available.
-
-## 2026-03-28 – Audit-driven security and lifecycle fixes (v0.6.0)
-
-- **Who**: Nyx, Dom
-- **Why**: Triple audit (quality, performance, security) revealed a critical D-Bus signal spoofing vector, fingerprint lifecycle bugs, and multi-monitor performance issues.
-- **Tradeoffs**: `cleanup_dbus()` extraction adds a method but clarifies the stop/match ownership; `running_flag: Rc<Cell<bool>>` adds a field but prevents race between async restart and stop; sender validation adds a check per signal but closes the only known auth bypass.
-- **How**: (1) Validate D-Bus VerifyStatus sender against fprintd's unique bus name. (2) Extract `cleanup_dbus()` from `stop()`, call it on verify-match. (3) `Rc<Cell<bool>>` running flag checked after await in `restart_verify_async`. (4) Consistent 3s D-Bus timeouts. (5) Panic hook before logging. (6) Blur and avatar caches shared across monitors. (7) Peek icon disabled. (8) Symlink rejection for background_path. (9) TOML parse errors logged.
-
 ## 2026-03-28 – GPU blur via GskBlurNode replaces CPU blur
 
 - **Who**: Nyx, Dom

resources/resources.gresource.xml

@@ -2,6 +2,7 @@
 <gresources>
   <gresource prefix="/dev/moonarch/moonlock">
     <file>style.css</file>
+    <file>wallpaper.jpg</file>
     <file>default-avatar.svg</file>
   </gresource>
 </gresources>

src/auth.rs

@@ -71,10 +71,6 @@ unsafe extern "C" fn pam_conv_callback(
     appdata_ptr: *mut libc::c_void,
 ) -> libc::c_int {
     unsafe {
-        if num_msg <= 0 {
-            return PAM_AUTH_ERR;
-        }
-
         // Safety: appdata_ptr was set to a valid *const CString in authenticate()
         let password = appdata_ptr as *const CString;
         if password.is_null() {

src/config.rs

@@ -6,6 +6,7 @@ use std::fs;
 use std::path::{Path, PathBuf};
 
 const MOONARCH_WALLPAPER: &str = "/usr/share/moonarch/wallpaper.jpg";
+const GRESOURCE_PREFIX: &str = "/dev/moonarch/moonlock";
 
 fn default_config_paths() -> Vec<PathBuf> {
     let mut paths = vec![PathBuf::from("/etc/moonlock/moonlock.toml")];
@@ -48,32 +49,27 @@ pub fn load_config(config_paths: Option<&[PathBuf]>) -> Config {
     let mut merged = Config::default();
     for path in paths {
         if let Ok(content) = fs::read_to_string(path) {
-            match toml::from_str::<RawConfig>(&content) {
-                Ok(parsed) => {
-                    if parsed.background_path.is_some() { merged.background_path = parsed.background_path; }
-                    if parsed.background_blur.is_some() { merged.background_blur = parsed.background_blur; }
-                    if let Some(fp) = parsed.fingerprint_enabled { merged.fingerprint_enabled = fp; }
-                }
-                Err(e) => {
-                    log::warn!("Failed to parse {}: {e}", path.display());
-                }
+            if let Ok(parsed) = toml::from_str::<RawConfig>(&content) {
+                if parsed.background_path.is_some() { merged.background_path = parsed.background_path; }
+                if parsed.background_blur.is_some() { merged.background_blur = parsed.background_blur; }
+                if let Some(fp) = parsed.fingerprint_enabled { merged.fingerprint_enabled = fp; }
             }
         }
     }
     merged
 }
 
-pub fn resolve_background_path(config: &Config) -> Option<PathBuf> {
+pub fn resolve_background_path(config: &Config) -> PathBuf {
     resolve_background_path_with(config, Path::new(MOONARCH_WALLPAPER))
 }
 
-pub fn resolve_background_path_with(config: &Config, moonarch_wallpaper: &Path) -> Option<PathBuf> {
+pub fn resolve_background_path_with(config: &Config, moonarch_wallpaper: &Path) -> PathBuf {
     if let Some(ref bg) = config.background_path {
         let path = PathBuf::from(bg);
-        if path.is_file() && !path.is_symlink() { return Some(path); }
+        if path.is_file() { return path; }
     }
-    if moonarch_wallpaper.is_file() { return Some(moonarch_wallpaper.to_path_buf()); }
-    None
+    if moonarch_wallpaper.is_file() { return moonarch_wallpaper.to_path_buf(); }
+    PathBuf::from(format!("{GRESOURCE_PREFIX}/wallpaper.jpg"))
 }
 
 #[cfg(test)]
@@ -108,7 +104,7 @@ mod tests {
         let dir = tempfile::tempdir().unwrap();
         let wp = dir.path().join("bg.jpg"); fs::write(&wp, "fake").unwrap();
         let c = Config { background_path: Some(wp.to_str().unwrap().to_string()), ..Config::default() };
-        assert_eq!(resolve_background_path_with(&c, Path::new("/nonexistent")), Some(wp));
+        assert_eq!(resolve_background_path_with(&c, Path::new("/nonexistent")), wp);
     }
     #[test] fn empty_user_config_preserves_system_fingerprint() {
         let dir = tempfile::tempdir().unwrap();
@@ -119,29 +115,9 @@ mod tests {
         let c = load_config(Some(&[sys_conf, usr_conf]));
         assert!(!c.fingerprint_enabled);
     }
-    #[test] fn resolve_no_wallpaper_returns_none() {
+    #[test] fn resolve_gresource_fallback() {
         let c = Config::default();
         let r = resolve_background_path_with(&c, Path::new("/nonexistent"));
-        assert!(r.is_none());
-    }
-    #[test] fn toml_parse_error_returns_default() {
-        let dir = tempfile::tempdir().unwrap();
-        let conf = dir.path().join("moonlock.toml");
-        fs::write(&conf, "this is not valid toml {{{{").unwrap();
-        let c = load_config(Some(&[conf]));
-        assert!(c.fingerprint_enabled);
-        assert!(c.background_path.is_none());
-    }
-    #[cfg(unix)]
-    #[test] fn symlink_rejected_for_background() {
-        let dir = tempfile::tempdir().unwrap();
-        let real = dir.path().join("bg.jpg");
-        let link = dir.path().join("link.jpg");
-        fs::write(&real, "fake").unwrap();
-        std::os::unix::fs::symlink(&real, &link).unwrap();
-        let c = Config { background_path: Some(link.to_str().unwrap().to_string()), ..Config::default() };
-        // Symlink should be rejected — falls through to None
-        let r = resolve_background_path_with(&c, Path::new("/nonexistent"));
-        assert!(r.is_none());
+        assert!(r.to_str().unwrap().contains("moonlock"));
     }
 }

src/fingerprint.rs

@@ -3,7 +3,7 @@
 
 use gio::prelude::*;
 use gtk4::gio;
-use std::cell::{Cell, RefCell};
+use std::cell::RefCell;
 use std::rc::Rc;
 
 const FPRINTD_BUS_NAME: &str = "net.reactivated.Fprint";
@@ -12,7 +12,6 @@ const FPRINTD_MANAGER_IFACE: &str = "net.reactivated.Fprint.Manager";
 const FPRINTD_DEVICE_IFACE: &str = "net.reactivated.Fprint.Device";
 
 const MAX_FP_ATTEMPTS: u32 = 10;
-const DBUS_TIMEOUT_MS: i32 = 3000;
 
 /// Retry-able statuses — finger not read properly, try again.
 const RETRY_STATUSES: &[&str] = &[
@@ -27,8 +26,6 @@ pub struct FingerprintListener {
     device_proxy: Option<gio::DBusProxy>,
     signal_id: Option<glib::SignalHandlerId>,
     running: bool,
-    /// Shared flag for async tasks to detect stop() between awaits.
-    running_flag: Rc<Cell<bool>>,
     failed_attempts: u32,
     on_success: Option<Box<dyn Fn() + 'static>>,
     on_failure: Option<Box<dyn Fn() + 'static>>,
@@ -43,7 +40,6 @@ impl FingerprintListener {
             device_proxy: None,
             signal_id: None,
             running: false,
-            running_flag: Rc::new(Cell::new(false)),
             failed_attempts: 0,
             on_success: None,
             on_failure: None,
@@ -72,7 +68,7 @@ impl FingerprintListener {
 
         // Call GetDefaultDevice
         let result = match manager
-            .call_future("GetDefaultDevice", None, gio::DBusCallFlags::NONE, DBUS_TIMEOUT_MS)
+            .call_future("GetDefaultDevice", None, gio::DBusCallFlags::NONE, -1)
             .await
         {
             Ok(r) => r,
@@ -122,7 +118,7 @@ impl FingerprintListener {
 
         let args = glib::Variant::from((&username,));
         match proxy
-            .call_future("ListEnrolledFingers", Some(&args), gio::DBusCallFlags::NONE, DBUS_TIMEOUT_MS)
+            .call_future("ListEnrolledFingers", Some(&args), gio::DBusCallFlags::NONE, -1)
             .await
         {
             Ok(result) => {
@@ -172,7 +168,7 @@ impl FingerprintListener {
         // Claim the device
         let args = glib::Variant::from((&username,));
         if let Err(e) = proxy
-            .call_future("Claim", Some(&args), gio::DBusCallFlags::NONE, DBUS_TIMEOUT_MS)
+            .call_future("Claim", Some(&args), gio::DBusCallFlags::NONE, -1)
             .await
         {
             log::error!("Failed to claim fingerprint device: {e}");
@@ -182,34 +178,20 @@ impl FingerprintListener {
         // Start verification
         let start_args = glib::Variant::from((&"any",));
         if let Err(e) = proxy
-            .call_future("VerifyStart", Some(&start_args), gio::DBusCallFlags::NONE, DBUS_TIMEOUT_MS)
+            .call_future("VerifyStart", Some(&start_args), gio::DBusCallFlags::NONE, -1)
             .await
         {
             log::error!("Failed to start fingerprint verification: {e}");
             let _ = proxy
-                .call_future("Release", None, gio::DBusCallFlags::NONE, DBUS_TIMEOUT_MS)
+                .call_future("Release", None, gio::DBusCallFlags::NONE, -1)
                 .await;
             return;
         }
 
-        // Capture the unique bus name of fprintd for sender validation.
-        // D-Bus signals carry the sender's unique name (e.g. ":1.42"), not the
-        // well-known name. We validate this to prevent signal spoofing.
-        let expected_sender = proxy.name_owner();
-
         // Connect the g-signal handler on the proxy to dispatch VerifyStatus
         let listener_weak = Rc::downgrade(listener);
         let signal_id = proxy.connect_local("g-signal", false, move |values| {
             // g-signal arguments: (proxy, sender_name, signal_name, parameters)
-            let sender: String = match values[1].get() {
-                Ok(s) => s,
-                Err(_) => return None,
-            };
-            if expected_sender.as_ref().map(|s| s.as_str()) != Some(sender.as_str()) {
-                log::warn!("Ignoring D-Bus signal from unexpected sender: {sender}");
-                return None;
-            }
-
             let signal_name: String = match values[2].get() {
                 Ok(v) => v,
                 Err(_) => return None,
@@ -242,7 +224,6 @@ impl FingerprintListener {
         let mut inner = listener.borrow_mut();
         inner.signal_id = Some(signal_id);
         inner.running = true;
-        inner.running_flag.set(true);
     }
 
     /// Process a VerifyStatus signal from fprintd.
@@ -252,7 +233,7 @@ impl FingerprintListener {
         }
 
         if status == "verify-match" {
-            self.cleanup_dbus();
+            self.running = false;
             if let Some(ref cb) = self.on_success {
                 cb();
             }
@@ -289,22 +270,17 @@ impl FingerprintListener {
     }
 
     /// Restart fingerprint verification asynchronously after a completed attempt.
-    /// Checks running_flag after VerifyStop to avoid restarting on a released device.
     fn restart_verify_async(&self) {
         if let Some(ref proxy) = self.device_proxy {
             let proxy = proxy.clone();
-            let running = self.running_flag.clone();
             glib::spawn_future_local(async move {
                 // VerifyStop before VerifyStart to avoid D-Bus errors
                 let _ = proxy
-                    .call_future("VerifyStop", None, gio::DBusCallFlags::NONE, DBUS_TIMEOUT_MS)
+                    .call_future("VerifyStop", None, gio::DBusCallFlags::NONE, -1)
                     .await;
-                if !running.get() {
-                    return;
-                }
                 let args = glib::Variant::from((&"any",));
                 if let Err(e) = proxy
-                    .call_future("VerifyStart", Some(&args), gio::DBusCallFlags::NONE, DBUS_TIMEOUT_MS)
+                    .call_future("VerifyStart", Some(&args), gio::DBusCallFlags::NONE, -1)
                     .await
                 {
                     log::error!("Failed to restart fingerprint verification: {e}");
@@ -313,12 +289,14 @@ impl FingerprintListener {
         }
     }
 
-    /// Disconnect the signal handler and send VerifyStop + Release to fprintd.
+    /// Stop listening and release the device.
     /// Signal disconnect is synchronous to prevent further callbacks.
-    /// D-Bus cleanup is fire-and-forget to avoid blocking the UI.
-    fn cleanup_dbus(&mut self) {
+    /// D-Bus cleanup (VerifyStop + Release) is fire-and-forget to avoid blocking the UI.
+    pub fn stop(&mut self) {
+        if !self.running {
+            return;
+        }
         self.running = false;
-        self.running_flag.set(false);
 
         if let Some(ref proxy) = self.device_proxy {
             if let Some(id) = self.signal_id.take() {
@@ -327,23 +305,15 @@ impl FingerprintListener {
             let proxy = proxy.clone();
             glib::spawn_future_local(async move {
                 let _ = proxy
-                    .call_future("VerifyStop", None, gio::DBusCallFlags::NONE, DBUS_TIMEOUT_MS)
+                    .call_future("VerifyStop", None, gio::DBusCallFlags::NONE, 3000)
                     .await;
                 let _ = proxy
-                    .call_future("Release", None, gio::DBusCallFlags::NONE, DBUS_TIMEOUT_MS)
+                    .call_future("Release", None, gio::DBusCallFlags::NONE, 3000)
                     .await;
             });
         }
     }
 
-    /// Stop listening and release the device. Idempotent — safe to call multiple times.
-    pub fn stop(&mut self) {
-        if !self.running {
-            return;
-        }
-        self.cleanup_dbus();
-    }
-
 }
 
 #[cfg(test)]
@@ -365,21 +335,21 @@ mod tests {
 
     #[test]
     fn verify_match_sets_running_false_and_calls_success() {
+        use std::cell::Cell;
         let called = Rc::new(Cell::new(false));
         let called_clone = called.clone();
         let mut listener = FingerprintListener::new();
         listener.running = true;
-        listener.running_flag.set(true);
         listener.on_success = Some(Box::new(move || { called_clone.set(true); }));
 
         listener.on_verify_status("verify-match", false);
         assert!(called.get());
         assert!(!listener.running);
-        assert!(!listener.running_flag.get());
     }
 
     #[test]
     fn verify_no_match_calls_failure_and_stays_running() {
+        use std::cell::Cell;
         let called = Rc::new(Cell::new(false));
         let called_clone = called.clone();
         let mut listener = FingerprintListener::new();
@@ -394,6 +364,7 @@ mod tests {
 
     #[test]
     fn max_attempts_stops_listener_and_calls_exhausted() {
+        use std::cell::Cell;
         let exhausted = Rc::new(Cell::new(false));
         let exhausted_clone = exhausted.clone();
         let mut listener = FingerprintListener::new();
@@ -411,6 +382,7 @@ mod tests {
 
     #[test]
     fn not_running_ignores_signals() {
+        use std::cell::Cell;
         let called = Rc::new(Cell::new(false));
         let called_clone = called.clone();
         let mut listener = FingerprintListener::new();

src/lockscreen.rs

@@ -41,15 +41,11 @@ struct LockscreenState {
 
 /// Create a lockscreen window for a single monitor.
 /// Fingerprint is not initialized here — use `wire_fingerprint()` after async init.
-/// The `blur_cache` and `avatar_cache` are shared across monitors for multi-monitor
-/// setups, avoiding redundant GPU renders and SVG rasterizations.
 pub fn create_lockscreen_window(
-    bg_texture: Option<&gdk::Texture>,
+    bg_texture: &gdk::Texture,
     config: &Config,
     app: &gtk::Application,
     unlock_callback: Rc<dyn Fn()>,
-    blur_cache: &Rc<RefCell<Option<gdk::Texture>>>,
-    avatar_cache: &Rc<RefCell<Option<gdk::Texture>>>,
 ) -> LockscreenHandles {
     let window = gtk::ApplicationWindow::builder()
         .application(app)
@@ -86,11 +82,9 @@ pub fn create_lockscreen_window(
     let overlay = gtk::Overlay::new();
     window.set_child(Some(&overlay));
 
-    // Background wallpaper (if available — otherwise GTK background color shows through)
-    if let Some(texture) = bg_texture {
-        let background = create_background_picture(texture, config.background_blur, blur_cache);
-        overlay.set_child(Some(&background));
-    }
+    // Background wallpaper
+    let background = create_background_picture(bg_texture, config.background_blur);
+    overlay.set_child(Some(&background));
 
     // Centered vertical box
     let main_box = gtk::Box::new(gtk::Orientation::Vertical, 0);
@@ -115,17 +109,12 @@ pub fn create_lockscreen_window(
     avatar_frame.append(&avatar_image);
     login_box.append(&avatar_frame);
 
-    // Load avatar — use shared cache to avoid redundant loading on multi-monitor setups.
-    // The cache is populated by the first monitor and reused by subsequent ones.
-    if let Some(ref cached) = *avatar_cache.borrow() {
-        avatar_image.set_paintable(Some(cached));
+    // Load avatar
+    let avatar_path = users::get_avatar_path(&user.home, &user.username);
+    if let Some(path) = avatar_path {
+        set_avatar_from_file(&avatar_image, &path);
     } else {
-        let avatar_path = users::get_avatar_path(&user.home, &user.username);
-        if let Some(path) = avatar_path {
-            set_avatar_from_file(&avatar_image, &path, avatar_cache);
-        } else {
-            set_default_avatar(&avatar_image, &window, avatar_cache);
-        }
+        set_default_avatar(&avatar_image, &window);
     }
 
     // Username label
@@ -136,7 +125,7 @@ pub fn create_lockscreen_window(
     // Password entry
     let password_entry = gtk::PasswordEntry::builder()
         .placeholder_text(strings.password_placeholder)
-        .show_peek_icon(false)
+        .show_peek_icon(true)
         .hexpand(true)
         .build();
     password_entry.add_css_class("password-entry");
@@ -372,18 +361,12 @@ pub fn start_fingerprint(
     let fp_label_fail = handles.fp_label.clone();
     let unlock_cb_fp = handles.unlock_callback.clone();
 
-    let fp_rc_success = fp_rc.clone();
     let on_success = move || {
         let label = fp_label_success.clone();
         let cb = unlock_cb_fp.clone();
-        let fp = fp_rc_success.clone();
         glib::idle_add_local_once(move || {
-            let strings = load_strings(None);
-            label.set_text(strings.fingerprint_success);
+            label.set_text(load_strings(None).fingerprint_success);
             label.add_css_class("success");
-            // stop() is idempotent — cleanup_dbus() already ran inside on_verify_status,
-            // but this mirrors the PAM success path for defense-in-depth.
-            fp.borrow_mut().stop();
             cb();
         });
     };
@@ -432,16 +415,18 @@ pub fn start_fingerprint(
 }
 
 /// Load the wallpaper as a texture once, for sharing across all windows.
-/// Returns None if no wallpaper path is provided or the file cannot be loaded.
 /// Blur is applied at render time via GPU (GskBlurNode), not here.
-pub fn load_background_texture(bg_path: &Path) -> Option<gdk::Texture> {
-    let file = gio::File::for_path(bg_path);
-    match gdk::Texture::from_file(&file) {
-        Ok(texture) => Some(texture),
-        Err(e) => {
-            log::warn!("Failed to load wallpaper {}: {e}", bg_path.display());
-            None
-        }
+pub fn load_background_texture(bg_path: &Path) -> gdk::Texture {
+    let fallback = "/dev/moonarch/moonlock/wallpaper.jpg";
+
+    if bg_path.starts_with("/dev/moonarch/moonlock") {
+        let resource_path = bg_path.to_str().unwrap_or(fallback);
+        gdk::Texture::from_resource(resource_path)
+    } else {
+        let file = gio::File::for_path(bg_path);
+        gdk::Texture::from_file(&file).unwrap_or_else(|_| {
+            gdk::Texture::from_resource(fallback)
+        })
     }
 }
 
@@ -449,13 +434,7 @@ pub fn load_background_texture(bg_path: &Path) -> Option<gdk::Texture> {
 /// When `blur_radius` is `Some(sigma)` with sigma > 0, blur is applied via GPU
 /// (GskBlurNode). The blur is rendered to a concrete texture on `realize` (when
 /// the GPU renderer is available), avoiding lazy-render artifacts.
-/// The `blur_cache` is shared across monitors — the first to realize renders the
-/// blur, subsequent monitors reuse the cached texture.
-fn create_background_picture(
-    texture: &gdk::Texture,
-    blur_radius: Option<f32>,
-    blur_cache: &Rc<RefCell<Option<gdk::Texture>>>,
-) -> gtk::Picture {
+fn create_background_picture(texture: &gdk::Texture, blur_radius: Option<f32>) -> gtk::Picture {
     let background = gtk::Picture::for_paintable(texture);
     background.set_content_fit(gtk::ContentFit::Cover);
     background.set_hexpand(true);
@@ -464,15 +443,9 @@ fn create_background_picture(
     if let Some(sigma) = blur_radius {
         if sigma > 0.0 {
             let texture = texture.clone();
-            let cache = blur_cache.clone();
             background.connect_realize(move |picture| {
-                if let Some(ref cached) = *cache.borrow() {
-                    picture.set_paintable(Some(cached));
-                    return;
-                }
                 if let Some(blurred) = render_blurred_texture(picture, &texture, sigma) {
                     picture.set_paintable(Some(&blurred));
-                    *cache.borrow_mut() = Some(blurred);
                 }
             });
         }
@@ -483,10 +456,6 @@ fn create_background_picture(
 
 /// Render a blurred texture using the widget's GPU renderer.
 /// Returns None if the renderer is not available.
-///
-/// To avoid edge darkening (blur samples transparent pixels outside bounds),
-/// the texture is rendered with padding equal to 3x the blur sigma. The blur
-/// is applied to the padded area, then cropped back to the original size.
 fn render_blurred_texture(
     widget: &impl IsA<gtk::Widget>,
     texture: &gdk::Texture,
@@ -494,37 +463,26 @@ fn render_blurred_texture(
 ) -> Option<gdk::Texture> {
     let native = widget.native()?;
     let renderer = native.renderer()?;
-
-    let w = texture.width() as f32;
-    let h = texture.height() as f32;
-    // Padding must cover the blur kernel radius (typically ~3x sigma)
-    let pad = (sigma * 3.0).ceil();
-
     let snapshot = gtk::Snapshot::new();
-    // Clip output to original texture size
-    snapshot.push_clip(&graphene::Rect::new(pad, pad, w, h));
+    let bounds = graphene::Rect::new(
+        0.0,
+        0.0,
+        texture.width() as f32,
+        texture.height() as f32,
+    );
     snapshot.push_blur(sigma as f64);
-    // Render texture with padding on all sides (edges repeat via oversized bounds)
-    snapshot.append_texture(texture, &graphene::Rect::new(0.0, 0.0, w + 2.0 * pad, h + 2.0 * pad));
-    snapshot.pop(); // blur
-    snapshot.pop(); // clip
-
+    snapshot.append_texture(texture, &bounds);
+    snapshot.pop();
     let node = snapshot.to_node()?;
-    let viewport = graphene::Rect::new(pad, pad, w, h);
-    Some(renderer.render_texture(&node, Some(&viewport)))
+    Some(renderer.render_texture(&node, None))
 }
 
-/// Load an image file and set it as the avatar. Stores the texture in the cache.
-fn set_avatar_from_file(
-    image: &gtk::Image,
-    path: &Path,
-    cache: &Rc<RefCell<Option<gdk::Texture>>>,
-) {
+/// Load an image file and set it as the avatar.
+fn set_avatar_from_file(image: &gtk::Image, path: &Path) {
     match Pixbuf::from_file_at_scale(path.to_str().unwrap_or(""), AVATAR_SIZE, AVATAR_SIZE, true) {
         Ok(pixbuf) => {
             let texture = gdk::Texture::for_pixbuf(&pixbuf);
             image.set_paintable(Some(&texture));
-            *cache.borrow_mut() = Some(texture);
         }
         Err(_) => {
             image.set_icon_name(Some("avatar-default-symbolic"));
@@ -533,12 +491,7 @@ fn set_avatar_from_file(
 }
 
 /// Load the default avatar SVG from GResources, tinted with the foreground color.
-/// Stores the texture in the cache for reuse on additional monitors.
-fn set_default_avatar(
-    image: &gtk::Image,
-    window: &gtk::ApplicationWindow,
-    cache: &Rc<RefCell<Option<gdk::Texture>>>,
-) {
+fn set_default_avatar(image: &gtk::Image, window: &gtk::ApplicationWindow) {
     let resource_path = users::get_default_avatar_path();
     if let Ok(bytes) =
         gio::resources_lookup_data(&resource_path, gio::ResourceLookupFlags::NONE)
@@ -560,7 +513,6 @@ fn set_default_avatar(
                 if let Some(pixbuf) = loader.pixbuf() {
                     let texture = gdk::Texture::for_pixbuf(&pixbuf);
                     image.set_paintable(Some(&texture));
-                    *cache.borrow_mut() = Some(texture);
                     return;
                 }
             }

src/main.rs

@@ -40,16 +40,16 @@ fn activate(app: &gtk::Application) {
     load_css(&display);
 
     let config = config::load_config(None);
-    let bg_texture = config::resolve_background_path(&config)
-        .and_then(|path| lockscreen::load_background_texture(&path));
+    let bg_path = config::resolve_background_path(&config);
+    let bg_texture = lockscreen::load_background_texture(&bg_path);
 
     if gtk4_session_lock::is_supported() {
-        activate_with_session_lock(app, &display, bg_texture.as_ref(), &config);
+        activate_with_session_lock(app, &display, &bg_texture, &config);
     } else {
         #[cfg(debug_assertions)]
         {
             log::warn!("ext-session-lock-v1 not supported — running in development mode");
-            activate_without_lock(app, bg_texture.as_ref(), &config);
+            activate_without_lock(app, &bg_texture, &config);
         }
         #[cfg(not(debug_assertions))]
         {
@@ -62,7 +62,7 @@ fn activate(app: &gtk::Application) {
 fn activate_with_session_lock(
     app: &gtk::Application,
     display: &gdk::Display,
-    bg_texture: Option<&gdk::Texture>,
+    bg_texture: &gdk::Texture,
     config: &config::Config,
 ) {
     let lock = gtk4_session_lock::Instance::new();
@@ -86,10 +86,6 @@ fn activate_with_session_lock(
         app_clone.quit();
     });
 
-    // Shared caches for multi-monitor — first monitor renders, rest reuse
-    let blur_cache: Rc<RefCell<Option<gdk::Texture>>> = Rc::new(RefCell::new(None));
-    let avatar_cache: Rc<RefCell<Option<gdk::Texture>>> = Rc::new(RefCell::new(None));
-
     // Create all monitor windows immediately — no D-Bus calls here
     let mut all_handles = Vec::new();
     let mut created_any = false;
@@ -103,8 +99,6 @@ fn activate_with_session_lock(
                 config,
                 app,
                 unlock_callback.clone(),
-                &blur_cache,
-                &avatar_cache,
             );
             lock.assign_window_to_monitor(&handles.window, &monitor);
             handles.window.present();
@@ -158,7 +152,7 @@ fn init_fingerprint_async(all_handles: Vec<lockscreen::LockscreenHandles>) {
 #[cfg(debug_assertions)]
 fn activate_without_lock(
     app: &gtk::Application,
-    bg_texture: Option<&gdk::Texture>,
+    bg_texture: &gdk::Texture,
     config: &config::Config,
 ) {
     let app_clone = app.clone();
@@ -166,15 +160,11 @@ fn activate_without_lock(
         app_clone.quit();
     });
 
-    let blur_cache = Rc::new(RefCell::new(None));
-    let avatar_cache = Rc::new(RefCell::new(None));
     let handles = lockscreen::create_lockscreen_window(
         bg_texture,
         config,
         app,
         unlock_callback,
-        &blur_cache,
-        &avatar_cache,
     );
     handles.window.set_default_size(800, 600);
     handles.window.present();
@@ -186,22 +176,11 @@ fn activate_without_lock(
 }
 
 fn setup_logging() {
-    match systemd_journal_logger::JournalLog::new() {
-        Ok(logger) => {
-            if let Err(e) = logger.install() {
-                eprintln!("Failed to install journal logger: {e}");
-            }
-        }
-        Err(e) => {
-            eprintln!("Failed to create journal logger: {e}");
-        }
-    }
-    let level = if std::env::var("MOONLOCK_DEBUG").is_ok() {
-        log::LevelFilter::Debug
-    } else {
-        log::LevelFilter::Info
-    };
-    log::set_max_level(level);
+    systemd_journal_logger::JournalLog::new()
+        .unwrap()
+        .install()
+        .unwrap();
+    log::set_max_level(log::LevelFilter::Info);
 }
 
 fn install_panic_hook() {
@@ -216,7 +195,6 @@ fn install_panic_hook() {
 }
 
 fn main() {
-    install_panic_hook();
     setup_logging();
 
     // Root check — moonlock should not run as root
@@ -224,6 +202,8 @@ fn main() {
         log::error!("Moonlock should not run as root");
         std::process::exit(1);
     }
+
+    install_panic_hook();
     log::info!("Moonlock starting");
 
     // Register compiled GResources

src/power.rs

@@ -7,12 +7,14 @@ use std::process::Command;
 #[derive(Debug)]
 pub enum PowerError {
     CommandFailed { action: &'static str, message: String },
+    Timeout { action: &'static str },
 }
 
 impl fmt::Display for PowerError {
     fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
         match self {
             PowerError::CommandFailed { action, message } => write!(f, "{action} failed: {message}"),
+            PowerError::Timeout { action } => write!(f, "{action} timed out"),
         }
     }
 }
@@ -42,6 +44,7 @@ mod tests {
     use super::*;
 
     #[test] fn power_error_display() { assert_eq!(PowerError::CommandFailed { action: "reboot", message: "fail".into() }.to_string(), "reboot failed: fail"); }
+    #[test] fn timeout_display() { assert_eq!(PowerError::Timeout { action: "shutdown" }.to_string(), "shutdown timed out"); }
     #[test] fn missing_binary() { assert!(run_command("test", "nonexistent-xyz", &[]).is_err()); }
     #[test] fn nonzero_exit() { assert!(run_command("test", "false", &[]).is_err()); }
     #[test] fn success() { assert!(run_command("test", "true", &[]).is_ok()); }