chore: drop unlock diagnostic instrumentation (v0.6.16)

The per-unlock window-state dump was scaffolding to prove the stale-window
hypothesis behind v0.6.15. With the fix in place, normal logging covers
validation: the prune handler already logs on monitor removal, and
coredumpctl shows whether the crash recurs. Remove the diagnostic block
and its all_handles_dbg clone; restore all_handles to its original spot.

CLAUDE.md

@@ -42,7 +42,7 @@ LD_PRELOAD=/usr/lib/libgtk4-layer-shell.so ./target/release/moonlock
 - `i18n.rs` — Locale-Erkennung (OnceLock-cached) und String-Tabellen (DE/EN), faillock_warning mit konfigurierbarem max_attempts
 - `config.rs` — TOML-Config (background_path, background_blur clamped [0,200], fingerprint_enabled als Option<bool>) + Wallpaper-Fallback + Symlink-Rejection via symlink_metadata + Parse-Error-Logging
 - `lockscreen.rs` — GTK4 UI via LockscreenHandles, PAM-Auth via gio::spawn_blocking mit 30s Timeout und Generation Counter, FP-Success ruft unlock_callback direkt (PAM-Stack ohne account-Modul, Lockout via auth-Pfad und MAX_FP_ATTEMPTS), Zeroizing<String> für Passwort, Power-Confirm, GPU-Blur via GskBlurNode (Downscale auf max 1920px), Blur/Avatar-Cache für Multi-Monitor
-- `main.rs` — Entry Point, Panic-Hook (vor Logging), Root-Check, ext-session-lock-v1 (Pflicht in Release), Monitor-Hotplug via `connect_monitor`-Signal (v1_2), shared Blur/Avatar-Caches in Rc, systemd-Journal-Logging, Debug-Level per `MOONLOCK_DEBUG` Env-Var, async fprintd-Init nach window.present()
+- `main.rs` — Entry Point, Panic-Hook (vor Logging), Root-Check, ext-session-lock-v1 (Pflicht in Release), Monitor-Hotplug via `connect_monitor`-Signal (v1_2) + Pruning toter Fenster bei Monitor-Removal (`display.monitors()` items_changed → `remove_window`) gegen Resume-Unlock-SIGSEGV, shared Blur/Avatar-Caches in Rc, systemd-Journal-Logging, Debug-Level per `MOONLOCK_DEBUG` Env-Var, async fprintd-Init nach window.present()
 
 ## Sicherheit
 

Cargo.lock

@@ -575,7 +575,7 @@ dependencies = [
 
 [[package]]
 name = "moonlock"
-version = "0.6.14"
+version = "0.6.16"
 dependencies = [
  "gdk-pixbuf",
  "gdk4",

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "moonlock"
-version = "0.6.14"
+version = "0.6.16"
 edition = "2024"
 description = "A secure Wayland lockscreen with GTK4, PAM and fingerprint support"
 license = "MIT"

DECISIONS.md

@@ -2,6 +2,13 @@
 
 Architectural and design decisions for Moonlock, in reverse chronological order.
 
+## 2026-06-02 – Prune per-monitor windows on monitor removal to fix resume-unlock SIGSEGV (v0.6.15)
+
+- **Who**: ClaudeCode, Dom
+- **Why**: Chronic SIGSEGV (multiple coredumps/day) on the unlock following a suspend/resume. Backtrace: `app.quit()` → `gtk_window_destroy` → gtk4-layer-shell → `g_signal_emit` → NULL deref (`0x278`, rax=0). Root cause: `connect_monitor` is add-only — it creates one window per monitor and pushes to `all_handles`, but nothing ever removes a window when a monitor powers off on suspend. gtk4-session-lock unmaps + drops *its* ref to that window on monitor removal (per `gtk4-session-lock` 0.4 docs), but the GtkApplication (`ApplicationWindow::builder().application(app)`) and `all_handles` still hold refs. The orphaned window survives until unlock, where destroying it dereferences its now-NULL monitor association. A diagnostic confirmed the windows are GTK-valid but accumulate (3 windows for 1-2 monitors) with a NULL associated object.
+- **Tradeoffs**: An earlier attempt deferred `unlock()`/`quit()` via `glib::idle_add_local_once` on a reentrancy theory — proven wrong by the logs (crash happens *inside* the idle trampoline). Reverted. The library doc explicitly says monitor removal is detected via "GTK APIs"; we follow that rather than fighting the library. We release our refs (do **not** call `destroy` — the lib already unmapped+dereffed the window). Diagnostic UNLOCK logging is kept for now, to be removed once a suspend/resume validation cycle confirms the fix.
+- **How**: `LockscreenHandles` gains `monitor: Option<gdk::Monitor>`, set in the `connect_monitor` handler. `activate_with_session_lock` watches `display.monitors()` via `connect_items_changed`; on any change it retains only handles whose monitor `is_valid()`, calling `app.remove_window()` on the pruned ones to drop the application's ref. With both refs released, the orphaned window is gone before unlock.
+
 ## 2026-06-02 – Align power-confirm to moonset's ActionDef pattern (v0.6.14)
 
 - **Who**: ClaudeCode, Dom

src/lockscreen.rs

@@ -27,6 +27,9 @@ pub struct LockscreenHandles {
     pub password_entry: gtk::PasswordEntry,
     pub unlock_callback: Rc<dyn Fn()>,
     pub username: String,
+    /// The monitor this window was assigned to (session-lock path only).
+    /// Used to prune the window when its monitor is removed on suspend/resume.
+    pub monitor: Option<gdk::Monitor>,
     state: Rc<RefCell<LockscreenState>>,
 }
 
@@ -70,6 +73,7 @@ pub fn create_lockscreen_window(
                 password_entry: gtk::PasswordEntry::new(),
                 unlock_callback,
                 username: String::new(),
+                monitor: None,
                 state: Rc::new(RefCell::new(LockscreenState {
                     failed_attempts: 0,
                     fp_listener_rc: None,
@@ -360,6 +364,7 @@ pub fn create_lockscreen_window(
         password_entry: password_entry.clone(),
         unlock_callback,
         username: user.username,
+        monitor: None,
         state: state.clone(),
     }
 }

src/main.rs

@@ -59,7 +59,7 @@ fn activate(app: &gtk::Application) {
 
 fn activate_with_session_lock(
     app: &gtk::Application,
-    _display: &gdk::Display,
+    display: &gdk::Display,
     config: &config::Config,
 ) {
     let lock = gtk4_session_lock::Instance::new();
@@ -127,7 +127,7 @@ fn activate_with_session_lock(
         shared_fp,
         move |_instance, monitor| {
             log::debug!("Monitor signal: creating lockscreen window");
-            let handles = lockscreen::create_lockscreen_window(
+            let mut handles = lockscreen::create_lockscreen_window(
                 bg_texture.as_ref().as_ref(),
                 &config,
                 &app,
@@ -137,6 +137,7 @@ fn activate_with_session_lock(
             );
             lock_for_signal.assign_window_to_monitor(&handles.window, monitor);
             handles.window.present();
+            handles.monitor = Some(monitor.clone());
 
             // If fingerprint is already initialized, wire up the label
             if let Some(ref fp_rc) = *shared_fp.borrow() {
@@ -147,6 +148,31 @@ fn activate_with_session_lock(
         }
     ));
 
+    // connect_monitor only ADDS — it never tells us when a monitor powers off on
+    // suspend. gtk4-session-lock then unmaps and drops its own ref to that monitor's
+    // window, but the GtkApplication and all_handles still hold refs, so the orphaned
+    // window survives until unlock — where gtk_window_destroy dereferences its now-NULL
+    // monitor association and segfaults. Watch the display's monitor list and prune any
+    // window whose monitor is no longer valid, releasing our refs (the lib doc points to
+    // "GTK APIs" for exactly this). We release refs, not destroy — the lib already
+    // unmapped+dereffed the window.
+    display.monitors().connect_items_changed(glib::clone!(
+        #[weak]
+        app,
+        #[strong]
+        all_handles,
+        move |_, _, _, _| {
+            all_handles.borrow_mut().retain(|h| {
+                let alive = h.monitor.as_ref().is_none_or(gdk::Monitor::is_valid);
+                if !alive {
+                    log::info!("Monitor removed — pruning its lockscreen window");
+                    app.remove_window(&h.window);
+                }
+                alive
+            });
+        }
+    ));
+
     lock.lock();
 
     // Async fprintd initialization — runs after windows are visible