fix: quit in ::unlocked instead of after unlock() (v0.6.17)

The real cause of the unlock SIGSEGV: gtk4-session-lock destroys the lock
windows itself when the lock ends (per its header), so unlock_callback's
`unlock(); app.quit();` destroyed them a second time — surface already gone
→ gdk_surface_get_display NULL → crash in gtk_window_destroy. Reproduces on
a plain single-monitor lock/unlock, no suspend needed.

unlock_callback now calls only unlock(); a new connect_unlocked handler
quits the app after the library finishes teardown. Mirrors the upstream
examples/simple.rs exactly.

Reverts the v0.6.15/v0.6.16 monitor-pruning + LockscreenHandles.monitor:
it was a misdiagnosis (the crash is monitor-independent) and manually
manipulated library-managed lock windows, which the upstream example
explicitly warns against. Monitor removal is left to the library.

CLAUDE.md

@@ -42,7 +42,7 @@ LD_PRELOAD=/usr/lib/libgtk4-layer-shell.so ./target/release/moonlock
 - `i18n.rs` — Locale-Erkennung (OnceLock-cached) und String-Tabellen (DE/EN), faillock_warning mit konfigurierbarem max_attempts
 - `config.rs` — TOML-Config (background_path, background_blur clamped [0,200], fingerprint_enabled als Option<bool>) + Wallpaper-Fallback + Symlink-Rejection via symlink_metadata + Parse-Error-Logging
 - `lockscreen.rs` — GTK4 UI via LockscreenHandles, PAM-Auth via gio::spawn_blocking mit 30s Timeout und Generation Counter, FP-Success ruft unlock_callback direkt (PAM-Stack ohne account-Modul, Lockout via auth-Pfad und MAX_FP_ATTEMPTS), Zeroizing<String> für Passwort, Power-Confirm, GPU-Blur via GskBlurNode (Downscale auf max 1920px), Blur/Avatar-Cache für Multi-Monitor
-- `main.rs` — Entry Point, Panic-Hook (vor Logging), Root-Check, ext-session-lock-v1 (Pflicht in Release), Monitor-Hotplug via `connect_monitor`-Signal (v1_2) + Pruning toter Fenster bei Monitor-Removal (`display.monitors()` items_changed → `remove_window`) gegen Resume-Unlock-SIGSEGV, shared Blur/Avatar-Caches in Rc, systemd-Journal-Logging, Debug-Level per `MOONLOCK_DEBUG` Env-Var, async fprintd-Init nach window.present()
+- `main.rs` — Entry Point, Panic-Hook (vor Logging), Root-Check, ext-session-lock-v1 (Pflicht in Release), Monitor-Hotplug via `connect_monitor`-Signal (v1_2), Unlock via `unlock()` + `connect_unlocked`→`app.quit()` (Lib zerstört die Lock-Fenster selbst beim Lock-Ende — kein eigenes Destroy/quit, sonst Double-Destroy-SIGSEGV), shared Blur/Avatar-Caches in Rc, systemd-Journal-Logging, Debug-Level per `MOONLOCK_DEBUG` Env-Var, async fprintd-Init nach window.present()
 
 ## Sicherheit
 

Cargo.lock

@@ -575,7 +575,7 @@ dependencies = [
 
 [[package]]
 name = "moonlock"
-version = "0.6.16"
+version = "0.6.17"
 dependencies = [
  "gdk-pixbuf",
  "gdk4",

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "moonlock"
-version = "0.6.16"
+version = "0.6.17"
 edition = "2024"
 description = "A secure Wayland lockscreen with GTK4, PAM and fingerprint support"
 license = "MIT"

DECISIONS.md

@@ -2,6 +2,13 @@
 
 Architectural and design decisions for Moonlock, in reverse chronological order.
 
+## 2026-06-02 – Real fix for the unlock SIGSEGV: quit in ::unlocked, never destroy windows ourselves (v0.6.17)
+
+- **Who**: ClaudeCode, Dom
+- **Why**: The v0.6.15 "stale per-monitor window" theory was a **misdiagnosis**. A clean manual `target/release/moonlock` lock→unlock (single monitor, no suspend, no monitor removal) still crashed, preceded by `Gdk-CRITICAL: gdk_surface_get_display: assertion 'GDK_IS_SURFACE (surface)' failed`. The v0.6.16 backtrace's top app frame is the `unlock_callback` closure, which ran `lock.unlock(); app.quit();`. Per the gtk4-session-lock header (`assign_window_to_monitor`: "the window will be unmapped and `gtk_window_destroy()` called on it when the current lock ends") the **library destroys the lock windows itself** on unlock. `app.quit()` then destroyed the same windows again — surface already gone → SIGSEGV. A double-destroy in the teardown sequence, entirely independent of monitors.
+- **Tradeoffs**: Reverted the v0.6.15/v0.6.16 monitor-pruning + `LockscreenHandles.monitor` field: it targeted the wrong cause, never fired in testing, and manually called `app.remove_window()` on library-managed lock windows — exactly what the upstream example warns against ("does NOT manually destroy or close the lock windows"). Monitor-removal-during-lock is left entirely to the library (which already auto-unmaps+dereferences such windows). Three attempts total: idle_add deferral (wrong: reentrancy theory), monitor-pruning (wrong: misdiagnosis), and this one — verified against both the C header and the upstream `examples/simple.rs`.
+- **How**: `unlock_callback` now calls only `lock.unlock()`. A new `lock.connect_unlocked(|_| app.quit())` quits the app only after the library finishes its teardown and fires `::unlocked`. Mirrors the canonical gtk4-session-lock usage exactly.
+
 ## 2026-06-02 – Prune per-monitor windows on monitor removal to fix resume-unlock SIGSEGV (v0.6.15)
 
 - **Who**: ClaudeCode, Dom

src/lockscreen.rs

@@ -27,9 +27,6 @@ pub struct LockscreenHandles {
     pub password_entry: gtk::PasswordEntry,
     pub unlock_callback: Rc<dyn Fn()>,
     pub username: String,
-    /// The monitor this window was assigned to (session-lock path only).
-    /// Used to prune the window when its monitor is removed on suspend/resume.
-    pub monitor: Option<gdk::Monitor>,
     state: Rc<RefCell<LockscreenState>>,
 }
 
@@ -73,7 +70,6 @@ pub fn create_lockscreen_window(
                 password_entry: gtk::PasswordEntry::new(),
                 unlock_callback,
                 username: String::new(),
-                monitor: None,
                 state: Rc::new(RefCell::new(LockscreenState {
                     failed_attempts: 0,
                     fp_listener_rc: None,
@@ -364,7 +360,6 @@ pub fn create_lockscreen_window(
         password_entry: password_entry.clone(),
         unlock_callback,
         username: user.username,
-        monitor: None,
         state: state.clone(),
     }
 }

src/main.rs

@@ -59,7 +59,7 @@ fn activate(app: &gtk::Application) {
 
 fn activate_with_session_lock(
     app: &gtk::Application,
-    display: &gdk::Display,
+    _display: &gdk::Display,
     config: &config::Config,
 ) {
     let lock = gtk4_session_lock::Instance::new();
@@ -75,9 +75,12 @@ fn activate_with_session_lock(
     // Shared unlock callback — unlocks session and quits.
     // Guard prevents double-unlock if PAM and fingerprint succeed simultaneously.
     let lock_clone = lock.clone();
-    let app_clone = app.clone();
     let already_unlocked = Rc::new(Cell::new(false));
     let au = already_unlocked.clone();
+    // unlock() only. The library destroys the lock windows itself when the lock ends,
+    // and the ::unlocked handler quits the app afterwards. Calling app.quit() here too
+    // double-destroyed the windows (their surface was already gone) and segfaulted
+    // gtk_window_destroy. Matches the upstream gtk4-session-lock example.
     let unlock_callback: Rc<dyn Fn()> = Rc::new(move || {
         if au.get() {
             log::debug!("Unlock already triggered, ignoring duplicate");
@@ -85,7 +88,6 @@ fn activate_with_session_lock(
         }
         au.set(true);
         lock_clone.unlock();
-        app_clone.quit();
     });
 
     // Shared caches for multi-monitor — first monitor renders, rest reuse
@@ -127,7 +129,7 @@ fn activate_with_session_lock(
         shared_fp,
         move |_instance, monitor| {
             log::debug!("Monitor signal: creating lockscreen window");
-            let mut handles = lockscreen::create_lockscreen_window(
+            let handles = lockscreen::create_lockscreen_window(
                 bg_texture.as_ref().as_ref(),
                 &config,
                 &app,
@@ -137,7 +139,6 @@ fn activate_with_session_lock(
             );
             lock_for_signal.assign_window_to_monitor(&handles.window, monitor);
             handles.window.present();
-            handles.monitor = Some(monitor.clone());
 
             // If fingerprint is already initialized, wire up the label
             if let Some(ref fp_rc) = *shared_fp.borrow() {
@@ -148,29 +149,14 @@ fn activate_with_session_lock(
         }
     ));
 
-    // connect_monitor only ADDS — it never tells us when a monitor powers off on
-    // suspend. gtk4-session-lock then unmaps and drops its own ref to that monitor's
-    // window, but the GtkApplication and all_handles still hold refs, so the orphaned
-    // window survives until unlock — where gtk_window_destroy dereferences its now-NULL
-    // monitor association and segfaults. Watch the display's monitor list and prune any
-    // window whose monitor is no longer valid, releasing our refs (the lib doc points to
-    // "GTK APIs" for exactly this). We release refs, not destroy — the lib already
-    // unmapped+dereffed the window.
-    display.monitors().connect_items_changed(glib::clone!(
+    // Quit only after the library finishes unlocking (::unlocked fires after the lock
+    // ends). gtk4-session-lock destroys the lock windows itself at lock-end; quitting
+    // earlier — or destroying windows ourselves — races that teardown and segfaults
+    // gtk_window_destroy on an already-gone surface. Mirrors the upstream example.
+    lock.connect_unlocked(glib::clone!(
         #[weak]
         app,
-        #[strong]
-        all_handles,
-        move |_, _, _, _| {
-            all_handles.borrow_mut().retain(|h| {
-                let alive = h.monitor.as_ref().is_none_or(gdk::Monitor::is_valid);
-                if !alive {
-                    log::info!("Monitor removed — pruning its lockscreen window");
-                    app.remove_window(&h.window);
-                }
-                alive
-            });
-        }
+        move |_| app.quit()
     ));
 
     lock.lock();