monolith

# Follow-up review of the 2026-10-19 session

Four reviewers read the session's diff (189b5d01..a1f375a8) by area. Items are as reported, lightly edited. Those marked (verify) rest on runtime behaviour the reviewer could not check. Confirmed items were rechecked against the code by the lead.

## Backend, power and pacing

High

1. (confirmed) Powering outputs on after an idle blank re-blanks them about 1 ms later. `set_output_power(on)` calls `wake_idle`, which re-arms the idle timer without touching `last_activity`. This hits `msg power on` and wlr-output-power clients. Touch activity when powering on.

Medium

2. A closed lid leaves the eDP in the layout and Space, just dark. The pointer can enter it, windows can map there and mouse-follows-focus can warp onto it. Remove and restore the layout output on lid transitions, as sway does.

3. Pointer warps count as user activity (`input.rs`, `activity()` in `pointer_motion` for `Motion::Warp`). Background maps and constraint hint warps wake blanked outputs and reset idle-notify. Skip `activity()` for warps.

4. (verify) `ActivateSession` resets `queued` without `frame_submitted()`. A flip in flight at pause can leave a stale `pending_frame` in DrmCompositor, so the first frame after resume waits for the 100 ms watchdog. Drain with `frame_submitted()` on activate.

5. (verify) FIFO barriers are latched only for windows and layers. Lock surfaces, the DnD icon and cursor surfaces fall back to the 100 ms sweep, about 7 to 10 fps for a fifo-using locker. Use `fifo::scanout` in `lock::send_frames`.

6. `DrmScanEvent::Changed`, which only fires on mode list changes, does a full disconnect and connect. That makes a new wl_output, drops the lock surface on a locked session, re-places windows and forgets an explicit power-off. Update the mode in place, or at least keep power state.

7. Nested treats an idle blank as real. Outputs report off over wlr-output-power and `confirm_lock` counts them blanked. Skip the idle blank when not on DRM.

Low

8. DPMS wake keeps the stale `last_vblank_ns`, so the first frame counts as missed and adds 0.5 ms slack for 30 s on every wake. Reset pacing state on power-on.

9. `lid_acted` is never reset while the lid stays shut, so a wake with the lid closed never suspends again. At boot with the lid closed, the action can run before external outputs are scanned.

10. `frame_cpu_ns` grows without bound when frames render without vblanks (empty-frame loops, failing retries).

11. `shown_windows` runs twice per frame and `render_surface` arranges a third time. Compute once and pass it down.

12. The signal handler does not save errno. SIGHUP and a repeated SIGTERM are not handled.

13. logind: a system bus restart silently drops the inhibitor with no reconnect. `Logind::connect` can block startup for 2 s. The systemctl fallback is written twice.

14. `drm.rs` is 1265 lines, `Surface` has 24 fields, `render_surface` about 175 lines, and the `surfaces.get_mut(&crtc)` lookup repeats 9 times. `power.rs` mixes idle, DPMS and lid. `fifo::unblock` and `idle::root_surface` are generic helpers living in feature modules. A few comments restate their field.

15. Stray tracked files in the repo root, `monolith.log` and `write`, are old run logs from 2026-10-17.

Checked and fine: dropped presentation feedback sends `discarded`, timing release cannot loop or spin, hook order for commit timing, VRR re-applied after DPMS wake, timer tokens removed on disconnect and the watchdog reschedules correctly, hotplug retry logic and the 5 s global removal, presentation coverage and clock, fifo release after empty frames, confirm_lock with dark outputs, wlr-output-power second-control `failed`, dbus build inputs.

## Windows, layout, rules and config

High

1. (confirmed) `Launches::find` has no age check, since the 120 s TTL is only applied when a new record is added. A terminal spawned in the morning places every window launched from it at the morning's tag and output, and the owner-ancestor tier added today is never reached. Expire in `find`, and prefer the owning window once it is mapped.

Medium

2. Transients ignore their parent for output and tag. `map_window` uses `launch_of(pid)`, whose owner lookup takes the first window of the pid in slot order. A dialog can land on a hidden tag or another output while drawn over its parent. Inherit the parent's output and tag first.

3. A taskbar activate or an xdg-activation request can focus a window covered by a fullscreen window (`activation.rs`, `toplevels.rs` Activate, `Layout::summon`). Add one `focus_unless_covered` and mark urgent instead.

4. `focus_if_covering` lets an unfocused client take the output and the keyboard by requesting fullscreen. Only move focus when the requester already held it, otherwise mark it urgent.

5. Hide to tray calls `remove_window`, losing floating, sticky, scratchpad, the user's tag and the float rect, breaking children's parent links and recreating the foreign-toplevel handle. Keep the layout entry marked unmapped, or stash and restore.

6. Hide to tray leaves no close ghost, because smithay clears the textures on a null-buffer commit before `last_frame` runs.

7. `arrange` only recognises a fullscreen window that is in the focus history. A rule `fullscreen = true` with `focus = false`, or a fullscreen window mapped on a hidden tag, is drawn tiled while IPC says fullscreen. Make arrange independent of history.

8. (verify) The lenient TOML parse can drop a broken `[[rules]` or `[binds` header line, attaching its keys to the previous table, so options silently land in the wrong rule. The `reload` doc saying a non-TOML file leaves the config untouched is now stale. Never drop header lines, fail or drop the whole section instead.

9. Startup config warnings are only logged, and IPC reports warnings only for an IPC-issued reload, not a reload from a bind.

10. `parent_changed` after map re-runs rules but not the layout, so a dialog that gains a fullscreen parent through xdg-foreign stays hidden and does not float.

11. `float_rect_for` and `place()` do not clamp. A dialog centred on a parent near an edge goes off screen or under the bar. Centring uses `area` while clamp and scratchpads use `usable()`.

Low

- `floats()` floats any window with a max size even when the max exceeds the output. Compare against the tile rect. (verify)

- Fixed-size dialogs use their current geometry rather than the fixed size, so one that has not drawn gets the 60% default.

- Reclassified windows never get `rule.size`.

- A session lock during a resize drag clears the hold without `apply_layout`, leaving tiles stretched until a later layout pass.

- A drag can outlive its window or output and write a float rect in a stale coordinate space.

- `rematch` re-runs facts, inhibit updates and a redraw on every title change once effects have been followed. Compare only the fields that can differ.

- The duplicate-bind warning says an earlier bind wins, but the table is a BTreeMap, so earlier means alphabetical.

- `realign` is dead since the Space origin fix, and its doc is stale. A redundant `placed_by_rule = false` in `release_hold`.

- `WindowState`'s six booleans form an implicit state machine with unreachable combinations. An enum would make it explicit.

- `windows.rs` mixes mapping, natural-size negotiation, rule placement and ghost capture.

- The fullscreen toggle exists in three diverging copies (xdg, X11, toplevels).

- Some doc comments restate their item.

- `x11_drag` lacks the same-client check the xdg path has.

- Scratchpad drags are janky, since arrange recentres them every pass. Moves do nothing and resizes track at half speed.

- Pre-existing: xdg-activation tokens are never removed and accumulate.

Checked and fine: stale timers are safe through slotmap generations and serials, natural-size negotiation and glide-once, null-buffer unmap ordering, fullscreen before map, transients above fullscreen and cycle rejection, reclassify before release, locked binds intercept order, autotile fallbacks, float rescale and clamp with zero areas, urgency clearing, rule error handling, the Space origin fix.

## Scale, scene and renderer

Medium

1. A hung GPU still blocks exit. The renderer's drop skips `device_wait_idle` when hung, but `Device::drop`, which runs with the last `Arc<Shared>`, waits unconditionally. Gate it on `hung()` and skip `destroy_device`.

2. The overshoot strips in `window_elements` ignore the `opacity` rule, so a dimmed window with a one-pixel size mismatch gets opaque lines on its right and bottom edge.

3. `PlacedTexture` gets a new `Id` and a constant commit counter every frame, so the strips damage their area every frame at fractional scales and an idle screen keeps flipping. Keep a stable id per window and take the commit from the surface.

4. (verify) Fullscreen at a fractional scale whose logical size is not an integer (2560 px at 1.5) cannot be exact. The client draws one pixel over, the crop path runs, and that likely blocks direct scanout.

5. Queued uploads can pin up to 64 MiB (`UPLOAD_BATCH_BYTES`) of host-visible staging, twice the pool cap, while no frame submits (scanout, DPMS off, VT switch). Each flush then frees half, bringing back the NVIDIA allocation stall the pool avoids. Flush at the pool size or on idle.

Low

- Cursor size jumps between outputs. At scale 1 the nearest theme image is drawn unstretched (32 px for size 24) while other scales stretch exactly, so the decision to skip the stretch at scale 1 is reversed. Always stretch to the requested size.

- `follow_pointer_scale` clones an `Output` and allocates its name on every motion event.

- `send_scales` skips popups, which keep a stale scale after a scale change or output move until they next commit.

- The scale is sent after the initial configure of toplevels, popups and layers, so a first buffer can be drawn at scale 1 and redrawn. Send it before the configure.

- (verify) A surface is marked told even when no output was found, so a layer or lock surface on a new output waits for an unrelated layout pass.

- (verify) The DnD icon is drawn over the lock screen, and locking does not cancel the DnD grab.

- Readback staging returns to the pool after a fence-wait timeout while a hung GPU may still write it. Keep it in `Pending`.

- Non-coherent flush and invalidate use `WHOLE_SIZE`, covering neighbouring suballocations. Use the size rounded to the atom.

- The pipeline cache is only saved on drop, so a crash loses the warm-up, and the hung exit path reads cache data from a bad device. Save once after warm-up.

- `reap` runs per shm commit and again after every dispatch, each time walking texture maps and locking the staging pool.

- `malloc_trim(0)` runs on the main thread before `flush_clients`, delaying client events by a few milliseconds when it fires.

- The CSD shadow inset and drawn size round separately, so the crop or strip decision can be off by a pixel.

- `capture.rs` says a window is captured with its popups, but `render_elements` returns only the surface tree.

- `window_elements` and `effect_elements` take scale and opacity positionally under clippy expects. A small placement struct would remove both.

Checked and fine: barrier scopes and foreign queue transfers, LayoutLog commit after submit and requeue on failure, upload batching order and texture lifetimes, blend-off only for truly opaque draws, y-invert, device-lost bookkeeping, the driver environment filter and its thread-safety claim, fractional-scale deduplication and viewport mapping, single-pixel buffers, rotation and capture sizes, layer inset rounding, dmabuf default feedback, import worker join order.

## Input, popups and selections

High

1. (confirmed, security) Locking with a popup grab open leaves the keyboard on the app that owns the menu. `lock()` never ends existing popup grabs, and smithay's popup keyboard grab ignores focus changes until it ends, so the password goes to the client. The pointer grab hides the lock surface from the pointer too. End the keyboard and pointer grabs and send `popup_done` on lock.

2. The same grab survives binds, tag switches and window closes, so typing keeps going to the old, possibly hidden, client, and `sync_focus` runs uselessly every dispatch. End the grab when focus moves to another root.

3. A floating window's resize ring takes clicks over layer surfaces, popups and X11 menus, including a bar the float sits against. Only take the ring over a tile or nothing.

Medium

4. Popups of transients drawn above a fullscreen window are neither drawn nor hit-tested. Skip only windows that are neither the fullscreen window nor in `arr.over`.

5. `x11_drag` accepts any active pointer grab, so an X11 client can start a compositor drag while the user holds a button elsewhere. Require the grab to start on that window.

6. The Latin-1 relay thread blocks forever on a source that never closes, buffers without a cap, and `thread::spawn` panics on EAGAIN. Cap it and move it to a nonblocking calloop source.

7. Mod+mouse ignores shortcut inhibition, so a VM that inhibited Super still loses Super+click.

8. A Mod drag ends on any button release, so pressing and releasing a second button mid-drag ends it and the later release reaches the client unmatched.

9. (verify) Per motion, `fullscreen_at` arranges the layout three or four times, `window_popup_under` allocates per window, and `drag_to` runs `apply_layout` including `send_scales` over every window. Arrange once per event and skip unchanged scale sends.

10. (decision) The selection-access setting gates reads only. Any X11 client can overwrite the Wayland clipboard.

Low

- `realign` is dead since the Space origin fix and runs on every commit.

- (verify) An Xwayland crash leaves a stale X11-owned selection.

- (verify) A popup holding keyboard focus releases an active pointer lock, because the constraint check compares root surfaces.

- The tiled split drag uses incremental deltas, so clamping makes it drift from the pointer.

- Locking mid-drag clears the resize hold without `apply_layout`, leaving windows stretched.

- A window closing mid-drag leaves the drag and hold set until release.

- The hover resize cursor can replace the DnD cursor over a ring.

- Popups straddling an output edge are clickable where they are not drawn.

- The cursor cache keeps every size and frame of 17 shapes, a few MB. A failed import is cached forever.

- `Edges::from_xdg` and `from_x11` duplicate one table. `fullscreen_at` is a layout query living in `popups.rs`. `input.rs` is 736 lines.

- A 130-column comment in `xwayland.rs`, and several modules over the comment budget.

- The nested backend's keyboard leave does not end a Mod drag.

Checked and fine: popup frame and unconstrain coordinates under scale and rotation, popup grab serials, the Space origin fix and hit-test agreement, hit-test order, xdg drag serial and client checks, resize clamping precedence, pointer constraint relative motion and hint warps, bind interception order, the selection bridge echo and replay, STRING mapping, DnD icon cleanup.

## Also found while merging

- When a modal maps and takes focus by itself, its parent is not put just below it in the focus history, so closing the modal can return focus to an unrelated window.