fix(overlays): destroy unrealized layer windows on teardown, not close() (#632)

[vibechoom]

Closes #632

The bug

All five per-monitor overlay close_all functions tore down their layer-shell windows with gtk::Window::close():

• trollshell/src/modal.rs
• trollshell/src/overlays/sidebar.rs
• trollshell/src/overlays/frame.rs
• trollshell/src/overlays/osd.rs
• trollshell/src/overlays/notifications.rs

GTK 4.22's own GIR docs draw a sharp line between the two calls:

• gtk_window_close — "Requests that the window is closed. This is similar to what happens when a window manager close button is clicked." A request, routed through close-request.
• gtk_window_destroy — "Drops the internal reference GTK holds on toplevel windows."

close() is not the call that releases GTK's internal toplevel reference — destroy() is.

hytte-ui's layer-shell builder deliberately never shows these windows (crates/hytte-ui/src/layer_window.rs:98: "Construct the gtk::Window, wire up layer-shell, but don't show"), and modal.rs's EAGER_PAGES is empty, so nothing forces a realize. A drawer/overlay the user never opened on a given monitor is therefore unrealized when a hot-plug's close_all runs, and close() on an unrealized window doesn't tear it down — the window and its whole child widget tree survive.

Worse: trollshell/src/plugins/region.rs:392 aborts the plugin-panel reconcile subscription only on connect_destroy. If destroy() never fires, every hot-plug/kanshi switch that never opened a given drawer on that monitor leaks another live subscriber re-reconciling an orphaned widget tree.

The fix

Switched all five close_all sites from close() to destroy(). It works on unrealized windows, it's the documented ref-dropping call, and — unlike close() — it can't be vetoed by a future close-request handler on these shell-owned, non-cancellable surfaces.

Left the surrounding structure alone:

• modal::close_all's drain-into-Vec-before-closing ordering (fix(modal): drop the PANELS borrow before closing drawer windows (#627) #630/aaba27a) and the post-loop reset_drawer_open_states() sequencing are untouched — only the panel.window.close() call inside the loop changed to destroy(). Updated the doc comment's mentions of gtk_window_close/close() to gtk_window_destroy/destroy() where it specifically discusses which GTK call is used, since the comment's own reasoning (avoid a reentrant borrow panic) still applies to destroy().
• sidebar.rs's panel.open_state.set(false) immediately before the window teardown (fix(osd): a hot-plug while a drawer is open latches DRAWER_OPEN true, silencing the OSD on that output for the rest of the session #618) is untouched — still runs first, then destroy().

trollshell/src/overlays/prompt.rs was not touched, per the issue and task scope:

• Its abort_subscription has the same if let Some(x) = …borrow_mut().take() shape as the fixed sites, but its body calls handle.abort() on a tokio AbortHandle — no GTK, nothing to destroy.
• Its own close_prompt() does call w.close(), but that window is only ever in PROMPT_WINDOW's slot after show_prompt has already called window.set_visible(true) + window.present() — i.e. it's realized by the time close() runs, and it's out of the issue's five named files, so it wasn't touched even though the same underlying GTK distinction technically applies to it.

Other connect_destroy dependencies found

Swept the whole tree for connect_destroy:

• trollshell/src/plugins/region.rs:392 — the one already named in the issue (plugin-panel reconcile teardown on a sidebar/drawer child). Now fires correctly once the parent drawer window is destroy()d instead of close()d.
• trollshell/src/plugins/region.rs:212 — same shape, one layer down: build_region's render-subscription teardown on the mount-region gtk::Box itself. This container is used both by the sidebar slots (now fixed transitively, since sidebar::close_all now destroy()s the parent window whose children cascade) and by the bar's bar_left/center/right_slot regions, which live inside Bar's own window (crates/hytte-ui/src/bar.rs) — not one of this issue's five files.
• crates/hytte-reactive/src/bind.rs:55 — the generic bind() apply-loop's WeakRef self-free. Same family: relies on the widget's destroy signal firing when its ancestor window goes away.

Also found, outside connect_destroy but the same underlying defect: crates/hytte-ui/src/bar.rs:195 and :208, and crates/hytte-ui/src/popup.rs:287, also call window.close() for teardown. The Bar window is always shown (mapped) before a rebuild ever tears it down, so it's less likely to hit the "unrealized, so close() no-ops entirely" failure mode this issue centers on — but the same "close() isn't the ref-dropping call" concern applies in principle. Left untouched: none of these are trollshell's five named files, they're a different crate (hytte-ui), and the issue explicitly scopes to the five trollshell/src sites — flagging here rather than expanding scope.

Test feasibility

No hermetic test was added. trollshell/src/modal.rs's own existing test-module doc comment already states the crate has no system-tests/xvfb harness (unlike hytte-bus/hytte-reactive/hytte-services/hytte-ui, which do), and the existing close_all_resets_drawer_open_state test relies on PANELS being empty on a test thread specifically so the drain touches no GTK at all. Asserting that destroy() actually drops GTK's internal toplevel reference needs a live display server plus a booted App (to construct a real layer window), which this crate's test harness doesn't have — a test that doesn't exercise real GTK window realization wouldn't be honest coverage of this change, so I didn't write one. Confirmed via cargo test -p trollshell (233 passed, 0 failed) that nothing else regressed.

Live-verify note

The honest manual check for this fix: on a two-monitor Niri session, hold a glib::WeakRef to (or otherwise track) a drawer/sidebar/frame/OSD/toast window that's never been opened on the secondary output, force several kanshi profile switches (hot-plug/hot-unplug cycles), and confirm:

1. The tracked window's WeakRef no longer upgrades after the corresponding close_all (or, short of instrumenting a WeakRef, that gtk::Window::toplevels()'s count doesn't grow per cycle for surfaces that were never opened).
2. Plugin panels mounted in the sidebar/drawer still reconcile correctly (respond to plugin state changes) after several such switches — i.e. no stale, orphaned region.rs:392 subscriber is left double-rendering into a dead tree.

Gates run

• unset RUSTC_WRAPPER && cargo clippy -p trollshell --all-targets -- -D warnings — clean.
• cargo test -p trollshell — 233 passed, 0 failed.
• nix fmt twice — 0 files changed both times.