fix: Preserve capture correctness across output changes

CONTRIBUTING.md

@@ -129,6 +129,30 @@ For offline work, prefetch dependencies first:
 ./tools/fetch-all-deps.sh
 ```
 
+### Freeze, zoom, and capture manual matrix
+
+Geometry unit tests cover crop arithmetic and stale-output rejection, but they do not prove a
+compositor's protocol behavior. For capture-related changes, exercise every unchecked cell below
+on real hardware; this checklist is manual evidence, not CI coverage.
+
+| Compositor | 1x | Fractional scale | Mixed DPI |
+|---|---|---|---|
+| Hyprland | [ ] | [ ] | [ ] |
+| Plasma/KWin | [ ] | [ ] | [ ] |
+| Niri | [ ] | [ ] | [ ] |
+| Sway | [ ] | [ ] | [ ] |
+| GNOME | [ ] | [ ] | [ ] |
+
+For each cell, record the selected capture backend from the logs. Verify that Freeze, Zoom,
+and a PDF desktop backdrop all use the active output's exact pixels. User full-screen
+screenshots remain whole-desktop captures. Repeat while switching outputs and, where supported,
+changing scale or transform during capture: the result must either stay exact or fail visibly,
+never shift, stretch, or reuse another output's image.
+
+These captures now fail when the active output does not advertise a current `wl_output` mode.
+Plugging or unplugging any monitor also cancels in-flight Freeze and Zoom captures on unrelated
+outputs, because output count is part of the layout identity used to reject stale frames.
+
 `./tools/code-health-report.sh` reports navigational maintainability metrics. Its CI artifact is
 observational, not a global file/function-size gate; use the report to find code worth understanding,
 not as a reason for mechanical splitting.

docs/SETUP.md

@@ -181,7 +181,7 @@ Then use the configurator's Daemon tab, or create a GNOME custom shortcut that r
 wayscriber --daemon-toggle
 ```
 
-Freeze prefers compositor-native `wlr-screencopy` or `ext-image-copy-capture` when either protocol is available, then falls back to the screenshot portal. On GNOME, Freeze works when that portal is available and responsive; the first use may show a desktop permission prompt. Portal capture can be slower than direct compositor capture, and mixed-DPI or multi-monitor setups may depend on client-side crop behavior.
+Freeze prefers compositor-native `wlr-screencopy` or `ext-image-copy-capture` when either protocol is available, then falls back to the screenshot portal. On GNOME, Freeze works when that portal is available and responsive; the first use may show a desktop permission prompt. Portal capture can be slower than direct compositor capture. On mixed-DPI or multi-monitor layouts, Wayscriber accepts a portal image only when it can validate the active output's crop; otherwise Freeze fails instead of guessing at an origin or scale. Freeze and Zoom also require the active output to advertise a current mode. Connecting or disconnecting a monitor cancels any in-flight Freeze or Zoom capture, including on screens that did not change.
 
 Light passthrough mode is not available in the regular app on stock GNOME Wayland. GNOME's xdg-shell fallback does not expose the shell-level overlay behavior needed to keep annotations visible while input goes to apps underneath, so `--light-toggle` is intentionally disabled instead of pretending to pass input through. A GNOME Shell extension companion would be the real path for that workflow.
 

docs/codebase-overview.md

@@ -76,7 +76,7 @@ Daemon mode therefore provides a persistent background service that reacts to us
 
 `WaylandState` centralizes everything the handlers need: current buffers, Cairo context, mouse positions, capture state, and tokio handle for async work.
 
-Freeze capture waits for the overlay-suppression frame, then selects `wlr-screencopy`, `ext-image-copy-capture`, or the screenshot portal in that order. The two direct protocols capture the active output into shared memory; the portal captures the desktop and the client crops the selected output when needed.
+Freeze capture waits for the overlay-suppression frame, then selects `wlr-screencopy`, `ext-image-copy-capture`, or the screenshot portal in that order. The two direct protocols capture the active output into shared memory; the portal captures the desktop and the client crops the selected output when needed. Direct capture and portal crop both require compositor-reported output pixels; a missing current mode fails instead of guessing from the overlay buffer.
 
 ---
 

src/backend/wayland/backend/event_loop/capture.rs

@@ -16,7 +16,10 @@ pub(super) fn poll_portal_captures(state: &mut WaylandState, now: Instant) {
         .frozen
         .poll_portal_capture(&mut state.input_state, now);
     handle_pending_frozen_image(state, now);
-    state.zoom.poll_portal_capture(&mut state.input_state, now);
+    let live_output_count = state.live_output_count();
+    state
+        .zoom
+        .poll_portal_capture(&mut state.input_state, now, live_output_count);
     // Portal completion can make the capture controller idle before dispatch.
     // Release its overlay suppression now so the normal blocking dispatch does
     // not wait forever for a wake that has already been consumed.

src/backend/wayland/capture.rs

@@ -40,6 +40,35 @@ pub(in crate::backend::wayland) struct PendingPdfExport {
     pub action: Action,
     pub operation: ImageOperationKind,
     pub save_config: FileSaveConfig,
+    pub layout_context: CaptureLayoutContext,
+}
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(in crate::backend::wayland) struct CaptureLayoutContext {
+    target_output_id: u32,
+    layout_generation: u64,
+}
+
+impl CaptureLayoutContext {
+    pub(in crate::backend::wayland) fn new(target_output_id: u32, layout_generation: u64) -> Self {
+        Self {
+            target_output_id,
+            layout_generation,
+        }
+    }
+
+    pub(in crate::backend::wayland) fn target_output_id(self) -> u32 {
+        self.target_output_id
+    }
+
+    pub(in crate::backend::wayland) fn matches(
+        self,
+        active_output_id: Option<u32>,
+        layout_generation: u64,
+    ) -> bool {
+        active_output_id == Some(self.target_output_id)
+            && layout_generation == self.layout_generation
+    }
 }
 
 /// Tracks capture manager state and in-progress flag.
@@ -222,4 +251,14 @@ mod tests {
         assert_eq!(state.accepted_id(), None);
         assert!(!state.is_in_progress());
     }
+
+    #[test]
+    fn capture_layout_context_rejects_output_or_geometry_generation_changes() {
+        let context = CaptureLayoutContext::new(7, 3);
+
+        assert!(context.matches(Some(7), 3));
+        assert!(!context.matches(Some(8), 3));
+        assert!(!context.matches(Some(7), 4));
+        assert!(!context.matches(None, 3));
+    }
 }

src/backend/wayland/frozen/capture.rs

@@ -21,6 +21,8 @@ use wayland_protocols_wlr::screencopy::v1::client::zwlr_screencopy_frame_v1::{
 };
 use wayland_protocols_wlr::screencopy::v1::client::zwlr_screencopy_manager_v1::ZwlrScreencopyManagerV1;
 
+use crate::backend::wayland::capture::CaptureLayoutContext;
+use crate::backend::wayland::frozen_geometry::require_verified_capture_source;
 use crate::input::InputState;
 
 use super::image::{copy_shm_argb, validate_shm_buffer_layout};
@@ -91,6 +93,7 @@ impl FrozenState {
             self.preferred_backend()
                 .context("no frozen capture backend is available")?,
         );
+        self.snapshot_preflight_layout();
         self.preflight_pending = true;
         Ok(())
     }
@@ -155,6 +158,8 @@ impl FrozenState {
             + Dispatch<ExtOutputImageCaptureSourceManagerV1, ()>
             + 'static,
     {
+        self.ensure_preflight_layout_current()
+            .map_err(anyhow::Error::msg)?;
         let mut backend = Some(first_backend);
         let mut last_error = None;
 
@@ -224,10 +229,12 @@ impl FrozenState {
                 anyhow::bail!("No active output available for frozen capture");
             }
         };
-        let target_output_id = self
-            .active_output_id
-            .context("Active output has no stable identity for frozen capture")?;
-        let source_geometry = self.active_geometry.clone();
+        let (source_geometry, target_output_id) = require_verified_capture_source(
+            self.active_geometry.clone(),
+            self.active_output_id,
+            "frozen capture",
+        )
+        .map_err(anyhow::Error::msg)?;
 
         let pool = SlotPool::new(4, shm).context("Failed to create frozen capture pool")?;
         debug!("Requesting screencopy frame for active output");
@@ -236,7 +243,10 @@ impl FrozenState {
         capture.pool = Some(pool);
         self.direct_capture = Some(DirectCaptureAttempt::WlrScreencopy {
             session: Box::new(capture),
-            context: DirectCaptureContext::new(target_output_id, source_geometry),
+            context: DirectCaptureContext::new(
+                CaptureLayoutContext::new(target_output_id, self.output_layout_generation),
+                source_geometry,
+            ),
         });
 
         Ok(())
@@ -404,11 +414,18 @@ impl FrozenState {
         })();
         capture.frame.destroy();
         let image = result?;
-        if !context.output_matches(self.active_output_id) {
+        if !context
+            .layout
+            .matches(self.active_output_id, self.output_layout_generation)
+        {
             return Ok(false);
         }
 
-        self.set_pending_output_image(image, context.target_output_id, context.source_geometry);
+        self.set_pending_output_image(
+            image,
+            context.layout.target_output_id(),
+            context.source_geometry,
+        );
 
         Ok(true)
     }
@@ -417,5 +434,6 @@ impl FrozenState {
         self.capture_done = true;
         input_state.set_frozen_active(false);
         input_state.needs_redraw = true;
+        Self::push_stale_layout_toast(input_state);
     }
 }

src/backend/wayland/frozen/ext_image_copy.rs

@@ -22,6 +22,8 @@ use wayland_protocols::ext::{
     },
 };
 
+use crate::backend::wayland::capture::CaptureLayoutContext;
+use crate::backend::wayland::frozen_geometry::require_verified_capture_source;
 use crate::input::InputState;
 
 use super::image::{copy_shm_argb, validate_shm_buffer_layout};
@@ -160,10 +162,12 @@ impl FrozenState {
             .active_output
             .as_ref()
             .context("No active output available for ext-image-copy capture")?;
-        let target_output_id = self
-            .active_output_id
-            .context("Active output has no stable identity for ext-image-copy capture")?;
-        let source_geometry = self.active_geometry.clone();
+        let (source_geometry, target_output_id) = require_verified_capture_source(
+            self.active_geometry.clone(),
+            self.active_output_id,
+            "ext-image-copy capture",
+        )
+        .map_err(anyhow::Error::msg)?;
 
         // Allocate the only fallible local resource before creating protocol
         // objects so an allocation failure cannot leave a live source/session.
@@ -175,7 +179,10 @@ impl FrozenState {
             .create_session(&source, Options::empty(), qh, ());
         self.direct_capture = Some(DirectCaptureAttempt::ExtImageCopy {
             session: Box::new(ExtImageCopySession::new(source, session, pool)),
-            context: DirectCaptureContext::new(target_output_id, source_geometry),
+            context: DirectCaptureContext::new(
+                CaptureLayoutContext::new(target_output_id, self.output_layout_generation),
+                source_geometry,
+            ),
         });
         debug!("Requested ext-image-copy capture constraints for active output");
         Ok(())
@@ -396,12 +403,15 @@ impl FrozenState {
             .take_ext_capture()
             .context("ext-image-copy capture attempt missing after frame completion")?;
         (*capture).destroy();
-        if !context.output_matches(self.active_output_id) {
+        if !context
+            .layout
+            .matches(self.active_output_id, self.output_layout_generation)
+        {
             return Ok(false);
         }
         self.set_pending_output_image_with_transform(
             image,
-            context.target_output_id,
+            context.layout.target_output_id(),
             context.source_geometry,
             output_transform,
         );