Close desktop safety gaps

config/dot/quickshell/services/Displays.qml

@@ -29,8 +29,24 @@ Singleton {
     // [{ name, description, width, height, refreshRate, scale, transform,
     //    modes: [{ label, mode, width, height, refresh }] }]
     property var monitors: []
+    // Quickshell.screens is the topology authority. The override is only the
+    // isolated harness model; normal sessions always observe Quickshell.
+    property var screenOverride: null
     property string lastError: ""
 
+    readonly property var screenModel: Array.isArray(root.screenOverride)
+        ? root.screenOverride : Quickshell.screens
+    readonly property string screenSignature: root.screenModel
+        .map(screen => typeof screen === "string" ? screen : screen.name)
+        .filter(name => !!name)
+        .sort()
+        .join("|")
+    readonly property var primaryFirstMonitors: root.monitors.slice().sort((left, right) => {
+        if (left.primary !== right.primary)
+            return left.primary ? -1 : 1;
+        return left.name.localeCompare(right.name);
+    })
+
     // Set while a change is applied but not yet confirmed.
     property var pendingPreviousLayout: null
     property var pendingRequestedLayout: null
@@ -113,6 +129,17 @@ Singleton {
 
     Component.onCompleted: root.refresh()
 
+    onScreenSignatureChanged: root.reconcileTopology()
+
+    // A hotplug can invalidate the unconfirmed layout while the confirmation
+    // is visible. Read the current compositor layout first; the normal queued
+    // rollback then filters out any output that has disappeared.
+    function reconcileTopology(): void {
+        root.refresh();
+        if (root.awaitingConfirmation)
+            root.revertWithMessage("A display was connected or disconnected, so Panama restored the previous setting.");
+    }
+
     function refresh(): bool {
         if (!query.running) {
             query.generation = root.operationGeneration;