[hanthor]

Fixes #655 (G-GRID-DRAG-CANCEL: "cancelled folder drag changed the saved layout").

Stacked on #674. This branch's base is fix/grid-drag-page-flakes, whose proof helpers (a11y_until) and grid fixes it uses. Merge #674 first; GitHub then retargets this PR to main.

Failure history

The "changed the saved layout" mode on main-equivalent grid code, last 150 ci runs:

• 38518164407 gtk-shell (renovate PR on e789435; grid code identical to main)
• 38355019560 gtk-shell (branch on 495fe04)

#655 counted about 5 in 20 runs earlier on 10-14, mixed with other failures. The remaining G-GRID-DRAG-CANCEL failures in the window ("GTK drag cleanup did not restore arrow before release", "native cancellation evidence…", 6 runs) came from Codex branches that carry #654's rewritten cancel proof, not main's.

Root cause

Runtime::on_manager_input (crates/compositor/src/runtime.rs:1230-1241 on main) consumes Escape to close the overview but leaves the shell's Wayland drag running. The proof sends key Escape and then mouseup. The overview close travels the control socket to the shell, which hides the grid. The release travels the DnD grab to the still-focused grid surface as wl_data_device.drop. When the drop reaches GTK first, the tile under the pointer takes it: on_drop → reorder → GridReflow::commit (crates/shell-gtk/src/overview.rs:642-653), which saves the reorder that the hover reflow had only previewed. In run 38518164407's nested.log the hover timer fires, Escape closes the overview, and the layout ends up saved.

GNOME behaves differently. Mutter's drag grab cancels a client drag on Escape and consumes the key, so the overview stays open and nothing can drop.

Fix

• Smithay 0.7.0 (vendored). Upstream has no way to cancel a client drag: unsetting DnDGrab runs its drop path. This PR ports v1: integrate latest proof candidate and refresh app folders #654's client_dnd_active / cancel_client_dnd. They mark the offer inactive under the grab lock, then unset the grab: the target gets leave, the source gets cancelled, and Accept/SetActions/Receive requests already in flight cannot revive the offer. A dead origin or source also cancels, and the terminal path runs once. The patch is documented in third-party/smithay/ROOST-PATCH.md with its isolated diff in DND-CANCEL-API-PATCH.diff.
• Runtime. An Escape press while a client drag holds the pointer or touch cancels the drag and is consumed, along with its repeats and its release. The flag clears when the lock takes the keyboard. Plain Escape still closes the overview. The state file reports client_dnd_active.
• Tests. v1: integrate latest proof candidate and refresh app folders #654's socketpair tests in crates/compositor/tests/data_device.rs cover pointer and touch drags, with and without an icon or a source, and a normal drop that still Receives and Finishes.
• Proof. It waits for .client_dnd_active and presses Escape. It then requires client_dnd_active false with overview_open and overview_app_grid still true, and polls the shell until its arrows are back and its hints are gone, all before releasing the button. The old "Escape may close the overview, reopen it" branch is removed.

#654 carries the same Smithay/runtime hunks verbatim, so it should rebase cleanly over this. One difference: #654's own flake, "GTK drag cleanup did not restore arrow before release", is a proof race. It dumps AT-SPI once, right after client_dnd_active turns false, before GTK has processed the cancel. This proof polls instead.

Validation

Exact-head reruns of gtk-shell and journey are listed below as they finish.