[radkawar]

X11 virtual input devices currently leave keys and buttons pressed when their last reference disappears. A portal backend crash can therefore leave Shift and a mouse button held on the local desktop.

Track the keycodes/buttons actually submitted to XTest and release them in dispose. For held keysyms, also undo the corresponding modifier latch and return reserved keycodes to the existing keymap pool. Reject out-of-range codes before indexing the tracking arrays. This does not enable RemoteDesktop by default or include the separate keycode/scroll fixes.

Tested on a genuine Mint 22.3 Cinnamon X11 golden VM:

• Built current master 17c9584 and this focused branch. On an isolated authenticated Xvfb display, created devices through the normal Clutter seat factory, held a raw key, Unicode keysym and button, then dropped their final references. Master left keys/buttons pressed and exhausted the reserved-code pool; this branch released all presses and allowed the next device to reuse the returned code.
• Separately tested the Mint 6.6 backport through consented public ScreenCast/RemoteDesktop portals: real decoded PipeWire frames, keyboard, pointer and scroll; killed the exact backend main PID while keys/buttons were held. Session Closed, every XQueryKeymap bit and button mask returned to their starting state, and further public input was rejected. The frontend owner-loss fix is a separate dependency for public Closed delivery.

Native test witness and fork integration: https://github.com/radkawar/xdg-desktop-portal-xapp/tree/assistance/muffin-remote-desktop . This is not a request to merge that portal implementation.

AI disclosure: implementation and testing were assisted by OpenAI Codex. Commits are signed off.