Never end playback over the cosmetic surround; always shut down OpenVR

Review (SWE-2 Max): a non-standby error re-sending the theatre surround
could end a healthy still, and a non-RuntimeError during DestroyOverlay
skipped VR_ShutdownInternal. drain() now drops a surround that fails for
other reasons, and close() shuts down in finally. Fake overlay handles no
longer depend on call order.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

tests/test_media.py

@@ -81,8 +81,12 @@ class Media(unittest.TestCase):
             write_status(path, **values)
 
         class FakeOverlay:
+            created = 0
+
             def create(self, *a, **k):
-                return len(calls)
+                # Handles in creation order: surround 0, then screen 1 (theatre).
+                FakeOverlay.created += 1
+                return FakeOverlay.created - 1
 
             def call(self, *a):
                 pass

ui/frame_media_player.py

@@ -88,12 +88,14 @@ class Overlay:
     def close(self):
         # Best effort: SteamVR removes a disconnected client's overlays anyway,
         # and a teardown error must not overwrite a finished playback's status.
-        for h in reversed(self.handles):
-            try:
-                self.call('DestroyOverlay', h)
-            except RuntimeError:
-                pass
-        self.vr.VR_ShutdownInternal()
+        try:
+            for h in reversed(self.handles):
+                try:
+                    self.call('DestroyOverlay', h)
+                except RuntimeError:
+                    pass
+        finally:
+            self.vr.VR_ShutdownInternal()
 
 
 def probe(path):
@@ -183,6 +185,8 @@ def play(args):
             except OverlayBusy:
                 pending.insert(0, item)
                 return
+            except RuntimeError:
+                pass  # the surround is cosmetic; never end playback over it
 
     def hold(handle, data, w, h):
         """Keep a still (photo or splat) up until Stop, retrying through standby."""