event_loop, a11y, text_shaping: AccessKit AT-SPI2 bridge, cross-app clipboard, xdg-activation, HarfBuzz shaping, multi-touch hooks

Five orthogonal capabilities land together because they share the same `try_run` plumbing: an optional global is bound at startup, a piece of state is added to `AppData`, the run-loop iteration drains an inbox / pushes a frame snapshot, and the public surface gains a small set of opt-in `App` hooks. Nothing here breaks an existing app — every new path degrades to a no-op when the compositor does not advertise the relevant global or when the platform adapter cannot start.
AT-SPI2 accessibility via AccessKit. A new `src/a11y/` module owns the platform adapter and the inbound `ActionRequest` channel. `A11yState::try_new` constructs an `accesskit_unix::Adapter`; when the AT-SPI2 daemon is not on the session bus (headless CI, locked-down compositors) the constructor returns `None` and the rest of the pipeline runs unchanged. After every successful `draw_frame`, the run loop builds a fresh `accesskit::TreeUpdate` from `widget_rects` and pushes it through the adapter — main surface plus every visible overlay, each translated to global coordinates via `surface_offset_for` so screen readers report positions in the same frame the user sees. Buttons / toggles / checkboxes / radios / list items / sliders / text edits map to the matching `Role`s; `Click` and `Focus` actions are advertised on every interactive node; inbound action requests are drained at the top of each iteration and translated into a synthetic press / focus on the matching widget. The integration is documented as best-effort in `docs/architecture.md` under "Known gaps and non-goals": hierarchical nesting, per-widget accessible names, live regions and `Action::SetValue` are listed as the natural follow-ups that the foundation now supports but does not yet wire.
Cross-application clipboard via `wl_data_device_manager`. A new `src/event_loop/data_device.rs` bridges the existing process-local `clipboard: String` to the Wayland selection. Outbound (Ctrl+C / Cut): after the local clipboard is populated, `publish_clipboard_selection` creates a `CopyPasteSource` offering `text/plain;charset=utf-8` and installs it as the seat's selection; `DataSourceHandler::send` writes the cached string into the fd the peer hands us. Inbound (Ctrl+V from another app): `DataDeviceHandler::selection` asks for the offered text via `WlDataOffer::receive`, spawns a tiny worker thread to drain the read pipe with a 16 MiB cap to prevent paste-bomb DoS, and posts the result back through an `mpsc::Sender` that the run loop drains each iteration into `data.clipboard`. The `clipboard:` field's doc-comment is updated to reflect the new behaviour: process-local when the compositor does not advertise the global, synchronised with the seat selection otherwise.
External drag-and-drop reception. The same `data_device` module handles `DragOffer` enter / motion / leave / drop_performed: `on_drop_motion( x, y )` fires while the drag hovers over the surface, `on_drop_leave()` when it withdraws without dropping, and `on_drop_received( x, y, mime, text )` when an external payload (`text/uri-list`, `text/plain`, …) is released on top of an ltk window. The receive path reuses the same worker-thread / channel pattern as the clipboard so the run loop never blocks on the read fd. Three new `App` hooks expose the events with no-op defaults; apps that ignore them get the previous behaviour.
`xdg-activation-v1`. The global is bound optionally; when it is present, `try_run` reads `$XDG_ACTIVATION_TOKEN` from the environment, removes it immediately (single-use; preventing leaks into child processes) and stashes it on `AppData::activation_token_pending`. After the first successful configure of the main surface — the earliest point at which `xdg_activation_v1.activate` is meaningful — the token is consumed once and the surface raised to focus. Compositors without the global leave `activation_state` as `None` and the inbound path silently degrades. An `App::request_activation_token` outbound path is reserved on the trait but not yet exercised here.
HarfBuzz shaping. A new `src/text_shaping.rs::shape_line` drives both renderers: the logical-order string is run through `unicode-bidi`, split into per-font sub-runs, and shaped through `rustybuzz`. Each `PositionedGlyph` carries the per-font `glyph_id`, the visual advance and the ink offsets — exactly what `fontdue::Font::rasterize_indexed` needs to render Arabic connected forms, Devanagari clusters and CJK shaped glyphs correctly. The GLES atlas is re-keyed on `(glyph_id, size_bits, font_id)` so glyphs from different fonts at the same size no longer collide, and the atlas format is selected per ES profile (`GL_R8` / `GL_RED` on ES3, `GL_LUMINANCE` on ES2) — the fragment shader samples `.r` for both, since `GL_LUMINANCE` replicates the coverage byte into `.r=.g=.b`. Software path follows the same key. New `Cargo.toml` deps: `unicode-bidi = "0.3"`, `rustybuzz = "0.14"`.
Multi-touch hooks. `App::on_touch_down / on_touch_move / on_touch_up( id, x, y )` expose the raw `wl_touch.id` of every secondary finger. The first finger to land remains the *primary slot* and is fed through the regular gesture machine (`on_pointer_*`, swipe, scroll, long-press, drag-and-drop). Every additional finger fires the new callbacks instead, leaving the existing single-slot behaviour untouched for apps that do not override them. This is the substrate for app-defined pinch-zoom / two-finger pan; the toolkit itself does not yet ship a built-in pinch gesture (called out in the same "Known gaps" doc section).
`event_loop::frame` extracted from `draw/mod.rs`. The `draw_frame` orchestrator and its per-format SHM helper (`pick_shm_format`) move into `src/event_loop/frame.rs`, leaving `draw/` strictly responsible for per-surface paint primitives. The import in `event_loop/run.rs` is rewritten accordingly; `draw/mod.rs` shrinks from 192-line orchestrator to a thin module index.
Overlay teardown safety. `AppData::discard_overlay( id )` synchronously removes a destroyed overlay from the map and rewrites every per-device focus that pointed at it (pointer, keyboard, every touch slot), migrating an in-flight long-press drag to the main surface the same way `reconcile_overlays` does. Used by the compositor-driven destruction paths (`PopupHandler::done`, `LayerShellHandler::closed`) where waiting for the next reconcile would leave a window in which `surface()` / `surface_mut()` panic. The non-panicking siblings `try_surface` / `try_surface_mut` are added for callers on async dispatch paths (IME `Done`, tooltip arm) that may race a teardown.
Miscellaneous. CI: `master` → `main` to match the actual default branch. `Makefile` adds `cargo run --example dialog` to the examples target. `src/lib.rs` re-exports `widget::scroll::ScrollAxis` so apps can configure a `scroll()` axis without reaching into a `pub(crate)` module. `Cargo.toml` adds `accesskit = "0.17"` and `accesskit_unix = "0.13"`. `docs/architecture.md` gains the "Known gaps and non-goals" section that enumerates the new capabilities, what still ships flat, and what is deferred (per-widget a11y labels, primary selection, intra-process multi-touch gestures, `wp_fractional_scale_v1`).

src/event_loop/app_data.rs

@@ -80,6 +80,56 @@ pub struct AppData<A: App>
 	pub current_cursor_shape: Option<crate::types::CursorShape>,
 	pub text_input_manager: Option<ZwpTextInputManagerV3>,
 	pub text_input:         Option<ZwpTextInputV3>,
+	/// `xdg-activation-v1`. Present when the compositor advertises the
+	/// global. Used on first configure to honour an incoming
+	/// `XDG_ACTIVATION_TOKEN` (a launcher that spawned us wants the
+	/// main surface raised to focus) and exposed via
+	/// [`App::request_activation_token`] for outbound requests.
+	pub activation_state:
+		Option<smithay_client_toolkit::activation::ActivationState>,
+	/// Honour the activation token exactly once — after the first
+	/// successful configure of the main surface. Subsequent configures
+	/// (resizes, scale changes) must not re-activate.
+	pub activation_token_pending: Option<String>,
+
+	/// `wl_data_device_manager` binding. `None` when the compositor
+	/// does not advertise the global, in which case copy / paste stays
+	/// process-local and inbound selections from other clients are
+	/// invisible.
+	pub data_device_manager:
+		Option<smithay_client_toolkit::data_device_manager::DataDeviceManagerState>,
+	/// Per-seat `wl_data_device` handle, created the first time a seat
+	/// with a keyboard or pointer capability appears. Required for
+	/// `set_selection` and to receive inbound `selection` events.
+	pub data_device:
+		Option<smithay_client_toolkit::data_device_manager::data_device::DataDevice>,
+	/// Currently-published outbound selection source. Held alive
+	/// across [`DataSourceHandler::send_request`] so the cached
+	/// clipboard text can be re-served on each paste from the peer.
+	pub clipboard_source:
+		Option<smithay_client_toolkit::data_device_manager::data_source::CopyPasteSource>,
+	/// Sender half of the cross-thread channel used to ferry inbound
+	/// selection bytes (a worker thread drains the read pipe).
+	pub clipboard_inbox_tx: std::sync::mpsc::Sender<String>,
+	/// Receiver half — drained once per run loop iteration.
+	pub clipboard_inbox_rx: std::sync::mpsc::Receiver<String>,
+
+	/// Cross-application drag-and-drop: best mime negotiated on
+	/// `enter` and the last pointer position (in logical surface
+	/// coords). Cleared on `leave` and after `drop_performed`.
+	pub drop_position: Option<( f64, f64 )>,
+	pub drop_mime:     Option<String>,
+	pub drop_inbox_tx: std::sync::mpsc::Sender<super::data_device::DropPayload>,
+	pub drop_inbox_rx: std::sync::mpsc::Receiver<super::data_device::DropPayload>,
+
+	/// AccessKit / AT-SPI2 adapter. `None` when the platform adapter
+	/// could not be created (no AT-SPI2 daemon on the session bus,
+	/// missing system libraries at runtime, headless CI). The
+	/// runtime carries on without an accessibility tree in that
+	/// case; nothing else in the pipeline reads this field except
+	/// the per-frame tree update and the per-iteration action
+	/// inbox drain.
+	pub a11y: Option<crate::a11y::A11yState>,
 	/// Client-side handle to `ext-foreign-toplevel-list-v1`. Holds the
 	/// global proxy plus the live list of open toplevels; SCTK fans
 	/// events through this object into our `ForeignToplevelListHandler`
@@ -113,12 +163,13 @@ pub struct AppData<A: App>
 	/// pointer leaving the surface, a gesture cancel, focus loss or
 	/// long-press promotion.
 	pub button_repeat:      Option<ButtonRepeatState>,
-	/// Process-local clipboard buffer. Copy / Cut store the selected
-	/// text here; Paste retrieves from here. Cross-application
-	/// clipboard via `wl_data_device_manager` is intentionally not
-	/// wired up — most app workflows need a same-process buffer first
-	/// (move text between fields, undo a delete by paste-back) and
-	/// the Wayland integration is a sizeable separate piece.
+	/// Clipboard buffer. Copy / Cut store the selected text here;
+	/// Paste retrieves from here. Synchronised with the Wayland
+	/// selection through `wl_data_device_manager` when the compositor
+	/// advertises the global: outbound copies publish a
+	/// `CopyPasteSource`, and inbound selections from other clients
+	/// land here through a worker thread (see
+	/// [`super::data_device`]).
 	pub clipboard:          String,
 	/// Timestamp of the previous press (pointer or touch). Combined
 	/// with [`Self::last_press_pos`] it lets the press handler
@@ -222,6 +273,18 @@ impl<A: App> AppData<A>
 		}
 	}
 
+	/// Non-panicking variant of [`surface`]. Returns `None` when `focus`
+	/// refers to an overlay that has already been removed — callers on
+	/// async dispatch paths (IME Done, tooltip arm) must use this.
+	pub( crate ) fn try_surface( &self, focus: SurfaceFocus ) -> Option<&SurfaceState<A::Message>>
+	{
+		match focus
+		{
+			SurfaceFocus::Main         => Some( &self.main ),
+			SurfaceFocus::Overlay( id ) => self.overlays.get( &id ),
+		}
+	}
+
 	/// Mutable counterpart of [`surface`].
 	#[allow( dead_code )]
 	pub( crate ) fn surface_mut( &mut self, focus: SurfaceFocus ) -> &mut SurfaceState<A::Message>
@@ -234,12 +297,90 @@ impl<A: App> AppData<A>
 		}
 	}
 
+	/// Non-panicking variant of [`surface_mut`].
+	pub( crate ) fn try_surface_mut( &mut self, focus: SurfaceFocus ) -> Option<&mut SurfaceState<A::Message>>
+	{
+		match focus
+		{
+			SurfaceFocus::Main         => Some( &mut self.main ),
+			SurfaceFocus::Overlay( id ) => self.overlays.get_mut( &id ),
+		}
+	}
+
+	/// Synchronous overlay teardown: removes the overlay from the map
+	/// and rewrites every per-device focus that pointed at it so the
+	/// next event in the same dispatch can no longer land on a freed
+	/// surface. Used by the compositor-driven destruction paths
+	/// (`PopupHandler::done`, `LayerShellHandler::closed`) where
+	/// waiting for the next `reconcile_overlays` would leave a window
+	/// in which `surface()` / `surface_mut()` panic. Migrates an
+	/// in-flight long-press drag to the main surface for the same
+	/// reason `reconcile_overlays` does.
+	pub( crate ) fn discard_overlay( &mut self, id: crate::app::OverlayId )
+	{
+		if let Some( ss ) = self.overlays.remove( &id )
+		{
+			if ss.gesture.long_press_fired
+			{
+				self.main.gesture.long_press_fired  = true;
+				self.main.gesture.long_press_origin = ss.gesture.long_press_origin;
+			}
+		}
+		if let SurfaceFocus::Overlay( fid ) = self.pointer_focus
+		{
+			if fid == id { self.pointer_focus = SurfaceFocus::Main; }
+		}
+		if let SurfaceFocus::Overlay( fid ) = self.keyboard_focus
+		{
+			if fid == id { self.keyboard_focus = SurfaceFocus::Main; }
+		}
+		for f in self.touch_focus.values_mut()
+		{
+			if let SurfaceFocus::Overlay( fid ) = *f
+			{
+				if fid == id { *f = SurfaceFocus::Main; }
+			}
+		}
+		if let Some( pending ) = self.tooltip_pending.as_ref()
+		{
+			if pending.focus == SurfaceFocus::Overlay( id ) { self.tooltip_pending = None; }
+		}
+		if let Some( visible ) = self.tooltip_visible.as_ref()
+		{
+			if visible.focus == SurfaceFocus::Overlay( id )
+			{
+				self.tooltip_visible = None;
+				self.overlays_dirty  = true;
+			}
+		}
+	}
+
 	// Configure the main surface size, (re)allocate its rendering target, and
 	// request a redraw. Routes to the GPU or SHM path inside `SurfaceState`
 	// according to whether `self.egl_context` is available.
 	pub( crate ) fn on_configure( &mut self, w: u32, h: u32 )
 	{
 		self.main.on_configure( &self.shm, self.egl_context.as_ref(), w, h );
+		if let Some( ref mut a ) = self.a11y
+		{
+			let sf = self.main.scale_factor.max( 1 ) as f64;
+			a.set_window_bounds( ( w as f64 ) * sf, ( h as f64 ) * sf );
+			a.set_window_focus( true );
+		}
+		// First-configure latch: honour an incoming
+		// `XDG_ACTIVATION_TOKEN` exactly once, after the surface has
+		// been mapped (`xdg_activation_v1.activate` is only meaningful
+		// against a configured surface). Compositors that don't
+		// advertise the global leave `activation_state` as `None` and
+		// the call drops the token silently.
+		if let Some( token ) = self.activation_token_pending.take()
+		{
+			if let ( Some( ref activation ), Some( wl ) ) =
+				( self.activation_state.as_ref(), self.main.surface.try_wl_surface() )
+			{
+				activation.activate::<Self>( &wl, token );
+			}
+		}
 		// `on_resize` is documented to deliver **physical** pixels, matching the
 		// coordinate space that the layout passes and the pointer/touch
 		// callbacks (`on_drag_move`, `on_drop`) work in. Wayland's