event_loop, a11y, text_shaping: AccessKit AT-SPI2 bridge, cross-app clipboard, xdg-activation, HarfBuzz shaping, multi-touch hooks

Five orthogonal capabilities land together because they share the same `try_run` plumbing: an optional global is bound at startup, a piece of state is added to `AppData`, the run-loop iteration drains an inbox / pushes a frame snapshot, and the public surface gains a small set of opt-in `App` hooks. Nothing here breaks an existing app — every new path degrades to a no-op when the compositor does not advertise the relevant global or when the platform adapter cannot start.
AT-SPI2 accessibility via AccessKit. A new `src/a11y/` module owns the platform adapter and the inbound `ActionRequest` channel. `A11yState::try_new` constructs an `accesskit_unix::Adapter`; when the AT-SPI2 daemon is not on the session bus (headless CI, locked-down compositors) the constructor returns `None` and the rest of the pipeline runs unchanged. After every successful `draw_frame`, the run loop builds a fresh `accesskit::TreeUpdate` from `widget_rects` and pushes it through the adapter — main surface plus every visible overlay, each translated to global coordinates via `surface_offset_for` so screen readers report positions in the same frame the user sees. Buttons / toggles / checkboxes / radios / list items / sliders / text edits map to the matching `Role`s; `Click` and `Focus` actions are advertised on every interactive node; inbound action requests are drained at the top of each iteration and translated into a synthetic press / focus on the matching widget. The integration is documented as best-effort in `docs/architecture.md` under "Known gaps and non-goals": hierarchical nesting, per-widget accessible names, live regions and `Action::SetValue` are listed as the natural follow-ups that the foundation now supports but does not yet wire.
Cross-application clipboard via `wl_data_device_manager`. A new `src/event_loop/data_device.rs` bridges the existing process-local `clipboard: String` to the Wayland selection. Outbound (Ctrl+C / Cut): after the local clipboard is populated, `publish_clipboard_selection` creates a `CopyPasteSource` offering `text/plain;charset=utf-8` and installs it as the seat's selection; `DataSourceHandler::send` writes the cached string into the fd the peer hands us. Inbound (Ctrl+V from another app): `DataDeviceHandler::selection` asks for the offered text via `WlDataOffer::receive`, spawns a tiny worker thread to drain the read pipe with a 16 MiB cap to prevent paste-bomb DoS, and posts the result back through an `mpsc::Sender` that the run loop drains each iteration into `data.clipboard`. The `clipboard:` field's doc-comment is updated to reflect the new behaviour: process-local when the compositor does not advertise the global, synchronised with the seat selection otherwise.
External drag-and-drop reception. The same `data_device` module handles `DragOffer` enter / motion / leave / drop_performed: `on_drop_motion( x, y )` fires while the drag hovers over the surface, `on_drop_leave()` when it withdraws without dropping, and `on_drop_received( x, y, mime, text )` when an external payload (`text/uri-list`, `text/plain`, …) is released on top of an ltk window. The receive path reuses the same worker-thread / channel pattern as the clipboard so the run loop never blocks on the read fd. Three new `App` hooks expose the events with no-op defaults; apps that ignore them get the previous behaviour.
`xdg-activation-v1`. The global is bound optionally; when it is present, `try_run` reads `$XDG_ACTIVATION_TOKEN` from the environment, removes it immediately (single-use; preventing leaks into child processes) and stashes it on `AppData::activation_token_pending`. After the first successful configure of the main surface — the earliest point at which `xdg_activation_v1.activate` is meaningful — the token is consumed once and the surface raised to focus. Compositors without the global leave `activation_state` as `None` and the inbound path silently degrades. An `App::request_activation_token` outbound path is reserved on the trait but not yet exercised here.
HarfBuzz shaping. A new `src/text_shaping.rs::shape_line` drives both renderers: the logical-order string is run through `unicode-bidi`, split into per-font sub-runs, and shaped through `rustybuzz`. Each `PositionedGlyph` carries the per-font `glyph_id`, the visual advance and the ink offsets — exactly what `fontdue::Font::rasterize_indexed` needs to render Arabic connected forms, Devanagari clusters and CJK shaped glyphs correctly. The GLES atlas is re-keyed on `(glyph_id, size_bits, font_id)` so glyphs from different fonts at the same size no longer collide, and the atlas format is selected per ES profile (`GL_R8` / `GL_RED` on ES3, `GL_LUMINANCE` on ES2) — the fragment shader samples `.r` for both, since `GL_LUMINANCE` replicates the coverage byte into `.r=.g=.b`. Software path follows the same key. New `Cargo.toml` deps: `unicode-bidi = "0.3"`, `rustybuzz = "0.14"`.
Multi-touch hooks. `App::on_touch_down / on_touch_move / on_touch_up( id, x, y )` expose the raw `wl_touch.id` of every secondary finger. The first finger to land remains the *primary slot* and is fed through the regular gesture machine (`on_pointer_*`, swipe, scroll, long-press, drag-and-drop). Every additional finger fires the new callbacks instead, leaving the existing single-slot behaviour untouched for apps that do not override them. This is the substrate for app-defined pinch-zoom / two-finger pan; the toolkit itself does not yet ship a built-in pinch gesture (called out in the same "Known gaps" doc section).
`event_loop::frame` extracted from `draw/mod.rs`. The `draw_frame` orchestrator and its per-format SHM helper (`pick_shm_format`) move into `src/event_loop/frame.rs`, leaving `draw/` strictly responsible for per-surface paint primitives. The import in `event_loop/run.rs` is rewritten accordingly; `draw/mod.rs` shrinks from 192-line orchestrator to a thin module index.
Overlay teardown safety. `AppData::discard_overlay( id )` synchronously removes a destroyed overlay from the map and rewrites every per-device focus that pointed at it (pointer, keyboard, every touch slot), migrating an in-flight long-press drag to the main surface the same way `reconcile_overlays` does. Used by the compositor-driven destruction paths (`PopupHandler::done`, `LayerShellHandler::closed`) where waiting for the next reconcile would leave a window in which `surface()` / `surface_mut()` panic. The non-panicking siblings `try_surface` / `try_surface_mut` are added for callers on async dispatch paths (IME `Done`, tooltip arm) that may race a teardown.
Miscellaneous. CI: `master` → `main` to match the actual default branch. `Makefile` adds `cargo run --example dialog` to the examples target. `src/lib.rs` re-exports `widget::scroll::ScrollAxis` so apps can configure a `scroll()` axis without reaching into a `pub(crate)` module. `Cargo.toml` adds `accesskit = "0.17"` and `accesskit_unix = "0.13"`. `docs/architecture.md` gains the "Known gaps and non-goals" section that enumerates the new capabilities, what still ships flat, and what is deferred (per-widget a11y labels, primary selection, intra-process multi-touch gestures, `wp_fractional_scale_v1`).

src/event_loop/data_device.rs

@@ -0,0 +1,251 @@
+// SPDX-License-Identifier: LGPL-2.1-only
+// Copyright (C) 2026 Liberux Labs, S. L. <info@liberux.net>
+
+//! `wl_data_device_manager` integration — cross-application
+//! clipboard.
+//!
+//! This module bridges ltk's process-local `clipboard: String` to the
+//! Wayland selection so that:
+//!
+//! * **Outbound (Ctrl+C / Cut)** — after the local clipboard is
+//!   populated, [`AppData::publish_clipboard_selection`] creates a
+//!   [`CopyPasteSource`] offering `text/plain;charset=utf-8` and
+//!   installs it as the seat's selection. When a peer pastes,
+//!   [`DataSourceHandler::send`] writes the cached string into the
+//!   fd the peer hands us.
+//!
+//! * **Inbound (Ctrl+V from another app)** — when the compositor
+//!   advertises a new selection through
+//!   [`DataDeviceHandler::selection`], we ask for it as UTF-8 text
+//!   via `WlDataOffer::receive`, spawn a tiny thread to drain the
+//!   read pipe, and post the result back to the event loop through
+//!   the runtime's existing `ChannelSender`-style channel. The
+//!   message just updates `self.clipboard`; subsequent local pastes
+//!   pick the new value up the next time the user hits Ctrl+V.
+//!
+//! Drag-and-drop across applications uses the same protocol but
+//! involves enter / leave / motion / drop_performed wiring with
+//! widget hit-tests, surface coordinates and drop targets that are a
+//! separate concern. The handlers in this file accept those events
+//! but currently route them to no-ops; an explicit follow-up will
+//! cover DnD targets.
+
+use std::io::Read;
+use std::sync::mpsc;
+
+use smithay_client_toolkit::data_device_manager::data_device::{ DataDeviceData, DataDeviceHandler };
+use smithay_client_toolkit::data_device_manager::data_offer::{ DataOfferHandler, DragOffer, SelectionOffer };
+use smithay_client_toolkit::data_device_manager::data_source::DataSourceHandler;
+use smithay_client_toolkit::reexports::client::
+{
+	protocol::
+	{
+		wl_data_device::WlDataDevice,
+		wl_data_device_manager::DndAction,
+		wl_data_source::WlDataSource,
+		wl_surface::WlSurface,
+	},
+	Connection, Proxy, QueueHandle,
+};
+
+use crate::app::App;
+use super::app_data::AppData;
+
+/// MIME type we advertise on outbound copies and request on inbound
+/// pastes. `text/plain;charset=utf-8` is the de-facto cross-toolkit
+/// baseline (GTK, Qt, electron, Firefox all carry it); `UTF8_STRING`
+/// is the X11-era legacy alias still emitted by some compositors.
+pub( super ) const CLIPBOARD_MIMES: &[ &str ] = &[ "text/plain;charset=utf-8", "text/plain", "UTF8_STRING" ];
+
+/// Mimes accepted for inter-application drag-and-drop. URI lists
+/// (file managers, browsers) come first because they are the most
+/// useful payload for typical desktop drops.
+pub( super ) const DND_MIMES: &[ &str ] = &[ "text/uri-list", "text/plain;charset=utf-8", "text/plain", "UTF8_STRING" ];
+
+/// Payload delivered from the DnD worker thread back to the run loop.
+pub( crate ) struct DropPayload
+{
+	pub mime: String,
+	pub text: String,
+	pub x:    f64,
+	pub y:    f64,
+}
+
+pub( crate ) fn drop_inbox() -> ( std::sync::mpsc::Sender<DropPayload>, std::sync::mpsc::Receiver<DropPayload> )
+{
+	std::sync::mpsc::channel()
+}
+
+impl<A: App> AppData<A>
+{
+	/// Publish the current `self.clipboard` value as the seat's
+	/// selection so other applications can paste it. Called by the
+	/// copy / cut handlers after they populate the local buffer.
+	/// No-op when the compositor does not advertise
+	/// `wl_data_device_manager` or when no seat has appeared yet.
+	pub( crate ) fn publish_clipboard_selection( &mut self )
+	{
+		let ( Some( ref ddm ), Some( ref dd ) ) = ( self.data_device_manager.as_ref(), self.data_device.as_ref() ) else { return };
+		let source = ddm.create_copy_paste_source( &self.qh, CLIPBOARD_MIMES.iter().copied() );
+		source.set_selection( dd, self.last_input_serial );
+		// Hold the source alive: the compositor only keeps the
+		// selection while the `WlDataSource` is not dropped. We also
+		// need to hang on to it so `DataSourceHandler::send` can find
+		// the cached text via `self.clipboard`.
+		self.clipboard_source = Some( source );
+	}
+}
+
+impl<A: App> DataDeviceHandler for AppData<A>
+{
+	fn enter(
+		&mut self,
+		_c: &Connection,
+		_qh: &QueueHandle<Self>,
+		d:   &WlDataDevice,
+		x:   f64,
+		y:   f64,
+		_s:  &WlSurface,
+	)
+	{
+		let Some( data )  = d.data::<DataDeviceData>() else { return };
+		let Some( offer ) = data.drag_offer()          else { return };
+		let mimes = offer.with_mime_types( |m| m.to_vec() );
+		let accepted = DND_MIMES.iter().copied()
+			.find( |c| mimes.iter().any( |m| m == *c ) )
+			.map( |s| s.to_string() );
+		offer.accept_mime_type( self.last_input_serial, accepted.clone() );
+		offer.set_actions( smithay_client_toolkit::reexports::client::protocol::wl_data_device_manager::DndAction::Copy,
+			smithay_client_toolkit::reexports::client::protocol::wl_data_device_manager::DndAction::Copy );
+		self.drop_position = Some( ( x, y ) );
+		self.drop_mime     = accepted;
+		self.app.on_drop_motion( x as f32, y as f32 );
+	}
+
+	fn leave( &mut self, _c: &Connection, _qh: &QueueHandle<Self>, _d: &WlDataDevice )
+	{
+		if self.drop_position.is_some() { self.app.on_drop_leave(); }
+		self.drop_position = None;
+		self.drop_mime     = None;
+	}
+
+	fn motion( &mut self, _c: &Connection, _qh: &QueueHandle<Self>, _d: &WlDataDevice, x: f64, y: f64 )
+	{
+		self.drop_position = Some( ( x, y ) );
+		self.app.on_drop_motion( x as f32, y as f32 );
+	}
+
+	fn drop_performed( &mut self, _c: &Connection, _qh: &QueueHandle<Self>, d: &WlDataDevice )
+	{
+		let Some( data )  = d.data::<DataDeviceData>() else { return };
+		let Some( offer ) = data.drag_offer()          else { return };
+		let Some( mime )  = self.drop_mime.clone()     else { offer.finish(); return };
+		let ( x, y )      = self.drop_position.unwrap_or( ( 0.0, 0.0 ) );
+		let Ok( pipe )    = offer.receive( mime.clone() ) else { offer.finish(); return };
+		offer.finish();
+		let tx = self.drop_inbox_tx.clone();
+		std::thread::spawn( move ||
+		{
+			use std::io::Read;
+			let mut reader = std::fs::File::from( std::os::fd::OwnedFd::from( pipe ) );
+			let mut buf    = String::new();
+			let mut bounded = ( &mut reader ).take( 16 * 1024 * 1024 );
+			let _ = bounded.read_to_string( &mut buf );
+			let _ = tx.send( DropPayload { mime, text: buf, x, y } );
+		} );
+		self.drop_position = None;
+		self.drop_mime     = None;
+	}
+
+	/// A new selection arrived from another client. Negotiate
+	/// UTF-8 text on a background thread (the receive side of the
+	/// data offer is a blocking read pipe) and post the result back
+	/// into the event loop through `clipboard_inbox`. The main loop
+	/// drains the inbox once per iteration and copies the bytes
+	/// into `self.clipboard`.
+	fn selection( &mut self, _conn: &Connection, _qh: &QueueHandle<Self>, data_device: &WlDataDevice )
+	{
+		let Some( data ) = data_device.data::<DataDeviceData>() else { return };
+		let Some( offer ) = data.selection_offer() else { return };
+		let Some( mime )  = pick_mime( &offer ) else { return };
+		let Ok( pipe )    = offer.receive( mime ) else { return };
+		let tx            = self.clipboard_inbox_tx.clone();
+		std::thread::spawn( move ||
+		{
+			let mut reader = std::fs::File::from( std::os::fd::OwnedFd::from( pipe ) );
+			let mut buf    = String::new();
+			// 16 MiB cap. Compositors are free to keep typing into the
+			// pipe forever; a runaway selection should not exhaust
+			// memory or stall the worker thread indefinitely.
+			let mut bounded = (&mut reader).take( 16 * 1024 * 1024 );
+			let _ = bounded.read_to_string( &mut buf );
+			let _ = tx.send( buf );
+		} );
+	}
+}
+
+impl<A: App> DataOfferHandler for AppData<A>
+{
+	fn source_actions( &mut self, _c: &Connection, _qh: &QueueHandle<Self>, _offer: &mut DragOffer, _actions: DndAction ) {}
+	fn selected_action( &mut self, _c: &Connection, _qh: &QueueHandle<Self>, _offer: &mut DragOffer, _actions: DndAction ) {}
+}
+
+impl<A: App> DataSourceHandler for AppData<A>
+{
+	fn accept_mime( &mut self, _c: &Connection, _qh: &QueueHandle<Self>, _source: &WlDataSource, _mime: Option<String> ) {}
+
+	fn send_request( &mut self, _conn: &Connection, _qh: &QueueHandle<Self>, source: &WlDataSource, _mime: String, fd: smithay_client_toolkit::data_device_manager::WritePipe )
+	{
+		// Only honour requests for our own active source — if a stale
+		// source is still hanging around (e.g. between a new copy and
+		// the compositor dropping the previous selection) the peer
+		// might still ask for its data; we just write nothing rather
+		// than leak the new clipboard contents through an old source.
+		let is_active = self.clipboard_source.as_ref()
+			.map( |s| s.inner() == source )
+			.unwrap_or( false );
+		if !is_active { return; }
+		// SCTK's `WritePipe` derefs to `OwnedFd`; convert to a `File`
+		// (no buffering — selection payloads are small) and write the
+		// cached clipboard string. Errors (peer closed early, broken
+		// pipe) are ignored: we cannot recover and the compositor
+		// will issue a fresh source on the next copy anyway.
+		use std::io::Write;
+		let mut writer = std::fs::File::from( std::os::fd::OwnedFd::from( fd ) );
+		let _ = writer.write_all( self.clipboard.as_bytes() );
+	}
+
+	fn cancelled( &mut self, _c: &Connection, _qh: &QueueHandle<Self>, source: &WlDataSource )
+	{
+		// Compositor dropped our source (another client claimed the
+		// selection). Drop the cached handle so a future copy creates
+		// a fresh one.
+		if self.clipboard_source.as_ref().map( |s| s.inner() == source ).unwrap_or( false )
+		{
+			self.clipboard_source = None;
+		}
+	}
+
+	fn dnd_dropped( &mut self, _c: &Connection, _qh: &QueueHandle<Self>, _source: &WlDataSource ) {}
+	fn dnd_finished( &mut self, _c: &Connection, _qh: &QueueHandle<Self>, _source: &WlDataSource ) {}
+	fn action( &mut self, _c: &Connection, _qh: &QueueHandle<Self>, _source: &WlDataSource, _action: DndAction ) {}
+}
+
+/// Pick the best-supported MIME type from a selection offer. Order
+/// matches `CLIPBOARD_MIMES` — UTF-8 first, then plain text, then
+/// the legacy `UTF8_STRING`.
+fn pick_mime( offer: &SelectionOffer ) -> Option<String>
+{
+	let mimes = offer.with_mime_types( |m| m.to_vec() );
+	CLIPBOARD_MIMES.iter()
+		.find( |c| mimes.iter().any( |m| m == *c ) )
+		.map( |s| s.to_string() )
+}
+
+/// Buffered channel pair used to ferry inbound-selection bytes from
+/// the read-pipe worker thread to the event loop. The receiver is
+/// drained once per iteration inside the main run loop.
+pub( crate ) fn clipboard_inbox() -> ( mpsc::Sender<String>, mpsc::Receiver<String> )
+{
+	mpsc::channel()
+}