event_loop, a11y, text_shaping: AccessKit AT-SPI2 bridge, cross-app clipboard, xdg-activation, HarfBuzz shaping, multi-touch hooks

Five orthogonal capabilities land together because they share the same `try_run` plumbing: an optional global is bound at startup, a piece of state is added to `AppData`, the run-loop iteration drains an inbox / pushes a frame snapshot, and the public surface gains a small set of opt-in `App` hooks. Nothing here breaks an existing app — every new path degrades to a no-op when the compositor does not advertise the relevant global or when the platform adapter cannot start.
AT-SPI2 accessibility via AccessKit. A new `src/a11y/` module owns the platform adapter and the inbound `ActionRequest` channel. `A11yState::try_new` constructs an `accesskit_unix::Adapter`; when the AT-SPI2 daemon is not on the session bus (headless CI, locked-down compositors) the constructor returns `None` and the rest of the pipeline runs unchanged. After every successful `draw_frame`, the run loop builds a fresh `accesskit::TreeUpdate` from `widget_rects` and pushes it through the adapter — main surface plus every visible overlay, each translated to global coordinates via `surface_offset_for` so screen readers report positions in the same frame the user sees. Buttons / toggles / checkboxes / radios / list items / sliders / text edits map to the matching `Role`s; `Click` and `Focus` actions are advertised on every interactive node; inbound action requests are drained at the top of each iteration and translated into a synthetic press / focus on the matching widget. The integration is documented as best-effort in `docs/architecture.md` under "Known gaps and non-goals": hierarchical nesting, per-widget accessible names, live regions and `Action::SetValue` are listed as the natural follow-ups that the foundation now supports but does not yet wire.
Cross-application clipboard via `wl_data_device_manager`. A new `src/event_loop/data_device.rs` bridges the existing process-local `clipboard: String` to the Wayland selection. Outbound (Ctrl+C / Cut): after the local clipboard is populated, `publish_clipboard_selection` creates a `CopyPasteSource` offering `text/plain;charset=utf-8` and installs it as the seat's selection; `DataSourceHandler::send` writes the cached string into the fd the peer hands us. Inbound (Ctrl+V from another app): `DataDeviceHandler::selection` asks for the offered text via `WlDataOffer::receive`, spawns a tiny worker thread to drain the read pipe with a 16 MiB cap to prevent paste-bomb DoS, and posts the result back through an `mpsc::Sender` that the run loop drains each iteration into `data.clipboard`. The `clipboard:` field's doc-comment is updated to reflect the new behaviour: process-local when the compositor does not advertise the global, synchronised with the seat selection otherwise.
External drag-and-drop reception. The same `data_device` module handles `DragOffer` enter / motion / leave / drop_performed: `on_drop_motion( x, y )` fires while the drag hovers over the surface, `on_drop_leave()` when it withdraws without dropping, and `on_drop_received( x, y, mime, text )` when an external payload (`text/uri-list`, `text/plain`, …) is released on top of an ltk window. The receive path reuses the same worker-thread / channel pattern as the clipboard so the run loop never blocks on the read fd. Three new `App` hooks expose the events with no-op defaults; apps that ignore them get the previous behaviour.
`xdg-activation-v1`. The global is bound optionally; when it is present, `try_run` reads `$XDG_ACTIVATION_TOKEN` from the environment, removes it immediately (single-use; preventing leaks into child processes) and stashes it on `AppData::activation_token_pending`. After the first successful configure of the main surface — the earliest point at which `xdg_activation_v1.activate` is meaningful — the token is consumed once and the surface raised to focus. Compositors without the global leave `activation_state` as `None` and the inbound path silently degrades. An `App::request_activation_token` outbound path is reserved on the trait but not yet exercised here.
HarfBuzz shaping. A new `src/text_shaping.rs::shape_line` drives both renderers: the logical-order string is run through `unicode-bidi`, split into per-font sub-runs, and shaped through `rustybuzz`. Each `PositionedGlyph` carries the per-font `glyph_id`, the visual advance and the ink offsets — exactly what `fontdue::Font::rasterize_indexed` needs to render Arabic connected forms, Devanagari clusters and CJK shaped glyphs correctly. The GLES atlas is re-keyed on `(glyph_id, size_bits, font_id)` so glyphs from different fonts at the same size no longer collide, and the atlas format is selected per ES profile (`GL_R8` / `GL_RED` on ES3, `GL_LUMINANCE` on ES2) — the fragment shader samples `.r` for both, since `GL_LUMINANCE` replicates the coverage byte into `.r=.g=.b`. Software path follows the same key. New `Cargo.toml` deps: `unicode-bidi = "0.3"`, `rustybuzz = "0.14"`.
Multi-touch hooks. `App::on_touch_down / on_touch_move / on_touch_up( id, x, y )` expose the raw `wl_touch.id` of every secondary finger. The first finger to land remains the *primary slot* and is fed through the regular gesture machine (`on_pointer_*`, swipe, scroll, long-press, drag-and-drop). Every additional finger fires the new callbacks instead, leaving the existing single-slot behaviour untouched for apps that do not override them. This is the substrate for app-defined pinch-zoom / two-finger pan; the toolkit itself does not yet ship a built-in pinch gesture (called out in the same "Known gaps" doc section).
`event_loop::frame` extracted from `draw/mod.rs`. The `draw_frame` orchestrator and its per-format SHM helper (`pick_shm_format`) move into `src/event_loop/frame.rs`, leaving `draw/` strictly responsible for per-surface paint primitives. The import in `event_loop/run.rs` is rewritten accordingly; `draw/mod.rs` shrinks from 192-line orchestrator to a thin module index.
Overlay teardown safety. `AppData::discard_overlay( id )` synchronously removes a destroyed overlay from the map and rewrites every per-device focus that pointed at it (pointer, keyboard, every touch slot), migrating an in-flight long-press drag to the main surface the same way `reconcile_overlays` does. Used by the compositor-driven destruction paths (`PopupHandler::done`, `LayerShellHandler::closed`) where waiting for the next reconcile would leave a window in which `surface()` / `surface_mut()` panic. The non-panicking siblings `try_surface` / `try_surface_mut` are added for callers on async dispatch paths (IME `Done`, tooltip arm) that may race a teardown.
Miscellaneous. CI: `master` → `main` to match the actual default branch. `Makefile` adds `cargo run --example dialog` to the examples target. `src/lib.rs` re-exports `widget::scroll::ScrollAxis` so apps can configure a `scroll()` axis without reaching into a `pub(crate)` module. `Cargo.toml` adds `accesskit = "0.17"` and `accesskit_unix = "0.13"`. `docs/architecture.md` gains the "Known gaps and non-goals" section that enumerates the new capabilities, what still ships flat, and what is deferred (per-widget a11y labels, primary selection, intra-process multi-touch gestures, `wp_fractional_scale_v1`).

src/event_loop/frame.rs

@@ -0,0 +1,158 @@
+// SPDX-License-Identifier: LGPL-2.1-only
+// Copyright (C) 2026 Liberux Labs, S. L. <info@liberux.net>
+
+use std::sync::Arc;
+use smithay_client_toolkit::compositor::CompositorState;
+use smithay_client_toolkit::reexports::client::protocol::{ wl_shm, wl_surface::WlSurface };
+use smithay_client_toolkit::shm::Shm;
+
+use crate::app::App;
+use crate::egl_context::EglContext;
+use crate::types::{ Color, Rect };
+use crate::widget::Element;
+
+use super::AppData;
+use super::surface::{ SurfaceFocus, SurfaceState };
+use crate::draw::gles::{ draw_surface_full_gpu, draw_surface_partial_gpu };
+use crate::draw::software::{ draw_surface_full, draw_surface_partial };
+use crate::draw::damage::compute_interaction_dirty_rects;
+
+/// Pick the best wl_shm format for our RGBA-premultiplied pixmap.
+/// Abgr8888 matches tiny-skia's byteorder on little-endian systems (plain
+/// memcpy). Falls back to mandatory Argb8888 when not advertised.
+/// Returns `(format, swap_rb)`.
+pub( crate ) fn pick_shm_format( shm: &Shm ) -> ( wl_shm::Format, bool )
+{
+	if shm.formats().contains( &wl_shm::Format::Abgr8888 )
+	{
+		( wl_shm::Format::Abgr8888, false )
+	} else {
+		( wl_shm::Format::Argb8888, true )
+	}
+}
+
+pub( crate ) fn draw_frame<A: App>( data: &mut AppData<A> )
+{
+	let main_view = data.cached_view.as_ref().expect( "view cache populated" );
+	let overlays  = data.cached_overlays.as_ref().expect( "overlays cache populated" );
+
+	let main_bg      = data.app.background_color();
+	let main_region  = data.app.input_region();
+	let debug_layout = data.debug_layout;
+	let ( format, swap_rb ) = pick_shm_format( &data.shm );
+	let egl_ctx = data.egl_context.as_ref();
+	let qh      = &data.qh;
+
+	if data.main.configured && data.main.needs_redraw && !data.main.frame_pending
+	{
+		let req_frame = | wl: &WlSurface | { let _ = wl.frame( qh, SurfaceFocus::Main ); };
+		draw_surface::<A::Message>(
+			&mut data.main,
+			&data.compositor_state,
+			egl_ctx,
+			main_view,
+			main_bg,
+			main_region.as_deref(),
+			debug_layout,
+			format,
+			swap_rb,
+			&req_frame,
+		);
+		data.main.needs_redraw = false;
+		data.main.last_draw    = std::time::Instant::now();
+	}
+
+	for spec in overlays
+	{
+		if let Some( ss ) = data.overlays.get_mut( &spec.id )
+		{
+			if !ss.configured || !ss.needs_redraw || ss.frame_pending { continue; }
+			let focus     = SurfaceFocus::Overlay( spec.id );
+			let req_frame = | wl: &WlSurface | { let _ = wl.frame( qh, focus ); };
+			let bg        = Color::rgba( 0.0, 0.0, 0.0, 0.0 );
+			draw_surface::<A::Message>(
+				ss,
+				&data.compositor_state,
+				egl_ctx,
+				&spec.view,
+				bg,
+				spec.input_region.as_deref(),
+				debug_layout,
+				format,
+				swap_rb,
+				&req_frame,
+			);
+			ss.needs_redraw = false;
+			ss.last_draw    = std::time::Instant::now();
+		}
+	}
+}
+
+fn draw_surface<Msg: Clone>(
+	ss:            &mut SurfaceState<Msg>,
+	compositor:    &CompositorState,
+	egl_ctx:       Option<&Arc<EglContext>>,
+	view:          &Element<Msg>,
+	bg:            Color,
+	input_region:  Option<&[Rect]>,
+	debug_layout:  bool,
+	shm_format:    wl_shm::Format,
+	swap_rb:       bool,
+	request_frame: &dyn Fn( &WlSurface ),
+)
+{
+	let scale = ss.scale_factor.max( 1 ) as u32;
+	let w = ss.width;
+	let h = ss.height;
+	if w == 0 || h == 0 { return; }
+	let pw = w * scale;
+	let ph = h * scale;
+
+	let canvas_ready = ss.canvas.as_ref()
+		.map( |c| c.size() == ( pw, ph ) )
+		.unwrap_or( false );
+	let partial_eligible = !ss.content_dirty
+		&& canvas_ready
+		&& !ss.widget_rects.is_empty();
+
+	if partial_eligible
+	{
+		let dirty_rects = compute_interaction_dirty_rects(
+			&ss.widget_rects,
+			ss.prev_focused, ss.prev_hovered, ss.prev_pressed,
+			ss.focused_idx,  ss.hovered_idx,  ss.gesture.pressed_idx,
+			pw, ph,
+		);
+		if dirty_rects.is_empty() { return; }
+		let total: f32 = dirty_rects.iter().map( |r| r.width * r.height ).sum();
+		if total < pw as f32 * ph as f32 * 0.5
+		{
+			if let ( Some( ctx ), true ) = ( egl_ctx, ss.egl_surface.is_some() )
+			{
+				draw_surface_partial_gpu(
+					ss, compositor, ctx, view, bg, input_region,
+					dirty_rects, pw, ph, scale, request_frame,
+				);
+			} else {
+				draw_surface_partial(
+					ss, compositor, view, bg, input_region,
+					shm_format, swap_rb, dirty_rects, pw, ph, scale, request_frame,
+				);
+			}
+			return;
+		}
+	}
+
+	if let ( Some( ctx ), true ) = ( egl_ctx, ss.egl_surface.is_some() )
+	{
+		draw_surface_full_gpu(
+			ss, compositor, ctx, view, bg, input_region, debug_layout,
+			pw, ph, scale, request_frame,
+		);
+	} else {
+		draw_surface_full(
+			ss, compositor, view, bg, input_region, debug_layout,
+			shm_format, swap_rb, pw, ph, scale, request_frame,
+		);
+	}
+}