event_loop, a11y, text_shaping: AccessKit AT-SPI2 bridge, cross-app clipboard, xdg-activation, HarfBuzz shaping, multi-touch hooks

Five orthogonal capabilities land together because they share the same `try_run` plumbing: an optional global is bound at startup, a piece of state is added to `AppData`, the run-loop iteration drains an inbox / pushes a frame snapshot, and the public surface gains a small set of opt-in `App` hooks. Nothing here breaks an existing app — every new path degrades to a no-op when the compositor does not advertise the relevant global or when the platform adapter cannot start.
AT-SPI2 accessibility via AccessKit. A new `src/a11y/` module owns the platform adapter and the inbound `ActionRequest` channel. `A11yState::try_new` constructs an `accesskit_unix::Adapter`; when the AT-SPI2 daemon is not on the session bus (headless CI, locked-down compositors) the constructor returns `None` and the rest of the pipeline runs unchanged. After every successful `draw_frame`, the run loop builds a fresh `accesskit::TreeUpdate` from `widget_rects` and pushes it through the adapter — main surface plus every visible overlay, each translated to global coordinates via `surface_offset_for` so screen readers report positions in the same frame the user sees. Buttons / toggles / checkboxes / radios / list items / sliders / text edits map to the matching `Role`s; `Click` and `Focus` actions are advertised on every interactive node; inbound action requests are drained at the top of each iteration and translated into a synthetic press / focus on the matching widget. The integration is documented as best-effort in `docs/architecture.md` under "Known gaps and non-goals": hierarchical nesting, per-widget accessible names, live regions and `Action::SetValue` are listed as the natural follow-ups that the foundation now supports but does not yet wire.
Cross-application clipboard via `wl_data_device_manager`. A new `src/event_loop/data_device.rs` bridges the existing process-local `clipboard: String` to the Wayland selection. Outbound (Ctrl+C / Cut): after the local clipboard is populated, `publish_clipboard_selection` creates a `CopyPasteSource` offering `text/plain;charset=utf-8` and installs it as the seat's selection; `DataSourceHandler::send` writes the cached string into the fd the peer hands us. Inbound (Ctrl+V from another app): `DataDeviceHandler::selection` asks for the offered text via `WlDataOffer::receive`, spawns a tiny worker thread to drain the read pipe with a 16 MiB cap to prevent paste-bomb DoS, and posts the result back through an `mpsc::Sender` that the run loop drains each iteration into `data.clipboard`. The `clipboard:` field's doc-comment is updated to reflect the new behaviour: process-local when the compositor does not advertise the global, synchronised with the seat selection otherwise.
External drag-and-drop reception. The same `data_device` module handles `DragOffer` enter / motion / leave / drop_performed: `on_drop_motion( x, y )` fires while the drag hovers over the surface, `on_drop_leave()` when it withdraws without dropping, and `on_drop_received( x, y, mime, text )` when an external payload (`text/uri-list`, `text/plain`, …) is released on top of an ltk window. The receive path reuses the same worker-thread / channel pattern as the clipboard so the run loop never blocks on the read fd. Three new `App` hooks expose the events with no-op defaults; apps that ignore them get the previous behaviour.
`xdg-activation-v1`. The global is bound optionally; when it is present, `try_run` reads `$XDG_ACTIVATION_TOKEN` from the environment, removes it immediately (single-use; preventing leaks into child processes) and stashes it on `AppData::activation_token_pending`. After the first successful configure of the main surface — the earliest point at which `xdg_activation_v1.activate` is meaningful — the token is consumed once and the surface raised to focus. Compositors without the global leave `activation_state` as `None` and the inbound path silently degrades. An `App::request_activation_token` outbound path is reserved on the trait but not yet exercised here.
HarfBuzz shaping. A new `src/text_shaping.rs::shape_line` drives both renderers: the logical-order string is run through `unicode-bidi`, split into per-font sub-runs, and shaped through `rustybuzz`. Each `PositionedGlyph` carries the per-font `glyph_id`, the visual advance and the ink offsets — exactly what `fontdue::Font::rasterize_indexed` needs to render Arabic connected forms, Devanagari clusters and CJK shaped glyphs correctly. The GLES atlas is re-keyed on `(glyph_id, size_bits, font_id)` so glyphs from different fonts at the same size no longer collide, and the atlas format is selected per ES profile (`GL_R8` / `GL_RED` on ES3, `GL_LUMINANCE` on ES2) — the fragment shader samples `.r` for both, since `GL_LUMINANCE` replicates the coverage byte into `.r=.g=.b`. Software path follows the same key. New `Cargo.toml` deps: `unicode-bidi = "0.3"`, `rustybuzz = "0.14"`.
Multi-touch hooks. `App::on_touch_down / on_touch_move / on_touch_up( id, x, y )` expose the raw `wl_touch.id` of every secondary finger. The first finger to land remains the *primary slot* and is fed through the regular gesture machine (`on_pointer_*`, swipe, scroll, long-press, drag-and-drop). Every additional finger fires the new callbacks instead, leaving the existing single-slot behaviour untouched for apps that do not override them. This is the substrate for app-defined pinch-zoom / two-finger pan; the toolkit itself does not yet ship a built-in pinch gesture (called out in the same "Known gaps" doc section).
`event_loop::frame` extracted from `draw/mod.rs`. The `draw_frame` orchestrator and its per-format SHM helper (`pick_shm_format`) move into `src/event_loop/frame.rs`, leaving `draw/` strictly responsible for per-surface paint primitives. The import in `event_loop/run.rs` is rewritten accordingly; `draw/mod.rs` shrinks from 192-line orchestrator to a thin module index.
Overlay teardown safety. `AppData::discard_overlay( id )` synchronously removes a destroyed overlay from the map and rewrites every per-device focus that pointed at it (pointer, keyboard, every touch slot), migrating an in-flight long-press drag to the main surface the same way `reconcile_overlays` does. Used by the compositor-driven destruction paths (`PopupHandler::done`, `LayerShellHandler::closed`) where waiting for the next reconcile would leave a window in which `surface()` / `surface_mut()` panic. The non-panicking siblings `try_surface` / `try_surface_mut` are added for callers on async dispatch paths (IME `Done`, tooltip arm) that may race a teardown.
Miscellaneous. CI: `master` → `main` to match the actual default branch. `Makefile` adds `cargo run --example dialog` to the examples target. `src/lib.rs` re-exports `widget::scroll::ScrollAxis` so apps can configure a `scroll()` axis without reaching into a `pub(crate)` module. `Cargo.toml` adds `accesskit = "0.17"` and `accesskit_unix = "0.13"`. `docs/architecture.md` gains the "Known gaps and non-goals" section that enumerates the new capabilities, what still ships flat, and what is deferred (per-widget a11y labels, primary selection, intra-process multi-touch gestures, `wp_fractional_scale_v1`).

src/gles_render/mod.rs

@@ -29,7 +29,7 @@
 //! * `primitives` — `GlesCanvas::{fill_rect, fill_linear_gradient_rect,
 //!   fill_radial_gradient_rect, fill_shadow_outer, fill_shadow_inset,
 //!   stroke_rect, draw_line}`.
-//! * `text` — `GlesCanvas::{draw_text, measure_text, draw_glyph_texture}`.
+//! * `text` — `GlesCanvas::{draw_text, measure_text}`.
 //! * `image` — `GlesCanvas::draw_image_data`.
 //! * `shaders` — GLSL ES 1.00 shader sources (const strings).
 //! * `helpers` — free functions: `ortho_rect`, `compile_program`,
@@ -101,15 +101,25 @@ pub struct BorrowedGlesTexture
 	pub y_inverted:       bool,
 }
 
-/// Cached glyph: pre-rasterized bitmap uploaded as a GL texture.
+/// Cached glyph: rasterized bitmap placed in the shared atlas.
 pub ( super ) struct GlyphEntry
 {
-	pub ( super ) texture:  glow::Texture,
 	pub ( super ) metrics:  fontdue::Metrics,
 	pub ( super ) tex_w:    i32,
 	pub ( super ) tex_h:    i32,
+	pub ( super ) atlas_x:  u32,
+	pub ( super ) atlas_y:  u32,
 }
 
+/// Cache key for the GLES glyph atlas — the GPU-side mirror of the
+/// software canvas's `GlyphKey`. `glyph_id` is the per-font index
+/// returned by HarfBuzz shaping; `size_bits` is `f32::to_bits` of
+/// `size * dpi_scale`; `font_id` is the address of the
+/// `Arc<fontdue::Font>` used for rasterisation.
+pub( super ) type GlyphAtlasKey = ( u16, u32, usize );
+
+pub( super ) const ATLAS_SIZE: u32 = 2048;
+
 // ─── GlesCanvas ──────────────────────────────────────────────────────────────
 
 /// GPU-accelerated canvas using EGL + GLES2/3.
@@ -127,6 +137,13 @@ pub struct GlesCanvas
 	/// Kept as a fallback for callers that do not route through the
 	/// theme registry.
 	pub font:         Arc<Font>,
+	/// Raw bytes of the default font. Required by rustybuzz for
+	/// HarfBuzz shaping (see [`crate::text_shaping`]). Kept on the
+	/// canvas so the shape pipeline has direct access without a
+	/// global lookup.
+	pub font_bytes:   Arc<Vec<u8>>,
+	/// TTC sub-face index for the default font (0 for non-`.ttc` files).
+	pub font_face:    u32,
 	/// Optional theme font registry. Populated by the runtime after
 	/// theme load; until then it is `None` and [`Self::font_for`]
 	/// falls back to [`Self::font`].
@@ -167,10 +184,19 @@ pub struct GlesCanvas
 	u_tex_sampler: glow::UniformLocation,
 
 	// Uniform locations for glyph shader
-	u_glyph_mvp:     glow::UniformLocation,
-	u_glyph_color:   glow::UniformLocation,
-	u_glyph_opacity: glow::UniformLocation,
-	u_glyph_sampler: glow::UniformLocation,
+	u_glyph_mvp:       glow::UniformLocation,
+	u_glyph_color:     glow::UniformLocation,
+	u_glyph_opacity:   glow::UniformLocation,
+	u_glyph_sampler:   glow::UniformLocation,
+	u_glyph_uv_offset: glow::UniformLocation,
+	u_glyph_uv_scale:  glow::UniformLocation,
+
+	glyph_batch_program: glow::Program,
+	u_glyph_batch_color:   glow::UniformLocation,
+	u_glyph_batch_opacity: glow::UniformLocation,
+	u_glyph_batch_sampler: glow::UniformLocation,
+	pub ( super ) glyph_batch_vao: glow::VertexArray,
+	pub ( super ) glyph_batch_vbo: glow::Buffer,
 
 	// Uniform location for blit shader
 	u_blit_sampler: glow::UniformLocation,
@@ -289,11 +315,23 @@ pub struct GlesCanvas
 	u_bd_fc_radii:       glow::UniformLocation,
 	u_bd_fc_tint:        glow::UniformLocation,
 
-	// Glyph cache: (char, size_key, font_id) → GlyphEntry. The
-	// `font_id` is the address of the `Arc<Font>` used for the
-	// rasterisation, so distinct weights / families of the same
-	// (char, size) keep separate atlas entries.
-	glyph_cache:   HashMap<(char, u32, usize), GlyphEntry>,
+	atlas_texture:    glow::Texture,
+	/// Upload format of `atlas_texture`. On GLES3 we use the modern
+	/// single-channel `GL_RED` over `GL_R8`; on GLES2 we keep the
+	/// legacy `GL_LUMINANCE` because `GL_R8` / `GL_RED` did not exist
+	/// before ES3. The fragment shader samples `.r` and is identical
+	/// for both — `GL_LUMINANCE` replicates the single channel into
+	/// `.r=.g=.b`, so `.r` carries the coverage either way.
+	pub ( super ) atlas_format: u32,
+	atlas_cursor_x:   u32,
+	atlas_cursor_y:   u32,
+	atlas_row_height: u32,
+
+	// (glyph_id, size_key, font_id) → GlyphEntry. `glyph_id` is the
+	// per-font glyph index returned by HarfBuzz shaping; the cache
+	// therefore persists Arabic / Devanagari / CJK shaped forms
+	// independently of the source codepoints.
+	glyph_cache:   HashMap<GlyphAtlasKey, GlyphEntry>,
 
 	// Reusable texture cache for images. Keyed by
 	// `(width, height, content fingerprint)` rather than the source
@@ -370,10 +408,8 @@ impl Drop for GlesCanvas
 				self.gl.delete_framebuffer( fbo );
 				self.gl.delete_texture( tex );
 			}
-			for ( _, entry ) in self.glyph_cache.drain()
-			{
-				self.gl.delete_texture( entry.texture );
-			}
+			self.glyph_cache.clear();
+			self.gl.delete_texture( self.atlas_texture );
 			for ( _, ( tex, _, _ ) ) in self.image_cache.drain()
 			{
 				self.gl.delete_texture( tex );