event_loop, a11y, text_shaping: AccessKit AT-SPI2 bridge, cross-app clipboard, xdg-activation, HarfBuzz shaping, multi-touch hooks

Five orthogonal capabilities land together because they share the same `try_run` plumbing: an optional global is bound at startup, a piece of state is added to `AppData`, the run-loop iteration drains an inbox / pushes a frame snapshot, and the public surface gains a small set of opt-in `App` hooks. Nothing here breaks an existing app — every new path degrades to a no-op when the compositor does not advertise the relevant global or when the platform adapter cannot start.
AT-SPI2 accessibility via AccessKit. A new `src/a11y/` module owns the platform adapter and the inbound `ActionRequest` channel. `A11yState::try_new` constructs an `accesskit_unix::Adapter`; when the AT-SPI2 daemon is not on the session bus (headless CI, locked-down compositors) the constructor returns `None` and the rest of the pipeline runs unchanged. After every successful `draw_frame`, the run loop builds a fresh `accesskit::TreeUpdate` from `widget_rects` and pushes it through the adapter — main surface plus every visible overlay, each translated to global coordinates via `surface_offset_for` so screen readers report positions in the same frame the user sees. Buttons / toggles / checkboxes / radios / list items / sliders / text edits map to the matching `Role`s; `Click` and `Focus` actions are advertised on every interactive node; inbound action requests are drained at the top of each iteration and translated into a synthetic press / focus on the matching widget. The integration is documented as best-effort in `docs/architecture.md` under "Known gaps and non-goals": hierarchical nesting, per-widget accessible names, live regions and `Action::SetValue` are listed as the natural follow-ups that the foundation now supports but does not yet wire.
Cross-application clipboard via `wl_data_device_manager`. A new `src/event_loop/data_device.rs` bridges the existing process-local `clipboard: String` to the Wayland selection. Outbound (Ctrl+C / Cut): after the local clipboard is populated, `publish_clipboard_selection` creates a `CopyPasteSource` offering `text/plain;charset=utf-8` and installs it as the seat's selection; `DataSourceHandler::send` writes the cached string into the fd the peer hands us. Inbound (Ctrl+V from another app): `DataDeviceHandler::selection` asks for the offered text via `WlDataOffer::receive`, spawns a tiny worker thread to drain the read pipe with a 16 MiB cap to prevent paste-bomb DoS, and posts the result back through an `mpsc::Sender` that the run loop drains each iteration into `data.clipboard`. The `clipboard:` field's doc-comment is updated to reflect the new behaviour: process-local when the compositor does not advertise the global, synchronised with the seat selection otherwise.
External drag-and-drop reception. The same `data_device` module handles `DragOffer` enter / motion / leave / drop_performed: `on_drop_motion( x, y )` fires while the drag hovers over the surface, `on_drop_leave()` when it withdraws without dropping, and `on_drop_received( x, y, mime, text )` when an external payload (`text/uri-list`, `text/plain`, …) is released on top of an ltk window. The receive path reuses the same worker-thread / channel pattern as the clipboard so the run loop never blocks on the read fd. Three new `App` hooks expose the events with no-op defaults; apps that ignore them get the previous behaviour.
`xdg-activation-v1`. The global is bound optionally; when it is present, `try_run` reads `$XDG_ACTIVATION_TOKEN` from the environment, removes it immediately (single-use; preventing leaks into child processes) and stashes it on `AppData::activation_token_pending`. After the first successful configure of the main surface — the earliest point at which `xdg_activation_v1.activate` is meaningful — the token is consumed once and the surface raised to focus. Compositors without the global leave `activation_state` as `None` and the inbound path silently degrades. An `App::request_activation_token` outbound path is reserved on the trait but not yet exercised here.
HarfBuzz shaping. A new `src/text_shaping.rs::shape_line` drives both renderers: the logical-order string is run through `unicode-bidi`, split into per-font sub-runs, and shaped through `rustybuzz`. Each `PositionedGlyph` carries the per-font `glyph_id`, the visual advance and the ink offsets — exactly what `fontdue::Font::rasterize_indexed` needs to render Arabic connected forms, Devanagari clusters and CJK shaped glyphs correctly. The GLES atlas is re-keyed on `(glyph_id, size_bits, font_id)` so glyphs from different fonts at the same size no longer collide, and the atlas format is selected per ES profile (`GL_R8` / `GL_RED` on ES3, `GL_LUMINANCE` on ES2) — the fragment shader samples `.r` for both, since `GL_LUMINANCE` replicates the coverage byte into `.r=.g=.b`. Software path follows the same key. New `Cargo.toml` deps: `unicode-bidi = "0.3"`, `rustybuzz = "0.14"`.
Multi-touch hooks. `App::on_touch_down / on_touch_move / on_touch_up( id, x, y )` expose the raw `wl_touch.id` of every secondary finger. The first finger to land remains the *primary slot* and is fed through the regular gesture machine (`on_pointer_*`, swipe, scroll, long-press, drag-and-drop). Every additional finger fires the new callbacks instead, leaving the existing single-slot behaviour untouched for apps that do not override them. This is the substrate for app-defined pinch-zoom / two-finger pan; the toolkit itself does not yet ship a built-in pinch gesture (called out in the same "Known gaps" doc section).
`event_loop::frame` extracted from `draw/mod.rs`. The `draw_frame` orchestrator and its per-format SHM helper (`pick_shm_format`) move into `src/event_loop/frame.rs`, leaving `draw/` strictly responsible for per-surface paint primitives. The import in `event_loop/run.rs` is rewritten accordingly; `draw/mod.rs` shrinks from 192-line orchestrator to a thin module index.
Overlay teardown safety. `AppData::discard_overlay( id )` synchronously removes a destroyed overlay from the map and rewrites every per-device focus that pointed at it (pointer, keyboard, every touch slot), migrating an in-flight long-press drag to the main surface the same way `reconcile_overlays` does. Used by the compositor-driven destruction paths (`PopupHandler::done`, `LayerShellHandler::closed`) where waiting for the next reconcile would leave a window in which `surface()` / `surface_mut()` panic. The non-panicking siblings `try_surface` / `try_surface_mut` are added for callers on async dispatch paths (IME `Done`, tooltip arm) that may race a teardown.
Miscellaneous. CI: `master` → `main` to match the actual default branch. `Makefile` adds `cargo run --example dialog` to the examples target. `src/lib.rs` re-exports `widget::scroll::ScrollAxis` so apps can configure a `scroll()` axis without reaching into a `pub(crate)` module. `Cargo.toml` adds `accesskit = "0.17"` and `accesskit_unix = "0.13"`. `docs/architecture.md` gains the "Known gaps and non-goals" section that enumerates the new capabilities, what still ships flat, and what is deferred (per-widget a11y labels, primary selection, intra-process multi-touch gestures, `wp_fractional_scale_v1`).

src/input/touch/mod.rs

@@ -10,14 +10,22 @@
 //! the two handlers share `apply_move_outcome` /
 //! `apply_release_events` in `dispatch.rs`.
 //!
-//! The only touch-specific state is `AppData::touch_focus`, a
-//! `HashMap<touch_id, SurfaceFocus>` so a finger that landed on an
-//! overlay continues to route to that overlay even if it drifts over
-//! the main surface. Multi-finger tracking is not yet modelled — the
-//! gesture machine is single-gesture; a second finger arriving while
-//! the first is pressed overwrites the same slot. Good enough for
-//! sliders, swipes and taps; a proper multi-touch rewrite is a
-//! separate refactor.
+//! The first finger to land on a surface becomes its **primary slot**
+//! and drives the single-slot gesture machine (swipe, scroll,
+//! long-press, drag). Any additional finger arriving while the
+//! primary is held bypasses the gesture machine and surfaces directly
+//! through [`App::on_touch_down`] / [`App::on_touch_move`] /
+//! [`App::on_touch_up`], so apps can implement pinch-zoom or
+//! two-finger pan without losing the built-in gestures. Slot
+//! ownership is recorded on `SurfaceState::primary_touch_id` plus
+//! `SurfaceState::touch_slots` for the auxiliary fingers' last
+//! position (Wayland `wl_touch.up` does not carry one, so the slot
+//! cache supplies it).
+//!
+//! The cross-surface routing map `AppData::touch_focus` is still
+//! per touch id, so an auxiliary slot that landed on an overlay
+//! keeps reporting through that overlay's `App` callback even if
+//! the finger drifts over the main surface.
 
 use smithay_client_toolkit::seat::touch::TouchHandler;
 use smithay_client_toolkit::reexports::client::
@@ -49,6 +57,32 @@ impl<A: App> TouchHandler for AppData<A>
 		self.touch_focus.insert( id, focus );
 		let pos = self.surface( focus ).to_physical( position.0, position.1 );
 		self.pointer_pos = pos;
+
+		// Auxiliary slot path: a second (or third…) finger arriving
+		// while another finger already drives the primary slot stays
+		// out of the single-slot gesture machine entirely. The app
+		// gets a raw `on_touch_down` and can drive its own pinch /
+		// pan from the per-id stream.
+		let is_primary =
+		{
+			let ss = self.surface_mut( focus );
+			if ss.primary_touch_id.is_none()
+			{
+				ss.primary_touch_id = Some( id );
+				true
+			}
+			else
+			{
+				ss.touch_slots.insert( id, pos );
+				false
+			}
+		};
+		if !is_primary
+		{
+			self.app.on_touch_down( id as i64, pos.x, pos.y );
+			return;
+		}
+
 		if matches!( focus, SurfaceFocus::Main ) && !self.overlays.is_empty()
 		{
 			self.dismiss_main_outside_popups( pos );
@@ -136,6 +170,26 @@ impl<A: App> TouchHandler for AppData<A>
 	)
 	{
 		let focus = self.touch_focus.remove( &id ).unwrap_or( SurfaceFocus::Main );
+		// Auxiliary release: not the primary slot → recover the last
+		// recorded position for the up callback (Wayland's `wl_touch.up`
+		// does not carry one) and bail before reaching the gesture
+		// machine.
+		let is_primary =
+		{
+			let ss = self.surface_mut( focus );
+			ss.primary_touch_id == Some( id )
+		};
+		if !is_primary
+		{
+			let pos =
+			{
+				let ss = self.surface_mut( focus );
+				ss.touch_slots.remove( &id ).unwrap_or( self.pointer_pos )
+			};
+			self.app.on_touch_up( id as i64, pos.x, pos.y );
+			return;
+		}
+
 		// Touch-up does not carry a position in wl_touch — the last
 		// motion's position is the release point.
 		let pos         = self.pointer_pos;
@@ -144,7 +198,8 @@ impl<A: App> TouchHandler for AppData<A>
 		let events_out  =
 		{
 			let ss = self.surface_mut( focus );
-			ss.needs_redraw = true;
+			ss.needs_redraw      = true;
+			ss.primary_touch_id  = None;
 			ss.gesture.on_release( pos, &ss.widget_rects, &swipe, global_drag )
 		};
 		self.apply_release_events( focus, events_out );
@@ -163,8 +218,25 @@ impl<A: App> TouchHandler for AppData<A>
 	{
 		let focus = *self.touch_focus.get( &id ).unwrap_or( &SurfaceFocus::Main );
 		let pp    = self.surface( focus ).to_physical( position.0, position.1 );
-		self.pointer_pos = pp;
 
+		let is_primary =
+		{
+			let ss = self.surface( focus );
+			ss.primary_touch_id == Some( id )
+		};
+		if !is_primary
+		{
+			// Auxiliary slot: cache the latest position so `up`'s
+			// release point is accurate, then surface the raw motion.
+			{
+				let ss = self.surface_mut( focus );
+				ss.touch_slots.insert( id, pp );
+			}
+			self.app.on_touch_move( id as i64, pp.x, pp.y );
+			return;
+		}
+
+		self.pointer_pos = pp;
 		let global_drag = self.has_active_long_press_drag();
 		let swipe       = self.swipe_config( focus );
 		let outcome =
@@ -209,14 +281,25 @@ impl<A: App> TouchHandler for AppData<A>
 
 	fn cancel( &mut self, _conn: &Connection, _qh: &QueueHandle<Self>, _touch: &WlTouch )
 	{
-		self.touch_focus.clear();
-		// The compositor is stealing every active touch — drop all
-		// in-flight gesture state across every surface.
-		let clear = |ss: &mut SurfaceState<A::Message>| { ss.gesture.on_cancel(); };
-		clear( &mut self.main );
+		// Snapshot every auxiliary slot's last position so the app
+		// can be notified with a meaningful release point, then drop
+		// every per-surface slot in one pass.
+		let mut aux_releases: Vec<( i32, crate::types::Point )> = Vec::new();
+		let collect = |ss: &mut SurfaceState<A::Message>, out: &mut Vec<( i32, crate::types::Point )>|
+		{
+			for ( id, pos ) in ss.touch_slots.drain() { out.push( ( id, pos ) ); }
+			ss.primary_touch_id = None;
+			ss.gesture.on_cancel();
+		};
+		collect( &mut self.main, &mut aux_releases );
 		for ss in self.overlays.values_mut()
 		{
-			clear( ss );
+			collect( ss, &mut aux_releases );
+		}
+		self.touch_focus.clear();
+		for ( id, pos ) in aux_releases
+		{
+			self.app.on_touch_up( id as i64, pos.x, pos.y );
 		}
 		self.stop_button_repeat();
 	}