event_loop, a11y, text_shaping: AccessKit AT-SPI2 bridge, cross-app clipboard, xdg-activation, HarfBuzz shaping, multi-touch hooks

Five orthogonal capabilities land together because they share the same `try_run` plumbing: an optional global is bound at startup, a piece of state is added to `AppData`, the run-loop iteration drains an inbox / pushes a frame snapshot, and the public surface gains a small set of opt-in `App` hooks. Nothing here breaks an existing app — every new path degrades to a no-op when the compositor does not advertise the relevant global or when the platform adapter cannot start.
AT-SPI2 accessibility via AccessKit. A new `src/a11y/` module owns the platform adapter and the inbound `ActionRequest` channel. `A11yState::try_new` constructs an `accesskit_unix::Adapter`; when the AT-SPI2 daemon is not on the session bus (headless CI, locked-down compositors) the constructor returns `None` and the rest of the pipeline runs unchanged. After every successful `draw_frame`, the run loop builds a fresh `accesskit::TreeUpdate` from `widget_rects` and pushes it through the adapter — main surface plus every visible overlay, each translated to global coordinates via `surface_offset_for` so screen readers report positions in the same frame the user sees. Buttons / toggles / checkboxes / radios / list items / sliders / text edits map to the matching `Role`s; `Click` and `Focus` actions are advertised on every interactive node; inbound action requests are drained at the top of each iteration and translated into a synthetic press / focus on the matching widget. The integration is documented as best-effort in `docs/architecture.md` under "Known gaps and non-goals": hierarchical nesting, per-widget accessible names, live regions and `Action::SetValue` are listed as the natural follow-ups that the foundation now supports but does not yet wire.
Cross-application clipboard via `wl_data_device_manager`. A new `src/event_loop/data_device.rs` bridges the existing process-local `clipboard: String` to the Wayland selection. Outbound (Ctrl+C / Cut): after the local clipboard is populated, `publish_clipboard_selection` creates a `CopyPasteSource` offering `text/plain;charset=utf-8` and installs it as the seat's selection; `DataSourceHandler::send` writes the cached string into the fd the peer hands us. Inbound (Ctrl+V from another app): `DataDeviceHandler::selection` asks for the offered text via `WlDataOffer::receive`, spawns a tiny worker thread to drain the read pipe with a 16 MiB cap to prevent paste-bomb DoS, and posts the result back through an `mpsc::Sender` that the run loop drains each iteration into `data.clipboard`. The `clipboard:` field's doc-comment is updated to reflect the new behaviour: process-local when the compositor does not advertise the global, synchronised with the seat selection otherwise.
External drag-and-drop reception. The same `data_device` module handles `DragOffer` enter / motion / leave / drop_performed: `on_drop_motion( x, y )` fires while the drag hovers over the surface, `on_drop_leave()` when it withdraws without dropping, and `on_drop_received( x, y, mime, text )` when an external payload (`text/uri-list`, `text/plain`, …) is released on top of an ltk window. The receive path reuses the same worker-thread / channel pattern as the clipboard so the run loop never blocks on the read fd. Three new `App` hooks expose the events with no-op defaults; apps that ignore them get the previous behaviour.
`xdg-activation-v1`. The global is bound optionally; when it is present, `try_run` reads `$XDG_ACTIVATION_TOKEN` from the environment, removes it immediately (single-use; preventing leaks into child processes) and stashes it on `AppData::activation_token_pending`. After the first successful configure of the main surface — the earliest point at which `xdg_activation_v1.activate` is meaningful — the token is consumed once and the surface raised to focus. Compositors without the global leave `activation_state` as `None` and the inbound path silently degrades. An `App::request_activation_token` outbound path is reserved on the trait but not yet exercised here.
HarfBuzz shaping. A new `src/text_shaping.rs::shape_line` drives both renderers: the logical-order string is run through `unicode-bidi`, split into per-font sub-runs, and shaped through `rustybuzz`. Each `PositionedGlyph` carries the per-font `glyph_id`, the visual advance and the ink offsets — exactly what `fontdue::Font::rasterize_indexed` needs to render Arabic connected forms, Devanagari clusters and CJK shaped glyphs correctly. The GLES atlas is re-keyed on `(glyph_id, size_bits, font_id)` so glyphs from different fonts at the same size no longer collide, and the atlas format is selected per ES profile (`GL_R8` / `GL_RED` on ES3, `GL_LUMINANCE` on ES2) — the fragment shader samples `.r` for both, since `GL_LUMINANCE` replicates the coverage byte into `.r=.g=.b`. Software path follows the same key. New `Cargo.toml` deps: `unicode-bidi = "0.3"`, `rustybuzz = "0.14"`.
Multi-touch hooks. `App::on_touch_down / on_touch_move / on_touch_up( id, x, y )` expose the raw `wl_touch.id` of every secondary finger. The first finger to land remains the *primary slot* and is fed through the regular gesture machine (`on_pointer_*`, swipe, scroll, long-press, drag-and-drop). Every additional finger fires the new callbacks instead, leaving the existing single-slot behaviour untouched for apps that do not override them. This is the substrate for app-defined pinch-zoom / two-finger pan; the toolkit itself does not yet ship a built-in pinch gesture (called out in the same "Known gaps" doc section).
`event_loop::frame` extracted from `draw/mod.rs`. The `draw_frame` orchestrator and its per-format SHM helper (`pick_shm_format`) move into `src/event_loop/frame.rs`, leaving `draw/` strictly responsible for per-surface paint primitives. The import in `event_loop/run.rs` is rewritten accordingly; `draw/mod.rs` shrinks from 192-line orchestrator to a thin module index.
Overlay teardown safety. `AppData::discard_overlay( id )` synchronously removes a destroyed overlay from the map and rewrites every per-device focus that pointed at it (pointer, keyboard, every touch slot), migrating an in-flight long-press drag to the main surface the same way `reconcile_overlays` does. Used by the compositor-driven destruction paths (`PopupHandler::done`, `LayerShellHandler::closed`) where waiting for the next reconcile would leave a window in which `surface()` / `surface_mut()` panic. The non-panicking siblings `try_surface` / `try_surface_mut` are added for callers on async dispatch paths (IME `Done`, tooltip arm) that may race a teardown.
Miscellaneous. CI: `master` → `main` to match the actual default branch. `Makefile` adds `cargo run --example dialog` to the examples target. `src/lib.rs` re-exports `widget::scroll::ScrollAxis` so apps can configure a `scroll()` axis without reaching into a `pub(crate)` module. `Cargo.toml` adds `accesskit = "0.17"` and `accesskit_unix = "0.13"`. `docs/architecture.md` gains the "Known gaps and non-goals" section that enumerates the new capabilities, what still ships flat, and what is deferred (per-widget a11y labels, primary selection, intra-process multi-touch gestures, `wp_fractional_scale_v1`).

src/render/mod.rs

@@ -23,8 +23,7 @@
 //!   has_clip, strip_intersects_clip, clear_rects_transparent}`.
 //! * [`primitives`] — `SoftwareCanvas::{clear, fill, fill_rect,
 //!   stroke_rect, draw_line}`.
-//! * [`text`] — `SoftwareCanvas::{draw_text, measure_text,
-//!   rasterize_cached}`.
+//! * [`text`] — `SoftwareCanvas::{draw_text, measure_text}`.
 //! * [`image`] — `SoftwareCanvas::{draw_image_data,
 //!   write_to_wayland_buf}`.
 //! * [`helpers`] — free functions: `build_rounded_rect`,
@@ -81,11 +80,15 @@ pub fn is_software_render() -> bool
 /// Cache key for a rasterized glyph. `size_bits` is the f32 bit
 /// pattern of `size * dpi_scale`; `font_id` is the address of the
 /// `Arc<Font>` used for the rasterisation, so distinct weights /
-/// families of the same `(char, size)` do not collide on the cache.
+/// families of the same `(glyph_id, size)` do not collide on the
+/// cache. `glyph_id` is the per-font glyph index returned by
+/// HarfBuzz shaping, so cached entries persist across script
+/// transitions and Arabic / Devanagari / CJK forms cluster
+/// independently of the `char` codepoint that produced them.
 #[ derive( Hash, PartialEq, Eq, Clone, Copy ) ]
 pub ( super ) struct GlyphKey
 {
-	pub ( super ) ch:        char,
+	pub ( super ) glyph_id: u16,
 	pub ( super ) size_bits: u32,
 	pub ( super ) font_id:   usize,
 }
@@ -118,6 +121,13 @@ pub struct SoftwareCanvas
 	/// working. Populated from
 	/// [`crate::render::helpers::find_font`] at construction time.
 	pub font:      Arc<Font>,
+	/// Raw bytes of the default font. Kept alongside `font` so the
+	/// HarfBuzz shaper (rustybuzz) can be invoked without re-reading
+	/// the file — fontdue does not expose its internal byte buffer.
+	pub font_bytes: Arc<Vec<u8>>,
+	/// TTC sub-face index for the default font (0 for single-face
+	/// files; collection index for `.ttc` archives).
+	pub font_face:  u32,
 	/// Optional theme font registry. When present,
 	/// [`SoftwareCanvas::font_for`] consults it before falling back
 	/// to `font`. Populated by the caller once the theme's `fonts`

src/render/setup.rs

@@ -10,29 +10,36 @@ use std::sync::{ Arc, OnceLock };
 use fontdue::{ Font, FontSettings };
 use tiny_skia::{ Pixmap, PixmapPaint, Transform };
 
+use crate::system_fonts::FontHandle;
 use crate::theme::{ FontRegistry, FontStyle };
 
 use super::helpers::load_default_font_bytes;
 use super::SoftwareCanvas;
 
-/// Process-wide cache of the default font face. Avoids re-reading +
-/// re-parsing the file on every surface bring-up. Sora is small
-/// (~50 KB) so the cost was minor in absolute terms — but a layer
-/// shell that brings up a launcher overlay, a QS panel, a calendar
-/// popup and a handful of toast surfaces would still pay the parse
-/// cost a dozen times in a single session, all of which is wasted
-/// work.
-static DEFAULT_FONT: OnceLock<Arc<Font>> = OnceLock::new();
+/// Process-wide cache of the default font face. The handle keeps the
+/// raw bytes (`Arc<Vec<u8>>`) alongside the fontdue `Arc<Font>` so
+/// the HarfBuzz shaper can be invoked without re-reading the file.
+/// Sora is small (~50 KB) so the cost was minor in absolute terms —
+/// but a layer shell that brings up a launcher overlay, a QS panel,
+/// a calendar popup and a handful of toast surfaces would still pay
+/// the parse cost a dozen times in a single session, all of which
+/// is wasted work.
+static DEFAULT_FONT: OnceLock<FontHandle> = OnceLock::new();
 
-fn default_font() -> Arc<Font>
+fn default_handle() -> FontHandle
 {
-	Arc::clone( DEFAULT_FONT.get_or_init( ||
+	DEFAULT_FONT.get_or_init( ||
 	{
 		let bytes = load_default_font_bytes();
 		let font  = Font::from_bytes( bytes.as_slice(), FontSettings::default() )
 			.expect( "bad font" );
-		Arc::new( font )
-	} ) )
+		FontHandle
+		{
+			font:  Arc::new( font ),
+			bytes: Arc::new( bytes ),
+			face:  0,
+		}
+	} ).clone()
 }
 
 impl SoftwareCanvas
@@ -47,10 +54,13 @@ impl SoftwareCanvas
 	/// process reuses the cached `Arc<Font>`.
 	pub fn new( width: u32, height: u32 ) -> Self
 	{
+		let handle = default_handle();
 		Self
 		{
 			pixmap:          Pixmap::new( width, height ).expect( "pixmap" ),
-			font:            default_font(),
+			font:            handle.font.clone(),
+			font_bytes:      handle.bytes.clone(),
+			font_face:       handle.face,
 			font_registry:   None,
 			dpi_scale:       1.0,
 			global_alpha:    1.0,
@@ -67,6 +77,8 @@ impl SoftwareCanvas
 		{
 			pixmap:         Pixmap::new( width, height ).expect( "pixmap" ),
 			font:           Arc::clone( &self.font ),
+			font_bytes:     Arc::clone( &self.font_bytes ),
+			font_face:      self.font_face,
 			font_registry:  self.font_registry.as_ref().map( Arc::clone ),
 			dpi_scale:      self.dpi_scale,
 			global_alpha:   self.global_alpha,
@@ -110,6 +122,33 @@ impl SoftwareCanvas
 		crate::system_fonts::lookup( ch ).unwrap_or_else( || Arc::clone( &self.font ) )
 	}
 
+	/// Bytes-aware variant of [`Self::font_for_char`]. Returns the
+	/// full `FontHandle` so callers that invoke the HarfBuzz shaper
+	/// can hand the raw bytes directly to rustybuzz. The primary
+	/// font supplies the bytes from
+	/// [`Self::font_bytes`]; fallback chars borrow the bytes that
+	/// were loaded into the system fallback cache.
+	pub fn font_handle_for_char( &self, ch: char ) -> crate::system_fonts::FontHandle
+	{
+		if self.font.lookup_glyph_index( ch ) != 0
+		{
+			return crate::system_fonts::FontHandle
+			{
+				font:  Arc::clone( &self.font ),
+				bytes: Arc::clone( &self.font_bytes ),
+				face:  self.font_face,
+			};
+		}
+		crate::system_fonts::lookup_handle( ch ).unwrap_or_else( ||
+			crate::system_fonts::FontHandle
+			{
+				font:  Arc::clone( &self.font ),
+				bytes: Arc::clone( &self.font_bytes ),
+				face:  self.font_face,
+			}
+		)
+	}
+
 	pub fn blit( &mut self, src: &SoftwareCanvas, dest_x: i32, dest_y: i32 )
 	{
 		let paint = PixmapPaint::default();

src/render/text.rs

@@ -1,10 +1,14 @@
 // SPDX-License-Identifier: LGPL-2.1-only
 // Copyright (C) 2026 Liberux Labs, S. L. <info@liberux.net>
 
-//! Text rendering for [`SoftwareCanvas`]. fontdue rasterises each
-//! glyph once into the persistent [`super::GlyphEntry`] cache; the
-//! per-frame hot path just lays out positions and blends cached
-//! bitmaps into the pixmap with the active clip mask + global alpha.
+//! Text rendering for [`SoftwareCanvas`]. The line is shaped through
+//! [`crate::text_shaping::shape_line`] (BiDi reordering + per-sub-run
+//! rustybuzz / HarfBuzz shaping) and each shaped glyph is rasterised
+//! by glyph index via `fontdue::Font::rasterize_indexed`. The cache
+//! is keyed on `(glyph_id, size, font_id)` so Arabic connected
+//! forms, Devanagari clusters, and CJK shaped glyphs cluster
+//! correctly without colliding with the per-codepoint cache the
+//! old path used.
 
 use std::sync::Arc;
 
@@ -16,68 +20,8 @@ use super::{ GlyphEntry, GlyphKey, SoftwareCanvas };
 
 const GLYPH_CACHE_SOFT_CAP: usize = 8192;
 
-/// Stable identifier for an `Arc<Font>`: the address of the font's
-/// allocation. Different reweights / families always live in
-/// distinct allocations, so the address is enough to disambiguate
-/// glyph cache entries.
-fn font_id( font: &Arc<Font> ) -> usize
-{
-	Arc::as_ptr( font ) as usize
-}
-
 impl SoftwareCanvas
 {
-	/// Per-glyph default font lookup. Routes through
-	/// [`Self::font_for_char`], which already consults the lazy
-	/// system-font fallback chain. Returns an owned [`Arc<Font>`] so
-	/// callers can hold the handle across `&mut self` borrows of the
-	/// glyph cache.
-	fn default_font_for_char( &self, ch: char ) -> ( usize, Arc<Font> )
-	{
-		let font = self.font_for_char( ch );
-		let id   = Arc::as_ptr( &font ) as usize;
-		( id, font )
-	}
-
-	pub ( super ) fn rasterize_cached( &mut self, ch: char, scaled: f32 ) -> &GlyphEntry
-	{
-		let ( id, font ) = self.default_font_for_char( ch );
-		let key = GlyphKey { ch, size_bits: scaled.to_bits(), font_id: id };
-		self.evict_if_full( &key );
-		if !self.glyph_cache.contains_key( &key )
-		{
-			let ( metrics, bitmap ) = font.rasterize( ch, scaled );
-			self.glyph_cache.insert( key, GlyphEntry { metrics, bitmap } );
-		}
-		self.glyph_cache.get( &key ).expect( "inserted above on miss" )
-	}
-
-	/// Pick the font to use for `ch` given a "preferred" override.
-	/// Falls through to the canvas default + Noto chain when the
-	/// preferred font does not own the glyph — so Sora Bold rendering
-	/// of CJK / Devanagari / etc. still works.
-	fn font_for_char_with_pref( &self, ch: char, pref: &Arc<Font> ) -> ( usize, Arc<Font> )
-	{
-		if pref.lookup_glyph_index( ch ) != 0
-		{
-			return ( font_id( pref ), Arc::clone( pref ) );
-		}
-		self.default_font_for_char( ch )
-	}
-
-	fn rasterize_cached_with( &mut self, ch: char, scaled: f32, pref: &Arc<Font> ) -> &GlyphEntry
-	{
-		let ( id, font ) = self.font_for_char_with_pref( ch, pref );
-		let key = GlyphKey { ch, size_bits: scaled.to_bits(), font_id: id };
-		self.evict_if_full( &key );
-		if !self.glyph_cache.contains_key( &key )
-		{
-			let ( metrics, bitmap ) = font.rasterize( ch, scaled );
-			self.glyph_cache.insert( key, GlyphEntry { metrics, bitmap } );
-		}
-		self.glyph_cache.get( &key ).expect( "inserted above on miss" )
-	}
-
 	fn evict_if_full( &mut self, key: &GlyphKey )
 	{
 		if !self.glyph_cache.contains_key( key )
@@ -92,6 +36,22 @@ impl SoftwareCanvas
 		}
 	}
 
+	/// Rasterise glyph `glyph_id` in `font` at `scaled` px, caching
+	/// the result under `(glyph_id, size_bits, font_id)`. Used by
+	/// both the public `draw_text` and `draw_text_with_font` paths
+	/// after shaping has resolved every codepoint to a glyph index.
+	fn rasterize_indexed_cached( &mut self, font: &Arc<Font>, glyph_id: u16, scaled: f32, font_id: usize ) -> &GlyphEntry
+	{
+		let key = GlyphKey { glyph_id, size_bits: scaled.to_bits(), font_id };
+		self.evict_if_full( &key );
+		if !self.glyph_cache.contains_key( &key )
+		{
+			let ( metrics, bitmap ) = font.rasterize_indexed( glyph_id, scaled );
+			self.glyph_cache.insert( key, GlyphEntry { metrics, bitmap } );
+		}
+		self.glyph_cache.get( &key ).expect( "inserted above on miss" )
+	}
+
 	pub fn draw_text( &mut self, text: &str, x: f32, y: f32, size: f32, color: Color )
 	{
 		self.draw_text_inner( text, x, y, size, color, None );
@@ -117,28 +77,96 @@ impl SoftwareCanvas
 			return;
 		}
 
-		let mut layout: Vec<( GlyphKey, f32 )> = Vec::with_capacity( text.chars().count() );
+		// Resolve the font handle (font + raw bytes + face index) per
+		// codepoint. When the caller supplied a preferred font (a
+		// theme-resolved bold / italic), we still consult the
+		// fallback chain whenever the preferred face does not own
+		// the requested glyph, so a Sora-Bold label that includes a
+		// CJK character still picks up Noto Sans CJK for that one
+		// codepoint.
+		let canvas_handle =
 		{
-			let mut cursor_x = x;
+			let h = self.font_handle();
+			match font
+			{
+				Some( f ) if Arc::ptr_eq( f, &h.font ) => h,
+				Some( f )                              => crate::system_fonts::FontHandle
+				{
+					font:  Arc::clone( f ),
+					bytes: Arc::new( Vec::new() ),
+					face:  0,
+				},
+				None                                   => h,
+			}
+		};
+		let resolve = |ch: char| -> Option<crate::system_fonts::FontHandle>
+		{
+			if canvas_handle.font.lookup_glyph_index( ch ) != 0 && !canvas_handle.bytes.is_empty()
+			{
+				return Some( canvas_handle.clone() );
+			}
+			crate::system_fonts::lookup_handle( ch ).or_else( ||
+				if !canvas_handle.bytes.is_empty() { Some( canvas_handle.clone() ) } else { None }
+			)
+		};
+
+		// `shape_line` returns glyphs in visual order with HarfBuzz
+		// advance widths and offsets. An empty result (rustybuzz
+		// refused the font, missing bytes for the preferred face)
+		// falls through to no-op — we'd rather not paint than risk
+		// a corrupted line.
+		let shaped = crate::text_shaping::shape_line( text, scaled, resolve );
+		if shaped.is_empty() { return; }
+
+		// Resolve every glyph's font into an `Arc<Font>` for
+		// rasterization — we keep a per-font-id index into a small
+		// vec of `Arc<Font>` so the rasterizer step does not have to
+		// re-walk the resolve fn (mut self borrow conflicts).
+		let mut fonts: Vec<( usize, Arc<Font> )> = Vec::new();
+		let primary_id = Arc::as_ptr( &canvas_handle.font ) as usize;
+		if !canvas_handle.bytes.is_empty()
+		{
+			fonts.push( ( primary_id, Arc::clone( &canvas_handle.font ) ) );
+		}
+		for g in &shaped
+		{
+			if fonts.iter().any( |( id, _ )| *id == g.font_id ) { continue; }
+			// Walk the fallback chain to find an Arc<Font> with this
+			// id — this only ever runs once per (font, line) pair
+			// because we cache by id in `fonts`.
+			let mut found = None;
+			// Try every char in the text — the resolve fn is monotone
+			// per char so checking the chars yields every distinct
+			// font that the shaper saw.
 			for ch in text.chars()
 			{
-				let ( id, advance ) = match font
+				if let Some( h ) = crate::system_fonts::lookup_handle( ch )
 				{
-					Some( f ) =>
-					{
-						let id = self.font_for_char_with_pref( ch, f ).0;
-						let advance = self.rasterize_cached_with( ch, scaled, f ).metrics.advance_width;
-						( id, advance )
-					}
-					None =>
-					{
-						let id = self.default_font_for_char( ch ).0;
-						let advance = self.rasterize_cached( ch, scaled ).metrics.advance_width;
-						( id, advance )
-					}
+					let id = Arc::as_ptr( &h.font ) as usize;
+					if id == g.font_id { found = Some( h.font ); break; }
+				}
+			}
+			if let Some( f ) = found
+			{
+				fonts.push( ( g.font_id, f ) );
+			}
+		}
+
+		let mut layout: Vec<( GlyphKey, f32, f32 )> = Vec::with_capacity( shaped.len() );
+		{
+			let mut cursor_x = x;
+			for g in &shaped
+			{
+				let Some( ( _, font_arc ) ) = fonts.iter().find( |( id, _ )| *id == g.font_id ) else
+				{
+					cursor_x += g.x_advance;
+					continue;
 				};
-				layout.push( ( GlyphKey { ch, size_bits: scaled.to_bits(), font_id: id }, cursor_x ) );
-				cursor_x += advance;
+				let glyph_id = g.glyph_id as u16;
+				let _ = self.rasterize_indexed_cached( font_arc, glyph_id, scaled, g.font_id );
+				let key = GlyphKey { glyph_id, size_bits: scaled.to_bits(), font_id: g.font_id };
+				layout.push( ( key, cursor_x + g.x_offset, g.y_offset ) );
+				cursor_x += g.x_advance;
 			}
 		}
 
@@ -153,16 +181,17 @@ impl SoftwareCanvas
 		let cache     = &self.glyph_cache;
 		let mask_data = self.clip_mask.as_ref().map( |m| ( m.data(), m.width() as i32 ) );
 
-		for ( key, cursor_x ) in layout
+		for ( key, cursor_x, glyph_y_offset ) in layout
 		{
 			let entry   = cache.get( &key ).expect( "warmed above" );
 			let metrics = &entry.metrics;
 			let bitmap  = &entry.bitmap;
+			if metrics.width == 0 || metrics.height == 0 { continue; }
 			for ( i, &alpha ) in bitmap.iter().enumerate()
 			{
 				if alpha == 0 { continue; }
 				let px = cursor_x as i32 + metrics.xmin + (i % metrics.width) as i32;
-				let py = y as i32
+				let py = ( y - glyph_y_offset ) as i32
 					- metrics.ymin as i32
 					- metrics.height as i32
 					+ 1
@@ -186,18 +215,65 @@ impl SoftwareCanvas
 
 	pub fn measure_text( &self, text: &str, size: f32 ) -> f32
 	{
-		text.chars().map( |ch|
-		{
-			self.font_for_char( ch ).metrics( ch, size * self.dpi_scale ).advance_width
-		} ).sum()
+		self.measure_with_font( text, size, None )
 	}
 
 	pub fn measure_text_with_font( &self, text: &str, size: f32, font: &Arc<Font> ) -> f32
 	{
-		text.chars().map( |ch|
+		self.measure_with_font( text, size, Some( font ) )
+	}
+
+	fn measure_with_font( &self, text: &str, size: f32, font: Option<&Arc<Font>> ) -> f32
+	{
+		let scaled = size * self.dpi_scale;
+		let canvas_handle =
 		{
-			let ( _, picked ) = self.font_for_char_with_pref( ch, font );
-			picked.metrics( ch, size * self.dpi_scale ).advance_width
-		} ).sum()
+			let h = self.font_handle();
+			match font
+			{
+				Some( f ) if Arc::ptr_eq( f, &h.font ) => h,
+				Some( f )                              => crate::system_fonts::FontHandle
+				{
+					font:  Arc::clone( f ),
+					bytes: Arc::new( Vec::new() ),
+					face:  0,
+				},
+				None                                   => h,
+			}
+		};
+		let resolve = |ch: char| -> Option<crate::system_fonts::FontHandle>
+		{
+			if canvas_handle.font.lookup_glyph_index( ch ) != 0 && !canvas_handle.bytes.is_empty()
+			{
+				return Some( canvas_handle.clone() );
+			}
+			crate::system_fonts::lookup_handle( ch ).or_else( ||
+				if !canvas_handle.bytes.is_empty() { Some( canvas_handle.clone() ) } else { None }
+			)
+		};
+		let shaped = crate::text_shaping::shape_line( text, scaled, resolve );
+		if shaped.is_empty()
+		{
+			// Fallback: rustybuzz could not shape (no bytes for the
+			// preferred font, no fallback covers the codepoints).
+			// Sum per-codepoint advances so layout still makes a
+			// vaguely useful decision.
+			return text.chars().map( |ch|
+			{
+				let f = font.map( Arc::clone ).unwrap_or_else( || self.font_for_char( ch ) );
+				f.metrics( ch, scaled ).advance_width
+			} ).sum();
+		}
+		shaped.iter().map( |g| g.x_advance ).sum()
+	}
+
+	fn font_handle( &self ) -> crate::system_fonts::FontHandle
+	{
+		crate::system_fonts::FontHandle
+		{
+			font:  Arc::clone( &self.font ),
+			bytes: Arc::clone( &self.font_bytes ),
+			face:  self.font_face,
+		}
 	}
 }