duration_until_next_timer_update saturates an already-expired deadline instead of subtracting two Slint instants directly, which could underflow in debug builds when a timer was due.
The 16 ms frame throttle was applied to every timeout, including when no redraw was pending, so the loop still woke at ~60 Hz after the timer change. Gate the throttle on a pending redraw and on a visible surface so an idle window sleeps until the next Slint timer or the one-second fallback.
Log system-font registration time so startup work can be attributed, and add a CI check that the Slint UI and mail-renderer fallback script lists stay identical. The two collections are separate, so this catches a script being added to only one side.
A stalled compositor could keep the Slint thread blocked in poll() for a full second. Cap the wait at 250 ms, abort the unready buffer, and drop the frame so the next redraw can retry instead of writing into a buffer whose fence never signalled.
Use SlintContext::next_timer_timeout to compute the next deadline; use a one-second fallback only when there is no timer or animation. This removes the fixed 100 ms idle wake-up while keeping timers accurate.
Keep the wheel axis step from cancelling the system scroll setting, validate present buffer stride and bounds before copying, and harden the PDFium source workflow with dispatch-only triggers, pinned actions and a checksum-verified SDK download.
Cache plain text from the page's pasteboard listener and let Slint read that cache, so a cross-device pasteboard read cannot stall the Slint thread. Writes keep the cache coherent, and permission grants trigger a fresh read.
Slint reports the initial caret rectangle with InputMethodRequest::Enable, not a separate Update. Forward it too, cache cursor updates while attach/showTextInput is pending, and replay the latest rectangle after the IME becomes editable.\n\nOnly mark a rectangle as applied after updateCursor succeeds, retry transient 12800016 errors, and ignore late completions for an older caret.
Hold the surface gate while attaching, so a destroy callback cannot invalidate the window between the epoch check and gpu::set_surface. This closes the remaining attach race beyond queued stale events.
Catch unwinding panics on the Slint thread, log the payload, and abort instead of leaving a frozen window backed by a dead event loop. Slint's thread-local platform cannot be safely reinitialized.
Latin text that asks for sans-serif must not be rendered by a CJK face. Prefer Roboto/Noto Sans/other non-Han families for generic sans and retain Han as the final fallback.
Tag surface events with a gate epoch, invalidate it in OnSurfaceDestroyed, and ignore queued Surface/Destroyed events that cross the 500ms teardown timeout. A stale acknowledgement can no longer detach a newer surface.
A crypto error can mean the row belongs to a previous signing identity, but deleting it before verifying loses a readable secret if the overwrite fails for another reason. Query the existing value first; only remove a confirmed stale entry.
- chunk Asset Store secrets above its 1024-byte limit with generation-suffixed entries; publish the marker last and cover the chunked path in the self-test and unit tests
- picker: copy asynchronously, cap imports at 50 MiB, stage under a random UUID (no picked filename in the cache), and let the native side report whether a late result was accepted so the page cleans up orphaned copies
- register the native mouse callback for right-click/ContextMenuArea and reset Shift/CapsLock/auto-repeat state when the window hides or is destroyed
- register non-Latin script fallbacks for the Slint UI and the email renderer from the platform font directory
- report the system light/dark scheme through AppStorage, the NAPI bridge and SlintContext; throttle repeated IME cursor/color updates and guard overlapping IME attach calls
- expose suspendPreview for the page lifecycle so preview resources are released
- pass the focused field's InputType::Password through the show hook, use VISIBLE_PASSWORD/DONE, and detach/attach when the keyboard type changes
- subscribe sendFunctionKey and send a full Return press/release for the keyboard action key; the reported enter-key value varies by keyboard and is not a fixed code
- forward InputMethodRequest::Update's caret rectangle to the OHOS controller's updateCursor
- remove the remaining privacy bridge closures and URL interception left after the privacy UI was dropped
- request a redraw on Surface/SurfaceShown instead of only invalidating the cache, and skip drawing while the window is hidden so the request survives until it is shown
- wait for and close the acquire fence returned by RequestBuffer, and abort a rejected flush instead of leaking a dequeued buffer
- key buffer geometry to the current surface size so a resize on the same native window reconfigures the queue
- expose only the active renderer to Slint and re-associate the software renderer when the GPU attach or render falls back
- scale mouse-wheel degrees by the user scroll step, leaving touchpad pixel deltas at 1:1
OHOS reports positive axis values toward the end of the content (wheel
down, or a touchpad swipe up under natural scrolling), while Slint's
positive delta scrolls toward the start. Invert both axes so the wheel
matches the rest of the system.
Reading the system pasteboard requires ohos.permission.READ_PASTEBOARD
(system_basic, user_grant). Declare it with a localized reason, resolve the
reasonId while packing the hap (the packing tool normally does this), and let
the page ask for the permission when a paste is denied; a toast explains the
denial.
The hap now only installs with an ACL-enabled signing profile that lists the
permission; the README documents the requirement.
- Register the XComponent UI input callback for axis events and translate
wheel/touchpad deltas into Slint's PointerScrolled (50 logical pixels per
wheel notch, the same step the desktop backend uses), so Slint flickables
scroll under the mouse without application-side changes.
- Request notification permission from EntryAbility after loadContent: the
page's aboutToAppear runs too early, the system rejects the request with
1600013 and never shows the prompt. Publishing logs the outcome and the
failure code through hilog.
- When OH_Asset_Add fails with ASSET_CRYPTO_ERROR (a stale row from an
earlier signing identity, for example after reinstalling the hap), remove
the alias and retry: deletion does not need the old secret, so sign-in and
reconnect recover instead of failing with 'asset add failed: 24000009'.
- Document wheel input and notification behaviour in platform/ohos/README,
and restore the notification_publisher and email_font_dir rows in the
PlatformContext contract table.
Tier-3 community port (maintainer: springmin), rebased onto the merged
document-provider abstraction (#84) and the opener seam (#80).
- platform/ohos: Slint backend (XComponent window adapter, software renderer
with the experimental femtovg/wgpu path, input/IME, clipboard, system
fonts), the NAPI cdylib that builds a PlatformContext (app-private paths,
DocumentProvider over the ArkTS pickers, Asset Store credential store,
loopback OAuth broker, external URL opener, notification publisher) and
calls flectar_mail::run, the demo crate, the ArkTS shell and the build and
packaging scripts (bundle name configurable, defaults to
com.flectar.mail_ohos).
- src/platform/ohos.rs: PDFium directory, renderer name, thread priority,
preview lifecycle, email font directory; OpenHarmony stays under the
mobile capability alias.
- patches/fontique + crates/fontique: the Fontconfig opt-out as a patch queue
applied by the platform/ohos workspace, verified from quality.yml.
- .github/workflows/ohos.yml: manually dispatched tier-3 workflow, unsigned by
default, signing material only from the FLECTAR_OHOS_* secrets.
- src/documents.rs: run_request blocks the calling thread on mobile hosts;
the picker covers the window, and keeping the presentation thread idle is
what OpenHarmony needs (verified on device; desktop keeps the runtime
request for the native dialog).
- The email renderer and the compose editor load platform::email_font_dir()
and the Han fallback, so CJK mail bodies and composed text render with the
platform fonts.
- New-mail notifications: a publisher seam fed by CoreEvent::MailNew; the host
publishes through @kit.NotificationKit.
Tomás Romero
springmin