Reconnect the OHOS host publisher to the core notification dispatcher: forward the raw sender, subject, thread and message ids, use NotificationKit with localized fallback text and a START_ABILITY wantAgent, and request notification permission after the page loads.
duration_until_next_timer_update saturates an already-expired deadline instead of subtracting two Slint instants directly, which could underflow in debug builds when a timer was due.
The 16 ms frame throttle was applied to every timeout, including when no redraw was pending, so the loop still woke at ~60 Hz after the timer change. Gate the throttle on a pending redraw and on a visible surface so an idle window sleeps until the next Slint timer or the one-second fallback.
Log system-font registration time so startup work can be attributed, and add a CI check that the Slint UI and mail-renderer fallback script lists stay identical. The two collections are separate, so this catches a script being added to only one side.
A stalled compositor could keep the Slint thread blocked in poll() for a full second. Cap the wait at 250 ms, abort the unready buffer, and drop the frame so the next redraw can retry instead of writing into a buffer whose fence never signalled.
Use SlintContext::next_timer_timeout to compute the next deadline; use a one-second fallback only when there is no timer or animation. This removes the fixed 100 ms idle wake-up while keeping timers accurate.
The caret rectangle is relative to the XComponent, but the cached window origin was only read when the page appeared. After maximizing a floating 2-in-1 window, the old floating origin was still added to every cursor update, so the IME candidate stayed at the previous window position. Listen for window rect/status changes and use a zero origin for maximized or full-screen windows.
Raise the mail-import selection and file-size limits, use a one-hour picker timeout, prefer FileUri.name for the display name, and align the bridge result argument order with the native signature.
Expose pickOpenMany on the bridge, stage selected files as one JSON result, and implement DocumentProvider::import_many so compose attachments can import several files in one picker action.
Carry the staged path and display name together from the ArkTS picker through the NAPI bridge. Keep the cache name random and only use the decoded original name as attachment metadata.
Keep the wheel axis step from cancelling the system scroll setting, validate present buffer stride and bounds before copying, and harden the PDFium source workflow with dispatch-only triggers, pinned actions and a checksum-verified SDK download.
Ship the LLVM libc++ license, document why the OpenHarmony PDFium component bundles libc++_shared.so, and record the pinned source-build compatibility patch and CI workflow.
Add compatibility entries for the annotation, catalog, font-name, page-object and text-object APIs that the pinned source no longer exports. These are not used by the preview renderer, but all dynamic bindings must resolve before the library can load.
Define FPDF_IMPLEMENTATION before the PDFium headers so FPDF_EXPORT applies default visibility; without it the compatibility functions were compiled hidden and dlsym still failed.
The compatibility translation unit uses FPDF_STRUCTELEMENT_ATTR_VALUE, which pdfium-render expects but the pinned OHOS header no longer declares. Add the opaque typedef locally.
pdfium-render 0.9.4 dynamically binds several optional struct-tree, text, font-map and page-move APIs that the pinned OHOS source no longer exports. Add a compatibility translation unit for the missing symbols so the library can load; the preview path only uses the core render APIs.
The source port exposes FPDF_GetDocPermissions with user semantics but no separate FPDF_GetDocUserPermissions symbol required by pdfium-render 0.9.4. Apply a pinned source patch that adds the compatibility entry point, and rebuild the CI artifact.
Report the underlying pdfium-render load error instead of discarding it. Component PDFium builds require libc++_shared.so; stage the matching SDK runtime beside libpdfium.so because the OHOS app namespace does not search /system/lib64 for it.
The OHOS port's default GN configuration is a component build and emits libpdfium.cr.so plus sibling .cr.so dependencies. Stage all component libraries beside a stable libpdfium.so and upload/checksum the complete set.
Add build-pdfium-source.sh for the OHOS PDFium port at a pinned source revision, using the local SDK through the port's ohos_sdk/18 path and staging a stripped libpdfium.so plus its license. Keep the checksum-pinned prebuilt as an offline fallback and package the source license when present.
fontique 0.11.1 already supports fontconfig-dlopen, which leaves an empty system collection when Fontconfig is absent. OHOS registers /system/fonts explicitly, so the local fontique copy, patch queue and quality verification are no longer needed; use the crates.io package and keep the lockfile pinned.
Cache plain text from the page's pasteboard listener and let Slint read that cache, so a cross-device pasteboard read cannot stall the Slint thread. Writes keep the cache coherent, and permission grants trigger a fresh read.
Slint reports the initial caret rectangle with InputMethodRequest::Enable, not a separate Update. Forward it too, cache cursor updates while attach/showTextInput is pending, and replay the latest rectangle after the IME becomes editable.\n\nOnly mark a rectangle as applied after updateCursor succeeds, retry transient 12800016 errors, and ignore late completions for an older caret.
Strip the staged native libraries for release builds (PDFium 62 MB -> 22 MB), package THIRD_PARTY_NOTICES.md plus the repository license texts under resources/rawfile, and document the pinned OHOS PDFium archive and its remaining reproducible-build limitation.
Pass the selected PROFILE to hvigor instead of always building debug. Default APP=demo to com.flectar.demo so it can coexist with the signed mail app; BUNDLE still overrides both.
Hold the surface gate while attaching, so a destroy callback cannot invalidate the window between the epoch check and gpu::set_surface. This closes the remaining attach race beyond queued stale events.
Catch unwinding panics on the Slint thread, log the payload, and abort instead of leaving a frozen window backed by a dead event loop. Slint's thread-local platform cannot be safely reinitialized.
Latin text that asks for sans-serif must not be rendered by a CJK face. Prefer Roboto/Noto Sans/other non-Han families for generic sans and retain Han as the final fallback.
Tomás Romero
springmin