Tag surface events with a gate epoch, invalidate it in OnSurfaceDestroyed, and ignore queued Surface/Destroyed events that cross the 500ms teardown timeout. A stale acknowledgement can no longer detach a newer surface.
A crypto error can mean the row belongs to a previous signing identity, but deleting it before verifying loses a readable secret if the overwrite fails for another reason. Query the existing value first; only remove a confirmed stale entry.
The 50 MiB constant only keeps an accidental huge selection out of the app cache; the shared core still enforces the 25 MiB total compose/draft attachment limit.
- use async fileIo open/stat/mkdir/close in both picker paths so slow content providers do not block the ArkUI thread
- add the window origin to IME updateCursor coordinates, since CursorInfo is in absolute physical screen coordinates
- subscribe the page to UIAbility.onBackground through the ability eventHub so preview resources are released on every background path, while keeping onPageHide as a fallback
- cache the latest password/type request while an IME attach or detach is in flight and replay it when the transition finishes
- chunk Asset Store secrets above its 1024-byte limit with generation-suffixed entries; publish the marker last and cover the chunked path in the self-test and unit tests
- picker: copy asynchronously, cap imports at 50 MiB, stage under a random UUID (no picked filename in the cache), and let the native side report whether a late result was accepted so the page cleans up orphaned copies
- register the native mouse callback for right-click/ContextMenuArea and reset Shift/CapsLock/auto-repeat state when the window hides or is destroyed
- register non-Latin script fallbacks for the Slint UI and the email renderer from the platform font directory
- report the system light/dark scheme through AppStorage, the NAPI bridge and SlintContext; throttle repeated IME cursor/color updates and guard overlapping IME attach calls
- expose suspendPreview for the page lifecycle so preview resources are released
- pass the focused field's InputType::Password through the show hook, use VISIBLE_PASSWORD/DONE, and detach/attach when the keyboard type changes
- subscribe sendFunctionKey and send a full Return press/release for the keyboard action key; the reported enter-key value varies by keyboard and is not a fixed code
- forward InputMethodRequest::Update's caret rectangle to the OHOS controller's updateCursor
- remove the remaining privacy bridge closures and URL interception left after the privacy UI was dropped
- request a redraw on Surface/SurfaceShown instead of only invalidating the cache, and skip drawing while the window is hidden so the request survives until it is shown
- wait for and close the acquire fence returned by RequestBuffer, and abort a rejected flush instead of leaking a dequeued buffer
- key buffer geometry to the current surface size so a resize on the same native window reconfigures the queue
- expose only the active renderer to Slint and re-associate the software renderer when the GPU attach or render falls back
- scale mouse-wheel degrees by the user scroll step, leaving touchpad pixel deltas at 1:1
Sync already records chime-worthy arrivals in the notification outbox. This adds the shared dispatcher that applies the Important/All/tabs scope, waits for pending AI routing, and hands raw sender/subject/thread ids to a host publisher. Hosts format and translate the notification and attach the platform action (slot type, wantAgent); the default publisher keeps the whole path a no-op.
Remove the bundled policy, first-launch consent screen, bridge URL interception and Settings/onboarding rows; Flectar hosts the policy at https://flectar.com/mail/privacy/. Remove the notification publisher seam and the permission request so they can be reviewed separately.
main now keys CalDAV secrets by connection id and names the legacy fixed slot AccountCaldavPassword; use Slot::key() and drop the host notification publisher assignment (the seam moves to its own PR).
OHOS reports positive axis values toward the end of the content (wheel
down, or a touchpad swipe up under natural scrolling), while Slint's
positive delta scrolls toward the start. Invert both axes so the wheel
matches the rest of the system.
The advisory database published three root-certificate/verification fixes
on 2026-10-19/20 and the quality job denies warnings, so update
rustls-webpki to 0.103.16 and webpki-roots/webpki-root-certs to 1.0.10 in
the root, Android and OpenHarmony lockfiles.
Each language version now states that it applies to its market and prevails
there, instead of the Chinese version claiming precedence over English.
Clarify the controller split (Flectar for support correspondence; local mail
processing on device; the mail provider as an independent controller), the
retention of support correspondence and the international-transfer basis.
Replace the English block's appended website policy with an application
policy of the same structure as the other languages (UK GDPR bases, ICO,
CCPA/CPRA), and link to the website policy instead. Children's age now
reflects each market (14 in Spain and China, 18 in Türkiye and Russia).
The consent gate now resolves its language the same way the bundled policy
does: the system language (zh/es/tr/ru, English otherwise) through the same
language dropdown, with every label, bullet and action translated. Opening
the policy from the gate reuses the selected language.
Restyle the three actions as 48px provider-style rows (icon, label and
chevron) with Lucide assets, add the highlight card, and replace the text
Back button on the policy viewer with a back-arrow icon.
Spanish (GDPR): legal bases, the full data-subject rights including
restriction, objection and portability, the AEPD complaint route and the
one-month response deadline; the Spanish version applies to users in Spain
and the EU. Turkish (KVKK): legal bases, the Article 11 rights, the 30-day
deadline and the KVKK complaint route. Russian (152-FZ): legal bases, the
Article 14 rights, the 10-working-day deadline and Roskomnadzor. English:
UK ICO and California CCPA/CPRA statements.
The policy page now carries Simplified Chinese, English, Spanish, Turkish
and Russian sections and a selector that mirrors Settings -> General; the
application passes the configured language (system, en, es, tr, zh_Hans,
ru) when it opens the page. Settings -> About gains a "Withdraw privacy
consent" row that clears the stored choice and stops the app, so consent can
be changed at any time.
Regenerate the catalogs without line wrapping: gettext versions wrap the
Language-Team header differently, which made the translation check fail on
CI.
Ship the policy as a local page (Simplified Chinese, an English application
supplement and the official Flectar text, selected from the system language)
and link it from onboarding and Settings -> About. The first launch asks for
consent before the native module starts, so no account or mail processing
happens before the user agrees; the choice is kept in ArkData preferences.
The host opens the bundled page when the shared UI asks for the published
policy URL; other platforms keep opening the website.
PDF attachment preview is verified on device, and the READ_PASTEBOARD ACL has
been approved; note the profile requirement and drop PDF from the untested
list.
The host never called platform::configure_pdfium, so PDF preview reported
"PDF preview is not configured". Resolve this cdylib's own path with dladdr
and register its directory, which is where the hap installs the bundled
libpdfium.so. Verified on device: previewing a PDF attachment works.
The entry page is produced by build-hap.sh from page-templates/Index.<APP>.ets,
so stop tracking it and tell IDE users to copy it first. Add the oxk ArkTS lint
configuration with the rules that pass today, a section on the checks run on
device, and the known limitations (clipboard ACL, untested import flows, soft
keyboard on 2-in-1).
Run the ArkTS rules of oxk (oxc-ark) over the shell sources: give build() an
explicit return type, use the remaining catch parameters, and replace the
indexed access in the staged file name with pop(). The linter reports no
findings for entry/src/main/ets.
Review against the installed HarmonyOS skills: replace the page's console
calls with hilog (public format specifiers, so values are not redacted and
the tag is stable), log the unused cleanup error, and annotate the
loadContent error parameter. The ArkTS compiler now reports no warnings.
Reading the system pasteboard requires ohos.permission.READ_PASTEBOARD
(system_basic, user_grant). Declare it with a localized reason, resolve the
reasonId while packing the hap (the packing tool normally does this), and let
the page ask for the permission when a paste is denied; a toast explains the
denial.
The hap now only installs with an ACL-enabled signing profile that lists the
permission; the README documents the requirement.
versionName is the root Cargo.toml version and versionCode is derived from
it (major*10^7 + minor*10^5 + patch*10^3, plus the prerelease number or 999
for a release) so application-market uploads stay monotonic. The values in
AppScope/app.json5 remain only as the fallback for an IDE build that skips
the script.
Use the project's bundle name on OpenHarmony too: the Flatpak app id, the
macOS/iOS bundle identifier and the Android applicationId are all
com.flectar.mail. Document the AGC release-signing environment
(hap-sign-tool with the release certificate and profile) and keep BUNDLE=
for signing material that was issued for another name.
- Register the XComponent UI input callback for axis events and translate
wheel/touchpad deltas into Slint's PointerScrolled (50 logical pixels per
wheel notch, the same step the desktop backend uses), so Slint flickables
scroll under the mouse without application-side changes.
- Request notification permission from EntryAbility after loadContent: the
page's aboutToAppear runs too early, the system rejects the request with
1600013 and never shows the prompt. Publishing logs the outcome and the
failure code through hilog.
- When OH_Asset_Add fails with ASSET_CRYPTO_ERROR (a stale row from an
earlier signing identity, for example after reinstalling the hap), remove
the alias and retry: deletion does not need the old secret, so sign-in and
reconnect recover instead of failing with 'asset add failed: 24000009'.
- Document wheel input and notification behaviour in platform/ohos/README,
and restore the notification_publisher and email_font_dir rows in the
PlatformContext contract table.
Tier-3 community port (maintainer: springmin), rebased onto the merged
document-provider abstraction (#84) and the opener seam (#80).
- platform/ohos: Slint backend (XComponent window adapter, software renderer
with the experimental femtovg/wgpu path, input/IME, clipboard, system
fonts), the NAPI cdylib that builds a PlatformContext (app-private paths,
DocumentProvider over the ArkTS pickers, Asset Store credential store,
loopback OAuth broker, external URL opener, notification publisher) and
calls flectar_mail::run, the demo crate, the ArkTS shell and the build and
packaging scripts (bundle name configurable, defaults to
com.flectar.mail_ohos).
- src/platform/ohos.rs: PDFium directory, renderer name, thread priority,
preview lifecycle, email font directory; OpenHarmony stays under the
mobile capability alias.
- patches/fontique + crates/fontique: the Fontconfig opt-out as a patch queue
applied by the platform/ohos workspace, verified from quality.yml.
- .github/workflows/ohos.yml: manually dispatched tier-3 workflow, unsigned by
default, signing material only from the FLECTAR_OHOS_* secrets.
- src/documents.rs: run_request blocks the calling thread on mobile hosts;
the picker covers the window, and keeping the presentation thread idle is
what OpenHarmony needs (verified on device; desktop keeps the runtime
request for the native dialog).
- The email renderer and the compose editor load platform::email_font_dir()
and the Han fallback, so CJK mail bodies and composed text render with the
platform fonts.
- New-mail notifications: a publisher seam fed by CoreEvent::MailNew; the host
publishes through @kit.NotificationKit.
springmin
Tomás Romero