Carry the staged path and display name together from the ArkTS picker through the NAPI bridge. Keep the cache name random and only use the decoded original name as attachment metadata.
Keep the wheel axis step from cancelling the system scroll setting, validate present buffer stride and bounds before copying, and harden the PDFium source workflow with dispatch-only triggers, pinned actions and a checksum-verified SDK download.
Restore the shared provider flow so desktop, Android, iOS and OHOS all use the host document picker and read the staged certificate before its guard is dropped.
Ship the LLVM libc++ license, document why the OpenHarmony PDFium component bundles libc++_shared.so, and record the pinned source-build compatibility patch and CI workflow.
Add compatibility entries for the annotation, catalog, font-name, page-object and text-object APIs that the pinned source no longer exports. These are not used by the preview renderer, but all dynamic bindings must resolve before the library can load.
Define FPDF_IMPLEMENTATION before the PDFium headers so FPDF_EXPORT applies default visibility; without it the compatibility functions were compiled hidden and dlsym still failed.
The compatibility translation unit uses FPDF_STRUCTELEMENT_ATTR_VALUE, which pdfium-render expects but the pinned OHOS header no longer declares. Add the opaque typedef locally.
pdfium-render 0.9.4 dynamically binds several optional struct-tree, text, font-map and page-move APIs that the pinned OHOS source no longer exports. Add a compatibility translation unit for the missing symbols so the library can load; the preview path only uses the core render APIs.
The source port exposes FPDF_GetDocPermissions with user semantics but no separate FPDF_GetDocUserPermissions symbol required by pdfium-render 0.9.4. Apply a pinned source patch that adds the compatibility entry point, and rebuild the CI artifact.
Report the underlying pdfium-render load error instead of discarding it. Component PDFium builds require libc++_shared.so; stage the matching SDK runtime beside libpdfium.so because the OHOS app namespace does not search /system/lib64 for it.
The OHOS port's default GN configuration is a component build and emits libpdfium.cr.so plus sibling .cr.so dependencies. Stage all component libraries beside a stable libpdfium.so and upload/checksum the complete set.
workflow_dispatch inputs are empty for the temporary push trigger; fall back to the pinned source revision instead of passing an empty pathspec to git fetch.
GitHub registers workflow_dispatch only on the default branch. Add a narrow push trigger for the PDFium source branch so the first build can run from the fork before promoting the workflow.
Add a fork-only manual workflow that runs on a Linux x86_64 GitHub-hosted runner, installs the public OHOS SDK, builds the pinned OHOS PDFium source tree, strips the library and uploads the artifact with its license and checksum. No signing material is used.
Add build-pdfium-source.sh for the OHOS PDFium port at a pinned source revision, using the local SDK through the port's ohos_sdk/18 path and staging a stripped libpdfium.so plus its license. Keep the checksum-pinned prebuilt as an offline fallback and package the source license when present.
fontique 0.11.1 already supports fontconfig-dlopen, which leaves an empty system collection when Fontconfig is absent. OHOS registers /system/fonts explicitly, so the local fontique copy, patch queue and quality verification are no longer needed; use the crates.io package and keep the lockfile pinned.
Cache plain text from the page's pasteboard listener and let Slint read that cache, so a cross-device pasteboard read cannot stall the Slint thread. Writes keep the cache coherent, and permission grants trigger a fresh read.
Slint reports the initial caret rectangle with InputMethodRequest::Enable, not a separate Update. Forward it too, cache cursor updates while attach/showTextInput is pending, and replay the latest rectangle after the IME becomes editable.\n\nOnly mark a rectangle as applied after updateCursor succeeds, retry transient 12800016 errors, and ignore late completions for an older caret.
append_mailboxes sorted folders with sort_by_key on a freshly lowercased name, re-allocating the key on every comparison (O(n log n) allocations). sort_by_cached_key computes each key once (O(n)) with identical ordering.
Remove the signing input and the GITHUB_ENV/command-line secret path. CI now always builds an unsigned hap; release signing remains a local explicit step.
Strip the staged native libraries for release builds (PDFium 62 MB -> 22 MB), package THIRD_PARTY_NOTICES.md plus the repository license texts under resources/rawfile, and document the pinned OHOS PDFium archive and its remaining reproducible-build limitation.
Pass the selected PROFILE to hvigor instead of always building debug. Default APP=demo to com.flectar.demo so it can coexist with the signed mail app; BUNDLE still overrides both.
Hold the surface gate while attaching, so a destroy callback cannot invalidate the window between the epoch check and gpu::set_surface. This closes the remaining attach race beyond queued stale events.
Catch unwinding panics on the Slint thread, log the payload, and abort instead of leaving a frozen window backed by a dead event loop. Slint's thread-local platform cannot be safely reinitialized.
Latin text that asks for sans-serif must not be rendered by a CJK face. Prefer Roboto/Noto Sans/other non-Han families for generic sans and retain Han as the final fallback.
Tag surface events with a gate epoch, invalidate it in OnSurfaceDestroyed, and ignore queued Surface/Destroyed events that cross the 500ms teardown timeout. A stale acknowledgement can no longer detach a newer surface.
A crypto error can mean the row belongs to a previous signing identity, but deleting it before verifying loses a readable secret if the overwrite fails for another reason. Query the existing value first; only remove a confirmed stale entry.
The 50 MiB constant only keeps an accidental huge selection out of the app cache; the shared core still enforces the 25 MiB total compose/draft attachment limit.
Tomás Romero
springmin
Alfirus Ahmad