[springmin]

Adds the OpenHarmony host proposed in #77 as a tier-3, community-maintained
port, following the architecture in platform/README.md.

Stacked on #80 (external-link opener seam) and #84 (document provider
adaptation). Both are merged; the branch is rebased onto the current main
and adds the host tree, the fixes from device testing, a one-line iOS
launch-context update for the new publisher field, the move to the project's
bundle name, and the privacy consent and policy screens.

What the port contains

• platform/ohos/ — the Slint platform backend (XComponent window adapter,
  software renderer with the experimental femtovg/wgpu path, input/IME,
  clipboard, system fonts, wheel/touchpad scrolling through the XComponent UI
  input callback, which forwards axis events to Slint as pointer scrolls),
  the NAPI cdylib that builds a PlatformContext (app-private paths,
  DocumentProvider over the ArkTS pickers, Asset Store credential store,
  loopback OAuth broker) and calls flectar_mail::run, the demo crate, the
  ArkTS shell and the build scripts. platform/ohos/README.md documents the
  build and the hap re-packing quirks, and names springmin as the maintainer.
• src/platform/ohos.rs — the application-side platform module (PDFium
  directory, renderer name, thread priority, preview lifecycle, email font
  directory). Shared code keeps selecting behaviour through the capability
  aliases (mobile, desktop, linux_desktop); OpenHarmony is part of
  mobile, and scripts/check-platform-gates.py passes with the host tree
  in the repository.
• patches/fontique/ + crates/fontique/ — the Fontconfig opt-out for
  OpenHarmony as a patch queue (README with the upstream link, the pinned
  0.11.1 archive checksum, the patch series), verified by
  scripts/fontique-patches.sh verify from quality.yml next to the
  Blitz and Parley queues.
• .github/workflows/ohos.yml — the tier-3 workflow: manually dispatched only
  and never triggered by pull requests; builds unsigned by default; signing
  material only through the FLECTAR_OHOS_* secrets. It targets a
  self-hosted runner because the HarmonyOS SDK is not anonymously
  downloadable.
• The document entry points stay available on every host now that each one
  provides a DocumentProvider, so the compose attach button and the Storage
  backup/snapshot cards are no longer hidden on mobile.
• The shared documents::run_request blocks the calling thread on mobile
  hosts: the system picker runs in a window that covers the application and
  the host bridge delivers the result from its own thread, so keeping the
  presentation thread idle is what OpenHarmony needs (verified on device;
  desktop keeps driving the future on the local executor for the native
  dialog).
• The email (Blitz/Parley) font context loads the platform font directory
  through platform::email_font_dir() and extends the Han fallback, so CJK
  mail bodies render with the platform fonts instead of missing glyphs.
• New-mail notifications: the application gains a publisher seam
  (PlatformContext.notification_publisher, a no-op without a publisher)
  fed by CoreEvent::MailNew; the OpenHarmony host publishes through
  @kit.NotificationKit. The ability requests the permission after
  loadContent, because a request from the page's aboutToAppear is rejected
  by the system with 1600013 and never shows the prompt.
• The hap version follows the workspace Cargo.toml: versionName is the
  crate version and versionCode is derived from it (prereleases sort below
  their release), so application-market uploads stay monotonic.
• Clipboard paste needs ohos.permission.READ_PASTEBOARD (an ACL/restricted
  permission, system_basic + user_grant). The module declares it with a
  localized reason, the hap packing resolves the numeric reasonId the
  permission dialog needs, and the page requests it when a paste is denied.
• Privacy: the policy ships as a local page with Simplified Chinese, English,
  Spanish, Turkish and Russian sections, selected from the configured language
  (the selector mirrors Settings -> General); it is reachable from onboarding
  and Settings -> About, and the first launch asks for consent before the
  native module starts. Settings -> About can withdraw the consent, which
  clears the choice and stops the app. The host serves the bundled page for the
  published policy URL until the website covers the application-specific
  disclosures.
• The Asset Store credential store recovers from stale rows: when
  OH_Asset_Add returns ASSET_CRYPTO_ERROR (a record left by an earlier
  signing identity, e.g. after reinstalling the hap), it removes the alias and
  retries, so first sign-in and reconnect work instead of failing with
  "asset add failed: 24000009".

Validation

• cargo fmt --all -- --check (root and the OHOS workspace), clean.
• python3 scripts/check-platform-gates.py passes with the host tree
  in-tree.
• scripts/fontique-patches.sh verify passes.
• cargo clippy -p flectar-mail --lib (mobile configuration) and both host
  crates with -D warnings are clean.
• The official ArkTS compiler (hvigor) builds the shell; the hap installs on a
  HarmonyOS 7.0.0.111 (API 26) 2-in-1.
• Device: mailbox sync and rendering (IMAP IDLE), sending (SMTP), CJK mail
  bodies and the compose editor, compose attachments through the system
  picker, account-backup export, database-snapshot export, certificate
  import, external links in the system browser, system notifications,
  wheel/touchpad scrolling, and Asset Store credentials including reconnect
  after a credential reset.
• Privacy on device: the first-run consent gate follows the system language
  (Simplified Chinese, English, Spanish, Turkish, Russian) with the same
  language selector as the policy page; the policy renders all five languages
  and the jurisdiction-specific sections; accepting starts the native module,
  declining stops the application, and withdrawing the consent from
  Settings → About clears the choice and stops the app.
• Fresh install signed with the AGC release material (com.flectar.mail,
  the same identifier as the desktop and mobile targets), verified on device
  through onboarding, sign-in, sync, send and notifications. The release
  hap passes hap-sign-tool verify-app; local devices install a
  debug-profile build because release profiles are AppGallery-only.

Known follow-ups

• The email renderer runs on the CPU: upstream only enables its GPU path on
  desktop, so enabling it on OpenHarmony needs a capability decision first.
• The bundle name defaults to com.flectar.mail; release builds need the
  AGC-issued certificate and profile, and BUNDLE= still overrides the name
  for signing material that was issued for another identifier.
• The clipboard ACL (ohos.permission.READ_PASTEBOARD) needs an approved
  restricted-permission application; a hap that declares it only installs
  with a signing profile whose acls.allowed-acls lists it.
• Switch the in-app policy link to https://flectar.com/legal/privacy/ once the
  website edition covers the application-specific disclosures (local storage,
  credentials, clipboard, permissions, no third-party SDKs).
• The jurisdiction-specific policy sections are adapted from the website
  edition; local counsel must confirm each language version, and the related
  organisational steps (KVKK/VERBİS, 152-FZ/Roskomnadzor, UK GDPR Article 27)
  must be completed, before the app is distributed in those markets.
• The tier-3 workflow needs a self-hosted runner carrying the ohos label.

Contribution and licensing

• I have the right to submit this work.
• Third-party dependencies/assets: the OpenHarmony PDFium prebuilt is
  fetched at build time with a pinned SHA-256
  (platform/ohos/scripts/fetch-pdfium.sh) and ships inside the hap; the
  fontique patch is a queue over the pinned crates.io archive.
• Disclosed generative-tool assistance: the port was developed with an AI
  coding agent (LLM); I reviewed every line, ran the checks above, and tested
  the behaviour on device as described.
• No credentials, private mailbox data, signing material, or unnecessary
  personal information included.

[springmin]

Note on the RustSec job: it fails on RUSTSEC-2026-0370 / RUSTSEC-2026-0372
(zvariant / zvariant_derive 5.15.0 unmaintained), published 2026-10-16 —
the same advisories as on #84, and unrelated to this branch: the lockfile
matches main plus the already-present zip dependency edge. Every other
check passes on the current head (format, clippy, tests, all platform lints,
the Flatpak source test, and the patch-queue verifications).

[springmin]

Comparison build on device: I ran the current #84 design (provider futures on
the runtime) on the OpenHarmony 2-in-1 (HarmonyOS 7.0.0.111, API 26) with the
window visibility gate active. The compose window still stops responding after
the system picker returns — the picker covers the window, so the hide callback
does not fire and the presentation thread keeps submitting frames into a
covered XComponent buffer queue.

The blocking variant (the reference port's behaviour) works: the application
thread waits while the picker window is up, the ArkTS bridge delivers the
result from another thread, and the window resumes cleanly.

So #85 keeps with_document_future: mobile blocks the calling thread for the
duration of the picker, desktop drives the future on the local executor for
the native file dialog. When #84 merges I will re-apply that policy on top of
the merged flows (it is a small change: route the picker requests through the
same helper).

[springmin]

Rebased onto main (b236c44) and ready for review. The previous head (983154c) was replaced; the branch now has three commits:

1. ohos: add the OpenHarmony platform host — the host tree, rebased onto the merged document-provider abstraction (documents: route attachments, backups and snapshots through the host provider #84) and the opener seam (refactor: route external links through a platform opener seam #80).
2. ohos: wheel scrolling, notification permission timing, asset recovery — fixes from device testing.
3. ios: pass the notification publisher in the launch context — the new context field broke the iOS launch context; CI caught it and it is now green.

Design notes worth a look:

• Mobile picker threading: documents::run_request blocks the calling thread on cfg(mobile). On OpenHarmony the picker runs in a system window that covers the application and the ArkTS bridge delivers the result from its own thread; driving the future on the runtime leaves the composer unresponsive after the picker returns (verified on device, both the async and the host-paused variants). Desktop keeps the existing executor path.
• Wheel input: the XComponent touch callback never sees axis events, so the backend registers OH_NativeXComponent_RegisterUIInputEventCallback with ARKUI_UIINPUTEVENT_TYPE_AXIS and forwards the deltas as WindowEvent::PointerScrolled (50 logical px per 15-degree notch, the same step the desktop backend uses).
• Notification permission: it must be requested after windowStage.loadContent (the ability does it). A request from the page's aboutToAppear is rejected with 1600013 and the system prompt never renders.
• Asset Store: reconnecting can hit ASSET_CRYPTO_ERROR (24000009) when a row from an earlier signing identity is still present (observed after reinstalling the hap). The store removes the alias and retries; deletion does not need the old secret.

Device verification (HarmonyOS 7.0.0.111, API 26, 2-in-1): IMAP IDLE sync, SMTP send, CJK bodies and the compose editor, attachments, backup and snapshot export, certificate import, external links, system notifications, wheel scrolling, and account reconnect after a credential reset.

CI: the iOS lint is fixed and green; the long package jobs are still running. @iamdarkle could you take a look once the checks settle? Happy to squash the three commits into one if you prefer.

[springmin]

Rebased onto 6169539; CI is green (including the translation gate) and the PR is mergeable.

Since the last update: the first-run privacy consent gate and the bundled five-language policy are in place (jurisdiction-specific sections, withdrawal from Settings → About), the READ_PASTEBOARD ACL is approved, and PDF preview, clipboard paste, attachments and backup/snapshot export are verified on the HarmonyOS 2-in-1.

The branch now has 18 commits. If it helps the review, I can split the privacy work into a stacked PR and leave this one as the platform host — otherwise I'll leave it as is for your pass.

[springmin]

Quick follow-up on the store side: the branch is rebased onto current main, mergeable, and CI is running with every completed check passing.

On HarmonyOS both external testing and release have to go through AppGallery: debug builds only install on UDIDs registered in the profile, and release profiles are AppGallery-only. Would you be open to authorizing me to submit the HarmonyOS build to AppGallery under com.flectar.mail? Either way works for me:

• I publish from my developer account as an authorized distributor, with a written authorization from Flectar for Huawei (the AGC record already exists, app ID 6917619452385162680), or
• Flectar keeps the AppGallery account and adds me as a maintainer.

I have a draft authorization letter, the five-language privacy policy and the listing materials ready and can send them over. The port stays AGPL and the platform host is in this PR. If you would rather keep the port unlisted for now, I will hold the AppGallery submission and keep this as the upstream contribution.

[springmin]

One process question, since this is a large platform PR: would you prefer I split it up?

Options I can prepare:

1. Shared UI PR — the privacy-policy / withdraw-consent rows in the settings and onboarding views plus the translation catalogs. This part is cross-platform and independent of the OpenHarmony host; it would leave the host PR focused on the platform layer.
2. Host core PR — platform/ohos/ (Slint backend, NAPI host, ArkTS shell, build scripts, workflow, docs) as one platform port, with the optional pieces (PDFium preview, notifications, wheel input, ACL) included.
3. Stacked feature PRs — host core first, then PDFium / notifications / wheel input / ACL as small stacked PRs. Smaller reviews, but more rebasing work for both of us while main moves.

The current branch is green and mergeable (21 commits, including the wheel-direction fix). I am happy to keep it as one PR if that is easier for you — just let me know which structure you prefer.

[iamdarkle]

Thanks again for the device reports. To keep #85 moving, I pushed some commits to ohos-alias (now e074912). Please pull before your next push instead of force-pushing over them.

What I pushed:

• Merged current main and regenerated the catalogs with CI's gettext. This drops the --no-wrap change and the reflowed .po files. src/platform/ohos.rs gains the new app icon items. show_app_icon is a no-op, because switching the home screen icon is a system API on OpenHarmony.
• The picker no longer blocks on mobile. run_request is back to main's version, so Android and iOS work as before; the block_on hung both of them.
  • On OpenHarmony, each pending picker request now holds presentation (backend/src/hold.rs) until the page reports the result. The Slint thread stays idle while the picker covers the window.
  • This now covers every picker flow, including attachment downloads and the Files view, which the old block_on never reached.
  • Could you check on the device that each of these resumes cleanly:
    • attaching files;
    • exporting a backup or a snapshot;
    • importing a certificate;
    • saving an attachment.
• Certificate import goes through the document provider and run_request on every host.
• crates/flectar-mail-core/Cargo.toml keeps keyring and dirs off OpenHarmony. Until now the D-Bus stack was built there too.
• Backend fixes:
  • the selection clipboard is ignored; it copied password fields to the system clipboard;
  • key codes are no longer logged;
  • a cancelled touch no longer clicks.
• The Asset Store keeps empty secrets as a marker. The service rejects empty secrets, so disconnecting a calendar used to leave its password behind.
• platform/ohos/Cargo.lock was stale. It now:
  • repeats the winit patch;
  • moves rustls, tokio, ammonia and clipboard-win to the versions in the root lockfile;
  • passes the RustSec scan with CI's ignore list.
• Smaller fixes:
  • fontique-patches.sh verify fails when the tree is missing;
  • versionCode follows the Android sequence;
  • the hvigor log is gone, and the ignore rules live in platform/ohos/.gitignore;
  • the shell's vendor and licence fields are fixed;
  • the README and backend docs match the code.

Splitting

Please move these out of #85:

• Privacy. Flectar will publish the app's policy at https://flectar.com/mail/privacy/. The app should link there rather than ship a copy, so we can update the policy without an app release. Please drop the bundled privacy.html, the consent screen, the URL interception in bridge.rs and the Settings and onboarding rows from this PR. We'll come back to you about the consent screen.
• The notification publisher seam, as its own small PR, like refactor: route external links through a platform opener seam #80 and documents: route attachments, backups and snapshots through the host provider #84. When it comes back:
  • it should respect the notification setting (Important/All/tabs) and translate its strings;
  • the shell should publish with a slot type and a wantAgent. Without a slot type the notification is silent, and without a wantAgent tapping it does nothing.

Still open on the OpenHarmony side. These need the device:

Rendering and lifecycle:

• The software fallback draws nothing: renderer() hands Slint the GPU renderer, and the software renderer never gets set_window_adapter (window.rs).
• Nothing requests a redraw after SurfaceShown or after a surface is recreated at the same size.
• The GPU path keeps presenting while hidden.
• DrawOutcome is discarded.
• present.rs:
  • the release fence is never waited on or closed (one fd leaked per frame);
  • geometry is only reconfigured when the window pointer changes, so a resize can copy past the buffer.
• Teardown: a queued Surface event can carry a destroyed window into the GPU attach after the 500 ms timeout.
• A panic on the Slint thread leaves a frozen window.
• The idle loop polls every 100 ms.

Input:

• The IME is never told about password fields: Enable(props) is dropped, and the page always attaches with TEXT.
• InputMethodRequest::Update is dropped, so the keyboard can cover the field.
• Soft keyboard Enter: sendFunctionKey is never subscribed, and bridge.rs compares the key with 1.
• Modifiers and Caps Lock go stale after focus loss.
• No mouse callback is registered, and Slint's long-press menus are Android-only, so ContextMenuArea menus can't be opened.
• Touchpad scrolling is about 3.3× too fast: pixel deltas are scaled as degrees.
• Multi-touch ids are dropped.
• Dark mode is never reported to Slint.

Host services:

• The Asset Store rejects secrets over 1024 bytes, and Microsoft OAuth bundles can exceed that. Core already chunks secrets for Windows' similar limit (accounts/credentials/system.rs).
• The crypto-error path in asset.rs deletes the row before re-adding it.
• OAuth uses the Android client ids with a loopback redirect. Google's Android-type clients don't accept loopback redirects; let's agree which clients OpenHarmony builds use.
• Picked files:
  • they are copied synchronously on the ArkTS thread with no size cap;
  • the staged name (a timestamp plus ASCII) becomes the attachment name that recipients see;
  • a staged copy leaks when its result arrives after the timeout.
• suspend_file_preview() is never called; that is part of the preview lifecycle contract.
• The clipboard is read on the Slint thread, where a cross-device paste can stall.
• READ_PASTEBOARD is declared unconditionally.

Fonts:

• Only a Han fallback is registered, and that face is also the generic sans-serif. Latin text in mail that asks for sans-serif renders in it, and other scripts get no fallback.
• fontique is already built with fontconfig-dlopen, which falls back to an empty collection when the library is missing. Could you check whether OpenHarmony works without crates/fontique? Upstream has the same fix in fontique: use the dummy system backend on HarmonyOS (OpenHarmony-based) linebender/parley#913.

Packaging and CI:

• PDFium:
  • the prebuilt is a personal GitCode build of 7947: unstripped and without licence files;
  • every other platform ships chromium/8044 from bblanchon with its notices;
  • please build it reproducibly from a pinned release, stage its notices, and update THIRD_PARTY_NOTICES.md;
  • the hap ships no third-party notices at all.
• ohos.yml:
  • signing secrets go through GITHUB_ENV and onto hap-sign-tool's command line;
  • there's no protected environment:;
  • we have no self-hosted OpenHarmony runner, and build-hap.sh only works natively on the device;
  • let's make the workflow build-only for now.
• build-hap.sh always runs hvigor in debug mode.
• APP=demo installs under com.flectar.mail.

FYI: six of your intermediate commits don't compile (ui/app.slint calls import_account_backup until 2ff00c2).

CI is green on e074912, including Lint Android and Lint iOS.

[springmin]

All four picker flows resume cleanly on the HarmonyOS 2-in-1:

• attaching files;
• exporting a backup and a database snapshot;
• importing a certificate;
• saving an attachment.

I pulled e074912 and will keep your commits when pushing.

Next I will merge current main, then remove the privacy pieces (bundled policy, consent screen, bridge interception, and the Settings/onboarding rows) and move the notification publisher seam into its own PR, as you asked. I will follow up separately on the rendering, input, host-service and font items.

[springmin]

I merged current main (b2086fe) into ohos-alias with a merge commit and pushed normally — no force-push. The only conflicts were the translation catalogs; I kept the catalogs from main.

As requested:

• Removed the bundled policy, first-launch consent screen, bridge URL interception, and the Settings/onboarding privacy rows. The app now leaves the policy to https://flectar.com/mail/privacy/; I did not add a replacement link.
• Removed the notification publisher and the permission request from this port. The shared seam is now feat: add a notification publisher seam #139: it drains the existing notification outbox, applies Important/All/tabs, defers pending AI routing, and hands raw sender/subject/thread ids to the host so the OHOS publisher can translate and use a slot type and wantAgent. The OHOS publisher will come back after feat: add a notification publisher seam #139 lands.
• Adapted the Asset Store credential mapping to the new per-connection slot API (Slot::key(), AccountCaldavPassword); cargo check -p flectar-mail-ohos passes.

The device checks from e074912 still stand: attaching files, exporting a backup/snapshot, importing a certificate, and saving an attachment all resume cleanly.

I am now working through the rendering/lifecycle, input, host-service and font items on your list and will report them individually.