Add configurable default home screen action

Themes can now specify an initialAction in home screen config to set the default selected action when entering home normally. Falls back to this theme setting when no explicit action is requested, but explicit firmware navigation still takes precedence.
Add SD theme system
2026-08-13 14:21:57 -07:00 · 2026-06-28 02:38:53 -04:00 · 2026-06-28 01:44:38 -04:00
218 changed files with 14455 additions and 27758 deletions
@@ -2,8 +2,6 @@
 .idea
 .DS_Store
 .vscode
-open-x4-sdk
-fs_
 lib/EpdFont/fontsrc
 lib/I18n/I18nKeys.h
 lib/I18n/I18nStrings.h
@@ -8,8 +8,6 @@ CrossPoint is open-source e-reader firmware - community-built, fully hackable, f

 ![CrossPoint Reader running on Xteink device](./docs/images/cover.jpg)

-> If you're planning to buy an Xteink device, consider purchasing an **X3/X4 Developer Edition** through https://crosspointreader.com. CrossPoint receives a small share of each sale, helping fund development costs.
-
 ## What can CrossPoint do?

 - **Reader engine**: EPUB 2/3 rendering with embedded-style option, image handling, hyphenation, kerning, chapter navigation, footnotes, bookmarks, go-to-percent, auto page turn, orientation control, focus reading, KOReader progress sync and more. 
@@ -69,6 +67,10 @@ USB port or browser before assuming the device is locked. Only reach for the unl
 > Flashing any other firmware on a USB-locked device may **permanently brick the device** or leave it **permanently
 > stuck on that firmware with no recovery path**. Once USB flashing is re-locked, your only way back is via OTA, and if
 > the firmware you flashed doesn't support OTA, **there is no way out**.
+> 
+> **The Papyrix fork has removed OTA update support from its code.** If you flash Papyrix onto a
+> USB-locked unit, you will have **zero update or recovery path** and will be stuck on it forever. **Do not flash
+> Papyrix (or any other unsupported firmware) on a locked device.**

 ## Install firmware

@@ -129,6 +131,23 @@ Convert your own TTF/OTF files into `.cpfont` files that load from the SD card.

 Conversion runs the firmware repo's `lib/EpdFont/scripts/fontconvert_sdcard.py` script unmodified, so output matches a local host build.

+## Custom SD-card themes
+
+Downloadable themes are packaged in the tools repo under `../crosspoint-tools/public/themes/<theme-id>/`. Each theme folder must contain a `theme.json`; optional assets such as generated BMP icons live beside it, usually under `icons/`.
+
+See [SD-card theme creation](./docs/theme-creation.md) for the full JSON format, device-specific overrides, icon generation, CrossInk extension fields, and packaging rules.
+
+After adding or changing a hosted theme, regenerate the download manifest:
+
+```bash
+python3 scripts/generate-theme-manifest.py \
+  --root ../crosspoint-tools/public/themes \
+  --base-url http://crosspointreader.com/themes \
+  --output ../crosspoint-tools/public/themes/themes.json
+```
+
+The script scans every theme folder, includes every file in each package, and writes size and CRC32 values used by the device downloader. Commit changed theme package files and the regenerated `themes.json` in `crosspoint-tools`.
+
 ---

 ## Documentation
@@ -136,6 +155,7 @@ Conversion runs the firmware repo's `lib/EpdFont/scripts/fontconvert_sdcard.py`
 - [User Guide](./USER_GUIDE.md)
 - [Web server usage](./docs/webserver.md)
 - [Web server endpoints](./docs/webserver-endpoints.md)
+- [SD-card theme creation](./docs/theme-creation.md)
 - [Project scope](./SCOPE.md)
 - [Contributing docs](./docs/contributing/README.md)

@@ -247,7 +267,7 @@ One of the best things about open source is that anyone can take the code in a d

 - [papyrix-reader](https://github.com/bigbag/papyrix-reader) — Adds FB2 and MD format support. Actively maintained with Arabic script support. Custom themes via SD card.

- ~~[crosspet](https://github.com/trilwu/crosspet) — A Vietnamese fork that adds a Tamagotchi-style virtual chicken that grows based on your reading milestones (pages read, streaks, care). Also: Flashcards, Weather, Pomodoro timer, and mini-games.~~ (Unmaintained)
+- [crosspet](https://github.com/trilwu/crosspet) — A Vietnamese fork that adds a Tamagotchi-style virtual chicken that grows based on your reading milestones (pages read, streaks, care). Also: Flashcards, Weather, Pomodoro timer, and mini-games.

 - [crosspoint-reader-cjk](https://github.com/aBER0724/crosspoint-reader-cjk) — Purpose-built for Chinese, Japanese, and Korean reading.

@@ -5,7 +5,6 @@ Welcome to the **CrossPoint** firmware. This guide outlines the hardware control
 - [CrossPoint User Guide](#crosspoint-user-guide)
  - [1. Hardware Overview](#1-hardware-overview)
    - [Button Layout](#button-layout)
-    - [Taking a Screenshot](#taking-a-screenshot)
  - [2. Power \& Startup](#2-power--startup)
    - [Power On / Off](#power-on--off)
    - [First Launch](#first-launch)
@@ -15,11 +14,7 @@ Welcome to the **CrossPoint** firmware. This guide outlines the hardware control
    - [3.3 Browse Files Screen](#33-browse-files-screen)
    - [3.4 Recent Books Screen](#34-recent-books-screen)
    - [3.5 File Transfer Screen](#35-file-transfer-screen)
-    - [3.5.1 Calibre Wireless Transfers](#351-calibre-wireless-transfers)
-      - [Installing the Plugin in Calibre](#installing-the-plugin-in-calibre)
-      - [Configuring the CrossPoint Plugin in Calibre](#configuring-the-crosspoint-plugin-in-calibre)
-      - [Uploading Books](#uploading-books)
-      - [Removing a Book](#removing-a-book)
+      - [3.5.1 Calibre Wireless Transfers](#351-calibre-wireless-transfers)
    - [3.6 Settings](#36-settings)
      - [3.6.1 Display](#361-display)
      - [3.6.2 Reader](#362-reader)
@@ -28,25 +23,21 @@ Welcome to the **CrossPoint** firmware. This guide outlines the hardware control
      - [3.6.5 OPDS Servers (Multiple Libraries)](#365-opds-servers-multiple-libraries)
      - [3.6.6 Web Settings (Wi-Fi + OPDS)](#366-web-settings-wi-fi--opds)
      - [3.6.7 KOReader Sync Quick Setup](#367-koreader-sync-quick-setup)
-        - [Option A: Free Public Server (`sync.koreader.rocks`)](#option-a-free-public-server-synckoreaderrocks)
-        - [Option B: Self-Hosted Server (Docker Compose)](#option-b-self-hosted-server-docker-compose)
    - [3.7 Sleep Screen](#37-sleep-screen)
-      - [Cover settings](#cover-settings)
-      - [Custom images](#custom-images)
    - [3.8 Custom Fonts (SD Card)](#38-custom-fonts-sd-card)
  - [4. Reading Mode](#4-reading-mode)
-    - [Page Turning](#page-turning)
-    - [Chapter Navigation](#chapter-navigation)
-    - [Auto Page Turn](#auto-page-turn)
-    - [Tilt Page Turn (X3 only)](#tilt-page-turn-x3-only)
-    - [Footnote Navigation](#footnote-navigation)
-    - [System Navigation](#system-navigation)
-    - [Supported Languages](#supported-languages)
+      - [Page Turning](#page-turning)
+      - [Chapter Navigation](#chapter-navigation)
+      - [Auto Page Turn](#auto-page-turn)
+      - [Tilt Page Turn (X3 only)](#tilt-page-turn-x3-only)
+      - [Footnote Navigation](#footnote-navigation)
+      - [System Navigation](#system-navigation)
+      - [Supported Languages](#supported-languages)
  - [5. Reader Menu](#5-reader-menu)
-    - [5.1 Chapter Selection](#51-chapter-selection)
-    - [5.2 Bookmarks](#52-bookmarks)
-  - [6. Current Limitations \& Roadmap](#6-current-limitations--roadmap)
-  - [7. Troubleshooting Issues \& Escaping Bootloop](#7-troubleshooting-issues--escaping-bootloop)
+      - [5.1 Chapter Selection](#51-chapter-selection)
+      - [5.2 Bookmarks](#52-bookmarks)
+  - [6. Current Limitations & Roadmap](#6-current-limitations--roadmap)
+  - [7. Troubleshooting Issues & Escaping Bootloop](#7-troubleshooting-issues--escaping-bootloop)

 ## 1. Hardware Overview

@@ -47,7 +47,6 @@ git ls-files  --exclude-standard ${GIT_LS_FILES_FLAGS} \
    | grep -v -E '^lib/EpdFont/builtinFonts/' \
    | grep -v -E '^lib/Epub/Epub/hyphenation/generated/' \
    | grep -v -E '^lib/uzlib/' \
-    | grep -v -E '^lib/miniz/third_party/' \
    | xargs -r "${CLANG_FORMAT_BIN}" -style=file -i
 # Restore strict pipeline failure handling for the rest of the script.
 set -o pipefail
@@ -90,19 +90,13 @@ if (parsedSize != fileSize) {

 ## `section.bin`

-### Version 30
+### Version 25

 Each file in `sections/*.bin` stores one laid-out spine section. The header is
 also the cache-busting key: if any layout-affecting setting differs from the
 current reader settings, the section is discarded and rebuilt.

-Version 30 is binary-identical to version 29. The version was bumped because
-Arabic contextual shaping changed text measurement (`getTextAdvanceX` now
-measures the shaped visual text), so word positions cached by v29 no longer
-match what `drawText` renders.
-
-Version 28 introduced serialized word style bits for underline, strikethrough,
-superscript, and subscript. The format also includes:
+Version 25 includes:

 - cache-busting fields for paragraph alignment, hyphenation, embedded CSS,
  image rendering mode, and Focus Reading
@@ -111,12 +105,6 @@ superscript, and subscript. The format also includes:
 - paragraph and list-item LUTs used by KOReader sync page refinement
 - optional per-word Focus Reading split metadata
 - per-page footnote entries
- serialized word style bits for underline, strikethrough, superscript, and
-  subscript
- flat TextBlock word storage (v29): per-word arrays plus one shared
-  NUL-terminated text blob, replacing v28's length-prefixed word strings. The
-  on-disk order mirrors the in-RAM arena so the firmware reads a whole block
-  payload with a single allocation and a single SD read

 ImHex pattern:

@@ -125,7 +113,7 @@ import std.mem;
 import std.string;
 import std.core;

-#define EXPECTED_VERSION 30
+#define EXPECTED_VERSION 25
 #define MAX_STRING_LENGTH 65535
 #define FOOTNOTE_NUMBER_LEN 32
 #define FOOTNOTE_HREF_LEN 96
@@ -186,20 +174,14 @@ struct BlockStyle {

 struct TextBlock {
    u16 wordCount;
-    u8 hasFocus;
-    u16 textBytes [[comment("Total size of text[], including one NUL per word")]];
+    String words[wordCount];
+    s16 wordXPos[wordCount];
+    WordStyle wordStyle[wordCount];

-    if (wordCount > 0) {
-        u16 textOff[wordCount] [[comment("Byte offset of word i's text within text[]")]];
-        s16 wordXPos[wordCount];
-        if (hasFocus != 0) {
-            u16 wordFocusSuffixX[wordCount] [[comment("Suffix x offset from word start")]];
-        }
-        WordStyle wordStyle[wordCount];
-        if (hasFocus != 0) {
-            u8 wordFocusBoundary[wordCount] [[comment("UTF-8 byte boundary between bold prefix and suffix")]];
-        }
-        char text[textBytes] [[comment("All words back to back, each NUL-terminated")]];
+    u8 hasFocus;
+    if (hasFocus != 0) {
+        u8 wordFocusBoundary[wordCount] [[comment("UTF-8 byte boundary between bold prefix and suffix")]];
+        u16 wordFocusSuffixX[wordCount] [[comment("Suffix x offset from word start")]];
    }

    BlockStyle blockStyle;
@@ -32,14 +32,9 @@ networks or in hotspot mode when you control who is connected.
 ## Join Network Mode

 1. Select **Join Network**.
-2. If you have saved Wi-Fi credentials, CrossPoint first tries the last
-   connected network, then other visible saved networks in signal-strength
-   order. Press **Back** to cancel or **Confirm** to stop auto-connect and show
-   the network list.
-3. If the network list is shown, pick a 2.4 GHz Wi-Fi network from the scan
-   results.
-4. Enter the password if prompted.
-5. Save credentials if you want the reader to reconnect automatically next time.
+2. Pick a 2.4 GHz Wi-Fi network from the scan results.
+3. Enter the password if prompted.
+4. Save credentials if you want the reader to reconnect automatically next time.

 After connection, the reader shows:

@@ -44,17 +44,16 @@ void EpdFont::getTextBounds(const char* string, const int startX, const int star
      continue;
    }

-    const combiningMark::Anchor anchor = combiningMark::anchorFor(cp);
-    const int raiseBy = isCombining ? combiningMark::raiseAboveBase(anchor, glyph->top, glyph->height, lastBaseTop) : 0;
+    const int raiseBy = isCombining ? combiningMark::raiseAboveBase(glyph->top, glyph->height, lastBaseTop) : 0;

    if (!isCombining && prevCp != 0) {
      const auto kernFP = getKerning(prevCp, cp);  // 4.4 fixed-point kern
      lastBaseX += fp4::toPixel(prevAdvanceFP + kernFP);
    }

-    const int glyphBaseX = isCombining ? combiningMark::anchorOver(anchor, lastBaseX, lastBaseLeft, lastBaseWidth,
-                                                                   glyph->left, glyph->width)
-                                       : lastBaseX;
+    const int glyphBaseX =
+        isCombining ? combiningMark::centerOver(lastBaseX, lastBaseLeft, lastBaseWidth, glyph->left, glyph->width)
+                    : lastBaseX;
    const int glyphBaseY = startY - raiseBy;

    *minX = std::min(*minX, glyphBaseX + glyph->left);
@@ -36,71 +36,24 @@ namespace combiningMark {

 constexpr int MIN_GAP_PX = 1;

-/// Placement of a mark relative to its base glyph.  The default heuristic —
-/// centered over the base, raised clear of its top — suits Latin diacritics
-/// and Arabic harakat, but misplaces the Hebrew niqqud whose identity depends
-/// on position: dagesh sits inside the letter body, the shin/sin dots
-/// distinguish the letter by sitting over its right/left arm, and holam hangs
-/// over the left corner.  "Native" anchors keep the glyph's font-designed
-/// height (which may overlap the base) instead of raising it.
-enum class Anchor : uint8_t {
-  CenterRaised,  ///< centered over the base, lifted above its top (default)
-  CenterNative,  ///< centered over the base at font-native height
-  RightNative,   ///< right edges aligned, font-native height
-  LeftNative,    ///< left edges aligned, font-native height
-};
-
-constexpr Anchor anchorFor(const uint32_t cp) {
-  switch (cp) {
-    case 0x05BC:  // dagesh / mapiq / shuruk dot: inside the letter body
-    case 0x05BA:  // holam haser for vav: straight above the vav stem
-      return Anchor::CenterNative;
-    case 0x05C1:  // shin dot: over the letter's right arm
-      return Anchor::RightNative;
-    case 0x05B9:  // holam: above the letter's left corner
-    case 0x05C2:  // sin dot: over the letter's left arm
-      return Anchor::LeftNative;
-    default:
-      return Anchor::CenterRaised;
-  }
-}
-
-/// Horizontal offset from the base bitmap's left edge to the mark bitmap's
-/// left edge for a given anchor.
-constexpr int anchorShift(const Anchor anchor, const int baseWidth, const int markWidth) {
-  switch (anchor) {
-    case Anchor::LeftNative:
-      return 0;
-    case Anchor::RightNative:
-      return baseWidth - markWidth;
-    default:
-      return baseWidth / 2 - markWidth / 2;
-  }
-}
-
 /// Compute the cursor-X at which to render a combining mark so its bitmap
-/// lands at its anchor position over the base glyph's bitmap.
-constexpr int anchorOver(const Anchor anchor, const int baseCursorPos, const int baseLeft, const int baseWidth,
-                         const int markLeft, const int markWidth) {
-  return baseCursorPos + baseLeft + anchorShift(anchor, baseWidth, markWidth) - markLeft;
+/// is visually centered over the base glyph's bitmap.
+constexpr int centerOver(int baseCursorPos, int baseLeft, int baseWidth, int markLeft, int markWidth) {
+  return baseCursorPos + baseLeft + baseWidth / 2 - markWidth / 2 - markLeft;
 }

-/// Rotated-90CW variant of anchorOver.  In the rotated coordinate system
+/// Rotated-90CW variant of centerOver.  In the rotated coordinate system
 /// renderCharImpl uses (cursorY - left) instead of (cursorX + left), so
 /// every left/width term inverts sign.
-constexpr int anchorOverRotated90CW(const Anchor anchor, const int baseCursorPos, const int baseLeft,
-                                    const int baseWidth, const int markLeft, const int markWidth) {
-  return baseCursorPos - baseLeft - anchorShift(anchor, baseWidth, markWidth) + markLeft;
+constexpr int centerOverRotated90CW(int baseCursorPos, int baseLeft, int baseWidth, int markLeft, int markWidth) {
+  return baseCursorPos - baseLeft - baseWidth / 2 + markWidth / 2 + markLeft;
 }

 /// For combining marks that sit entirely above the baseline, compute how many
 /// pixels to raise the mark so there is at least MIN_GAP_PX between its bottom
 /// edge and the top of the base glyph.  Returns 0 for marks that extend to or
-/// below the baseline (e.g. cedilla, dot-below, ogonek) and for anchors that
-/// keep the font-native height (dagesh must stay inside the letter, the
-/// shin/sin dots touch its arms).
-constexpr int raiseAboveBase(const Anchor anchor, const int markTop, const int markHeight, const int baseTop) {
-  if (anchor != Anchor::CenterRaised) return 0;
+/// below the baseline (e.g. cedilla, dot-below, ogonek).
+constexpr int raiseAboveBase(int markTop, int markHeight, int baseTop) {
  if (markTop - markHeight <= 0) return 0;
  const int gap = markTop - markHeight - baseTop;
  return (gap < MIN_GAP_PX) ? (MIN_GAP_PX - gap) : 0;
@@ -108,20 +61,6 @@ constexpr int raiseAboveBase(const Anchor anchor, const int markTop, const int m

 }  // namespace combiningMark

-/// GCC/Clang (the ESP32 firmware toolchain) pack structs with __attribute__((packed)).
-/// MSVC (host unit tests) has no equivalent attribute and instead needs a #pragma pack
-/// region achieving the same 1-byte alignment. These macros keep the on-disk font layout
-/// identical across both toolchains.
-#if defined(_MSC_VER)
-#define EPD_PACKED_BEGIN __pragma(pack(push, 1))
-#define EPD_PACKED_END __pragma(pack(pop))
-#define EPD_PACKED_ATTR
-#else
-#define EPD_PACKED_BEGIN
-#define EPD_PACKED_END
-#define EPD_PACKED_ATTR __attribute__((packed))
-#endif
-
 /// Fixed-point conventions used by EpdGlyph and EpdFontData:
 ///   advanceX:   12.4 unsigned fixed-point in uint16_t  (use fp4::toPixel)
 ///   kernMatrix:  4.4 signed fixed-point in int8_t      (use fp4::toPixel)
@@ -156,21 +95,17 @@ typedef struct {

 /// Maps a codepoint to a kerning class ID, sorted by codepoint for binary search.
 /// Class IDs are 1-based; codepoints not in the table have implicit class 0 (no kerning).
-EPD_PACKED_BEGIN
 typedef struct {
  uint16_t codepoint;  ///< Unicode codepoint
  uint8_t classId;     ///< 1-based kerning class ID
-} EPD_PACKED_ATTR EpdKernClassEntry;
-EPD_PACKED_END
+} __attribute__((packed)) EpdKernClassEntry;

 /// Ligature substitution for a specific glyph pair, sorted by `pair` for binary search.
 /// `pair` encodes (leftCodepoint << 16 | rightCodepoint) for single-key lookup.
-EPD_PACKED_BEGIN
 typedef struct {
  uint32_t pair;        ///< Packed codepoint pair (left << 16 | right)
  uint32_t ligatureCp;  ///< Codepoint of the replacement ligature glyph
-} EPD_PACKED_ATTR EpdLigaturePair;
-EPD_PACKED_END
+} __attribute__((packed)) EpdLigaturePair;

 /// Data stored for FONT AS A WHOLE
 typedef struct {
@@ -1,7 +1,7 @@
 #include "EpdFontFamily.h"

 const EpdFont* EpdFontFamily::getFont(const Style style) const {
-  // Extract font style bits; render-time overlay bits do not affect font selection.
+  // Extract font style bits (ignore UNDERLINE bit for font selection)
  const bool hasBold = (style & BOLD) != 0;
  const bool hasItalic = (style & ITALIC) != 0;

@@ -17,7 +17,6 @@ class EpdFontFamily {
    SUP = 16,           // superscript: glyph scaled 50%, raised ~40% of ascender
    SUB = 32,           // subscript: glyph scaled 50%, lowered ~25% of ascender
  };
-  static constexpr uint8_t TEXT_DECORATION_MASK = static_cast<uint8_t>(UNDERLINE | STRIKETHROUGH);

  explicit EpdFontFamily(const EpdFont* regular, const EpdFont* bold = nullptr, const EpdFont* italic = nullptr,
                         const EpdFont* boldItalic = nullptr)
@@ -28,9 +27,6 @@ class EpdFontFamily {
  const EpdGlyph* getGlyph(uint32_t cp, Style style = REGULAR) const;
  int8_t getKerning(uint32_t leftCp, uint32_t rightCp, Style style = REGULAR) const;
  uint32_t applyLigatures(uint32_t cp, const char*& text, Style style = REGULAR) const;
-  static constexpr bool hasTextDecoration(const Style style) {
-    return (static_cast<uint8_t>(style) & TEXT_DECORATION_MASK) != 0;
-  }

 private:
  const EpdFont* regular;
@@ -33,24 +33,12 @@ void FontDecompressor::freePageBuffer() {
 }

 void FontDecompressor::freeHotGroup() {
-  free(hotGroup);
-  hotGroup = nullptr;
-  hotGroupCapacity = 0;
+  hotGroup.clear();
+  hotGroup.shrink_to_fit();
  hotGroupFont = nullptr;
  hotGroupIndex = UINT16_MAX;
-  free(hotGlyphBuf);
-  hotGlyphBuf = nullptr;
-  hotGlyphBufCapacity = 0;
-}
-
-bool FontDecompressor::ensureCapacity(uint8_t*& buf, uint32_t& capacity, uint32_t needed) {
-  if (capacity >= needed) return true;
-  // Grow-only, free-then-malloc: every caller fully rewrites the buffer after a grow, so the
-  // old contents are dead -- freeing first gives the allocator its best shot on a tight heap.
-  free(buf);
-  buf = static_cast<uint8_t*>(malloc(needed));  // owned by FontDecompressor, freed in freeHotGroup()
-  capacity = buf ? needed : 0;
-  return buf != nullptr;
+  hotGlyphBuf.clear();
+  hotGlyphBuf.shrink_to_fit();
 }

 uint16_t FontDecompressor::getGroupIndex(const EpdFontData* fontData, uint32_t glyphIndex) {
@@ -182,20 +170,24 @@ const uint8_t* FontDecompressor::getBitmap(const EpdFontData* fontData, const Ep
  }

  // Check if hot group already has this group decompressed — if not, decompress it
-  if (!(hotGroup != nullptr && hotGroupFont == fontData && hotGroupIndex == groupIndex)) {
+  if (!(!hotGroup.empty() && hotGroupFont == fontData && hotGroupIndex == groupIndex)) {
    stats.cacheMisses++;
    const EpdFontGroup& group = fontData->groups[groupIndex];

-    // ensureCapacity may free the buffer, so the cached-group identity dies with it either way.
-    hotGroupFont = nullptr;
-    hotGroupIndex = UINT16_MAX;
-    if (!ensureCapacity(hotGroup, hotGroupCapacity, group.uncompressedSize)) {
+    hotGroup.resize(group.uncompressedSize);
+    if (hotGroup.empty()) {
      LOG_ERR("FDC", "Failed to allocate %u bytes for hot group %u", group.uncompressedSize, groupIndex);
+      hotGroupFont = nullptr;
+      hotGroupIndex = UINT16_MAX;
      stats.getBitmapTimeUs += micros() - tStart;
      return nullptr;
    }

-    if (!decompressGroup(fontData, groupIndex, hotGroup, group.uncompressedSize)) {
+    if (!decompressGroup(fontData, groupIndex, hotGroup.data(), group.uncompressedSize)) {
+      hotGroup.clear();
+      hotGroup.shrink_to_fit();
+      hotGroupFont = nullptr;
+      hotGroupIndex = UINT16_MAX;
      stats.getBitmapTimeUs += micros() - tStart;
      return nullptr;
    }
@@ -208,16 +200,18 @@ const uint8_t* FontDecompressor::getBitmap(const EpdFontData* fontData, const Ep
  }

  // Compact just the requested glyph from byte-aligned data into scratch buffer
-  if (!ensureCapacity(hotGlyphBuf, hotGlyphBufCapacity, glyph->dataLength)) {
-    LOG_ERR("FDC", "Failed to allocate %u bytes for glyph scratch", (unsigned)glyph->dataLength);
+  if (glyph->dataLength > hotGlyphBuf.size()) {
+    hotGlyphBuf.resize(glyph->dataLength);
+  }
+  if (hotGlyphBuf.empty()) {
    stats.getBitmapTimeUs += micros() - tStart;
    return nullptr;
  }

  uint32_t alignedOff = getAlignedOffset(fontData, groupIndex, glyphIndex);
-  compactSingleGlyph(&hotGroup[alignedOff], hotGlyphBuf, glyph->width, glyph->height);
+  compactSingleGlyph(&hotGroup[alignedOff], hotGlyphBuf.data(), glyph->width, glyph->height);
  stats.getBitmapTimeUs += micros() - tStart;
-  return hotGlyphBuf;
+  return hotGlyphBuf.data();
 }

 // --- Prewarm: pre-decompress glyph bitmaps for a page of text ---
@@ -2,6 +2,8 @@

 #include <InflateReader.h>

+#include <vector>
+
 #include "EpdFontData.h"

 class FontDecompressor {
@@ -65,22 +67,13 @@ class FontDecompressor {

  // Hot group: last decompressed group (byte-aligned) for non-prewarmed fallback path.
  // Kept in byte-aligned format; individual glyphs are compacted on demand into hotGlyphBuf.
-  // Nothrow high-water malloc buffers, NOT std::vector: getBitmap() runs on the render path,
-  // and under -fno-exceptions a vector resize that hits OOM abort()s the firmware instead of
-  // failing (field crash: hotGroup.resize() -> std::bad_alloc -> abort with ~11 KB free).
-  // ensureCapacity() returns false on OOM so the caller can skip the glyph gracefully.
  const EpdFontData* hotGroupFont = nullptr;
  uint16_t hotGroupIndex = UINT16_MAX;
-  uint8_t* hotGroup = nullptr;  // owned; freed in freeHotGroup()/dtor
-  uint32_t hotGroupCapacity = 0;
+  std::vector<uint8_t> hotGroup;

  // Scratch buffer for compacting a single glyph from the hot group.
-  // Valid until the next getBitmap() call. Same ownership/OOM contract as hotGroup.
-  uint8_t* hotGlyphBuf = nullptr;
-  uint32_t hotGlyphBufCapacity = 0;
-
-  // Grow (never shrink) an owned buffer to at least `needed` bytes; false on OOM, buffer freed.
-  static bool ensureCapacity(uint8_t*& buf, uint32_t& capacity, uint32_t needed);
+  // Valid until the next getBitmap() call.
+  std::vector<uint8_t> hotGlyphBuf;

  void freePageBuffer();
  void freeHotGroup();
@@ -1195,8 +1195,7 @@ int SdCardFont::fetchAdvancesForCodepoints(uint32_t* codepoints, uint32_t cpCoun
 }

 template <typename Iter>
-int SdCardFont::buildAdvanceTableRange(Iter begin, Iter end, bool includeSpace, bool includeHyphen, uint8_t styleMask,
-                                       const char* extraText) {
+int SdCardFont::buildAdvanceTableRange(Iter begin, Iter end, bool includeSpace, bool includeHyphen, uint8_t styleMask) {
  if (!loaded_) return -1;
  styleMask = resolveStyleMask(styleMask);
  if (styleMask == 0) return 0;
@@ -1216,9 +1215,6 @@ int SdCardFont::buildAdvanceTableRange(Iter begin, Iter end, bool includeSpace,
  for (auto it = begin; it != end && !hitCap; ++it) {
    hitCap = collectUniqueCodepoints(asCStr(*it), codepoints, cpCount, MAX_UNIQUE_CODEPOINTS);
  }
-  if (extraText && !hitCap) {
-    hitCap = collectUniqueCodepoints(extraText, codepoints, cpCount, MAX_UNIQUE_CODEPOINTS);
-  }

  if (includeSpace && std::none_of(codepoints, codepoints + cpCount, [](uint32_t c) { return c == ' '; }))
    codepoints[cpCount++] = ' ';
@@ -1236,13 +1232,12 @@ int SdCardFont::buildAdvanceTableRange(Iter begin, Iter end, bool includeSpace,
  return totalMissed;
 }

-int SdCardFont::buildAdvanceTable(const char* utf8Text, uint8_t styleMask, const char* extraText) {
-  return buildAdvanceTableRange(&utf8Text, &utf8Text + 1, false, false, styleMask, extraText);
+int SdCardFont::buildAdvanceTable(const char* utf8Text, uint8_t styleMask) {
+  return buildAdvanceTableRange(&utf8Text, &utf8Text + 1, false, false, styleMask);
 }

-int SdCardFont::buildAdvanceTable(const std::vector<std::string>& words, bool includeHyphen, uint8_t styleMask,
-                                  const char* extraText) {
-  return buildAdvanceTableRange(words.begin(), words.end(), words.size() > 1, includeHyphen, styleMask, extraText);
+int SdCardFont::buildAdvanceTable(const std::vector<std::string>& words, bool includeHyphen, uint8_t styleMask) {
+  return buildAdvanceTableRange(words.begin(), words.end(), words.size() > 1, includeHyphen, styleMask);
 }

 // --- Stats ---
@@ -47,12 +47,9 @@ class SdCardFont {
  // Build a compact advance-only table for layout measurement.
  // Extracts ALL unique codepoints from words (no MAX_PAGE_GLYPHS cap),
  // batch-reads advanceX from SD, stores in a sorted per-style table.
-  // extraText: optional additional codepoints to warm in the same SD pass
-  // (e.g. shaped Arabic presentation forms the measurement path will look up).
  // Returns number of codepoints not found in font coverage.
-  int buildAdvanceTable(const char* utf8Text, uint8_t styleMask = 0x0F, const char* extraText = nullptr);
-  int buildAdvanceTable(const std::vector<std::string>& words, bool includeHyphen, uint8_t styleMask = 0x0F,
-                        const char* extraText = nullptr);
+  int buildAdvanceTable(const char* utf8Text, uint8_t styleMask = 0x0F);
+  int buildAdvanceTable(const std::vector<std::string>& words, bool includeHyphen, uint8_t styleMask = 0x0F);

  // Look up advanceX for a codepoint from the advance table.
  // Returns the 12.4 fixed-point advance, or 0 if not found.
@@ -143,13 +140,11 @@ class SdCardFont {

    // Full intervals loaded from file (kept in RAM for codepoint lookup)
    EpdUnicodeInterval* fullIntervals = nullptr;
-    EPD_PACKED_BEGIN
    struct BmpInterval16 {
      uint16_t first;
      uint16_t last;
      uint16_t offset;
-    } EPD_PACKED_ATTR;
-    EPD_PACKED_END
+    } __attribute__((packed));
    static_assert(sizeof(BmpInterval16) == 6, "BmpInterval16 must remain compact");
    BmpInterval16* bmpIntervals = nullptr;
    bool intervalsAreBmp16 = false;
@@ -254,8 +249,7 @@ class SdCardFont {
  int32_t findGlobalGlyphIndex(const PerStyle& s, uint32_t codepoint) const;
  int fetchAdvancesForCodepoints(uint32_t* codepoints, uint32_t cpCount, uint8_t styleMask);
  template <typename Iter>
-  int buildAdvanceTableRange(Iter begin, Iter end, bool includeSpace, bool includeHyphen, uint8_t styleMask,
-                             const char* extraText = nullptr);
+  int buildAdvanceTableRange(Iter begin, Iter end, bool includeSpace, bool includeHyphen, uint8_t styleMask);
  int prewarmStyle(uint8_t styleIdx, const uint32_t* codepoints, uint32_t cpCount, bool metadataOnly);

  // Global helpers
@@ -6,8 +6,6 @@
 !NotoSerif/**
 !NotoSans/
 !NotoSans/**
-!NotoSansArabic/
-!NotoSansArabic/**
 !NotoSansHebrew/
 !NotoSansHebrew/**
 !OpenDyslexic/