Expose pointer device identity through NativeWeb document input #807

Parent release epic: #227
Cross-repository owner: SceneTech/AppScene#298
Prerequisites: AppScene#299 and WebScene#806 (merged)

Proven gap

The installed NativeWeb adapter in AppScene decodes the 48-byte ws_input_event only as legacy mouse. It drops the merged versioned device class, stable pointer ID, primary state, and pointercancel kind before calling native_web::document::pointer. The unchanged Code OSS V8 runtime path already consumes these fields directly; this issue completes the reusable installed NativeWeb boundary without changing that application path.

Required implementation

1. Add an additive NativeWeb pointer descriptor for mouse/touch/pen, ID 1..15, and primary state while preserving the existing document::pointer(...) source API as legacy primary mouse ID 1.
2. Expose the fields on NativeWeb event, keep mouse hover/click/focus behavior compatible, and make cancellation retire the matching contact without activation.
3. Reject zero/out-of-range IDs and unknown device values at the API boundary; use fixed bounded state with no heap/hash work per event.
4. Let AppScene Add readable response and FetchEvent vertical #298 decode the shared ABI once and forward the descriptor and kind 17 cancellation.

Gates

• legacy API compatibility and exact mouse fields;
• touch/pen fields, stable IDs, primary state, multi-contact ordering, and cancel-without-click;
• malformed/future ABI rejection in AppScene;
• 10,000-event bounded-work/no-retained-contact lifecycle guard;
• installed SDK compilation and exact AppScene consumer proof when validation resumes.

Performance boundary

No DOM scan, layout, scene publication, timer, allocation, or browser dependency is permitted solely to carry metadata. Existing mouse behavior and source compatibility must remain unchanged.

Current status — 20 September 2026

Merged by PR #808 at WebScene a46b62e14eb197603f7e227c1558afb9088633b0; issue closed. The NativeWeb API now preserves legacy/touch/pen identity with fixed contact state. AppScene consumer PR #300 is open at 6b8984089af90d41e321e36c9a00024dde439c6c. CI remained queued and was canceled after merge under the active fast policy; authored execution evidence remains deferred.