refactor(input): own pointer and callback lifetime

Move camera pointer, framebuffer resize, and retained/devtools input edges behind focused reversible owners. Preserve input priority while making shutdown deactivate callbacks before live-session retirement and retry physical detach without stranding transport teardown.

docs/plans/2026-04-11-roadmap.md

@@ -1,6 +1,6 @@
 # acdream — strategic roadmap
 
-**Status:** Living document. Updated 2026-07-22. **M3 landed; M4 is next after the active `GameWindow` structural prerequisite.** M3's retail casting/UI, R6 locomotion/collision/projectile/teleport/radar rebaseline, deterministic fresh-login/portal world lifecycle, and final two-client portal observer flow are user-gated. The current program is the behavior-preserving ownership campaign in [`docs/architecture/code-structure.md`](../architecture/code-structure.md); Slices 1–7 and Slice 8 checkpoints A–D are complete, with the remaining composition/shutdown checkpoints active. New M4 quest/emote/character-creation feature bodies wait until that campaign is complete. Issue #225's lifestone/particle alpha comparison remains a separate rendering visual gate.
+**Status:** Living document. Updated 2026-07-22. **M3 landed; M4 is next after the active `GameWindow` structural prerequisite.** M3's retail casting/UI, R6 locomotion/collision/projectile/teleport/radar rebaseline, deterministic fresh-login/portal world lifecycle, and final two-client portal observer flow are user-gated. The current program is the behavior-preserving ownership campaign in [`docs/architecture/code-structure.md`](../architecture/code-structure.md); Slices 1–7 and Slice 8 checkpoints A–E are complete, with the remaining composition/shutdown checkpoints active. New M4 quest/emote/character-creation feature bodies wait until that campaign is complete. Issue #225's lifestone/particle alpha comparison remains a separate rendering visual gate.
 **Purpose:** One source of truth for where the project is and where it's going. Every observed defect or missing feature has a named phase that owns it; when something looks wrong in-game, look here to find the phase that'll address it. Implementation details live in per-phase specs under `docs/superpowers/specs/`, not in this file.
 
 ---
@@ -79,12 +79,17 @@ second synchronized soak pass with graceful exits, and the six stable PNG
 checkpoints preserve Slice 6 presentation. Issue #232 tracks the coarse
 process-residency gate's diagnostic blind spot; no tolerance was loosened.
 
-Final Slice 8 composition/shutdown cleanup is active. Checkpoints A–D now own
+Final Slice 8 composition/shutdown cleanup is active. Checkpoints A–E now own
 the frozen shell boundary, all nine native callback edges, live-session
 reset/selection/entry/route composition, and world clock/sky/day/weather/
-AdminEnvirons state. `GameWindow` is 4,330 lines / 192 fields / 67 methods;
-the Checkpoint D Release suite passes 7,419 tests / 5 skips. Input, settings,
-startup/resource transfer, and shutdown checkpoints E–L remain.
+AdminEnvirons state. Checkpoint E adds reversible, transactional Silk,
+dispatcher, retained-UI, and devtools input edges; a focused raw pointer owner;
+and one physical framebuffer-size publisher. Logical callback cutoff and
+live-session retirement precede physical removal, so failed device detach
+cannot block graceful transport close. `GameWindow` is 4,266 lines / 194
+fields / 65 methods; the Checkpoint E Release suite passes 7,477 tests / 5
+skips. Gameplay routing, settings, startup/resource transfer, shutdown, soak,
+and closeout checkpoints F–L remain.
 
 This is a behavior-preserving structural program. Severe regressions still get
 root-cause fixes in separate commits; ordinary feature work resumes with M4

docs/plans/2026-05-12-milestones.md

@@ -39,12 +39,15 @@ diagnostic owners preserve the accepted draw/failure graph. `GameWindow` is
 campaign baseline. The full Release suite passes 7,341 tests / 5 skips; the
 315.6-second capped/reconnect lifecycle gate and 395.2-second synchronized
 nine-destination soak pass with graceful exits, and six stable PNG checkpoints
-preserve Slice 6 presentation. Final Slice 8 checkpoints A–D are complete:
+preserve Slice 6 presentation. Final Slice 8 checkpoints A–E are complete:
 native callbacks and live-session composition now have explicit retryable
 owners. Checkpoint D adds the sole world-environment owner for clock, DAT sky,
-day group, weather, and AdminEnvirons state. `GameWindow` is 4,330 lines / 192
-fields / 67 methods; 7,419 Release tests pass / 5 skip. Checkpoints E–L remain
-active. Issue #232 tracks process-residency variance in the soak without
+day group, weather, and AdminEnvirons state. Checkpoint E adds terminal,
+transactional ownership for Silk/dispatcher/retained/devtools input, the raw
+camera pointer, focus, and physical framebuffer size. Graceful live-session
+retirement now precedes physical callback removal. `GameWindow` is 4,266 lines
+/ 194 fields / 65 methods; 7,477 Release tests pass / 5 skip. Checkpoints F–L
+remain active. Issue #232 tracks process-residency variance in the soak without
 loosening its leak threshold.
 
 Carried:

docs/plans/2026-07-22-gamewindow-slice-8-composition-lifecycle.md

@@ -21,7 +21,7 @@ audit.
 - [x] C — extract live-session host/reset/binding callbacks and verify the
   embedded skill formula against named retail.
 - [x] D — extract retail world-environment/day/weather behavior.
-- [ ] E — extract two-phase raw pointer/camera input, focus, and framebuffer
+- [x] E — extract two-phase raw pointer/camera input, focus, and framebuffer
   resize behind symmetric named subscriptions.
 - [ ] F — extract the sole gameplay input-action router plus focused combat and
   diagnostic command owners.
@@ -497,6 +497,27 @@ this behavior-preserving ownership checkpoint.
 - Require rollback after every Nth event add and silence between every shutdown
   stage for raw/retained/devtools device events.
 
+Result: `CameraPointerInputController` now owns raw move, camera-mode cursor,
+focus-loss, scroll, and per-mode sensitivity policy; its gameplay-frame edge is
+late-bound without resubscription. Silk keyboard/mouse sources,
+`InputDispatcher`, retained UI bindings, and the devtools
+`QuiescentInputContext` are publish-before-attach, terminal after disposal,
+transactional on every side-effecting event add, and retry only the physical
+edges that remain pending. Mouse-only hosts retain camera/cursor behavior.
+`FramebufferResizeController` is the sole physical framebuffer publisher and
+seeds viewport/aspect/camera state from `FramebufferSize`, while logical UI and
+frame dimensions remain `Window.Size`. Shutdown now performs no-throw logical
+input cutoff, retires the live session, then removes physical callbacks; the
+post-session mouse-look release therefore cannot send a final movement packet,
+and a bad Silk remove accessor cannot block F653/transport teardown. TS-56
+records the carried non-retail camera input scalars. Three corrected-diff review
+loops are clean; 66 focused App tests, 9 dispatcher-lifetime tests, 5 Core input
+integration tests, the warning-free production Release build, and the complete
+Release suite (7,477 pass / 5 intentional skips) pass. `GameWindow` is 4,266
+raw lines / 194 fields / 65 methods. No connected gate was required for this
+behavior-preserving ownership checkpoint; Checkpoint L retains the final
+connected lifecycle and visual gates.
+
 ### F — gameplay action and command routing
 
 - Move the frozen action-priority graph into the sole Fired subscriber.