feat(gamepad): implement SDK, tooling, and complete repository coverage

.planning/ROADMAP.md

@@ -929,3 +929,16 @@ Plans:
 - [x] 162-01-PLAN.md — Current-schema writer and readers
 - [x] 162-02-PLAN.md — CLI format boundary and event migration
 - [x] 162-03-PLAN.md — Docs, release metadata and draft PR shipment
+
+### Phase 163: NAP-GAMEPAD across repositories
+
+**Goal:** Implement the proposed GAMEPAD API/runtime/tooling across all organization repositories and applicable packages, including boilerplate. Non-normative acceptance defers to [NAP-GAMEPAD](https://github.com/napplet/naps/pull/108) and [NIP-5D](https://github.com/nostr-protocol/nips/pull/2303).
+**Requirements:** GP-API, GP-WIRE, GP-ISOLATION, GP-TRUST, GP-REPOS, GP-DOCS, GP-SHIP (defined in 163-CONTEXT.md)
+**Depends on:** Phase 162
+**Plans:** 3 plans — COMPLETE
+
+- [x] 163-01-PLAN.md — Portable API, core types, runtime binding and SDK exports
+- [x] 163-02-PLAN.md — Host isolation, injection and conformance
+- [x] 163-03-PLAN.md — All repositories, docs, releases and coordinated PR shipment
+
+Verified and shipped in [web #242](https://github.com/napplet/web/pull/242), [Kehto #297](https://github.com/kehto/web/pull/297), and five consumer/community PRs linked in COVERAGE.md. Publish the Kehto package set before the primary release. The optional native API replacement conflict and existing CVM baseline failures remain disclosed.

.planning/STATE.md

@@ -2,17 +2,19 @@
 gsd_state_version: 1.0
 milestone: v0.34.0
 milestone_name: NIP-5D Runtime Injection
-current_phase: 162
-current_phase_name: nip-5d-event-schema-migration
-status: complete
-stopped_at: "Phase 162 verified; draft PR #224 open with hzrd149 requested"
-last_updated: "2026-10-14T05:55:04.171122+00:00"
-last_activity: 2026-10-13
-last_activity_desc: "Completed quick task 261013-vo3: icon design and generation skill"
+current_phase: 163
+current_phase_name: nap-gamepad-across-repositories
+status: completed
+stopped_at: Phase 163 verified; completing prerequisite publication for CLI follow-up 243
+last_updated: "2026-10-14T16:24:49.491178+00:00"
+last_activity: 2026-10-14
+last_activity_desc: Integrated the merged icon skill with the verified GAMEPAD release
 progress:
-  total_plans: 3
-  completed_plans: 3
-  percent: 100
+  total_phases: 8
+  completed_phases: 3
+  total_plans: 16
+  completed_plans: 6
+  percent: 38
 ---
 
 # Project State
@@ -23,18 +25,18 @@ See: .planning/PROJECT.md (updated 2026-05-24 after v0.31.0 archive)
 
 **Core value:** Prove that sandboxed Nostr apps can securely delegate to a host shell over a simple, standardized protocol — and ship the spec + SDK so others can build on it.
 
-**Current focus:** Phase 162 — NIP-5D event schema migration; draft PR #224 awaiting review
+**Current focus:** Phase 163 — NAP-GAMEPAD verified and shipped as coordinated PRs; release ordering recorded in COVERAGE.md.
 
 > **Provenance note:** The "Accumulated Context" section below preserves bullet records from BOTH branches' STATE.md histories. Records tagged "v0.29.0" from main's lineage refer to the milestone NOW renumbered as v0.30.0 (Class-Gated Decrypt — Phases 135-138). Records tagged "v0.29.0" from feat/strict-model refer to NUB-CONNECT (Phases 135-142). Phase number alone is not a unique identifier across the two; cross-reference the topic (decrypt/identity/NIP-07 → v0.30.0; connect/class/CSP-authority → v0.29.0).
 
 ## Current Position
 
-Phase: 162 (nip-5d-event-schema-migration) — COMPLETE
+Phase: 163 (nap-gamepad-across-repositories) — implementation verified
 Plan: 3 of 3
-Status: Verified; [draft PR #224](https://github.com/napplet/web/pull/224) open, hzrd149 requested
-Last activity: 2026-10-13 - Completed quick task 261013-vo3: Add icon design and generation skill
+Status: Completing prerequisite publication for CLI follow-up #243
+Last activity: 2026-10-14 - Integrated the merged icon skill with the GAMEPAD release branch
 
-See phase 162 VERIFICATION.md for evidence and disclosed compatibility/tooling findings. Earlier phase and quick-task records below are historical.
+See phase 163 VERIFICATION.md and COVERAGE.md for evidence and disclosed release/specification/baseline limits. Earlier phase and quick-task records below are historical.
 
 ### Quick task 261011-hdg — COMPLETE
 
@@ -716,3 +718,7 @@ Resume: Phase 142 TERMINAL-COMPLETE — all 13 VER-IDs (VER-01..13) verified PAS
 | Phase 161 P12 | 4min | 1 tasks | 5 files |
 | Phase 161-ad-hoc-convention-package-contracts P15 | 2min | 1 tasks | 4 files |
 | Phase 161 P16 | 4 min | 2 tasks | 5 files |
+
+### Phase 163 roadmap evolution
+
+- Added NAP-GAMEPAD across repositories, including boilerplate and relevant Kehto runtime consumers. Planning and implementation evidence live in phases/163-nap-gamepad-across-repositories.

.planning/debug/resolved/pr242-paja-release-order.md

@@ -0,0 +1,41 @@
+---
+status: resolved
+trigger: "Resolve PR #242 review comment 6131874990"
+created: 2026-10-14
+updated: 2026-10-14
+---
+
+# PR #242 Paja release compatibility
+
+## Requirements
+
+Resolve [the review follow-up](https://github.com/napplet/web/pull/242#issuecomment-6131874990): make the conformance CLI release install with compatible Paja peers, and preserve the GAMEPAD subscription `id` rejection and silent reference-shell drop required by the living proposal.
+
+## Evidence and decision
+
+- npm now publishes Paja 0.21.0 (published 2026-10-13T01:38:08.664Z). Its core/NAP peers are `>=0.32.0 <0.35.0`, admitting this PR's 0.34.0 packages. Paja 0.20.1 peers remain `>=0.32.0 <0.33.0`.
+- The branch permits `>=0.20.1 <0.22.0` and still locks 0.20.1. Publication alone does not remove that incompatible locked dependency.
+- Keep the planned core/NAP 0.34.0 release and require the already-published Paja 0.21.x line. Update the lockfile and docs. Include the correction in the prepared, unpublished conformance CLI 0.3.4 release.
+- Current [NAP-GAMEPAD](https://github.com/napplet/naps/pull/108) head `0b28f77e3dfa0f07dd7c0f9d61a7090ee99f3a5e`, Wire Protocol and Error Handling, defines messages without correlation IDs and silent handling of malformed subscriptions. Current NIP-5D PR #2303 head is `020cb8b33a9e4c6b8ca4b2f9d0ed0a67843b68f7`. Keep the existing validator and reference-shell behavior.
+
+## Verification plan
+
+1. Reproduce the peer conflict with packed core/NAP 0.34.0 and published Paja 0.20.1 using strict peer installation.
+2. Pack the updated CLI and its unpublished workspace dependencies; install those exact tarballs with npm strict peers and published Paja 0.21.0. Verify resolved package versions and run the installed CLI.
+3. Run build, type-check, recursive unit tests, conformance/browser checks, and AI-slop. Confirm both subscribe and unsubscribe reject IDs and are silently dropped by the reference shell.
+4. Push the reviewed fix, record the evidence on the PR, and inspect current CI results. No merge or publication is needed to resolve this review comment.
+
+## Resolution and verification
+
+Raised the Paja minimum to `>=0.21.0 <0.22.0`; the lockfile selects 0.21.0 and the compatible Kehto peer graph. Updated the package README, site guide, and the prepared 0.3.4 changelog. The existing `workspace:*` core/NAP dependencies and GAMEPAD validators are preserved.
+
+- Reproduced the old Paja 0.20.1/core 0.34.0 conflict with npm strict peers: `ERESOLVE` and the incompatible `<0.33.0` peer range.
+- Packed the actual core 0.34.0, NAP 0.34.0, conformance 0.20.0, and conformance CLI 0.3.4 builds with `pnpm pack`; verified that packed manifests contain normal version dependencies, not workspace protocols.
+- A temporary loopback registry served these four unchanged, unpublished tarballs and redirected all other packages to npm. Fresh consumer manifests depended only on conformance CLI 0.3.4. `npm install --strict-peer-deps` and `pnpm install --strict-peer-dependencies` passed without overrides, `--force`, or legacy peer handling. Dependency trees resolved core/NAP 0.34.0 throughout.
+- npm initially selected published Paja 0.21.0. Paja 0.21.1 was published during verification; an initial tarball 404 cleared, after which isolated npm and pnpm installs selected 0.21.1 and passed. Both releases retain compatible core/NAP peers.
+- The installed CLI captured 640×360 PNGs with both Paja 0.21.0 and 0.21.1 after a fixture received its first GAMEPAD state callback. No GUI browser was opened.
+- Direct assertions against the built conformance package accepted valid subscribe/unsubscribe envelopes, rejected an `id` on both, and verified silent reference-shell drops. No protocol behavior changed.
+- Build: 12 tasks passed. Types: 18 tasks passed. Recursive unit tests passed. Conformance browser suite: 5 tests passed. Release-tooling and workflow contract tests passed. Frozen workspace install with strict peers and whitespace checks passed.
+- AI-slop: 98/100, zero errors, only the existing `fflate` dependency advisory.
+
+The fix is committed as `3c3f1a66` and pushed to PR #242. Local verification logs and packed-install evidence are under `/tmp/napplet-pr242-*`; the scratch registry root is `/tmp/napplet-pr242-peers.a32qMw`. These tests establish release compatibility without claiming the napplet package set is already on npm. The PR check runs and review response carry the remote verification record. No merge or publication was performed.

.planning/phases/163-nap-gamepad-across-repositories/.gitkeep

@@ -0,0 +1 @@
+

.planning/phases/163-nap-gamepad-across-repositories/163-01-PLAN.md

@@ -0,0 +1,21 @@
+---
+phase: 163-nap-gamepad-across-repositories
+plan: 01
+type: execute
+wave: 01
+depends_on: []
+autonomous: true
+requirements: [GP-API, GP-WIRE, GP-TRUST]
+---
+
+# Portable API and injection
+
+Non-normative execution plan; all protocol choices defer to the living references in 163-CONTEXT.md.
+
+<objective>
+Add core schemas/API/domain identity; NAP types, cached shim, SDK helpers and exports; runtime injection and sdk namespace/subpath; exact wire and lifecycle tests. Verify through the runtime-provided namespace before expanding to runtime consumers.
+</objective>
+
+<verification>
+Verify the named requirements against current source, built import surfaces and task-relevant unit/browser tests. Record actual commands/results and unresolved specification conflicts. Preserve unrelated work. Commit each green checkpoint. Do not claim completion from import presence alone; prove the live/neutral input boundary and teardown.
+</verification>

.planning/phases/163-nap-gamepad-across-repositories/163-01-SUMMARY.md

@@ -0,0 +1,11 @@
+---
+phase: 163
+plan: 01
+status: complete
+---
+
+# Portable GAMEPAD API
+
+Core types/domain, NAP binding and validators, SDK root/subpath exports, npm/JSR maps, and selected shim installation are implemented. Built export tests, cached snapshot/range/parent-source tests, full build/type/unit gates and slop pass.
+
+Non-normative evidence; protocol authority remains the living references in 163-CONTEXT.md.

.planning/phases/163-nap-gamepad-across-repositories/163-02-PLAN.md

@@ -0,0 +1,21 @@
+---
+phase: 163-nap-gamepad-across-repositories
+plan: 02
+type: execute
+wave: 02
+depends_on: [163-01]
+autonomous: true
+requirements: [GP-ISOLATION, GP-WIRE, GP-TRUST]
+---
+
+# Runtime isolation and conformance
+
+Non-normative execution plan; all protocol choices defer to the living references in 163-CONTEXT.md.
+
+<objective>
+Implement shell-side focus-scoped polling/snapshots in Kehto and its Paja/host consumers. Add reference harness state behavior, exact envelope validation, native controller denial and real Chromium multi-napplet focus/visibility/unsubscribe tests. Keep physical device handles outside napplets.
+</objective>
+
+<verification>
+Verify the named requirements against current source, built import surfaces and task-relevant unit/browser tests. Record actual commands/results and unresolved specification conflicts. Preserve unrelated work. Commit each green checkpoint. Do not claim completion from import presence alone; prove the live/neutral input boundary and teardown.
+</verification>

.planning/phases/163-nap-gamepad-across-repositories/163-02-SUMMARY.md

@@ -0,0 +1,11 @@
+---
+phase: 163
+plan: 02
+status: complete
+---
+
+# Runtime and conformance
+
+Conformance implements the three envelopes and cached parent-bound browser binding. Kehto provides host-owned native reading, input-owner/visibility isolation, controller Permissions-Policy denial, subscription/rate/session cleanup, and optional SHELL-independent routing. Chromium proves native denial and frame/host/tab focus isolation with canonical host test samples. Native API replacement remains deferred for the disclosed specification conflict.
+
+Non-normative evidence; protocol authority remains the living references in 163-CONTEXT.md.

.planning/phases/163-nap-gamepad-across-repositories/163-03-PLAN.md

@@ -0,0 +1,21 @@
+---
+phase: 163-nap-gamepad-across-repositories
+plan: 03
+type: execute
+wave: 03
+depends_on: [163-02]
+autonomous: true
+requirements: [GP-REPOS, GP-DOCS, GP-SHIP]
+---
+
+# All repositories, docs and shipment
+
+Non-normative execution plan; all protocol choices defer to the living references in 163-CONTEXT.md.
+
+<objective>
+Audit all seven organization repos plus Kehto and every package. Add applicable generator/client/template integrations and evidence for unchanged surfaces. Sync package/site/skill/boilerplate docs, preserve keyboard/pointer fallbacks, run required gates, prepare release metadata and open PRs for each changed repo.
+</objective>
+
+<verification>
+Verify the named requirements against current source, built import surfaces and task-relevant unit/browser tests. Record actual commands/results and unresolved specification conflicts. Preserve unrelated work. Commit each green checkpoint. Do not claim completion from import presence alone; prove the live/neutral input boundary and teardown.
+</verification>

.planning/phases/163-nap-gamepad-across-repositories/163-03-SUMMARY.md

@@ -0,0 +1,15 @@
+---
+phase: 163
+plan: 03
+status: complete
+---
+
+# All repositories and shipment
+
+All seven organization repositories plus Kehto are audited. Applicable source, consumer/toolchain, template, migration, policy, organization, site/package/skill, and release surfaces are covered in COVERAGE.md. Primary build/type/unit/docs/slop gates pass. CVM controller suites pass; protected-authority and timing failures also reproduce on its untouched baseline. Linked PRs and final host gates are recorded before completion.
+
+Non-normative evidence; protocol authority remains the living references in 163-CONTEXT.md.
+
+Opened PRs: web #242, Kehto #297, boilerplate #7, Nappagochi #1, migrate #1, CVM #1, organization #1. naps proposal #108 remains the canonical open draft. Publish Kehto CLI 0.5.5/Paja 0.21.0 before the primary release. All owned working trees are clean; unrelated original work remains unchanged.
+
+Release sequencing correction: primary web #242 publishes the SDK/conformance set while retaining the already-published CLI runners. Draft follow-up [#243](https://github.com/napplet/web/pull/243) changes the private runner pins and CLI version only after conformance CLI 0.3.4 and Kehto CLI 0.5.5/Paja 0.21.0 publish. Fresh-cache CI correctly rejected nonexistent future versions, which prompted this split; no provisioning test was weakened.

.planning/phases/163-nap-gamepad-across-repositories/163-CONTEXT.md

@@ -0,0 +1,19 @@
+# Phase 163 context
+
+Non-normative implementation planning. The living sources govern; this document creates no protocol requirements.
+
+User objective: implement NAP-GAMEPAD with coverage across every napplet repository and package, including boilerplate. Canonical proposal: https://github.com/napplet/naps/pull/108 (current head inspected: 0b28f77e3dfa0f07dd7c0f9d61a7090ee99f3a5e). Canonical NIP-5D: https://github.com/nostr-protocol/nips/pull/2303 (current head inspected: 020cb8b33a9e4c6b8ca4b2f9d0ed0a67843b68f7). Recheck heads before shipping.
+
+Implementation acceptance references:
+
+- GP-API: implement the four operations and initial cached state from NAP-GAMEPAD API Surface, with exported types and npm/JSR subpaths.
+- GP-WIRE: implement exactly the three fire-and-forget envelopes from Wire Protocol; reject malformed state without adding requests, results or ids.
+- GP-ISOLATION: implement Shell Behavior focus, neutral snapshots, visibility, connections, unavailable reasons, unsubscribe and session teardown; test native denial in a real browser.
+- GP-TRUST: preserve NIP-5D Transport parent/source checks, domain presence and injection timing.
+- GP-REPOS: audit every napplet organization repo and every web monorepo package; implement relevant integration and document evidence for surfaces needing no change. Include Kehto because it supplies runtime/Paja services consumed by these packages.
+- GP-DOCS: update package, site, skills and boilerplate guidance with optional availability, focus transitions and keyboard/pointer fallback.
+- GP-SHIP: meaningful unit/browser/package export tests; required repository build/type/unit/doc/slop checks; changesets/release metadata; atomic commits and open PRs for changed repos.
+
+Native API replacement is an unresolved spec conflict: NAP-GAMEPAD Web Projection Guidance permits navigator.getGamepads replacement, whereas current NIP-5D Security Rationale item 5 limits runtime injection to window.napplet. Preserve the native operation and deny physical access through Permissions-Policy; the required domain API does not need that optional replacement. Surface this conflict in PRs and coverage evidence.
+
+Existing unrelated work in the original worktrees remains untouched. Work happens on feat/nap-gamepad in separate clones/worktrees based on each repository default branch.

.planning/phases/163-nap-gamepad-across-repositories/163-RESEARCH.md

@@ -0,0 +1,11 @@
+# Research
+
+Non-normative; defer to the linked living specifications in CONTEXT.md.
+
+The active web monorepo separates protocol/global types in core, per-domain types/shim/helpers in nap, selected runtime injection in shim, and late-bound application wrappers in sdk. npm/JSR export maps and tsup entrypoints require explicit new subpaths. Existing core dispatch registration is private package plumbing; do not add wire handshakes.
+
+Conformance has JSON envelope validators, endpoint-bound reference responses, a browser boot harness and separate CLI/Paja transport. Add state/subscription coverage and controller denial to the existing boundaries. The browser harness presently creates allow-scripts frames without controller policy denial. Kehto owns production runtime/Paja device and focus mediation and therefore needs corresponding integration.
+
+Organization inventory: web, naps, boilerplate, .github, cvm, nappagochi, migrate. naps contains published GAMEPAD proposal #108; .github is community metadata. Audit other repos against their current default branches, not dirty existing local worktrees. Boilerplate documentation contains obsolete NIP-5A aggregate-hash guidance; correct it against current NIP-5D while adding controller authoring guidance.
+
+Verification will use canonical connected/neutral/blocked examples, multi-session focus transitions and native Permissions-Policy denial in Chromium. Test public import surfaces in built npm packages and JSR source maps. Do not require controllers on machines that lack them or declare gamepad as a hard capability for apps retaining other input.