Product card policy: coordinator host review

On 2026-09-23 the coordinator reviewed the actual C policy in nix/card-shell-policy/card-shell-policy.c and its integration contract. Source commits 237be7b and c2ece6a were integrated as 1755cb3 and 8f21cf3. The adapter compiles this shared source; there is no independent Python state model. Adapter integration remains a separate task.

Command run from the integration worktree:

python3 tests/test_card_shell_state.py
openspec validate the-shell-manages-apps-as-cards --strict

Both exited zero. All 21 scenarios passed with AddressSanitizer and UndefinedBehaviorSanitizer. They exercise dynamic snapshots, horizontal tracking, adjacent-card identity, private/unavailable states and transitions, graceful close, refusal, timeout, source removal, edge entry, multiple contacts, button equivalents, keyboard geometry and reduced-motion outcomes. A 257-card fixture avoids baking the two-app architecture probe into the product policy.

Review found that locally cancelling a gesture and ending a complete touch stream need different semantics. Waiting for an up event after compositor cancellation or device removal can swallow future input indefinitely. The correction adds cs_stream_cancel, which clears all held contacts immediately; locally rejected gestures still consume their remaining releases. Tests cancel without any later up and then complete a fresh gesture, including after a multiple-contact abort. The adapter owner received this API requirement.

This closes only the host policy task. Actual scene buffers, privacy pixels, surface lifetimes, UI routes, keyboard focus, live rendering, physical touch, performance and image integration remain UNVERIFIED by this evidence.