[tiensonqin]

Summary

Fix autofocus inside a sibling portal dismissing its parent menu. Web layers now derive a cycle-safe, transitive ownership closure from retained ownership or a child trigger contained by the parent surface, not by a shared external invoker. Focus/pointer classification, focus scopes and ancestor close/removal use the same closure; closing surfaces no longer grant ownership. Owned popovers begin exit and emit their existing Dismiss on ancestor teardown.

Explicit typed anchor-target takes precedence over recorded invoking focus for popover ownership and return focus; an unavailable explicit anchor never falls back to an unrelated trigger. Autofocus, unrelated outside-focus dismissal and topmost Escape remain enabled. Documents the default/event behavior in docs/api-migrations.md; no constructors, schema, wire, Dune files, public pins, app code or non-Web renderers change. Independent of #291.

Validation

• opam exec -- dune build @web @all: passed (production Web and native compilation).
• npm --prefix platform/web run check: 157 passed.
• node --test tooling/test/*.mjs: 10 passed.
• opam exec -- dune runtest test --force -j 1: 236 passed.
• Focused layer/focus-policy/return-focus checks: 15 passed.
• node --check platform/web/test/layer-close-input.test.mjs, staged/cumulative git diff --check: passed.
• ocamlformat --check exits successfully but is a no-op because the repository has no formatter configuration; not claimed as formatting coverage.

Test-value gate: KEEP, one retained test at the existing headless layer-module boundary. It fails against the unchanged baseline Web algorithm because nested portal focus dismisses its ancestors, then passes with this fix. It covers the same transitive ownership invariant across focus scope, close/removal, trigger rebind and the shared-external-trigger negative case, without app selectors or browser fixtures.

No GUI, browser E2E, OS clipboard, worker, graph or native runtime operation was performed. Headless checks do not establish production UI acceptance; production Web/native revalidation remains a separate consumer step.

Link to Devin session: https://app.devin.ai/sessions/8fb8206975da46adad697ea4f962c885
Open in Devin Desktop: https://app.devin.ai/desktop/session/8fb8206975da46adad697ea4f962c885?variant=devin
Requested by: @tiensonqin

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring