fix(pen): re-baseline zoom on pointer-count change; observe pen on child HWND

Zoom jumping (device: min 0.5 / max 2.47 while zooming near 1): the per-frame
scale clamp limited single-frame spikes but not multi-frame runs. Root cause is
pointer-count transitions — on Windows touch the two fingers land/lift at
different times and digitizers drop/re-acquire touches, and stock InteractiveViewer
keeps _scaleStart/_referenceFocalPoint from the OLD finger set, so the next frame
jumps. PenInteractiveViewer now re-baselines (and skips the transitional frame)
whenever details.pointerCount changes. The per-frame clamp stays as a secondary
guard.

Buttons (device evidence: btn=1 for tip-down, side-button, AND inverted; kind
never becomes invertedStylus): Flutter does NOT surface the barrel/eraser/inverted
state at all — unreachable from Dart. The only path is the native badnote/pen
plugin, which was SILENT because WM_POINTER is delivered to the Flutter CHILD
view window, not the top-level FlutterWindow where ObservePenMessage was hooked.
Fix: subclass the child HWND (SetWindowSubclass + comctl32) and observe its
WM_POINTER messages, passing every message through unchanged via DefSubclassProc
(observation-only, input behavior preserved). This is what should finally feed
GetPointerPenInfo penFlags + tilt to the channel — to be confirmed on-device with
the diagnostic (btn / kind / tilt readout).

Dart: analyze clean, 66/66 tests, linux build green. Native compiles on Windows CI.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

windows/runner/flutter_window.cpp

@@ -1,11 +1,36 @@
 #include "flutter_window.h"
 
+#include <commctrl.h>
+
 #include <optional>
 
 #include "flutter/generated_plugin_registrant.h"
 #include "ocr_channel.h"
 #include "pen_channel.h"
 
+// SetWindowSubclass / DefSubclassProc / RemoveWindowSubclass live in comctl32.
+#pragma comment(lib, "comctl32.lib")
+
+namespace {
+
+// Id for the pen observer subclass installed on the Flutter child view window.
+constexpr UINT_PTR kPenSubclassId = 1;
+
+// Subclass proc on the FLUTTER CHILD window. WM_POINTER messages are delivered
+// to the window under the pointer — that is the Flutter view's child HWND, not
+// the top-level window — so this is where the pen's barrel/eraser/tilt actually
+// arrive. We observe (non-consuming) and pass every message straight through to
+// Flutter's own handler via DefSubclassProc, so input behavior is unchanged.
+LRESULT CALLBACK FlutterChildSubclassProc(HWND hwnd, UINT message,
+                                          WPARAM wparam, LPARAM lparam,
+                                          UINT_PTR /*subclass_id*/,
+                                          DWORD_PTR /*ref_data*/) {
+  ObservePenMessage(message, wparam, lparam);
+  return DefSubclassProc(hwnd, message, wparam, lparam);
+}
+
+}  // namespace
+
 FlutterWindow::FlutterWindow(const flutter::DartProject& project)
     : project_(project) {}
 
@@ -29,7 +54,15 @@ bool FlutterWindow::OnCreate() {
   RegisterPlugins(flutter_controller_->engine());
   RegisterOcrChannel(flutter_controller_->engine());
   RegisterPenChannel(flutter_controller_->engine());
-  SetChildContent(flutter_controller_->view()->GetNativeWindow());
+
+  HWND flutter_child = flutter_controller_->view()->GetNativeWindow();
+  SetChildContent(flutter_child);
+
+  // Observe WM_POINTER on the Flutter child window (where pen messages land) so
+  // the pen barrel/eraser/inverted flags + tilt reach the badnote/pen channel.
+  if (flutter_child) {
+    SetWindowSubclass(flutter_child, FlutterChildSubclassProc, kPenSubclassId, 0);
+  }
 
   flutter_controller_->engine()->SetNextFrameCallback([&]() {
     this->Show();
@@ -45,6 +78,11 @@ bool FlutterWindow::OnCreate() {
 
 void FlutterWindow::OnDestroy() {
   if (flutter_controller_) {
+    HWND flutter_child = flutter_controller_->view()->GetNativeWindow();
+    if (flutter_child) {
+      RemoveWindowSubclass(flutter_child, FlutterChildSubclassProc,
+                           kPenSubclassId);
+    }
     flutter_controller_ = nullptr;
   }