For a):

If a gamepad is disconnected, previously assigned indices MUST NOT be reassigned to gamepads that continue to be connected.

A gamepad should preserve its index in the array returned by getGamepads. Suppose the user connects an Xbox 360 gamepad over USB, then pairs a DS4 over Bluetooth, then unplugs the Xbox 360 gamepad. If getGamepads tried to avoid leaving a null element in the array, it means that any page using gamepad input would need to move the DS4 from slot 1 to slot 0. If the connected gamepad's slot has meaning in the application (eg, different gamepads correspond to different players), switching the slot unexpectedly could cause confusion and frustration.

For b), I think the spec should be clarified. In my opinion, the "interacted-with" bit should only be set if the interaction is significant (it should not be triggered when an analog gamepad is gently set onto a table or if a button is lightly touched) and should persist at the very least across a refresh but definitely not across origins. Button.pressed is probably too sensitive to be used as an "interacted-with" signal since it can fire if an analog trigger is lightly pulled.

+1 for more explicitly scoping the user interaction necessary for making the presence of gamepads clear. Describing the level of user interaction, how long an interaction should count for presence of a gamepad, whether interaction on one gamepad implies presence of any other connected gamepads, whether the interaction is per origin, whether that interaction counts beyond that session -- all those seem to have some assumption by implementers/users that isn't clearly described in the spec. (Issue #71 is related.)

I think another topic along the lines of the origin scope is whether the gamepads are intended to be made visible to embedded parties or only the top-level browsing context. I think users might be surprised (and the API would be much more likely to be used primarily for background tracking) if embedded iframes could also access the configuration of connected gamepads. That said, there might be larger embedded iframes that are the games themselves.

@npdoty: very good points. see my brief comment in #71 about possibly using the Feature Policy: #71 (comment)