## Context

The native Apollo session and production QUIC gateway already quiesce media before terminal delivery. A public independent-client test proved that immediate `CloseWithError` can overtake the queued reliable stream frame, while waiting for client connection closure leaves tunnel ownership unbounded.

## Goals / Non-Goals

**Goals:**

- Deliver one terminal event before gateway-owned closure.
- Bound closure when a client remains open or omits the receipt.
- Preserve cleanup, input release, reservation, and durable state behavior.

**Non-Goals:**

- A generic acknowledgement or lifecycle framework.
- Any Apollo protocol, media, Server authority, or dependency change.

## Decisions

- Reuse Protocol `control.ack.v1` type `0x03` as an empty terminal receipt.
- Hold the receipt-state lock across the terminal write, arm one receipt slot only after a successful write, and consume it in the gateway rather than provider feedback.
- Wait at most two seconds for receipt, then close and clean up regardless.
- Serialize the bounded native event queue and evict one older feedback item only when necessary to retain a terminal event.

## Risks / Trade-offs

- [Client omits receipt] → Close at the two-second bound and retain durable cleanup behavior.
- [Feedback queue is saturated] → Sacrifice one older nonterminal feedback event rather than lose terminal ownership.
- [Receipt is malformed, duplicate, or early] → Fail the session closed without provider mutation.