feat(protocol): negotiate display and native input

frames/gateway-input-feedback-v1.md

@@ -4,12 +4,14 @@ This grammar is carried only in an authenticated Phase 3C gateway session. It
 is deliberately provider-neutral: it never carries provider routes,
 certificates, credentials, opaque provider packets, clipboard bytes, files, or
 client-folder data. It does not change the v1 datagram header or any existing
-release candidate.
+kind encoding; the new kinds require explicit feature negotiation and a new
+immutable Protocol release candidate.
 
 ## `input.sequenced.v1` payload (`VGI1`)
 
-All multibyte fields are unsigned big-endian. The payload has exactly six bytes
-of header followed by the declared body:
+All multibyte fields are big-endian and unsigned unless a field is explicitly
+marked signed. The payload has exactly six bytes of header followed by the
+declared body:
 
 | Offset | Size | Field | Rule |
 |---:|---:|---|---|
@@ -32,12 +34,16 @@ during cleanup.
 | `0x03` | relative mouse | `delta_x` (i16), `delta_y` (i16). |
 | `0x04` | UTF-8 scalar | exactly one valid UTF-8 Unicode scalar, one through four bytes. |
 | `0x05` | controller state | `controller` (0 through 15), `active_mask` (u16), `button_flags` (u16), `left_trigger` (u8), `right_trigger` (u8), `left_x` (i16), `left_y` (i16), `right_x` (i16), `right_y` (i16), `extra_button_flags` (u16). A zero `active_mask` and zero state is release. |
+| `0x06` | absolute mouse | `x` (u16), `y` (u16), `viewport_width` (u16), `viewport_height` (u16). Viewport dimensions must be nonzero and each coordinate must be strictly smaller than its corresponding dimension. |
+| `0x07` | high-resolution scroll | `vertical_delta` (i16), `horizontal_delta` (i16). Positive and negative values preserve the client scroll direction without provider-specific scaling. |
 
-Keyboard, mouse button, UTF-8, and controller messages are delivered over the
-gateway's reliable ordered input flow. Relative mouse is a state change, not a
-pressed-state entry. The gateway maps the validated values to the provider's
-separate keyboard, mouse, UTF-8, and controller control messages; it does not
-forward this envelope to the provider.
+Keyboard, mouse button, UTF-8, controller, absolute mouse, and scroll messages
+are delivered over the gateway's reliable ordered input flow. Relative and
+absolute mouse movement and scroll are state changes, not pressed-state
+entries. Kinds `0x06` and `0x07` are accepted only when the session advertises
+`input.absolute.v1` and `input.scroll.v1`, respectively. The gateway maps the
+validated values to the provider's separate input messages; it does not forward
+this envelope to the provider.
 
 ## Reliable control payload (`VGF1`)