fix(protocol): harden gateway contract validation

openspec/changes/phase3c-apollo-input-feedback/specs/gateway-input-feedback/spec.md

@@ -33,7 +33,7 @@ an implementation-specific release-all provider command.
   packets reliably before starting provider disconnect.
 
 ### Requirement: Bounded provider feedback control envelope
-The bidirectional reliable control flow SHALL define an ASCII `VGF1` envelope
+The registered bidirectional reliable `control.ack.v1` flow SHALL define an ASCII `VGF1` envelope
 with a direction byte, type byte, big-endian payload length, and exact payload
 bytes. Only host termination, rumble, and HDR feedback SHALL be valid from the
 gateway to the client; only IDR and FEC/loss feedback SHALL be valid from the
@@ -53,7 +53,8 @@ certificate, credential, or opaque provider packet.
 
 ### Requirement: Policy-bound text clipboard envelope
 The reliable `clipboard.text.v1` flow SHALL carry only a typed UTF-8 text
-envelope with exact direction and a bounded loop token. The Server SHALL mint
+envelope with exact direction and a 16--128 character canonical unpadded ASCII
+base64url loop token. The Server SHALL mint
 the enabled directions, maximum text bytes, and maximum updates per minute in
 authenticated provider work. The gateway SHALL reject disabled direction,
 unknown fields, files, file URLs, client folders, binary data, malformed UTF-8,
@@ -62,11 +63,15 @@ SHALL not put clipboard content, provider routes, or credentials in telemetry,
 audit, state, or errors.
 
 #### Scenario: Clipboard audit metadata
-- **WHEN** the gateway accepts, suppresses, or rejects a clipboard update
+- **WHEN** the gateway successfully delivers, suppresses, or rejects a clipboard update
 - **THEN** it sends an authenticated Server audit record with only direction,
   bounded byte count, outcome, and a fixed reason; it never includes text or
   the loop token.
 
+#### Scenario: Clipboard delivery failure
+- **WHEN** provider-to-client control delivery fails
+- **THEN** the gateway does not report the update as forwarded.
+
 #### Scenario: Reflected clipboard value
 - **WHEN** a client-originated text value returns from the provider with the
   matching retained token/value pair