Boundary: source bus, and how svc-gw judges stale

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DDwfd6Ki8UfG4hK6W5YpJz

docs/BOUNDARY.md

@@ -31,11 +31,17 @@ The two channels from decision 24 share the socket but keep different guarantees
 
 | `t` | When | Fields |
 |---|---|---|
-| `hello` | first message | `proto` (0), `server`, `host`, `source` (`mock` \| `none`), `mock`, `hb_ms`, `timeout_ms` |
+| `hello` | first message | `proto` (0), `server`, `host`, `source` (`bus` \| `mock` \| `none`), `mock`, `hb_ms`, `timeout_ms` |
 | `hb` | every `hb_ms` | `ts` (Orin epoch ms), `clients` |
 | `state` | 5 Hz, when there is a source | `seq`, `mock`, `signals`: name → envelope (`schema/envelope.json`) |
 | `ack` | reply to a `cmd` | `id`, `ok`, `detail`, `dup` (true when answered from the cache) |
 
+With `source: bus`, `signals` is the newest envelope of every signal svc-gw has
+seen on `yukart/vehicle/+` and `yukart/host/+`. svc-gw marks one
+`quality: "stale"` when it has not been refreshed for 5 s, or is known only from
+the broker's retained copy (which may predate a reboot). A signal once seen is
+never removed.
+
 `signals` holds only what is currently known. A missing signal is unknown, a
 `null` value is known-without-value, `quality: "stale"` is an old value. All three
 are normal and a display must render each distinctly.
@@ -67,5 +73,5 @@ connections) and never re-runs the command.
 ## Not yet
 
 - TTS utterances (id, chunk sequence, terminator, expiry) — when there is a TTS.
-- `gnss` and decoded vehicle state from the bus — when the bus exists.
+- `gnss`: its fix is an object, which the envelope's `value` does not allow yet.
 - Any version beyond `proto: 0`. A breaking change bumps it; the client checks it.