Plan: note the boundary protocol is undefined, and what it must carry

The app<->svc-gw channels have no wire format yet. Measured USB link
drops (~3 s per power change, sleeping tablet invisible at link level)
and yukart decision 24 already fix the required fields: heartbeat,
command idempotency key, and utterance id/sequence/terminator/expiry.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/impl/plans/INITIAL.md

@@ -1,7 +1,7 @@
 ---
 type: plan
 status: active
-updated: 2026-09-05
+updated: 2026-10-09
 ---
 # Initial plan
 
@@ -20,6 +20,21 @@ observed traffic. They arrive as DBC entries plus registry rows with
 `system/<service>` have their fields named in `topics.json` but no JSON Schema
 yet. They get one when a publisher exists to constrain.
 
+**The app ↔ `svc-gw` boundary protocol.** Bus topics are defined here, but the
+two channels across the boundary (latest-wins state down, acknowledged commands
+up) have no wire format yet. Project-yukart decision 24 (proposed) already
+fixes what it must carry, because the USB link drops for ~3 s at every power
+change and a sleeping tablet looks alive at the link layer:
+
+- a **heartbeat** in both directions, with an agreed interval and timeout, so the
+  Orin reaps a silent client instead of trusting TCP or link state;
+- an **idempotency key** on every upstream command, so retries across a
+  reconnect never act twice;
+- for TTS, **utterance id + chunk sequence + terminator + an expiry**, so a
+  reconnect can resume or drop an utterance rather than replay it blindly.
+
+Defined when `svc-gw` and `app-flutter` first talk, not before.
+
 ## Order
 
 1. Schema validation available to all three languages — the Rust services, the