feat(gateway): relay complete encoded frames

openspec/specs/gateway-qualification/spec.md

@@ -5,14 +5,47 @@ Define the deterministic processing, impairment, pacing, and evidence boundaries
 for qualifying a frozen Phase 3C gateway candidate.
 ## Requirements
 ### Requirement: Fixed media processing qualification
-The qualification harness SHALL drive pinned-mTLS Apollo management, encrypted RTSP, ENet, and provider UDP through native source validation, `readUDPMedia`, recovery/FEC, bounded production queues, the production fair pacer, Verse framing/QUIC, and a public or independent client decoder for 1080p60 H.264 at 20 Mbps, 1440p120 HEVC at 50 Mbps, and 4K60 HEVC at 80 Mbps. After a recorded warm-up, the frozen candidate SHALL run each profile for ten wall-clock minutes, preserve encoded payload bytes, retain every monotonic processing sample plus bounded provider-queue observations, and report count, min, median, p90, p95, p99, max, mean, standard deviation, measured batched monotonic-clock overhead and method, and observed bitrate. Processing begins at complete provider-unit receipt and ends at QUIC handoff, excluding client transit and pacing. Queue delay SHALL measure provider-queue residence, processing SHALL measure gateway work before pacing, and pacing delay SHALL measure scheduler waiting. Native queues SHALL remain bounded at 256 video packets and 16 audio or event units per session, retaining latest-unit replacement. CPU, heap, allocations, and goroutines SHALL be measured from the isolated gateway process only; CPU SHALL be actual OS user plus system consumption and MUST NOT include idle wall capacity or unrelated parent fixture/client work. Successive profiles SHALL use independent resource-counter baselines. Any bypass, payload mutation, wall-duration violation, bitrate outside both lower and upper bounds, unexplained clean-path loss, zero or unbounded clock overhead, or p95 above 5 ms SHALL fail.
+The qualification harness SHALL drive pinned-mTLS Apollo management, encrypted
+RTSP, ENet, and provider UDP through native source validation, `readUDPMedia`,
+recovery/FEC, byte/count/latency-bounded production queues, the production fair
+pacer, Protocol complete-frame fragmentation, Verse framing/QUIC, and an
+independent bounded client reassembler for 1080p60 H.264 at 20 Mbps, 1440p120
+HEVC at 50 Mbps, and 4K60 HEVC at 80 Mbps. The source fixture SHALL emit
+deterministic variable-size complete encoded frames at the named 60/120 FPS
+rate, preserve exact target bytes over each fixed interval, and include bounded
+larger keyframes without codec operation. After a recorded warm-up, the frozen
+candidate SHALL run each profile for ten wall-clock minutes, preserve every
+frame's bytes and boundary, retain every monotonic processing sample plus
+bounded provider-queue observations, and report frame count, frame rate,
+bitrate, min, median, p90, p95, p99, max, mean, standard deviation, and measured
+batched monotonic-clock overhead and method. Processing begins at complete
+provider-frame receipt and ends at QUIC handoff, excluding client transit and
+pacing. Queue delay SHALL measure provider-queue residence, processing SHALL
+measure gateway work before pacing, and pacing delay SHALL measure scheduler
+waiting. Native video queues SHALL retain at most 16 complete frames, 4 MiB,
+and 250 milliseconds; audio and event queues SHALL remain independently bounded
+at 16 units. CPU, heap, allocations, and goroutines SHALL be measured from the
+isolated gateway process only; CPU SHALL be actual OS user plus system
+consumption and MUST NOT include idle wall capacity or unrelated parent
+fixture/client work. Successive profiles SHALL use independent resource-counter
+baselines. Any bypass, payload or frame-boundary mutation, frame-rate/count
+mismatch, wall-duration violation, bitrate outside both lower and upper bounds,
+unexplained clean-path loss, zero or unbounded clock overhead, or p95 above 5
+ms SHALL fail.
 
 #### Scenario: Healthy fixed profile
 - **WHEN** a frozen candidate runs one fixed profile for the normative duration in the isolated qualification command
-- **THEN** the harness emits compressed raw path and gateway-process resource samples plus a summary tied to the exact command, CPU scope, timing-overhead method, topology, source commit, immutable Protocol version, environment, and payload hash
+- **THEN** the harness emits compressed raw frame/path and gateway-process
+  resource samples plus a summary tied to the exact command, CPU scope,
+  timing-overhead method, topology, source commit, immutable Protocol version,
+  environment, and payload hash
 
 #### Scenario: Processing gate failure
-- **WHEN** any production path stage lacks a per-traversal observation, stage accounting does not balance, payload integrity fails, duration or bitrate bounds fail, measured p95 exceeds 5 ms, parent work changes gateway CPU, idle capacity is reported as consumed CPU, or timing overhead is absent
+- **WHEN** any production path stage lacks a per-frame observation, stage
+  accounting does not balance, payload or frame boundaries change, duration,
+  frame-rate, frame-count, or bitrate bounds fail, measured p95 exceeds 5 ms,
+  parent work changes gateway CPU, idle capacity is reported as consumed CPU, or
+  timing overhead is absent
 - **THEN** the qualification command exits unsuccessfully without recording a passing candidate
 
 ### Requirement: Bounded impairment qualification