test(gateway): retain raw wire qualification evidence

.gitea/workflows/verify.yml

@@ -14,19 +14,19 @@ concurrency:
 
 jobs:
   gateway:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-latest-on-demand-xhigh-performance
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-go@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
         with:
           go-version: "1.26.5"
           cache: true
           cache-dependency-path: go.mod
-      - uses: oven-sh/setup-bun@v2
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
           bun-version: "1.3.13"
-      - name: Verify Go and OpenSpec baseline
+      - name: Verify Go and OpenSpec
         run: make OPENSPEC='bunx --bun @fission-ai/openspec@1.5.0' verify
       - name: Build and inspect reproducible Linux gateway artifacts
         run: |
@@ -35,11 +35,13 @@ jobs:
           file dist/verse-gateway-linux-* | tee dist/file.txt
           go version -m dist/verse-gateway-linux-amd64 > dist/go-version-amd64.txt
           go version -m dist/verse-gateway-linux-arm64 > dist/go-version-arm64.txt
-      - uses: christopherhx/gitea-upload-artifact@v4
+          make gateway-sbom DIST_DIR=dist
+      - uses: christopherhx/gitea-upload-artifact@81f940d004763f986ba3582c007fd842dd5cb0d7 # v4
         with:
           name: verse-gateway-linux-${{ gitea.sha }}
           path: dist/*
           if-no-files-found: error
-          retention-days: 30
+          # Gitea 1.27 floors the positive upload delay; request 31 days to retain at least 30 elapsed days.
+          retention-days: 31
       - name: Verify clean checkout
         run: git diff --exit-code

Makefile

@@ -1,8 +1,10 @@
-.PHONY: format-check module-verify build vet test openspec gateway-linux verify
+.PHONY: format-check module-verify build vet test openspec gateway-linux gateway-sbom verify
 
 GO ?= go
 OPENSPEC ?= openspec
 DIST_DIR ?= dist
+SOURCE_REVISION ?= $(shell git rev-parse HEAD)
+SOURCE_DATE ?= $(shell git show -s --format=%cI HEAD)
 
 format-check:
 	@test -z "$$(gofmt -l $$(find gateway -type f -name '*.go' -print))"
@@ -27,4 +29,12 @@ gateway-linux:
 	CGO_ENABLED=0 GOOS=linux GOARCH=amd64 GOWORK=off $(GO) build -mod=readonly -trimpath -buildvcs=false -ldflags=-buildid= -o "$(DIST_DIR)/verse-gateway-linux-amd64" ./cmd/verse-gateway
 	CGO_ENABLED=0 GOOS=linux GOARCH=arm64 GOWORK=off $(GO) build -mod=readonly -trimpath -buildvcs=false -ldflags=-buildid= -o "$(DIST_DIR)/verse-gateway-linux-arm64" ./cmd/verse-gateway
 
+gateway-sbom:
+	$(GO) run ./cmd/verse-gateway-sbom \
+		-source-revision "$(SOURCE_REVISION)" \
+		-source-date "$(SOURCE_DATE)" \
+		-artifact "amd64=$(DIST_DIR)/verse-gateway-linux-amd64" \
+		-artifact "arm64=$(DIST_DIR)/verse-gateway-linux-arm64" \
+		-output "$(DIST_DIR)/verse-gateway.spdx.json"
+
 verify: format-check module-verify build vet test openspec

cmd/verse-gateway-sbom/main.go

@@ -0,0 +1,376 @@
+package main
+
+import (
+	"bufio"
+	"crypto/sha256"
+	"debug/buildinfo"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"flag"
+	"fmt"
+	"io"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"reflect"
+	"regexp"
+	"sort"
+	"strings"
+	"time"
+)
+
+const (
+	dataPlaneModulePath = "git.sechmachine.io.vn/sechmachine/VerseVDI-Data-Plane"
+	protocolModulePath  = "git.sechmachine.io.vn/sechmachine/VerseVDI-Protocol"
+)
+
+type artifactFlags []string
+
+func (values *artifactFlags) String() string { return strings.Join(*values, ",") }
+func (values *artifactFlags) Set(value string) error {
+	*values = append(*values, value)
+	return nil
+}
+
+type goModule struct {
+	Path    string
+	Version string
+	Sum     string
+}
+
+type gatewayArtifact struct {
+	Architecture string
+	Filename     string
+	SHA256       string
+	Size         int64
+}
+
+type sbomInput struct {
+	SourceRevision   string
+	Created          time.Time
+	ProtocolGoModSum string
+	Modules          []goModule
+	Artifacts        []gatewayArtifact
+}
+
+type spdxDocument struct {
+	SPDXVersion       string             `json:"spdxVersion"`
+	DataLicense       string             `json:"dataLicense"`
+	SPDXID            string             `json:"SPDXID"`
+	Name              string             `json:"name"`
+	DocumentNamespace string             `json:"documentNamespace"`
+	CreationInfo      spdxCreationInfo   `json:"creationInfo"`
+	DocumentComment   string             `json:"documentComment"`
+	Packages          []spdxPackage      `json:"packages"`
+	Relationships     []spdxRelationship `json:"relationships"`
+}
+
+type spdxCreationInfo struct {
+	Created  string   `json:"created"`
+	Creators []string `json:"creators"`
+}
+
+type spdxPackage struct {
+	Name             string         `json:"name"`
+	SPDXID           string         `json:"SPDXID"`
+	VersionInfo      string         `json:"versionInfo"`
+	DownloadLocation string         `json:"downloadLocation"`
+	FilesAnalyzed    bool           `json:"filesAnalyzed"`
+	PackagePurpose   string         `json:"primaryPackagePurpose"`
+	Checksums        []spdxChecksum `json:"checksums,omitempty"`
+	LicenseConcluded string         `json:"licenseConcluded"`
+	LicenseDeclared  string         `json:"licenseDeclared"`
+	CopyrightText    string         `json:"copyrightText"`
+	Comment          string         `json:"comment,omitempty"`
+	ExternalRefs     []spdxRef      `json:"externalRefs,omitempty"`
+}
+
+type spdxChecksum struct {
+	Algorithm     string `json:"algorithm"`
+	ChecksumValue string `json:"checksumValue"`
+}
+
+type spdxRef struct {
+	Category string `json:"referenceCategory"`
+	Type     string `json:"referenceType"`
+	Locator  string `json:"referenceLocator"`
+	Comment  string `json:"comment,omitempty"`
+}
+
+type spdxRelationship struct {
+	Element string `json:"spdxElementId"`
+	Type    string `json:"relationshipType"`
+	Related string `json:"relatedSpdxElement"`
+}
+
+func main() {
+	var artifacts artifactFlags
+	sourceRevision := flag.String("source-revision", "", "full clean source commit")
+	sourceDate := flag.String("source-date", "", "UTC RFC3339 source date")
+	goSumPath := flag.String("go-sum", "go.sum", "Go checksum file")
+	output := flag.String("output", "", "SPDX JSON output")
+	flag.Var(&artifacts, "artifact", "linux architecture and binary path, for example amd64=dist/verse-gateway-linux-amd64")
+	flag.Parse()
+
+	if *output == "" {
+		fatal(errors.New("output is required"))
+	}
+	created, err := time.Parse(time.RFC3339, *sourceDate)
+	if err != nil {
+		fatal(errors.New("source-date must be RFC3339"))
+	}
+	created = created.UTC()
+	if err := verifyCleanRevision(*sourceRevision); err != nil {
+		fatal(err)
+	}
+	inspected, modules, err := inspectArtifacts(artifacts)
+	if err != nil {
+		fatal(err)
+	}
+	protocolVersion := ""
+	for _, module := range modules {
+		if module.Path == protocolModulePath {
+			protocolVersion = module.Version
+		}
+	}
+	goModSum, err := readGoModSum(*goSumPath, protocolModulePath, protocolVersion)
+	if err != nil {
+		fatal(err)
+	}
+	encoded, err := buildSPDX(sbomInput{
+		SourceRevision: *sourceRevision, Created: created, ProtocolGoModSum: goModSum,
+		Modules: modules, Artifacts: inspected,
+	})
+	if err != nil {
+		fatal(err)
+	}
+	if err := os.WriteFile(*output, encoded, 0o644); err != nil {
+		fatal(err)
+	}
+}
+
+func fatal(err error) {
+	_, _ = fmt.Fprintln(os.Stderr, err)
+	os.Exit(1)
+}
+
+func verifyCleanRevision(revision string) error {
+	if !regexp.MustCompile(`^[0-9a-f]{40}$`).MatchString(revision) {
+		return errors.New("source-revision must be a full lowercase commit")
+	}
+	head, err := exec.Command("git", "rev-parse", "HEAD").Output()
+	if err != nil || strings.TrimSpace(string(head)) != revision {
+		return errors.New("source-revision does not match HEAD")
+	}
+	status, err := exec.Command("git", "status", "--porcelain", "--untracked-files=no").Output()
+	if err != nil {
+		return fmt.Errorf("inspect source dirt: %w", err)
+	}
+	if len(status) != 0 {
+		return errors.New("tracked source tree is dirty")
+	}
+	return nil
+}
+
+func inspectArtifacts(specifications []string) ([]gatewayArtifact, []goModule, error) {
+	if len(specifications) != 2 {
+		return nil, nil, errors.New("exactly amd64 and arm64 artifacts are required")
+	}
+	var artifacts []gatewayArtifact
+	var common []goModule
+	seen := make(map[string]bool)
+	for _, specification := range specifications {
+		architecture, path, ok := strings.Cut(specification, "=")
+		if !ok || (architecture != "amd64" && architecture != "arm64") || seen[architecture] {
+			return nil, nil, errors.New("artifact must uniquely name amd64 or arm64")
+		}
+		seen[architecture] = true
+		artifact, modules, err := inspectArtifact(architecture, path)
+		if err != nil {
+			return nil, nil, err
+		}
+		if common == nil {
+			common = modules
+		} else if !reflect.DeepEqual(common, modules) {
+			return nil, nil, errors.New("artifact module inventories differ")
+		}
+		artifacts = append(artifacts, artifact)
+	}
+	sort.Slice(artifacts, func(first, second int) bool {
+		return artifacts[first].Architecture < artifacts[second].Architecture
+	})
+	return artifacts, common, nil
+}
+
+func inspectArtifact(architecture, path string) (gatewayArtifact, []goModule, error) {
+	info, err := buildinfo.ReadFile(path)
+	if err != nil {
+		return gatewayArtifact{}, nil, fmt.Errorf("read %s build metadata: %w", architecture, err)
+	}
+	settings := make(map[string]string, len(info.Settings))
+	for _, setting := range info.Settings {
+		settings[setting.Key] = setting.Value
+	}
+	if info.Path != dataPlaneModulePath+"/cmd/verse-gateway" || settings["GOOS"] != "linux" ||
+		settings["GOARCH"] != architecture || settings["CGO_ENABLED"] != "0" {
+		return gatewayArtifact{}, nil, fmt.Errorf("%s artifact build identity is invalid", architecture)
+	}
+	modules := []goModule{{Path: info.Main.Path, Version: info.Main.Version, Sum: info.Main.Sum}}
+	for _, dependency := range info.Deps {
+		if dependency.Replace != nil {
+			return gatewayArtifact{}, nil, fmt.Errorf("%s contains replaced module %s", architecture, dependency.Path)
+		}
+		modules = append(modules, goModule{Path: dependency.Path, Version: dependency.Version, Sum: dependency.Sum})
+	}
+	sort.Slice(modules, func(first, second int) bool {
+		if modules[first].Path == modules[second].Path {
+			return modules[first].Version < modules[second].Version
+		}
+		return modules[first].Path < modules[second].Path
+	})
+	file, err := os.Open(path)
+	if err != nil {
+		return gatewayArtifact{}, nil, err
+	}
+	defer file.Close()
+	digest := sha256.New()
+	size, err := io.Copy(digest, file)
+	if err != nil {
+		return gatewayArtifact{}, nil, err
+	}
+	return gatewayArtifact{
+		Architecture: architecture, Filename: filepath.Base(path),
+		SHA256: hex.EncodeToString(digest.Sum(nil)), Size: size,
+	}, modules, nil
+}
+
+func readGoModSum(path, modulePath, version string) (string, error) {
+	file, err := os.Open(path)
+	if err != nil {
+		return "", err
+	}
+	defer file.Close()
+	prefix := modulePath + " " + version + "/go.mod "
+	scanner := bufio.NewScanner(file)
+	for scanner.Scan() {
+		if strings.HasPrefix(scanner.Text(), prefix) {
+			return strings.TrimPrefix(scanner.Text(), prefix), nil
+		}
+	}
+	if err := scanner.Err(); err != nil {
+		return "", err
+	}
+	return "", errors.New("protocol go.mod checksum is absent")
+}
+
+func buildSPDX(input sbomInput) ([]byte, error) {
+	if !regexp.MustCompile(`^[0-9a-f]{40}$`).MatchString(input.SourceRevision) || input.Created.Location() != time.UTC ||
+		input.ProtocolGoModSum == "" || len(input.Artifacts) != 2 {
+		return nil, errors.New("incomplete SPDX inputs")
+	}
+	modules := append([]goModule(nil), input.Modules...)
+	sort.Slice(modules, func(first, second int) bool {
+		if modules[first].Path == modules[second].Path {
+			return modules[first].Version < modules[second].Version
+		}
+		return modules[first].Path < modules[second].Path
+	})
+	artifacts := append([]gatewayArtifact(nil), input.Artifacts...)
+	sort.Slice(artifacts, func(first, second int) bool {
+		return artifacts[first].Architecture < artifacts[second].Architecture
+	})
+	if artifacts[0].Architecture != "amd64" || artifacts[1].Architecture != "arm64" {
+		return nil, errors.New("SPDX requires amd64 and arm64 artifacts")
+	}
+
+	sourceID := "SPDXRef-Source"
+	packages := []spdxPackage{{
+		Name: dataPlaneModulePath, SPDXID: sourceID, VersionInfo: input.SourceRevision,
+		DownloadLocation: "NOASSERTION", FilesAnalyzed: false, PackagePurpose: "SOURCE",
+		LicenseConcluded: "NOASSERTION", LicenseDeclared: "GPL-3.0-only", CopyrightText: "NOASSERTION",
+		Comment: "license_provenance=LICENSE",
+	}}
+	moduleIDs := make(map[string]string)
+	protocolFound := false
+	for _, module := range modules {
+		if module.Path == dataPlaneModulePath {
+			continue
+		}
+		if module.Path == "" || module.Version == "" || moduleIDs[module.Path] != "" {
+			return nil, errors.New("ambiguous module inventory")
+		}
+		id := "SPDXRef-Module-" + shortDigest(module.Path+"@"+module.Version)
+		moduleIDs[module.Path] = id
+		comment := "go_module_sum=" + module.Sum
+		if module.Path == protocolModulePath {
+			if module.Sum == "" {
+				return nil, errors.New("immutable Protocol checksum is absent")
+			}
+			protocolFound = true
+			comment += "; go_mod_sum=" + input.ProtocolGoModSum
+		}
+		packages = append(packages, spdxPackage{
+			Name: module.Path, SPDXID: id, VersionInfo: module.Version,
+			DownloadLocation: "NOASSERTION", FilesAnalyzed: false, PackagePurpose: "LIBRARY",
+			LicenseConcluded: "NOASSERTION", LicenseDeclared: "NOASSERTION", CopyrightText: "NOASSERTION",
+			Comment: comment,
+			ExternalRefs: []spdxRef{{
+				Category: "PACKAGE-MANAGER", Type: "purl",
+				Locator: "pkg:golang/" + module.Path + "@" + module.Version,
+			}},
+		})
+	}
+	if !protocolFound {
+		return nil, errors.New("Protocol module is absent")
+	}
+
+	var relationships []spdxRelationship
+	for _, artifact := range artifacts {
+		if artifact.Filename == "" || len(artifact.SHA256) != 64 || artifact.Size < 1 {
+			return nil, errors.New("artifact metadata is invalid")
+		}
+		id := "SPDXRef-Artifact-" + artifact.Architecture
+		packages = append(packages, spdxPackage{
+			Name: artifact.Filename, SPDXID: id, VersionInfo: input.SourceRevision,
+			DownloadLocation: "NOASSERTION", FilesAnalyzed: false, PackagePurpose: "APPLICATION",
+			Checksums:        []spdxChecksum{{Algorithm: "SHA256", ChecksumValue: artifact.SHA256}},
+			LicenseConcluded: "NOASSERTION", LicenseDeclared: "GPL-3.0-only", CopyrightText: "NOASSERTION",
+			Comment: fmt.Sprintf("GOOS=linux; GOARCH=%s; CGO_ENABLED=0; size=%d", artifact.Architecture, artifact.Size),
+		})
+		relationships = append(relationships,
+			spdxRelationship{Element: "SPDXRef-DOCUMENT", Type: "DESCRIBES", Related: id},
+			spdxRelationship{Element: id, Type: "GENERATED_FROM", Related: sourceID},
+		)
+		for _, moduleID := range moduleIDs {
+			relationships = append(relationships, spdxRelationship{Element: id, Type: "DEPENDS_ON", Related: moduleID})
+		}
+	}
+	sort.Slice(packages, func(first, second int) bool { return packages[first].SPDXID < packages[second].SPDXID })
+	sort.Slice(relationships, func(first, second int) bool {
+		left := relationships[first].Element + relationships[first].Type + relationships[first].Related
+		right := relationships[second].Element + relationships[second].Type + relationships[second].Related
+		return left < right
+	})
+	document := spdxDocument{
+		SPDXVersion: "SPDX-2.3", DataLicense: "CC0-1.0", SPDXID: "SPDXRef-DOCUMENT",
+		Name:              "verse-gateway-" + input.SourceRevision,
+		DocumentNamespace: "https://git.sechmachine.io.vn/sechmachine/VerseVDI-Data-Plane/spdx/" + input.SourceRevision,
+		CreationInfo: spdxCreationInfo{
+			Created:  input.Created.Format(time.RFC3339),
+			Creators: []string{"Tool: verse-gateway-sbom"},
+		},
+		DocumentComment: "notices=LICENSE; provenance=Go build metadata and artifact SHA-256; vulnerability_status=unscanned; signing_status=unsigned; phase3c_c_image_remediation=separate",
+		Packages:        packages, Relationships: relationships,
+	}
+	encoded, err := json.MarshalIndent(document, "", "  ")
+	if err != nil {
+		return nil, err
+	}
+	return append(encoded, '\n'), nil
+}
+
+func shortDigest(value string) string {
+	digest := sha256.Sum256([]byte(value))
+	return hex.EncodeToString(digest[:8])
+}

cmd/verse-gateway-sbom/main_test.go

@@ -0,0 +1,82 @@
+package main
+
+import (
+	"bytes"
+	"strings"
+	"testing"
+	"time"
+)
+
+func TestBuildSPDXIsDeterministicAndTruthful(t *testing.T) {
+	input := sbomInput{
+		SourceRevision:   strings.Repeat("a", 40),
+		Created:          time.Date(2026, time.July, 30, 1, 2, 3, 0, time.UTC),
+		ProtocolGoModSum: "h1:protocol-go-mod",
+		Modules: []goModule{
+			{Path: "git.sechmachine.io.vn/sechmachine/VerseVDI-Data-Plane", Version: "(devel)"},
+			{Path: protocolModulePath, Version: "v1.0.0-phase3c-gateway-rc.9", Sum: "h1:protocol"},
+			{Path: "github.com/quic-go/quic-go", Version: "v0.61.0", Sum: "h1:quic"},
+		},
+		Artifacts: []gatewayArtifact{
+			{Architecture: "amd64", Filename: "verse-gateway-linux-amd64", SHA256: strings.Repeat("1", 64), Size: 100},
+			{Architecture: "arm64", Filename: "verse-gateway-linux-arm64", SHA256: strings.Repeat("2", 64), Size: 101},
+		},
+	}
+	first, err := buildSPDX(input)
+	if err != nil {
+		t.Fatal(err)
+	}
+	second, err := buildSPDX(input)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !bytes.Equal(first, second) {
+		t.Fatal("SPDX generation was not byte-stable")
+	}
+	text := string(first)
+	for _, required := range []string{
+		`"spdxVersion": "SPDX-2.3"`,
+		input.SourceRevision,
+		"v1.0.0-phase3c-gateway-rc.9",
+		input.ProtocolGoModSum,
+		"verse-gateway-linux-amd64",
+		"verse-gateway-linux-arm64",
+		strings.Repeat("1", 64),
+		strings.Repeat("2", 64),
+		`"licenseConcluded": "NOASSERTION"`,
+		"vulnerability_status=unscanned",
+		"signing_status=unsigned",
+	} {
+		if !strings.Contains(text, required) {
+			t.Fatalf("SPDX is missing %q", required)
+		}
+	}
+}
+
+func TestBuildSPDXRejectsAmbiguousInputs(t *testing.T) {
+	valid := sbomInput{
+		SourceRevision: strings.Repeat("a", 40), Created: time.Unix(0, 0).UTC(),
+		ProtocolGoModSum: "h1:protocol-go-mod",
+		Modules: []goModule{
+			{Path: protocolModulePath, Version: "v1.0.0-rc.9", Sum: "h1:protocol"},
+		},
+		Artifacts: []gatewayArtifact{
+			{Architecture: "amd64", Filename: "amd64", SHA256: strings.Repeat("1", 64), Size: 1},
+			{Architecture: "arm64", Filename: "arm64", SHA256: strings.Repeat("2", 64), Size: 1},
+		},
+	}
+	mutations := []func(*sbomInput){
+		func(input *sbomInput) { input.SourceRevision = "short" },
+		func(input *sbomInput) { input.Modules = nil },
+		func(input *sbomInput) { input.Artifacts[1].Architecture = "amd64" },
+	}
+	for index, mutate := range mutations {
+		input := valid
+		input.Modules = append([]goModule(nil), valid.Modules...)
+		input.Artifacts = append([]gatewayArtifact(nil), valid.Artifacts...)
+		mutate(&input)
+		if _, err := buildSPDX(input); err == nil {
+			t.Fatalf("invalid SPDX input %d was accepted", index)
+		}
+	}
+}

gateway/apollo_native.go

@@ -27,14 +27,26 @@ import (
 	protocol "git.sechmachine.io.vn/sechmachine/VerseVDI-Protocol/gen/go/protocol"
 )
 
+const (
+	nativeApolloVideoQueuePackets = 16
+	nativeApolloVideoQueueBytes   = 4 << 20
+	nativeApolloVideoQueueLatency = 250 * time.Millisecond
+	nativeApolloAudioQueuePackets = 16
+	nativeApolloEventQueuePackets = 16
+	nativeApolloVideoIngressSlots = 2048
+	nativeApolloVideoPacketBytes  = apolloVideoHeaderSize + apolloVideoRawPacketSize
+	nativeApolloVideoReadBuffer   = nativeApolloVideoIngressSlots * nativeApolloVideoPacketBytes
+)
+
 // NativeApolloBackend keeps provider sockets inside the gateway process. The
 // session-scoped Server work is the sole source of provider endpoint and mTLS
 // material; it is never serialized into a client manifest or authority.
 type NativeApolloBackend struct {
 	Dialer *net.Dialer
 
-	mu      sync.Mutex
-	pending map[string]*apolloRTSPSetup
+	mu             sync.Mutex
+	pending        map[string]*apolloRTSPSetup
+	configureMedia func(*apolloMediaCodec)
 }
 
 func NewNativeApolloBackend() *NativeApolloBackend {
@@ -260,7 +272,7 @@ func (b *NativeApolloBackend) Open(ctx context.Context, request LaunchRequest, _
 	if !ok || setup == nil {
 		return nil, ErrProviderDisconnected
 	}
-	return newNativeApolloProviderSession(ctx, setup)
+	return newNativeApolloProviderSession(ctx, setup, b.configureMedia)
 }
 
 func readBounded(reader io.Reader, max int) ([]byte, error) {
@@ -310,13 +322,25 @@ type nativeApolloSession struct {
 	mediaRecovered              atomic.Uint64
 	mediaEnqueued               atomic.Uint64
 	mediaQueueMaximum           atomic.Uint64
+	mediaQueueBytes             atomic.Int64
+	mediaQueueMaximumBytes      atomic.Uint64
+	mediaQueueSequence          atomic.Uint64
 }
 
 func newNativeApolloSession(sessionID string) *nativeApolloSession {
-	return &nativeApolloSession{sessionID: sessionID, video: make(chan ProviderMedia, 16), audio: make(chan ProviderMedia, 16), events: make(chan ProviderEvent, 16), state: protocol.ProviderState{Version: "1", SessionID: sessionID, State: ProviderStateStarting, Channels: []string{"video", "audio", "input", "feedback"}}, pressed: make(map[string]InputEvent), done: make(chan struct{}), readDone: make(chan struct{})}
+	return &nativeApolloSession{
+		sessionID: sessionID,
+		video:     make(chan ProviderMedia, nativeApolloVideoQueuePackets),
+		audio:     make(chan ProviderMedia, nativeApolloAudioQueuePackets),
+		events:    make(chan ProviderEvent, nativeApolloEventQueuePackets),
+		state:     protocol.ProviderState{Version: "1", SessionID: sessionID, State: ProviderStateStarting, Channels: []string{"video", "audio", "input", "feedback"}},
+		pressed:   make(map[string]InputEvent),
+		done:      make(chan struct{}),
+		readDone:  make(chan struct{}),
+	}
 }
 
-func newNativeApolloProviderSession(ctx context.Context, setup *apolloRTSPSetup) (*nativeApolloSession, error) {
+func newNativeApolloProviderSession(ctx context.Context, setup *apolloRTSPSetup, configureMedia func(*apolloMediaCodec)) (*nativeApolloSession, error) {
 	if setup == nil || len(setup.streamKey) != 16 || setup.controlPort == 0 || setup.audioPort == 0 || setup.videoPort == 0 {
 		return nil, ErrProviderMalformed
 	}
@@ -340,6 +364,9 @@ func newNativeApolloProviderSession(ctx context.Context, setup *apolloRTSPSetup)
 		peer.close(err)
 		return nil, err
 	}
+	if configureMedia != nil {
+		configureMedia(media)
+	}
 	session := newNativeApolloSession(setup.sessionID)
 	managementClient, err := newPinnedApolloHTTPClient(setup.providerWork)
 	if err != nil {
@@ -371,6 +398,12 @@ func newNativeApolloProviderSession(ctx context.Context, setup *apolloRTSPSetup)
 		peer.close(err)
 		return nil, err
 	}
+	if err := videoConn.SetReadBuffer(nativeApolloVideoReadBuffer); err != nil {
+		_ = audioConn.Close()
+		_ = videoConn.Close()
+		peer.close(err)
+		return nil, fmt.Errorf("set Apollo video receive buffer: %w", err)
+	}
 	if _, err := audioConn.Write(apolloMediaPing(setup.audioPing, 1)); err != nil {
 		_ = audioConn.Close()
 		_ = videoConn.Close()
@@ -747,10 +780,22 @@ func (s *nativeApolloSession) quiesceMedia() {
 
 func (s *nativeApolloSession) closeMediaChannels() {
 	s.channelsOnce.Do(func() {
+		s.mediaQuiesced.Store(true)
 		s.mediaMu.Lock()
 		defer s.mediaMu.Unlock()
-		close(s.video)
-		close(s.audio)
+		for {
+			select {
+			case media := <-s.video:
+				if media.expiry != nil {
+					media.expiry.Stop()
+				}
+				media.releaseQueue()
+			default:
+				close(s.video)
+				close(s.audio)
+				return
+			}
+		}
 	})
 }
 
@@ -760,9 +805,66 @@ func (s *nativeApolloSession) enqueueMedia(output chan ProviderMedia, payload []
 	if len(payload) == 0 || s.mediaQuiesced.Load() {
 		return false
 	}
+	if output == s.video && len(payload) > maxCompleteFrameBytes {
+		s.mediaDrops.Add(1)
+		return false
+	}
 	s.mediaRecovered.Add(1)
 	media := ProviderMedia{Payload: payload, ReceivedAt: receivedAt, EnqueuedAt: time.Now()}
-	if pushLatest(output, media) {
+	if output == s.video {
+		dropped := uint64(0)
+		for s.mediaQueueBytes.Load()+int64(len(payload)) > nativeApolloVideoQueueBytes {
+			select {
+			case replaced := <-output:
+				if replaced.expiry != nil {
+					replaced.expiry.Stop()
+				}
+				replaced.releaseQueue()
+				dropped++
+			default:
+				s.mediaDrops.Add(dropped + 1)
+				return false
+			}
+		}
+		media.queueID = s.mediaQueueSequence.Add(1)
+		media.accounting = &providerMediaQueueAccounting{
+			bytes: int64(len(payload)), total: &s.mediaQueueBytes,
+		}
+		currentBytes := uint64(s.mediaQueueBytes.Add(int64(len(payload))))
+		media.expiry = time.AfterFunc(nativeApolloVideoQueueLatency, func() {
+			s.expireVideo(media.queueID)
+			media.releaseQueue()
+		})
+		for maximum := s.mediaQueueMaximumBytes.Load(); currentBytes > maximum && !s.mediaQueueMaximumBytes.CompareAndSwap(maximum, currentBytes); maximum = s.mediaQueueMaximumBytes.Load() {
+		}
+		if dropped > 0 {
+			s.mediaDrops.Add(dropped)
+		}
+	}
+	dropped := false
+	select {
+	case output <- media:
+	default:
+		select {
+		case replaced := <-output:
+			if replaced.expiry != nil {
+				replaced.expiry.Stop()
+			}
+			replaced.releaseQueue()
+		default:
+		}
+		select {
+		case output <- media:
+			dropped = true
+		default:
+			if media.expiry != nil {
+				media.expiry.Stop()
+			}
+			media.releaseQueue()
+			dropped = true
+		}
+	}
+	if dropped {
 		s.mediaDrops.Add(1)
 	}
 	s.mediaEnqueued.Add(1)
@@ -772,25 +874,55 @@ func (s *nativeApolloSession) enqueueMedia(output chan ProviderMedia, payload []
 	return true
 }
 
+func (s *nativeApolloSession) expireVideo(queueID uint64) {
+	s.mediaMu.Lock()
+	defer s.mediaMu.Unlock()
+	if s.mediaQuiesced.Load() {
+		return
+	}
+	retained := make([]ProviderMedia, 0, cap(s.video))
+	removed := false
+	for {
+		select {
+		case media := <-s.video:
+			if media.queueID == queueID {
+				removed = true
+				media.releaseQueue()
+				continue
+			}
+			retained = append(retained, media)
+		default:
+			for _, media := range retained {
+				s.video <- media
+			}
+			if removed {
+				s.mediaDrops.Add(1)
+			}
+			return
+		}
+	}
+}
+
 func (s *nativeApolloSession) readUDPMedia() {
 	if s.media == nil {
 		close(s.readDone)
 		s.closeMediaChannels()
 		return
 	}
-	var readers sync.WaitGroup
-	readers.Add(2)
-	read := func(conn *net.UDPConn, output chan ProviderMedia, video bool) {
-		defer readers.Done()
+	videoIngress := newNativeApolloVideoIngress()
+	var workers sync.WaitGroup
+	workers.Add(3)
+	go func() {
+		defer workers.Done()
 		buffer := make([]byte, apolloMediaMaximumPacket+1)
 		for {
 			if s.mediaQuiesced.Load() {
 				return
 			}
-			if err := conn.SetReadDeadline(time.Now().Add(250 * time.Millisecond)); err != nil {
+			if err := s.audioConn.SetReadDeadline(time.Now().Add(250 * time.Millisecond)); err != nil {
 				return
 			}
-			count, err := conn.Read(buffer)
+			count, err := s.audioConn.Read(buffer)
 			receivedAt := time.Now()
 			if err != nil {
 				if networkErr, ok := err.(net.Error); ok && networkErr.Timeout() {
@@ -810,45 +942,121 @@ func (s *nativeApolloSession) readUDPMedia() {
 				return
 			}
 			s.mediaIngress.Add(1)
-			var payloads [][]byte
-			if video {
-				shard, openErr := s.media.OpenVideo(buffer[:count])
-				if openErr != nil {
-					continue
-				}
-				payload, err := s.videoFEC.Add(shard)
-				if err != nil || len(payload) == 0 {
-					continue
-				}
-				payloads = [][]byte{payload}
-			} else {
-				shard, openErr := s.media.OpenAudio(buffer[:count])
-				if openErr != nil {
-					continue
-				}
-				var evicted bool
-				payloads, evicted, err = s.audioFEC.Add(s.media, shard)
-				if evicted {
-					s.mediaDrops.Add(1)
-				}
+			shard, openErr := s.media.OpenAudio(buffer[:count])
+			if openErr != nil {
+				continue
+			}
+			payloads, evicted, err := s.audioFEC.Add(s.media, shard)
+			if evicted {
+				s.mediaDrops.Add(1)
 			}
 			if err != nil {
 				continue
 			}
 			for _, payload := range payloads {
-				s.enqueueMedia(output, payload, receivedAt)
+				s.enqueueMedia(s.audio, payload, receivedAt)
 			}
 		}
-	}
-	go read(s.audioConn, s.audio, false)
-	go read(s.videoConn, s.video, true)
+	}()
 	go func() {
-		readers.Wait()
+		defer workers.Done()
+		s.drainApolloVideo(videoIngress)
+	}()
+	go func() {
+		defer workers.Done()
+		s.processApolloVideo(videoIngress)
+	}()
+	go func() {
+		workers.Wait()
 		close(s.readDone)
 		s.closeMediaChannels()
 	}()
 }
 
+type nativeApolloVideoIngressSlot struct {
+	packet     [apolloMediaMaximumPacket + 1]byte
+	count      int
+	receivedAt time.Time
+}
+
+type nativeApolloVideoIngress struct {
+	slots   [nativeApolloVideoIngressSlots]nativeApolloVideoIngressSlot
+	free    chan uint16
+	ready   chan uint16
+	scratch [apolloMediaMaximumPacket + 1]byte
+}
+
+func newNativeApolloVideoIngress() *nativeApolloVideoIngress {
+	ingress := &nativeApolloVideoIngress{
+		free:  make(chan uint16, nativeApolloVideoIngressSlots),
+		ready: make(chan uint16, nativeApolloVideoIngressSlots),
+	}
+	for index := range nativeApolloVideoIngressSlots {
+		ingress.free <- uint16(index)
+	}
+	return ingress
+}
+
+func (s *nativeApolloSession) drainApolloVideo(ingress *nativeApolloVideoIngress) {
+	defer close(ingress.ready)
+	for {
+		if s.mediaQuiesced.Load() {
+			return
+		}
+		select {
+		case index := <-ingress.free:
+			slot := &ingress.slots[index]
+			count, err := s.videoConn.Read(slot.packet[:])
+			receivedAt := time.Now()
+			if err != nil {
+				ingress.free <- index
+				return
+			}
+			if count > apolloMediaMaximumPacket {
+				ingress.free <- index
+				continue
+			}
+			if s.mediaQuiesced.Load() {
+				ingress.free <- index
+				return
+			}
+			s.mediaIngress.Add(1)
+			slot.count, slot.receivedAt = count, receivedAt
+			ingress.ready <- index
+		default:
+			count, err := s.videoConn.Read(ingress.scratch[:])
+			if err != nil {
+				return
+			}
+			if count > apolloMediaMaximumPacket {
+				continue
+			}
+			if s.mediaQuiesced.Load() {
+				return
+			}
+			s.mediaIngress.Add(1)
+			s.mediaDrops.Add(1)
+		}
+	}
+}
+
+func (s *nativeApolloSession) processApolloVideo(ingress *nativeApolloVideoIngress) {
+	for index := range ingress.ready {
+		slot := &ingress.slots[index]
+		if !s.mediaQuiesced.Load() {
+			shard, err := s.media.OpenVideo(slot.packet[:slot.count])
+			if err == nil {
+				payload, fecErr := s.videoFEC.Add(shard)
+				if fecErr == nil && len(payload) > 0 {
+					s.enqueueMedia(s.video, payload, slot.receivedAt)
+				}
+			}
+		}
+		slot.count, slot.receivedAt = 0, time.Time{}
+		ingress.free <- index
+	}
+}
+
 func pushLatest[T any](channel chan T, payload T) bool {
 	select {
 	case channel <- payload:

gateway/apollo_native_test.go

@@ -1,6 +1,7 @@
 package gateway
 
 import (
+	"bytes"
 	"context"
 	"crypto/aes"
 	"crypto/cipher"
@@ -16,8 +17,10 @@ import (
 	"net"
 	"net/http"
 	"net/http/httptest"
+	"runtime"
 	"strconv"
 	"strings"
+	"sync"
 	"testing"
 	"time"
 
@@ -531,19 +534,6 @@ func TestNativeApolloSetupRequiresModernEncryptedRTSPOrder(t *testing.T) {
 		t.Fatal(err)
 	}
 	awaitControl(apolloControlTypeFEC, false)
-	remote := <-controlRemote
-	hostTermination := sourceSealHostControl(t, material.key, 0, apolloControlTypeTerm, []byte{1, 2, 3, 4})
-	if _, err := controlServer.WriteToUDP(sourceShapedENetReliablePacketOn(7, 2, apolloChannelGeneric, 1, hostTermination), remote); err != nil {
-		t.Fatal(err)
-	}
-	select {
-	case event := <-session.Events():
-		if event.Kind != ProviderEventTerminated || string(event.Payload) != string([]byte{1, 2, 3, 4}) {
-			t.Fatalf("provider termination event = %#v", event)
-		}
-	case <-time.After(time.Second):
-		t.Fatal("encrypted host termination was not forwarded")
-	}
 	select {
 	case media := <-session.Video():
 		payload := media.Payload
@@ -562,6 +552,19 @@ func TestNativeApolloSetupRequiresModernEncryptedRTSPOrder(t *testing.T) {
 	case <-time.After(time.Second):
 		t.Fatal("source-shaped audio was not relayed")
 	}
+	remote := <-controlRemote
+	hostTermination := sourceSealHostControl(t, material.key, 0, apolloControlTypeTerm, []byte{1, 2, 3, 4})
+	if _, err := controlServer.WriteToUDP(sourceShapedENetReliablePacketOn(7, 2, apolloChannelGeneric, 1, hostTermination), remote); err != nil {
+		t.Fatal(err)
+	}
+	select {
+	case event := <-session.Events():
+		if event.Kind != ProviderEventTerminated || string(event.Payload) != string([]byte{1, 2, 3, 4}) {
+			t.Fatalf("provider termination event = %#v", event)
+		}
+	case <-time.After(time.Second):
+		t.Fatal("encrypted host termination was not forwarded")
+	}
 	terminateCtx, cancel := context.WithTimeout(context.Background(), time.Second)
 	defer cancel()
 	if err := session.Terminate(terminateCtx); err != nil {
@@ -759,6 +762,34 @@ func TestNativeApolloSessionRelaysOnlyAuthenticatedEncodedUDPMedia(t *testing.T)
 	if drops := session.Telemetry().MediaDrops; drops < 2 {
 		t.Fatalf("stale FEC eviction drops = %d, want at least 2", drops)
 	}
+	beforeIngress := session.mediaIngress.Load()
+	beforeDrops := session.mediaDrops.Load()
+	if _, err := videoServer.WriteToUDP(make([]byte, apolloMediaMaximumPacket+2), videoClient.LocalAddr().(*net.UDPAddr)); err != nil {
+		t.Fatal(err)
+	}
+	marker := []byte{0xde, 0xad, 0xbe, 0xef}
+	markerPayload := make([]byte, apolloVideoShardPayloadSize)
+	markerPayload[0], markerPayload[3] = 0x01, 0x01
+	binary.LittleEndian.PutUint16(markerPayload[4:6], uint16(8+len(marker)))
+	copy(markerPayload[8:], marker)
+	markerPacket := sourceEncryptVideoRaw(t, key, sourceShapedVideoRaw(44, 103, 103, 0x07, 1, 0, 0, markerPayload), "0123456789dV")
+	if _, err := videoServer.WriteToUDP(markerPacket, videoClient.LocalAddr().(*net.UDPAddr)); err != nil {
+		t.Fatal(err)
+	}
+	select {
+	case media := <-session.Video():
+		if !bytes.Equal(media.Payload, marker) {
+			t.Fatalf("post-oversize marker relay = %x, want %x", media.Payload, marker)
+		}
+	case <-time.After(time.Second):
+		t.Fatal("post-oversize marker was not relayed")
+	}
+	if got := session.mediaIngress.Load() - beforeIngress; got != 1 {
+		t.Fatalf("post-oversize video ingress = %d, want 1 valid marker", got)
+	}
+	if got := session.mediaDrops.Load(); got != beforeDrops {
+		t.Fatalf("post-oversize video drops = %d, want unchanged %d", got, beforeDrops)
+	}
 	terminateCtx, cancel := context.WithTimeout(context.Background(), time.Second)
 	defer cancel()
 	if err := session.Terminate(terminateCtx); err != nil {
@@ -766,6 +797,166 @@ func TestNativeApolloSessionRelaysOnlyAuthenticatedEncodedUDPMedia(t *testing.T)
 	}
 }
 
+func TestNativeApolloVideoIngressSaturationIsBoundedAndAccounted(t *testing.T) {
+	if nativeApolloVideoIngressSlots != 2048 || nativeApolloVideoReadBuffer != 2_195_456 {
+		t.Fatalf("video ingress bounds = %d slots/%d bytes, want 2048/2195456", nativeApolloVideoIngressSlots, nativeApolloVideoReadBuffer)
+	}
+	ingress := newNativeApolloVideoIngress()
+	if len(ingress.slots) != 2048 || len(ingress.free) != 2048 || cap(ingress.ready) != 2048 || len(ingress.slots[0].packet) != apolloMediaMaximumPacket+1 {
+		t.Fatalf("video ingress pool = slots:%d free:%d ready-cap:%d packet:%d",
+			len(ingress.slots), len(ingress.free), cap(ingress.ready), len(ingress.slots[0].packet))
+	}
+
+	key := []byte("0123456789abcdef")
+	session, audioServer, videoServer := newNativeApolloMediaTestSession(t, key)
+	defer audioServer.Close()
+	defer videoServer.Close()
+	blockCtx, cancelBlock := context.WithCancel(context.Background())
+	defer cancelBlock()
+	blocked := make(chan struct{})
+	release := make(chan struct{})
+	var releaseOnce sync.Once
+	releaseAEAD := func() { releaseOnce.Do(func() { close(release) }) }
+	defer releaseAEAD()
+	session.media.aead = &qualificationBlockingAEAD{
+		AEAD: session.media.aead, ctx: blockCtx, blocked: blocked, release: release,
+	}
+	go session.readUDPMedia()
+
+	packet := sourceShapedEncryptedVideoPacket(t, key, []byte{1})
+	if _, err := videoServer.WriteToUDP(packet, session.videoConn.LocalAddr().(*net.UDPAddr)); err != nil {
+		t.Fatal(err)
+	}
+	select {
+	case <-blocked:
+	case <-time.After(time.Second):
+		t.Fatal("video processor did not block")
+	}
+	waitIngress := func(want uint64) {
+		t.Helper()
+		deadline := time.NewTimer(time.Second)
+		defer deadline.Stop()
+		for session.mediaIngress.Load() < want {
+			select {
+			case <-deadline.C:
+				t.Fatalf("video ingress = %d, want at least %d", session.mediaIngress.Load(), want)
+			default:
+				runtime.Gosched()
+			}
+		}
+	}
+	waitIngress(1)
+	const overflow = 33
+	sent := uint64(1)
+	for remaining := nativeApolloVideoIngressSlots - 1 + overflow; remaining > 0; {
+		batch := min(32, remaining)
+		for range batch {
+			if _, err := videoServer.WriteToUDP([]byte{1}, session.videoConn.LocalAddr().(*net.UDPAddr)); err != nil {
+				t.Fatal(err)
+			}
+		}
+		sent += uint64(batch)
+		waitIngress(sent)
+		remaining -= batch
+	}
+	if got := session.mediaDrops.Load(); got != overflow {
+		t.Fatalf("saturated video ingress drops = %d, want %d", got, overflow)
+	}
+
+	session.quiesceMedia()
+	cancelBlock()
+	select {
+	case <-session.readDone:
+	case <-time.After(time.Second):
+		t.Fatal("video ingress workers did not stop")
+	}
+}
+
+func TestNativeApolloTerminateStopsActiveVideoDrainAndProcessor(t *testing.T) {
+	key := []byte("0123456789abcdef")
+	session, audioServer, videoServer := newNativeApolloMediaTestSession(t, key)
+	defer audioServer.Close()
+	defer videoServer.Close()
+	blockCtx, cancelBlock := context.WithCancel(context.Background())
+	t.Cleanup(cancelBlock)
+	blocked := make(chan struct{})
+	session.media.aead = &qualificationBlockingAEAD{
+		AEAD: session.media.aead, ctx: blockCtx, blocked: blocked, release: make(chan struct{}),
+	}
+	go session.readUDPMedia()
+	if _, err := videoServer.WriteToUDP(sourceShapedEncryptedVideoPacket(t, key, []byte{1}), session.videoConn.LocalAddr().(*net.UDPAddr)); err != nil {
+		t.Fatal(err)
+	}
+	select {
+	case <-blocked:
+	case <-time.After(time.Second):
+		t.Fatal("video processor did not block")
+	}
+
+	terminateCtx, cancelTerminate := context.WithTimeout(context.Background(), time.Second)
+	defer cancelTerminate()
+	terminated := make(chan error, 1)
+	go func() { terminated <- session.Terminate(terminateCtx) }()
+	cancelBlock()
+	if err := <-terminated; err != nil {
+		t.Fatalf("Terminate() error = %v", err)
+	}
+	select {
+	case <-session.readDone:
+	default:
+		t.Fatal("Terminate returned before video drain and processor stopped")
+	}
+	select {
+	case _, ok := <-session.Video():
+		if ok {
+			t.Fatal("video channel remained open after worker shutdown")
+		}
+	default:
+		t.Fatal("video channel was not closed after worker shutdown")
+	}
+}
+
+func newNativeApolloMediaTestSession(t *testing.T, key []byte) (*nativeApolloSession, *net.UDPConn, *net.UDPConn) {
+	t.Helper()
+	audioServer, err := net.ListenUDP("udp", &net.UDPAddr{IP: net.ParseIP("127.0.0.1")})
+	if err != nil {
+		t.Fatal(err)
+	}
+	videoServer, err := net.ListenUDP("udp", &net.UDPAddr{IP: net.ParseIP("127.0.0.1")})
+	if err != nil {
+		_ = audioServer.Close()
+		t.Fatal(err)
+	}
+	audioClient, err := net.DialUDP("udp", nil, audioServer.LocalAddr().(*net.UDPAddr))
+	if err != nil {
+		_ = audioServer.Close()
+		_ = videoServer.Close()
+		t.Fatal(err)
+	}
+	videoClient, err := net.DialUDP("udp", nil, videoServer.LocalAddr().(*net.UDPAddr))
+	if err != nil {
+		_ = audioClient.Close()
+		_ = audioServer.Close()
+		_ = videoServer.Close()
+		t.Fatal(err)
+	}
+	session := newNativeApolloSession("session-video-ingress")
+	session.media, err = newApolloMediaCodec(key, 1)
+	if err != nil {
+		_ = audioClient.Close()
+		_ = videoClient.Close()
+		_ = audioServer.Close()
+		_ = videoServer.Close()
+		t.Fatal(err)
+	}
+	session.audioConn, session.videoConn = audioClient, videoClient
+	t.Cleanup(func() {
+		_ = audioClient.Close()
+		_ = videoClient.Close()
+	})
+	return session, audioServer, videoServer
+}
+
 func TestNativeApolloTerminateReleasesPressedProviderInput(t *testing.T) {
 	server, err := net.ListenUDP("udp", &net.UDPAddr{IP: net.ParseIP("127.0.0.1")})
 	if err != nil {
@@ -899,6 +1090,55 @@ func TestPushLatestDropsExactlyOneOldPayload(t *testing.T) {
 	}
 }
 
+func TestNativeProviderVideoQueueBoundsRealFrames(t *testing.T) {
+	const maximumQueuedVideoBytes = 4 << 20
+	session := newNativeApolloSession("bounded-video")
+	frame := bytes.Repeat([]byte{0x65}, 768<<10)
+	for index := 0; index < 12; index++ {
+		if !session.enqueueMedia(session.video, append([]byte(nil), frame...), time.Now()) {
+			t.Fatalf("frame %d was not accepted", index)
+		}
+	}
+
+	var queuedBytes int
+	for {
+		select {
+		case media := <-session.Video():
+			queuedBytes += len(media.Payload)
+		default:
+			if queuedBytes > maximumQueuedVideoBytes {
+				t.Fatalf("video queue retained %d bytes, limit %d", queuedBytes, maximumQueuedVideoBytes)
+			}
+			if drops := session.Telemetry().MediaDrops; drops != 7 {
+				t.Fatalf("latest-frame replacements = %d, want 7", drops)
+			}
+			if maximum := session.mediaQueueMaximum.Load(); maximum > nativeApolloVideoQueuePackets {
+				t.Fatalf("maximum video queue entries = %d", maximum)
+			}
+			if maximum := session.mediaQueueMaximumBytes.Load(); maximum > maximumQueuedVideoBytes {
+				t.Fatalf("maximum video queue bytes = %d", maximum)
+			}
+			return
+		}
+	}
+}
+
+func TestNativeProviderVideoQueueExpiresResidence(t *testing.T) {
+	session := newNativeApolloSession("expiring-video")
+	if !session.enqueueMedia(session.video, []byte("stale-frame"), time.Now()) {
+		t.Fatal("video frame was not accepted")
+	}
+	time.Sleep(nativeApolloVideoQueueLatency + 25*time.Millisecond)
+	select {
+	case media := <-session.Video():
+		t.Fatalf("expired video remained queued: %#v", media)
+	default:
+	}
+	if drops := session.Telemetry().MediaDrops; drops != 1 {
+		t.Fatalf("expired video drops = %d, want 1", drops)
+	}
+}
+
 func sourceShapedEncryptedVideoPacket(t *testing.T, key, encoded []byte) []byte {
 	t.Helper()
 	payload := make([]byte, apolloVideoShardPayloadSize)

gateway/capability.go

@@ -11,7 +11,7 @@ var ErrNoCapabilityOverlap = errors.New("no capability overlap")
 func DefaultCapabilities() protocol.CapabilityProfile {
 	return protocol.CapabilityProfile{
 		Transport:         "quic-tls13",
-		Framing:           "datagram-v1",
+		Framing:           "datagram-v2",
 		Media:             "encoded",
 		Audio:             "encoded",
 		SourceRateControl: "server",

gateway/fair_pacer_test.go

@@ -41,6 +41,83 @@ func TestFairPacerBoundsCatchupAfterHostStall(t *testing.T) {
 	if next.Before(resumed.Add(-fairPacerMaximumCatchup)) || next.After(resumed.Add(10*time.Millisecond)) {
 		t.Fatalf("post-stall reservation = %s, want bounded catchup near %s", next, resumed)
 	}
+	pacer.mu.Lock()
+	debt := pacer.flows["one"].debt
+	pacer.mu.Unlock()
+	if debt <= 0 || debt > nativeApolloVideoQueueLatency-fairPacerMaximumCatchup {
+		t.Fatalf("post-stall debt = %s, want bounded valid schedule debt", debt)
+	}
+}
+
+func TestFairPacerRepaysBoundedDebtAfterHostStall(t *testing.T) {
+	start := time.Date(2026, time.January, 1, 0, 0, 0, 0, time.UTC)
+	pacer := newFairPacer(8000)
+	next := make(map[string]time.Time)
+	deliveries := runSyntheticPacerWithStall(
+		pacer, start, start.Add(6*time.Second), []string{"one"}, next,
+		start.Add(time.Second), 100*time.Millisecond,
+	)
+	if total := syntheticDeliveryBytes(deliveries); total < 5_990_000 || total > 6_010_000 {
+		t.Fatalf("post-stall delivery bytes = %d, want nominal throughput after bounded debt repayment", total)
+	}
+	pacer.mu.Lock()
+	remaining := pacer.flows["one"].debt
+	pacer.mu.Unlock()
+	if remaining != 0 {
+		t.Fatalf("post-stall debt = %s after repayment, want zero", remaining)
+	}
+	assertSyntheticCap(t, deliveries, 1_000_000)
+	t.Logf("single-flow debt repaid: bytes=%d remaining=%s", syntheticDeliveryBytes(deliveries), remaining)
+}
+
+func TestFairPacerRepaysSimultaneousEightFlowDebtAcrossCapacitySteps(t *testing.T) {
+	start := time.Date(2026, time.January, 1, 0, 0, 0, 0, time.UTC)
+	flows := []string{"one", "two", "three", "four", "five", "six", "seven", "eight"}
+
+	tests := []struct {
+		name           string
+		kbps           int64
+		bytesPerSecond int64
+		minimumBytes   int64
+	}{
+		{name: "baseline", kbps: 8000, bytesPerSecond: 1_000_000, minimumBytes: 9_980_000},
+		{name: "quarter", kbps: 6000, bytesPerSecond: 750_000, minimumBytes: 7_480_000},
+		{name: "half", kbps: 4000, bytesPerSecond: 500_000, minimumBytes: 4_980_000},
+	}
+	for _, test := range tests {
+		pacer := newFairPacer(8000)
+		next := make(map[string]time.Time, len(flows))
+		_ = runSyntheticPacer(pacer, start, start.Add(time.Second), flows, next)
+		resumed := start.Add(1100 * time.Millisecond)
+		for _, flow := range flows {
+			next[flow] = pacer.reserveAt(resumed, flow, 1000)
+		}
+		assertSyntheticDebt(t, pacer, flows, true)
+		pacer.setKbps(test.kbps)
+		deliveries := runSyntheticPacer(pacer, resumed, resumed.Add(10*time.Second), flows, next)
+		if total := syntheticDeliveryBytes(deliveries); total < test.minimumBytes {
+			t.Fatalf("%s post-stall delivery bytes = %d, want at least %d", test.name, total, test.minimumBytes)
+		}
+		assertSyntheticFairness(t, deliveries, flows)
+		assertSyntheticCap(t, deliveries, test.bytesPerSecond)
+		assertSyntheticDebt(t, pacer, flows, false)
+		t.Logf("%s eight-flow debt repaid: bytes=%d cap=%d", test.name, syntheticDeliveryBytes(deliveries), test.bytesPerSecond*5*105/100)
+	}
+}
+
+func assertSyntheticDebt(t *testing.T, pacer *fairPacer, flows []string, wantDebt bool) {
+	t.Helper()
+	pacer.mu.Lock()
+	defer pacer.mu.Unlock()
+	for _, flow := range flows {
+		debt := pacer.flows[flow].debt
+		if wantDebt && (debt <= 0 || debt > nativeApolloVideoQueueLatency-fairPacerMaximumCatchup) {
+			t.Fatalf("flow %s active debt = %s, want bounded nonzero debt", flow, debt)
+		}
+		if !wantDebt && debt != 0 {
+			t.Fatalf("flow %s debt = %s after repayment, want zero", flow, debt)
+		}
+	}
 }
 
 func runSyntheticPacer(pacer *fairPacer, start, end time.Time, flows []string, next map[string]time.Time) []syntheticPacerDelivery {
@@ -67,6 +144,50 @@ func runSyntheticPacer(pacer *fairPacer, start, end time.Time, flows []string, n
 	}
 }
 
+func runSyntheticPacerWithStall(pacer *fairPacer, start, end time.Time, flows []string, next map[string]time.Time, stallAt time.Time, stall time.Duration) []syntheticPacerDelivery {
+	const packetBytes = 1000
+	for _, flow := range flows {
+		if next[flow].IsZero() {
+			next[flow] = pacer.reserveAt(start, flow, packetBytes)
+		}
+	}
+	now := start
+	stalled := false
+	var deliveries []syntheticPacerDelivery
+	for {
+		flow := ""
+		target := end.Add(time.Nanosecond)
+		for _, candidate := range flows {
+			if next[candidate].Before(target) {
+				flow, target = candidate, next[candidate]
+			}
+		}
+		if target.After(end) {
+			return deliveries
+		}
+		if !stalled && !target.Before(stallAt) {
+			now = stallAt.Add(stall)
+			stalled = true
+		}
+		if now.Before(target) {
+			now = target
+		}
+		if now.After(end) {
+			return deliveries
+		}
+		deliveries = append(deliveries, syntheticPacerDelivery{at: now, flow: flow, bytes: packetBytes})
+		next[flow] = pacer.reserveAt(now, flow, packetBytes)
+	}
+}
+
+func syntheticDeliveryBytes(deliveries []syntheticPacerDelivery) int64 {
+	var total int64
+	for _, delivery := range deliveries {
+		total += delivery.bytes
+	}
+	return total
+}
+
 func assertSyntheticFairness(t *testing.T, deliveries []syntheticPacerDelivery, flows []string) {
 	t.Helper()
 	counts := make(map[string]int64, len(flows))

gateway/frame.go

@@ -7,9 +7,15 @@ import (
 )
 
 const (
-	frameHeaderSize  = 21
-	maxFrameSize     = 1 << 16
-	maxFragmentCount = 16
+	frameV1HeaderSize     = 21
+	frameV2HeaderSize     = 23
+	frameV1PayloadSize    = 1179
+	frameV2PayloadSize    = 1177
+	maxV1FragmentCount    = 16
+	maxV2FragmentCount    = 891
+	maxCompleteFrameBytes = 1 << 20
+	maxFrameSize          = 1 << 16
+	frameHeaderSize       = frameV2HeaderSize
 )
 
 const (
@@ -35,16 +41,25 @@ var (
 )
 
 type Frame struct {
+	Version       byte
 	Channel       byte
 	Flags         byte
 	Sequence      uint32
 	TimestampMS   uint64
-	FragmentIndex byte
-	FragmentCount byte
+	FragmentIndex uint16
+	FragmentCount uint16
 	Payload       []byte
 }
 
-func channelLimit(channel byte) (int, bool) {
+func channelLimit(version, channel byte) (int, bool) {
+	if version == 2 {
+		switch channel {
+		case ChannelVideo, ChannelAudio:
+			return frameV2PayloadSize, true
+		default:
+			return 0, false
+		}
+	}
 	switch channel {
 	case ChannelControl:
 		return 1024, true
@@ -53,93 +68,139 @@ func channelLimit(channel byte) (int, bool) {
 	case ChannelText:
 		return 65515, true
 	case ChannelVideo, ChannelAudio, ChannelInput:
-		return 1179, true
+		return frameV1PayloadSize, true
 	default:
 		return 0, false
 	}
 }
 
 func EncodeFrame(frame Frame) ([]byte, error) {
-	limit, ok := channelLimit(frame.Channel)
+	version := frame.Version
+	if version == 0 {
+		version = 1
+	}
+	if version != 1 && version != 2 {
+		return nil, ErrFrameVersion
+	}
+	limit, ok := channelLimit(version, frame.Channel)
 	if !ok {
 		return nil, ErrFrameChannel
 	}
 	if frame.Flags != 0 {
 		return nil, ErrFrameFlags
 	}
-	if frame.FragmentCount == 0 || frame.FragmentCount > maxFragmentCount || frame.FragmentIndex >= frame.FragmentCount {
+	maxFragments := uint16(maxV1FragmentCount)
+	headerSize := frameV1HeaderSize
+	if version == 2 {
+		maxFragments = maxV2FragmentCount
+		headerSize = frameV2HeaderSize
+	}
+	if frame.FragmentCount == 0 || frame.FragmentCount > maxFragments || frame.FragmentIndex >= frame.FragmentCount {
 		return nil, ErrFrameFragment
 	}
 	if len(frame.Payload) > limit {
 		return nil, ErrFramePayloadLimit
 	}
-	if len(frame.Payload) > maxFrameSize-frameHeaderSize {
+	if len(frame.Payload) > 1<<16-headerSize {
 		return nil, ErrFrameSize
 	}
-	encoded := make([]byte, frameHeaderSize+len(frame.Payload))
-	encoded[0], encoded[1], encoded[2], encoded[3], encoded[4] = 'V', 'D', 1, frame.Channel, frame.Flags
+	encoded := make([]byte, headerSize+len(frame.Payload))
+	encoded[0], encoded[1], encoded[2], encoded[3], encoded[4] = 'V', 'D', version, frame.Channel, frame.Flags
 	binary.BigEndian.PutUint32(encoded[5:9], frame.Sequence)
 	binary.BigEndian.PutUint64(encoded[9:17], frame.TimestampMS)
-	encoded[17], encoded[18] = frame.FragmentIndex, frame.FragmentCount
-	binary.BigEndian.PutUint16(encoded[19:21], uint16(len(frame.Payload)))
-	copy(encoded[frameHeaderSize:], frame.Payload)
+	if version == 1 {
+		encoded[17], encoded[18] = byte(frame.FragmentIndex), byte(frame.FragmentCount)
+		binary.BigEndian.PutUint16(encoded[19:21], uint16(len(frame.Payload)))
+	} else {
+		binary.BigEndian.PutUint16(encoded[17:19], frame.FragmentIndex)
+		binary.BigEndian.PutUint16(encoded[19:21], frame.FragmentCount)
+		binary.BigEndian.PutUint16(encoded[21:23], uint16(len(frame.Payload)))
+	}
+	copy(encoded[headerSize:], frame.Payload)
 	return encoded, nil
 }
 
 func DecodeFrame(raw []byte) (Frame, error) {
-	if len(raw) < frameHeaderSize {
+	if len(raw) < 3 {
 		return Frame{}, ErrFrameTruncated
 	}
-	if len(raw) > maxFrameSize {
-		return Frame{}, ErrFrameSize
-	}
 	if raw[0] != 'V' || raw[1] != 'D' {
 		return Frame{}, ErrFrameMagic
 	}
-	if raw[2] != 1 {
+	version := raw[2]
+	if version != 1 && version != 2 {
 		return Frame{}, ErrFrameVersion
 	}
-	limit, ok := channelLimit(raw[3])
+	headerSize := frameV1HeaderSize
+	maxFragments := uint16(maxV1FragmentCount)
+	if version == 2 {
+		headerSize = frameV2HeaderSize
+		maxFragments = maxV2FragmentCount
+	}
+	if len(raw) < headerSize {
+		return Frame{}, ErrFrameTruncated
+	}
+	if version == 1 && len(raw) > 1<<16 || version == 2 && len(raw) > 1200 {
+		return Frame{}, ErrFrameSize
+	}
+	limit, ok := channelLimit(version, raw[3])
 	if !ok {
 		return Frame{}, ErrFrameChannel
 	}
 	if raw[4] != 0 {
 		return Frame{}, ErrFrameFlags
 	}
-	if raw[18] == 0 || raw[18] > maxFragmentCount || raw[17] >= raw[18] {
+	var fragmentIndex, fragmentCount uint16
+	payloadOffset := 19
+	if version == 1 {
+		fragmentIndex, fragmentCount = uint16(raw[17]), uint16(raw[18])
+	} else {
+		fragmentIndex = binary.BigEndian.Uint16(raw[17:19])
+		fragmentCount = binary.BigEndian.Uint16(raw[19:21])
+		payloadOffset = 21
+	}
+	if fragmentCount == 0 || fragmentCount > maxFragments || fragmentIndex >= fragmentCount {
 		return Frame{}, ErrFrameFragment
 	}
-	payloadLength := int(binary.BigEndian.Uint16(raw[19:21]))
+	payloadLength := int(binary.BigEndian.Uint16(raw[payloadOffset : payloadOffset+2]))
 	if payloadLength > limit {
 		return Frame{}, ErrFramePayloadLimit
 	}
-	if len(raw) != frameHeaderSize+payloadLength {
+	if len(raw) != headerSize+payloadLength {
 		return Frame{}, ErrFrameLength
 	}
 	return Frame{
+		Version:       version,
 		Channel:       raw[3],
 		Flags:         raw[4],
 		Sequence:      binary.BigEndian.Uint32(raw[5:9]),
 		TimestampMS:   binary.BigEndian.Uint64(raw[9:17]),
-		FragmentIndex: raw[17],
-		FragmentCount: raw[18],
-		Payload:       append([]byte(nil), raw[frameHeaderSize:]...),
+		FragmentIndex: fragmentIndex,
+		FragmentCount: fragmentCount,
+		Payload:       append([]byte(nil), raw[headerSize:]...),
 	}, nil
 }
 
 func FragmentPayload(channel byte, sequence uint32, timestampMS uint64, payload []byte) ([]Frame, error) {
-	limit, ok := channelLimit(channel)
-	if !ok {
+	version := byte(1)
+	limit := frameV1PayloadSize
+	maxFragments := maxV1FragmentCount
+	if channel == ChannelVideo || channel == ChannelAudio {
+		version = 2
+		limit = frameV2PayloadSize
+		maxFragments = maxV2FragmentCount
+	}
+	if _, ok := channelLimit(version, channel); !ok {
 		return nil, ErrFrameChannel
 	}
-	if limit > 1179 {
-		limit = 1179
+	if len(payload) > maxCompleteFrameBytes {
+		return nil, ErrFrameFragmentedLimit
 	}
 	count := (len(payload) + limit - 1) / limit
 	if count == 0 {
 		count = 1
 	}
-	if count > maxFragmentCount {
+	if count > maxFragments {
 		return nil, ErrFrameFragmentedLimit
 	}
 	frames := make([]Frame, 0, count)
@@ -150,11 +211,12 @@ func FragmentPayload(channel byte, sequence uint32, timestampMS uint64, payload
 			end = len(payload)
 		}
 		frames = append(frames, Frame{
+			Version:       version,
 			Channel:       channel,
 			Sequence:      sequence,
 			TimestampMS:   timestampMS,
-			FragmentIndex: byte(index),
-			FragmentCount: byte(count),
+			FragmentIndex: uint16(index),
+			FragmentCount: uint16(count),
 			Payload:       append([]byte(nil), payload[start:end]...),
 		})
 	}

gateway/gateway_test.go

@@ -1,6 +1,7 @@
 package gateway
 
 import (
+	"bytes"
 	"context"
 	"crypto/ecdsa"
 	"crypto/elliptic"
@@ -28,9 +29,11 @@ import (
 	protocol "git.sechmachine.io.vn/sechmachine/VerseVDI-Protocol/gen/go/protocol"
 )
 
+const protocolTerminalReceiptVector = "VGF1\x00\x03\x00\x00"
+
 func TestFrameValidationAndFragmentation(t *testing.T) {
 	frames, err := FragmentPayload(ChannelVideo, 7, 11, make([]byte, 1180))
-	if err != nil || len(frames) != 2 || len(frames[0].Payload) != 1179 || len(frames[1].Payload) != 1 {
+	if err != nil || len(frames) != 2 || len(frames[0].Payload) != 1177 || len(frames[1].Payload) != 3 {
 		t.Fatalf("fragmentation = %#v, err = %v", frames, err)
 	}
 	encoded, err := EncodeFrame(frames[0])
@@ -110,7 +113,7 @@ func TestClientFeedbackUsesFixedProtocolVGFVector(t *testing.T) {
 		t.Fatalf("decoded disconnected event = %#v, %v", event, err)
 	}
 	receipt, err := EncodeClientFeedback(Feedback{Kind: FeedbackTerminalReceipt})
-	if err != nil || hex.EncodeToString(receipt) != "5647463100030000" {
+	if err != nil || string(receipt) != protocolTerminalReceiptVector {
 		t.Fatalf("terminal receipt vector = %x, %v", receipt, err)
 	}
 }
@@ -159,11 +162,11 @@ func TestNewServerRejectsPartiallyConfiguredCapabilities(t *testing.T) {
 }
 
 func TestSyntheticImpairmentPacingAndResourceBounds(t *testing.T) {
-	payload := make([]byte, 1179*16+1)
+	payload := make([]byte, maxCompleteFrameBytes+1)
 	if _, err := FragmentPayload(ChannelVideo, 1, 0, payload); !errors.Is(err, ErrFrameFragmentedLimit) {
 		t.Fatalf("oversized media payload accepted: %v", err)
 	}
-	frames, err := FragmentPayload(ChannelVideo, 1, 0, bytesRepeat(0x5a, 1179*4))
+	frames, err := FragmentPayload(ChannelVideo, 1, 0, bytesRepeat(0x5a, frameV2PayloadSize*4))
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -184,11 +187,29 @@ func TestSyntheticImpairmentPacingAndResourceBounds(t *testing.T) {
 		}
 		deliveredBytes += len(decoded.Payload)
 	}
-	if delivered != 3 || deliveredBytes != 1179*3 {
+	if delivered != 3 || deliveredBytes != frameV2PayloadSize*3 {
 		t.Fatalf("synthetic impairment delivered=%d bytes=%d", delivered, deliveredBytes)
 	}
 }
 
+func TestFragmentPayloadCarriesCompleteEncodedFrame(t *testing.T) {
+	payload := bytesRepeat(0x5a, 256*1024)
+	frames, err := FragmentPayload(ChannelVideo, 9, 11, payload)
+	if errors.Is(err, ErrFrameFragmentedLimit) {
+		t.Fatalf("complete encoded frame rejected at legacy fragment ceiling: %v", err)
+	}
+	if err != nil {
+		t.Fatal(err)
+	}
+	var recovered []byte
+	for _, frame := range frames {
+		recovered = append(recovered, frame.Payload...)
+	}
+	if !bytes.Equal(recovered, payload) {
+		t.Fatal("complete encoded frame payload changed")
+	}
+}
+
 func TestApolloFixturesAndLifecycle(t *testing.T) {
 	management, err := os.ReadFile("testdata/apollo-management.xml")
 	if err != nil {
@@ -216,10 +237,10 @@ func TestApolloFixturesAndLifecycle(t *testing.T) {
 		t.Fatal(err)
 	}
 	if got := <-session.Video(); string(got.Payload) != string(video) {
-		t.Fatalf("video changed: %x", got)
+		t.Fatalf("video changed: %x", got.Payload)
 	}
 	if got := <-session.Audio(); string(got.Payload) != string(audio) {
-		t.Fatalf("audio changed: %x", got)
+		t.Fatalf("audio changed: %x", got.Payload)
 	}
 	if err := session.Input(context.Background(), InputEvent{Sequence: 1, Device: "keyboard", Code: 7, Pressed: true}); err != nil {
 		t.Fatal(err)
@@ -399,7 +420,7 @@ func TestGatewayTelemetrySeparatesQueueProcessingAndPacing(t *testing.T) {
 		t.Fatal(err)
 	}
 	receiveCtx, receiveCancel := context.WithTimeout(context.Background(), 2*time.Second)
-	for index := byte(0); index < 2; index++ {
+	for index := uint16(0); index < 2; index++ {
 		frame, err := client.ReceiveFrame(receiveCtx)
 		if err != nil {
 			t.Fatal(err)
@@ -836,6 +857,7 @@ func newNativeGatewayLifecycleHarness(t *testing.T, sessionID string) nativeGate
 type independentGatewayClient struct {
 	connection *quic.Conn
 	control    *quic.Stream
+	media      independentMediaReassembler
 }
 
 func dialIndependentGateway(ctx context.Context, address string, tlsConfig *tls.Config, request protocol.TunnelAdmissionRequest) (*independentGatewayClient, error) {
@@ -864,7 +886,11 @@ func dialIndependentGateway(ctx context.Context, address string, tlsConfig *tls.
 		_ = connection.CloseWithError(applicationError, "independent client admission failed")
 		return nil, err
 	}
-	return &independentGatewayClient{connection: connection, control: stream}, nil
+	return &independentGatewayClient{
+		connection: connection,
+		control:    stream,
+		media:      independentMediaReassembler{incomplete: make(map[independentMediaKey]*independentMediaUnit)},
+	}, nil
 }
 
 func (c *independentGatewayClient) ReceiveProviderEvent(ctx context.Context) (ProviderEvent, error) {
@@ -893,11 +919,7 @@ func (c *independentGatewayClient) receiveProviderEvent(ctx context.Context, ack
 		}
 		event, err := DecodeProviderEvent(payload)
 		if acknowledge && err == nil && (event.Kind == ProviderEventTerminated || event.Kind == ProviderEventDisconnected) {
-			receipt, encodeErr := EncodeClientFeedback(Feedback{Kind: FeedbackTerminalReceipt})
-			if encodeErr != nil {
-				return ProviderEvent{}, encodeErr
-			}
-			ack, encodeErr := protocol.EncodeChannelFrame(testChannelFrame("control.ack.v1", 0, receipt))
+			ack, encodeErr := protocol.EncodeChannelFrame(testChannelFrame("control.ack.v1", 0, []byte(protocolTerminalReceiptVector)))
 			if encodeErr != nil {
 				return ProviderEvent{}, encodeErr
 			}
@@ -914,7 +936,253 @@ func (c *independentGatewayClient) ReceiveFrame(ctx context.Context) (Frame, err
 	if err != nil {
 		return Frame{}, err
 	}
-	return DecodeFrame(data)
+	return independentDecodeFrame(data)
+}
+
+func (c *independentGatewayClient) ReceiveMedia(ctx context.Context) ([]byte, error) {
+	return c.receiveMedia(ctx, nil)
+}
+
+func (c *independentGatewayClient) receiveMedia(ctx context.Context, observe func(time.Time, int)) ([]byte, error) {
+	for {
+		data, err := c.connection.ReceiveDatagram(ctx)
+		if err != nil {
+			return nil, err
+		}
+		receivedAt := time.Now()
+		if observe != nil {
+			observe(receivedAt, len(data))
+		}
+		payload, complete, err := c.media.Add(data, receivedAt)
+		if err != nil {
+			return nil, err
+		}
+		if complete {
+			return payload, nil
+		}
+	}
+}
+
+type independentMediaKey struct {
+	channel  byte
+	sequence uint32
+}
+
+type independentMediaUnit struct {
+	started   time.Time
+	timestamp uint64
+	fragments [][]byte
+	received  []bool
+	bytes     int
+}
+
+type independentMediaReassembler struct {
+	incomplete map[independentMediaKey]*independentMediaUnit
+}
+
+func independentDecodeFrame(data []byte) (Frame, error) {
+	const (
+		v1Header, v2Header   = 21, 23
+		v1Payload, v2Payload = 1179, 1177
+	)
+	if len(data) < 3 {
+		return Frame{}, ErrFrameTruncated
+	}
+	if data[0] != 'V' || data[1] != 'D' {
+		return Frame{}, ErrFrameMagic
+	}
+	version := data[2]
+	headerSize, payloadLimit := v1Header, v1Payload
+	if version == 2 {
+		headerSize, payloadLimit = v2Header, v2Payload
+	} else if version != 1 {
+		return Frame{}, ErrFrameVersion
+	}
+	if len(data) < headerSize || version == 2 && len(data) > 1200 {
+		return Frame{}, ErrFrameSize
+	}
+	frame := Frame{
+		Version:     version,
+		Channel:     data[3],
+		Flags:       data[4],
+		Sequence:    binary.BigEndian.Uint32(data[5:9]),
+		TimestampMS: binary.BigEndian.Uint64(data[9:17]),
+	}
+	payloadLengthOffset := 19
+	if version == 1 {
+		frame.FragmentIndex = uint16(data[17])
+		frame.FragmentCount = uint16(data[18])
+	} else {
+		frame.FragmentIndex = binary.BigEndian.Uint16(data[17:19])
+		frame.FragmentCount = binary.BigEndian.Uint16(data[19:21])
+		payloadLengthOffset = 21
+	}
+	if (frame.Channel != ChannelVideo && frame.Channel != ChannelAudio) || frame.Flags != 0 ||
+		frame.FragmentCount == 0 || version == 1 && frame.FragmentCount > 16 ||
+		version == 2 && frame.FragmentCount > 891 || frame.FragmentIndex >= frame.FragmentCount {
+		return Frame{}, ErrFrameFragment
+	}
+	payloadLength := int(binary.BigEndian.Uint16(data[payloadLengthOffset : payloadLengthOffset+2]))
+	if payloadLength > payloadLimit || len(data) != headerSize+payloadLength {
+		return Frame{}, ErrFrameLength
+	}
+	frame.Payload = append([]byte(nil), data[headerSize:]...)
+	return frame, nil
+}
+
+func (r *independentMediaReassembler) Add(data []byte, now time.Time) ([]byte, bool, error) {
+	frame, err := independentDecodeFrame(data)
+	if err != nil {
+		return nil, false, err
+	}
+	for key, unit := range r.incomplete {
+		if now.Sub(unit.started) > 250*time.Millisecond {
+			delete(r.incomplete, key)
+		}
+	}
+	key := independentMediaKey{channel: frame.Channel, sequence: frame.Sequence}
+	unit := r.incomplete[key]
+	if unit == nil {
+		if len(r.incomplete) == 4 {
+			var oldestKey independentMediaKey
+			var oldest time.Time
+			for candidate, current := range r.incomplete {
+				if oldest.IsZero() || current.started.Before(oldest) {
+					oldestKey, oldest = candidate, current.started
+				}
+			}
+			delete(r.incomplete, oldestKey)
+		}
+		unit = &independentMediaUnit{
+			started: now, timestamp: frame.TimestampMS,
+			fragments: make([][]byte, frame.FragmentCount), received: make([]bool, frame.FragmentCount),
+		}
+		r.incomplete[key] = unit
+	}
+	if len(unit.fragments) != int(frame.FragmentCount) || unit.timestamp != frame.TimestampMS {
+		return nil, false, ErrFrameFragment
+	}
+	index := int(frame.FragmentIndex)
+	if unit.received[index] {
+		if !bytes.Equal(unit.fragments[index], frame.Payload) {
+			return nil, false, ErrFrameFragment
+		}
+		return nil, false, nil
+	}
+	if unit.bytes+len(frame.Payload) > 1<<20 {
+		delete(r.incomplete, key)
+		return nil, false, ErrFrameSize
+	}
+	unit.fragments[index] = frame.Payload
+	unit.received[index] = true
+	unit.bytes += len(frame.Payload)
+	for _, received := range unit.received {
+		if !received {
+			return nil, false, nil
+		}
+	}
+	payload := make([]byte, 0, unit.bytes)
+	for _, fragment := range unit.fragments {
+		payload = append(payload, fragment...)
+	}
+	delete(r.incomplete, key)
+	return payload, true, nil
+}
+
+func TestIndependentClientReassemblesProtocolDatagramV2(t *testing.T) {
+	fixed, err := hex.DecodeString("5644020a00000000010000000000000002000000010003010203")
+	if err != nil {
+		t.Fatal(err)
+	}
+	frame, err := independentDecodeFrame(fixed)
+	if err != nil || frame.Version != 2 || frame.Channel != ChannelVideo ||
+		frame.Sequence != 1 || frame.TimestampMS != 2 || frame.FragmentCount != 1 ||
+		!bytes.Equal(frame.Payload, []byte{1, 2, 3}) {
+		t.Fatalf("fixed Protocol v2 frame = %#v, %v", frame, err)
+	}
+
+	payload := bytes.Repeat([]byte("frame-boundary-"), 300)
+	fragments, err := FragmentPayload(ChannelVideo, 7, 11, payload)
+	if err != nil || len(fragments) < 3 {
+		t.Fatalf("fragments = %d, %v", len(fragments), err)
+	}
+	encoded := make([][]byte, len(fragments))
+	for index, fragment := range fragments {
+		encoded[index], err = EncodeFrame(fragment)
+		if err != nil {
+			t.Fatal(err)
+		}
+	}
+	reassembler := independentMediaReassembler{incomplete: make(map[independentMediaKey]*independentMediaUnit)}
+	now := time.Unix(0, 0)
+	order := []int{2, 0, 0, 1, 3}
+	var recovered []byte
+	for _, index := range order {
+		var complete bool
+		recovered, complete, err = reassembler.Add(encoded[index], now)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if index != 3 && complete {
+			t.Fatalf("unit completed at fragment %d", index)
+		}
+	}
+	if !bytes.Equal(recovered, payload) {
+		t.Fatal("independent client changed the complete encoded frame")
+	}
+
+	if _, _, err := reassembler.Add(encoded[0], now); err != nil {
+		t.Fatal(err)
+	}
+	conflict := append([]byte(nil), encoded[0]...)
+	conflict[len(conflict)-1] ^= 0xff
+	if _, _, err := reassembler.Add(conflict, now); !errors.Is(err, ErrFrameFragment) {
+		t.Fatalf("conflicting duplicate = %v", err)
+	}
+	reassembler = independentMediaReassembler{incomplete: make(map[independentMediaKey]*independentMediaUnit)}
+	if _, _, err := reassembler.Add(encoded[0], now); err != nil {
+		t.Fatal(err)
+	}
+	expired := append([]byte(nil), encoded[0]...)
+	binary.BigEndian.PutUint32(expired[5:9], 8)
+	if _, _, err := reassembler.Add(expired, now.Add(251*time.Millisecond)); err != nil {
+		t.Fatal(err)
+	}
+	if len(reassembler.incomplete) != 1 {
+		t.Fatalf("expired incomplete units = %d, want 1", len(reassembler.incomplete))
+	}
+
+	reassembler = independentMediaReassembler{incomplete: make(map[independentMediaKey]*independentMediaUnit)}
+	for sequence := uint32(1); sequence <= 5; sequence++ {
+		partial, encodeErr := EncodeFrame(Frame{
+			Version: 2, Channel: ChannelVideo, Sequence: sequence, TimestampMS: 1,
+			FragmentIndex: 0, FragmentCount: 2, Payload: []byte{byte(sequence)},
+		})
+		if encodeErr != nil {
+			t.Fatal(encodeErr)
+		}
+		if _, _, err := reassembler.Add(partial, now.Add(time.Duration(sequence)*time.Nanosecond)); err != nil {
+			t.Fatal(err)
+		}
+	}
+	if len(reassembler.incomplete) != 4 || reassembler.incomplete[independentMediaKey{channel: ChannelVideo, sequence: 1}] != nil {
+		t.Fatalf("fifth unit did not evict the oldest: %#v", reassembler.incomplete)
+	}
+
+	reassembler = independentMediaReassembler{incomplete: make(map[independentMediaKey]*independentMediaUnit)}
+	for index := uint16(0); index < 891; index++ {
+		fragment, encodeErr := EncodeFrame(Frame{
+			Version: 2, Channel: ChannelVideo, Sequence: 99, TimestampMS: 1,
+			FragmentIndex: index, FragmentCount: 891, Payload: make([]byte, 1177),
+		})
+		if encodeErr != nil {
+			t.Fatal(encodeErr)
+		}
+		_, _, err = reassembler.Add(fragment, now)
+	}
+	if !errors.Is(err, ErrFrameSize) || len(reassembler.incomplete) != 0 {
+		t.Fatalf("oversized reassembly = %v, incomplete=%d", err, len(reassembler.incomplete))
+	}
 }
 
 func (c *independentGatewayClient) waitClosed(t *testing.T) {

gateway/packaging_test.go

@@ -1,15 +1,37 @@
 package gateway
 
 import (
+	"bufio"
 	"bytes"
 	"debug/buildinfo"
 	"debug/elf"
 	"os"
 	"os/exec"
 	"path/filepath"
+	"regexp"
+	"strings"
 	"testing"
 )
 
+func TestCIActionReferencesAreImmutable(t *testing.T) {
+	workflow, err := os.Open(filepath.Join("..", ".gitea", "workflows", "verify.yml"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer workflow.Close()
+	immutable := regexp.MustCompile(`@[0-9a-f]{40}(?:\s+#.*)?$`)
+	scanner := bufio.NewScanner(workflow)
+	for scanner.Scan() {
+		line := strings.TrimSpace(scanner.Text())
+		if strings.HasPrefix(line, "- uses:") && !immutable.MatchString(line) {
+			t.Errorf("mutable CI action reference: %s", line)
+		}
+	}
+	if err := scanner.Err(); err != nil {
+		t.Fatal(err)
+	}
+}
+
 func TestGatewayLinuxArtifactsAreReproduciblePureGoELF(t *testing.T) {
 	first, second := t.TempDir(), t.TempDir()
 	for _, output := range []string{first, second} {

gateway/provider.go

@@ -8,6 +8,7 @@ import (
 	"strconv"
 	"strings"
 	"sync"
+	"sync/atomic"
 	"time"
 
 	protocol "git.sechmachine.io.vn/sechmachine/VerseVDI-Protocol/gen/go/protocol"
@@ -234,6 +235,21 @@ type ProviderMedia struct {
 	Payload    []byte
 	ReceivedAt time.Time
 	EnqueuedAt time.Time
+	queueID    uint64
+	expiry     *time.Timer
+	accounting *providerMediaQueueAccounting
+}
+
+type providerMediaQueueAccounting struct {
+	released atomic.Bool
+	bytes    int64
+	total    *atomic.Int64
+}
+
+func (media ProviderMedia) releaseQueue() {
+	if media.accounting != nil && media.accounting.released.CompareAndSwap(false, true) {
+		media.accounting.total.Add(-media.accounting.bytes)
+	}
 }
 
 type Provider interface {

gateway/qualification_process_test.go

@@ -0,0 +1,556 @@
+package gateway
+
+import (
+	"bufio"
+	"bytes"
+	"compress/gzip"
+	"context"
+	"crypto/rand"
+	"crypto/tls"
+	"crypto/x509"
+	"encoding/hex"
+	"encoding/json"
+	"encoding/pem"
+	"errors"
+	"fmt"
+	"io"
+	"net"
+	"net/http"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	protocol "git.sechmachine.io.vn/sechmachine/VerseVDI-Protocol/gen/go/protocol"
+)
+
+const qualificationProcessTokenHeader = "X-VerseVDI-Qualification-Token"
+
+type qualificationGatewayProcessConfig struct {
+	ServerCertificatePEM string
+	ServerPrivateKeyPEM  string
+	ClientCAPEM          string
+	Authority            protocol.SessionAuthority
+	Work                 protocol.ProviderSessionWork
+	PacerKbps            int64
+	ReadyPath            string
+	Token                string
+}
+
+type qualificationGatewayProcessReady struct {
+	GatewayAddress string
+	ControlAddress string
+}
+
+type qualificationGatewayProcessSnapshot struct {
+	Metrics                     MetricsSnapshot
+	NativeSetups                uint64
+	NativeOpens                 uint64
+	MediaIngress                uint64
+	MediaRecovered              uint64
+	MediaEnqueued               uint64
+	MediaDrops                  uint64
+	MediaQueueMaximum           uint64
+	MediaQueueMaximumBytes      uint64
+	PacerReservations           uint64
+	ProviderTelemetry           ProviderTelemetry
+	VideoReceiveBuffer          int
+	VideoReceiveBufferAvailable bool
+	KernelDrops                 uint64
+	KernelDropsAvailable        bool
+}
+
+type qualificationProcessRecordRequest struct {
+	RawPath      string
+	ResourcePath string
+}
+
+type qualificationProcessRecordResult struct {
+	Count            int
+	ClockOverhead    time.Duration
+	ClockMethod      string
+	ResourceSamples  int
+	CPUSeconds       float64
+	PeakHeapBytes    uint64
+	PeakGoroutines   int
+	AllocatedObjects uint64
+	AllocatedBytes   uint64
+	RecordingElapsed time.Duration
+}
+
+type qualificationProcessTimingSample struct {
+	elapsed     time.Duration
+	observation mediaTimingObservation
+}
+
+type qualificationProcessRecorder struct {
+	mu            sync.Mutex
+	active        bool
+	started       time.Time
+	rawFile       *os.File
+	rawCompressed *gzip.Writer
+	rawBuffered   *bufio.Writer
+	resourcePath  string
+	resources     []qualificationResourceSample
+	samples       int
+	recordErr     error
+	tickerStop    chan struct{}
+	tickerDone    chan struct{}
+	timingSamples chan qualificationProcessTimingSample
+	timingDone    chan struct{}
+	clock         time.Duration
+}
+
+func (r *qualificationProcessRecorder) start(request qualificationProcessRecordRequest) error {
+	if err := validateQualificationOutputDir(filepath.Dir(request.RawPath)); err != nil {
+		return err
+	}
+	if filepath.Dir(request.RawPath) != filepath.Dir(request.ResourcePath) || request.RawPath == request.ResourcePath {
+		return errors.New("qualification process output paths invalid")
+	}
+	file, err := os.OpenFile(request.RawPath, os.O_CREATE|os.O_EXCL|os.O_WRONLY, 0o640)
+	if err != nil {
+		return err
+	}
+	compressed, err := gzip.NewWriterLevel(file, gzip.BestSpeed)
+	if err != nil {
+		_ = file.Close()
+		return err
+	}
+	buffered := bufio.NewWriterSize(compressed, 1<<20)
+	if _, err = buffered.WriteString("elapsed_ns,queue_ns,processing_ns,pacing_ns\n"); err != nil {
+		_ = compressed.Close()
+		_ = file.Close()
+		return err
+	}
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	if r.active {
+		_ = buffered.Flush()
+		_ = compressed.Close()
+		_ = file.Close()
+		return errors.New("qualification process recording already active")
+	}
+	clock := qualificationClockOverhead()
+	r.active = true
+	r.started = time.Now()
+	r.rawFile = file
+	r.rawCompressed = compressed
+	r.rawBuffered = buffered
+	r.resourcePath = request.ResourcePath
+	r.resources = []qualificationResourceSample{qualificationRuntimeSample(r.started)}
+	r.samples = 0
+	r.recordErr = nil
+	r.clock = clock
+	r.tickerStop = make(chan struct{})
+	r.tickerDone = make(chan struct{})
+	r.timingSamples = make(chan qualificationProcessTimingSample, 4096)
+	r.timingDone = make(chan struct{})
+	go r.writeTimings()
+	go r.sampleResources()
+	return nil
+}
+
+func (r *qualificationProcessRecorder) observe(observation mediaTimingObservation) {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	if !r.active {
+		return
+	}
+	r.timingSamples <- qualificationProcessTimingSample{
+		elapsed: time.Since(r.started), observation: observation,
+	}
+}
+
+func (r *qualificationProcessRecorder) writeTimings() {
+	defer close(r.timingDone)
+	line := make([]byte, 0, 96)
+	for sample := range r.timingSamples {
+		if r.recordErr == nil {
+			line = line[:0]
+			line = strconv.AppendInt(line, sample.elapsed.Nanoseconds(), 10)
+			line = append(line, ',')
+			line = strconv.AppendInt(line, sample.observation.QueueDelay.Nanoseconds(), 10)
+			line = append(line, ',')
+			line = strconv.AppendInt(line, sample.observation.ProcessingDelay.Nanoseconds(), 10)
+			line = append(line, ',')
+			line = strconv.AppendInt(line, sample.observation.PacingDelay.Nanoseconds(), 10)
+			line = append(line, '\n')
+			_, r.recordErr = r.rawBuffered.Write(line)
+		}
+		r.samples++
+	}
+}
+
+func (r *qualificationProcessRecorder) sampleResources() {
+	ticker := time.NewTicker(time.Second)
+	defer ticker.Stop()
+	defer close(r.tickerDone)
+	for {
+		select {
+		case <-r.tickerStop:
+			return
+		case <-ticker.C:
+			r.mu.Lock()
+			if r.active {
+				r.resources = append(r.resources, qualificationRuntimeSample(r.started))
+			}
+			r.mu.Unlock()
+		}
+	}
+}
+
+func (r *qualificationProcessRecorder) stop() (qualificationProcessRecordResult, error) {
+	r.mu.Lock()
+	if !r.active {
+		r.mu.Unlock()
+		return qualificationProcessRecordResult{}, errors.New("qualification process recording is not active")
+	}
+	r.active = false
+	stop, done := r.tickerStop, r.tickerDone
+	timings, timingDone := r.timingSamples, r.timingDone
+	close(timings)
+	r.mu.Unlock()
+	close(stop)
+	<-done
+	<-timingDone
+
+	r.mu.Lock()
+	r.resources = append(r.resources, qualificationRuntimeSample(r.started))
+	elapsed := time.Since(r.started)
+	err := r.recordErr
+	if flushErr := r.rawBuffered.Flush(); err == nil {
+		err = flushErr
+	}
+	if closeErr := r.rawCompressed.Close(); err == nil {
+		err = closeErr
+	}
+	if closeErr := r.rawFile.Close(); err == nil {
+		err = closeErr
+	}
+	resources := append([]qualificationResourceSample(nil), r.resources...)
+	result := qualificationProcessRecordResult{
+		Count: r.samples, ClockOverhead: r.clock, ClockMethod: qualificationClockOverheadMethod,
+		ResourceSamples: len(resources), RecordingElapsed: elapsed,
+	}
+	resourcePath := r.resourcePath
+	r.mu.Unlock()
+	if err != nil {
+		return qualificationProcessRecordResult{}, err
+	}
+	if err := writeQualificationResourceSamples(resourcePath, resources); err != nil {
+		return qualificationProcessRecordResult{}, err
+	}
+	first, last := resources[0], resources[len(resources)-1]
+	result.CPUSeconds = qualificationCPUSecondsDelta(first.CPUSeconds, last.CPUSeconds)
+	result.AllocatedObjects = last.AllocatedObjects - first.AllocatedObjects
+	result.AllocatedBytes = last.AllocatedBytes - first.AllocatedBytes
+	for _, sample := range resources {
+		result.PeakHeapBytes = max(result.PeakHeapBytes, sample.HeapBytes)
+		result.PeakGoroutines = max(result.PeakGoroutines, sample.Goroutines)
+	}
+	return result, nil
+}
+
+func qualificationCPUSecondsDelta(first, last float64) float64 {
+	cpuSeconds := -1.0
+	if first >= 0 && last >= first {
+		cpuSeconds = last - first
+	}
+	return cpuSeconds
+}
+
+func TestQualificationCPUSecondsDeltaRejectsUnavailableOrDecreasingSamples(t *testing.T) {
+	tests := []struct {
+		name        string
+		first, last float64
+		want        float64
+	}{
+		{name: "positive", first: 1.25, last: 1.75, want: 0.5},
+		{name: "zero", first: 1.25, last: 1.25, want: 0},
+		{name: "unavailable first", first: -1, last: 1.25, want: -1},
+		{name: "unavailable last", first: 1.25, last: -1, want: -1},
+		{name: "decreasing", first: 1.75, last: 1.25, want: -1},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			if got := qualificationCPUSecondsDelta(test.first, test.last); got != test.want {
+				t.Fatalf("CPU delta for first=%f last=%f = %f, want %f", test.first, test.last, got, test.want)
+			}
+		})
+	}
+}
+
+type qualificationGatewayProcess struct {
+	command *exec.Cmd
+	cancel  context.CancelFunc
+	done    chan error
+	output  *bytes.Buffer
+	ready   qualificationGatewayProcessReady
+	token   string
+	client  *http.Client
+	once    sync.Once
+}
+
+func startQualificationGatewayProcess(t *testing.T, serverTLS *tls.Config, authority protocol.SessionAuthority, work protocol.ProviderSessionWork, pacerKbps int64) *qualificationGatewayProcess {
+	t.Helper()
+	temp := t.TempDir()
+	configPath := filepath.Join(temp, "gateway-config.json")
+	readyPath := filepath.Join(temp, "gateway-ready.json")
+	tokenBytes := make([]byte, 32)
+	if _, err := rand.Read(tokenBytes); err != nil {
+		t.Fatal(err)
+	}
+	config := qualificationGatewayProcessConfig{
+		ServerCertificatePEM: qualificationCertificateChainPEM(t, serverTLS.Certificates[0]),
+		ServerPrivateKeyPEM:  privateKeyPEM(t, serverTLS.Certificates[0]),
+		ClientCAPEM:          string(pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: serverTLS.Certificates[0].Certificate[1]})),
+		Authority:            authority, Work: work, PacerKbps: pacerKbps, ReadyPath: readyPath,
+		Token: hex.EncodeToString(tokenBytes),
+	}
+	encoded, err := json.Marshal(config)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(configPath, encoded, 0o600); err != nil {
+		t.Fatal(err)
+	}
+	ctx, cancel := context.WithCancel(context.Background())
+	command := exec.CommandContext(ctx, os.Args[0], "-test.run=^TestQualificationGatewayProcessChild$", "-test.count=1")
+	command.Env = append(os.Environ(), "VERSEVDI_QUALIFICATION_GATEWAY_CONFIG="+configPath)
+	output := &bytes.Buffer{}
+	command.Stdout, command.Stderr = output, output
+	if err := command.Start(); err != nil {
+		cancel()
+		t.Fatal(err)
+	}
+	process := &qualificationGatewayProcess{
+		command: command, cancel: cancel, done: make(chan error, 1), output: output,
+		token: config.Token, client: &http.Client{Timeout: 5 * time.Second},
+	}
+	go func() { process.done <- command.Wait() }()
+	deadline := time.Now().Add(10 * time.Second)
+	for time.Now().Before(deadline) {
+		raw, readErr := os.ReadFile(readyPath)
+		if readErr == nil && json.Unmarshal(raw, &process.ready) == nil &&
+			process.ready.GatewayAddress != "" && process.ready.ControlAddress != "" {
+			return process
+		}
+		select {
+		case waitErr := <-process.done:
+			cancel()
+			t.Fatalf("qualification gateway child exited before ready: %v\n%s", waitErr, output)
+		case <-time.After(10 * time.Millisecond):
+		}
+	}
+	process.Close()
+	t.Fatalf("qualification gateway child did not become ready\n%s", output)
+	return nil
+}
+
+func qualificationCertificateChainPEM(t *testing.T, certificate tls.Certificate) string {
+	t.Helper()
+	var encoded strings.Builder
+	for _, der := range certificate.Certificate {
+		if err := pem.Encode(&encoded, &pem.Block{Type: "CERTIFICATE", Bytes: der}); err != nil {
+			t.Fatal(err)
+		}
+	}
+	return encoded.String()
+}
+
+func (p *qualificationGatewayProcess) request(method, path string, body any, response any) error {
+	var reader io.Reader
+	if body != nil {
+		encoded, err := json.Marshal(body)
+		if err != nil {
+			return err
+		}
+		reader = bytes.NewReader(encoded)
+	}
+	request, err := http.NewRequest(method, "http://"+p.ready.ControlAddress+path, reader)
+	if err != nil {
+		return err
+	}
+	request.Header.Set(qualificationProcessTokenHeader, p.token)
+	result, err := p.client.Do(request)
+	if err != nil {
+		return err
+	}
+	defer result.Body.Close()
+	if result.StatusCode != http.StatusOK {
+		raw, _ := io.ReadAll(io.LimitReader(result.Body, 4096))
+		return fmt.Errorf("qualification gateway control %s: %s", result.Status, raw)
+	}
+	if response != nil {
+		return json.NewDecoder(io.LimitReader(result.Body, 1<<20)).Decode(response)
+	}
+	return nil
+}
+
+func (p *qualificationGatewayProcess) startRecording(rawPath, resourcePath string) error {
+	return p.request(http.MethodPost, "/record/start", qualificationProcessRecordRequest{RawPath: rawPath, ResourcePath: resourcePath}, nil)
+}
+
+func (p *qualificationGatewayProcess) stopRecording() (qualificationProcessRecordResult, error) {
+	var result qualificationProcessRecordResult
+	err := p.request(http.MethodPost, "/record/stop", nil, &result)
+	return result, err
+}
+
+func (p *qualificationGatewayProcess) snapshot() (qualificationGatewayProcessSnapshot, error) {
+	var result qualificationGatewayProcessSnapshot
+	err := p.request(http.MethodGet, "/snapshot", nil, &result)
+	return result, err
+}
+
+func (p *qualificationGatewayProcess) Close() {
+	if p == nil {
+		return
+	}
+	p.once.Do(func() {
+		_ = p.request(http.MethodPost, "/shutdown", nil, nil)
+		select {
+		case <-p.done:
+		case <-time.After(5 * time.Second):
+			p.cancel()
+			<-p.done
+		}
+		p.cancel()
+	})
+}
+
+func TestQualificationGatewayProcessChild(t *testing.T) {
+	configPath := os.Getenv("VERSEVDI_QUALIFICATION_GATEWAY_CONFIG")
+	if configPath == "" {
+		return
+	}
+	raw, err := os.ReadFile(configPath)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var config qualificationGatewayProcessConfig
+	if err := json.Unmarshal(raw, &config); err != nil {
+		t.Fatal(err)
+	}
+	certificate, err := tls.X509KeyPair([]byte(config.ServerCertificatePEM), []byte(config.ServerPrivateKeyPEM))
+	if err != nil {
+		t.Fatal(err)
+	}
+	clientCAs := x509.NewCertPool()
+	if !clientCAs.AppendCertsFromPEM([]byte(config.ClientCAPEM)) {
+		t.Fatal("qualification gateway client CA invalid")
+	}
+	serverTLS := &tls.Config{
+		MinVersion: tls.VersionTLS13, Certificates: []tls.Certificate{certificate},
+		ClientAuth: tls.RequireAndVerifyClientCert, ClientCAs: clientCAs,
+	}
+	admission := &oneTimeAdmission{
+		authority: config.Authority, released: make(chan struct{}), disableClipboard: true,
+		providerWork: &config.Work,
+	}
+	backend := &qualificationTracingBackend{native: NewNativeApolloBackend()}
+	recorder := &qualificationProcessRecorder{}
+	server, err := NewServer(ServerConfig{
+		ListenAddress: "127.0.0.1:0", TLSConfig: serverTLS, GatewayID: config.Authority.GatewayID,
+		Capabilities: DefaultCapabilities(), ProviderCapabilities: DefaultCapabilities(),
+		Admission: admission, ProviderStateReporter: &recordingProviderStateReporter{},
+		Provider: NewApolloAdapter(backend, ProviderIdentity{}), PacerKbps: config.PacerKbps,
+		mediaObserver: recorder.observe,
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	ctx, cancel := context.WithCancel(context.Background())
+	serveDone := make(chan error, 1)
+	go func() { serveDone <- server.Serve(ctx) }()
+	shutdown := make(chan struct{})
+	var shutdownOnce sync.Once
+	handler := http.NewServeMux()
+	authorized := func(response http.ResponseWriter, request *http.Request) bool {
+		if request.Header.Get(qualificationProcessTokenHeader) != config.Token {
+			http.Error(response, "unauthorized", http.StatusUnauthorized)
+			return false
+		}
+		return true
+	}
+	handler.HandleFunc("/snapshot", func(response http.ResponseWriter, request *http.Request) {
+		if request.Method != http.MethodGet || !authorized(response, request) {
+			return
+		}
+		snapshot := qualificationGatewayProcessSnapshot{
+			Metrics: server.Metrics(), NativeSetups: backend.setups.Load(), NativeOpens: backend.opens.Load(),
+			PacerReservations: server.pacer.reservations.Load(),
+		}
+		if session := backend.session(config.Authority.SessionID); session != nil {
+			snapshot.MediaIngress = session.mediaIngress.Load()
+			snapshot.MediaRecovered = session.mediaRecovered.Load()
+			snapshot.MediaEnqueued = session.mediaEnqueued.Load()
+			snapshot.MediaDrops = session.mediaDrops.Load()
+			snapshot.MediaQueueMaximum = session.mediaQueueMaximum.Load()
+			snapshot.MediaQueueMaximumBytes = session.mediaQueueMaximumBytes.Load()
+			snapshot.ProviderTelemetry = session.Telemetry()
+			snapshot.VideoReceiveBuffer, snapshot.VideoReceiveBufferAvailable,
+				snapshot.KernelDrops, snapshot.KernelDropsAvailable =
+				qualificationProviderVideoSocketDiagnostics(session.videoConn)
+		}
+		_ = json.NewEncoder(response).Encode(snapshot)
+	})
+	handler.HandleFunc("/record/start", func(response http.ResponseWriter, request *http.Request) {
+		if request.Method != http.MethodPost || !authorized(response, request) {
+			return
+		}
+		var recordRequest qualificationProcessRecordRequest
+		if err := json.NewDecoder(io.LimitReader(request.Body, 4096)).Decode(&recordRequest); err != nil {
+			http.Error(response, "invalid record request", http.StatusBadRequest)
+			return
+		}
+		if err := recorder.start(recordRequest); err != nil {
+			http.Error(response, err.Error(), http.StatusConflict)
+		}
+	})
+	handler.HandleFunc("/record/stop", func(response http.ResponseWriter, request *http.Request) {
+		if request.Method != http.MethodPost || !authorized(response, request) {
+			return
+		}
+		result, err := recorder.stop()
+		if err != nil {
+			http.Error(response, err.Error(), http.StatusConflict)
+			return
+		}
+		_ = json.NewEncoder(response).Encode(result)
+	})
+	handler.HandleFunc("/shutdown", func(response http.ResponseWriter, request *http.Request) {
+		if request.Method != http.MethodPost || !authorized(response, request) {
+			return
+		}
+		shutdownOnce.Do(func() { close(shutdown) })
+	})
+	control, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatal(err)
+	}
+	controlServer := &http.Server{Handler: handler, ReadHeaderTimeout: time.Second}
+	go func() { _ = controlServer.Serve(control) }()
+	ready, err := json.Marshal(qualificationGatewayProcessReady{
+		GatewayAddress: server.Addr().String(), ControlAddress: control.Addr().String(),
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(config.ReadyPath, ready, 0o600); err != nil {
+		t.Fatal(err)
+	}
+	<-shutdown
+	_, _ = recorder.stop()
+	cancel()
+	_ = server.Close()
+	_ = controlServer.Shutdown(context.Background())
+	if err := <-serveDone; err != nil {
+		t.Fatal(err)
+	}
+}

gateway/qualification_socket_other_test.go

@@ -0,0 +1,11 @@
+//go:build !darwin && !linux
+
+package gateway
+
+import "net"
+
+func qualificationProcessCPUSeconds() float64 { return -1 }
+
+func qualificationProviderVideoSocketDiagnostics(*net.UDPConn) (receiveBuffer int, receiveBufferAvailable bool, kernelDrops uint64, kernelDropsAvailable bool) {
+	return 0, false, 0, false
+}

gateway/qualification_socket_unix_test.go

@@ -0,0 +1,80 @@
+//go:build darwin || linux
+
+package gateway
+
+import (
+	"io"
+	"net"
+	"os"
+	"runtime"
+	"strconv"
+	"strings"
+	"syscall"
+)
+
+func qualificationProcessCPUSeconds() float64 {
+	var usage syscall.Rusage
+	if syscall.Getrusage(syscall.RUSAGE_SELF, &usage) != nil {
+		return -1
+	}
+	return float64(usage.Utime.Sec+usage.Stime.Sec) +
+		float64(usage.Utime.Usec+usage.Stime.Usec)/1_000_000
+}
+
+func qualificationProviderVideoSocketDiagnostics(connection *net.UDPConn) (receiveBuffer int, receiveBufferAvailable bool, kernelDrops uint64, kernelDropsAvailable bool) {
+	if connection == nil {
+		return 0, false, 0, false
+	}
+	raw, err := connection.SyscallConn()
+	if err != nil {
+		return 0, false, 0, false
+	}
+	var inode uint64
+	var socketErr error
+	if err := raw.Control(func(descriptor uintptr) {
+		receiveBuffer, socketErr = syscall.GetsockoptInt(int(descriptor), syscall.SOL_SOCKET, syscall.SO_RCVBUF)
+		if runtime.GOOS == "linux" {
+			var stat syscall.Stat_t
+			if statErr := syscall.Fstat(int(descriptor), &stat); statErr == nil {
+				inode = stat.Ino
+			}
+		}
+	}); err != nil || socketErr != nil {
+		return 0, false, 0, false
+	}
+	receiveBufferAvailable = true
+	if runtime.GOOS == "linux" {
+		kernelDrops, kernelDropsAvailable = qualificationLinuxUDPDrops(inode)
+	}
+	return receiveBuffer, receiveBufferAvailable, kernelDrops, kernelDropsAvailable
+}
+
+func qualificationLinuxUDPDrops(inode uint64) (uint64, bool) {
+	if inode == 0 {
+		return 0, false
+	}
+	inodeText := strconv.FormatUint(inode, 10)
+	for _, path := range []string{"/proc/net/udp", "/proc/net/udp6"} {
+		file, err := os.Open(path)
+		if err != nil {
+			continue
+		}
+		raw, readErr := io.ReadAll(io.LimitReader(file, 1<<20))
+		closeErr := file.Close()
+		if readErr != nil || closeErr != nil {
+			continue
+		}
+		for _, line := range strings.Split(string(raw), "\n") {
+			fields := strings.Fields(line)
+			if len(fields) < 11 || fields[9] != inodeText {
+				continue
+			}
+			drops, err := strconv.ParseUint(fields[len(fields)-1], 10, 64)
+			if err != nil {
+				return 0, false
+			}
+			return drops, true
+		}
+	}
+	return 0, false
+}

gateway/resource_test.go

@@ -1,6 +1,7 @@
 package gateway
 
 import (
+	"context"
 	"net"
 	"testing"
 	"time"
@@ -17,6 +18,24 @@ func TestGatewaySlowReaderStillCleansUpWithinBound(t *testing.T) {
 	harness.waitReleased(t)
 }
 
+func TestGatewayDropsVideoPastQueueResidenceBound(t *testing.T) {
+	harness := newGatewayTransportHarness(t)
+	harness.drainInitialMedia(t)
+	before := harness.server.Metrics().MediaDrops
+	harness.session.video <- ProviderMedia{
+		Payload: []byte("stale-complete-frame"), ReceivedAt: time.Now().Add(-time.Second),
+		EnqueuedAt: time.Now().Add(-nativeApolloVideoQueueLatency - time.Millisecond),
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), 150*time.Millisecond)
+	defer cancel()
+	if frame, err := harness.client.ReceiveFrame(ctx); err == nil {
+		t.Fatalf("expired provider frame crossed the public transport: %#v", frame)
+	}
+	if drops := harness.server.Metrics().MediaDrops - before; drops != 1 {
+		t.Fatalf("expired queue drops = %d, want 1", drops)
+	}
+}
+
 func TestGatewayMalformedUDPDoesNotAmplify(t *testing.T) {
 	harness := newGatewayTransportHarness(t)
 	connection, err := net.DialUDP("udp", nil, harness.server.Addr().(*net.UDPAddr))

gateway/telemetry.go

@@ -126,6 +126,7 @@ type fairPacer struct {
 type fairPacerFlow struct {
 	next     time.Time
 	lastSeen time.Time
+	debt     time.Duration
 }
 
 const fairPacerMaximumCatchup = 5 * time.Millisecond
@@ -180,9 +181,14 @@ func (p *fairPacer) reserveAt(now time.Time, flow string, bytes int) time.Time {
 		base = now
 	} else if lag := now.Sub(base); lag > fairPacerMaximumCatchup {
 		base = now.Add(-fairPacerMaximumCatchup)
+		state.debt = min(state.debt+lag-fairPacerMaximumCatchup, nativeApolloVideoQueueLatency-fairPacerMaximumCatchup)
 	}
 	numerator := int64(bytes) * int64(len(p.flows)) * int64(time.Second)
 	delay := time.Duration((numerator + p.bytesPerSecond - 1) / p.bytesPerSecond)
+	if repayment := min(delay/21, state.debt); repayment > 0 {
+		delay -= repayment
+		state.debt -= repayment
+	}
 	state.next = base.Add(delay)
 	p.flows[flow] = state
 	return state.next

gateway/transport.go

@@ -77,6 +77,13 @@ type ServerConfig struct {
 	ProviderProfile        string
 	ProviderIdentity       string
 	PacerKbps              int64
+	mediaObserver          func(mediaTimingObservation)
+}
+
+type mediaTimingObservation struct {
+	QueueDelay      time.Duration
+	ProcessingDelay time.Duration
+	PacingDelay     time.Duration
 }
 
 type Server struct {
@@ -666,6 +673,14 @@ func (s *gatewaySession) mediaLoop() {
 				video = nil
 				continue
 			}
+			if media.expiry != nil {
+				media.expiry.Stop()
+			}
+			media.releaseQueue()
+			if !media.EnqueuedAt.IsZero() && time.Since(media.EnqueuedAt) > nativeApolloVideoQueueLatency {
+				s.server.metrics.MediaDrops.Add(1)
+				continue
+			}
 			if err := s.forwardMedia(ChannelVideo, media); err != nil {
 				s.result <- err
 				return
@@ -725,11 +740,17 @@ func (s *gatewaySession) sendMedia(channel byte, media ProviderMedia) error {
 		s.server.metrics.MediaPackets.Add(1)
 		s.server.metrics.MediaBytes.Add(uint64(len(encoded)))
 	}
-	processingDelay := media.EnqueuedAt.Sub(media.ReceivedAt) + time.Since(processingStarted) - pacingDelay
-	s.server.metrics.QueueDelayNanos.Add(uint64(dequeuedAt.Sub(media.EnqueuedAt)))
-	s.server.metrics.ProcessingDelayNanos.Add(uint64(max(processingDelay, 0)))
+	queueDelay := dequeuedAt.Sub(media.EnqueuedAt)
+	processingDelay := max(media.EnqueuedAt.Sub(media.ReceivedAt)+time.Since(processingStarted)-pacingDelay, 0)
+	s.server.metrics.QueueDelayNanos.Add(uint64(queueDelay))
+	s.server.metrics.ProcessingDelayNanos.Add(uint64(processingDelay))
 	s.server.metrics.PacingDelayNanos.Add(uint64(pacingDelay))
 	s.server.metrics.ProcessingSamples.Add(1)
+	if s.server.config.mediaObserver != nil {
+		s.server.config.mediaObserver(mediaTimingObservation{
+			QueueDelay: queueDelay, ProcessingDelay: processingDelay, PacingDelay: pacingDelay,
+		})
+	}
 	return nil
 }
 

go.mod

@@ -3,7 +3,7 @@ module git.sechmachine.io.vn/sechmachine/VerseVDI-Data-Plane
 go 1.26.5
 
 require (
-	git.sechmachine.io.vn/sechmachine/VerseVDI-Protocol v1.0.0-phase3c-gateway-rc.8
+	git.sechmachine.io.vn/sechmachine/VerseVDI-Protocol v1.0.0-phase3c-gateway-rc.10
 	github.com/quic-go/quic-go v0.61.0
 )
 

go.sum

@@ -10,6 +10,10 @@ git.sechmachine.io.vn/sechmachine/VerseVDI-Protocol v1.0.0-phase3c-gateway-rc.7
 git.sechmachine.io.vn/sechmachine/VerseVDI-Protocol v1.0.0-phase3c-gateway-rc.7/go.mod h1:7PhFIDhjtr20btWoEb2GqB+7dBpzJt43olrnHVutWoc=
 git.sechmachine.io.vn/sechmachine/VerseVDI-Protocol v1.0.0-phase3c-gateway-rc.8 h1:DqD2I3bjiVt+mr741o7hw4wDUp2vYZx32CNDSkqADwY=
 git.sechmachine.io.vn/sechmachine/VerseVDI-Protocol v1.0.0-phase3c-gateway-rc.8/go.mod h1:7PhFIDhjtr20btWoEb2GqB+7dBpzJt43olrnHVutWoc=
+git.sechmachine.io.vn/sechmachine/VerseVDI-Protocol v1.0.0-phase3c-gateway-rc.9 h1:X7v4Xcjs2xuxcRv95w22gpBYz7Fv+LFAe4lSB2GooBM=
+git.sechmachine.io.vn/sechmachine/VerseVDI-Protocol v1.0.0-phase3c-gateway-rc.9/go.mod h1:7PhFIDhjtr20btWoEb2GqB+7dBpzJt43olrnHVutWoc=
+git.sechmachine.io.vn/sechmachine/VerseVDI-Protocol v1.0.0-phase3c-gateway-rc.10 h1:9KcV44asmhURVQJ6NbuRXaoTf0UI7Zmx/b3b2/kfHlM=
+git.sechmachine.io.vn/sechmachine/VerseVDI-Protocol v1.0.0-phase3c-gateway-rc.10/go.mod h1:7PhFIDhjtr20btWoEb2GqB+7dBpzJt43olrnHVutWoc=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=

openspec/changes/archive/2026-07-30-correct-gateway-qualification-evidence/.openspec.yaml

@@ -0,0 +1,2 @@
+schema: spec-driven
+created: 2026-07-30

openspec/changes/archive/2026-07-30-correct-gateway-qualification-evidence/design.md

@@ -0,0 +1,36 @@
+## Context
+
+The qualification driver already reaches the production Apollo-to-QUIC path, but its source shaper reorders jitter even when reorder is disabled, its packet accounting cannot identify unexplained loss, and in-process resource counters include the provider/client driver.
+
+## Goals / Non-Goals
+
+**Goals:**
+
+- Attribute every source unit to one bounded production-path outcome.
+- Keep impairment axes independently configured and observed.
+- Sample CPU, heap, allocation, and goroutine use from the gateway process only.
+- Record measured monotonic-clock overhead.
+
+**Non-Goals:**
+
+- No second simulator, profiling service, production dependency, or expanded impairment matrix.
+- No larger queues or relaxed acceptance limits without measured need.
+
+## Decisions
+
+- Reuse the existing source-boundary shaper, preserve source order unless explicit reorder is enabled, and limit catch-up to one media serialization interval. Record the fixed-seed applied-delay standard deviation separately from the jitter observed after ordered traversal.
+- Drive processing sends at the configured source rate while a separate public-client receive loop validates ordered payload delivery. Use cooperative scheduling with a bounded high-resolution final wait in the parent driver so sub-millisecond packet spacing does not depend on host sleep granularity.
+- Assign stable source sequence identifiers and retain per-stage counts so injected loss, provider/FEC drop, queue replacement, QUIC failure, and client miss are disjoint.
+- Reuse the established gateway child-test pattern for the actual gateway server; the Apollo fixture and QUIC client remain in the parent driver. A token-protected loopback test control endpoint starts and stops bounded child-owned recording and returns aggregate stage state.
+- Stream queue, processing, and pacing samples from the production `sendMedia` boundary to child-owned raw evidence. Sample child `RUSAGE_SELF`, Go heap, allocations, and goroutines once per second with independent per-run baselines.
+- Buffer at most 4,096 child-owned timing samples before the gzip writer; encode rows into a reused byte buffer, drain every sample before recording stops, and backpressure on sustained writer overload instead of dropping evidence or formatting/compressing synchronously in the media loop.
+- Bound native video at 256 packets (about 30 ms and less than 0.4 MiB per session at the largest fixture unit) after the sustained public-path regression observed a 141-packet scheduler/GC stall with the 64-packet bound; keep audio and events at 16 and retain latest-unit replacement. Sample heap objects, allocated objects/bytes, and live goroutines through `runtime/metrics` while retaining `RUSAGE_SELF` for CPU.
+- Measure clock overhead as the median elapsed time per read across 1,000 batches of 100 monotonic reads and record that method.
+
+## Risks / Trade-offs
+
+- [Ordered release suppresses some delivered jitter] → Retain both the applied fixed-seed delay distribution and the separately observed ordered-traversal jitter.
+- [Stage attribution double-counts a unit] → Record one terminal outcome per source sequence and validate accounting equality.
+- [Process sampling perturbs qualification] → Use bounded low-rate samples and include the sampling method in evidence.
+- [The source driver consumes CPU for precise pacing] → Keep it in the parent process excluded by the gateway-only resource sampler, and yield cooperatively until the final 50 microseconds.
+- [Shared private runners cannot sustain the reviewed 20/50/80 Mbps gates] → Run the complete verifier on the registered on-demand xhigh runner; the frozen qualification remains authoritative for the normative duration.

openspec/changes/archive/2026-07-30-correct-gateway-qualification-evidence/proposal.md

@@ -0,0 +1,25 @@
+## Why
+
+RC8 qualification evidence cannot support candidate readiness because clean traffic loses packets without stage attribution, reorder-off jitter reorders traffic, and resource counters include the provider/client driver rather than the gateway process alone.
+
+## What Changes
+
+- Attribute every production-path packet outcome at the source fixture, native provider queue, gateway forwarding, QUIC, and public-client stages.
+- Preserve source order for reorder-off profiles while retaining configured latency and jitter; inject bounded reorder only when enabled.
+- Measure gateway CPU, heap, allocations, and goroutines from the gateway process only, with isolated per-profile counters.
+- Measure and record bounded nonzero monotonic-clock overhead using a batched method.
+- Retain the existing six-profile matrix and real provider-to-public-client traversal.
+
+## Capabilities
+
+### New Capabilities
+
+None.
+
+### Modified Capabilities
+
+- `gateway-qualification`: Require attributable clean-path delivery, independent impairment axes, gateway-process-only resource evidence, and truthful timing-overhead evidence.
+
+## Impact
+
+P3C-002, P3C-026, P3C-028, P3C-029, and P3C-033; the GPL Data Plane qualification driver, production gateway subprocess boundary, raw evidence, and append-only Phase 3C-G evidence. No Protocol wire contract, provider route, transcode path, or closed Server dependency is introduced.

openspec/changes/archive/2026-07-30-correct-gateway-qualification-evidence/specs/gateway-qualification/spec.md

@@ -0,0 +1,27 @@
+## MODIFIED Requirements
+
+### Requirement: Fixed media processing qualification
+The qualification harness SHALL drive pinned-mTLS Apollo management, encrypted RTSP, ENet, and provider UDP through native source validation, `readUDPMedia`, recovery/FEC, bounded production queues, the production fair pacer, Verse framing/QUIC, and a public or independent client decoder for 1080p60 H.264 at 20 Mbps, 1440p120 HEVC at 50 Mbps, and 4K60 HEVC at 80 Mbps. After a recorded warm-up, the frozen candidate SHALL run each profile for ten wall-clock minutes, preserve encoded payload bytes, retain every monotonic processing sample plus bounded provider-queue observations, and report count, min, median, p90, p95, p99, max, mean, standard deviation, measured batched monotonic-clock overhead and method, and observed bitrate. Processing begins at complete provider-unit receipt and ends at QUIC handoff, excluding client transit and pacing. Queue delay SHALL measure provider-queue residence, processing SHALL measure gateway work before pacing, and pacing delay SHALL measure scheduler waiting. Native queues SHALL remain bounded at 256 video packets and 16 audio or event units per session, retaining latest-unit replacement. CPU, heap, allocations, and goroutines SHALL be measured from the isolated gateway process only; CPU SHALL be actual OS user plus system consumption and MUST NOT include idle wall capacity or unrelated parent fixture/client work. Successive profiles SHALL use independent resource-counter baselines. Any bypass, payload mutation, wall-duration violation, bitrate outside both lower and upper bounds, unexplained clean-path loss, zero or unbounded clock overhead, or p95 above 5 ms SHALL fail.
+
+#### Scenario: Healthy fixed profile
+- **WHEN** a frozen candidate runs one fixed profile for the normative duration in the isolated qualification command
+- **THEN** the harness emits compressed raw path and gateway-process resource samples plus a summary tied to the exact command, CPU scope, timing-overhead method, topology, source commit, immutable Protocol version, environment, and payload hash
+
+#### Scenario: Processing gate failure
+- **WHEN** any production path stage lacks a per-traversal observation, stage accounting does not balance, payload integrity fails, duration or bitrate bounds fail, measured p95 exceeds 5 ms, parent work changes gateway CPU, idle capacity is reported as consumed CPU, or timing overhead is absent
+- **THEN** the qualification command exits unsuccessfully without recording a passing candidate
+
+### Requirement: Bounded impairment qualification
+The harness SHALL run exactly the baseline, latency, jitter, loss, reorder, and constrained Section 7.2 profiles once by applying fixed-seed impairment at the source-shaped provider network boundary while traffic concurrently traverses the production gateway path. Baseline SHALL cover all three media profiles and the other profiles SHALL cover 1080p60. The harness MUST NOT serialize a complete provider-to-client traversal per source unit. Reorder-off profiles SHALL preserve source order through an ordered delay queue whose catch-up is limited to one media serialization interval; the fixed-seed applied-delay distribution and jitter observed after ordered traversal SHALL be reported separately. Loss-only traffic SHALL NOT gain implicit reorder. Reorder-on profiles SHALL inject and record only the fixed bounded reorder pattern. Each source unit SHALL have one attributable outcome across source emission, injected drop, native provider/FEC handling, bounded queue replacement, gateway forwarding, QUIC send/receive, and public-client delivery. Each artifact SHALL retain raw impairment and queue observations and record tool version, exact command/configuration, environment, candidate commit, immutable Protocol version, direction, queue discipline, topology, fixed seed, observed one-way latency, acknowledged Apollo ENet RTT, applied and observed jitter, injected and unexplained loss, reorder, throughput, drops, and capacity-step statistics.
+
+#### Scenario: Complete six-profile run
+- **WHEN** the frozen candidate runs impairment qualification
+- **THEN** one result exists for each named profile, configured and observed impairment axes remain separately attributable, reorder-off profiles preserve source order, RTT comes from real request/response acknowledgement timing, and raw statistics come from actual traversal
+
+#### Scenario: Clean production traversal
+- **WHEN** 10,000 source packets traverse a zero-loss baseline profile
+- **THEN** stage accounting identifies every packet and fails on any unexplained loss while each fixed media bitrate remains within its reviewed healthy-path contract
+
+#### Scenario: Unsupported or unbounded configuration
+- **WHEN** a profile name, packet count, queue bound, loss, reorder, or bandwidth step falls outside the fixed catalog
+- **THEN** the harness rejects it before allocating or running traffic

openspec/changes/archive/2026-07-30-correct-gateway-qualification-evidence/tasks.md

@@ -0,0 +1,23 @@
+## 1. Loss Attribution
+
+- [x] 1.1 Add a 10,000-packet production-path regression that records source, injected-drop, provider/FEC, queue, gateway, QUIC, and public-client outcomes
+- [x] 1.2 Reproduce and repair unexplained zero-loss baseline loss without relaxing bounds or hiding drops
+- [x] 1.3 Prove all three fixed baseline bitrates meet the healthy-path contract
+
+## 2. Impairment Semantics
+
+- [x] 2.1 Add fixed-seed regressions for reorder-off jitter, loss-only order, and bounded reorder-on behavior
+- [x] 2.2 Repair the existing source-boundary shaper and retain separately attributable configured and observed axes
+
+## 3. Resource and Timing Attribution
+
+- [x] 3.1 Add child-process regressions proving gateway-only CPU, heap, allocation, and goroutine samples
+- [x] 3.2 Prove parent CPU isolation, idle/work behavior, and independent per-profile counter baselines
+- [x] 3.3 Measure and record bounded nonzero batched monotonic-clock overhead and method
+
+## 4. Verification and Evidence
+
+- [x] 4.1 Run focused production-path, race, fuzz, cancellation, slow-reader, amplification, parser-resource, and bounded soak checks
+- [x] 4.2 Run strict OpenSpec validation, normal-module verification, and reproducible Linux artifact inspection
+- [x] 4.3 Freeze all executable inputs and run the corrected normative Section 7 qualification once for the candidate
+- [x] 4.4 Preserve failed attempts and append superseding evidence and ledger rows without rewriting RC8

openspec/changes/complete-encoded-frame-transport/.openspec.yaml

@@ -0,0 +1,2 @@
+schema: spec-driven
+created: 2026-07-30

openspec/changes/complete-encoded-frame-transport/design.md

@@ -0,0 +1,33 @@
+## Context
+
+`FragmentPayload` currently stops at 16 × 1,179 bytes and the independent test client assumes ordered fragments. Native Apollo output enters count-only buffered channels, so realistic complete frames have neither a byte ceiling nor an explicit residence bound.
+
+## Goals / Non-Goals
+
+**Goals:**
+
+- Implement Protocol datagram-v2 for complete encoded frames up to 1 MiB.
+- Reassemble bounded duplicate/reordered QUIC datagrams independently.
+- Bound native video queue count, bytes, and residence time while retaining latest-frame replacement and drop telemetry.
+
+**Non-Goals:**
+
+- Codec inspection, retransmission, provider fallback, generic queue/transport APIs, or Server behavior changes.
+
+## Decisions
+
+- Keep the existing `Frame`/QUIC path and add version-aware encode/decode rather than a second transport.
+- Use one sequence per provider frame and the Protocol 1,177-byte fragment size.
+- Keep the existing native video channel at 16 entries, add exact atomic byte
+  accounting capped at 4 MiB, and use per-entry timers for the 250 ms residence
+  bound. This matches the Protocol's reviewed incomplete-unit timeout and covers
+  bounded keyframe serialization; the transport performs a final stale check.
+- Audio and events keep their independent existing limits.
+
+## Risks / Trade-offs
+
+- [Latest-frame eviction drops decodable dependencies] → preserve truthful drops and existing IDR feedback; never grow memory or block every session.
+- [Large frames multiply fragment sends] → cap both complete bytes and fragment count before allocation.
+- [Expiry races with dequeue or cleanup] → stop each package-private timer on
+  dequeue/replacement, serialize channel expiry and close, and retain the
+  transport stale check.

openspec/changes/complete-encoded-frame-transport/proposal.md

@@ -0,0 +1,24 @@
+## Why
+
+The production gateway cannot forward complete encoded video frames larger than 18,864 bytes, and its native video queue is bounded only by entry count. Realistic Phase 3C frame distributions therefore fail before QUIC delivery or can consume unreviewed memory.
+
+## What Changes
+
+- Implement the Protocol-owned complete-frame datagram profile and independent bounded client reassembly.
+- Relay full recovered Apollo frames without mutation or unrelated sequence splitting.
+- Bound native video queuing by frame count, encoded bytes, and residence time with latest-frame replacement and truthful drops.
+- Preserve independent audio and event bounds and all no-transcode/provider isolation rules.
+
+## Capabilities
+
+### New Capabilities
+
+- `complete-encoded-frame-transport`: Production fragmentation, reassembly, and byte/latency/count-bounded native frame queuing.
+
+### Modified Capabilities
+
+None.
+
+## Impact
+
+Gateway framing, native Apollo media queues, QUIC send/receive tests, telemetry, and bounded resource checks. No new dependency or Server change. Requirements: P3C-006–P3C-009, P3C-025, P3C-026, P3C-028, P3C-030, P3C-038, VER-001, VER-006, VER-010.

openspec/changes/complete-encoded-frame-transport/specs/complete-encoded-frame-transport/spec.md

@@ -0,0 +1,35 @@
+## ADDED Requirements
+
+### Requirement: Production transport preserves complete encoded frames
+The gateway SHALL carry each recovered Apollo encoded frame as one Protocol datagram-v2 sequence, preserve exact bytes and frame boundaries through the production media queue, pacer, QUIC transport, and independent reassembler, and reject frames outside Protocol bounds before forwarding.
+
+#### Scenario: Large source-shaped frame
+- **WHEN** Apollo UDP/FEC recovers a valid encoded frame above 18,864 bytes within the reviewed maximum
+- **THEN** the independent client receives one byte-identical frame with the same boundary
+
+#### Scenario: Invalid fragment stream
+- **WHEN** fragments are oversized, inconsistent, conflicting duplicates, outside the reorder/state/time bounds, or claim an oversized frame
+- **THEN** the client emits no partial payload and bounded state is released
+
+### Requirement: Native video queue has count byte and latency bounds
+The native provider video queue SHALL retain at most 16 complete frames, at
+most 4 MiB of encoded frame bytes, and no frame for more than 250 milliseconds.
+It SHALL replace the oldest entry when full, expire stale entries independently
+of queue activity, and increment truthful drop telemetry for every replacement
+or expiry. Cleanup and cancellation MUST stop expiry work and release all queued
+payload references.
+
+#### Scenario: Sustained realistic frames
+- **WHEN** a provider produces realistic variable-size complete frames faster than a slow Verse reader can forward them
+- **THEN** retained entries, bytes, and age remain within the reviewed per-session limits and newer frames continue to progress
+
+#### Scenario: Session cleanup
+- **WHEN** a session terminates, disconnects, or is cancelled with queued video
+- **THEN** queued frames are released, blocked readers wake, and no media crosses after quiescence
+
+### Requirement: Other provider queues remain independently bounded
+Audio and provider event queues SHALL retain independent count and payload bounds and MUST NOT share the video byte budget.
+
+#### Scenario: Video saturation
+- **WHEN** the video queue reaches its byte or age bound
+- **THEN** audio and terminal event delivery retain their existing independent bounded capacity

openspec/changes/complete-encoded-frame-transport/tasks.md

@@ -0,0 +1,20 @@
+## 1. Red production path
+
+- [x] 1.1 Add a public Apollo-UDP-to-independent-client regression for complete frames above 18,864 bytes
+- [x] 1.2 Add malformed, duplicate, reorder, timeout, and maximum-allocation reassembly cases
+
+## 2. Complete-frame transport
+
+- [x] 2.1 Implement negotiated datagram-v2 fragmentation and bounded independent reassembly
+- [x] 2.2 Prove deterministic 1080p60, 1440p120, and 4K60 frame distributions preserve exact bytes and boundaries
+
+## 3. Native queue bounds
+
+- [x] 3.1 Add sustained realistic-frame regressions for count, byte, latency, cleanup, cancellation, slow-reader, and amplification bounds
+- [x] 3.2 Bound the existing native video channel by 16 entries, 4 MiB, and 250 ms with latest-frame replacement and truthful drops
+- [x] 3.3 Preserve independent bounded audio and terminal event paths
+
+## 4. Verification
+
+- [x] 4.1 Run focused framing, native media, queue, race, cancellation, and resource checks
+- [x] 4.2 Run strict OpenSpec validation and the final affected Data Plane verification once

openspec/changes/deterministic-gateway-sbom/.openspec.yaml

@@ -0,0 +1,2 @@
+schema: spec-driven
+created: 2026-07-30

openspec/changes/deterministic-gateway-sbom/design.md

@@ -0,0 +1,28 @@
+## Context
+
+The repository already produces reproducible pure-Go Linux binaries and can read exact Go module/build metadata. A standard deterministic document is missing; adding an external SBOM tool is unnecessary for this bounded artifact.
+
+## Goals / Non-Goals
+
+**Goals:**
+
+- Generate byte-stable SPDX 2.3 JSON with Go standard library encoding.
+- Describe the repository, Protocol dependency, all resolved modules, both Linux binaries, relationships, hashes, architectures, notices, and truthful licenses.
+
+**Non-Goals:**
+
+- Vulnerability scanning, signing, image remediation, public release, or inferred license conclusions.
+
+## Decisions
+
+- Use a small repository command that reads each binary with
+  `debug/buildinfo`, verifies Linux architecture and cgo settings, and compares
+  embedded module inventories before sorting every package and relationship.
+- Use fixed SPDX identifiers and a source-date timestamp supplied by the caller; reject dirty/ambiguous inputs rather than embedding current time.
+- Use `NOASSERTION` for unavailable concluded/declared license evidence and record no vulnerability result.
+
+## Risks / Trade-offs
+
+- [Go module metadata lacks complete license conclusions] → retain notices and use `NOASSERTION`.
+- [Artifact paths make output host-dependent] → encode architecture, filename, size, and digest only.
+- [A hand-built serializer could drift] → validate required SPDX fields and require byte-identical double generation.

openspec/changes/deterministic-gateway-sbom/proposal.md

@@ -0,0 +1,24 @@
+## Why
+
+The gateway has reproducible Linux binaries and a dependency inventory but no deterministic standard SBOM, while OPS-009 and the Phase 3C gateway plan require one for engineering exit.
+
+## What Changes
+
+- Generate byte-stable SPDX 2.3 JSON using repository, Go module, and artifact metadata.
+- Record exact source revision, immutable Protocol version/checksum, module relationships, Linux artifact hashes and architectures, and truthful license fields.
+- Retain notices/provenance and use `NOASSERTION` where license evidence is unavailable.
+- Keep vulnerability scanning, signing, and Phase 3C-C image remediation explicitly separate.
+
+## Capabilities
+
+### New Capabilities
+
+None.
+
+### Modified Capabilities
+
+- `gateway-deployment-artifact`: Require an inspected deterministic standard SBOM for shipped gateway binaries.
+
+## Impact
+
+Data Plane packaging tooling, deterministic tests, Makefile targets, canonical deployment-artifact OpenSpec, and evidence records. Uses Go standard library only; no new dependency. Requirements: SYS-019, P3C-002, P3C-035, OPS-009, VER-015, VER-017.

openspec/changes/deterministic-gateway-sbom/specs/gateway-deployment-artifact/spec.md

@@ -0,0 +1,12 @@
+## MODIFIED Requirements
+
+### Requirement: Artifact evidence is inspected and truthful
+Candidate evidence SHALL record exact source and immutable Protocol revisions/checksums, artifact hashes, architecture, embedded dependency inventory, container configuration when built, and the actual scanner/signing status. It SHALL include one byte-stable SPDX 2.3 JSON SBOM for the shipped Linux gateway artifacts containing the source package, resolved Go modules, dependency and generated-from relationships, artifact hashes and architectures, retained notices/provenance, and truthful license fields using `NOASSERTION` where evidence is unavailable. It MUST NOT claim a vulnerability result, signature, image architecture, deployment, or license conclusion that was not produced and inspected.
+
+#### Scenario: Deterministic gateway SBOM
+- **WHEN** the canonical SBOM command runs twice with the same clean source revision, Protocol module/checksum, module graph, source date, and Linux artifacts
+- **THEN** both SPDX JSON outputs are byte-identical and every declared artifact/module relationship and hash matches the inspected inputs
+
+#### Scenario: Supplemental scanner is unavailable
+- **WHEN** no qualifying vulnerability scanner is available in the frozen environment
+- **THEN** the artifact remains explicitly unscanned and unsigned, the deterministic SBOM/compiler/dependency/boundary evidence is retained, and no zero-finding security claim is emitted

openspec/changes/deterministic-gateway-sbom/tasks.md

@@ -0,0 +1,14 @@
+## 1. Red deterministic contract
+
+- [x] 1.1 Add a focused test requiring SPDX 2.3 fields, source/Protocol/module relationships, two architectures, and exact artifact hashes
+- [x] 1.2 Prove current packaging cannot produce the required standard SBOM
+
+## 2. Standard-library generator
+
+- [x] 2.1 Implement bounded deterministic SPDX JSON generation from explicit build and Go module metadata
+- [x] 2.2 Record truthful license fields, notices/provenance, unscanned status, and no signing claim
+
+## 3. Verification
+
+- [x] 3.1 Prove byte-stable regeneration and rejection of dirty, missing, mismatched, or ambiguous inputs
+- [x] 3.2 Reconcile the deployment-artifact canonical spec and run strict validation

openspec/changes/truthful-fixed-frame-qualification/.openspec.yaml

@@ -0,0 +1,2 @@
+schema: spec-driven
+created: 2026-07-30

openspec/changes/truthful-fixed-frame-qualification/design.md

@@ -0,0 +1,66 @@
+## Context
+
+The current harness sends one fixed 1,179-byte payload per logical sample. It reaches the production path but does not represent encoded frames at 60/120 FPS or exercise realistic fragmentation, reassembly, queue bytes, and keyframe pressure.
+
+The complete-frame fixture also must preserve the pinned Apollo source schedule. For each frame it derives packets per millisecond from the raw UDP block size at 80% of 1 Gbps, limits source batches to both 64 KiB and 64 packets, and carries the next-send time into the following frame. Waiting is context-cancellable. This is qualification-fixture behavior only; production transport and queue behavior remain unchanged.
+
+Because the bounded fixture uses loopback rather than a physical 1 Gbps link, v8 writes the first shard of a batch successfully, captures that actual monotonic emission start, and schedules the next batch no earlier than that start plus the current batch's raw-block serialization interval. The persistent schedule carries across frames. A delayed batch therefore remains late instead of collapsing overdue batches into a catch-up burst.
+
+The retained v6 qualification run passed its then-current checks but is superseded because its tight-loop sender contradicted the pinned Apollo schedule. Private Linux runs 123 and 124 remain failed evidence. One local v8 sustained run passed on Darwin, but it is neither Linux proof nor normative Section 7 evidence.
+
+The later Darwin non-sustained pre-CI invocation was not green and was not retried. Its 1440p120 profile delivered the exact 6,250,000 bytes in 120 frames plus all 6,483 source and warm-up shards with zero drops, but measured 46,973.13 kbps over an implied approximately 1.0644383 seconds and failed the 5% throughput gate. Private Linux full verification/artifact retention and the replacement v10 normative run remain open.
+
+Private Linux run 125 at the frozen v8 harness head is retained as failed evidence. Its exact 33-datagram gap between successful fixture writes and production `MediaIngress` equaled the Linux socket's 33 measured kernel UDP drops. The complete-frame queue, fair pacer, QUIC fragmentation, and public decoder were downstream and did not account for the loss.
+
+The one authorized v8 Section 7 invocation at production candidate `55afea72a1487fa071501615d806e68efc0a436b` was consumed and failed. Its directory `gateway-rc10-55afea7` is retained byte-for-byte with two partial processing files and no manifest. The failure occurred at payload sequence 16801 after 16,834 provider frames had been recovered and enqueued; the provider queue reached 15 entries and dropped one valid frame while source-write and ingress accounting remained balanced at the diagnostic boundary. This attempt is failed evidence and is not eligible for retry or relabeling.
+
+The production fair pacer previously limited instantaneous recovery to 5 ms by moving an overdue flow's schedule to `now-5ms`, but silently discarded every additional valid scheduling interval. Repeated host stalls therefore accumulated complete frames in the existing provider queue until its 250 ms residence horizon correctly expired one. The repair keeps the 5 ms instantaneous ceiling, carries only the remaining debt up to that existing horizon, and shortens later nominal intervals by at most one twenty-first. That 20/21 interval is exactly 5% above nominal rate; once the debt reaches zero, the flow returns to its unchanged nominal interval. Per-flow debt and the shared nominal fair-share calculation preserve the existing eight-flow fairness and rolling aggregate cap through the existing 25% and 50% capacity changes.
+
+Private Linux run 127/job 481 at exact source `122080ab342d20585d9a45db0017337b9ece570a` is retained as failed evidence. `TestQualificationLossAndSteppedThroughputBounds` reported the 25% step's 11-second convergence sentinel and a 5,207,475-byte five-second maximum. No artifact was uploaded and the run was not retried. The retained log `/private/tmp/versevdi-gitea-run-127-job-481.log` has SHA-256 `2b368413d4b0e954c64ba6f6dcefb1e165166d773b6d8f84ee372bc2c92ff5f1`. The failure exposed a measurement-unit defect: capacity samples were emitted only after complete logical-payload reassembly and were compared with a payload-derived target even though the pacer reserves encoded public datagram bytes. It did not establish a production pacer defect, and `122080ab` is superseded as a final source candidate.
+
+Qualification v9 observes every raw public QUIC datagram immediately after the independent client's `ReceiveDatagram` returns and before the existing decoder/reassembler. Capacity convergence and rolling five-second maxima use those monotonic receive times and encoded lengths. Their target bytes per second and five-second cap derive from `qualificationMediaPacerKbps(profile, reduction) * 1000 / 8`. Complete logical-payload observations remain separate and continue to own payload integrity, loss, reorder, latency, throughput, and queue assertions. The first public delivery at or after a step anchors the four consecutive 250 ms windows so an arbitrary control-plane timestamp cannot split the first observed datagram pair. The delivery-after-step boundary, 90%-105% window bounds, ten-second convergence ceiling, and rolling-five-second 105% gate are unchanged.
+
+Private Linux run 128/job 482 was the single push-triggered attempt at exact source `22433e5c45c179e9d487b59e5d80f1dcf3b285ce`. Linux `make verify`, the sustained gate, strict OpenSpec, deterministic artifact generation, upload, and the clean-checkout step passed. Artifact 28's binaries and SPDX matched the frozen hashes and source metadata. The retained log `/private/tmp/versevdi-gitea-run-128-job-482.log` has SHA-256 `6f5852dce815ba87a55d61aae34cb2fce17a1a62c5ee50e18c0034259ad0a029`. The workflow requested 30 retention days, but Gitea 1.27 floored the positive request delay and the API recorded `2026-08-09T23:18:18+07:00` through `2026-09-07T23:18:18+07:00`, exactly 2,505,600 seconds or 29 elapsed days. The run was not retried. It is passing Linux execution and artifact-byte evidence but retention-nonconforming, so it neither satisfies the private Linux artifact gate nor authorizes normative Section 7. The local 31-day request compensates for verified platform rounding without changing the acceptance threshold; a separately authorized future run must prove an API interval of at least 2,592,000 seconds.
+
+At exact source `c0e362c0285d267f8af4087d07943822311f60e1`, the first Section 7 process created mode-0750 `gateway-rc10-c0e362c` and stopped before fixture startup because the sandbox denied its required loopback bind. The directory remains empty as environment-boundary evidence. The separately authorized escalated attempt retained `gateway-rc10-c0e362c-a2`, passed the v9 runtime checks, and wrote 16 files with manifest SHA-256 `61ea55140dfe6b37332de03879ac33206dd5d47763d09fb0fc2f65bb1f8e02b4`. Independent review denied normative acceptance: the constrained logical CSV and manifest aggregates did not persist every raw public QUIC datagram receive offset/encoded length, and `fairness.csv.gz` lacked manifest transition offsets. A2 therefore remains runtime-passing but normative-raw-evidence-incomplete, without mutation or relabeling.
+
+Qualification v10 keeps the logical impairment CSV unchanged and adds only `impairment-constrained-1080p60-h264-wire.csv.gz`. One monotonic epoch is captured before the constrained delivery and transition sequence. The bounded CSV interleaves two explicit transition records with every public datagram observation in monotonic order using `record_type,reduction_percent,transition_after_ns,received_after_ns,encoded_bytes`; transition-only and delivery-only fields remain empty and are validated as such. Its maximum row count is derived from the existing constrained job bound, the frame-fragment count, and the two configured transitions rather than a captured-run row constant. The manifest binds the file name, SHA-256, compressed bytes, total/delivery/transition row counts, timebase, exact transition offsets, and each capacity summary's recomputation source. Each impairment step is recomputed from every delivery at or after its transition through completion, preserving the original v9 classifier semantics even after the next transition. Fairness remains stage-bounded because `runQualificationFleetStage` records each capacity stage as a separate slice; its summaries retain their 25% and 50% offsets relative to the existing fairness CSV epoch.
+
+The independent parser's caller explicitly selects smoke or normative authority. Normative validation requires exactly 10,000 sent logical units and always enforces the ten-second convergence and 105% rolling-cap gates; retained `sent` data cannot weaken them. Both wire and fairness readers reject compressed input before hashing when it exceeds a writer-derived bound, feed gzip output through a bounded standard-library reader before CSV parsing, and bound fields, offsets, flows, and encoded lengths from the canonical row count, schema, time horizon, and writer values. Aggregate-only v9 data and malformed schema/hash/count/order/transition/length or oversized inputs remain rejected.
+
+The ingress repair follows reviewed behavior rather than copying implementation source:
+
+- Apollo `adc5c5a0bd80831ce495434bb16aee2cd4175fb8`, GPL-3.0, `src/stream.cpp:1463-1474,1573-1627`, supplies the 80%-of-1-Gbps raw-block pacing, 64-KiB/64-packet batch cap, and cross-frame send schedule used by the fixture.
+- Moonlight common-C pin `2ea47752c3051d72a64bcca190024e8b354fa1ef`, GPL-3.0, `src/VideoStream.c:28-35,331-333` and `src/PlatformSockets.c:364-405`, supplies the reviewed 2,048-video-packet receive-buffer request and dedicated receive-thread behavior. The cited `VideoStream.c` blob is byte-identical at the local standalone `703a06946861ff82cd33e5e13c59c1b017f7ded9` checkout.
+
+The native provider therefore requests `2,048 * 1,072 = 2,195,456` bytes with `SetReadBuffer()` on the connected video socket immediately after dialing it. A setter error aborts setup; an OS-imposed cap is accepted without privilege or getter dependence. A dedicated drain owns a fixed 2,048-slot FIFO pool. Every slot is 1,433 bytes (`apolloMediaMaximumPacket + 1`), so oversized datagrams remain observably invalid rather than being truncated into the accepted range; packet storage is 2,934,784 bytes (about 2.80 MiB) plus fixed index and timestamp metadata. The existing single decrypt/FEC processor consumes those slots. When every slot is occupied, the drain keeps reading into one fixed 1,433-byte scratch buffer and counts each accepted-size discard in both ingress and drop telemetry; oversized datagrams retain the existing rejection semantics. Socket close cancels the blocking read, and media channels close only after the unchanged audio reader, video drain, and video processor exit. Audio and control behavior are unchanged.
+
+## Goals / Non-Goals
+
+**Goals:**
+
+- Deterministically generate complete variable-size frame units at exact profile frame rates and target bitrates.
+- Include bounded periodic keyframes while preserving exact aggregate bytes.
+- Measure the existing production path and independent reassembly with frame-level accounting.
+
+**Non-Goals:**
+
+- A real encoder, codec parsing, a second simulator, or a normative run before immutable Protocol publication.
+
+## Decisions
+
+- Derive bytes per fixed interval from bitrate and FPS, distribute integer remainder deterministically, and shift bounded bytes into periodic keyframes while keeping the interval total exact.
+- Carry a deterministic frame index/pattern only in the generated payload bytes; no codec semantics are claimed.
+- Keep the existing path/impairment/resource driver and change its unit from datagram payload to complete frame.
+- Keep video decrypt/FEC single-threaded; only the bounded connected-socket drain is separated so crypto stalls cannot become unexplained kernel loss.
+- Preserve valid scheduling debt after bounded host stalls instead of converting it into provider-queue residence; repay it within the existing fair pacer without a new queue, interface, or configured headroom.
+- Classify constrained-capacity evidence from actual public datagram observations and configured wire capacity; do not infer transport timing from completed logical frames.
+- Persist constrained public-wire observations and transition events in one bounded monotonic-offset CSV, recompute impairment summaries from each transition through completion, and bind both impairment and stage-bounded fairness capacity summaries to their retained raw sources.
+- Select smoke versus normative evidence validation through trusted caller input and bound compressed bytes, decompressed bytes, fields, offsets, flows, and encoded lengths before independent CSV parsing.
+
+## Risks / Trade-offs
+
+- [Keyframes can exceed queue budget] → use the reviewed 1 MiB frame ceiling and production byte-bound queue.
+- [Short smoke windows have rounding effects] → assert exact generated totals and report measured duration separately from normative ten-minute gates.
+- [A stalled video processor exhausts the user-space pool] → keep draining into one fixed scratch buffer and attribute accepted-size overflow to existing ingress/drop counters rather than kernel loss or unbounded allocation.
+- [Debt repayment creates a burst or aggregate oversubscription] → retain the 5 ms instantaneous ceiling and limit repayment to a 20/21 nominal interval per flow, with every rolling five-second aggregate window bounded to 105%.

openspec/changes/truthful-fixed-frame-qualification/proposal.md

@@ -0,0 +1,40 @@
+## Why
+
+The existing fixed-profile harness treats each 1,179-byte datagram as an encoded frame, so its reported frame rate, frame boundaries, bitrate, queue pressure, and processing evidence do not model the named 60/120 FPS profiles.
+
+The v6 complete-frame fixture subsequently exposed a source-fidelity defect on ordinary Linux runners: it emitted every UDP shard in one tight loop, unlike pinned Apollo's bounded intra-frame rate and batch schedule. The affected v6 qualification evidence remains retained but is superseded for candidate-readiness purposes.
+
+Private Linux run 125 then demonstrated a separate production-ingress defect after source pacing was corrected: 33 successful fixture writes missing from `MediaIngress` matched 33 measured kernel UDP drops while decrypt/FEC, queue, pacer, QUIC, and client counters remained downstream of the shortfall.
+
+The consumed v8 Section 7 attempt at `55afea72` subsequently failed after accumulated host scheduling delays exposed the production pacer's discarded schedule debt beyond its 5 ms instantaneous catch-up allowance. The retained partial evidence remains failed and supersedes `55afea72` as a final executable candidate.
+
+Private Linux run 127/job 481 at exact source `122080ab342d20585d9a45db0017337b9ece570a` then failed `TestQualificationLossAndSteppedThroughputBounds`: the 25% capacity step reported the 11-second convergence sentinel and 5,207,475 bytes in the measured five-second window. The run produced no artifact and was not retried. Its retained log is `/private/tmp/versevdi-gitea-run-127-job-481.log`, SHA-256 `2b368413d4b0e954c64ba6f6dcefb1e165166d773b6d8f84ee372bc2c92ff5f1`; `122080ab` is superseded as a final source candidate.
+
+Private Linux run 128/job 482 was the single push-triggered attempt at exact source `22433e5c45c179e9d487b59e5d80f1dcf3b285ce`. Linux `make verify`, the sustained gate, strict OpenSpec, deterministic artifact generation, upload, and the clean-checkout step passed. Artifact 28's binaries and SPDX matched the frozen hashes and source metadata. The retained log `/private/tmp/versevdi-gitea-run-128-job-482.log` has SHA-256 `6f5852dce815ba87a55d61aae34cb2fce17a1a62c5ee50e18c0034259ad0a029`. The workflow requested 30 retention days, but Gitea 1.27 floored the positive request delay and its API scheduled exactly 29 elapsed days. The run was not retried: it is passing Linux execution and artifact-byte evidence but retention-nonconforming, so it does not satisfy the private Linux artifact gate or authorize normative Section 7. The local 31-day request preserves the at-least-30-elapsed-day requirement; a separately authorized future run must prove `expires_at - created_at >= 2,592,000` seconds.
+
+At exact source `c0e362c0285d267f8af4087d07943822311f60e1`, the first Section 7 attempt created `gateway-rc10-c0e362c` and stopped at the sandbox loopback-bind boundary, leaving that mode-0750 directory empty. The separately authorized escalated attempt `gateway-rc10-c0e362c-a2` then passed the v9 runtime gates and retained 16 files; its manifest has SHA-256 `61ea55140dfe6b37332de03879ac33206dd5d47763d09fb0fc2f65bb1f8e02b4`. Independent review denied normative acceptance because v9 retained only logical impairment rows and aggregate capacity summaries: it did not retain the raw public datagram timestamps/lengths or fairness transition offsets needed to recompute those summaries. Both attempts remain preserved without relabeling; a2 is runtime-passing but normative-raw-evidence-incomplete.
+
+## What Changes
+
+- Generate deterministic variable-size encoded frame units at the named frame rates and target bitrates, including bounded keyframes.
+- Traverse native Apollo recovery, production queues, the production pacer, QUIC framing, and independent reassembly.
+- Assert frame count/rate, bitrate, exact bytes and boundaries, clean loss attribution, latency, and resource bounds.
+- Decouple native video socket draining from the single decrypt/FEC processor with a fixed provider-scoped receive pool and request the source-backed video receive-buffer size.
+- Retain bounded valid per-flow pacing debt after a host stall and repay it at no more than 5% above nominal fair share.
+- Measure capacity convergence and rolling caps from each raw public QUIC datagram's observed length and receive time while retaining completed logical-payload observations for integrity and traversal results.
+- Persist the constrained public datagram observations and capacity transitions under one monotonic epoch, bind their hash/counts into the v10 manifest, and retain fairness transition offsets for independent recomputation. Impairment summaries use the full delivery tail after each transition; trusted caller input selects normative validation, and bounded readers reject oversized compressed, decompressed, and field data.
+- Keep short smoke tests separate and leave all prior normative artifacts unchanged.
+
+## Capabilities
+
+### New Capabilities
+
+None.
+
+### Modified Capabilities
+
+- `gateway-qualification`: Fixed-profile evidence measures complete encoded frame units rather than one datagram per frame.
+
+## Impact
+
+The qualification harness and its canonical specification, plus the already-reviewed native Apollo video ingress in `gateway/apollo_native.go` and production fair pacer in `gateway/telemetry.go`. This v10 correction changes test-only retained evidence, not production behavior. Downstream complete-frame queues, audio/control ingress, codec/FEC formats, QUIC, dependencies, and public interfaces remain unchanged. No codec operation or normative rerun is included. Requirements: P3C-002, P3C-008, P3C-029, P3C-030, P3C-033, VER-009, VER-010, OPS-015.

openspec/changes/truthful-fixed-frame-qualification/specs/gateway-qualification/spec.md

@@ -0,0 +1,67 @@
+## MODIFIED Requirements
+
+### Requirement: Fixed media processing qualification
+The qualification harness SHALL drive pinned-mTLS Apollo management, encrypted RTSP, ENet, and provider UDP through native source validation, `readUDPMedia`, recovery/FEC, byte/count/latency-bounded production queues, the production fair pacer, Protocol complete-frame fragmentation, Verse framing/QUIC, and an independent bounded client reassembler for 1080p60 H.264 at 20 Mbps, 1440p120 HEVC at 50 Mbps, and 4K60 HEVC at 80 Mbps. The source fixture SHALL emit deterministic variable-size complete encoded frame units at the named 60/120 FPS rate, preserve exact target bytes over each fixed interval, and include bounded larger keyframes without codec operation. After a recorded warm-up, the frozen candidate SHALL run each profile for ten wall-clock minutes, preserve every frame's bytes and boundary, retain every monotonic processing sample plus bounded provider-queue observations, and report frame count, frame rate, bitrate, count, min, median, p90, p95, p99, max, mean, standard deviation, measured batched monotonic-clock overhead and method, and observed bitrate. Processing begins at complete provider-frame receipt and ends at QUIC handoff, excluding client transit and pacing. Queue delay SHALL measure provider-queue residence, processing SHALL measure gateway work before pacing, and pacing delay SHALL measure scheduler waiting. CPU, heap, allocations, and goroutines SHALL be measured from the isolated gateway process only; CPU SHALL be actual OS user plus system consumption and MUST NOT include idle wall capacity or unrelated parent fixture/client work. Successive profiles SHALL use independent resource-counter baselines. Any bypass, payload or boundary mutation, frame-rate/count mismatch, wall-duration violation, bitrate outside both lower and upper bounds, unexplained clean-path loss, zero or unbounded clock overhead, or p95 above 5 ms SHALL fail.
+
+Within each complete frame the source fixture SHALL reproduce pinned Apollo's source schedule by deriving packets per millisecond from the raw UDP block size at 80% of 1 Gbps, bounding each source batch to the smaller of 64 KiB or 64 packets, capturing the monotonic batch start immediately after the first successful shard write, scheduling the next batch no earlier than that start plus the current batch's raw-block serialization interval, carrying that schedule across frames, and making pacing waits context-cancellable. A delayed batch SHALL remain late rather than trigger an overdue catch-up burst.
+
+Native Apollo video ingress SHALL request a 2,195,456-byte socket receive buffer before media ping or worker startup and SHALL drain the connected video socket into a fixed FIFO pool of exactly 2,048 slots before the existing single decrypt/FEC processor. Each slot and the saturation scratch buffer SHALL be `apolloMediaMaximumPacket + 1` bytes so oversized datagrams remain rejected. A full pool SHALL NOT stop socket draining: each successfully read accepted-size discard SHALL increment both media-ingress and media-drop telemetry without allocation, while oversized reads SHALL retain the existing rejection accounting. Socket closure SHALL cancel the video read, and video/audio channels SHALL close only after the audio reader, video drain, and video processor exit. Audio and control ingress SHALL remain unchanged.
+
+The production fair pacer SHALL retain its 5 ms instantaneous catch-up ceiling. When a flow resumes later than that ceiling, it SHALL carry the remaining valid schedule debt only within the existing 250 ms provider-queue horizon and SHALL repay that debt using an interval no shorter than 20/21 of its nominal equal-tier fair-share interval. It SHALL return to the nominal interval when the debt is repaid. Simultaneous debt across eight equal-tier flows and the existing 25% and 50% capacity changes SHALL preserve the existing share-error contract and SHALL NOT exceed 105% of configured aggregate capacity in any rolling five-second window.
+
+Capacity-step convergence and rolling-cap evidence SHALL use the monotonic receive time and encoded length of every raw public QUIC datagram observed immediately after the independent client's `ReceiveDatagram` returns and before decode or reassembly. For each reduction, target bytes per second and the five-second cap SHALL derive from the configured public-wire rate, `qualificationMediaPacerKbps(profile, reduction) * 1000 / 8`. Completed logical-payload observations SHALL remain separate and SHALL continue to measure payload integrity, loss, reorder, latency, throughput, and queue behavior. An impairment capacity step SHALL include every delivery observation at or after its recorded transition through constrained-run completion; a later transition SHALL NOT truncate the earlier step's retained tail. It SHALL anchor measurement windows at the first such public delivery, require four consecutive 250 ms windows between 90% and 105% of its target, converge within ten seconds, and remain at or below 105% in every rolling five-second window.
+
+The constrained profile SHALL retain a bounded gzip CSV containing exactly two capacity-transition records and every observed raw public datagram delivery under one monotonic epoch captured before the constrained sequence. The schema SHALL distinguish transition and delivery records and SHALL contain `record_type`, `reduction_percent`, `transition_after_ns`, `received_after_ns`, and `encoded_bytes`; fields not applicable to a record type SHALL remain empty and SHALL be rejected when populated. The manifest SHALL bind the file name, SHA-256, compressed byte count, total row count, delivery row count, transition row count, monotonic timebase, exact 25% and 50% transition offsets, and each capacity summary's raw recomputation source. The row bound SHALL derive from the configured constrained-job and fragment bounds rather than a prior run's observed row count.
+
+The retained fairness manifest SHALL bind its 25% and 50% transition offsets to the monotonic epoch of `fairness.csv.gz`. Fairness recomputation SHALL remain bounded to each separately collected `runQualificationFleetStage` capacity slice. An independent parser SHALL be able to reconstruct each stage and reproduce the rolling-five-second maximum, configured cap, and exact two-second fairness convergence from the retained raw files and manifest alone. The parser SHALL select normative versus smoke validation only from trusted caller input; normative validation SHALL require exactly 10,000 sent logical units and SHALL enforce the ten-second convergence and 105% rolling-cap gates unconditionally. Compressed, decompressed, row, field, offset, flow, and encoded-length limits SHALL derive from canonical writer schemas, configured row limits, and canonical run horizons and SHALL be enforced before CSV parsing can allocate an unbounded record. Missing raw-wire evidence; a wrong file hash, size, or count; duplicate or missing transitions; negative or nonmonotonic offsets; invalid encoded lengths; completed-logical-frame substitution; populated not-applicable fields; oversized input; or a summary mismatch SHALL fail qualification evidence acceptance.
+
+#### Scenario: Healthy fixed profile
+- **WHEN** a frozen candidate runs one fixed profile for the normative duration in the isolated qualification command
+- **THEN** the harness emits compressed raw frame/path and gateway-process resource samples plus a summary tied to the exact command, CPU scope, timing-overhead method, topology, source commit, immutable Protocol version, environment, and payload hash
+
+#### Scenario: Processing gate failure
+- **WHEN** any production path stage lacks a per-frame observation, stage accounting does not balance, payload or frame boundaries change, duration, frame-rate, frame-count, or bitrate bounds fail, measured p95 exceeds 5 ms, parent work changes gateway CPU, idle capacity is reported as consumed CPU, or timing overhead is absent
+- **THEN** the qualification command exits unsuccessfully without recording a passing candidate
+
+#### Scenario: Source-shaped Apollo pacing is preserved
+- **WHEN** the fixture emits 1,072-byte encrypted video shards with 1,040-byte raw blocks for consecutive complete frames
+- **THEN** it uses 96 packets per millisecond, batches at most 63 shards, records each batch after its first successful shard write, starts each later batch no earlier than the prior batch's raw serialization interval, carries the schedule into the following frame, and emits no shard after a cancelled pacing wait
+
+#### Scenario: Video crypto processing stalls
+- **WHEN** the first video AEAD operation is blocked while a 662-shard keyframe arrives
+- **THEN** all 662 successful connected-socket reads reach media-ingress accounting before processing resumes, and after release the exact complete frame traverses recovery, the bounded production queue, pacer, QUIC, and independent reassembly
+
+#### Scenario: Video ingress pool saturates
+- **WHEN** all 2,048 fixed video slots are occupied
+- **THEN** accepted-size datagrams are deliberately discarded through the fixed scratch buffer and counted as ingress plus drops, oversized datagrams remain rejected, and cancellation closes every media worker without a race or leak
+
+#### Scenario: Repeated media-loop host stalls
+- **WHEN** three approximately 95 ms scheduling debts are introduced at separated completed-public-frame barriers while source recovery continues
+- **THEN** the pacer limits instantaneous catch-up to 5 ms, repays each remaining debt at no more than 5% above nominal fair share, preserves every frame in exact order and bytes without provider or gateway drops, stays within the existing queue bounds, and closes cleanly on cancellation
+
+#### Scenario: Capacity measurement crosses a short transition phase
+- **WHEN** a constrained 1080p flow carries nonzero bounded debt through the approximately 1.572-second 25% phase before the 50% transition
+- **THEN** convergence and rolling-cap checks use the observed 1,200-byte and 25-byte public datagrams against the configured wire targets, while the separately retained completed-payload observations cannot substitute for transport delivery timing
+
+#### Scenario: Aggregate-only capacity evidence is retained
+- **WHEN** a qualification bundle contains logical-frame impairment rows and aggregate capacity summaries but omits raw public-wire rows or fairness transition offsets
+- **THEN** independent evidence validation rejects the bundle as incomplete even if its in-process runtime assertions passed
+
+#### Scenario: Raw capacity evidence is independently recomputed
+- **WHEN** v10 validation reads the retained constrained wire CSV, fairness CSV, and manifest transitions
+- **THEN** it validates bounded schema, hashes, sizes, counts, monotonic offsets, encoded datagram lengths, and transition uniqueness, then exactly reproduces the full-after-transition impairment targets, four consecutive 250 ms convergence windows, every rolling-five-second maximum, and stage-bounded fairness two-second alignment
+
+#### Scenario: Retained counts cannot weaken normative gates
+- **WHEN** a purported normative bundle retains a sent count other than 10,000 or retains an 11-second convergence or over-cap summary
+- **THEN** validation rejects it regardless of any retained field value, while explicitly selected smoke validation still requires exact raw-summary recomputation
+
+#### Scenario: Retained CSV exceeds bounded evidence grammar
+- **WHEN** a wire or fairness gzip exceeds its canonical compressed or decompressed limit or contains an overlong field, out-of-horizon offset, unknown flow, or out-of-range encoded length
+- **THEN** validation rejects it through the bounded standard-library reader before an unbounded CSV record can be allocated
+
+### Requirement: Retained private Linux candidate artifact
+A retained private Linux candidate artifact SHALL have API metadata whose `expires_at - created_at` interval is at least 30 elapsed days (2,592,000 seconds). Workflow intent, cleanup lag, and a local copy SHALL NOT substitute for the recorded API interval. A shorter interval SHALL fail the artifact-retention gate even when execution and artifact bytes pass. The workflow request MAY exceed 30 calendar days only to compensate for verified platform rounding; the acceptance threshold remains at least 30 elapsed days.
+
+#### Scenario: Platform rounding shortens retention
+- **WHEN** a private Linux candidate run passes execution and artifact-byte checks but its artifact API metadata records less than 2,592,000 seconds between creation and expiry
+- **THEN** the artifact-retention gate remains failed until a separately authorized candidate run records an interval of at least 2,592,000 seconds

openspec/changes/truthful-fixed-frame-qualification/tasks.md

@@ -0,0 +1,52 @@
+## 1. Red fixed-profile model
+
+- [x] 1.1 Add deterministic frame-count, frame-rate, bitrate, keyframe, byte-total, and boundary regressions
+- [x] 1.2 Prove the current 1,179-byte one-frame model fails the required profiles
+
+## 2. Production-path qualification
+
+- [x] 2.1 Replace packet payload generation with bounded variable-size complete frame units
+- [x] 2.2 Carry frame-level source, recovery, queue, QUIC, delivery, and loss attribution through the existing path
+- [x] 2.3 Assert frame rate/count, bitrate bounds, exact bytes/boundaries, processing latency, and resource bounds
+
+## 3. Verification
+
+- [x] 3.1 Run short production-path smoke tests for all three profiles and affected impairment accounting
+- [x] 3.2 Validate the active OpenSpec change strictly
+
+## 4. Frozen qualification
+
+- [x] 4.1 Run the earlier single normative Section 7 qualification after immutable Protocol consumer resolution; later audit findings superseded that candidate
+
+## 5. Pinned Apollo source-fidelity remediation
+
+- [x] 5.1 Retain the v6 qualification attempt and mark its passing result superseded by the tight-loop source defect
+- [x] 5.2 Implement v8 post-first-write, non-collapsing complete-frame UDP pacing with persistent cross-frame carry and verify the focused, race, short-resource, and cross-platform compile checks that passed
+- [x] 5.3 Preserve private Linux runs 123 and 124 as failed evidence, the passing local v8 Darwin sustained run as non-Linux and non-normative, and the un-retried failed Darwin non-sustained pre-CI invocation with its exact throughput evidence
+- [ ] 5.4 Run private Linux full verification and retain deterministic Linux artifacts for the frozen v10 evidence descendant
+- [ ] 5.5 Run one separately approved replacement v10 normative Section 7 qualification
+
+## 6. Native video ingress remediation
+
+- [x] 6.1 Preserve run 125 and reproduce its pre-decrypt shortfall with a public 662-shard blocked-AEAD regression
+- [x] 6.2 Add the video-only 2,195,456-byte socket-buffer request, fixed 2,048-slot drain, single processor, overflow accounting, and bounded cancellation tests
+- [ ] 6.3 Freeze the reviewed production repair through the still-open private Linux full-verification and artifact gate before any replacement normative run
+
+## 7. Fair-pacer schedule-debt remediation
+
+- [x] 7.1 Preserve the consumed failed `55afea72` v8 attempt and its two partial files without retry, relabeling, or modification
+- [x] 7.2 Reproduce repeated host-stall queue expiry through the public native path and add bounded one-flow/eight-flow debt, fairness, rolling-cap, and capacity-step regressions
+- [x] 7.3 Retain the 5 ms instantaneous ceiling, carry valid debt within the 250 ms queue horizon, and repay it at no more than 5% above nominal fair share
+- [ ] 7.4 Freeze and verify a new executable candidate on private Linux before any separately authorized replacement normative run
+
+## 8. Public-wire capacity measurement correction
+
+- [x] 8.1 Preserve run 127/job 481 at `122080ab` as failed evidence with its exact log hash, no artifact, and no retry
+- [x] 8.2 Observe raw independent-client QUIC datagram lengths/times in-process and derive v9 capacity convergence and caps from configured wire rate while keeping logical payload observations separate; this did not persist sufficient raw evidence for independent proof
+- [x] 8.3 Preserve run 128/job 482 as passing Linux execution and artifact-byte evidence but retention-nonconforming, with no retry
+- [ ] 8.4 Freeze the 31-day-request descendant and prove a future private artifact records at least 30 elapsed days before tasks 5.4, 5.5, 6.3, or 7.4 can close
+
+## 9. Retained public-wire evidence correction
+
+- [x] 9.1 Preserve the first empty `gateway-rc10-c0e362c` environment-boundary attempt and the runtime-passing but normative-raw-evidence-incomplete `gateway-rc10-c0e362c-a2` bundle without mutation or relabeling
+- [x] 9.2 Persist bounded v10 constrained public-wire rows and fairness transition offsets; recompute each impairment step from its transition through completion and fairness from its separate stage; select normative authority explicitly; and bound compressed, decompressed, row, field, time, flow, and encoded-length parsing

openspec/specs/gateway-deployment-artifact/spec.md

@@ -12,8 +12,26 @@ The candidate SHALL build the gateway with the normal immutable Protocol module
 - **THEN** both amd64 and arm64 outputs are byte-identical pure-Go ELF executables with matching embedded GOOS, GOARCH, and cgo settings
 
 ### Requirement: Artifact evidence is inspected and truthful
-Candidate evidence SHALL record exact source and Protocol revisions, artifact hashes, architecture, embedded dependency inventory, container configuration when built, and the actual scanner/signing status. It MUST NOT claim an SBOM, vulnerability result, signature, image architecture, or deployment that was not produced and inspected.
+Candidate evidence SHALL record exact source and immutable Protocol
+revisions/checksums, artifact hashes, architecture, embedded dependency
+inventory, container configuration when built, and the actual scanner/signing
+status. It SHALL include one byte-stable SPDX 2.3 JSON SBOM for the shipped Linux
+gateway artifacts containing the source package, resolved Go modules, dependency
+and generated-from relationships, artifact hashes and architectures, retained
+notices/provenance, and truthful license fields using `NOASSERTION` where
+evidence is unavailable. It MUST NOT claim a vulnerability result, signature,
+image architecture, deployment, or license conclusion that was not produced and
+inspected.
+
+#### Scenario: Deterministic gateway SBOM
+- **WHEN** the canonical SBOM command runs twice with the same clean source
+  revision, Protocol module/checksum, module graph, source date, and Linux
+  artifacts
+- **THEN** both SPDX JSON outputs are byte-identical and every declared
+  artifact/module relationship and hash matches the inspected inputs
 
 #### Scenario: Supplemental scanner is unavailable
 - **WHEN** no qualifying vulnerability scanner is available in the frozen environment
-- **THEN** the artifact remains explicitly unscanned, deterministic compiler/dependency/boundary evidence is retained, and no zero-finding security claim is emitted
+- **THEN** the artifact remains explicitly unscanned and unsigned, the
+  deterministic SBOM/compiler/dependency/boundary evidence is retained, and no
+  zero-finding security claim is emitted

openspec/specs/gateway-qualification/spec.md

@@ -5,22 +5,59 @@ Define the deterministic processing, impairment, pacing, and evidence boundaries
 for qualifying a frozen Phase 3C gateway candidate.
 ## Requirements
 ### Requirement: Fixed media processing qualification
-The qualification harness SHALL drive pinned-mTLS Apollo management, encrypted RTSP, ENet, and provider UDP through native source validation, `readUDPMedia`, recovery/FEC, bounded production queues, the production fair pacer, Verse framing/QUIC, and a public or independent client decoder for 1080p60 H.264 at 20 Mbps, 1440p120 HEVC at 50 Mbps, and 4K60 HEVC at 80 Mbps. After a recorded warm-up, the frozen candidate SHALL run each profile for ten wall-clock minutes, preserve encoded payload bytes, retain every monotonic processing sample plus bounded process CPU, memory, goroutine, allocation, and provider-queue observations, and report count, min, median, p90, p95, p99, max, mean, standard deviation, timing overhead, and observed bitrate. Processing begins at complete provider-unit receipt and ends at QUIC handoff, excluding client transit and pacing. CPU SHALL be actual OS user plus system consumption of the isolated gateway qualification process and MUST NOT be GOMAXPROCS-times-wall capacity or unrelated parent test work. Any bypass, payload mutation, wall-duration violation, bitrate outside both lower and upper bounds, or p95 above 5 ms SHALL fail.
+The qualification harness SHALL drive pinned-mTLS Apollo management, encrypted
+RTSP, ENet, and provider UDP through native source validation, `readUDPMedia`,
+recovery/FEC, byte/count/latency-bounded production queues, the production fair
+pacer, Protocol complete-frame fragmentation, Verse framing/QUIC, and an
+independent bounded client reassembler for 1080p60 H.264 at 20 Mbps, 1440p120
+HEVC at 50 Mbps, and 4K60 HEVC at 80 Mbps. The source fixture SHALL emit
+deterministic variable-size complete encoded frames at the named 60/120 FPS
+rate, preserve exact target bytes over each fixed interval, and include bounded
+larger keyframes without codec operation. After a recorded warm-up, the frozen
+candidate SHALL run each profile for ten wall-clock minutes, preserve every
+frame's bytes and boundary, retain every monotonic processing sample plus
+bounded provider-queue observations, and report frame count, frame rate,
+bitrate, min, median, p90, p95, p99, max, mean, standard deviation, and measured
+batched monotonic-clock overhead and method. Processing begins at complete
+provider-frame receipt and ends at QUIC handoff, excluding client transit and
+pacing. Queue delay SHALL measure provider-queue residence, processing SHALL
+measure gateway work before pacing, and pacing delay SHALL measure scheduler
+waiting. Native video queues SHALL retain at most 16 complete frames, 4 MiB,
+and 250 milliseconds; audio and event queues SHALL remain independently bounded
+at 16 units. CPU, heap, allocations, and goroutines SHALL be measured from the
+isolated gateway process only; CPU SHALL be actual OS user plus system
+consumption and MUST NOT include idle wall capacity or unrelated parent
+fixture/client work. Successive profiles SHALL use independent resource-counter
+baselines. Any bypass, payload or frame-boundary mutation, frame-rate/count
+mismatch, wall-duration violation, bitrate outside both lower and upper bounds,
+unexplained clean-path loss, zero or unbounded clock overhead, or p95 above 5
+ms SHALL fail.
 
 #### Scenario: Healthy fixed profile
 - **WHEN** a frozen candidate runs one fixed profile for the normative duration in the isolated qualification command
-- **THEN** the harness emits compressed raw path and resource samples plus a summary tied to the exact command, CPU scope, topology, source commit, immutable Protocol version, environment, and payload hash
+- **THEN** the harness emits compressed raw frame/path and gateway-process
+  resource samples plus a summary tied to the exact command, CPU scope,
+  timing-overhead method, topology, source commit, immutable Protocol version,
+  environment, and payload hash
 
 #### Scenario: Processing gate failure
-- **WHEN** any production path stage lacks a per-traversal observation, payload integrity fails, duration or bitrate bounds fail, measured p95 exceeds 5 ms, or idle capacity is reported as consumed CPU
+- **WHEN** any production path stage lacks a per-frame observation, stage
+  accounting does not balance, payload or frame boundaries change, duration,
+  frame-rate, frame-count, or bitrate bounds fail, measured p95 exceeds 5 ms,
+  parent work changes gateway CPU, idle capacity is reported as consumed CPU, or
+  timing overhead is absent
 - **THEN** the qualification command exits unsuccessfully without recording a passing candidate
 
 ### Requirement: Bounded impairment qualification
-The harness SHALL run exactly the baseline, latency, jitter, loss, reorder, and constrained Section 7.2 profiles once by applying fixed-seed impairment at the source-shaped provider network boundary while traffic concurrently traverses the production gateway path. Baseline SHALL cover all three media profiles and the other profiles SHALL cover 1080p60. The harness MUST NOT serialize a complete provider-to-client traversal per source unit. Each artifact SHALL retain raw impairment and queue observations and record tool version, exact command/configuration, environment, candidate commit, immutable Protocol version, direction, queue discipline, topology, fixed seed, observed one-way latency, acknowledged Apollo ENet RTT, jitter, loss, reorder, throughput, drops, and capacity-step statistics.
+The harness SHALL run exactly the baseline, latency, jitter, loss, reorder, and constrained Section 7.2 profiles once by applying fixed-seed impairment at the source-shaped provider network boundary while traffic concurrently traverses the production gateway path. Baseline SHALL cover all three media profiles and the other profiles SHALL cover 1080p60. The harness MUST NOT serialize a complete provider-to-client traversal per source unit. Reorder-off profiles SHALL preserve source order through an ordered delay queue whose catch-up is limited to one media serialization interval; the fixed-seed applied-delay distribution and jitter observed after ordered traversal SHALL be reported separately. Loss-only traffic SHALL NOT gain implicit reorder. Reorder-on profiles SHALL inject and record only the fixed bounded reorder pattern. Each source unit SHALL have one attributable outcome across source emission, injected drop, native provider/FEC handling, bounded queue replacement, gateway forwarding, QUIC send/receive, and public-client delivery. Each artifact SHALL retain raw impairment and queue observations and record tool version, exact command/configuration, environment, candidate commit, immutable Protocol version, direction, queue discipline, topology, fixed seed, observed one-way latency, acknowledged Apollo ENet RTT, applied and observed jitter, injected and unexplained loss, reorder, throughput, drops, and capacity-step statistics.
 
 #### Scenario: Complete six-profile run
 - **WHEN** the frozen candidate runs impairment qualification
-- **THEN** one result exists for each named profile, configured jitter remains observable within reviewed fixed-seed tolerances, RTT comes from real request/response acknowledgement timing, and raw statistics come from actual traversal
+- **THEN** one result exists for each named profile, configured and observed impairment axes remain separately attributable, reorder-off profiles preserve source order, RTT comes from real request/response acknowledgement timing, and raw statistics come from actual traversal
+
+#### Scenario: Clean production traversal
+- **WHEN** 10,000 source packets traverse a zero-loss baseline profile
+- **THEN** stage accounting identifies every packet and fails on any unexplained loss while each fixed media bitrate remains within its reviewed healthy-path contract
 
 #### Scenario: Unsupported or unbounded configuration
 - **WHEN** a profile name, packet count, queue bound, loss, reorder, or bandwidth step falls outside the fixed catalog