## Context

`FragmentPayload` currently stops at 16 × 1,179 bytes and the independent test client assumes ordered fragments. Native Apollo output enters count-only buffered channels, so realistic complete frames have neither a byte ceiling nor an explicit residence bound.

## Goals / Non-Goals

**Goals:**

- Implement Protocol datagram-v2 for complete encoded frames up to 1 MiB.
- Reassemble bounded duplicate/reordered QUIC datagrams independently.
- Bound native video queue count, bytes, and residence time while retaining latest-frame replacement and drop telemetry.

**Non-Goals:**

- Codec inspection, retransmission, provider fallback, generic queue/transport APIs, or Server behavior changes.

## Decisions

- Keep the existing `Frame`/QUIC path and add version-aware encode/decode rather than a second transport.
- Use one sequence per provider frame and the Protocol 1,177-byte fragment size.
- Keep the existing native video channel at 16 entries, add exact atomic byte
  accounting capped at 4 MiB, and use per-entry timers for the 250 ms residence
  bound. This matches the Protocol's reviewed incomplete-unit timeout and covers
  bounded keyframe serialization; the transport performs a final stale check.
- Audio and events keep their independent existing limits.

## Risks / Trade-offs

- [Latest-frame eviction drops decodable dependencies] → preserve truthful drops and existing IDR feedback; never grow memory or block every session.
- [Large frames multiply fragment sends] → cap both complete bytes and fragment count before allocation.
- [Expiry races with dequeue or cleanup] → stop each package-private timer on
  dequeue/replacement, serialize channel expiry and close, and retain the
  transport stale check.