## ADDED Requirements

### Requirement: Versioned gateway authority contracts
Gateway registration, heartbeat, drain, admission, capability selection, channel framing,
provider state, and stable errors SHALL use bounded versioned objects with strict decoding.

#### Scenario: Unknown or malformed gateway message
- **WHEN** a consumer receives an unknown version, missing required field, unknown field,
  invalid bound, or trailing JSON value
- **THEN** it rejects the message before allocating provider or media state with a stable
  validation error.

### Requirement: Gateway-only client manifest
Client-facing manifests SHALL expose only the selected gateway, tunnel/profile identifiers,
policy bounds, opaque grant, audience, expiry, session, and correlation data.

#### Scenario: Provider route injection
- **WHEN** a manifest or client-facing authority contains a provider address, RTSP URL,
  certificate, pairing identity, credential, or private key field
- **THEN** schema validation rejects it and no generated client binding accepts it.

### Requirement: Explicit capability intersection
Transport, framing, media, audio, source-rate-control, and client-decode capabilities SHALL
remain separate and no-overlap or unknown-required-profile results SHALL fail closed.

#### Scenario: No capability overlap
- **WHEN** policy, gateway, provider, and client capabilities have no allowed intersection
- **THEN** negotiation returns a stable no-overlap error before provider launch or media flow.

### Requirement: Bounded encoded datagrams
Encoded media and approved sequenced input SHALL use registered application flow identifiers,
validated fixed headers, bounded fragments, and payload bytes that are not codec-transformed.

#### Scenario: Malformed or oversized datagram
- **WHEN** a datagram is truncated, has an unknown flow, invalid fragment, length mismatch,
  or exceeds its registered payload limit
- **THEN** the datagram is rejected without allocation proportional to the claimed payload.