@@ -28,6 +28,29 @@ The envelope wire format is versioned separately by `meta.schema_version`
   stays on the poison / unknown-URN path instead of being routed to a handler.
 
 ### Fixed
+- **`on_unknown_urn=RELEASE` no longer loops a version-gated or poison message forever.**
+  `BabelQueue.dispatch()` re-published such a message unchanged on every delivery (`attempts` never
+  grew, so it never reached the DLQ). A delivery a transport version-gated (reserved
+  `unsupported-schema-version` `route_urn`, e.g. Pulsar `bq-schema-version`), an undecodable body
+  and a body naming no URN now take the bounded `FAIL` path under `RELEASE` (retry up to
+  `max_attempts`, then dead-letter or drop), matching the Go core (GR-5). A genuinely unknown URN
+  still releases verbatim. No public API or wire change. Note: as on the existing `FAIL` path, a
+  body that is not valid JSON is not carried verbatim through the retry / dead-letter re-publish
+  (the runtime re-encodes the envelope it could build, so the producer's original bytes are lost);
+  previously `RELEASE` re-published those bytes unchanged.
+- **Pulsar consumer version-gates on `bq-schema-version` (broker-bindings §5.7 step 3).**
+  `PulsarTransport.pop()` now reads the `bq-schema-version` message property before decoding the
+  body. A missing or blank value changes nothing; "Blank" is the same set in every SDK: the empty string or only ASCII whitespace (space, `\t`, `\n`, `\v`, `\f`, `\r`); anything else (NBSP, U+001C-U+001F, U+0085, U+FEFF, U+3000, ...) is not blank and is rejected unless it is exactly the supported version. (`str.strip()` is not used: it also strips U+001C-U+001F, U+0085, NBSP, ...) a value other than the supported
+  `SCHEMA_VERSION` (`"2"`, `"x"`, `"01"`, ...) is not decoded: the delivery carries the reserved
+  `route_urn` `babelqueue:unsupported-schema-version:<value>`, which no handler owns, so the
+  runtime quarantines it through the existing unknown-URN retry / dead-letter path (the error
+  names the rejected version). The body is passed through untouched. No wire change. The route
+  is an in-process marker only: it also carries the delivery's original `bq-job`, and the retry /
+  dead-letter re-publish (`publish_routed`) writes that original `bq-job` (or, when the delivery
+  had none, the body's job) and the original raw `bq-schema-version` back, never the sentinel, so
+  a redrive meets the same gate. The gate also logs a `babelqueue.pulsar` warning naming the
+  rejected version and queue, including for a body that is not valid JSON (which the runtime
+  quarantines as a poison message whose error names the reserved route).
 - **Pulsar consumer now follows broker-bindings §5.2 / §5.7.** `PulsarTransport.pop()` routes on
   the `bq-job` message property (set on `ReceivedMessage.route_urn`; the body's URN is used only
   when the property is absent or blank) and takes `attempts` from the authoritative
 
@@ -440,15 +440,22 @@ def _route_unknown(self, urn: str, received: ReceivedMessage, envelope: Mapping[
         if strategy == UnknownUrnStrategy.DELETE:
             self._ack_settled(received)
             return
-        if strategy == UnknownUrnStrategy.RELEASE:
+        # A transport's version-gated delivery, an undecodable body or a body naming no URN can
+        # never gain a handler, so releasing it unchanged would redeliver it forever. It takes the
+        # bounded FAIL path instead (retry up to max_attempts, then dead-letter or drop); only a
+        # genuinely unknown URN keeps the verbatim release.
+        gated = received.route_urn.startswith(_UNSUPPORTED_SCHEMA_ROUTE_PREFIX)
+        poison = gated or not urn
+        if strategy == UnknownUrnStrategy.RELEASE and not poison:
             self._release(received, received.body, self.unknown_urn_release_delay)
             return
         if strategy == UnknownUrnStrategy.DEAD_LETTER:
             self._dead_letter(received, dict(envelope), "unknown_urn", None)
             return
-        # FAIL — surfaced through the retry/dead-letter path (never kills the loop).
+        # FAIL (and RELEASE of a poison message) — surfaced through the retry/dead-letter path
+        # (never kills the loop). A gated delivery names its reserved route (the rejected version).
         raise UnknownUrnError(
-            f"No handler mapped for URN [{urn or '(empty)'}]."
+            f"No handler mapped for URN [{urn or (received.route_urn if gated else '') or '(empty)'}]."
         )
 
     def _retry_or_dead_letter(
@@ -490,6 +497,13 @@ def _dead_letter(
         self._ack_settled(received)
 
 
+#: Reserved ``ReceivedMessage.route_urn`` prefix a transport uses to hand over a delivery it
+#: version-gated (broker-bindings §5.7 step 3, e.g. the pulsar transport's ``bq-schema-version``
+#: check). Not a ``urn:babel:`` URN, so no handler owns it. Must equal
+#: ``pulsar_transport.UNSUPPORTED_SCHEMA_ROUTE_PREFIX`` (locked by a test); never reaches the wire.
+_UNSUPPORTED_SCHEMA_ROUTE_PREFIX = "babelqueue:unsupported-schema-version:"
+
+
 def _without_forbidden_keys(body: str) -> str:
     """``body`` unchanged, unless it carries a forbidden envelope key (message-envelope.md §10,
     e.g. from a legacy producer) — then it is re-encoded without it (warned by the codec), so a
 
@@ -19,6 +19,18 @@
 the property wins and the optional ``on_routing_mismatch(property_urn, body_urn, envelope)``
 hook is called (for an accepted envelope, after attempts are reconciled). A message left un-acked is redelivered (at-least-once).
 
+Before any of that, a ``bq-schema-version`` property that is present but not the core's supported
+``SCHEMA_VERSION`` (``"2"``, ``"x"``, ``"01"``, ...) is version-gated (§5.7 step 3): the body is
+**not decoded** and the message is handed to the runtime under a reserved ``route_urn`` no
+handler owns, so it is quarantined through the existing unknown-URN retry / dead-letter path (the
+error names the rejected version, and a ``babelqueue.pulsar`` warning is logged with the version
+and queue, also for a body that is not valid JSON). A missing or blank property (empty or only
+ASCII whitespace: space, tab, LF, VT, FF, CR - nothing else counts as blank) decodes as usual.
+The reserved route is an in-process marker only: it carries the delivery's original ``bq-job``,
+and a retry / dead-letter re-publish writes that ``bq-job`` (or, when the delivery had none, the
+body's job) and the original raw ``bq-schema-version`` back — never the sentinel — so a redrive
+meets the same gate.
+
 This implements §5 of the broker-bindings contract. The envelope is unchanged
 (``schema_version`` stays 1); Apache Pulsar is purely additive.
 
@@ -30,16 +42,51 @@
 
 from __future__ import annotations
 
+import logging
 import re
+from urllib.parse import quote, unquote
 from typing import Any, Callable, Dict, Optional, Tuple
 
-from .codec import EnvelopeCodec, parse_envelope
+from .codec import SCHEMA_VERSION, EnvelopeCodec, parse_envelope
 from .transport import ReceivedMessage, Transport
 
 #: ``bq-attempts`` is valid only as a run of ASCII digits (no sign, no whitespace) ...
 _ATTEMPTS_PATTERN = re.compile(r"[0-9]+")
+#: A blank ``bq-schema-version``: empty or only ASCII whitespace (space, \t, \n, \v, \f, \r) — the
+#: same set in every SDK (GR-5). Deliberately not ``str.strip()``, which also strips U+001C-U+001F,
+#: U+0085, U+00A0, U+2028, U+3000 ...
+_BLANK_ASCII_PATTERN = re.compile(r"[ \t\n\x0b\x0c\r]*")
 #: ... that fits a signed 32-bit int, matching the Java and .NET consumers (GR-5).
 _MAX_ATTEMPTS = 2**31 - 1
+#: Prefix of the reserved ``route_urn`` a version-gated message is delivered under. It is not a
+#: ``urn:babel:`` URN, so no handler can legitimately own it; the runtime reports it as an
+#: unknown URN, which names the rejected ``bq-schema-version``.
+UNSUPPORTED_SCHEMA_ROUTE_PREFIX = "babelqueue:unsupported-schema-version:"
+#: Separates the rejected version from the delivery's original ``bq-job`` in a gate route.
+_GATE_JOB_PARAM = "?bq-job="
+
+_logger = logging.getLogger("babelqueue.pulsar")
+
+
+def _gate_route(version: str, properties: Dict[str, Any]) -> str:
+    """The reserved route of a version-gated delivery: the prefix, the rejected version and, when
+    the delivery carried one, its original ``bq-job`` (both percent-escaped). The runtime hands
+    it back through :meth:`PulsarTransport.publish_routed` on every retry / dead-letter write."""
+    route = UNSUPPORTED_SCHEMA_ROUTE_PREFIX + quote(version, safe="")
+    job = properties.get("bq-job")
+    if job is not None:
+        route += _GATE_JOB_PARAM + quote(str(job), safe="")
+    return route
+
+
+def _parse_gate_route(route: str) -> Optional[Tuple[str, Optional[str]]]:
+    """Inverse of :func:`_gate_route`: ``(version, bq_job_or_None)``, or ``None`` for any other
+    route."""
+    if not route.startswith(UNSUPPORTED_SCHEMA_ROUTE_PREFIX):
+        return None
+    rest = route[len(UNSUPPORTED_SCHEMA_ROUTE_PREFIX):]
+    raw_version, sep, raw_job = rest.partition(_GATE_JOB_PARAM)
+    return unquote(raw_version), (unquote(raw_job) if sep else None)
 
 
 class PulsarTransport(Transport):
@@ -124,8 +171,19 @@ def _projection(body: str, route_urn: str = "") -> Dict[str, str]:
         the body: bq-job/bq-trace-id/bq-message-id + bq-schema-version/lang/attempts. §5.2.
 
         A non-empty ``route_urn`` pins ``bq-job`` (a retry / release re-publish keeps the original
-        delivery's routing URN); blank derives it from the body."""
+        delivery's routing URN); blank derives it from the body.
+
+        A ``route_urn`` that is a version-gate route is never written: the original delivery's
+        ``bq-job`` (if it had one) and raw ``bq-schema-version`` are restored instead, so the
+        republished message is gated the same way when it is consumed again."""
+        gate = _parse_gate_route(route_urn)
         env = parse_envelope(body)
+        if gate is not None:
+            props = PulsarTransport._projection(body) if env else {}
+            props["bq-schema-version"] = gate[0]
+            if gate[1] is not None:
+                props["bq-job"] = gate[1]
+            return props
         if not env:
             return {}
         meta = env.get("meta") or {}
@@ -146,6 +204,23 @@ def _projection(body: str, route_urn: str = "") -> Dict[str, str]:
             props["bq-job"] = route_urn
         return props
 
+    @staticmethod
+    def _unsupported_schema_version(properties: Dict[str, Any]) -> Optional[str]:
+        """The §5.7 step-3 gate on ``bq-schema-version``: the offending raw value, or ``None``.
+
+        A missing or blank property is not gated (the usual decode path runs); blank means the
+        empty string or only ASCII whitespace (space, ``\\t``, ``\\n``, ``\\v``, ``\\f``, ``\\r``) — the
+        same set in every SDK (GR-5), not ``str.strip()``, which also strips U+001C-U+001F,
+        U+0085, U+00A0, U+2028, U+3000 ... A present property is accepted only when it is exactly
+        the core's supported ``SCHEMA_VERSION`` as a plain decimal string, so ``"2"``, ``"x"``,
+        ``"01"`` and ``" 1"`` are all rejected."""
+        raw = properties.get("bq-schema-version")
+        if raw is None or (isinstance(raw, str) and _BLANK_ASCII_PATTERN.fullmatch(raw) is not None):
+            return None
+        if isinstance(raw, str) and raw == str(SCHEMA_VERSION):
+            return None
+        return str(raw)
+
     @staticmethod
     def _parse_attempts(raw: Any) -> Optional[int]:
         """The ``bq-attempts`` value as an int, or ``None`` when absent or invalid (§5.5)."""
@@ -267,10 +342,26 @@ def pop(self, queue: str, timeout: float = 1.0) -> Optional[ReceivedMessage]:
             raise
         if message is None:  # pragma: no cover - defensive (real client raises instead)
             return None
+        properties = self._properties(message)
+        rejected = self._unsupported_schema_version(properties)
+        if rejected is not None:
+            # Version gate (§5.7 step 3): quarantine before decoding. The body is handed over
+            # untouched; the reserved route keeps the runtime from dispatching it to a handler.
+            _logger.warning(
+                "Pulsar message on %r rejected by the bq-schema-version gate: unsupported "
+                "version %r (supported: %s); quarantined without decoding the body",
+                queue, rejected, SCHEMA_VERSION,
+            )
+            return ReceivedMessage(
+                body=self._payload(message),
+                queue=queue,
+                handle=message,
+                route_urn=_gate_route(rejected, properties),
+            )
         body, route_urn = self._reconcile(
             self._payload(message),
             self._redelivery_count(message),
-            self._properties(message),
+            properties,
             self._on_routing_mismatch,
         )
         return ReceivedMessage(body=body, queue=queue, handle=message, route_urn=route_urn)
 
@@ -218,6 +218,80 @@ def handle(data, meta):  # noqa: ANN001
         self.assertEqual(app.transport.size("orders"), 0)
         self.assertEqual(app.transport.size("orders.dlq"), 0)
 
+    def _redeliver_until_settled(self, app, queue, route_urn, first_body, limit=6):
+        """Feed ``first_body`` through ``dispatch`` and keep redelivering whatever the runtime
+        re-publishes to ``queue`` (as a broker would); returns the number of deliveries."""
+        tr = app.transport
+        body = first_body
+        deliveries = 0
+        while body is not None and deliveries < limit:
+            deliveries += 1
+            app.dispatch(ReceivedMessage(body=body, queue=queue, route_urn=route_urn))
+            body = tr._queues[queue].popleft() if tr._queues.get(queue) else None  # noqa: SLF001
+        return deliveries
+
+    def test_version_gated_message_is_bounded_under_release(self) -> None:
+        from babelqueue.app import _UNSUPPORTED_SCHEMA_ROUTE_PREFIX
+        from babelqueue.pulsar_transport import UNSUPPORTED_SCHEMA_ROUTE_PREFIX
+
+        self.assertEqual(_UNSUPPORTED_SCHEMA_ROUTE_PREFIX, UNSUPPORTED_SCHEMA_ROUTE_PREFIX)
+        route = _UNSUPPORTED_SCHEMA_ROUTE_PREFIX + "2"
+        decodable = EnvelopeCodec.encode(EnvelopeCodec.make("urn:babel:orders:created", {}, queue="orders"))
+        for name, body in (("decodable", decodable), ("undecodable", "{not json")):
+            with self.subTest(body=name):
+                app = BabelQueue(
+                    "memory://", queue="orders", max_attempts=3, dead_letter=True,
+                    on_unknown_urn=UnknownUrnStrategy.RELEASE,
+                )
+                seen = []
+                app.handler("urn:babel:orders:created")(lambda d, m: seen.append(d))
+
+                deliveries = self._redeliver_until_settled(app, "orders", route, body)
+
+                self.assertEqual(deliveries, 3)  # max_attempts, not an endless release loop
+                self.assertEqual(seen, [])
+                self.assertEqual(app.transport.size("orders"), 0)
+                self.assertEqual(app.transport.size("orders.dlq"), 1)
+                dead = EnvelopeCodec.decode(app.transport._queues["orders.dlq"][0])  # noqa: SLF001
+                self.assertEqual(dead["dead_letter"]["reason"], "unknown_urn")
+                self.assertIn(route, dead["dead_letter"]["error"])
+
+    def test_version_gated_message_without_dead_letter_is_dropped_under_release(self) -> None:
+        route = "babelqueue:unsupported-schema-version:x"
+        body = EnvelopeCodec.encode(EnvelopeCodec.make("urn:babel:orders:created", {}, queue="orders"))
+        app = BabelQueue(
+            "memory://", queue="orders", max_attempts=2, on_unknown_urn=UnknownUrnStrategy.RELEASE
+        )
+        self.assertEqual(self._redeliver_until_settled(app, "orders", route, body), 2)
+        self.assertEqual(app.transport.size("orders"), 0)
+
+    def test_unknown_urn_release_still_releases_verbatim(self) -> None:
+        body = EnvelopeCodec.encode(EnvelopeCodec.make("urn:babel:orders:nope", {}, queue="orders"))
+        app = BabelQueue(
+            "memory://", queue="orders", max_attempts=2, dead_letter=True,
+            on_unknown_urn=UnknownUrnStrategy.RELEASE,
+        )
+        for route_urn in ("", "urn:babel:orders:nope"):
+            with self.subTest(route_urn=route_urn):
+                app.dispatch(ReceivedMessage(body=body, queue="orders", route_urn=route_urn))
+                self.assertEqual(app.transport.size("orders.dlq"), 0)
+                self.assertEqual(app.transport._queues["orders"].popleft(), body)  # noqa: SLF001
+
+    def test_ungated_poison_is_bounded_under_release(self) -> None:
+        # Not version-gated: an undecodable body and a body naming no URN can never gain a handler
+        # either, so RELEASE takes the bounded FAIL path for them too (Go routePoison parity).
+        no_urn = EnvelopeCodec.encode(EnvelopeCodec.make("urn:babel:orders:created", {}, queue="orders"))
+        no_urn = no_urn.replace('"urn:babel:orders:created"', '""')
+        for name, body in (("undecodable", "{not json"), ("no-urn", no_urn)):
+            with self.subTest(body=name):
+                app = BabelQueue(
+                    "memory://", queue="orders", max_attempts=3, dead_letter=True,
+                    on_unknown_urn=UnknownUrnStrategy.RELEASE,
+                )
+                self.assertEqual(self._redeliver_until_settled(app, "orders", "", body), 3)
+                self.assertEqual(app.transport.size("orders"), 0)
+                self.assertEqual(app.transport.size("orders.dlq"), 1)
+
     def test_unsupported_broker_scheme_raises(self) -> None:
         from babelqueue import BabelQueueError