@blockcast/mmt-container 0.3.0 → 0.4.0-main.1cd3cdea89da

package/src/fec-state.ts

@@ -15,20 +15,8 @@
 
 import { isFecBlockProfile } from '@blockcast/mmt-base'
 
-/**
- * Minimum valid FEC interleave depth in milliseconds, per spec §5.1
- * (the interactive/gaming floor; broadcast/ATSC 3.0 ranges up to 10000ms).
- *
- * A protocol constant, NOT a tuning knob. Values below this floor are almost
- * certainly a raw frame count (e.g. `2`) that a caller passed when no framerate
- * was available to convert to ms (common on audio tracks). Feeding such a value
- * into computeFecTimeout treats it as `2ms`, yielding a near-zero FEC block
- * timeout that abandons startup FEC blocks before their repair symbols arrive
- * (measured: moqtail startupFailed=4, shaka dropped=5.8% on startup). Timing
- * derivations MUST reject sub-floor values and fall back to the established
- * timeout instead of collapsing.
- */
-export const MIN_INTERLEAVE_DEPTH_MS = 33
+/** Smallest positive catalog elapsed span; zero/absence means no elapsed deadline. */
+export const MIN_INTERLEAVE_DEPTH_MS = 1
 
 /** Why FEC is not protecting this session. */
 export type FecInactiveReason = 'no-catalog-fec' | 'reliable-moq' | 'no-multicast-bridge'
@@ -112,8 +100,10 @@ function isPositiveSafeInteger(value: unknown): boolean {
  * Whether one catalog `fec` block (a hang rendition's `fec` or an MSF/CMSF
  * track's `fec`) declares an FEC instance a receiver can configure: source
  * symbols per block (K) and a symbol size (T) are both positive integers, the
- * algorithm is not `none`, and `blockProfile` names a known block profile
- * (BLO-35597). Total: it never throws, and answers false for any other value.
+ * algorithm is not `none`, `blockProfile` names the implemented profile
+ * `iso-ssbg1-v1` (BLO-35597), and the block carries that profile's usable
+ * span field (`isoBlockSpanUsable`); zero/absence still permits in-band FEC. Total: it never throws, and answers false for
+ * any other value.
  *
  * `resolveCatalogTrackFec` reads this predicate, so the players' parameters and
  * this state never disagree. Of the blocks this rejects, it returns no FEC
@@ -127,14 +117,18 @@ function isPositiveSafeInteger(value: unknown): boolean {
  * the track's repair subscription.
  *
  * The block profile is part of this predicate because the profile selects the
- * block math and is never defaulted: without a known one no receiver can
- * configure the instance. `resolveCatalogTrackFec` resolves such a track to no
- * FEC with a typed `fecUnavailable` reason (`track_fec_block_profile`), scoped
- * to that track, so its parameters and this state still agree. The CMSF
- * conformance validator (`validateCmsfMmtpCatalog`) still rejects the catalog
- * with `track_fec_block_profile`. An `iso-ssbg1-v1` instance without a usable
- * block span (`isoBlockSpanUsable`) is likewise no FEC for its track alone,
- * with `fecUnavailable` code `track_fec` on its `interleaveDepthMs`.
+ * block math and is never defaulted: draft-ramadan-moq-fec §5.1 defines one,
+ * `iso-ssbg1-v1`, and a receiver MUST NOT apply FEC under any other token. The
+ * retired `k-padded-v1` is simply not a known profile. `resolveCatalogTrackFec`
+ * and `MulticastManager.configureMultiTrack` resolve such a track to no FEC
+ * with a typed `TrackFecUnavailable` reason (`catalogFecUnavailable`: code
+ * `track_fec_block_profile_unimplemented` for an unimplemented token,
+ * `track_fec_block_profile` for an absent one), scoped to that track, so their
+ * parameters and this state still agree. The CMSF conformance validator
+ * (`validateCmsfMmtpCatalog`) rejects the catalog with the same code. An
+ * `iso-ssbg1-v1` instance with an invalid span is likewise unavailable for its
+ * track alone. Zero or absence supplies no elapsed deadline and uses bounded
+ * receiver-local state while decoding in-band FEC.
  *
  * The repair-contract resolvers (`resolveRepairLayers`) gate a `depends` target
  * on `algorithm` alone and never read a source's `symbolSize`. They check its
@@ -153,18 +147,12 @@ export function catalogDeclaresFec(fec: unknown): boolean {
   )
 }
 
-/**
- * Whether a `fec` block that names `iso-ssbg1-v1` carries the block span its
- * block location is bounded by: `interleaveDepthMs`, a finite number of
- * milliseconds no smaller than `MIN_INTERLEAVE_DEPTH_MS`. Without it a receiver
- * cannot bound the sources it holds before a repair states their block, so the
- * instance cannot be configured (BLO-35597). Any other block needs no span here.
- */
+/** Validate the optional elapsed span without requiring one for in-band FEC. */
 export function isoBlockSpanUsable(fec: unknown): boolean {
   const block = recordOf(fec)
   if (block === undefined || block['blockProfile'] !== 'iso-ssbg1-v1') return true
   const ms = block['interleaveDepthMs']
-  return typeof ms === 'number' && Number.isFinite(ms) && ms >= MIN_INTERLEAVE_DEPTH_MS
+  return ms === undefined || (typeof ms === 'number' && Number.isSafeInteger(ms) && ms >= 0)
 }
 
 function requireBoolean(value: unknown, field: string): boolean {

package/src/fec-worker-setup.ts

@@ -4,7 +4,7 @@
  * Wires a FecWorkerClient into a MulticastManager for a specific track.
  * Both moq-lib (`hang-mmt-fec/js/watch/src/element.ts`) and moqtail
  * (`moqtail-private/apps/client-js/src/lib/player.ts`) call this from their
- * SessionManager `fec-setup` handler so the Worker+ALTA setup lives in one
+ * SessionManager `fec-setup` handler so the Worker setup lives in one
  * place instead of being duplicated across ~80 lines per player.
  *
  * Callers are responsible for holding the returned `dispose()` and calling it
@@ -16,7 +16,11 @@
 import { parseFecBlockProfile, type FecBlockProfile } from '@blockcast/mmt-base'
 import type { FecWorkerClient, FecTrackConfig } from '@blockcast/fec-worker'
 import type { MulticastManager } from './multicast-manager.js'
-import { deriveFecRetentionBlocks } from '@blockcast/mmt-fec'
+import {
+  deriveFecRetentionBlocks,
+  LOCAL_FEC_RETENTION_BLOCKS,
+  LOCAL_FEC_TIMEOUT_MS,
+} from '@blockcast/mmt-fec'
 import { computeFecDeliveryWindowMs } from './track-session.js'
 
 /** Asset URLs the helper needs. Callers pass the already-resolved set. */
@@ -25,8 +29,6 @@ export interface FecWorkerAssetUrls {
   fecWorker: string
   /** URL to the RaptorQ WASM module (compiled via compileStreaming). */
   rqWasm: string
-  /** URL to the ALTA WASM module. Fetched only when an ALTA key is provided. */
-  altaWasm: string
 }
 
 export interface FecWorkerSetupOptions {
@@ -39,13 +41,19 @@ export interface FecWorkerSetupOptions {
   /** Track type from catalog. Never inferred from name. */
   trackType: 'video' | 'audio'
   /**
-   * The catalog `fec.blockProfile` (BLO-35597). Required: `k-padded-v1` or
-   * `iso-ssbg1-v1`; never defaulted, never inferred.
+   * The catalog `fec.blockProfile` (BLO-35597). Required and validated with
+   * `parseFecBlockProfile`: `iso-ssbg1-v1` is the only FEC block profile, and
+   * any other token (the retired `k-padded-v1` included) throws before a
+   * Worker is created. Never defaulted, never inferred.
    */
   fecBlockProfile: FecBlockProfile
-  /** FEC K from catalog (source symbols per block). Under iso-ssbg1-v1 the maximum SSB_length. */
+  /**
+   * FEC K from catalog: the maximum SSB_length (K_max) of any block. Blocks
+   * are variable-length ssbg_mode1 blocks keyed by SS_Start, so K bounds
+   * block distance from below; it never strides SS_IDs into blocks.
+   */
   fecK: number
-  /** Symbol size in bytes (T) — the ALTA-adjusted value if ALTA is signed. */
+  /** Symbol size in bytes (T). */
   fecSymbolSize: number
   /** Repair symbols per block (P). */
   fecRepairCount: number
@@ -57,12 +65,16 @@ export interface FecWorkerSetupOptions {
    * `fecRepairCount`, which is the same value on a single-layer track.
    */
   joinedRepairCount?: number
-  /** Interleave depth in ms. */
+  /** Catalog interleave span in integer milliseconds; zero means no span. */
   fecInterleaveMs: number
   /** Explicit catalog jitter/reorder allowance in ms. */
   fecReorderToleranceMs?: number
-  /** Duration of one FEC media unit in ms (video frame or audio access unit). */
-  mediaUnitDurationMs: number
+  /**
+   * Duration of one FEC media unit in ms (video frame or audio access unit).
+   * Required only when the catalog supplies a positive elapsed FEC span. A
+   * missing/zero span must not invent a media cadence for its local bound.
+   */
+  mediaUnitDurationMs?: number
   /** Optional repair track name (MoQ). Forwarded to FecTrackConfig. */
   repairTrackName?: string
   /** Audio sample rate (optional — audio tracks only). */
@@ -71,8 +83,6 @@ export interface FecWorkerSetupOptions {
   codec?: string
   /** Video framerate (optional metadata forwarded to the worker). */
   framerate?: number
-  /** Base64 SPKI public key (optional). Accepts padded/unpadded, std or url-safe alphabet. */
-  altaPublicKeySpki?: string
   /** Absolute or origin-relative asset URLs. */
   assetUrls: FecWorkerAssetUrls
   /** Optional FecWorkerClient factory — main use is test injection. */
@@ -82,8 +92,6 @@ export interface FecWorkerSetupOptions {
 export interface FecWorkerSetupResult {
   /** The configured client (already registered with MulticastManager). */
   client: FecWorkerClient
-  /** True when the ALTA public key decoded and the ALTA WASM compiled. */
-  altaEnabled: boolean
   /** Removes the Worker from MulticastManager routing, then releases it. */
   dispose: () => void
 }
@@ -100,50 +108,98 @@ export interface FecWorkerSetupResult {
 export async function setupFecWorkerForTrack(
   opts: FecWorkerSetupOptions,
 ): Promise<FecWorkerSetupResult> {
-  // These two were previously validated as a side effect of calling
-  // deriveFecInterleaveDepth() here. That call is gone (see below), so the
-  // guards are explicit — a zero or non-finite span/media-unit must still fail
-  // closed rather than size a window from a hardcoded depth.
-  //
-  // `mediaUnitDurationMs` no longer influences the retention this function
-  // computes: it survives only as `mediaUnitsPerSecond`, which
-  // `computeFecDeliveryWindowMs` (track-session.ts) documents as geometry
-  // accepted for existing callers and deliberately not fed to deadline math.
-  // The guard stays anyway — this is a trust boundary for a catalog-supplied
-  // value, and the test `rejects missing media-unit timing instead of using a
-  // hardcoded depth` pins it. Not dead code. Cite both by symbol, not by line:
-  // a line number here is invalidated by the next edit to the file it points
-  // at, and this comment is the guard's only stated defence.
-  if (!Number.isFinite(opts.fecInterleaveMs) || opts.fecInterleaveMs <= 0) {
-    // Names the catalog field (`fec.interleaveDepthMs`), not the local option
-    // (`opts.fecInterleaveMs`), because that is the knob an operator fixes.
+  // A zero span is the catalog's no-deadline signal. It still configures the
+  // decoder, but its retention and cleanup values are receiver-local. Do not
+  // pass it through a timing derivation: that would turn a missing media
+  // cadence into a made-up FEC deadline.
+  if (
+    !Number.isFinite(opts.fecInterleaveMs) ||
+    !Number.isSafeInteger(opts.fecInterleaveMs) ||
+    opts.fecInterleaveMs < 0
+  ) {
     throw new Error(
-      `[FEC] interleaveDepthMs (opts.fecInterleaveMs) must be finite and > 0 ` +
+      `[FEC] interleaveDepthMs (opts.fecInterleaveMs) must be a finite non-negative integer ` +
         `(got ${opts.fecInterleaveMs})`,
     )
   }
-  if (!Number.isFinite(opts.mediaUnitDurationMs) || opts.mediaUnitDurationMs <= 0) {
+  if (
+    opts.fecReorderToleranceMs !== undefined &&
+    (!Number.isFinite(opts.fecReorderToleranceMs) || opts.fecReorderToleranceMs < 0)
+  ) {
     throw new Error(
-      `[FEC] mediaUnitDurationMs must be finite and > 0 (got ${opts.mediaUnitDurationMs})`,
+      `[FEC] fecReorderToleranceMs must be finite and >= 0 ` +
+        `(got ${opts.fecReorderToleranceMs})`,
+    )
+  }
+  const hasCatalogTiming = opts.fecInterleaveMs > 0
+  const validateWorkerGeometry = (): void => {
+    // `computeFecDeliveryWindowMs` used to reject a malformed K as a side
+    // effect. The no-span path intentionally skips that timing derivation, so
+    // keep decoder geometry validation at this trust boundary before creating
+    // a Worker. T is likewise checked here because the Worker receives it
+    // through the asynchronous configure message.
+    if (!Number.isSafeInteger(opts.fecK) || opts.fecK <= 0) {
+      throw new Error(`[FEC] fecK must be a finite positive integer (got ${opts.fecK})`)
+    }
+    if (
+      !Number.isSafeInteger(opts.fecSymbolSize) ||
+      opts.fecSymbolSize <= 0 ||
+      opts.fecSymbolSize % 8 !== 0
+    ) {
+      throw new Error(
+        `[FEC] fecSymbolSize must be a positive 8-byte-aligned integer (got ${opts.fecSymbolSize})`,
+      )
+    }
+    if (!Number.isSafeInteger(opts.fecRepairCount) || opts.fecRepairCount <= 0) {
+      throw new Error(
+        `[FEC] fecRepairCount must be a finite positive integer (got ${opts.fecRepairCount})`,
+      )
+    }
+  }
+  let deliveryWindowMs: number
+  let interleaveDepthBlocks: number
+  if (!hasCatalogTiming) {
+    validateWorkerGeometry()
+    deliveryWindowMs = LOCAL_FEC_TIMEOUT_MS
+    interleaveDepthBlocks = LOCAL_FEC_RETENTION_BLOCKS
+  } else {
+    const mediaUnitDurationMs = opts.mediaUnitDurationMs
+    if (
+      typeof mediaUnitDurationMs !== 'number' ||
+      !Number.isFinite(mediaUnitDurationMs) ||
+      mediaUnitDurationMs <= 0
+    ) {
+      throw new Error(
+        `[FEC] mediaUnitDurationMs must be finite and > 0 (got ${mediaUnitDurationMs})`,
+      )
+    }
+    validateWorkerGeometry()
+    deliveryWindowMs = computeFecDeliveryWindowMs({
+      interleaveDepthMs: opts.fecInterleaveMs,
+      sourceSymbols: opts.fecK,
+      repairSymbols: opts.fecRepairCount,
+      symbolSize: opts.fecSymbolSize,
+      mediaUnitsPerSecond: 1000 / mediaUnitDurationMs,
+      jitterBufferMs: opts.fecReorderToleranceMs,
+    })
+    // `interleaveDepth` is a decoder block count. It is derived only for a
+    // positive catalog span; no-span uses the fixed local count above.
+    interleaveDepthBlocks = deriveFecRetentionBlocks(
+      deliveryWindowMs,
+      opts.fecInterleaveMs,
     )
   }
   const blockProfile = parseFecBlockProfile(
     opts.fecBlockProfile,
     `[FEC] ${opts.trackName} fec.blockProfile`,
   )
-  const deliveryWindowMs = computeFecDeliveryWindowMs({
-    interleaveDepthMs: opts.fecInterleaveMs,
-    sourceSymbols: opts.fecK,
-    repairSymbols: opts.fecRepairCount,
-    symbolSize: opts.fecSymbolSize,
-    mediaUnitsPerSecond: 1000 / opts.mediaUnitDurationMs,
-    jitterBufferMs: opts.fecReorderToleranceMs,
-  })
   // `FecTrackConfig.interleaveDepth` is a BLOCK COUNT, not D. Every consumer
-  // measures SBN distance with it: the worker's `advanceMediaHorizon` does
-  // `liveSbn - interleaveDepth`, and `MmtFecDecoder::new` documents its
-  // argument as "the number of interleaved blocks" before `cleanup_by_sbn`
-  // subtracts it from an SBN and counts the remainder `blocks_failed`.
+  // measures block distance with it: the worker's `advanceMediaHorizon`
+  // retires a block more than `interleaveDepth` blocks behind the live SS_ID
+  // (`isoBlocksBehind`, a lower bound from K_max), and `MmtFecDecoder::new`
+  // documents its argument as "the number of interleaved blocks" before
+  // `cleanup_by_ss_start` retires every block that far behind and counts it
+  // `blocks_failed`.
   //
   // `deriveFecInterleaveDepth` returns D — MEDIA UNITS per block — so feeding
   // it here mixed units and sized the retention window in the wrong quantity.
@@ -161,19 +217,6 @@ export async function setupFecWorkerForTrack(
   // On 720p and audio the decoder expired blocks — counting them failed — while
   // the receiver's own deadline for them had not yet passed.
   //
-  // Derive the count from the two quantities that define it, so retention
-  // always covers the deadline already armed for that block: the blocks that
-  // can be in flight within one block's budget, plus the one being filled.
-  //
-  // `deriveFecRetentionBlocks` is THE one derivation of this horizon -- the
-  // FECManager's ordered-relay settlement consumes the same function, so the
-  // two cannot drift apart again (BLO-35597 Decision E). It fails closed above
-  // the 255 the WASM decoder and the ISO/IEC 23008-1 AL-FEC signaling byte
-  // accept, rather than clamping to a retention shorter than this window.
-  const interleaveDepthBlocks = deriveFecRetentionBlocks(
-    deliveryWindowMs,
-    opts.fecInterleaveMs,
-  )
   // Resolve URL against location.origin when available (browser runtime).
   // Absolute URLs pass through unchanged per the URL() spec.
   const origin =
@@ -185,32 +228,9 @@ export async function setupFecWorkerForTrack(
     ? opts.clientFactory(workerUrl)
     : new FecWorkerCtor.FecWorkerClient(workerUrl)
 
-  // Compile RaptorQ WASM once; ALTA WASM only when we have a key to decode.
+  // Compile RaptorQ WASM once.
   const rqWasm = await WebAssembly.compileStreaming(fetch(opts.assetUrls.rqWasm))
 
-  let altaKeyBuffer: ArrayBuffer | undefined
-  let altaWasmModule: WebAssembly.Module | undefined
-  if (opts.altaPublicKeySpki) {
-    const b64 = opts.altaPublicKeySpki.replace(/-/g, '+').replace(/_/g, '/')
-    const padded = b64.padEnd(Math.ceil(b64.length / 4) * 4, '=')
-    try {
-      const keyBytes = Uint8Array.from(atob(padded), c => c.charCodeAt(0))
-      // SPKI size range: Ed25519=44, P-256=91; tolerate 32..=256 for forward-compat.
-      if (keyBytes.length >= 32 && keyBytes.length <= 256) {
-        altaKeyBuffer = keyBytes.buffer
-        altaWasmModule = await WebAssembly.compileStreaming(fetch(opts.assetUrls.altaWasm))
-      } else {
-        console.warn(
-          `[fec-worker-setup] ALTA SPKI wrong length for "${opts.trackName}": ` +
-            `${keyBytes.length} (expected 32..256) — ALTA disabled`,
-        )
-      }
-    } catch (e) {
-      console.warn(`[fec-worker-setup] ALTA key decode / WASM compile failed for "${opts.trackName}":`, e)
-    }
-  }
-
-  const altaEnabled = !!(altaKeyBuffer && altaWasmModule)
   const fecTrackConfig = {
     codec: opts.codec ?? 'unknown',
     trackName: opts.trackName,
@@ -229,20 +249,20 @@ export async function setupFecWorkerForTrack(
     deliveryWindowMs,
     fecMode: 'subframe' as const,
     repairTrack: opts.repairTrackName,
-    altaEnabled,
     relayBlockSigEnabled: false,
   } as unknown as FecTrackConfig
 
-  client.configure(fecTrackConfig, rqWasm, altaKeyBuffer, altaWasmModule)
+  client.configure(fecTrackConfig, rqWasm)
   try {
     opts.multicastManager.setFecWorker(opts.packetId, client, opts.trackType, {
       blockProfile,
       k: opts.fecK,
       symbolSize: opts.fecSymbolSize,
       interleaveDepthMs: opts.fecInterleaveMs,
-      // FEC timing is expressed in media units. For audio this is the access-unit
-      // cadence (for example 1024/48kHz), not a video-only framerate field.
-      fps: 1000 / opts.mediaUnitDurationMs,
+      // No-span tracks have no catalog media cadence. The manager still gets
+      // the local cleanup budget, but it must not use a guessed fps for timing
+      // or classification.
+      ...(hasCatalogTiming ? { fps: 1000 / opts.mediaUnitDurationMs! } : {}),
       timeoutMs: deliveryWindowMs,
     }, opts.trackName)
   } catch (e) {
@@ -260,7 +280,6 @@ export async function setupFecWorkerForTrack(
   let disposed = false
   return {
     client,
-    altaEnabled,
     dispose: () => {
       if (disposed) return
       disposed = true

package/src/index.ts

@@ -126,6 +126,7 @@ export {
   type FecAlgorithm,
   type FecCatalogConfig,
   isFecCatalogConfig,
+  isFecCatalogGeometry,
   type MulticastProtocol,
   type MulticastTrack,
   type MulticastTrackObject,
@@ -149,6 +150,28 @@ export {
   archiveOrigin,
 } from './carp-catalog.js'
 
+// Strict v2 multicast delivery catalog (DASH/HLS/MMTP routes), moved from
+// moqtail-private so players share one contract (BLO-47003).
+export {
+  normalizeDeliveryCatalog,
+  type DeliveryPackaging,
+  type DeliveryContentType,
+  type DeliveryEndpoint,
+  type DeliveryPolicy,
+  type DeliveryObjectMapping,
+  type DeliveryFec,
+  type DeliveryRouteBase,
+  type DashDeliveryRoute,
+  type HlsDeliveryRoute,
+  type MmtpDeliveryRoute,
+  type DashDeliveryConfig,
+  type HlsDeliveryConfig,
+  type MmtpDeliveryConfig,
+  type DeliveryMulticastBase,
+  type DeliveryMulticastV2,
+  type DeliveryCatalogV2,
+} from './delivery-catalog.js'
+
 // Multicast input contract — validator + builder for publisher-emitted
 // catalogs (draft-ramadan-moq-multicast-00 §4.1, BLO-3323 A.1).
 // `multicastFromEnv` is the env-var helper used by FFmpeg and the
@@ -410,7 +433,13 @@ export {
   type FrameMeta as RouterFrameMeta,
   type FrameKind,
   type SourceKind,
+  type DeltaFallbackConfig,
 } from './media-router.js'
+export {
+  resolveDeltaFallback,
+  type DeltaFallbackTrack,
+  type ResolvedDeltaFallback,
+} from './delta-fallback-config.js'
 
 // Group-alignment primitive — shared with Go sender + Rust relay.
 // See align.ts docstring for cross-language contract. Authoritative form
@@ -522,7 +551,10 @@ export {
 	type KeyframeCadenceCatalog,
 	type TrackFecParams,
 	type TrackFecUnavailable,
+	catalogFecUnavailable,
 	catalogGroupDurationMs,
+	catalogKeyframeCadenceMs,
+	catalogFecMediaUnitsPerSecond,
 	type GroupDurationRendition,
 	resolveCatalogTrackGroupDurationMs,
 	joinedRepairSymbolCount,

package/src/media-router.ts

@@ -161,6 +161,51 @@ interface TrackSourceRecord {
   emitCount: number
 }
 
+/** Catalog-derived inputs to {@link MediaRouter.configureDelta}. */
+export interface DeltaFallbackConfig {
+  framerate: number
+  sourceSymbols: number
+  repairSymbols: number
+  deltaFailWindowBlocks?: number
+  deltaProbeIntervalMs?: number
+  interleaveDepthMs?: number
+}
+
+/**
+ * The one admission check for {@link DeltaFallbackConfig}, shared by
+ * {@link MediaRouter.configureDelta} and `resolveDeltaFallback` so a config the
+ * resolver accepts is exactly one configureDelta accepts. Every present number
+ * must be finite and positive (`typeof NaN === 'number'`, and `NaN <= 0` is
+ * false, so a bare comparison admits it); the fail window is a block count and
+ * must be an integer; and a probe interval must be derivable.
+ */
+export function assertDeltaFallbackConfig(cfg: DeltaFallbackConfig, prefix: string): void {
+  if (!isPositiveFinite(cfg.framerate)) throw new Error(`${prefix}: framerate required and must be > 0`)
+  if (!isPositiveFinite(cfg.sourceSymbols))
+    throw new Error(`${prefix}: sourceSymbols (K_delta) required and must be > 0`)
+  if (!isPositiveFinite(cfg.repairSymbols))
+    throw new Error(`${prefix}: repairSymbols (P_delta) required and must be > 0`)
+  if (
+    cfg.deltaFailWindowBlocks !== undefined &&
+    !(Number.isInteger(cfg.deltaFailWindowBlocks) && cfg.deltaFailWindowBlocks > 0)
+  ) {
+    throw new Error(`${prefix}: deltaFailWindowBlocks must be a positive integer when present`)
+  }
+  if (cfg.deltaProbeIntervalMs !== undefined && !isPositiveFinite(cfg.deltaProbeIntervalMs))
+    throw new Error(`${prefix}: deltaProbeIntervalMs must be > 0 when present`)
+  if (cfg.interleaveDepthMs !== undefined && !isPositiveFinite(cfg.interleaveDepthMs))
+    throw new Error(`${prefix}: interleaveDepthMs must be > 0 when present`)
+  if (cfg.deltaProbeIntervalMs === undefined && cfg.interleaveDepthMs === undefined) {
+    throw new Error(
+      `${prefix}: either deltaProbeIntervalMs or interleaveDepthMs required for probe interval derivation`
+    )
+  }
+}
+
+function isPositiveFinite(value: unknown): value is number {
+  return typeof value === 'number' && Number.isFinite(value) && value > 0
+}
+
 export class MediaRouter {
   #active: SourceKind = 'moq'
   #multicastVideoKeyed = false
@@ -339,29 +384,21 @@ export class MediaRouter {
    * CLAUDE.md: error on bad init — throws if required inputs are absent.
    *
    * Calling again resets deltaActive=true and clears the window buffer (stream restart).
+   * Pass null on teardown or when a replacement catalog cannot configure this policy.
    */
-  configureDelta(cfg: {
-    framerate: number
-    sourceSymbols: number
-    repairSymbols: number
-    deltaFailWindowBlocks?: number
-    deltaProbeIntervalMs?: number
-    interleaveDepthMs?: number
-  }): void {
-    if (typeof cfg.framerate !== 'number' || !Number.isFinite(cfg.framerate) || cfg.framerate <= 0) {
-      throw new Error('[MediaRouter] configureDelta: framerate required and must be > 0')
-    }
-    if (typeof cfg.sourceSymbols !== 'number' || cfg.sourceSymbols <= 0) {
-      throw new Error('[MediaRouter] configureDelta: sourceSymbols (K_delta) required and must be > 0')
-    }
-    if (typeof cfg.repairSymbols !== 'number' || cfg.repairSymbols <= 0) {
-      throw new Error('[MediaRouter] configureDelta: repairSymbols (P_delta) required and must be > 0')
-    }
-    if (cfg.deltaProbeIntervalMs === undefined && cfg.interleaveDepthMs === undefined) {
-      throw new Error(
-        '[MediaRouter] configureDelta: either deltaProbeIntervalMs or interleaveDepthMs required for probe interval derivation'
-      )
+  configureDelta(cfg: DeltaFallbackConfig | null): void {
+    if (cfg === null) {
+      this.#deltaConfigured = false
+      this.#deltaActive = true
+      this.#deltaWindow = []
+      this.#deltaWindowSize = 0
+      this.#deltaFailThresholdRatio = 0
+      this.#deltaRecoverThresholdRatio = 0
+      this.#deltaProbeIntervalMs = 0
+      this.#lastProbeAt = 0
+      return
     }
+    assertDeltaFallbackConfig(cfg, '[MediaRouter] configureDelta')
 
     // Derivations — no magic floors, no hardcoded defaults (CLAUDE.md).
     this.#deltaWindowSize = cfg.deltaFailWindowBlocks ?? Math.ceil(cfg.framerate)
@@ -791,6 +828,7 @@ export class MediaRouter {
   /** Dispose timers and per-track sources. Call on teardown to prevent
    *  stale timer callbacks firing into garbage-collected closures (WR-03). */
   dispose(): void {
+    this.configureDelta(null)
     if (this.#audioFallbackTimer) {
       clearTimeout(this.#audioFallbackTimer)
       this.#audioFallbackTimer = null