@blockcast/mmt-container 0.5.0 → 1.0.0-main.3cb7359ea316

package/src/multicast-manager.ts

@@ -8,7 +8,7 @@
  * - MulticastTransport — SSM join/socket/watchdog
  */
 
-import { parseFecBlockProfile, type FecBlockProfile } from "@blockcast/mmt-base";
+import { parseFecBlockProfile, resolveFecBindings, type FecBlockProfile, type FecSourceBinding } from "@blockcast/mmt-base";
 import {
   FECManager,
   MIN_INTERLEAVE_DEPTH_MS,
@@ -79,12 +79,9 @@ import {
   hasSwitchingSetRole,
   parseTrackRole,
   validateSwitchingSet,
-  isFecCatalogConfig,
-  isFecCatalogGeometry,
-  type FecCatalogConfig,
   type TrackRole,
 } from "./carp-catalog.js";
-import { catalogFecUnavailable, type TrackFecUnavailable } from "./catalog-fec-params.js";
+import type { TrackFecUnavailable } from "./catalog-fec-params.js";
 
 /**
  * One dedicated repair group to join beside the media join: the shape
@@ -110,11 +107,13 @@ export interface MulticastRepairEndpoint {
 /**
  * Opens one repair-group subscription through the caller's own provider (a
  * hang bridge, for one): delivers each packet to `onPacket` and returns (or
- * resolves to) the call that releases it.
+ * resolves to) the call that releases it. Pass each datagram's sender as
+ * `sourceAddress` when known: the group then admits only its first sender,
+ * as MulticastTransport does (`packetsDroppedForeignSender`).
  */
 export type MulticastRepairSubscribe = (
   endpoint: MulticastRepairEndpoint,
-  onPacket: (packet: Uint8Array) => void,
+  onPacket: (packet: Uint8Array, sourceAddress?: string) => void,
 ) => (() => void) | Promise<() => void>;
 
 /**
@@ -1092,10 +1091,12 @@ export interface MultiTrackCatalogTrack {
   /** `"fec-repair"` marks a self-describing repair track (draft-ramadan-moq-fec
    *  §6.3). Absent on media tracks and on naming-era catalogs. */
   packaging?: string;
-  /** The one source track this repair track carries repair symbols for. Layers
-   *  1..n and a keyframe overlay are reachable only through `depends`; layer 0
-   *  is additionally named by the source's `fec.repairTrack`. */
-  depends?: string[];
+  /** The source track this repair track carries repair symbols for
+   *  (draft-ramadan-moq-fec-catalog-00 3.2), with `instanceId` naming the
+   *  instance (default 0). Layer 0 is also named by the instance's
+   *  `repairTrack`. */
+  source?: string;
+  instanceId?: number;
   /** Base layer index. Absent on a keyframe overlay, which is a separate FEC
    *  instance rather than a member of the layer chain. */
   repairLayer?: number;
@@ -1229,47 +1230,40 @@ function altGroupKey(track: MultiTrackCatalogTrack): string {
 }
 
 /**
- * Every repair track of each source: layer 0 named by the source's
- * `fec.repairTrack`, plus every self-describing `packaging: "fec-repair"` track
- * whose `depends` names that source (layers 1..n and a keyframe overlay), per
- * draft-ramadan-moq-fec §6.3.
- *
- * Membership comes from the explicit pointer and from `depends`, never from a
- * name suffix, so a publisher-chosen name like "parity-alpha" resolves.
- *
- * This deliberately does not call `resolveRepairLayers`: that validates the
- * full layer contract and requires `packaging: "mmtp"` on the source plus a
- * declared layer-0 repair track, neither of which a `MultiTrackCatalog`
- * carries. Running it here would throw on every naming-era catalog. Ownership
- * registration needs membership only; RS_ID offsets and layer ordering are the
- * decoder's concern, not the router's.
+ * Every repair track each source names or is named by: each `fec` instance's
+ * `repairTrack`, plus every `packaging: "fec-repair"` track whose `source`
+ * names it (draft-ramadan-moq-fec-catalog-00 3.2). Membership only, so a
+ * source whose FEC is not `ok` still keeps its legs roled `repair`; which legs
+ * get an owner is the source's binding's (`resolveFecBindings`). Never from a
+ * name suffix.
  */
 function repairTrackNamesBySource(
   tracks: readonly MultiTrackCatalogTrack[],
 ): Map<string, Set<string>> {
   const bySource = new Map<string, Set<string>>();
-  const add = (source: string, repair: string): void => {
-    if (!source || !repair) return;
+  const add = (source: unknown, repair: unknown): void => {
+    if (typeof source !== "string" || typeof repair !== "string" || !source || !repair) return;
     const names = bySource.get(source) ?? new Set<string>();
     names.add(repair);
     bySource.set(source, names);
   };
   for (const track of tracks) {
-    // The explicit pointer counts whether or not the source's FEC config is
-    // usable (an unimplemented block profile leaves the track without FEC,
-    // not without its repair track): ownership is membership, not
-    // decodability, so no isFecCatalogConfig gate here.
-    const repairTrack = typeof track.fec === "object" && track.fec !== null
-      ? (track.fec as { readonly repairTrack?: unknown }).repairTrack
-      : undefined;
-    if (typeof repairTrack === "string") add(track.name, repairTrack);
-    if (track.packaging === "fec-repair" && Array.isArray(track.depends) && track.depends.length === 1) {
-      add(track.depends[0]!, track.name);
+    if (Array.isArray(track.fec)) {
+      for (const instance of track.fec) add(track.name, (instance as { repairTrack?: unknown } | null)?.repairTrack);
     }
+    if (track.packaging === "fec-repair") add(track.source, track.name);
   }
   return bySource;
 }
 
+/** The repair tracks an `ok` binding joins: base layers, then the overlay. */
+function boundRepairNames(binding: FecSourceBinding | undefined): string[] {
+  if (binding?.status !== "ok") return [];
+  const names = binding.layers.map((layer) => layer.repairTrackName);
+  if (binding.overlay) names.push(binding.overlay.repairTrackName);
+  return names;
+}
+
 export class MulticastManager {
   readonly #fec: FECManager;
   readonly #router: MmtpRouter;
@@ -2032,10 +2026,6 @@ export class MulticastManager {
   onTrackPacket(packetId: number, cb: TrackPacketCallback) {
     this.#router.onTrackPacket(packetId, cb);
   }
-  /** @deprecated Use onTrackInit(packetId, cb); see MmtpRouter.onInitSegment. */
-  onInitSegment(cb: (data: Uint8Array) => void) {
-    this.#router.onInitSegment(cb);
-  }
   onTrackInit(packetId: number, cb: (data: Uint8Array) => void) {
     this.#router.onTrackInit(packetId, cb);
   }
@@ -2321,8 +2311,13 @@ export class MulticastManager {
         tracks: Object.freeze(endpoint.tracks.map(({ name, packetId }) => Object.freeze({ name, packetId }))),
         ...(endpoint.flow === undefined ? {} : { flow: endpoint.flow }),
       };
-      const onPacket = (packet: Uint8Array) => {
-        if (!released) this.#router.feedPacket(packet, "multicast", ingress);
+      let sender: string | undefined;
+      const onPacket = (packet: Uint8Array, sourceAddress?: string) => {
+        if (released) return;
+        // The media join's sender owns the repair too; this group's own first
+        // sender stands in only until the media join has one.
+        if (sourceAddress !== undefined && sourceAddress !== (this.#transport.sender ?? (sender ??= sourceAddress))) return;
+        this.#router.feedPacket(packet, "multicast", ingress);
       };
       const fail = (error: unknown) =>
         console.warn(`[MulticastManager] repair group ${endpoint.group}:${endpoint.port} not joined`, error);
@@ -2332,7 +2327,10 @@ export class MulticastManager {
           .then((release) => (released ? safely(release) : releases.push(release)), fail);
         continue;
       }
-      const transport = new MulticastTransport((packet) => onPacket(packet), { gateway: provider });
+      const transport = new MulticastTransport((packet) => onPacket(packet), {
+        gateway: provider,
+        lockedTo: () => this.#transport.sender,
+      });
       releases.push(() => transport.dispose());
       void transport.join({
         sourceAddress: endpoint.source,
@@ -2663,8 +2661,8 @@ export class MulticastManager {
    *  transport attribution in FEC path counters.
    *  The `router` accessor above is already public.
    */
-  feedPacket(data: ArrayBuffer | Uint8Array, ingress?: MmtpIngressContext) {
-    this.#transport.feedPacket(data, ingress);
+  feedPacket(data: ArrayBuffer | Uint8Array, ingress?: MmtpIngressContext, sourceAddress?: string) {
+    this.#transport.feedPacket(data, ingress, sourceAddress);
   }
 
   /**
@@ -2718,20 +2716,18 @@ export class MulticastManager {
    * D-17: Builds altGroup → track-name index for getSwitchingSet() (repair legs excluded).
    * D-26: Registers packetId → TrackRole on MmtpRouter for block-complete fanout.
    *
-   * FEC availability is per track (draft-ramadan-moq-fec §5.1). A media track
-   * whose `fec` names no implemented `blockProfile` (only `iso-ssbg1-v1` is
-   * implemented; the retired `k-padded-v1` is not), or an `iso-ssbg1-v1` span
-   * it cannot use, is consumed without FEC: it gets no decoder, and none of
-   * its repair tracks (layer 0 by `fec.repairTrack`, further layers and the
-   * overlay by `depends`) is given an owner, so the router drops their packets
-   * before any decoder. Those legs keep the `repair` role and their owner's
-   * switching set. Neither the call nor any other track's FEC fails on that
-   * account; `trackFecUnavailable(name)` reports the reason. FEC a previous
-   * call configured on a packetId this call does not is released
-   * (FECManager.releasePacket); frames its release gate held are delivered in
-   * order, each gap stalled. FEC wired by hand (setFecDecoder) is left alone.
-   * Geometry a decoder could not configure (K, P, T, `repairTrack`,
-   * algorithm) still throws.
+   * FEC is per track and per instance (`resolveFecBindings`,
+   * draft-ramadan-moq-fec-catalog-00 array, fec-core-00 10.3). A media track
+   * whose base instance is not `ok` (an invalid instance, a profile other than
+   * `iso-ssbg1-v1`, a draft-01 object `fec`) is consumed without FEC: it gets
+   * no decoder, and none of its repair tracks is given an owner, so the router
+   * drops their packets before any decoder. Those legs keep the `repair` role
+   * and their owner's switching set. Neither the call nor any other track's
+   * FEC fails on that account; `trackFecUnavailable(name)` reports the reason.
+   * FEC a previous call configured on a packetId this call does not is
+   * released (FECManager.releasePacket); frames its release gate held are
+   * delivered in order, each gap stalled. FEC wired by hand (setFecDecoder) is
+   * left alone.
    *
    * @param catalog - Multi-track catalog (tracks array with name, altGroup, fec, packetId).
    * @param wasmDecoderSource - One WASM FEC decoder for a single FEC stream, or
@@ -2756,44 +2752,27 @@ export class MulticastManager {
     // mis-roled or rejected on its name, and would land in its own altGroup
     // rather than its owner's.
     const repairNamesBySource = repairTrackNamesBySource(catalog.tracks);
-    // §5.1: classify each media track's FEC before roles are resolved. A track
-    // whose FEC is unavailable still names its layer 0 by `fec.repairTrack`;
-    // that pointer is a catalog fact about the leg, not about the profile, so
-    // the leg stays roled `repair` in its owner's group rather than falling
-    // through to its name. It is never given an owner below.
-    const declaredRepairNames = new Set<string>();
-    for (const names of repairNamesBySource.values()) {
-      for (const name of names) declaredRepairNames.add(name);
-    }
+    // FEC per source, per instance (fec-core-00 10.3). A configureMultiTrack
+    // catalog is MMTP by construction, so a media track that states no
+    // `packaging` is read as `mmtp`.
+    const bindings = resolveFecBindings({
+      tracks: catalog.tracks.map((track) =>
+        track.packaging === undefined ? { ...track, packaging: "mmtp" } : track,
+      ),
+    });
     const fecUnavailableByTrack = new Map<string, TrackFecUnavailable>();
-    for (let i = 0; i < catalog.tracks.length; i++) {
-      const track = catalog.tracks[i]!;
-      if (
-        track.fec === undefined ||
-        track.packaging === "fec-repair" ||
-        declaredRepairNames.has(track.name)
-      ) {
-        continue;
-      }
-      const fecUnavailable = catalogFecUnavailable(track.fec, `$.tracks[${i}].fec`);
-      if (fecUnavailable === undefined) continue;
-      fecUnavailableByTrack.set(track.name, fecUnavailable);
-      const layerZero = (track.fec as { repairTrack?: unknown }).repairTrack;
-      if (typeof layerZero === "string" && layerZero.length > 0) {
-        const names = repairNamesBySource.get(track.name) ?? new Set<string>();
-        names.add(layerZero);
-        repairNamesBySource.set(track.name, names);
-      }
-    }
-    // Every repair leg of a source without FEC goes unowned, including one a
-    // source with FEC also names: the router could not tell the two sources'
-    // symbols apart on it, and the unavailable source's must reach no decoder.
-    const unownedRepairNames = new Set<string>();
-    for (const sourceName of fecUnavailableByTrack.keys()) {
-      for (const repairName of repairNamesBySource.get(sourceName) ?? []) {
-        unownedRepairNames.add(repairName);
-      }
-    }
+    for (const binding of bindings.values()) {
+      if (binding.status === "unavailable") fecUnavailableByTrack.set(binding.track, binding.reason);
+    }
+    // Only the legs an `ok` binding joins get an owner. Every other named leg
+    // (a source without FEC, a dropped overlay, a leg two sources name) keeps
+    // its `repair` role and reaches no decoder.
+    const ownedRepairNames = new Set<string>();
+    const claimed = new Map<string, number>();
+    for (const binding of bindings.values()) {
+      for (const name of boundRepairNames(binding)) claimed.set(name, (claimed.get(name) ?? 0) + 1);
+    }
+    for (const [name, count] of claimed) if (count === 1) ownedRepairNames.add(name);
     const repairOwnerGroup = new Map<string, string>();
     for (const track of catalog.tracks) {
       for (const repairName of repairNamesBySource.get(track.name) ?? []) {
@@ -2854,17 +2833,8 @@ export class MulticastManager {
     const fecTrackIndexes: number[] = [];
     for (let i = 0; i < catalog.tracks.length; i++) {
       const track = catalog.tracks[i]!;
-      if (resolvedRoles[i] === "repair" || track.fec === undefined) continue;
-      // Malformed geometry fails the call whatever the profile says; an
-      // unavailable profile or span only costs this track its FEC (§5.1).
-      const unavailable = fecUnavailableByTrack.has(track.name);
-      if (!(unavailable ? isFecCatalogGeometry(track.fec) : isFecCatalogConfig(track.fec))) {
-        throw new Error(
-          `[MulticastManager] invalid fec config for track '${track.name}'`,
-        );
-      }
-      if (unavailable) continue;
-      if (track.packetId !== undefined) fecTrackIndexes.push(i);
+      if (resolvedRoles[i] === "repair" || track.packetId === undefined) continue;
+      if (bindings.get(track.name)?.status === "ok") fecTrackIndexes.push(i);
     }
 
     // Stateful decoders cannot span physical streams: resetting one stream
@@ -2966,15 +2936,16 @@ export class MulticastManager {
 
       // D-07: Apply per-track FEC config for non-repair tracks. A track whose
       // FEC is unavailable (§5.1) is consumed like a track without `fec`.
-      if (track.fec !== undefined && !fecUnavailableByTrack.has(track.name)) {
-        const fecCfg = track.fec as FecCatalogConfig;
+      const binding = bindings.get(track.name);
+      if (binding?.status === "ok") {
+        const fecCfg = binding.base;
         // Every repair layer and the keyframe overlay route to this source's
         // decoder, not only layer 0. A layer whose packetId had no registered
         // owner would have its repair symbols dropped as an unknown owner, and
         // two sources whose RS_ID ranges overlap would be indistinguishable.
         if (track.packetId !== undefined) {
-          for (const repairName of repairNamesBySource.get(track.name) ?? []) {
-            if (unownedRepairNames.has(repairName)) continue;
+          for (const repairName of boundRepairNames(binding)) {
+            if (!ownedRepairNames.has(repairName)) continue;
             const repairTrack = catalogTracksByName.get(repairName);
             if (repairTrack?.packetId !== undefined) {
               this.#router.setRepairPacketIdOwner(repairTrack.packetId, track.packetId);
@@ -2988,7 +2959,7 @@ export class MulticastManager {
           // have no FEC in Phase 14 (D-26 covers video base+delta only). Callers that need
           // audio FEC can call setFecDecoder() directly after configureMultiTrack().
           const blockProfile = parseFecBlockProfile(
-            (fecCfg as { blockProfile?: unknown }).blockProfile,
+            fecCfg.blockProfile,
             `tracks[${JSON.stringify(track.name)}].fec.blockProfile`,
           );
           this.#fec.setFecDecoder(
@@ -3021,14 +2992,11 @@ export class MulticastManager {
 
   /**
    * Why `configureMultiTrack` consumes the named catalog track without FEC
-   * although its `fec` block declares one (draft-ramadan-moq-fec §5.1): no
-   * implemented `blockProfile` (`track_fec_block_profile_unimplemented`, e.g.
-   * the retired `k-padded-v1`; `track_fec_block_profile` when absent), or an
-   * invalid `iso-ssbg1-v1` span (`track_fec`). Absent/zero spans keep in-band
-   * decoding enabled. The same reason the hang
-   * resolver reports (`catalogFecUnavailable`). Undefined for every other
-   * track, and for every track before the first call; each call replaces the
-   * previous call's answers.
+   * although it declares some: its base instance is not `ok`, with the
+   * validator's code and path (`TrackFecUnavailable`), the same reason the
+   * hang resolver reports (`catalogTrackFecUnavailable`). Undefined for every
+   * other track, and for every track before the first call; each call
+   * replaces the previous call's answers.
    */
   trackFecUnavailable(trackName: string): TrackFecUnavailable | undefined {
     return this.#fecUnavailableByTrack.get(trackName);

package/src/multicast-transport.ts

@@ -133,6 +133,15 @@ export interface MulticastTransportStats {
    * `droppedPacketIds` slot.
    */
   packetsDroppedSignaling: number
+  /**
+   * From a sender other than the one this join locked to (BLO-50098). An
+   * unprotected ASM subscription admits any source, so two senders can share
+   * one (G, port, packet_id); the first sender whose packet is accepted owns
+   * the sub-flow until the next join, and every other sender is dropped here,
+   * before any gap, duplicate or FEC ledger sees it. A join or a silence
+   * failback releases the lock.
+   */
+  packetsDroppedForeignSender: number
 }
 
 /**
@@ -197,6 +206,12 @@ function hasMulticastGateway(): boolean {
   return typeof getMulticastGlobals().multicast?.subscribe === 'function'
 }
 
+/** The `bytes` event's sender (multicast-contract 1.3.0); undefined when unknown. */
+function senderOf(event: CustomEvent<unknown>): string | undefined {
+  const sourceAddress = (event as { sourceAddress?: unknown }).sourceAddress
+  return typeof sourceAddress === 'string' ? sourceAddress : undefined
+}
+
 /**
  * The packet one `bytes` event (or one element of a `packets` batch) carries,
  * as a view of the provider's own bytes. A Uint8Array is used as it is; the
@@ -293,6 +308,7 @@ export class MulticastTransport<TPacketContext = never> {
     packetsDroppedUnregisteredPid: 0,
     packetsDroppedUnparseable: 0,
     packetsDroppedSignaling: 0,
+    packetsDroppedForeignSender: 0,
   }
   // join() calls by how they resolved; see joinStats.
   #joinsSucceeded = 0
@@ -317,6 +333,11 @@ export class MulticastTransport<TPacketContext = never> {
   // per packet once a count outgrows the small-integer range.
   readonly #acceptedBytesByPacketId = new Map<number, { bytes: number }>()
   #packetIds: ReadonlySet<number> | null = null
+  // The sender S this join's accepted packets came from, once known; see
+  // packetsDroppedForeignSender. Cleared by every join and by a silence
+  // failback, so a replacement publisher is not locked out.
+  #sender: string | undefined = undefined
+  readonly #lockedTo: (() => string | undefined) | undefined
   // What the live join delivers with each accepted packet. A field, not a
   // listener closure, so an in-place admission change (setContext) applies
   // from the next packet on without rejoining.
@@ -340,12 +361,18 @@ export class MulticastTransport<TPacketContext = never> {
   // The provider to subscribe through; window.multicast when unset.
   readonly #gateway: WindowMulticastGateway | undefined
 
+  /**
+   * `lockedTo` reads the sender another transport is locked to (a repair
+   * group follows its media join, whose publisher sends both). While it reads
+   * a sender, this join admits only that one; until then its own lock applies.
+   */
   constructor(
     onPacket: (packet: Uint8Array, context?: TPacketContext) => void,
-    options: { gateway?: WindowMulticastGateway } = {},
+    options: { gateway?: WindowMulticastGateway; lockedTo?: () => string | undefined } = {},
   ) {
     this.#onPacket = onPacket
     this.#gateway = options.gateway
+    this.#lockedTo = options.lockedTo
   }
 
   static isAvailable(): boolean {
@@ -356,6 +383,7 @@ export class MulticastTransport<TPacketContext = never> {
     const generation = ++this.#joinGeneration
     this.#releaseSubscription()
     this.#dataPlaneLive = false
+    this.#sender = undefined
 
     if (this.#disposed) return this.#declined(generation, 'disposed')
     const gateway = this.#gateway ?? getMulticastGlobals().multicast
@@ -411,7 +439,13 @@ export class MulticastTransport<TPacketContext = never> {
       // one DOM event and one liveness read per batch instead of per packet
       // (BLO-36599). Every packet still goes through the same filter, counters
       // and callback, in arrival order, as a view of the provider's bytes.
-      const packetListener: PacketListener = subscriptionDeliversPacketBatches(subscription)
+      // A batch carries no per-packet sender, so an any-source join, the one
+      // join that can see two senders, listens to `bytes` (BLO-50098). That
+      // costs batching on every any-source join, including one on a pre-1.3.0
+      // provider that sends no sender and so gets no lock for it; keep it
+      // unless the provider can say it carries the sender.
+      const anySource = !config.sourceAddress && !config.senderAddress && !config.atsc3
+      const packetListener: PacketListener = !anySource && subscriptionDeliversPacketBatches(subscription)
         ? {
             type: 'packets',
             listener: (event) => {
@@ -423,7 +457,7 @@ export class MulticastTransport<TPacketContext = never> {
             type: 'bytes',
             listener: (event) => {
               if (!live()) return
-              if (this.#deliver(event.detail)) this.#resetWatchdog()
+              if (this.#deliver(event.detail, senderOf(event))) this.#resetWatchdog()
             },
           }
       this.#packetListener = packetListener
@@ -546,13 +580,13 @@ export class MulticastTransport<TPacketContext = never> {
    * One packet from the subscription: filter, count, and hand it to the
    * callback. Returns whether it was delivered; the caller notes liveness.
    */
-  #deliver(detail: unknown): boolean {
+  #deliver(detail: unknown, sourceAddress?: string): boolean {
     const packet = normalizeBytesEventDetail(detail)
     if (!packet) {
       this.#stats.packetsDroppedUnparseable++
       return false
     }
-    if (!this.#acceptPacket(packet)) return false
+    if (!this.#acceptPacket(packet, sourceAddress)) return false
     // Read per packet: a callback that changes the admission (an in-place
     // rendition switch committing on this very packet) takes effect from the
     // next packet, including the rest of a batch.
@@ -604,11 +638,15 @@ export class MulticastTransport<TPacketContext = never> {
     }
   }
 
-  /** Feed a raw packet from an external source (e.g., AMT tunnel or ASM subscription). */
-  feedPacket(data: ArrayBuffer | Uint8Array, context?: TPacketContext): void {
+  /**
+   * Feed a raw packet from an external source (e.g., AMT tunnel or ASM
+   * subscription). `sourceAddress` is the datagram's sender when the source
+   * knows it; see packetsDroppedForeignSender.
+   */
+  feedPacket(data: ArrayBuffer | Uint8Array, context?: TPacketContext, sourceAddress?: string): void {
     if (this.#disposed) return
     const packet = data instanceof Uint8Array ? data : new Uint8Array(data)
-    if (!this.#acceptPacket(packet)) return
+    if (!this.#acceptPacket(packet, sourceAddress)) return
     this.#onPacket(packet, context)
     this.#resetWatchdog()
   }
@@ -778,6 +816,11 @@ export class MulticastTransport<TPacketContext = never> {
     return this.#withdrawnPacketIdDrops
   }
 
+  /** The sender this join is locked to; undefined until one is known. */
+  get sender(): string | undefined {
+    return this.#sender
+  }
+
   /** Whether a subscription is live: joined, and not yet released or replaced. */
   get joined(): boolean {
     return this.#subscription !== null
@@ -953,7 +996,13 @@ export class MulticastTransport<TPacketContext = never> {
   }
 
   /** The ingress filter; an accepted packet is counted here, once. */
-  #acceptPacket(packet: Uint8Array): boolean {
+  #acceptPacket(packet: Uint8Array, sourceAddress?: string): boolean {
+    // Absent means unknown (a pre-1.3.0 provider, a tuner): never a new sender.
+    const owner = this.#lockedTo?.() ?? this.#sender
+    if (sourceAddress !== undefined && owner !== undefined && sourceAddress !== owner) {
+      this.#stats.packetsDroppedForeignSender++
+      return false
+    }
     // This early read is intentional: rejected PIDs must not affect page
     // delivery, receive statistics, or the failback liveness watchdog. It
     // refuses exactly what parseMMTPHeader refuses but builds no header
@@ -963,7 +1012,7 @@ export class MulticastTransport<TPacketContext = never> {
       // Without an allow-list there is no filter to enforce, so an unparseable
       // packet keeps flowing to the router as before.
       if (!this.#packetIds) {
-        this.#countAccepted(packet, null)
+        this.#countAccepted(packet, null, sourceAddress)
         return true
       }
       this.#stats.packetsDroppedUnparseable++
@@ -977,7 +1026,7 @@ export class MulticastTransport<TPacketContext = never> {
       return false
     }
     if (!this.#packetIds || this.#packetIds.has(packetId)) {
-      this.#countAccepted(packet, packetId)
+      this.#countAccepted(packet, packetId, sourceAddress)
       return true
     }
     this.#recordUnregisteredPidDrop(packetId)
@@ -985,7 +1034,8 @@ export class MulticastTransport<TPacketContext = never> {
   }
 
   /** Receive counters for one accepted packet; `packetId` is null when it has none. */
-  #countAccepted(packet: Uint8Array, packetId: number | null): void {
+  #countAccepted(packet: Uint8Array, packetId: number | null, sourceAddress: string | undefined): void {
+    this.#sender ??= sourceAddress
     this.#stats.packetsReceived++
     this.#stats.bytesReceived += packet.byteLength
     if (packetId === null) return
@@ -1067,6 +1117,9 @@ export class MulticastTransport<TPacketContext = never> {
       console.warn(
         `[MulticastTransport] No packets for ${this.#failbackWindowMs}ms; failing back to MoQ`,
       )
+      // The sub-flow's owner went silent: a sender that resumes after this,
+      // the same one or a replacement publisher, owns the sub-flow anew.
+      this.#sender = undefined
       this.#onFailback({ kind: 'silence', windowMs: this.#failbackWindowMs })
     }, delayMs)
   }