@blockcast/mmt-container 2.2.0-main.73af0eedcbc8 → 2.2.0-main.75b39a2cdddf

package/src/mmtp-container-parser.ts

@@ -248,7 +248,10 @@ export interface FecReleaseGate {
 export interface MmtpTimingBudgetStats {
   /** Slots currently charged to declared-but-undelivered samples. */
   pending: number
-  /** Total slots available; `pending === capacity` rejects every new moof. */
+  /**
+   * Slots each stream's window holds (`maxBufferedMfus`). A stream at
+   * capacity displaces its own oldest timing; `pending` sums every stream.
+   */
   capacity: number
   /** Slots returned by samples the combiner abandoned (evicted or timed out). */
   reclaimed: number
@@ -259,7 +262,13 @@ export interface MmtpTimingBudgetStats {
    * up, `evicted` is loss that was never observable at all.
    */
   evicted: number
-  /** Movie fragments refused because the budget had no room for their samples. */
+  /**
+   * Movie fragments refused because the budget had no room for their samples.
+   * Stays 0 with a window per stream (BLO-52085): a stream at capacity
+   * displaces its own oldest timing to make room, and a moof declaring more
+   * samples than a whole window holds is refused as invalid before any budget
+   * is consulted. Kept as a guard, and because it is public.
+   */
   rejectedMovieFragments: number
 }
 
@@ -365,10 +374,22 @@ export type MmtpFeedDropReason =
   /** No timing resolver, or it refused the initialization segment. */
   | 'init-timing-refused'
   | 'fragment-unexpected-fragmentation'
+  /** FT=1 before an FT=0 has bound the stream's timing track. */
   | 'fragment-no-resolver'
-  /** addMovieFragment refused — includes the pending-timing-sample budget. */
+  /** addMovieFragment refused: the moof does not parse against the stream's
+   *  track, conflicts with a pending copy of itself, or repeats a pending
+   *  copy whose samples are partly consumed. Never the timing budget: a full
+   *  window displaces the stream's own oldest timing. */
   | 'fragment-timing-refused'
   | 'unknown-fragment-type'
+  /** Stable code, no longer produced: an FT=2 with no timing (before the
+   *  stream's first FT=0, or after setTrack dropped it) now waits for its
+   *  timing like one whose FT=1 has not arrived. A head counts as
+   *  `drop:mfu-sample-timing-missing` (parked) and a FI=2/FI=3 continuation
+   *  as the `pending` record. A continuation that completes a head the
+   *  reassembler buffered before the timing was dropped counts as
+   *  `drop:assembled-timing-missing`. A panel keyed on this code reads zero:
+   *  a re-attribution, not lost coverage. Re-key on both drop codes. */
   | 'mfu-no-resolver'
   | 'mfu-empty-payload'
   | 'mfu-du-header-missing'
@@ -679,7 +700,10 @@ class FrameSequencer {
 // ── FecReleaseSequencer ─────────────────────────────────────────────
 
 /** Authored decode-time adjacency: the next frame starts where this one ends. */
-function authoredAdjacent(before: FrameMeta, after: FrameMeta): boolean {
+export function authoredAdjacent(
+  before: Pick<FrameMeta, 'authoredTiming'>,
+  after: Pick<FrameMeta, 'authoredTiming'>,
+): boolean {
   const a = before.authoredTiming
   const b = after.authoredTiming
   if (!a || !b || a.mediaTimescale !== b.mediaTimescale) return false
@@ -1089,9 +1113,30 @@ interface AwaitingTimingHead {
   mpuSequenceNumber: number
   movieFragmentSequenceNumber: number
   sampleNumber: number
+  /** MMTP packet sequence number; a recovered copy carries its source's. */
+  sequenceNumber: number
   arrivedAt: number
 }
 
+/** FEC-recovered heads that went through the awaiting-timing queue. Every
+ * count but `pending` is cumulative. A held head is pending or has left the
+ * queue exactly once, so `held - expired - discarded - superseded - pending`
+ * is the number fed again once their FT=1 landed. That feed can still refuse
+ * one (size, offset, dispose from a frame callback); the refusal is counted in
+ * `feedStats.deferredOutcomes`, not here. */
+export interface MmtpRecoveredHeadTimingStats {
+  /** Held because their sample's FT=1 had not arrived yet. */
+  held: number
+  /** Left without timing: the reassembler-timeout deadline, or pushed out by the queue's capacity. */
+  expired: number
+  /** Dropped with their stream (track reconfigure, reset or retire) or by dispose(). */
+  discarded: number
+  /** Gave way to their arriving source copy, which takes their place in the queue. */
+  superseded: number
+  /** In the queue now; current occupancy, not cumulative. */
+  pending: number
+}
+
 const MAX_AWAITING_TIMING_HEADS = 8
 
 // ── MmtpContainerParser ─────────────────────────────────────────────
@@ -1129,6 +1174,9 @@ export class MmtpContainerParser {
   #reclaimedTimingSamples = 0
   #evictedTimingSamples = 0
   #rejectedMovieFragments = 0
+  #recoveredHeadsAwaitingTiming: Omit<MmtpRecoveredHeadTimingStats, 'pending'> = {
+    held: 0, expired: 0, discarded: 0, superseded: 0,
+  }
   #sequencers = new Map<string, { packetId: number; sequencer: FrameSequencer }>()
   #fecGate: FecReleaseGate | null = null
   #fecSequencer: FecReleaseSequencer | null = null
@@ -1330,11 +1378,12 @@ export class MmtpContainerParser {
   /**
    * Typed view of the ISO-BMFF timing-sample budget.
    *
-   * This is the acceptance signal for the budget ratchet: `pending` walking
-   * to `capacity` while `rejectedMovieFragments` climbs is the stream wedging,
-   * and it is observable here rather than only as media silently stopping.
-   * Per repo policy this is a producer-owned counter -- never infer budget
-   * state by parsing logs.
+   * Each stream admits timing against its own window of `capacity` slots
+   * (BLO-52085). A stream at capacity displaces its own oldest timing to
+   * admit the moof in hand, and `evicted` counts the slots so displaced:
+   * timing a stream declared and never delivered shows up there. `pending`
+   * sums every stream, so it can exceed `capacity`. Per repo policy this is
+   * a producer-owned counter -- never infer budget state by parsing logs.
    */
   get timingBudgetStats(): Readonly<MmtpTimingBudgetStats> {
     return {
@@ -1346,6 +1395,15 @@ export class MmtpContainerParser {
     }
   }
 
+  /** Recovered heads parked for FT=1 timing (BLO-53369). Survives dispose(). */
+  get recoveredHeadsAwaitingTiming(): Readonly<MmtpRecoveredHeadTimingStats> {
+    let pending = 0
+    for (const { awaitingTiming } of this.#timingStreams.values()) {
+      for (const head of awaitingTiming) if (head.options?.recovered) pending++
+    }
+    return { ...this.#recoveredHeadsAwaitingTiming, pending }
+  }
+
   get reorderStats(): Readonly<MmtpReorderStats> {
     let bufferedFrames = this.#fecSequencer?.buffered ?? 0
     for (const { sequencer } of this.#sequencers.values()) bufferedFrames += sequencer.buffered
@@ -1541,7 +1599,7 @@ export class MmtpContainerParser {
     const now = Date.now()
     for (const { awaitingTiming } of this.#timingStreams.values()) {
       while (awaitingTiming.length > 0 && now - awaitingTiming[0]!.arrivedAt > timeoutMs) {
-        awaitingTiming.shift()
+        this.#leaveAwaitingTiming(awaitingTiming.shift()!, 'expired')
       }
     }
   }
@@ -1711,17 +1769,27 @@ export class MmtpContainerParser {
       if (mpu.fragmentationIndicator !== 0 || mpu.fragmentCounter !== 0)
         return this.#drop('fragment-unexpected-fragmentation')
       const resolver = this.#timingResolver(streamKey, info.packetId, false)
-      if (!resolver) return this.#drop('fragment-no-resolver')
+      if (!resolver?.initialized) return this.#drop('fragment-no-resolver')
       const pendingBefore = resolver.pendingSampleCount
       const evictedBefore = resolver.evictedSampleCount
-      const remaining = this.#maxPendingTimingSamples - this.#pendingTimingSamples
-      const admitted = resolver.addMovieFragment(mpu.mpuSequenceNumber, data, remaining)
+      // Each stream's window is the whole budget. A resolver can displace only
+      // its own timing, so a pool shared across streams let one stream's
+      // unconsumed slots refuse another stream's moofs with nothing to
+      // displace: BLO-52085 G7b, overlay-rebuilt video keyframes refusing audio.
+      const remaining = this.#maxPendingTimingSamples - resolver.pendingSampleCount
+      const admitted = resolver.addMovieFragment(
+        mpu.mpuSequenceNumber,
+        data,
+        remaining,
+        options?.recovered === true,
+      )
       // Sync on BOTH paths: the resolver can displace stale timing and still
-      // refuse the fragment in hand, and a global count that missed those
-      // freed slots would keep refusing on a budget that is no longer full.
+      // refuse the fragment in hand, and the total must count those freed slots.
       this.#pendingTimingSamples += resolver.pendingSampleCount - pendingBefore
       this.#evictedTimingSamples += resolver.evictedSampleCount - evictedBefore
       if (!admitted) {
+        // Never 'budget' with a window per stream (see
+        // `rejectedMovieFragments`); kept as a guard.
         if (resolver.lastMovieFragmentRejection === 'budget') {
           this.#rejectedMovieFragments++
         }
@@ -1739,7 +1807,11 @@ export class MmtpContainerParser {
     }
     if (fragmentType !== 2) return this.#drop('unknown-fragment-type')
 
-    const resolver = this.#timingResolver(streamKey, info.packetId, false)
+    // An FT=2 before the stream's first FT=0 (a join, a track reset) is taken
+    // like one whose FT=1 has not arrived: a head waits for its timing, a
+    // continuation parks in the reassembler, and a later or FEC-recovered
+    // FT=0/FT=1 can still time them.
+    const resolver = this.#timingResolver(streamKey, info.packetId, true)
     if (!resolver) return this.#drop('mfu-no-resolver')
     if (!Number.isSafeInteger(data.byteLength) || data.byteLength <= 0)
       return this.#drop('mfu-empty-payload')
@@ -1761,6 +1833,7 @@ export class MmtpContainerParser {
           mpuSequenceNumber: mpu.mpuSequenceNumber,
           movieFragmentSequenceNumber: mfuDuHeader.movieFragmentSequenceNumber,
           sampleNumber: mfuDuHeader.sampleNumber,
+          sequenceNumber: info.sequenceNumber,
           arrivedAt: Date.now(),
         })
         return this.#drop('mfu-sample-timing-missing')
@@ -2146,6 +2219,18 @@ export class MmtpContainerParser {
     this.#emitFrame(data, meta)
   }
 
+  /** Whether FT=1 metadata already names this sample, without claiming it. */
+  hasAuthoredTimingFor(
+    packetId: number,
+    mpuSequenceNumber: number,
+    movieFragmentSequenceNumber: number,
+    sampleNumber: number,
+    catalogTrackName?: string,
+  ): boolean {
+    return this.#timingResolver(this.#streamKey(packetId, catalogTrackName), packetId, false)
+      ?.sampleTiming(mpuSequenceNumber, movieFragmentSequenceNumber, sampleNumber) != null
+  }
+
   /**
    * Claim and return the authored timing for a recovered sample. Recovery does
    * not pass through the ordinary `feed()` completion path, so it must retire
@@ -2216,6 +2301,9 @@ export class MmtpContainerParser {
     for (const { sequencer } of this.#sequencers.values()) sequencer.discard()
     this.#sequencers.clear()
     this.#fecSequencer?.discard()
+    for (const { awaitingTiming } of this.#timingStreams.values()) {
+      for (const head of awaitingTiming) this.#leaveAwaitingTiming(head, 'discarded')
+    }
     this.#timingStreams.clear()
     this.#pendingTimingSamples = 0
     this.#reliableMoqStartupGate.clear()
@@ -2241,10 +2329,27 @@ export class MmtpContainerParser {
   }
 
   #awaitTiming(streamKey: string, head: AwaitingTimingHead): void {
-    const awaitingTiming = this.#timingStreams.get(streamKey)?.awaitingTiming
-    if (!awaitingTiming) return
+    const state = this.#timingStreams.get(streamKey)
+    if (!state) return
+    // The source copy of a held recovered head takes its place, so the frame
+    // is delivered with source provenance once FT=1 lands.
+    if (!head.options?.recovered) {
+      const kept = state.awaitingTiming.filter(queued =>
+        !queued.options?.recovered || queued.sequenceNumber !== head.sequenceNumber)
+      this.#recoveredHeadsAwaitingTiming.superseded += state.awaitingTiming.length - kept.length
+      state.awaitingTiming = kept
+    }
+    const awaitingTiming = state.awaitingTiming
     awaitingTiming.push(head)
-    if (awaitingTiming.length > MAX_AWAITING_TIMING_HEADS) awaitingTiming.shift()
+    if (head.options?.recovered) this.#recoveredHeadsAwaitingTiming.held++
+    if (awaitingTiming.length > MAX_AWAITING_TIMING_HEADS) {
+      this.#leaveAwaitingTiming(awaitingTiming.shift()!, 'expired')
+    }
+  }
+
+  /** Count a recovered head leaving the queue other than by replay or its source copy. */
+  #leaveAwaitingTiming(head: AwaitingTimingHead, outcome: 'expired' | 'discarded'): void {
+    if (head.options?.recovered) this.#recoveredHeadsAwaitingTiming[outcome]++
   }
 
   /**
@@ -2274,6 +2379,7 @@ export class MmtpContainerParser {
     const state = this.#timingStreams.get(streamKey)
     if (!state) return
     this.#timingStreams.delete(streamKey)
+    for (const head of state.awaitingTiming) this.#leaveAwaitingTiming(head, 'discarded')
     this.#pendingTimingSamples -= state.resolver.pendingSampleCount
     if (this.#pendingTimingSamples < 0) {
       throw new Error('[MmtpContainerParser] pending timing sample accounting underflow')

package/src/mmtp-fec-session.ts

@@ -23,6 +23,15 @@
  * uses. A packet below B_0 at or after the anchor fails the session closed:
  * `stats.failClosed` reports why, and every later repair is refused.
  *
+ * Catalog-less (draft-ramadan-moq-mmt-02 8.3, 13.2): a receiver holding
+ * layer 0 under the AL-FEC message alone builds the session from the message's
+ * fec_flow entry (`alFecFlow`) instead. K, T, the code point and the repair
+ * packet_id come from that entry, and layer 0 is held at
+ * maximum_p_for_repair_flow, standing for O_0 + P_0, by the anchored clause of
+ * draft-ramadan-moq-fec-core-00 7.3.2 alone. A later version that raises the
+ * field raises the held total (updateAlFecFlow()); the message carries no
+ * millisecond budget, so the caller states the retention (fec-core-00 9.4).
+ *
  * Every repair packet that cannot be used is counted under the reason it was
  * refused, and every block ends under exactly one outcome, so a stream whose
  * FEC is doing nothing can be told apart from one with nothing to repair.
@@ -30,6 +39,8 @@
 
 import {
   admitMmtpRepairObject,
+  alFecRaptorQFlowConfig,
+  FEC_CODE_RAPTORQ,
   isoBlockContains,
   isoBlocksBehindLowerBound,
   parseFecBlockProfile,
@@ -39,6 +50,8 @@ import {
   serial32Precedes,
   ssbg1FitsSymbol,
   trimSsbg1SourceSymbol,
+  type AlFecFlow,
+  type AlFecRaptorQFlowConfig,
   type FecBlockProfile,
 } from '@blockcast/mmt-base'
 import { deriveFecRetentionBlocks, fecBlockBudgetMs } from '@blockcast/mmt-fec'
@@ -105,6 +118,25 @@ export interface MmtpFecSessionConfig {
   heldLayers?: readonly number[]
 }
 
+/**
+ * A catalog-less session: one fec_flow entry of the AL-FEC message
+ * (`parseAlFecMessage(...).flows[i]`), draft-ramadan-moq-mmt-02 8.3.
+ */
+export interface MmtpFecSessionMessageConfig {
+  /** The source track's entry; it must pass `alFecRaptorQFlowConfig`. */
+  alFecFlow: AlFecFlow
+  /**
+   * The decoder retention in blocks. The message carries no elapsed-time
+   * budget (mmt-02 7.5), so open-block state is bounded by local policy
+   * (fec-core-00 9.4); required, never defaulted.
+   */
+  retentionBlocks: number
+  Decoder: MmtpFecSessionDecoderConstructor
+}
+
+/** What updateAlFecFlow() did with a later version of the message. */
+export type MmtpFecSessionMessageUpdate = 'raised' | 'unchanged' | 'refused'
+
 /**
  * The path a symbol arrived on: its MoQT subscription, or the multicast
  * group (native SSM or AMT) carrying the same asset. The caller states it;
@@ -197,12 +229,17 @@ export class MmtpFecSession {
   readonly algorithm: 'raptorq' | 'reed-solomon'
   readonly sourceSymbols: number
   /** P_0 = B_0, the held total every repair packet is checked against. */
-  readonly repairSymbols: number
+  get repairSymbols(): number {
+    return this.#repairSymbols
+  }
   readonly symbolSize: number
   /** The decoder's retention, in blocks, derived from the catalog budget. */
   readonly retentionBlocks: number
 
   #decoder: MmtpFecSessionDecoder | null
+  #repairSymbols: number
+  /** The message entry a catalog-less session was built from; undefined under a catalog. */
+  #message: AlFecRaptorQFlowConfig | undefined
   /** Blocks a repair has defined and that are not settled yet, by SS_Start. */
   #blocks = new Map<number, BlockState>()
   /** SS_Starts of settled blocks, so a later repair for one is refused. */
@@ -240,7 +277,26 @@ export class MmtpFecSession {
    *   the scheme, the block profile, K, P_0 (`repairSymbols`), T,
    *   `interleaveDepthMs` or `reorderToleranceMs`. None is defaulted.
    */
-  constructor(config: MmtpFecSessionConfig) {
+  constructor(config: MmtpFecSessionConfig | MmtpFecSessionMessageConfig) {
+    if (config && 'alFecFlow' in config) {
+      const message = alFecRaptorQFlowConfig(config.alFecFlow)
+      if (!message) {
+        throw new Error('MmtpFecSession: the AL-FEC entry is outside draft-ramadan-moq-mmt-02 8.3 (iso-ssbg1-v1)')
+      }
+      this.#message = message
+      // Coding byte 0x14 is the iso-ssbg1-v1 profile (mmt-02 8.3).
+      this.blockProfile = parseFecBlockProfile('iso-ssbg1-v1', 'alFecFlow')
+      this.algorithm = message.fecCodeId === FEC_CODE_RAPTORQ ? 'raptorq' : 'reed-solomon'
+      this.sourceSymbols = message.maximumK
+      this.#repairSymbols = message.maximumP
+      this.symbolSize = message.repairSymbolSize
+      this.retentionBlocks = requirePositiveInteger(config.retentionBlocks, 'retentionBlocks')
+      this.#repairPacketId = message.repairFlowId
+      this.#heldLayers = layerZero(message.maximumP)
+      this.#anchorHorizon = heldLayerAnchorHorizon(this.retentionBlocks, this.sourceSymbols)
+      this.#decoder = buildDecoder(config.Decoder, this)
+      return
+    }
     const fec = config?.fec
     if (!fec || typeof fec !== 'object') {
       throw new Error('MmtpFecSession: the catalog fec instance is required')
@@ -251,7 +307,7 @@ export class MmtpFecSession {
     }
     this.algorithm = fec.scheme
     this.sourceSymbols = requirePositiveInteger(fec.sourceSymbols, 'fec.sourceSymbols')
-    this.repairSymbols = requirePositiveInteger(fec.repairSymbols, 'fec.repairSymbols')
+    this.#repairSymbols = requirePositiveInteger(fec.repairSymbols, 'fec.repairSymbols')
     this.symbolSize = requirePositiveInteger(fec.symbolSize, 'fec.symbolSize')
     const interleaveDepthMs = requireNumber(fec.interleaveDepthMs, 'fec.interleaveDepthMs')
     const reorderToleranceMs = requireNumber(fec.reorderToleranceMs, 'fec.reorderToleranceMs')
@@ -271,17 +327,38 @@ export class MmtpFecSession {
       config.heldLayers,
     )
     this.#anchorHorizon = heldLayerAnchorHorizon(this.retentionBlocks, this.sourceSymbols)
-    if (typeof config.Decoder !== 'function') {
-      throw new Error('MmtpFecSession: a decoder constructor (wasm_bindgen.MmtFecDecoder) is required')
-    }
-    const decoder = new config.Decoder(this.retentionBlocks, this.blockProfile, this.algorithm)
-    try {
-      decoder.configure_params(this.sourceSymbols, this.symbolSize)
-    } catch (error) {
-      decoder.free()
-      throw error
+    this.#decoder = buildDecoder(config.Decoder, this)
+  }
+
+  /**
+   * A later version of the AL-FEC message, catalog-less sessions only. A
+   * maximum_p_for_repair_flow above the held total raises it (`raised`): the
+   * anchored check restarts at the new total, so a block generated under the
+   * previous one stays valid before the first block carrying the new total
+   * (fec-core-00 7.3.2, mmt-02 8.3). A field at or below it changes nothing
+   * (`unchanged`): no publisher lowers it, and the check catches a wire that
+   * does. An entry with another asset, repair flow, code point, K or T, or
+   * one outside 8.3, is `refused`: that is a new source encoding, which needs
+   * a new session. A latched fail-closed stays latched either way.
+   */
+  updateAlFecFlow(flow: AlFecFlow): MmtpFecSessionMessageUpdate {
+    const held = this.#message
+    if (!held) throw new Error('MmtpFecSession: updateAlFecFlow() needs a session built from an AL-FEC entry')
+    const next = alFecRaptorQFlowConfig(flow)
+    if (
+      !next ||
+      next.sourcePacketIds[0] !== held.sourcePacketIds[0] ||
+      next.repairFlowId !== held.repairFlowId ||
+      next.fecCodeId !== held.fecCodeId ||
+      next.maximumK !== held.maximumK ||
+      next.repairSymbolSize !== held.repairSymbolSize
+    ) {
+      return 'refused'
     }
-    this.#decoder = decoder
+    if (next.maximumP <= this.#repairSymbols) return 'unchanged'
+    this.#repairSymbols = next.maximumP
+    this.#heldLayers = layerZero(next.maximumP)
+    return 'raised'
   }
 
   /** True once release() ran. */
@@ -386,7 +463,7 @@ export class MmtpFecSession {
       // An RSB_length below a held layer's total goes to the 7.3.2 stop, not
       // to the discard; the block state is unchanged either way.
       const verdict = this.#heldLayers.failsClosed(
-        repairTrackName, frame.ssStart, frame.rsbLength, this.#anchorHorizon, this.#newestSource,
+        this.#trackFor(repairTrackName), frame.ssStart, frame.rsbLength, this.#anchorHorizon, this.#newestSource,
       )
       if (verdict) {
         this.#stats.failClosed = verdict
@@ -399,7 +476,7 @@ export class MmtpFecSession {
     // fec-01 6.3.9, after the 4.5 discards and the size check, before a block
     // is placed. Without a track name only the anchored rule (b) applies.
     const verdict = this.#heldLayers.admit(
-      repairTrackName,
+      this.#trackFor(repairTrackName),
       frame.ssStart,
       frame.rsbLength,
       this.#anchorHorizon,
@@ -464,6 +541,11 @@ export class MmtpFecSession {
     return true
   }
 
+  /** Catalog-less: layer 0 has no own-track clause (mmt-02 8.3), so no track name is judged. */
+  #trackFor(repairTrackName: string | undefined): string | undefined {
+    return this.#message ? undefined : repairTrackName
+  }
+
   #drop(reason: string): Uint8Array[] {
     this.#stats.dropped[reason] = (this.#stats.dropped[reason] ?? 0) + 1
     return []
@@ -600,6 +682,24 @@ export class MmtpFecSession {
   }
 }
 
+function layerZero(total: number): HeldLayerAdmission {
+  return new HeldLayerAdmission([{ layer: 0, repairTrackName: '', rsIdOffset: 0, repairSymbols: total }])
+}
+
+function buildDecoder(Decoder: MmtpFecSessionDecoderConstructor, session: MmtpFecSession): MmtpFecSessionDecoder {
+  if (typeof Decoder !== 'function') {
+    throw new Error('MmtpFecSession: a decoder constructor (wasm_bindgen.MmtFecDecoder) is required')
+  }
+  const decoder = new Decoder(session.retentionBlocks, session.blockProfile, session.algorithm)
+  try {
+    decoder.configure_params(session.sourceSymbols, session.symbolSize)
+  } catch (error) {
+    decoder.free()
+    throw error
+  }
+  return decoder
+}
+
 function requirePositiveInteger(value: unknown, path: string): number {
   if (typeof value !== 'number' || !Number.isSafeInteger(value) || value <= 0) {
     throw new Error(`MmtpFecSession: ${path} must be a positive integer (got ${String(value)})`)