@norskvideo/moq-net 0.1.2 → 0.1.4

package/ietf/subscriber.js

@@ -1,17 +1,26 @@
 /* @ts-self-types="./subscriber.d.ts" */
-import { Announced } from "../announced.js";
-import { Broadcast } from "../broadcast.js";
-import { Group } from "../group.js";
+import * as announce from "../announced.js";
+import * as broadcast from "../broadcast.js";
+import { BroadcastCache } from "../consume.js";
+import { error, ProtocolViolation, reason } from "../error.js";
+import * as netGroup from "../group.js";
 import * as Path from "../path.js";
-import { error } from "../util/error.js";
-import { TrackAliases } from "./aliases.js";
+import { Timestamp } from "../time.js";
+import { withTimeout } from "../util/timeout.js";
+import { DuplicateTrackAlias, RetiredTrackAlias, TrackAliases } from "./aliases.js";
+import * as Cluster from "./cluster.js";
 import { Frame } from "./object.js";
+import { toWire } from "./priority.js";
 import { PublishError } from "./publish.js";
-import { PublishNamespaceError, PublishNamespaceOk } from "./publish_namespace.js";
+import { PublishNamespace, PublishNamespaceDone, PublishNamespaceError, PublishNamespaceOk, } from "./publish_namespace.js";
 import { RequestError, RequestOk } from "./request.js";
-import { Subscribe, SubscribeError, SubscribeOk, Unsubscribe } from "./subscribe.js";
+import { joinFilter, Subscribe, SubscribeError, SubscribeOk, Unsubscribe } from "./subscribe.js";
 import { PublishBlocked, SubscribeNamespace, SubscribeNamespaceEntry, SubscribeNamespaceEntryDone, SubscribeNamespaceLegacy, SubscribeNamespaceOk, UnsubscribeNamespace, } from "./subscribe_namespace.js";
 import { Version } from "./version.js";
+// Bound on how long stream-open plus SUBSCRIBE_OK may take. Browsers cap
+// concurrent QUIC streams (Chrome ~100); past the cap openBi() silently
+// blocks. The timeout turns that into a clear error.
+const SUBSCRIBE_OK_TIMEOUT_MS = 10_000;
 /**
  * Handles subscribing to broadcasts using moq-transport protocol.
  * Uses the stream-per-request pattern (real bidi streams for v17, virtual for v14-v16).
@@ -20,40 +29,130 @@ import { Version } from "./version.js";
  */
 export class Subscriber {
     #session;
+    // The Hop IDs this session declared; see {@link Cluster}. What the peer declared is what
+    // says whether an advertisement carries a hop path, and ours is what a path looping back
+    // to us contains.
+    #cluster;
     // Publisher-chosen aliases used by incoming group streams.
     #aliases = new TrackAliases();
-    // Any currently active announcements.
-    #announced = new Set();
+    // Units for each track's object Timestamps, from the TIMESCALE Track Property in
+    // SUBSCRIBE_OK. A track missing from this map declared no timeline, so the publisher
+    // opted out of timestamps and its frames are stamped on arrival instead.
+    #timescales = new Map();
+    // Dedup consumed broadcasts per path: repeat consume() calls share one subscription.
+    #consumes = new BroadcastCache();
+    // Paths with a legacy PUBLISH_NAMESPACE request in flight, reserved synchronously.
+    // The count below is only taken once the OK is written, and two requests that both
+    // got past the duplicate check before either attached would both take one.
+    #legacyRequests = new Set();
+    // Every announced path, counted by how many live advertisements reference it.
+    //
+    // A peer may advertise one namespace twice on a session: an unsolicited
+    // PUBLISH_NAMESPACE and an inline NAMESPACE answering our own SUBSCRIBE_NAMESPACE are
+    // two messages about one source, which the MoQ Solicit draft requires us to tolerate.
+    // Counting them is what keeps the second from duplicating the announce and the first
+    // to end from retracting what the other still holds.
+    #announced = new Map();
     // Any consumers that want each new announcement.
     #announcedConsumers = new Set();
     /**
      * Creates a new Subscriber instance.
-     * @param session - The session abstraction for bidi streams and request IDs
      *
      * @internal
      */
-    constructor(session) {
+    constructor({ session, cluster, }) {
         this.#session = session;
+        this.#cluster = cluster;
+    }
+    /**
+     * Whether an advertisement is ours coming back: its hop path already ran through us, so
+     * subscribing via it would route us back to ourselves.
+     *
+     * A conforming peer withholds these (it knows our Hop ID), so this is the backstop that
+     * keeps a mesh working when one member does not. A session that negotiated nothing
+     * carries no path, and there is nothing to check.
+     */
+    #reflected(advert) {
+        return advert !== undefined && this.#cluster !== undefined && Cluster.loops(advert, this.#cluster.self);
     }
     /**
      * Gets an announced reader for the specified prefix.
+     *
+     * The peer is asked with SUBSCRIBE_NAMESPACE regardless of what it declared, and an
+     * unsolicited PUBLISH_NAMESPACE lands here too, so a peer that only tells and one
+     * that only answers are both discovered.
      */
     announced(prefix = Path.empty()) {
-        const announced = new Announced(prefix);
-        for (const active of this.#announced) {
-            if (!Path.hasPrefix(prefix, active))
+        const announced = new announce.Producer(prefix);
+        for (const active of this.#announced.keys()) {
+            const suffix = Path.stripPrefix(prefix, active);
+            if (suffix === null)
                 continue;
-            announced.append({ path: active, active: true });
+            announced.append({ path: suffix, active: true });
         }
         this.#announcedConsumers.add(announced);
         void this.#runAnnounced(announced, prefix).finally(() => {
             this.#announcedConsumers.delete(announced);
             announced.close();
         });
-        return announced;
+        return announced.consume();
+    }
+    /**
+     * Record one more advertisement for a path, telling consumers only when it is the
+     * first. A second one is the same namespace said twice, not news.
+     */
+    #attachAnnounce(path) {
+        const count = this.#announced.get(path) ?? 0;
+        this.#announced.set(path, count + 1);
+        if (count > 0)
+            return;
+        console.debug(`announced: broadcast=${path} active=true`);
+        for (const consumer of this.#announcedConsumers) {
+            const suffix = Path.stripPrefix(consumer.prefix, path);
+            if (suffix === null)
+                continue;
+            consumer.append({ path: suffix, active: true });
+        }
+    }
+    /**
+     * Drop one advertisement for a path, retracting it only once the last one goes.
+     */
+    #detachAnnounce(path) {
+        const count = this.#announced.get(path);
+        if (count === undefined)
+            return;
+        if (count > 1) {
+            this.#announced.set(path, count - 1);
+            return;
+        }
+        this.#announced.delete(path);
+        // The path is gone, so stop sharing its broadcast: a holder outliving the publisher
+        // would otherwise hand the dead generation to whoever consumes the path next.
+        this.#consumes.evict(path);
+        console.debug(`announced: broadcast=${path} active=false`);
+        for (const consumer of this.#announcedConsumers) {
+            const suffix = Path.stripPrefix(consumer.prefix, path);
+            if (suffix === null)
+                continue;
+            try {
+                consumer.append({ path: suffix, active: false });
+            }
+            catch {
+                // Consumer already closed, will be cleaned up
+            }
+        }
     }
     async #runAnnounced(announced, prefix) {
         const version = this.#session.version;
+        // Suffixes live on this stream, so a repeat is recognized as an update to the
+        // advertisement rather than a second one, which would leak the count.
+        const live = new Set();
+        // Set once the teardown below has given back everything this stream held. The read
+        // loop is not awaited when the local consumer closes first, and closing the stream
+        // cancels the transport without discarding what the reader already buffered, so a
+        // fully buffered entry can still decode afterwards. Attaching one then would take a
+        // reference nobody is left to release, pinning the path for the session.
+        let released = false;
         // v14/v15: SubscribeNamespace on control stream (via adapter virtual stream)
         // v16+: SubscribeNamespace on its own real bidi stream
         const requestId = await this.#session.nextRequestId();
@@ -100,25 +199,32 @@ export class Subscriber {
                             break;
                         const msgType = await stream.reader.u53();
                         if (msgType === SubscribeNamespaceEntry.id) {
-                            const entry = await SubscribeNamespaceEntry.decode(stream.reader, version);
+                            const entry = await SubscribeNamespaceEntry.decode(stream.reader, version, Cluster.negotiated(this.#cluster));
+                            if (released)
+                                break;
                             const path = Path.join(prefix, entry.suffix);
-                            console.debug(`announced: broadcast=${path} active=true`);
-                            this.#announced.add(path);
-                            for (const consumer of this.#announcedConsumers) {
-                                if (!Path.hasPrefix(consumer.prefix, path))
-                                    continue;
-                                consumer.append({ path, active: true });
+                            // A repeat updates the advertisement in place, so one that now
+                            // loops back through us has taken a route we can't subscribe
+                            // over: the path is gone even though the message says active.
+                            if (this.#reflected(entry.cluster)) {
+                                console.debug(`dropping reflected namespace: broadcast=${path}`);
+                                if (live.delete(path))
+                                    this.#detachAnnounce(path);
+                                continue;
+                            }
+                            // A repeat updates the advertisement; only the first is news.
+                            if (!live.has(path)) {
+                                live.add(path);
+                                this.#attachAnnounce(path);
                             }
                         }
                         else if (msgType === SubscribeNamespaceEntryDone.id) {
                             const entry = await SubscribeNamespaceEntryDone.decode(stream.reader, version);
+                            if (released)
+                                break;
                             const path = Path.join(prefix, entry.suffix);
-                            console.debug(`announced: broadcast=${path} active=false`);
-                            this.#announced.delete(path);
-                            for (const consumer of this.#announcedConsumers) {
-                                if (!Path.hasPrefix(consumer.prefix, path))
-                                    continue;
-                                consumer.append({ path, active: false });
+                            if (live.delete(path)) {
+                                this.#detachAnnounce(path);
                             }
                         }
                         else if (msgType === PublishBlocked.id && version === Version.DRAFT_17) {
@@ -130,6 +236,15 @@ export class Subscriber {
                         }
                     }
                 })();
+                // The race below can end through the consumer's close while a message that
+                // already arrived is still decoding, which leaves the loop with nothing
+                // awaiting it: a violation decoded after that would land nowhere, and its
+                // rejection would go unhandled. Idempotent with the catch below, which is
+                // what runs when the loop is the one that ends the race.
+                readLoop.catch((err) => {
+                    if (err instanceof ProtocolViolation)
+                        this.#session.close();
+                });
                 // Wait for either the read loop or the announced to close
                 await Promise.race([readLoop, announced.closed]);
                 // For v14/v15: send UnsubscribeNamespace before closing
@@ -152,109 +267,269 @@ export class Subscriber {
         }
         catch (err) {
             const e = error(err);
-            console.warn(`subscribe_namespace error: ${e.message}`);
+            console.warn(`subscribe_namespace error: ${reason(e)}`);
+            // An advertisement is decoded here rather than in the session dispatch, so this
+            // is the only place a malformed one surfaces. The cluster draft requires closing
+            // the session over those, and the stream alone is not enough: the peer would
+            // just repeat it on the next SUBSCRIBE_NAMESPACE.
+            if (e instanceof ProtocolViolation)
+                this.#session.close();
+            // Abort the stream rather than letting the caller's `finally` close it cleanly.
+            // A rejected namespace subscription is a failure, and a consumer that can't tell
+            // it from "nothing is published under this prefix" waits forever on a broadcast
+            // that will never be announced. Matches the lite subscriber.
+            announced.close(e);
+        }
+        finally {
+            // The stream owns every advertisement it carried, so release them however it
+            // ends: a clean close, a decode error, or the peer resetting it. Without this
+            // each namespace keeps its count and the source never detaches, which would
+            // pin the path for the session even after the other source withdrew.
+            released = true;
+            for (const path of live) {
+                this.#detachAnnounce(path);
+            }
+            live.clear();
         }
     }
     /**
      * Consumes a broadcast from the connection.
+     *
+     * Deduplicated per path: repeat calls for the same still-live path share one reference-counted
+     * broadcast (and one upstream subscription). The shared broadcast closes once every caller has
+     * closed its handle, so callers close normally.
      */
     consume(path) {
-        const broadcast = new Broadcast();
+        return this.#consumes.get(path) ?? this.#consumes.insert(path, this.#createConsume(path));
+    }
+    #createConsume(path) {
+        // moq-transport has no one-shot group fetch; ConsumeBroadcast rejects it. Track info
+        // is resolved by the subscribe path (the inherited resolveTrackInfo).
+        const consumer = new ConsumeBroadcast();
         void (async () => {
             for (;;) {
-                const request = await broadcast.requested();
+                const request = await consumer.requested();
                 if (!request)
                     break;
                 void this.#runSubscribe(path, request);
             }
         })();
-        return broadcast;
+        return consumer;
     }
     async #runSubscribe(broadcast, request) {
-        const version = this.#session.version;
         const requestId = await this.#session.nextRequestId();
         if (requestId === undefined) {
-            request.track.close(new Error("session closed"));
+            request.reject(new Error("session closed"));
             return;
         }
-        console.debug(`subscribe start: id=${requestId} broadcast=${broadcast} track=${request.track.name}`);
+        console.debug(`subscribe start: id=${requestId} broadcast=${broadcast} track=${request.name}`);
+        // IETF negotiates group order in SUBSCRIBE_OK; this implementation only
+        // supports descending (newest-first), so commit ordered: false. (There's no
+        // per-frame timescale, so the rest stay at their defaults.) This
+        // resolves the consumer's track.info() and gives us the write side that
+        // incoming object streams are routed into.
+        const producer = request.accept({ ordered: false });
+        // Open the stream and wait for SUBSCRIBE_OK under a timeout. State
+        // flows back via `state` so the timeout path can clean up the stream
+        // and any registration if setup eventually finishes.
+        const state = {};
+        const setup = this.#openSubscribe(state, broadcast, request, producer, requestId);
+        // The publisher can be serving before it answers, so waiting only on the response
+        // would miss the local side going away and leave it serving a track nobody reads.
+        // Demand returning before we commit is not abandonment, matching the serving loop.
+        const waitAbandoned = async () => {
+            for (;;) {
+                await producer.unused();
+                if (producer.closed.peek() !== undefined || !producer.used.peek())
+                    return null;
+            }
+        };
+        let stream;
+        let trackAlias;
         try {
-            const stream = await this.#session.openBi();
-            try {
-                // Write Subscribe
-                await stream.writer.u53(Subscribe.id);
-                const msg = new Subscribe({
-                    requestId,
-                    trackNamespace: broadcast,
-                    trackName: request.track.name,
-                    subscriberPriority: request.priority,
-                });
-                await msg.encode(stream.writer, version);
-                console.debug(`subscribe written: id=${requestId} broadcast=${broadcast} track=${request.track.name}`);
-                // Read response (SubscribeOk or error)
-                const respTypeId = await stream.reader.u53();
-                if (respTypeId === SubscribeOk.id) {
-                    const ok = await SubscribeOk.decode(stream.reader, version);
-                    try {
-                        this.#aliases.set(ok.trackAlias, request.track);
-                    }
-                    catch (err) {
-                        this.#session.close();
-                        throw err;
-                    }
-                    console.debug(`subscribe ok: id=${requestId} broadcast=${broadcast} track=${request.track.name} alias=${ok.trackAlias}`);
-                    try {
-                        // Wait for stream close (= PublishDone) or track close (= local unsubscribe)
-                        await Promise.race([stream.reader.closed, request.track.closed]);
-                        // For v14-v16: send Unsubscribe before closing (removed in v17+)
-                        if (version === Version.DRAFT_14 ||
-                            version === Version.DRAFT_15 ||
-                            version === Version.DRAFT_16) {
-                            try {
-                                await stream.writer.u53(Unsubscribe.id);
-                                const unsub = new Unsubscribe({ requestId });
-                                await unsub.encode(stream.writer, version);
-                            }
-                            catch {
-                                // Stream might already be closed
-                            }
-                        }
-                        request.track.close();
-                        stream.close();
-                        console.debug(`subscribe close: id=${requestId} broadcast=${broadcast} track=${request.track.name}`);
-                    }
-                    finally {
-                        this.#aliases.delete(ok.trackAlias, request.track);
-                    }
+            const result = await Promise.race([
+                withTimeout(setup, SUBSCRIBE_OK_TIMEOUT_MS, `subscribe timed out after ${SUBSCRIBE_OK_TIMEOUT_MS}ms waiting for SUBSCRIBE_OK (browser stream limit reached?)`),
+                waitAbandoned(),
+            ]);
+            if (result === null)
+                throw new Error("subscribe abandoned before it was accepted");
+            stream = result.stream;
+            trackAlias = result.alias;
+            console.debug(`subscribe ok: id=${requestId} broadcast=${broadcast} track=${request.name}`);
+        }
+        catch (err) {
+            const e = error(err);
+            producer.close(e);
+            console.warn(`subscribe error: id=${requestId} broadcast=${broadcast} track=${request.name} error=${reason(e)}`);
+            // Runs now for whatever is already open, and again if `setup` settles late.
+            // Retirement is repeated because a late SUBSCRIBE_OK can register an alias after
+            // the first pass; the stream is torn down once.
+            let torn = false;
+            const cleanup = async (afterSetup) => {
+                state.cancelled = true;
+                if (state.registeredAlias !== undefined && this.#aliases.retire(state.registeredAlias, producer)) {
+                    this.#timescales.delete(state.registeredAlias);
                 }
-                else {
-                    // Error response
-                    let reasonPhrase = "unknown error";
-                    try {
-                        if (respTypeId === RequestError.id) {
-                            // SubscribeError (v14) or RequestError (v15+)
-                            const err = version === Version.DRAFT_14
-                                ? await SubscribeError.decode(stream.reader, version)
-                                : await RequestError.decode(stream.reader, version);
-                            reasonPhrase = `code=${err.errorCode} reason=${err.reasonPhrase}`;
-                        }
-                    }
-                    catch {
-                        // Decoding error response failed, use default message
-                    }
-                    throw new Error(`SUBSCRIBE error: ${reasonPhrase}`);
+                if (!state.stream || torn)
+                    return;
+                // A SUBSCRIBE still being written must not be torn down from here. Aborting a
+                // Web Stream waits for the in-flight write, so the request can still reach the
+                // peer while the abort destroys the stream we would have cancelled on. Setup
+                // unwinds on the cancelled flag once that write lands, and its pass below has
+                // the finished picture.
+                if (!state.sent && !afterSetup)
+                    return;
+                torn = true;
+                // Once the SUBSCRIBE is out the publisher may be serving, whether or not it has
+                // answered yet: data streams are independent of the request stream. Aborting says
+                // nothing on v14-16, where the request rides a virtual stream whose reset is
+                // local, so the UNSUBSCRIBE has to go out explicitly.
+                if (state.sent && !state.rejected)
+                    await this.#cancelSubscribe(state.stream, requestId);
+                state.stream.abort(e);
+            };
+            // Tear down what is already open rather than waiting on `setup`. A peer that
+            // opened the stream and then went quiet never settles it, and deferring would
+            // leave the request outstanding for the life of the session -- which is the
+            // timeout case, not a rare one.
+            void cleanup(false);
+            setup.then(() => cleanup(true), () => cleanup(true));
+            return;
+        }
+        try {
+            // Which terminal fired decides whether we owe the publisher a cancellation, so
+            // tag them rather than racing bare promises.
+            const publisherEnded = Symbol("publisher");
+            const localEnded = Symbol("local");
+            const idle = Symbol("idle");
+            // Terminal conditions settle at most once (stream close = PublishDone, track close =
+            // local unsubscribe); race them once so the demand loop doesn't re-subscribe each pass.
+            const done = Promise.race([
+                stream.reader.closed.then(() => publisherEnded),
+                producer.closed.then(() => localEnded),
+            ]);
+            // Serve until a terminal condition fires or the last local subscriber leaves. The unused
+            // wake is level-triggered: re-check demand so a subscriber that returns before we tear
+            // down resumes on the same stream.
+            let terminal = localEnded;
+            for (;;) {
+                const reason = await Promise.race([done, producer.unused().then(() => idle)]);
+                if (reason === idle && producer.closed.peek() === undefined && producer.used.peek())
+                    continue;
+                terminal = reason;
+                break;
+            }
+            // The publisher already ended the request, so there is nothing to cancel. Sending
+            // UNSUBSCRIBE here would name a request it has already torn down.
+            if (terminal !== publisherEnded)
+                await this.#cancelSubscribe(stream, requestId);
+            producer.close();
+            stream.close();
+            console.debug(`subscribe close: id=${requestId} broadcast=${broadcast} track=${request.name}`);
+        }
+        catch (err) {
+            const e = error(err);
+            producer.close(e);
+            stream.abort(e);
+            console.warn(`subscribe error: id=${requestId} broadcast=${broadcast} track=${request.name} error=${reason(e)}`);
+        }
+        finally {
+            // Only the owner tears down the alias metadata: a later subscription may have
+            // reclaimed the alias and installed its own timescale.
+            if (this.#aliases.retire(trackAlias, producer))
+                this.#timescales.delete(trackAlias);
+        }
+    }
+    /**
+     * Tell the publisher to stop serving a subscription we are walking away from.
+     *
+     * v14-16 cancel with UNSUBSCRIBE (draft-16 section 9.12), which is what lets the
+     * publisher destroy the subscription (section 5.1.1); v17+ removed the message and
+     * rely on the stream reset instead. Every path that abandons an Established
+     * subscription goes through here, because those versions carry the request over a
+     * virtual stream whose reset never reaches the peer.
+     */
+    async #cancelSubscribe(stream, requestId) {
+        const version = this.#session.version;
+        if (version !== Version.DRAFT_14 && version !== Version.DRAFT_15 && version !== Version.DRAFT_16)
+            return;
+        try {
+            await stream.writer.u53(Unsubscribe.id);
+            await new Unsubscribe({ requestId }).encode(stream.writer, version);
+        }
+        catch {
+            // The stream may already be gone; there is nothing further to tell the peer.
+        }
+    }
+    // Opens the subscribe stream, sends SUBSCRIBE, and reads the response.
+    // `state` is populated as soon as the stream opens and again when the
+    // trackAlias is registered, so the caller can clean both up on timeout
+    // even before this promise settles.
+    async #openSubscribe(state, broadcast, request, producer, requestId) {
+        const version = this.#session.version;
+        state.stream = await this.#session.openBi();
+        // The timeout can fire while the open is still in flight, in which case cleanup ran
+        // with nothing to release. Bail now that the stream is recorded, so settling this
+        // promise hands it back to be torn down.
+        if (state.cancelled)
+            throw new Error("subscribe cancelled before it was sent");
+        await state.stream.writer.u53(Subscribe.id);
+        const msg = new Subscribe({
+            requestId,
+            trackNamespace: broadcast,
+            trackName: request.name,
+            subscriberPriority: toWire(request.priority),
+            // No fill is requested: the fill's fetch stream and the live subscription split
+            // the group across two streams, and this subscriber does not reassemble them into
+            // one group yet. A lenient publisher (like ours) replays the whole in-range group
+            // on the subscription instead; a strict one only delivers from the next published
+            // object, and that mid-group stream is dropped, degrading the join to the next
+            // group boundary.
+            filter: joinFilter(version),
+        });
+        await msg.encode(state.stream.writer, version);
+        state.sent = true;
+        // The caller may have given up while that write was in flight. It deliberately left
+        // the stream alone, so unwind here and let its cleanup send the cancellation now that
+        // the SUBSCRIBE has actually reached the peer.
+        if (state.cancelled)
+            throw new Error("subscribe cancelled while it was being sent");
+        console.debug(`subscribe written: id=${requestId} broadcast=${broadcast} track=${request.name}`);
+        const respTypeId = await state.stream.reader.u53();
+        if (respTypeId !== SubscribeOk.id) {
+            let reasonPhrase = "unknown error";
+            try {
+                if (respTypeId === RequestError.id) {
+                    const err = version === Version.DRAFT_14
+                        ? await SubscribeError.decode(state.stream.reader, version)
+                        : await RequestError.decode(state.stream.reader, version);
+                    reasonPhrase = `code=${err.errorCode} reason=${err.reasonPhrase}`;
                 }
             }
-            catch (err) {
-                stream.abort(error(err));
-                throw err;
+            catch {
+                // Decoding error response failed, use default message
+            }
+            state.rejected = true;
+            throw new Error(`SUBSCRIBE error: ${reasonPhrase}`);
+        }
+        const ok = await SubscribeOk.decode(state.stream.reader, version);
+        try {
+            this.#aliases.set(ok.trackAlias, producer, { broadcast, name: request.name });
+            const timescale = ok.properties.timescale;
+            if (timescale !== undefined) {
+                this.#timescales.set(ok.trackAlias, timescale);
             }
         }
         catch (err) {
-            const e = error(err);
-            request.track.close(e);
-            console.warn(`subscribe error: id=${requestId} broadcast=${broadcast} track=${request.track.name} error=${e.message}`);
+            // Only one alias naming two different tracks is the session's problem. A publisher
+            // sharing an alias between subscriptions to one track is allowed to do that, and
+            // disconnecting over it would drop every other broadcast on the session.
+            if (err instanceof DuplicateTrackAlias)
+                this.#session.close();
+            throw err;
         }
+        state.registeredAlias = ok.trackAlias;
+        return { stream: state.stream, alias: ok.trackAlias };
     }
     /**
      * Handles an incoming PUBLISH_NAMESPACE on a bidi stream.
@@ -265,32 +540,57 @@ export class Subscriber {
     async runPublishNamespace(msg, stream) {
         const version = this.#session.version;
         const path = msg.trackNamespace;
-        if (this.#announced.has(path)) {
+        // A path that already ran through us looped back. Refuse it rather than holding an
+        // advertisement we could never subscribe through. The peer knows our Hop ID, so a
+        // conforming one never offers it; 0 as the retry interval says not to come back.
+        if (this.#reflected(msg.cluster)) {
+            console.debug(`dropping reflected publish_namespace: broadcast=${path}`);
+            await stream.writer.u53(RequestError.id);
+            await new RequestError({
+                requestId: msg.requestId,
+                errorCode: 400,
+                reasonPhrase: "route loops back",
+            }).encode(stream.writer, version);
+            stream.close();
+            return;
+        }
+        // Draft-14/15 key their namespace-scoped messages by name, not request ID, so the
+        // adapter can hold only one request per namespace: a second would overwrite the
+        // first, and the withdrawals would then close the wrong stream and fail to find
+        // the other. Nothing is lost by refusing it, because the case that makes a second
+        // reference legitimate (an inline NAMESPACE for a path a PUBLISH_NAMESPACE already
+        // carried) needs a message those drafts do not have.
+        const legacy = version === Version.DRAFT_14 || version === Version.DRAFT_15;
+        if (legacy && (this.#announced.has(path) || this.#legacyRequests.has(path))) {
             console.warn("duplicate PublishNamespace");
             if (version === Version.DRAFT_14) {
                 await stream.writer.u53(PublishNamespaceError.id);
-                const err = new PublishNamespaceError({
+                await new PublishNamespaceError({
                     requestId: msg.requestId,
                     errorCode: 409,
                     reasonPhrase: "duplicate namespace",
-                });
-                await err.encode(stream.writer, version);
+                }).encode(stream.writer, version);
             }
             else {
                 await stream.writer.u53(RequestError.id);
-                const err = new RequestError({
-                    requestId: version === Version.DRAFT_15 || version === Version.DRAFT_16 ? msg.requestId : undefined,
+                await new RequestError({
+                    requestId: msg.requestId,
                     errorCode: 409,
                     reasonPhrase: "duplicate namespace",
-                });
-                await err.encode(stream.writer, version);
+                }).encode(stream.writer, version);
             }
             stream.close();
             return;
         }
-        this.#announced.add(path);
+        // Everywhere else a path this session already knows is not refused: the same
+        // namespace can reach us twice, and the count is what tells the second apart from
+        // news. This request owns exactly one of those references and gives it back when
+        // the stream ends.
+        if (legacy)
+            this.#legacyRequests.add(path);
+        let attached = false;
         try {
-            // Send OK first — must complete before notifying consumers,
+            // Send OK first. This must complete before notifying consumers,
             // because consumers may trigger Subscribe writes that would
             // interleave with our OK on the control stream.
             if (version === Version.DRAFT_14) {
@@ -305,32 +605,57 @@ export class Subscriber {
                 });
                 await ok.encode(stream.writer, version);
             }
-            console.debug(`announced: broadcast=${path} active=true`);
-            // Notify consumers after OK is written
-            for (const consumer of this.#announcedConsumers) {
-                const suffix = Path.stripPrefix(consumer.prefix, path);
-                if (suffix === null)
+            // Only now is the advertisement ours to announce, for the reason above: a
+            // consumer reacting with a SUBSCRIBE must not interleave with that OK.
+            attached = true;
+            this.#attachAnnounce(path);
+            // An advertisement is updated in place, by repeating PUBLISH_NAMESPACE on the
+            // stream that already carries it, so read until the stream ends rather than
+            // waiting on the close. Nothing else would deliver a re-parented route.
+            const done = version === Version.DRAFT_16 || legacy;
+            for (;;) {
+                if (await stream.reader.done())
+                    break;
+                const typeId = await stream.reader.u53();
+                if (done && typeId === PublishNamespaceDone.id) {
+                    await PublishNamespaceDone.decode(stream.reader, version);
+                    break;
+                }
+                if (typeId !== PublishNamespace.id) {
+                    throw new ProtocolViolation(`unexpected message on publish_namespace stream: 0x${typeId.toString(16)}`);
+                }
+                const update = await PublishNamespace.decode(stream.reader, version, Cluster.negotiated(this.#cluster));
+                // The stream is the advertisement, so an update on it must name the same
+                // one. Applying a mismatched update would retarget this path with metadata
+                // meant for a different request.
+                if (update.requestId !== msg.requestId || update.trackNamespace !== path) {
+                    throw new ProtocolViolation("publish_namespace update does not match its stream");
+                }
+                // A path that now runs through us is unusable, so give it back. Keep
+                // reading: this stream is the advertisement's only channel, so a later
+                // clean path arrives here or nowhere.
+                if (this.#reflected(update.cluster)) {
+                    if (attached) {
+                        attached = false;
+                        console.debug(`publish_namespace now loops back, detaching: broadcast=${path}`);
+                        this.#detachAnnounce(path);
+                    }
                     continue;
-                consumer.append({ path, active: true });
+                }
+                // Re-attach: a clean path replaced the reflected one we detached from.
+                if (!attached) {
+                    attached = true;
+                    this.#attachAnnounce(path);
+                }
             }
-            // Wait for stream close (= PublishNamespaceDone)
-            console.debug(`runPublishNamespace: awaiting stream.reader.closed for ${path}`);
-            await stream.reader.closed;
-            console.debug(`runPublishNamespace: stream.reader.closed resolved for ${path}`);
         }
         finally {
-            this.#announced.delete(path);
-            console.debug(`announced: broadcast=${path} active=false`);
-            for (const consumer of this.#announcedConsumers) {
-                const suffix = Path.stripPrefix(consumer.prefix, path);
-                if (suffix === null)
-                    continue;
-                try {
-                    consumer.append({ path, active: false });
-                }
-                catch {
-                    // Consumer already closed, will be cleaned up
-                }
+            if (legacy)
+                this.#legacyRequests.delete(path);
+            // Give back exactly what was taken: a request that never got its OK out never
+            // referenced the path, and retracting there would drop someone else's count.
+            if (attached) {
+                this.#detachAnnounce(path);
             }
         }
     }
@@ -342,11 +667,17 @@ export class Subscriber {
      */
     async runPublish(msg, stream) {
         const version = this.#session.version;
+        // NOT_SUPPORTED, from the PUBLISH error codes in draft-19 section 10.10. We decline
+        // the method itself rather than this particular track, which is UNINTERESTED (0x4).
+        //
+        // The alias the message carries is deliberately not recorded. Nothing will ever bind
+        // it, and a rejected request has no lifetime of ours to hang the cleanup on.
+        const NOT_SUPPORTED = 0x3;
         if (version === Version.DRAFT_14) {
             await stream.writer.u53(PublishError.id);
             const err = new PublishError({
                 requestId: msg.requestId,
-                errorCode: 500,
+                errorCode: NOT_SUPPORTED,
                 reasonPhrase: "publish not supported",
             });
             await err.encode(stream.writer, version);
@@ -355,7 +686,7 @@ export class Subscriber {
             await stream.writer.u53(RequestError.id);
             const err = new RequestError({
                 requestId: version === Version.DRAFT_15 || version === Version.DRAFT_16 ? msg.requestId : undefined,
-                errorCode: 500,
+                errorCode: NOT_SUPPORTED,
                 reasonPhrase: "publish not supported",
             });
             await err.encode(stream.writer, version);
@@ -368,10 +699,25 @@ export class Subscriber {
      * @internal
      */
     async handleGroup(group, stream) {
-        const producer = new Group(group.groupId);
         if (group.subGroupId !== 0) {
             throw new Error("subgroups are not supported");
         }
+        // FIRST_OBJECT clear says this stream starts partway through the group, which the
+        // draft lets a publisher do to answer a filter. Nothing above here can use it: the
+        // objects that would arrive are not decodable without the missing head, and a group
+        // is the unit an application resyncs on. Drop it and pick up at the next group, the
+        // same degradation as a publisher that no longer holds the head.
+        //
+        // This only saves reading a stream we would throw away. The bit is the publisher's
+        // claim, so what is enforced is the object ids themselves: `Frame.decode` holds every
+        // object to starting at 0 and incrementing by 1, whatever the header said and on the
+        // drafts that have no such bit to read.
+        if (!group.flags.firstObject) {
+            console.debug(`dropping a group with no head: alias=${group.trackAlias} group=${group.groupId}`);
+            stream.stop(new Error("a group must start at object 0"));
+            return;
+        }
+        const producer = new netGroup.Producer(group.groupId);
         try {
             // The control message establishing this alias can arrive after the data stream.
             const track = await this.#aliases.get(group.trackAlias);
@@ -380,18 +726,42 @@ export class Subscriber {
                 const done = await Promise.race([stream.done(), producer.closed, track.closed]);
                 if (done !== false)
                     break;
-                const frame = await Frame.decode(stream, group.flags);
+                const frame = await Frame.decode(stream, group.flags, this.#timescales.get(group.trackAlias), this.#session.version);
                 if (frame.payload === undefined)
                     break;
-                producer.writeFrame(frame.payload, frame.extensions);
+                producer.writeFrame({ payload: frame.payload, timestamp: frame.timestamp ?? Timestamp.now() });
             }
             producer.close();
         }
         catch (err) {
             const e = error(err);
+            // Ours: we cancelled the subscription and the publisher has not stopped yet.
+            // Anything else on this alias is the publisher sending data for a track it never
+            // acknowledged, which is worth seeing.
+            if (e instanceof RetiredTrackAlias) {
+                console.debug(`dropping group for a cancelled subscription: alias=${group.trackAlias}`);
+            }
             producer.close(e);
             stream.stop(e);
         }
     }
 }
+/**
+ * A broadcast consumed from a moq-transport session. Track info is resolved by the
+ * subscribe path (the inherited `resolveTrackInfo`), but the protocol has no one-shot
+ * group fetch, so `track.Consumer.fetchGroup()` is rejected.
+ */
+class ConsumeBroadcast extends broadcast.Consumer {
+    // biome-ignore lint/complexity/noUselessConstructor: widens the protected base constructor to public
+    constructor(state) {
+        super(state);
+    }
+    // Preserve the subclass when the consume cache shares this broadcast across callers.
+    clone() {
+        return new ConsumeBroadcast(this.shareState());
+    }
+    fetchGroup() {
+        return Promise.reject(new Error("fetch group is not supported for moq-transport"));
+    }
+}
 //# sourceMappingURL=subscriber.js.map