@norskvideo/moq-net 0.1.7 → 0.2.0

package/ietf/subscriber.js

@@ -1,18 +1,24 @@
 /* @ts-self-types="./subscriber.d.ts" */
+import { race, Signal } from "@norskvideo/moq-signals";
 import * as announce from "../announced.js";
 import * as broadcast from "../broadcast.js";
 import { BroadcastCache } from "../consume.js";
-import { error, ProtocolViolation, reason } from "../error.js";
+import { closeError, controlTimeout, error, ProtocolViolation, reason, sessionCause } from "../error.js";
 import * as netGroup from "../group.js";
+import { Cost, randomHop, routesEqual, stampHops, UNKNOWN_HOP } from "../hop.js";
+import { hiddenBelow, hooks, scopeCaptures, scopeHead, scopeOverlaps } from "../internal.js";
 import * as Path from "../path.js";
+import { Tail } from "../tail.js";
 import { Timestamp } from "../time.js";
-import { withTimeout } from "../util/timeout.js";
+import { TimeoutError, withTimeout } from "../util/timeout.js";
+import { overrideBroadcastWire, wireOf } from "../wire.js";
 import { DuplicateTrackAlias, RetiredTrackAlias, TrackAliases } from "./aliases.js";
 import * as Cluster from "./cluster.js";
+import { requestReason, toRequestCode } from "./error.js";
 import { Frame } from "./object.js";
-import { toWire } from "./priority.js";
-import { PublishError } from "./publish.js";
-import { PublishNamespace, PublishNamespaceDone, PublishNamespaceError, PublishNamespaceOk, } from "./publish_namespace.js";
+import { fromWire, toWire } from "./priority.js";
+import { PublishDone, PublishError, publishDoneClean } from "./publish.js";
+import { PublishNamespaceDone, PublishNamespaceError, PublishNamespaceOk, PublishNamespaceUpdate, } from "./publish_namespace.js";
 import { RequestError, RequestOk } from "./request.js";
 import { joinFilter, Subscribe, SubscribeError, SubscribeOk, Unsubscribe } from "./subscribe.js";
 import { PublishBlocked, SubscribeNamespace, SubscribeNamespaceEntry, SubscribeNamespaceEntryDone, SubscribeNamespaceLegacy, SubscribeNamespaceOk, UnsubscribeNamespace, } from "./subscribe_namespace.js";
@@ -21,6 +27,10 @@ import { Version } from "./version.js";
 // concurrent QUIC streams (Chrome ~100); past the cap openBi() silently
 // blocks. The timeout turns that into a clear error.
 const SUBSCRIBE_OK_TIMEOUT_MS = 10_000;
+/** Whether a reader with `filter` sees an announcement at `path`. */
+function sees(filter, path) {
+    return scopeOverlaps(filter.scope, path) && (filter.hidden || !hiddenBelow(filter.prefix, path));
+}
 /**
  * Handles subscribing to broadcasts using moq-transport protocol.
  * Uses the stream-per-request pattern (real bidi streams for v17, virtual for v14-v16).
@@ -29,6 +39,9 @@ const SUBSCRIBE_OK_TIMEOUT_MS = 10_000;
  */
 export class Subscriber {
     #session;
+    // The transport, so a request cut off by the session's close ends with the session's
+    // error. Optional for tests that drive a bare session.
+    #quic;
     // The Hop IDs this session declared; see {@link Cluster}. What the peer declared is what
     // says whether an advertisement carries a hop path, and ours is what a path looping back
     // to us contains.
@@ -41,6 +54,9 @@ export class Subscriber {
     #timescales = new Map();
     // Dedup consumed broadcasts per path: repeat consume() calls share one subscription.
     #consumes = new BroadcastCache();
+    // A random Hop ID of this connection's own, written as the first hop of any path that
+    // names no publisher, so a publisher that reconnects reads as a new one.
+    #stamp = randomHop();
     // Paths with a legacy PUBLISH_NAMESPACE request in flight, reserved synchronously.
     // The count below is only taken once the OK is written, and two requests that both
     // got past the duplicate check before either attached would both take one.
@@ -53,16 +69,20 @@ export class Subscriber {
     // Counting them is what keeps the second from duplicating the announce and the first
     // to end from retracting what the other still holds.
     #announced = new Map();
-    // Any consumers that want each new announcement.
-    #announcedConsumers = new Set();
+    // Any consumers that want each new announcement, keyed by their local filter.
+    #announcedConsumers = new Map();
+    // Whether the peer understands the HIDDEN parameter (MoQ Hidden).
+    #hidden;
     /**
      * Creates a new Subscriber instance.
      *
      * @internal
      */
-    constructor({ session, cluster, }) {
+    constructor({ session, quic, cluster, hidden = false, }) {
         this.#session = session;
+        this.#quic = quic;
         this.#cluster = cluster;
+        this.#hidden = hidden;
     }
     /**
      * Whether an advertisement is ours coming back: its hop path already ran through us, so
@@ -76,22 +96,47 @@ export class Subscriber {
         return advert !== undefined && this.#cluster !== undefined && Cluster.loops(advert, this.#cluster.self);
     }
     /**
-     * Gets an announced reader for the specified prefix.
+     * The route an advertisement carries; one without a path is free. A path that names no
+     * publisher, or none at all, gets this connection's stamp in front of a 0.
+     */
+    #route(advert) {
+        if (advert === undefined)
+            return { hops: [this.#stamp, UNKNOWN_HOP], cost: Cost.zero };
+        // A full chain, or a stamp colliding with an entry (a 1-in-2^53 draw), keeps the
+        // path as sent.
+        const hops = stampHops(advert.hops, this.#stamp) ?? [...advert.hops];
+        return { hops, cost: { warm: advert.cost, cold: advert.cost } };
+    }
+    /**
+     * Gets an announced reader matching `scope`. Paths are relative to the session,
+     * not the scope.
      *
      * The peer is asked with SUBSCRIBE_NAMESPACE regardless of what it declared, and an
      * unsolicited PUBLISH_NAMESPACE lands here too, so a peer that only tells and one
      * that only answers are both discovered.
+     *
+     * Hidden routes (a `.`-prefixed segment below the scope's head) are left out unless
+     * `options.hidden` opts in. The opt-in rides the SUBSCRIBE_NAMESPACE when the peer
+     * understands it (MoQ Hidden); the rule is also applied here, since an unsolicited
+     * PUBLISH_NAMESPACE or a peer that never heard of it hides nothing.
      */
-    announced(prefix = Path.empty()) {
-        const announced = new announce.Producer(prefix);
-        for (const active of this.#announced.keys()) {
-            const suffix = Path.stripPrefix(prefix, active);
-            if (suffix === null)
+    announced(scope = Path.Pattern.all(), options) {
+        // The wire speaks announce interest by prefix.
+        const prefix = scopeHead(scope);
+        const filter = { scope, prefix, hidden: options?.hidden ?? false };
+        const announced = new announce.Producer();
+        for (const [active, info] of this.#announced) {
+            if (!sees(filter, active))
                 continue;
-            announced.append({ path: suffix, active: true });
+            announced.append({
+                prefix: active,
+                captures: scopeCaptures(scope, active),
+                kind: "announced",
+                route: info.route,
+            });
         }
-        this.#announcedConsumers.add(announced);
-        void this.#runAnnounced(announced, prefix).finally(() => {
+        this.#announcedConsumers.set(announced, filter);
+        void this.#runAnnounced(announced, prefix, filter.hidden && this.#hidden).finally(() => {
             this.#announcedConsumers.delete(announced);
             announced.close();
         });
@@ -101,28 +146,53 @@ export class Subscriber {
      * Record one more advertisement for a path, telling consumers only when it is the
      * first. A second one is the same namespace said twice, not news.
      */
-    #attachAnnounce(path) {
-        const count = this.#announced.get(path) ?? 0;
-        this.#announced.set(path, count + 1);
-        if (count > 0)
+    #attachAnnounce(path, route) {
+        const existing = this.#announced.get(path);
+        if (existing) {
+            existing.count += 1;
             return;
+        }
+        this.#announced.set(path, { count: 1, route });
         console.debug(`announced: broadcast=${path} active=true`);
-        for (const consumer of this.#announcedConsumers) {
-            const suffix = Path.stripPrefix(consumer.prefix, path);
-            if (suffix === null)
+        for (const [consumer, filter] of this.#announcedConsumers) {
+            if (!sees(filter, path))
                 continue;
-            consumer.append({ path: suffix, active: true });
+            const scope = filter.scope;
+            consumer.append({ prefix: path, captures: scopeCaptures(scope, path), kind: "announced", route });
+        }
+    }
+    /**
+     * Replace the stored route for a path that is already announced. A no-op when the
+     * hops and cost did not change; otherwise consumers hear `updated` so a forwarder
+     * can reprice without retracting.
+     *
+     * A new first hop is a new publisher: holders keep their broadcast to drain, but the
+     * next consume starts fresh rather than reusing the old publisher's cached track info.
+     */
+    #updateAnnounce(path, route) {
+        const existing = this.#announced.get(path);
+        if (existing === undefined || routesEqual(existing.route, route))
+            return;
+        if (existing.route.hops[0] !== route.hops[0])
+            this.#consumes.evict(path);
+        existing.route = route;
+        console.debug(`announced: broadcast=${path} rerouted`);
+        for (const [consumer, filter] of this.#announcedConsumers) {
+            if (!sees(filter, path))
+                continue;
+            const scope = filter.scope;
+            consumer.append({ prefix: path, captures: scopeCaptures(scope, path), kind: "updated", route });
         }
     }
     /**
      * Drop one advertisement for a path, retracting it only once the last one goes.
      */
     #detachAnnounce(path) {
-        const count = this.#announced.get(path);
-        if (count === undefined)
+        const existing = this.#announced.get(path);
+        if (existing === undefined)
             return;
-        if (count > 1) {
-            this.#announced.set(path, count - 1);
+        if (existing.count > 1) {
+            existing.count -= 1;
             return;
         }
         this.#announced.delete(path);
@@ -130,19 +200,24 @@ export class Subscriber {
         // would otherwise hand the dead generation to whoever consumes the path next.
         this.#consumes.evict(path);
         console.debug(`announced: broadcast=${path} active=false`);
-        for (const consumer of this.#announcedConsumers) {
-            const suffix = Path.stripPrefix(consumer.prefix, path);
-            if (suffix === null)
+        for (const [consumer, filter] of this.#announcedConsumers) {
+            if (!sees(filter, path))
                 continue;
+            const scope = filter.scope;
             try {
-                consumer.append({ path: suffix, active: false });
+                consumer.append({
+                    prefix: path,
+                    captures: scopeCaptures(scope, path),
+                    kind: "retracted",
+                    route: existing.route,
+                });
             }
             catch {
                 // Consumer already closed, will be cleaned up
             }
         }
     }
-    async #runAnnounced(announced, prefix) {
+    async #runAnnounced(announced, prefix, hidden) {
         const version = this.#session.version;
         // Suffixes live on this stream, so a repeat is recognized as an update to the
         // advertisement rather than a second one, which would leak the count.
@@ -171,11 +246,11 @@ export class Subscriber {
                     version === Version.DRAFT_16 ||
                     version === Version.DRAFT_17) {
                     await stream.writer.u53(SubscribeNamespaceLegacy.id);
-                    await new SubscribeNamespaceLegacy({ namespace: prefix, requestId }).encode(stream.writer, version);
+                    await new SubscribeNamespaceLegacy({ namespace: prefix, requestId, hidden }).encode(stream.writer, version);
                 }
                 else {
                     await stream.writer.u53(SubscribeNamespace.id);
-                    await new SubscribeNamespace({ namespace: prefix, requestId }).encode(stream.writer, version);
+                    await new SubscribeNamespace({ namespace: prefix, requestId, hidden }).encode(stream.writer, version);
                 }
                 console.debug(`subscribe_namespace written: requestId=${requestId}`);
                 // Read response
@@ -212,10 +287,15 @@ export class Subscriber {
                                     this.#detachAnnounce(path);
                                 continue;
                             }
-                            // A repeat updates the advertisement; only the first is news.
-                            if (!live.has(path)) {
+                            // A repeat replaces the advertisement in place: HOP_PATH / ROUTE_COST
+                            // can change without a NAMESPACE_DONE. Only the first is a new path.
+                            const route = this.#route(entry.cluster);
+                            if (live.has(path)) {
+                                this.#updateAnnounce(path, route);
+                            }
+                            else {
                                 live.add(path);
-                                this.#attachAnnounce(path);
+                                this.#attachAnnounce(path, route);
                             }
                         }
                         else if (msgType === SubscribeNamespaceEntryDone.id) {
@@ -246,7 +326,7 @@ export class Subscriber {
                         this.#session.close();
                 });
                 // Wait for either the read loop or the announced to close
-                await Promise.race([readLoop, announced.closed]);
+                await race([readLoop, announced.closed]);
                 // For v14/v15: send UnsubscribeNamespace before closing
                 if (version === Version.DRAFT_14 || version === Version.DRAFT_15) {
                     try {
@@ -308,7 +388,7 @@ export class Subscriber {
         const consumer = new ConsumeBroadcast();
         void (async () => {
             for (;;) {
-                const request = await consumer.requested();
+                const request = await wireOf(consumer).requested();
                 if (!request)
                     break;
                 void this.#runSubscribe(path, request);
@@ -316,28 +396,43 @@ export class Subscriber {
         })();
         return consumer;
     }
+    // The adapter is gone. If the transport has already closed, that close is the
+    // error. A still-open transport, such as a GOAWAY drain, has no peer code yet,
+    // so this does not wait for it.
+    async #closedSession() {
+        const quic = this.#quic;
+        if (!quic)
+            return new Error("session closed");
+        return Promise.race([
+            closeError(quic),
+            new Promise((resolve) => queueMicrotask(() => resolve(new Error("session closed")))),
+        ]);
+    }
     async #runSubscribe(broadcast, request) {
         const requestId = await this.#session.nextRequestId();
         if (requestId === undefined) {
-            request.reject(new Error("session closed"));
+            request.reject(await this.#closedSession());
             return;
         }
         console.debug(`subscribe start: id=${requestId} broadcast=${broadcast} track=${request.name}`);
-        // IETF negotiates group order in SUBSCRIBE_OK; this implementation only
-        // supports descending (newest-first), so commit ordered: false. (There's no
-        // per-frame timescale, so the rest stay at their defaults.) This
-        // resolves the consumer's track.info() and gives us the write side that
-        // incoming object streams are routed into.
-        const producer = request.accept({ ordered: false });
+        // Keep the request pending until SUBSCRIBE_OK supplies immutable track metadata.
+        // Group streams already wait on the alias, so early data stays behind this response.
+        const producer = hooks.pendingTrackProducer(request);
+        const subscription = { track: producer, tail: new Tail() };
         // Open the stream and wait for SUBSCRIBE_OK under a timeout. State
         // flows back via `state` so the timeout path can clean up the stream
         // and any registration if setup eventually finishes.
         const state = {};
-        const setup = this.#openSubscribe(state, broadcast, request, producer, requestId);
+        const setup = this.#openSubscribe(state, broadcast, request, subscription, requestId);
         // The publisher can be serving before it answers, so waiting only on the response
         // would miss the local side going away and leave it serving a track nobody reads.
         // Demand returning before we commit is not abandonment, matching the serving loop.
         const waitAbandoned = async () => {
+            // An info-only lookup attaches no subscriber yet still waits on SUBSCRIBE_OK for
+            // the track info, so only demand that arrived and then left is abandonment.
+            while (!producer.used.peek() && producer.closed.peek() === undefined) {
+                await Signal.race(producer.used, producer.closed);
+            }
             for (;;) {
                 await producer.unused();
                 if (producer.closed.peek() !== undefined || !producer.used.peek())
@@ -347,7 +442,7 @@ export class Subscriber {
         let stream;
         let trackAlias;
         try {
-            const result = await Promise.race([
+            const result = await race([
                 withTimeout(setup, SUBSCRIBE_OK_TIMEOUT_MS, `subscribe timed out after ${SUBSCRIBE_OK_TIMEOUT_MS}ms waiting for SUBSCRIBE_OK (browser stream limit reached?)`),
                 waitAbandoned(),
             ]);
@@ -358,8 +453,9 @@ export class Subscriber {
             console.debug(`subscribe ok: id=${requestId} broadcast=${broadcast} track=${request.name}`);
         }
         catch (err) {
-            const e = error(err);
-            producer.close(e);
+            // A control request that timed out is not late content, so it carries its own code.
+            const e = err instanceof TimeoutError ? controlTimeout(err) : await sessionCause(this.#quic, err);
+            request.reject(e);
             console.warn(`subscribe error: id=${requestId} broadcast=${broadcast} track=${request.name} error=${reason(e)}`);
             // Runs now for whatever is already open, and again if `setup` settles late.
             // Retirement is repeated because a late SUBSCRIBE_OK can register an alias after
@@ -367,7 +463,7 @@ export class Subscriber {
             let torn = false;
             const cleanup = async (afterSetup) => {
                 state.cancelled = true;
-                if (state.registeredAlias !== undefined && this.#aliases.retire(state.registeredAlias, producer)) {
+                if (state.registeredAlias !== undefined && this.#aliases.retire(state.registeredAlias, subscription)) {
                     this.#timescales.delete(state.registeredAlias);
                 }
                 if (!state.stream || torn)
@@ -402,10 +498,10 @@ export class Subscriber {
             const publisherEnded = Symbol("publisher");
             const localEnded = Symbol("local");
             const idle = Symbol("idle");
-            // Terminal conditions settle at most once (stream close = PublishDone, track close =
-            // local unsubscribe); race them once so the demand loop doesn't re-subscribe each pass.
-            const done = Promise.race([
-                stream.reader.closed.then(() => publisherEnded),
+            // Terminal conditions settle at most once (PublishDone, track close = local
+            // unsubscribe); race them once so the demand loop doesn't re-subscribe each pass.
+            const done = race([
+                this.#runPublishDone(stream, subscription).then(() => publisherEnded),
                 producer.closed.then(() => localEnded),
             ]);
             // Serve until a terminal condition fires or the last local subscriber leaves. The unused
@@ -413,22 +509,26 @@ export class Subscriber {
             // down resumes on the same stream.
             let terminal = localEnded;
             for (;;) {
-                const reason = await Promise.race([done, producer.unused().then(() => idle)]);
+                const reason = await race([done, producer.unused().then(() => idle)]);
                 if (reason === idle && producer.closed.peek() === undefined && producer.used.peek())
                     continue;
                 terminal = reason;
                 break;
             }
+            // Close before the cancellation is written, not after: awaiting the write first
+            // reopens the window the demand re-check above just closed, and a subscriber that
+            // returned during it would be closed by this line. The lite subscriber closes
+            // straight out of its loop for the same reason.
+            producer.close();
             // The publisher already ended the request, so there is nothing to cancel. Sending
             // UNSUBSCRIBE here would name a request it has already torn down.
             if (terminal !== publisherEnded)
                 await this.#cancelSubscribe(stream, requestId);
-            producer.close();
             stream.close();
             console.debug(`subscribe close: id=${requestId} broadcast=${broadcast} track=${request.name}`);
         }
         catch (err) {
-            const e = error(err);
+            const e = await sessionCause(this.#quic, err);
             producer.close(e);
             stream.abort(e);
             console.warn(`subscribe error: id=${requestId} broadcast=${broadcast} track=${request.name} error=${reason(e)}`);
@@ -436,10 +536,36 @@ export class Subscriber {
         finally {
             // Only the owner tears down the alias metadata: a later subscription may have
             // reclaimed the alias and installed its own timescale.
-            if (this.#aliases.retire(trackAlias, producer))
+            if (this.#aliases.retire(trackAlias, subscription))
                 this.#timescales.delete(trackAlias);
         }
     }
+    /**
+     * Read the PUBLISH_DONE that ends a subscription, then wait for the data streams it counts.
+     *
+     * An error status aborts the track with it. A clean one leaves streams in flight, since
+     * QUIC does not order them, so wait until the Stream Count many have been read, or a
+     * bounded grace for the ones that never arrive (the draft says to use a timeout). The count
+     * is only a hint: a peer may send 0 regardless, so 0 waits out the grace. A request
+     * stream that FINs without PUBLISH_DONE is a protocol violation.
+     */
+    async #runPublishDone(stream, subscription) {
+        const version = this.#session.version;
+        if (await stream.reader.done())
+            throw new ProtocolViolation("subscribe stream ended without PUBLISH_DONE");
+        const typeId = await stream.reader.u53();
+        if (typeId !== PublishDone.id) {
+            throw new ProtocolViolation(`unexpected message on a subscription: 0x${typeId.toString(16)}`);
+        }
+        const done = await PublishDone.decode(stream.reader, version);
+        if (!publishDoneClean(done.statusCode, version)) {
+            throw new Error(`publish done: status=0x${done.statusCode.toString(16)} reason=${done.reasonPhrase}`);
+        }
+        const count = done.streamCount;
+        const { tail, track } = subscription;
+        const complete = () => count > 0n && BigInt(tail.streams) >= count;
+        await tail.settle(complete, track.closed);
+    }
     /**
      * Tell the publisher to stop serving a subscription we are walking away from.
      *
@@ -465,7 +591,7 @@ export class Subscriber {
     // `state` is populated as soon as the stream opens and again when the
     // trackAlias is registered, so the caller can clean both up on timeout
     // even before this promise settles.
-    async #openSubscribe(state, broadcast, request, producer, requestId) {
+    async #openSubscribe(state, broadcast, request, subscription, requestId) {
         const version = this.#session.version;
         state.stream = await this.#session.openBi();
         // The timeout can fire while the open is still in flight, in which case cleanup ran
@@ -503,7 +629,7 @@ export class Subscriber {
                     const err = version === Version.DRAFT_14
                         ? await SubscribeError.decode(state.stream.reader, version)
                         : await RequestError.decode(state.stream.reader, version);
-                    reasonPhrase = `code=${err.errorCode} reason=${err.reasonPhrase}`;
+                    reasonPhrase = requestReason(err.errorCode, err.reasonPhrase, "subscribe", version);
                 }
             }
             catch {
@@ -513,8 +639,11 @@ export class Subscriber {
             throw new Error(`SUBSCRIBE error: ${reasonPhrase}`);
         }
         const ok = await SubscribeOk.decode(state.stream.reader, version);
+        if (state.cancelled)
+            throw new Error("subscribe cancelled before acceptance");
+        request.accept({ priority: fromWire(ok.properties.priority ?? 128) });
         try {
-            this.#aliases.set(ok.trackAlias, producer, { broadcast, name: request.name });
+            this.#aliases.set(ok.trackAlias, subscription, { broadcast, name: request.name });
             const timescale = ok.properties.timescale;
             if (timescale !== undefined) {
                 this.#timescales.set(ok.trackAlias, timescale);
@@ -548,7 +677,7 @@ export class Subscriber {
             await stream.writer.u53(RequestError.id);
             await new RequestError({
                 requestId: msg.requestId,
-                errorCode: 400,
+                errorCode: toRequestCode("uninterested", "publish_namespace", version),
                 reasonPhrase: "route loops back",
             }).encode(stream.writer, version);
             stream.close();
@@ -563,11 +692,14 @@ export class Subscriber {
         const legacy = version === Version.DRAFT_14 || version === Version.DRAFT_15;
         if (legacy && (this.#announced.has(path) || this.#legacyRequests.has(path))) {
             console.warn("duplicate PublishNamespace");
+            // No draft registers a code for a duplicate, and this refusal is a draft-14/15
+            // implementation limit, which is what INTERNAL_ERROR describes.
+            const errorCode = toRequestCode("internal", "publish_namespace", version);
             if (version === Version.DRAFT_14) {
                 await stream.writer.u53(PublishNamespaceError.id);
                 await new PublishNamespaceError({
                     requestId: msg.requestId,
-                    errorCode: 409,
+                    errorCode,
                     reasonPhrase: "duplicate namespace",
                 }).encode(stream.writer, version);
             }
@@ -575,7 +707,7 @@ export class Subscriber {
                 await stream.writer.u53(RequestError.id);
                 await new RequestError({
                     requestId: msg.requestId,
-                    errorCode: 409,
+                    errorCode,
                     reasonPhrase: "duplicate namespace",
                 }).encode(stream.writer, version);
             }
@@ -608,10 +740,12 @@ export class Subscriber {
             // Only now is the advertisement ours to announce, for the reason above: a
             // consumer reacting with a SUBSCRIBE must not interleave with that OK.
             attached = true;
-            this.#attachAnnounce(path);
-            // An advertisement is updated in place, by repeating PUBLISH_NAMESPACE on the
-            // stream that already carries it, so read until the stream ends rather than
-            // waiting on the close. Nothing else would deliver a re-parented route.
+            this.#attachAnnounce(path, this.#route(msg.cluster));
+            // An advertisement is updated in place with REQUEST_UPDATE on the stream that
+            // already carries it, so read until the stream ends rather than waiting on the
+            // close. Nothing else would deliver a re-parented route. What the peer holds
+            // is kept current, since an update carries only what changed.
+            let held = msg.cluster;
             const done = version === Version.DRAFT_16 || legacy;
             for (;;) {
                 if (await stream.reader.done())
@@ -621,32 +755,47 @@ export class Subscriber {
                     await PublishNamespaceDone.decode(stream.reader, version);
                     break;
                 }
-                if (typeId !== PublishNamespace.id) {
+                // A repeated PUBLISH_NAMESPACE lands here too: a second request on the
+                // stream is the base draft's duplicate request ID.
+                if (typeId !== PublishNamespaceUpdate.id) {
                     throw new ProtocolViolation(`unexpected message on publish_namespace stream: 0x${typeId.toString(16)}`);
                 }
-                const update = await PublishNamespace.decode(stream.reader, version, Cluster.negotiated(this.#cluster));
-                // The stream is the advertisement, so an update on it must name the same
-                // one. Applying a mismatched update would retarget this path with metadata
-                // meant for a different request.
-                if (update.requestId !== msg.requestId || update.trackNamespace !== path) {
-                    throw new ProtocolViolation("publish_namespace update does not match its stream");
+                const update = await PublishNamespaceUpdate.decode(stream.reader, version);
+                // The parameters exist only on a session that negotiated the extension;
+                // anywhere else they are the peer's violation.
+                if (held === undefined) {
+                    if (update.update.hops !== undefined || update.update.cost !== undefined) {
+                        throw new ProtocolViolation("cluster parameters on a session that negotiated none");
+                    }
+                }
+                else {
+                    // A different original publisher applies in place too, as it does inline.
+                    held = Cluster.apply(held, update.update);
                 }
-                // A path that now runs through us is unusable, so give it back. Keep
-                // reading: this stream is the advertisement's only channel, so a later
-                // clean path arrives here or nowhere.
-                if (this.#reflected(update.cluster)) {
+                // A path that now runs through us is unusable, so give it back. The update
+                // itself is accepted, and reading continues: this stream is the
+                // advertisement's only channel, so a later clean path arrives here or
+                // nowhere.
+                if (this.#reflected(held)) {
                     if (attached) {
                         attached = false;
                         console.debug(`publish_namespace now loops back, detaching: broadcast=${path}`);
                         this.#detachAnnounce(path);
                     }
-                    continue;
                 }
-                // Re-attach: a clean path replaced the reflected one we detached from.
-                if (!attached) {
+                else if (!attached) {
+                    // Re-attach: a clean path replaced the reflected one we detached from.
                     attached = true;
-                    this.#attachAnnounce(path);
+                    this.#attachAnnounce(path, this.#route(held));
+                }
+                else {
+                    this.#updateAnnounce(path, this.#route(held));
                 }
+                // Nothing here can fail to apply, so every update is acknowledged. A leaf
+                // routes nothing, so a repricing changes nothing it holds; consumers still
+                // hear the new route so a forwarder can reprice.
+                await stream.writer.u53(RequestOk.id);
+                await new RequestOk({}).encode(stream.writer, version);
             }
         }
         finally {
@@ -667,17 +816,17 @@ export class Subscriber {
      */
     async runPublish(msg, stream) {
         const version = this.#session.version;
-        // NOT_SUPPORTED, from the PUBLISH error codes in draft-19 section 10.10. We decline
-        // the method itself rather than this particular track, which is UNINTERESTED (0x4).
+        // We decline the method itself rather than this particular track, which would be
+        // UNINTERESTED.
         //
         // The alias the message carries is deliberately not recorded. Nothing will ever bind
         // it, and a rejected request has no lifetime of ours to hang the cleanup on.
-        const NOT_SUPPORTED = 0x3;
+        const errorCode = toRequestCode("not_supported", "publish", version);
         if (version === Version.DRAFT_14) {
             await stream.writer.u53(PublishError.id);
             const err = new PublishError({
                 requestId: msg.requestId,
-                errorCode: NOT_SUPPORTED,
+                errorCode,
                 reasonPhrase: "publish not supported",
             });
             await err.encode(stream.writer, version);
@@ -686,7 +835,7 @@ export class Subscriber {
             await stream.writer.u53(RequestError.id);
             const err = new RequestError({
                 requestId: version === Version.DRAFT_15 || version === Version.DRAFT_16 ? msg.requestId : undefined,
-                errorCode: NOT_SUPPORTED,
+                errorCode,
                 reasonPhrase: "publish not supported",
             });
             await err.encode(stream.writer, version);
@@ -702,48 +851,114 @@ export class Subscriber {
         if (group.subGroupId !== 0) {
             throw new Error("subgroups are not supported");
         }
-        // FIRST_OBJECT clear says this stream starts partway through the group, which the
-        // draft lets a publisher do to answer a filter. Nothing above here can use it: the
-        // objects that would arrive are not decodable without the missing head, and a group
-        // is the unit an application resyncs on. Drop it and pick up at the next group, the
-        // same degradation as a publisher that no longer holds the head.
-        //
-        // This only saves reading a stream we would throw away. The bit is the publisher's
-        // claim, so what is enforced is the object ids themselves: `Frame.decode` holds every
-        // object to starting at 0 and incrementing by 1, whatever the header said and on the
-        // drafts that have no such bit to read.
-        if (!group.flags.firstObject) {
-            console.debug(`dropping a group with no head: alias=${group.trackAlias} group=${group.groupId}`);
-            stream.stop(new Error("a group must start at object 0"));
+        let subscription;
+        try {
+            // The control message establishing this alias can arrive after the data stream.
+            subscription = await this.#aliases.get(group.trackAlias);
+        }
+        catch (err) {
+            const e = error(err);
+            // Ours: we cancelled the subscription and the publisher has not stopped yet.
+            // Anything else on this alias is the publisher sending data for a track it never
+            // acknowledged, which is worth seeing.
+            if (e instanceof RetiredTrackAlias) {
+                console.debug(`dropping group for a cancelled subscription: alias=${group.trackAlias}`);
+            }
+            stream.stop(e);
             return;
         }
-        const producer = new netGroup.Producer(group.groupId);
+        const { track, tail } = subscription;
+        // Every data stream counts toward PUBLISH_DONE's Stream Count, even one dropped below.
+        const read = tail.open(group.groupId);
+        // Created on the first object rather than the header: an END_OF_TRACK at object 0
+        // means the group does not exist at all.
+        let producer;
+        const open = () => {
+            if (!producer) {
+                // The publisher contradicted its own end, which no later group can repair.
+                if (subscription.end !== undefined && group.groupId >= subscription.end) {
+                    throw new ProtocolViolation(`group ${group.groupId} is at or past the declared end ${subscription.end}`);
+                }
+                producer = new netGroup.Producer(group.groupId);
+                track.writeGroup(producer);
+            }
+            return producer;
+        };
         try {
-            // The control message establishing this alias can arrive after the data stream.
-            const track = await this.#aliases.get(group.trackAlias);
-            track.writeGroup(producer);
+            // FIRST_OBJECT clear says this stream starts partway through the group, which the
+            // draft lets a publisher do to answer a filter. Nothing above here can use it: the
+            // objects that would arrive are not decodable without the missing head, and a group
+            // is the unit an application resyncs on. Drop it and pick up at the next group, the
+            // same degradation as a publisher that no longer holds the head.
+            //
+            // This only saves reading a stream we would throw away. The bit is the publisher's
+            // claim, so what is enforced is the object ids themselves: `Frame.decode` holds every
+            // object to starting at 0 and incrementing by 1, whatever the header said and on the
+            // drafts that have no such bit to read.
+            if (!group.flags.firstObject) {
+                console.debug(`dropping a group with no head: alias=${group.trackAlias} group=${group.groupId}`);
+                stream.stop(new Error("a group must start at object 0"));
+                return;
+            }
+            // The alias binds after SUBSCRIBE_OK commits the track property; an omitted
+            // header priority inherits it (draft-21 section 10.4).
+            if (!group.flags.hasPriority)
+                group.publisherPriority = toWire((await track.info()).priority);
+            const decode = (c) => Frame.decode(c, group.flags, this.#timescales.get(group.trackAlias));
             for (;;) {
-                const done = await Promise.race([stream.done(), producer.closed, track.closed]);
-                if (done !== false)
+                // Every object already buffered is written without an await, so the reader wakes
+                // once per batch rather than once per object. Only the group's own stream ends it:
+                // a track that closes first has already closed (or aborted) this group through its
+                // cache.
+                const frame = stream.tryDecode(decode) ??
+                    (await (producer
+                        ? race([stream.decodeMaybe(decode), producer.closed])
+                        : stream.decodeMaybe(decode)));
+                if (!frame || frame instanceof Error)
                     break;
-                const frame = await Frame.decode(stream, group.flags, this.#timescales.get(group.trackAlias), this.#session.version);
+                if (frame.endOfTrack) {
+                    // No object at or past this location exists: after the group's last object
+                    // the track ends with it, and at object 0 it ends before it.
+                    const end = producer ? group.groupId + 1 : group.groupId;
+                    producer?.close();
+                    try {
+                        track.finishAt(end);
+                    }
+                    catch (err) {
+                        throw new ProtocolViolation(`invalid END_OF_TRACK: ${reason(error(err))}`);
+                    }
+                    subscription.end ??= end;
+                    return;
+                }
                 if (frame.payload === undefined)
                     break;
-                producer.writeFrame({ payload: frame.payload, timestamp: frame.timestamp ?? Timestamp.now() });
+                open().writeFrame({ payload: frame.payload, timestamp: frame.timestamp ?? Timestamp.now() });
             }
-            producer.close();
+            // A group with no objects still exists.
+            open().close();
         }
         catch (err) {
             const e = error(err);
-            // Ours: we cancelled the subscription and the publisher has not stopped yet.
-            // Anything else on this alias is the publisher sending data for a track it never
-            // acknowledged, which is worth seeing.
-            if (e instanceof RetiredTrackAlias) {
-                console.debug(`dropping group for a cancelled subscription: alias=${group.trackAlias}`);
+            if (e instanceof ProtocolViolation) {
+                // The publisher broke the track's end, which no later group can repair.
+                producer?.close(e);
+                track.close(e);
+            }
+            else {
+                // A stream that fails before its first object still names a group, which the
+                // reader sees fail rather than silently go missing.
+                try {
+                    open().close(e);
+                }
+                catch {
+                    // The track has already closed or ended below this group.
+                }
             }
-            producer.close(e);
             stream.stop(e);
         }
+        finally {
+            read();
+        }
     }
 }
 /**
@@ -752,16 +967,15 @@ export class Subscriber {
  * group fetch, so `track.Consumer.fetchGroup()` is rejected.
  */
 class ConsumeBroadcast extends broadcast.Consumer {
-    // biome-ignore lint/complexity/noUselessConstructor: widens the protected base constructor to public
     constructor(state) {
         super(state);
+        overrideBroadcastWire(this, {
+            fetchGroup: () => Promise.reject(new Error("fetch group is not supported for moq-transport")),
+        });
     }
     // Preserve the subclass when the consume cache shares this broadcast across callers.
     clone() {
         return new ConsumeBroadcast(this.shareState());
     }
-    fetchGroup() {
-        return Promise.reject(new Error("fetch group is not supported for moq-transport"));
-    }
 }
 //# sourceMappingURL=subscriber.js.map