@norskvideo/moq-net 0.1.8 → 0.2.1

package/ietf/publisher.js

@@ -1,31 +1,65 @@
 /* @ts-self-types="./publisher.d.ts" */
-import { Signal } from "@norskvideo/moq-signals";
-import { error, reason } from "../error.js";
+import { race, Signal } from "@norskvideo/moq-signals";
+import { controlTimeout, error, reason, StreamCode, StreamError } from "../error.js";
+import { hiddenBelow, hooks, presented } from "../internal.js";
 import * as Path from "../path.js";
 import { Writer } from "../stream.js";
-import { withTimeout } from "../util/timeout.js";
+import { Milli, Timescale } from "../time.js";
+import { TimeoutError, withTimeout } from "../util/timeout.js";
+import * as Varint from "../varint.js";
+import { wireOf } from "../wire.js";
 import * as Cluster from "./cluster.js";
-import { FetchHeader } from "./fetch.js";
+import { requestReason, toRequestCode } from "./error.js";
+import { FetchError, FetchHeader } from "./fetch.js";
 import * as Filter from "./filter.js";
 import { FetchFrame, Frame, Group as GroupMessage } from "./object.js";
-import { fromWire } from "./priority.js";
+import { fromWire, toWire } from "./priority.js";
 import * as Properties from "./properties.js";
-import { PublishDone } from "./publish.js";
-import { PublishNamespace, PublishNamespaceDone, PublishNamespaceOk } from "./publish_namespace.js";
+import { PublishDone, PublishDoneStatus } from "./publish.js";
+import { PublishNamespace, PublishNamespaceDone, PublishNamespaceOk, PublishNamespaceUpdate, } from "./publish_namespace.js";
 import { RequestError, RequestOk } from "./request.js";
 import { SubscribeError, SubscribeOk } from "./subscribe.js";
 import { SubscribeNamespaceEntry, SubscribeNamespaceEntryDone, SubscribeNamespaceOk, } from "./subscribe_namespace.js";
-import { TrackStatus } from "./track.js";
 import { Version } from "./version.js";
 /** First wait before re-offering a namespace the peer refused or we couldn't open for. */
 const RETRY_BASE = 100;
 /** Ceiling on that wait. The loop retries for the life of the session, so it must not spin. */
 const RETRY_MAX = 5000;
-/** PUBLISH_DONE statuses this implementation emits. Stable across drafts 14 through 19. */
-const PUBLISH_DONE_STATUS = {
-    INTERNAL_ERROR: 0x0,
-    TRACK_ENDED: 0x2,
-};
+/** Cluster parameters for one snapshot: the advertised hops, then our own id last. */
+function clusterFor(base, route) {
+    if (!base)
+        return undefined;
+    const self = base.hops.at(-1);
+    if (self === undefined)
+        return undefined;
+    const hops = route.hops.at(-1) === self ? [...route.hops] : [...route.hops, self];
+    return { hops, cost: route.cost.warm };
+}
+/**
+ * What it takes to move the peer from `held` to `next`.
+ *
+ * - `"same"`: the peer would decode the same advertisement. The cold cost, and the whole
+ *   route without Cluster, never reach the wire, so a change there sends nothing.
+ * - `"restart"`: nothing is held, nothing is wanted, or a different broadcast, which is
+ *   withdrawn and advertised again.
+ * - Otherwise the same broadcast at a new hop chain or warm cost: the cluster parameters
+ *   the peer holds and the ones it should, for the target to update.
+ */
+function change(base, held, next) {
+    if (held === undefined || next === undefined || held.identity !== next.identity)
+        return "restart";
+    const from = clusterFor(base, held.route);
+    const to = clusterFor(base, next.route);
+    if (from === undefined || to === undefined)
+        return from === to ? "same" : "restart";
+    if (from.cost === to.cost && sameHops(from.hops, to.hops))
+        return "same";
+    return { from, to };
+}
+/** Whether two hop paths list the same hops in the same order. */
+function sameHops(a, b) {
+    return a.length === b.length && a.every((hop, i) => hop === b[i]);
+}
 /**
  * How long one advertisement may take to be answered. Matches the Rust publisher, and the
  * peer accepting the stream is only half the exchange: one it never answers on holds the
@@ -46,44 +80,32 @@ export class Publisher {
     #quic;
     #session;
     #requiresSolicitation;
+    #hidden;
+    // The origin this session serves, borrowed: it outlives the session, and closing the
+    // session leaves its broadcasts alone. The namespaces are advertised with an unsolicited
+    // PUBLISH_NAMESPACE (see {@link runPublishNamespaces}), or on request if the peer asked
+    // for that (see {@link runSubscribeNamespace}).
+    #advertised;
+    #publish;
     // What every advertisement carries on a session that negotiated the MoQ Cluster
     // extension: a hop path holding our own id, so the peer can tell that what it hears
     // back came from us. `undefined` when nothing negotiated it.
     #advert;
-    // Our published broadcasts.
-    // It's a signal so we can live update any subscribe_namespace streams.
-    #broadcasts = new Signal(new Map());
     /**
      * Creates a new Publisher instance.
      *
      * @internal
      */
-    constructor({ quic, session, requiresSolicitation, cluster, }) {
+    constructor({ quic, session, publish, requiresSolicitation, hidden = false, cluster, }) {
         this.#quic = quic;
         this.#session = session;
+        const origin = publish && wireOf(publish);
+        this.#advertised = origin?.advertised ?? new Signal(new Map());
+        this.#publish = publish;
         this.#requiresSolicitation = requiresSolicitation;
+        this.#hidden = hidden;
         this.#advert = Cluster.advertise(cluster);
     }
-    /**
-     * Publishes a broadcast with any associated tracks.
-     * The namespace is advertised with an unsolicited PUBLISH_NAMESPACE, or on request
-     * if the peer asked for that (see {@link runPublishNamespaces}).
-     */
-    publish(path, broadcast) {
-        this.#broadcasts.mutate((broadcasts) => {
-            if (!broadcasts)
-                throw new Error("closed");
-            broadcasts.set(path, broadcast);
-        });
-        // Remove the broadcast from the lookup when it's closed, unless the path was republished.
-        void broadcast.closed.then(() => {
-            this.#broadcasts.mutate((broadcasts) => {
-                if (broadcasts?.get(path) === broadcast) {
-                    broadcasts.delete(path);
-                }
-            });
-        });
-    }
     /**
      * Handles an incoming SUBSCRIBE request on a bidi stream.
      * Owns the full lifecycle: sends response, serves track data, waits for close.
@@ -93,15 +115,43 @@ export class Publisher {
     async runSubscribe(msg, stream) {
         const version = this.#session.version;
         const name = msg.trackNamespace;
-        const broadcast = this.#broadcasts.peek()?.get(name);
-        if (!broadcast) {
-            // Write error response
+        let broadcast;
+        let refusal;
+        // Legal requests we can't honor are refused one at a time. A subscription that
+        // forwards nothing is only useful to a subscriber that later turns forwarding on,
+        // and serving a Range Filter unfiltered would deliver objects it excluded.
+        const unsupported = !msg.forward
+            ? "FORWARD=0 not supported"
+            : msg.rangeFilters
+                ? "range filters not supported"
+                : undefined;
+        if (unsupported) {
+            refusal = { errorCode: toRequestCode("not_supported", "subscribe", version), reasonPhrase: unsupported };
+        }
+        else {
+            try {
+                broadcast =
+                    this.#publish && (wireOf(this.#publish).local(name) ?? (await wireOf(this.#publish).demand(name)));
+                if (!broadcast) {
+                    refusal = {
+                        errorCode: toRequestCode("does_not_exist", "subscribe", version),
+                        reasonPhrase: "broadcast not found",
+                    };
+                }
+            }
+            catch (err) {
+                const e = error(err);
+                const condition = e instanceof StreamError && e.code === StreamCode.NotFound ? "does_not_exist" : "internal";
+                refusal = { errorCode: toRequestCode(condition, "subscribe", version), reasonPhrase: reason(e) };
+            }
+        }
+        if (refusal) {
             if (version === Version.DRAFT_14) {
                 await stream.writer.u53(SubscribeError.id);
                 const err = new SubscribeError({
                     requestId: msg.requestId,
-                    errorCode: 404,
-                    reasonPhrase: "Broadcast not found",
+                    errorCode: refusal.errorCode,
+                    reasonPhrase: refusal.reasonPhrase,
                 });
                 await err.encode(stream.writer, version);
             }
@@ -109,21 +159,36 @@ export class Publisher {
                 await stream.writer.u53(RequestError.id);
                 const err = new RequestError({
                     requestId: version === Version.DRAFT_15 || version === Version.DRAFT_16 ? msg.requestId : undefined,
-                    errorCode: 404,
-                    reasonPhrase: "Broadcast not found",
+                    errorCode: refusal.errorCode,
+                    reasonPhrase: refusal.reasonPhrase,
                 });
                 await err.encode(stream.writer, version);
             }
             stream.close();
             return;
         }
+        if (!broadcast)
+            return;
         const priority = fromWire(msg.subscriberPriority);
-        const track = broadcast.subscribe(msg.trackName, { priority });
-        // Hoisted so the cleanup below reaches it: the fork happens before SUBSCRIBE_OK is
-        // written, and a write that throws must not strand the sink it attached.
+        const track = wireOf(broadcast).subscribe(msg.trackName, {
+            priority,
+            // moq-transport has no subscriber latency parameter. Keep everything the
+            // producer retained and let the receiving subscriber enforce its own budget.
+            // Keep the sentinel encodable if this demand crosses a Lite hop before the
+            // producer's retention bound is known.
+            maxAge: Milli(Varint.MAX_U53),
+        });
         let cache;
         try {
-            const timescale = (await track.info()).timescale;
+            // Declaring the timescale is what opts the track into timestamps; every object
+            // Timestamp below is in these units.
+            const info = await track.info();
+            const timescale = info.timescale;
+            // The model ranks higher-first, the IETF wire lower-first. Every group this
+            // subscription serves carries the same publisher priority, which is what lets a
+            // relay prefer catalog and audio over video when it has no subscriber preference
+            // to go on.
+            const publisherPriority = toWire(info.priority);
             // The filter and any fill are relative to the live edge, so snapshot it once: the
             // fill ends exactly where a Next Object subscription begins, which is what lets
             // the draft's current-group join (Next Object plus a StartGroup=1 fill) cover the
@@ -133,21 +198,25 @@ export class Publisher {
             // The wire request tells an upstream what we need; the cursor is what actually
             // trims this subscriber, since the producer fans every cached group out to every
             // sink regardless. An absent start joins at the latest group, which is what
-            // moq-lite means by joining a live track.
+            // moq-lite means by joining a live track. The range's end is the inclusive last
+            // group; the model's `endGroup` is exclusive.
             track.update({
                 priority,
-                startGroup: range.start && Number(range.start.group),
-                endGroup: range.end && Number(range.end.group),
+                maxAge: Milli(Varint.MAX_U53),
+                groups: {
+                    start: range.start ? { included: Number(range.start.group) } : undefined,
+                    end: range.end ? { included: Number(range.end.group) } : undefined,
+                },
             });
             const startGroup = range.start ? Number(range.start.group) : track.latest();
             if (startGroup !== undefined)
-                track.startAt(startGroup);
+                track.setGroups({ start: { included: startGroup } });
             // A fill reads the group cache through its own consumer, independent of the
             // subscription's cursor. Forked from this subscriber rather than resolved through
             // the broadcast again: a dynamic serve is one request per peer subscription, so
             // asking the broadcast would mint a second producer nobody has accepted.
             const fill = msg.fill && Filter.isDraft20(version) ? fillRange(msg.fill, msg.filter, edge.largest) : undefined;
-            cache = fill && fill.kind !== "empty" ? track.fork({ priority }) : undefined;
+            cache = fill && fill.kind !== "empty" ? track.fork({ priority, maxAge: Milli(Varint.MAX_U53) }) : undefined;
             // Send SUBSCRIBE_OK
             await stream.writer.u53(SubscribeOk.id);
             const ok = new SubscribeOk({
@@ -156,13 +225,20 @@ export class Publisher {
                     : undefined,
                 trackAlias: msg.requestId,
                 // Required once the track has content; a fill-requesting subscriber sizes its
-                // backfill against this.
-                largest: edge.largest && { groupId: edge.largest.group, objectId: edge.largest.object },
+                // backfill against this. Below draft-20 round it down to the start of its
+                // group, matching what the subscription serves there: a draft-20 subscriber
+                // recovers a group's head with a FILL, which we serve, while older drafts
+                // recover it with a joining FETCH, which we do not, so naming a mid-group
+                // start would strand them.
+                largest: edge.largest &&
+                    (Filter.isDraft20(version)
+                        ? { groupId: edge.largest.group, objectId: edge.largest.object }
+                        : { groupId: edge.largest.group, objectId: 0n }),
                 properties: msg.propertiesWanted
                     ? // Declaring the timescale is what opts the track into timestamps; every
                         // object Timestamp below is in these units. We serve the newest group
                         // first, matching moq-lite.
-                        { timescale, groupOrder: Properties.DESCENDING }
+                        { timescale, priority: publisherPriority, groupOrder: Properties.DESCENDING }
                     : // INCLUDE_PROPERTIES=0. The block stays present but empty, which also means
                         // the track opts out of timestamps for this subscriber.
                         {},
@@ -183,13 +259,17 @@ export class Publisher {
             }, 
             // A reset is always the peer.
             () => unsubscribe());
+            // Every group started, until its stream finishes or resets, and the data streams
+            // opened for PUBLISH_DONE to report.
+            const groups = new Set();
+            const streams = { opened: 0 };
             // Serve track groups, racing with stream close (= Unsubscribe)
             const serving = (async () => {
                 for (;;) {
                     const group = await track.recvGroup();
                     if (!group)
                         return;
-                    // Past the filter's end. Dropped here rather than through `endAt`, which
+                    // Past the filter's end. Dropped here rather than through `setGroups`, which
                     // parks a capped group instead: this range is fixed for the life of the
                     // subscription, so a group above it is never coming back in, and holding
                     // one keeps the loop from ever ending. A producer that publishes beyond
@@ -198,14 +278,18 @@ export class Publisher {
                         group.close();
                         continue;
                     }
-                    void this.#runGroup({
+                    const task = this.#runGroup({
                         requestId: msg.requestId,
                         group,
                         timescale,
+                        publisherPriority,
                         stamped: msg.propertiesWanted,
                         slice: groupSlice(range, group.sequence),
                         unsubscribed,
+                        streams,
                     });
+                    groups.add(task);
+                    void task.finally(() => groups.delete(task));
                 }
             })();
             // The fill (when one was requested) runs alongside on its own fetch stream; its
@@ -219,15 +303,35 @@ export class Publisher {
                     timescale,
                     stamped: msg.propertiesWanted,
                     unsubscribed,
+                    streams,
                 })
                 : Promise.resolve();
             let publishError;
+            let ended = false;
             try {
-                await Promise.race([Promise.all([serving, filling]), stream.reader.closed]);
+                const served = Symbol("served");
+                ended =
+                    (await race([Promise.all([serving, filling]).then(() => served), stream.reader.closed])) === served;
             }
             catch (err) {
                 publishError = error(err);
             }
+            // PUBLISH_DONE waits until every stream this subscription will open is closed, as
+            // the draft requires, so its count is final. The subscriber leaving cancels the
+            // ones still queued instead.
+            await race([Promise.all(groups), unsubscribed]);
+            // Draft 14 on has no end location in PUBLISH_DONE: an END_OF_TRACK object is what
+            // tells the subscriber where the track ended.
+            const final = track.final();
+            if (ended && !publishError && final !== undefined) {
+                await this.#runEndOfTrack({
+                    requestId: msg.requestId,
+                    final,
+                    publisherPriority,
+                    unsubscribed,
+                    streams,
+                });
+            }
             console.debug(`publish done: broadcast=${name} track=${track.name}`);
             if (publishError) {
                 console.warn(`publish error: broadcast=${name} track=${track.name} error=${reason(publishError)}`);
@@ -240,7 +344,8 @@ export class Publisher {
                     requestId: version === Version.DRAFT_14 || version === Version.DRAFT_15 || version === Version.DRAFT_16
                         ? msg.requestId
                         : undefined,
-                    statusCode: publishError ? PUBLISH_DONE_STATUS.INTERNAL_ERROR : PUBLISH_DONE_STATUS.TRACK_ENDED,
+                    statusCode: publishError ? PublishDoneStatus.INTERNAL_ERROR : PublishDoneStatus.TRACK_ENDED,
+                    streamCount: BigInt(streams.opened),
                     reasonPhrase: publishError ? "internal error" : "track ended",
                 });
                 await done.encode(stream.writer, version);
@@ -270,7 +375,7 @@ export class Publisher {
      * Runs a group and sends its frames using ObjectStream (Subgroup delivery mode).
      */
     async #runGroup(options) {
-        const { requestId, group, timescale, stamped, slice, unsubscribed } = options;
+        const { requestId, group, timescale, publisherPriority, stamped, slice, unsubscribed, streams } = options;
         try {
             // One stream per group is faster than a peer at its limit can retire them, so this
             // is the one path that doesn't wait for a slot: the transport would serve the opens
@@ -285,11 +390,12 @@ export class Publisher {
                 group.close(new Error("no stream slot"));
                 return;
             }
+            streams.opened += 1;
             const header = new GroupMessage({
                 trackAlias: requestId,
                 groupId: group.sequence,
                 subGroupId: 0,
-                publisherPriority: 0,
+                publisherPriority,
                 flags: {
                     // The object properties carry the timestamp, so there is nothing to write
                     // when the track declared no units to read one in.
@@ -303,8 +409,8 @@ export class Publisher {
                     firstObject: slice.skip === 0,
                 },
             });
-            await header.encode(stream, this.#session.version);
             try {
+                await hooks.guardGroup(group, () => header.encode(stream, this.#session.version));
                 // The first written object goes on the wire as its absolute id, so a trimmed
                 // head shows the true numbering rather than a silently renumbered group.
                 let first = true;
@@ -318,20 +424,25 @@ export class Publisher {
                     // outside the requested range, so stop without waiting for the group's end.
                     if (slice.until !== undefined && next >= slice.until)
                         break;
-                    // Reading from the filter's start drops the objects below it, including any the
-                    // group's cache evicted: they are outside the requested range, so losing them is
-                    // not the gap that would otherwise reset this stream and forfeit the rest of the
-                    // group. An eviction at or above the start is a real gap and still throws.
-                    const frame = await Promise.race([group.readFrameSequence({ from: slice.skip }), stream.closed]);
-                    if (!frame)
+                    // Reading from the filter's start drops the objects below it: they are outside
+                    // the requested range, so skipping them is not a gap.
+                    const read = await race([hooks.readGroupFrame(group, slice.skip), stream.closed]);
+                    if (!read)
                         break;
-                    next = frame.sequence + 1;
-                    if (slice.until !== undefined && frame.sequence >= slice.until)
+                    next = read.sequence + 1;
+                    if (slice.until !== undefined && read.sequence >= slice.until) {
+                        read.complete();
                         break;
-                    const obj = new Frame({ payload: frame.payload, timestamp: frame.timestamp });
-                    const delta = first ? frame.sequence : 0;
-                    first = false;
-                    await obj.encode(stream, header.flags, timescale, this.#session.version, delta);
+                    }
+                    try {
+                        const obj = new Frame({ payload: read.frame.payload, timestamp: read.frame.timestamp });
+                        const delta = first ? read.sequence : 0;
+                        first = false;
+                        await hooks.guardGroup(group, () => obj.encode(stream, header.flags, timescale, this.#session.version, delta));
+                    }
+                    finally {
+                        read.complete();
+                    }
                 }
                 stream.close();
             }
@@ -343,6 +454,43 @@ export class Publisher {
             group.close();
         }
     }
+    /**
+     * Mark the track's end with an END_OF_TRACK object on its own stream, at object 0 of the
+     * group that will never exist.
+     *
+     * The last group's stream has usually finished before the track ends, so the marker cannot
+     * ride on it. A failure only costs the subscriber the early boundary.
+     */
+    async #runEndOfTrack(options) {
+        const { requestId, final, publisherPriority, unsubscribed, streams } = options;
+        const version = this.#session.version;
+        const stream = await Writer.tryOpen(this.#quic, { cancel: unsubscribed, version }).catch(() => undefined);
+        if (!stream)
+            return;
+        streams.opened += 1;
+        try {
+            const header = new GroupMessage({
+                trackAlias: requestId,
+                groupId: final,
+                subGroupId: 0,
+                publisherPriority,
+                flags: {
+                    hasExtensions: false,
+                    hasSubgroup: false,
+                    hasSubgroupObject: false,
+                    hasEnd: false,
+                    hasPriority: true,
+                    firstObject: true,
+                },
+            });
+            await header.encode(stream, version);
+            await new Frame({ endOfTrack: true }).encode(stream, header.flags, Timescale.MILLI, version);
+            stream.close();
+        }
+        catch (err) {
+            stream.reset(error(err));
+        }
+    }
     /**
      * Serve a draft-20 fill on its own fetch stream: the requested range, read from the
      * group cache, capped at the Largest Object snapshot.
@@ -352,7 +500,7 @@ export class Publisher {
      * fill-failure signal. Nothing here touches the subscription either way.
      */
     async #runFill(options) {
-        const { requestId, fill, cache, timescale, stamped, unsubscribed } = options;
+        const { requestId, fill, cache, timescale, stamped, unsubscribed, streams } = options;
         const version = this.#session.version;
         // Everything is inside the try so the cache fork is released on every path out,
         // including a transport failure while opening the stream.
@@ -365,6 +513,7 @@ export class Publisher {
                 console.debug(`fill stream failed to open: fill=${requestId}`);
                 return;
             }
+            streams.opened += 1;
             await stream.u53(FetchHeader.type);
             await new FetchHeader({ requestId }).encode(stream, version);
             if (fill.kind !== "group") {
@@ -413,13 +562,8 @@ export class Publisher {
             // subscription, so stop without waiting for the group's end.
             if (fill.until !== undefined && next >= fill.until)
                 break;
-            // Reading from the fill's start drops everything below it, evicted objects included;
-            // see the same read in #runGroup.
-            const frame = await Promise.race([
-                group.readFrameSequence({ from: Number(fill.skip) }),
-                stream.closed,
-                cancelled,
-            ]);
+            // Reading from the fill's start drops everything below it; see the same read in #runGroup.
+            const frame = await race([group.readFrameSequence({ from: Number(fill.skip) }), stream.closed, cancelled]);
             if (left)
                 throw new Error("unsubscribed before the fill finished");
             if (!frame)
@@ -435,11 +579,12 @@ export class Publisher {
     /**
      * Handles an incoming SUBSCRIBE_NAMESPACE on a bidi stream.
      *
-     * This carries the advertisements only when the peer asked to be told on request
-     * (MoQ Solicit); otherwise {@link runPublishNamespaces} has already announced
-     * everything and repeating it here would leave the peer holding two sources for one
-     * broadcast. Draft-16+ streams Namespace entries inline; draft-14/15 predate those
-     * messages, so each advertisement is a PUBLISH_NAMESPACE request of its own.
+     * This carries the advertisements when the peer asked to be told on request (MoQ
+     * Solicit); otherwise {@link runPublishNamespaces} has already announced everything
+     * visible and repeating it here would leave the peer holding two sources for one
+     * broadcast, so only the hidden namespaces it may see ride here (MoQ Hidden).
+     * Draft-16+ streams Namespace entries inline; draft-14/15 predate those messages, so
+     * each advertisement is a PUBLISH_NAMESPACE request of its own.
      *
      * @internal
      */
@@ -463,35 +608,38 @@ export class Publisher {
                 });
                 await ok.encode(stream.writer, version);
             }
-            if (!this.#requiresSolicitation) {
-                // Already announced, unasked. Hold the stream open until the peer is done.
-                await stream.reader.closed;
-                stream.close();
-                return;
-            }
-            // Reports whether the peer now holds the namespace: an inline entry always
-            // lands, but a PUBLISH_NAMESPACE request can be declined.
-            const advertise = async (suffix) => {
-                if (legacy) {
-                    return await this.#advertise(Path.join(prefix, suffix), requests, refused);
-                }
+            // Hidden namespaces are left out unless the peer opted in (MoQ Hidden). Unless the
+            // peer asked to be told only on request, it has already heard everything visible
+            // from the empty prefix unasked, so this stream carries only what that hid.
+            const carries = (covered) => (!this.#hidden || msg.hidden || !hiddenBelow(prefix, covered)) &&
+                (this.#requiresSolicitation || (this.#hidden && hiddenBelow(Path.empty(), covered)));
+            // Inline entries always land, and the receiver treats a repeated NAMESPACE as a
+            // replacement, so repricing one is just sending it again, a new original
+            // publisher included, as Rust does. Only a legacy PUBLISH_NAMESPACE request can
+            // be declined.
+            const namespace = async (suffix, snap) => {
                 await stream.writer.u53(SubscribeNamespaceEntry.id);
-                await new SubscribeNamespaceEntry({ suffix, cluster: this.#advert }).encode(stream.writer, version);
-                return true;
+                const cluster = clusterFor(this.#advert, snap.route);
+                await new SubscribeNamespaceEntry({ suffix, cluster }).encode(stream.writer, version);
+                return "held";
             };
-            const withdraw = async (suffix) => {
-                if (legacy) {
-                    await this.#withdraw(Path.join(prefix, suffix), requests);
-                }
-                else {
-                    await stream.writer.u53(SubscribeNamespaceEntryDone.id);
-                    await new SubscribeNamespaceEntryDone({ suffix }).encode(stream.writer, version);
+            const target = legacy
+                ? {
+                    advertise: (suffix, snap) => this.#advertise(Path.join(prefix, suffix), requests, clusterFor(this.#advert, snap.route)),
+                    update: (suffix, _snap, reprice) => this.#update(Path.join(prefix, suffix), requests, reprice),
+                    withdraw: (suffix) => this.#withdraw(Path.join(prefix, suffix), requests),
                 }
-            };
-            let active = new Set();
+                : {
+                    advertise: namespace,
+                    update: namespace,
+                    withdraw: async (suffix) => {
+                        await stream.writer.u53(SubscribeNamespaceEntryDone.id);
+                        await new SubscribeNamespaceEntryDone({ suffix }).encode(stream.writer, version);
+                    },
+                };
+            // Keyed by suffix, as the entries name them.
+            const ns = { active: new Map(), refused: new Map(), offered: new Map() };
             let retry = 0;
-            // What the peer refused, and whether coming back is worth anything.
-            const refused = new Map();
             for (;;) {
                 // Subscribe BEFORE reconciling, for the same reason as
                 // {@link runPublishNamespaces}: a publish landing while an advertisement
@@ -499,51 +647,19 @@ export class Publisher {
                 // TODO Make a better helper within Signals.
                 let dispose;
                 const changed = new Promise((resolve) => {
-                    dispose = this.#broadcasts.changed(resolve);
+                    dispose = this.#advertised.changed(resolve);
                 });
-                const broadcasts = this.#broadcasts.peek();
-                if (!broadcasts) {
+                const advertised = this.#advertised.peek();
+                if (!advertised) {
                     dispose();
                     break;
                 }
-                const updated = new Set();
-                for (const name of broadcasts.keys()) {
-                    const suffix = Path.stripPrefix(prefix, name);
-                    if (suffix === null)
-                        continue;
-                    updated.add(suffix);
-                }
-                // A namespace that is gone takes its refusal with it, so re-announcing the
-                // path offers it again.
-                const live = new Set([...updated].map((suffix) => Path.join(prefix, suffix)));
-                for (const path of [...refused.keys()]) {
-                    if (!live.has(path))
-                        refused.delete(path);
-                }
-                // Track what the peer holds rather than what we attempted: a declined
-                // advertisement stays out of `held`, so the next turn retries it instead of
-                // believing the namespace is already up.
-                const held = new Set(active);
-                for (const added of updated.difference(active)) {
-                    if (this.#offerable(Path.join(prefix, added), refused)) {
-                        if (await advertise(added))
-                            held.add(added);
-                    }
-                }
-                for (const removed of active.difference(updated)) {
-                    await withdraw(removed);
-                    held.delete(removed);
-                }
-                active = held;
-                // Whatever we wanted up and could not get up, as {@link runPublishNamespaces}
-                // does: only a legacy request can be declined, and nothing about the peer
-                // starting to answer raises a signal this loop is watching.
-                const outstanding = [...updated.difference(active)].some((suffix) => this.#pending(Path.join(prefix, suffix), refused));
+                const outstanding = await this.#reconcile(ns, presented(prefix, advertised, carries), target);
                 retry = outstanding ? Math.min(retry ? retry * 2 : RETRY_BASE, RETRY_MAX) : 0;
                 // Wait for the next change, or for the peer to unsubscribe.
                 const next = await (retry
-                    ? Promise.race([changed, stream.reader.closed, retryAfter(retry).then(() => broadcasts)])
-                    : Promise.race([changed, stream.reader.closed]));
+                    ? race([changed, stream.reader.closed, retryAfter(retry).then(() => advertised)])
+                    : race([changed, stream.reader.closed]));
                 dispose();
                 if (!next)
                     break;
@@ -581,11 +697,22 @@ export class Publisher {
         }
         // The open PUBLISH_NAMESPACE request per advertised path.
         const requests = new Map();
+        const target = {
+            advertise: (path, snap) => this.#advertise(path, requests, clusterFor(this.#advert, snap.route)),
+            update: (path, _snap, reprice) => this.#update(path, requests, reprice),
+            withdraw: (path) => this.#withdraw(path, requests),
+        };
+        // The origin outlives the session and its signal never ends, so this loop needs the
+        // session's own ending to stop: without it a closed connection leaves the loop parked
+        // on a shared origin forever, waking on someone else's publish to fail on a dead
+        // transport. `runSubscribeNamespace` gets this from the stream the peer asked on; an
+        // unsolicited loop has no stream of its own, so the session is what it watches.
+        const closed = this.#quic.closed.then(() => undefined, () => undefined);
+        let dispose;
         try {
-            let active = new Set();
+            // Keyed by path.
+            const ns = { active: new Map(), refused: new Map(), offered: new Map() };
             let retry = 0;
-            // What the peer refused, and whether coming back is worth anything.
-            const refused = new Map();
             for (;;) {
                 // Subscribe BEFORE reconciling. Each advertisement below waits a round trip
                 // for the peer's reply, and a publish that lands in that window notifies
@@ -593,43 +720,28 @@ export class Publisher {
                 // through it and leave the namespace unadvertised until something unrelated
                 // changed.
                 // TODO Make a better helper within Signals.
-                let dispose;
                 const changed = new Promise((resolve) => {
-                    dispose = this.#broadcasts.changed(resolve);
+                    dispose = this.#advertised.changed(resolve);
                 });
-                const broadcasts = this.#broadcasts.peek();
-                if (!broadcasts) {
-                    dispose();
+                const advertised = this.#advertised.peek();
+                if (!advertised) {
+                    dispose?.();
                     break;
                 }
-                const updated = new Set(broadcasts.keys());
-                // A namespace that is gone takes its refusal with it, so re-announcing the
-                // path offers it again. Rust gets this by rebuilding the watched entry.
-                for (const path of [...refused.keys()]) {
-                    if (!updated.has(path))
-                        refused.delete(path);
-                }
-                for (const added of updated.difference(active)) {
-                    if (this.#offerable(added, refused)) {
-                        await this.#advertise(added, requests, refused);
-                    }
-                }
-                for (const removed of active.difference(updated)) {
-                    await this.#withdraw(removed, requests);
+                const updated = new Map();
+                for (const [covered, candidates] of advertised) {
+                    // Only peers that declared MoQ Hidden filter unsolicited discovery.
+                    if ((this.#hidden && hiddenBelow(Path.empty(), covered)) || candidates.length === 0)
+                        continue;
+                    updated.set(covered, candidates[0]);
                 }
-                // What the peer holds, not what we attempted: a declined PUBLISH_NAMESPACE
-                // leaves no request behind, so it stays outstanding below.
-                active = new Set(requests.keys());
-                // Whatever we wanted up and could not get up. Stream credit freeing, a
-                // transient failure clearing, or the peer starting to answer raises no
-                // signal of its own, so the only way back is to ask again on a timer.
-                const outstanding = [...updated.difference(active)].some((path) => this.#pending(path, refused));
+                const outstanding = await this.#reconcile(ns, updated, target);
                 retry = outstanding ? Math.min(retry ? retry * 2 : RETRY_BASE, RETRY_MAX) : 0;
                 // Wait for the next change, which has already fired if one landed above.
                 const next = await (retry
-                    ? Promise.race([changed, retryAfter(retry).then(() => broadcasts)])
-                    : changed);
-                dispose();
+                    ? race([changed, closed, retryAfter(retry).then(() => advertised)])
+                    : race([changed, closed]));
+                dispose?.();
                 if (!next)
                     break;
             }
@@ -640,20 +752,86 @@ export class Publisher {
             console.warn(`publish_namespace loop failed: ${reason(error(err))}`);
         }
         finally {
+            dispose?.();
             // Close out every open PUBLISH_NAMESPACE request.
             for (const path of [...requests.keys()]) {
                 await this.#withdraw(path, requests);
             }
         }
     }
+    /**
+     * Bring the peer's view in line with `updated`, one namespace at a time, and report
+     * whether anything it should hold is still missing and worth coming back for.
+     *
+     * Nothing the peer cannot see is sent, a reprice updates the namespace in place, and
+     * anything else is withdrawn first so a republish reads as withdraw-then-advertise.
+     * `ns` records what the peer holds rather than what we attempted: a declined
+     * advertisement or update stays out of it, so the next turn offers it fresh instead
+     * of believing it is already up.
+     */
+    async #reconcile(ns, updated, target) {
+        // A namespace that is gone, or that a republish replaced, takes its refusal with
+        // it: the peer refused a broadcast, not a path forever, so a different one at the
+        // same path is offered again. The origin swaps the front in one mutation, so the
+        // path never leaves `updated` and only the front says they differ. Rust gets this
+        // by rebuilding the watched entry.
+        for (const key of [...ns.refused.keys()]) {
+            const snap = updated.get(key);
+            if (snap === undefined || ns.offered.get(key) !== snap.identity) {
+                ns.refused.delete(key);
+                ns.offered.delete(key);
+            }
+        }
+        const held = new Map(ns.active);
+        for (const [key, snap] of ns.active) {
+            if (change(this.#advert, snap, updated.get(key)) !== "restart")
+                continue;
+            await target.withdraw(key);
+            held.delete(key);
+        }
+        for (const [key, snap] of updated) {
+            const prev = held.get(key);
+            const diff = change(this.#advert, prev, snap);
+            if (diff === "same")
+                continue;
+            let answer;
+            if (prev !== undefined && diff !== "restart") {
+                answer = await target.update(key, snap, diff);
+            }
+            else {
+                // A fresh offer waits for what a refusal asked for, whatever brought us back.
+                if (!this.#offerable(key, ns.refused))
+                    continue;
+                answer = await target.advertise(key, snap);
+            }
+            // `offered` pairs with `refused`, so a held or withdrawn path leaves nothing behind.
+            if (answer === "held") {
+                held.set(key, snap);
+                ns.refused.delete(key);
+                ns.offered.delete(key);
+            }
+            else {
+                held.delete(key);
+                if (answer !== "dropped") {
+                    ns.refused.set(key, answer);
+                    ns.offered.set(key, snap.identity);
+                }
+            }
+        }
+        ns.active = held;
+        // Whatever we wanted up and could not get up. Stream credit freeing, a transient
+        // failure clearing, or the peer starting to answer raises no signal of its own, so
+        // the only way back is to ask again on a timer.
+        return [...updated].some(([key, snap]) => change(this.#advert, held.get(key), snap) !== "same" && this.#pending(key, ns.refused));
+    }
     /**
      * Whether a namespace may be offered to the peer right now.
      *
      * A peer that asked never to be offered it again means it, whatever brought us back;
      * one that named a minimum wait gets it, even when our own backoff comes round sooner.
      */
-    #offerable(path, refused) {
-        const entry = refused.get(path);
+    #offerable(key, refused) {
+        const entry = refused.get(key);
         if (entry === undefined)
             return true;
         return entry !== "never" && Date.now() >= entry;
@@ -666,21 +844,31 @@ export class Publisher {
      * gating the timer on offerable instead would disarm it for exactly the wait it is
      * supposed to be counting. Only a refusal that forbids retrying ends it.
      */
-    #pending(path, refused) {
-        return refused.get(path) !== "never";
+    #pending(key, refused) {
+        return refused.get(key) !== "never";
+    }
+    /**
+     * What a REQUEST_ERROR's retry interval, in milliseconds, says about re-offering the
+     * namespace.
+     *
+     * Draft-14/15 carry no such field, so a 0 there says nothing and our own backoff
+     * stands; everywhere else 0 means the peer does not want this again.
+     */
+    #refusal(err) {
+        const version = this.#session.version;
+        if (version === Version.DRAFT_14 || version === Version.DRAFT_15)
+            return "dropped";
+        return err.retryInterval === 0n ? "never" : Date.now() + Number(err.retryInterval);
     }
     /**
      * Advertise one namespace on its own PUBLISH_NAMESPACE request. A declined request
      * is logged and skipped: a peer that wants none of this rejects each one and stays
      * connected.
-     *
-     * `refused` records what a refusal said about coming back, so a peer that asked not to
-     * be offered a namespace again is not re-offered it by the retry above.
      */
-    async #advertise(path, requests, refused) {
+    async #advertise(path, requests, cluster = this.#advert) {
         const requestId = await this.#session.nextRequestId();
         if (requestId === undefined)
-            return false;
+            return "dropped";
         // Opening is inside the try because it fails like any other advertisement does:
         // a peer out of stream credit rejects here, and letting that escape would unwind
         // the announce loop and take discovery down for the whole session, rather than
@@ -693,22 +881,18 @@ export class Publisher {
             // advertisements, so a peer that takes the stream and answers nothing strands
             // every publish and withdrawal behind it. Timing out costs this namespace a
             // turn and leaves it outstanding, which the retry above re-offers.
-            await withTimeout((async () => {
+            const answer = await withTimeout((async () => {
                 await stream.writer.u53(PublishNamespace.id);
-                const msg = new PublishNamespace({ requestId, trackNamespace: path, cluster: this.#advert });
+                const msg = new PublishNamespace({ requestId, trackNamespace: path, cluster });
                 await msg.encode(stream.writer, this.#session.version);
                 // Read response (RequestOk and PublishNamespaceOk share 0x07)
                 const respTypeId = await stream.reader.u53();
                 if (respTypeId === RequestError.id) {
-                    // The peer named how long to stay away, in milliseconds. Draft-14/15
-                    // carry no such field, so a 0 there says nothing and our own backoff
-                    // stands; everywhere else 0 means it does not want this again.
                     const err = await RequestError.decode(stream.reader, this.#session.version);
-                    const legacy = this.#session.version === Version.DRAFT_14 || this.#session.version === Version.DRAFT_15;
-                    if (!legacy) {
-                        refused.set(path, err.retryInterval === 0n ? "never" : Date.now() + Number(err.retryInterval));
-                    }
-                    throw new Error(`PublishNamespace rejected: ${err.errorCode} ${err.reasonPhrase}`);
+                    const why = requestReason(err.errorCode, err.reasonPhrase, "publish_namespace", this.#session.version);
+                    console.warn(`announce refused: broadcast=${path} error=${why}`);
+                    stream.abort(new Error(`PublishNamespace rejected: ${why}`));
+                    return this.#refusal(err);
                 }
                 if (respTypeId !== RequestOk.id) {
                     throw new Error(`PublishNamespace rejected: typeId=0x${respTypeId.toString(16)}`);
@@ -720,16 +904,78 @@ export class Publisher {
                 else {
                     await RequestOk.decode(stream.reader, this.#session.version);
                 }
+                return "held";
             })(), ADVERTISE_TIMEOUT_MS, `advertisement timed out after ${ADVERTISE_TIMEOUT_MS}ms waiting for the peer's answer`);
-            requests.set(path, { path, requestId, stream: request });
-            return true;
+            if (answer === "held")
+                requests.set(path, { path, requestId, stream });
+            return answer;
         }
         catch (err) {
-            const e = error(err);
+            // The peer never answered the advertisement: a control timeout, not late content.
+            const e = err instanceof TimeoutError ? controlTimeout(err) : error(err);
             console.warn(`announce failed: broadcast=${path} error=${reason(e)}`);
             request?.abort(e);
-            return false;
+            return "dropped";
+        }
+    }
+    /**
+     * Update a namespace the peer holds: REQUEST_UPDATE on the request that carries it,
+     * with only the parameters that changed, then its answer.
+     *
+     * Waiting for the answer keeps one update outstanding per stream, which satisfies any
+     * MAX_REQUEST_UPDATES the peer set without reading it; a change landing meanwhile waits
+     * for the next turn. The answer decides whether the peer still holds the namespace: a
+     * REQUEST_ERROR closes the peer's side and withdraws the advertisement, so ours is
+     * finished too, and an unanswered update is dropped abruptly, since a peer that ignored
+     * it cannot be assumed to hold either price. Either way the retry re-offers it fresh.
+     *
+     * A different original publisher is an update like any other: the receiver drains what
+     * it already serves from the old one and never splices the two.
+     */
+    async #update(path, requests, { from, to }) {
+        const request = requests.get(path);
+        if (!request)
+            return "dropped";
+        const update = {
+            hops: sameHops(from.hops, to.hops) ? undefined : to.hops,
+            cost: from.cost === to.cost ? undefined : to.cost,
+        };
+        const version = this.#session.version;
+        let answer;
+        try {
+            const requestId = await this.#session.nextRequestId();
+            if (requestId === undefined)
+                throw new Error("no request ID for the update");
+            answer = await withTimeout((async () => {
+                const { writer, reader } = request.stream;
+                await writer.u53(PublishNamespaceUpdate.id);
+                await new PublishNamespaceUpdate({ requestId, update }).encode(writer, version);
+                const typeId = await reader.u53();
+                if (typeId === RequestError.id) {
+                    const err = await RequestError.decode(reader, version);
+                    const why = requestReason(err.errorCode, err.reasonPhrase, "publish_namespace", version);
+                    console.warn(`publish_namespace update refused: broadcast=${path} error=${why}`);
+                    return this.#refusal(err);
+                }
+                if (typeId !== RequestOk.id) {
+                    throw new Error(`unexpected answer to the update: typeId=0x${typeId.toString(16)}`);
+                }
+                await RequestOk.decode(reader, version);
+                return "held";
+            })(), ADVERTISE_TIMEOUT_MS, `update timed out after ${ADVERTISE_TIMEOUT_MS}ms waiting for the peer's answer`);
+        }
+        catch (err) {
+            const e = err instanceof TimeoutError ? controlTimeout(err) : error(err);
+            console.warn(`publish_namespace update failed: broadcast=${path} error=${reason(e)}`);
+            requests.delete(path);
+            request.stream.abort(e);
+            return "dropped";
         }
+        // The peer already closed out a refused request, and its STOP_SENDING can reject the
+        // wait on our FIN. That is the withdrawal finishing, not a reason to end the loop.
+        if (answer !== "held")
+            await this.#withdraw(path, requests).catch(() => undefined);
+        return answer;
     }
     /**
      * Close out a namespace's PUBLISH_NAMESPACE request with PUBLISH_NAMESPACE_DONE.
@@ -753,8 +999,14 @@ export class Publisher {
             catch {
                 // Stream might already be closed
             }
+            request.stream.close();
+            return;
         }
         request.stream.close();
+        // Wait for transport acknowledgment before opening a replacement request.
+        // This assumes the peer processes the withdrawal by then; FIN acknowledgment
+        // does not itself acknowledge application processing across streams.
+        await request.stream.writer.closed;
     }
     /**
      * Handles an incoming TRACK_STATUS_REQUEST on a bidi stream.
@@ -762,42 +1014,38 @@ export class Publisher {
      * @internal
      */
     async runTrackStatusRequest(msg, stream) {
+        // TRACK_STATUS_ERROR is 0x0f on draft-14.
+        await this.#refuseUnsupported(stream, msg.requestId, "track_status", 0x0f, "TRACK_STATUS is not supported");
+    }
+    /**
+     * Handles an incoming FETCH on a bidi stream. We serve none.
+     *
+     * @internal
+     */
+    async runFetch(msg, stream) {
+        await this.#refuseUnsupported(stream, msg.requestId, "fetch", FetchError.id, "FETCH is not supported");
+    }
+    /**
+     * Refuse a request NOT_SUPPORTED. Draft-14 gives each request its own error message,
+     * `errorId14`, with the SUBSCRIBE_ERROR body; later drafts use REQUEST_ERROR.
+     */
+    async #refuseUnsupported(stream, requestId, kind, errorId14, reasonPhrase) {
         const version = this.#session.version;
+        const errorCode = toRequestCode("not_supported", kind, version);
         if (version === Version.DRAFT_14) {
-            // v14: respond with TrackStatus (0x0E = TRACK_STATUS_OK)
-            await stream.writer.u53(TrackStatus.id);
-            const status = new TrackStatus({
-                trackNamespace: msg.trackNamespace,
-                trackName: msg.trackName,
-                statusCode: TrackStatus.STATUS_NOT_FOUND,
-                lastGroupId: 0n,
-                lastObjectId: 0n,
-            });
-            await status.encode(stream.writer, version);
+            await stream.writer.u53(errorId14);
+            await new SubscribeError({ requestId, errorCode, reasonPhrase }).encode(stream.writer, version);
         }
         else {
-            // v15+: respond with RequestOk (0x07)
-            await stream.writer.u53(RequestOk.id);
-            const ok = new RequestOk({
-                requestId: version === Version.DRAFT_15 || version === Version.DRAFT_16 ? msg.requestId : undefined,
-            });
-            await ok.encode(stream.writer, version);
+            await stream.writer.u53(RequestError.id);
+            await new RequestError({
+                requestId: version === Version.DRAFT_15 || version === Version.DRAFT_16 ? requestId : undefined,
+                errorCode,
+                reasonPhrase,
+            }).encode(stream.writer, version);
         }
         stream.close();
     }
-    /**
-     * Closes every published broadcast and stops accepting new ones.
-     *
-     * @internal
-     */
-    close() {
-        this.#broadcasts.update((broadcasts) => {
-            for (const broadcast of broadcasts?.values() ?? []) {
-                broadcast.close();
-            }
-            return undefined;
-        });
-    }
 }
 /**
  * Take one group out of a cache view, without waiting.