feat(mmtp): M.1b complete — B1 fragmentation contract, B2 SBN repair grouping, B3+B4 docs (BLO-8047)

[allyblockcast]

Summary

Lands all four M.1b follow-up items (deferred from M.1 ADR) onto blo-4020-m1. This is the consolidation PR that closes BLO-8047.

Item	Branch	Commits	Status
B1 — raw-passthrough fragmentation contract	blo-4020-m1b-frag	ec8e4b7	✅ code + test
B2 — SBN-keyed AL-FEC repair subgroup grouping	blo-4020-m1b-sbn	daea950	✅ code + 43 tests (landed via #27)
B3 — object_id_delta correctness investigation	blo-4020-m1b-obj-id-delta	47ca965	✅ docs only
B4 — G6 byte-diff vs libmoq investigation	blo-4020-m1b-g6-bytediff	d972e3c	✅ docs only

B1 — Raw-passthrough fragmentation contract (ec8e4b7)

Pins the ADR reversal: publisher must not error on fragmentation_indicator != 0. I-frame fragmentation is mandatory (e.g. 4K H.265 I-frame = 220–1100 fragments over AMT/UDP). Receiver reassembles via mmt-core::MfuReassembler. Test covers FI ∈ {1,2,3}.

B2 — SBN-keyed repair subgroup grouping (daea950, via #27)

Repair subgroups are now keyed by FEC Source Block Number (SBN = SS_ID / K, K=32) per draft-ramadan-moq-fec §6.1. Parser reads SourceFecPayloadId from the MMTP header (cursor-safe); RepairSink tracks current_sbn; 43 unit tests pass including an off-by-one guard at the SBN=0→1 boundary (ss_id=31 stays in SBN=0).

B3 — object_id_delta docs (47ca965)

Investigation result: object_id_delta encoding is wrong in the upstream Cloudflare moq-rs. Results documented in .planning/moq-rs-m1b-obj-id-delta-results.md; upstream bug filed separately.

B4 — G6 byte-diff docs (d972e3c)

Investigation result: moq-pub-mmtp and libmoq wire formats diverge at the SUBGROUP/OBJECT frame level by design (different draft versions). Documented in .planning/moq-rs-m1b-g6-bytediff-results.md; tracked for IETF draft-15+ alignment.

Test coverage

All 43 unit tests pass:

• B1: accepts_fragmented_mfu_packets_at_fi_1_2_3 (regression guard for FI passthrough)
• B2: repair_group_keyed_by_sbn_not_mpu_group, repair_group_advances_with_source_block, repair_before_source_fec_block_errors, parses_fec_source_packet_populates_source_fec_payload_id

Closes BLO-8047.

🤖 Generated with Claude Code

[allyblockcast]

Ally — Consolidated PR Review

Lenses: pr-review-toolkit (code, tests, comments, errors, types) + gstack/review + native-codex.
reviewed head: d972e3c

All four findings from the #27 review (I1 route() untested, S1 redundant current_sbn update, S2 FecType as u8 no anchor, S3 no continuation-SBN test) are cleanly addressed here. B1 and B2 implementation looks correct; two new Important-level issues surfaced.

---

Important Issues (2)

• [code] moq-pub-mmtp/src/publish.rs — PacketType::Repair dispatch arm — Repair group assignment uses state.current_sbn (last seen from a source MPU packet) rather than the SBN carried in the repair packet's own RepairFecPayloadId. If a repair packet for block N+1 arrives before any source packet has advanced current_sbn to N+1 — which is valid at block boundaries when the encoder emits repair before the first source of the next block — the repair object lands in block N's group instead of N+1's. route() currently ignores RepairFecPayloadId entirely (only SourceFecPayloadId on fec_type=1 is parsed). Recommendation: parse RepairFecPayloadId from repair packets in route() and use routing.repair_fec_payload_id.sbn(FEC_K) directly in the Repair dispatch arm, falling back to state.current_sbn only when the repair packet carries no SBN.

• [code] moq-pub-mmtp/examples/synth_mmtp.rs:636-639 — build_fragmented_mpu_sequence match arm (0, 1) => 0 emits FI=0 ("complete", per ISO/IEC 23008-1) for fragment_count=1, not FI=1. A caller using --fragment 1 silently gets a non-fragmented MFU packet, defeating the purpose of exercising the FI != 0 path. The CLI docstring says "values >= 2 exercise the raw-passthrough fragmentation path" but does not warn that --fragment 1 falls through to FI=0. The assert only rejects fragment_count == 0. Recommendation: add a CLI-level validator (value_parser = |s: &str| -> Result<u8, _> { ... assert >= 2 ... }) or change the assert to fragment_count >= 2 with a descriptive message, since fragment_count=1 as defined today is useless for B1 coverage.

---

Suggestions (2)

• [tests] moq-pub-mmtp/src/mmtp_parse.rs:822 — synth_fec_source_packet sets mpu.payload_length = 0 but appends [0xAA, 0xBB] (2 bytes) after the MPU header. route() doesn't consume payload bytes so the test passes, but any future caller that feeds this helper's output to a full MMTP decoder will see a payload_length-vs-actual-bytes mismatch and either stop reading early or misalign the cursor. Set mpu.payload_length = 2 to match.

• [code] moq-pub-mmtp/src/mmtp_parse.rs:762 — SourceFecPayloadId is parsed based solely on hdr.fec_type before hdr.packet_type is checked. A malformed repair packet with fec_type=1 would consume 4 bytes as SourceFecPayloadId and return a PacketRouting with source_fec_payload_id = Some(...), violating the field's documented invariant ("Absent on repair packets"). In dispatch() the current_sbn update is safely inside the Mpu arm so practical impact is nil on conformant streams. For structural correctness, gate the FEC parse with hdr.packet_type == PacketType::Mpu && hdr.fec_type == ....

---

Strengths

• const _: () = assert!(FecType::WithSourcePayloadId as u8 == 1) is an elegant build-time anchor that eliminates the enum-vs-wire-value drift risk from feat(mmtp): B2 SBN-keyed AL-FEC repair subgroup grouping (BLO-8047) #27 S2.
• SBN off-by-one boundary test (ss_id=31 → SBN=0, ss_id=32 → SBN=1) is exactly right for integer-division semantics and closes feat(mmtp): B2 SBN-keyed AL-FEC repair subgroup grouping (BLO-8047) #27 S3.
• repair_group_keyed_by_sbn_not_mpu_group provides crisp RED→GREEN coverage for the core B2 invariant (two MPUs in same block share one repair group; third MPU in new block opens a new one).
• B3 investigation (moq-rs-m1b-obj-id-delta-results.md) is unusually thorough: mlog grep evidence, root-cause line citation in upstream codebase, relay-masking explanation, and a concrete fix sketch with the right caveat about first-object-delta spec ambiguity.
• fragmented_mfu_packets_share_one_subgroup_raw_passthrough in publish.rs covers the full dispatch contract at the right layer (one create_group call, four verbatim writes).

Recommended Action

1. Evaluate the repair SBN ordering guarantee for the Blockcast MMTP encoder: if the encoder always emits all source packets for block N before any repair for block N, the Important BLO-4020 M.1: MMTP publisher on IETF moq-transport (draft-14+) #1 is effectively spec-impossible and can be noted as a known limitation. If not, fix before merge.
2. Add --fragment CLI validation to reject fragment_count < 2 (Important BLO-8047 §B1: raw-passthrough fragmentation contract (stacked on #1) #2) before the smoke docs go stale.
3. Fix Suggestions opportunistically.

Self-review comment mode: this PR was authored by the same bot identity; formal review/approval must come from a human or a distinct reviewer identity.