feat(catalog): adopt canonical MSF multicast schema

[allyblockcast]

Summary

• replace the catalogformat-01 inheritance envelope with flat MSF rendition fields
• make repair tracks and AMT/ATSC3 multicast descriptors schema-faithful
• migrate Rust publishers/subscriber to the canonical catalog track and priority 240 repair delivery
• vendor the merged golden fixture suite for positive round-trip and negative rejection tests

Contract decision

The merged golden fixtures from BLO-16823 are the executable source of truth. They retain version: 1, streamingFormat: "mmtp", and streamingFormatVersion; this PR follows that contract rather than the stale version: "draft-01" wording in the issue description.

Verification

• cargo test --workspace
• cargo clippy -p moq-catalog --all-targets -- -D warnings
• cargo clippy -p moq-pub-mmtp --bin moq-pub-mmtp -- -D warnings
• cargo clippy -p moq-pub -p moq-sub --lib --bins -- -D warnings
• libmmt npm test -- --run src/catalog-schema.test.ts (13 passed)

Notes

Full moq-pub-mmtp --all-targets clippy still reaches a pre-existing too_many_arguments warning in examples/mmtp_packet_vectors.rs; the changed binary target is clean.

Paperclip: https://paperclip.blockcast.net/BLO/issues/BLO-16831

[allyblockcast]

🔗 Paperclip issue: BLO-16823
🔗 Paperclip issue: BLO-16831

[allyblockcast]

🔗 Paperclip issue: BLO-16823
🔗 Paperclip issue: BLO-16831

[allyblockcast]

@ally Please review the catalog wire-contract rewrite, especially strict serde/schema parity, multicast endpoint defaults, repair priority propagation, and regressions in legacy moq-pub/moq-sub consumers. The golden fixture round-trip and negative rejection tests are the acceptance seam.

[allyblockcast]

Ally — Consolidated PR Review

Lenses: pr-review-toolkit (code, tests, comments, errors, types) + gstack/review + native-codex.
reviewed head: be919ad

Important Issues (2)

• [native-codex] moq-catalog/src/multicast.rs:69-73 — MulticastConfig::endpoints and MulticastConfig::network_source lost their #[serde(skip_serializing_if = "Option::is_none")] attributes in this rewrite (the old struct had both; every other optional field in this schema still uses the attribute). A MulticastConfig with only one side populated — which is exactly what the moq-pub-mmtp test helper endpoint() builds (network_source: None always) — now serializes as "networkSource":null / "endpoints":null instead of omitting the key. That's a schema-conformance regression on a PR whose whole point is a schema-faithful, deny_unknown_fields-strict catalog. Recommend restoring skip_serializing_if = "Option::is_none" on both fields.

• [native-codex] moq-pub-mmtp/src/main.rs:159-165 and :356-365 — build_state_map and build_datagram_state now hardcode let history_window_raw = 32;, but the doc comments directly above are unchanged and still claim "Config-or-throw... there is no silent unbounded default" (line 161) and "There is no silent unbounded — or silently lossy — default... the window must be an explicit catalog decision" (build_datagram_state). The removed field was multicast.subgroupHistoryGroups, which no longer exists in the canonical schema — yet the NonZeroU64::new(...).ok_or_else error text on line 365 still references multicast.subgroupHistoryGroups verbatim, an error path that can now never fire (32 is never zero) and describes a config key that doesn't exist anymore. This silently drops what was previously a required per-deployment tunable; at minimum the stale comments/error text should be updated to reflect that retention is now a fixed runtime constant, not catalog-driven.

Suggestions (3)

• [gstack/review] moq-catalog/src/lib.rs:401-424 (validate_multicast) — whenever Root.multicast is Some(_), networkSource is now required to be present and non-empty, even for a plain SSM/ASM endpoint with no AMT/ATSC3 bridging. The removed doc comments described networkSource as OPTIONAL (§4.2.3), and none of the three golden positive fixtures exercise a multicast catalog without networkSource, so this constraint is untested. Worth confirming against the canonical MSF spec that networkSource is truly mandatory for every multicast catalog, not just AMT/ATSC3-bridged ones.

• [pr-review-toolkit] moq-catalog/src/lib.rs:410-422 — the endpoints.is_empty() check on line 419 is unreachable: multicast.endpoints.as_ref().filter(|value| !value.is_empty()).ok_or(...) on lines 407-411 already guarantees endpoints is non-empty before that later check runs. Dead code left over from the merge.

• [pr-review-toolkit] moq-sub/src/media.rs (catalog validation block in run) — the previous unconditional anyhow::ensure!(c.version == 1, ...) was replaced with a check that only runs Root::validate() (which itself checks version) when streaming_format == "mmtp". moq-pub's catalogs are streaming_format: "cmaf", so moq-sub now performs zero validation — not even the old version check — on the catalogs it actually consumes from moq-pub. Likely low-impact for an internal test client, but worth a conscious call rather than an incidental drop.

Strengths

• The golden-fixture round-trip test (moq-catalog/tests/golden.rs) is a solid regression guard: it pins both "parses + validates + re-serializes losslessly" for positive fixtures and "rejected at parse-or-validate" for negative ones.
• Threading the repair track's catalog-declared priority (240) through RepairSink instead of hardcoding 7 in publish.rs is a clean, well-tested change (dispatch tests updated to match).
• deny_unknown_fields + tagged NetworkSource enum + narrowed MulticastProtocol/AmtDiscovery enums meaningfully tighten the wire format vs. the old stringly-typed fields.

Recommended Action

1. Fix the two Important issues before merge — both are concrete, reproducible regressions with clear repros.
2. Consider the Suggestions opportunistically; the networkSource mandatoriness is worth a quick spec check since it's currently unverified by any fixture.

[kkroo]

@ally Please re-review rebased head 5383e61. The two Important findings and all three suggestions are addressed: optional fields omit nulls, retention is a named fixed runtime policy, networkSource is optional with coverage, dead validation is removed, and moq-sub restores unconditional version checking. The rebase also preserves #43 formula/interleave grouping and the relay-required catalog aliases. Local cargo test --workspace, strict changed-target Clippy, cargo fmt, and REUSE lint pass.