relay: merge multiple upstream publishers per track (§9.5)

[floatdrop]

What

Implements full §9.5 multiple-publishers-per-track in the relay. A track can now be ingested from N upstreams — redundant origins, a graceful switchover overlap, or several discovered relays — and merged into a single clean outbound subgroup stream per subscriber, with each object deduplicated and seamless continuity when one origin drops out.

Previously the relay assumed one usable upstream per track; two publishers of the same (Namespace, Name) produced two outbound streams per subscriber (a §2.2 violation) and double-delivered every object.

How

• Shared fan-out merge. Outbound subgroup writers move from per-inbound-stream (local to runFanout) to a per-(GroupID, SubgroupID) shared, refcounted set on TrackEntry (SharedSubgroup + Acquire/ReleaseSubgroup). All inbound streams for one Subgroup share one writer per subscriber, so a Subgroup is never split across streams (§2.2).
• Dedup ledger. TrackEntry.ClaimDelivered keyed by {GroupID, ObjectID} (§2.1 — SubgroupID is not part of object identity). It lives on the entry (not a per-Subgroup structure) so redundant streams that don't temporally overlap still dedup, and it's independent of the size-bounded Object Cache so a peer lagging by more than the cache capacity dedups correctly. Memory is bounded to the most recent deliveredGroupWindow (32) groups.
• Failover teardown. FIN-vs-reset is aggregated across contributors: the merged stream FINs if any upstream completed cleanly, resets only if all reset — one origin failing doesn't disturb subscribers (§2.2 reset/"upstream conditions" carve-out).
• Subscribe to all. handler_subscribe now subscribes to every matching publisher (all local + all remotes via upstreamPool.resolveAll) with source dedup, instead of stopping at the first.

Spec conformance

Verified against draft-ietf-moq-transport-18: object identity {GroupID, ObjectID} (§2.1, Subgroup ID excluded); one-stream-per-Subgroup (§2.2) with its reset/out-of-order carve-out covering failover.

Tests

• Redundant-origin dedup → one stream, each object once
• Mid-stream failover continuity (survivor continues, clean FIN)
• Disjoint fan-in union
• Dedup survives cache eviction (the regression that motivated the entry-level group-windowed ledger)
• Two-remote cross-relay fan-in (dial-all + dedup)
• ClaimDelivered unit test (dedup + window pruning)

go build ./..., go test ./..., and go test -race ./pkg/relay/... are green; gofmt/go vet/modernize clean.

Notes / residual scope

• Late publishers that begin advertising after an on-demand upstream set is established aren't retroactively pulled until the set drains (documented in README); proactive PUBLISHers are always merged.
• subscribeUpstream now does a Discovery lookup + sequential remote dials on every SUBSCRIBE even when a local publisher already succeeded — a latency cost on cross-relay deployments, left as a follow-up (could be parallelized / short-circuited).

🤖 Generated with Claude Code