fix(net)!: bound timestamps to 2^61 - 1 so lite-05/06 can carry every one

cpp/moq/MIGRATE.md

@@ -28,6 +28,12 @@ Pass the new `moq::ContainerFormat::kCmaf` to keep publishing CMAF.
 `BroadcastConsumer::resolve(reference)` becomes `resolve(reference, epoch)`; pass the rendition's `epoch` alongside its `broadcast`, or `std::nullopt` to resolve whichever instance answers.
 Resolving, and the rendition-based consumers, fail with `moq::Error::kMux` for a rendition whose broadcast is proven to serve another epoch.
 
+### Timestamps stop at 2^61 - 1 microseconds (#6168)
+
+Writing a frame, or any other call that takes a timestamp, fails with `TimeOverflow` past `2^61 - 1` microseconds instead of `2^62 - 1`, the most moq-lite-05/06 can carry.
+A received timestamp past it fails the group as a malformed track.
+Clamp timestamps you build from unbounded input to `2^61 - 1`.
+
 ### Finished tracks stay until the broadcast ends (#6157)
 
 A finished track now stays listed, with its catalog rendition and demand, until its broadcast closes or the new `BroadcastProducer::finish` lets go.

dart/moq/MIGRATE.md

@@ -34,6 +34,12 @@ Pass the new `ContainerFormat.cmaf` to keep publishing CMAF.
 `BroadcastConsumer.resolve(reference:)` requires `epoch:` too; pass the rendition's `epoch` alongside its `broadcast`, or `null` to resolve whichever instance answers.
 Resolving, and the rendition-based consumers, throw for a rendition whose broadcast is proven to serve another epoch.
 
+### Timestamps stop at 2^61 - 1 microseconds (#6168)
+
+Writing a frame, or any other call that takes a timestamp, fails with `TimeOverflow` past `2^61 - 1` microseconds instead of `2^62 - 1`, the most moq-lite-05/06 can carry.
+A received timestamp past it fails the group as a malformed track.
+Clamp timestamps you build from unbounded input to `2^61 - 1`.
+
 ### Finished tracks stay until the broadcast ends (#6157)
 
 A finished track now stays listed, with its catalog rendition and demand, until its broadcast closes or the new `BroadcastProducer.finish()` lets go.

drafts/draft-lcurley-moq-lite.md

@@ -182,6 +182,8 @@ A Group Stream normally starts at frame 0, but MAY start later when the publishe
 
 Each frame of a timed Track carries a presentation timestamp expressed in the Track's `Timescale` (see [TRACK_INFO](#track-info)), used by the moq-lite layer for [expiration](#expiration) decisions.
 A Track without a `Timescale` is untimed: its frames and datagrams carry no timestamp.
+A timestamp MUST be less than 2^61: lite-05 and lite-06 zigzag a Group's first [Timestamp Delta](#frame) into a QUIC varint, which carries no more, and the bound lets a relay forward any timestamp to any version.
+A receiver treats a larger timestamp as a malformed Track, even one it discards.
 A publisher MUST NOT start a timed Group's frame 0 earlier than that of any lower-sequence Group it publishes.
 lite-05 and lite-06 cannot encode an untimed Track, so a publisher on those versions declares a `Timescale` of 1000 for it and stamps every frame and datagram with its send time in milliseconds.
 A receiver cannot tell such send times from presentation timestamps, and they need not rise with sequence, so it discards every timestamp received on those versions and treats the Track as untimed.
@@ -1777,6 +1779,9 @@ The `Message Length` describes the payload size on the wire.
 - Replaced ANNOUNCE_OK Active Count with an ordered, empty SYNCED event (0x4), marking the initial set without retaining routes that end before delivery.
 
 - A publisher must not start a timed Group's frame 0 earlier than a lower-sequence Group's, and a receiver may refuse a Group that does. A receiver discards the timestamps it receives over lite-05/06, which may be send times, and a relay serves a Track whose timestamps it cannot vouch for untimed.
+
+- Bounded every timestamp below 2^61, since a lite-05/06 Group's first Timestamp Delta carries no more, so a relay never holds one it cannot forward. A larger one is a malformed Track.
+
 - Added the reliable ordered RTCDataChannel binding, with one Qmux Record per binary message and no datagrams.
 
 - Added `Group Order` to SUBSCRIBE and SUBSCRIBE_UPDATE: descending (0x0, the previous fixed order) or ascending (0x1). A relay requests descending upstream unless every subscription it serves is ascending.

go/wrapper/MIGRATE.md

@@ -34,6 +34,12 @@ Pass the new `media.ContainerFormatCmaf` to keep publishing CMAF.
 `BroadcastConsumer.Resolve(ctx, reference)` becomes `Resolve(ctx, reference, epoch)`; pass the rendition's `Epoch` alongside its `Broadcast`, or `nil` to resolve whichever instance answers.
 Resolving, and the rendition-based consumers, error for a rendition whose broadcast is proven to serve another epoch.
 
+### Timestamps stop at 2^61 - 1 microseconds (#6168)
+
+Writing a frame, or any other call that takes a timestamp, fails with `ErrTimeOverflow` past `2^61 - 1` microseconds instead of `2^62 - 1`, the most moq-lite-05/06 can carry.
+A received timestamp past it fails the group as a malformed track.
+Clamp timestamps you build from unbounded input to `2^61 - 1`.
+
 ### Finished tracks stay until the broadcast ends (#6157)
 
 A finished track now stays listed, with its catalog rendition and demand, until its broadcast closes or the new `BroadcastProducer.Finish()` lets go.

kt/moq/MIGRATE.md

@@ -34,6 +34,12 @@ Pass the new `ContainerFormat.CMAF` to keep publishing CMAF.
 `BroadcastConsumer.resolve(reference)` becomes `resolve(reference, epoch)`; pass the rendition's `epoch` alongside its `broadcast`, or `null` to resolve whichever instance answers.
 Resolving, and the rendition-based consumers, throw `MoqException.Mux` for a rendition whose broadcast is proven to serve another epoch.
 
+### Timestamps stop at 2^61 - 1 microseconds (#6168)
+
+Writing a frame, or any other call that takes a timestamp, fails with `TimeOverflow` past `2^61 - 1` microseconds instead of `2^62 - 1`, the most moq-lite-05/06 can carry.
+A received timestamp past it fails the group as a malformed track.
+Clamp timestamps you build from unbounded input to `2^61 - 1`.
+
 ### Finished tracks stay until the broadcast ends (#6157)
 
 A finished track now stays listed, with its catalog rendition and demand, until its broadcast ends or the new `BroadcastProducer.finish()` lets go.

py/moq-rs/MIGRATE.md

@@ -34,6 +34,12 @@ Pass the new `ContainerFormat.CMAF` to keep publishing CMAF.
 `BroadcastConsumer.resolve(reference)` becomes `resolve(reference, epoch)`; pass the rendition's `epoch` alongside its `broadcast`, or `None` to resolve whichever instance answers.
 Resolving, and the rendition-based consumers, raise for a rendition whose broadcast is proven to serve another epoch.
 
+### Timestamps stop at 2^61 - 1 microseconds (#6168)
+
+Writing a frame, or any other call that takes a timestamp, fails with `TimeOverflow` past `2^61 - 1` microseconds instead of `2^62 - 1`, the most moq-lite-05/06 can carry.
+A received timestamp past it fails the group as a malformed track.
+Clamp timestamps you build from unbounded input to `2^61 - 1`.
+
 ### Finished tracks stay until the broadcast ends (#6157)
 
 A finished track now stays listed, with its catalog rendition and demand, until its broadcast closes or the new `BroadcastProducer.finish()` lets go.

quest/m1/README.md

@@ -99,7 +99,6 @@ tracks, so per-group stats stop costing cluster announces.
 - [Pause an IETF SUBSCRIBE](/quest/m1/ietf-subscribe-pause.md) - Forward=0 pauses a SUBSCRIBE without demand upstream and Forward=1 resumes it, instead of ending it
 - [A listing says whether a removed track finished](/quest/m1/listing-end-reason.md) - a listing removal carries whether the track finished, at every hop, so the IETF answerer ends a finished track's PUBLISH with TRACK_ENDED and a Rust-to-Rust IETF listing removes it without a reset
 - [Compressed tracks](/quest/m1/compress/README.md) - a track flagged `compress` is DEFLATEd per group by moq-net, forwarded compressed, and inflated once on the relay for peers that cannot signal it; `catalog.json.z` and moq-flate go away
-- [lite-06 max sequence](/quest/m1/lite06-max-sequence.md) - group sequence 2^62-1 reaches a lite-06 subscriber or is refused loudly, instead of vanishing
 - [Finalize moq-lite-07](/quest/m1/lite07-finalize.md) - when the maintainer cuts it, lite-07 negotiates as `moq-lite-07` and the next release ships it
 - [Moxygen minimal interop](/quest/m1/smoke-moxygen.md) - waiting on Moxygen to send a registered filter type, then the smoke lane stops hiding its failure
 - [More tests under load](/quest/m1/test-flakes-2/README.md) - the second round of load-only failures, one quest per flake, fixed at the cause

quest/m1/lite07-finalize.md

@@ -86,10 +86,9 @@ identifier. This release adopts the new routing contract end to end.
 Public API: the lite-07 version constant and ALPN lose `-wip`. Wire: lite-07
 is published; older versions are unchanged.
 
-Decided 2026-10-22 (maintainer): lite-07 also waits for the lite-06
-max-sequence quest, since it may change what the final wire carries.
 Timestamp provenance landed in
-[#6150](https://github.com/moq-dev/moq/pull/6150).
+[#6150](https://github.com/moq-dev/moq/pull/6150), and the 2^61 - 1
+timestamp bound in [#6168](https://github.com/moq-dev/moq/pull/6168).
 
 ## Required
 
@@ -100,7 +99,6 @@ Timestamp provenance landed in
 - [Subscribe ranges](/quest/m1/subscribe-ranges/README.md) - SUBSCRIBE carries ranges and an order and lite FETCH is gone, in Rust and JS
 - [Announcement takeover](/quest/m1/announce-takeover.md) - ANNOUNCE_TAKEOVER preserves a proven instance under a new independent route
 - [Listing end reason](/quest/m1/listing-end-reason.md) - lite-07's TRACKS_FINISH says a listed track finished, so an IETF answerer can end it with TRACK_ENDED
-- [lite-06 max sequence](/quest/m1/lite06-max-sequence.md) - the refusal boundary for an uncarriable sequence is settled before lite-07 freezes
 
 ## Related
 

rs/moq-c/MIGRATE.md

@@ -28,6 +28,12 @@ moq-transport and moq-lite-03/04 sessions are unchanged.
 A container import with `MOQ_CONTAINER_FORMAT_FMP4` now publishes one Legacy frame per sample instead of one CMAF frame per fragment.
 Pass the new `MOQ_CONTAINER_FORMAT_CMAF` to keep publishing CMAF.
 
+### Timestamps stop at 2^61 - 1 microseconds (#6168)
+
+Writing a frame, or any other call that takes a timestamp, fails with `MOQ_ERROR_TIMESTAMP_OVERFLOW` past `2^61 - 1` microseconds instead of `2^62 - 1`, the most moq-lite-05/06 can carry.
+A received timestamp past it fails the group as a malformed track.
+Clamp timestamps you build from unbounded input to `2^61 - 1`.
+
 ### Finished tracks stay until the broadcast ends (#6157)
 
 `moq_publish_track_finish`, `moq_publish_media_finish`, `moq_publish_container_finish`, and the encoder finishes now release the handle while the broadcast keeps the finished track listed, with its catalog rendition and demand, until `moq_publish_close` or the new `moq_publish_finish_close`.

rs/moq-cli/src/play/timeline.rs

@@ -519,9 +519,9 @@ pub(super) fn timestamp(timestamp: Timestamp) -> Duration {
 /// A duration from the start of the track as a wire timestamp, the inverse of
 /// [`timestamp`].
 fn media(duration: Duration) -> Timestamp {
-	// A wire timestamp caps at 2^62 - 1, which is ~146,000 years of microseconds.
-	const MAX: u128 = (1 << 62) - 1;
-	Timestamp::from_micros(duration.as_micros().min(MAX) as u64).expect("clamped to the wire maximum")
+	// A timestamp caps at 2^61 - 1, which is ~73,000 years of microseconds.
+	const MAX: u128 = (1 << 61) - 1;
+	Timestamp::from_micros(duration.as_micros().min(MAX) as u64).expect("clamped to the timestamp maximum")
 }
 
 /// Where the audio track has reached, measured from its own origin so

rs/moq-e2ee/src/tests.rs

@@ -986,8 +986,8 @@ fn secrets_stay_out_of_debug() {
 fn failed_group_write_does_not_burn_nonce() {
 	let mut pair = pair("video");
 	let mut group = pair.producer.append_group().unwrap();
-	// (2^62-1) seconds overflows conversion to the milli-scale track.
-	let huge = moq_net::Timestamp::from_secs((1 << 62) - 1).unwrap();
+	// (2^61-1) seconds overflows conversion to the milli-scale track.
+	let huge = moq_net::Timestamp::from_secs((1 << 61) - 1).unwrap();
 	assert!(group.write_frame(huge, b"bad").is_err());
 	assert_eq!(group.invocations(), 0);
 	let big = vec![0u8; MAX_GROUPED_PLAINTEXT + 1];

rs/moq-ffi/MIGRATE.md

@@ -35,6 +35,12 @@ Pass the new `MoqContainerFormat::Cmaf` to keep publishing CMAF.
 `MoqBroadcastConsumer::resolve` takes the rendition's `epoch` after `reference`; pass it alongside, or `None` to resolve whichever instance answers.
 Resolving, and the rendition-based consumers, fail a rendition whose broadcast is proven to serve another epoch with `Mux`.
 
+### Timestamps stop at 2^61 - 1 microseconds (#6168)
+
+Every `timestamp_us` input, such as `MoqTrackProducer::write_frame` or `MoqAnchor::Time`, fails with `MoqError::TimeOverflow` past `2^61 - 1` instead of `2^62 - 1`, the most moq-lite-05/06 can carry.
+A received timestamp past it fails the group as a malformed track.
+Clamp timestamps you build from unbounded input to `2^61 - 1`.
+
 ### Finished tracks stay until the broadcast ends (#6157)
 
 A finished track, raw or media, now stays listed, with its catalog rendition and demand, until its broadcast closes or the new `MoqBroadcastProducer::finish` lets go, instead of unlisting when its producer finishes or is released.

rs/moq-mux/src/clock.rs

@@ -460,7 +460,7 @@ mod tests {
 	fn wall_clock_validates_bounds() {
 		let clock = Clock::at(epoch(), moq_epoch()).unwrap();
 		// The largest representable broadcast timestamp still maps.
-		let max = moq_net::Timestamp::from_micros((1u64 << 62) - 1).unwrap();
+		let max = moq_net::Timestamp::from_micros((1u64 << 61) - 1).unwrap();
 		assert!(clock.wall_clock(max).is_err(), "past the JSON-safe range is refused");
 	}
 }

rs/moq-net/MIGRATE.md

@@ -102,6 +102,12 @@ moq-transport sessions, and moq-lite-03/04 sessions (whose announce streams mark
 Replace `Frame { timestamp, payload }` with `Frame::new(timestamp, payload)`.
 `timestamp` and `payload` stay public fields.
 
+### Timestamps stop at 2^61 - 1 (#6168)
+
+`Timestamp::new`, its `from_*` constructors, `convert`, `checked_add`, and `TryFrom<Duration>` return `TimeOverflow` past `2^61 - 1` instead of `2^62 - 1`, the most lite-05/06 can carry as a group's first frame.
+A received timestamp past it fails the group as a malformed track.
+Clamp timestamps you build from unbounded input to `(1 << 61) - 1`.
+
 ### A dropped or cut group ends its reader with an error (#6143)
 
 A group the publisher cut, or named in `SUBSCRIBE_DROP`, after a `track::Subscriber` saw it is now handed out, and reading it fails with the publisher's error; before, it was skipped or ended cleanly.

rs/moq-net/src/ietf/object.rs

@@ -692,7 +692,7 @@ mod tests {
 		let decoded = read(&list(limit), Version::Draft22, milli).unwrap();
 		assert_eq!(decoded.properties.heap(), limit as u64);
 		assert!(check_frame(&decoded.properties, milli).is_ok());
-		let latest = Timestamp::new((1 << 62) - 1, Timescale::MILLI).unwrap();
+		let latest = Timestamp::new((1 << 61) - 1, Timescale::MILLI).unwrap();
 		let written = write(
 			&decoded.properties,
 			Some(Version::Draft22),