From: CIRISServer (the fabric node — the relay/transport tier that composes edge). Filing from the consumer side: we surveyed edge v4.2.0 (08d9e05) for everything a fabric node needs to relay live video end-to-end, and the substrate is genuinely close — but two concrete gaps stand between the shipped primitives and an actual stream. "Infra must not have agency / authors no primitives" means we'd rather these land in the substrate than wire transport logic ourselves.

What already ships in v4.2.0 (thank you — confirmed by reading source)

• Two-layer AEAD seal/open (realtime_av.rs), relay outer-open open_av_outer (realtime_av: relay outer-OPEN primitive (SealedAvChunk -> InnerSealed) — multi-tier ALM trees + scale/chaos CI (Layer 2) #149).
• Per-subscriber relay fan-out with layer-drop before seal (realtime_av_relay.rs::RelayNode::forward, realtime_av: per-receiver layer policy on fan-out (dyadic scalable degradation for hundreds-of-peer mesh video) #128).
• ALM parent selection (realtime_av_alm/{capacity,join,heal}.rs — SignedRelayCapacity, AlmJoinPlanner primary + backups).
• MLS membership rekey (realtime_av_session.rs::advance_epoch, realtime_av: membership-change rekey (epoch DEK rotation on join/leave) — unicast-mesh baseline before #66 TreeKEM #129) + batch cold-join.
• Codecs: codec-fountain (RaptorQ), av1, opus_voice. (We now CI-test the fountain codec's survival floor directly: 99.6% reconstruct @ 20/30, 100% @ 21/30.)
• Deterministic ALM topology is tracked in v3.10.0 [holonomic substrate]: Deterministic ALM topology — path-independent tree from pure inputs #136; large-N fan-out in Relay/multicast fan-out for large-N broadcast + large group video (streaming scale, 1.x) #66.

Gap 1 — Layer-2 wire dispatcher (the critical blocker)

RelayNode::forward(...) -> Vec<RelayForwardOut> returns the sealed-per-subscriber chunks but does not enqueue them onto each subscriber's RNS Link. The module docs (realtime_av_relay.rs, §"What this module is NOT") explicitly defer this: "the actual outbound enqueue onto each subscriber's RNS Link is Layer 2 (T8)." There is no streaming session / event loop / receiver task — so today a consumer must hand-roll the publisher→relay→subscriber wire path.

Ask: ship the Layer-2 dispatcher (a RealtimeSession/AvStream-style binding that takes forward output and drives the RNS Links, with a receiver side), so a fabric node relays rather than re-implements transport. This is the single thing blocking a live stream on top of v4.2.0.

Gap 2 — Joiner-side bootstrap process_welcome

AvSession::process_welcome(...) is a documented stub returning AvSessionError::JoinerSurfaceUnwired (realtime_av_session.rs), pending L3 federation-directory KeyPackage publish/fetch. So a new participant can't actually complete the MLS handshake to join a live stream. advance_epoch (the existing-member rekey) ships; the joiner surface does not. (Possibly a sub-task of #129 — flag if so.)

Ask: wire the joiner path (KeyPackage publish/fetch via the directory, then process_welcome) so a peer can join an in-progress stream.

Why now

We need encrypted group video ASAP and want the substrate to provide the full path. Gaps 1–2 are the difference between "the primitives all pass unit tests" and "two peers actually see each other." Happy to test against pre-release branches from the fabric-node side and contribute the CIRISServer integration once the surfaces land.

cc: relates to #66 (fan-out scale), #129 (rekey), #133 (holographic e2e scope), #136 (deterministic topology).