fix(mux): refuse damaged TS units without ending ingest

doc/bin/cli.md

@@ -97,6 +97,16 @@ run on the program clock, which starts at the first PCR after the PMT.
 `PID_error` is covered, more strictly, by the access-unit counts above.
 `PCR_accuracy_error` is not measured.
 
+A corrupt media packet, malformed PES header, or damaged codec access unit is
+refused whole and counted in the PID's cumulative `damaged` counter, beside
+`resyncs`, `discarded`, and `unconfirmed`. Ingest continues on every other PID.
+Video closes its group at the break and resumes at its next keyframe, as it does
+after a continuity-counter gap: the pictures in between may reference the lost
+one, so they are dropped rather than decoded with artefacts. Each break freezes
+video for up to one GOP. The shared TS stats log reports each counter increase,
+including at the end of input. Publishing, catalog, and clock errors still end
+the import.
+
 MPEG-TS import takes one program. A multi-program stream is refused before
 anything is published, naming its programs, rather than merged onto one clock;
 a PAT that adds a program mid-stream ends the import the same way.

doc/bin/srt.md

@@ -11,8 +11,10 @@ remote. The payload is MPEG-TS, so the same codecs as [`import ts`](/bin/cli)
 apply: H.264/H.265 video and AAC, MP2, AC-3, or E-AC-3 audio. Ingest logs the
 same per-stream lines as `import ts`, under an `srt{path=...}` span: an
 elementary stream that stopped delivering access units, audio frame sync lost,
-and the TR 101 290 counters when one moves. They grade the TS as SRT delivered
-it, after retransmission.
+damaged units refused on each PID, and the TR 101 290 counters when one moves.
+They grade the TS as SRT delivered it, after retransmission. Damage drops that
+unit and keeps the session alive; video closes its group at the break and
+resumes at its next keyframe, freezing for up to one GOP.
 
 ```bash
 # Accept a contribution feed and publish it

doc/lib/rs/moq-mux.md

@@ -25,6 +25,15 @@ the inverse and skip stalled groups past a max age. Per-codec
 producers (`import::Opus`, H.264, and so on) are available for feeding frames
 you already have.
 
+MPEG-TS `Import::stats` returns cumulative per-PID `StreamStats`: delivered
+`units`, transport-clock `quiet` time, audio `resyncs`, scanned bytes `discarded`,
+frames `unconfirmed`, damaged units refused in `damaged`, and the PID's share of
+the TR 101 290 counters. A malformed media packet, PES header, or codec unit is
+dropped whole; only that PID loses sync, and video closes its group at the break
+and waits for its next keyframe. Publishing and catalog failures remain
+fatal. `ts::stats::Log` reports these counters for both the CLI and SRT gateway.
+The exporter's `damaged` count remains zero.
+
 fMP4 export emits one fragment per publisher group by default, including audio.
 A closed group flushes even if the live publisher pauses before its next frame.
 `fmp4::Export::with_fragment_duration` adds an explicit duration cap. A zero cap

quest/m1/README.md

@@ -60,7 +60,6 @@ QUIC studies there on that rule.
 - [Wire compatibility](/quest/m1/wire-compat.md) - a nightly run tests this checkout against the last published release for tokens, session wire, and catalog/container
 - [Same-hop importers](/quest/m1/hop-aligned-import.md) - importers fed one stream publish identical groups and timestamps, so failover between a redundant pair survives
 - [Auth client CA](/quest/m1/relay-auth-client-ca.md) - `auth::Config::validate` and `init` take the client-CA flag, so no caller can skip the check
-- [TS damaged units](/quest/m1/ts-damaged-units.md) - one malformed PES or access unit is dropped, counted as `damaged`, and resynced at the next keyframe instead of ending the import
 - [TS stats module](/quest/m1/ts-stats-module.md) - the TS stats types move under `ts::stats` as `Snapshot` and `Stream`, with an owned `track`
 - [Audio capture without ALSA link](/quest/m1/capture-alsa-link.md) - moq-audio capture and playback build on Linux without linking libasound
 - [Capture by default](/quest/m1/capture-default.md) - moq-video and moq-audio build `capture` by default, so pre-merge checks test it and the capture gate goes away

rs/moq-mux/src/codec/h264/split.rs

@@ -224,14 +224,16 @@ impl Split {
 		Ok(())
 	}
 
-	/// Drop any in-flight access unit.
+	/// Drop any in-flight access unit, and any frame completed but not yet returned.
 	///
 	/// Pre-reset NALs would otherwise leak into a later frame with the wrong
-	/// timestamp. The parameter-set cache is kept so subsequent keyframes stay
-	/// self-contained.
+	/// timestamp, and a frame queued before a failed [`decode`](Self::decode) would
+	/// surface on the next call. The parameter-set cache is kept so subsequent
+	/// keyframes stay self-contained.
 	pub fn reset(&mut self) {
 		self.current = Avc3Frame::default();
 		self.tail.clear();
+		self.pending.clear();
 	}
 
 	fn pts(&mut self, hint: Option<moq_net::Timestamp>) -> Result<moq_net::Timestamp> {

rs/moq-mux/src/codec/h265/split.rs

@@ -228,14 +228,16 @@ impl Split {
 		Ok(())
 	}
 
-	/// Drop any in-flight access unit.
+	/// Drop any in-flight access unit, and any frame completed but not yet returned.
 	///
 	/// Pre-reset NALs would otherwise leak into a later frame with the wrong
-	/// timestamp. The parameter-set cache is kept so subsequent keyframes stay
-	/// self-contained.
+	/// timestamp, and a frame queued before a failed [`decode`](Self::decode) would
+	/// surface on the next call. The parameter-set cache is kept so subsequent
+	/// keyframes stay self-contained.
 	pub fn reset(&mut self) {
 		self.current = Au::default();
 		self.tail.clear();
+		self.pending.clear();
 	}
 
 	fn pts(&mut self, hint: Option<moq_net::Timestamp>) -> Result<moq_net::Timestamp> {