@blockcast/mmt-container 0.1.0-main.0399efef1f07

package/src/mfu-reassembler.ts

@@ -0,0 +1,3741 @@
+/**
+ * @mmt/container - MFU Fragment Reassembler
+ *
+ * Handles authored fragmented MFUs (Media Fragment Units) according to
+ * ISO/IEC 23008-1:2023 Section 9.2.3.3. Fragmented runs are admitted in the
+ * exact FI/fragment_counter countdown carried on the wire. FI=1 supplies the
+ * intrinsic data-unit key. Every fragmented fragment is addressed by
+ * (stream scope, MPU, packetSequenceNumber + fragmentCounter mod 2^32); a
+ * continuation joins, parks under, or is stale against the one run holding
+ * its address, and other runs are never consulted.
+ *
+ * Fragmentation Indicator (FI) values:
+ * - 0: Complete MFU (single packet, no fragmentation)
+ * - 1: First fragment
+ * - 2: Middle fragment
+ * - 3: Last fragment
+ *
+ * @packageDocumentation
+ */
+
+import { extractMFUPayload, isFecRepairPacket } from '@blockcast/mmt-base'
+
+/** Source transport admitted by the MMTP router. */
+export type MmtpSourcePath = 'multicast' | 'moq'
+
+/**
+ * Strict whole-frame delivery provenance, folded over EVERY contributing
+ * fragment rather than the head fragment alone.
+ *
+ * This is deliberately NOT `source`. `source` answers a routing question —
+ * "is this the reliable-MoQ copy that must not confirm multicast takeover?" —
+ * and head-fragment-wins is the documented, deterministic answer to it.
+ * Provenance answers an evidence question: "did every byte of this frame
+ * physically arrive over multicast?" A frame with a multicast head and a
+ * QUIC-delivered tail is a legitimate routing win for `source: 'multicast'`
+ * and is emphatically NOT multicast-exclusive delivery.
+ *
+ *   - 'multicast' — every contributing fragment was explicitly multicast.
+ *     The ONLY value that may be counted as physical-delivery evidence.
+ *   - 'mixed'     — at least one contributing fragment arrived over MoQ.
+ *   - 'unknown'   — no fragment arrived over MoQ, but at least one carried no
+ *     attribution at all. Absence is preserved as its own state rather than
+ *     defaulted, so a consumer cannot mistake "never recorded" for "proven".
+ */
+export type MmtpDeliveryProvenance = 'multicast' | 'mixed' | 'unknown'
+
+/**
+ * Fold one fragment's `source` into a running provenance verdict.
+ *
+ * Fail-closed, order-independent and associative: 'mixed' absorbs everything,
+ * a missing attribution degrades 'multicast' to 'unknown', and nothing ever
+ * upgrades a verdict. Fold over an empty set is 'unknown' — no fragment ever
+ * proved anything.
+ */
+export function foldDeliveryProvenance(
+  verdict: MmtpDeliveryProvenance,
+  source: MmtpSourcePath | undefined
+): MmtpDeliveryProvenance {
+  if (verdict === 'mixed') return 'mixed'
+  if (source === 'moq') return 'mixed'
+  if (source === undefined) return 'unknown'
+  return verdict
+}
+
+/**
+ * One fragment's own provenance.
+ *
+ * An explicit `deliveryProvenance` wins: FEC-recovered fragments carry no
+ * `source` (they were never delivered as themselves) but their block's symbol
+ * provenance IS known, and the router supplies it. Falling back to `source`
+ * keeps directly-delivered fragments working unchanged.
+ */
+function fragmentProvenance(fragment: {
+  source?: MmtpSourcePath
+  deliveryProvenance?: MmtpDeliveryProvenance
+}): MmtpDeliveryProvenance {
+  if (fragment.deliveryProvenance !== undefined) return fragment.deliveryProvenance
+  if (fragment.source === 'moq') return 'mixed'
+  if (fragment.source === 'multicast') return 'multicast'
+  return 'unknown'
+}
+
+/** Strict provenance for a complete fragment set. */
+export function deliveryProvenanceOf(
+  fragments: readonly {
+    source?: MmtpSourcePath
+    deliveryProvenance?: MmtpDeliveryProvenance
+  }[]
+): MmtpDeliveryProvenance {
+  if (fragments.length === 0) return 'unknown'
+  let verdict: MmtpDeliveryProvenance = 'multicast'
+  for (const fragment of fragments) {
+    const own = fragmentProvenance(fragment)
+    verdict =
+      verdict === 'mixed' || own === 'mixed'
+        ? 'mixed'
+        : verdict === 'unknown' || own === 'unknown'
+          ? 'unknown'
+          : 'multicast'
+  }
+  return verdict
+}
+
+/**
+ * MFU Fragment for reassembly
+ */
+export interface MFUFragment {
+  fragmentationIndicator: number
+  mpuSequenceNumber: number
+  fragmentCounter: number
+  data: Uint8Array
+  timestamp: bigint
+  /** Random Access Point flag from MMTP header - indicates keyframe */
+  rapFlag: boolean
+  /** MFU DU priority. FFmpeg marks random-access samples with high priority. */
+  priority?: number
+  sampleNumber?: number
+  movieFragmentSequenceNumber?: number
+  sampleOffset?: number
+  /** Non-timed MFU Item_ID from the 4-byte DU header. */
+  itemId?: number
+  /** Authored u32 MMTP packet_sequence_number, including on recovered packets. */
+  packetSequenceNumber?: number
+  /** True when this accepted source packet was reconstructed by FEC. */
+  recovered?: boolean
+  /** Transport that supplied this accepted fragment. Absent for recovered data. */
+  source?: MmtpSourcePath
+  /**
+   * Explicit provenance for this fragment, overriding what `source` implies.
+   * Set by the router for FEC-recovered fragments, which have no `source` of
+   * their own but whose FEC block's symbol provenance is known.
+   */
+  deliveryProvenance?: MmtpDeliveryProvenance
+  /** Immutable catalog identity supplied by the owning ingress subscription. */
+  catalogTrackName?: string
+  /** Physical MMTP stream identity when no catalog identity is available. */
+  packetId?: number
+}
+
+/**
+ * Reassembled MFU result
+ */
+export interface ReassembledMFU {
+  mpuSequenceNumber: number
+  /** MMTP packet_sequence_number of the first fragment in delivery order. */
+  packetSequenceNumber?: number
+  /** Every authoritative MMTP source-packet sequence that formed this MFU. */
+  packetSequenceNumbers?: number[]
+  /** Subset of packetSequenceNumbers reconstructed by FEC. */
+  repairedPacketSequenceNumbers?: number[]
+  data: Uint8Array
+  timestamp: bigint
+  fragmentCount: number
+  /** Random Access Point flag - indicates keyframe (from first fragment) */
+  rapFlag: boolean
+  /** MFU DU priority from the first fragment that carried it. */
+  priority?: number
+  sampleNumber?: number
+  movieFragmentSequenceNumber?: number
+  /**
+   * This DU's authored base byte offset within its sample (moqcast #37). 0
+   * for a whole-sample DU; nonzero identifies one subsample DU among
+   * siblings partitioning an oversized sample. Constant across the DU's own
+   * fragments — feed into a sample combiner to reassemble the full sample.
+   */
+  sampleOffset?: number
+  /**
+   * Transport that supplied the accepted FI=1 head fragment (or the complete
+   * FI=0 frame). This is the deterministic winner for mixed-path assembly.
+   *
+   * ROUTING ONLY. It describes one fragment, so it is not evidence about the
+   * whole frame — read {@link ReassembledMFU.deliveryProvenance} for that.
+   */
+  source?: MmtpSourcePath
+  /**
+   * Strict provenance folded over every contributing fragment. Only
+   * 'multicast' proves multicast-exclusive delivery of this frame.
+   */
+  deliveryProvenance: MmtpDeliveryProvenance
+  /** Catalog identity from the accepted FI=1 head fragment, or FI=0 frame. */
+  catalogTrackName?: string
+}
+
+/**
+ * Reassembler statistics
+ */
+export interface ReassemblerStats {
+  totalFragments: number
+  reassembledMFUs: number
+  /** Fragments rejected by strict authored DU-state validation. */
+  rejectedFragments: number
+  /** Incomplete MFUs discarded after their configured deadline. */
+  timedOutMFUs: number
+  /** Incomplete MFUs discarded to enforce the configured memory bound. */
+  evictedMemoryLimit: number
+  outOfOrderFragments: number
+}
+
+export const MFU_REASSEMBLY_ERROR_CODES = [
+  'invalid-fragment-state',
+  'missing-data-unit-identity',
+  'missing-packet-sequence',
+  'conflicting-data-unit-identity',
+  'overlapping-data-unit',
+  'fragment-counter-mismatch',
+  'data-unit-identity-mismatch',
+  'offset-overflow',
+  'active-data-unit-limit',
+  'incomplete-terminal-fragment',
+  'ambiguous-continuation',
+] as const
+
+export type MfuReassemblyErrorCode = (typeof MFU_REASSEMBLY_ERROR_CODES)[number]
+
+const mfuReassemblyErrorCodes = new Set<string>(MFU_REASSEMBLY_ERROR_CODES)
+
+export function isMfuReassemblyErrorCode(value: unknown): value is MfuReassemblyErrorCode {
+  return typeof value === 'string' && mfuReassemblyErrorCodes.has(value)
+}
+
+export class MfuReassemblyError extends Error {
+  readonly name = 'MfuReassemblyError'
+
+  constructor(
+    readonly code: MfuReassemblyErrorCode,
+    message: string
+  ) {
+    super(message)
+  }
+}
+
+/**
+ * Identity-free test for a reassembly rejection.
+ *
+ * Consumers that inline `@blockcast/mmt-container` more than once (a component
+ * bundle whose `@blockcast/*` dependencies each carry their own copy) end up
+ * with several distinct `MfuReassemblyError` classes. An `instanceof` check
+ * against one copy then misses rejections raised by another, and a per-fragment
+ * rejection escapes as an uncaught throw that aborts the rest of the packet's
+ * processing. The wire contract of a rejection is its name plus one of the
+ * closed error codes, so that is what this guard checks.
+ */
+export function isMfuReassemblyError(error: unknown): error is MfuReassemblyError {
+  if (error instanceof MfuReassemblyError) return true
+  if (typeof error !== 'object' || error === null) return false
+  return (
+    Reflect.get(error, 'name') === 'MfuReassemblyError' &&
+    isMfuReassemblyErrorCode(Reflect.get(error, 'code'))
+  )
+}
+
+function assembledPacketSequences(fragments: readonly MFUFragment[]): {
+  packetSequenceNumbers?: number[]
+  repairedPacketSequenceNumbers?: number[]
+} {
+  const packetSequenceNumbers: number[] = []
+  const repairedPacketSequenceNumbers: number[] = []
+  const seen = new Set<number>()
+  const repaired = new Set<number>()
+  for (const fragment of fragments) {
+    const sequence = fragment.packetSequenceNumber
+    if (typeof sequence !== 'number' || !Number.isSafeInteger(sequence) || sequence < 0 || sequence > 0xffffffff) {
+      return {}
+    }
+    if (!seen.has(sequence)) {
+      seen.add(sequence)
+      packetSequenceNumbers.push(sequence)
+    }
+    if (fragment.recovered === true && !repaired.has(sequence)) {
+      repaired.add(sequence)
+      repairedPacketSequenceNumbers.push(sequence)
+    }
+  }
+  return { packetSequenceNumbers, repairedPacketSequenceNumbers }
+}
+
+export interface PendingMfuDebug {
+  key: string
+  fragments: number
+  fi0: number
+  fi1: number
+  fi2: number
+  fi3: number
+  firstFi: number
+  lastFi: number
+  firstOrder: number
+  lastOrder: number
+  minCounter: number
+  maxCounter: number
+  minOffset?: number
+  maxOffset?: number
+  movieFragmentSequenceNumber?: number
+  sampleNumber?: number
+  mpuSequenceNumber?: number
+  sortedHead: Array<{
+    fi: number
+    counter: number
+    order: number
+    seq?: number
+    offset?: number
+  }>
+  sortedTail: Array<{
+    fi: number
+    counter: number
+    order: number
+    seq?: number
+    offset?: number
+  }>
+}
+
+export interface MFUReassemblerOptions {
+  /** Timeout (ms) for incomplete MFUs. Derive from frame duration or FEC interleaveDepthMs.
+   *  Pass null for live clock-free operation; memory remains bounded by maxBuffered. */
+  timeoutMs: number | null
+  /** Max concurrent incomplete MFUs, including continuations awaiting FI=1. */
+  maxBuffered?: number
+}
+
+/** Reassembly surface consumed by MmtpContainerParser and MmtpRouter.
+ * Implemented by both the TypeScript engine and the shared
+ * Rust/WASM IFC adapter. */
+export interface MfuReassemblerBackend {
+  timeoutMs: number | null
+  readonly stats: ReassemblerStats
+  onDeferredAssembly?: (result: ReassembledMFU) => void
+  /** Returns null only for a valid incomplete DU; strict rejection throws
+   * `MfuReassemblyError`. */
+  addFragment(fragment: MFUFragment): ReassembledMFU | null
+  flush(): void
+  resetStream(catalogTrackName: string): void
+  reset(): void
+  readonly pendingCount: number
+  getStatus(): {
+    bufferedMFUs: number
+    pendingFragments: number
+    pendingSamples: PendingMfuDebug[]
+    stats: ReassemblerStats
+  }
+}
+
+function streamScope(fragment: MFUFragment): readonly [kind: string, identity: string | number | null] {
+  if (fragment.catalogTrackName !== undefined) return ['catalog', fragment.catalogTrackName]
+  if (fragment.packetId !== undefined) return ['packet', fragment.packetId]
+  return ['unspecified', null]
+}
+
+function isU32(value: unknown): value is number {
+  return typeof value === 'number' && Number.isInteger(value) && value >= 0 && value <= 0xffffffff
+}
+
+/**
+ * Wire address of one fragmented data unit: the physical stream scope, the
+ * MPU, and `packetSequenceNumber + fragmentCounter` mod 2^32. Under the
+ * contiguous-source producer profile every fragment of one data unit occupies
+ * consecutive packet sequence numbers on its packet ID while
+ * `fragmentCounter` counts the payloads that follow, so the sum is the
+ * sequence number of the data unit's last fragment: equal for every fragment
+ * of one data unit and distinct between data units of one MPU. Transport
+ * association only; objectKey remains the intrinsic DU identity.
+ */
+function dataUnitAddress(fragment: MFUFragment, packetSequenceNumber: number): string {
+  return JSON.stringify([
+    ...streamScope(fragment),
+    fragment.mpuSequenceNumber,
+    (packetSequenceNumber + fragment.fragmentCounter) >>> 0,
+  ])
+}
+
+function hasAnySampleIdentityField(fragment: MFUFragment): boolean {
+  return (
+    fragment.movieFragmentSequenceNumber !== undefined ||
+    fragment.sampleNumber !== undefined ||
+    fragment.sampleOffset !== undefined
+  )
+}
+
+type IdentifiedSampleFragment = MFUFragment &
+  Required<Pick<MFUFragment, 'movieFragmentSequenceNumber' | 'sampleNumber' | 'sampleOffset'>>
+
+function hasSampleIdentity(fragment: MFUFragment): fragment is IdentifiedSampleFragment {
+  return (
+    isU32(fragment.movieFragmentSequenceNumber) &&
+    fragment.movieFragmentSequenceNumber > 0 &&
+    isU32(fragment.sampleNumber) &&
+    fragment.sampleNumber > 0 &&
+    isU32(fragment.sampleOffset)
+  )
+}
+
+function hasValidFragmentHeader(fragment: MFUFragment): boolean {
+  const { fragmentationIndicator: fi, fragmentCounter: counter } = fragment
+  if (!Number.isInteger(fi) || fi < 0 || fi > 3) return false
+  if (!Number.isInteger(counter) || counter < 0 || counter > 0xff) return false
+  return fi === 0 || fi === 3 ? counter === 0 : counter > 0
+}
+
+function fragmentCounterOrder(fragment: MFUFragment): number {
+  return 0xff - fragment.fragmentCounter
+}
+
+function objectKey(fragment: MFUFragment): string {
+  const scope = streamScope(fragment)
+  if (fragment.itemId !== undefined) {
+    return JSON.stringify([...scope, fragment.mpuSequenceNumber, 'item', fragment.itemId])
+  }
+  if (hasSampleIdentity(fragment)) {
+    return JSON.stringify([
+      ...scope,
+      fragment.mpuSequenceNumber,
+      'sample',
+      fragment.movieFragmentSequenceNumber,
+      fragment.sampleNumber,
+      // The DU's authored base offset (moqcast #37): sibling subsample DUs
+      // of one sample get distinct keys instead of colliding. Only ever
+      // called with the unmutated FI=1 (or FI=0) fragment, whose
+      // sampleOffset is that authored base -- never the accumulating
+      // per-continuation value written by #associateDataUnit.
+      fragment.sampleOffset,
+    ])
+  }
+  return JSON.stringify([...scope, fragment.mpuSequenceNumber, 'unidentified'])
+}
+
+function ordersByOffset(fragments: MFUFragment[]): boolean {
+  return fragments.every(fragment => hasSampleIdentity(fragment))
+}
+
+type ActiveDataUnit = {
+  /** Wire address every continuation of this data unit carries. */
+  address: string
+  bufferKey: string
+  nextFragmentCounter: number
+  /** Monotonic admission ordinal of this data unit's slot. Never a clock. */
+  admissionSeq: number
+  catalogTrackName?: string
+} & (
+  | {
+      kind: 'sample'
+      movieFragmentSequenceNumber: number
+      sampleNumber: number
+      nextOffset: number
+    }
+  | {
+      kind: 'item'
+      itemId: number
+    }
+)
+
+interface DataUnitAssociation {
+  bufferKey: string
+  first: boolean
+  terminal: boolean
+}
+
+interface PendingContinuationRun {
+  fragments: Map<number, MFUFragment>
+  startedAt: number
+  /** Monotonic admission ordinal of this data unit's slot. Never a clock. */
+  admissionSeq: number
+  timeoutId?: ReturnType<typeof setTimeout>
+}
+
+interface BufferTimeoutState {
+  startedAt: number
+  timeoutId?: ReturnType<typeof setTimeout>
+}
+
+function checkedSampleEnd(offset: number, byteLength: number): number | null {
+  const end = offset + byteLength
+  return Number.isSafeInteger(end) && end <= 0xffffffff ? end : null
+}
+
+/**
+ * MFU Reassembler with bounded reordered-fragment association
+ * Based on ISO/IEC 23008-1:2023 Section 9.2.3.3
+ */
+
+/**
+ * Completed-address window, as a multiple of maxBuffered. A late continuation
+ * is refused as stale while its data unit's address is within this window and
+ * parks as a headless data unit once the address has been forgotten. The
+ * value is a cross-engine invariant shared with the Rust reassembler
+ * (mmt-core COMPLETED_ADDRESS_WINDOW_MULTIPLE); change both together.
+ */
+export const COMPLETED_ADDRESS_WINDOW_MULTIPLE = 2
+
+/**
+ * Cross-engine anchors for the clock-free eviction guard. The bound itself is
+ * `maxBuffered`, a host parameter — these fix the one scenario both regression
+ * corpora drive so the Rust and TypeScript guards assert the same boundary
+ * rather than each deriving its own. Shared with the Rust reassembler
+ * (`EVICTION_GUARD_MAX_BUFFERED` / `EVICTION_GUARD_DATA_UNITS` in
+ * `mmt-core/src/reassembler/policy/mmt.rs`); change both together.
+ *
+ * `EVICTION_GUARD_DATA_UNITS` headless data units admitted against a bound of
+ * `EVICTION_GUARD_MAX_BUFFERED` must evict exactly the difference.
+ */
+export const EVICTION_GUARD_MAX_BUFFERED = 4
+export const EVICTION_GUARD_DATA_UNITS = 12
+
+/**
+ * Does a parked continuation queue hold a `maxBuffered` slot of its own?
+ *
+ * One rule, four call sites. Two read the bound: the queue that is *counted*
+ * toward it (`#unopenedParkedRunCount`) is exactly the queue that is *offered*
+ * to eviction (`#evictLeastRecentlyAdmitted`). Two gate admission against it:
+ * `#parkContinuation` and the FI=1 arm of `#associateDataUnit` each ask whether
+ * this address is already charged before moving the bound. Stating the rule once
+ * is what keeps those four answers from drifting apart — a queue that charges a
+ * slot no eviction can reclaim wedges the receiver, because the bound then
+ * refuses every new data unit forever with `active-data-unit-limit`.
+ *
+ * Two exclusions, for two different reasons:
+ *
+ * - **An open run owns the address.** The data unit is already charged through
+ *   that run, so its queue costs nothing further.
+ * - **The queue is empty.** It holds nothing, so it charges nothing and offers
+ *   nothing.
+ *
+ * The emptiness half is belt-and-braces, not load-bearing. Both engines discard
+ * an emptied queue eagerly — `#deletePendingRun` here on every drain exit,
+ * `discard_empty_parked_run` in Rust — and `#parkContinuation` always inserts
+ * into a queue it just created, so an empty queue is not observable today.
+ * Correctness must not depend on that invariant holding in all three places per
+ * engine: routing every site that asks the question through this one predicate
+ * is what keeps the engines agreeing if a future edit ever misses one of them.
+ *
+ * Scope: this rule decides *slot accounting* — counted, offered, admitted. A
+ * queue carries two further per-slot facts, its admission ordinal and its
+ * retention anchor (`startedAt` plus the timer armed from it), and both must
+ * move when an empty queue is charged again. `#parkContinuation` resets them
+ * explicitly; Rust gets the same contract structurally, by deriving each from
+ * the queue's live entries. Same contract, two mechanisms.
+ *
+ * The *reap schedule* asks the same question, and every site that arms a
+ * parked queue reaches one function, `#armHeadlessPendingTimeout`, which takes
+ * the test through this rule: `set timeoutMs` calls it for every queue when
+ * the policy changes, `#parkContinuation` calls it after a created or
+ * re-anchored queue holds its first fragment, and a run closing without
+ * completing calls it for the queue it leaves behind. It never arms a timer
+ * for an empty queue, because a timeout reports a data unit that failed to
+ * complete in time and an empty queue holds no such data unit. Charging one
+ * would record an MFU that never existed. No site installs a parked-queue
+ * timer of its own, so neither the slot rule nor the `startedAt` anchoring can
+ * drift one site at a time.
+ *
+ * That is the answer Rust reaches structurally: `next_timeout_at` derives
+ * candidate deadlines from the queue's live entries, so an empty queue yields
+ * none and no sweep is ever scheduled on its account, and `cleanup_timeouts`
+ * retains by `parked_run_holds_a_slot`, so a sweep arriving for any *other*
+ * queue leaves an empty one in place rather than charging
+ * `record_policy_timeout` for it. Both engines therefore agree on when the
+ * reap is scheduled, and the recorded statistic is unchanged for every queue
+ * that really did hold a data unit: `#onPendingTimeout` charges
+ * `stats.timedOutMFUs`, the shape Rust's `record_policy_timeout` produces, and
+ * takes the same slot test before charging, so the statistic cannot be
+ * recorded for an empty queue whatever order the arming sites run in.
+ *
+ * The trade this makes, in both engines: a queue that is emptied without being
+ * discarded is invisible to the reap schedule, to the slot count, and to
+ * eviction, so nothing reclaims it until `reset()` clears the policy state.
+ * Disposal of an emptied queue therefore rests entirely on the eager discard
+ * sites (`#deletePendingRun` here, `discard_empty_parked_run` in Rust), where
+ * it is housekeeping rather than an expiry; a drain exit that skips that call
+ * leaks the queue for the life of the reassembler rather than charging a
+ * phantom timeout for it. Converged under BLO-32420. The arming half of this
+ * rule is pinned in `mfu-reassembler-eviction.test.ts`: a headless queue that
+ * holds fragments is armed by `set timeoutMs` and by its run closing, and
+ * disarmed by `timeoutMs = null`. The emptiness half is Rust-only, because
+ * `#pendingContinuations` is unreachable from this package's tests.
+ *
+ * The public counters are a separate matter and *are* governed: `pendingCount`
+ * — and through it `getStatus().bufferedMFUs` — delegates to
+ * `#unopenedParkedRunCount`, exactly as Rust's `buffered_count` is built on
+ * `unopened_parked_run_count`. Filtering either on the open run alone makes the
+ * engines report different numbers for the same state out of a host-observable
+ * API.
+ *
+ * Twin of `parked_run_holds_a_slot` in
+ * `mmt-core/src/reassembler/policy/mmt.rs`; change both together.
+ */
+export function parkedRunHoldsASlot(hasOpenRun: boolean, fragmentCount: number): boolean {
+  return !hasOpenRun && fragmentCount > 0
+}
+
+export class MFUReassembler {
+  // Fragment buffers and active runs use the authored MFU DU identity.
+  // Continuations may wait in one counter-indexed queue per data-unit address
+  // until FI=1 supplies that identity. The address is transport association
+  // only; the object key stays the intrinsic DU identity.
+  #buffers: Map<string, MFUFragment[]> = new Map()
+  #timeouts: Map<string, BufferTimeoutState> = new Map()
+  #activeDataUnits: Map<string, ActiveDataUnit> = new Map()
+  #pendingContinuations: Map<string, PendingContinuationRun> = new Map()
+  #emitted: Set<string> = new Set() // same sample keys, so FEC-recovered duplicate heads are dropped
+  #emittedOrder: string[] = []
+  // Addresses of emitted data units. A continuation addressed to one of them
+  // is a late copy of a fragment the run already consumed (FEC recovery
+  // supplied it first), so it is rejected as stale rather than parked as a
+  // headless data unit that would hold a slot until reset. Bounded at
+  // COMPLETED_ADDRESS_WINDOW_MULTIPLE x maxBuffered, the same window the Rust
+  // engine keeps, so both engines forget an address after the same number of
+  // completions. (#emitted is a separate, per-engine window: this engine keeps
+  // maxBuffered sample keys where Rust keeps 2x; the completed set does not
+  // derive from it.)
+  #completed: Set<string> = new Set()
+  #completedOrder: string[] = []
+  #timeoutMs: number | null
+  #maxBuffered: number
+  /**
+   * Monotonic admission ordinal. Counts slot admissions, never reads a clock,
+   * so eviction order survives on hosts that run `timeoutMs: null`.
+   */
+  #nextAdmissionSeq = 0
+
+  /** Statistics for debugging */
+  readonly stats: ReassemblerStats = {
+    totalFragments: 0,
+    reassembledMFUs: 0,
+    rejectedFragments: 0,
+    timedOutMFUs: 0,
+    evictedMemoryLimit: 0,
+    outOfOrderFragments: 0,
+  }
+
+  constructor(options: MFUReassemblerOptions) {
+    if (options.timeoutMs !== null && (!Number.isFinite(options.timeoutMs) || options.timeoutMs <= 0)) {
+      throw new Error('[MFUReassembler] timeoutMs must be > 0 (derive from frame duration or FEC config)')
+    }
+    const maxBuffered = options.maxBuffered ?? 100
+    if (!Number.isInteger(maxBuffered) || maxBuffered <= 0) {
+      throw new Error('[MFUReassembler] maxBuffered must be a positive integer')
+    }
+    this.#timeoutMs = options.timeoutMs
+    this.#maxBuffered = maxBuffered
+  }
+
+  /** Update the expiry policy for all retained and future incomplete MFUs. */
+  set timeoutMs(ms: number | null) {
+    if (ms !== null && (!Number.isFinite(ms) || ms <= 0)) {
+      throw new Error('[MFUReassembler] timeoutMs must be > 0 (derive from frame duration or FEC config)')
+    }
+    this.#timeoutMs = ms
+    const now = Date.now()
+    for (const [bufferKey, state] of this.#timeouts) {
+      if (state.timeoutId !== undefined) clearTimeout(state.timeoutId)
+      delete state.timeoutId
+      if (ms !== null) {
+        state.timeoutId = setTimeout(() => this.#onTimeout(bufferKey), Math.max(0, state.startedAt + ms - now))
+      }
+    }
+    // Parked queues re-arm through the one arming function, which reads the
+    // new policy from `#timeoutMs` (assigned above) and keeps each queue on its
+    // own `startedAt` anchor. Clearing first releases any timer armed under the
+    // old policy so the helper's already-armed guard cannot skip the re-arm.
+    for (const address of this.#pendingContinuations.keys()) {
+      this.#clearPendingTimeout(address)
+      this.#armHeadlessPendingTimeout(address)
+    }
+  }
+  get timeoutMs(): number | null {
+    return this.#timeoutMs
+  }
+
+  /**
+   * Add a fragment and return reassembled MFU if complete
+   */
+  addFragment(fragment: MFUFragment): ReassembledMFU | null {
+    this.stats.totalFragments++
+
+    if (!hasValidFragmentHeader(fragment)) {
+      this.#reject('invalid-fragment-state', 'invalid MFU fragmentation indicator or counter')
+    }
+    if (fragment.itemId !== undefined && hasAnySampleIdentityField(fragment)) {
+      this.#reject('conflicting-data-unit-identity', 'MFU carries timed and non-timed DU identities')
+    }
+
+    const { mpuSequenceNumber, fragmentationIndicator } = fragment
+
+    // A complete FT=2 data unit still requires its intrinsic DU identity.
+    // The transport parser strips the deterministic timed/non-timed DU header
+    // before calling this layer; direct callers must provide the same identity.
+    // Don't check or update #emitted: in MMTP over MoQ, multiple complete MFUs
+    // share the same mpuSequenceNumber (all frames in a GOP have the same mpuSeq).
+    // Blocking FI=0 would prevent keyframe fragment assembly at the same mpuSeq.
+    if (fragmentationIndicator === 0) {
+      const sampleIdentity = hasSampleIdentity(fragment)
+      const hasSampleFields = hasAnySampleIdentityField(fragment)
+      const hasItemIdentity = fragment.itemId !== undefined
+      if (!sampleIdentity && !hasItemIdentity) {
+        this.#reject('missing-data-unit-identity', 'complete MFU has no intrinsic DU identity')
+      }
+      if (hasSampleFields && !sampleIdentity) {
+        this.#reject('missing-data-unit-identity', 'complete MFU has an incomplete sample identity')
+      }
+      if (hasItemIdentity && !isU32(fragment.itemId)) {
+        this.#reject('missing-data-unit-identity', 'complete MFU has an invalid Item_ID')
+      }
+      this.stats.reassembledMFUs++
+      return {
+        mpuSequenceNumber,
+        packetSequenceNumber: fragment.packetSequenceNumber,
+        ...assembledPacketSequences([fragment]),
+        data: fragment.data,
+        timestamp: fragment.timestamp,
+        fragmentCount: 1,
+        rapFlag: fragment.rapFlag,
+        priority: fragment.priority,
+        sampleNumber: fragment.sampleNumber,
+        movieFragmentSequenceNumber: fragment.movieFragmentSequenceNumber,
+        sampleOffset: fragment.sampleOffset,
+        source: fragment.source,
+        deliveryProvenance: deliveryProvenanceOf([fragment]),
+        catalogTrackName: fragment.catalogTrackName,
+      }
+    }
+
+    const sequence = fragment.packetSequenceNumber
+    if (!isU32(sequence)) {
+      this.#reject('missing-packet-sequence', 'fragmented MFU has no MMTP packet sequence number')
+    }
+    const address = dataUnitAddress(fragment, sequence)
+
+    if (fragmentationIndicator !== 1) {
+      // Attribution is an exact per-data-unit lookup. The continuation joins
+      // the one open run holding its address when its counter is that run's
+      // next. It is stale when the run has already counted past the counter,
+      // or when the data unit was already emitted: the position was accepted
+      // once, so no run can ever take it again. Otherwise (no open run at this
+      // address, or the run has not reached the counter yet) it parks under
+      // its own address. Other runs' counters are never consulted.
+      const open = this.#openRunAt(address)
+      if (open === undefined) {
+        if (this.#completed.has(address)) {
+          this.#reject('fragment-counter-mismatch', 'MFU continuation names a data unit that already completed')
+        }
+        this.#parkContinuation(address, fragment)
+        return null
+      }
+      const [runKey, active] = open
+      if (active.nextFragmentCounter > fragment.fragmentCounter) {
+        this.#parkContinuation(address, fragment)
+        return null
+      }
+      if (active.nextFragmentCounter < fragment.fragmentCounter) {
+        this.#reject('fragment-counter-mismatch', 'MFU continuation is behind the authored fragment-counter countdown')
+      }
+      const result = this.#addAssociatedFragment(fragment, runKey, address)
+      if (result !== null) return result
+      return this.#drainPendingContinuations(address, runKey)
+    }
+
+    const runKey = objectKey(fragment)
+    if ((hasSampleIdentity(fragment) || isU32(fragment.itemId)) && this.#emitted.has(runKey)) {
+      // The identity already emitted, so this first fragment is a duplicate
+      // and is dropped. Queues under other addresses belong to other data
+      // units and are untouched.
+      return null
+    }
+    if (this.#activeDataUnits.has(runKey)) {
+      this.#reject('overlapping-data-unit', 'fragmented MFU overlaps an active data unit')
+    }
+    // Two heads with one address are one data unit delivered twice or an
+    // identity clash on the wire. The established run keeps the address.
+    if (this.#openRunAt(address) !== undefined) {
+      this.#reject('overlapping-data-unit', 'fragmented MFU opens on an address held by an open data unit')
+    }
+    const pending = this.#pendingContinuations.get(address)
+    // A parked continuation of this data unit cannot carry a counter at or
+    // above its own head's countdown.
+    if (pending !== undefined && [...pending.fragments.keys()].some(counter => counter >= fragment.fragmentCounter)) {
+      this.#reject(
+        'fragment-counter-mismatch',
+        'queued continuation counter is not below the authored first-fragment counter'
+      )
+    }
+
+    // The run's deadline starts at the earliest arrival of its own fragments.
+    const result = this.#addAssociatedFragment(fragment, runKey, address, pending?.startedAt)
+    this.#clearPendingTimeout(address)
+    if (result !== null) return result
+    return this.#drainPendingContinuations(address, runKey)
+  }
+
+  #addAssociatedFragment(
+    fragment: MFUFragment,
+    runKey: string,
+    address: string,
+    startedAt?: number
+  ): ReassembledMFU | null {
+    const association = this.#associateDataUnit(fragment, runKey, address)
+    const { bufferKey, first, terminal } = association
+
+    let fragments = this.#buffers.get(bufferKey)
+    if (first) {
+      if (fragments !== undefined) {
+        this.#reject('overlapping-data-unit', 'intrinsic data-unit buffer already exists')
+      }
+      fragments = []
+      this.#buffers.set(bufferKey, fragments)
+    } else if (fragments === undefined) {
+      throw new Error('[MFUReassembler] active data unit has no fragment buffer')
+    }
+
+    // A lossy-path deadline is measured from the first received fragment,
+    // including a continuation that arrived before FI=1. Reliable paths are
+    // clock-free and never install this timer.
+    if (first) this.#setTimeout(bufferKey, startedAt)
+    fragments.push(fragment)
+
+    if (!terminal) return null
+    const result = this.#tryReassemble(bufferKey)
+    this.#activeDataUnits.delete(runKey)
+    if (result === null) {
+      this.#clearTimeout(bufferKey)
+      this.#buffers.delete(bufferKey)
+      this.#reject('incomplete-terminal-fragment', 'validated terminal fragment did not complete its data unit')
+    }
+    this.#markCompleted(address)
+    return result
+  }
+
+  #parkContinuation(address: string, fragment: MFUFragment): void {
+    let pending = this.#pendingContinuations.get(address)
+    const open = this.#openRunAt(address)
+    // A data unit is charged one slot: through its open run, or through its
+    // queue while no run is open. Parking under an address that is already
+    // charged adds nothing to the bound, so admission is judged by what this
+    // fragment would add, not by the total alone. The queue half routes through
+    // `parkedRunHoldsASlot` rather than restating it, so this gate cannot drift
+    // from the sites that count and evict by it: an empty queue charges nothing
+    // here for the same reason it is offered nothing there. Gating on
+    // `pending === undefined` instead would skip the bound entirely for a queue
+    // that exists but holds nothing, overshooting `maxBuffered` by one while
+    // Rust evicts — the cross-engine split BLO-31813 exists to close.
+    const alreadyCharged =
+      open !== undefined || parkedRunHoldsASlot(open !== undefined, pending?.fragments.size ?? 0)
+    if (!alreadyCharged && this.#incompleteRunCount() >= this.#maxBuffered) {
+      // `open` and `pending` are captured above, and eviction can delete from
+      // `#pendingContinuations` — so both are read across a mutation. Neither
+      // goes stale, and the predicate is what makes that true: eviction only
+      // runs when `open === undefined`, and an empty queue is not a candidate,
+      // so the record the `else if` below writes to cannot be the one released
+      // here. Re-read both if that rule is ever loosened.
+      if (!this.#evictLeastRecentlyAdmitted()) {
+        this.#reject('active-data-unit-limit', 'active MFU data-unit limit reached')
+      }
+    }
+    // Both branches below leave the timer to `#armHeadlessPendingTimeout`,
+    // called once the fragment is in, so the queue is armed only while it
+    // holds a data unit and through the same slot rule as every other site.
+    let armAfterInsert = false
+    if (pending === undefined) {
+      // A queue opened under an already-charged address inherits that slot's
+      // ordinal, so a run does not renew its admission by parking a fragment.
+      // The arm below is a no-op under an open run: the run's own deadline
+      // covers the data unit, and `#armHeadlessPendingTimeout` tests for it.
+      pending = {
+        fragments: new Map(),
+        startedAt: Date.now(),
+        admissionSeq: open !== undefined ? open[1].admissionSeq : this.#nextAdmissionSeq++,
+      }
+      this.#pendingContinuations.set(address, pending)
+      armAfterInsert = true
+    } else if (!alreadyCharged) {
+      // A queue that exists but holds nothing charged no slot, so this fragment
+      // is a fresh admission — and every per-slot fact the record still carries
+      // describes an occupancy that ended when its last entry left. Rust derives
+      // all of them from the queue's *live* entries, so re-parking moves them
+      // together; TypeScript caches them as fields written once at creation, so
+      // they have to be reset together here or the queue goes transparent to the
+      // bound while staying stale on its deadline:
+      //
+      // - Ordinal. `slot_admission_seq` mins over the entries and an empty queue
+      //   has none, so Rust mints a fresh one. Decides victim ordering.
+      // - Retention anchor. `cleanup_timeouts` retains on `min(received_at)`,
+      //   which a re-parked entry moves forward. Left stale, `#onPendingTimeout`
+      //   can discard the queue on the emptied queue's deadline while it holds a
+      //   fragment that was just charged a slot — and that may have evicted
+      //   another data unit to get it.
+      // - Armed timer. `#armHeadlessPendingTimeout` anchors on `startedAt` and
+      //   arms only a queue that holds a fragment, so the re-arm runs once this
+      //   fragment is in (below), where the creation branch arms too, rather
+      //   than here, where the queue is still empty and the call would arm
+      //   nothing. Any timer left on the record is cleared first so the queue
+      //   cannot keep running on the old anchor.
+      //
+      // `Date.now()` here is the same retention anchor the queue-creation branch
+      // above already reads, not a clock in the admission order: the ordinal
+      // stays a monotonic sequence, so eviction remains clock-free per PR #93.
+      //
+      // Unreachable while every drain exit discards an emptied queue; pinned so
+      // the engines cannot pick different victims — or different expiries — if
+      // one ever misses a discard site.
+      pending.admissionSeq = this.#nextAdmissionSeq++
+      pending.startedAt = Date.now()
+      this.#clearPendingTimeout(address)
+      armAfterInsert = true
+    }
+    // The same data unit naming the same countdown position twice: the first
+    // parked copy is kept.
+    if (pending.fragments.has(fragment.fragmentCounter)) {
+      this.#reject('fragment-counter-mismatch', 'duplicate queued continuation counter would replace retained media')
+    }
+    pending.fragments.set(fragment.fragmentCounter, fragment)
+    // A created or re-anchored queue holds its first fragment only now, so this
+    // is the first point at which `#armHeadlessPendingTimeout` arms it. With
+    // `startedAt` set one tick earlier the deadline it computes is the full
+    // `timeoutMs`, the same schedule a raw timer armed at creation would have
+    // kept. The duplicate check above cannot reject on this path: both branches
+    // that set the flag run exactly when the queue is empty.
+    if (armAfterInsert) this.#armHeadlessPendingTimeout(address)
+  }
+
+  #drainPendingContinuations(address: string, runKey: string): ReassembledMFU | null {
+    while (true) {
+      const active = this.#activeDataUnits.get(runKey)
+      const pending = this.#pendingContinuations.get(address)
+      if (active === undefined) {
+        // The run closed. Its queue holds only this data unit's fragments;
+        // drop it once empty so it is not counted as a headless data unit.
+        if (pending?.fragments.size === 0) this.#deletePendingRun(address)
+        return null
+      }
+      const fragment = pending?.fragments.get(active.nextFragmentCounter)
+      if (fragment === undefined) {
+        if (pending?.fragments.size === 0) this.#deletePendingRun(address)
+        return null
+      }
+      pending!.fragments.delete(active.nextFragmentCounter)
+      if (pending!.fragments.size === 0) this.#deletePendingRun(address)
+      const result = this.#addAssociatedFragment(fragment, runKey, address)
+      if (result !== null) {
+        return result
+      }
+    }
+  }
+
+  /** Parked data units that hold a `maxBuffered` slot of their own. Membership
+   * is `parkedRunHoldsASlot`, the same rule #evictLeastRecentlyAdmitted offers
+   * as candidates, so nothing can be counted here that eviction cannot reclaim.
+   *
+   * One site, two callers — `#incompleteRunCount` and `pendingCount` — mirroring
+   * Rust's `unopened_parked_run_count`, which `incomplete_run_count` and
+   * `buffered_count` both delegate to. Both callers used to inline this loop
+   * verbatim, so converging the *rule* moved one copy and left the other as the
+   * divergence (Ally's review of #400). The rule can no longer drift now that
+   * every site routes through `parkedRunHoldsASlot`; keeping the loop itself at
+   * one site is what stops the scaffolding drifting the next time this question
+   * grows an argument. */
+  #unopenedParkedRunCount(): number {
+    let count = 0
+    for (const [address, pending] of this.#pendingContinuations) {
+      if (parkedRunHoldsASlot(this.#openRunAt(address) !== undefined, pending.fragments.size)) {
+        count++
+      }
+    }
+    return count
+  }
+
+  /** Every open run plus every headless parked data unit that holds a slot,
+   * one slot each. This is the quantity maxBuffered bounds. The parked term is
+   * `#unopenedParkedRunCount`, whose membership is `parkedRunHoldsASlot` — the
+   * same rule #evictLeastRecentlyAdmitted offers as candidates, so nothing can
+   * be counted here that eviction cannot reclaim. */
+  #incompleteRunCount(): number {
+    return this.#activeDataUnits.size + this.#unopenedParkedRunCount()
+  }
+
+  /**
+   * Drop the incomplete data unit admitted longest ago so a newly arriving one
+   * can take its slot. Selection is by monotonic admission ordinal, never by
+   * wall clock, so this is a bounded-capacity replacement policy and not a
+   * timeout: it behaves identically on hosts that never drive `cleanup_timeouts`
+   * (`timeoutMs: null`). Only incomplete data units are candidates — a data
+   * unit that completed has already left both maps.
+   *
+   * Returns false only if no slot is charged, which cannot happen at the bound
+   * (`maxBuffered` is a positive integer); admission then falls back to the
+   * fail-closed `active-data-unit-limit` reject, which stays a stable host code.
+   * That holds because the candidate set here is built from the same
+   * `parkedRunHoldsASlot` rule `#incompleteRunCount` counts by, so reaching the
+   * bound implies at least one candidate. Filtering one and not the other would
+   * make the claim false: a queue counted but not offered charges a slot no
+   * eviction can reclaim, and the receiver refuses every later data unit
+   * permanently.
+   */
+  #evictLeastRecentlyAdmitted(): boolean {
+    let victimAddress: string | undefined
+    let victimSeq = Number.POSITIVE_INFINITY
+    for (const [, active] of this.#activeDataUnits) {
+      if (active.admissionSeq < victimSeq) {
+        victimSeq = active.admissionSeq
+        victimAddress = active.address
+      }
+    }
+    for (const [address, pending] of this.#pendingContinuations) {
+      // Exactly the queues #incompleteRunCount charges a slot to: a queue under
+      // an open run is that run's slot, already considered above, and an empty
+      // queue holds nothing to evict.
+      if (!parkedRunHoldsASlot(this.#openRunAt(address) !== undefined, pending.fragments.size)) {
+        continue
+      }
+      if (pending.admissionSeq < victimSeq) {
+        victimSeq = pending.admissionSeq
+        victimAddress = address
+      }
+    }
+    if (victimAddress === undefined) return false
+    this.#releaseSlot(victimAddress)
+    this.stats.evictedMemoryLimit++
+    return true
+  }
+
+  /**
+   * Release every form of state one address holds: its open run, that run's
+   * buffered fragments and deadline, and its continuation queue. The address is
+   * deliberately not marked completed — the data unit never emitted, so a later
+   * fragment of it may open a fresh slot rather than being rejected as stale.
+   */
+  #releaseSlot(address: string): void {
+    const open = this.#openRunAt(address)
+    if (open !== undefined) {
+      const [runKey, active] = open
+      this.#activeDataUnits.delete(runKey)
+      this.#clearTimeout(active.bufferKey)
+      this.#buffers.delete(active.bufferKey)
+    }
+    this.#deletePendingRun(address)
+  }
+
+  #reject(code: MfuReassemblyErrorCode, message: string): never {
+    this.stats.rejectedFragments++
+    throw new MfuReassemblyError(code, message)
+  }
+
+  #associateDataUnit(fragment: MFUFragment, runKey: string, address: string): DataUnitAssociation {
+    const fi = fragment.fragmentationIndicator
+    if (fi === 1) {
+      // Opening a run is free when this data unit already holds a parked
+      // slot: the run inherits it, so the bound does not move.
+      //
+      // A second head on an open address is refused upstream, so no run is open
+      // here. Read that live rather than assume it, and route the answer through
+      // `parkedRunHoldsASlot`, so this gate is the fourth site of one rule
+      // instead of a fourth restatement of it. `parked` is non-null wherever
+      // this is true, because the rule requires a non-empty queue.
+      const parked = this.#pendingContinuations.get(address)
+      const inheritsParkedSlot = parkedRunHoldsASlot(
+        this.#openRunAt(address) !== undefined,
+        parked?.fragments.size ?? 0,
+      )
+
+      // Resolve identity and byte extent BEFORE taking a slot. Eviction
+      // replaces a healthy data unit, so it must only ever run for a fragment
+      // that is going to be admitted -- a reject reached after eviction would
+      // destroy valid state and break the contract these rejects exist to
+      // uphold ("without advancing or replacing valid state"). addFragment
+      // pre-validates only the FI/counter pair and the itemId/sample-field
+      // conflict, so every reject below is reachable at the bound.
+      const sampleIdentity = hasSampleIdentity(fragment)
+      const hasSampleFields = hasAnySampleIdentityField(fragment)
+      const hasItemIdentity = fragment.itemId !== undefined
+      if (sampleIdentity && hasItemIdentity) {
+        this.#reject('conflicting-data-unit-identity', 'fragmented MFU carries timed and non-timed DU identities')
+      }
+      if (!sampleIdentity && !hasItemIdentity) {
+        this.#reject('missing-data-unit-identity', 'first fragment has no intrinsic DU identity')
+      }
+      if (hasSampleFields && !sampleIdentity) {
+        this.#reject('missing-data-unit-identity', 'first fragment has an incomplete sample identity')
+      }
+      if (hasItemIdentity && !isU32(fragment.itemId)) {
+        this.#reject('missing-data-unit-identity', 'first fragment has an invalid Item_ID')
+      }
+
+      const bufferKey = objectKey(fragment)
+      if (this.#buffers.has(bufferKey)) {
+        this.#reject('overlapping-data-unit', 'intrinsic data-unit buffer already exists')
+      }
+
+      let sampleEnd: number | null = null
+      if (sampleIdentity) {
+        sampleEnd = checkedSampleEnd(fragment.sampleOffset, fragment.data.byteLength)
+        if (sampleEnd === null) this.#reject('offset-overflow', 'sample byte offset overflow')
+      }
+
+      // The fragment is admissible from here on, so charging it a slot cannot
+      // be undone by a later reject. A second head on an open address was
+      // already refused upstream, so this address holds no run and can never
+      // be its own eviction victim.
+      if (!inheritsParkedSlot && this.#incompleteRunCount() >= this.#maxBuffered) {
+        if (!this.#evictLeastRecentlyAdmitted()) {
+          this.#reject('active-data-unit-limit', 'active MFU data-unit limit reached')
+        }
+      }
+      // An inherited slot keeps the ordinal it was admitted with: the head
+      // arriving late does not make the data unit younger than one parked
+      // after it.
+      const admissionSeq = inheritsParkedSlot ? parked!.admissionSeq : this.#nextAdmissionSeq++
+
+      let active: ActiveDataUnit
+      if (sampleIdentity) {
+        active = {
+          address,
+          kind: 'sample',
+          bufferKey,
+          nextFragmentCounter: fragment.fragmentCounter - 1,
+          admissionSeq,
+          movieFragmentSequenceNumber: fragment.movieFragmentSequenceNumber,
+          sampleNumber: fragment.sampleNumber,
+          nextOffset: sampleEnd!,
+          ...(fragment.catalogTrackName === undefined ? {} : { catalogTrackName: fragment.catalogTrackName }),
+        }
+      } else {
+        active = {
+          address,
+          kind: 'item',
+          bufferKey,
+          nextFragmentCounter: fragment.fragmentCounter - 1,
+          admissionSeq,
+          itemId: fragment.itemId!,
+          ...(fragment.catalogTrackName === undefined ? {} : { catalogTrackName: fragment.catalogTrackName }),
+        }
+      }
+      this.#activeDataUnits.set(objectKey(fragment), active)
+      return { bufferKey, first: true, terminal: false }
+    }
+
+    const active = this.#activeDataUnits.get(runKey)
+    if (active === undefined) {
+      throw new Error('[MFUReassembler] continuation was not parked before association')
+    }
+    if (fragment.fragmentCounter !== active.nextFragmentCounter) {
+      this.#reject(
+        'fragment-counter-mismatch',
+        'MFU continuation does not follow the authored fragment-counter countdown'
+      )
+    }
+
+    if (active.kind === 'sample') {
+      if (fragment.itemId !== undefined) {
+        this.#reject('data-unit-identity-mismatch', 'sample continuation carries an Item_ID')
+      }
+      if (
+        hasAnySampleIdentityField(fragment) &&
+        (!hasSampleIdentity(fragment) ||
+          fragment.movieFragmentSequenceNumber !== active.movieFragmentSequenceNumber ||
+          fragment.sampleNumber !== active.sampleNumber ||
+          fragment.sampleOffset !== active.nextOffset)
+      ) {
+        this.#reject('data-unit-identity-mismatch', 'sample continuation identity does not match')
+      }
+      const nextOffset = checkedSampleEnd(active.nextOffset, fragment.data.byteLength)
+      if (nextOffset === null) this.#reject('offset-overflow', 'sample byte offset overflow')
+      fragment.movieFragmentSequenceNumber = active.movieFragmentSequenceNumber
+      fragment.sampleNumber = active.sampleNumber
+      fragment.sampleOffset = active.nextOffset
+      if (fi === 2) {
+        active.nextOffset = nextOffset
+        active.nextFragmentCounter = fragment.fragmentCounter - 1
+      }
+    } else {
+      if (hasAnySampleIdentityField(fragment) || (fragment.itemId !== undefined && fragment.itemId !== active.itemId)) {
+        this.#reject('data-unit-identity-mismatch', 'Item_ID continuation identity does not match')
+      }
+      fragment.itemId = active.itemId
+      if (fi === 2) active.nextFragmentCounter = fragment.fragmentCounter - 1
+    }
+
+    return {
+      bufferKey: active.bufferKey,
+      first: false,
+      terminal: fi === 3,
+    }
+  }
+
+  #tryReassemble(bufferKey: string): ReassembledMFU | null {
+    const fragments = this.#buffers.get(bufferKey)
+    if (!fragments || fragments.length === 0) {
+      return null
+    }
+
+    const sorted = [...fragments].sort((a, b) => this.#orderValue(a) - this.#orderValue(b))
+
+    if (sorted[0]!.fragmentationIndicator !== 1 || sorted[sorted.length - 1]!.fragmentationIndicator !== 3) {
+      return null
+    }
+    if (sorted.slice(1, -1).some(fragment => fragment.fragmentationIndicator !== 2)) {
+      return null
+    }
+
+    // ISO fragment_counter is the number of succeeding payloads. After
+    // normalization (`255 - counter`), a complete non-wrapping chain is strictly
+    // consecutive. This also caps a data unit at 256 payloads.
+    for (let i = 1; i < sorted.length; i++) {
+      if (this.#orderValue(sorted[i]!) !== this.#orderValue(sorted[i - 1]!) + 1) {
+        return null
+      }
+    }
+
+    // When every fragment carries a timed-MFU byte offset, independently prove
+    // byte adjacency within this data unit. Counter order remains authoritative;
+    // conflicting offsets fail closed instead of changing the fragment order.
+    // sorted[0]'s offset is this DU's authored base (moqcast #37: zero for a
+    // whole-sample DU, nonzero for one subsample DU of a partitioned sample) --
+    // never asserted against a literal zero.
+    if (ordersByOffset(sorted)) {
+      for (let i = 1; i < sorted.length; i++) {
+        const previous = sorted[i - 1]!
+        if (sorted[i]!.sampleOffset !== previous.sampleOffset! + previous.data.byteLength) {
+          return null
+        }
+      }
+    }
+
+    fragments.splice(0, fragments.length, ...sorted)
+    return this.#assemble(bufferKey, fragments)
+  }
+
+  #assemble(bufferKey: string, fragments: MFUFragment[]): ReassembledMFU {
+    // Reassemble: concatenate all fragment data
+    const totalSize = fragments.reduce((sum, f) => sum + f.data.length, 0)
+    const data = new Uint8Array(totalSize)
+
+    let offset = 0
+    for (const fragment of fragments) {
+      data.set(fragment.data, offset)
+      offset += fragment.data.length
+    }
+
+    // Cleanup + mark the intrinsic identity as emitted to prevent a recovered
+    // duplicate from starting another fragmented run.
+    this.#clearTimeout(bufferKey)
+    this.#buffers.delete(bufferKey)
+    this.#markEmitted(bufferKey)
+    this.stats.reassembledMFUs++
+
+    return {
+      mpuSequenceNumber: fragments[0]!.mpuSequenceNumber,
+      packetSequenceNumber: fragments[0]!.packetSequenceNumber,
+      ...assembledPacketSequences(fragments),
+      data,
+      timestamp: fragments[0]!.timestamp,
+      fragmentCount: fragments.length,
+      rapFlag: fragments[0]!.rapFlag,
+      priority: fragments.find(f => f.priority !== undefined)?.priority,
+      sampleNumber: fragments[0]!.sampleNumber,
+      movieFragmentSequenceNumber: fragments[0]!.movieFragmentSequenceNumber,
+      sampleOffset: fragments[0]!.sampleOffset,
+      source: fragments[0]!.source,
+      deliveryProvenance: deliveryProvenanceOf(fragments),
+      catalogTrackName: fragments[0]!.catalogTrackName,
+    }
+  }
+
+  #setTimeout(bufferKey: string, startedAt = Date.now()): void {
+    const state: BufferTimeoutState = { startedAt }
+    if (this.#timeoutMs !== null) {
+      state.timeoutId = setTimeout(
+        () => this.#onTimeout(bufferKey),
+        Math.max(0, startedAt + this.#timeoutMs - Date.now())
+      )
+    }
+    this.#timeouts.set(bufferKey, state)
+  }
+
+  #clearPendingTimeout(address: string): void {
+    const pending = this.#pendingContinuations.get(address)
+    if (pending?.timeoutId !== undefined) clearTimeout(pending.timeoutId)
+    if (pending !== undefined) {
+      delete pending.timeoutId
+    }
+  }
+
+  /**
+   * A queue whose run closed without completing is headless again and expires
+   * from its own first arrival, exactly as it would had the head never come.
+   *
+   * An empty queue is not armed: it holds no data unit that could fail to
+   * complete, so there is nothing for a deadline to expire. Every arming site
+   * reaches this function, which takes that test through `parkedRunHoldsASlot`
+   * rather than filtering on the open run alone, which is how this engine
+   * reaches Rust's answer: its
+   * `next_timeout_at` derives candidate deadlines from the queue's live
+   * entries, so an empty queue yields none (BLO-32420).
+   */
+  #armHeadlessPendingTimeout(address: string): void {
+    const pending = this.#pendingContinuations.get(address)
+    if (pending === undefined || pending.timeoutId !== undefined || this.#timeoutMs === null) return
+    if (!parkedRunHoldsASlot(this.#openRunAt(address) !== undefined, pending.fragments.size)) return
+    pending.timeoutId = setTimeout(
+      () => this.#onPendingTimeout(address),
+      Math.max(0, pending.startedAt + this.#timeoutMs - Date.now())
+    )
+  }
+
+  #deletePendingRun(address: string): void {
+    this.#clearPendingTimeout(address)
+    this.#pendingContinuations.delete(address)
+  }
+
+  #onPendingTimeout(address: string): void {
+    const pending = this.#pendingContinuations.get(address)
+    if (pending === undefined) return
+    // The charging site takes the same slot rule as the arming sites, evaluated
+    // live at expiry the way Rust's `cleanup_timeouts` evaluates it at sweep
+    // time: a queue that holds no slot is retained rather than charged
+    // `record_policy_timeout`. That makes "an empty queue is never charged a
+    // timeout" a property of this method, not of arming order. The fired timer
+    // is released so a later re-park can arm the queue again.
+    if (!parkedRunHoldsASlot(this.#openRunAt(address) !== undefined, pending.fragments.size)) {
+      this.#clearPendingTimeout(address)
+      return
+    }
+    this.stats.timedOutMFUs++
+    console.warn(
+      `[MfuReassembler] timeout: run=${address} fragments=${pending.fragments.size} ` +
+        '(continuations awaiting first fragment, discarded)'
+    )
+    this.#pendingContinuations.delete(address)
+  }
+
+  #clearTimeout(bufferKey: string): void {
+    const state = this.#timeouts.get(bufferKey)
+    if (state !== undefined) {
+      if (state.timeoutId !== undefined) clearTimeout(state.timeoutId)
+      this.#timeouts.delete(bufferKey)
+    }
+  }
+
+  /** Callback for deferred assembly results (set by caller for async frame delivery) */
+  onDeferredAssembly?: (result: ReassembledMFU) => void
+
+  #markEmitted(bufferKey: string): void {
+    if (this.#emitted.has(bufferKey)) return
+    this.#emitted.add(bufferKey)
+    this.#emittedOrder.push(bufferKey)
+    while (this.#emittedOrder.length > this.#maxBuffered) {
+      const oldest = this.#emittedOrder.shift()
+      if (oldest !== undefined) this.#emitted.delete(oldest)
+    }
+  }
+
+  #markCompleted(address: string): void {
+    if (this.#completed.has(address)) return
+    this.#completed.add(address)
+    this.#completedOrder.push(address)
+    const cap = this.#maxBuffered * COMPLETED_ADDRESS_WINDOW_MULTIPLE
+    while (this.#completedOrder.length > cap) {
+      const oldest = this.#completedOrder.shift()
+      if (oldest !== undefined) this.#completed.delete(oldest)
+    }
+  }
+
+  #orderValue(fragment: MFUFragment): number {
+    return fragmentCounterOrder(fragment)
+  }
+
+  /** Close the run behind an expired buffer. Early arrivals parked under its
+   * address stay, now headless, and expire from their own arrival. */
+  #removeActiveDataUnitForBuffer(bufferKey: string): void {
+    for (const [objectKey, active] of this.#activeDataUnits) {
+      if (active.bufferKey === bufferKey) {
+        this.#activeDataUnits.delete(objectKey)
+        this.#armHeadlessPendingTimeout(active.address)
+      }
+    }
+  }
+
+  /** The one open run holding this address, with its object key. Admission
+   * rejects a second head on an open address, so at most one run can match. */
+  #openRunAt(address: string): readonly [string, ActiveDataUnit] | undefined {
+    for (const entry of this.#activeDataUnits) {
+      if (entry[1].address === address) return entry
+    }
+    return undefined
+  }
+
+  #onTimeout(bufferKey: string): void {
+    const fragments = this.#buffers.get(bufferKey)
+    if (!fragments || fragments.length === 0) {
+      this.#buffers.delete(bufferKey)
+      this.#timeouts.delete(bufferKey)
+      this.#removeActiveDataUnitForBuffer(bufferKey)
+      this.stats.timedOutMFUs++
+      console.warn(`[MfuReassembler] timeout: key=${bufferKey} fragments=0 (no data buffered)`)
+      return
+    }
+
+    // Discard partial MFUs — incomplete AVCC data crashes WebCodecs with
+    // "Unable to determine size of bitstream buffer".  FEC recovery handles
+    // loss; partial assembly only produces garbage frames.
+    this.stats.timedOutMFUs++
+    console.warn(`[MfuReassembler] timeout: key=${bufferKey} fragments=${fragments.length} (partial, discarded)`)
+
+    this.#buffers.delete(bufferKey)
+    this.#timeouts.delete(bufferKey)
+    this.#removeActiveDataUnitForBuffer(bufferKey)
+  }
+
+  /**
+   * Flush all buffered fragments
+   */
+  flush(): void {
+    for (const key of this.#buffers.keys()) {
+      this.#clearTimeout(key)
+    }
+    this.#buffers.clear()
+    this.#timeouts.clear()
+    this.#activeDataUnits.clear()
+    for (const address of this.#pendingContinuations.keys()) {
+      this.#clearPendingTimeout(address)
+    }
+    this.#pendingContinuations.clear()
+    this.#emitted.clear()
+    this.#emittedOrder.length = 0
+    this.#completed.clear()
+    this.#completedOrder.length = 0
+  }
+
+  /** Drop one catalog stream's incomplete and dedup state. */
+  resetStream(catalogTrackName: string): void {
+    const belongsToStream = (key: string): boolean => {
+      try {
+        const decoded = JSON.parse(key)
+        return Array.isArray(decoded) && decoded[0] === 'catalog' && decoded[1] === catalogTrackName
+      } catch {
+        return false
+      }
+    }
+    const discarded = new Set<string>()
+    for (const [key, fragments] of this.#buffers) {
+      if (fragments.some(fragment => fragment.catalogTrackName === catalogTrackName)) {
+        discarded.add(key)
+      }
+    }
+    for (const [objectKey, active] of this.#activeDataUnits) {
+      if (active.catalogTrackName === catalogTrackName) {
+        discarded.add(active.bufferKey)
+        this.#activeDataUnits.delete(objectKey)
+      }
+    }
+    for (const [address, pending] of this.#pendingContinuations) {
+      if (
+        [...pending.fragments.values()].some(fragment => fragment.catalogTrackName === catalogTrackName) ||
+        belongsToStream(address)
+      )
+        this.#deletePendingRun(address)
+    }
+    for (const key of this.#emitted) {
+      if (belongsToStream(key)) discarded.add(key)
+    }
+    for (const key of discarded) {
+      this.#clearTimeout(key)
+      this.#buffers.delete(key)
+      this.#emitted.delete(key)
+    }
+    this.#emittedOrder = this.#emittedOrder.filter(key => !discarded.has(key))
+    for (const address of this.#completed) {
+      if (belongsToStream(address)) this.#completed.delete(address)
+    }
+    this.#completedOrder = this.#completedOrder.filter(address => this.#completed.has(address))
+  }
+
+  /** Reset all state — flush buffers and zero stats */
+  reset(): void {
+    this.flush()
+    this.stats.totalFragments = 0
+    this.stats.reassembledMFUs = 0
+    this.stats.rejectedFragments = 0
+    this.stats.timedOutMFUs = 0
+    this.stats.evictedMemoryLimit = 0
+    this.stats.outOfOrderFragments = 0
+  }
+
+  /**
+   * Get number of pending MFUs: engine buffers plus every headless parked data
+   * unit that holds a slot.
+   *
+   * This is not one of the four charging sites, but it shares their second term,
+   * so it takes the same rule — by delegating to `#unopenedParkedRunCount`, the
+   * one site that applies it. Rust's public `buffered_count()` is
+   * `inner.buffered_count() + unopened_parked_run_count()`, and that count is
+   * `parked_run_holds_a_slot` — so filtering here on the open run alone would
+   * report a phantom slot for an empty published queue in TypeScript and not in
+   * Rust, out of a *host-observable* counter (`getStatus().bufferedMFUs`). Same
+   * state, two numbers, decided by which engine the host loaded: the divergence
+   * class this file exists to close, so the public counters have to agree too.
+   *
+   * Distinct from `#incompleteRunCount`, which sums `#activeDataUnits` rather
+   * than `#buffers`. Those are different quantities by design and are not being
+   * merged; only the parked term they share is required to agree, which is what
+   * routing both through one method makes structural rather than conventional.
+   */
+  get pendingCount(): number {
+    return this.#buffers.size + this.#unopenedParkedRunCount()
+  }
+
+  /**
+   * Get current buffer status
+   */
+  getStatus(): {
+    bufferedMFUs: number
+    pendingFragments: number
+    pendingSamples: PendingMfuDebug[]
+    stats: ReassemblerStats
+  } {
+    let pendingFragments = 0
+    for (const fragments of this.#buffers.values()) {
+      pendingFragments += fragments.length
+    }
+    for (const pending of this.#pendingContinuations.values()) {
+      pendingFragments += pending.fragments.size
+    }
+
+    return {
+      bufferedMFUs: this.pendingCount,
+      pendingFragments,
+      pendingSamples: this.#pendingDebugSamples(),
+      stats: { ...this.stats },
+    }
+  }
+
+  #pendingDebugSamples(): PendingMfuDebug[] {
+    const out: PendingMfuDebug[] = []
+    for (const [key, fragments] of this.#buffers) {
+      if (fragments.length === 0) continue
+      const sorted = [...fragments].sort((a, b) => this.#orderValue(a) - this.#orderValue(b))
+      const fiCounts = [0, 0, 0, 0]
+      let minCounter = Infinity
+      let maxCounter = -Infinity
+      let minOffset = Infinity
+      let maxOffset = -Infinity
+      for (const fragment of sorted) {
+        fiCounts[fragment.fragmentationIndicator] = (fiCounts[fragment.fragmentationIndicator] ?? 0) + 1
+        minCounter = Math.min(minCounter, fragment.fragmentCounter)
+        maxCounter = Math.max(maxCounter, fragment.fragmentCounter)
+        if (typeof fragment.sampleOffset === 'number') {
+          minOffset = Math.min(minOffset, fragment.sampleOffset)
+          maxOffset = Math.max(maxOffset, fragment.sampleOffset)
+        }
+      }
+      const point = (fragment: MFUFragment) => ({
+        fi: fragment.fragmentationIndicator,
+        counter: fragment.fragmentCounter,
+        order: this.#orderValue(fragment),
+        ...(typeof fragment.packetSequenceNumber === 'number' ? { seq: fragment.packetSequenceNumber } : {}),
+        ...(typeof fragment.sampleOffset === 'number' ? { offset: fragment.sampleOffset } : {}),
+      })
+      const summary: PendingMfuDebug = {
+        key,
+        fragments: sorted.length,
+        fi0: fiCounts[0] ?? 0,
+        fi1: fiCounts[1] ?? 0,
+        fi2: fiCounts[2] ?? 0,
+        fi3: fiCounts[3] ?? 0,
+        firstFi: sorted[0]!.fragmentationIndicator,
+        lastFi: sorted[sorted.length - 1]!.fragmentationIndicator,
+        firstOrder: this.#orderValue(sorted[0]!),
+        lastOrder: this.#orderValue(sorted[sorted.length - 1]!),
+        minCounter,
+        maxCounter,
+        movieFragmentSequenceNumber: sorted.find(f => f.movieFragmentSequenceNumber !== undefined)
+          ?.movieFragmentSequenceNumber,
+        sampleNumber: sorted.find(f => f.sampleNumber !== undefined)?.sampleNumber,
+        mpuSequenceNumber: sorted[0]!.mpuSequenceNumber,
+        sortedHead: sorted.slice(0, 6).map(point),
+        sortedTail: sorted.slice(-6).map(point),
+      }
+      if (minOffset !== Infinity) summary.minOffset = minOffset
+      if (maxOffset !== -Infinity) summary.maxOffset = maxOffset
+      out.push(summary)
+      if (out.length >= 12) break
+    }
+    return out
+  }
+}
+
+/**
+ * Create MFU fragment from MMTP packet for reassembly
+ */
+export function createFragment(mmtpPacket: Uint8Array): MFUFragment {
+  const extraction = extractMFUPayload(mmtpPacket)
+  if (!extraction) throw new Error('Unable to extract MFU payload from MMTP packet')
+  const { header, mpu, data, mfuDuHeader, itemId } = extraction
+
+  return {
+    fragmentationIndicator: mpu.fragmentationIndicator,
+    mpuSequenceNumber: mpu.mpuSequenceNumber,
+    fragmentCounter: mpu.fragmentCounter,
+    data,
+    timestamp: header.timestamp,
+    rapFlag: header.rapFlag,
+    sampleNumber: mfuDuHeader?.sampleNumber,
+    movieFragmentSequenceNumber: mfuDuHeader?.movieFragmentSequenceNumber,
+    sampleOffset: mfuDuHeader?.offset,
+    priority: mfuDuHeader?.priority,
+    itemId: itemId ?? undefined,
+    packetSequenceNumber: header.sequenceNumber,
+    packetId: header.packetId,
+  }
+}
+
+/**
+ * Process MMTP packet with fragment reassembly
+ */
+export function processMMTPWithReassembly(mmtpPacket: Uint8Array, reassembler: MFUReassembler): ReassembledMFU | null {
+  // Skip FEC repair packets
+  if (isFecRepairPacket(mmtpPacket)) {
+    return null
+  }
+
+  const fragment = createFragment(mmtpPacket)
+  return reassembler.addFragment(fragment)
+}
+
+// =============================================================================
+// Inline Tests (vitest)
+// =============================================================================
+
+if (import.meta.vitest) {
+  const { describe, test, expect, vi } = import.meta.vitest
+
+  const expectRejection = (call: () => unknown, code: MfuReassemblyErrorCode): void => {
+    let rejection: unknown
+    try {
+      call()
+    } catch (error) {
+      rejection = error
+    }
+    expect(rejection).toBeInstanceOf(MfuReassemblyError)
+    expect((rejection as MfuReassemblyError).code).toBe(code)
+  }
+
+  const testPacketSequence = (mpu: number, counter: number, run = 0): number =>
+    (mpu * 1000 + run - counter + 0x1_0000_0000) % 0x1_0000_0000
+
+  describe('MFUReassembler', () => {
+    test('should return complete MFU for FI=0', () => {
+      const reassembler = new MFUReassembler({ timeoutMs: 1000 })
+      const result = reassembler.addFragment({
+        fragmentationIndicator: 0,
+        mpuSequenceNumber: 1,
+        fragmentCounter: 0,
+        itemId: 1,
+        data: new Uint8Array([1, 2, 3, 4]),
+        timestamp: 1000n,
+
+        rapFlag: true,
+      })
+      expect(result).not.toBeNull()
+      expect(result?.data).toEqual(new Uint8Array([1, 2, 3, 4]))
+      expect(result?.fragmentCount).toBe(1)
+      expect(result?.rapFlag).toBe(true)
+    })
+
+    test('rejects a complete MFU without a valid sample identity', () => {
+      const reassembler = new MFUReassembler({ timeoutMs: 1000 })
+      const complete = (identity: Partial<MFUFragment>): MFUFragment => ({
+        fragmentationIndicator: 0,
+        mpuSequenceNumber: 1,
+        fragmentCounter: 0,
+        data: new Uint8Array([1]),
+        timestamp: 1000n,
+        rapFlag: true,
+        ...identity,
+      })
+      expectRejection(() => reassembler.addFragment(complete({})), 'missing-data-unit-identity')
+      expectRejection(
+        () =>
+          reassembler.addFragment(
+            complete({
+              movieFragmentSequenceNumber: 2,
+              sampleNumber: 1,
+            })
+          ),
+        'missing-data-unit-identity'
+      )
+    })
+
+    test('accepts a complete subsample MFU with a nonzero authored offset', () => {
+      // moqcast #37: a subsample DU's offset is its authored base byte
+      // position within the sample -- nonzero identifies one subsample DU
+      // among siblings partitioning an oversized sample.
+      const reassembler = new MFUReassembler({ timeoutMs: 1000 })
+      const result = reassembler.addFragment({
+        fragmentationIndicator: 0,
+        mpuSequenceNumber: 1,
+        fragmentCounter: 0,
+        movieFragmentSequenceNumber: 2,
+        sampleNumber: 1,
+        sampleOffset: 4,
+        data: new Uint8Array([1]),
+        timestamp: 1000n,
+        rapFlag: true,
+      })
+      expect(result).not.toBeNull()
+      expect(result?.sampleOffset).toBe(4)
+    })
+
+    test('accepts a fragmented subsample DU whose first fragment has a nonzero authored offset', () => {
+      const reassembler = new MFUReassembler({ timeoutMs: 1000 })
+
+      expect(
+        reassembler.addFragment({
+          fragmentationIndicator: 1,
+          mpuSequenceNumber: 2,
+          fragmentCounter: 1,
+          movieFragmentSequenceNumber: 2,
+          sampleNumber: 1,
+          sampleOffset: 4,
+          packetSequenceNumber: testPacketSequence(2, 1),
+          data: new Uint8Array([0xa1]),
+          timestamp: 1000n,
+          rapFlag: true,
+        })
+      ).toBeNull()
+      expect(reassembler.pendingCount).toBe(1)
+      expect(reassembler.getStatus().pendingFragments).toBe(1)
+
+      const out = reassembler.addFragment({
+        fragmentationIndicator: 3,
+        mpuSequenceNumber: 2,
+        fragmentCounter: 0,
+        data: new Uint8Array([0xa2]),
+        timestamp: 1001n,
+        rapFlag: false,
+        packetSequenceNumber: testPacketSequence(2, 0),
+      })
+      expect(out?.data).toEqual(new Uint8Array([0xa1, 0xa2]))
+      expect(out?.sampleOffset).toBe(4)
+    })
+
+    // Rust twin: `a_mid_data_unit_sequence_gap_strands_the_data_unit` in
+    // `mmt-core/src/reassembler/policy/mmt.rs`.
+    //
+    // One data unit's fragments occupy sequences 100, 102, 103 with an
+    // unrelated complete unit at 101 -- an interleave *inside* the fragmented
+    // unit rather than after it. ISO/IEC 23008-1 permits that, so this is the
+    // boundary of the contiguous-source producer profile, not a bug within it.
+    //
+    // This test exists because no fixture in either corpus could previously
+    // express a mid-data-unit sequence gap at all: the helpers derive
+    // continuation sequences arithmetically from the head, so every fixture
+    // was contiguous by construction and the profile's edge was untestable
+    // (BLO-33550). It pins current behaviour rather than the guarantee we
+    // would prefer -- change the association path and update it deliberately.
+    test('a mid-data-unit packet sequence gap strands the data unit', () => {
+      const reassembler = new MFUReassembler({ timeoutMs: null, maxBuffered: 10 })
+
+      expect(
+        reassembler.addFragment({
+          fragmentationIndicator: 1,
+          mpuSequenceNumber: 7,
+          fragmentCounter: 2,
+          movieFragmentSequenceNumber: 9,
+          sampleNumber: 17,
+          sampleOffset: 0,
+          packetSequenceNumber: 100,
+          data: new Uint8Array([0xa1]),
+          timestamp: 1100n,
+          rapFlag: true,
+        })
+      ).toBeNull()
+
+      // An unrelated complete unit of the same MPU consumes sequence 101,
+      // *between* the fragmented unit's head and its next fragment.
+      const interleaved = reassembler.addFragment({
+        fragmentationIndicator: 0,
+        mpuSequenceNumber: 7,
+        fragmentCounter: 0,
+        movieFragmentSequenceNumber: 9,
+        sampleNumber: 18,
+        sampleOffset: 0,
+        packetSequenceNumber: 101,
+        data: new Uint8Array([0xff]),
+        timestamp: 1101n,
+        rapFlag: true,
+      })
+      expect(interleaved?.data).toEqual(new Uint8Array([0xff]))
+
+      expect(
+        reassembler.addFragment({
+          fragmentationIndicator: 2,
+          mpuSequenceNumber: 7,
+          fragmentCounter: 1,
+          packetSequenceNumber: 102,
+          data: new Uint8Array([0xa2]),
+          timestamp: 1102n,
+          rapFlag: false,
+        })
+      ).toBeNull()
+
+      const output = reassembler.addFragment({
+        fragmentationIndicator: 3,
+        mpuSequenceNumber: 7,
+        fragmentCounter: 0,
+        packetSequenceNumber: 103,
+        data: new Uint8Array([0xa3]),
+        timestamp: 1103n,
+        rapFlag: false,
+      })
+
+      // What we would want, and do not get: `output` carrying a1 a2 a3. The
+      // head addresses 100+2=102; both continuations address 102+1 = 103+0 =
+      // 103, so they are two data units and neither can complete.
+      expect(output).toBeNull()
+
+      // Fail-closed, not corrupt: only the interleaver emitted, and no
+      // fragment was donated across data units.
+      expect(reassembler.stats.reassembledMFUs).toBe(1)
+      expect(reassembler.stats.rejectedFragments).toBe(0)
+
+      // The loss is invisible at this scale -- since BLO-31513 the bound is
+      // enforced by replacement, so at `maxBuffered` this same stranding is
+      // charged only to `evictedMemoryLimit` and presents as intermittent
+      // missing media rather than an error.
+      expect(reassembler.stats.evictedMemoryLimit).toBe(0)
+
+      // Two slots for one data unit -- the open run at 102 plus the headless
+      // parked queue at 103 -- so sustained profile-violating interleave
+      // consumes `maxBuffered` at twice the expected rate and evicts healthy
+      // data units alongside the stranded one. Matches the Rust twin's
+      // `buffered_count() == 2` / `pending_fragment_count() == 3`.
+      expect(reassembler.getStatus().bufferedMFUs).toBe(2)
+      expect(reassembler.getStatus().pendingFragments).toBe(3)
+    })
+
+    test('sibling subsample DUs of one sample reassemble independently by offset', () => {
+      // moqcast #37: each subsample DU of a partitioned sample runs its own
+      // FI chain and gets its own buffer, keyed in part by its authored base
+      // offset -- distinct from a sibling DU sharing (movie, sample).
+      const reassembler = new MFUReassembler({ timeoutMs: 1000 })
+
+      expect(
+        reassembler.addFragment({
+          mpuSequenceNumber: 3,
+          movieFragmentSequenceNumber: 5,
+          sampleNumber: 9,
+          fragmentationIndicator: 1,
+          fragmentCounter: 1,
+          sampleOffset: 0,
+          data: new Uint8Array([0xa1]),
+          timestamp: 2000n,
+          rapFlag: true,
+          packetSequenceNumber: testPacketSequence(3, 1, 0),
+        })
+      ).toBeNull()
+      // The sibling's head sits at its own packet sequence, so its address
+      // (packetSequenceNumber + fragmentCounter) differs from the first's.
+      // Both stay open at once and every headerless continuation names exactly
+      // one of them by that address. A second head on an already-open address
+      // is refused instead ('rejects an overlapping non-timed item without
+      // replacing the active run').
+      expect(
+        reassembler.addFragment({
+          mpuSequenceNumber: 3,
+          movieFragmentSequenceNumber: 5,
+          sampleNumber: 9,
+          fragmentationIndicator: 1,
+          fragmentCounter: 2,
+          sampleOffset: 3,
+          data: new Uint8Array([0xb1]),
+          timestamp: 2001n,
+          rapFlag: false,
+          packetSequenceNumber: testPacketSequence(3, 1, 1),
+        })
+      ).toBeNull()
+      expect(reassembler.pendingCount).toBe(2)
+
+      const first = reassembler.addFragment({
+        mpuSequenceNumber: 3,
+        fragmentationIndicator: 3,
+        fragmentCounter: 0,
+        data: new Uint8Array([0xa2]),
+        timestamp: 2000n,
+        rapFlag: false,
+        packetSequenceNumber: testPacketSequence(3, 0, 0),
+      })
+      expect(first?.data).toEqual(new Uint8Array([0xa1, 0xa2]))
+      expect(first?.sampleOffset).toBe(0)
+
+      expect(
+        reassembler.addFragment({
+          mpuSequenceNumber: 3,
+          fragmentationIndicator: 2,
+          fragmentCounter: 1,
+          data: new Uint8Array([0xb2]),
+          timestamp: 2001n,
+          rapFlag: false,
+          packetSequenceNumber: testPacketSequence(3, 0, 1),
+        })
+      ).toBeNull()
+      const second = reassembler.addFragment({
+        mpuSequenceNumber: 3,
+        fragmentationIndicator: 3,
+        fragmentCounter: 0,
+        data: new Uint8Array([0xb3]),
+        timestamp: 2001n,
+        rapFlag: false,
+        packetSequenceNumber: testPacketSequence(3, 0, 2),
+      })
+      expect(second?.data).toEqual(new Uint8Array([0xb1, 0xb2, 0xb3]))
+      expect(second?.sampleOffset).toBe(3)
+      expect(reassembler.pendingCount).toBe(0)
+    })
+
+    test('isolates colliding fragment coordinates by catalog track identity', () => {
+      const reassembler = new MFUReassembler({ timeoutMs: 1000 })
+      const fragment = (
+        catalogTrackName: string,
+        fragmentationIndicator: number,
+        fragmentCounter: number,
+        byte: number
+      ): MFUFragment => ({
+        itemId: 1,
+        fragmentationIndicator,
+        fragmentCounter,
+        mpuSequenceNumber: 1,
+        data: new Uint8Array([byte]),
+        timestamp: 1000n,
+        rapFlag: fragmentationIndicator === 1,
+        catalogTrackName,
+        packetSequenceNumber: testPacketSequence(1, fragmentCounter),
+      })
+
+      expect(reassembler.addFragment(fragment('video/720p', 1, 1, 0x71))).toBeNull()
+      expect(reassembler.addFragment(fragment('video/540p', 1, 1, 0x51))).toBeNull()
+      const high = reassembler.addFragment(fragment('video/720p', 3, 0, 0x72))
+      const low = reassembler.addFragment(fragment('video/540p', 3, 0, 0x52))
+
+      expect(high?.data).toEqual(new Uint8Array([0x71, 0x72]))
+      expect(high?.catalogTrackName).toBe('video/720p')
+      expect(low?.data).toEqual(new Uint8Array([0x51, 0x52]))
+      expect(low?.catalogTrackName).toBe('video/540p')
+    })
+
+    test('rejects an overlapping non-timed item without replacing the active run', () => {
+      const reassembler = new MFUReassembler({ timeoutMs: 1000 })
+      const fragment = (
+        itemId: number,
+        fragmentationIndicator: number,
+        fragmentCounter: number,
+        byte: number
+      ): MFUFragment => ({
+        itemId,
+        fragmentationIndicator,
+        fragmentCounter,
+        mpuSequenceNumber: 1,
+        data: new Uint8Array([byte]),
+        timestamp: 1000n,
+        rapFlag: false,
+        packetSequenceNumber: testPacketSequence(1, fragmentCounter),
+      })
+
+      expect(reassembler.addFragment(fragment(10, 1, 1, 0x10))).toBeNull()
+      expectRejection(() => reassembler.addFragment(fragment(20, 1, 1, 0x20)), 'overlapping-data-unit')
+      expect(reassembler.pendingCount).toBe(1)
+      expect(reassembler.addFragment(fragment(10, 3, 0, 0x11))?.data).toEqual(new Uint8Array([0x10, 0x11]))
+      expect(reassembler.pendingCount).toBe(0)
+    })
+
+    test('associates continuations by authored state when packet timestamps change', () => {
+      const reassembler = new MFUReassembler({ timeoutMs: 1000 })
+      const fragment = (
+        itemId: number | undefined,
+        fragmentationIndicator: number,
+        fragmentCounter: number,
+        byte: number,
+        timestamp: bigint
+      ): MFUFragment => ({
+        ...(itemId === undefined ? {} : { itemId }),
+        fragmentationIndicator,
+        fragmentCounter,
+        mpuSequenceNumber: 1,
+        data: new Uint8Array([byte]),
+        timestamp,
+        rapFlag: false,
+        packetSequenceNumber: testPacketSequence(1, fragmentCounter),
+      })
+
+      expect(reassembler.addFragment(fragment(10, 1, 2, 0x10, 1000n))).toBeNull()
+      expect(reassembler.addFragment(fragment(undefined, 2, 1, 0x11, 1001n))).toBeNull()
+      const out = reassembler.addFragment(fragment(undefined, 3, 0, 0x12, 1002n))
+      expect(out?.data).toEqual(new Uint8Array([0x10, 0x11, 0x12]))
+      expect(out?.timestamp).toBe(1000n)
+    })
+
+    test('should buffer and reassemble 2 fragments', () => {
+      const reassembler = new MFUReassembler({ timeoutMs: 1000 })
+
+      // First fragment (FI=1)
+      const result1 = reassembler.addFragment({
+        fragmentationIndicator: 1,
+        mpuSequenceNumber: 1,
+        fragmentCounter: 1,
+        itemId: 1,
+        data: new Uint8Array([1, 2]),
+        timestamp: 1000n,
+        rapFlag: true,
+        packetSequenceNumber: testPacketSequence(1, 1),
+      })
+      expect(result1).toBeNull()
+
+      // Last fragment (FI=3)
+      const result2 = reassembler.addFragment({
+        fragmentationIndicator: 3,
+        mpuSequenceNumber: 1,
+        fragmentCounter: 0,
+        data: new Uint8Array([3, 4]),
+        timestamp: 1000n,
+        rapFlag: false,
+        packetSequenceNumber: testPacketSequence(1, 0),
+      })
+      expect(result2).not.toBeNull()
+      expect(result2?.data).toEqual(new Uint8Array([1, 2, 3, 4]))
+      expect(result2?.fragmentCount).toBe(2)
+      expect(result2?.rapFlag).toBe(true) // Should use first fragment's rapFlag
+    })
+
+    test('buffers a terminal continuation until its authored first fragment arrives', () => {
+      const reassembler = new MFUReassembler({ timeoutMs: 1000 })
+
+      // Last fragment first (FI=3)
+      expect(
+        reassembler.addFragment({
+          fragmentationIndicator: 3,
+          mpuSequenceNumber: 1,
+          fragmentCounter: 0,
+          data: new Uint8Array([3, 4]),
+          timestamp: 1000n,
+          rapFlag: false,
+          packetSequenceNumber: testPacketSequence(1, 0),
+        })
+      ).toBeNull()
+      expect(reassembler.pendingCount).toBe(1)
+
+      // Then first fragment (FI=1)
+      const completed = reassembler.addFragment({
+        fragmentationIndicator: 1,
+        mpuSequenceNumber: 1,
+        fragmentCounter: 1,
+        itemId: 1,
+        data: new Uint8Array([1, 2]),
+        timestamp: 1000n,
+        rapFlag: true,
+        packetSequenceNumber: testPacketSequence(1, 1),
+      })
+
+      expect(completed?.data).toEqual(new Uint8Array([1, 2, 3, 4]))
+      expect(completed?.rapFlag).toBe(true)
+      expect(reassembler.pendingCount).toBe(0)
+    })
+
+    test('clock-free mode keeps an admitted MFU until completion', async () => {
+      const reassembler = new MFUReassembler({ timeoutMs: null })
+
+      reassembler.addFragment({
+        fragmentationIndicator: 1,
+        mpuSequenceNumber: 1,
+        fragmentCounter: 1,
+        itemId: 1,
+        data: new Uint8Array([1, 2]),
+        timestamp: 1000n,
+        rapFlag: true,
+        packetSequenceNumber: testPacketSequence(1, 1),
+      })
+
+      await new Promise(resolve => setTimeout(resolve, 5))
+
+      const result = reassembler.addFragment({
+        fragmentationIndicator: 3,
+        mpuSequenceNumber: 1,
+        fragmentCounter: 0,
+        data: new Uint8Array([3, 4]),
+        timestamp: 1000n,
+        rapFlag: false,
+        packetSequenceNumber: testPacketSequence(1, 0),
+      })
+
+      expect(result).not.toBeNull()
+      expect(result?.data).toEqual(new Uint8Array([1, 2, 3, 4]))
+      expect(reassembler.stats.timedOutMFUs).toBe(0)
+    })
+
+    test('should track pending count', () => {
+      const reassembler = new MFUReassembler({ timeoutMs: 1000 })
+      expect(reassembler.pendingCount).toBe(0)
+
+      reassembler.addFragment({
+        fragmentationIndicator: 1,
+        mpuSequenceNumber: 1,
+        fragmentCounter: 1,
+        itemId: 1,
+        data: new Uint8Array([1]),
+        timestamp: 1000n,
+        rapFlag: false,
+        packetSequenceNumber: testPacketSequence(1, 1),
+      })
+      expect(reassembler.pendingCount).toBe(1)
+
+      reassembler.flush()
+      expect(reassembler.pendingCount).toBe(0)
+    })
+
+    test('should reassemble 3 fragments (FI=1, FI=2, FI=3)', () => {
+      const reassembler = new MFUReassembler({ timeoutMs: 1000 })
+
+      // First fragment
+      expect(
+        reassembler.addFragment({
+          fragmentationIndicator: 1,
+          mpuSequenceNumber: 10,
+          fragmentCounter: 2,
+          itemId: 1,
+          data: new Uint8Array([0xaa, 0xbb]),
+          timestamp: 5000n,
+          rapFlag: true,
+          packetSequenceNumber: testPacketSequence(10, 2),
+        })
+      ).toBeNull()
+
+      // Middle fragment
+      expect(
+        reassembler.addFragment({
+          fragmentationIndicator: 2,
+          mpuSequenceNumber: 10,
+          fragmentCounter: 1,
+          data: new Uint8Array([0xcc, 0xdd]),
+          timestamp: 5000n,
+          rapFlag: false,
+          packetSequenceNumber: testPacketSequence(10, 1),
+        })
+      ).toBeNull()
+
+      // Last fragment — triggers reassembly
+      const result = reassembler.addFragment({
+        fragmentationIndicator: 3,
+        mpuSequenceNumber: 10,
+        fragmentCounter: 0,
+        data: new Uint8Array([0xee, 0xff]),
+        timestamp: 5000n,
+        rapFlag: false,
+        packetSequenceNumber: testPacketSequence(10, 0),
+      })
+
+      expect(result).not.toBeNull()
+      expect(result!.data).toEqual(new Uint8Array([0xaa, 0xbb, 0xcc, 0xdd, 0xee, 0xff]))
+      expect(result!.fragmentCount).toBe(3)
+      expect(result!.rapFlag).toBe(true) // from first fragment
+      expect(result!.mpuSequenceNumber).toBe(10)
+    })
+
+    test('should handle interleaved MPU sequences', () => {
+      const reassembler = new MFUReassembler({ timeoutMs: 1000 })
+
+      // MPU 1: first fragment
+      reassembler.addFragment({
+        fragmentationIndicator: 1,
+        mpuSequenceNumber: 1,
+        fragmentCounter: 1,
+        itemId: 1,
+        data: new Uint8Array([0x01]),
+        timestamp: 100n,
+        rapFlag: false,
+        packetSequenceNumber: testPacketSequence(1, 1),
+      })
+      // MPU 2: complete (FI=0)
+      const r2 = reassembler.addFragment({
+        fragmentationIndicator: 0,
+        mpuSequenceNumber: 2,
+        fragmentCounter: 0,
+        itemId: 2,
+        data: new Uint8Array([0x02]),
+        timestamp: 200n,
+        rapFlag: false,
+      })
+      expect(r2).not.toBeNull()
+      expect(r2!.mpuSequenceNumber).toBe(2)
+
+      // MPU 1: last fragment
+      const r1 = reassembler.addFragment({
+        fragmentationIndicator: 3,
+        mpuSequenceNumber: 1,
+        fragmentCounter: 0,
+        data: new Uint8Array([0x03]),
+        timestamp: 100n,
+        rapFlag: false,
+        packetSequenceNumber: testPacketSequence(1, 0),
+      })
+      expect(r1).not.toBeNull()
+      expect(r1!.data).toEqual(new Uint8Array([0x01, 0x03]))
+    })
+
+    test('rejects overlapping fragmented MFUs sharing one stream and MPU', () => {
+      const reassembler = new MFUReassembler({ timeoutMs: 1000 })
+      const mpuSeq = 5
+
+      expect(
+        reassembler.addFragment({
+          fragmentationIndicator: 1,
+          mpuSequenceNumber: mpuSeq,
+          fragmentCounter: 1,
+          itemId: 10,
+          data: new Uint8Array([0xa1]),
+          timestamp: 100n,
+          rapFlag: true,
+          packetSequenceNumber: testPacketSequence(mpuSeq, 1),
+        })
+      ).toBeNull()
+      expectRejection(
+        () =>
+          reassembler.addFragment({
+            fragmentationIndicator: 1,
+            mpuSequenceNumber: mpuSeq,
+            fragmentCounter: 1,
+            itemId: 20,
+            data: new Uint8Array([0xb1]),
+            timestamp: 200n,
+            rapFlag: false,
+            packetSequenceNumber: testPacketSequence(mpuSeq, 1),
+          }),
+        'overlapping-data-unit'
+      )
+      expect(reassembler.pendingCount).toBe(1)
+
+      const a = reassembler.addFragment({
+        fragmentationIndicator: 3,
+        mpuSequenceNumber: mpuSeq,
+        fragmentCounter: 0,
+        data: new Uint8Array([0xa2]),
+        timestamp: 101n,
+        rapFlag: false,
+        packetSequenceNumber: testPacketSequence(mpuSeq, 0),
+      })
+      expect(a).not.toBeNull()
+      expect(a!.data).toEqual(new Uint8Array([0xa1, 0xa2]))
+      expect(a!.rapFlag).toBe(true) // from A's first fragment
+
+      expect(
+        reassembler.addFragment({
+          fragmentationIndicator: 1,
+          mpuSequenceNumber: mpuSeq,
+          fragmentCounter: 1,
+          itemId: 20,
+          data: new Uint8Array([0xb1]),
+          timestamp: 200n,
+          rapFlag: false,
+          packetSequenceNumber: testPacketSequence(mpuSeq, 1, 10),
+        })
+      ).toBeNull()
+      const b = reassembler.addFragment({
+        fragmentationIndicator: 3,
+        mpuSequenceNumber: mpuSeq,
+        fragmentCounter: 0,
+        data: new Uint8Array([0xb2]),
+        timestamp: 201n,
+        rapFlag: false,
+        packetSequenceNumber: testPacketSequence(mpuSeq, 0, 10),
+      })
+      expect(b).not.toBeNull()
+      expect(b!.data).toEqual(new Uint8Array([0xb1, 0xb2]))
+    })
+
+    test('reassembles FFmpeg timed MFU fragments by sample number and byte offset', () => {
+      const reassembler = new MFUReassembler({ timeoutMs: 1000 })
+      const common = {
+        mpuSequenceNumber: 0,
+        movieFragmentSequenceNumber: 9,
+        sampleNumber: 17,
+      }
+
+      expect(
+        reassembler.addFragment({
+          ...common,
+          fragmentationIndicator: 1,
+          fragmentCounter: 2,
+          sampleOffset: 0,
+          data: new Uint8Array([0xa1]),
+          timestamp: 1000n,
+          rapFlag: true,
+          packetSequenceNumber: testPacketSequence(0, 2),
+        })
+      ).toBeNull()
+      expect(
+        reassembler.addFragment({
+          ...common,
+          fragmentationIndicator: 2,
+          fragmentCounter: 1,
+          sampleOffset: 1,
+          data: new Uint8Array([0xb2]),
+          timestamp: 1001n,
+          rapFlag: false,
+          packetSequenceNumber: testPacketSequence(0, 1),
+        })
+      ).toBeNull()
+      const out = reassembler.addFragment({
+        ...common,
+        fragmentationIndicator: 3,
+        fragmentCounter: 0,
+        sampleOffset: 2,
+        data: new Uint8Array([0xc3]),
+        timestamp: 1002n,
+        rapFlag: false,
+        packetSequenceNumber: testPacketSequence(0, 0),
+      })
+
+      expect(out).not.toBeNull()
+      expect(out!.data).toEqual(new Uint8Array([0xa1, 0xb2, 0xc3]))
+      expect(out!.timestamp).toBe(1000n)
+      expect(out!.sampleNumber).toBe(17)
+      expect(out!.movieFragmentSequenceNumber).toBe(9)
+    })
+
+    test('buffers a counter gap without advancing the active data unit', () => {
+      const reassembler = new MFUReassembler({ timeoutMs: 1000 })
+      const common = {
+        mpuSequenceNumber: 0,
+        movieFragmentSequenceNumber: 9,
+        sampleNumber: 17,
+        timestamp: 1000n,
+        rapFlag: true,
+      }
+
+      expect(
+        reassembler.addFragment({
+          ...common,
+          fragmentationIndicator: 1,
+          fragmentCounter: 2,
+          sampleOffset: 0,
+          data: new Uint8Array([0xa1, 0xa2]),
+          packetSequenceNumber: testPacketSequence(0, 2),
+        })
+      ).toBeNull()
+      expect(
+        reassembler.addFragment({
+          ...common,
+          fragmentationIndicator: 3,
+          fragmentCounter: 0,
+          sampleOffset: 4,
+          data: new Uint8Array([0xc1, 0xc2]),
+          packetSequenceNumber: testPacketSequence(0, 0),
+        })
+      ).toBeNull()
+      expect(reassembler.pendingCount).toBe(1)
+
+      const out = reassembler.addFragment({
+        ...common,
+        fragmentationIndicator: 2,
+        fragmentCounter: 1,
+        sampleOffset: 2,
+        data: new Uint8Array([0xb1, 0xb2]),
+        packetSequenceNumber: testPacketSequence(0, 1),
+      })
+      expect(out?.data).toEqual(new Uint8Array([0xa1, 0xa2, 0xb1, 0xb2, 0xc1, 0xc2]))
+    })
+
+    test('reassembles first-only DU-header fragments across changing packet timestamps', () => {
+      const reassembler = new MFUReassembler({ timeoutMs: 1000 })
+
+      expect(
+        reassembler.addFragment({
+          fragmentationIndicator: 1,
+          mpuSequenceNumber: 44,
+          fragmentCounter: 2,
+          movieFragmentSequenceNumber: 9,
+          sampleNumber: 17,
+          sampleOffset: 0,
+          data: new Uint8Array([0xa1]),
+          timestamp: 12345n,
+          rapFlag: true,
+          packetSequenceNumber: testPacketSequence(44, 2),
+        })
+      ).toBeNull()
+      expect(
+        reassembler.addFragment({
+          fragmentationIndicator: 2,
+          mpuSequenceNumber: 44,
+          fragmentCounter: 1,
+          data: new Uint8Array([0xb2]),
+          timestamp: 12346n,
+          rapFlag: false,
+          packetSequenceNumber: testPacketSequence(44, 1),
+        })
+      ).toBeNull()
+      const out = reassembler.addFragment({
+        fragmentationIndicator: 3,
+        mpuSequenceNumber: 44,
+        fragmentCounter: 0,
+        data: new Uint8Array([0xc3]),
+        timestamp: 12347n,
+        rapFlag: false,
+        packetSequenceNumber: testPacketSequence(44, 0),
+      })
+
+      expect(out).not.toBeNull()
+      expect(out!.data).toEqual(new Uint8Array([0xa1, 0xb2, 0xc3]))
+      expect(out!.timestamp).toBe(12345n)
+      expect(out!.sampleNumber).toBe(17)
+      expect(out!.movieFragmentSequenceNumber).toBe(9)
+    })
+
+    test('reassembles first-only DU-header fragments with an ISO countdown', () => {
+      const reassembler = new MFUReassembler({ timeoutMs: 1000 })
+      const timestamp = 12345n
+
+      expect(
+        reassembler.addFragment({
+          fragmentationIndicator: 1,
+          mpuSequenceNumber: 44,
+          fragmentCounter: 3,
+          movieFragmentSequenceNumber: 9,
+          sampleNumber: 17,
+          sampleOffset: 0,
+          data: new Uint8Array([0xa1]),
+          timestamp,
+          rapFlag: true,
+          packetSequenceNumber: testPacketSequence(44, 3),
+        })
+      ).toBeNull()
+      expect(
+        reassembler.addFragment({
+          fragmentationIndicator: 2,
+          mpuSequenceNumber: 44,
+          fragmentCounter: 2,
+          data: new Uint8Array([0xb2]),
+          timestamp,
+          rapFlag: false,
+          packetSequenceNumber: testPacketSequence(44, 2),
+        })
+      ).toBeNull()
+      expect(
+        reassembler.addFragment({
+          fragmentationIndicator: 2,
+          mpuSequenceNumber: 44,
+          fragmentCounter: 1,
+          data: new Uint8Array([0xc3]),
+          timestamp,
+          rapFlag: false,
+          packetSequenceNumber: testPacketSequence(44, 1),
+        })
+      ).toBeNull()
+      const out = reassembler.addFragment({
+        fragmentationIndicator: 3,
+        mpuSequenceNumber: 44,
+        fragmentCounter: 0,
+        data: new Uint8Array([0xd4]),
+        timestamp,
+        rapFlag: false,
+        packetSequenceNumber: testPacketSequence(44, 0),
+      })
+
+      expect(out).not.toBeNull()
+      expect(out!.data).toEqual(new Uint8Array([0xa1, 0xb2, 0xc3, 0xd4]))
+      expect(out!.sampleNumber).toBe(17)
+      expect(out!.movieFragmentSequenceNumber).toBe(9)
+    })
+
+    test('rejects fragmented MFUs without an authored DU identity', () => {
+      const reassembler = new MFUReassembler({ timeoutMs: 1000 })
+      const timestamp = 22222n
+
+      expectRejection(
+        () =>
+          reassembler.addFragment({
+            fragmentationIndicator: 1,
+            mpuSequenceNumber: 55,
+            fragmentCounter: 2,
+            data: new Uint8Array([0xa1]),
+            timestamp,
+            rapFlag: true,
+            packetSequenceNumber: testPacketSequence(55, 2),
+          }),
+        'missing-data-unit-identity'
+      )
+      expect(reassembler.pendingCount).toBe(0)
+    })
+
+    test('rejects fragmented MFUs without an authored packet sequence', () => {
+      const reassembler = new MFUReassembler({ timeoutMs: 1000 })
+      expectRejection(
+        () =>
+          reassembler.addFragment({
+            fragmentationIndicator: 1,
+            mpuSequenceNumber: 55,
+            fragmentCounter: 1,
+            itemId: 1,
+            data: new Uint8Array([0xa1]),
+            timestamp: 22222n,
+            rapFlag: true,
+          }),
+        'missing-packet-sequence'
+      )
+      expect(reassembler.pendingCount).toBe(0)
+    })
+
+    test('rejects fragmented MFUs whose authored packet sequence is not u32', () => {
+      const reassembler = new MFUReassembler({ timeoutMs: 1000 })
+      for (const packetSequenceNumber of [-1, 0x1_0000_0000, 1.5, Number.NaN]) {
+        expectRejection(
+          () =>
+            reassembler.addFragment({
+              fragmentationIndicator: 1,
+              mpuSequenceNumber: 55,
+              fragmentCounter: 1,
+              itemId: 1,
+              data: new Uint8Array([0xa1]),
+              timestamp: 22222n,
+              rapFlag: true,
+              packetSequenceNumber,
+            }),
+          'missing-packet-sequence'
+        )
+      }
+      expect(reassembler.pendingCount).toBe(0)
+    })
+
+    test('a packet sequence gap inside a fragmented DU splits it and never completes', () => {
+      const reassembler = new MFUReassembler({ timeoutMs: 1000 })
+      const timestamp = 66666n
+
+      // The head is addressed 1000 + 3 = 1003. One unrelated same-pid packet
+      // consumed psn 1001, so every later fragment is addressed 1004: a
+      // second data unit on the wire, parked headless and never merged with
+      // the head by scope, counter, timestamp, or arrival order.
+      expect(
+        reassembler.addFragment({
+          fragmentationIndicator: 1,
+          mpuSequenceNumber: 80,
+          fragmentCounter: 3,
+          movieFragmentSequenceNumber: 241,
+          sampleNumber: 1,
+          sampleOffset: 0,
+          packetSequenceNumber: 1000,
+          data: new Uint8Array([0xa0]),
+          timestamp,
+          rapFlag: true,
+        })
+      ).toBeNull()
+      for (const [counter, psn] of [
+        [2, 1002],
+        [1, 1003],
+      ] as const) {
+        expect(
+          reassembler.addFragment({
+            fragmentationIndicator: 2,
+            mpuSequenceNumber: 80,
+            fragmentCounter: counter,
+            packetSequenceNumber: psn,
+            data: new Uint8Array([0xa0 + counter]),
+            timestamp,
+            rapFlag: false,
+          })
+        ).toBeNull()
+      }
+      expect(
+        reassembler.addFragment({
+          fragmentationIndicator: 3,
+          mpuSequenceNumber: 80,
+          fragmentCounter: 0,
+          packetSequenceNumber: 1004,
+          data: new Uint8Array([0xb1]),
+          timestamp,
+          rapFlag: false,
+        })
+      ).toBeNull()
+
+      // The open head plus one headless parked data unit, one slot each.
+      expect(reassembler.pendingCount).toBe(2)
+      expect(reassembler.getStatus().pendingFragments).toBe(4)
+      expect(reassembler.stats.reassembledMFUs).toBe(0)
+      expect(reassembler.stats.rejectedFragments).toBe(0)
+    })
+
+    test('keeps adjacent MFUs with equal countdowns in one MPU separate', () => {
+      const reassembler = new MFUReassembler({ timeoutMs: 1000 })
+      const common = { mpuSequenceNumber: 80, packetId: 7, timestamp: 66666n }
+
+      // Two adjacent samples of one MPU fragmented into the same countdown are
+      // both open at once. Each continuation carries its unit's terminal
+      // sequence (100 + 1 and 102 + 1), so each run completes with its own
+      // terminal fragment.
+      expect(
+        reassembler.addFragment({
+          ...common,
+          fragmentationIndicator: 1,
+          fragmentCounter: 1,
+          packetSequenceNumber: 100,
+          movieFragmentSequenceNumber: 241,
+          sampleNumber: 1,
+          sampleOffset: 0,
+          data: new Uint8Array([0xa1]),
+          rapFlag: true,
+        })
+      ).toBeNull()
+      expect(
+        reassembler.addFragment({
+          ...common,
+          fragmentationIndicator: 1,
+          fragmentCounter: 1,
+          packetSequenceNumber: 102,
+          movieFragmentSequenceNumber: 241,
+          sampleNumber: 2,
+          sampleOffset: 0,
+          data: new Uint8Array([0xb1]),
+          rapFlag: false,
+        })
+      ).toBeNull()
+      expect(reassembler.pendingCount).toBe(2)
+
+      const earlier = reassembler.addFragment({
+        ...common,
+        fragmentationIndicator: 3,
+        fragmentCounter: 0,
+        packetSequenceNumber: 101,
+        data: new Uint8Array([0xa2]),
+        rapFlag: false,
+      })
+      expect(earlier?.data).toEqual(new Uint8Array([0xa1, 0xa2]))
+      expect(earlier?.packetSequenceNumbers).toEqual([100, 101])
+
+      const later = reassembler.addFragment({
+        ...common,
+        fragmentationIndicator: 3,
+        fragmentCounter: 0,
+        packetSequenceNumber: 103,
+        data: new Uint8Array([0xb2]),
+        rapFlag: false,
+      })
+      expect(later?.data).toEqual(new Uint8Array([0xb1, 0xb2]))
+      expect(later?.packetSequenceNumbers).toEqual([102, 103])
+      expect(reassembler.pendingCount).toBe(0)
+    })
+
+    test('wraps the fragmented run coordinate at u32 packet sequence', () => {
+      const reassembler = new MFUReassembler({ timeoutMs: 1000 })
+      expect(
+        reassembler.addFragment({
+          fragmentationIndicator: 1,
+          mpuSequenceNumber: 81,
+          fragmentCounter: 1,
+          packetSequenceNumber: 0xffffffff,
+          itemId: 1,
+          data: new Uint8Array([0xa1]),
+          timestamp: 66666n,
+          rapFlag: true,
+        })
+      ).toBeNull()
+      expect(
+        reassembler.addFragment({
+          fragmentationIndicator: 3,
+          mpuSequenceNumber: 81,
+          fragmentCounter: 0,
+          packetSequenceNumber: 0,
+          data: new Uint8Array([0xa2]),
+          timestamp: 66667n,
+          rapFlag: false,
+        })?.data
+      ).toEqual(new Uint8Array([0xa1, 0xa2]))
+    })
+
+    test('dedupes recovered copies by ISO fragment-counter position', () => {
+      const reassembler = new MFUReassembler({ timeoutMs: 1000 })
+      const timestamp = 44444n
+
+      expect(
+        reassembler.addFragment({
+          fragmentationIndicator: 1,
+          mpuSequenceNumber: 77,
+          fragmentCounter: 2,
+          movieFragmentSequenceNumber: 12,
+          sampleNumber: 1,
+          sampleOffset: 0,
+          packetSequenceNumber: 2000,
+          data: new Uint8Array([0xa1]),
+          timestamp,
+          rapFlag: true,
+        })
+      ).toBeNull()
+      expect(
+        reassembler.addFragment({
+          fragmentationIndicator: 2,
+          mpuSequenceNumber: 77,
+          fragmentCounter: 1,
+          packetSequenceNumber: 2001,
+          data: new Uint8Array([0xb2]),
+          timestamp,
+          rapFlag: false,
+        })
+      ).toBeNull()
+      expect(
+        reassembler.addFragment({
+          fragmentationIndicator: 3,
+          mpuSequenceNumber: 77,
+          fragmentCounter: 0,
+          packetSequenceNumber: 2002,
+          data: new Uint8Array([0xc3]),
+          timestamp,
+          rapFlag: false,
+        })
+      ).not.toBeNull()
+
+      reassembler.flush()
+
+      expect(
+        reassembler.addFragment({
+          fragmentationIndicator: 1,
+          mpuSequenceNumber: 78,
+          fragmentCounter: 2,
+          movieFragmentSequenceNumber: 13,
+          sampleNumber: 1,
+          sampleOffset: 0,
+          packetSequenceNumber: 3000,
+          data: new Uint8Array([0xd4]),
+          timestamp,
+          rapFlag: true,
+        })
+      ).toBeNull()
+      expect(
+        reassembler.addFragment({
+          fragmentationIndicator: 2,
+          mpuSequenceNumber: 78,
+          fragmentCounter: 1,
+          packetSequenceNumber: 3001,
+          data: new Uint8Array([0xe5]),
+          timestamp,
+          rapFlag: false,
+        })
+      ).toBeNull()
+      expectRejection(
+        () =>
+          reassembler.addFragment({
+            fragmentationIndicator: 2,
+            mpuSequenceNumber: 78,
+            fragmentCounter: 1,
+            packetSequenceNumber: 3001,
+            data: new Uint8Array([0xe5]),
+            timestamp,
+            rapFlag: false,
+          }),
+        'fragment-counter-mismatch'
+      )
+      const out = reassembler.addFragment({
+        fragmentationIndicator: 3,
+        mpuSequenceNumber: 78,
+        fragmentCounter: 0,
+        packetSequenceNumber: 3002,
+        data: new Uint8Array([0xf6]),
+        timestamp,
+        rapFlag: false,
+      })
+
+      expect(out).not.toBeNull()
+      expect(out!.data).toEqual(new Uint8Array([0xd4, 0xe5, 0xf6]))
+    })
+
+    test('reassembles middle and terminal continuations that arrive before first', () => {
+      const reassembler = new MFUReassembler({ timeoutMs: 1000 })
+      const timestamp = 54321n
+
+      expect(
+        reassembler.addFragment({
+          fragmentationIndicator: 2,
+          mpuSequenceNumber: 45,
+          fragmentCounter: 1,
+          data: new Uint8Array([0xb2]),
+          timestamp,
+          rapFlag: false,
+          packetSequenceNumber: testPacketSequence(45, 1),
+        })
+      ).toBeNull()
+      expect(
+        reassembler.addFragment({
+          fragmentationIndicator: 3,
+          mpuSequenceNumber: 45,
+          fragmentCounter: 0,
+          data: new Uint8Array([0xc3]),
+          timestamp: timestamp + 1n,
+          rapFlag: false,
+          packetSequenceNumber: testPacketSequence(45, 0),
+        })
+      ).toBeNull()
+      expect(reassembler.pendingCount).toBe(1)
+      const out = reassembler.addFragment({
+        fragmentationIndicator: 1,
+        mpuSequenceNumber: 45,
+        fragmentCounter: 2,
+        movieFragmentSequenceNumber: 10,
+        sampleNumber: 18,
+        sampleOffset: 0,
+        data: new Uint8Array([0xa1]),
+        timestamp,
+        rapFlag: true,
+        packetSequenceNumber: testPacketSequence(45, 2),
+      })
+
+      expect(out).not.toBeNull()
+      expect(out!.data).toEqual(new Uint8Array([0xa1, 0xb2, 0xc3]))
+      expect(out!.sampleNumber).toBe(18)
+      expect(out!.movieFragmentSequenceNumber).toBe(10)
+      expect(reassembler.pendingCount).toBe(0)
+    })
+
+    test('rejects a duplicate continuation before first without replacing retained media', () => {
+      const reassembler = new MFUReassembler({ timeoutMs: 1000 })
+      const timestamp = 54322n
+
+      expect(
+        reassembler.addFragment({
+          fragmentationIndicator: 3,
+          mpuSequenceNumber: 46,
+          fragmentCounter: 0,
+          data: new Uint8Array([0xc3]),
+          timestamp,
+          rapFlag: false,
+          packetSequenceNumber: testPacketSequence(46, 0),
+        })
+      ).toBeNull()
+      expectRejection(
+        () =>
+          reassembler.addFragment({
+            fragmentationIndicator: 3,
+            mpuSequenceNumber: 46,
+            fragmentCounter: 0,
+            data: new Uint8Array([0xff]),
+            timestamp: timestamp + 1n,
+            rapFlag: false,
+            packetSequenceNumber: testPacketSequence(46, 0),
+          }),
+        'fragment-counter-mismatch'
+      )
+      expect(
+        reassembler.addFragment({
+          fragmentationIndicator: 2,
+          mpuSequenceNumber: 46,
+          fragmentCounter: 1,
+          data: new Uint8Array([0xb2]),
+          timestamp: timestamp + 2n,
+          rapFlag: false,
+          packetSequenceNumber: testPacketSequence(46, 1),
+        })
+      ).toBeNull()
+
+      const out = reassembler.addFragment({
+        fragmentationIndicator: 1,
+        mpuSequenceNumber: 46,
+        fragmentCounter: 2,
+        movieFragmentSequenceNumber: 10,
+        sampleNumber: 19,
+        sampleOffset: 0,
+        data: new Uint8Array([0xa1]),
+        timestamp: timestamp + 3n,
+        rapFlag: true,
+        packetSequenceNumber: testPacketSequence(46, 2),
+      })
+
+      expect(out).not.toBeNull()
+      expect(out!.data).toEqual(new Uint8Array([0xa1, 0xb2, 0xc3]))
+      expect(reassembler.pendingCount).toBe(0)
+    })
+
+    test('rejects invalid ISO fragmentation-indicator and counter combinations', () => {
+      const reassembler = new MFUReassembler({ timeoutMs: 1000 })
+      const invalidHeaders = [
+        { fragmentationIndicator: 0, fragmentCounter: 1 },
+        { fragmentationIndicator: 3, fragmentCounter: 1 },
+        { fragmentationIndicator: 1, fragmentCounter: 0 },
+        { fragmentationIndicator: 2, fragmentCounter: 0 },
+        { fragmentationIndicator: -1, fragmentCounter: 1 },
+        { fragmentationIndicator: 4, fragmentCounter: 1 },
+        { fragmentationIndicator: 1.5, fragmentCounter: 1 },
+        { fragmentationIndicator: 1, fragmentCounter: -1 },
+        { fragmentationIndicator: 1, fragmentCounter: 256 },
+        { fragmentationIndicator: 1, fragmentCounter: 1.5 },
+        { fragmentationIndicator: 1, fragmentCounter: Number.NaN },
+      ]
+
+      for (const header of invalidHeaders) {
+        expectRejection(
+          () =>
+            reassembler.addFragment({
+              ...header,
+              mpuSequenceNumber: 48,
+              data: new Uint8Array([0xa1]),
+              timestamp: 54324n,
+              rapFlag: false,
+            }),
+          'invalid-fragment-state'
+        )
+      }
+
+      expect(reassembler.pendingCount).toBe(0)
+      expect(reassembler.stats.reassembledMFUs).toBe(0)
+    })
+
+    test('reassembles the maximum ISO chain of 256 payloads', () => {
+      const reassembler = new MFUReassembler({ timeoutMs: null })
+      const common = {
+        mpuSequenceNumber: 47,
+        timestamp: 54323n,
+        rapFlag: false,
+      }
+
+      expect(
+        reassembler.addFragment({
+          ...common,
+          fragmentationIndicator: 1,
+          fragmentCounter: 255,
+          itemId: 1,
+          data: new Uint8Array([0]),
+          rapFlag: true,
+          packetSequenceNumber: testPacketSequence(47, 255),
+        })
+      ).toBeNull()
+      for (let counter = 254; counter > 0; counter--) {
+        expect(
+          reassembler.addFragment({
+            ...common,
+            fragmentationIndicator: 2,
+            fragmentCounter: counter,
+            data: new Uint8Array([255 - counter]),
+            packetSequenceNumber: testPacketSequence(47, counter),
+          })
+        ).toBeNull()
+      }
+      const out = reassembler.addFragment({
+        ...common,
+        fragmentationIndicator: 3,
+        fragmentCounter: 0,
+        data: new Uint8Array([255]),
+        packetSequenceNumber: testPacketSequence(47, 0),
+      })
+
+      expect(out?.fragmentCount).toBe(256)
+      expect(out?.data).toEqual(Uint8Array.from({ length: 256 }, (_, index) => index))
+    })
+
+    test('should not reassemble without last fragment (FI=3)', () => {
+      const reassembler = new MFUReassembler({ timeoutMs: 1000 })
+      reassembler.addFragment({
+        fragmentationIndicator: 1,
+        mpuSequenceNumber: 1,
+        fragmentCounter: 2,
+        itemId: 1,
+        data: new Uint8Array([1]),
+        timestamp: 1000n,
+        rapFlag: false,
+        packetSequenceNumber: testPacketSequence(1, 2),
+      })
+      const result = reassembler.addFragment({
+        fragmentationIndicator: 2,
+        mpuSequenceNumber: 1,
+        fragmentCounter: 1,
+        data: new Uint8Array([2]),
+        timestamp: 1000n,
+        rapFlag: false,
+        packetSequenceNumber: testPacketSequence(1, 1),
+      })
+      expect(result).toBeNull()
+      expect(reassembler.pendingCount).toBe(1)
+    })
+
+    test('bounds continuations that arrive before their first fragments', () => {
+      const reassembler = new MFUReassembler({
+        timeoutMs: null,
+        maxBuffered: 1,
+      })
+      // Data unit 1 parks headless at address 1000 and takes the only slot.
+      expect(
+        reassembler.addFragment({
+          fragmentationIndicator: 3,
+          mpuSequenceNumber: 1,
+          fragmentCounter: 0,
+          data: new Uint8Array([1]),
+          timestamp: 1000n,
+          rapFlag: false,
+          packetSequenceNumber: testPacketSequence(1, 0),
+        })
+      ).toBeNull()
+      expect(reassembler.pendingCount).toBe(1)
+
+      // Data unit 2 parks headless at address 2000. The bound holds by
+      // replacement: data unit 1, admitted first, yields its slot.
+      expect(
+        reassembler.addFragment({
+          fragmentationIndicator: 3,
+          mpuSequenceNumber: 2,
+          fragmentCounter: 0,
+          data: new Uint8Array([2]),
+          timestamp: 1000n,
+          rapFlag: false,
+          packetSequenceNumber: testPacketSequence(2, 0),
+        })
+      ).toBeNull()
+      expect(reassembler.pendingCount).toBe(1)
+      expect(reassembler.getStatus().pendingFragments).toBe(1)
+      expect(reassembler.stats.evictedMemoryLimit).toBe(1)
+
+      // Data unit 2's head inherits the slot its queue already holds, so it
+      // evicts nothing and completes from the parked continuation.
+      const completed = reassembler.addFragment({
+        fragmentationIndicator: 1,
+        mpuSequenceNumber: 2,
+        fragmentCounter: 1,
+        itemId: 2,
+        data: new Uint8Array([4]),
+        timestamp: 1000n,
+        rapFlag: true,
+        packetSequenceNumber: testPacketSequence(2, 1),
+      })
+      expect(completed?.data).toEqual(new Uint8Array([4, 2]))
+      expect(reassembler.stats.evictedMemoryLimit).toBe(1)
+      expect(reassembler.pendingCount).toBe(0)
+
+      // Data unit 1's continuation was released with its slot, so its head
+      // opens a fresh run and waits rather than completing from evicted state.
+      const result = reassembler.addFragment({
+        fragmentationIndicator: 1,
+        mpuSequenceNumber: 1,
+        fragmentCounter: 1,
+        itemId: 1,
+        data: new Uint8Array([3]),
+        timestamp: 1000n,
+        rapFlag: true,
+        packetSequenceNumber: testPacketSequence(1, 1),
+      })
+      expect(result).toBeNull()
+      expect(reassembler.pendingCount).toBe(1)
+    })
+
+    test('expires a continuation that never receives its first fragment', () => {
+      vi.useFakeTimers()
+      try {
+        const reassembler = new MFUReassembler({
+          timeoutMs: 50,
+          maxBuffered: 1,
+        })
+        expect(
+          reassembler.addFragment({
+            fragmentationIndicator: 3,
+            mpuSequenceNumber: 1,
+            fragmentCounter: 0,
+            data: new Uint8Array([1]),
+            timestamp: 1000n,
+            rapFlag: false,
+            packetSequenceNumber: testPacketSequence(1, 0),
+          })
+        ).toBeNull()
+        vi.advanceTimersByTime(50)
+        expect(reassembler.pendingCount).toBe(0)
+        expect(reassembler.stats.timedOutMFUs).toBe(1)
+      } finally {
+        vi.useRealTimers()
+      }
+    })
+
+    test('retimes retained continuations when the timeout policy changes', () => {
+      vi.useFakeTimers()
+      try {
+        const enabled = new MFUReassembler({ timeoutMs: null, maxBuffered: 1 })
+        expect(
+          enabled.addFragment({
+            fragmentationIndicator: 3,
+            mpuSequenceNumber: 1,
+            fragmentCounter: 0,
+            data: new Uint8Array([1]),
+            timestamp: 1000n,
+            rapFlag: false,
+            packetSequenceNumber: testPacketSequence(1, 0),
+          })
+        ).toBeNull()
+        enabled.timeoutMs = 10
+        vi.advanceTimersByTime(10)
+        expect(enabled.pendingCount).toBe(0)
+
+        const disabled = new MFUReassembler({ timeoutMs: 10, maxBuffered: 1 })
+        expect(
+          disabled.addFragment({
+            fragmentationIndicator: 3,
+            mpuSequenceNumber: 2,
+            fragmentCounter: 0,
+            data: new Uint8Array([2]),
+            timestamp: 1000n,
+            rapFlag: false,
+            packetSequenceNumber: testPacketSequence(2, 0),
+          })
+        ).toBeNull()
+        disabled.timeoutMs = null
+        vi.advanceTimersByTime(10)
+        expect(disabled.pendingCount).toBe(1)
+        disabled.flush()
+      } finally {
+        vi.useRealTimers()
+      }
+    })
+
+    test('bounds active data units by evicting the oldest at maxBuffered', () => {
+      const reassembler = new MFUReassembler({
+        timeoutMs: 1000,
+        maxBuffered: 2,
+      })
+
+      // Two runs remain active; the third first fragment displaces the run
+      // admitted longest ago instead of being refused.
+      for (let i = 0; i < 2; i++) {
+        reassembler.addFragment({
+          fragmentationIndicator: 1,
+          mpuSequenceNumber: i,
+          fragmentCounter: 1,
+          itemId: i,
+          data: new Uint8Array([i]),
+          timestamp: BigInt(i * 100),
+          rapFlag: false,
+          packetSequenceNumber: testPacketSequence(i, 1),
+        })
+      }
+      expect(
+        reassembler.addFragment({
+          fragmentationIndicator: 1,
+          mpuSequenceNumber: 2,
+          fragmentCounter: 1,
+          itemId: 2,
+          data: new Uint8Array([2]),
+          timestamp: 200n,
+          rapFlag: false,
+          packetSequenceNumber: testPacketSequence(2, 1),
+        })
+      ).toBeNull()
+      expect(reassembler.pendingCount).toBe(2)
+      // Eviction is a replacement policy, not a deadline: it must not be
+      // reported as a timeout, and it must be separately countable.
+      expect(reassembler.stats.timedOutMFUs).toBe(0)
+      expect(reassembler.stats.evictedMemoryLimit).toBe(1)
+
+      // The evicted run's continuation no longer has a run to join; it parks
+      // as a fresh headless data unit, which displaces the next-oldest run.
+      expect(
+        reassembler.addFragment({
+          fragmentationIndicator: 3,
+          mpuSequenceNumber: 0,
+          fragmentCounter: 0,
+          data: new Uint8Array([9]),
+          timestamp: 300n,
+          rapFlag: false,
+          packetSequenceNumber: testPacketSequence(0, 0),
+        })
+      ).toBeNull()
+      expect(reassembler.pendingCount).toBe(2)
+      expect(reassembler.stats.evictedMemoryLimit).toBe(2)
+      expect(reassembler.stats.timedOutMFUs).toBe(0)
+    })
+
+    test('should report stats correctly', () => {
+      const reassembler = new MFUReassembler({ timeoutMs: 1000 })
+
+      // One complete MFU
+      reassembler.addFragment({
+        fragmentationIndicator: 0,
+        mpuSequenceNumber: 1,
+        fragmentCounter: 0,
+        itemId: 1,
+        data: new Uint8Array([1]),
+        timestamp: 1000n,
+        rapFlag: false,
+      })
+
+      const status = reassembler.getStatus()
+      expect(status.bufferedMFUs).toBe(0)
+      expect(status.stats.totalFragments).toBe(1)
+      expect(status.stats.reassembledMFUs).toBe(1)
+    })
+
+    test('rejects an overlapping first without replacing the original fragment', () => {
+      const reassembler = new MFUReassembler({ timeoutMs: 1000 })
+
+      reassembler.addFragment({
+        fragmentationIndicator: 1,
+        mpuSequenceNumber: 1,
+        fragmentCounter: 1,
+        itemId: 1,
+        data: new Uint8Array([0xaa]),
+        timestamp: 1000n,
+        rapFlag: true,
+        source: 'multicast',
+        packetSequenceNumber: testPacketSequence(1, 1),
+      })
+      // Duplicate of fragmentCounter=1
+      expectRejection(
+        () =>
+          reassembler.addFragment({
+            fragmentationIndicator: 1,
+            mpuSequenceNumber: 1,
+            fragmentCounter: 1,
+            itemId: 2,
+            data: new Uint8Array([0xbb]),
+            timestamp: 1000n,
+            rapFlag: true,
+            source: 'moq',
+            packetSequenceNumber: testPacketSequence(1, 1),
+          }),
+        'overlapping-data-unit'
+      )
+
+      const result = reassembler.addFragment({
+        fragmentationIndicator: 3,
+        mpuSequenceNumber: 1,
+        fragmentCounter: 0,
+        data: new Uint8Array([0xcc]),
+        timestamp: 1000n,
+        rapFlag: false,
+        packetSequenceNumber: testPacketSequence(1, 0),
+      })
+      expect(result).not.toBeNull()
+      expect(result!.data).toEqual(new Uint8Array([0xaa, 0xcc]))
+      expect(result!.fragmentCount).toBe(2)
+      expect(result!.source).toBe('multicast')
+    })
+  })
+
+  test('should retain an assembly with a gap in fragment counters', () => {
+    const reassembler = new MFUReassembler({ timeoutMs: 1000 })
+
+    // First fragment declares three succeeding payloads.
+    reassembler.addFragment({
+      fragmentationIndicator: 1,
+      mpuSequenceNumber: 1,
+      fragmentCounter: 3,
+      itemId: 1,
+      data: new Uint8Array([0xaa]),
+      timestamp: 1000n,
+      rapFlag: true,
+      packetSequenceNumber: testPacketSequence(1, 3),
+    })
+    // Counter 1 arrives while counter 2 is missing.
+    expect(
+      reassembler.addFragment({
+        fragmentationIndicator: 2,
+        mpuSequenceNumber: 1,
+        fragmentCounter: 1,
+        data: new Uint8Array([0xcc]),
+        timestamp: 1000n,
+        rapFlag: false,
+        packetSequenceNumber: testPacketSequence(1, 1),
+      })
+    ).toBeNull()
+    // Last fragment has the required zero counter.
+    expect(
+      reassembler.addFragment({
+        fragmentationIndicator: 3,
+        mpuSequenceNumber: 1,
+        fragmentCounter: 0,
+        data: new Uint8Array([0xdd]),
+        timestamp: 1000n,
+        rapFlag: false,
+        packetSequenceNumber: testPacketSequence(1, 0),
+      })
+    ).toBeNull()
+    expect(reassembler.pendingCount).toBe(1)
+    expect(reassembler.getStatus().pendingFragments).toBe(3)
+  })
+
+  test('accepts a reordered countdown and rejects a stale duplicate', () => {
+    const reassembler = new MFUReassembler({ timeoutMs: 1000 })
+
+    // Counters 3, 1, 0 arrive (gap at 2).
+    reassembler.addFragment({
+      fragmentationIndicator: 1,
+      mpuSequenceNumber: 1,
+      fragmentCounter: 3,
+      itemId: 1,
+      data: new Uint8Array([0xaa]),
+      timestamp: 1000n,
+      rapFlag: true,
+      packetSequenceNumber: testPacketSequence(1, 3),
+    })
+    expect(
+      reassembler.addFragment({
+        fragmentationIndicator: 2,
+        mpuSequenceNumber: 1,
+        fragmentCounter: 1,
+        data: new Uint8Array([0xcc]),
+        timestamp: 1000n,
+        rapFlag: false,
+        packetSequenceNumber: testPacketSequence(1, 1),
+      })
+    ).toBeNull()
+    expect(
+      reassembler.addFragment({
+        fragmentationIndicator: 2,
+        mpuSequenceNumber: 1,
+        fragmentCounter: 2,
+        data: new Uint8Array([0xbb]),
+        timestamp: 1000n,
+        rapFlag: false,
+        packetSequenceNumber: testPacketSequence(1, 2),
+      })
+    ).toBeNull()
+    expectRejection(
+      () =>
+        reassembler.addFragment({
+          fragmentationIndicator: 2,
+          mpuSequenceNumber: 1,
+          fragmentCounter: 1,
+          data: new Uint8Array([0xcc]),
+          timestamp: 1001n,
+          rapFlag: false,
+          packetSequenceNumber: testPacketSequence(1, 1),
+        }),
+      'fragment-counter-mismatch'
+    )
+    const result = reassembler.addFragment({
+      fragmentationIndicator: 3,
+      mpuSequenceNumber: 1,
+      fragmentCounter: 0,
+      data: new Uint8Array([0xdd]),
+      timestamp: 1002n,
+      rapFlag: false,
+      packetSequenceNumber: testPacketSequence(1, 0),
+    })
+    expect(result).not.toBeNull()
+    expect(result!.data).toEqual(new Uint8Array([0xaa, 0xbb, 0xcc, 0xdd]))
+    expect(result!.fragmentCount).toBe(4)
+  })
+
+  test('rejects an overlapping first without discarding queued continuations', () => {
+    const reassembler = new MFUReassembler({ timeoutMs: 1000 })
+    const fragment = (fragmentationIndicator: number, fragmentCounter: number, byte: number): MFUFragment => ({
+      fragmentationIndicator,
+      mpuSequenceNumber: 2,
+      fragmentCounter,
+      data: new Uint8Array([byte]),
+      timestamp: 1000n,
+      rapFlag: fragmentationIndicator === 1,
+      packetSequenceNumber: testPacketSequence(2, fragmentCounter),
+      ...(fragmentationIndicator === 1 ? { itemId: 9 } : {}),
+    })
+
+    expect(reassembler.addFragment(fragment(1, 3, 0xaa))).toBeNull()
+    expect(reassembler.addFragment(fragment(2, 1, 0xcc))).toBeNull()
+    expectRejection(() => reassembler.addFragment(fragment(1, 1, 0xee)), 'overlapping-data-unit')
+    expect(reassembler.addFragment(fragment(2, 2, 0xbb))).toBeNull()
+    expect(reassembler.addFragment(fragment(3, 0, 0xdd))?.data).toEqual(new Uint8Array([0xaa, 0xbb, 0xcc, 0xdd]))
+  })
+
+  test('rejects a duplicate emitted intrinsic identity', () => {
+    const reassembler = new MFUReassembler({ timeoutMs: 1000 })
+
+    expect(
+      reassembler.addFragment({
+        fragmentationIndicator: 1,
+        mpuSequenceNumber: 42,
+        fragmentCounter: 1,
+        itemId: 1,
+        data: new Uint8Array([0xaa]),
+        timestamp: 1000n,
+        rapFlag: true,
+        packetSequenceNumber: testPacketSequence(42, 1),
+      })
+    ).toBeNull()
+    expect(
+      reassembler.addFragment({
+        fragmentationIndicator: 3,
+        mpuSequenceNumber: 42,
+        fragmentCounter: 0,
+        data: new Uint8Array([0xab]),
+        timestamp: 1001n,
+        rapFlag: false,
+        packetSequenceNumber: testPacketSequence(42, 0),
+      })
+    ).not.toBeNull()
+    expect(
+      reassembler.addFragment({
+        fragmentationIndicator: 3,
+        mpuSequenceNumber: 42,
+        fragmentCounter: 0,
+        data: new Uint8Array([0xbc]),
+        timestamp: 1002n,
+        rapFlag: false,
+        packetSequenceNumber: testPacketSequence(42, 0, 10),
+      })
+    ).toBeNull()
+    expect(reassembler.pendingCount).toBe(1)
+    expect(
+      reassembler.addFragment({
+        fragmentationIndicator: 1,
+        mpuSequenceNumber: 42,
+        fragmentCounter: 1,
+        itemId: 1,
+        data: new Uint8Array([0xbb]),
+        timestamp: 2000n,
+        rapFlag: true,
+        packetSequenceNumber: testPacketSequence(42, 1, 10),
+      })
+    ).toBeNull()
+    // The queued FI=3 above is addressed to a data unit of MPU 42 whose own
+    // FI=1 has not arrived. This duplicate head names that same address, but
+    // its identity already emitted, so it is dropped before it can open a run
+    // and touches nothing: the queue is retained and reclaimed by its own
+    // arrival timeout.
+    expect(reassembler.pendingCount).toBe(1)
+
+    const result = reassembler.addFragment({
+      fragmentationIndicator: 1,
+      mpuSequenceNumber: 43,
+      fragmentCounter: 1,
+      itemId: 1,
+      data: new Uint8Array([0xcc]),
+      timestamp: 2000n,
+      rapFlag: false,
+      packetSequenceNumber: testPacketSequence(43, 1),
+    })
+    expect(result).toBeNull()
+    expect(
+      reassembler.addFragment({
+        fragmentationIndicator: 3,
+        mpuSequenceNumber: 43,
+        fragmentCounter: 0,
+        data: new Uint8Array([0xdd]),
+        timestamp: 2001n,
+        rapFlag: false,
+        packetSequenceNumber: testPacketSequence(43, 0),
+      })?.data
+    ).toEqual(new Uint8Array([0xcc, 0xdd]))
+  })
+
+  test('does not create active state for an emitted identity duplicate', () => {
+    const reassembler = new MFUReassembler({ timeoutMs: 1000 })
+
+    expect(
+      reassembler.addFragment({
+        fragmentationIndicator: 1,
+        mpuSequenceNumber: 50,
+        fragmentCounter: 1,
+        movieFragmentSequenceNumber: 10,
+        sampleNumber: 18,
+        sampleOffset: 0,
+        data: new Uint8Array([0xa1]),
+        timestamp: 1000n,
+        rapFlag: true,
+        packetSequenceNumber: testPacketSequence(50, 1),
+      })
+    ).toBeNull()
+    expect(
+      reassembler.addFragment({
+        fragmentationIndicator: 3,
+        mpuSequenceNumber: 50,
+        fragmentCounter: 0,
+        data: new Uint8Array([0xb2]),
+        timestamp: 1000n,
+        rapFlag: false,
+        packetSequenceNumber: testPacketSequence(50, 0),
+      })?.data
+    ).toEqual(new Uint8Array([0xa1, 0xb2]))
+    expect(reassembler.pendingCount).toBe(0)
+
+    expect(
+      reassembler.addFragment({
+        fragmentationIndicator: 1,
+        mpuSequenceNumber: 50,
+        fragmentCounter: 1,
+        movieFragmentSequenceNumber: 10,
+        sampleNumber: 18,
+        sampleOffset: 0,
+        data: new Uint8Array([0xa1]),
+        timestamp: 2000n,
+        rapFlag: true,
+        packetSequenceNumber: testPacketSequence(50, 1, 10),
+      })
+    ).toBeNull()
+    expect(reassembler.pendingCount).toBe(0)
+  })
+
+  test('flush should clear emitted set and allow re-assembly', () => {
+    const reassembler = new MFUReassembler({ timeoutMs: 1000 })
+
+    // Use fragmented MFU (FI=1 start + FI=3 end) — only fragmented MFUs
+    // go through the #emitted dedup set. FI=0 (complete) bypasses it.
+    const first = reassembler.addFragment({
+      fragmentationIndicator: 1,
+      mpuSequenceNumber: 42,
+      fragmentCounter: 1,
+      itemId: 1,
+      data: new Uint8Array([0xaa]),
+      timestamp: 1000n,
+      rapFlag: true,
+      packetSequenceNumber: testPacketSequence(42, 1),
+    })
+    expect(first).toBeNull() // first fragment, not yet complete
+    const assembled = reassembler.addFragment({
+      fragmentationIndicator: 3,
+      mpuSequenceNumber: 42,
+      fragmentCounter: 0,
+      data: new Uint8Array([0xbb]),
+      timestamp: 1000n,
+      rapFlag: true,
+      packetSequenceNumber: testPacketSequence(42, 0),
+    })
+    expect(assembled).not.toBeNull() // complete — mpuSeq 42 now in emitted set
+
+    // Rejected before flush — same mpuSeq already emitted
+    expect(
+      reassembler.addFragment({
+        fragmentationIndicator: 1,
+        mpuSequenceNumber: 42,
+        fragmentCounter: 1,
+        itemId: 1,
+        data: new Uint8Array([0xcc]),
+        timestamp: 1000n,
+        rapFlag: true,
+        packetSequenceNumber: testPacketSequence(42, 1, 10),
+      })
+    ).toBeNull()
+
+    // After flush, same mpuSeq should work again
+    reassembler.flush()
+    const r2 = reassembler.addFragment({
+      fragmentationIndicator: 1,
+      mpuSequenceNumber: 42,
+      fragmentCounter: 1,
+      itemId: 1,
+      data: new Uint8Array([0xdd]),
+      timestamp: 1000n,
+      rapFlag: true,
+      packetSequenceNumber: testPacketSequence(42, 1),
+    })
+    expect(r2).toBeNull() // first fragment of new assembly
+    const r3 = reassembler.addFragment({
+      fragmentationIndicator: 3,
+      mpuSequenceNumber: 42,
+      fragmentCounter: 0,
+      data: new Uint8Array([0xee]),
+      timestamp: 1000n,
+      rapFlag: true,
+      packetSequenceNumber: testPacketSequence(42, 0),
+    })
+    expect(r3).not.toBeNull()
+    expect(r3!.data).toEqual(new Uint8Array([0xdd, 0xee]))
+  })
+
+  describe('createFragment', () => {
+    test('should create fragment from complete timed MMTP packet', () => {
+      // Build: MMTP(12) + MPU(8, T=1 FI=0 payloadLength=25) + MFU_DU(14) + data(5)
+      const packet = new Uint8Array(12 + 8 + 14 + 5)
+      // MMTP header: byte0 = rap=1, byte1 = MPU type
+      packet[0] = 0x01 // RAP flag set
+      packet[1] = 0x00 // packet_type = MPU
+      // packetId = 1
+      const view = new DataView(packet.buffer)
+      view.setUint16(2, 1, false)
+      view.setUint32(4, 42, false) // timestamp
+      view.setUint32(8, 100, false) // sequence number
+
+      // MPU header at offset 12
+      view.setUint16(12, 25, false) // 6 remaining MPU bytes + 14 DU + 5 media
+      packet[14] = 0x28 // FT=2, T=1, FI=0, A=0
+      packet[15] = 0 // fragment_counter
+      view.setUint32(16, 999, false) // mpuSequenceNumber
+
+      // MFU DU header (14 bytes) at offset 20.
+      view.setUint32(20, 7, false) // movie_fragment_sequence_number
+      view.setUint32(24, 1, false) // sample_number
+      // Video data at offset 34
+      packet[34] = 0xde
+      packet[35] = 0xad
+      packet[36] = 0xbe
+      packet[37] = 0xef
+      packet[38] = 0x01
+
+      const frag = createFragment(packet)
+      expect(frag.mpuSequenceNumber).toBe(999)
+      expect(frag.fragmentationIndicator).toBe(0)
+      expect(frag.rapFlag).toBe(true)
+      expect(frag.movieFragmentSequenceNumber).toBe(7)
+      expect(frag.sampleNumber).toBe(1)
+      expect(frag.sampleOffset).toBe(0)
+      expect(frag.data.length).toBe(5) // 5 bytes of video data
+    })
+
+    test('reads Item_ID from a non-timed MFU DU header', () => {
+      const packet = new Uint8Array(12 + 8 + 4 + 2)
+      const view = new DataView(packet.buffer)
+      view.setUint16(2, 1, false)
+      view.setUint32(4, 42, false)
+      view.setUint32(8, 100, false)
+      view.setUint16(12, 12, false) // 6 remaining MPU bytes + 4 DU + 2 media
+      packet[14] = 0x20 // FT=2, T=0, FI=0
+      view.setUint32(16, 999, false)
+      view.setUint32(20, 0x01020304, false)
+      packet.set([0xde, 0xad], 24)
+
+      const fragment = createFragment(packet)
+      expect(fragment.itemId).toBe(0x01020304)
+      expect(fragment.data).toEqual(new Uint8Array([0xde, 0xad]))
+    })
+  })
+
+  describe('processMMTPWithReassembly', () => {
+    test('should skip FEC repair packets', () => {
+      const reassembler = new MFUReassembler({ timeoutMs: 1000 })
+      const packet = new Uint8Array(12 + 8 + 14 + 4)
+      packet[0] = 0x10 // fecType=2 (repair)
+      const result = processMMTPWithReassembly(packet, reassembler)
+      expect(result).toBeNull()
+    })
+
+    test('should return reassembled MFU for complete packet', () => {
+      const reassembler = new MFUReassembler({ timeoutMs: 1000 })
+      const packet = new Uint8Array(12 + 8 + 14 + 4)
+      packet[0] = 0x01 // RAP
+      packet[1] = 0x00 // MPU
+      const view = new DataView(packet.buffer)
+      view.setUint16(2, 1, false) // packetId
+      view.setUint32(4, 100, false) // timestamp
+      view.setUint32(8, 1, false) // seq
+      // MPU: payloadLength=24 (6 + 14 + 4), FT=2 T=1 FI=0 A=0
+      view.setUint16(12, 24, false)
+      packet[14] = 0x28
+      view.setUint32(16, 42, false) // mpuSeq
+      view.setUint32(20, 7, false) // movie_fragment_sequence_number
+      view.setUint32(24, 1, false) // sample_number
+
+      packet[34] = 0x00
+      packet[35] = 0x00
+      packet[36] = 0x00
+      packet[37] = 0x01
+
+      const result = processMMTPWithReassembly(packet, reassembler)
+      expect(result).not.toBeNull()
+      expect(result!.mpuSequenceNumber).toBe(42)
+      expect(result!.rapFlag).toBe(true)
+    })
+  })
+
+  describe('strict delivery provenance', () => {
+    test('folds to multicast only when every fragment is explicitly multicast', () => {
+      expect(deliveryProvenanceOf([{ source: 'multicast' }, { source: 'multicast' }])).toBe('multicast')
+    })
+
+    test('a single moq fragment makes the whole frame mixed', () => {
+      expect(deliveryProvenanceOf([{ source: 'multicast' }, { source: 'moq' }])).toBe('mixed')
+      // ...and it does not matter where in the run it lands.
+      expect(deliveryProvenanceOf([{ source: 'moq' }, { source: 'multicast' }])).toBe('mixed')
+    })
+
+    test('an unattributed fragment degrades multicast to unknown, never to proven', () => {
+      expect(deliveryProvenanceOf([{ source: 'multicast' }, {}])).toBe('unknown')
+      expect(deliveryProvenanceOf([{}])).toBe('unknown')
+    })
+
+    test('mixed absorbs unknown — a moq byte is worse news than a missing label', () => {
+      expect(deliveryProvenanceOf([{ source: 'moq' }, {}])).toBe('mixed')
+      expect(deliveryProvenanceOf([{}, { source: 'moq' }])).toBe('mixed')
+    })
+
+    test('an empty fragment set proves nothing', () => {
+      expect(deliveryProvenanceOf([])).toBe('unknown')
+    })
+
+    test('the fold never upgrades a verdict', () => {
+      expect(foldDeliveryProvenance('mixed', 'multicast')).toBe('mixed')
+      expect(foldDeliveryProvenance('unknown', 'multicast')).toBe('unknown')
+      expect(foldDeliveryProvenance('unknown', 'moq')).toBe('mixed')
+    })
+
+    test('a multicast head with a non-multicast tail is NOT multicast-exclusive', () => {
+      // This is the leak this field exists to close. `source` legitimately
+      // reports 'multicast' — head-fragment-wins is the routing contract —
+      // but the frame contains bytes that never crossed a multicast socket,
+      // so it must never be counted as physical-delivery evidence.
+      const reassembler = new MFUReassembler({ timeoutMs: 1000 })
+      reassembler.addFragment({
+        fragmentationIndicator: 1,
+        mpuSequenceNumber: 1,
+        fragmentCounter: 1,
+        itemId: 1,
+        data: new Uint8Array([0xaa]),
+        timestamp: 1000n,
+        rapFlag: true,
+        source: 'multicast',
+        packetSequenceNumber: testPacketSequence(1, 1),
+      })
+      const result = reassembler.addFragment({
+        fragmentationIndicator: 3,
+        mpuSequenceNumber: 1,
+        fragmentCounter: 0,
+        data: new Uint8Array([0xcc]),
+        timestamp: 1000n,
+        rapFlag: false,
+        source: 'moq',
+        packetSequenceNumber: testPacketSequence(1, 0),
+      })
+      expect(result).not.toBeNull()
+      expect(result!.fragmentCount).toBe(2)
+      expect(result!.source).toBe('multicast')
+      expect(result!.deliveryProvenance).toBe('mixed')
+    })
+
+    test('an all-multicast fragmented frame is multicast-exclusive', () => {
+      const reassembler = new MFUReassembler({ timeoutMs: 1000 })
+      reassembler.addFragment({
+        fragmentationIndicator: 1,
+        mpuSequenceNumber: 2,
+        fragmentCounter: 1,
+        itemId: 1,
+        data: new Uint8Array([0xaa]),
+        timestamp: 2000n,
+        rapFlag: true,
+        source: 'multicast',
+        packetSequenceNumber: testPacketSequence(2, 1),
+      })
+      const result = reassembler.addFragment({
+        fragmentationIndicator: 3,
+        mpuSequenceNumber: 2,
+        fragmentCounter: 0,
+        data: new Uint8Array([0xcc]),
+        timestamp: 2000n,
+        rapFlag: false,
+        source: 'multicast',
+        packetSequenceNumber: testPacketSequence(2, 0),
+      })
+      expect(result).not.toBeNull()
+      expect(result!.deliveryProvenance).toBe('multicast')
+    })
+
+    test('an unlabelled complete frame proves nothing', () => {
+      const reassembler = new MFUReassembler({ timeoutMs: 1000 })
+      const result = reassembler.addFragment({
+        fragmentationIndicator: 0,
+        mpuSequenceNumber: 3,
+        fragmentCounter: 0,
+        itemId: 1,
+        data: new Uint8Array([1]),
+        timestamp: 3000n,
+        rapFlag: true,
+      })
+      expect(result).not.toBeNull()
+      expect(result!.deliveryProvenance).toBe('unknown')
+    })
+  })
+}