@blockcast/mmt-container 0.1.0-main.0399efef1f07

package/src/mmtp-router.ts

@@ -0,0 +1,3136 @@
+/**
+ * MMTP packet processing and frame routing layer.
+ *
+ * Delegates MMTP header parsing, MFU extraction, reassembly, and keyframe
+ * detection to MmtpContainerParser while owning FEC orchestration, sync
+ * gating, CMAF assembly, and callback routing.
+ *
+ * Extracted from MulticastManager — this module owns MMTP-layer concerns:
+ * FEC symbol feeding, sync gating, MSE segment assembly, and frame routing.
+ * It does NOT own network I/O, watchdog timers, or multicast join/leave.
+ *
+ * @packageDocumentation
+ */
+
+import { parseMMTPHeader } from "@blockcast/mmt-base";
+import { isMfuReassemblyError } from "./mfu-reassembler.js";
+import type {
+  MfuReassemblerBackend,
+  MmtpSourcePath,
+  MmtpDeliveryProvenance,
+} from "./mfu-reassembler.js";
+import type { MfuReassemblyPolicy } from "./mfu-reassembly-policy.js";
+import { mmtpTimestampToMicros } from "./codec-utils.js";
+import { scaleAuthoredTiming, type AuthoredTiming } from "./authored-timing.js";
+import {
+  processFecBlock,
+  processFecSymbol,
+  parseRepairPacket,
+  FecBlockMapper,
+  type ProcessFecBlockResult,
+} from "@blockcast/mmt-fec";
+import {
+  CmafBlockAssembler,
+  type BlockAssemblerConfig,
+  type CmafBlockSample,
+} from "./cmaf-block-assembler.js";
+import { MmtpContainerParser, isMfuKeyframeMetadata } from "./mmtp-container-parser.js";
+import { type TrackRole } from "./carp-catalog.js";
+import type {
+  ManifestAuthMode,
+  ManifestObjectIdentity,
+  ManifestTrackContext,
+  ManifestVerifier,
+} from "@blockcast/mmt-manifest-verify";
+
+// ─── Constants ─────────────────────────────────────────────────────
+
+/**
+ * Keyframe loss timeout slack factor.
+ *
+ * Derivation: The keyframe loss timer must fire after one full keyframe group
+ * has been missed. Group duration must come from explicit catalog timing; FEC
+ * sourceSymbols is a block width, not a GOP length. Multicast jitter means the
+ * last packet of a group may arrive up to ~0.5 group durations late (network
+ * reordering + FEC recovery latency). The total timeout is therefore:
+ *
+ *   timeout = group_duration * (1.0 + 0.5_jitter) = group_duration * 1.5
+ *
+ * The 0.5 jitter margin covers: (a) FEC interleave recovery window (up to D
+ * frames), (b) network reordering within one interleave depth, and (c) OS
+ * socket buffer draining latency. This is tight enough to detect loss within
+ * one missing group while avoiding false positives from normal jitter.
+ */
+export const KEYFRAME_LOST_TIMEOUT_SLACK = 1.5;
+
+function isRouterDebugEnabled(): boolean {
+  const globalDebug = (globalThis as { __MMTP_ROUTER_DEBUG?: unknown }).__MMTP_ROUTER_DEBUG;
+  if (globalDebug === true || globalDebug === "true" || globalDebug === "1") return true;
+  const env = (globalThis as { process?: { env?: Record<string, string | undefined> } }).process
+    ?.env;
+  return env?.["MMTP_ROUTER_DEBUG"] === "1" || env?.["MMTP_ROUTER_DEBUG"] === "true";
+}
+function debugRouter(message: string): void {
+  if (isRouterDebugEnabled()) console.debug(message);
+}
+
+// ─── Types ──────────────────────────────────────────────────────────
+
+export type RoutedFrameMeta = {
+  /** Authored ISO-BMFF presentation timestamp, in microseconds. */
+  timestamp: number;
+  /**
+   * Raw MMTP short-NTP header timestamp. This is transport timing metadata
+   * only; it is deliberately separate from the authored media timestamp.
+   */
+  mmtpTimestamp?: bigint;
+  keyframe: boolean;
+  /** Exact ISO-BMFF timing in the media track's native timescale. */
+  authoredTiming?: AuthoredTiming;
+  /** Transport that supplied the accepted FI=1 head (or complete FI=0 frame). */
+  source?: MmtpSourcePath;
+  /**
+   * Whole-frame delivery verdict folded across every contributing fragment.
+   *
+   * Distinct from `source` on purpose. `source` answers a routing question —
+   * which transport's copy is this — and deliberately lets the head fragment
+   * decide. This answers an evidence question: did every byte of this frame
+   * physically arrive over multicast? A frame can be routed as 'multicast'
+   * and still be 'mixed'.
+   */
+  deliveryProvenance?: MmtpDeliveryProvenance;
+  packetId?: number;
+  packetSequenceNumber?: number;
+  /** Every authoritative MMTP source-packet sequence that formed this frame. */
+  packetSequenceNumbers?: number[];
+  /** Subset of packetSequenceNumbers reconstructed by FEC. */
+  repairedPacketSequenceNumbers?: number[];
+  /** Native MMTP MPU group coordinate. */
+  mpuSequenceNumber?: number;
+  /**
+   * Timed-MFU sample identity `(movie_fragment_sequence_number, sample_number)`
+   * from the MFU data-unit header. Absent when the MFU header is untimed.
+   */
+  movieFragmentSequenceNumber?: number;
+  sampleNumber?: number;
+  /** Immutable catalog identity supplied by the owning ingress subscription. */
+  catalogTrackName?: string;
+  recovered?: boolean;
+  /**
+   * True when this frame opens playback after the router suppressed earlier
+   * video deltas while waiting for a sync keyframe. Downstream decoders can
+   * use this to treat the following dependency chain as provisional.
+   */
+  sourceDiscontinuity?: boolean;
+};
+
+export interface MmtpIngressContext {
+  tracks: readonly Readonly<{ name: string; packetId: number }>[];
+}
+
+function catalogTrackNameForPacket(
+  ingress: MmtpIngressContext | undefined,
+  packetId: number,
+): string | undefined {
+  if (!ingress) return undefined;
+  const names = new Set(
+    ingress.tracks
+      .filter((track) => track.packetId === packetId && track.name.length > 0)
+      .map((track) => track.name),
+  );
+  return names.size === 1 ? names.values().next().value : undefined;
+}
+
+function hasAmbiguousCatalogTrackName(
+  ingress: MmtpIngressContext | undefined,
+  packetId: number,
+): boolean {
+  if (!ingress) return false;
+  const names = new Set(
+    ingress.tracks
+      .filter((track) => track.packetId === packetId && track.name.length > 0)
+      .map((track) => track.name),
+  );
+  return names.size > 1;
+}
+
+function ingressHasPacketId(
+  ingress: MmtpIngressContext | undefined,
+  packetId: number,
+): boolean {
+  // Direct/legacy callers have no catalog-backed ingress policy to enforce.
+  // MulticastManager supplies a populated context whenever packetIds are selected.
+  return ingress === undefined || ingress.tracks.some((track) => track.packetId === packetId);
+}
+
+/** Callback for decoded video/audio frames. */
+export type FrameCallback = (data: Uint8Array, meta: RoutedFrameMeta) => void;
+
+/** Metadata accompanying an accepted raw MMTP source packet. */
+export type RoutedPacketMeta = {
+  packetId: number;
+  packetSequenceNumber: number;
+  /** True when FEC reconstructed this source packet. */
+  recovered: boolean;
+  /** True when the packet has no trailing Source FEC Payload ID. */
+  skipFecPayloadId: boolean;
+  /** Immutable catalog identity supplied by the owning ingress subscription. */
+  catalogTrackName?: string;
+  /**
+   * Strict provenance for the fragments this packet produces. Set for
+   * FEC-recovered packets, which carry no `source` of their own but inherit
+   * their FEC block's symbol provenance.
+   */
+  deliveryProvenance?: MmtpDeliveryProvenance;
+};
+
+/** Callback for accepted raw MMTP source packets. */
+export type TrackPacketCallback = (packet: Uint8Array, meta: RoutedPacketMeta) => void;
+
+type PendingRecoveredVideoFrame = {
+  data: Uint8Array;
+  meta: RoutedFrameMeta;
+};
+
+type PendingRecoveredAudioFrame = {
+  data: Uint8Array;
+  meta: RoutedFrameMeta;
+};
+
+type DirectAudioCursor = {
+  timestamp: number;
+  sequenceNumber: number;
+};
+
+const DIRECT_RECOVERED_VIDEO_QUEUE_LIMIT = 512;
+const DIRECT_RECOVERED_AUDIO_QUEUE_LIMIT = 512;
+
+type ParserDiagnostics = {
+  packets: number;
+  frames: number;
+  initSegments: number;
+  noFragment: number;
+  fragments: number;
+  reassembled: number;
+  pendingBuffers: number;
+  pendingFragments: number;
+  pendingSamples?: unknown[];
+  lastPacketLength: number;
+  lastSequenceNumber: number;
+  lastFecSsId?: number;
+  lastFrameTimestamp?: number;
+  directAudioSourceEmitted: number;
+  directAudioSourceRegressions: number;
+  directAudioRecoveredQueued: number;
+  directAudioRecoveredDrained: number;
+  directAudioRecoveredStaleDropped: number;
+};
+
+/**
+ * FECManager interface — the contract MmtpRouter expects for FEC
+ * source/repair symbol processing and block lifecycle events.
+ *
+ * Concrete implementation: `FECManager` class in `./fec-manager.ts`.
+ * MmtpRouter only interacts with FEC through this interface.
+ */
+export interface FECManagerLike {
+  /** Feed a source symbol to the FEC decoder for a given track.
+   *  Returns recovered block bytes if recovery completes, else null.
+   *
+   *  Optional `alta` carries the detached ALTA authenticator extracted from
+   *  the MMTP header-extension trailer (08-07 Path 2) — present on signed
+   *  source packets, absent on relay-reassembled / unsigned streams. When
+   *  provided, the fec-worker runs verify_detached instead of counting the
+   *  symbol as `altaPending`. */
+  feedSourceSymbol(
+    packetId: number,
+    ssId: number,
+    symbolData: Uint8Array,
+    alta?: { auth: Uint8Array; payloadEnd: number },
+    catalogTrackName?: string,
+  ): Uint8Array | null;
+
+  /** Feed a repair symbol to the FEC decoder for a given track.
+   *  Returns recovered block bytes if recovery completes, else null. */
+  feedRepairSymbol(
+    packetId: number,
+    ssStart: number,
+    ssbLength: number,
+    rsId: number,
+    repairData: Uint8Array,
+    catalogTrackName?: string,
+  ): Uint8Array | null;
+
+  /** Record a transport symbol for first-arrival-wins dedup and path counters. */
+  feedSymbolFromSource(
+    packetId: number,
+    sbn: number,
+    esi: number,
+    data: Uint8Array,
+    source: "multicast" | "moq",
+    catalogTrackName?: string,
+  ): boolean;
+
+  /** Strict provenance for a block: 'multicast' only when no symbol arrived
+   *  over MoQ. Recovered bytes inherit it, since a recovered symbol is a
+   *  function of every symbol that entered the block. */
+  blockDeliveryProvenance?(
+    sbn: number,
+    packetId: number,
+    catalogTrackName?: string,
+  ): MmtpDeliveryProvenance;
+
+  /** Track a source symbol arrival for block completion counting.
+   *  Refreshes the inactivity deadline and marks clean when K arrive. */
+  trackBlock(
+    sbn: number,
+    packetId: number,
+    catalogTrackName?: string,
+    esi?: number,
+  ): void;
+
+  /** Refresh the block inactivity deadline after accepted repair progress. */
+  noteBlockActivity?(sbn: number, packetId: number, catalogTrackName?: string): void;
+
+  /** Cancel block timeout (block completed via clean or FEC recovery). */
+  cancelBlockTimeout(sbn: number, packetId?: number, catalogTrackName?: string): void;
+
+  /** Check if a block is already completed (clean or recovered). */
+  isBlockCompleted(sbn: number, packetId?: number, catalogTrackName?: string): boolean;
+
+  /** Mark a block as completed externally (after routing recovered data). */
+  markBlockCompleted(sbn: number, packetId?: number, catalogTrackName?: string): void;
+
+  /** Increment blocksRecovered stat (called after routing recovery). */
+  countRecovery(packetId?: number): void;
+
+  /** FEC source symbol count K per block. */
+  readonly k: number;
+  kForPacket?(packetId: number): number;
+
+  /** FEC symbol size T in bytes (0 = unknown / no FEC). */
+  readonly symbolSize: number;
+  symbolSizeForPacket?(packetId: number): number;
+
+  /** Update framerate — used to refine FEC block timeout. */
+  setFramerate(fps: number): void;
+
+  /** Per-block state snapshot for FecBlockGrid visualization. */
+  getBlockStates(): Array<{
+    sbn: number;
+    packetId?: number;
+    state: "collecting" | "complete" | "failed";
+    sourceCount: number;
+    k: number;
+    progress: number;
+  }>;
+
+  /** FEC statistics snapshot. */
+  readonly fecStats: {
+    sourcePackets: number;
+    repairPackets: number;
+    blocksClean: number;
+    blocksRecovered: number;
+    blocksFailed: number;
+    greenFillFrames: number;
+  };
+
+  // ── Event hooks (set by MmtpRouter in constructor) ──
+
+  /** Called when a block receives its first source symbol. */
+  onBlockStarted:
+    | ((sbn: number, packetId: number, catalogTrackName?: string) => void)
+    | null;
+
+  /** Called when a block completes cleanly (all K sources arrived). */
+  onBlockComplete:
+    | ((sbn: number, packetId: number, catalogTrackName?: string) => void)
+    | null;
+
+  /** Called when a block times out (unrecoverable). */
+  onBlockFailed:
+    | ((sbn: number, packetId: number, catalogTrackName?: string) => void)
+    | null;
+
+  /** Dispose timers and state. */
+  dispose(): void;
+}
+
+// ─── MmtpRouter ─────────────────────────────────────────────────────
+
+export interface ManifestIdentityResolutionInput {
+  packetId: number;
+  sbn: number;
+  esi: number;
+  catalogTrackName?: string;
+  recovered: boolean;
+  sourceSymbolFormat: "full-mmtp-packet" | "fec-padded-recovery";
+}
+
+export type ManifestIdentityResolver = (
+  input: ManifestIdentityResolutionInput,
+) => ManifestObjectIdentity | null;
+
+export class MmtpRouter {
+  readonly #parser: MmtpContainerParser;
+  // Source AND FEC-recovered MFU fragments share ONE reassembler — the parser's
+  // (see #parser.reassembler). A keyframe split between source-received and
+  // FEC-recovered fragments must reassemble in a single buffer (BLO-8151).
+  readonly #fecManager: FECManagerLike | null;
+  #defaultFecMapper: FecBlockMapper | null;
+  #fecMappersByPacketId = new Map<number, FecBlockMapper>();
+  readonly #manifestVerifier: ManifestVerifier | null;
+  readonly #ownsManifestVerifier: boolean;
+  readonly #resolveManifestIdentity:
+    | ((
+        packetId: number,
+        sbn: number,
+        esi: number,
+        catalogTrackName?: string,
+      ) => ManifestObjectIdentity | null)
+    | null;
+  readonly #resolveManifestIdentityForRoute: ManifestIdentityResolver | null;
+  #manifestRecoveryQueues = new Map<
+    string,
+    Array<{
+      blockId: number;
+      result: ProcessFecBlockResult;
+      ownerPacketId: number;
+      catalogTrackName?: string;
+    }>
+  >();
+
+  // Temp state set by #processMMTP before calling parser.feed(),
+  // read by the parser's onFrame callback for CMAF assembly + dedup.
+  #currentFecInfo:
+    | { sbn: number; esi: number; oversized?: boolean }
+    | undefined;
+  #currentSeqNum = 0;
+
+  // Track type registry: which packetIds are video vs audio (from catalog)
+  #videoPacketIds = new Set<number>();
+  #audioPacketIds = new Set<number>();
+  #catalogTrackNamesByPacketId = new Map<number, Set<string>>();
+
+  // Per-track codec string for keyframe detection (e.g. 'avc1.42001e', 'av01.0.04M.08')
+  #trackCodecs = new Map<number, string>();
+
+  // Per-track frame callbacks keyed by packetId — used for ABR / multi-track routing
+  #trackCallbacks = new Map<
+    number,
+    FrameCallback
+  >();
+  #trackPacketCallbacks = new Map<number, TrackPacketCallback>();
+  // Cached resolved callbacks: per-track + legacy composite per packetId.
+  // Invalidated when any callback is registered (onTrackFrame, onVideoFrame, onAudioFrame).
+  #resolvedCallbacks = new Map<number, FrameCallback>();
+
+  // Per-ingress-stream sync flag: suppress direct frame emission until the first complete
+  // FEC block confirms we've joined mid-stream cleanly. Prevents corrupt partial
+  // frames from reaching the decoder on multicast mid-stream join. Catalog
+  // identity keeps renditions that reuse a packet ID from opening each other's gate.
+  #trackSynced = new Set<string>();
+  #droppedPreSyncVideo = new Set<string>();
+
+  // Dedup: packetId-scoped packetSequenceNumbers already received via direct source path.
+  // Recovered FEC blocks contain all K source symbols, so skip direct-path
+  // duplicates even when the source frame is still buffered by parser reordering.
+  #sourcePktSeqs = new Set<string>();
+  #routedPacketSeqs = new Set<string>();
+
+  // Live WebCodecs callbacks cannot accept late recovered inter-frame video.
+  // MSE recovery routes through CmafBlockAssembler and can reorder by block; the
+  // direct callback path has to preserve decode order before frames leave libmmt.
+  #latestVideoSeqByStream = new Map<string, number>();
+  #lastDirectSourceVideoTsByStream = new Map<string, number>();
+  #lastDirectEmittedVideoTsByStream = new Map<string, number>();
+  #pendingDirectRecoveredVideoByStream = new Map<string, Map<string, PendingRecoveredVideoFrame>>();
+  // AudioDecoder input must remain monotonic too. A repair that completes after
+  // the live source cursor passed its AAC access unit is useful for FEC
+  // accounting, but injecting it into the decoder can stall PCM output.
+  #lastDirectSourceAudioCursorByStream = new Map<string, DirectAudioCursor>();
+  #lastDirectEmittedAudioCursorByStream = new Map<string, DirectAudioCursor>();
+  #pendingDirectRecoveredAudioByStream = new Map<string, Map<string, PendingRecoveredAudioFrame>>();
+
+  // Per-track CMAF block assemblers for MSE mode. When active, frames are buffered per-SBN
+  // and emitted as multi-sample CMAF segments on block completion instead of per-frame.
+  #mseAssemblers = new Map<string, CmafBlockAssembler>();
+
+  // Callbacks (legacy — used when per-track callbacks are not registered)
+  #onVideoFrame: FrameCallback | null = null;
+  #onAudioFrame: FrameCallback | null = null;
+
+  // Init segment (ftyp+moov) from MMTP MPU metadata — needed for MSE SourceBuffer
+  #onInitSegment: ((data: Uint8Array) => void) | null = null;
+
+  // Per-track init segment callbacks keyed by packetId
+  #trackInitCallbacks = new Map<number, (data: Uint8Array) => void>();
+  // Track whether init has been delivered per physical stream — prevent duplicates
+  #trackInitDelivered = new Set<string>();
+
+  // FEC block lifecycle — backend decides failed handling: WebCodecs=freeze, MSE=green fill
+  #onBlockStarted: ((sbn: number, packetId: number) => void) | null = null;
+  /** Subscriber for unrecoverable FEC blocks. Mirrors #onBlockStarted so
+   *  players can drive decoder recovery when a block times out; the internal
+   *  MSE/delta-role handling below stays independent of this subscriber. */
+  #onBlockFailed:
+    | ((sbn: number, packetId: number, catalogTrackName?: string) => void)
+    | null = null;
+  // ── Phase 14: per-role packetId dispatch (D-26, D-27, D-28) ───────
+  /** Maps packetId → TrackRole. Default: 'single' when absent (legacy path). */
+  #packetIdRoles: Map<number, TrackRole> = new Map();
+  /** Explicit catalog ownership for dedicated repair-track packet IDs. */
+  #repairOwnersByPacketId = new Map<number, Set<number>>();
+  /** Callback fired when a delta-track FEC block completes or fails. */
+  #onDeltaBlockCompleteCb:
+    | ((packetId: number, failed: boolean) => void)
+    | null = null;
+
+  // Debug counters
+  #pidCounts: Record<number, number> = {};
+  #repairPidCounts: Record<number, number> = {};
+  #moqRepairPidCounts: Record<number, number> = {};
+  #moqRepairOwnerCounts: Record<number, number> = {};
+  #parserDiagnostics = new Map<string, ParserDiagnostics>();
+
+  // ── Keyframe loss detection state ───────────────────────────────
+  /** Catalog-derived keyframe loss timeout (ms). null = not configured (throws on video track registration). */
+  #keyframeLostTimeoutMs: number | null;
+  /** Active keyframe loss timer handle. Single timer per video track — cleared on each rapFlag and on dispose(). */
+  #keyframeLostTimer: ReturnType<typeof setTimeout> | null = null;
+  /** Monotonic counter incremented on each emitted video keyframe. Tracks current GOP position. */
+  #lastKeyframeGroupId = 0;
+  /** Callback fired when no complete keyframe is emitted within keyframeLostTimeoutMs. Argument: next expected groupId. */
+  #onKeyframeLost: ((expectedGroupId: number) => void) | null = null;
+
+  #disposed = false;
+
+  constructor(config?: {
+    fecManager?: FECManagerLike;
+    fecMapper?: FecBlockMapper;
+    /** MFU reassembly timeout (ms) for FEC recovery path. Derive from FEC interleaveDepthMs. */
+    mfuTimeoutMs?: number;
+    reassemblyPolicy?: MfuReassemblyPolicy;
+    reassembler?: MfuReassemblerBackend;
+    maxBufferedMfus?: number;
+    /** Catalog-derived keyframe loss timeout (ms). Derive from explicit
+     *  keyframe/group duration; do not use FEC sourceSymbols as GOP length. */
+    keyframeLostTimeoutMs?: number;
+    manifestVerifier?: ManifestVerifier;
+    /** Existing behavior is router ownership; shared browser plans opt into caller ownership. */
+    manifestVerifierOwnership?: "caller" | "router";
+    resolveManifestIdentity?: (
+      packetId: number,
+      sbn: number,
+      esi: number,
+      catalogTrackName?: string,
+    ) => ManifestObjectIdentity | null;
+    resolveManifestIdentityForRoute?: ManifestIdentityResolver;
+    /** Internal terminal-failure sink owned by the composing transport. */
+    onBlockFailed?: (
+      sbn: number,
+      packetId: number,
+      catalogTrackName?: string,
+    ) => void;
+  }) {
+    this.#keyframeLostTimeoutMs = config?.keyframeLostTimeoutMs ?? null;
+    this.#fecManager = config?.fecManager ?? null;
+    this.#defaultFecMapper = config?.fecMapper ?? null;
+    this.#manifestVerifier = config?.manifestVerifier ?? null;
+    this.#ownsManifestVerifier = config?.manifestVerifierOwnership !== "caller";
+    this.#resolveManifestIdentity = config?.resolveManifestIdentity ?? null;
+    this.#resolveManifestIdentityForRoute = config?.resolveManifestIdentityForRoute ?? null;
+
+    // Create MMTP parser — handles MFU extraction, reassembly, keyframe detection.
+    // Its MFUReassembler is the single reassembler for BOTH the source path
+    // (parser.feed) and the FEC-recovery path (#routeRecoveredBlock), so a frame
+    // split across both completes (BLO-8151). mfuTimeoutMs threads the
+    // catalog-derived timeout through.
+    this.#parser = new MmtpContainerParser({
+      mfuTimeoutMs: config?.mfuTimeoutMs,
+      reassemblyPolicy: config?.reassemblyPolicy,
+      reassembler: config?.reassembler,
+      maxBufferedMfus: config?.maxBufferedMfus,
+    });
+
+    // Wire parser init callback → router's init delivery (dedup).
+    this.#parser.onInit((data, packetId, catalogTrackName) => {
+      this.#diagFor(packetId, catalogTrackName).initSegments++;
+      this.#deliverInit(packetId, data, catalogTrackName);
+    });
+
+    // Wire parser frame callback → router's callback routing + CMAF assembly.
+    this.#parser.onFrame((data, meta) => {
+      const packetId = meta.packetId;
+      const diag = this.#diagFor(packetId, meta.catalogTrackName);
+      diag.frames++;
+      diag.lastFrameTimestamp = meta.timestamp;
+      const isVideo = this.#classifyPacketId(packetId) === true;
+      const frameMeta: RoutedFrameMeta = {
+        timestamp: meta.timestamp,
+        ...(meta.mmtpTimestamp === undefined
+          ? {}
+          : { mmtpTimestamp: meta.mmtpTimestamp }),
+        keyframe: isVideo ? meta.keyframe : true,
+        packetId,
+        packetSequenceNumber: meta.packetSequenceNumber ?? this.#currentSeqNum,
+        ...(meta.authoredTiming === undefined
+          ? {}
+          : { authoredTiming: meta.authoredTiming }),
+        ...(meta.packetSequenceNumbers === undefined
+          ? {}
+          : { packetSequenceNumbers: meta.packetSequenceNumbers }),
+        ...(meta.repairedPacketSequenceNumbers === undefined
+          ? {}
+          : { repairedPacketSequenceNumbers: meta.repairedPacketSequenceNumbers }),
+        ...(meta.mpuSequenceNumber === undefined
+          ? {}
+          : { mpuSequenceNumber: meta.mpuSequenceNumber }),
+        ...(meta.movieFragmentSequenceNumber === undefined
+          ? {}
+          : { movieFragmentSequenceNumber: meta.movieFragmentSequenceNumber }),
+        ...(meta.sampleNumber === undefined
+          ? {}
+          : { sampleNumber: meta.sampleNumber }),
+        ...(meta.catalogTrackName === undefined
+          ? {}
+          : { catalogTrackName: meta.catalogTrackName }),
+      };
+      if (meta.source) frameMeta.source = meta.source;
+      // Forward whenever present, not when truthy: 'unknown' is a verdict the
+      // parser reached, not a value to drop.
+      if (meta.deliveryProvenance !== undefined)
+        frameMeta.deliveryProvenance = meta.deliveryProvenance;
+      if (meta.recovered) frameMeta.recovered = true;
+      const sourceDiscontinuity = this.#opensFecSync(
+        packetId,
+        frameMeta.keyframe,
+        frameMeta.catalogTrackName,
+      );
+
+      // Route to MSE assembler if active for this track.
+      const assembler = this.#mseAssemblerFor(packetId, frameMeta.catalogTrackName);
+      if (assembler) {
+        const fecInfo = this.#currentFecInfo;
+        if (fecInfo && !fecInfo.oversized) {
+          assembler.addFrame(
+            fecInfo.sbn,
+            fecInfo.esi,
+            data,
+            frameMeta.timestamp,
+            frameMeta.keyframe,
+            frameMeta.catalogTrackName,
+            frameMeta.mpuSequenceNumber,
+            frameMeta.packetSequenceNumber,
+            frameMeta.packetSequenceNumbers,
+            frameMeta.repairedPacketSequenceNumbers,
+            frameMeta.authoredTiming,
+            frameMeta.deliveryProvenance,
+            frameMeta.mmtpTimestamp,
+            frameMeta.movieFragmentSequenceNumber,
+            frameMeta.sampleNumber,
+          );
+        } else {
+          assembler.addBypassFrame(
+            data,
+            frameMeta.timestamp,
+            frameMeta.keyframe,
+            frameMeta.catalogTrackName,
+            frameMeta.mpuSequenceNumber,
+            frameMeta.packetSequenceNumber,
+            frameMeta.packetSequenceNumbers,
+            frameMeta.repairedPacketSequenceNumbers,
+            frameMeta.authoredTiming,
+            frameMeta.deliveryProvenance,
+            frameMeta.mmtpTimestamp,
+            frameMeta.movieFragmentSequenceNumber,
+            frameMeta.sampleNumber,
+          );
+        }
+      }
+
+      if (!this.#shouldEmitFrame(
+        packetId,
+        frameMeta.keyframe,
+        frameMeta.catalogTrackName,
+      )) return;
+      if (sourceDiscontinuity) frameMeta.sourceDiscontinuity = true;
+
+      this.#noteEmittedKeyframe(packetId, frameMeta.keyframe);
+
+      // The emitted-sequence high-water mark (#noteEmittedVideoSeq) is recorded
+      // at the actual emit inside #emitDirectVideo, not here — a recovered frame
+      // can be queued ahead of the source cursor, so it must track real emits.
+
+      // Route to per-track or legacy callback. Even when an MSE block-assembler
+      // is registered, this callback still fires — downstream consumers
+      // (`mc.onVideoFrame` → takeover detection, multicast frame counter,
+      // `confirmVideo`/`confirmAudio`) need every reassembled frame. The
+      // SourceBuffer-write side of this callback path is suppressed inside
+      // `MseBackend.feedVideo`/`feedAudio` when the assembler owns the track,
+      // which is configured via `MseBackend.setAssemblerOwns('video' | 'audio')`.
+      // Prevents the dual-CMAF-timeline collision (BLO-3035 layer 3).
+      const cb = this.#getFrameCallback(packetId);
+      if (isVideo && !assembler) {
+        if (frameMeta.recovered) {
+          this.#routeDirectRecoveredVideo(packetId, data, frameMeta, cb);
+        } else {
+          this.#routeDirectSourceVideo(packetId, data, frameMeta, cb);
+        }
+      } else if (!isVideo && !assembler) {
+        if (frameMeta.recovered) {
+          this.#routeDirectRecoveredAudio(packetId, data, frameMeta, cb);
+        } else {
+          this.#routeDirectSourceAudio(packetId, data, frameMeta, cb);
+        }
+      } else {
+        cb?.(data, frameMeta);
+      }
+    });
+
+    // Wire up FECManager block lifecycle events.
+    // NOTE: Recovery routing is handled from feedSourceSymbol/feedRepairSymbol
+    // return values in #processMMTP — no onBlockRecovered event needed.
+    if (this.#fecManager) {
+      this.#fecManager.onBlockStarted = (
+        sbn: number,
+        packetId: number,
+        _catalogTrackName?: string,
+      ) => {
+        this.#onBlockStarted?.(sbn, packetId);
+      };
+
+      this.#fecManager.onBlockComplete = (
+        sbn: number,
+        packetId: number,
+        catalogTrackName?: string,
+      ) => {
+        this.#mseAssemblerFor(packetId, catalogTrackName)?.completeBlock(sbn);
+        // Phase 14 D-26: fan-out to delta callback when delta-role packetId completes.
+        if (
+          this.#isCatalogTrackUnambiguous(packetId, catalogTrackName) &&
+          this.#packetIdRoles.get(packetId) === "delta"
+        ) {
+          this.#onDeltaBlockCompleteCb?.(packetId, false); // failed=false
+        }
+      };
+
+      this.#fecManager.onBlockFailed = (
+        sbn: number,
+        packetId: number,
+        catalogTrackName?: string,
+      ) => {
+        this.#mseAssemblerFor(packetId, catalogTrackName)?.failBlock(sbn);
+        if (
+          this.#isCatalogTrackUnambiguous(packetId, catalogTrackName) &&
+          this.#packetIdRoles.get(packetId) === "delta"
+        ) {
+          this.#onDeltaBlockCompleteCb?.(packetId, true); // failed=true
+        }
+        config?.onBlockFailed?.(sbn, packetId, catalogTrackName);
+        this.#onBlockFailed?.(sbn, packetId, catalogTrackName);
+      };
+    }
+  }
+
+  // ── Accessors ───────────────────────────────────────────────────
+
+  get fecManager(): FECManagerLike | null {
+    return this.#fecManager;
+  }
+
+  get reassembler(): MfuReassemblerBackend {
+    return this.#parser.reassembler;
+  }
+
+  getDiagnostics(): Record<number, ParserDiagnostics> {
+    const out: Record<number, ParserDiagnostics> = {};
+    for (const [key, diag] of this.#parserDiagnostics) {
+      const packetId = this.#packetIdFromStreamKey(key);
+      const existing = out[packetId];
+      if (!existing) {
+        out[packetId] = { ...diag };
+        continue;
+      }
+      const latest =
+        diag.lastSequenceNumber >= existing.lastSequenceNumber ? diag : existing;
+      out[packetId] = {
+        packets: existing.packets + diag.packets,
+        frames: existing.frames + diag.frames,
+        initSegments: existing.initSegments + diag.initSegments,
+        noFragment: existing.noFragment + diag.noFragment,
+        fragments: existing.fragments + diag.fragments,
+        reassembled: existing.reassembled + diag.reassembled,
+        pendingBuffers: existing.pendingBuffers + diag.pendingBuffers,
+        pendingFragments: existing.pendingFragments + diag.pendingFragments,
+        directAudioSourceEmitted:
+          existing.directAudioSourceEmitted + diag.directAudioSourceEmitted,
+        directAudioSourceRegressions:
+          existing.directAudioSourceRegressions + diag.directAudioSourceRegressions,
+        directAudioRecoveredQueued:
+          existing.directAudioRecoveredQueued + diag.directAudioRecoveredQueued,
+        directAudioRecoveredDrained:
+          existing.directAudioRecoveredDrained + diag.directAudioRecoveredDrained,
+        directAudioRecoveredStaleDropped:
+          existing.directAudioRecoveredStaleDropped + diag.directAudioRecoveredStaleDropped,
+        pendingSamples: [
+          ...((existing.pendingSamples as unknown[]) ?? []),
+          ...((diag.pendingSamples as unknown[]) ?? []),
+        ],
+        lastPacketLength: latest.lastPacketLength,
+        lastSequenceNumber: latest.lastSequenceNumber,
+        ...(latest.lastFecSsId === undefined ? {} : { lastFecSsId: latest.lastFecSsId }),
+        ...(latest.lastFrameTimestamp === undefined
+          ? {}
+          : { lastFrameTimestamp: latest.lastFrameTimestamp }),
+      };
+    }
+    return out;
+  }
+
+  // ── Track configuration ─────────────────────────────────────────
+
+  /** Register callback for keyframe loss detection.
+   *  Fires when no complete keyframe is emitted within keyframeLostTimeoutMs.
+   *  Argument: next expected groupId (lastKeyframeGroupId + 1). */
+  onKeyframeLost(cb: (expectedGroupId: number) => void): void {
+    this.#onKeyframeLost = cb;
+  }
+
+  /**
+   * Set the keyframe loss timeout after construction.
+   * Must be called BEFORE setPacketIdType('video').
+   * Derive from explicit keyframe/group duration:
+   * Math.ceil(groupDurationMs * KEYFRAME_LOST_TIMEOUT_SLACK).
+   */
+  setKeyframeLostTimeoutMs(ms: number): void {
+    this.#keyframeLostTimeoutMs = ms;
+  }
+
+  /** Update MFU reassembly timeout. Source and FEC-recovery paths share the
+   *  parser's single reassembler (BLO-8151), so one update covers both. */
+  setMfuTimeoutMs(ms: number): void {
+    if (ms <= 0) throw new Error("[MmtpRouter] mfuTimeoutMs must be > 0");
+    this.#parser.setMfuTimeoutMs(ms);
+  }
+
+  /** Update parser frame reordering for unordered multicast delivery.
+   *  Callers derive this from the catalog FEC block span (§5.1 — the
+   *  interleave value IS the span): positive round-half-up of span / frameMs. */
+  setReorderWindow(windowSize: number): void {
+    this.#parser.setReorderWindow(windowSize);
+  }
+
+  /** Register MMTP packetId → track type mapping.
+   *  Call BEFORE packets arrive to ensure correct routing from the first packet.
+   *  If keyframeLostTimeoutMs is not provided, Phase 13 keyframe repair is
+   *  disabled (video still routes/decodes normally). framerate is OPTIONAL per
+   *  draft-ietf-moq-catalogformat-01 §3.2.23, so we can't require the timeout. */
+  setPacketIdType(packetId: number, trackType: "video" | "audio"): void {
+    if (trackType === "video" && this.#keyframeLostTimeoutMs === null) {
+      console.warn(
+        "[MmtpRouter] keyframeLostTimeoutMs not configured — Phase 13 keyframe " +
+          "repair disabled for this track. Set it via setKeyframeLostTimeoutMs() " +
+          "or provide in constructor config to enable: " +
+          "Math.ceil(groupDurationMs * KEYFRAME_LOST_TIMEOUT_SLACK).",
+      );
+    }
+    if (trackType === "video") this.#videoPacketIds.add(packetId);
+    else this.#audioPacketIds.add(packetId);
+    // Sync track info to parser for codec-aware keyframe detection.
+    const codec = this.#trackCodecs.get(packetId) ?? "";
+    this.#parser.setTrack(packetId, { type: trackType, codec });
+  }
+
+  /** Register codec string for a packetId — enables codec-aware keyframe detection.
+   *  Without this, only H.264 IDR (NAL type 5) is detected as keyframe fallback.
+   *  AV1 (OBU_SEQUENCE_HEADER) and VP9 (frame_type bit) require the codec string. */
+  setTrackCodec(packetId: number, codec: string): void {
+    this.#trackCodecs.set(packetId, codec);
+    // Sync to parser. Determine track type from existing registration.
+    const trackType = this.#videoPacketIds.has(packetId)
+      ? ("video" as const)
+      : this.#audioPacketIds.has(packetId)
+        ? ("audio" as const)
+        : null;
+    if (trackType) {
+      this.#parser.setTrack(packetId, { type: trackType, codec });
+    }
+  }
+
+  // ── Frame callbacks ─────────────────────────────────────────────
+
+  /** @deprecated Use onTrackFrame(packetId, cb) for per-track routing */
+  onVideoFrame(cb: FrameCallback): void {
+    this.#onVideoFrame = cb;
+    this.#resolvedCallbacks.clear();
+  }
+
+  /** @deprecated Use onTrackFrame(packetId, cb) for per-track routing */
+  onAudioFrame(cb: FrameCallback): void {
+    this.#onAudioFrame = cb;
+    this.#resolvedCallbacks.clear();
+  }
+
+  /** Register a frame callback for a specific MMTP packetId (track).
+   *  When a legacy callback (onVideoFrame/onAudioFrame) also exists for this
+   *  packetId's type, both fire: per-track first, then legacy. This ensures
+   *  element.ts wiring (confirmAudio, feedMulticast) continues working when
+   *  TrackPipeline registers per-track sources. */
+  onTrackFrame(
+    packetId: number,
+    cb: FrameCallback,
+  ): void {
+    this.#trackCallbacks.set(packetId, cb);
+    this.#resolvedCallbacks.clear();
+  }
+
+  /** Register a raw MMTP source-packet callback for one track.
+   *
+   * Direct packets retain their original bytes, including a Source FEC Payload
+   * ID when present. FEC-recovered packets are the recovered source-symbol
+   * bytes and set `skipFecPayloadId` because that trailer is not part of the
+   * protected symbol. Repair packets are never delivered here.
+   */
+  onTrackPacket(packetId: number, cb: TrackPacketCallback): void {
+    this.#trackPacketCallbacks.set(packetId, cb);
+  }
+
+  /** Register an init segment callback (ftyp+moov from MMTP MPU metadata). */
+  onInitSegment(cb: (data: Uint8Array) => void): void {
+    this.#onInitSegment = cb;
+  }
+
+  /** Register an init segment callback for a specific MMTP packetId.
+   *  Called when FT=0 init arrives via direct source or FEC recovery. */
+  onTrackInit(packetId: number, cb: (data: Uint8Array) => void): void {
+    this.#trackInitCallbacks.set(packetId, cb);
+  }
+
+  // ── MSE integration ─────────────────────────────────────────────
+
+  /** Create a CMAF block assembler for MSE mode on a specific track.
+   *  When active, source frames are buffered per FEC block and emitted as
+   *  multi-sample CMAF segments instead of per-frame callbacks. */
+  enableMseAssembler(
+    packetId: number,
+    config: Omit<BlockAssemblerConfig, "k">,
+    catalogTrackName?: string,
+  ): CmafBlockAssembler {
+    const k = this.#kForPacket(packetId);
+    const assemblerKey = this.#mseAssemblerKey(packetId, catalogTrackName);
+    const previous = this.#mseAssemblers.get(assemblerKey);
+    if (previous) {
+      previous.flush();
+      previous.dispose();
+    }
+    const assembler = new CmafBlockAssembler({ ...config, k });
+    this.#mseAssemblers.set(assemblerKey, assembler);
+    console.log(
+      `[MmtpRouter] MSE assembler enabled for packetId=${packetId}${catalogTrackName === undefined ? "" : ` track=${catalogTrackName}`} (K=${k}, ${config.trackType})`,
+    );
+    return assembler;
+  }
+
+  /** Register a segment callback for a track's MSE assembler.
+   *  Called with complete moof+mdat CMAF segments on block completion. */
+  onMseSegment(packetId: number, cb: (segment: Uint8Array) => void, catalogTrackName?: string): void {
+    const assembler = this.#mseAssemblers.get(this.#mseAssemblerKey(packetId, catalogTrackName));
+    if (assembler) assembler.onSegment = cb;
+  }
+
+  /** Register a raw-sample callback for a track's MSE assembler.
+   *  Use this when the caller already owns the fMP4/MSE timeline and only wants
+   *  FEC recovery, keyframe gating, and dedup from the assembler. */
+  onMseSample(packetId: number, cb: (sample: CmafBlockSample) => void, catalogTrackName?: string): void {
+    const assembler = this.#mseAssemblers.get(this.#mseAssemblerKey(packetId, catalogTrackName));
+    if (assembler) assembler.onSample = cb;
+  }
+
+  /** Register an init segment callback for a track's MSE assembler. */
+  onMseInitSegment(packetId: number, cb: (init: Uint8Array) => void, catalogTrackName?: string): void {
+    const assembler = this.#mseAssemblers.get(this.#mseAssemblerKey(packetId, catalogTrackName));
+    if (assembler) assembler.onInitSegment = cb;
+  }
+
+  /** Build and emit init segment for a track's MSE assembler from catalog config. */
+  emitMseInit(packetId: number, catalogTrackName?: string): void {
+    this.#mseAssemblers.get(this.#mseAssemblerKey(packetId, catalogTrackName))?.emitInit();
+  }
+
+  /** Mark a video track as synchronized by an external path.
+   *  This opens the MMTP/FEC pre-sync gates without waiting for a multicast
+   *  keyframe, for MSE timelines already seeded by MoQ with the same track. */
+  markExternalVideoSync(packetId?: number, catalogTrackName?: string): void {
+    const packetIds =
+      packetId === undefined
+        ? [...this.#videoPacketIds]
+        : this.#videoPacketIds.has(packetId)
+          ? [packetId]
+          : [];
+    for (const id of packetIds) {
+      const streamKey = this.#mediaStreamKey(id, catalogTrackName);
+      this.#trackSynced.add(streamKey);
+      this.#droppedPreSyncVideo.delete(streamKey);
+      this.#mseAssemblerFor(id, catalogTrackName)?.markVideoSynced();
+    }
+  }
+
+  // ── FEC event handler ───────────────────────────────────────────
+
+  /** Register callback for FEC blocks when the first source symbol arrives. */
+  onFecBlockStarted(cb: (sbn: number, packetId: number) => void): void {
+    this.#onBlockStarted = cb;
+  }
+
+  /** Register callback for FEC blocks that time out unrecoverably. Players use
+   *  this to recover a decoder that was starved by the lost block. */
+  onFecBlockFailed(
+    cb: (sbn: number, packetId: number, catalogTrackName?: string) => void,
+  ): void {
+    this.#onBlockFailed = cb;
+  }
+
+  // ── Phase 14: per-role packetId dispatch (D-26, D-27, D-28) ────────
+
+  /**
+   * Register a TrackRole for a specific packetId.
+   *
+   * D-26: Enables per-role block-complete fanout — delta-role packetIds fire
+   * onDeltaBlockComplete when their FEC block completes or fails.
+   * Composite callback preserved: legacy onVideoFrame/onAudioFrame still fire
+   * (MEMORY.md "prevents callback stealing").
+   *
+   * Valid roles: 'base' | 'delta' | 'repair' | 'single'.
+   * Throws on unknown role (error on bad init, CLAUDE.md).
+   */
+  setPacketIdRole(packetId: number, role: TrackRole): void {
+    const VALID_ROLES: readonly TrackRole[] = [
+      "base",
+      "delta",
+      "repair",
+      "single",
+    ];
+    if (!VALID_ROLES.includes(role)) {
+      throw new Error(
+        `[MmtpRouter] setPacketIdRole: unknown role '${role}'. Valid: ${VALID_ROLES.join(", ")}`,
+      );
+    }
+    this.#packetIdRoles.set(packetId, role);
+  }
+
+  /** Replace catalog-derived repair ownership before a catalog reconfiguration. */
+  clearRepairPacketIdOwners(): void {
+    this.#repairOwnersByPacketId.clear();
+  }
+
+  /** Bind one dedicated repair-track PID to its authoritative media PID. */
+  setRepairPacketIdOwner(repairPacketId: number, ownerPacketId: number): void {
+    const owners = this.#repairOwnersByPacketId.get(repairPacketId) ?? new Set<number>();
+    owners.add(ownerPacketId);
+    this.#repairOwnersByPacketId.set(repairPacketId, owners);
+  }
+
+  /**
+   * Register callback fired when a delta-track FEC block completes or fails.
+   *
+   * @param cb - (packetId, failed) — packetId identifies the delta track,
+   *             failed=false means clean/recovered, failed=true means unrecoverable.
+   *
+   * Called from both onBlockComplete (failed=false) and onBlockFailed (failed=true)
+   * for every packetId registered with role='delta' via setPacketIdRole().
+   */
+  onDeltaBlockComplete(cb: (packetId: number, failed: boolean) => void): void {
+    this.#onDeltaBlockCompleteCb = cb;
+  }
+
+  // ── Packet processing ───────────────────────────────────────────
+
+  /** Update framerate — delegates to FECManager for timeout refinement. */
+  setFramerate(fps: number): void {
+    this.#fecManager?.setFramerate(fps);
+  }
+
+  /** Set FEC block mapper (created when FEC config becomes known via configureFec). */
+  setFecMapper(mapper: FecBlockMapper, packetId?: number): void {
+    if (packetId == null) {
+      this.#defaultFecMapper = mapper;
+      return;
+    }
+    this.#fecMappersByPacketId.set(packetId, mapper);
+  }
+
+  registerManifestTrack(context: ManifestTrackContext): void {
+    if (!this.#manifestVerifier) throw new Error("manifest verifier is not configured");
+    this.#manifestVerifier.registerTrack(context);
+  }
+
+  feedManifestFrame(trackName: string, frame: Uint8Array): void {
+    this.#manifestVerifier?.ingestManifestFrame(trackName, frame);
+  }
+
+  setManifestAuthMode(mode: ManifestAuthMode): void {
+    this.#manifestVerifier?.setMode(mode);
+    if (mode !== "enforce") {
+      for (const queue of this.#manifestRecoveryQueues.values()) {
+        for (const item of queue) {
+          this.#routeProcessedFecSymbols(
+            item.blockId,
+            item.result,
+            item.ownerPacketId,
+            item.catalogTrackName,
+          );
+        }
+      }
+      this.#manifestRecoveryQueues.clear();
+    }
+  }
+
+  /**
+   * Main entry point: feed a raw MMTP packet for processing.
+   *
+   * Source packets are played immediately AND fed to FECManager for recovery.
+   * Repair packets are fed to FECManager only (no direct playback).
+   */
+  /**
+   * Feed one MMTP source packet.
+   *
+   * `source` is REQUIRED. It used to default to "multicast", which meant any
+   * caller that forgot it silently attributed its bytes to a multicast socket
+   * they may never have crossed — and that attribution is what the physical-
+   * delivery evidence path is built on. Absence is not multicast; say which.
+   */
+  feedPacket(
+    packet: Uint8Array,
+    source: "multicast" | "moq",
+    manifestIdentity?: ManifestObjectIdentity,
+    ingress?: MmtpIngressContext,
+  ): void {
+    if (this.#disposed) return;
+    this.#processMMTP(packet, source, manifestIdentity, false, ingress);
+  }
+
+  /**
+   * Feed a repair packet from MoQ (reliable QUIC) — parses MMTP repair
+   * header and delegates to FECManager for FEC recovery.
+   */
+  feedRepairPacket(
+    packet: Uint8Array,
+    ownerPacketIdHint?: number,
+    catalogTrackName?: string,
+  ): void {
+    if (this.#disposed) return;
+
+    const parsed = parseRepairPacket(packet);
+    if (!parsed) return;
+
+    // A dedicated repair track can carry a packet ID that differs from the
+    // media packet ID. The subscribing track supplies the authoritative owner.
+    const header = packet.length >= 4 ? parseMMTPHeader(packet) : null;
+    const repairPacketId = header?.packetId;
+    if (repairPacketId == null) return;
+
+    const hintedOwner =
+      ownerPacketIdHint != null && this.#classifyPacketId(ownerPacketIdHint) !== null
+        ? ownerPacketIdHint
+        : null;
+    // A MoQ repair subscription owns a media track explicitly. Dedicated
+    // repair PIDs must carry that hint; only same-PID repair is self-describing.
+    const ownerPacketId = hintedOwner ??
+      (this.#classifyPacketId(repairPacketId) !== null ? repairPacketId : null);
+    if (ownerPacketId === null) {
+      debugRouter(
+        `[MmtpRouter] Dropping MoQ repair packet pid=${repairPacketId}: owner hint is required`,
+      );
+    }
+
+    if (ownerPacketId != null && this.#fecManager) {
+      this.#moqRepairPidCounts[repairPacketId] =
+        (this.#moqRepairPidCounts[repairPacketId] || 0) + 1;
+      this.#moqRepairOwnerCounts[ownerPacketId] =
+        (this.#moqRepairOwnerCounts[ownerPacketId] || 0) + 1;
+      const pidCount = this.#moqRepairPidCounts[repairPacketId]!;
+      const ownerCount = this.#moqRepairOwnerCounts[ownerPacketId]!;
+      if (pidCount <= 2 || pidCount % 500 === 0) {
+        console.log(
+          `[MOQ-REPAIR] pid=${repairPacketId} repairOwner=${ownerPacketId} pidCount=${pidCount} ownerCount=${ownerCount} ssbLength=${parsed.ssbLength} len=${packet.length}`,
+        );
+      }
+
+      const repairSbn = this.#deriveRepairSbn(parsed.ssStart, parsed.ssbLength, ownerPacketId);
+      if (repairSbn === null) return;
+      const repairEsi = this.#kForPacket(ownerPacketId) + parsed.rsId;
+
+      if (
+        !this.#feedFecTransportSymbol(
+          ownerPacketId,
+          repairSbn,
+          repairEsi,
+          parsed.repairData,
+          "moq",
+          catalogTrackName,
+        )
+      ) return;
+
+      // NOTE: Do NOT call trackBlock for repair packets (same as multicast repair path).
+      const recovered = catalogTrackName === undefined
+        ? this.#fecManager.feedRepairSymbol(
+            ownerPacketId,
+            parsed.ssStart,
+            parsed.ssbLength,
+            parsed.rsId,
+            parsed.repairData,
+          )
+        : this.#fecManager.feedRepairSymbol(
+            ownerPacketId,
+            parsed.ssStart,
+            parsed.ssbLength,
+            parsed.rsId,
+            parsed.repairData,
+            catalogTrackName,
+          );
+      if (recovered) {
+        const alreadyCompleted = catalogTrackName === undefined
+          ? this.#fecManager.isBlockCompleted(repairSbn, ownerPacketId)
+          : this.#fecManager.isBlockCompleted(repairSbn, ownerPacketId, catalogTrackName);
+        if (catalogTrackName === undefined) {
+          this.#fecManager.cancelBlockTimeout(repairSbn, ownerPacketId);
+        } else {
+          this.#fecManager.cancelBlockTimeout(repairSbn, ownerPacketId, catalogTrackName);
+        }
+        if (!alreadyCompleted) {
+          this.#fecManager.countRecovery(ownerPacketId);
+          if (catalogTrackName === undefined) {
+            this.#fecManager.markBlockCompleted(repairSbn, ownerPacketId);
+          } else {
+            this.#fecManager.markBlockCompleted(repairSbn, ownerPacketId, catalogTrackName);
+          }
+          this.#routeRecoveredBlock(
+            repairSbn,
+            recovered,
+            ownerPacketId,
+            catalogTrackName,
+          );
+        }
+      }
+    }
+  }
+
+  // ── SBN/ESI derivation ──────────────────────────────────────────
+
+  #kForPacket(packetId?: number): number {
+    // Same packet-scoped rule as #deriveSbnEsi: once the packet ID is known,
+    // only its explicitly registered mapper may stand in for the FEC
+    // manager's per-packet K — never the default single-track mapper.
+    if (packetId != null)
+      return (
+        this.#fecManager?.kForPacket?.(packetId) ??
+        this.#fecMappersByPacketId.get(packetId)?.k ??
+        this.#fecManager?.k ??
+        4
+      );
+    return this.#defaultFecMapper?.k ?? this.#fecManager?.k ?? 4;
+  }
+
+  #symbolSizeForPacket(packetId?: number): number {
+    if (packetId != null) return this.#fecManager?.symbolSizeForPacket?.(packetId) ?? this.#fecManager?.symbolSize ?? 0;
+    return this.#fecManager?.symbolSize ?? 0;
+  }
+
+  /** Derive SBN/ESI from SS_ID using packet-scoped FEC geometry. */
+  #deriveSbnEsi(ssId: number, packetId?: number): { sbn: number; esi: number } {
+    // A default mapper describes legacy single-track geometry. Once a packet
+    // ID is known, only its explicitly registered mapper may override the
+    // FECManager's packet-scoped K. Falling back to the default video mapper
+    // here maps audio source symbols with video K while repair SBNs correctly
+    // use the audio SSB_length, splitting one block across two coordinates.
+    const mapper = packetId == null
+      ? this.#defaultFecMapper
+      : this.#fecMappersByPacketId.get(packetId) ?? null;
+    if (mapper) return mapper.fromSsId(ssId);
+    const k = this.#kForPacket(packetId);
+    return { sbn: Math.floor(ssId / k), esi: ssId % k };
+  }
+
+  #deriveRepairSbn(
+    ssStart: number,
+    ssbLength: number,
+    packetId?: number,
+  ): number | null {
+    const k = this.#kForPacket(packetId);
+    if (ssbLength <= 0 || ssbLength > k || ssStart % k !== 0) return null;
+    return Math.floor(ssStart / k);
+  }
+
+  #resolveRepairOwnerPacketId(
+    packetId: number,
+    ingress?: MmtpIngressContext,
+  ): number | null {
+    if (this.#classifyPacketId(packetId) !== null) return packetId;
+
+    if (this.#packetIdRoles.get(packetId) !== "repair") {
+      debugRouter(
+        `[MmtpRouter] Dropping repair packet pid=${packetId}: physical PID is unregistered`,
+      );
+      return null;
+    }
+
+    const registeredOwners = this.#repairOwnersByPacketId.get(packetId) ?? new Set<number>();
+    const owners = ingress === undefined
+      ? [...registeredOwners]
+      : [...registeredOwners].filter((ownerPacketId) =>
+          ingressHasPacketId(ingress, ownerPacketId));
+    if (owners.length === 1) return owners[0]!;
+
+    debugRouter(
+      `[MmtpRouter] Dropping repair packet pid=${packetId}: catalog owner is ${owners.length === 0 ? "absent" : "ambiguous"}`,
+    );
+    return null;
+  }
+
+  /** Route a recovered FEC block through the parser + dedup pipeline.
+   *  Sync WASM decoders return K fixed-width source symbols concatenated. */
+  routeRecoveredBlock(
+    blockId: number,
+    data: Uint8Array,
+    packetId: number,
+    catalogTrackName?: string,
+  ): void {
+    this.#routeRecoveredBlock(blockId, data, packetId, catalogTrackName);
+  }
+
+  /** Route a single recovered source symbol through the parser + dedup pipeline.
+   *  Worker-backed decoders emit one padded source symbol per frame event. */
+  routeRecoveredSymbol(
+    blockId: number,
+    data: Uint8Array,
+    packetId: number,
+    esi = 0,
+    catalogTrackName?: string,
+  ): void {
+    const result = processFecSymbol(data, { ownerPacketId: packetId, index: esi });
+    this.#routeVerifiedFecSymbols(blockId, result, packetId, catalogTrackName);
+  }
+
+  // ── Keyframe timer cancellation ─────────────────────────────────
+
+  /** Cancel the active keyframe loss timer.
+   *  Call on failbackToMoq to prevent a stale timer from firing
+   *  onKeyframeLost after multicast is no longer the active source. */
+  cancelKeyframeLostTimer(): void {
+    if (this.#keyframeLostTimer) {
+      clearTimeout(this.#keyframeLostTimer);
+      this.#keyframeLostTimer = null;
+    }
+  }
+
+  // ── Dispose ─────────────────────────────────────────────────────
+
+  /** Emit parser frames buffered for a finite input before teardown. */
+  flush(): void {
+    if (this.#disposed) return;
+    this.#parser.flush();
+  }
+
+  /** Drop one rendition's parser/router/CMAF epoch without touching peers. */
+  resetTrack(packetId: number, catalogTrackName: string): void {
+    if (this.#disposed) return;
+    this.#parser.resetTrack(packetId, catalogTrackName);
+    const streamKey = this.#mediaStreamKey(packetId, catalogTrackName);
+    this.#trackSynced.delete(streamKey);
+    this.#droppedPreSyncVideo.delete(streamKey);
+    this.#latestVideoSeqByStream.delete(streamKey);
+    this.#lastDirectSourceVideoTsByStream.delete(streamKey);
+    this.#lastDirectEmittedVideoTsByStream.delete(streamKey);
+    this.#pendingDirectRecoveredVideoByStream.delete(streamKey);
+    this.#lastDirectSourceAudioCursorByStream.delete(streamKey);
+    this.#lastDirectEmittedAudioCursorByStream.delete(streamKey);
+    this.#pendingDirectRecoveredAudioByStream.delete(streamKey);
+    this.#manifestRecoveryQueues.delete(streamKey);
+    for (const packetSeqs of [this.#sourcePktSeqs, this.#routedPacketSeqs]) {
+      for (const key of packetSeqs) {
+        try {
+          const [keyPacketId, keyTrackName] = JSON.parse(key);
+          if (keyPacketId === packetId && keyTrackName === catalogTrackName) {
+            packetSeqs.delete(key);
+          }
+        } catch {
+          // Internal keys are JSON tuples; malformed legacy keys do not belong
+          // to a named physical stream and are left untouched.
+        }
+      }
+    }
+    const assemblersToReset = new Set<CmafBlockAssembler>();
+    const exactAssembler = this.#mseAssemblers.get(streamKey);
+    if (exactAssembler) assemblersToReset.add(exactAssembler);
+    const selectedAssembler = this.#mseAssemblerFor(packetId, catalogTrackName);
+    if (selectedAssembler) assemblersToReset.add(selectedAssembler);
+    for (const assembler of assemblersToReset) assembler.reset();
+    this.#trackInitDelivered.delete(streamKey);
+    this.#parserDiagnostics.delete(streamKey);
+  }
+
+  /** Live teardown is drop-only. Finite inputs must opt into a final flush. */
+  dispose(options: { flush?: boolean } = {}): void {
+    if (options.flush) this.flush();
+    this.#disposed = true;
+    this.cancelKeyframeLostTimer();
+    this.#parser.dispose();
+    this.#sourcePktSeqs.clear();
+    this.#routedPacketSeqs.clear();
+    this.#trackPacketCallbacks.clear();
+    this.#latestVideoSeqByStream.clear();
+    this.#lastDirectSourceVideoTsByStream.clear();
+    this.#lastDirectEmittedVideoTsByStream.clear();
+    this.#pendingDirectRecoveredVideoByStream.clear();
+    this.#lastDirectSourceAudioCursorByStream.clear();
+    this.#lastDirectEmittedAudioCursorByStream.clear();
+    this.#pendingDirectRecoveredAudioByStream.clear();
+    this.#trackSynced.clear();
+    this.#droppedPreSyncVideo.clear();
+    this.#trackInitDelivered.clear();
+    this.#repairPidCounts = {};
+    this.#moqRepairPidCounts = {};
+    this.#moqRepairOwnerCounts = {};
+    this.#parserDiagnostics.clear();
+    this.#catalogTrackNamesByPacketId.clear();
+    this.#repairOwnersByPacketId.clear();
+    if (this.#ownsManifestVerifier) this.#manifestVerifier?.dispose();
+    this.#manifestRecoveryQueues.clear();
+    for (const assembler of this.#mseAssemblers.values()) assembler.dispose();
+    this.#mseAssemblers.clear();
+  }
+
+  // ── Private: keyframe loss detection ────────────────────────────
+
+  /** Arm (or re-arm) the keyframe loss timer.
+   *  Clears any existing timer and sets a new one for keyframeLostTimeoutMs.
+   *  On timeout, fires onKeyframeLost with the next expected groupId. */
+  #armKeyframeLostTimer(): void {
+    if (this.#keyframeLostTimer) {
+      clearTimeout(this.#keyframeLostTimer);
+    }
+    const expectedNext = this.#lastKeyframeGroupId + 1;
+    this.#keyframeLostTimer = setTimeout(() => {
+      this.#keyframeLostTimer = null;
+      this.#onKeyframeLost?.(expectedNext);
+    }, this.#keyframeLostTimeoutMs!);
+  }
+
+  #noteEmittedKeyframe(packetId: number, keyframe: boolean): void {
+    if (!keyframe) return;
+    if (!this.#videoPacketIds.has(packetId)) return;
+    if (this.#keyframeLostTimeoutMs === null) return;
+    this.#lastKeyframeGroupId++;
+    this.#armKeyframeLostTimer();
+  }
+
+  // ── Private: MMTP processing ────────────────────────────────────
+
+  /** Classify a packetId from the catalog. Returns true=video, false=audio, null=unknown (drop). */
+  #classifyPacketId(packetId: number): boolean | null {
+    if (this.#videoPacketIds.has(packetId)) return true;
+    if (this.#audioPacketIds.has(packetId)) return false;
+    return null;
+  }
+
+  /** Resolve callback for a packetId (cached per-packetId, invalidated on registration).
+   *  When a per-track callback is registered AND a legacy callback exists,
+   *  fires BOTH: per-track first, then legacy. This ensures element.ts wiring
+   *  (confirmAudio, feedMulticast) continues to fire even when TrackPipeline
+   *  registers per-track sources.
+   *  Returns null for unknown packetIds — callers must drop the packet. */
+  #getFrameCallback(packetId: number): FrameCallback | null {
+    const cached = this.#resolvedCallbacks.get(packetId);
+    if (cached) return cached;
+
+    const perTrack = this.#trackCallbacks.get(packetId);
+    const classification = this.#classifyPacketId(packetId);
+    const legacy =
+      classification === true
+        ? this.#onVideoFrame
+        : classification === false
+          ? this.#onAudioFrame
+          : null;
+
+    let resolved: FrameCallback | null;
+    if (perTrack && legacy) {
+      // Composite: fire both so per-track routing AND legacy confirm/feedMulticast work.
+      resolved = (data, meta) => {
+        perTrack(data, meta);
+        legacy(data, meta);
+      };
+    } else {
+      resolved = perTrack ?? legacy ?? null;
+    }
+
+    if (resolved) this.#resolvedCallbacks.set(packetId, resolved);
+    return resolved;
+  }
+
+  /** Deliver init segment for a track (deduped per physical stream). */
+  #deliverInit(packetId: number, data: Uint8Array, catalogTrackName?: string): void {
+    const streamKey = this.#mediaStreamKey(packetId, catalogTrackName);
+    if (this.#trackInitDelivered.has(streamKey)) return;
+    if (data.byteLength <= 8) return;
+    this.#trackInitDelivered.add(streamKey);
+    const cb = this.#trackInitCallbacks.get(packetId);
+    if (cb) {
+      cb(data);
+    } else if (this.#onInitSegment) {
+      this.#onInitSegment(data);
+    }
+    console.log(
+      `[MmtpRouter] Init delivered for packetId=${packetId}${catalogTrackName === undefined ? "" : ` track=${catalogTrackName}`} (${data.byteLength}B)`,
+    );
+  }
+
+  /**
+   * Core MMTP packet processing — source packets → play + FEC, repair → FEC only.
+   * Both source and repair feed FECManager so RaptorQ has enough symbols (source + repair >= K).
+   *
+   * Two-phase parsing via MmtpContainerParser:
+   *   1. parseHeader() → extract packetId + fecPayloadId for FEC feeding
+   *   2. feed() → MFU extraction, reassembly, keyframe detection, emit via callbacks
+   */
+  #processMMTP(
+    packet: Uint8Array,
+    source: "multicast" | "moq",
+    manifestIdentity?: ManifestObjectIdentity,
+    manifestAdmitted = false,
+    ingress?: MmtpIngressContext,
+  ): void {
+    const info = this.#parser.parseHeader(packet);
+    if (!info) return;
+    if (source === "multicast" && !ingressHasPacketId(ingress, info.packetId)) {
+      debugRouter(
+        `[MmtpRouter] Dropping multicast packet pid=${info.packetId}: absent from ingress tracks`,
+      );
+      return;
+    }
+    const packetRole = this.#packetIdRoles.get(info.packetId);
+    if (
+      source === "multicast" &&
+      this.#classifyPacketId(info.packetId) === null &&
+      (!info.isRepair || packetRole !== "repair")
+    ) {
+      debugRouter(
+        `[MmtpRouter] Dropping multicast packet pid=${info.packetId}: physical PID is unregistered`,
+      );
+      return;
+    }
+    if (!info.isRepair && hasAmbiguousCatalogTrackName(ingress, info.packetId)) {
+      return;
+    }
+
+    if (!info.isRepair && this.#manifestVerifier && !manifestAdmitted) {
+      let identity = manifestIdentity;
+      if (!identity && info.fecPayloadId && (this.#resolveManifestIdentityForRoute || this.#resolveManifestIdentity)) {
+        const coordinates = this.#deriveSbnEsi(info.fecPayloadId.ssId, info.packetId);
+        const catalogTrackName = catalogTrackNameForPacket(ingress, info.packetId);
+        identity = (this.#resolveManifestIdentityForRoute
+          ? this.#resolveManifestIdentityForRoute({
+              packetId: info.packetId,
+              sbn: coordinates.sbn,
+              esi: coordinates.esi,
+              ...(catalogTrackName === undefined ? {} : { catalogTrackName }),
+              recovered: false,
+              sourceSymbolFormat: "full-mmtp-packet",
+            })
+          : this.#resolveManifestIdentity!(
+              info.packetId,
+              coordinates.sbn,
+              coordinates.esi,
+              catalogTrackName,
+            )) ?? undefined;
+      }
+      if (identity) {
+        identity = {
+          ...identity,
+          packetId: info.packetId,
+          ...(info.fecPayloadId ? { ssId: info.fecPayloadId.ssId } : {}),
+        };
+        const authenticated = info.fecPayloadId ? packet.subarray(0, packet.length - 4) : packet;
+        this.#manifestVerifier.admitObject(identity, authenticated, () => {
+          if (!this.#disposed) this.#processMMTP(packet, source, identity, true, ingress);
+        });
+        return;
+      }
+      if (
+        this.#manifestVerifier.config.mode === "enforce" &&
+        this.#manifestVerifier.config.onMissingManifest === "stall"
+      ) {
+        console.warn(`[MmtpRouter] manifest identity absent; stalling packetId=${info.packetId}`);
+        return;
+      }
+    }
+
+    if (info.isRepair) {
+      // Repair packet — per ISO 23008-1 §C.5.3, carries (SS_Start, SSB_length, RS_ID).
+      const parsed = parseRepairPacket(packet);
+      if (!parsed) return;
+
+        const ownerPacketId = this.#resolveRepairOwnerPacketId(info.packetId, ingress);
+        if (ownerPacketId != null && this.#fecManager) {
+          if (hasAmbiguousCatalogTrackName(ingress, ownerPacketId)) return;
+        this.#repairPidCounts[info.packetId] = (this.#repairPidCounts[info.packetId] || 0) + 1;
+        const count = this.#repairPidCounts[info.packetId]!;
+        if (count <= 2 || count % 500 === 0) {
+          console.log(
+            `[MC-PKT] pid=${info.packetId} repairOwner=${ownerPacketId} type=${info.packetType} count=${count} ssbLength=${parsed.ssbLength} len=${packet.length}`,
+          );
+        }
+
+        // NOTE: Do NOT call trackBlock for repair packets. Only source symbols
+        // should count toward block completion — repair inflates blocksClean stats
+        // and masks blocks that actually needed FEC recovery.
+        const repairSbn = this.#deriveRepairSbn(parsed.ssStart, parsed.ssbLength, ownerPacketId);
+        if (repairSbn === null) return;
+        const repairEsi = this.#kForPacket(ownerPacketId) + parsed.rsId;
+
+        if (
+          !this.#feedFecTransportSymbol(
+            ownerPacketId,
+            repairSbn,
+            repairEsi,
+            parsed.repairData,
+            source,
+            catalogTrackNameForPacket(ingress, ownerPacketId),
+          )
+        ) return;
+
+        // Repair symbols are block progress too. The deadline measures
+        // inactivity, not total block lifetime.
+        const repairCatalogTrackName = catalogTrackNameForPacket(ingress, ownerPacketId);
+        if (repairCatalogTrackName === undefined) {
+          this.#fecManager.noteBlockActivity?.(repairSbn, ownerPacketId);
+        } else {
+          this.#fecManager.noteBlockActivity?.(
+            repairSbn,
+            ownerPacketId,
+            repairCatalogTrackName,
+          );
+        }
+
+        const recovered = repairCatalogTrackName === undefined
+          ? this.#fecManager.feedRepairSymbol(
+              ownerPacketId,
+              parsed.ssStart,
+              parsed.ssbLength,
+              parsed.rsId,
+              parsed.repairData,
+            )
+          : this.#fecManager.feedRepairSymbol(
+              ownerPacketId,
+              parsed.ssStart,
+              parsed.ssbLength,
+              parsed.rsId,
+              parsed.repairData,
+              repairCatalogTrackName,
+            );
+        if (recovered) {
+          const alreadyCompleted = repairCatalogTrackName === undefined
+            ? this.#fecManager.isBlockCompleted(repairSbn, ownerPacketId)
+            : this.#fecManager.isBlockCompleted(
+                repairSbn,
+                ownerPacketId,
+                repairCatalogTrackName,
+              );
+          if (repairCatalogTrackName === undefined) {
+            this.#fecManager.cancelBlockTimeout(repairSbn, ownerPacketId);
+          } else {
+            this.#fecManager.cancelBlockTimeout(
+              repairSbn,
+              ownerPacketId,
+              repairCatalogTrackName,
+            );
+          }
+          // Skip routing if block was already completed via source path (all K sources
+          // arrived). The parser's feed() already played every frame.
+          if (!alreadyCompleted) {
+            this.#fecManager.countRecovery(ownerPacketId);
+            if (repairCatalogTrackName === undefined) {
+              this.#fecManager.markBlockCompleted(repairSbn, ownerPacketId);
+            } else {
+              this.#fecManager.markBlockCompleted(
+                repairSbn,
+                ownerPacketId,
+                repairCatalogTrackName,
+              );
+            }
+            this.#routeRecoveredBlock(
+              repairSbn,
+              recovered,
+              ownerPacketId,
+              catalogTrackNameForPacket(ingress, ownerPacketId),
+            );
+          }
+        }
+      }
+    } else {
+      // Drop source packets with unknown packetId — not in catalog.
+      if (this.#classifyPacketId(info.packetId) === null) return;
+
+      // Debug: count packets per packetId
+      this.#pidCounts[info.packetId] = (this.#pidCounts[info.packetId] || 0) + 1;
+      const count = this.#pidCounts[info.packetId]!;
+      if (count <= 2 || count % 500 === 0) {
+        console.log(
+          `[MC-PKT] pid=${info.packetId} type=${info.packetType} count=${count} len=${packet.length}`,
+        );
+      }
+
+      // Source packet — parse for playback first, then feed FEC only if the
+      // source block did not complete cleanly. Feeding FEC before parser/feed
+      // lets a source-triggered recovery race ahead of the source timeline.
+      let fecInfo:
+        | { sbn: number; esi: number; oversized?: boolean }
+        | undefined;
+      let sourceFec:
+        | {
+            ssId: number;
+            sbn: number;
+            symbolData: Uint8Array;
+          }
+        | null = null;
+      let sourceSymbolAccepted = false;
+      let sourceSymbolTrackable = false;
+      const catalogTrackName = catalogTrackNameForPacket(ingress, info.packetId);
+      if (catalogTrackName !== undefined) {
+        const names = this.#catalogTrackNamesByPacketId.get(info.packetId) ?? new Set();
+        names.add(catalogTrackName);
+        this.#catalogTrackNamesByPacketId.set(info.packetId, names);
+      }
+
+      if (this.#fecManager && info.fecPayloadId) {
+        const fecId = info.fecPayloadId;
+        const symbolSize = this.#symbolSizeForPacket(info.packetId);
+
+        // The mmtp-packet source symbol protects the complete MMTP packet
+        // before SS_ID is appended, self-delimiting and zero-padded to T.
+        const rawSymbol = packet.subarray(0, packet.length - 4);
+        const oversized = symbolSize > 0 && rawSymbol.length > symbolSize;
+        const coords = this.#deriveSbnEsi(fecId.ssId, info.packetId);
+
+        // NOTE: trackBlock() is deferred to AFTER #feedViaParser (below).
+        // Reason: trackBlock synchronously fires onBlockComplete when the
+        // K-th source symbol arrives, which synchronously calls
+        // CmafBlockAssembler.completeBlock → #flushBlock → emit. If
+        // trackBlock fires BEFORE parser.feed, the K-th packet's
+        // parser.onFrame → assembler.addFrame happens AFTER flushBlock
+        // already drained the block — the K-th frame is stranded in a
+        // newly-allocated empty block that never gets a completeBlock
+        // event again, because that SBN is already in fecManager's
+        // #completedBlocks set (BLO-3035 layer 4).
+        //
+        // Complete-packet symbols larger than T cannot be decoded but still
+        // represent a source-symbol arrival, so trackBlock counts them below.
+
+        if (oversized) {
+          // Oversized packet — not FEC-encoded by FFmpeg, skip FEC feed.
+          // Still emitted via parser.feed() below (direct path).
+          sourceSymbolAccepted = this.#feedFecTransportSymbol(
+            info.packetId,
+            coords.sbn,
+            coords.esi,
+            rawSymbol,
+            source,
+            catalogTrackName,
+          );
+          sourceSymbolTrackable = sourceSymbolAccepted;
+        } else {
+          let symbolData: Uint8Array;
+          if (symbolSize > 0 && rawSymbol.length < symbolSize) {
+            symbolData = new Uint8Array(symbolSize);
+            symbolData.set(rawSymbol);
+          } else {
+            symbolData = rawSymbol;
+          }
+
+          sourceSymbolAccepted = this.#feedFecTransportSymbol(
+            info.packetId,
+            coords.sbn,
+            coords.esi,
+            symbolData,
+            source,
+            catalogTrackName,
+          );
+          sourceSymbolTrackable = sourceSymbolAccepted;
+          if (sourceSymbolAccepted) {
+            sourceFec = { ssId: fecId.ssId, sbn: coords.sbn, symbolData };
+          }
+        }
+
+        // Compute FEC block info for the MSE assembler.
+        fecInfo = { sbn: coords.sbn, esi: coords.esi, oversized };
+      }
+
+      // Parse only the first copy of an FEC source symbol. A late direct copy
+      // of a worker-recovered fragment has the same SBN/ESI and fragment
+      // counter; feeding it again can make the MFU buffer non-contiguous even
+      // when FI=1..3 were already complete. Non-FEC packets still always flow.
+      if (!this.#fecManager || !info.fecPayloadId || sourceSymbolAccepted) {
+        this.#noteSourcePacketSeq(
+          info.packetId,
+          info.sequenceNumber,
+          catalogTrackName,
+        );
+        this.#routeTrackPacket(packet, info.packetId, info.sequenceNumber, {
+          recovered: false,
+          skipFecPayloadId: false,
+          catalogTrackName,
+        });
+        this.#feedViaParser(packet, info, fecInfo, {
+          source,
+          catalogTrackName,
+        });
+      }
+
+      // Deferred trackBlock (BLO-3035 layer 4 race fix). Fire AFTER
+      // #feedViaParser → parser.feed → addFrame, so the K-th source
+      // packet's frame is buffered in CmafBlockAssembler.#blocks BEFORE
+      // trackBlock synchronously triggers onBlockComplete → completeBlock
+      // → #flushBlock. Without this ordering, the K-th frame was lost on
+      // every block — only K-1 frames per block were ever emitted to MSE.
+      // Only first-arriving symbols count toward completion or playback.
+      if (
+        this.#fecManager &&
+        info.fecPayloadId &&
+        sourceSymbolAccepted &&
+        sourceSymbolTrackable
+      ) {
+        const { sbn, esi } = this.#deriveSbnEsi(
+          info.fecPayloadId.ssId,
+          info.packetId,
+        );
+        if (this.#classifyPacketId(info.packetId) !== null) {
+          if (catalogTrackName === undefined) {
+            this.#fecManager.trackBlock(sbn, info.packetId, undefined, esi);
+          } else {
+            this.#fecManager.trackBlock(
+              sbn,
+              info.packetId,
+              catalogTrackName,
+              esi,
+            );
+          }
+        }
+      }
+
+      // Only now feed source symbols into FEC. The decoder must still receive
+      // the K-th source symbol after trackBlock() marks a clean block complete:
+      // Worker-backed decoders use that symbol for their own block lifecycle
+      // and stats. Suppress any synchronous recovered-block return when the
+      // manager already completed the block, because every source frame was
+      // parsed and emitted above.
+      if (this.#fecManager && sourceFec) {
+        const alreadyCompleted = catalogTrackName === undefined
+          ? this.#fecManager.isBlockCompleted(sourceFec.sbn, info.packetId)
+          : this.#fecManager.isBlockCompleted(
+              sourceFec.sbn,
+              info.packetId,
+              catalogTrackName,
+            );
+        const recovered = catalogTrackName === undefined
+          ? this.#fecManager.feedSourceSymbol(
+              info.packetId,
+              sourceFec.ssId,
+              sourceFec.symbolData,
+              undefined,
+            )
+          : this.#fecManager.feedSourceSymbol(
+              info.packetId,
+              sourceFec.ssId,
+              sourceFec.symbolData,
+              undefined,
+              catalogTrackName,
+            );
+        if (recovered) {
+          if (!alreadyCompleted && this.#classifyPacketId(info.packetId) !== null) {
+            if (catalogTrackName === undefined) {
+              this.#fecManager.cancelBlockTimeout(sourceFec.sbn, info.packetId);
+            } else {
+              this.#fecManager.cancelBlockTimeout(
+                sourceFec.sbn,
+                info.packetId,
+                catalogTrackName,
+              );
+            }
+          }
+          // Only route recovered blocks that needed actual repair.
+          if (!alreadyCompleted) {
+            this.#fecManager.countRecovery(info.packetId);
+            if (catalogTrackName === undefined) {
+              this.#fecManager.markBlockCompleted(sourceFec.sbn, info.packetId);
+            } else {
+              this.#fecManager.markBlockCompleted(
+                sourceFec.sbn,
+                info.packetId,
+                catalogTrackName,
+              );
+            }
+            this.#routeRecoveredBlock(
+              sourceFec.sbn,
+              recovered,
+              info.packetId,
+              catalogTrackName,
+            );
+          }
+        }
+      }
+    }
+  }
+
+  /**
+   * Set temp context and delegate to parser.feed() for MFU extraction,
+   * reassembly, keyframe detection, and frame emission via callbacks.
+   */
+  #feedViaParser(
+    packet: Uint8Array,
+    info: {
+      packetId: number;
+      sequenceNumber: number;
+      fecPayloadId?: { ssId: number } | null;
+    },
+    fecInfo?: { sbn: number; esi: number; oversized?: boolean },
+    parserOptions?: {
+      skipFecPayloadId?: boolean;
+      recovered?: boolean;
+      source?: MmtpSourcePath;
+      deliveryProvenance?: MmtpDeliveryProvenance;
+      catalogTrackName?: string;
+    },
+  ): void {
+    const diag = this.#diagFor(info.packetId, parserOptions?.catalogTrackName);
+    const before = this.#parser.reassembler.getStatus();
+    diag.packets++;
+    diag.lastPacketLength = packet.byteLength;
+    diag.lastSequenceNumber = info.sequenceNumber;
+    if (info.fecPayloadId) diag.lastFecSsId = info.fecPayloadId.ssId;
+    this.#currentFecInfo = fecInfo;
+    this.#currentSeqNum = info.sequenceNumber;
+    try {
+      this.#parser.feed(packet, {
+        skipFecPayloadId: parserOptions?.skipFecPayloadId,
+        recovered: parserOptions?.recovered,
+        source: parserOptions?.source,
+        deliveryProvenance: parserOptions?.deliveryProvenance,
+        catalogTrackName: parserOptions?.catalogTrackName,
+      });
+    } finally {
+      this.#currentFecInfo = undefined;
+    }
+    const after = this.#parser.reassembler.getStatus();
+    const fragmentDelta = after.stats.totalFragments - before.stats.totalFragments;
+    const reassembledDelta = after.stats.reassembledMFUs - before.stats.reassembledMFUs;
+    if (fragmentDelta > 0) diag.fragments += fragmentDelta;
+    else diag.noFragment++;
+    if (reassembledDelta > 0) diag.reassembled += reassembledDelta;
+    diag.pendingBuffers = after.bufferedMFUs;
+    diag.pendingFragments = after.pendingFragments;
+    diag.pendingSamples = after.pendingSamples;
+  }
+
+  #feedFecTransportSymbol(
+    packetId: number,
+    sbn: number,
+    esi: number,
+    data: Uint8Array,
+    source: MmtpSourcePath,
+    catalogTrackName?: string,
+  ): boolean {
+    const fecManager = this.#fecManager;
+    if (!fecManager) return false;
+    return catalogTrackName === undefined
+      ? fecManager.feedSymbolFromSource(packetId, sbn, esi, data, source)
+      : fecManager.feedSymbolFromSource(
+          packetId,
+          sbn,
+          esi,
+          data,
+          source,
+          catalogTrackName,
+        );
+  }
+
+  #diagFor(packetId: number, catalogTrackName?: string): ParserDiagnostics {
+    const streamKey = this.#mediaStreamKey(packetId, catalogTrackName);
+    let diag = this.#parserDiagnostics.get(streamKey);
+    if (!diag) {
+      diag = {
+        packets: 0,
+        frames: 0,
+        initSegments: 0,
+        noFragment: 0,
+        fragments: 0,
+        reassembled: 0,
+        pendingBuffers: 0,
+        pendingFragments: 0,
+        lastPacketLength: 0,
+        lastSequenceNumber: 0,
+        directAudioSourceEmitted: 0,
+        directAudioSourceRegressions: 0,
+        directAudioRecoveredQueued: 0,
+        directAudioRecoveredDrained: 0,
+        directAudioRecoveredStaleDropped: 0,
+      };
+      this.#parserDiagnostics.set(streamKey, diag);
+    }
+    return diag;
+  }
+
+  #shouldEmitFrame(
+    packetId: number,
+    keyframe: boolean,
+    catalogTrackName?: string,
+  ): boolean {
+    if (!this.#fecManager) return true;
+    if (!this.#videoPacketIds.has(packetId)) return true;
+    const streamKey = this.#mediaStreamKey(packetId, catalogTrackName);
+    if (this.#trackSynced.has(streamKey)) return true;
+    if (!keyframe) {
+      this.#droppedPreSyncVideo.add(streamKey);
+      return false;
+    }
+    this.#trackSynced.add(streamKey);
+    this.#droppedPreSyncVideo.delete(streamKey);
+    return true;
+  }
+
+  #opensFecSync(
+    packetId: number,
+    keyframe: boolean,
+    catalogTrackName?: string,
+  ): boolean {
+    const streamKey = this.#mediaStreamKey(packetId, catalogTrackName);
+    return !!this.#fecManager &&
+      this.#videoPacketIds.has(packetId) &&
+      !this.#trackSynced.has(streamKey) &&
+      this.#droppedPreSyncVideo.has(streamKey) &&
+      keyframe;
+  }
+
+  #noteEmittedVideoSeq(streamKey: string, packetSequenceNumber: number | undefined): void {
+    if (packetSequenceNumber === undefined || !Number.isFinite(packetSequenceNumber)) return;
+    const latest = this.#latestVideoSeqByStream.get(streamKey);
+    if (latest === undefined || packetSequenceNumber > latest) {
+      this.#latestVideoSeqByStream.set(streamKey, packetSequenceNumber);
+    }
+  }
+
+  #noteSourcePacketSeq(
+    packetId: number,
+    packetSequenceNumber: number | undefined,
+    catalogTrackName?: string,
+  ): void {
+    if (packetSequenceNumber === undefined || !Number.isFinite(packetSequenceNumber)) return;
+    this.#sourcePktSeqs.add(
+      this.#packetSeqKey(packetId, packetSequenceNumber, catalogTrackName),
+    );
+    // Eviction: keep the most recent 2000 entries (covers ~62 blocks at K=32/30fps).
+    // FEC recovery completes within the catalog-derived holdback window, so older
+    // sequence numbers cannot be useful for duplicate suppression.
+    if (this.#sourcePktSeqs.size > 4000) {
+      const iter = this.#sourcePktSeqs.values();
+      for (let i = 0; i < 2000; i++) iter.next();
+      const keep = new Set<string>();
+      for (const v of iter) keep.add(v);
+      this.#sourcePktSeqs = keep;
+    }
+  }
+
+  #routeTrackPacket(
+    packet: Uint8Array,
+    packetId: number,
+    packetSequenceNumber: number,
+    meta: Pick<
+      RoutedPacketMeta,
+      "recovered" | "skipFecPayloadId" | "catalogTrackName" | "deliveryProvenance"
+    >,
+  ): void {
+    if (!Number.isFinite(packetSequenceNumber)) return;
+    const callback = this.#trackPacketCallbacks.get(packetId);
+    if (!callback) return;
+    const key = this.#packetSeqKey(packetId, packetSequenceNumber, meta.catalogTrackName);
+    if (this.#routedPacketSeqs.has(key)) return;
+    this.#routedPacketSeqs.add(key);
+    if (this.#routedPacketSeqs.size > 4000) {
+      const iter = this.#routedPacketSeqs.values();
+      for (let i = 0; i < 2000; i++) iter.next();
+      const keep = new Set<string>();
+      for (const value of iter) keep.add(value);
+      this.#routedPacketSeqs = keep;
+    }
+    callback(packet, {
+      packetId,
+      packetSequenceNumber,
+      recovered: meta.recovered,
+      skipFecPayloadId: meta.skipFecPayloadId,
+      ...(meta.catalogTrackName === undefined
+        ? {}
+        : { catalogTrackName: meta.catalogTrackName }),
+      ...(meta.deliveryProvenance === undefined
+        ? {}
+        : { deliveryProvenance: meta.deliveryProvenance }),
+    });
+  }
+
+  #isStaleRecoveredVideo(
+    packetId: number,
+    packetSequenceNumber: number,
+    catalogTrackName?: string,
+  ): boolean {
+    const latest = this.#latestVideoSeqByStream.get(
+      this.#mediaStreamKey(packetId, catalogTrackName),
+    );
+    return latest !== undefined && packetSequenceNumber <= latest;
+  }
+
+  #mediaStreamKey(packetId: number, catalogTrackName?: string): string {
+    return JSON.stringify([packetId, catalogTrackName ?? null]);
+  }
+
+  #packetIdFromStreamKey(key: string): number {
+    try {
+      const decoded = JSON.parse(key);
+      if (Array.isArray(decoded) && typeof decoded[0] === "number") return decoded[0];
+    } catch {
+      // Internal keys are JSON tuples; malformed legacy keys should not happen.
+    }
+    return 0;
+  }
+
+  #mseAssemblerKey(packetId: number, catalogTrackName?: string): string {
+    return this.#mediaStreamKey(packetId, catalogTrackName);
+  }
+
+  #mseAssemblerFor(
+    packetId: number,
+    catalogTrackName?: string,
+  ): CmafBlockAssembler | undefined {
+    const exact = this.#mseAssemblers.get(
+      this.#mseAssemblerKey(packetId, catalogTrackName),
+    );
+    if (exact || catalogTrackName === undefined) return exact;
+    if (!this.#isCatalogTrackUnambiguous(packetId, catalogTrackName)) return undefined;
+    return this.#mseAssemblers.get(this.#mseAssemblerKey(packetId));
+  }
+
+  #isCatalogTrackUnambiguous(
+    packetId: number,
+    catalogTrackName?: string,
+  ): boolean {
+    if (catalogTrackName === undefined) return true;
+    const names = this.#catalogTrackNamesByPacketId.get(packetId);
+    return names?.size === 1 && names.has(catalogTrackName);
+  }
+
+  #resolveRecoveredTiming(
+    packetId: number,
+    mpuSequenceNumber: number,
+    movieFragmentSequenceNumber: number | undefined,
+    sampleNumber: number | undefined,
+    mmtpTimestamp: bigint,
+    catalogTrackName?: string,
+  ): { authoredTiming?: AuthoredTiming; timestamp: number; mmtpTimestamp: bigint } | null {
+    // Non-timed MFUs do not carry a movie-fragment/sample identity. They are
+    // outside the ISO-BMFF presentation timeline, so retain the raw MMTP
+    // timestamp path used by the untimed router contract.
+    if (movieFragmentSequenceNumber === undefined || sampleNumber === undefined) {
+      return {
+        timestamp: mmtpTimestampToMicros(mmtpTimestamp),
+        mmtpTimestamp,
+      };
+    }
+
+    // Claim the resolver entry before scaling it. The claim is the single
+    // consume operation for a recovered sample; doing lookup → scale → claim
+    // would leave an invalid entry live forever when scaling rejects it.
+    const authoredTiming = this.#parser.consumeAuthoredTimingFor(
+      packetId,
+      mpuSequenceNumber,
+      movieFragmentSequenceNumber,
+      sampleNumber,
+      catalogTrackName,
+    );
+    // Recovery is accepted only when the timed stream's FT=1 metadata names
+    // this exact sample. MMTP send timestamps describe transport arrival, not
+    // the authored presentation timeline, so they are never a fallback.
+    if (authoredTiming === null) return null;
+    const scaled = scaleAuthoredTiming(authoredTiming, 1_000_000);
+    if (scaled === null) return null;
+    return { authoredTiming, timestamp: scaled.timestamp, mmtpTimestamp };
+  }
+
+  #packetSeqKey(
+    packetId: number,
+    packetSequenceNumber: number,
+    catalogTrackName?: string,
+  ): string {
+    return JSON.stringify([packetId, catalogTrackName ?? null, packetSequenceNumber]);
+  }
+
+  #pendingRecoveredKey(meta: RoutedFrameMeta): string {
+    return `${meta.timestamp}:${meta.packetSequenceNumber ?? ""}`;
+  }
+
+  #pendingRecoveredQueue(streamKey: string): Map<string, PendingRecoveredVideoFrame> {
+    let queue = this.#pendingDirectRecoveredVideoByStream.get(streamKey);
+    if (!queue) {
+      queue = new Map();
+      this.#pendingDirectRecoveredVideoByStream.set(streamKey, queue);
+    }
+    return queue;
+  }
+
+  #comparePendingRecoveredVideo(
+    a: PendingRecoveredVideoFrame,
+    b: PendingRecoveredVideoFrame,
+  ): number {
+    if (a.meta.timestamp !== b.meta.timestamp) return a.meta.timestamp - b.meta.timestamp;
+    const aSeq = a.meta.packetSequenceNumber ?? Number.MAX_SAFE_INTEGER;
+    const bSeq = b.meta.packetSequenceNumber ?? Number.MAX_SAFE_INTEGER;
+    return aSeq - bSeq;
+  }
+
+  #emitDirectVideo(
+    packetId: number,
+    data: Uint8Array,
+    meta: RoutedFrameMeta,
+    cb: FrameCallback | null,
+  ): boolean {
+    const streamKey = this.#mediaStreamKey(packetId, meta.catalogTrackName);
+    const lastEmitted = this.#lastDirectEmittedVideoTsByStream.get(streamKey);
+    if (lastEmitted !== undefined && meta.timestamp <= lastEmitted) return false;
+    this.#lastDirectEmittedVideoTsByStream.set(streamKey, meta.timestamp);
+    // Record the emitted sequence number HERE — at the real emit — not when a
+    // recovered frame is queued. #routeDirectRecoveredVideo may enqueue a frame
+    // that is ahead of the source cursor; noting its seq before it drains would
+    // make #isStaleRecoveredVideo drop an earlier gap frame that arrives later
+    // (it would look <= the queued-but-unemitted seq). The high-water mark must
+    // reflect what actually reached the decoder callback.
+    this.#noteEmittedVideoSeq(streamKey, meta.packetSequenceNumber);
+    cb?.(data, meta);
+    return true;
+  }
+
+  #drainDirectRecoveredVideoUpTo(
+    streamKey: string,
+    packetId: number,
+    horizonTs: number,
+    cb: FrameCallback | null,
+  ): void {
+    const queue = this.#pendingDirectRecoveredVideoByStream.get(streamKey);
+    if (!queue || queue.size === 0) return;
+
+    const ready = [...queue.values()]
+      .filter(frame => frame.meta.timestamp <= horizonTs)
+      .sort((a, b) => this.#comparePendingRecoveredVideo(a, b));
+
+    for (const frame of ready) {
+      queue.delete(this.#pendingRecoveredKey(frame.meta));
+      this.#emitDirectVideo(packetId, frame.data, frame.meta, cb);
+    }
+
+    if (queue.size === 0) {
+      this.#pendingDirectRecoveredVideoByStream.delete(streamKey);
+    }
+  }
+
+  #enqueueDirectRecoveredVideo(
+    packetId: number,
+    data: Uint8Array,
+    meta: RoutedFrameMeta,
+  ): void {
+    const streamKey = this.#mediaStreamKey(packetId, meta.catalogTrackName);
+    const lastEmitted = this.#lastDirectEmittedVideoTsByStream.get(streamKey);
+    if (lastEmitted !== undefined && meta.timestamp <= lastEmitted) return;
+
+    const queue = this.#pendingRecoveredQueue(streamKey);
+    queue.set(this.#pendingRecoveredKey(meta), { data, meta: { ...meta } });
+
+    if (queue.size > DIRECT_RECOVERED_VIDEO_QUEUE_LIMIT) {
+      const keep = [...queue.entries()]
+        .sort((a, b) => this.#comparePendingRecoveredVideo(a[1], b[1]))
+        .slice(-Math.floor(DIRECT_RECOVERED_VIDEO_QUEUE_LIMIT / 2));
+      queue.clear();
+      for (const [key, frame] of keep) queue.set(key, frame);
+    }
+  }
+
+  #routeDirectSourceVideo(
+    packetId: number,
+    data: Uint8Array,
+    meta: RoutedFrameMeta,
+    cb: FrameCallback | null,
+  ): void {
+    const streamKey = this.#mediaStreamKey(packetId, meta.catalogTrackName);
+    const lastSourceTs = this.#lastDirectSourceVideoTsByStream.get(streamKey);
+    if (lastSourceTs === undefined || meta.timestamp > lastSourceTs) {
+      this.#lastDirectSourceVideoTsByStream.set(streamKey, meta.timestamp);
+    }
+
+    // Recovered FEC may arrive before the source stream reaches the same media
+    // time. Drain those gap fills immediately before the source frame that proves
+    // the live cursor caught up, preserving the decoder dependency chain.
+    this.#drainDirectRecoveredVideoUpTo(streamKey, packetId, meta.timestamp, cb);
+    this.#emitDirectVideo(packetId, data, meta, cb);
+  }
+
+  #routeDirectRecoveredVideo(
+    packetId: number,
+    data: Uint8Array,
+    meta: RoutedFrameMeta,
+    cb: FrameCallback | null,
+  ): void {
+    const streamKey = this.#mediaStreamKey(packetId, meta.catalogTrackName);
+    this.#enqueueDirectRecoveredVideo(packetId, data, meta);
+    const lastSourceTs = this.#lastDirectSourceVideoTsByStream.get(streamKey);
+    this.#drainDirectRecoveredVideoUpTo(
+      streamKey,
+      packetId,
+      lastSourceTs ?? Number.POSITIVE_INFINITY,
+      cb,
+    );
+  }
+
+  #pendingRecoveredAudioQueue(streamKey: string): Map<string, PendingRecoveredAudioFrame> {
+    let queue = this.#pendingDirectRecoveredAudioByStream.get(streamKey);
+    if (!queue) {
+      queue = new Map();
+      this.#pendingDirectRecoveredAudioByStream.set(streamKey, queue);
+    }
+    return queue;
+  }
+
+  #directAudioCursor(meta: RoutedFrameMeta): DirectAudioCursor {
+    return {
+      timestamp: meta.timestamp,
+      // A recovered frame without transport sequence metadata must drain before
+      // an equal-timestamp source horizon instead of remaining queued forever.
+      sequenceNumber: meta.packetSequenceNumber ?? Number.MIN_SAFE_INTEGER,
+    };
+  }
+
+  #compareDirectAudioCursor(a: DirectAudioCursor, b: DirectAudioCursor): number {
+    if (a.timestamp !== b.timestamp) return a.timestamp - b.timestamp;
+    return a.sequenceNumber - b.sequenceNumber;
+  }
+
+  #emitDirectAudio(
+    packetId: number,
+    data: Uint8Array,
+    meta: RoutedFrameMeta,
+    cb: FrameCallback | null,
+  ): boolean {
+    const streamKey = this.#mediaStreamKey(packetId, meta.catalogTrackName);
+    const cursor = this.#directAudioCursor(meta);
+    const lastEmitted = this.#lastDirectEmittedAudioCursorByStream.get(streamKey);
+    if (
+      lastEmitted !== undefined &&
+      this.#compareDirectAudioCursor(cursor, lastEmitted) <= 0
+    ) return false;
+    this.#lastDirectEmittedAudioCursorByStream.set(streamKey, cursor);
+    cb?.(data, meta);
+    return true;
+  }
+
+  #emitDirectSourceAudio(
+    packetId: number,
+    data: Uint8Array,
+    meta: RoutedFrameMeta,
+    cb: FrameCallback | null,
+  ): void {
+    const streamKey = this.#mediaStreamKey(packetId, meta.catalogTrackName);
+    const cursor = this.#directAudioCursor(meta);
+    const lastEmitted = this.#lastDirectEmittedAudioCursorByStream.get(streamKey);
+    const diag = this.#diagFor(packetId, meta.catalogTrackName);
+    diag.directAudioSourceEmitted++;
+    if (
+      lastEmitted !== undefined &&
+      this.#compareDirectAudioCursor(cursor, lastEmitted) <= 0
+    ) {
+      // Source packets already passed transport/parser validation. Preserve
+      // them even when unordered multicast completion moves the callback
+      // cursor backward; only recovered frames are optional stale gap fills.
+      diag.directAudioSourceRegressions++;
+    } else {
+      this.#lastDirectEmittedAudioCursorByStream.set(streamKey, cursor);
+    }
+    cb?.(data, meta);
+  }
+
+  #drainDirectRecoveredAudioUpTo(
+    streamKey: string,
+    packetId: number,
+    horizon: DirectAudioCursor,
+    cb: FrameCallback | null,
+  ): void {
+    const queue = this.#pendingDirectRecoveredAudioByStream.get(streamKey);
+    if (!queue || queue.size === 0) return;
+
+    const ready = [...queue.values()]
+      .filter(frame => this.#compareDirectAudioCursor(
+        this.#directAudioCursor(frame.meta),
+        horizon,
+      ) <= 0)
+      .sort((a, b) => this.#compareDirectAudioCursor(
+        this.#directAudioCursor(a.meta),
+        this.#directAudioCursor(b.meta),
+      ));
+
+    for (const frame of ready) {
+      queue.delete(this.#pendingRecoveredKey(frame.meta));
+      if (this.#emitDirectAudio(packetId, frame.data, frame.meta, cb)) {
+        this.#diagFor(packetId, frame.meta.catalogTrackName)
+          .directAudioRecoveredDrained++;
+      } else {
+        this.#diagFor(packetId, frame.meta.catalogTrackName)
+          .directAudioRecoveredStaleDropped++;
+      }
+    }
+
+    if (queue.size === 0) {
+      this.#pendingDirectRecoveredAudioByStream.delete(streamKey);
+    }
+  }
+
+  #routeDirectSourceAudio(
+    packetId: number,
+    data: Uint8Array,
+    meta: RoutedFrameMeta,
+    cb: FrameCallback | null,
+  ): void {
+    const streamKey = this.#mediaStreamKey(packetId, meta.catalogTrackName);
+    const cursor = this.#directAudioCursor(meta);
+    const lastSource = this.#lastDirectSourceAudioCursorByStream.get(streamKey);
+    if (
+      lastSource === undefined ||
+      this.#compareDirectAudioCursor(cursor, lastSource) > 0
+    ) {
+      this.#lastDirectSourceAudioCursorByStream.set(streamKey, cursor);
+    }
+    this.#drainDirectRecoveredAudioUpTo(streamKey, packetId, cursor, cb);
+    this.#emitDirectSourceAudio(packetId, data, meta, cb);
+  }
+
+  #routeDirectRecoveredAudio(
+    packetId: number,
+    data: Uint8Array,
+    meta: RoutedFrameMeta,
+    cb: FrameCallback | null,
+  ): void {
+    const streamKey = this.#mediaStreamKey(packetId, meta.catalogTrackName);
+    const cursor = this.#directAudioCursor(meta);
+    const lastEmitted = this.#lastDirectEmittedAudioCursorByStream.get(streamKey);
+    if (
+      lastEmitted !== undefined &&
+      this.#compareDirectAudioCursor(cursor, lastEmitted) <= 0
+    ) {
+      this.#diagFor(packetId, meta.catalogTrackName)
+        .directAudioRecoveredStaleDropped++;
+      return;
+    }
+
+    const queue = this.#pendingRecoveredAudioQueue(streamKey);
+    queue.set(this.#pendingRecoveredKey(meta), { data, meta: { ...meta } });
+    this.#diagFor(packetId, meta.catalogTrackName).directAudioRecoveredQueued++;
+    if (queue.size > DIRECT_RECOVERED_AUDIO_QUEUE_LIMIT) {
+      const keep = [...queue.entries()]
+        .sort((a, b) => this.#compareDirectAudioCursor(
+          this.#directAudioCursor(a[1].meta),
+          this.#directAudioCursor(b[1].meta),
+        ))
+        .slice(-Math.floor(DIRECT_RECOVERED_AUDIO_QUEUE_LIMIT / 2));
+      queue.clear();
+      for (const [key, frame] of keep) queue.set(key, frame);
+    }
+
+    const lastSource = this.#lastDirectSourceAudioCursorByStream.get(streamKey);
+    if (lastSource !== undefined) {
+      this.#drainDirectRecoveredAudioUpTo(streamKey, packetId, lastSource, cb);
+    }
+  }
+
+  // ── Private: FEC recovery routing ───────────────────────────────
+
+  /** Route WASM-recovered block through appropriate path based on container kind. */
+  #routeRecoveredBlock(
+    blockId: number,
+    recovered: Uint8Array,
+    ownerPacketId?: number,
+    catalogTrackName?: string,
+  ): void {
+    // MMTP path: use processFecBlock for MMTP-wrapped recovery.
+    // Recovered symbols are individual MMTP packets that may be fragments
+    // (FI=1/2/3) of a larger MFU.  Route through the reassembler so
+    // multi-packet MFUs (e.g., keyframes spanning 15+ packets) are
+    // properly assembled before reaching the decoder.
+    const k = this.#kForPacket(ownerPacketId);
+    const packetSymbolSize = this.#symbolSizeForPacket(ownerPacketId);
+    const symbolSize = packetSymbolSize > 0 ? packetSymbolSize : undefined;
+    const result = processFecBlock(recovered, {
+      k,
+      symbolSize,
+      ownerPacketId,
+    });
+    this.#routeVerifiedFecSymbols(blockId, result, ownerPacketId, catalogTrackName);
+  }
+
+  #routeVerifiedFecSymbols(
+    blockId: number,
+    result: ProcessFecBlockResult,
+    ownerPacketId?: number,
+    catalogTrackName?: string,
+  ): void {
+    if (!this.#manifestVerifier || ownerPacketId == null) {
+      this.#routeProcessedFecSymbols(blockId, result, ownerPacketId, catalogTrackName);
+      return;
+    }
+    if (!this.#resolveManifestIdentity && !this.#resolveManifestIdentityForRoute) {
+      console.warn(`[MmtpRouter] manifest identity resolver unavailable; recovered media is fail-open for packetId=${ownerPacketId} block=${blockId}`);
+      this.#routeProcessedFecSymbols(blockId, result, ownerPacketId, catalogTrackName);
+      return;
+    }
+    const queueKey = this.#mediaStreamKey(ownerPacketId, catalogTrackName);
+    const queue = this.#manifestRecoveryQueues.get(queueKey) ?? [];
+    queue.push({ blockId, result, ownerPacketId, catalogTrackName });
+    this.#manifestRecoveryQueues.set(queueKey, queue);
+    if (queue.length > 1) return;
+    const drain = (): void => {
+      const next = queue[0];
+      if (!next) {
+        this.#manifestRecoveryQueues.delete(queueKey);
+        return;
+      }
+      this.#admitRecoveredResult(
+        next.blockId,
+        next.result,
+        next.ownerPacketId,
+        next.catalogTrackName,
+        () => {
+          queue.shift();
+          drain();
+        },
+      );
+    };
+    drain();
+  }
+
+  #admitRecoveredResult(
+    blockId: number,
+    result: ProcessFecBlockResult,
+    ownerPacketId: number,
+    catalogTrackName: string | undefined,
+    done: () => void,
+  ): void {
+    const verifier = this.#manifestVerifier;
+    const resolveIdentity = this.#resolveManifestIdentity;
+    const resolveIdentityForRoute = this.#resolveManifestIdentityForRoute;
+    if (!verifier) {
+      this.#routeProcessedFecSymbols(blockId, result, ownerPacketId, catalogTrackName);
+      done();
+      return;
+    }
+    if (!resolveIdentity && !resolveIdentityForRoute) throw new Error("manifest identity resolver disappeared during admission");
+    const symbols = result.symbols;
+    const admitNext = (index: number): void => {
+      const symbol = symbols[index];
+      if (!symbol) {
+        done();
+        return;
+      }
+      const identity = resolveIdentityForRoute
+        ? resolveIdentityForRoute({
+            packetId: ownerPacketId,
+            sbn: blockId,
+            esi: symbol.index,
+            ...(catalogTrackName === undefined ? {} : { catalogTrackName }),
+            recovered: true,
+            sourceSymbolFormat: "fec-padded-recovery",
+          })
+        : resolveIdentity!(ownerPacketId, blockId, symbol.index, catalogTrackName);
+      if (!identity) {
+        console.warn(`[MmtpRouter] manifest identity unresolved; recovered symbol is fail-open for packetId=${ownerPacketId} block=${blockId} esi=${symbol.index}`);
+        this.#routeProcessedFecSymbols(
+          blockId,
+          { ...result, symbols: [symbol] },
+          ownerPacketId,
+          catalogTrackName,
+        );
+        admitNext(index + 1);
+        return;
+      }
+      const admission = verifier.admitObject(
+        {
+          ...identity,
+          packetId: ownerPacketId,
+          ssId: blockId * this.#kForPacket(ownerPacketId) + symbol.index,
+        },
+        symbol.rawSymbol,
+        () => {
+          if (!this.#disposed) {
+            this.#routeProcessedFecSymbols(
+              blockId,
+              { ...result, symbols: [symbol] },
+              ownerPacketId,
+              catalogTrackName,
+            );
+          }
+          admitNext(index + 1);
+        },
+        // A stalled symbol that is later discarded instead of played must still
+        // advance this loop; enforce mode never calls the release callback for
+        // it (BLO-30095).
+        () => admitNext(index + 1),
+      );
+      if (admission.action === "drop") admitNext(index + 1);
+    };
+    admitNext(0);
+  }
+
+  #routeProcessedFecSymbols(
+    blockId: number,
+    result: ProcessFecBlockResult,
+    ownerPacketId?: number,
+    catalogTrackName?: string,
+  ): void {
+    // Route recovered symbols to the track's callback. The ownerPacketId tells us
+    // which track this block belongs to — resolves per-track, then legacy fallback.
+    if (ownerPacketId == null) return; // no track association
+    if (this.#classifyPacketId(ownerPacketId) === null) return; // unknown track
+
+    // A recovered symbol is a function of EVERY symbol that entered its block,
+    // so its provenance is the block's, not the media path's. Repair symbols
+    // routinely arrive over reliable QUIC (`feedRepairPacket`), so a block that
+    // recovered with MoQ help produced bytes that never crossed a multicast
+    // socket. Without this, recovered frames reached the decoder carrying no
+    // attribution at all and were counted as multicast by default.
+    // A FEC manager that cannot report block provenance yields 'unknown', not
+    // a guess: these bytes are then never counted as physical-delivery
+    // evidence. `FECManagerLike` is a pluggable structural interface, so an
+    // implementation without this method must degrade, not throw.
+    const deliveryProvenance: MmtpDeliveryProvenance =
+      this.#fecManager?.blockDeliveryProvenance?.(
+        blockId,
+        ownerPacketId,
+        catalogTrackName,
+      ) ?? 'unknown';
+
+    for (const sym of result.symbols) {
+      this.#routeTrackPacket(sym.rawSymbol, ownerPacketId, sym.packetSequenceNumber, {
+        recovered: true,
+        skipFecPayloadId: true,
+        catalogTrackName,
+        deliveryProvenance,
+      });
+    }
+
+    // Feed recovered metadata before routing data. FT=0 initializes the timing
+    // resolver and FT=1 publishes the sample table that recovered FT=2 data
+    // must resolve against. The parser's callbacks dedupe repeated init
+    // delivery, while keeping this path in lockstep with direct source input.
+    for (const sym of result.symbols) {
+      if (sym.fragmentType !== 0 && sym.fragmentType !== 1) continue;
+      this.#feedViaParser(
+        sym.rawSymbol,
+        { packetId: ownerPacketId, sequenceNumber: sym.packetSequenceNumber },
+        undefined,
+        {
+          skipFecPayloadId: true,
+          recovered: true,
+          ...(catalogTrackName === undefined ? {} : { catalogTrackName }),
+        },
+      );
+    }
+
+    // MSE assembler path: route recovered block as pre-assembled frames (skip FT=0)
+    // BLO-3035 layer 3: recovered symbols are RAW MFU fragments, not complete
+    // frames. A keyframe can span multiple packets (FI=1/2/3); pushing each
+    // fragment as a "frame" produces garbage moof+mdat that fails decode.
+    // Mirror the non-MSE path's logic: FI=0 → emit single-packet MFU directly
+    // (after dedup against source path), FI=1/2/3 → feed reassembler, emit when
+    // the complete frame is available. Take the keyframe bit from the assembled
+    // frame's rapFlag (with `#detectKeyframe` as a bitstream fallback for
+    // publishers that don't set rapFlag) — `sym.isKeyframe` is just rapFlag
+    // from a single fragment's header (see `block-processor.ts` where
+    // `isKeyframe = hdr.rapFlag`) and isn't meaningful for the reassembled-
+    // frame keyframe decision when FI≠0.
+    const assembler = this.#mseAssemblerFor(ownerPacketId, catalogTrackName);
+    if (assembler) {
+      const isVideoTrack = this.#classifyPacketId(ownerPacketId) === true;
+      const frames: Array<{
+        data: Uint8Array;
+        timestamp: number;
+        keyframe: boolean;
+        authoredTiming?: AuthoredTiming;
+        packetSequenceNumber?: number;
+        packetSequenceNumbers?: number[];
+        repairedPacketSequenceNumbers?: number[];
+        mmtpTimestamp?: bigint;
+        mpuSequenceNumber?: number;
+        movieFragmentSequenceNumber?: number;
+        sampleNumber?: number;
+        catalogTrackName?: string;
+        deliveryProvenance?: MmtpDeliveryProvenance;
+        sourceDiscontinuity?: boolean;
+      }> = [];
+      let dedupedAgainstSource = 0;
+      let droppedBeforeSync = 0;
+      for (const sym of result.symbols) {
+        if (sym.fragmentType === 0 || sym.fragmentType === 1) continue;
+        // FT=0/FT=1 are MPU metadata (initialization/movie fragment), already
+        // consumed above to seed the authored timing resolver. Only FT=2 MFU
+        // payloads can become media samples here.
+        const fi = sym.fragment.fragmentationIndicator;
+        if (fi === 0) {
+          // Single-packet MFU. Dedup against source path so frames aren't
+          // emitted twice. The direct source frame may still be buffered by the
+          // parser reorder window, so use source-received sequence numbers.
+          if (this.#sourcePktSeqs.has(
+            this.#packetSeqKey(ownerPacketId, sym.packetSequenceNumber, catalogTrackName),
+          )) {
+            dedupedAgainstSource++;
+            continue;
+          }
+          const keyframe = isVideoTrack
+            ? this.#detectKeyframe(
+                ownerPacketId,
+                sym.fragment.data,
+                isMfuKeyframeMetadata(sym.fragment.rapFlag, sym.fragment.priority),
+              )
+            : sym.fragment.rapFlag;
+          const sourceDiscontinuity = this.#opensFecSync(
+            ownerPacketId,
+            keyframe,
+            catalogTrackName,
+          );
+          if (!this.#shouldEmitFrame(ownerPacketId, keyframe, catalogTrackName)) {
+            droppedBeforeSync++;
+            continue;
+          }
+          const recoveredTiming = this.#resolveRecoveredTiming(
+            ownerPacketId,
+            sym.fragment.mpuSequenceNumber,
+            sym.fragment.movieFragmentSequenceNumber,
+            sym.fragment.sampleNumber,
+            sym.fragment.timestamp,
+            catalogTrackName,
+          );
+          if (!recoveredTiming) continue;
+          frames.push({
+            data: sym.fragment.data,
+            timestamp: recoveredTiming.timestamp,
+            mmtpTimestamp: recoveredTiming.mmtpTimestamp,
+            keyframe,
+            authoredTiming: recoveredTiming.authoredTiming,
+            packetSequenceNumber: sym.packetSequenceNumber,
+            packetSequenceNumbers: [sym.packetSequenceNumber],
+            repairedPacketSequenceNumbers: [sym.packetSequenceNumber],
+            mpuSequenceNumber: sym.fragment.mpuSequenceNumber,
+            ...(sym.fragment.movieFragmentSequenceNumber === undefined
+              ? {}
+              : { movieFragmentSequenceNumber: sym.fragment.movieFragmentSequenceNumber }),
+            ...(sym.fragment.sampleNumber === undefined
+              ? {}
+              : { sampleNumber: sym.fragment.sampleNumber }),
+            ...(catalogTrackName === undefined ? {} : { catalogTrackName }),
+            // A single-packet MFU needs the block verdict just as much as a
+            // reassembled one. The multi-fragment branch below gets it via the
+            // reassembler fold (`assembled.deliveryProvenance`); this branch
+            // never touches the reassembler, so it must carry the block-level
+            // verdict directly or the sample reaches MSE unattributed.
+            deliveryProvenance,
+            ...(sourceDiscontinuity ? { sourceDiscontinuity: true } : {}),
+          });
+          this.#noteEmittedKeyframe(ownerPacketId, keyframe);
+        } else {
+          // Multi-packet MFU. Feed to reassembler; emit only when complete.
+          // A decoded block contains every source symbol, including fragments
+          // already accepted on the direct path. Re-feeding those fragments as
+          // recovered would replace their original attribution in the shared
+          // reassembler and overstate repairedPacketSequenceNumbers.
+          if (this.#sourcePktSeqs.has(
+            this.#packetSeqKey(ownerPacketId, sym.packetSequenceNumber, catalogTrackName),
+          )) {
+            dedupedAgainstSource++;
+            continue;
+          }
+          let assembled;
+          try {
+            assembled = this.#parser.reassembler.addFragment({
+              fragmentationIndicator: fi,
+              mpuSequenceNumber: sym.fragment.mpuSequenceNumber,
+              fragmentCounter: sym.fragment.fragmentCounter,
+              data: sym.fragment.data,
+              timestamp: sym.fragment.timestamp,
+              rapFlag: sym.fragment.rapFlag,
+              sampleNumber: sym.fragment.sampleNumber,
+              movieFragmentSequenceNumber: sym.fragment.movieFragmentSequenceNumber,
+              sampleOffset: sym.fragment.sampleOffset,
+              priority: sym.fragment.priority,
+              packetSequenceNumber: sym.packetSequenceNumber,
+              recovered: true,
+              // Without this the fold sees a fragment with neither `source`
+              // nor a verdict, returns 'unknown', and the block-level finding
+              // computed above is lost before the frame reaches any consumer.
+              deliveryProvenance,
+              packetId: ownerPacketId,
+              ...(catalogTrackName === undefined ? {} : { catalogTrackName }),
+            });
+          } catch (error) {
+            if (!isMfuReassemblyError(error)) throw error;
+            console.warn(
+              `[MmtpRouter] dropped rejected recovered MFU fragment: block=${blockId} ` +
+              `packetId=${ownerPacketId} code=${error.code}`,
+            );
+            continue;
+          }
+          if (assembled) {
+            const keyframe = isVideoTrack
+              ? this.#detectKeyframe(
+                  ownerPacketId,
+                  assembled.data,
+                  isMfuKeyframeMetadata(assembled.rapFlag, assembled.priority),
+                )
+              : assembled.rapFlag;
+            const recoveredCatalogTrackName = assembled.catalogTrackName ?? catalogTrackName;
+            const sourceDiscontinuity = this.#opensFecSync(
+              ownerPacketId,
+              keyframe,
+              recoveredCatalogTrackName,
+            );
+            if (!this.#shouldEmitFrame(
+              ownerPacketId,
+              keyframe,
+              recoveredCatalogTrackName,
+            )) {
+              droppedBeforeSync++;
+              continue;
+            }
+            const recoveredTiming = this.#resolveRecoveredTiming(
+              ownerPacketId,
+              assembled.mpuSequenceNumber,
+              assembled.movieFragmentSequenceNumber,
+              assembled.sampleNumber,
+              assembled.timestamp,
+              recoveredCatalogTrackName,
+            );
+            if (!recoveredTiming) continue;
+            frames.push({
+              data: assembled.data,
+              timestamp: recoveredTiming.timestamp,
+              mmtpTimestamp: recoveredTiming.mmtpTimestamp,
+              keyframe,
+              authoredTiming: recoveredTiming.authoredTiming,
+              // The singular delivery identity is the fragment that completed
+              // and delivered the MFU, matching the callback/parser path.
+              packetSequenceNumber: sym.packetSequenceNumber,
+              ...(assembled.packetSequenceNumbers === undefined
+                ? {}
+                : { packetSequenceNumbers: assembled.packetSequenceNumbers }),
+              ...(assembled.repairedPacketSequenceNumbers === undefined
+                ? {}
+                : {
+                    repairedPacketSequenceNumbers:
+                      assembled.repairedPacketSequenceNumbers,
+                  }),
+              mpuSequenceNumber: assembled.mpuSequenceNumber,
+              ...(assembled.movieFragmentSequenceNumber === undefined
+                ? {}
+                : { movieFragmentSequenceNumber: assembled.movieFragmentSequenceNumber }),
+              ...(assembled.sampleNumber === undefined
+                ? {}
+                : { sampleNumber: assembled.sampleNumber }),
+              ...(assembled.catalogTrackName === undefined
+                ? {}
+                : { catalogTrackName: assembled.catalogTrackName }),
+              deliveryProvenance: assembled.deliveryProvenance,
+              ...(sourceDiscontinuity ? { sourceDiscontinuity: true } : {}),
+            });
+            this.#noteEmittedKeyframe(ownerPacketId, keyframe);
+          }
+        }
+      }
+      if (frames.length > 0) {
+        assembler.addRecoveredBlock(blockId, frames);
+        // The assembler owns MSE writes, but the normal frame callback still
+        // carries transport admission: MulticastManager uses it to confirm
+        // video/audio and MediaRouter uses that confirmation to complete the
+        // takeover. Recovered frames bypass parser.onFrame, so without this
+        // callback MSE can receive samples forever while takeover never fires.
+        const cb = this.#getFrameCallback(ownerPacketId);
+        for (const frame of frames) {
+          cb?.(frame.data, {
+            timestamp: frame.timestamp,
+            ...(frame.mmtpTimestamp === undefined ? {} : { mmtpTimestamp: frame.mmtpTimestamp }),
+            keyframe: frame.keyframe,
+            ...(frame.authoredTiming === undefined ? {} : { authoredTiming: frame.authoredTiming }),
+            packetId: ownerPacketId,
+            ...(frame.packetSequenceNumber === undefined
+              ? {}
+              : { packetSequenceNumber: frame.packetSequenceNumber }),
+            ...(frame.packetSequenceNumbers === undefined
+              ? {}
+              : { packetSequenceNumbers: frame.packetSequenceNumbers }),
+            ...(frame.repairedPacketSequenceNumbers === undefined
+              ? {}
+              : { repairedPacketSequenceNumbers: frame.repairedPacketSequenceNumbers }),
+            ...(frame.mpuSequenceNumber === undefined ? {} : { mpuSequenceNumber: frame.mpuSequenceNumber }),
+            ...(frame.movieFragmentSequenceNumber === undefined
+              ? {}
+              : { movieFragmentSequenceNumber: frame.movieFragmentSequenceNumber }),
+            ...(frame.sampleNumber === undefined ? {} : { sampleNumber: frame.sampleNumber }),
+            ...(frame.catalogTrackName === undefined ? {} : { catalogTrackName: frame.catalogTrackName }),
+            recovered: true,
+            deliveryProvenance: frame.deliveryProvenance,
+            ...(frame.sourceDiscontinuity ? { sourceDiscontinuity: true } : {}),
+          });
+        }
+        debugRouter(
+          `[MmtpRouter] Block ${blockId}: ${result.symbols.length} symbols → ${frames.length} reassembled frames → MSE assembler (packetId=${ownerPacketId}, dedupedAgainstSource=${dedupedAgainstSource}, droppedBeforeSync=${droppedBeforeSync})`,
+        );
+      } else if (result.symbols.length > 0) {
+        // Recovery yielded symbols but no complete frames emerged — either all
+        // FI=0 were source-path duplicates, or all FI=1/2/3 are still mid-
+        // reassembly. Surface this so an operator debugging "FEC recovered N
+        // symbols but no new frames rendered" has a signal.
+        debugRouter(
+          `[MmtpRouter] Block ${blockId}: ${result.symbols.length} symbols recovered → 0 emitted (dedupedAgainstSource=${dedupedAgainstSource}, droppedBeforeSync=${droppedBeforeSync}, pending-reassembly=${result.symbols.length - dedupedAgainstSource - droppedBeforeSync}, packetId=${ownerPacketId})`,
+        );
+      }
+      return;
+    }
+
+    const cb = this.#getFrameCallback(ownerPacketId);
+    const isVideo = this.#classifyPacketId(ownerPacketId) === true;
+    let droppedBeforeSync = 0;
+    let droppedStale = 0;
+    let dedupedAgainstSource = 0;
+
+    for (const sym of result.symbols) {
+      // FT=0 init already delivered above — skip data routing
+      if (sym.fragmentType === 0 || sym.fragmentType === 1) continue;
+      // FT=0/FT=1 are metadata, not decoder samples. The metadata pass above
+      // has already used them to establish the timed-MFU contract.
+
+      if (isVideo) {
+        const fi = sym.fragment.fragmentationIndicator;
+        if (fi === 0) {
+          // Dedup: skip FI=0 frames already received via direct source path.
+          // The reassembler deduplicates FI=1/2/3 fragments via #emitted, but
+          // FI=0 (single-packet MFU) bypasses it. Without this check, recovery
+          // can re-emit a source frame that is only held in the reorder buffer,
+          // producing duplicate timestamps when the source path later flushes.
+          if (this.#sourcePktSeqs.has(
+            this.#packetSeqKey(ownerPacketId, sym.packetSequenceNumber, catalogTrackName),
+          )) {
+            dedupedAgainstSource++;
+            continue;
+          }
+          if (this.#isStaleRecoveredVideo(
+            ownerPacketId,
+            sym.packetSequenceNumber,
+            catalogTrackName,
+          )) {
+            droppedStale++;
+            continue;
+          }
+
+          const d = sym.fragment.data;
+          const keyframe = this.#detectKeyframe(
+            ownerPacketId,
+            d,
+            isMfuKeyframeMetadata(sym.fragment.rapFlag, sym.fragment.priority),
+          );
+          const recoveredTiming = this.#resolveRecoveredTiming(
+            ownerPacketId,
+            sym.fragment.mpuSequenceNumber,
+            sym.fragment.movieFragmentSequenceNumber,
+            sym.fragment.sampleNumber,
+            sym.fragment.timestamp,
+            catalogTrackName,
+          );
+          if (!recoveredTiming) continue;
+          this.#parser.routeFrame(d, {
+            timestamp: recoveredTiming.timestamp,
+            mmtpTimestamp: recoveredTiming.mmtpTimestamp,
+            authoredTiming: recoveredTiming.authoredTiming,
+            keyframe,
+            packetId: ownerPacketId,
+            trackType: "video",
+            packetSequenceNumber: sym.packetSequenceNumber,
+            packetSequenceNumbers: [sym.packetSequenceNumber],
+            repairedPacketSequenceNumbers: [sym.packetSequenceNumber],
+            mpuSequenceNumber: sym.fragment.mpuSequenceNumber,
+            ...(sym.fragment.movieFragmentSequenceNumber === undefined
+              ? {}
+              : { movieFragmentSequenceNumber: sym.fragment.movieFragmentSequenceNumber }),
+            ...(sym.fragment.sampleNumber === undefined
+              ? {}
+              : { sampleNumber: sym.fragment.sampleNumber }),
+            recovered: true,
+            deliveryProvenance,
+            ...(catalogTrackName === undefined ? {} : { catalogTrackName }),
+          });
+        } else {
+          // Fragment of a multi-packet MFU — must go through reassembler
+          if (this.#sourcePktSeqs.has(
+            this.#packetSeqKey(ownerPacketId, sym.packetSequenceNumber, catalogTrackName),
+          )) {
+            dedupedAgainstSource++;
+            continue;
+          }
+          let assembled;
+          try {
+            assembled = this.#parser.reassembler.addFragment({
+              fragmentationIndicator: fi,
+              mpuSequenceNumber: sym.fragment.mpuSequenceNumber,
+              fragmentCounter: sym.fragment.fragmentCounter,
+              data: sym.fragment.data,
+              timestamp: sym.fragment.timestamp,
+              rapFlag: sym.fragment.rapFlag,
+              sampleNumber: sym.fragment.sampleNumber,
+              movieFragmentSequenceNumber: sym.fragment.movieFragmentSequenceNumber,
+              sampleOffset: sym.fragment.sampleOffset,
+              priority: sym.fragment.priority,
+              packetSequenceNumber: sym.packetSequenceNumber,
+              recovered: true,
+              // Without this the fold sees a fragment with neither `source`
+              // nor a verdict, returns 'unknown', and the block-level finding
+              // computed above is lost before the frame reaches any consumer.
+              deliveryProvenance,
+              packetId: ownerPacketId,
+              ...(catalogTrackName === undefined ? {} : { catalogTrackName }),
+            });
+          } catch (error) {
+            if (!isMfuReassemblyError(error)) throw error;
+            console.warn(
+              `[MmtpRouter] dropped rejected recovered MFU fragment: block=${blockId} ` +
+              `packetId=${ownerPacketId} code=${error.code}`,
+            );
+            continue;
+          }
+          if (assembled) {
+            if (this.#isStaleRecoveredVideo(
+              ownerPacketId,
+              sym.packetSequenceNumber,
+              assembled.catalogTrackName,
+            )) {
+              droppedStale++;
+              continue;
+            }
+            const keyframe = this.#detectKeyframe(
+              ownerPacketId,
+              assembled.data,
+              isMfuKeyframeMetadata(assembled.rapFlag, assembled.priority),
+            );
+            const recoveredCatalogTrackName = assembled.catalogTrackName ?? catalogTrackName;
+            const recoveredTiming = this.#resolveRecoveredTiming(
+              ownerPacketId,
+              assembled.mpuSequenceNumber,
+              assembled.movieFragmentSequenceNumber,
+              assembled.sampleNumber,
+              assembled.timestamp,
+              recoveredCatalogTrackName,
+            );
+            if (!recoveredTiming) continue;
+            this.#parser.routeFrame(assembled.data, {
+              timestamp: recoveredTiming.timestamp,
+              mmtpTimestamp: recoveredTiming.mmtpTimestamp,
+              authoredTiming: recoveredTiming.authoredTiming,
+              keyframe,
+              packetId: ownerPacketId,
+              trackType: "video",
+              packetSequenceNumber: sym.packetSequenceNumber,
+              ...(assembled.packetSequenceNumbers === undefined
+                ? {}
+                : { packetSequenceNumbers: assembled.packetSequenceNumbers }),
+              ...(assembled.repairedPacketSequenceNumbers === undefined
+                ? {}
+                : {
+                    repairedPacketSequenceNumbers:
+                      assembled.repairedPacketSequenceNumbers,
+                  }),
+              mpuSequenceNumber: assembled.mpuSequenceNumber,
+              ...(assembled.movieFragmentSequenceNumber === undefined
+                ? {}
+                : { movieFragmentSequenceNumber: assembled.movieFragmentSequenceNumber }),
+              ...(assembled.sampleNumber === undefined
+                ? {}
+                : { sampleNumber: assembled.sampleNumber }),
+              recovered: true,
+              deliveryProvenance,
+              ...(assembled.catalogTrackName === undefined
+                ? {}
+                : { catalogTrackName: assembled.catalogTrackName }),
+            });
+          }
+        }
+      } else {
+        // Audio recovery: dedup single-packet MFUs already emitted via direct source path
+        // (parity with video FI=0 path at line 993). Prevents re-delivering audio frames
+        // with duplicate timestamps — doubled samples in the FIFO ring buffer corrupt the
+        // 1kHz test tone (pitch/energy instability in FFT spectrum).
+        if (this.#sourcePktSeqs.has(
+          this.#packetSeqKey(ownerPacketId, sym.packetSequenceNumber, catalogTrackName),
+        )) {
+          dedupedAgainstSource++;
+          continue;
+        }
+        const recoveredTiming = this.#resolveRecoveredTiming(
+          ownerPacketId,
+          sym.fragment.mpuSequenceNumber,
+          sym.fragment.movieFragmentSequenceNumber,
+          sym.fragment.sampleNumber,
+          sym.fragment.timestamp,
+          catalogTrackName,
+        );
+        if (recoveredTiming === null) continue;
+        const meta = {
+          timestamp: recoveredTiming.timestamp,
+          mmtpTimestamp: recoveredTiming.mmtpTimestamp,
+          authoredTiming: recoveredTiming.authoredTiming,
+          keyframe: true,
+          packetId: ownerPacketId,
+          packetSequenceNumber: sym.packetSequenceNumber,
+          packetSequenceNumbers: [sym.packetSequenceNumber],
+          repairedPacketSequenceNumbers: [sym.packetSequenceNumber],
+          mpuSequenceNumber: sym.fragment.mpuSequenceNumber,
+          ...(sym.fragment.movieFragmentSequenceNumber === undefined
+            ? {}
+            : { movieFragmentSequenceNumber: sym.fragment.movieFragmentSequenceNumber }),
+          ...(sym.fragment.sampleNumber === undefined
+            ? {}
+            : { sampleNumber: sym.fragment.sampleNumber }),
+          recovered: true,
+          ...(catalogTrackName === undefined ? {} : { catalogTrackName }),
+        };
+        this.#routeDirectRecoveredAudio(
+          ownerPacketId,
+          sym.fragment.data,
+          meta,
+          cb,
+        );
+      }
+    }
+    if (result.symbols.length > 0) {
+      debugRouter(
+        `[MmtpRouter] Block ${blockId}: ${result.symbols.length} symbols recovered (packetId=${ownerPacketId}, dedupedAgainstSource=${dedupedAgainstSource}, droppedBeforeSync=${droppedBeforeSync}, droppedStale=${droppedStale})`,
+      );
+    }
+  }
+
+  // ── Private: keyframe detection ─────────────────────────────────
+
+  /** Codec-aware keyframe detection from bitstream data.
+   *  H.264 IDR (NAL type 5/7), AV1 OBU_SEQUENCE_HEADER (type 1), VP9 frame_type bit. */
+  #detectKeyframe(
+    packetId: number,
+    data: Uint8Array,
+    rapFlag = false,
+  ): boolean {
+    const codec = this.#trackCodecs.get(packetId) ?? "";
+    return MmtpContainerParser.isKeyframe(data, rapFlag, codec);
+  }
+}