@blockcast/mmt-container 0.1.0-main.fcefcc30604d → 0.1.0-main.ffdace838275

package/dist/browser-runtime.js

@@ -6308,10 +6308,15 @@ function validateCmsfMmtpCatalog(value) {
   if (!Array.isArray(catalog["tracks"])) {
     catalogError("catalog_tracks", "$.tracks", "tracks must be an array");
   }
-  const common = typeof catalog["commonTrackFields"] === "object" && catalog["commonTrackFields"] !== null && !Array.isArray(catalog["commonTrackFields"]) ? catalog["commonTrackFields"] : {};
+  if ("commonTrackFields" in catalog) {
+    catalogError(
+      "catalog_common_track_fields",
+      "$.commonTrackFields",
+      "commonTrackFields is retired; every track carries its own fields"
+    );
+  }
   const tracks = catalog["tracks"];
   const trackRecords = [];
-  const effective = (track, field) => track[field] ?? common[field];
   const positiveInteger2 = (input) => Number.isSafeInteger(input) && input > 0;
   const positiveNumber = (input) => typeof input === "number" && Number.isFinite(input) && input > 0;
   for (let index = 0; index < tracks.length; index++) {
@@ -6326,28 +6331,32 @@ function validateCmsfMmtpCatalog(value) {
       catalogError("track_name", `${path}.name`, "name must be a non-empty string");
     }
     trackRecords.push(track);
-    const packaging = effective(track, "packaging");
+    const packaging = track["packaging"];
     if (typeof packaging !== "string" || packaging.length === 0) {
       catalogError("track_packaging", `${path}.packaging`, "packaging must be a non-empty string");
     }
-    const trackHasIsLive = Object.prototype.hasOwnProperty.call(track, "isLive");
-    const hasIsLive = trackHasIsLive || Object.prototype.hasOwnProperty.call(common, "isLive");
-    const isLive = trackHasIsLive ? track["isLive"] : common["isLive"];
+    const hasIsLive = Object.prototype.hasOwnProperty.call(track, "isLive");
+    const isLive = track["isLive"];
     if (hasIsLive && typeof isLive !== "boolean") {
       catalogError("track_is_live", `${path}.isLive`, "isLive must be a boolean");
     }
     track["isLive"] = isLive ?? true;
-    const selectionValue = effective(track, "selectionParams");
-    const selection = typeof selectionValue === "object" && selectionValue !== null && !Array.isArray(selectionValue) ? selectionValue : void 0;
-    const codec = selection?.["codec"] ?? effective(track, "codec");
+    if ("selectionParams" in track) {
+      catalogError(
+        "track_selection_params",
+        `${path}.selectionParams`,
+        "selectionParams is retired; codec and the other selection fields are flat on the track"
+      );
+    }
+    const codec = track["codec"];
     if (packaging !== "timeline" && packaging !== "mediatimeline" && packaging !== "eventtimeline" && packaging !== "fec-repair" && (typeof codec !== "string" || codec.length === 0)) {
       catalogError("track_codec", `${path}.codec`, `codec is required for packaging=${packaging}`);
     }
-    const timescale = effective(track, "timescale");
-    const groupDurationMs = effective(track, "groupDurationMs");
-    const groupDurationTicks = effective(track, "groupDurationTicks");
-    const keyframeIntervalMs = effective(track, "keyframeIntervalMs");
-    const keyframeIntervalTicks = effective(track, "keyframeIntervalTicks");
+    const timescale = track["timescale"];
+    const groupDurationMs = track["groupDurationMs"];
+    const groupDurationTicks = track["groupDurationTicks"];
+    const keyframeIntervalMs = track["keyframeIntervalMs"];
+    const keyframeIntervalTicks = track["keyframeIntervalTicks"];
     if (groupDurationMs !== void 0 && !positiveInteger2(groupDurationMs)) {
       catalogError("track_group_duration_ms", `${path}.groupDurationMs`, "must be a positive integer");
     }
@@ -6364,7 +6373,7 @@ function validateCmsfMmtpCatalog(value) {
       rejectRepairFieldsOnMediaTrack(path, track, catalogError);
     }
     if (packaging === "mmtp") {
-      const mmtpMode = effective(track, "mmtpMode");
+      const mmtpMode = track["mmtpMode"];
       if (mmtpMode !== "mpu" && mmtpMode !== "mfu") {
         catalogError("track_mmtp_mode", `${path}.mmtpMode`, "must be mpu or mfu");
       }
@@ -6418,10 +6427,10 @@ function validateCmsfMmtpCatalog(value) {
     }
   }
   const repairDescriptors = trackRecords.flatMap(
-    (track, index) => effective(track, "packaging") === "fec-repair" ? [describeRepairTrack(track["name"], `$.tracks[${index}]`, track)] : []
+    (track, index) => track["packaging"] === "fec-repair" ? [describeRepairTrack(track["name"], `$.tracks[${index}]`, track)] : []
   );
   const reachability = repairReachability(
-    trackRecords.filter((track) => effective(track, "packaging") !== "fec-repair").map((track) => track["fec"])
+    trackRecords.filter((track) => track["packaging"] !== "fec-repair").map((track) => track["fec"])
   );
   for (const descriptor of repairDescriptors) {
     assertRepairTrackReachable(descriptor, reachability, catalogError);
@@ -6429,7 +6438,7 @@ function validateCmsfMmtpCatalog(value) {
     if (target === void 0) continue;
     const source = trackRecords.find((candidate) => candidate["name"] === target);
     const sourceFec = source?.["fec"];
-    if (!source || effective(source, "packaging") !== "mmtp" || !sourceFec || sourceFec["algorithm"] === "none") {
+    if (!source || source["packaging"] !== "mmtp" || !sourceFec || sourceFec["algorithm"] === "none") {
       catalogError(
         "track_repair_depends",
         `${descriptor.path}.depends`,
@@ -6458,12 +6467,12 @@ function validateCmsfMmtpCatalog(value) {
   const switchingSets = /* @__PURE__ */ new Map();
   for (let index = 0; index < trackRecords.length; index++) {
     const track = trackRecords[index];
-    if (effective(track, "packaging") !== "mmtp") continue;
-    const altGroup = effective(track, "altGroup");
+    if (track["packaging"] !== "mmtp") continue;
+    const altGroup = track["altGroup"];
     if (!Number.isSafeInteger(altGroup)) continue;
-    const timescale = BigInt(effective(track, "timescale"));
-    const durationTicks = effective(track, "groupDurationTicks");
-    const ticks = durationTicks !== void 0 ? BigInt(durationTicks) : BigInt(effective(track, "groupDurationMs")) * timescale / 1000n;
+    const timescale = BigInt(track["timescale"]);
+    const durationTicks = track["groupDurationTicks"];
+    const ticks = durationTicks !== void 0 ? BigInt(durationTicks) : BigInt(track["groupDurationMs"]) * timescale / 1000n;
     const anchor = switchingSets.get(altGroup);
     if (anchor && ticks * anchor.timescale !== anchor.ticks * timescale) {
       catalogError("track_switching_set", `$.tracks[${index}]`, `group duration does not match ${JSON.stringify(anchor.name)} in altGroup ${altGroup}`);
@@ -9522,15 +9531,21 @@ var SessionManager = class {
    * deadline before the subscription existed and abandoned the join on the
    * happy path. BLO-34289.
    *
-   * Flip it true when the subscribe settles, never later. Over AMT a settled
-   * subscribe means the gateway has sent its Membership Update, and the relay's
-   * upstream join plus a path RTT still precede the first packet, but that
-   * latency belongs inside this budget, not in front of it: RFC 7450 gives a
-   * gateway no signal that the relay has traffic for its (S,G), so a join whose
-   * source never sends is bounded only by this deadline. Holding the flag until
-   * MulticastTransport.onDataPlaneLive would park such a join in `joining`
-   * forever. MulticastTransport's silence window, not this deadline, is what
-   * starts at the first packet.
+   * The deadline is a media budget (group cadence plus FEC delivery window) and
+   * budgets nothing for reaching the stream, so ideally it starts at
+   * MulticastTransport.onDataPlaneLive, the join's first accepted packet. Over
+   * AMT that is measurably later than a settled subscribe: the subscribe
+   * settles once the gateway has sent its Membership Update, and the relay's
+   * upstream join plus a path RTT (0.4-0.8 s measured to the prod relay) still
+   * precede the first packet. But RFC 7450 gives a gateway no signal that the
+   * relay has traffic for its (S,G), so a join whose source never sends never
+   * reaches that edge. Starting the deadline there is therefore sound only when
+   * the provider bounds the join phase itself, with a typed subscription error
+   * for a join that delivers nothing (MulticastTransport forwards it to
+   * onFailback). A host whose provider makes no such guarantee flips this true
+   * when the subscribe settles and accepts that join latency is charged to the
+   * media budget; holding it until the first packet would park a silent join
+   * in `joining` forever.
    *
    * The flag tracks the host's primary join, not per-track transport state. A
    * track that fails over to the next transport in its own chain while this is
@@ -9767,6 +9782,91 @@ var SessionManager = class {
   }
 };
 
+// src/delivery-gap.ts
+var DeliveryGapEstimator = class {
+  /** Most recent arrival, or undefined before the first one since reset. */
+  #lastArrivalMs;
+  /** Last MMTP packet_sequence_number seen per packet_id. */
+  #lastSequence = /* @__PURE__ */ new Map();
+  /**
+   * Monotonic deque of (arrivalMs, gapMs): gaps strictly decrease from head to
+   * tail, so the head is the window maximum. Amortized O(1) per arrival.
+   */
+  #times = [];
+  #gaps = [];
+  #head = 0;
+  #windowMs;
+  /**
+   * @param windowMs trailing window in ms, which also caps the reported gap,
+   *   or undefined when the catalog gives none (no gap is reported).
+   */
+  setWindowMs(windowMs) {
+    if (windowMs !== void 0 && !(Number.isFinite(windowMs) && windowMs > 0)) {
+      throw new Error(
+        `[DeliveryGap] window must be a finite positive ms value or undefined (got ${windowMs})`
+      );
+    }
+    this.#windowMs = windowMs;
+  }
+  get windowMs() {
+    return this.#windowMs;
+  }
+  /**
+   * Record one multicast datagram arrival at receiver time `nowMs`, carrying
+   * MMTP `packetSequenceNumber` (32-bit, per packet_id) on `packetId`.
+   */
+  noteArrival(nowMs, packetId, packetSequenceNumber) {
+    const last = this.#lastArrivalMs;
+    const previousSequence = this.#lastSequence.get(packetId);
+    this.#lastArrivalMs = nowMs;
+    this.#lastSequence.set(packetId, packetSequenceNumber);
+    if (last === void 0 || previousSequence === void 0) return;
+    if (this.#windowMs === void 0) return;
+    if (previousSequence + 1 >>> 0 !== packetSequenceNumber >>> 0) return;
+    const gap = nowMs - last;
+    this.#evict(nowMs);
+    while (this.#gaps.length > this.#head && this.#gaps[this.#gaps.length - 1] <= gap) {
+      this.#gaps.pop();
+      this.#times.pop();
+    }
+    this.#gaps.push(gap);
+    this.#times.push(nowMs);
+    this.#compact();
+  }
+  /**
+   * Largest gap observed within the window ending at `nowMs`, at most the
+   * window itself; 0 if none or when no window is set.
+   */
+  peakGapMs(nowMs) {
+    const windowMs = this.#windowMs;
+    if (windowMs === void 0) return 0;
+    this.#evict(nowMs);
+    return this.#gaps.length > this.#head ? Math.min(this.#gaps[this.#head], windowMs) : 0;
+  }
+  /** Forget everything: a new delivery path starts with no measurement. */
+  reset() {
+    this.#lastArrivalMs = void 0;
+    this.#lastSequence.clear();
+    this.#times = [];
+    this.#gaps = [];
+    this.#head = 0;
+  }
+  #evict(nowMs) {
+    const windowMs = this.#windowMs;
+    if (windowMs === void 0) return;
+    while (this.#times.length > this.#head && this.#times[this.#head] < nowMs - windowMs) {
+      this.#head++;
+    }
+  }
+  #compact() {
+    if (this.#head > 0 && this.#head * 2 >= this.#times.length) {
+      this.#times = this.#times.slice(this.#head);
+      this.#gaps = this.#gaps.slice(this.#head);
+      this.#head = 0;
+    }
+  }
+};
+
 // src/block-policy.ts
 function repairPriorityForClass(blockClass) {
   switch (blockClass) {
@@ -10231,6 +10331,9 @@ var WORKER_ERROR_LOG_CAP = 5;
 var WORKER_ERROR_KIND_CAP = 32;
 var WORKER_ERROR_OVERFLOW_KIND = "other";
 var STARTUP_REPAIR_WAIT_SOURCE_BOUNDARIES = 2;
+function isMulticastSymbolDelivery(value) {
+  return value === "datagram" || value === "ordered-relay";
+}
 function newFecCounters() {
   return {
     sourcePackets: 0,
@@ -10296,6 +10399,17 @@ var FECManager = class {
     // deadline; the timer re-checks it when it fires (see DeadlineTimer).
     this.#activeBlocks = /* @__PURE__ */ new Map();
     this.#activeBlockDeadlinesMs = /* @__PURE__ */ new Map();
+    // The two terms #activeBlockDeadlinesMs is the later of (BLO-35597):
+    // - the multicast late-symbol wait, refreshed by every accepted symbol;
+    // - a D-28 repair hold, set by the repair scheduler only while a repair
+    //   FETCH it admitted can still land before the block's presentation
+    //   deadline. The multicast span elapsing never ends a fetch the scheduler
+    //   judged able to arrive in time.
+    this.#blockWaitDeadlinesMs = /* @__PURE__ */ new Map();
+    this.#repairHoldUntilMs = /* @__PURE__ */ new Map();
+    // Receiver-measured multicast delivery gap: the late-symbol wait's jitter
+    // term (see DeliveryGapEstimator for the statistic and why).
+    this.#deliveryGaps = new DeliveryGapEstimator();
     this.#lifecycleTrace = [];
     // Worker-backed timeouts enqueue cleanup behind all prior symbol messages.
     // Failure remains pending until cleanupComplete acknowledges that queue drain.
@@ -10353,6 +10467,9 @@ var FECManager = class {
     this.#lastStreamKey = "";
     this.#seenSymbols = /* @__PURE__ */ new Set();
     this.#blockPathCounts = /* @__PURE__ */ new Map();
+    // Receiver-local first-accepted-symbol time per block, bounded like
+    // #blockPathCounts (see blockAnchorAtMs).
+    this.#blockAnchorsMs = /* @__PURE__ */ new Map();
     // Exact catalog identity observed on accepted symbols for each FEC block.
     // Conflicting identities collapse to null so recovery fails closed.
     this.#blockCatalogTrackNames = /* @__PURE__ */ new Map();
@@ -10400,6 +10517,19 @@ var FECManager = class {
     // Worker recovery emits all K source symbols. Track recovery once per block
     // while routing only ESI slots that were absent from the direct source path.
     this.#workerRecoveredBlocks = /* @__PURE__ */ new Set();
+    // How the multicast leg delivers symbols (see MulticastSymbolDelivery). The
+    // provider declares it per transport join; absence keeps datagram semantics.
+    this.#multicastSymbolDelivery = "datagram";
+    // ordered-relay: per stream, the highest SBN any multicast symbol carried.
+    // The relay preserves the receiving socket's order, so every block more than
+    // the decoder's interleave horizon behind this frontier has received every
+    // symbol it will ever receive over multicast.
+    this.#orderedFrontiers = /* @__PURE__ */ new Map();
+    // ordered-relay: blocks with multicast symbols that are neither terminal nor
+    // handed to a decoder cleanup, per stream, keyed by SBN. They carry no
+    // timer; the frontier settles them. At most one interleave horizon of blocks
+    // per stream is ever here.
+    this.#orderedPendingBlocks = /* @__PURE__ */ new Map();
     // ── Keyframe-protected repair policy (block-policy.ts) ──
     // One classifier per physical stream, built from that stream's geometry.
     this.#classifiers = /* @__PURE__ */ new Map();
@@ -10506,6 +10636,9 @@ var FECManager = class {
   #fecStatsObservers;
   #activeBlocks;
   #activeBlockDeadlinesMs;
+  #blockWaitDeadlinesMs;
+  #repairHoldUntilMs;
+  #deliveryGaps;
   #lifecycleTrace;
   #pendingWorkerCleanups;
   #pendingWorkerCleanupClients;
@@ -10529,6 +10662,7 @@ var FECManager = class {
   #lastStreamKey;
   #seenSymbols;
   #blockPathCounts;
+  #blockAnchorsMs;
   #blockCatalogTrackNames;
   #startupAlignedPackets;
   #startupPartialBlocks;
@@ -10541,6 +10675,9 @@ var FECManager = class {
   #repairDeadlines;
   #repairDeadlineAtMs;
   #workerRecoveredBlocks;
+  #multicastSymbolDelivery;
+  #orderedFrontiers;
+  #orderedPendingBlocks;
   #classifiers;
   #streamGeometries;
   #failedBlocks;
@@ -10640,6 +10777,7 @@ var FECManager = class {
   #markTerminal(key, sbn, packetId, clean) {
     const nowMs = performance.now();
     this.#retireTerminalBlocks(packetId, nowMs);
+    this.#forgetOrderedPending(key);
     this.#completedBlocks.add(key);
     if (clean) this.#cleanlyCompletedBlocks.add(key);
     this.#indexBlockKey(key, sbn, packetId);
@@ -10657,8 +10795,10 @@ var FECManager = class {
     if (!queue) return;
     for (let record = queue.peek(); record !== void 0; record = queue.peek()) {
       if (record.expiresAtMs > nowMs) return;
+      const current = this.#terminalExpiryMs.get(record.key) === record.expiresAtMs;
+      if (current && this.#withinOrderedHorizon(record.key)) return;
       queue.shift();
-      if (this.#terminalExpiryMs.get(record.key) !== record.expiresAtMs) continue;
+      if (!current) continue;
       this.#terminalExpiryMs.delete(record.key);
       this.#completedBlocks.delete(record.key);
       this.#cleanlyCompletedBlocks.delete(record.key);
@@ -10669,12 +10809,143 @@ var FECManager = class {
       this.#unindexBlockKey(record.key);
     }
   }
+  // -----------------------------------------------------------------------
+  // Ordered-relay settlement (MulticastSymbolDelivery 'ordered-relay')
+  // -----------------------------------------------------------------------
+  /**
+   * The decoder's interleave horizon for one stream, in blocks: the same
+   * `interleaveDepth` the Worker and the WASM decoder are configured with
+   * (fec-worker-setup derives it from the catalog interleaveDepthMs and the
+   * media-unit duration). The decoder already retires every block more than
+   * this many SBNs behind the newest one it saw (`cleanup_by_sbn`), so it is
+   * the stream-order reorder allowance the receiver has already committed to.
+   */
+  #orderedHorizonBlocksFor(packetId, config) {
+    const horizon = this.#derivableOrderedHorizon(config);
+    if (horizon === void 0) {
+      throw new Error(
+        `[FECManager] packetId=${packetId}: ordered-relay settlement derives the decoder's interleave horizon from the catalog interleaveDepthMs (>= ${MIN_INTERLEAVE_DEPTH_MS}ms) and the media-unit rate; got interleaveDepthMs=${config.interleaveDepthMs} fps=${String(config.fps)}.`
+      );
+    }
+    return horizon;
+  }
+  #derivableOrderedHorizon(config) {
+    if (!(config.interleaveDepthMs >= MIN_INTERLEAVE_DEPTH_MS) || config.fps === void 0 || !Number.isFinite(config.fps) || config.fps <= 0) {
+      return void 0;
+    }
+    return deriveFecInterleaveDepth(config.interleaveDepthMs, 1e3 / config.fps);
+  }
+  /**
+   * The stream's interleave horizon, or undefined when its geometry cannot
+   * define one. Explicitly configured tracks are refused that case at config
+   * time (#upsertTrackConfig, setMulticastSymbolDelivery); only a packetId that
+   * was never configured, and so resolves to the manager defaults, reaches it
+   * here, and such a stream keeps datagram semantics rather than throwing from
+   * the packet-feed path. Those defaults can change under a stream that already
+   * holds blocks, so a caller cannot assume a horizon that was defined when a
+   * block was held is still defined (see #advanceOrderedFrontier).
+   */
+  #orderedHorizonBlocks(packetId) {
+    return this.#derivableOrderedHorizon(this.#resolveTrackConfig(packetId));
+  }
+  /** True while a block of an ordered-relay stream can still receive symbols. */
+  #withinOrderedHorizon(key) {
+    if (this.#multicastSymbolDelivery !== "ordered-relay") return false;
+    const block = this.#parseBlockKey(key);
+    const frontier = this.#orderedFrontiers.get(
+      this.#streamKey(block.packetId, block.catalogTrackName)
+    );
+    if (frontier === void 0) return false;
+    const horizon = this.#orderedHorizonBlocks(block.packetId);
+    if (horizon === void 0) return false;
+    return block.sbn >= frontier - horizon;
+  }
+  /** Whether a block's fate is decided by stream order rather than a timer. */
+  #settlesByOrder(key) {
+    return this.#multicastSymbolDelivery === "ordered-relay" && (this.#blockPathCounts.get(key)?.multicastSymbols ?? 0) > 0 && this.#orderedHorizonBlocks(this.#parseBlockKey(key).packetId) !== void 0;
+  }
+  #forgetOrderedPending(key) {
+    if (this.#orderedPendingBlocks.size === 0) return;
+    const block = this.#parseBlockKey(key);
+    const streamKey = this.#streamKey(block.packetId, block.catalogTrackName);
+    const pending = this.#orderedPendingBlocks.get(streamKey);
+    if (pending?.get(block.sbn) !== key) return;
+    pending.delete(block.sbn);
+    if (pending.size === 0) this.#orderedPendingBlocks.delete(streamKey);
+  }
+  /**
+   * Record the stream position of a multicast symbol and settle every pending
+   * block it proves final: a block more than the interleave horizon behind the
+   * frontier has already been handed every symbol the relay will deliver.
+   */
+  #advanceOrderedFrontier(streamKey, sbn, packetId, catalogTrackName) {
+    const previous = this.#orderedFrontiers.get(streamKey);
+    const frontier = previous === void 0 || sbn > previous ? sbn : previous;
+    if (frontier !== previous) this.#orderedFrontiers.set(streamKey, frontier);
+    const pending = this.#orderedPendingBlocks.get(streamKey);
+    if (!pending) return;
+    const blocks = this.#orderedHorizonBlocks(packetId);
+    if (blocks === void 0) {
+      this.#orderedPendingBlocks.delete(streamKey);
+      for (const pendingSbn of pending.keys()) {
+        this.noteBlockActivity(pendingSbn, packetId, catalogTrackName);
+      }
+      return;
+    }
+    const horizon = frontier - blocks;
+    for (const [pendingSbn, key] of pending) {
+      if (pendingSbn >= horizon) continue;
+      pending.delete(pendingSbn);
+      this.#settleOrderedBlock(key, pendingSbn, packetId, catalogTrackName);
+    }
+    if (pending.size === 0 && this.#orderedPendingBlocks.get(streamKey) === pending) {
+      this.#orderedPendingBlocks.delete(streamKey);
+    }
+  }
+  /**
+   * Decide a block the ordered relay has finished delivering. Its accounting
+   * is final: SSB_length (from any repair symbol) against the source and
+   * repair symbols it holds says whether the decoder can still recover it.
+   * A block short of that asks for repair when D-28 is wired, under the same
+   * post-request fetch budget the datagram path grants; otherwise, and for a
+   * block the decoder holds enough symbols for, the decoder finalizes it
+   * exactly as a datagram deadline would (a Worker acknowledges the cleanup
+   * only after every earlier symbol, so an in-flight recovery still wins).
+   */
+  #settleOrderedBlock(key, sbn, packetId, catalogTrackName) {
+    if (this.#completedBlocks.has(key) || this.#pendingWorkerCleanups.has(key) || this.#repairRequestedBlocks.has(key)) return;
+    const authoredLength = this.#blockAuthoredLengths.get(key);
+    const received = (this.#blockSourceCounts.get(key) ?? 0) + (this.#blockRepairRsIds.get(key)?.size ?? 0);
+    if (this.onRepairNeeded && (authoredLength === void 0 || received < authoredLength)) {
+      this.#requestRepair(sbn, packetId, catalogTrackName, true);
+      return;
+    }
+    this.#traceLifecycle("horizon-settled", sbn, packetId, catalogTrackName);
+    this.#finalizeExpiredBlock(sbn, packetId, catalogTrackName);
+  }
+  /** Register a block whose multicast symbols arrive over an ordered relay. */
+  #holdForOrderedSettlement(key, sbn, packetId, catalogTrackName) {
+    this.#clearRepairDeadline(key);
+    if (this.#activeBlocks.has(key)) {
+      this.#clearBlockTimer(key);
+      this.#unindexBlockKey(key);
+    }
+    const streamKey = this.#streamKey(packetId, catalogTrackName);
+    let pending = this.#orderedPendingBlocks.get(streamKey);
+    if (!pending) {
+      pending = /* @__PURE__ */ new Map();
+      this.#orderedPendingBlocks.set(streamKey, pending);
+    }
+    pending.set(sbn, key);
+  }
   /** Cancel and forget a block's inactivity timer and deadline. */
   #clearBlockTimer(key) {
     const timer = this.#activeBlocks.get(key);
     if (timer?.handle != null) clearTimeout(timer.handle);
     this.#activeBlocks.delete(key);
     this.#activeBlockDeadlinesMs.delete(key);
+    this.#blockWaitDeadlinesMs.delete(key);
+    this.#repairHoldUntilMs.delete(key);
   }
   #parseBlockKey(key) {
     const [packetIdText, sbnText, ...catalogParts] = key.split(":");
@@ -10799,7 +11070,7 @@ var FECManager = class {
     timer.handle = setTimeout(onFire, delayMs);
     this.#repairDeadlines.set(key, timer);
   }
-  #requestRepair(sbn, packetId, catalogTrackName) {
+  #requestRepair(sbn, packetId, catalogTrackName, settledByOrder = false) {
     const key = this.#blockKey(sbn, packetId, catalogTrackName);
     if (this.#completedBlocks.has(key) || !this.onRepairNeeded || this.#repairRequestedBlocks.has(key)) return;
     const deadline = this.#repairDeadlines.get(key);
@@ -10807,16 +11078,7 @@ var FECManager = class {
     this.#repairDeadlines.set(key, null);
     this.#repairDeadlineAtMs.delete(key);
     this.#repairRequestedBlocks.add(key);
-    const config = this.#resolveTrackConfig(packetId);
-    const graceMs = this.#repairGraceMs(config);
-    const now = performance.now();
-    const currentDeadline = this.#activeBlockDeadlinesMs.get(key) ?? now;
-    this.#armBlockTimeout(
-      sbn,
-      packetId,
-      catalogTrackName,
-      Math.max(1, Math.ceil(Math.max(now, currentDeadline) + graceMs - now))
-    );
+    if (settledByOrder) this.#armBlockTimeout(sbn, packetId, catalogTrackName, 0);
     this.#traceLifecycle("repair-requested", sbn, packetId, catalogTrackName);
     this.onRepairNeeded(
       sbn,
@@ -11062,8 +11324,55 @@ var FECManager = class {
     }
     return this.#fecTimeoutMs;
   }
-  #repairDeadlineMs(config) {
-    const halfFailBoundMs = Math.ceil(config.timeoutMs / 2);
+  /**
+   * The delivery-gap window is the longest catalog keyframe interval among
+   * the configured video streams. A failed video block costs every frame up
+   * to the next keyframe, so a receiver must remember a stall for at least
+   * that long: forgetting it sooner would let the next recurrence fail a
+   * block whose damage outlives the memory of the stall that caused it. It
+   * comes from the catalog's `keyframeIntervalTicks`/`keyframeIntervalMs`
+   * (via the classifier geometry), never from a constant. It also caps the
+   * gap the wait may absorb; with no catalog cadence no gap is reported and
+   * the catalog tolerance alone applies (see DeliveryGapEstimator).
+   */
+  #refreshDeliveryGapWindow() {
+    let windowMs;
+    const consider = (geometry) => {
+      if (geometry?.trackKind !== "video" || geometry.mode !== "classifying") return;
+      const { ticks, timescale } = geometry.keyframeInterval;
+      const ms = ticks / timescale * 1e3;
+      if (Number.isFinite(ms) && ms > 0 && (windowMs === void 0 || ms > windowMs)) windowMs = ms;
+    };
+    for (const geometry of this.#streamGeometries.values()) consider(geometry);
+    for (const config of this.#trackConfigs.values()) consider(config.geometry);
+    this.#deliveryGaps.setWindowMs(windowMs);
+  }
+  /**
+   * The multicast late-symbol wait: the block span plus the larger of the
+   * catalog's signaled tolerance and the receiver-measured delivery gap.
+   *
+   * `config.timeoutMs` already is span + `fec.reorderToleranceMs` (or the
+   * wider envelope configure() applies), so it stays the floor; the measured
+   * gap widens it only when the path stalls for longer than the catalog
+   * allowed for. Datagram delivery only: an ordered relay settles blocks by
+   * stream order and never feeds the estimator.
+   */
+  #multicastWaitMs(config) {
+    return this.#waitForGapMs(config, this.#deliveryGaps.peakGapMs(performance.now()));
+  }
+  /**
+   * The widest #multicastWaitMs can become: the estimator reports at most its
+   * catalog window, so this is a catalog quantity that no measurement moves.
+   */
+  #maxMulticastWaitMs(config) {
+    return this.#waitForGapMs(config, this.#deliveryGaps.windowMs ?? 0);
+  }
+  #waitForGapMs(config, gapMs) {
+    if (!(gapMs > 0) || !(config.interleaveDepthMs > 0)) return config.timeoutMs;
+    return Math.max(config.timeoutMs, Math.ceil(config.interleaveDepthMs + gapMs));
+  }
+  #repairDeadlineMs(config, waitMs = this.#multicastWaitMs(config)) {
+    const halfFailBoundMs = Math.ceil(waitMs / 2);
     if (config.k > 0 && config.interleaveDepthMs >= MIN_INTERLEAVE_DEPTH_MS && config.fps !== void 0 && Number.isFinite(config.fps) && config.fps > 0) {
       const mediaUnitMs = 1e3 / config.fps;
       const interleaveUnits = deriveFecInterleaveDepth(
@@ -11071,21 +11380,52 @@ var FECManager = class {
         mediaUnitMs
       );
       const sourceHorizonMs = Math.ceil(config.k * interleaveUnits * mediaUnitMs);
-      if (sourceHorizonMs < config.timeoutMs) return sourceHorizonMs;
+      if (sourceHorizonMs < waitMs) return sourceHorizonMs;
     }
     return halfFailBoundMs;
   }
-  /** One block lifetime: the inactivity fail bound plus the D-28 repair grace. */
+  /**
+   * One block lifetime: the inactivity fail bound plus the D-28 repair grace,
+   * at the widest wait the catalog allows (#maxMulticastWaitMs). Everything
+   * derived from it (terminal retention, the release gate's hold ceiling, the
+   * duplicate ledgers, the owed-cleanup bound) is compared across time, so it
+   * must not follow the live measurement.
+   */
   #blockLifetimeMs(config) {
-    return config.timeoutMs + this.#repairGraceMs(config);
+    const waitMs = this.#maxMulticastWaitMs(config);
+    return waitMs + this.#repairGraceMs(config, waitMs);
   }
-  #repairGraceMs(config) {
-    return Math.max(1, config.timeoutMs - this.#repairDeadlineMs(config));
+  /**
+   * The lifetime at the live wait, capped at #blockLifetimeMs: lifetime is not
+   * monotone in the wait (the repair deadline switches from half the wait to
+   * the source horizon), so the cap is what keeps it inside the retention.
+   */
+  #liveBlockLifetimeMs(config) {
+    const waitMs = this.#multicastWaitMs(config);
+    return Math.min(waitMs + this.#repairGraceMs(config, waitMs), this.#blockLifetimeMs(config));
+  }
+  #repairGraceMs(config, waitMs) {
+    return Math.max(1, waitMs - this.#repairDeadlineMs(config, waitMs));
   }
   #armBlockTimeout(sbn, packetId, catalogTrackName, delayMs) {
     const key = this.#blockKey(sbn, packetId, catalogTrackName);
-    const boundedDelayMs = Math.max(1, Math.ceil(delayMs));
-    const deadlineMs = performance.now() + boundedDelayMs;
+    const waitAtMs = performance.now() + Math.max(1, Math.ceil(delayMs));
+    const holdAtMs = this.#repairHoldUntilMs.get(key);
+    this.#blockWaitDeadlinesMs.set(key, holdAtMs === void 0 ? waitAtMs : Math.min(waitAtMs, holdAtMs));
+    this.#applyBlockDeadline(key, sbn, packetId, catalogTrackName);
+  }
+  /**
+   * Arm (or move) a block's one fail timer at the later of its multicast
+   * wait and its repair hold. Moving it later costs no timer operation: the
+   * armed timer wakes no later than the new deadline and re-arms for the
+   * remainder.
+   */
+  #applyBlockDeadline(key, sbn, packetId, catalogTrackName) {
+    const nowMs = performance.now();
+    const deadlineMs = Math.max(
+      this.#blockWaitDeadlinesMs.get(key) ?? nowMs + 1,
+      this.#repairHoldUntilMs.get(key) ?? -Infinity
+    );
     this.#activeBlockDeadlinesMs.set(key, deadlineMs);
     const armed = this.#activeBlocks.get(key);
     if (armed?.handle != null) {
@@ -11096,45 +11436,55 @@ var FECManager = class {
     const onFire = () => {
       if (this.#activeBlocks.get(key) !== timer) return;
       const currentDeadlineMs = this.#activeBlockDeadlinesMs.get(key);
-      const nowMs = performance.now();
-      if (currentDeadlineMs !== void 0 && currentDeadlineMs > nowMs) {
+      const firedAtMs = performance.now();
+      if (currentDeadlineMs !== void 0 && currentDeadlineMs > firedAtMs) {
         timer.fireAtMs = currentDeadlineMs;
-        timer.handle = setTimeout(onFire, Math.ceil(currentDeadlineMs - nowMs));
+        timer.handle = setTimeout(onFire, Math.ceil(currentDeadlineMs - firedAtMs));
         return;
       }
       this.#activeBlocks.delete(key);
       this.#activeBlockDeadlinesMs.delete(key);
+      this.#blockWaitDeadlinesMs.delete(key);
+      this.#repairHoldUntilMs.delete(key);
       this.#traceLifecycle("timeout-queued", sbn, packetId, catalogTrackName);
-      if (this.#materializedBlocks.has(key) && !this.#blockPathCounts.has(key)) {
-        this.#failBlock(sbn, packetId, catalogTrackName);
-        return;
-      }
-      const syncOwner = this.#syncDecoderBlockOwners.get(key);
-      if (syncOwner) {
-        this.#routeSyncCleanup(syncOwner, sbn, packetId);
-        this.#failBlock(sbn, packetId, catalogTrackName);
-        return;
-      }
-      const workerClient = this.#routableWorkerForPacket(packetId, catalogTrackName);
-      if (workerClient) {
-        this.#pendingWorkerCleanups.add(key);
-        this.#pendingWorkerCleanupClients.set(key, workerClient);
-        this.#boundOwedCleanup(key, packetId, workerClient);
-        workerClient.cleanup(sbn);
-      } else {
-        const decoder = this.#decoderForPacket(packetId, catalogTrackName)?.client;
-        if (decoder) {
-          this.#routeSyncCleanup(decoder, sbn, packetId);
-          this.#failBlock(sbn, packetId, catalogTrackName);
-        } else {
-          this.#failBlock(sbn, packetId, catalogTrackName);
-        }
-      }
+      this.#finalizeExpiredBlock(sbn, packetId, catalogTrackName);
     };
-    timer.handle = setTimeout(onFire, boundedDelayMs);
+    timer.handle = setTimeout(onFire, Math.max(1, Math.ceil(deadlineMs - nowMs)));
     this.#activeBlocks.set(key, timer);
     this.#indexBlockKey(key, sbn, packetId);
   }
+  /**
+   * Hand a block whose delivery is over to its decoder for finalization: the
+   * datagram deadline fired, or the ordered relay moved past it.
+   */
+  #finalizeExpiredBlock(sbn, packetId, catalogTrackName) {
+    const key = this.#blockKey(sbn, packetId, catalogTrackName);
+    if (this.#materializedBlocks.has(key) && !this.#blockPathCounts.has(key)) {
+      this.#failBlock(sbn, packetId, catalogTrackName);
+      return;
+    }
+    const syncOwner = this.#syncDecoderBlockOwners.get(key);
+    if (syncOwner) {
+      this.#routeSyncCleanup(syncOwner, sbn, packetId);
+      this.#failBlock(sbn, packetId, catalogTrackName);
+      return;
+    }
+    const workerClient = this.#routableWorkerForPacket(packetId, catalogTrackName);
+    if (workerClient) {
+      this.#pendingWorkerCleanups.add(key);
+      this.#pendingWorkerCleanupClients.set(key, workerClient);
+      this.#boundOwedCleanup(key, packetId, workerClient);
+      workerClient.cleanup(sbn);
+    } else {
+      const decoder = this.#decoderForPacket(packetId, catalogTrackName)?.client;
+      if (decoder) {
+        this.#routeSyncCleanup(decoder, sbn, packetId);
+        this.#failBlock(sbn, packetId, catalogTrackName);
+      } else {
+        this.#failBlock(sbn, packetId, catalogTrackName);
+      }
+    }
+  }
   /**
    * Upsert one packetId's track configuration. With `catalogTrackName`, the
    * classifier geometry in `config` is that stream's own and is kept per
@@ -11159,12 +11509,17 @@ var FECManager = class {
       ...(config.geometry ?? previous.geometry) === void 0 ? {} : { geometry: config.geometry ?? previous.geometry }
     };
     next.timeoutMs = this.#computeTimeout(next);
+    if (this.#multicastSymbolDelivery === "ordered-relay") {
+      this.#orderedHorizonBlocksFor(packetId, next);
+    }
     this.#trackConfigs.set(packetId, next);
+    this.#refreshDeliveryGapWindow();
     let policyChanged = config.geometry !== void 0 && JSON.stringify(config.geometry) !== JSON.stringify(previous.geometry) || config.trackKind !== void 0 && config.trackKind !== previous.trackKind;
     if (streamScopedGeometry !== void 0) {
       const streamKey = this.#streamKey(packetId, catalogTrackName);
       if (JSON.stringify(streamScopedGeometry) !== JSON.stringify(this.#streamGeometries.get(streamKey))) {
         this.#streamGeometries.set(streamKey, streamScopedGeometry);
+        this.#refreshDeliveryGapWindow();
         policyChanged = true;
       }
     }
@@ -11231,6 +11586,9 @@ var FECManager = class {
       pendingWorkerCleanups: this.#pendingWorkerCleanups.size,
       decoderUnavailableEvents: this.#decoderUnavailableEvents,
       repairTrackedBlocks: this.#blockRepairRsIds.size,
+      multicastSymbolDelivery: this.#multicastSymbolDelivery,
+      orderedFrontiers: Object.fromEntries(this.#orderedFrontiers),
+      orderedPendingBlocks: [...this.#orderedPendingBlocks.values()].reduce((total, pending) => total + pending.size, 0),
       lifecycleTrace: this.#lifecycleTrace.map((entry) => ({ ...entry }))
     };
   }
@@ -11289,6 +11647,7 @@ var FECManager = class {
   }
   /** Start a new multicast transport join without discarding track/decoder state. */
   beginMulticastJoin() {
+    this.#orderedFrontiers.clear();
     this.#startupAlignedPackets.clear();
     this.#startupPartialBlocks.clear();
     this.#startupRequireRepairReady = true;
@@ -11296,6 +11655,45 @@ var FECManager = class {
     this.#startupRepairBoundaryCounts.clear();
     this.#startupRepairFailOpenPackets.clear();
   }
+  /** How the multicast leg currently delivers symbols. */
+  get multicastSymbolDelivery() {
+    return this.#multicastSymbolDelivery;
+  }
+  /**
+   * Declare how the multicast leg delivers symbols (see
+   * MulticastSymbolDelivery). The multicast provider owns this fact:
+   * MulticastManager applies what the window.multicast subscription declares
+   * on every join, and a consumer feeding packets itself declares its own leg.
+   *
+   * Switching to 'ordered-relay' requires every configured track to define
+   * its interleave horizon and throws otherwise. Switching back to 'datagram'
+   * gives every block awaiting ordered settlement the datagram inactivity
+   * deadline from now.
+   */
+  setMulticastSymbolDelivery(delivery) {
+    if (!isMulticastSymbolDelivery(delivery)) {
+      throw new Error(
+        `[FECManager] multicast symbol delivery must be 'datagram' or 'ordered-relay', got ${String(delivery)}`
+      );
+    }
+    if (delivery === this.#multicastSymbolDelivery) return;
+    this.#deliveryGaps.reset();
+    if (delivery === "ordered-relay") {
+      for (const [packetId, config] of this.#trackConfigs) {
+        this.#orderedHorizonBlocksFor(packetId, config);
+      }
+      this.#multicastSymbolDelivery = delivery;
+      return;
+    }
+    this.#multicastSymbolDelivery = delivery;
+    const pending = [...this.#orderedPendingBlocks.values()].flatMap((blocks) => [...blocks.values()]);
+    this.#orderedPendingBlocks.clear();
+    this.#orderedFrontiers.clear();
+    for (const key of pending) {
+      const block = this.#parseBlockKey(key);
+      this.noteBlockActivity(block.sbn, block.packetId, block.catalogTrackName);
+    }
+  }
   /** Begin a fresh decode epoch for one physical stream. */
   resetTrack(packetId, catalogTrackName) {
     if (!Number.isInteger(packetId) || packetId < 0) {
@@ -11325,6 +11723,8 @@ var FECManager = class {
     resetTimerMap(this.#activeBlocks);
     resetTimerMap(this.#repairDeadlines);
     resetMap(this.#activeBlockDeadlinesMs);
+    resetMap(this.#blockWaitDeadlinesMs);
+    resetMap(this.#repairHoldUntilMs);
     resetMap(this.#repairDeadlineAtMs);
     resetMap(this.#terminalExpiryMs);
     resetMap(this.#pendingWorkerCleanupClients);
@@ -11336,9 +11736,12 @@ var FECManager = class {
     resetMap(this.#blockAuthoredLengths);
     resetMap(this.#blockRepairRsIds);
     resetMap(this.#blockPathCounts);
+    resetMap(this.#blockAnchorsMs);
     resetMap(this.#blockCatalogTrackNames);
     resetMap(this.#syncDecoderBlockOwners);
     resetMap(this.#startupRepairBoundaryCounts);
+    resetMap(this.#orderedFrontiers);
+    resetMap(this.#orderedPendingBlocks);
     resetSet(this.#pendingWorkerCleanups);
     resetSet(this.#completedBlocks);
     resetSet(this.#cleanlyCompletedBlocks);
@@ -11398,6 +11801,9 @@ var FECManager = class {
   feedSymbolFromSource(packetId, sbn, esi, _data, source, catalogTrackName) {
     const blockKey = this.#blockKey(sbn, packetId, catalogTrackName);
     const streamKey = this.#streamKey(packetId, catalogTrackName);
+    if (source === "multicast" && this.#multicastSymbolDelivery === "ordered-relay") {
+      this.#advanceOrderedFrontier(streamKey, sbn, packetId, catalogTrackName);
+    }
     const k = this.kForPacket(packetId);
     const isSourceSymbol = esi >= 0 && esi < k;
     const isStartupPartial = this.#startupPartialBlocks.has(blockKey);
@@ -11452,6 +11858,7 @@ var FECManager = class {
       moqSymbols: 0,
       complete: false
     };
+    if (!this.#blockAnchorsMs.has(blockKey)) this.#blockAnchorsMs.set(blockKey, performance.now());
     if (source === "multicast") counts.multicastSymbols++;
     else counts.moqSymbols++;
     this.#blockPathCounts.set(blockKey, counts);
@@ -11462,6 +11869,9 @@ var FECManager = class {
     if (this.#blockPathCounts.size > 512) {
       dropOldest(this.#blockPathCounts, this.#blockPathCounts.size - 256);
     }
+    if (this.#blockAnchorsMs.size > 512) {
+      dropOldest(this.#blockAnchorsMs, this.#blockAnchorsMs.size - 256);
+    }
     if (this.#blockCatalogTrackNames.size > 512) {
       for (const key of dropOldest(
         this.#blockCatalogTrackNames,
@@ -11550,9 +11960,75 @@ var FECManager = class {
   interleaveDepthMsForPacket(packetId) {
     return this.#resolveTrackConfig(packetId).interleaveDepthMs;
   }
-  /** Resolved per-track block fail bound in milliseconds. */
+  /**
+   * Record one multicast MMTP packet arrival (every packet of the leg, FEC
+   * symbol or not) for the delivery-gap measurement. `packetSequenceNumber`
+   * is the MMTP packet_sequence_number, which increments by one per packet of
+   * a packet_id: it is what separates a stall from a loss (see
+   * DeliveryGapEstimator). Datagram delivery only.
+   */
+  noteMulticastArrival(packetId, packetSequenceNumber) {
+    if (this.#multicastSymbolDelivery !== "datagram") return;
+    this.#deliveryGaps.noteArrival(performance.now(), packetId, packetSequenceNumber);
+  }
+  /**
+   * Resolved per-track multicast late-symbol wait in milliseconds: the span
+   * plus the larger of the catalog tolerance and the measured delivery gap.
+   */
   timeoutMsForPacket(packetId) {
-    return this.#resolveTrackConfig(packetId).timeoutMs;
+    return this.#multicastWaitMs(this.#resolveTrackConfig(packetId));
+  }
+  /**
+   * Largest multicast delivery gap measured over the current window (ms), and
+   * that window (undefined: held since the last reset). Diagnostics.
+   */
+  multicastDeliveryGap() {
+    return {
+      peakGapMs: this.#deliveryGaps.peakGapMs(performance.now()),
+      windowMs: this.#deliveryGaps.windowMs
+    };
+  }
+  /**
+   * Receiver-local time of a block's first accepted symbol, or undefined for
+   * a block no symbol reached (one materialized because a later SBN arrived).
+   */
+  blockAnchorAtMs(sbn, packetId, catalogTrackName) {
+    return this.#blockAnchorsMs.get(this.#blockKey(sbn, packetId, catalogTrackName));
+  }
+  /** Absolute fail deadline of a still-open block, or undefined. */
+  blockDeadlineAtMs(sbn, packetId, catalogTrackName) {
+    return this.#activeBlockDeadlinesMs.get(this.#blockKey(sbn, packetId, catalogTrackName));
+  }
+  /**
+   * Keep a block open until `untilAtMs` while a repair FETCH the scheduler
+   * admitted is in flight. Never shortens the multicast wait already armed;
+   * while set, the hold is the block's whole deadline, so no later symbol
+   * extends it. Returns false when the block is no longer open (resolved, or
+   * not yet tracked).
+   */
+  holdBlockForRepair(sbn, packetId, catalogTrackName, untilAtMs) {
+    if (!Number.isFinite(untilAtMs)) {
+      throw new Error(`[FECManager] repair hold must be a finite time (got ${untilAtMs})`);
+    }
+    const key = this.#blockKey(sbn, packetId, catalogTrackName);
+    if (!this.#activeBlocks.has(key)) return false;
+    const previous = this.#repairHoldUntilMs.get(key);
+    if (previous !== void 0 && previous >= untilAtMs) return true;
+    this.#repairHoldUntilMs.set(
+      key,
+      Math.max(untilAtMs, this.#blockWaitDeadlinesMs.get(key) ?? -Infinity)
+    );
+    this.#applyBlockDeadline(key, sbn, packetId, catalogTrackName);
+    return true;
+  }
+  /**
+   * Drop a block's repair hold: its FETCH ended without delivering. The block
+   * falls back to its multicast wait, which may already have passed.
+   */
+  releaseRepairHold(sbn, packetId, catalogTrackName) {
+    const key = this.#blockKey(sbn, packetId, catalogTrackName);
+    if (!this.#repairHoldUntilMs.delete(key) || !this.#activeBlocks.has(key)) return;
+    this.#applyBlockDeadline(key, sbn, packetId, catalogTrackName);
   }
   /** Resolved per-track D-28 repair request deadline in milliseconds. */
   repairDeadlineMsForPacket(packetId) {
@@ -11921,7 +12397,7 @@ var FECManager = class {
           return;
         }
         this.#settleOwedCleanup(key, "cleanup-ack-timeout");
-      }, Math.ceil(this.#blockLifetimeMs(this.#resolveTrackConfig(packetId))))
+      }, Math.ceil(this.#liveBlockLifetimeMs(this.#resolveTrackConfig(packetId))))
     };
     this.#pendingWorkerCleanupBounds.set(key, bound);
   }
@@ -12239,14 +12715,19 @@ var FECManager = class {
     const key = this.#blockKey(sbn, packetId, catalogTrackName);
     if (this.#completedBlocks.has(key)) return;
     if (this.#pendingWorkerCleanups.has(key)) return;
-    if (this.#repairRequestedBlocks.has(key)) return;
+    const repairRequested = this.#repairRequestedBlocks.has(key);
+    if (repairRequested && this.#settlesByOrder(key)) return;
+    if (this.#settlesByOrder(key)) {
+      this.#holdForOrderedSettlement(key, sbn, packetId, catalogTrackName);
+      return;
+    }
     const trackConfig = this.#resolveTrackConfig(packetId);
-    const timeoutMs = trackConfig.timeoutMs;
+    const timeoutMs = this.#multicastWaitMs(trackConfig);
     if (!(timeoutMs > 0)) {
       throw new Error(`[FECManager] packetId=${packetId} has no positive fail bound (timeoutMs=${timeoutMs})`);
     }
     const repairDeadline = this.#repairDeadlines.get(key);
-    if (this.onRepairNeeded && (repairDeadline === void 0 || sourceProgress)) {
+    if (this.onRepairNeeded && !repairRequested && (repairDeadline === void 0 || sourceProgress)) {
       this.#armRepairDeadline(
         key,
         sbn,
@@ -12377,6 +12858,9 @@ var FECManager = class {
     }
     this.#activeBlocks.clear();
     this.#activeBlockDeadlinesMs.clear();
+    this.#blockWaitDeadlinesMs.clear();
+    this.#repairHoldUntilMs.clear();
+    this.#deliveryGaps.reset();
     this.#pendingWorkerCleanups.clear();
     this.#pendingWorkerCleanupClients.clear();
     for (const bound of this.#pendingWorkerCleanupBounds.values()) clearTimeout(bound.handle);
@@ -12404,8 +12888,11 @@ var FECManager = class {
     this.#startupRepairReadyPackets.clear();
     this.#startupRepairBoundaryCounts.clear();
     this.#startupRepairFailOpenPackets.clear();
+    this.#orderedFrontiers.clear();
+    this.#orderedPendingBlocks.clear();
     this.#seenSymbols.clear();
     this.#blockPathCounts.clear();
+    this.#blockAnchorsMs.clear();
     this.#blockCatalogTrackNames.clear();
     this.#classifiers.clear();
     this.#streamGeometries.clear();
@@ -14798,6 +15285,7 @@ var StreamDuplicateLedgers = class {
 
 // src/mmtp-router.ts
 var KEYFRAME_LOST_TIMEOUT_SLACK = 1.5;
+var MAX_TIMER_DELAY_MS = 2147483647;
 function isRouterDebugEnabled() {
   const globalDebug = globalThis.__MMTP_ROUTER_DEBUG;
   if (globalDebug === true || globalDebug === "true" || globalDebug === "1") return true;
@@ -14967,8 +15455,10 @@ var MmtpRouter = class {
   #moqRepairOwnerCounts = {};
   #parserDiagnostics = /* @__PURE__ */ new Map();
   // ── Keyframe loss detection state ───────────────────────────────
-  /** Catalog-derived keyframe loss timeout (ms). null = not configured (throws on video track registration). */
+  /** Catalog-derived keyframe loss timeout (ms), or a reader evaluated at each arm. null = not configured (warns on video track registration; Phase-13 keyframe repair stays off). */
   #keyframeLostTimeoutMs;
+  /** Why the last reader evaluation left the timer unarmed; null while arming. Dedups the warning. */
+  #keyframeLostUnarmedReason = null;
   /** Active keyframe loss timer handle. Single timer per video track — cleared on each rapFlag and on dispose(). */
   #keyframeLostTimer = null;
   /** Monotonic counter incremented on each emitted video keyframe. Tracks current GOP position. */
@@ -15229,11 +15719,19 @@ var MmtpRouter = class {
   /**
    * Set the keyframe loss timeout after construction.
    * Must be called BEFORE setPacketIdType('video').
-   * Derive from explicit keyframe/group duration:
+   * A fixed timeout derives from explicit keyframe/group duration:
    * Math.ceil(groupDurationMs * KEYFRAME_LOST_TIMEOUT_SLACK).
+   * A timeout whose inputs are measured after configuration (e.g. keyframe
+   * cadence plus measured playout lateness) is passed as a reader, evaluated
+   * each time the timer is armed. Both forms pass the same check at each arm:
+   * a throw, or a value that is not finite, positive and within the timer
+   * maximum, leaves that keyframe unarmed (fail closed per keyframe, not per
+   * session). A fixed NaN, e.g. derived from a catalog without a group
+   * duration, therefore never reaches setTimeout.
    */
   setKeyframeLostTimeoutMs(ms) {
     this.#keyframeLostTimeoutMs = ms;
+    this.#keyframeLostUnarmedReason = null;
   }
   /** Update MFU reassembly timeout. Source and FEC-recovery paths share the
    *  parser's single reassembler (BLO-8151), so one update covers both. */
@@ -15727,16 +16225,49 @@ var MmtpRouter = class {
   // ── Private: keyframe loss detection ────────────────────────────
   /** Arm (or re-arm) the keyframe loss timer.
    *  Clears any existing timer and sets a new one for keyframeLostTimeoutMs.
-   *  On timeout, fires onKeyframeLost with the next expected groupId. */
+   *  On timeout, fires onKeyframeLost with the next expected groupId.
+   *  A reader without a valid value leaves the timer cleared and unarmed. */
   #armKeyframeLostTimer() {
     if (this.#keyframeLostTimer) {
       clearTimeout(this.#keyframeLostTimer);
+      this.#keyframeLostTimer = null;
     }
+    const timeoutMs = this.#readKeyframeLostTimeoutMs();
+    if (timeoutMs === null) return;
     const expectedNext = this.#lastKeyframeGroupId + 1;
     this.#keyframeLostTimer = setTimeout(() => {
       this.#keyframeLostTimer = null;
       this.#onKeyframeLost?.(expectedNext);
-    }, this.#keyframeLostTimeoutMs);
+    }, timeoutMs);
+  }
+  /** The configured number, or the reader's current value; null when the
+   *  reader throws or either form yields a value no timer can honour. Warns
+   *  on entering that state or when its cause changes (a different exception,
+   *  or a different class of bad value), not once per keyframe. */
+  #readKeyframeLostTimeoutMs() {
+    const timeout = this.#keyframeLostTimeoutMs;
+    let reason;
+    let detail;
+    try {
+      const ms = typeof timeout === "function" ? timeout() : timeout;
+      if (Number.isFinite(ms) && ms > 0 && ms <= MAX_TIMER_DELAY_MS) {
+        this.#keyframeLostUnarmedReason = null;
+        return ms;
+      }
+      reason = typeof ms !== "number" ? "yielded a non-number" : Number.isNaN(ms) ? "yielded NaN" : !Number.isFinite(ms) ? "yielded an infinite value" : ms <= 0 ? "yielded a non-positive value" : `exceeds the ${MAX_TIMER_DELAY_MS} ms timer maximum`;
+      detail = ms;
+    } catch (error) {
+      reason = `threw ${error instanceof Error ? `${error.name}: ${error.message}` : String(error)}`;
+      detail = error;
+    }
+    if (reason !== this.#keyframeLostUnarmedReason) {
+      this.#keyframeLostUnarmedReason = reason;
+      console.warn(
+        `[MmtpRouter] keyframeLostTimeoutMs ${reason} \u2014 keyframe loss timer not armed until it yields a finite positive value:`,
+        detail
+      );
+    }
+    return null;
   }
   #noteEmittedKeyframe(packetId, keyframe) {
     if (!keyframe) return;
@@ -15950,6 +16481,9 @@ var MmtpRouter = class {
     const parsed = this.#parser.parsePacket(packet);
     if (!parsed) return;
     const info = parsed.info;
+    if (source === "multicast" && !manifestAdmitted) {
+      this.#fecManager?.noteMulticastArrival?.(info.packetId, info.sequenceNumber);
+    }
     if (source === "multicast" && !ingressHasPacketId(ingress, info.packetId)) {
       debugRouter(
         `[MmtpRouter] Dropping multicast packet pid=${info.packetId}: absent from ingress tracks`
@@ -18901,6 +19435,8 @@ var MulticastTransport = class _MulticastTransport {
   #dataPlaneLive = false;
   #onDataPlaneLive = null;
   #errorListener = null;
+  #onDelivery = null;
+  #delivery;
   #disposed = false;
   #stats = {
     packetsReceived: 0,
@@ -18910,6 +19446,11 @@ var MulticastTransport = class _MulticastTransport {
     packetsDroppedSignaling: 0
   };
   #droppedPidCounts = /* @__PURE__ */ new Map();
+  // Accepted bytes per MMTP packet_id; see bytesReceivedForPacketIds. Each
+  // value is a mutable cell, so the per-packet update is one lookup and an
+  // in-place add: no insertion once the key exists, and no re-boxed number
+  // per packet once a count outgrows the small-integer range.
+  #acceptedBytesByPacketId = /* @__PURE__ */ new Map();
   #packetIds = null;
   #joinGeneration = 0;
   constructor(onPacket) {
@@ -18971,7 +19512,22 @@ var MulticastTransport = class _MulticastTransport {
       this.#subscription = subscription;
       this.#packetListener = packetListener;
       this.#packetIds = packetIds;
+      if (packetIds) {
+        for (const packetId of packetIds) {
+          if (!this.#acceptedBytesByPacketId.has(packetId)) {
+            this.#acceptedBytesByPacketId.set(packetId, { bytes: 0 });
+          }
+        }
+      }
       this.#resolvedTransport = subscribeConfig.origin === "amt" ? "amt" : "native";
+      const delivery = subscription.delivery ?? "datagram";
+      if (delivery !== "datagram" && delivery !== "ordered-relay") {
+        throw new Error(
+          `window.multicast subscription declared unknown delivery ${String(delivery)}`
+        );
+      }
+      this.#delivery = delivery;
+      this.#onDelivery?.(delivery);
       const onError = (event) => {
         if (this.#disposed || generation !== this.#joinGeneration) return;
         this.#failBackOnSubscriptionError(event.detail);
@@ -19005,8 +19561,6 @@ var MulticastTransport = class _MulticastTransport {
       return false;
     }
     if (!this.#acceptPacket(packet)) return false;
-    this.#stats.packetsReceived++;
-    this.#stats.bytesReceived += packet.byteLength;
     this.#onPacket(packet, context);
     return true;
   }
@@ -19052,8 +19606,6 @@ var MulticastTransport = class _MulticastTransport {
     if (this.#disposed) return;
     const packet = data instanceof Uint8Array ? data : new Uint8Array(data);
     if (!this.#acceptPacket(packet)) return;
-    this.#stats.packetsReceived++;
-    this.#stats.bytesReceived += packet.byteLength;
     this.#onPacket(packet, context);
     this.#resetWatchdog();
   }
@@ -19071,14 +19623,25 @@ var MulticastTransport = class _MulticastTransport {
   onFailback(cb) {
     this.#onFailback = cb;
   }
+  /**
+   * Called on every successful join, before the joined subscription can
+   * deliver a packet, with how that subscription delivers packets.
+   */
+  onDelivery(cb) {
+    this.#onDelivery = cb;
+  }
+  /** How the current subscription delivers packets, once joined. */
+  get delivery() {
+    return this.#delivery;
+  }
   /**
    * Fires once per join, at the first packet the join accepts (after the PID
    * filter; a rejected packet is not liveness). This is the data-plane-live
-   * edge, where this transport's silence window starts. It reports progress; it
-   * arms nothing else. In particular, a host's takeover deadline starts when
-   * the subscribe settles, not here: a join whose source never sends never
-   * reaches this edge, and that deadline is what bounds it (see
-   * SessionManager.joinActive).
+   * edge, where this transport's silence window starts. A join whose source
+   * never sends never reaches it, so a host may start a media-arrival budget
+   * here only if the provider bounds the join phase with a typed subscription
+   * error (see SessionManager.joinActive); otherwise the host starts it when
+   * the subscribe settles.
    */
   onDataPlaneLive(cb) {
     this.#onDataPlaneLive = cb;
@@ -19103,6 +19666,33 @@ var MulticastTransport = class _MulticastTransport {
   get stats() {
     return this.#stats;
   }
+  /**
+   * Accepted bytes summed over `packetIds`: the `bytesReceived` share of those
+   * MMTP packet_ids. Counted by the same rule, on every path that counts
+   * `bytesReceived` (only packets that pass the ingress filter; packet_id 0
+   * signaling never), and cumulative for the life of the transport, across
+   * rejoins, as `bytesReceived` is. An id never accepted contributes 0. An
+   * unparseable packet admitted by a join without an allow-list has no
+   * packet_id, so it counts toward `bytesReceived` only.
+   *
+   * Use it to scope an ABR throughput sample to the active tier's source and
+   * repair packet_ids when the join admits more than the active tier (a
+   * shared group joined across rendition switches); `bytesReceived` is then
+   * the whole allow-list's arrival, not the active tier's. A Set, so an id
+   * shared by two tracks of the tier is counted once.
+   *
+   * Monotonic only for a fixed set: each id has counted since it was first
+   * admitted, so after a tier switch the new set's sum is not a continuation
+   * of the old one. A cumulative consumer takes a fresh baseline for the new
+   * set and never differences across sets.
+   */
+  bytesReceivedForPacketIds(packetIds) {
+    let bytes = 0;
+    for (const packetId of packetIds) {
+      bytes += this.#acceptedBytesByPacketId.get(packetId)?.bytes ?? 0;
+    }
+    return bytes;
+  }
   /**
    * Per-PID drop breakdown, newest-capped at MAX_TRACKED_DROPPED_PIDS distinct
    * PIDs.  This is what names the offender: `packetsDroppedUnregisteredPid`
@@ -19138,12 +19728,17 @@ var MulticastTransport = class _MulticastTransport {
     this.#packetListener = null;
     this.#errorListener = null;
     this.#resolvedTransport = void 0;
+    this.#delivery = void 0;
     this.#packetIds = null;
   }
+  /** The ingress filter; an accepted packet is counted here, once. */
   #acceptPacket(packet) {
     const packetId = readMMTPPacketId(packet);
     if (packetId === null) {
-      if (!this.#packetIds) return true;
+      if (!this.#packetIds) {
+        this.#countAccepted(packet, null);
+        return true;
+      }
       this.#stats.packetsDroppedUnparseable++;
       return false;
     }
@@ -19151,10 +19746,25 @@ var MulticastTransport = class _MulticastTransport {
       this.#stats.packetsDroppedSignaling++;
       return false;
     }
-    if (!this.#packetIds || this.#packetIds.has(packetId)) return true;
+    if (!this.#packetIds || this.#packetIds.has(packetId)) {
+      this.#countAccepted(packet, packetId);
+      return true;
+    }
     this.#recordUnregisteredPidDrop(packetId);
     return false;
   }
+  /** Receive counters for one accepted packet; `packetId` is null when it has none. */
+  #countAccepted(packet, packetId) {
+    this.#stats.packetsReceived++;
+    this.#stats.bytesReceived += packet.byteLength;
+    if (packetId === null) return;
+    const counter = this.#acceptedBytesByPacketId.get(packetId);
+    if (counter !== void 0) {
+      counter.bytes += packet.byteLength;
+    } else {
+      this.#acceptedBytesByPacketId.set(packetId, { bytes: packet.byteLength });
+    }
+  }
   #recordUnregisteredPidDrop(packetId) {
     this.#stats.packetsDroppedUnregisteredPid++;
     const seen = this.#droppedPidCounts.get(packetId);
@@ -19240,6 +19850,7 @@ function newBlockPolicyStats(packetId, catalogTrackName, epoch) {
     deltaBlocksRecoveredQuic: 0,
     deltaRepairsPreempted: 0,
     deltaRepairsDeferred: 0,
+    repairsSkipped: 0,
     deltaBlocksFailed: 0,
     audioBlocksRecoveredInband: 0,
     audioBlocksRecoveredQuic: 0,
@@ -19630,6 +20241,9 @@ var MulticastManager = class {
     this.#transport = new MulticastTransport((packet, ingress) => {
       this.#router.feedPacket(packet, "multicast", void 0, ingress);
     });
+    this.#transport.onDelivery((delivery) => {
+      this.#fec.setMulticastSymbolDelivery(delivery);
+    });
     this.#fec.onBlockRecovered = (sbn, packetId, data, meta, recoveredTrackName) => {
       const recovered = new Uint8Array(data);
       const catalogTrackName = recoveredTrackName ?? this.#fec.catalogTrackNameForBlock(sbn, packetId);
@@ -19736,6 +20350,16 @@ var MulticastManager = class {
   get stats() {
     return this.#transport.stats;
   }
+  /**
+   * Accepted bytes for these MMTP packet_ids, cumulative like
+   * `stats.bytesReceived`; see MulticastTransport.bytesReceivedForPacketIds.
+   * Scopes an ABR throughput sample to the active tier when the join admits
+   * more packet_ids than that tier's. Monotonic only while the set is fixed:
+   * re-baseline when the queried set changes (e.g. on a tier switch).
+   */
+  bytesReceivedForPacketIds(packetIds) {
+    return this.#transport.bytesReceivedForPacketIds(packetIds);
+  }
   get fecStats() {
     return this.#fec.fecStats;
   }
@@ -20011,7 +20635,8 @@ var MulticastManager = class {
    * Applies only to tracks WITHOUT FEC: an FEC track never arms the timer,
    * because its vanished blocks resolve through catalog-derived block
    * deadlines and the release gate's stall decision.
-   * Must be called BEFORE setPacketIdType('video').
+   * Must be called BEFORE setPacketIdType('video'). A reader is passed
+   * through; see MmtpRouter.setKeyframeLostTimeoutMs.
    */
   setKeyframeLostTimeoutMs(ms) {
     this.#router.setKeyframeLostTimeoutMs(ms);
@@ -20115,6 +20740,14 @@ var MulticastManager = class {
       groupAddress: config.groupAddress,
       port: config.port,
       mode: config.mode,
+      // Precedence between two sources, not a tolerant alias: `amtRelay*` is
+      // the player/UI override and `relay*` is the catalog endpoint's relay
+      // (REQUIRED for `protocol: "amt"`; see multicast-input.ts). The override
+      // wins, else the catalog value. This is the only inlet for the
+      // endpoint-level catalog relay (`relayAddress` / `relayPort`); a catalog
+      // `multicast.networkSource` AMT entry reaches the transport separately,
+      // through `findAmtRelay`. Retiring `relayAddress` therefore belongs to
+      // the coordinated `networkSource` migration.
       amtRelay: config.amtRelay ?? config.relayAddress,
       amtRelayPort: config.amtRelayPort ?? config.relayPort,
       packetIds: config.packetIds,
@@ -20133,6 +20766,14 @@ var MulticastManager = class {
   feedPacket(data, ingress) {
     this.#transport.feedPacket(data, ingress);
   }
+  /**
+   * Declare how packets given to feedPacket() reach this manager. A consumer
+   * that owns the multicast socket itself declares its own leg; join()
+   * applies what the window.multicast subscription declares instead.
+   */
+  setMulticastSymbolDelivery(delivery) {
+    this.#fec.setMulticastSymbolDelivery(delivery);
+  }
   /** Process a repair packet from MoQ (reliable QUIC). */
   processRepairFromMoQ(packet, ownerPacketId, catalogTrackName) {
     this.#router.feedRepairPacket(packet, ownerPacketId, catalogTrackName);
@@ -20349,6 +20990,18 @@ var MulticastManager = class {
       reason
     });
   }
+  /** Record a repair request the scheduler sent no FETCH for. */
+  noteRepairSkipped(reason, measurement, sbn, packetId, catalogTrackName) {
+    this.#statsFor(packetId, catalogTrackName).repairsSkipped++;
+    this.#emitRepairLifecycle({
+      version: 2,
+      type: "repair-skipped",
+      block: repairBlockIdentity(packetId, sbn, catalogTrackName),
+      reason,
+      rttMs: measurement.rttMs,
+      budgetMs: measurement.budgetMs
+    });
+  }
   /**
    * Record a repair-scheduler decision about a delta block: preempted for
    * keyframe/audio work, or never dispatched before its block resolved.
@@ -20622,7 +21275,7 @@ var MediaRouter = class {
   // ── Keyframe repair state ────────────────────────────────────────
   /** Groups currently being repaired — idempotent guard per Pitfall 2 (T-13-01 mitigation) */
   #repairInFlight = /* @__PURE__ */ new Set();
-  /** Max concurrent repairs — prevents relay SUBSCRIBE flood (T-13-01 mitigation) */
+  /** Max concurrent repairs — prevents relay SUBSCRIBE flood (T-13-01 mitigation). A reader is evaluated per decision. */
   #maxRepairInFlight;
   /** Callback to request MoQ subscribe for a specific group (wired by player) */
   #onRepairRequest = null;
@@ -20668,7 +21321,7 @@ var MediaRouter = class {
     this.#crossfadeFrames = options?.crossfadeFrames ?? DEFAULT_CROSSFADE_FRAMES;
     this.#maxOverlayBuffer = options?.maxOverlayBuffer ?? DEFAULT_MAX_OVERLAY_BUFFER;
     const maxRepairInFlight = options?.maxRepairInFlight;
-    if (maxRepairInFlight !== void 0 && (!Number.isSafeInteger(maxRepairInFlight) || maxRepairInFlight < 1)) {
+    if (maxRepairInFlight !== void 0 && typeof maxRepairInFlight !== "function" && (!Number.isSafeInteger(maxRepairInFlight) || maxRepairInFlight < 1)) {
       throw new Error(
         `[MediaRouter] maxRepairInFlight=${maxRepairInFlight} must be a positive integer`
       );
@@ -20704,6 +21357,8 @@ var MediaRouter = class {
   /**
    * Request repair for a lost keyframe group. Only fires when activeSource is 'multicast'.
    * Idempotent per groupId — duplicate calls for the same group are suppressed.
+   * A reader `maxRepairInFlight` is evaluated here; without a valid value the
+   * group is skipped and a later call reads it again.
    * @param expectedGroupId - The group ID expected but not received
    * @param trackName - Track name for the SUBSCRIBE (e.g. 'video'). Default: 'video'.
    */
@@ -20711,9 +21366,25 @@ var MediaRouter = class {
     if (this.#active !== "multicast") return;
     if (this.#maxRepairInFlight === null) return;
     if (this.#repairInFlight.has(expectedGroupId)) return;
-    if (this.#repairInFlight.size >= this.#maxRepairInFlight) {
+    let maxRepairInFlight;
+    try {
+      maxRepairInFlight = typeof this.#maxRepairInFlight === "function" ? this.#maxRepairInFlight() : this.#maxRepairInFlight;
+    } catch (error) {
+      console.warn(
+        `[MediaRouter] maxRepairInFlight unmeasured, skipping repair for group ${expectedGroupId}:`,
+        error
+      );
+      return;
+    }
+    if (!Number.isSafeInteger(maxRepairInFlight) || maxRepairInFlight < 1) {
+      console.warn(
+        `[MediaRouter] maxRepairInFlight=${maxRepairInFlight} is not a positive integer, skipping repair for group ${expectedGroupId}`
+      );
+      return;
+    }
+    if (this.#repairInFlight.size >= maxRepairInFlight) {
       console.warn(
-        `[MediaRouter] max repair in flight (${this.#maxRepairInFlight}), dropping repair for group ${expectedGroupId}`
+        `[MediaRouter] max repair in flight (${maxRepairInFlight}), dropping repair for group ${expectedGroupId}`
       );
       return;
     }
@@ -22193,8 +22864,7 @@ function recordOf(value) {
 function msfTracks(catalog) {
   const raw = catalog.tracks;
   if (!Array.isArray(raw)) return void 0;
-  const common = recordOf(catalog.commonTrackFields) ?? {};
-  return { tracks: raw.map((t) => recordOf(t) ?? {}), common };
+  return { tracks: raw.map((t) => recordOf(t) ?? {}) };
 }
 function resolveRepairLayers(catalog, source) {
   if (!catalog) return void 0;
@@ -22250,7 +22920,7 @@ function resolveRepairLayers(catalog, source) {
   if (!msf || msfIndex < 0) return void 0;
   const track = msf.tracks[msfIndex];
   const fec = recordOf(track["fec"]);
-  const packagingOf = (t) => t["packaging"] ?? msf.common["packaging"];
+  const packagingOf = (t) => t["packaging"];
   const fecOfTrack = (t) => {
     const trackFec = recordOf(t?.["fec"]);
     return trackFec !== void 0 && trackFec["algorithm"] !== "none" ? trackFec : void 0;
@@ -22296,7 +22966,7 @@ function catalogRepairTarget(catalog, source) {
   const sourceName = typeof source === "string" ? source : source.name;
   const msf = msfTracks(catalog);
   const entry = msf?.tracks.find((t) => t["name"] === sourceName);
-  const sourcePriority = entry === void 0 ? null : moqtPriority2(entry["priority"] ?? msf.common["priority"]);
+  const sourcePriority = entry === void 0 ? null : moqtPriority2(entry["priority"]);
   return { repairTrack: layerZero.repairTrackName, sourcePriority, repairPriority: layerZero.priority };
 }
 function geometryOf(name, path, fec) {
@@ -22430,6 +23100,12 @@ function wireRepairFetch(mc, opts) {
       `[RepairFetch] attemptLimit=${String(opts.attemptLimit)} must be a positive integer`
     );
   }
+  if (typeof opts.reliableRttMs !== "function") {
+    throw new Error("[RepairFetch] reliableRttMs is required: repair admission needs the measured reliable-path RTT");
+  }
+  if (typeof opts.presentationDelayMs !== "function") {
+    throw new Error("[RepairFetch] presentationDelayMs is required: a repair FETCH is due by the block's presentation deadline");
+  }
   const entries = /* @__PURE__ */ new Map();
   const warnedNoTarget = /* @__PURE__ */ new Set();
   let disposed = false;
@@ -22443,12 +23119,41 @@ function wireRepairFetch(mc, opts) {
   const note = (type, entry) => {
     mc.noteRepairScheduling(type, entry.sbn, entry.packetId, entry.catalogTrackName);
   };
+  const releaseHold = (entry) => {
+    if (entry.catalogTrackName === void 0) mc.fecManager.releaseRepairHold(entry.sbn, entry.packetId);
+    else mc.fecManager.releaseRepairHold(entry.sbn, entry.packetId, entry.catalogTrackName);
+  };
   const stop = (entry, reason) => {
     const run = entry.running;
     if (!run) return;
     entry.running = null;
     run.stopped = reason;
     run.controller.abort();
+    if (reason === "preempted") releaseHold(entry);
+  };
+  const readRtt = () => {
+    try {
+      const rtt = opts.reliableRttMs();
+      return Number.isFinite(rtt) && rtt > 0 ? rtt : null;
+    } catch {
+      return null;
+    }
+  };
+  const admit = (entry, now) => {
+    const budgetMs = entry.deadlineAt - now;
+    const rttMs = readRtt();
+    if (rttMs !== null && rttMs < budgetMs) return true;
+    retire(entry);
+    releaseHold(entry);
+    clearRepair(entry.sbn, entry.packetId, entry.catalogTrackName);
+    mc.noteRepairSkipped(
+      rttMs === null ? "rtt-unmeasured" : "rtt-exceeds-budget",
+      { rttMs, budgetMs },
+      entry.sbn,
+      entry.packetId,
+      entry.catalogTrackName
+    );
+    return false;
   };
   const retire = (entry) => {
     if (entries.get(entry.key) === entry) entries.delete(entry.key);
@@ -22480,9 +23185,16 @@ function wireRepairFetch(mc, opts) {
     return derived.kind === "omit" ? { subscriberPriority: void 0 } : null;
   };
   const start = (entry, counted = true) => {
+    if (!admit(entry, performance.now())) return;
     if (counted) entry.attempts++;
     const run = { controller: new AbortController(), stopped: null };
     entry.running = run;
+    mc.fecManager.holdBlockForRepair(
+      entry.sbn,
+      entry.packetId,
+      entry.catalogTrackName,
+      entry.deadlineAt
+    );
     void execute(entry, run);
   };
   const dispatch = () => {
@@ -22519,7 +23231,10 @@ function wireRepairFetch(mc, opts) {
     entry.running = null;
     if (error === void 0) {
       retire(entry);
-      if (fed === 0) clearRepair(entry.sbn, entry.packetId, entry.catalogTrackName);
+      if (fed === 0) {
+        releaseHold(entry);
+        clearRepair(entry.sbn, entry.packetId, entry.catalogTrackName);
+      }
       dispatch();
       return;
     }
@@ -22529,6 +23244,7 @@ function wireRepairFetch(mc, opts) {
       return;
     }
     retire(entry);
+    if (fed === 0) releaseHold(entry);
     clearRepair(entry.sbn, entry.packetId, entry.catalogTrackName);
     console.warn(
       `[RepairFetch] fetch failed pid=${entry.packetId} sbn=${entry.sbn} track=${entry.repairTrack}:`,
@@ -22599,6 +23315,20 @@ function wireRepairFetch(mc, opts) {
     else if (entry.priority === 2 && entry.attempts === 0) note("repair-deferred", entry);
     dispatch();
   });
+  const presentationDeadlineAt = (sbn, packetId, catalogTrackName, now) => {
+    const waitDeadlineAt = now + mc.fecManager.repairFetchTimeoutMsForBlock(sbn, packetId, catalogTrackName);
+    const anchor = mc.fecManager.blockAnchorAtMs(sbn, packetId, catalogTrackName);
+    if (anchor === void 0) return waitDeadlineAt;
+    let delayMs;
+    try {
+      delayMs = opts.presentationDelayMs(packetId, catalogTrackName);
+    } catch {
+      return null;
+    }
+    if (!(Number.isFinite(delayMs) && delayMs > 0)) return null;
+    const ceilingAt = anchor + mc.fecManager.terminalRetentionMsForPacket(packetId);
+    return Math.max(waitDeadlineAt, Math.min(anchor + delayMs, ceilingAt));
+  };
   mc.onRepairSubscribe((sbn, packetId, catalogTrackName, blockClass) => {
     if (disposed) {
       clearRepair(sbn, packetId, catalogTrackName);
@@ -22633,14 +23363,26 @@ function wireRepairFetch(mc, opts) {
       clearRepair(sbn, packetId, catalogTrackName);
       return;
     }
-    const budgetMs = mc.fecManager.repairFetchTimeoutMsForBlock(sbn, packetId, catalogTrackName);
+    const now = performance.now();
+    const deadlineAt = presentationDeadlineAt(sbn, packetId, catalogTrackName, now);
+    if (deadlineAt === null) {
+      clearRepair(sbn, packetId, catalogTrackName);
+      mc.noteRepairSkipped(
+        "presentation-delay-unavailable",
+        { rttMs: readRtt(), budgetMs: 0 },
+        sbn,
+        packetId,
+        catalogTrackName
+      );
+      return;
+    }
     const entry = {
       key,
       ...identity,
       repairTrack: target.repairTrack,
       priority: repairPriorityForClass(blockClass),
       subscriberPriority: wire.subscriberPriority,
-      deadlineAt: performance.now() + budgetMs,
+      deadlineAt,
       order: enqueueOrder++,
       attempts: 0,
       running: null
@@ -22655,6 +23397,7 @@ function wireRepairFetch(mc, opts) {
     removeLifecycleObserver();
     for (const entry of [...entries.values()]) {
       clearRepair(entry.sbn, entry.packetId, entry.catalogTrackName);
+      if (entry.running) releaseHold(entry);
       stop(entry, "disposed");
     }
     entries.clear();
@@ -22670,6 +23413,7 @@ export {
   CmcdProducer,
   CmsfCatalogValidationError,
   DEFAULT_REPAIR_PRIORITY,
+  DeliveryGapEstimator,
   FECManager,
   FEC_ESI_MAX,
   FEC_SBN_MAX,