@blockcast/mmt-container 0.1.0 → 0.3.0

package/src/fec-manager.ts

@@ -0,0 +1,4298 @@
+/**
+ * FEC Manager — codec-agnostic FEC decode service.
+ *
+ * Receives (packetId, sbn, esi, symbolData) tuples from any transport
+ * (MMTP, LOC, etc.) and manages FEC block lifecycle: source counting,
+ * WASM RaptorQ decode, block timeout, and recovery/failure notification.
+ *
+ * Extracted from MulticastManager to decouple FEC block logic from
+ * MMTP packet parsing and frame routing.
+ */
+
+import { computeFecDeliveryWindowMs } from './track-session.js'
+import { DeliveryGapEstimator } from './delivery-gap.js'
+import {
+  deriveFecInterleaveDepth,
+  deriveFecRetentionBlocks,
+  tryDeriveFecRetentionBlocks,
+} from '@blockcast/mmt-fec'
+import {
+  isKStrideBlock,
+  isoBlockContains,
+  isoBlocksBehindLowerBound,
+  kStrideBlockPrecedes,
+  kStrideBlocksBehind,
+  kStrideNextBlock,
+  parseFecBlockProfile,
+  serial32Distance,
+  serial32Precedes,
+  ssbg1FitsSymbol,
+  type FecBlockProfile,
+} from '@blockcast/mmt-base'
+import { IsoBlockLocator, type IsoRepairPlacement } from './iso-block-locator.js'
+import { MIN_INTERLEAVE_DEPTH_MS } from './fec-state.js'
+import {
+  BlockClassifier,
+  type BlockClass,
+  type BlockClassifierGeometry,
+  type ClassifierChange,
+  type ClassifierMode,
+  type ClassifierReason,
+  type ReclassificationEvidence,
+  type SourceSymbolEvidence,
+  type TrackKind,
+} from './block-policy.js'
+
+import type { MmtpDeliveryProvenance } from './mfu-reassembler.js'
+import type {
+  FecWorkerClient,
+  FecTrackStats,
+  FecBlockSnapshot,
+  FrameMeta,
+  FecWorkerErrorCode,
+} from '@blockcast/fec-worker'
+
+// ---------------------------------------------------------------------------
+// Constants
+// ---------------------------------------------------------------------------
+
+// MIN_INTERLEAVE_DEPTH_MS lives with the catalog FEC predicate that also
+// needs it (fec-state.ts); re-exported here for existing importers.
+export { MIN_INTERLEAVE_DEPTH_MS }
+const WORKER_ERROR_LOG_CAP = 5
+const WORKER_ERROR_KIND_CAP = 32
+const WORKER_ERROR_OVERFLOW_KIND = 'other'
+const STARTUP_REPAIR_WAIT_SOURCE_BOUNDARIES = 2
+
+// ---------------------------------------------------------------------------
+// Types
+// ---------------------------------------------------------------------------
+
+/**
+ * Algorithm-agnostic FEC decoder backend interface.
+ *
+ * Implementations:
+ *   - RaptorQ WASM (mmt_wasm.js) — RFC 6330
+ *   - Reed-Solomon WASM — future
+ *   - XOR — future
+ *
+ * Source/repair symbol IDs follow ISO 23008-1 §C.5.2/C.5.3:
+ *   source: SS_ID (flat 32-bit symbol identifier)
+ *   repair: SS_Start + SSB_length + RS_ID (block-scoped repair coords)
+ */
+export type WasmFecDecoder = {
+  add_source(ss_id: number, data: Uint8Array, ts: number): Uint8Array | null
+  add_repair(ss_start: number, ssb_length: number, rs_id: number, data: Uint8Array, ts: number): Uint8Array | null
+  configure(oti: Uint8Array): void
+  cleanup(current_time: number): Uint8Array
+  /** Retire the named blocks from the decoder (last-chance decode + stats). */
+  cleanup_blocks_detailed(sbns: Uint32Array): unknown
+  /**
+   * iso-ssbg1-v1 only: retire the source symbols the decoder holds before a
+   * repair states their block, once no repair can place them any more, by the
+   * decoder's own horizon behind `current`, the newest SS_ID seen. Retires no
+   * block: the manager retires blocks itself, by their deadlines. Returns how
+   * many it retired. The manager calls it after every feed that grows the
+   * decoder and on block retirement. (`MmtFecDecoder.retire_unplaced`; the
+   * worker path uses `cleanup_by_ss_start`, which applies the same rule.)
+   */
+  retire_unplaced(current: number): number
+  flush?(): void
+  reset_stats?(): void
+}
+
+/** Algorithm-agnostic FEC stats snapshot. */
+export interface FecStats {
+  sourcePackets: number
+  repairPackets: number
+  duplicateSymbols: number
+  blocksClean: number
+  blocksRecovered: number
+  blocksFailed: number
+  blocksComplete: number
+  mixedPathBlocks: number
+  recentBlockPathCounts: FecBlockPathCount[]
+  k: number
+  /** Of blocks with loss, what percentage were recovered (0-100). */
+  recoveryRate: number
+  /** What percentage of blocks had any loss (0-100). */
+  packetLossRate: number
+  /** Per-MMTP-packet-ID counters for the synchronous WASM decoder path. */
+  tracks: FecPacketStats[]
+  /** Latest Worker/WASM snapshot for each packet ID. */
+  workers: Array<FecTrackStats & { packetId: number }>
+  /** Main-thread repair symbols rejected before dispatch because their size did not match T. */
+  repairSymbolSizeMismatches: number
+  /** Bounded Worker error counts keyed by stable code, or message text for legacy errors. */
+  workerErrors: Record<string, number>
+}
+
+export interface FecPacketStats {
+  packetId: number
+  sourcePackets: number
+  repairPackets: number
+  duplicateSymbols: number
+  blocksClean: number
+  blocksRecovered: number
+  blocksFailed: number
+  blocksComplete: number
+  k: number
+  recoveryRate: number
+  packetLossRate: number
+}
+
+export type FecSymbolSource = 'multicast' | 'moq'
+
+/**
+ * One iso-ssbg1-v1 first-arrival source symbol MmtpRouter holds until a repair
+ * symbol states its block: the exact protected packet (no SS_ID, unpadded),
+ * the transport that delivered it and its classification evidence.
+ */
+export interface IsoHeldSource {
+  readonly symbolData: Uint8Array
+  readonly source: FecSymbolSource
+  readonly evidence: SourceSymbolEvidence
+  /** Larger than one ssbg_mode1 symbol: counted, never decoded. */
+  readonly oversized: boolean
+}
+
+/**
+ * How the multicast leg hands its symbols to this manager.
+ *
+ * - `'datagram'`: every symbol is an independent datagram from the receiving
+ *   socket. A pause in arrivals is the only loss signal the receiver has, so a
+ *   block that stays idle past the catalog-derived inactivity deadline fails.
+ * - `'ordered-relay'`: the provider relays one receiving socket over a
+ *   reliable, ordered stream (the BCDS bridge's WebTransport uni stream). The
+ *   delivered sequence is a subsequence of the socket's receive order, so a
+ *   pause carries no loss information at all: the relay's own scheduling
+ *   decides when bytes arrive. What does carry it is order. Once the stream
+ *   has advanced more than the decoder's interleave horizon past a block, no
+ *   symbol of that block can still be in flight, and the block's fate follows
+ *   from the symbols it holds (in-band SS_ID/SS_Start and SSB_length), not
+ *   from a wall clock tuned for raw datagrams.
+ *
+ * Only the provider can know which of the two it is delivering; an undeclared
+ * provider promises no ordering and keeps datagram semantics.
+ */
+export type MulticastSymbolDelivery = 'datagram' | 'ordered-relay'
+
+function isMulticastSymbolDelivery(value: unknown): value is MulticastSymbolDelivery {
+  return value === 'datagram' || value === 'ordered-relay'
+}
+
+export interface FecBlockPathCount {
+  packetId: number
+  sbn: number
+  catalogTrackName?: string
+  multicastSymbols: number
+  moqSymbols: number
+  complete: boolean
+}
+
+type FecLifecycleTrace = {
+  atMs: number
+  event:
+    | 'repair-requested'
+    | 'repair-arrived'
+    | 'timeout-queued'
+    | 'horizon-settled'
+    | 'cleanup-ack'
+    | 'cleanup-ack-timeout'
+    | 'recovered'
+    | 'failed'
+    | 'decoder-unavailable'
+  packetId: number
+  sbn: number
+  catalogTrackName?: string
+  sourceCount: number
+  sourceEsis: number[]
+  repairRsIds: number[]
+  decoderPath: 'worker' | 'sync' | 'none'
+  deadlineRemainingMs?: number
+  pendingCleanup: boolean
+  rsId?: number
+}
+
+export interface FECManagerConfig {
+  /**
+   * The catalog `fec.blockProfile` of the track (BLO-35597). Required for every
+   * configured track: there is no default, and nothing infers it.
+   * `k-padded-v1` keeps the legacy K-stride geometry; `iso-ssbg1-v1` is
+   * ISO/IEC 23008-1 ssbg_mode1 with K' = SSB_length blocks located by
+   * `(SS_Start, SSB_length)` range membership, `k` being only their maximum.
+   */
+  blockProfile?: FecBlockProfile
+  k?: number
+  /** Symbol size in bytes (T). NOT repair count. */
+  symbolSize?: number
+  interleaveDepthMs?: number
+  fps?: number
+  /** Guarded block inactivity deadline derived from the full delivery geometry. */
+  timeoutMs?: number
+  /** Media kind of the track (block class `audio` vs video classification). */
+  trackKind?: TrackKind
+  /** Catalog codec string. */
+  codec?: string
+  /**
+   * Block classifier geometry derived from raw catalog timing
+   * (`deriveBlockClassifierGeometry`). Absent geometry classifies every video
+   * block `unknown` (fail-closed: protected).
+   */
+  geometry?: BlockClassifierGeometry
+}
+
+interface ResolvedFECTrackConfig {
+  blockProfile?: FecBlockProfile
+  k: number
+  symbolSize: number
+  interleaveDepthMs: number
+  timeoutMs: number
+  fps?: number
+  trackKind?: TrackKind
+  codec?: string
+  geometry?: BlockClassifierGeometry
+}
+
+/** Which symbol path completed a short block. */
+export type RepairVia = 'inband' | 'quic'
+
+/** Lifecycle resolution of one FEC block, for in-order frame release. */
+export type FecBlockResolution = 'pending' | 'complete' | 'failed' | 'untracked'
+
+interface MutableFecCounters {
+  sourcePackets: number
+  repairPackets: number
+  duplicateSymbols: number
+  blocksClean: number
+  blocksRecovered: number
+  blocksFailed: number
+}
+
+function newFecCounters(): MutableFecCounters {
+  return {
+    sourcePackets: 0,
+    repairPackets: 0,
+    duplicateSymbols: 0,
+    blocksClean: 0,
+    blocksRecovered: 0,
+    blocksFailed: 0,
+  }
+}
+
+/**
+ * The one timer armed for a block deadline (BLO-36599).
+ *
+ * Symbols move a block's deadline later many times per block. Re-arming a
+ * browser timer for each of them cost ~41 us per clear+set pair on a Kirin 659,
+ * so the deadline itself is stored as a performance.now() timestamp and this
+ * timer only guarantees a wake-up no later than it. When the timer fires it
+ * re-checks the stored deadline and re-arms for the remainder if activity
+ * moved it. `fireAtMs` is what the armed timer was scheduled for; `handle` is
+ * null once it fired without re-arming.
+ */
+interface DeadlineTimer {
+  handle: ReturnType<typeof setTimeout> | null
+  fireAtMs: number
+}
+
+/**
+ * Delete the `count` oldest (first-inserted) keys of `collection` in place
+ * and return them.
+ */
+function dropOldest(
+  collection: Set<string> | Map<string, unknown>,
+  count: number,
+): string[] {
+  const dropped: string[] = []
+  for (const key of collection.keys()) {
+    if (dropped.length >= count) break
+    dropped.push(key)
+  }
+  for (const key of dropped) collection.delete(key)
+  return dropped
+}
+
+/** A block key whose terminal state expires at `expiresAtMs`. */
+interface TerminalRecord {
+  readonly key: string
+  readonly expiresAtMs: number
+}
+
+/** FIFO of terminal records in the order blocks became terminal. */
+class TerminalQueue {
+  #records: TerminalRecord[] = []
+  #head = 0
+
+  push(record: TerminalRecord): void {
+    this.#records.push(record)
+  }
+
+  peek(): TerminalRecord | undefined {
+    return this.#records[this.#head]
+  }
+
+  shift(): void {
+    this.#head++
+    // Compact once the consumed prefix outweighs the live tail, so the array
+    // never holds more than twice the records still in the window.
+    if (this.#head * 2 >= this.#records.length) {
+      this.#records = this.#records.slice(this.#head)
+      this.#head = 0
+    }
+  }
+}
+
+// ---------------------------------------------------------------------------
+// FECManager
+// ---------------------------------------------------------------------------
+
+/** Why a stream's Worker decoder stopped being routable. */
+export type FecDecoderUnavailableReason = 'cleared' | 'disposed'
+
+/**
+ * What still decodes a stream after its Worker left routing: the synchronous
+ * WASM decoder registered for the same stream (the Worker path took precedence
+ * over it while both were live), or nothing.
+ */
+export type FecFallbackDecoder = 'sync' | 'none'
+
+export interface FecDecoderUnavailableEvent {
+  readonly packetId: number
+  readonly catalogTrackName?: string
+  readonly reason: FecDecoderUnavailableReason
+  /**
+   * What decodes the stream at the moment the Worker left. A synchronous
+   * decoder discarded later (a resetTrack flush failure drops it without an
+   * event) is not reported here; a consumer that keeps a stream alive on
+   * 'sync' owns that decoder's lifecycle itself.
+   */
+  readonly fallbackDecoder: FecFallbackDecoder
+}
+
+export class FECManager {
+  // Per-track WASM RaptorQ decoders, keyed by physical stream identity.
+  #fecDecoders = new Map<string, { client: WasmFecDecoder; k: number }>()
+  /** @deprecated Use setFecDecoder(packetId, ...). Backwards-compat shim. */
+
+  // Per-track Worker-backed FEC decoders, keyed by physical stream identity.
+  // Worker-backed tracks use async decode — recovered frames arrive via onFrame callback,
+  // not synchronous return from feedSourceSymbol/feedRepairSymbol.
+  #workerClients = new Map<string, FecWorkerClient>()
+  // Worker clients whose streams releasePacket ended. A Worker posts
+  // asynchronously, so a message it sent before its reset can still arrive;
+  // the stream it describes is gone, and letting it in would rebuild state
+  // (block ledgers, statistics, lifecycle events) for a retired packet ID.
+  #releasedWorkerClients = new WeakSet<FecWorkerClient>()
+  // Worker setup can finish while an interleaved block is already collecting
+  // on the sync decoder. Keep that block on its original decoder so later
+  // source/repair symbols do not split across two RaptorQ states.
+  #syncDecoderBlockOwners = new Map<string, WasmFecDecoder>()
+  #decoderBlockOwners = new WeakMap<object, Map<number, {
+    catalogTrackName?: string
+    conflicted: boolean
+  }>>()
+
+  #fecK = 4
+  #fecSymbolSize = 0
+  #fecTimeoutMs = 500 // default 500ms; refined by setFramerate() when fps known
+  #trackConfigs = new Map<number, ResolvedFECTrackConfig>()
+  #fecStats = newFecCounters()
+  #fecTrackStats = new Map<number, MutableFecCounters>()
+  #fecWorkerStats = new Map<number, FecTrackStats>()
+  #fecStatsObservers = new Set<(packetId: number, stats: FecTrackStats) => void>()
+
+  // Block inactivity tracking: (packetId, SBN) -> the one armed timer. The
+  // deadline is derived from catalog geometry and refreshed on progress; only
+  // an idle block fails. #activeBlockDeadlinesMs is the authoritative
+  // deadline; the timer re-checks it when it fires (see DeadlineTimer).
+  #activeBlocks = new Map<string, DeadlineTimer>()
+  #activeBlockDeadlinesMs = new Map<string, number>()
+  // The two terms #activeBlockDeadlinesMs is the later of (BLO-35597):
+  // - the multicast late-symbol wait, refreshed by every accepted symbol;
+  // - a D-28 repair hold, set by the repair scheduler only while a repair
+  //   FETCH it admitted can still land before the block's presentation
+  //   deadline. The multicast span elapsing never ends a fetch the scheduler
+  //   judged able to arrive in time.
+  #blockWaitDeadlinesMs = new Map<string, number>()
+  #repairHoldUntilMs = new Map<string, number>()
+  // Receiver-measured multicast delivery gap: the late-symbol wait's jitter
+  // term (see DeliveryGapEstimator for the statistic and why).
+  #deliveryGaps = new DeliveryGapEstimator()
+  #lifecycleTrace: FecLifecycleTrace[] = []
+  // Worker-backed timeouts enqueue cleanup behind all prior symbol messages.
+  // Failure remains pending until cleanupComplete acknowledges that queue drain.
+  #pendingWorkerCleanups = new Set<string>()
+  #pendingWorkerCleanupClients = new Map<string, FecWorkerClient>()
+  // One bound per owed cleanup: the acknowledgement is awaited for at most one
+  // catalog-derived block lifetime (fail bound plus repair grace).
+  // A Worker that hangs or drops one message must not leave the block
+  // 'pending' forever, which would park every later frame of its stream in
+  // the in-order release gate. Each entry owns its handle; the callback
+  // checks it still owns the key, so a settled or reset key is never touched.
+  #pendingWorkerCleanupBounds = new Map<string, { handle: ReturnType<typeof setTimeout> }>()
+  // Source symbol count per track-scoped block — marks complete when K symbols arrive.
+  #blockSourceCounts = new Map<string, number>()
+  #blockSourceEsis = new Map<string, Set<number>>()
+  // Authored SSB_length per block (ISO/IEC 23008-1 §C.5.3), learned from the
+  // first repair symbol. The FFmpeg moq_mmt publisher closes a block every D
+  // media units, usually before it holds K symbols, and fec-raptorq
+  // force_complete() encodes it as a K-symbol RaptorQ block whose ESIs
+  // SSB_length..K-1 are zero padding that is never sent. Such a block is clean
+  // at SSB_length source arrivals and recoverable from SSB_length received
+  // symbols; waiting for K fails every one of them.
+  #blockAuthoredLengths = new Map<string, number>()
+  #ssbLengthConflictCount = 0
+  #blockRepairRsIds = new Map<string, Set<number>>()
+  // Blocks already recovered — prevents late source symbols from restarting timeouts.
+  // WASM removes blocks after recovery; late symbols create empty blocks returning null,
+  // which would falsely start new timeouts without this guard.
+  //
+  // Every insertion goes through #markTerminal, which retires the key once its
+  // catalog-derived retention window (terminalRetentionMsForPacket) passes. The
+  // previous bound (trim to 500 at 1000) lived in cancelBlockTimeout alone, so
+  // a stream whose blocks only failed grew this set without limit (BLO-36599).
+  #completedBlocks = new Set<string>()
+  #terminalExpiryMs = new Map<string, number>()
+  #terminalQueues = new Map<number, TerminalQueue>()
+  // sbn -> (block key -> packetId) for every key held by #activeBlocks,
+  // #blockSourceCounts, #blockCatalogTrackNames or #completedBlocks. A lookup
+  // without a catalog name used to string-parse every key of all of those on
+  // each source packet, which is O(retained blocks) per packet (BLO-36599).
+  #blockKeysBySbn = new Map<number, Map<string, number>>()
+  // Stable per-name encodings for stream and block keys, bounded by the
+  // catalog's track names; #blockKey is built several times per packet.
+  #encodedTrackNames = new Map<string, string>()
+  // The last block and stream key built. One packet asks for the same block's
+  // key from every FECManager entry point it passes through (~6 per source
+  // symbol), so each key is built once per packet rather than once per call
+  // (BLO-36599). Both keys are pure functions of their arguments.
+  #lastBlockKeySbn = -1
+  #lastBlockKeyPacketId = -1
+  #lastBlockKeyTrackName: string | undefined = undefined
+  #lastBlockKey = ''
+  #lastStreamKeyPacketId = -1
+  #lastStreamKeyTrackName: string | undefined = undefined
+  #lastStreamKey = ''
+  #seenSymbols = new Set<string>()
+  #blockPathCounts = new Map<string, FecBlockPathCount>()
+  // Receiver-local first-accepted-symbol time per block, bounded like
+  // #blockPathCounts (see blockAnchorAtMs).
+  #blockAnchorsMs = new Map<string, number>()
+  // Exact catalog identity observed on accepted symbols for each FEC block.
+  // Conflicting identities collapse to null so recovery fails closed.
+  #blockCatalogTrackNames = new Map<string, string | null>()
+  // A receiver joins an already-running live stream in the middle of D
+  // interleaved source blocks. This applies to both multicast and reliable MoQ:
+  // a MoQ group boundary is not an FEC ESI=0 boundary. Those blocks are not
+  // packet loss because their earlier ESIs predate the subscription. Ignore
+  // each such block until ESI=0 establishes a complete boundary for the track.
+  // After that boundary, a first observed ESI>0 is real delivery loss and must
+  // continue through normal FEC recovery/failure accounting.
+  #startupAlignedPackets = new Set<string>()
+  #startupPartialBlocks = new Set<string>()
+  // A live multicast join can observe an ESI=0 source boundary before the
+  // repair lane catches up. Returning false here also drops that media packet
+  // at MmtpRouter, so the readiness probe is multicast-only and bounded: an
+  // actual multicast repair unlocks the next boundary, while a second source
+  // boundary fails open. Reliable MoQ media continues through normal startup
+  // alignment and retained MoQ repair cannot prove multicast readiness.
+  #startupRequireRepairReady = false
+  #startupRepairReadyPackets = new Set<string>()
+  #startupRepairBoundaryCounts = new Map<string, number>()
+  #startupRepairFailOpenPackets = new Set<string>()
+  // SBNs that reached K source-symbol arrivals via trackBlock. Used by the
+  // worker recovery suppression check (see onFrame handler below) so we only
+  // suppress `recovered=true` emits for blocks that ALSO completed cleanly
+  // via source symbols. Separating this from #completedBlocks (which is also
+  // populated by every worker frame emit, by failed timeouts, and by external
+  // callers) was the BLO-3323 L15 fix: the prior predicate caused blocksRecovered
+  // to stay at 0 because the SBN was always in #completedBlocks by the time the
+  // worker fired recovered=true.
+  #cleanlyCompletedBlocks = new Set<string>()
+  // D-28: blocks whose repair deadline already fired onRepairNeeded. At most
+  // one repair request per block; entries are removed when the block
+  // completes, recovers, or fails.
+  #repairRequestedBlocks = new Set<string>()
+  // D-28: repair deadlines refreshed by accepted source progress until the
+  // first repair request. A `null` value marks a deadline that already fired
+  // and requested repair (never re-armed). At most K accepted source symbols
+  // can refresh the horizon, so browser scheduling delay cannot create an
+  // early loss signal and repair traffic cannot keep a block alive
+  // indefinitely. #repairDeadlineAtMs is the authoritative deadline; the one
+  // armed timer re-checks it when it fires (see DeadlineTimer).
+  #repairDeadlines = new Map<string, DeadlineTimer | null>()
+  #repairDeadlineAtMs = new Map<string, number>()
+  // Worker recovery emits all K source symbols. Track recovery once per block
+  // while routing only ESI slots that were absent from the direct source path.
+  #workerRecoveredBlocks = new Set<string>()
+
+  // How the multicast leg delivers symbols (see MulticastSymbolDelivery). The
+  // provider declares it per transport join; absence keeps datagram semantics.
+  #multicastSymbolDelivery: MulticastSymbolDelivery = 'datagram'
+  // ordered-relay: per stream, the highest SBN any multicast symbol carried.
+  // The relay preserves the receiving socket's order, so every block more than
+  // the decoder's interleave horizon behind this frontier has received every
+  // symbol it will ever receive over multicast.
+  #orderedFrontiers = new Map<string, number>()
+  // ordered-relay: blocks with multicast symbols that are neither terminal nor
+  // handed to a decoder cleanup, per stream, keyed by SBN. They carry no
+  // timer; the frontier settles them. At most one interleave horizon of blocks
+  // per stream is ever here.
+  #orderedPendingBlocks = new Map<string, Map<number, string>>()
+
+  // ── Keyframe-protected repair policy (block-policy.ts) ──
+  // One classifier per physical stream, built from that stream's geometry.
+  #classifiers = new Map<string, BlockClassifier>()
+  // Geometry a stream-scoped configuration gave one stream (streamKey). ABR
+  // rungs can share a packetId with a different framerate or GOP, so the
+  // packet-level geometry is only the geometry of a packet whose streams
+  // were never configured apart (see #geometryFor).
+  #streamGeometries = new Map<string, BlockClassifierGeometry>()
+  // Terminal outcomes retained for in-order frame release: a failed block is
+  // resolved-with-loss, a completed one resolved-clean.
+  #failedBlocks = new Set<string>()
+  // A block's class at resolution, so events emitted after the classifier
+  // forgot the block (the router counts a recovery after cancelling the
+  // block) still carry it.
+  #resolvedBlockClasses = new Map<string, BlockClass>()
+  // Blocks already reported through onBlockRepaired (once per block).
+  #repairedBlocks = new Set<string>()
+  // Blocks created without any symbol because every symbol vanished.
+  #materializedBlocks = new Set<string>()
+  // packetIds whose ordered-relay horizon became underivable and fell back to
+  // the datagram deadline. Bounds the warn in #derivableOrderedHorizon to once
+  // per stream. Not only throws: the ordinary out-of-range case is detected by
+  // arithmetic and never throws at all.
+  #orderedHorizonWarnedFor = new Set<number>()
+  // Highest SBN seen per stream and when, for vanished-block detection.
+  #highestSbn = new Map<string, { sbn: number; atMs: number }>()
+  // iso-ssbg1-v1 block location per stream (streamKey). A source belongs to a
+  // block only once a repair symbol stated the block's (SS_Start, SSB_length).
+  #isoLocators = new Map<string, IsoBlockLocator<IsoHeldSource>>()
+  #isoRepairRefusedCount = 0
+  #isoSourceOversizeCount = 0
+  // Held sources a locator's capacity cap evicted (IsoBlockLocator.heldCapacity):
+  // only a stream whose SS_IDs are not consecutive reaches it. Cumulative,
+  // unlike the locators, which a reset discards.
+  #isoHeldEvictedCount = 0
+  // Sources a synchronous decoder held unplaced and retired at its horizon
+  // (WasmFecDecoder.retire_unplaced): placed sources whose block's repair
+  // never reached that decoder. Cumulative.
+  #isoDecoderUnplacedRetired = 0
+  // Failed retire_unplaced calls. The sweep runs on every feed, so its warn is
+  // rate-limited like the other per-symbol warns here. Cumulative.
+  #isoDecoderUnplacedRetireFailed = 0
+  // The latest source symbol per stream that carried its MMTP
+  // packet_sequence_number: the anchor that bounds how many blocks the
+  // producer can have started before a later source symbol.
+  #sourceAnchors = new Map<string, { sbn: number; psn: number; atMs: number }>()
+  // Catalog/reset epoch per packetId. Gap decisions carry it for fencing.
+  #packetEpochs = new Map<number, number>()
+
+  // Framerate detection state
+  #fpsDetected = false
+  #fecFps?: number
+  #fecInterleaveDepthMs = 0
+
+  // Worker error log rate-limiter — bounds console.warn output and exported
+  // error cardinality when the FEC Worker emits the same failure repeatedly
+  // with volatile packet details (e.g. ssStart) in the message text.
+  // Stable Worker codes aggregate those messages; uncoded/legacy messages are
+  // capped into an `other` bucket. This also covers wasm-bindgen
+  // "recursive use of an object" bubbled from add_source/add_repair during
+  // overlapping message processing). Without this, Point 5 of the 7-point
+  // validation harness — which caps headless warnings at 500 — fails even
+  // though the errors are duplicates of a single underlying event.
+  #workerErrorCounts = new Map<string, number>()
+  #decoderUnavailableEvents = 0
+  #repairSymbolSizeMismatchCount = 0
+
+  // Event callbacks — block lifecycle notifications for MmtpRouter wiring.
+  // NOTE: For sync WASM path, recovery routing is handled by MmtpRouter from
+  // feedSourceSymbol/feedRepairSymbol return values. For Worker path, recovery
+  // arrives via onBlockRecovered callback.
+  onBlockStarted:
+    | ((sbn: number, packetId: number, catalogTrackName?: string) => void)
+    | null = null
+  onBlockComplete:
+    | ((sbn: number, packetId: number, catalogTrackName?: string) => void)
+    | null = null
+  /** A block reached its fail bound. `blockClass` is its class at failure. */
+  onBlockFailed:
+    | ((
+        sbn: number,
+        packetId: number,
+        catalogTrackName: string | undefined,
+        blockClass: BlockClass,
+      ) => void)
+    | null = null
+  /**
+   * Fired once per stream when its Worker decoder stops being routable.
+   * `reason` is 'cleared' when clearFecWorker() removed it and 'disposed' when
+   * a symbol or reset found the registered client already disposed and
+   * evicted it. `fallbackDecoder` is 'sync' when a synchronous WASM decoder
+   * registered for the same stream keeps decoding its symbols, and 'none'
+   * when nothing does. Only 'none' leaves the stream unprotected: the host
+   * must then register a decoder again or leave the stream, because counting
+   * its symbols as handled would hide the loss.
+   */
+  onDecoderUnavailable: ((event: FecDecoderUnavailableEvent) => void) | null = null
+
+  // D-28 on-demand repair callbacks. When onRepairNeeded is registered, each
+  // block arms a one-shot repair deadline after the derived K-symbol source
+  // horizon; a block still short of K when it fires requests a per-SBN MoQ
+  // repair fetch upstream. The inactivity fail bound is unchanged either way —
+  // repair and failure are orthogonal timers, so wiring D-28 never delays
+  // failure accounting. onRepairResolved fires when a repair-requested block
+  // leaves the active set, with the outcome ("completed" after clean completion
+  // or recovery, "failed" at the fail bound) so the upstream in-flight slot
+  // (MulticastManager.clearRepairForBlock) can be released and logged.
+  onRepairNeeded:
+    | ((
+        sbn: number,
+        packetId: number,
+        catalogTrackName: string | undefined,
+        blockClass: BlockClass,
+      ) => void)
+    | null = null
+  onRepairResolved:
+    | ((
+        sbn: number,
+        packetId: number,
+        outcome: 'completed' | 'failed',
+        catalogTrackName: string | undefined,
+        via: RepairVia | null,
+      ) => void)
+    | null = null
+
+  /**
+   * A block that could not complete from its first-arrival source symbols
+   * alone was completed anyway: by FEC decode (in-band or QUIC repair
+   * symbols) or, after a D-28 request, by late symbols. Fired once per block.
+   */
+  onBlockRepaired:
+    | ((
+        sbn: number,
+        packetId: number,
+        catalogTrackName: string | undefined,
+        blockClass: BlockClass,
+        via: RepairVia,
+      ) => void)
+    | null = null
+  /** A block's class changed on new evidence or when classification was disabled. */
+  onBlockReclassified:
+    | ((
+        sbn: number,
+        packetId: number,
+        catalogTrackName: string | undefined,
+        from: BlockClass,
+        to: BlockClass,
+        evidence: ReclassificationEvidence,
+      ) => void)
+    | null = null
+  /** A video stream's classifier mode was established or changed. */
+  onClassifierMode:
+    | ((
+        packetId: number,
+        catalogTrackName: string | undefined,
+        mode: ClassifierMode,
+        reason: ClassifierReason | null,
+      ) => void)
+    | null = null
+  /** A block every symbol of which vanished was created by SBN evidence. */
+  onBlockVanished:
+    | ((sbn: number, packetId: number, catalogTrackName: string | undefined) => void)
+    | null = null
+  /** A block reached a terminal state (completed, recovered, or failed). */
+  onBlockResolved:
+    | ((sbn: number, packetId: number, catalogTrackName: string | undefined) => void)
+    | null = null
+  /** A stream's SBN went backwards (or jumped implausibly): the source restarted. */
+  onSourceDiscontinuity:
+    | ((packetId: number, catalogTrackName: string | undefined) => void)
+    | null = null
+
+  // Worker-path callbacks — async recovery and stats from FecWorkerClient.
+  onBlockRecovered: ((sbn: number, packetId: number, data: ArrayBuffer, meta: FrameMeta, catalogTrackName?: string) => void) | null = null
+  onFecStatsUpdate: ((packetId: number, stats: FecTrackStats) => void) | null = null
+
+  #encodeTrackName(catalogTrackName: string): string {
+    let encoded = this.#encodedTrackNames.get(catalogTrackName)
+    if (encoded === undefined) {
+      encoded = encodeURIComponent(catalogTrackName)
+      this.#encodedTrackNames.set(catalogTrackName, encoded)
+    }
+    return encoded
+  }
+
+  #streamKey(packetId: number, catalogTrackName?: string): string {
+    if (
+      packetId === this.#lastStreamKeyPacketId &&
+      catalogTrackName === this.#lastStreamKeyTrackName
+    ) {
+      return this.#lastStreamKey
+    }
+    const key = catalogTrackName === undefined
+      ? `${packetId}`
+      : `${packetId}:${this.#encodeTrackName(catalogTrackName)}`
+    this.#lastStreamKeyPacketId = packetId
+    this.#lastStreamKeyTrackName = catalogTrackName
+    this.#lastStreamKey = key
+    return key
+  }
+
+  #belongsToPacket(key: string, packetId: number): boolean {
+    return Number(key.split(':', 1)[0]) === packetId
+  }
+
+  #belongsToStream(key: string, packetId: number, catalogTrackName: string): boolean {
+    if (!this.#belongsToPacket(key, packetId)) return false
+    const parts = key.split(':')
+    const encodedTrackName = this.#encodeTrackName(catalogTrackName)
+    if (parts.length === 2) return parts[1] === encodedTrackName
+    if (parts.length >= 3) return parts[2] === encodedTrackName
+    return false
+  }
+
+  #packetIdsForStreamKeys(keys: Set<string>): number[] {
+    return [...new Set([...keys].map((key) => Number(key.split(':', 1)[0])))]
+  }
+
+  #parseStreamKey(key: string): { packetId: number; catalogTrackName?: string } {
+    const separator = key.indexOf(':')
+    if (separator < 0) return { packetId: Number(key) || 0 }
+    return {
+      packetId: Number(key.slice(0, separator)) || 0,
+      catalogTrackName: decodeURIComponent(key.slice(separator + 1)),
+    }
+  }
+
+  #blockKey(sbn: number, packetId: number, catalogTrackName?: string): string {
+    if (
+      sbn === this.#lastBlockKeySbn &&
+      packetId === this.#lastBlockKeyPacketId &&
+      catalogTrackName === this.#lastBlockKeyTrackName
+    ) {
+      return this.#lastBlockKey
+    }
+    const base = `${packetId}:${sbn}`
+    const key = catalogTrackName === undefined
+      ? base
+      : `${base}:${this.#encodeTrackName(catalogTrackName)}`
+    this.#lastBlockKeySbn = sbn
+    this.#lastBlockKeyPacketId = packetId
+    this.#lastBlockKeyTrackName = catalogTrackName
+    this.#lastBlockKey = key
+    return key
+  }
+
+  /** Record that `key` (block `sbn` on `packetId`) is held by a lookup set. */
+  #indexBlockKey(key: string, sbn: number, packetId: number): void {
+    let keys = this.#blockKeysBySbn.get(sbn)
+    if (!keys) {
+      keys = new Map()
+      this.#blockKeysBySbn.set(sbn, keys)
+    }
+    keys.set(key, packetId)
+  }
+
+  /** True while any set a catalog-name-less lookup consults still holds `key`. */
+  #isBlockKeyHeld(key: string): boolean {
+    return this.#activeBlocks.has(key) ||
+      this.#blockSourceCounts.has(key) ||
+      this.#blockCatalogTrackNames.has(key) ||
+      this.#completedBlocks.has(key)
+  }
+
+  /** Drop `key` from the SBN index once no lookup set holds it any more. */
+  #unindexBlockKey(key: string): void {
+    if (this.#isBlockKeyHeld(key)) return
+    const sbn = this.#parseBlockKey(key).sbn
+    const keys = this.#blockKeysBySbn.get(sbn)
+    if (!keys) return
+    keys.delete(key)
+    if (keys.size === 0) this.#blockKeysBySbn.delete(sbn)
+  }
+
+  /**
+   * Make `key` terminal: late symbols for it are duplicates from now on. The
+   * key is retired terminalRetentionMsForPacket later, when no copy of any of
+   * its symbols can still be in flight on either transport and no frame can
+   * still be held behind it. Retirement is swept lazily here, on the stream's
+   * own terminal events, so it needs no timer.
+   */
+  #markTerminal(key: string, sbn: number, packetId: number, clean: boolean): void {
+    const nowMs = performance.now()
+    this.#retireTerminalBlocks(packetId, nowMs)
+    this.#forgetOrderedPending(key)
+    this.#completedBlocks.add(key)
+    if (clean) this.#cleanlyCompletedBlocks.add(key)
+    this.#indexBlockKey(key, sbn, packetId)
+    const expiresAtMs = nowMs + this.terminalRetentionMsForPacket(packetId)
+    this.#terminalExpiryMs.set(key, expiresAtMs)
+    let queue = this.#terminalQueues.get(packetId)
+    if (!queue) {
+      queue = new TerminalQueue()
+      this.#terminalQueues.set(packetId, queue)
+    }
+    queue.push({ key, expiresAtMs })
+  }
+
+  #retireTerminalBlocks(packetId: number, nowMs: number): void {
+    const queue = this.#terminalQueues.get(packetId)
+    if (!queue) return
+    for (let record = queue.peek(); record !== undefined; record = queue.peek()) {
+      if (record.expiresAtMs > nowMs) return
+      // A key made terminal again later (or reset and reused) owns a newer
+      // record; this one no longer describes it.
+      const current = this.#terminalExpiryMs.get(record.key) === record.expiresAtMs
+      // An ordered relay can still hand over the rest of a terminal block's
+      // symbols (a clean block's remaining repair symbols) for as long as the
+      // relay pauses. Until the stream passes the block's interleave horizon
+      // those symbols are late copies, not a new block, so the key stays.
+      if (current && this.#withinOrderedHorizon(record.key)) return
+      queue.shift()
+      if (!current) continue
+      this.#terminalExpiryMs.delete(record.key)
+      this.#completedBlocks.delete(record.key)
+      this.#cleanlyCompletedBlocks.delete(record.key)
+      this.#workerRecoveredBlocks.delete(record.key)
+      // The policy's terminal ledgers describe the same terminal state and
+      // retire with it: a failed block must never outlive its failure record
+      // as 'complete' (that would hide a loss from the release gate).
+      this.#failedBlocks.delete(record.key)
+      this.#resolvedBlockClasses.delete(record.key)
+      this.#repairedBlocks.delete(record.key)
+      this.#unindexBlockKey(record.key)
+    }
+  }
+
+  // -----------------------------------------------------------------------
+  // Ordered-relay settlement (MulticastSymbolDelivery 'ordered-relay')
+  // -----------------------------------------------------------------------
+
+  /**
+   * The decoder's interleave horizon for one stream, in blocks: the same
+   * retention the Worker and the WASM decoder are configured with, because it
+   * comes from the same function they do (`deriveFecRetentionBlocks`, over the
+   * block's delivery window and its span). The decoder retires every block
+   * more than this many SBNs behind the newest one it saw (`cleanup_by_sbn`),
+   * so settling earlier than this would decide a block the decoder would still
+   * have recovered.
+   *
+   * This used to call `deriveFecInterleaveDepth`, which returns D -- MEDIA
+   * UNITS per block, not a block count -- and a comment here asserted the two
+   * matched. They did, only while the decoder's retention was also (wrongly)
+   * sized in D. Once BLO-35597 sized retention as a real block count this
+   * settled 2-5 blocks early on the live ISS catalog at reorderToleranceMs=100
+   * (720p 1 vs 6, audio 2 vs 5), making the manager the binding constraint and
+   * the decoder fix inert on ordered relays. Both sides now consume one
+   * derivation; do not re-derive a horizon at either call site.
+   */
+  #orderedHorizonBlocksFor(packetId: number, config: ResolvedFECTrackConfig): number {
+    if (!FECManager.#hasOrderedGeometry(config)) {
+      throw new Error(
+        `[FECManager] packetId=${packetId}: ordered-relay settlement derives the ` +
+          `decoder's interleave horizon from the catalog interleaveDepthMs ` +
+          `(>= ${MIN_INTERLEAVE_DEPTH_MS}ms), the media-unit rate and the block ` +
+          `delivery window; got interleaveDepthMs=${config.interleaveDepthMs} ` +
+          `fps=${String(config.fps)} timeoutMs=${config.timeoutMs}.`,
+      )
+    }
+    // Config time is where failing closed is right, so a > 255 geometry throws
+    // from here with the message oti.ts wrote: it names interleaveDepthMs and
+    // the catalog fix. #derivableOrderedHorizon deliberately does not.
+    return deriveFecRetentionBlocks(config.timeoutMs, config.interleaveDepthMs)
+  }
+
+  /**
+   * Whether a stream's geometry can define an ordered-relay horizon at all.
+   * One definition, shared by the config-time and packet-feed callers, so the
+   * two can never disagree about which streams settle by stream order.
+   */
+  static #hasOrderedGeometry(config: ResolvedFECTrackConfig): boolean {
+    return (
+      config.interleaveDepthMs >= MIN_INTERLEAVE_DEPTH_MS &&
+      // `fps` is no longer an input to the horizon, but it still gates WHICH
+      // streams settle by stream order at all: a track with no usable
+      // media-unit rate fell back to datagram semantics before this and must
+      // keep doing so. Removing this widens ordered-relay settlement to streams
+      // that never had it. Load-bearing — do not drop it as unused.
+      config.fps !== undefined &&
+      Number.isFinite(config.fps) &&
+      config.fps > 0 &&
+      Number.isFinite(config.timeoutMs) &&
+      config.timeoutMs > 0
+    )
+  }
+
+  /**
+   * The horizon for one stream, or undefined when its geometry cannot define
+   * one.
+   *
+   * `config.timeoutMs` is the block's delivery window. On the live path
+   * multicast-manager computes it with `jitterBufferMs: fec.reorderToleranceMs`
+   * and passes it to configure(), which is the same `deliveryWindowMs`
+   * fec-worker-setup sizes decoder retention from, so the two horizons are
+   * equal there.
+   *
+   * They are NOT equal on the fallback path, and the skew runs in the
+   * direction this file's invariant calls unsafe. `jitterBufferMs` reaches
+   * fec-manager only inside an explicit configure({timeoutMs}); all four of
+   * its own computeFecDeliveryWindowMs calls (one in #computeTimeout, one in
+   * configure(), two in setFramerate) omit it, so a manager-derived
+   * timeoutMs is tolerance-free and yields a
+   * horizon NARROWER than the decoder's retention — the direction that settles
+   * a block the decoder would still have recovered. At 720p/33ms the decoder
+   * retains ceil(133/33)+1 = 6 while a tolerance-free 33ms window gives
+   * ceil(33/33)+1 = 2. Two writes can also raise a validated timeoutMs
+   * afterwards without re-validating (configure()'s widening loop and
+   * setFramerate).
+   *
+   * Not fixed here: the real fix is to thread the tolerance into those four
+   * calls so both sides derive from the same quantity, which is a change to
+   * inputs fec-manager does not currently receive. Tracked in BLO-38250. The
+   * live ISS path does not hit it — multicast-manager always supplies both
+   * `timeoutMs` and `fps`, and setFramerate skips tracks that already carry
+   * `fps` — so this is a latent skew on the fallback, not a live defect. Do
+   * not read the old "can only skew narrower, never wider" note as a safety
+   * argument: narrower IS the failing direction.
+   */
+  #derivableOrderedHorizon(config: ResolvedFECTrackConfig, packetId: number): number | undefined {
+    if (!FECManager.#hasOrderedGeometry(config)) return undefined
+    try {
+      // `tryDeriveFecRetentionBlocks`, not the throwing variant: this is the
+      // per-symbol path (#settlesByOrder -> #orderedHorizonBlocks, from
+      // noteBlockActivity on every source and repair symbol), and a geometry
+      // past the 255-block ceiling is STEADY STATE, not a transient --
+      // `timeoutMs` does not narrow back on its own. Throwing here would
+      // construct an Error and capture a stack in oti.ts, then unwind it,
+      // for every symbol on the stream, and #advanceOrderedFrontier's
+      // `blocks === undefined` branch re-enters noteBlockActivity per pending
+      // SBN and would multiply it again. The ceiling itself stays owned by
+      // oti.ts -- open-coding the comparison here would re-create the second
+      // derivation this change exists to remove.
+      const blocks = tryDeriveFecRetentionBlocks(config.timeoutMs, config.interleaveDepthMs)
+      if (blocks === undefined) {
+        // Falls back to datagram semantics through the `blocks === undefined`
+        // branch already written for it in #advanceOrderedFrontier. Two writes
+        // can raise a track's timeoutMs after #orderedHorizonBlocksFor
+        // validated it (configure()'s widening loop and setFramerate's), and
+        // neither re-validates, so this is reachable without a second
+        // config-time check.
+        this.#noteLeftOrderedSettlement(
+          packetId,
+          `geometry cannot define a retention horizon within the 255-block ceiling ` +
+            `(timeoutMs=${config.timeoutMs}ms over interleaveDepthMs=${config.interleaveDepthMs}ms)`,
+        )
+      }
+      return blocks
+    } catch (error) {
+      // Backstop only -- nothing above throws today. Deliberately unnarrowed:
+      // if the callee grows a new throw, this is what makes it visible rather
+      // than silently swallowed. The contract of this path
+      // (#orderedHorizonBlocks) is that it must not throw.
+      this.#noteLeftOrderedSettlement(packetId, String(error))
+      return undefined
+    }
+  }
+
+  /**
+   * Warn once per stream that it dropped from ordered-relay settlement to the
+   * datagram deadline. Swallowing is right for the packet-feed contract, but a
+   * configured stream changing settlement mid-flight is a behavioural change,
+   * and it is otherwise indistinguishable from a stream that never had
+   * geometry.
+   */
+  #noteLeftOrderedSettlement(packetId: number, reason: string): void {
+    if (this.#orderedHorizonWarnedFor.has(packetId)) return
+    this.#orderedHorizonWarnedFor.add(packetId)
+    console.warn(
+      `[FECManager] packetId=${packetId} left ordered-relay settlement for the datagram deadline: ${reason}`,
+    )
+  }
+
+  /**
+   * The stream's interleave horizon, or undefined when its geometry cannot
+   * define one. Two different streams reach that case, with different causes:
+   * a packetId that was never configured, and so resolves to the manager
+   * defaults (explicitly configured tracks are refused an underivable geometry
+   * at config time — #upsertTrackConfig, setMulticastSymbolDelivery); or a
+   * configured track whose timeoutMs was later widened past the 255-block
+   * ceiling without re-validating, which #derivableOrderedHorizon catches
+   * rather than throwing from the packet-feed path. Either way the stream
+   * keeps datagram semantics instead of throwing. The manager defaults can
+   * also change under a stream that already holds blocks, so a caller cannot
+   * assume a horizon that was defined when a block was held is still defined
+   * (see #advanceOrderedFrontier).
+   */
+  #orderedHorizonBlocks(packetId: number): number | undefined {
+    return this.#derivableOrderedHorizon(this.#resolveTrackConfig(packetId), packetId)
+  }
+
+  /** True while a block of an ordered-relay stream can still receive symbols. */
+  #withinOrderedHorizon(key: string): boolean {
+    if (this.#multicastSymbolDelivery !== 'ordered-relay') return false
+    const block = this.#parseBlockKey(key)
+    const frontier = this.#orderedFrontiers.get(
+      this.#streamKey(block.packetId, block.catalogTrackName),
+    )
+    if (frontier === undefined) return false
+    const horizon = this.#orderedHorizonBlocks(block.packetId)
+    if (horizon === undefined) return false
+    return this.#blocksBehind(block.sbn, frontier, block.packetId) <= horizon
+  }
+
+  /** Whether a block's fate is decided by stream order rather than a timer. */
+  #settlesByOrder(key: string): boolean {
+    return this.#multicastSymbolDelivery === 'ordered-relay' &&
+      (this.#blockPathCounts.get(key)?.multicastSymbols ?? 0) > 0 &&
+      this.#orderedHorizonBlocks(this.#parseBlockKey(key).packetId) !== undefined
+  }
+
+  #forgetOrderedPending(key: string): void {
+    if (this.#orderedPendingBlocks.size === 0) return
+    const block = this.#parseBlockKey(key)
+    const streamKey = this.#streamKey(block.packetId, block.catalogTrackName)
+    const pending = this.#orderedPendingBlocks.get(streamKey)
+    if (pending?.get(block.sbn) !== key) return
+    pending.delete(block.sbn)
+    if (pending.size === 0) this.#orderedPendingBlocks.delete(streamKey)
+  }
+
+  /**
+   * Record the stream position of a multicast symbol and settle every pending
+   * block it proves final: a block more than the interleave horizon behind the
+   * frontier has already been handed every symbol the relay will deliver.
+   */
+  #advanceOrderedFrontier(
+    streamKey: string,
+    sbn: number,
+    packetId: number,
+    catalogTrackName?: string,
+  ): void {
+    const previous = this.#orderedFrontiers.get(streamKey)
+    const frontier = previous === undefined || this.#blockPrecedes(previous, sbn, packetId)
+      ? sbn
+      : previous
+    if (frontier !== previous) this.#orderedFrontiers.set(streamKey, frontier)
+    const pending = this.#orderedPendingBlocks.get(streamKey)
+    if (!pending) return
+    const blocks = this.#orderedHorizonBlocks(packetId)
+    if (blocks === undefined) {
+      // Either an unconfigured stream (it resolves to the manager defaults,
+      // and configure() accepts a sub-floor interleaveDepthMs) or a configured
+      // one whose timeoutMs was widened past the 255-block ceiling after
+      // validation (#derivableOrderedHorizon). Stream
+      // order can no longer settle its held blocks, so hand them to the
+      // datagram deadline -- as setMulticastSymbolDelivery('datagram') does --
+      // rather than settle them a horizon early or hold them with no timer.
+      this.#orderedPendingBlocks.delete(streamKey)
+      for (const pendingSbn of pending.keys()) {
+        this.noteBlockActivity(pendingSbn, packetId, catalogTrackName)
+      }
+      return
+    }
+    for (const [pendingSbn, key] of pending) {
+      if (this.#blocksBehind(pendingSbn, frontier, packetId) <= blocks) continue
+      pending.delete(pendingSbn)
+      this.#settleOrderedBlock(key, pendingSbn, packetId, catalogTrackName)
+    }
+    if (pending.size === 0 && this.#orderedPendingBlocks.get(streamKey) === pending) {
+      this.#orderedPendingBlocks.delete(streamKey)
+    }
+  }
+
+  /**
+   * Decide a block the ordered relay has finished delivering. Its accounting
+   * is final: SSB_length (from any repair symbol) against the source and
+   * repair symbols it holds says whether the decoder can still recover it.
+   * A block short of that asks for repair when D-28 is wired, under the same
+   * post-request fetch budget the datagram path grants; otherwise, and for a
+   * block the decoder holds enough symbols for, the decoder finalizes it
+   * exactly as a datagram deadline would (a Worker acknowledges the cleanup
+   * only after every earlier symbol, so an in-flight recovery still wins).
+   */
+  #settleOrderedBlock(
+    key: string,
+    sbn: number,
+    packetId: number,
+    catalogTrackName?: string,
+  ): void {
+    if (
+      this.#completedBlocks.has(key) ||
+      this.#pendingWorkerCleanups.has(key) ||
+      this.#repairRequestedBlocks.has(key)
+    ) return
+    const authoredLength = this.#blockAuthoredLengths.get(key)
+    const received =
+      (this.#blockSourceCounts.get(key) ?? 0) +
+      (this.#blockRepairRsIds.get(key)?.size ?? 0)
+    if (
+      this.onRepairNeeded &&
+      (authoredLength === undefined || received < authoredLength)
+    ) {
+      this.#requestRepair(sbn, packetId, catalogTrackName, true)
+      return
+    }
+    this.#traceLifecycle('horizon-settled', sbn, packetId, catalogTrackName)
+    this.#finalizeExpiredBlock(sbn, packetId, catalogTrackName)
+  }
+
+  /** Register a block whose multicast symbols arrive over an ordered relay. */
+  #holdForOrderedSettlement(
+    key: string,
+    sbn: number,
+    packetId: number,
+    catalogTrackName?: string,
+  ): void {
+    // A block that started on the other transport may already hold a timer.
+    // Its multicast symbols now decide it by order; a wall clock cannot.
+    this.#clearRepairDeadline(key)
+    if (this.#activeBlocks.has(key)) {
+      this.#clearBlockTimer(key)
+      this.#unindexBlockKey(key)
+    }
+    const streamKey = this.#streamKey(packetId, catalogTrackName)
+    let pending = this.#orderedPendingBlocks.get(streamKey)
+    if (!pending) {
+      pending = new Map()
+      this.#orderedPendingBlocks.set(streamKey, pending)
+    }
+    pending.set(sbn, key)
+  }
+
+  /** Cancel and forget a block's inactivity timer and deadline. */
+  #clearBlockTimer(key: string): void {
+    const timer = this.#activeBlocks.get(key)
+    if (timer?.handle != null) clearTimeout(timer.handle)
+    this.#activeBlocks.delete(key)
+    this.#activeBlockDeadlinesMs.delete(key)
+    this.#blockWaitDeadlinesMs.delete(key)
+    this.#repairHoldUntilMs.delete(key)
+  }
+
+  #parseBlockKey(key: string): { packetId: number; sbn: number; catalogTrackName?: string } {
+    const [packetIdText, sbnText, ...catalogParts] = key.split(':')
+    const catalogTrackName = catalogParts.length > 0
+      ? decodeURIComponent(catalogParts.join(':'))
+      : undefined
+    return {
+      packetId: Number(packetIdText) || 0,
+      sbn: Number(sbnText) || 0,
+      ...(catalogTrackName === undefined ? {} : { catalogTrackName }),
+    }
+  }
+
+  #decoderForPacket(packetId: number, catalogTrackName?: string) {
+    return this.#fecDecoders.get(this.#streamKey(packetId, catalogTrackName))
+      ?? this.#fecDecoders.get(this.#streamKey(packetId))
+  }
+
+  #workerForPacket(packetId: number, catalogTrackName?: string) {
+    return this.#workerClients.get(this.#streamKey(packetId, catalogTrackName))
+      ?? this.#workerClients.get(this.#streamKey(packetId))
+  }
+
+  /**
+   * The stream's Worker client for routing, or undefined after evicting a
+   * registered client that was already disposed. A disposed client throws on
+   * every command, so it leaves routing here before a symbol reaches it and
+   * the stream reports its decoder unavailable instead.
+   */
+  #routableWorkerForPacket(packetId: number, catalogTrackName?: string): FecWorkerClient | undefined {
+    const client = this.#workerForPacket(packetId, catalogTrackName)
+    if (client === undefined || client.disposed !== true) return client
+    this.#evictDisposedWorker(client)
+    return undefined
+  }
+
+  #claimDecoderBlock(
+    client: object,
+    sbn: number,
+    catalogTrackName?: string,
+  ): boolean {
+    let blocks = this.#decoderBlockOwners.get(client)
+    if (!blocks) {
+      blocks = new Map()
+      this.#decoderBlockOwners.set(client, blocks)
+    }
+    const owner = blocks.get(sbn)
+    if (!owner) {
+      blocks.set(sbn, { catalogTrackName, conflicted: false })
+      if (blocks.size > 512) {
+        const stale = [...blocks.keys()].slice(0, 256)
+        for (const key of stale) blocks.delete(key)
+      }
+      return true
+    }
+    if (owner.conflicted) return false
+    if (owner.catalogTrackName === catalogTrackName) return true
+    owner.conflicted = true
+    return false
+  }
+
+  #decoderBlockCatalogTrackName(client: object, sbn: number): string | undefined {
+    const owner = this.#decoderBlockOwners.get(client)?.get(sbn)
+    return owner?.conflicted ? undefined : owner?.catalogTrackName
+  }
+
+  #resetDecoderBlockOwners(client: object, catalogTrackName: string): void {
+    const blocks = this.#decoderBlockOwners.get(client)
+    if (!blocks) return
+    for (const [sbn, owner] of blocks) {
+      if (owner.catalogTrackName === catalogTrackName || owner.conflicted) {
+        blocks.delete(sbn)
+      }
+    }
+    if (blocks.size === 0) this.#decoderBlockOwners.delete(client)
+  }
+
+  #discardFecDecoderClient(client: WasmFecDecoder): void {
+    for (const [key, entry] of this.#fecDecoders) {
+      if (entry.client === client) this.#fecDecoders.delete(key)
+    }
+    this.#decoderBlockOwners.delete(client)
+  }
+
+  #assertExclusiveDecoderClient(
+    streamKey: string,
+    client: object,
+    registrations: Iterable<readonly [string, object]>,
+    kind: 'decoder' | 'worker',
+  ): void {
+    for (const [registeredKey, registeredClient] of registrations) {
+      if (registeredClient !== client || registeredKey === streamKey) continue
+      throw new Error(
+        `[FECManager] ${kind} client is already registered for stream ${registeredKey}; ` +
+        `create one client per physical stream`,
+      )
+    }
+  }
+
+  #statsForPacket(packetId: number): MutableFecCounters {
+    let stats = this.#fecTrackStats.get(packetId)
+    if (!stats) {
+      stats = newFecCounters()
+      this.#fecTrackStats.set(packetId, stats)
+    }
+    return stats
+  }
+
+  #markPathBlockComplete(sbn: number, packetId: number, catalogTrackName?: string): void {
+    const block = this.#blockPathCounts.get(this.#blockKey(sbn, packetId, catalogTrackName))
+    if (block) block.complete = true
+  }
+
+  /** Cancel and forget a block's D-28 repair-deadline timer. */
+  #clearRepairDeadline(key: string): void {
+    const timer = this.#repairDeadlines.get(key)
+    if (timer?.handle != null) clearTimeout(timer.handle)
+    this.#repairDeadlines.delete(key)
+    this.#repairDeadlineAtMs.delete(key)
+  }
+
+  /**
+   * Move a block's D-28 repair deadline to `delayMs` from now. The timer
+   * already armed for an earlier moment fires first and re-arms for the
+   * remainder, so repeated source progress costs no timer operation.
+   */
+  #armRepairDeadline(
+    key: string,
+    sbn: number,
+    packetId: number,
+    catalogTrackName: string | undefined,
+    delayMs: number,
+  ): void {
+    const deadlineMs = performance.now() + delayMs
+    this.#repairDeadlineAtMs.set(key, deadlineMs)
+    const armed = this.#repairDeadlines.get(key)
+    if (armed?.handle != null) {
+      if (armed.fireAtMs <= deadlineMs) return
+      clearTimeout(armed.handle)
+    }
+    const timer: DeadlineTimer = { handle: null, fireAtMs: deadlineMs }
+    const onFire = (): void => {
+      if (this.#repairDeadlines.get(key) !== timer) return
+      const currentDeadlineMs = this.#repairDeadlineAtMs.get(key)
+      const nowMs = performance.now()
+      if (currentDeadlineMs !== undefined && currentDeadlineMs > nowMs) {
+        timer.fireAtMs = currentDeadlineMs
+        timer.handle = setTimeout(onFire, Math.ceil(currentDeadlineMs - nowMs))
+        return
+      }
+      timer.handle = null
+      this.#requestRepair(sbn, packetId, catalogTrackName)
+    }
+    timer.handle = setTimeout(onFire, delayMs)
+    this.#repairDeadlines.set(key, timer)
+  }
+
+  #requestRepair(
+    sbn: number,
+    packetId: number,
+    catalogTrackName?: string,
+    /**
+     * Ordered-relay settlement only: the stream has proved the block final,
+     * so its multicast wait ends now. A datagram block keeps the wait its
+     * accepted symbols armed.
+     */
+    settledByOrder = false,
+  ): void {
+    const key = this.#blockKey(sbn, packetId, catalogTrackName)
+    if (
+      this.#completedBlocks.has(key) ||
+      !this.onRepairNeeded ||
+      this.#repairRequestedBlocks.has(key)
+    ) return
+
+    const deadline = this.#repairDeadlines.get(key)
+    if (deadline?.handle != null) clearTimeout(deadline.handle)
+    this.#repairDeadlines.set(key, null)
+    this.#repairDeadlineAtMs.delete(key)
+    this.#repairRequestedBlocks.add(key)
+
+    // The request itself grants no time (BLO-35597). The multicast wait keeps
+    // running, extended by any late symbol; the repair scheduler extends the
+    // block past it (holdBlockForRepair) only for a FETCH it admits, i.e. one
+    // the measured reliable-path RTT says can land before the block's
+    // presentation deadline. A request it declines leaves the block on the
+    // multicast wait alone, so no doomed FETCH is sent and none is aborted
+    // for want of a grace that could never have covered the round trip.
+    if (settledByOrder) this.#armBlockTimeout(sbn, packetId, catalogTrackName, 0)
+    this.#traceLifecycle('repair-requested', sbn, packetId, catalogTrackName)
+    this.onRepairNeeded(
+      sbn,
+      packetId,
+      catalogTrackName,
+      this.blockClassFor(sbn, packetId, catalogTrackName),
+    )
+  }
+
+  // ── Keyframe-protected repair policy ──
+
+  /**
+   * The classifier geometry of one stream. A stream-scoped configuration
+   * wins. Once any stream of a packetId was configured with its own geometry,
+   * a sibling stream without one has none that provably belongs to it: the
+   * packet-level geometry may be another rung's (a different framerate or
+   * GOP), so it runs all-protected (`stream-geometry-absent`).
+   */
+  #geometryFor(packetId: number, catalogTrackName?: string): BlockClassifierGeometry {
+    const own = this.#streamGeometries.get(this.#streamKey(packetId, catalogTrackName))
+    if (own) return own
+    const config = this.#trackConfigs.get(packetId)
+    if (config?.trackKind === 'audio') return { trackKind: 'audio' }
+    for (const key of this.#streamGeometries.keys()) {
+      if (this.#belongsToPacket(key, packetId)) {
+        return { trackKind: 'video', mode: 'all-protected', reason: 'stream-geometry-absent' }
+      }
+    }
+    if (config?.geometry) return config.geometry
+    // No catalog cadence reached this track: every video block is protected.
+    return { trackKind: 'video', mode: 'all-protected', reason: 'keyframe-cadence-absent' }
+  }
+
+  #classifierFor(packetId: number, catalogTrackName?: string): BlockClassifier {
+    const streamKey = this.#streamKey(packetId, catalogTrackName)
+    let classifier = this.#classifiers.get(streamKey)
+    if (!classifier) {
+      classifier = new BlockClassifier(this.#geometryFor(packetId, catalogTrackName))
+      this.#classifiers.set(streamKey, classifier)
+      if (classifier.geometry.trackKind === 'video') {
+        this.onClassifierMode?.(packetId, catalogTrackName, classifier.mode, classifier.reason)
+      }
+    }
+    return classifier
+  }
+
+  #applyClassifierChanges(
+    packetId: number,
+    catalogTrackName: string | undefined,
+    changes: readonly ClassifierChange[],
+  ): void {
+    for (const change of changes) {
+      if (change.kind === 'mode') {
+        this.onClassifierMode?.(packetId, catalogTrackName, change.mode, change.reason)
+      } else {
+        this.onBlockReclassified?.(
+          change.sbn,
+          packetId,
+          catalogTrackName,
+          change.from,
+          change.to,
+          change.evidence,
+        )
+      }
+    }
+  }
+
+  /**
+   * Freeze a block's class at resolution and drop its classifier state. The
+   * frozen class answers every later query (a recovery counted after the
+   * block was cancelled, a failure event) exactly.
+   */
+  #retireBlockClass(
+    key: string,
+    sbn: number,
+    packetId: number,
+    catalogTrackName?: string,
+  ): BlockClass {
+    const frozen = this.#resolvedBlockClasses.get(key)
+    if (frozen !== undefined) return frozen
+    const blockClass = this.#peekClass(sbn, packetId, catalogTrackName)
+    this.#classifiers.get(this.#streamKey(packetId, catalogTrackName))?.forget(sbn)
+    this.#resolvedBlockClasses.set(key, blockClass)
+    this.#materializedBlocks.delete(key)
+    return blockClass
+  }
+
+  /** A block's live class without creating classifier state for the stream. */
+  #peekClass(sbn: number, packetId: number, catalogTrackName?: string): BlockClass {
+    const classifier = this.#classifiers.get(this.#streamKey(packetId, catalogTrackName))
+    if (classifier) return classifier.classOf(sbn)
+    return this.#geometryFor(packetId, catalogTrackName).trackKind === 'audio' ? 'audio' : 'unknown'
+  }
+
+  #viaFor(key: string): RepairVia {
+    return (this.#blockPathCounts.get(key)?.moqSymbols ?? 0) > 0 ? 'quic' : 'inband'
+  }
+
+  #noteBlockRepaired(
+    key: string,
+    sbn: number,
+    packetId: number,
+    catalogTrackName?: string,
+  ): void {
+    if (this.#repairedBlocks.has(key)) return
+    this.#repairedBlocks.add(key)
+    this.onBlockRepaired?.(
+      sbn,
+      packetId,
+      catalogTrackName,
+      this.blockClassFor(sbn, packetId, catalogTrackName),
+      this.#viaFor(key),
+    )
+  }
+
+  // Deliberately one block tighter than deriveFecRetentionBlocks over the same
+  // inputs (that function's `+ 1`). Different question: the retention horizon
+  // asks how long the decoder still ACCEPTS symbols for a block, this asks how
+  // far back a block that vanished entirely may still be repairable (see
+  // #noteSbnSeen).
+  // The extra block of retention is slack for a block still being fed; a block
+  // nothing has been heard from does not get it. Not the units defect — but it
+  // is the next place the two can drift, so change both or neither.
+  #liveWindowBlocks(config: ResolvedFECTrackConfig): number | null {
+    if (config.interleaveDepthMs < MIN_INTERLEAVE_DEPTH_MS || config.timeoutMs <= 0) return null
+    return Math.ceil(config.timeoutMs / config.interleaveDepthMs)
+  }
+
+  /**
+   * Record that a symbol for block `sbn` arrived and materialise any blocks
+   * that vanished entirely between the stream's highest SBN and this one.
+   *
+   * The newest ceil(timeoutMs / interleaveDepthMs) vanished blocks may still
+   * be repairable, so they get the normal repair and fail deadlines, armed
+   * from now. Older ones are already past their fail bound and fail now, as
+   * class `unknown`. A SOURCE symbol whose SBN goes back further than one
+   * live window, or jumps further than the stream could have produced since
+   * its last symbol, is a source discontinuity, not loss. A repair symbol can
+   * only advance the frontier: a D-28 fetch legitimately answers for an old
+   * block, so it never signals a discontinuity.
+   *
+   * The producer closes a block at its Dth media-unit boundary OR when K
+   * source symbols filled it, so one interleave span can start several
+   * blocks (every large keyframe does). What bounds a forward jump is
+   * therefore packet evidence, not a block rate: with the MMTP
+   * packet_sequence_number (contiguous per packet_id, ISO/IEC 23008-1) of
+   * both source symbols, every block strictly between them holds at least one
+   * of the packets sent strictly between them, and K-closes can add at most
+   * one block per K of those packets on top of the D-closes elapsed time
+   * allows. Without it, only the D-close rate is known.
+   */
+  #noteSbnSeen(
+    sbn: number,
+    packetId: number,
+    catalogTrackName: string | undefined,
+    symbol: 'source' | 'repair',
+    packetSequenceNumber?: number,
+  ): void {
+    const streamKey = this.#streamKey(packetId, catalogTrackName)
+    const now = performance.now()
+    const previous = this.#highestSbn.get(streamKey)
+    const anchor = this.#sourceAnchors.get(streamKey)
+    const psn = symbol === 'source' &&
+      packetSequenceNumber !== undefined &&
+      Number.isSafeInteger(packetSequenceNumber) &&
+      packetSequenceNumber >= 0 &&
+      packetSequenceNumber <= 0xffff_ffff
+      ? packetSequenceNumber
+      : undefined
+    const anchorHere = (): void => {
+      if (psn !== undefined && (anchor === undefined || !this.#blockPrecedes(sbn, anchor.sbn, packetId))) {
+        this.#sourceAnchors.set(streamKey, { sbn, psn, atMs: now })
+      }
+    }
+    const discontinuity = (): void => {
+      // The classifier compares authored order with SBN order only within
+      // one continuous SBN sequence.
+      this.#classifiers.get(streamKey)?.noteSourceDiscontinuity()
+      this.#highestSbn.set(streamKey, { sbn, atMs: now })
+      if (psn === undefined) this.#sourceAnchors.delete(streamKey)
+      else this.#sourceAnchors.set(streamKey, { sbn, psn, atMs: now })
+      this.onSourceDiscontinuity?.(packetId, catalogTrackName)
+    }
+    if (previous === undefined) {
+      this.#highestSbn.set(streamKey, { sbn, atMs: now })
+      anchorHere()
+      return
+    }
+    const config = this.#resolveTrackConfig(packetId)
+    const window = this.#liveWindowBlocks(config)
+    if (!this.#blockPrecedes(previous.sbn, sbn, packetId)) {
+      if (symbol === 'source' && window !== null &&
+          this.#blocksBehind(sbn, previous.sbn, packetId) > window) {
+        discontinuity()
+        return
+      }
+      anchorHere()
+      return
+    }
+    const missing = this.#blocksBehind(previous.sbn, sbn, packetId) - 1
+    let plausible = true
+    if (window !== null) {
+      // A packet_sequence_number that did not advance says nothing (a
+      // producer that does not maintain it); only then is the D-close rate
+      // the whole bound.
+      if (this.#isIso(packetId) && psn !== undefined && anchor !== undefined &&
+          this.#blockPrecedes(anchor.sbn, sbn, packetId) && psn !== anchor.psn) {
+        // iso-ssbg1-v1: SS_ID advances by one per FEC source packet (C.5.2)
+        // and packet_sequence_number by one per packet of the packet_id, so a
+        // block start can move at most the packets sent since the anchor,
+        // plus the anchor's own offset into its block (< K).
+        const sent = (psn - anchor.psn) >>> 0
+        plausible =
+          sent <= 0x7fff_ffff &&
+          serial32Distance(anchor.sbn, sbn) <= sent + config.k
+      } else if (psn !== undefined && anchor !== undefined &&
+          this.#blockPrecedes(anchor.sbn, sbn, packetId) && psn !== anchor.psn) {
+        // Packets sent from the anchor packet to this one, serial arithmetic
+        // (RFC 1982): more than half the space means it went backwards.
+        const sent = (psn - anchor.psn) >>> 0
+        const between = this.#blocksBehind(anchor.sbn, sbn, packetId) - 1
+        const dCloses = window + Math.ceil((now - anchor.atMs) / config.interleaveDepthMs)
+        // Each K-close consumes K of the packets sent; with K unknown,
+        // every packet may have closed one.
+        const kCloses = config.k > 0 ? Math.ceil(sent / config.k) : sent
+        plausible =
+          sent <= 0x7fff_ffff &&
+          between <= sent - 1 &&
+          between <= dCloses + kCloses
+      } else {
+        plausible = missing <= window + Math.ceil((now - previous.atMs) / config.interleaveDepthMs)
+      }
+    }
+    if (!plausible) {
+      if (symbol === 'repair') return
+      discontinuity()
+      return
+    }
+    this.#highestSbn.set(streamKey, { sbn, atMs: now })
+    anchorHere()
+    // iso-ssbg1-v1 cannot enumerate vanished blocks by key: their starts are
+    // unknown. The SS_IDs between two stated blocks become one repair-less
+    // span when the later block's repair arrives (placeIsoRepair).
+    if (this.#isIso(packetId)) return
+    if (missing <= 0 || window === null) return
+    let vanished = previous.sbn
+    for (let i = 0; i < missing; i++) {
+      vanished = this.#nextBlock(vanished, packetId)
+      this.#materializeBlock(
+        vanished,
+        packetId,
+        catalogTrackName,
+        this.#blocksBehind(vanished, sbn, packetId) <= window,
+      )
+    }
+  }
+
+  /*
+   * Block order for one stream (BLO-35597 iso:5). SS_ID is a 32-bit serial
+   * number (ISO/IEC 23008-1 C.5.2), so blocks are ordered by RFC 1982
+   * comparison of their first SS_ID (sbn * K mod 2^32). That is identical to
+   * comparing SBNs with < for every stream that has not wrapped SS_ID; only
+   * the order across the wrap changes. A block outside K-stride geometry has
+   * no SS_ID position, so it keeps the SBN order it always had.
+   */
+  #blockPrecedes(a: number, b: number, packetId: number): boolean {
+    // iso-ssbg1-v1 keys a block by its SS_Start: plain RFC 1982 order.
+    if (this.#isIso(packetId)) return serial32Precedes(a, b)
+    const k = this.kForPacket(packetId)
+    return isKStrideBlock(a, k) && isKStrideBlock(b, k) ? kStrideBlockPrecedes(a, b, k) : a < b
+  }
+
+  /** Blocks `a` lies behind `b` (0 when it does not precede it). */
+  #blocksBehind(a: number, b: number, packetId: number): number {
+    // iso-ssbg1-v1 blocks vary in length, so only a lower bound is known: the
+    // one metric the decoder and the worker retire by too.
+    if (this.#isIso(packetId)) return isoBlocksBehindLowerBound(a, b, this.kForPacket(packetId))
+    const k = this.kForPacket(packetId)
+    return isKStrideBlock(a, k) && isKStrideBlock(b, k)
+      ? kStrideBlocksBehind(a, b, k)
+      : Math.max(0, b - a)
+  }
+
+  /** The block after `sbn`, stepping to block 0 where SS_ID wraps. */
+  #nextBlock(sbn: number, packetId: number): number {
+    const k = this.kForPacket(packetId)
+    return isKStrideBlock(sbn, k) ? kStrideNextBlock(sbn, k) : sbn + 1
+  }
+
+  #materializeBlock(
+    sbn: number,
+    packetId: number,
+    catalogTrackName: string | undefined,
+    repairable: boolean,
+  ): void {
+    const key = this.#blockKey(sbn, packetId, catalogTrackName)
+    if (this.#blockResolutionFor(key) !== 'untracked') return
+    this.#materializedBlocks.add(key)
+    this.#classifierFor(packetId, catalogTrackName).touch(sbn)
+    this.onBlockVanished?.(sbn, packetId, catalogTrackName)
+    if (repairable) {
+      this.noteBlockActivity(sbn, packetId, catalogTrackName, true)
+    } else {
+      this.#failBlock(sbn, packetId, catalogTrackName)
+    }
+  }
+
+  #blockResolutionFor(key: string): FecBlockResolution {
+    if (this.#failedBlocks.has(key)) return 'failed'
+    if (this.#completedBlocks.has(key)) return 'complete'
+    if (
+      this.#activeBlocks.has(key) ||
+      this.#pendingWorkerCleanups.has(key) ||
+      this.#repairDeadlines.has(key) ||
+      this.#blockSourceCounts.has(key) ||
+      this.#blockRepairRsIds.has(key) ||
+      this.#materializedBlocks.has(key)
+    ) {
+      return 'pending'
+    }
+    return 'untracked'
+  }
+
+  #bumpEpoch(packetId: number): void {
+    this.#packetEpochs.set(packetId, (this.#packetEpochs.get(packetId) ?? 0) + 1)
+  }
+
+  #traceLifecycle(
+    event: FecLifecycleTrace['event'],
+    sbn: number,
+    packetId: number,
+    catalogTrackName?: string,
+    rsId?: number,
+  ): void {
+    const key = this.#blockKey(sbn, packetId, catalogTrackName)
+    const deadline = this.#activeBlockDeadlinesMs.get(key)
+    const decoderPath = this.#syncDecoderBlockOwners.has(key)
+      ? 'sync'
+      : this.#workerForPacket(packetId, catalogTrackName)
+        ? 'worker'
+        : this.#decoderForPacket(packetId, catalogTrackName)
+          ? 'sync'
+          : 'none'
+    this.#lifecycleTrace.push({
+      atMs: Date.now(),
+      event,
+      packetId,
+      sbn,
+      ...(catalogTrackName === undefined ? {} : { catalogTrackName }),
+      sourceCount: this.#blockSourceCounts.get(key) ?? 0,
+      sourceEsis: [...(this.#blockSourceEsis.get(key) ?? [])].sort((a, b) => a - b),
+      repairRsIds: [...(this.#blockRepairRsIds.get(key) ?? [])].sort((a, b) => a - b),
+      decoderPath,
+      ...(deadline === undefined
+        ? {}
+        : { deadlineRemainingMs: Math.max(0, deadline - performance.now()) }),
+      pendingCleanup: this.#pendingWorkerCleanups.has(key),
+      ...(rsId === undefined ? {} : { rsId }),
+    })
+    if (this.#lifecycleTrace.length > 64) this.#lifecycleTrace.splice(0, 32)
+  }
+
+  #defaultTrackConfig(): ResolvedFECTrackConfig {
+    return {
+      k: this.#fecK,
+      symbolSize: this.#fecSymbolSize,
+      interleaveDepthMs: this.#fecInterleaveDepthMs,
+      fps: this.#fecFps,
+      timeoutMs: this.#fecTimeoutMs,
+    }
+  }
+
+  #resolveTrackConfig(packetId: number): ResolvedFECTrackConfig {
+    return this.#trackConfigs.get(packetId) ?? this.#defaultTrackConfig()
+  }
+
+  #computeTimeout(config: {
+    k: number
+    interleaveDepthMs: number
+    fps?: number
+    timeoutMs?: number
+  }): number {
+    if (config.timeoutMs && config.timeoutMs > 0) return config.timeoutMs
+    // Only a valid §5.1 ms interleave (>= MIN_INTERLEAVE_DEPTH_MS) drives the
+    // timeout. A sub-floor value is a raw frame count (no fps to convert with);
+    // fall back to the established #fecTimeoutMs rather than collapse to ~0.
+    if (config.interleaveDepthMs >= MIN_INTERLEAVE_DEPTH_MS) {
+      return Math.max(
+        this.#fecTimeoutMs,
+        computeFecDeliveryWindowMs({
+          interleaveDepthMs: config.interleaveDepthMs,
+          sourceSymbols: config.k,
+          mediaUnitsPerSecond: config.fps,
+        }),
+      )
+    }
+    return this.#fecTimeoutMs
+  }
+
+  /**
+   * The delivery-gap window is the longest catalog keyframe interval among
+   * the configured video streams. A failed video block costs every frame up
+   * to the next keyframe, so a receiver must remember a stall for at least
+   * that long: forgetting it sooner would let the next recurrence fail a
+   * block whose damage outlives the memory of the stall that caused it. It
+   * comes from the catalog's `keyframeIntervalTicks`/`keyframeIntervalMs`
+   * (via the classifier geometry), never from a constant. It also caps the
+   * gap the wait may absorb; with no catalog cadence no gap is reported and
+   * the catalog tolerance alone applies (see DeliveryGapEstimator).
+   */
+  #refreshDeliveryGapWindow(): void {
+    let windowMs: number | undefined
+    const consider = (geometry: BlockClassifierGeometry | undefined): void => {
+      if (geometry?.trackKind !== 'video' || geometry.mode !== 'classifying') return
+      const { ticks, timescale } = geometry.keyframeInterval
+      const ms = (ticks / timescale) * 1000
+      if (Number.isFinite(ms) && ms > 0 && (windowMs === undefined || ms > windowMs)) windowMs = ms
+    }
+    for (const geometry of this.#streamGeometries.values()) consider(geometry)
+    for (const config of this.#trackConfigs.values()) consider(config.geometry)
+    this.#deliveryGaps.setWindowMs(windowMs)
+  }
+
+  /**
+   * The multicast late-symbol wait: the block span plus the larger of the
+   * catalog's signaled tolerance and the receiver-measured delivery gap.
+   *
+   * `config.timeoutMs` already is span + `fec.reorderToleranceMs` (or the
+   * wider envelope configure() applies), so it stays the floor; the measured
+   * gap widens it only when the path stalls for longer than the catalog
+   * allowed for. Datagram delivery only: an ordered relay settles blocks by
+   * stream order and never feeds the estimator.
+   */
+  #multicastWaitMs(config: ResolvedFECTrackConfig): number {
+    return this.#waitForGapMs(config, this.#deliveryGaps.peakGapMs(performance.now()))
+  }
+
+  /**
+   * The widest #multicastWaitMs can become: the estimator reports at most its
+   * catalog window, so this is a catalog quantity that no measurement moves.
+   */
+  #maxMulticastWaitMs(config: ResolvedFECTrackConfig): number {
+    return this.#waitForGapMs(config, this.#deliveryGaps.windowMs ?? 0)
+  }
+
+  #waitForGapMs(config: ResolvedFECTrackConfig, gapMs: number): number {
+    if (!(gapMs > 0) || !(config.interleaveDepthMs > 0)) return config.timeoutMs
+    return Math.max(config.timeoutMs, Math.ceil(config.interleaveDepthMs + gapMs))
+  }
+
+  #repairDeadlineMs(
+    config: ResolvedFECTrackConfig,
+    waitMs = this.#multicastWaitMs(config),
+  ): number {
+    const halfFailBoundMs = Math.ceil(waitMs / 2)
+    if (
+      config.k > 0 &&
+      config.interleaveDepthMs >= MIN_INTERLEAVE_DEPTH_MS &&
+      config.fps !== undefined &&
+      Number.isFinite(config.fps) &&
+      config.fps > 0
+    ) {
+      const mediaUnitMs = 1000 / config.fps
+      const interleaveUnits = deriveFecInterleaveDepth(
+        config.interleaveDepthMs,
+        mediaUnitMs,
+      )
+      const sourceHorizonMs = Math.ceil(config.k * interleaveUnits * mediaUnitMs)
+      if (sourceHorizonMs < waitMs) return sourceHorizonMs
+    }
+    return halfFailBoundMs
+  }
+
+  /**
+   * One block lifetime: the inactivity fail bound plus the D-28 repair grace,
+   * at the widest wait the catalog allows (#maxMulticastWaitMs). Everything
+   * derived from it (terminal retention, the release gate's hold ceiling, the
+   * duplicate ledgers, the owed-cleanup bound) is compared across time, so it
+   * must not follow the live measurement.
+   */
+  #blockLifetimeMs(config: ResolvedFECTrackConfig): number {
+    const waitMs = this.#maxMulticastWaitMs(config)
+    return waitMs + this.#repairGraceMs(config, waitMs)
+  }
+
+  /**
+   * The lifetime at the live wait, capped at #blockLifetimeMs: lifetime is not
+   * monotone in the wait (the repair deadline switches from half the wait to
+   * the source horizon), so the cap is what keeps it inside the retention.
+   */
+  #liveBlockLifetimeMs(config: ResolvedFECTrackConfig): number {
+    const waitMs = this.#multicastWaitMs(config)
+    return Math.min(waitMs + this.#repairGraceMs(config, waitMs), this.#blockLifetimeMs(config))
+  }
+
+  #repairGraceMs(config: ResolvedFECTrackConfig, waitMs: number): number {
+    return Math.max(1, waitMs - this.#repairDeadlineMs(config, waitMs))
+  }
+
+  #armBlockTimeout(
+    sbn: number,
+    packetId: number,
+    catalogTrackName: string | undefined,
+    delayMs: number,
+  ): void {
+    const key = this.#blockKey(sbn, packetId, catalogTrackName)
+    const waitAtMs = performance.now() + Math.max(1, Math.ceil(delayMs))
+    // A held block's symbols (its own FETCH's repair symbols included) never
+    // carry its wait past the hold: the hold is its presentation deadline.
+    const holdAtMs = this.#repairHoldUntilMs.get(key)
+    this.#blockWaitDeadlinesMs.set(key, holdAtMs === undefined ? waitAtMs : Math.min(waitAtMs, holdAtMs))
+    this.#applyBlockDeadline(key, sbn, packetId, catalogTrackName)
+  }
+
+  /**
+   * Arm (or move) a block's one fail timer at the later of its multicast
+   * wait and its repair hold. Moving it later costs no timer operation: the
+   * armed timer wakes no later than the new deadline and re-arms for the
+   * remainder.
+   */
+  #applyBlockDeadline(
+    key: string,
+    sbn: number,
+    packetId: number,
+    catalogTrackName: string | undefined,
+  ): void {
+    const nowMs = performance.now()
+    const deadlineMs = Math.max(
+      this.#blockWaitDeadlinesMs.get(key) ?? nowMs + 1,
+      this.#repairHoldUntilMs.get(key) ?? -Infinity,
+    )
+    this.#activeBlockDeadlinesMs.set(key, deadlineMs)
+    const armed = this.#activeBlocks.get(key)
+    if (armed?.handle != null) {
+      if (armed.fireAtMs <= deadlineMs) return
+      clearTimeout(armed.handle)
+    }
+    const timer: DeadlineTimer = { handle: null, fireAtMs: deadlineMs }
+    const onFire = (): void => {
+      // clearTimeout() cannot retract a callback that the browser already
+      // moved onto its task queue. Only the timer that still owns this
+      // block's deadline may fail it or enqueue Worker cleanup.
+      if (this.#activeBlocks.get(key) !== timer) return
+      const currentDeadlineMs = this.#activeBlockDeadlinesMs.get(key)
+      const firedAtMs = performance.now()
+      if (currentDeadlineMs !== undefined && currentDeadlineMs > firedAtMs) {
+        timer.fireAtMs = currentDeadlineMs
+        timer.handle = setTimeout(onFire, Math.ceil(currentDeadlineMs - firedAtMs))
+        return
+      }
+      this.#activeBlocks.delete(key)
+      this.#activeBlockDeadlinesMs.delete(key)
+      this.#blockWaitDeadlinesMs.delete(key)
+      this.#repairHoldUntilMs.delete(key)
+      this.#traceLifecycle('timeout-queued', sbn, packetId, catalogTrackName)
+      this.#finalizeExpiredBlock(sbn, packetId, catalogTrackName)
+    }
+    timer.handle = setTimeout(onFire, Math.max(1, Math.ceil(deadlineMs - nowMs)))
+    this.#activeBlocks.set(key, timer)
+    this.#indexBlockKey(key, sbn, packetId)
+  }
+
+  /**
+   * Hand a block whose delivery is over to its decoder for finalization: the
+   * datagram deadline fired, or the ordered relay moved past it.
+   */
+  #finalizeExpiredBlock(
+    sbn: number,
+    packetId: number,
+    catalogTrackName: string | undefined,
+  ): void {
+    const key = this.#blockKey(sbn, packetId, catalogTrackName)
+    // A vanished block that never received a symbol holds no decoder state
+    // to clean up; waiting on a Worker acknowledgement would never settle.
+    if (this.#materializedBlocks.has(key) && !this.#blockPathCounts.has(key)) {
+      this.#failBlock(sbn, packetId, catalogTrackName)
+      return
+    }
+
+    // A block that began on the synchronous decoder remains owned by that
+    // decoder even if Worker setup completed later. Cleanup must follow the
+    // same ownership rule as source and repair symbol dispatch.
+    const syncOwner = this.#syncDecoderBlockOwners.get(key)
+    if (syncOwner) {
+      this.#routeSyncCleanup(syncOwner, sbn, packetId, catalogTrackName)
+      this.#failBlock(sbn, packetId, catalogTrackName)
+      return
+    }
+
+    const workerClient = this.#routableWorkerForPacket(packetId, catalogTrackName)
+    if (workerClient) {
+      this.#pendingWorkerCleanups.add(key)
+      this.#pendingWorkerCleanupClients.set(key, workerClient)
+      this.#boundOwedCleanup(key, packetId, workerClient)
+      workerClient.cleanup(sbn)
+    } else {
+      const decoder = this.#decoderForPacket(packetId, catalogTrackName)?.client
+      if (decoder) {
+        this.#routeSyncCleanup(decoder, sbn, packetId, catalogTrackName)
+        this.#failBlock(sbn, packetId, catalogTrackName)
+      } else {
+        this.#failBlock(sbn, packetId, catalogTrackName)
+      }
+    }
+  }
+
+  /**
+   * Upsert one packetId's track configuration. With `catalogTrackName`, the
+   * classifier geometry in `config` is that stream's own and is kept per
+   * stream; every other field stays per packetId.
+   */
+  #upsertTrackConfig(
+    packetId: number,
+    config: FECManagerConfig,
+    catalogTrackName?: string,
+  ): ResolvedFECTrackConfig {
+    const previous = this.#trackConfigs.get(packetId) ?? this.#defaultTrackConfig()
+    const streamScopedGeometry =
+      catalogTrackName !== undefined && config.geometry !== undefined ? config.geometry : undefined
+    if (streamScopedGeometry !== undefined) {
+      const { geometry: _streamGeometry, ...packetLevel } = config
+      config = packetLevel
+    }
+    const timingChanged =
+      config.k !== undefined ||
+      config.interleaveDepthMs !== undefined ||
+      config.fps !== undefined
+    if (config.blockProfile !== undefined) {
+      parseFecBlockProfile(config.blockProfile, `packetId=${packetId} fec.blockProfile`)
+    }
+    const blockProfile = config.blockProfile ?? previous.blockProfile
+    if (blockProfile === undefined) {
+      throw new Error(
+        `[FECManager] packetId=${packetId}: fec.blockProfile is required ` +
+          '("k-padded-v1" or "iso-ssbg1-v1"); configure the track from its catalog',
+      )
+    }
+    if (blockProfile === 'iso-ssbg1-v1') {
+      // iso-ssbg1-v1 block location keeps what it holds for a horizon derived
+      // from this packet's catalog block span (#isoRetentionBlocks): without
+      // one the locator would grow for the life of the session. The span is
+      // this packet's own; the manager-wide default is never borrowed.
+      const ownInterleaveDepthMs =
+        config.interleaveDepthMs ?? this.#trackConfigs.get(packetId)?.interleaveDepthMs
+      if (
+        ownInterleaveDepthMs === undefined ||
+        !Number.isFinite(ownInterleaveDepthMs) ||
+        ownInterleaveDepthMs < MIN_INTERLEAVE_DEPTH_MS
+      ) {
+        throw new Error(
+          `[FECManager] packetId=${packetId}: iso-ssbg1-v1 requires the catalog fec.interleaveDepthMs ` +
+            `(>= ${MIN_INTERLEAVE_DEPTH_MS} ms; got ${String(ownInterleaveDepthMs)}): it bounds how long ` +
+            'block location keeps stated blocks and held sources',
+        )
+      }
+    }
+    const next: ResolvedFECTrackConfig = {
+      blockProfile,
+      k: config.k ?? previous.k,
+      symbolSize:
+        config.symbolSize != null && config.symbolSize > 0
+          ? config.symbolSize
+          : previous.symbolSize,
+      interleaveDepthMs: config.interleaveDepthMs ?? previous.interleaveDepthMs,
+      fps: config.fps ?? previous.fps,
+      timeoutMs: config.timeoutMs ?? (timingChanged ? 0 : previous.timeoutMs),
+      ...((config.trackKind ?? previous.trackKind) === undefined
+        ? {}
+        : { trackKind: config.trackKind ?? previous.trackKind }),
+      ...((config.codec ?? previous.codec) === undefined
+        ? {}
+        : { codec: config.codec ?? previous.codec }),
+      ...((config.geometry ?? previous.geometry) === undefined
+        ? {}
+        : { geometry: config.geometry ?? previous.geometry }),
+    }
+    next.timeoutMs = this.#computeTimeout(next)
+    if (this.#multicastSymbolDelivery === 'ordered-relay') {
+      // Error on bad init: an ordered-relay stream settles its blocks by the
+      // decoder's interleave horizon, which this geometry must define.
+      this.#orderedHorizonBlocksFor(packetId, next)
+    }
+    if (
+      previous.blockProfile !== undefined &&
+      (previous.blockProfile !== blockProfile || (blockProfile === 'iso-ssbg1-v1' && previous.k !== next.k))
+    ) {
+      // A different profile, or a different maximum K under iso-ssbg1-v1, is
+      // a different block geometry: the stream's blocks must not be read
+      // under the old one's rules.
+      this.#dropIsoLocators(packetId)
+    }
+    this.#trackConfigs.set(packetId, next)
+    this.#refreshDeliveryGapWindow()
+    let policyChanged =
+      (config.geometry !== undefined &&
+        JSON.stringify(config.geometry) !== JSON.stringify(previous.geometry)) ||
+      (config.trackKind !== undefined && config.trackKind !== previous.trackKind)
+    if (streamScopedGeometry !== undefined) {
+      const streamKey = this.#streamKey(packetId, catalogTrackName)
+      if (JSON.stringify(streamScopedGeometry) !== JSON.stringify(this.#streamGeometries.get(streamKey))) {
+        this.#streamGeometries.set(streamKey, streamScopedGeometry)
+        this.#refreshDeliveryGapWindow()
+        policyChanged = true
+      }
+    }
+    if (policyChanged) {
+      // A new catalog epoch for this packet: every classifier whose geometry
+      // changed rebuilds from the new one on its next symbol and announces
+      // its mode again. A stream with its own geometry is untouched by a
+      // sibling's change, but the first stream-scoped geometry on a packet
+      // does change the siblings that have none (stream-geometry-absent).
+      this.#bumpEpoch(packetId)
+      for (const [key, classifier] of [...this.#classifiers]) {
+        if (!this.#belongsToPacket(key, packetId)) continue
+        const stream = this.#parseStreamKey(key)
+        const geometry = this.#geometryFor(stream.packetId, stream.catalogTrackName)
+        if (JSON.stringify(geometry) === JSON.stringify(classifier.geometry)) continue
+        this.#classifiers.delete(key)
+        // Blocks still unresolved lose the evidence their class rested on:
+        // under the fresh classifier they read `unknown`. Say so, so a queued
+        // or running P2 repair for a former delta block is promoted to P0
+        // instead of silently keeping a priority its class no longer has.
+        this.#applyClassifierChanges(stream.packetId, stream.catalogTrackName, classifier.retire())
+      }
+    }
+    return next
+  }
+
+  #normalizeSymbolData(packetId: number, data: Uint8Array): Uint8Array {
+    const symbolSize = this.symbolSizeForPacket(packetId)
+    if (symbolSize <= 0 || data.byteLength === symbolSize) return data
+    const normalized = new Uint8Array(symbolSize)
+    normalized.set(data.subarray(0, symbolSize))
+    return normalized
+  }
+
+  #blockKeysFor(sbn: number, packetId?: number, catalogTrackName?: string): string[] {
+    if (packetId != null && catalogTrackName !== undefined) {
+      return [this.#blockKey(sbn, packetId, catalogTrackName)]
+    }
+
+    // Every key held by a block-keyed lookup set is indexed under its SBN
+    // (#indexBlockKey), so this visits only the handful of streams sharing the
+    // SBN instead of every retained block. #cleanlyCompletedBlocks is a subset
+    // of #completedBlocks and needs no separate check.
+    const keys: string[] = []
+    const candidates = this.#blockKeysBySbn.get(sbn)
+    if (candidates) {
+      for (const [key, keyPacketId] of candidates) {
+        if (packetId !== undefined && keyPacketId !== packetId) continue
+        if (!this.#isBlockKeyHeld(key)) {
+          candidates.delete(key)
+          continue
+        }
+        keys.push(key)
+      }
+      if (candidates.size === 0) this.#blockKeysBySbn.delete(sbn)
+    }
+
+    if (packetId !== undefined) {
+      if (keys.length === 0) return [this.#blockKey(sbn, packetId)]
+      return keys.length === 1 ? keys : []
+    }
+    return keys.length > 0 ? keys : [this.#blockKey(sbn, 0, catalogTrackName)]
+  }
+
+  // -----------------------------------------------------------------------
+  // Accessors
+  // -----------------------------------------------------------------------
+
+  /** Internal state for diagnostics — not part of the public stats API. */
+  get diagnostics() {
+    return {
+      timeoutMs: this.#fecTimeoutMs,
+      activeBlocks: this.#activeBlocks.size,
+      completedBlocks: this.#completedBlocks.size,
+      cleanlyCompletedBlocks: this.#cleanlyCompletedBlocks.size,
+      pendingCounts: Object.fromEntries(this.#blockSourceCounts),
+      fpsDetected: this.#fpsDetected,
+      interleaveDepthMs: this.#fecInterleaveDepthMs,
+      startupAlignedPackets: this.#packetIdsForStreamKeys(this.#startupAlignedPackets),
+      startupPartialBlocks: this.#startupPartialBlocks.size,
+      startupRepairReadyPackets: this.#packetIdsForStreamKeys(this.#startupRepairReadyPackets),
+      startupRepairFailOpenPackets: this.#packetIdsForStreamKeys(this.#startupRepairFailOpenPackets),
+      pendingWorkerCleanups: this.#pendingWorkerCleanups.size,
+      decoderUnavailableEvents: this.#decoderUnavailableEvents,
+      repairTrackedBlocks: this.#blockRepairRsIds.size,
+      multicastSymbolDelivery: this.#multicastSymbolDelivery,
+      orderedFrontiers: Object.fromEntries(this.#orderedFrontiers),
+      orderedPendingBlocks: [...this.#orderedPendingBlocks.values()]
+        .reduce((total, pending) => total + pending.size, 0),
+      lifecycleTrace: this.#lifecycleTrace.map((entry) => ({ ...entry })),
+    }
+  }
+
+  get fecStats(): FecStats {
+    const s = this.#fecStats
+    const affected = s.blocksRecovered + s.blocksFailed
+    const total = s.blocksClean + affected
+    const tracks = [...this.#fecTrackStats.entries()]
+      .sort(([left], [right]) => left - right)
+      .map(([packetId, stats]) => {
+        const trackAffected = stats.blocksRecovered + stats.blocksFailed
+        const trackTotal = stats.blocksClean + trackAffected
+        return {
+          ...stats,
+          packetId,
+          blocksComplete: trackTotal,
+          k: this.#resolveTrackConfig(packetId).k,
+          recoveryRate: trackAffected > 0
+            ? (stats.blocksRecovered / trackAffected) * 100
+            : 100,
+          packetLossRate: trackTotal > 0 ? (trackAffected / trackTotal) * 100 : 0,
+        }
+      })
+    return {
+      ...s,
+      blocksComplete: total,
+      mixedPathBlocks: Array.from(this.#blockPathCounts.values()).filter(
+        (block) => block.multicastSymbols > 0 && block.moqSymbols > 0,
+      ).length,
+      recentBlockPathCounts: Array.from(this.#blockPathCounts.values()).slice(-24),
+      k: this.#fecK,
+      // True recovery rate: of blocks that HAD loss, how many were recovered?
+      recoveryRate: affected > 0 ? (s.blocksRecovered / affected) * 100 : 100,
+      packetLossRate: total > 0 ? (affected / total) * 100 : 0,
+      tracks,
+      workers: [...this.#fecWorkerStats.entries()]
+        .sort(([left], [right]) => left - right)
+        .map(([packetId, stats]) => ({
+          ...stats,
+          config: {
+            ...stats.config,
+            resolution: stats.config.resolution ? { ...stats.config.resolution } : undefined,
+          },
+          blocks: stats.blocks.map((block) => ({ ...block })),
+          decoder: stats.decoder ? { ...stats.decoder } : undefined,
+          altaFailedDetails: stats.altaFailedDetails?.map((detail) => ({ ...detail })),
+          packetId,
+        })),
+      repairSymbolSizeMismatches: this.#repairSymbolSizeMismatchCount,
+      workerErrors: Object.fromEntries(this.#workerErrorCounts),
+    }
+  }
+
+  /**
+   * Observe Worker-backed per-track snapshots without taking ownership of the
+   * legacy single-callback slot. Infrastructure diagnostics and a player may
+   * therefore consume the same source event without wrapping or replacing one
+   * another's callback.
+   */
+  addFecStatsObserver(
+    observer: (packetId: number, stats: FecTrackStats) => void,
+  ): () => void {
+    this.#fecStatsObservers.add(observer)
+    return () => this.#fecStatsObservers.delete(observer)
+  }
+
+  /** Start a new multicast transport join without discarding track/decoder state. */
+  beginMulticastJoin(): void {
+    // A new subscription is a new relay: stream order is only defined within
+    // one. Blocks still pending from the last join settle once the new
+    // stream's own frontier passes them.
+    this.#orderedFrontiers.clear()
+    this.#startupAlignedPackets.clear()
+    this.#startupPartialBlocks.clear()
+    this.#startupRequireRepairReady = true
+    this.#startupRepairReadyPackets.clear()
+    this.#startupRepairBoundaryCounts.clear()
+    this.#startupRepairFailOpenPackets.clear()
+  }
+
+  /** How the multicast leg currently delivers symbols. */
+  get multicastSymbolDelivery(): MulticastSymbolDelivery {
+    return this.#multicastSymbolDelivery
+  }
+
+  /**
+   * Declare how the multicast leg delivers symbols (see
+   * MulticastSymbolDelivery). The multicast provider owns this fact:
+   * MulticastManager applies what the window.multicast subscription declares
+   * on every join, and a consumer feeding packets itself declares its own leg.
+   *
+   * Switching to 'ordered-relay' requires every configured track to define
+   * its interleave horizon and throws otherwise. Switching back to 'datagram'
+   * gives every block awaiting ordered settlement the datagram inactivity
+   * deadline from now.
+   */
+  setMulticastSymbolDelivery(delivery: MulticastSymbolDelivery): void {
+    if (!isMulticastSymbolDelivery(delivery)) {
+      throw new Error(
+        `[FECManager] multicast symbol delivery must be 'datagram' or ` +
+          `'ordered-relay', got ${String(delivery)}`,
+      )
+    }
+    if (delivery === this.#multicastSymbolDelivery) return
+    // A different delivery path: gaps measured on the old one say nothing
+    // about it (and ordered-relay never feeds the estimator).
+    this.#deliveryGaps.reset()
+    if (delivery === 'ordered-relay') {
+      for (const [packetId, config] of this.#trackConfigs) {
+        this.#orderedHorizonBlocksFor(packetId, config)
+      }
+      this.#multicastSymbolDelivery = delivery
+      return
+    }
+    this.#multicastSymbolDelivery = delivery
+    const pending = [...this.#orderedPendingBlocks.values()]
+      .flatMap((blocks) => [...blocks.values()])
+    this.#orderedPendingBlocks.clear()
+    this.#orderedFrontiers.clear()
+    for (const key of pending) {
+      const block = this.#parseBlockKey(key)
+      this.noteBlockActivity(block.sbn, block.packetId, block.catalogTrackName)
+    }
+  }
+
+  /** Begin a fresh decode epoch for one physical stream. */
+  resetTrack(packetId: number, catalogTrackName: string): void {
+    if (!Number.isInteger(packetId) || packetId < 0) {
+      throw new Error(`[FECManager] invalid packetId for reset: ${packetId}`)
+    }
+    if (!catalogTrackName) {
+      throw new Error('[FECManager] catalogTrackName is required for track reset')
+    }
+    const resetMap = <T>(map: Map<string, T>): void => {
+      for (const key of map.keys()) {
+        if (!this.#belongsToStream(key, packetId, catalogTrackName)) continue
+        map.delete(key)
+      }
+    }
+    const resetTimerMap = (map: Map<string, DeadlineTimer | null>): void => {
+      for (const [key, timer] of map) {
+        if (!this.#belongsToStream(key, packetId, catalogTrackName)) continue
+        if (timer?.handle != null) clearTimeout(timer.handle)
+        map.delete(key)
+      }
+    }
+    const resetSet = (set: Set<string>): void => {
+      for (const key of set) {
+        if (this.#belongsToStream(key, packetId, catalogTrackName)) set.delete(key)
+      }
+    }
+
+    resetTimerMap(this.#activeBlocks)
+    resetTimerMap(this.#repairDeadlines)
+    resetMap(this.#activeBlockDeadlinesMs)
+    resetMap(this.#blockWaitDeadlinesMs)
+    resetMap(this.#repairHoldUntilMs)
+    resetMap(this.#repairDeadlineAtMs)
+    // Queued terminal records of this stream no longer match an expiry entry,
+    // so the retirement sweep skips them and cannot retire a reused key early.
+    resetMap(this.#terminalExpiryMs)
+    resetMap(this.#pendingWorkerCleanupClients)
+    for (const key of [...this.#pendingWorkerCleanupBounds.keys()]) {
+      if (this.#belongsToStream(key, packetId, catalogTrackName)) this.#clearOwedCleanupBound(key)
+    }
+    resetMap(this.#blockSourceCounts)
+    resetMap(this.#blockSourceEsis)
+    resetMap(this.#blockAuthoredLengths)
+    resetMap(this.#blockRepairRsIds)
+    resetMap(this.#blockPathCounts)
+    resetMap(this.#blockAnchorsMs)
+    resetMap(this.#blockCatalogTrackNames)
+    resetMap(this.#syncDecoderBlockOwners)
+    resetMap(this.#startupRepairBoundaryCounts)
+    resetMap(this.#orderedFrontiers)
+    resetMap(this.#orderedPendingBlocks)
+    resetSet(this.#pendingWorkerCleanups)
+    resetSet(this.#completedBlocks)
+    resetSet(this.#cleanlyCompletedBlocks)
+    resetSet(this.#repairRequestedBlocks)
+    resetSet(this.#workerRecoveredBlocks)
+    resetSet(this.#startupAlignedPackets)
+    resetSet(this.#startupPartialBlocks)
+    resetSet(this.#startupRepairReadyPackets)
+    resetSet(this.#startupRepairFailOpenPackets)
+    resetSet(this.#seenSymbols)
+    resetSet(this.#failedBlocks)
+    resetSet(this.#repairedBlocks)
+    resetSet(this.#materializedBlocks)
+    resetMap(this.#resolvedBlockClasses)
+    resetMap(this.#highestSbn)
+    resetMap(this.#isoLocators)
+    resetMap(this.#sourceAnchors)
+    this.#classifiers.delete(this.#streamKey(packetId, catalogTrackName))
+    this.#bumpEpoch(packetId)
+    for (const [sbn, keys] of this.#blockKeysBySbn) {
+      for (const key of keys.keys()) {
+        if (this.#belongsToStream(key, packetId, catalogTrackName)) keys.delete(key)
+      }
+      if (keys.size === 0) this.#blockKeysBySbn.delete(sbn)
+    }
+
+    const decoderClients = new Set<WasmFecDecoder>()
+    for (const [key, entry] of this.#fecDecoders) {
+      if (this.#belongsToStream(key, packetId, catalogTrackName)) {
+        decoderClients.add(entry.client)
+      }
+    }
+    const clients = new Set<object>()
+    for (const client of decoderClients) {
+      if (
+        typeof client.flush === 'function' &&
+        typeof client.reset_stats === 'function'
+      ) {
+        try {
+          client.flush()
+          client.reset_stats()
+          clients.add(client)
+        } catch {
+          this.#discardFecDecoderClient(client)
+        }
+      } else {
+        this.#discardFecDecoderClient(client)
+      }
+    }
+    for (const [key, client] of [...this.#workerClients]) {
+      if (!this.#belongsToStream(key, packetId, catalogTrackName)) continue
+      if (client.disposed === true) {
+        // reset() throws on a disposed client; evict it (reporting the
+        // decoder unavailable) instead of resetting a Worker that is gone.
+        this.#evictDisposedWorker(client)
+        continue
+      }
+      client.reset()
+      clients.add(client)
+    }
+    for (const client of clients) this.#resetDecoderBlockOwners(client, catalogTrackName)
+  }
+
+  /**
+   * Retire one packet ID, drop-only: forget every stream on it (block
+   * ledgers, deadlines and their timers, repair holds, terminal records,
+   * classifiers, stream geometry), its per-packet configuration and
+   * statistics, and take its decoders out of routing.
+   *
+   * This is the end of the packet ID's streams, not a new epoch of them (that
+   * is resetTrack): afterwards isTrackConfigured() is false and nothing about
+   * it remains until it is configured again. Nothing is reported, because
+   * nothing happened to the media: no block fails, recovers or resolves, no
+   * repair resolves, and no decoder becomes "unavailable" (a retired stream
+   * has no symbols left to decode, so a decoder-unavailable event would
+   * describe lost protection that no stream suffers). The epoch still
+   * advances, so a gap decision made before the retirement never matches a
+   * stream later configured on the same packet ID.
+   *
+   * Decoder and Worker clients stay caller-owned: each is flushed or reset so
+   * it holds no block of the retired streams, then released from routing;
+   * dispose it after this returns. Cumulative totals in fecStats keep what
+   * the retired streams contributed.
+   */
+  releasePacket(packetId: number): void {
+    if (!Number.isInteger(packetId) || packetId < 0) {
+      throw new Error(`[FECManager] invalid packetId for release: ${packetId}`)
+    }
+    const onPacket = (key: string): boolean => this.#belongsToPacket(key, packetId)
+    const dropMap = <T>(map: Map<string, T>): void => {
+      for (const key of [...map.keys()]) if (onPacket(key)) map.delete(key)
+    }
+    const dropTimerMap = (map: Map<string, DeadlineTimer | null>): void => {
+      for (const [key, timer] of [...map]) {
+        if (!onPacket(key)) continue
+        if (timer?.handle != null) clearTimeout(timer.handle)
+        map.delete(key)
+      }
+    }
+    const dropSet = (set: Set<string>): void => {
+      for (const key of [...set]) if (onPacket(key)) set.delete(key)
+    }
+
+    dropTimerMap(this.#activeBlocks)
+    dropTimerMap(this.#repairDeadlines)
+    for (const key of [...this.#pendingWorkerCleanupBounds.keys()]) {
+      if (onPacket(key)) this.#clearOwedCleanupBound(key)
+    }
+    dropMap(this.#activeBlockDeadlinesMs)
+    dropMap(this.#blockWaitDeadlinesMs)
+    dropMap(this.#repairHoldUntilMs)
+    dropMap(this.#repairDeadlineAtMs)
+    dropMap(this.#terminalExpiryMs)
+    dropMap(this.#pendingWorkerCleanupClients)
+    dropMap(this.#blockSourceCounts)
+    dropMap(this.#blockSourceEsis)
+    dropMap(this.#blockAuthoredLengths)
+    dropMap(this.#blockRepairRsIds)
+    dropMap(this.#blockPathCounts)
+    dropMap(this.#blockAnchorsMs)
+    dropMap(this.#blockCatalogTrackNames)
+    dropMap(this.#syncDecoderBlockOwners)
+    dropMap(this.#startupRepairBoundaryCounts)
+    dropMap(this.#orderedFrontiers)
+    dropMap(this.#orderedPendingBlocks)
+    dropMap(this.#resolvedBlockClasses)
+    dropMap(this.#highestSbn)
+    dropMap(this.#isoLocators)
+    dropMap(this.#sourceAnchors)
+    dropMap(this.#classifiers)
+    dropMap(this.#streamGeometries)
+    dropSet(this.#pendingWorkerCleanups)
+    dropSet(this.#completedBlocks)
+    dropSet(this.#cleanlyCompletedBlocks)
+    dropSet(this.#repairRequestedBlocks)
+    dropSet(this.#workerRecoveredBlocks)
+    dropSet(this.#startupAlignedPackets)
+    dropSet(this.#startupPartialBlocks)
+    dropSet(this.#startupRepairReadyPackets)
+    dropSet(this.#startupRepairFailOpenPackets)
+    dropSet(this.#seenSymbols)
+    dropSet(this.#failedBlocks)
+    dropSet(this.#repairedBlocks)
+    dropSet(this.#materializedBlocks)
+    for (const [sbn, keys] of [...this.#blockKeysBySbn]) {
+      for (const [key, keyPacketId] of [...keys]) {
+        if (keyPacketId === packetId) keys.delete(key)
+      }
+      if (keys.size === 0) this.#blockKeysBySbn.delete(sbn)
+    }
+    this.#terminalQueues.delete(packetId)
+
+    // Bookkeeping first: a decoder or Worker client whose teardown throws must
+    // not leave the packet ID configured or its epoch unbumped, or a gap
+    // decision made before the release could match a stream later configured
+    // on the same packet ID.
+    this.#trackConfigs.delete(packetId)
+    this.#fecTrackStats.delete(packetId)
+    this.#fecWorkerStats.delete(packetId)
+    this.#bumpEpoch(packetId)
+    // The retired stream's keyframe cadence no longer widens the gap window.
+    // The delivery-gap estimator's per-packet sequence is kept: it measures
+    // the link, which the retired packet ID's datagrams still describe while
+    // a rendition-stable allow-list keeps delivering them.
+    this.#refreshDeliveryGapWindow()
+
+    for (const [key, entry] of [...this.#fecDecoders]) {
+      if (!onPacket(key)) continue
+      this.#fecDecoders.delete(key)
+      this.#decoderBlockOwners.delete(entry.client)
+      try {
+        entry.client.flush?.()
+      } catch {
+        // The client is leaving routing either way; a decoder that cannot
+        // flush holds nothing this manager will ask it for again.
+      }
+    }
+    for (const [key, client] of [...this.#workerClients]) {
+      if (!onPacket(key)) continue
+      this.#workerClients.delete(key)
+      this.#decoderBlockOwners.delete(client)
+      this.#releasedWorkerClients.add(client)
+      try {
+        if (client.disposed !== true) client.reset()
+      } catch {
+        // Already out of routing, and its late messages are ignored
+        // (#releasedWorkerClients); a Worker that cannot reset holds nothing
+        // this manager will ask it for again.
+      }
+    }
+  }
+
+  /** Record a transport symbol and reject later duplicates of the same packetId/SBN/ESI. */
+  feedSymbolFromSource(
+    packetId: number,
+    sbn: number,
+    esi: number,
+    _data: Uint8Array,
+    source: FecSymbolSource,
+    catalogTrackName?: string,
+  ): boolean {
+    const blockKey = this.#blockKey(sbn, packetId, catalogTrackName)
+    const streamKey = this.#streamKey(packetId, catalogTrackName)
+    if (source === 'multicast' && this.#multicastSymbolDelivery === 'ordered-relay') {
+      // Every multicast symbol is a stream position on an ordered relay, even
+      // one refused below as a join partial or a duplicate.
+      this.#advanceOrderedFrontier(streamKey, sbn, packetId, catalogTrackName)
+    }
+    const k = this.kForPacket(packetId)
+    // iso-ssbg1-v1 repair ESIs start at the block's own SSB_length (K'), which
+    // its locator states; k-padded-v1 repair ESIs start at K.
+    const sourceSymbols = this.#isIso(packetId)
+      ? this.#isoLocatorFor(packetId, catalogTrackName).blockAt(sbn)?.length ?? k
+      : k
+    const isSourceSymbol = esi >= 0 && esi < sourceSymbols
+    const isStartupPartial = this.#startupPartialBlocks.has(blockKey)
+    const isReadyMulticastRepair =
+      this.#startupRequireRepairReady &&
+      source === 'multicast' &&
+      !isSourceSymbol &&
+      this.#startupRepairReadyPackets.has(streamKey)
+    const awaitingMulticastRepair =
+      this.#startupRequireRepairReady &&
+      source === 'multicast' &&
+      !this.#startupRepairReadyPackets.has(streamKey) &&
+      !this.#startupRepairFailOpenPackets.has(streamKey)
+    if (awaitingMulticastRepair) {
+      if (!isSourceSymbol) {
+        this.#startupRepairReadyPackets.add(streamKey)
+        this.#startupRepairBoundaryCounts.delete(streamKey)
+        this.#markStartupPartial(blockKey)
+        return false
+      }
+
+      if (esi === 0) {
+        const boundaries = (this.#startupRepairBoundaryCounts.get(streamKey) ?? 0) + 1
+        this.#startupRepairBoundaryCounts.set(streamKey, boundaries)
+        if (boundaries >= STARTUP_REPAIR_WAIT_SOURCE_BOUNDARIES) {
+          this.#startupRepairBoundaryCounts.delete(streamKey)
+          this.#startupRepairFailOpenPackets.add(streamKey)
+        } else {
+          this.#markStartupPartial(blockKey)
+          return false
+        }
+      } else {
+        this.#markStartupPartial(blockKey)
+        return false
+      }
+    }
+    if (isSourceSymbol && esi === 0) {
+      // ESI=0 establishes a complete source boundary for this SBN. Remove
+      // only this block: other interleaved SBNs may still be join partials.
+      this.#startupPartialBlocks.delete(blockKey)
+      this.#startupAlignedPackets.add(streamKey)
+    } else if (
+      (isStartupPartial && !isReadyMulticastRepair) ||
+      (!this.#startupAlignedPackets.has(streamKey) && !isReadyMulticastRepair)
+    ) {
+      this.#markStartupPartial(blockKey)
+      return false
+    }
+
+    // A completed block remains authoritative after its individual symbol
+    // identities age out of the bounded #seenSymbols cache. Without this
+    // guard, a delayed copy from the other transport can recreate the block
+    // inside a Worker decoder; that orphan never receives the full source and
+    // repair set, so cleanup later reports a false failure/green fill.
+    if (this.#completedBlocks.has(blockKey)) {
+      this.#fecStats.duplicateSymbols++
+      this.#statsForPacket(packetId).duplicateSymbols++
+      return false
+    }
+
+    const symbolKey = `${blockKey}:${esi}`
+    if (this.#seenSymbols.has(symbolKey)) {
+      this.#fecStats.duplicateSymbols++
+      this.#statsForPacket(packetId).duplicateSymbols++
+      return false
+    }
+    this.#seenSymbols.add(symbolKey)
+
+    const counts = this.#blockPathCounts.get(blockKey) ?? {
+      packetId,
+      sbn,
+      ...(catalogTrackName === undefined ? {} : { catalogTrackName }),
+      multicastSymbols: 0,
+      moqSymbols: 0,
+      complete: false,
+    }
+    // The block's absolute anchor (fecBlockDeadlineMs): the receiver-local
+    // time of its first accepted symbol, from which its presentation deadline
+    // is measured.
+    if (!this.#blockAnchorsMs.has(blockKey)) this.#blockAnchorsMs.set(blockKey, performance.now())
+    if (source === 'multicast') counts.multicastSymbols++
+    else counts.moqSymbols++
+    this.#blockPathCounts.set(blockKey, counts)
+    this.#observeBlockCatalogTrackName(blockKey, sbn, packetId, catalogTrackName)
+
+    // Keep the newest entries of each bounded cache. Deleting the oldest in
+    // place keeps exactly the entries a slice(-n) rebuild would, without
+    // copying the whole collection into an array on the page thread.
+    if (this.#seenSymbols.size > 4096) {
+      dropOldest(this.#seenSymbols, this.#seenSymbols.size - 2048)
+    }
+    if (this.#blockPathCounts.size > 512) {
+      dropOldest(this.#blockPathCounts, this.#blockPathCounts.size - 256)
+    }
+    if (this.#blockAnchorsMs.size > 512) {
+      dropOldest(this.#blockAnchorsMs, this.#blockAnchorsMs.size - 256)
+    }
+    if (this.#blockCatalogTrackNames.size > 512) {
+      for (const key of dropOldest(
+        this.#blockCatalogTrackNames,
+        this.#blockCatalogTrackNames.size - 256,
+      )) {
+        this.#unindexBlockKey(key)
+      }
+    }
+
+    return true
+  }
+
+  #observeBlockCatalogTrackName(
+    blockKey: string,
+    sbn: number,
+    packetId: number,
+    catalogTrackName?: string,
+  ): void {
+    if (catalogTrackName === undefined) return
+    if (!this.#blockCatalogTrackNames.has(blockKey)) {
+      this.#blockCatalogTrackNames.set(blockKey, catalogTrackName)
+      this.#indexBlockKey(blockKey, sbn, packetId)
+      return
+    }
+    if (this.#blockCatalogTrackNames.get(blockKey) !== catalogTrackName) {
+      this.#blockCatalogTrackNames.set(blockKey, null)
+    }
+  }
+
+  /** Exact catalog identity retained for async recovery, if unambiguous. */
+  catalogTrackNameForBlock(
+    sbn: number,
+    packetId: number,
+    catalogTrackName?: string,
+  ): string | undefined {
+    if (catalogTrackName !== undefined) {
+      return this.#blockCatalogTrackNames.get(
+        this.#blockKey(sbn, packetId, catalogTrackName),
+      ) ?? undefined
+    }
+    const names = new Set<string>()
+    for (const [key, name] of this.#blockCatalogTrackNames) {
+      const block = this.#parseBlockKey(key)
+      if (block.packetId === packetId && block.sbn === sbn && name !== null) names.add(name)
+    }
+    return names.size === 1 ? [...names][0] : undefined
+  }
+
+  #markStartupPartial(blockKey: string): void {
+    this.#startupPartialBlocks.add(blockKey)
+    if (this.#startupPartialBlocks.size > 128) {
+      this.#startupPartialBlocks = new Set(
+        Array.from(this.#startupPartialBlocks).slice(-64),
+      )
+    }
+  }
+
+  /** Per-block state snapshot for FecBlockGrid visualization.
+   *  Returns the most recent blocks (active + recently completed). */
+  getBlockStates(): Array<{
+    sbn: number;
+    packetId?: number;
+    state: 'collecting' | 'complete' | 'failed';
+    sourceCount: number;
+    k: number;
+    progress: number;
+  }> {
+    const blocks: Array<{ sbn: number; packetId?: number; state: 'collecting' | 'complete' | 'failed'; sourceCount: number; k: number; progress: number }> = [];
+    // Active blocks (still collecting symbols)
+    for (const [key] of this.#activeBlocks) {
+      const { packetId, sbn } = this.#parseBlockKey(key);
+      const count = this.#blockSourceCounts.get(key) ?? 0;
+      const k = this.#blockAuthoredLengths.get(key) ?? this.kForPacket(packetId);
+      blocks.push({ sbn, packetId, state: 'collecting', sourceCount: count, k, progress: k > 0 ? Math.min(count / k, 1) : 0 });
+    }
+    // Recently completed blocks (last 16)
+    const completed = [...this.#completedBlocks].slice(-16);
+    for (const key of completed) {
+      const { packetId, sbn } = this.#parseBlockKey(key);
+      if (!this.#activeBlocks.has(key)) {
+        const k = this.kForPacket(packetId);
+        blocks.push({ sbn, packetId, state: 'complete', sourceCount: k, k, progress: 1 });
+      }
+    }
+    blocks.sort((a, b) => a.sbn - b.sbn || (a.packetId ?? 0) - (b.packetId ?? 0));
+    return blocks.slice(-24); // cap at 24 most recent
+  }
+
+  /** The raw WASM decoder for stats access (first registered decoder) */
+  get wasmDecoder(): WasmFecDecoder | null {
+    return this.#fecDecoders.values().next().value?.client ?? null
+  }
+
+  get k(): number { return this.#fecK }
+  kForPacket(packetId: number): number { return this.#resolveTrackConfig(packetId).k }
+  /** FEC symbol size in bytes. */
+  get symbolSize(): number { return this.#fecSymbolSize }
+  symbolSizeForPacket(packetId: number): number { return this.#resolveTrackConfig(packetId).symbolSize }
+  /** FEC block span in milliseconds (0 = no interleaving). */
+  get interleaveDepthMs(): number { return this.#fecInterleaveDepthMs }
+  interleaveDepthMsForPacket(packetId: number): number { return this.#resolveTrackConfig(packetId).interleaveDepthMs }
+  /**
+   * Record one multicast MMTP packet arrival (every packet of the leg, FEC
+   * symbol or not) for the delivery-gap measurement. `packetSequenceNumber`
+   * is the MMTP packet_sequence_number, which increments by one per packet of
+   * a packet_id: it is what separates a stall from a loss (see
+   * DeliveryGapEstimator). Datagram delivery only.
+   */
+  noteMulticastArrival(packetId: number, packetSequenceNumber: number): void {
+    if (this.#multicastSymbolDelivery !== 'datagram') return
+    this.#deliveryGaps.noteArrival(performance.now(), packetId, packetSequenceNumber)
+  }
+  /**
+   * Resolved per-track multicast late-symbol wait in milliseconds: the span
+   * plus the larger of the catalog tolerance and the measured delivery gap.
+   */
+  timeoutMsForPacket(packetId: number): number {
+    return this.#multicastWaitMs(this.#resolveTrackConfig(packetId))
+  }
+  /**
+   * Largest multicast delivery gap measured over the current window (ms), and
+   * that window (undefined: held since the last reset). Diagnostics.
+   */
+  multicastDeliveryGap(): { peakGapMs: number; windowMs: number | undefined } {
+    return {
+      peakGapMs: this.#deliveryGaps.peakGapMs(performance.now()),
+      windowMs: this.#deliveryGaps.windowMs,
+    }
+  }
+  /**
+   * Receiver-local time of a block's first accepted symbol, or undefined for
+   * a block no symbol reached (one materialized because a later SBN arrived).
+   */
+  blockAnchorAtMs(sbn: number, packetId: number, catalogTrackName?: string): number | undefined {
+    return this.#blockAnchorsMs.get(this.#blockKey(sbn, packetId, catalogTrackName))
+  }
+  /** Absolute fail deadline of a still-open block, or undefined. */
+  blockDeadlineAtMs(sbn: number, packetId: number, catalogTrackName?: string): number | undefined {
+    return this.#activeBlockDeadlinesMs.get(this.#blockKey(sbn, packetId, catalogTrackName))
+  }
+  /**
+   * Keep a block open until `untilAtMs` while a repair FETCH the scheduler
+   * admitted is in flight. Never shortens the multicast wait already armed;
+   * while set, the hold is the block's whole deadline, so no later symbol
+   * extends it. Returns false when the block is no longer open (resolved, or
+   * not yet tracked).
+   */
+  holdBlockForRepair(
+    sbn: number,
+    packetId: number,
+    catalogTrackName: string | undefined,
+    untilAtMs: number,
+  ): boolean {
+    if (!Number.isFinite(untilAtMs)) {
+      throw new Error(`[FECManager] repair hold must be a finite time (got ${untilAtMs})`)
+    }
+    const key = this.#blockKey(sbn, packetId, catalogTrackName)
+    if (!this.#activeBlocks.has(key)) return false
+    const previous = this.#repairHoldUntilMs.get(key)
+    if (previous !== undefined && previous >= untilAtMs) return true
+    // The hold absorbs the wait already armed, so it never shortens it.
+    this.#repairHoldUntilMs.set(
+      key,
+      Math.max(untilAtMs, this.#blockWaitDeadlinesMs.get(key) ?? -Infinity),
+    )
+    this.#applyBlockDeadline(key, sbn, packetId, catalogTrackName)
+    return true
+  }
+  /**
+   * Drop a block's repair hold: its FETCH ended without delivering. The block
+   * falls back to its multicast wait, which may already have passed.
+   */
+  releaseRepairHold(sbn: number, packetId: number, catalogTrackName?: string): void {
+    const key = this.#blockKey(sbn, packetId, catalogTrackName)
+    if (!this.#repairHoldUntilMs.delete(key) || !this.#activeBlocks.has(key)) return
+    this.#applyBlockDeadline(key, sbn, packetId, catalogTrackName)
+  }
+  /** Resolved per-track D-28 repair request deadline in milliseconds. */
+  repairDeadlineMsForPacket(packetId: number): number {
+    return this.#repairDeadlineMs(this.#resolveTrackConfig(packetId))
+  }
+  /**
+   * One block lifetime: the longest a block stays open after its last symbol
+   * (inactivity fail bound plus D-28 repair grace).
+   */
+  blockLifetimeMsForPacket(packetId: number): number {
+    return this.#blockLifetimeMs(this.#resolveTrackConfig(packetId))
+  }
+  /**
+   * How long a terminal (clean, recovered or failed) block stays authoritative,
+   * for late symbols and for the in-order release gate. It is also the gate's
+   * hold ceiling (MmtpRouter's holdLimitMs): a retired block reads back as
+   * untracked, which the gate counts as lost, so no frame may still be waiting
+   * on a block that can retire. The window is one interleave depth for a gap's
+   * last block to finish arriving, one block lifetime to fail it, and one more
+   * for an owed Worker cleanup that can keep a failing block pending. Every
+   * term comes from the track's catalog geometry; there is no separate cap.
+   */
+  terminalRetentionMsForPacket(packetId: number): number {
+    const config = this.#resolveTrackConfig(packetId)
+    return config.interleaveDepthMs + 2 * this.#blockLifetimeMs(config)
+  }
+  /** Remaining fetch budget for a specific repair-requested block. */
+  repairFetchTimeoutMsForBlock(
+    sbn: number,
+    packetId: number,
+    catalogTrackName?: string,
+  ): number {
+    const deadlineMs = this.#activeBlockDeadlinesMs.get(
+      this.#blockKey(sbn, packetId, catalogTrackName),
+    )
+    if (deadlineMs !== undefined) {
+      return Math.max(1, Math.ceil(deadlineMs - performance.now()))
+    }
+    const trackConfig = this.#resolveTrackConfig(packetId)
+    return Math.max(1, trackConfig.timeoutMs - this.#repairDeadlineMs(trackConfig))
+  }
+
+  /** True once configureTrack/setFecDecoder/setFecWorker configured this packetId. */
+  // -----------------------------------------------------------------------
+  // iso-ssbg1-v1 block location (BLO-35597 iso:2/iso:3)
+  // -----------------------------------------------------------------------
+
+  /** The configured `fec.blockProfile` of a packetId (undefined until configured). */
+  blockProfileForPacket(packetId: number): FecBlockProfile | undefined {
+    return this.#trackConfigs.get(packetId)?.blockProfile
+  }
+
+  #isIso(packetId: number): boolean {
+    return this.#trackConfigs.get(packetId)?.blockProfile === 'iso-ssbg1-v1'
+  }
+
+  #isoLocatorFor(packetId: number, catalogTrackName?: string): IsoBlockLocator<IsoHeldSource> {
+    const streamKey = this.#streamKey(packetId, catalogTrackName)
+    let locator = this.#isoLocators.get(streamKey)
+    if (!locator) {
+      locator = new IsoBlockLocator<IsoHeldSource>(this.kForPacket(packetId), this.#isoRetentionBlocks(packetId))
+      this.#isoLocators.set(streamKey, locator)
+    }
+    return locator
+  }
+
+  /**
+   * The locator a call is about to grow, with its retention brought up to
+   * date: the horizon follows catalog timing, which a later configuration
+   * (this track's or another video track's keyframe cadence) can change.
+   */
+  #growingIsoLocatorFor(packetId: number, catalogTrackName?: string): IsoBlockLocator<IsoHeldSource> {
+    const locator = this.#isoLocatorFor(packetId, catalogTrackName)
+    locator.retentionBlocks = this.#isoRetentionBlocks(packetId)
+    return locator
+  }
+
+  #dropIsoLocators(packetId: number): void {
+    for (const key of [...this.#isoLocators.keys()]) {
+      if (this.#belongsToPacket(key, packetId)) this.#isoLocators.delete(key)
+    }
+  }
+
+  /**
+   * The iso-ssbg1-v1 locator horizon in blocks: every block the manager can
+   * still hold terminal state for (`terminalRetentionMsForPacket`) over the
+   * block span, plus the block being filled, measured with the shared
+   * lower-bound metric so a retained block is never forgotten early. Every
+   * term is the packet's catalog geometry, which configuration validated
+   * (#upsertTrackConfig), so this never falls back: an underivable horizon
+   * throws rather than leave the locator without retention.
+   */
+  #isoRetentionBlocks(packetId: number): number {
+    const config = this.#trackConfigs.get(packetId)
+    if (config?.blockProfile !== 'iso-ssbg1-v1' || !(config.interleaveDepthMs >= MIN_INTERLEAVE_DEPTH_MS)) {
+      throw new Error(
+        `[FECManager] packetId=${packetId} has no iso-ssbg1-v1 block span to derive block-location retention from`,
+      )
+    }
+    const blocks = Math.ceil(this.terminalRetentionMsForPacket(packetId) / config.interleaveDepthMs) + 1
+    if (!Number.isSafeInteger(blocks) || blocks <= 0) {
+      throw new Error(`[FECManager] packetId=${packetId} iso-ssbg1-v1 retention of ${blocks} blocks is not derivable`)
+    }
+    return blocks
+  }
+
+  /** Whether an iso-ssbg1-v1 protected packet fits one ssbg_mode1 symbol (len + 2 <= T). */
+  isoSourceFits(packetId: number, packetLength: number): boolean {
+    return ssbg1FitsSymbol(packetLength, this.symbolSizeForPacket(packetId))
+  }
+
+  /**
+   * Locate an iso-ssbg1-v1 source by range membership in a block a repair
+   * already stated. Null while its block is unknown: hold it (holdIsoSource).
+   */
+  locateIsoSource(
+    packetId: number,
+    catalogTrackName: string | undefined,
+    ssId: number,
+  ): { sbn: number; esi: number } | null {
+    const located = this.#isoLocatorFor(packetId, catalogTrackName).locate(ssId)
+    return located === null ? null : { sbn: located.block.start, esi: located.esi }
+  }
+
+  /**
+   * Hold a first-arrival iso-ssbg1-v1 source whose block no repair has stated
+   * yet. Returns false for a later copy of an SS_ID already held.
+   */
+  holdIsoSource(
+    packetId: number,
+    catalogTrackName: string | undefined,
+    ssId: number,
+    source: IsoHeldSource,
+  ): boolean {
+    const locator = this.#growingIsoLocatorFor(packetId, catalogTrackName)
+    const evictedBefore = locator.heldEvicted
+    const held = locator.hold(ssId, source)
+    const evicted = locator.heldEvicted - evictedBefore
+    if (evicted > 0) {
+      const before = this.#isoHeldEvictedCount
+      this.#isoHeldEvictedCount += evicted
+      if (before < 5 || Math.floor(before / 100) !== Math.floor(this.#isoHeldEvictedCount / 100)) {
+        console.warn(
+          `[FECManager] packetId=${packetId} iso-ssbg1-v1 held-source cap (${locator.heldCapacity}) ` +
+            `evicted ${evicted} unplaced source(s); SS_IDs are not consecutive (C.5.2)`,
+        )
+      }
+    }
+    return held
+  }
+
+  /**
+   * Apply an iso-ssbg1-v1 repair symbol's `(SS_Start, SSB_length)`: states the
+   * block, and hands back the held sources it (and any repair-less span in
+   * front of it) now places. The caller feeds them as first-arrival sources,
+   * then the repair symbol, the order they had on the wire. A repair that
+   * contradicts a known block is refused (counted) and must be dropped.
+   */
+  placeIsoRepair(
+    packetId: number,
+    catalogTrackName: string | undefined,
+    ssStart: number,
+    ssbLength: number,
+  ): IsoRepairPlacement<IsoHeldSource> {
+    const placement = this.#growingIsoLocatorFor(packetId, catalogTrackName).placeRepair(ssStart, ssbLength)
+    if (placement.status !== 'placed') {
+      this.#isoRepairRefusedCount++
+      if (this.#isoRepairRefusedCount <= 5 || this.#isoRepairRefusedCount % 100 === 0) {
+        console.warn(`[FECManager] packetId=${packetId} iso-ssbg1-v1 repair refused (${placement.status}): ${placement.reason}`)
+      }
+      return placement
+    }
+    // A repair-less span has no repair to state its length, so it is known
+    // here: its sources make it clean exactly when all of them arrived. A
+    // stated block learns its SSB_length from its own repair symbol, fed
+    // after its placed sources exactly as on the wire (feedRepairSymbol).
+    if (placement.span !== undefined) {
+      const key = this.#blockKey(placement.span.block.start, packetId, catalogTrackName)
+      if (!this.#blockAuthoredLengths.has(key)) this.#blockAuthoredLengths.set(key, placement.span.block.length)
+    }
+
+    if (placement.span !== undefined && placement.span.placed.length === 0) {
+      // Every SS_ID of the span vanished, repair included: it resolves
+      // through its deadline like any vanished block.
+      this.#materializeBlock(placement.span.block.start, packetId, catalogTrackName, true)
+    }
+    return placement
+  }
+
+  /**
+   * Resolution of the SS_IDs strictly between two released frames' SS_IDs on
+   * an iso-ssbg1-v1 stream, for in-order frame release: null while a block
+   * that could hold them is pending or not yet stated by a repair, else the
+   * starts of the blocks that failed or vanished.
+   *
+   * `untracked` reads exactly as in the k-padded-v1 release gate
+   * (MmtpRouter #createFecReleaseGate): a block holding either released
+   * frame's SS_ID (`fromSsId` or `toSsId`) delivered that frame, so untracked
+   * there means it resolved and retired; a block starting after the stream's frontier (`highestSbn`,
+   * an SS_Start here) may still be heard from; a block at or behind the
+   * frontier that no symbol of this manager ever reached vanished, and its
+   * media is lost.
+   */
+  isoSpanResolution(
+    packetId: number,
+    catalogTrackName: string | undefined,
+    fromSsId: number,
+    toSsId: number,
+  ): readonly number[] | null {
+    if (!serial32Precedes(fromSsId, toSsId) || serial32Distance(fromSsId, toSsId) <= 1) return []
+    const locator = this.#isoLocators.get(this.#streamKey(packetId, catalogTrackName))
+    if (!locator || !locator.coversBetween(fromSsId, toSsId)) return null
+    const highest = this.highestSbn(packetId, catalogTrackName)
+    const lost: number[] = []
+    for (const block of locator.blocksBetween(fromSsId, toSsId)) {
+      const resolution = this.blockResolution(block.start, packetId, catalogTrackName)
+      if (resolution === 'pending') return null
+      if (resolution === 'failed') {
+        lost.push(block.start)
+      } else if (resolution === 'untracked') {
+        if (
+          isoBlockContains(block.start, block.length, fromSsId) ||
+          isoBlockContains(block.start, block.length, toSsId)
+        ) {
+          continue
+        }
+        if (highest === undefined || serial32Precedes(highest, block.start)) return null
+        lost.push(block.start)
+      }
+    }
+    return lost
+  }
+
+  /**
+   * iso-ssbg1-v1 block location: repair symbols it refused, oversize sources,
+   * the sources held now for a block no repair has stated yet, and the held
+   * sources the capacity cap evicted (cumulative), and the sources a
+   * synchronous decoder held unplaced and retired at its horizon (cumulative).
+   */
+  get isoDiagnostics(): {
+    repairRefused: number
+    sourceOversize: number
+    heldSources: number
+    heldEvicted: number
+    decoderUnplacedRetired: number
+    decoderUnplacedRetireFailed: number
+  } {
+    let heldSources = 0
+    for (const locator of this.#isoLocators.values()) heldSources += locator.heldCount
+    return {
+      repairRefused: this.#isoRepairRefusedCount,
+      sourceOversize: this.#isoSourceOversizeCount,
+      heldSources,
+      heldEvicted: this.#isoHeldEvictedCount,
+      decoderUnplacedRetired: this.#isoDecoderUnplacedRetired,
+      decoderUnplacedRetireFailed: this.#isoDecoderUnplacedRetireFailed,
+    }
+  }
+
+  isTrackConfigured(packetId: number): boolean {
+    return this.#trackConfigs.has(packetId)
+  }
+
+  /** Catalog/reset epoch of a packet's streams; gap decisions carry it. */
+  epochFor(packetId: number): number {
+    return this.#packetEpochs.get(packetId) ?? 0
+  }
+
+  /** Configured media kind of a packetId, when known. */
+  trackKindFor(packetId: number): TrackKind | undefined {
+    return this.#trackConfigs.get(packetId)?.trackKind
+  }
+
+  /** Configured codec of a packetId, when known. */
+  codecFor(packetId: number): string | undefined {
+    return this.#trackConfigs.get(packetId)?.codec
+  }
+
+  /**
+   * Block classifier geometry of one stream: its own stream-scoped geometry,
+   * else the packet's (fail-closed when absent, or when a sibling stream of
+   * the packet has its own geometry and this one has none).
+   */
+  geometryFor(packetId: number, catalogTrackName?: string): BlockClassifierGeometry {
+    return this.#geometryFor(packetId, catalogTrackName)
+  }
+
+  /** Current classifier mode of a stream. */
+  classifierModeFor(
+    packetId: number,
+    catalogTrackName?: string,
+  ): { mode: ClassifierMode; reason: ClassifierReason | null } {
+    const classifier = this.#classifierFor(packetId, catalogTrackName)
+    return { mode: classifier.mode, reason: classifier.reason }
+  }
+
+  /**
+   * Whether an MPU boundary still bounds this stream's RAPs (see
+   * `BlockClassifier.mpuBoundsRaps`). Gap decisions drop MPU evidence once
+   * it does not. A stream with no classifier yet has shown nothing against it.
+   */
+  mpuBoundsRapsFor(packetId: number, catalogTrackName?: string): boolean {
+    return this.#classifiers.get(this.#streamKey(packetId, catalogTrackName))?.mpuBoundsRaps ?? true
+  }
+
+  /** A block's class now, or frozen at its resolution. */
+  blockClassFor(sbn: number, packetId: number, catalogTrackName?: string): BlockClass {
+    const frozen = this.#resolvedBlockClasses.get(this.#blockKey(sbn, packetId, catalogTrackName))
+    if (frozen !== undefined) return frozen
+    return this.#peekClass(sbn, packetId, catalogTrackName)
+  }
+
+  /**
+   * Lifecycle resolution of one block for in-order frame release: `pending`
+   * while it can still complete, `complete`/`failed` once terminal, and
+   * `untracked` when no symbol of it was ever accepted.
+   */
+  blockResolution(sbn: number, packetId: number, catalogTrackName?: string): FecBlockResolution {
+    return this.#blockResolutionFor(this.#blockKey(sbn, packetId, catalogTrackName))
+  }
+
+  /** Highest SBN any symbol of this stream carried in the current epoch. */
+  highestSbn(packetId: number, catalogTrackName?: string): number | undefined {
+    return this.#highestSbn.get(this.#streamKey(packetId, catalogTrackName))?.sbn
+  }
+
+  /**
+   * Record a RAP frame released in order, for the classifier's RAP-spacing
+   * invariant (consecutive MPUs exactly one keyframe interval apart).
+   */
+  noteReleasedRap(
+    packetId: number,
+    catalogTrackName: string | undefined,
+    mpu: number,
+    presentationTime: bigint,
+    mediaTimescale: number,
+  ): void {
+    if (!this.#trackConfigs.has(packetId)) return
+    this.#applyClassifierChanges(
+      packetId,
+      catalogTrackName,
+      this.#classifierFor(packetId, catalogTrackName).noteReleasedRap(
+        mpu,
+        presentationTime,
+        mediaTimescale,
+      ),
+    )
+  }
+
+  // -----------------------------------------------------------------------
+  // Configuration
+  // -----------------------------------------------------------------------
+
+  /** Configure FEC parameters. */
+  configure(config: FECManagerConfig): void {
+    if (config.k != null) this.#fecK = config.k
+    if (config.symbolSize != null && config.symbolSize > 0) this.#fecSymbolSize = config.symbolSize
+    if (config.interleaveDepthMs != null) this.#fecInterleaveDepthMs = config.interleaveDepthMs
+    if (config.fps != null && Number.isFinite(config.fps) && config.fps > 0) {
+      this.#fecFps = config.fps
+    }
+    // interleaveDepthMs is in milliseconds per spec §5.1.
+    // Valid range: 33ms (interactive/gaming) to 10000ms (broadcast ATSC 3.0).
+    // Warn if value looks like frame count instead of ms (common misconfiguration).
+    if (config.interleaveDepthMs != null && config.interleaveDepthMs > 0 && config.interleaveDepthMs < MIN_INTERLEAVE_DEPTH_MS) {
+      console.warn(`[FECManager] interleaveDepthMs=${config.interleaveDepthMs} looks like frame count, not milliseconds (§5.1 requires ms). Expected range: ${MIN_INTERLEAVE_DEPTH_MS}-10000ms.`)
+    }
+    if (config.timeoutMs != null && config.timeoutMs > 0) {
+      this.#fecTimeoutMs = config.timeoutMs
+    } else if (
+      config.interleaveDepthMs != null &&
+      config.interleaveDepthMs >= MIN_INTERLEAVE_DEPTH_MS
+    ) {
+      this.#fecTimeoutMs = computeFecDeliveryWindowMs({
+        interleaveDepthMs: config.interleaveDepthMs,
+        sourceSymbols: this.#fecK,
+        symbolSize: this.#fecSymbolSize,
+        mediaUnitsPerSecond: config.fps,
+      })
+    }
+    // A shared multicast parser receives every packetId. Keep existing track
+    // deadlines at least as wide as the selected video delivery envelope so a
+    // short audio interleave cannot expire during browser/AMT scheduling gaps.
+    for (const [packetId, track] of this.#trackConfigs) {
+      if (track.timeoutMs < this.#fecTimeoutMs) {
+        this.#trackConfigs.set(packetId, { ...track, timeoutMs: this.#fecTimeoutMs })
+      }
+    }
+  }
+
+  /**
+   * Configure FEC parameters for one packetId without changing legacy
+   * defaults. With `catalogTrackName`, `config.geometry` is that stream's
+   * own classifier geometry (ABR rungs that share a packetId each get
+   * theirs); K, T, timing, kind and codec stay per packetId.
+   */
+  configureTrack(packetId: number, config: FECManagerConfig, catalogTrackName?: string): void {
+    this.#upsertTrackConfig(packetId, config, catalogTrackName)
+  }
+
+  /** Register a FEC decoder for a specific packetId (track). */
+  setFecDecoder(
+    packetId: number,
+    client: WasmFecDecoder,
+    k: number,
+    config?: FECManagerConfig,
+    catalogTrackName?: string,
+  ): void {
+    const streamKey = this.#streamKey(packetId, catalogTrackName)
+    this.#assertExclusiveDecoderClient(
+      streamKey,
+      client,
+      [...this.#fecDecoders].map(([key, entry]) => [key, entry.client] as const),
+      'decoder',
+    )
+    const trackConfig = this.#upsertTrackConfig(packetId, { ...config, k }, catalogTrackName)
+    this.#fecDecoders.set(streamKey, { client, k: trackConfig.k })
+  }
+
+  /**
+   * Register a Worker-backed FEC decoder for a specific packetId (track).
+   *
+   * Worker-backed tracks decode asynchronously — feedSourceSymbol/feedRepairSymbol
+   * return null immediately, and recovered frames arrive via the onBlockRecovered callback.
+   *
+   * Takes precedence over sync WASM decoders for the same packetId.
+   */
+  setFecWorker(
+    packetId: number,
+    client: FecWorkerClient,
+    config: FECManagerConfig,
+    catalogTrackName?: string,
+  ): void {
+    const k = config?.k
+    if (k === undefined || !Number.isFinite(k) || k <= 0) {
+      throw new Error(`[FECManager] packetId=${packetId} Worker requires an explicit positive k`)
+    }
+    const symbolSize = config.symbolSize
+    if (symbolSize === undefined || !Number.isFinite(symbolSize) || symbolSize <= 0) {
+      throw new Error(
+        `[FECManager] packetId=${packetId} Worker requires an explicit positive symbolSize`,
+      )
+    }
+    const streamKey = this.#streamKey(packetId, catalogTrackName)
+    this.#assertExclusiveDecoderClient(
+      streamKey,
+      client,
+      this.#workerClients,
+      'worker',
+    )
+    // Every Worker leaves routing through #retireWorker, which fails the
+    // blocks it still owed and reports the stream's decoder unavailable.
+    // Overwriting a registration would skip that path and strand those
+    // blocks, so a second Worker under a routed stream is refused.
+    const incumbent = this.#workerClients.get(streamKey)
+    if (incumbent !== undefined && incumbent !== client) {
+      throw new Error(
+        `[FECManager] stream ${streamKey} already routes to a Worker; ` +
+          `call clearFecWorker before registering another`,
+      )
+    }
+    if (config) this.#upsertTrackConfig(packetId, config, catalogTrackName)
+    const workerK = this.#resolveTrackConfig(packetId).k
+    this.#workerClients.set(streamKey, client)
+    this.#releasedWorkerClients.delete(client)
+
+    client.onFrame((data: ArrayBuffer, meta: FrameMeta) => {
+      if (this.#releasedWorkerClients.has(client)) return
+      if (meta.recovered) {
+        // Recovered Worker events represent one exact source-symbol position.
+        // Block-completion accounting needs that exact ESI, and counting an
+        // ESI-less event as recovered would report healthy FEC while dropping
+        // the media. Enforce the Worker contract before any recovery metric.
+        // The Worker names the recovered block's authored SSB_length; ESIs
+        // SSB_length..K-1 are encoder padding and are never emitted.
+        if (
+          !Number.isInteger(meta.ssbLength) ||
+          meta.ssbLength! <= 0 ||
+          meta.ssbLength! > workerK
+        ) {
+          const kind: FecWorkerErrorCode = 'recovered-symbol-ssb-length-invalid'
+          const seen = this.#workerErrorCounts.get(kind) ?? 0
+          this.#workerErrorCounts.set(kind, seen + 1)
+          if (seen < WORKER_ERROR_LOG_CAP) {
+            console.warn(
+              `[FECManager] Dropping recovered symbol with invalid SSB_length: pid=${packetId} sbn=${meta.sbn} ssbLength=${String(meta.ssbLength)}`,
+            )
+          }
+          return
+        }
+        if (
+          !Number.isInteger(meta.esi) ||
+          meta.esi! < 0 ||
+          meta.esi! >= meta.ssbLength!
+        ) {
+          const kind = 'recovered-symbol-missing-esi'
+          const seen = this.#workerErrorCounts.get(kind) ?? 0
+          this.#workerErrorCounts.set(kind, seen + 1)
+          if (seen < WORKER_ERROR_LOG_CAP) {
+            console.warn(
+              `[FECManager] Dropping recovered symbol without valid ESI: pid=${packetId} sbn=${meta.sbn} esi=${String(meta.esi)} ssbLength=${String(meta.ssbLength)}`,
+            )
+          }
+          return
+        }
+        const esi = meta.esi!
+
+        // Suppress duplicate routing when the worker fires recovered=true
+        // for a block ALREADY CLEANLY COMPLETED by K source symbols.
+        //
+        // BLO-3323 L15: predicate was previously `#completedBlocks.has(sbn)`,
+        // but `#completedBlocks` is populated by 5 paths (clean K-arrival,
+        // failed timeout, every worker frame emit via markBlockCompleted below,
+        // external markBlockCompleted, and cancelBlockTimeout). The first
+        // worker frame for a block adds the SBN, so subsequent recovered=true
+        // emits for the same block were always suppressed → blocksRecovered
+        // stayed at 0 even when recovery actually fired. Switching to the
+        // narrower #cleanlyCompletedBlocks set (populated only by trackBlock
+        // when count >= K) preserves the original dedup intent (BLO-3035
+        // layer 4 — don't double-route a block already received via source)
+        // while letting genuinely-recovered blocks bump the counter.
+        const recoveredCatalogTrackName = catalogTrackName
+          ?? this.#decoderBlockCatalogTrackName(client, meta.sbn)
+        if (!this.#claimDecoderBlock(client, meta.sbn, recoveredCatalogTrackName)) return
+        const blockKey = this.#blockKey(meta.sbn, packetId, recoveredCatalogTrackName)
+        const cleanlyCompleted = this.#cleanlyCompletedBlocks.has(blockKey)
+        if (!cleanlyCompleted) {
+          if (!this.#workerRecoveredBlocks.has(blockKey)) {
+            this.#traceLifecycle(
+              'recovered',
+              meta.sbn,
+              packetId,
+              recoveredCatalogTrackName,
+            )
+            this.#workerRecoveredBlocks.add(blockKey)
+            this.#fecStats.blocksRecovered++
+            this.#statsForPacket(packetId).blocksRecovered++
+            if (this.#workerRecoveredBlocks.size > 1000) {
+              dropOldest(this.#workerRecoveredBlocks, 500)
+            }
+            this.#noteBlockRepaired(blockKey, meta.sbn, packetId, recoveredCatalogTrackName)
+          }
+
+          // RaptorQ returns the full K-symbol block, not only erased symbols.
+          // The direct path already parsed every source ESI in #seenSymbols;
+          // routing those symbols again injects duplicate MFU fragments and can
+          // leave a real FI=3 tail followed by duplicate FI=2 fragments.
+          const symbolKey = `${blockKey}:${esi}`
+          if (!this.#seenSymbols.has(symbolKey)) {
+            this.#seenSymbols.add(symbolKey)
+            this.onBlockRecovered?.(
+              meta.sbn,
+              packetId,
+              data,
+              meta,
+              recoveredCatalogTrackName,
+            )
+          }
+        }
+
+        // The worker emits recovered source symbols in ESI order. Complete the
+        // block only after its final authored slot so assemblers receive every
+        // missing symbol before their completion callback flushes buffered media.
+        if (
+          esi >= meta.ssbLength! - 1 &&
+          !this.#completedBlocks.has(blockKey)
+        ) {
+          this.cancelBlockTimeout(meta.sbn, packetId, recoveredCatalogTrackName)
+          if (recoveredCatalogTrackName === undefined) {
+            this.onBlockComplete?.(meta.sbn, packetId)
+          } else {
+            this.onBlockComplete?.(
+              meta.sbn,
+              packetId,
+              recoveredCatalogTrackName,
+            )
+          }
+        }
+      } else {
+        const completedCatalogTrackName = catalogTrackName
+          ?? this.#decoderBlockCatalogTrackName(client, meta.sbn)
+        this.markBlockCompleted(meta.sbn, packetId, completedCatalogTrackName)
+      }
+    })
+
+    client.onSnapshot((stats: FecTrackStats) => {
+      if (this.#releasedWorkerClients.has(client)) return
+      this.#fecWorkerStats.set(packetId, stats)
+      try {
+        this.onFecStatsUpdate?.(packetId, stats)
+      } catch (error) {
+        console.warn('[FECManager] FEC stats callback failed:', error)
+      }
+      for (const observer of this.#fecStatsObservers) {
+        try {
+          observer(packetId, stats)
+        } catch (error) {
+          console.warn('[FECManager] FEC stats observer failed:', error)
+        }
+      }
+    })
+
+    client.onCleanupComplete((sbn: number) => {
+      if (this.#releasedWorkerClients.has(client)) return
+      const cleanupKeys = [...this.#pendingWorkerCleanups].filter((key) => {
+        const block = this.#parseBlockKey(key)
+        return block.packetId === packetId &&
+          block.sbn === sbn &&
+          this.#pendingWorkerCleanupClients.get(key) === client
+      })
+      for (const key of cleanupKeys) this.#settleOwedCleanup(key, 'cleanup-ack')
+    })
+
+    client.onError((msg: string, code?: FecWorkerErrorCode) => {
+      const requestedKind = code ?? msg
+      const kind =
+        this.#workerErrorCounts.has(requestedKind) ||
+        this.#workerErrorCounts.size < WORKER_ERROR_KIND_CAP - 1
+          ? requestedKind
+          : WORKER_ERROR_OVERFLOW_KIND
+      const seen = this.#workerErrorCounts.get(kind) ?? 0
+      this.#workerErrorCounts.set(kind, seen + 1)
+      if (seen < WORKER_ERROR_LOG_CAP) {
+        console.warn('[FECManager] Worker error:', msg)
+      } else if (seen === WORKER_ERROR_LOG_CAP) {
+        console.warn(
+          `[FECManager] Worker error (suppressing further copies of ${kind}): ${msg}`,
+        )
+      }
+    })
+  }
+
+  /**
+   * Remove a stream's Worker decoder from routing.
+   *
+   * Returns false when no Worker is registered under that exact stream key.
+   * On success every cleanup acknowledgement still owed by the client is
+   * resolved by failing its block now (a Worker that is going away cannot
+   * post it), the client's block ownership is released, and
+   * onDecoderUnavailable fires once with reason 'cleared' and the decoder
+   * that remains for the stream ('sync' or 'none'). Call this before
+   * disposing the client; a client disposed while still registered is
+   * evicted on its next symbol or reset with reason 'disposed'.
+   */
+  clearFecWorker(packetId: number, catalogTrackName?: string): boolean {
+    const streamKey = this.#streamKey(packetId, catalogTrackName)
+    const client = this.#workerClients.get(streamKey)
+    if (!client) return false
+    this.#retireWorker(streamKey, client, 'cleared')
+    return true
+  }
+
+  /**
+   * Take a Worker client out of routing under one stream key, fail the blocks
+   * whose completion it still owed, and report the stream's decoder
+   * unavailable together with whatever still decodes the stream.
+   */
+  #retireWorker(streamKey: string, client: FecWorkerClient, reason: FecDecoderUnavailableReason): void {
+    this.#workerClients.delete(streamKey)
+    this.#releaseWorkerClient(client)
+    this.#decoderUnavailableEvents++
+    const stream = this.#parseStreamKey(streamKey)
+    const fallbackDecoder: FecFallbackDecoder =
+      this.#decoderForPacket(stream.packetId, stream.catalogTrackName) ? 'sync' : 'none'
+    this.onDecoderUnavailable?.({
+      packetId: stream.packetId,
+      ...(stream.catalogTrackName === undefined ? {} : { catalogTrackName: stream.catalogTrackName }),
+      reason,
+      fallbackDecoder,
+    })
+  }
+
+  /**
+   * Fail every block whose Worker cleanup acknowledgement is owed by `client`
+   * and drop its block ownership, so no block waits on a message the Worker
+   * will never post.
+   */
+  #releaseWorkerClient(client: FecWorkerClient): void {
+    const owed = [...this.#pendingWorkerCleanupClients]
+      .filter(([, owner]) => owner === client)
+      .map(([key]) => key)
+    for (const key of owed) this.#settleOwedCleanup(key, 'decoder-unavailable')
+    this.#decoderBlockOwners.delete(client)
+  }
+
+  /**
+   * Bound the wait for one Worker cleanup acknowledgement by the block's
+   * catalog-derived terminal lifetime. When it elapses with the cleanup still
+   * owed to the same client, the block fails as if the ack had arrived: its
+   * fail deadline already passed, so failing it is the decision that deadline
+   * made. A late ack then finds nothing owed and is a no-op.
+   */
+  #boundOwedCleanup(key: string, packetId: number, client: FecWorkerClient): void {
+    this.#clearOwedCleanupBound(key)
+    const bound = {
+      handle: setTimeout(() => {
+        if (this.#pendingWorkerCleanupBounds.get(key) !== bound) return
+        this.#pendingWorkerCleanupBounds.delete(key)
+        if (
+          !this.#pendingWorkerCleanups.has(key) ||
+          this.#pendingWorkerCleanupClients.get(key) !== client
+        ) {
+          return
+        }
+        this.#settleOwedCleanup(key, 'cleanup-ack-timeout')
+      }, Math.ceil(this.#liveBlockLifetimeMs(this.#resolveTrackConfig(packetId)))),
+    }
+    this.#pendingWorkerCleanupBounds.set(key, bound)
+  }
+
+  #clearOwedCleanupBound(key: string): void {
+    const bound = this.#pendingWorkerCleanupBounds.get(key)
+    if (!bound) return
+    clearTimeout(bound.handle)
+    this.#pendingWorkerCleanupBounds.delete(key)
+  }
+
+  /**
+   * Resolve one owed Worker cleanup: drop the pending entry and fail the block
+   * unless it already completed. Shared by the cleanup acknowledgement and by
+   * Worker retirement, so the two paths cannot drift in their bookkeeping.
+   */
+  #settleOwedCleanup(
+    key: string,
+    event: 'cleanup-ack' | 'cleanup-ack-timeout' | 'decoder-unavailable',
+  ): void {
+    this.#clearOwedCleanupBound(key)
+    this.#pendingWorkerCleanups.delete(key)
+    this.#pendingWorkerCleanupClients.delete(key)
+    if (this.#completedBlocks.has(key)) return
+    const block = this.#parseBlockKey(key)
+    this.#traceLifecycle(event, block.sbn, block.packetId, block.catalogTrackName)
+    this.#failBlock(block.sbn, block.packetId, block.catalogTrackName)
+  }
+
+  /** Evict a disposed client under every stream key that still maps to it. */
+  #evictDisposedWorker(client: FecWorkerClient): void {
+    for (const [key, registered] of [...this.#workerClients]) {
+      if (registered !== client) continue
+      const stream = this.#parseStreamKey(key)
+      const track = stream.catalogTrackName === undefined ? '' : ` track=${stream.catalogTrackName}`
+      console.warn(
+        `[FECManager] packetId=${stream.packetId}${track} Worker decoder was disposed while still registered; evicting it`,
+      )
+      this.#retireWorker(key, client, 'disposed')
+    }
+  }
+
+  /** Called by player when framerate is known (from decoder output). Refines FEC block timeout. */
+  setFramerate(fps: number): void {
+    if (this.#fpsDetected || fps <= 0) return
+    this.#fpsDetected = true
+    this.#fecFps = fps
+    // Only a valid §5.1 ms interleave refines the timeout; a sub-floor value is
+    // a raw frame count and would collapse it (see MIN_INTERLEAVE_DEPTH_MS).
+    if (this.#fecInterleaveDepthMs >= MIN_INTERLEAVE_DEPTH_MS) {
+      this.#fecTimeoutMs = computeFecDeliveryWindowMs({
+        interleaveDepthMs: this.#fecInterleaveDepthMs,
+        sourceSymbols: this.#fecK,
+        symbolSize: this.#fecSymbolSize,
+        mediaUnitsPerSecond: fps,
+      })
+    }
+    for (const [packetId, config] of this.#trackConfigs) {
+      if (config.fps !== undefined || config.interleaveDepthMs < MIN_INTERLEAVE_DEPTH_MS) continue
+      this.#trackConfigs.set(packetId, {
+        ...config,
+        fps,
+        timeoutMs: Math.max(
+          this.#fecTimeoutMs,
+          computeFecDeliveryWindowMs({
+            interleaveDepthMs: config.interleaveDepthMs,
+            sourceSymbols: config.k,
+            symbolSize: config.symbolSize,
+            mediaUnitsPerSecond: fps,
+          }),
+        ),
+      })
+    }
+  }
+
+  // -----------------------------------------------------------------------
+  // Symbol feeding (codec-agnostic)
+  // -----------------------------------------------------------------------
+
+  /**
+   * Feed a source symbol to the WASM FEC decoder.
+   *
+   * Does NOT track block source counts or fire lifecycle events — call
+   * `trackBlock()` separately BEFORE this method (MmtpRouter does this).
+   *
+   * @returns Recovered block data if WASM completed the block, else null.
+   *          Caller is responsible for routing recovered data and updating
+   *          block completion state via `markBlockCompleted()`.
+   */
+  feedSourceSymbol(
+    packetId: number,
+    ssId: number,
+    symbolData: Uint8Array,
+    alta?: { auth: Uint8Array; payloadEnd: number },
+    catalogTrackName?: string,
+  ): Uint8Array | null {
+    this.#fecStats.sourcePackets++
+    this.#statsForPacket(packetId).sourcePackets++
+    let sbn: number
+    let fecData: Uint8Array
+    if (this.#isIso(packetId)) {
+      // iso-ssbg1-v1: the decoder builds the ssbg_mode1 symbol from the exact
+      // protected packet, so the packet travels unpadded. Its block must
+      // already be stated (MmtpRouter holds a source until a repair places it).
+      const locator = this.#isoLocatorFor(packetId, catalogTrackName)
+      const located = locator.locate(ssId)
+      if (located === null) {
+        throw new Error(
+          `[FECManager] iso-ssbg1-v1 source SS_ID=${ssId} (packetId=${packetId}) has no stated block; ` +
+            'hold it until a repair places it (placeIsoRepair)',
+        )
+      }
+      locator.observe(ssId)
+      if (!ssbg1FitsSymbol(symbolData.byteLength, this.symbolSizeForPacket(packetId))) {
+        this.#isoSourceOversizeCount++
+        return null
+      }
+      sbn = located.block.start
+      fecData = symbolData
+    } else {
+      fecData = this.#normalizeSymbolData(packetId, symbolData)
+      sbn = Math.floor(ssId / this.kForPacket(packetId))
+    }
+    const blockKey = this.#blockKey(sbn, packetId, catalogTrackName)
+    const syncBlockOwner = this.#syncDecoderBlockOwners.get(blockKey)
+
+    // Worker-backed track: dispatch async, return null (recovery via onFrame callback)
+    const workerClient = this.#routableWorkerForPacket(packetId, catalogTrackName)
+    if (workerClient && !syncBlockOwner) {
+      if (!this.#claimDecoderBlock(workerClient, sbn, catalogTrackName)) return null
+      // Transfer an ArrayBuffer nothing else references. A symbol this manager
+      // just zero-padded to T already is one; copying it again cost a second
+      // T-byte allocation per short packet (BLO-36599). A caller's buffer may
+      // be a view into a larger packet, so it is copied first (T-03-06).
+      const buf = fecData !== symbolData
+        ? fecData.buffer as ArrayBuffer
+        : fecData.buffer.slice(
+            fecData.byteOffset,
+            fecData.byteOffset + fecData.byteLength,
+          ) as ArrayBuffer
+      // Pass the flat SS_ID through to the worker. The WASM decoder derives
+      // SBN/ESI internally per ISO 23008-1 §C.5.2; the WASM add_source
+      // signature is (ss_id, data, timestamp) — pre-computing sbn/esi on this
+      // side produces wrong WASM argument alignment and silently breaks
+      // block assembly.
+      if (alta) {
+        // Copy auth into a fresh ArrayBuffer to transfer zero-copy. The
+        // underlying buffer of the parsed trailer view belongs to the wire
+        // packet, which may be transferred separately or reused.
+        const authBuf = alta.auth.buffer.slice(
+          alta.auth.byteOffset,
+          alta.auth.byteOffset + alta.auth.byteLength,
+        ) as ArrayBuffer
+        workerClient.feedSource(ssId, buf, performance.now(), {
+          auth: authBuf,
+          payloadEnd: alta.payloadEnd,
+        })
+      } else {
+        workerClient.feedSource(ssId, buf, performance.now())
+      }
+      return null
+    }
+
+    // Synchronous WASM path.
+    const entry = this.#decoderForPacket(packetId, catalogTrackName)
+    const client = syncBlockOwner ?? entry?.client
+    if (!client) return null
+    if (!this.#claimDecoderBlock(client, sbn, catalogTrackName)) return null
+    this.#syncDecoderBlockOwners.set(blockKey, client)
+
+    let recovered: Uint8Array | null = null
+    try {
+      recovered = client.add_source(ssId, fecData, performance.now())
+    } catch {
+      // WASM RefCell panic — decoder instance shared with multicast repair path
+    }
+    this.#retireIsoUnplaced(client, packetId, catalogTrackName)
+    if (recovered || this.#completedBlocks.has(blockKey)) {
+      this.#syncDecoderBlockOwners.delete(blockKey)
+    }
+
+    return recovered
+  }
+
+  /**
+   * Feed a repair symbol to the WASM FEC decoder.
+   *
+   * @returns Recovered block data if repair completed the block, else null.
+   *          Caller is responsible for routing recovered data and updating
+   *          block completion state via `markBlockCompleted()`.
+   */
+  feedRepairSymbol(
+    packetId: number,
+    ssStart: number,
+    ssbLength: number,
+    rsId: number,
+    repairData: Uint8Array,
+    catalogTrackName?: string,
+  ): Uint8Array | null {
+    this.#fecStats.repairPackets++
+    this.#statsForPacket(packetId).repairPackets++
+    const symbolSize = this.symbolSizeForPacket(packetId)
+    if (symbolSize > 0 && repairData.byteLength !== symbolSize) {
+      this.#repairSymbolSizeMismatchCount++
+      if (this.#repairSymbolSizeMismatchCount <= 5 || this.#repairSymbolSizeMismatchCount % 100 === 0) {
+        console.warn(
+          `[FECManager] Dropping repair symbol with invalid size: got ${repairData.byteLength}B, expected ${symbolSize}B (packetId=${packetId}, ssStart=${ssStart}, ssbLength=${ssbLength}, rsId=${rsId})`,
+        )
+      }
+      return null
+    }
+    const fecData = repairData
+
+    // SSB_length is the authored source-symbol count in this block, not the
+    // decoder's configured block width. Short authored blocks are padded to
+    // the configured K, so all internal keys and lifecycle coordinates use K.
+    // Keep the wire tuple unchanged when calling the decoder below.
+    const k = this.kForPacket(packetId)
+    let sbn: number
+    if (this.#isIso(packetId)) {
+      // iso-ssbg1-v1 (C.5.3): the block is [SS_Start, SS_Start + SSB_length),
+      // K' = SSB_length, and the catalog K is only its maximum. MmtpRouter
+      // placed the block before feeding its repair (placeIsoRepair).
+      const block = this.#isoLocatorFor(packetId, catalogTrackName).blockAt(ssStart)
+      if (ssbLength <= 0 || ssbLength > k || block === undefined || block.span || block.length !== ssbLength) {
+        return null
+      }
+      sbn = ssStart
+    } else {
+      if (ssbLength <= 0 || ssbLength > k || ssStart % k !== 0) return null
+      sbn = Math.floor(ssStart / k)
+    }
+    this.#noteSbnSeen(sbn, packetId, catalogTrackName, 'repair')
+
+    // Repair symbols are block activity: refresh the inactivity fail bound so
+    // a block being actively repaired over MoQ is not failed mid-recovery.
+    // The multicast in-band path already does this at the router; this covers
+    // the MoQ backfill path, which bypasses the router's packet accounting.
+    this.noteBlockActivity(sbn, packetId, catalogTrackName)
+    const blockKey = this.#blockKey(sbn, packetId, catalogTrackName)
+    if (this.#completedBlocks.has(blockKey)) return null
+    if (!this.#noteAuthoredLength(blockKey, sbn, packetId, ssbLength, catalogTrackName)) {
+      return null
+    }
+    let repairIds = this.#blockRepairRsIds.get(blockKey)
+    if (!repairIds) {
+      repairIds = new Set()
+      this.#blockRepairRsIds.set(blockKey, repairIds)
+    }
+    repairIds.add(rsId)
+    if (this.#repairRequestedBlocks.has(blockKey)) {
+      this.#traceLifecycle('repair-arrived', sbn, packetId, catalogTrackName, rsId)
+    }
+
+    // Every authored source symbol already arrived: the block is clean now
+    // that its SSB_length is known. The decoder still receives the repair so
+    // it retires its own copy of the block, but whatever it returns is the
+    // source the direct path already routed, not a recovery.
+    const cleanOnArrival =
+      (this.#blockSourceCounts.get(blockKey) ?? 0) >= ssbLength
+    const recovered = this.#dispatchRepairSymbol(
+      blockKey,
+      sbn,
+      packetId,
+      ssStart,
+      ssbLength,
+      rsId,
+      fecData,
+      catalogTrackName,
+    )
+    if (cleanOnArrival) {
+      this.#completeCleanBlock(blockKey, sbn, packetId, catalogTrackName)
+      return null
+    }
+    return recovered
+  }
+
+  /**
+   * Record a block's authored SSB_length from a repair symbol. Returns false,
+   * leaving the block unchanged, when the symbol contradicts the block: a
+   * different SSB_length than an earlier repair symbol declared is dropped,
+   * and an SSB_length that places an already-received source ESI inside the
+   * zero padding fails the block, since its geometry can no longer be trusted.
+   */
+  #noteAuthoredLength(
+    blockKey: string,
+    sbn: number,
+    packetId: number,
+    ssbLength: number,
+    catalogTrackName?: string,
+  ): boolean {
+    const known = this.#blockAuthoredLengths.get(blockKey)
+    if (known === ssbLength) return true
+    if (known !== undefined) {
+      this.#ssbLengthConflictCount++
+      if (this.#ssbLengthConflictCount <= 5 || this.#ssbLengthConflictCount % 100 === 0) {
+        console.warn(
+          `[FECManager] Dropping repair symbol whose SSB_length ${ssbLength} conflicts with ${known} for packetId=${packetId} sbn=${sbn}`,
+        )
+      }
+      return false
+    }
+    const sourceEsis = this.#blockSourceEsis.get(blockKey)
+    if (sourceEsis && [...sourceEsis].some((esi) => esi >= ssbLength)) {
+      this.#failBlock(sbn, packetId, catalogTrackName)
+      return false
+    }
+    this.#blockAuthoredLengths.set(blockKey, ssbLength)
+    return true
+  }
+
+  #dispatchRepairSymbol(
+    blockKey: string,
+    sbn: number,
+    packetId: number,
+    ssStart: number,
+    ssbLength: number,
+    rsId: number,
+    fecData: Uint8Array,
+    catalogTrackName?: string,
+  ): Uint8Array | null {
+    const syncBlockOwner = this.#syncDecoderBlockOwners.get(blockKey)
+    // Worker-backed track: dispatch async, return null (recovery via onFrame callback)
+    const workerClient = this.#routableWorkerForPacket(packetId, catalogTrackName)
+    if (workerClient && !syncBlockOwner) {
+      if (!this.#claimDecoderBlock(workerClient, sbn, catalogTrackName)) return null
+      // Create clean ArrayBuffer copy (T-03-06)
+      const buf = fecData.buffer.slice(
+        fecData.byteOffset,
+        fecData.byteOffset + fecData.byteLength,
+      ) as ArrayBuffer
+      // Forward the wire-level Repair FEC Payload ID (ISO 23008-1 §C.5.3)
+      // directly. WASM add_repair signature is
+      // (ss_start, ssb_length, rs_id, data, timestamp) — pre-computing
+      // (sbn, esi) on this side misaligns WASM args and produces 0% recovery.
+      workerClient.feedRepair(ssStart, ssbLength, rsId, buf, performance.now())
+      return null
+    }
+
+    // Synchronous WASM path.
+    const entry = this.#decoderForPacket(packetId, catalogTrackName)
+    const client = syncBlockOwner ?? entry?.client
+    if (!client) return null
+    if (!this.#claimDecoderBlock(client, sbn, catalogTrackName)) return null
+    this.#syncDecoderBlockOwners.set(blockKey, client)
+
+    let recovered: Uint8Array | null = null
+    try {
+      recovered = client.add_repair(ssStart, ssbLength, rsId, fecData, performance.now())
+    } catch {
+      // WASM add_repair failure — block will timeout and be marked failed
+    }
+    this.#retireIsoUnplaced(client, packetId, catalogTrackName)
+    if (recovered) this.#syncDecoderBlockOwners.delete(blockKey)
+
+    return recovered
+  }
+
+  #routeSyncCleanup(
+    decoder: WasmFecDecoder,
+    sbn: number,
+    packetId: number,
+    catalogTrackName: string | undefined,
+  ): void {
+    // Retire the block from the decoder. Concealment of a lost block is the
+    // sink's job (hold last good frame), so nothing is routed from here.
+    try {
+      decoder.cleanup_blocks_detailed(Uint32Array.of(sbn))
+    } catch (error) {
+      console.warn(`[FECManager] Scoped cleanup failed for SBN ${sbn}:`, error)
+    }
+    this.#retireIsoUnplaced(decoder, packetId, catalogTrackName)
+  }
+
+  /**
+   * iso-ssbg1-v1: a placed source the decoder took before its block's repair
+   * (fed in wire order, sources first) waits unplaced in the decoder; one
+   * whose repair never reaches it, such as a source of a repair-less span,
+   * would stay there. Retire those by the decoder's horizon behind the newest
+   * SS_ID the stream's locator has seen. Run after every feed that grows the
+   * decoder and when a block is retired, as the fec-worker sweeps its own
+   * pool: a stream that loses only repair symbols never expires a block, so
+   * a sweep tied to expiry alone would never run there.
+   */
+  #retireIsoUnplaced(
+    decoder: WasmFecDecoder,
+    packetId: number,
+    catalogTrackName: string | undefined,
+  ): void {
+    if (!this.#isIso(packetId)) return
+    const newest = this.#isoLocators.get(this.#streamKey(packetId, catalogTrackName))?.newest
+    if (newest === undefined) return
+    try {
+      this.#isoDecoderUnplacedRetired += decoder.retire_unplaced(newest)
+    } catch (error) {
+      this.#isoDecoderUnplacedRetireFailed++
+      const failed = this.#isoDecoderUnplacedRetireFailed
+      if (failed <= 5 || failed % 100 === 0) {
+        console.warn(
+          `[FECManager] iso-ssbg1-v1 unplaced retirement failed for packetId=${packetId} (${failed} total):`,
+          error,
+        )
+      }
+    }
+  }
+
+  // -----------------------------------------------------------------------
+  // Block lifecycle
+  // -----------------------------------------------------------------------
+
+  /**
+   * Track a first-arrival network source symbol for an FEC block. Refreshes
+   * the inactivity deadline on each symbol, records the symbol's in-band
+   * classification evidence, and marks the block clean when all of its
+   * authored source symbols arrived: the SSB_length a repair symbol declared,
+   * otherwise K.
+   *
+   * Throws for a packetId that was never configured, so a classified block
+   * never reads the manager-global K or timeout.
+   */
+  trackBlock(
+    sbn: number,
+    packetId: number,
+    catalogTrackName: string | undefined,
+    esi: number,
+    evidence: SourceSymbolEvidence,
+  ): void {
+    const trackConfig = this.#trackConfigs.get(packetId)
+    if (trackConfig === undefined) {
+      throw new Error(
+        `[FECManager] trackBlock for packetId=${packetId}, which was never configured; ` +
+          'configure the track from its catalog (configureTrack/setFecWorker/setFecDecoder) first',
+      )
+    }
+    const key = this.#blockKey(sbn, packetId, catalogTrackName)
+    const k = trackConfig.k
+
+    // Skip blocks already recovered — late source symbols must not restart timeouts
+    if (this.#completedBlocks.has(key)) return
+
+    this.#noteSbnSeen(sbn, packetId, catalogTrackName, 'source', evidence.packetSequenceNumber)
+
+    // A source ESI inside the zero padding contradicts the block's authored
+    // SSB_length; its geometry can no longer be trusted, so fail it closed.
+    const authoredLength = this.#blockAuthoredLengths.get(key) ?? k
+    if (Number.isInteger(esi) && esi! >= authoredLength) {
+      this.#failBlock(sbn, packetId, catalogTrackName)
+      return
+    }
+
+    this.#applyClassifierChanges(
+      packetId,
+      catalogTrackName,
+      this.#classifierFor(packetId, catalogTrackName).observe(sbn, evidence),
+    )
+
+    // Count source symbols per block
+    const count = (this.#blockSourceCounts.get(key) ?? 0) + 1
+    this.#blockSourceCounts.set(key, count)
+    if (count === 1) this.#indexBlockKey(key, sbn, packetId)
+    if (Number.isInteger(esi) && esi! >= 0 && esi! < k) {
+      let sourceEsis = this.#blockSourceEsis.get(key)
+      if (!sourceEsis) {
+        sourceEsis = new Set()
+        this.#blockSourceEsis.set(key, sourceEsis)
+      }
+      sourceEsis.add(esi!)
+    }
+    if (count === 1) {
+      if (catalogTrackName === undefined) {
+        this.onBlockStarted?.(sbn, packetId)
+      } else {
+        this.onBlockStarted?.(sbn, packetId, catalogTrackName)
+      }
+    }
+
+    // When every authored source symbol arrived (SSB_length once a repair
+    // symbol declared it, otherwise K), the block is clean: no loss, no FEC.
+    if (k > 0 && count >= authoredLength) {
+      this.#completeCleanBlock(key, sbn, packetId, catalogTrackName)
+      return
+    }
+
+    this.noteBlockActivity(sbn, packetId, catalogTrackName, true)
+
+    // Source ESI is intentionally not a repair trigger. Multicast delivery is
+    // unordered, so K-1 may precede an interior symbol in a clean block. The
+    // progress-refreshed source horizon above is the earliest loss signal.
+  }
+
+  #completeCleanBlock(
+    key: string,
+    sbn: number,
+    packetId: number,
+    catalogTrackName?: string,
+  ): void {
+    this.#fecStats.blocksClean++
+    this.#statsForPacket(packetId).blocksClean++
+    this.cancelBlockTimeout(sbn, packetId, catalogTrackName)
+    this.#blockSourceCounts.delete(key)
+    this.#blockSourceEsis.delete(key)
+    this.#blockAuthoredLengths.delete(key)
+    this.#blockRepairRsIds.delete(key)
+    // BLO-3323 L15: track which SBNs reached K source-symbol arrivals so the
+    // worker recovery suppression can distinguish "block completed by source"
+    // (legitimately suppress duplicate recovery) from "block touched by any
+    // prior emit / timeout / external mark" (do NOT suppress recovery).
+    // #markTerminal retires both memberships together (BLO-36599).
+    this.#markTerminal(key, sbn, packetId, true)
+    this.#markPathBlockComplete(sbn, packetId, catalogTrackName)
+    if (catalogTrackName === undefined) {
+      this.onBlockComplete?.(sbn, packetId)
+    } else {
+      this.onBlockComplete?.(sbn, packetId, catalogTrackName)
+    }
+    // MmtpRouter feeds the K-th source immediately after this callback.
+    // Defer cleanup so that synchronous feed selects the same decoder; this
+    // also clears blocks whose K-th packet was too large for decoder input.
+    queueMicrotask(() => this.#syncDecoderBlockOwners.delete(key))
+  }
+
+  /** Refresh deadlines after accepted block activity. */
+  noteBlockActivity(
+    sbn: number,
+    packetId: number,
+    catalogTrackName?: string,
+    sourceProgress = false,
+  ): void {
+    const key = this.#blockKey(sbn, packetId, catalogTrackName)
+
+    // Late symbols must not resurrect a block that already completed or failed.
+    if (this.#completedBlocks.has(key)) return
+    // The worker cleanup command is already queued after all symbols that made
+    // the inactivity deadline. Symbols arriving after that boundary are late
+    // and must not arm a second timer before the acknowledgement resolves it.
+    if (this.#pendingWorkerCleanups.has(key)) return
+
+    const repairRequested = this.#repairRequestedBlocks.has(key)
+    // An ordered relay already decided a requested block by stream order; its
+    // fate is the scheduler's hold (or its absence), never a re-hold.
+    if (repairRequested && this.#settlesByOrder(key)) return
+
+    // An ordered relay's pauses say nothing about loss; stream order settles
+    // the block (see MulticastSymbolDelivery). No timer is armed for it.
+    if (this.#settlesByOrder(key)) {
+      this.#holdForOrderedSettlement(key, sbn, packetId, catalogTrackName)
+      return
+    }
+
+    const trackConfig = this.#resolveTrackConfig(packetId)
+    const timeoutMs = this.#multicastWaitMs(trackConfig)
+    // #computeTimeout never yields <= 0 (computeFecDeliveryWindowMs throws on
+    // a non-positive interleave or K). Returning here would leave a block
+    // with source counted but no fail deadline, 'pending' forever, so a
+    // violated invariant must fail loudly instead.
+    if (!(timeoutMs > 0)) {
+      throw new Error(`[FECManager] packetId=${packetId} has no positive fail bound (timeoutMs=${timeoutMs})`)
+    }
+
+    // D-28: accepted source progress refreshes the pre-request horizon. There
+    // are at most K such arrivals; repair traffic never refreshes this timer.
+    // A requested block's accepted symbols keep extending its multicast wait
+    // (a late symbol can still complete it) but never re-arm the request: at
+    // most K+P accepted symbols can move the wait, so the block stays bounded.
+    const repairDeadline = this.#repairDeadlines.get(key)
+    if (
+      this.onRepairNeeded &&
+      !repairRequested &&
+      (repairDeadline === undefined || sourceProgress)
+    ) {
+      this.#armRepairDeadline(
+        key,
+        sbn,
+        packetId,
+        catalogTrackName,
+        this.#repairDeadlineMs(trackConfig),
+      )
+    }
+
+    this.#armBlockTimeout(sbn, packetId, catalogTrackName, timeoutMs)
+  }
+
+  #failBlock(
+    sbn: number,
+    packetId: number,
+    catalogTrackName?: string,
+  ): void {
+    const key = this.#blockKey(sbn, packetId, catalogTrackName)
+    this.#traceLifecycle('failed', sbn, packetId, catalogTrackName)
+    this.#clearRepairDeadline(key)
+    this.#clearBlockTimer(key)
+    const blockClass = this.#retireBlockClass(key, sbn, packetId, catalogTrackName)
+    if (this.#repairRequestedBlocks.delete(key)) {
+      this.onRepairResolved?.(sbn, packetId, 'failed', catalogTrackName, null)
+    }
+    this.#blockSourceCounts.delete(key)
+    this.#blockSourceEsis.delete(key)
+    this.#blockAuthoredLengths.delete(key)
+    this.#blockRepairRsIds.delete(key)
+    this.#syncDecoderBlockOwners.delete(key)
+    this.#markTerminal(key, sbn, packetId, false)
+    this.#failedBlocks.add(key)
+    this.#markPathBlockComplete(sbn, packetId, catalogTrackName)
+    this.#fecStats.blocksFailed++
+    this.#statsForPacket(packetId).blocksFailed++
+    this.onBlockFailed?.(sbn, packetId, catalogTrackName, blockClass)
+    this.onBlockResolved?.(sbn, packetId, catalogTrackName)
+  }
+
+  /**
+   * Resolve a block as completed (clean, recovered, or externally marked).
+   * A block that had a D-28 repair outstanding counts as repaired: it was
+   * short of its source at the repair deadline and completed anyway.
+   */
+  #resolveCompleted(key: string): void {
+    const block = this.#parseBlockKey(key)
+    this.#markTerminal(key, block.sbn, block.packetId, false)
+    this.#clearOwedCleanupBound(key)
+    this.#pendingWorkerCleanups.delete(key)
+    this.#pendingWorkerCleanupClients.delete(key)
+    this.#markPathBlockComplete(block.sbn, block.packetId, block.catalogTrackName)
+    this.#clearRepairDeadline(key)
+    if (this.#repairRequestedBlocks.delete(key)) {
+      this.#noteBlockRepaired(key, block.sbn, block.packetId, block.catalogTrackName)
+      this.onRepairResolved?.(
+        block.sbn,
+        block.packetId,
+        'completed',
+        block.catalogTrackName,
+        this.#viaFor(key),
+      )
+    }
+    this.#retireBlockClass(key, block.sbn, block.packetId, block.catalogTrackName)
+    this.#blockSourceCounts.delete(key)
+    this.#blockSourceEsis.delete(key)
+    this.#blockAuthoredLengths.delete(key)
+    this.#blockRepairRsIds.delete(key)
+    this.#clearBlockTimer(key)
+    this.onBlockResolved?.(block.sbn, block.packetId, block.catalogTrackName)
+  }
+
+  /** Check whether a block has already been completed (clean or recovered). */
+  isBlockCompleted(sbn: number, packetId?: number, catalogTrackName?: string): boolean {
+    return this.#blockKeysFor(sbn, packetId, catalogTrackName).some((key) => this.#completedBlocks.has(key))
+  }
+
+  /** Mark a block as completed externally (e.g., after routing recovered data). */
+  markBlockCompleted(sbn: number, packetId?: number, catalogTrackName?: string): void {
+    for (const key of this.#blockKeysFor(sbn, packetId, catalogTrackName)) {
+      this.#resolveCompleted(key)
+    }
+  }
+
+  /**
+   * Increment blocksRecovered (called by MmtpRouter after routing a
+   * synchronous recovery). With the block's coordinates the recovery is also
+   * reported through onBlockRepaired, once per block.
+   */
+  countRecovery(packetId?: number, sbn?: number, catalogTrackName?: string): void {
+    this.#fecStats.blocksRecovered++
+    if (packetId != null) this.#statsForPacket(packetId).blocksRecovered++
+    if (packetId != null && sbn != null) {
+      this.#noteBlockRepaired(
+        this.#blockKey(sbn, packetId, catalogTrackName),
+        sbn,
+        packetId,
+        catalogTrackName,
+      )
+    }
+  }
+
+  /**
+   * Strict delivery provenance for one FEC block.
+   *
+   * A recovered symbol is a function of every symbol that entered its block,
+   * so it can only be attributed to multicast when NO symbol in that block
+   * arrived over MoQ. Repair symbols routinely arrive over reliable QUIC
+   * (`MmtpRouter.feedRepairPacket`), so a block that recovered with MoQ help
+   * produced bytes that never crossed a multicast socket.
+   *
+   * An untracked block returns 'unknown' rather than a guess: absence of
+   * evidence is not evidence of multicast.
+   */
+  blockDeliveryProvenance(
+    sbn: number,
+    packetId: number,
+    catalogTrackName?: string,
+  ): MmtpDeliveryProvenance {
+    const counts = this.blockPathCount(sbn, packetId, catalogTrackName)
+    if (!counts) return 'unknown'
+    if (counts.moqSymbols > 0) return 'mixed'
+    if (counts.multicastSymbols > 0) return 'multicast'
+    return 'unknown'
+  }
+
+  /** Per-path symbol counts for one block (D-28 gate logging), if tracked. */
+  blockPathCount(
+    sbn: number,
+    packetId: number,
+    catalogTrackName?: string,
+  ): FecBlockPathCount | null {
+    return this.#blockPathCounts.get(
+      this.#blockKey(sbn, packetId, catalogTrackName),
+    ) ?? null
+  }
+
+  /** Cancel block timeout (block completed via clean reception or FEC recovery). */
+  cancelBlockTimeout(sbn: number, packetId?: number, catalogTrackName?: string): void {
+    for (const key of this.#blockKeysFor(sbn, packetId, catalogTrackName)) {
+      this.#resolveCompleted(key)
+    }
+  }
+
+  // -----------------------------------------------------------------------
+  // Cleanup
+  // -----------------------------------------------------------------------
+
+  dispose(): void {
+    for (const timer of this.#activeBlocks.values()) {
+      if (timer.handle != null) clearTimeout(timer.handle)
+    }
+    this.#activeBlocks.clear()
+    this.#activeBlockDeadlinesMs.clear()
+    this.#blockWaitDeadlinesMs.clear()
+    this.#repairHoldUntilMs.clear()
+    this.#deliveryGaps.reset()
+    this.#pendingWorkerCleanups.clear()
+    this.#pendingWorkerCleanupClients.clear()
+    for (const bound of this.#pendingWorkerCleanupBounds.values()) clearTimeout(bound.handle)
+    this.#pendingWorkerCleanupBounds.clear()
+    for (const timer of this.#repairDeadlines.values()) {
+      if (timer?.handle != null) clearTimeout(timer.handle)
+    }
+    this.#repairDeadlines.clear()
+    this.#repairDeadlineAtMs.clear()
+    this.#terminalExpiryMs.clear()
+    this.#terminalQueues.clear()
+    this.#blockKeysBySbn.clear()
+    this.#blockSourceCounts.clear()
+    this.#blockSourceEsis.clear()
+    this.#blockAuthoredLengths.clear()
+    this.#blockRepairRsIds.clear()
+    this.#completedBlocks.clear()
+    this.#cleanlyCompletedBlocks.clear()
+    this.#repairRequestedBlocks.clear()
+    this.#workerRecoveredBlocks.clear()
+    this.#syncDecoderBlockOwners.clear()
+    this.#startupAlignedPackets.clear()
+    this.#startupPartialBlocks.clear()
+    this.#startupRequireRepairReady = false
+    this.#startupRepairReadyPackets.clear()
+    this.#startupRepairBoundaryCounts.clear()
+    this.#startupRepairFailOpenPackets.clear()
+    this.#orderedFrontiers.clear()
+    this.#orderedPendingBlocks.clear()
+    this.#seenSymbols.clear()
+    this.#blockPathCounts.clear()
+    this.#blockAnchorsMs.clear()
+    this.#blockCatalogTrackNames.clear()
+    this.#classifiers.clear()
+    this.#streamGeometries.clear()
+    this.#failedBlocks.clear()
+    this.#resolvedBlockClasses.clear()
+    this.#repairedBlocks.clear()
+    this.#materializedBlocks.clear()
+    this.#highestSbn.clear()
+    this.#isoLocators.clear()
+    this.#sourceAnchors.clear()
+    this.#trackConfigs.clear()
+    this.#fecDecoders.clear()
+    // Dispose Worker clients (T-03-07: prevent Worker leak)
+    for (const client of new Set(this.#workerClients.values())) client.dispose()
+    this.#workerClients.clear()
+  }
+}