@blockcast/mmt-container 0.1.0 → 0.3.0

package/src/mmtp-router.ts

@@ -0,0 +1,4860 @@
+/**
+ * MMTP packet processing and frame routing layer.
+ *
+ * Delegates MMTP header parsing, MFU extraction, reassembly, and keyframe
+ * detection to MmtpContainerParser while owning FEC orchestration, sync
+ * gating, CMAF assembly, and callback routing.
+ *
+ * Extracted from MulticastManager — this module owns MMTP-layer concerns:
+ * FEC symbol feeding, sync gating, MSE segment assembly, and frame routing.
+ * It does NOT own network I/O, watchdog timers, or multicast join/leave.
+ *
+ * @packageDocumentation
+ */
+
+import {
+  MMTP_SIGNALING_PACKET_ID,
+  parseMMTPHeader,
+  parseMoqRepairFrameWithHeader,
+  serial32Add,
+  serial32Distance,
+  serial32Precedes,
+  type FecBlockProfile,
+  type MMTPHeader,
+} from "@blockcast/mmt-base";
+import type { IsoHeldSource } from "./fec-manager.js";
+import type { IsoPlacedSource, IsoRepairPlacement } from "./iso-block-locator.js";
+import { isMfuReassemblyError } from "./mfu-reassembler.js";
+import type {
+  MfuReassemblerBackend,
+  MmtpSourcePath,
+  MmtpDeliveryProvenance,
+} from "./mfu-reassembler.js";
+import type { MfuReassemblyPolicy } from "./mfu-reassembly-policy.js";
+import { mmtpTimestampToMicros } from "./codec-utils.js";
+import { scaleAuthoredTiming, type AuthoredTiming } from "./authored-timing.js";
+import {
+  processFecBlock,
+  processFecSymbol,
+  FecBlockMapper,
+  type ProcessFecBlockResult,
+} from "@blockcast/mmt-fec";
+import {
+  CmafBlockAssembler,
+  type BlockAssemblerConfig,
+  type CmafBlockSample,
+} from "./cmaf-block-assembler.js";
+import {
+  MmtpContainerParser,
+  isMfuKeyframeMetadata,
+  type FecReleaseGate,
+  type FrameMeta as ParserFrameMeta,
+  type ParsedMmtpPacket,
+} from "./mmtp-container-parser.js";
+import { type TrackRole } from "./carp-catalog.js";
+import {
+  decideGap,
+  type BlockClass,
+  type ClassifierMode,
+  type ClassifierReason,
+  type FrameGapDecision,
+  type GapFrameEvidence,
+  type SourceSymbolEvidence,
+} from "./block-policy.js";
+import {
+  duplicateRetentionMs,
+  StreamDuplicateLedgers,
+  type DuplicateHorizon,
+} from "./duplicate-ledger.js";
+import type {
+  ManifestAuthMode,
+  ManifestObjectIdentity,
+  ManifestTrackContext,
+  ManifestVerifier,
+} from "@blockcast/mmt-manifest-verify";
+
+// ─── Constants ─────────────────────────────────────────────────────
+
+/**
+ * Keyframe loss timeout slack factor (Phase 13, tracks WITHOUT FEC only).
+ *
+ * FEC tracks never arm the keyframe-lost timer: vanished FEC blocks are
+ * materialised from SBN evidence and resolve through their catalog-derived
+ * repair and fail deadlines, and the stall/conceal decision rides on the
+ * first frame released after the gap (`RoutedFrameMeta.gapBefore`).
+ *
+ * Derivation: The keyframe loss timer must fire after one full keyframe group
+ * has been missed. Group duration must come from explicit catalog timing; FEC
+ * sourceSymbols is a block width, not a GOP length. Multicast jitter means the
+ * last packet of a group may arrive up to ~0.5 group durations late (network
+ * reordering + FEC recovery latency). The total timeout is therefore:
+ *
+ *   timeout = group_duration * (1.0 + 0.5_jitter) = group_duration * 1.5
+ *
+ * The 0.5 jitter margin covers: (a) FEC interleave recovery window (up to D
+ * frames), (b) network reordering within one interleave depth, and (c) OS
+ * socket buffer draining latency. This is tight enough to detect loss within
+ * one missing group while avoiding false positives from normal jitter.
+ */
+export const KEYFRAME_LOST_TIMEOUT_SLACK = 1.5;
+
+/**
+ * Largest delay a JavaScript timer honours: HTML and Node store it as a signed
+ * 32-bit millisecond count, and a larger value overflows to fire almost at
+ * once. A keyframe-lost timeout above it, fixed or read, would therefore
+ * declare every keyframe lost immediately, so it is refused like any other
+ * unusable value.
+ */
+const MAX_TIMER_DELAY_MS = 0x7fffffff;
+
+function isRouterDebugEnabled(): boolean {
+  const globalDebug = (globalThis as { __MMTP_ROUTER_DEBUG?: unknown }).__MMTP_ROUTER_DEBUG;
+  if (globalDebug === true || globalDebug === "true" || globalDebug === "1") return true;
+  const env = (globalThis as { process?: { env?: Record<string, string | undefined> } }).process
+    ?.env;
+  return env?.["MMTP_ROUTER_DEBUG"] === "1" || env?.["MMTP_ROUTER_DEBUG"] === "true";
+}
+function debugRouter(message: string): void {
+  if (isRouterDebugEnabled()) console.debug(message);
+}
+
+// ─── Types ──────────────────────────────────────────────────────────
+
+export type RoutedFrameMeta = {
+  /** Authored ISO-BMFF presentation timestamp, in microseconds. */
+  timestamp: number;
+  /**
+   * Raw MMTP short-NTP header timestamp. This is transport timing metadata
+   * only; it is deliberately separate from the authored media timestamp.
+   */
+  mmtpTimestamp?: bigint;
+  keyframe: boolean;
+  /** Exact ISO-BMFF timing in the media track's native timescale. */
+  authoredTiming?: AuthoredTiming;
+  /** Transport that supplied the accepted FI=1 head (or complete FI=0 frame). */
+  source?: MmtpSourcePath;
+  /**
+   * Whole-frame delivery verdict folded across every contributing fragment.
+   *
+   * Distinct from `source` on purpose. `source` answers a routing question —
+   * which transport's copy is this — and deliberately lets the head fragment
+   * decide. This answers an evidence question: did every byte of this frame
+   * physically arrive over multicast? A frame can be routed as 'multicast'
+   * and still be 'mixed'.
+   */
+  deliveryProvenance?: MmtpDeliveryProvenance;
+  packetId?: number;
+  packetSequenceNumber?: number;
+  /** Every authoritative MMTP source-packet sequence that formed this frame. */
+  packetSequenceNumbers?: number[];
+  /** Subset of packetSequenceNumbers reconstructed by FEC. */
+  repairedPacketSequenceNumbers?: number[];
+  /** Native MMTP MPU group coordinate. */
+  mpuSequenceNumber?: number;
+  /**
+   * Timed-MFU sample identity `(movie_fragment_sequence_number, sample_number)`
+   * from the MFU data-unit header. Absent when the MFU header is untimed.
+   */
+  movieFragmentSequenceNumber?: number;
+  sampleNumber?: number;
+  /** Immutable catalog identity supplied by the owning ingress subscription. */
+  catalogTrackName?: string;
+  recovered?: boolean;
+  /**
+   * True when this frame opens playback after the router suppressed earlier
+   * video deltas while waiting for a sync keyframe. Downstream decoders can
+   * use this to treat the following dependency chain as provisional.
+   */
+  sourceDiscontinuity?: boolean;
+  /**
+   * Stall/conceal decision for the first frame released after a gap: its
+   * FEC blocks resolved with lost media, or authored decode time shows a
+   * missing sample. Sinks act on it in order, on this frame. It is the same
+   * object the manager emits as its `gap` event.
+   */
+  gapBefore?: FrameGapDecision;
+};
+
+export interface MmtpIngressContext {
+  tracks: readonly Readonly<{ name: string; packetId: number }>[];
+}
+
+/** One physical stream: an MMTP packet ID and the catalog track it carries. */
+export interface MmtpStreamIdentity {
+  readonly packetId: number;
+  readonly catalogTrackName: string;
+}
+
+/**
+ * Where a staged stream switch committed, relative to the outgoing stream.
+ *
+ * - `outgoing-reached-rap`: the outgoing stream was about to deliver a frame
+ *   at or past the incoming RAP's presentation time. The splice is exact:
+ *   the outgoing stream delivered every frame before the RAP that reached
+ *   the router, and none at or after it. An MSE assembler is the one
+ *   exception, since its flush is unbounded (see `stageStreamSwitch`).
+ * - `outgoing-ahead`: when the incoming RAP arrived, the outgoing stream had
+ *   already delivered a frame at or past it. The switch commits on that RAP
+ *   at once; incoming frames up to `outgoingHighWater` cover media time the
+ *   outgoing stream already delivered.
+ * - `outgoing-overdue`: the incoming stream reached its next RAP before the
+ *   outgoing stream reached the one held for it, so the outgoing stream is at
+ *   least a GOP behind (stalled, or losing media) and waiting longer only
+ *   widens the gap. The switch commits on the held RAP: the held GOP is
+ *   delivered, then the newer RAP. It overlaps nothing, since every outgoing
+ *   frame delivered was compared against the held RAP and is before it.
+ */
+export type StreamSwitchCommitReason =
+  | "outgoing-reached-rap"
+  | "outgoing-ahead"
+  | "outgoing-overdue";
+
+/** Presentation position of one frame, in the router's frame vocabulary. */
+export interface StreamSwitchPosition {
+  /** Authored presentation timestamp, in microseconds. */
+  readonly timestamp: number;
+  /** Exact authored timing, when the frame carried it. */
+  readonly authoredTiming?: Readonly<AuthoredTiming>;
+}
+
+/** A staged stream switch, at the moment it commits. */
+export interface StreamSwitchCommit {
+  readonly from: MmtpStreamIdentity;
+  readonly to: MmtpStreamIdentity;
+  /** The incoming RAP the switch commits on: the first `to` frame delivered. */
+  readonly rap: StreamSwitchPosition & {
+    readonly mpuSequenceNumber?: number;
+  };
+  /**
+   * The furthest-presented outgoing frame delivered before the commit,
+   * counting the gap fills the commit released, or undefined when the
+   * outgoing stream delivered none.
+   */
+  readonly outgoingHighWater: StreamSwitchPosition | undefined;
+  readonly reason: StreamSwitchCommitReason;
+  /**
+   * Incoming frames never delivered: the deltas before the incoming stream's
+   * first RAP (the GOP it was admitted into mid-way), and a held GOP a reset
+   * of the incoming stream invalidated.
+   */
+  readonly droppedIncomingFrames: number;
+}
+
+/** What MmtpRouter.stageStreamSwitch needs. */
+export interface StreamSwitchOptions {
+  /** The stream being replaced: a registered video packet ID. */
+  readonly from: MmtpStreamIdentity;
+  /** The replacing stream: a registered video packet ID other than `from`'s. */
+  readonly to: MmtpStreamIdentity;
+  /**
+   * Called synchronously at the commit, after `from`'s packet ID is retired
+   * and before `to`'s withheld init and its RAP are delivered. Throwing fails
+   * the commit closed: `to` is retired as well and nothing of it is
+   * delivered, since `from` can no longer be restored.
+   */
+  readonly onCommit: (commit: StreamSwitchCommit) => void;
+}
+
+/** A switch MmtpRouter.stageStreamSwitch staged. */
+export interface StagedStreamSwitch {
+  /**
+   * Abandon the switch before it commits: `to` is no longer withheld and its
+   * withheld init is dropped. Returns false when the switch already committed
+   * or was cancelled.
+   */
+  cancel(): boolean;
+}
+
+/** One incoming frame withheld until the switch commits. */
+interface HeldSwitchFrame {
+  readonly data: Uint8Array;
+  readonly meta: ParserFrameMeta;
+  /** The FEC coordinates the frame arrived under, for its MSE assembler. */
+  readonly fecInfo: { sbn: number; esi: number; oversized?: boolean } | undefined;
+}
+
+/** Router-side state of a staged stream switch. */
+interface StreamSwitchState {
+  readonly from: MmtpStreamIdentity;
+  readonly to: MmtpStreamIdentity;
+  readonly onCommit: (commit: StreamSwitchCommit) => void;
+  /** Null until the incoming stream's first RAP; then that RAP and every incoming frame after it. */
+  held: HeldSwitchFrame[] | null;
+  /** The incoming stream's newest init, withheld until the commit. */
+  heldInit: Uint8Array | undefined;
+  droppedIncomingFrames: number;
+}
+
+function assertStreamIdentity(role: string, stream: MmtpStreamIdentity | undefined): void {
+  if (
+    stream === undefined ||
+    !Number.isInteger(stream.packetId) ||
+    stream.packetId <= MMTP_SIGNALING_PACKET_ID ||
+    typeof stream.catalogTrackName !== "string" ||
+    stream.catalogTrackName.length === 0
+  ) {
+    throw new Error(
+      `[MmtpRouter] stream switch ${role} needs a track packet ID and a non-empty catalog track name`,
+    );
+  }
+}
+
+function isStream(
+  meta: { packetId: number; catalogTrackName?: string },
+  stream: MmtpStreamIdentity,
+): boolean {
+  return meta.packetId === stream.packetId && meta.catalogTrackName === stream.catalogTrackName;
+}
+
+/**
+ * Presentation order of two frames of different renditions. Exact when both
+ * carry authored timing (renditions may use different timescales); otherwise
+ * by the microsecond timestamps the router emits.
+ */
+function comparePresentation(a: StreamSwitchPosition, b: StreamSwitchPosition): number {
+  const at = a.authoredTiming;
+  const bt = b.authoredTiming;
+  if (at !== undefined && bt !== undefined) {
+    const left = at.presentationTime * BigInt(bt.mediaTimescale);
+    const right = bt.presentationTime * BigInt(at.mediaTimescale);
+    return left < right ? -1 : left > right ? 1 : 0;
+  }
+  return a.timestamp - b.timestamp;
+}
+
+function switchPosition(meta: {
+  timestamp: number;
+  authoredTiming?: AuthoredTiming;
+}): StreamSwitchPosition {
+  return Object.freeze({
+    timestamp: meta.timestamp,
+    ...(meta.authoredTiming === undefined
+      ? {}
+      : { authoredTiming: Object.freeze({ ...meta.authoredTiming }) }),
+  });
+}
+
+/** What one ingress track list says about one packet ID. */
+interface IngressPacketEntry {
+  /** The one non-empty catalog name the list gives the packet ID, if exactly one. */
+  readonly name?: string;
+  /** More than one non-empty catalog name claims the packet ID. */
+  readonly ambiguous: boolean;
+}
+
+function indexIngressTracks(
+  tracks: MmtpIngressContext["tracks"],
+): ReadonlyMap<number, IngressPacketEntry> {
+  const names = new Map<number, Set<string>>();
+  for (const track of tracks) {
+    let packetNames = names.get(track.packetId);
+    if (!packetNames) {
+      packetNames = new Set();
+      names.set(track.packetId, packetNames);
+    }
+    if (track.name.length > 0) packetNames.add(track.name);
+  }
+  const index = new Map<number, IngressPacketEntry>();
+  for (const [packetId, packetNames] of names) {
+    index.set(
+      packetId,
+      packetNames.size === 1
+        ? { name: packetNames.values().next().value, ambiguous: false }
+        : { ambiguous: packetNames.size > 1 },
+    );
+  }
+  return index;
+}
+
+/**
+ * Index of each frozen ingress track list (BLO-36599). MulticastManager.join
+ * freezes the list it hands the transport, which passes that same list with
+ * every packet, so the packetId -> name mapping is derived once per join
+ * rather than filtered up to four times per packet. A list that is not frozen
+ * may still change, so it is indexed afresh on every packet as before.
+ */
+const frozenIngressIndexes = new WeakMap<object, ReadonlyMap<number, IngressPacketEntry>>();
+
+function ingressEntry(
+  ingress: MmtpIngressContext,
+  packetId: number,
+): IngressPacketEntry | undefined {
+  const tracks = ingress.tracks;
+  if (!Object.isFrozen(tracks)) return indexIngressTracks(tracks).get(packetId);
+  let index = frozenIngressIndexes.get(tracks);
+  if (!index) {
+    index = indexIngressTracks(tracks);
+    frozenIngressIndexes.set(tracks, index);
+  }
+  return index.get(packetId);
+}
+
+function catalogTrackNameForPacket(
+  ingress: MmtpIngressContext | undefined,
+  packetId: number,
+): string | undefined {
+  if (!ingress) return undefined;
+  return ingressEntry(ingress, packetId)?.name;
+}
+
+function hasAmbiguousCatalogTrackName(
+  ingress: MmtpIngressContext | undefined,
+  packetId: number,
+): boolean {
+  if (!ingress) return false;
+  return ingressEntry(ingress, packetId)?.ambiguous === true;
+}
+
+function ingressHasPacketId(
+  ingress: MmtpIngressContext | undefined,
+  packetId: number,
+): boolean {
+  // packet_id 0 is the MMTP signaling flow, never a track's, whatever the ingress.
+  if (packetId === MMTP_SIGNALING_PACKET_ID) return false;
+  // Direct/legacy callers have no catalog-backed ingress policy to enforce.
+  // MulticastManager supplies a populated context whenever packetIds are selected.
+  return ingress === undefined || ingressEntry(ingress, packetId) !== undefined;
+}
+
+/** Callback for decoded video/audio frames. */
+export type FrameCallback = (data: Uint8Array, meta: RoutedFrameMeta) => void;
+
+/** Metadata accompanying an accepted raw MMTP source packet. */
+export type RoutedPacketMeta = {
+  packetId: number;
+  packetSequenceNumber: number;
+  /** True when FEC reconstructed this source packet. */
+  recovered: boolean;
+  /** True when the packet has no trailing Source FEC Payload ID. */
+  skipFecPayloadId: boolean;
+  /** Immutable catalog identity supplied by the owning ingress subscription. */
+  catalogTrackName?: string;
+  /**
+   * Strict provenance for the fragments this packet produces. Set for
+   * FEC-recovered packets, which carry no `source` of their own but inherit
+   * their FEC block's symbol provenance.
+   */
+  deliveryProvenance?: MmtpDeliveryProvenance;
+};
+
+/** Callback for accepted raw MMTP source packets. */
+export type TrackPacketCallback = (packet: Uint8Array, meta: RoutedPacketMeta) => void;
+
+type PendingRecoveredVideoFrame = {
+  data: Uint8Array;
+  meta: RoutedFrameMeta;
+};
+
+type PendingRecoveredAudioFrame = {
+  data: Uint8Array;
+  meta: RoutedFrameMeta;
+};
+
+type DirectAudioCursor = {
+  timestamp: number;
+  sequenceNumber: number;
+};
+
+/**
+ * One physical stream's stable key and duplicate ledgers, keyed by wire
+ * numbers rather than strings.
+ */
+interface StreamLedgers {
+  /** JSON tuple naming the stream; see #mediaStreamKey. */
+  readonly key: string;
+  /**
+   * The stream's three duplicate ledgers, each retained for the stream's FEC
+   * horizon (see duplicate-ledger.ts):
+   *
+   * - `sourceSeqs`: packet_sequence_numbers already received on the direct
+   *   source path. Recovered FEC blocks contain all K source symbols, so skip
+   *   direct-path duplicates even when the source frame is still buffered by
+   *   parser reordering.
+   * - `routedSeqs`: packet_sequence_numbers already handed to the track packet
+   *   callback.
+   * - `parsedSymbols`: Source FEC Payload IDs (SS_ID) already parsed for
+   *   playback. An overlap copy and its multicast twin carry the same symbol,
+   *   and the copy never feeds FEC, so FEC's first-arrival check cannot dedup
+   *   the pair.
+   */
+  readonly duplicates: StreamDuplicateLedgers;
+}
+
+const NO_FEC_MANAGER_HORIZON: DuplicateHorizon = Object.freeze({
+  kind: "none",
+  reason: "no-fec-manager",
+});
+const NO_FEC_GEOMETRY_HORIZON: DuplicateHorizon = Object.freeze({
+  kind: "none",
+  reason: "no-fec-geometry",
+});
+const NO_BLOCK_SPAN_HORIZON: DuplicateHorizon = Object.freeze({
+  kind: "none",
+  reason: "no-block-span",
+});
+
+const DIRECT_RECOVERED_VIDEO_QUEUE_LIMIT = 512;
+const DIRECT_RECOVERED_AUDIO_QUEUE_LIMIT = 512;
+
+type ParserDiagnostics = {
+  packets: number;
+  frames: number;
+  initSegments: number;
+  noFragment: number;
+  fragments: number;
+  reassembled: number;
+  pendingBuffers: number;
+  pendingFragments: number;
+  pendingSamples?: unknown[];
+  lastPacketLength: number;
+  lastSequenceNumber: number;
+  lastFecSsId?: number;
+  lastFrameTimestamp?: number;
+  directAudioSourceEmitted: number;
+  directAudioSourceRegressions: number;
+  directAudioRecoveredQueued: number;
+  directAudioRecoveredDrained: number;
+  directAudioRecoveredStaleDropped: number;
+};
+
+/**
+ * FECManager interface — the contract MmtpRouter expects for FEC
+ * source/repair symbol processing and block lifecycle events.
+ *
+ * Concrete implementation: `FECManager` class in `./fec-manager.ts`.
+ * MmtpRouter only interacts with FEC through this interface.
+ */
+export interface FECManagerLike {
+  /** Feed a source symbol to the FEC decoder for a given track.
+   *  Returns recovered block bytes if recovery completes, else null.
+   *
+   *  `symbolData` is the complete MMTP packet without its Source FEC Payload
+   *  ID, unpadded and possibly a view into the received packet. The manager
+   *  zero-pads it to the packet's own symbol size T.
+   *
+   *  Optional `alta` carries the detached ALTA authenticator extracted from
+   *  the MMTP header-extension trailer (08-07 Path 2) — present on signed
+   *  source packets, absent on relay-reassembled / unsigned streams. When
+   *  provided, the fec-worker runs verify_detached instead of counting the
+   *  symbol as `altaPending`. */
+  feedSourceSymbol(
+    packetId: number,
+    ssId: number,
+    symbolData: Uint8Array,
+    alta?: { auth: Uint8Array; payloadEnd: number },
+    catalogTrackName?: string,
+  ): Uint8Array | null;
+
+  /** Feed a repair symbol to the FEC decoder for a given track.
+   *  Returns recovered block bytes if recovery completes, else null. */
+  feedRepairSymbol(
+    packetId: number,
+    ssStart: number,
+    ssbLength: number,
+    rsId: number,
+    repairData: Uint8Array,
+    catalogTrackName?: string,
+  ): Uint8Array | null;
+
+  /** Delivery-gap sample for one multicast packet (FECManager.noteMulticastArrival). */
+  noteMulticastArrival?(packetId: number, packetSequenceNumber: number): void;
+
+  /** Record a transport symbol for first-arrival-wins dedup and path counters. */
+  feedSymbolFromSource(
+    packetId: number,
+    sbn: number,
+    esi: number,
+    data: Uint8Array,
+    source: "multicast" | "moq",
+    catalogTrackName?: string,
+  ): boolean;
+
+  /** Strict provenance for a block: 'multicast' only when no symbol arrived
+   *  over MoQ. Recovered bytes inherit it, since a recovered symbol is a
+   *  function of every symbol that entered the block. */
+  blockDeliveryProvenance?(
+    sbn: number,
+    packetId: number,
+    catalogTrackName?: string,
+  ): MmtpDeliveryProvenance;
+
+  /** Track a first-arrival network source symbol for block completion and
+   *  classification. Refreshes the inactivity deadline and marks clean when
+   *  K arrive. */
+  trackBlock(
+    sbn: number,
+    packetId: number,
+    catalogTrackName: string | undefined,
+    esi: number,
+    evidence: SourceSymbolEvidence,
+  ): void;
+
+  /** True once the packetId has a per-track FEC configuration. */
+  isTrackConfigured?(packetId: number): boolean;
+
+  /** Lifecycle resolution of one block for in-order frame release. */
+  blockResolution?(
+    sbn: number,
+    packetId: number,
+    catalogTrackName?: string,
+  ): "pending" | "complete" | "failed" | "untracked";
+
+  /** Highest SBN seen for a stream in the current epoch. */
+  highestSbn?(packetId: number, catalogTrackName?: string): number | undefined;
+
+  /** Catalog/reset epoch of a packet's streams. */
+  epochFor?(packetId: number): number;
+
+  /**
+   * Catalog `fec.interleaveDepthMs` (§5.1 full block span) of a packetId; 0
+   * when the stream has none.
+   */
+  interleaveDepthMsForPacket?(packetId: number): number;
+
+  /**
+   * How long a terminal block stays authoritative before it retires to
+   * untracked. The release gate holds a frame at most this long, so its loss
+   * scan never reads a retired, delivered block as lost. Required whenever
+   * blockResolution is.
+   */
+  terminalRetentionMsForPacket?(packetId: number): number;
+
+  /** Configured codec of a packetId. */
+  codecFor?(packetId: number): string | undefined;
+
+  /** Current classifier mode of a stream. */
+  classifierModeFor?(
+    packetId: number,
+    catalogTrackName?: string,
+  ): { mode: ClassifierMode; reason: ClassifierReason | null };
+
+  /** Whether an MPU boundary still bounds the stream's RAPs. */
+  mpuBoundsRapsFor?(packetId: number, catalogTrackName?: string): boolean;
+
+  /** Record a RAP released in order (RAP-spacing invariant). */
+  noteReleasedRap?(
+    packetId: number,
+    catalogTrackName: string | undefined,
+    mpu: number,
+    presentationTime: bigint,
+    mediaTimescale: number,
+  ): void;
+
+  /** Refresh the block inactivity deadline after accepted repair progress. */
+  noteBlockActivity?(sbn: number, packetId: number, catalogTrackName?: string): void;
+
+  /** Cancel block timeout (block completed via clean or FEC recovery). */
+  cancelBlockTimeout(sbn: number, packetId?: number, catalogTrackName?: string): void;
+
+  /** Check if a block is already completed (clean or recovered). */
+  isBlockCompleted(sbn: number, packetId?: number, catalogTrackName?: string): boolean;
+
+  /** Mark a block as completed externally (after routing recovered data). */
+  markBlockCompleted(sbn: number, packetId?: number, catalogTrackName?: string): void;
+
+  /** Increment blocksRecovered stat (called after routing recovery). */
+  countRecovery(packetId?: number, sbn?: number, catalogTrackName?: string): void;
+
+  /**
+   * The configured catalog `fec.blockProfile` of a packetId, or undefined
+   * while it is unconfigured. Required: a Source or Repair FEC Payload ID is
+   * read under exactly one profile, and the router never guesses it.
+   */
+  blockProfileForPacket(packetId: number): FecBlockProfile | undefined;
+  /** iso-ssbg1-v1: whether a protected packet fits one ssbg_mode1 symbol. */
+  isoSourceFits?(packetId: number, packetLength: number): boolean;
+  /** iso-ssbg1-v1: locate a source in a block a repair already stated. */
+  locateIsoSource?(
+    packetId: number,
+    catalogTrackName: string | undefined,
+    ssId: number,
+  ): { sbn: number; esi: number } | null;
+  /** iso-ssbg1-v1: hold a first-arrival source until a repair states its block. */
+  holdIsoSource?(
+    packetId: number,
+    catalogTrackName: string | undefined,
+    ssId: number,
+    source: IsoHeldSource,
+  ): boolean;
+  /** iso-ssbg1-v1: state a repair's block and hand back the held sources it places. */
+  placeIsoRepair?(
+    packetId: number,
+    catalogTrackName: string | undefined,
+    ssStart: number,
+    ssbLength: number,
+  ): IsoRepairPlacement<IsoHeldSource>;
+  /** iso-ssbg1-v1: resolution of the SS_IDs strictly between two released frames. */
+  isoSpanResolution?(
+    packetId: number,
+    catalogTrackName: string | undefined,
+    fromSsId: number,
+    toSsId: number,
+  ): readonly number[] | null;
+
+  /** FEC source symbol count K per block. */
+  readonly k: number;
+  kForPacket?(packetId: number): number;
+
+  /**
+   * The longest a block stays open after its last symbol (inactivity fail
+   * bound plus D-28 repair grace). With interleaveDepthMsForPacket it bounds
+   * how long the router keeps a stream's duplicate ledgers.
+   */
+  blockLifetimeMsForPacket?(packetId: number): number;
+
+  /** FEC symbol size T in bytes (0 = unknown / no FEC). */
+  readonly symbolSize: number;
+  symbolSizeForPacket?(packetId: number): number;
+
+  /** Update framerate — used to refine FEC block timeout. */
+  setFramerate(fps: number): void;
+
+  /** Per-block state snapshot for FecBlockGrid visualization. */
+  getBlockStates(): Array<{
+    sbn: number;
+    packetId?: number;
+    state: "collecting" | "complete" | "failed";
+    sourceCount: number;
+    k: number;
+    progress: number;
+  }>;
+
+  /** FEC statistics snapshot. */
+  readonly fecStats: {
+    sourcePackets: number;
+    repairPackets: number;
+    blocksClean: number;
+    blocksRecovered: number;
+    blocksFailed: number;
+  };
+
+  // ── Event hooks (set by MmtpRouter in constructor) ──
+
+  /** Called when a block receives its first source symbol. */
+  onBlockStarted:
+    | ((sbn: number, packetId: number, catalogTrackName?: string) => void)
+    | null;
+
+  /** Called when a block completes cleanly (all K sources arrived). */
+  onBlockComplete:
+    | ((sbn: number, packetId: number, catalogTrackName?: string) => void)
+    | null;
+
+  /** Called when a block times out (unrecoverable), with its class. */
+  onBlockFailed:
+    | ((
+        sbn: number,
+        packetId: number,
+        catalogTrackName: string | undefined,
+        blockClass: BlockClass,
+      ) => void)
+    | null;
+
+  /** Called when a block reaches any terminal state. */
+  onBlockResolved?:
+    | ((sbn: number, packetId: number, catalogTrackName: string | undefined) => void)
+    | null;
+
+  /** Called when a stream's FEC source restarted (SBN discontinuity). */
+  onSourceDiscontinuity?:
+    | ((packetId: number, catalogTrackName: string | undefined) => void)
+    | null;
+
+  /** Dispose timers and state. */
+  dispose(): void;
+}
+
+// ─── MmtpRouter ─────────────────────────────────────────────────────
+
+export interface ManifestIdentityResolutionInput {
+  packetId: number;
+  sbn: number;
+  esi: number;
+  /**
+   * The packet's SS_ID and its MPU's mpu_sequence_number. Under
+   * iso-ssbg1-v1 blocks vary in length, so a packet's media group comes from
+   * its own MPU header, never from SBN arithmetic (BLO-35597 D2a).
+   */
+  ssId?: number;
+  mpuSequenceNumber?: number;
+  catalogTrackName?: string;
+  recovered: boolean;
+  sourceSymbolFormat: "full-mmtp-packet" | "fec-padded-recovery";
+}
+
+export type ManifestIdentityResolver = (
+  input: ManifestIdentityResolutionInput,
+) => ManifestObjectIdentity | null;
+
+/**
+ * Classification evidence carried by one first-arrival network source
+ * packet: the MMTP header R bit and the MPU / data-unit identity it states
+ * (movie fragment, sample, DU offset). `idx` is the 0-based sample position
+ * (`sample_number` is 1-based). The packet_sequence_number rides along for
+ * FECManager's forward-jump bound.
+ */
+function sourceSymbolEvidence(
+  packet: Uint8Array,
+  header: MMTPHeader,
+  rapFlag: boolean,
+  packetSequenceNumber: number,
+): SourceSymbolEvidence {
+  const identity = MmtpContainerParser.sourcePacketIdentity(packet, header);
+  return {
+    rap: rapFlag,
+    packetSequenceNumber,
+    ...(identity === null ? {} : { mpu: identity.mpuSequenceNumber }),
+    ...(identity?.sampleNumber !== undefined && identity.sampleNumber >= 1
+      ? { idx: identity.sampleNumber - 1 }
+      : {}),
+    ...(identity?.movieFragmentSequenceNumber !== undefined
+      ? { movieFragment: identity.movieFragmentSequenceNumber }
+      : {}),
+    ...(identity?.offset !== undefined ? { offset: identity.offset } : {}),
+  };
+}
+
+export class MmtpRouter {
+  readonly #parser: MmtpContainerParser;
+  // Source AND FEC-recovered MFU fragments share ONE reassembler — the parser's
+  // (see #parser.reassembler). A keyframe split between source-received and
+  // FEC-recovered fragments must reassemble in a single buffer (BLO-8151).
+  readonly #fecManager: FECManagerLike | null;
+  #defaultFecMapper: FecBlockMapper | null;
+  #fecMappersByPacketId = new Map<number, FecBlockMapper>();
+  readonly #manifestVerifier: ManifestVerifier | null;
+  readonly #ownsManifestVerifier: boolean;
+  readonly #resolveManifestIdentity:
+    | ((
+        packetId: number,
+        sbn: number,
+        esi: number,
+        catalogTrackName?: string,
+      ) => ManifestObjectIdentity | null)
+    | null;
+  readonly #resolveManifestIdentityForRoute: ManifestIdentityResolver | null;
+  #manifestRecoveryQueues = new Map<
+    string,
+    Array<{
+      blockId: number;
+      result: ProcessFecBlockResult;
+      ownerPacketId: number;
+      catalogTrackName?: string;
+    }>
+  >();
+
+  // Temp state set by #processMMTP before calling parser.feed(),
+  // read by the parser's onFrame callback for CMAF assembly + dedup.
+  #currentFecInfo:
+    | { sbn: number; esi: number; oversized?: boolean }
+    | undefined;
+  #currentSeqNum = 0;
+
+  // Track type registry: which packetIds are video vs audio (from catalog)
+  #videoPacketIds = new Set<number>();
+  #audioPacketIds = new Set<number>();
+  #catalogTrackNamesByPacketId = new Map<number, Set<string>>();
+
+  // Per-track codec string for keyframe detection (e.g. 'avc1.42001e', 'av01.0.04M.08')
+  #trackCodecs = new Map<number, string>();
+
+  // Per-track frame callbacks keyed by packetId — used for ABR / multi-track routing
+  #trackCallbacks = new Map<
+    number,
+    FrameCallback
+  >();
+  #trackPacketCallbacks = new Map<number, TrackPacketCallback>();
+  // Cached resolved callbacks: per-track + legacy composite per packetId.
+  // Invalidated when any callback is registered (onTrackFrame, onVideoFrame, onAudioFrame).
+  #resolvedCallbacks = new Map<number, FrameCallback>();
+
+  // Per-ingress-stream sync flag: suppress direct frame emission until the first complete
+  // FEC block confirms we've joined mid-stream cleanly. Prevents corrupt partial
+  // frames from reaching the decoder on multicast mid-stream join. Catalog
+  // identity keeps renditions that reuse a packet ID from opening each other's gate.
+  #trackSynced = new Set<string>();
+  #droppedPreSyncVideo = new Set<string>();
+
+  // One entry per physical stream (packetId, catalog track name): its stable
+  // JSON key and its per-packet duplicate ledgers. The ledgers used to be
+  // three router-wide Sets of "<streamKey>:<coordinates>" strings, so every
+  // packet built and hashed up to three strings, and resetTrack() scanned
+  // every retained key by prefix (BLO-36599). They now hold the wire numbers
+  // themselves, and a reset clears one stream's Sets.
+  #streams = new Map<number, Map<string | undefined, StreamLedgers>>();
+
+  // Live WebCodecs callbacks cannot accept late recovered inter-frame video.
+  // MSE recovery routes through CmafBlockAssembler and can reorder by block; the
+  // direct callback path has to preserve decode order before frames leave libmmt.
+  #latestVideoSeqByStream = new Map<string, number>();
+  #lastDirectSourceVideoTsByStream = new Map<string, number>();
+  #lastDirectEmittedVideoTsByStream = new Map<string, number>();
+  #pendingDirectRecoveredVideoByStream = new Map<string, Map<string, PendingRecoveredVideoFrame>>();
+  // AudioDecoder input must remain monotonic too. A repair that completes after
+  // the live source cursor passed its AAC access unit is useful for FEC
+  // accounting, but injecting it into the decoder can stall PCM output.
+  #lastDirectSourceAudioCursorByStream = new Map<string, DirectAudioCursor>();
+  #lastDirectEmittedAudioCursorByStream = new Map<string, DirectAudioCursor>();
+  #pendingDirectRecoveredAudioByStream = new Map<string, Map<string, PendingRecoveredAudioFrame>>();
+
+  // The furthest-presented video frame each stream delivered, which a staged
+  // switch reads as its outgoing high water. Recorded where a frame reaches a
+  // decoder callback or an MSE assembler, not on arrival: a recovered frame
+  // can be queued ahead of the source cursor and discarded at the commit. A
+  // max, because an MSE assembler takes a late FEC gap fill below frames
+  // already delivered; an under-stated high water reports an overlapping
+  // splice as exact.
+  #deliveredVideoHighWaterByStream = new Map<string, StreamSwitchPosition>();
+
+  // Per-track CMAF block assemblers for MSE mode. When active, frames are buffered per-SBN
+  // and emitted as multi-sample CMAF segments on block completion instead of per-frame.
+  #mseAssemblers = new Map<string, CmafBlockAssembler>();
+
+  // Callbacks (legacy — used when per-track callbacks are not registered)
+  #onVideoFrame: FrameCallback | null = null;
+  #onAudioFrame: FrameCallback | null = null;
+
+  // Init segment (ftyp+moov) from MMTP MPU metadata — needed for MSE SourceBuffer
+  #onInitSegment: ((data: Uint8Array) => void) | null = null;
+
+  // Per-track init segment callbacks keyed by packetId
+  #trackInitCallbacks = new Map<number, (data: Uint8Array) => void>();
+  // Track whether init has been delivered per physical stream — prevent duplicates
+  #trackInitDelivered = new Set<string>();
+
+  // FEC block lifecycle. A failed block is NOT a decoder instruction: the
+  // stall/conceal decision rides on the first frame released after the gap.
+  #onBlockStarted: ((sbn: number, packetId: number) => void) | null = null;
+  /** Diagnostic subscriber for unrecoverable FEC blocks, with their class. */
+  #onBlockFailed:
+    | ((
+        sbn: number,
+        packetId: number,
+        catalogTrackName: string | undefined,
+        blockClass: BlockClass,
+      ) => void)
+    | null = null;
+  /** Typed observer of every gap decision the release gate makes. */
+  readonly #onFrameGap: ((decision: FrameGapDecision) => void) | null;
+  // Pokes requested while a packet is being processed are deferred to its
+  // end: a synchronous recovery completes its block BEFORE routing the
+  // recovered frames, and releasing a held gap in between would strand them.
+  #fecPokeDepth = 0;
+  #pendingFecPokes = new Map<string, { packetId: number; catalogTrackName?: string }>();
+  // ── Phase 14: per-role packetId dispatch (D-26, D-27, D-28) ───────
+  /** Maps packetId → TrackRole. Default: 'single' when absent (legacy path). */
+  #packetIdRoles: Map<number, TrackRole> = new Map();
+  /** Explicit catalog ownership for dedicated repair-track packet IDs. */
+  #repairOwnersByPacketId = new Map<number, Set<number>>();
+  /** Callback fired when a delta-track FEC block completes or fails. */
+  #onDeltaBlockCompleteCb:
+    | ((packetId: number, failed: boolean) => void)
+    | null = null;
+
+  // Debug counters
+  #pidCounts: Record<number, number> = {};
+  #repairPidCounts: Record<number, number> = {};
+  #moqRepairPidCounts: Record<number, number> = {};
+  #moqRepairOwnerCounts: Record<number, number> = {};
+  #parserDiagnostics = new Map<string, ParserDiagnostics>();
+
+  // ── Keyframe loss detection state ───────────────────────────────
+  /** Catalog-derived keyframe loss timeout (ms), or a reader evaluated at each arm. null = not configured (warns on video track registration; Phase-13 keyframe repair stays off). */
+  #keyframeLostTimeoutMs: number | (() => number) | null;
+  /** Why the last reader evaluation left the timer unarmed; null while arming. Dedups the warning. */
+  #keyframeLostUnarmedReason: string | null = null;
+  /** Active keyframe loss timer handle. Single timer per video track — cleared on each rapFlag and on dispose(). */
+  #keyframeLostTimer: ReturnType<typeof setTimeout> | null = null;
+  /** Monotonic counter incremented on each emitted video keyframe. Tracks current GOP position. */
+  #lastKeyframeGroupId = 0;
+  /** Callback fired when no complete keyframe is emitted within keyframeLostTimeoutMs. Argument: next expected groupId. */
+  #onKeyframeLost: ((expectedGroupId: number) => void) | null = null;
+
+  /**
+   * Owner-held state to reset when a multicast stream's publisher restarts
+   * (BLO-36599); see #processMMTP. The router has already reset its own state
+   * for the stream when this runs.
+   */
+  #onPublisherRestart: ((packetId: number, catalogTrackName: string) => void) | null;
+  #publisherRestarts = 0;
+  // FEC Payload IDs left unread because their (owner) packetId had no
+  // configured fec.blockProfile (see #noteUnreadableFecPayloadId).
+  #fecPayloadIdsWithoutProfile = 0;
+
+  /** The staged in-place stream switch, if any (stageStreamSwitch). */
+  #staged: StreamSwitchState | null = null;
+
+  #disposed = false;
+
+  constructor(config?: {
+    fecManager?: FECManagerLike;
+    fecMapper?: FecBlockMapper;
+    /** MFU reassembly timeout (ms) for FEC recovery path. Derive from FEC interleaveDepthMs. */
+    mfuTimeoutMs?: number;
+    reassemblyPolicy?: MfuReassemblyPolicy;
+    reassembler?: MfuReassemblerBackend;
+    maxBufferedMfus?: number;
+    /** Catalog-derived keyframe loss timeout (ms). Derive from explicit
+     *  keyframe/group duration; do not use FEC sourceSymbols as GOP length.
+     *  Pass a reader when its inputs are measured later; see
+     *  setKeyframeLostTimeoutMs. */
+    keyframeLostTimeoutMs?: number | (() => number);
+    manifestVerifier?: ManifestVerifier;
+    /** Existing behavior is router ownership; shared browser plans opt into caller ownership. */
+    manifestVerifierOwnership?: "caller" | "router";
+    resolveManifestIdentity?: (
+      packetId: number,
+      sbn: number,
+      esi: number,
+      catalogTrackName?: string,
+    ) => ManifestObjectIdentity | null;
+    resolveManifestIdentityForRoute?: ManifestIdentityResolver;
+    /** Internal terminal-failure sink owned by the composing transport. */
+    onBlockFailed?: (
+      sbn: number,
+      packetId: number,
+      catalogTrackName: string | undefined,
+      blockClass: BlockClass,
+    ) => void;
+    /** Internal gap-decision sink owned by the composing transport. */
+    onFrameGap?: (decision: FrameGapDecision) => void;
+    /**
+     * Called when a multicast stream's publisher restarted its wire counters,
+     * after the router reset its own state for the stream, so the composing
+     * transport can reset what it holds (FEC blocks, repair I/O) before the
+     * packet that revealed the restart is processed.
+     */
+    onPublisherRestart?: (packetId: number, catalogTrackName: string) => void;
+  }) {
+    this.#onPublisherRestart = config?.onPublisherRestart ?? null;
+    this.#keyframeLostTimeoutMs = config?.keyframeLostTimeoutMs ?? null;
+    this.#fecManager = config?.fecManager ?? null;
+    this.#onFrameGap = config?.onFrameGap ?? null;
+    this.#defaultFecMapper = config?.fecMapper ?? null;
+    this.#manifestVerifier = config?.manifestVerifier ?? null;
+    this.#ownsManifestVerifier = config?.manifestVerifierOwnership !== "caller";
+    this.#resolveManifestIdentity = config?.resolveManifestIdentity ?? null;
+    this.#resolveManifestIdentityForRoute = config?.resolveManifestIdentityForRoute ?? null;
+
+    // Create MMTP parser — handles MFU extraction, reassembly, keyframe detection.
+    // Its MFUReassembler is the single reassembler for BOTH the source path
+    // (parser.feed) and the FEC-recovery path (#routeRecoveredBlock), so a frame
+    // split across both completes (BLO-8151). mfuTimeoutMs threads the
+    // catalog-derived timeout through.
+    this.#parser = new MmtpContainerParser({
+      mfuTimeoutMs: config?.mfuTimeoutMs,
+      reassemblyPolicy: config?.reassemblyPolicy,
+      reassembler: config?.reassembler,
+      maxBufferedMfus: config?.maxBufferedMfus,
+      ...(this.#fecManager ? { fecReleaseGate: this.#createFecReleaseGate() } : {}),
+    });
+
+    // Wire parser init callback → router's init delivery (dedup).
+    this.#parser.onInit((data, packetId, catalogTrackName) => {
+      this.#diagFor(packetId, catalogTrackName).initSegments++;
+      this.#deliverInit(packetId, data, catalogTrackName);
+    });
+
+    // Wire parser frame callback → router's callback routing + CMAF assembly.
+    this.#parser.onFrame((data, meta) => this.#routeParsedFrame(data, meta));
+
+    // Wire up FECManager block lifecycle events.
+    // NOTE: Recovery routing is handled from feedSourceSymbol/feedRepairSymbol
+    // return values in #processMMTP — no onBlockRecovered event needed.
+    this.#wireFecLifecycle(config?.onBlockFailed);
+  }
+
+  /**
+   * Deliver one parser frame: MSE assembly, sync gating, and callback
+   * routing. Reads #currentFecInfo, the FEC coordinates of the packet the
+   * frame completed on.
+   */
+  #deliverParsedFrame(data: Uint8Array, meta: ParserFrameMeta): void {
+    const packetId = meta.packetId;
+    const diag = this.#diagFor(packetId, meta.catalogTrackName);
+    diag.frames++;
+    diag.lastFrameTimestamp = meta.timestamp;
+    const isVideo = this.#classifyPacketId(packetId) === true;
+    const frameMeta: RoutedFrameMeta = {
+      timestamp: meta.timestamp,
+      ...(meta.mmtpTimestamp === undefined
+        ? {}
+        : { mmtpTimestamp: meta.mmtpTimestamp }),
+      keyframe: isVideo ? meta.keyframe : true,
+      packetId,
+      packetSequenceNumber: meta.packetSequenceNumber ?? this.#currentSeqNum,
+      ...(meta.authoredTiming === undefined
+        ? {}
+        : { authoredTiming: meta.authoredTiming }),
+      ...(meta.packetSequenceNumbers === undefined
+        ? {}
+        : { packetSequenceNumbers: meta.packetSequenceNumbers }),
+      ...(meta.repairedPacketSequenceNumbers === undefined
+        ? {}
+        : { repairedPacketSequenceNumbers: meta.repairedPacketSequenceNumbers }),
+      ...(meta.mpuSequenceNumber === undefined
+        ? {}
+        : { mpuSequenceNumber: meta.mpuSequenceNumber }),
+      ...(meta.movieFragmentSequenceNumber === undefined
+        ? {}
+        : { movieFragmentSequenceNumber: meta.movieFragmentSequenceNumber }),
+      ...(meta.sampleNumber === undefined
+        ? {}
+        : { sampleNumber: meta.sampleNumber }),
+      ...(meta.catalogTrackName === undefined
+        ? {}
+        : { catalogTrackName: meta.catalogTrackName }),
+    };
+    if (meta.source) frameMeta.source = meta.source;
+    // Forward whenever present, not when truthy: 'unknown' is a verdict the
+    // parser reached, not a value to drop.
+    if (meta.deliveryProvenance !== undefined)
+      frameMeta.deliveryProvenance = meta.deliveryProvenance;
+    if (meta.recovered) frameMeta.recovered = true;
+    if (meta.gapBefore) frameMeta.gapBefore = meta.gapBefore;
+    const sourceDiscontinuity = this.#opensFecSync(
+      packetId,
+      frameMeta.keyframe,
+      frameMeta.catalogTrackName,
+    );
+
+    // Route to MSE assembler if active for this track.
+    const assembler = this.#mseAssemblerFor(packetId, frameMeta.catalogTrackName);
+    if (assembler && frameMeta.recovered) {
+      // An FEC-recovered frame released in order by the FEC release gate.
+      assembler.addRecoveredBlock(meta.fecSbn ?? -1, [{
+        data,
+        timestamp: frameMeta.timestamp,
+        keyframe: frameMeta.keyframe,
+        ...(frameMeta.mmtpTimestamp === undefined ? {} : { mmtpTimestamp: frameMeta.mmtpTimestamp }),
+        ...(frameMeta.authoredTiming === undefined ? {} : { authoredTiming: frameMeta.authoredTiming }),
+        ...(frameMeta.packetSequenceNumber === undefined
+          ? {}
+          : { packetSequenceNumber: frameMeta.packetSequenceNumber }),
+        ...(frameMeta.packetSequenceNumbers === undefined
+          ? {}
+          : { packetSequenceNumbers: frameMeta.packetSequenceNumbers }),
+        ...(frameMeta.repairedPacketSequenceNumbers === undefined
+          ? {}
+          : { repairedPacketSequenceNumbers: frameMeta.repairedPacketSequenceNumbers }),
+        ...(frameMeta.mpuSequenceNumber === undefined ? {} : { mpuSequenceNumber: frameMeta.mpuSequenceNumber }),
+        ...(frameMeta.movieFragmentSequenceNumber === undefined
+          ? {}
+          : { movieFragmentSequenceNumber: frameMeta.movieFragmentSequenceNumber }),
+        ...(frameMeta.sampleNumber === undefined ? {} : { sampleNumber: frameMeta.sampleNumber }),
+        ...(frameMeta.catalogTrackName === undefined ? {} : { catalogTrackName: frameMeta.catalogTrackName }),
+        ...(frameMeta.deliveryProvenance === undefined
+          ? {}
+          : { deliveryProvenance: frameMeta.deliveryProvenance }),
+        ...(frameMeta.gapBefore === undefined ? {} : { gapBefore: frameMeta.gapBefore }),
+      }]);
+    } else if (assembler) {
+      const fecInfo = this.#currentFecInfo;
+      if (fecInfo && !fecInfo.oversized) {
+        assembler.addFrame(
+          fecInfo.sbn,
+          fecInfo.esi,
+          data,
+          frameMeta.timestamp,
+          frameMeta.keyframe,
+          frameMeta.catalogTrackName,
+          frameMeta.mpuSequenceNumber,
+          frameMeta.packetSequenceNumber,
+          frameMeta.packetSequenceNumbers,
+          frameMeta.repairedPacketSequenceNumbers,
+          frameMeta.authoredTiming,
+          frameMeta.deliveryProvenance,
+          frameMeta.mmtpTimestamp,
+          frameMeta.movieFragmentSequenceNumber,
+          frameMeta.sampleNumber,
+          frameMeta.gapBefore,
+        );
+      } else {
+        assembler.addBypassFrame(
+          data,
+          frameMeta.timestamp,
+          frameMeta.keyframe,
+          frameMeta.catalogTrackName,
+          frameMeta.mpuSequenceNumber,
+          frameMeta.packetSequenceNumber,
+          frameMeta.packetSequenceNumbers,
+          frameMeta.repairedPacketSequenceNumbers,
+          frameMeta.authoredTiming,
+          frameMeta.deliveryProvenance,
+          frameMeta.mmtpTimestamp,
+          frameMeta.movieFragmentSequenceNumber,
+          frameMeta.sampleNumber,
+          frameMeta.gapBefore,
+        );
+      }
+    }
+
+    if (assembler && isVideo) {
+      this.#noteDeliveredVideo(this.#mediaStreamKey(packetId, frameMeta.catalogTrackName), frameMeta);
+    }
+
+    if (!this.#shouldEmitFrame(
+      packetId,
+      frameMeta.keyframe,
+      frameMeta.catalogTrackName,
+    )) return;
+    if (sourceDiscontinuity) frameMeta.sourceDiscontinuity = true;
+
+    this.#noteEmittedKeyframe(packetId, frameMeta.keyframe);
+
+    // The emitted-sequence high-water mark (#noteEmittedVideoSeq) is recorded
+    // at the actual emit inside #emitDirectVideo, not here — a recovered frame
+    // can be queued ahead of the source cursor, so it must track real emits.
+
+    // Route to per-track or legacy callback. Even when an MSE block-assembler
+    // is registered, this callback still fires — downstream consumers
+    // (`mc.onVideoFrame` → takeover detection, multicast frame counter,
+    // `confirmVideo`/`confirmAudio`) need every reassembled frame. The
+    // SourceBuffer-write side of this callback path is suppressed inside
+    // `MseBackend.feedVideo`/`feedAudio` when the assembler owns the track,
+    // which is configured via `MseBackend.setAssemblerOwns('video' | 'audio')`.
+    // Prevents the dual-CMAF-timeline collision (BLO-3035 layer 3).
+    const cb = this.#getFrameCallback(packetId);
+    if (isVideo && !assembler) {
+      if (frameMeta.recovered) {
+        this.#routeDirectRecoveredVideo(packetId, data, frameMeta, cb);
+      } else {
+        this.#routeDirectSourceVideo(packetId, data, frameMeta, cb);
+      }
+    } else if (!isVideo && !assembler) {
+      if (frameMeta.recovered) {
+        this.#routeDirectRecoveredAudio(packetId, data, frameMeta, cb);
+      } else {
+        this.#routeDirectSourceAudio(packetId, data, frameMeta, cb);
+      }
+    } else {
+      cb?.(data, frameMeta);
+    }
+  }
+
+  #wireFecLifecycle(
+    onBlockFailed:
+      | ((
+          sbn: number,
+          packetId: number,
+          catalogTrackName: string | undefined,
+          blockClass: BlockClass,
+        ) => void)
+      | undefined,
+  ): void {
+    if (this.#fecManager) {
+      this.#fecManager.onBlockStarted = (
+        sbn: number,
+        packetId: number,
+        _catalogTrackName?: string,
+      ) => {
+        this.#onBlockStarted?.(sbn, packetId);
+      };
+
+      this.#fecManager.onBlockResolved = (
+        _sbn: number,
+        packetId: number,
+        catalogTrackName: string | undefined,
+      ) => {
+        this.#requestFecPoke(packetId, catalogTrackName);
+      };
+      this.#fecManager.onSourceDiscontinuity = (
+        packetId: number,
+        catalogTrackName: string | undefined,
+      ) => {
+        // Mark now, drain through the same deferral as every other gate
+        // wake: this fires from inside FECManager.trackBlock, and a
+        // synchronous drain would re-enter FECManager (noteReleasedRap) and
+        // the downstream sink mid-update.
+        this.#parser.markFecDiscontinuity(packetId, catalogTrackName);
+        this.#requestFecPoke(packetId, catalogTrackName);
+      };
+
+      this.#fecManager.onBlockComplete = (
+        sbn: number,
+        packetId: number,
+        catalogTrackName?: string,
+      ) => {
+        this.#mseAssemblerFor(packetId, catalogTrackName)?.completeBlock(sbn);
+        // Phase 14 D-26: fan-out to delta callback when delta-role packetId completes.
+        if (
+          this.#isCatalogTrackUnambiguous(packetId, catalogTrackName) &&
+          this.#packetIdRoles.get(packetId) === "delta"
+        ) {
+          this.#onDeltaBlockCompleteCb?.(packetId, false); // failed=false
+        }
+      };
+
+      this.#fecManager.onBlockFailed = (
+        sbn: number,
+        packetId: number,
+        catalogTrackName: string | undefined,
+        blockClass: BlockClass,
+      ) => {
+        this.#mseAssemblerFor(packetId, catalogTrackName)?.failBlock(sbn);
+        if (
+          this.#isCatalogTrackUnambiguous(packetId, catalogTrackName) &&
+          this.#packetIdRoles.get(packetId) === "delta"
+        ) {
+          this.#onDeltaBlockCompleteCb?.(packetId, true); // failed=true
+        }
+        onBlockFailed?.(sbn, packetId, catalogTrackName, blockClass);
+        this.#onBlockFailed?.(sbn, packetId, catalogTrackName, blockClass);
+      };
+    }
+  }
+
+  // ── Accessors ───────────────────────────────────────────────────
+
+  get fecManager(): FECManagerLike | null {
+    return this.#fecManager;
+  }
+
+  /**
+   * How long this router keeps a packet ID's duplicate ledgers, derived from
+   * the FEC manager's geometry for it (see duplicate-ledger.ts), or why no
+   * horizon is derivable (the stream then keeps count-bounded ledgers, or none
+   * without an FEC manager). A stream reads this when it moves to a new FEC
+   * block, so a catalog change applies from the next block.
+   */
+  duplicateHorizonFor(packetId: number): DuplicateHorizon {
+    const fec = this.#fecManager;
+    if (!fec) return NO_FEC_MANAGER_HORIZON;
+    if (!fec.interleaveDepthMsForPacket || !fec.blockLifetimeMsForPacket) {
+      return NO_FEC_GEOMETRY_HORIZON;
+    }
+    const blockSpanMs = fec.interleaveDepthMsForPacket(packetId);
+    // FECManager reports 0 for a stream the catalog gave no block span.
+    if (blockSpanMs === 0) return NO_BLOCK_SPAN_HORIZON;
+    return {
+      kind: "fec-horizon",
+      retentionMs: duplicateRetentionMs({
+        blockSpanMs,
+        blockLifetimeMs: fec.blockLifetimeMsForPacket(packetId),
+      }),
+    };
+  }
+
+  /** Publisher restarts detected on the multicast leg since construction. */
+  get publisherRestartCount(): number {
+    return this.#publisherRestarts;
+  }
+
+  /**
+   * Packets whose Source or Repair FEC Payload ID was left unread because
+   * their (owner) packetId had no configured `fec.blockProfile`: FEC not
+   * configured yet for a track whose packets already flow, or a track whose
+   * catalog FEC was unusable. Such a source packet's media is routed as on a
+   * track without FEC; such a repair packet is dropped. Neither is read as a
+   * block coordinate under a guessed profile, and neither touches FEC state.
+   */
+  get fecPayloadIdsWithoutProfile(): number {
+    return this.#fecPayloadIdsWithoutProfile;
+  }
+
+  get reassembler(): MfuReassemblerBackend {
+    return this.#parser.reassembler;
+  }
+
+  getDiagnostics(): Record<number, ParserDiagnostics> {
+    const out: Record<number, ParserDiagnostics> = {};
+    // The reassembler is shared by every stream; its occupancy is one reading
+    // taken now, not a per-packet snapshot (BLO-36599).
+    const status = this.#parserDiagnostics.size > 0
+      ? this.#parser.reassembler.getStatus()
+      : null;
+    for (const [key, diag] of this.#parserDiagnostics) {
+      if (status) {
+        diag.pendingBuffers = status.bufferedMFUs;
+        diag.pendingFragments = status.pendingFragments;
+        diag.pendingSamples = status.pendingSamples;
+      }
+      const packetId = this.#packetIdFromStreamKey(key);
+      const existing = out[packetId];
+      if (!existing) {
+        out[packetId] = { ...diag };
+        continue;
+      }
+      const latest =
+        diag.lastSequenceNumber >= existing.lastSequenceNumber ? diag : existing;
+      out[packetId] = {
+        packets: existing.packets + diag.packets,
+        frames: existing.frames + diag.frames,
+        initSegments: existing.initSegments + diag.initSegments,
+        noFragment: existing.noFragment + diag.noFragment,
+        fragments: existing.fragments + diag.fragments,
+        reassembled: existing.reassembled + diag.reassembled,
+        pendingBuffers: existing.pendingBuffers + diag.pendingBuffers,
+        pendingFragments: existing.pendingFragments + diag.pendingFragments,
+        directAudioSourceEmitted:
+          existing.directAudioSourceEmitted + diag.directAudioSourceEmitted,
+        directAudioSourceRegressions:
+          existing.directAudioSourceRegressions + diag.directAudioSourceRegressions,
+        directAudioRecoveredQueued:
+          existing.directAudioRecoveredQueued + diag.directAudioRecoveredQueued,
+        directAudioRecoveredDrained:
+          existing.directAudioRecoveredDrained + diag.directAudioRecoveredDrained,
+        directAudioRecoveredStaleDropped:
+          existing.directAudioRecoveredStaleDropped + diag.directAudioRecoveredStaleDropped,
+        pendingSamples: [
+          ...((existing.pendingSamples as unknown[]) ?? []),
+          ...((diag.pendingSamples as unknown[]) ?? []),
+        ],
+        lastPacketLength: latest.lastPacketLength,
+        lastSequenceNumber: latest.lastSequenceNumber,
+        ...(latest.lastFecSsId === undefined ? {} : { lastFecSsId: latest.lastFecSsId }),
+        ...(latest.lastFrameTimestamp === undefined
+          ? {}
+          : { lastFrameTimestamp: latest.lastFrameTimestamp }),
+      };
+    }
+    return out;
+  }
+
+  // ── Track configuration ─────────────────────────────────────────
+
+  /** Register callback for keyframe loss detection.
+   *  Fires when no complete keyframe is emitted within keyframeLostTimeoutMs.
+   *  Argument: next expected groupId (lastKeyframeGroupId + 1). */
+  onKeyframeLost(cb: (expectedGroupId: number) => void): void {
+    this.#onKeyframeLost = cb;
+  }
+
+  /**
+   * Set the keyframe loss timeout after construction.
+   * Must be called BEFORE setPacketIdType('video').
+   * A fixed timeout derives from explicit keyframe/group duration:
+   * Math.ceil(groupDurationMs * KEYFRAME_LOST_TIMEOUT_SLACK).
+   * A timeout whose inputs are measured after configuration (e.g. keyframe
+   * cadence plus measured playout lateness) is passed as a reader, evaluated
+   * each time the timer is armed. Both forms pass the same check at each arm:
+   * a throw, or a value that is not finite, positive and within the timer
+   * maximum, leaves that keyframe unarmed (fail closed per keyframe, not per
+   * session). A fixed NaN, e.g. derived from a catalog without a group
+   * duration, therefore never reaches setTimeout.
+   */
+  setKeyframeLostTimeoutMs(ms: number | (() => number)): void {
+    this.#keyframeLostTimeoutMs = ms;
+    this.#keyframeLostUnarmedReason = null;
+  }
+
+  /** Update MFU reassembly timeout. Source and FEC-recovery paths share the
+   *  parser's single reassembler (BLO-8151), so one update covers both. */
+  setMfuTimeoutMs(ms: number): void {
+    if (ms <= 0) throw new Error("[MmtpRouter] mfuTimeoutMs must be > 0");
+    this.#parser.setMfuTimeoutMs(ms);
+  }
+
+  /** Update parser frame reordering for unordered multicast delivery.
+   *  Callers derive this from the catalog FEC block span (§5.1 — the
+   *  interleave value IS the span): positive round-half-up of span / frameMs. */
+  setReorderWindow(windowSize: number): void {
+    this.#parser.setReorderWindow(windowSize);
+  }
+
+  /** Register MMTP packetId → track type mapping.
+   *  Call BEFORE packets arrive to ensure correct routing from the first packet.
+   *  If keyframeLostTimeoutMs is not provided, Phase 13 keyframe repair is
+   *  disabled (video still routes/decodes normally). framerate is OPTIONAL per
+   *  draft-ietf-moq-catalogformat-01 §3.2.23, so we can't require the timeout. */
+  setPacketIdType(packetId: number, trackType: "video" | "audio"): void {
+    if (trackType === "video" && this.#keyframeLostTimeoutMs === null) {
+      console.warn(
+        "[MmtpRouter] keyframeLostTimeoutMs not configured — Phase 13 keyframe " +
+          "repair disabled for this track. Set it via setKeyframeLostTimeoutMs() " +
+          "or provide in constructor config to enable: " +
+          "Math.ceil(groupDurationMs * KEYFRAME_LOST_TIMEOUT_SLACK).",
+      );
+    }
+    if (trackType === "video") this.#videoPacketIds.add(packetId);
+    else this.#audioPacketIds.add(packetId);
+    // Sync track info to parser for codec-aware keyframe detection.
+    const codec = this.#trackCodecs.get(packetId) ?? "";
+    this.#parser.setTrack(packetId, { type: trackType, codec });
+  }
+
+  /** Media kind registered for a packetId, if any. */
+  trackKindFor(packetId: number): "video" | "audio" | undefined {
+    const classification = this.#classifyPacketId(packetId);
+    return classification === null ? undefined : classification ? "video" : "audio";
+  }
+
+  /** Register codec string for a packetId — enables codec-aware keyframe detection.
+   *  Without this, only H.264 IDR (NAL type 5) is detected as keyframe fallback.
+   *  AV1 (OBU_SEQUENCE_HEADER) and VP9 (frame_type bit) require the codec string. */
+  setTrackCodec(packetId: number, codec: string): void {
+    this.#trackCodecs.set(packetId, codec);
+    // Sync to parser. Determine track type from existing registration.
+    const trackType = this.#videoPacketIds.has(packetId)
+      ? ("video" as const)
+      : this.#audioPacketIds.has(packetId)
+        ? ("audio" as const)
+        : null;
+    if (trackType) {
+      this.#parser.setTrack(packetId, { type: trackType, codec });
+    }
+  }
+
+  // ── Frame callbacks ─────────────────────────────────────────────
+
+  /** @deprecated Use onTrackFrame(packetId, cb) for per-track routing */
+  onVideoFrame(cb: FrameCallback): void {
+    this.#onVideoFrame = cb;
+    this.#resolvedCallbacks.clear();
+  }
+
+  /** @deprecated Use onTrackFrame(packetId, cb) for per-track routing */
+  onAudioFrame(cb: FrameCallback): void {
+    this.#onAudioFrame = cb;
+    this.#resolvedCallbacks.clear();
+  }
+
+  /** Register a frame callback for a specific MMTP packetId (track).
+   *  When a legacy callback (onVideoFrame/onAudioFrame) also exists for this
+   *  packetId's type, both fire: per-track first, then legacy. This ensures
+   *  element.ts wiring (confirmAudio, feedMulticast) continues working when
+   *  TrackPipeline registers per-track sources. */
+  onTrackFrame(
+    packetId: number,
+    cb: FrameCallback,
+  ): void {
+    this.#trackCallbacks.set(packetId, cb);
+    this.#resolvedCallbacks.clear();
+  }
+
+  /** Register a raw MMTP source-packet callback for one track.
+   *
+   * Direct packets retain their original bytes, including a Source FEC Payload
+   * ID when present. FEC-recovered packets are the recovered source-symbol
+   * bytes and set `skipFecPayloadId` because that trailer is not part of the
+   * protected symbol. Repair packets are never delivered here.
+   */
+  onTrackPacket(packetId: number, cb: TrackPacketCallback): void {
+    this.#trackPacketCallbacks.set(packetId, cb);
+  }
+
+  /** Register an init segment callback (ftyp+moov from MMTP MPU metadata). */
+  onInitSegment(cb: (data: Uint8Array) => void): void {
+    this.#onInitSegment = cb;
+  }
+
+  /** Register an init segment callback for a specific MMTP packetId.
+   *  Called when FT=0 init arrives via direct source or FEC recovery. */
+  onTrackInit(packetId: number, cb: (data: Uint8Array) => void): void {
+    this.#trackInitCallbacks.set(packetId, cb);
+  }
+
+  // ── MSE integration ─────────────────────────────────────────────
+
+  /** Create a CMAF block assembler for MSE mode on a specific track.
+   *  When active, source frames are buffered per FEC block and emitted as
+   *  multi-sample CMAF segments instead of per-frame callbacks. */
+  enableMseAssembler(
+    packetId: number,
+    config: Omit<BlockAssemblerConfig, "k">,
+    catalogTrackName?: string,
+  ): CmafBlockAssembler {
+    const k = this.#kForPacket(packetId);
+    const assemblerKey = this.#mseAssemblerKey(packetId, catalogTrackName);
+    const previous = this.#mseAssemblers.get(assemblerKey);
+    if (previous) {
+      previous.flush();
+      previous.dispose();
+    }
+    const assembler = new CmafBlockAssembler({ ...config, k });
+    this.#mseAssemblers.set(assemblerKey, assembler);
+    console.log(
+      `[MmtpRouter] MSE assembler enabled for packetId=${packetId}${catalogTrackName === undefined ? "" : ` track=${catalogTrackName}`} (K=${k}, ${config.trackType})`,
+    );
+    return assembler;
+  }
+
+  /** Register a segment callback for a track's MSE assembler.
+   *  Called with complete moof+mdat CMAF segments on block completion. */
+  onMseSegment(packetId: number, cb: (segment: Uint8Array) => void, catalogTrackName?: string): void {
+    const assembler = this.#mseAssemblers.get(this.#mseAssemblerKey(packetId, catalogTrackName));
+    if (assembler) assembler.onSegment = cb;
+  }
+
+  /** Register a raw-sample callback for a track's MSE assembler.
+   *  Use this when the caller already owns the fMP4/MSE timeline and only wants
+   *  FEC recovery, keyframe gating, and dedup from the assembler. */
+  onMseSample(packetId: number, cb: (sample: CmafBlockSample) => void, catalogTrackName?: string): void {
+    const assembler = this.#mseAssemblers.get(this.#mseAssemblerKey(packetId, catalogTrackName));
+    if (assembler) assembler.onSample = cb;
+  }
+
+  /** Register an init segment callback for a track's MSE assembler. */
+  onMseInitSegment(packetId: number, cb: (init: Uint8Array) => void, catalogTrackName?: string): void {
+    const assembler = this.#mseAssemblers.get(this.#mseAssemblerKey(packetId, catalogTrackName));
+    if (assembler) assembler.onInitSegment = cb;
+  }
+
+  /** Build and emit init segment for a track's MSE assembler from catalog config. */
+  emitMseInit(packetId: number, catalogTrackName?: string): void {
+    this.#mseAssemblers.get(this.#mseAssemblerKey(packetId, catalogTrackName))?.emitInit();
+  }
+
+  /** Mark a video track as synchronized by an external path.
+   *  This opens the MMTP/FEC pre-sync gates without waiting for a multicast
+   *  keyframe, for MSE timelines already seeded by MoQ with the same track. */
+  markExternalVideoSync(packetId?: number, catalogTrackName?: string): void {
+    const packetIds =
+      packetId === undefined
+        ? [...this.#videoPacketIds]
+        : this.#videoPacketIds.has(packetId)
+          ? [packetId]
+          : [];
+    for (const id of packetIds) {
+      const streamKey = this.#mediaStreamKey(id, catalogTrackName);
+      this.#trackSynced.add(streamKey);
+      this.#droppedPreSyncVideo.delete(streamKey);
+      this.#mseAssemblerFor(id, catalogTrackName)?.markVideoSynced();
+    }
+  }
+
+  // ── FEC event handler ───────────────────────────────────────────
+
+  /** Register callback for FEC blocks when the first source symbol arrives. */
+  onFecBlockStarted(cb: (sbn: number, packetId: number) => void): void {
+    this.#onBlockStarted = cb;
+  }
+
+  /** Register a diagnostic callback for FEC blocks that fail. A failure is
+   *  not a decoder instruction: act on `RoutedFrameMeta.gapBefore`. */
+  onFecBlockFailed(
+    cb: (
+      sbn: number,
+      packetId: number,
+      catalogTrackName: string | undefined,
+      blockClass: BlockClass,
+    ) => void,
+  ): void {
+    this.#onBlockFailed = cb;
+  }
+
+  // ── Phase 14: per-role packetId dispatch (D-26, D-27, D-28) ────────
+
+  /**
+   * Register a TrackRole for a specific packetId.
+   *
+   * D-26: Enables per-role block-complete fanout — delta-role packetIds fire
+   * onDeltaBlockComplete when their FEC block completes or fails.
+   * Composite callback preserved: legacy onVideoFrame/onAudioFrame still fire
+   * (MEMORY.md "prevents callback stealing").
+   *
+   * Valid roles: 'base' | 'delta' | 'repair' | 'single'.
+   * Throws on unknown role (error on bad init, CLAUDE.md).
+   */
+  setPacketIdRole(packetId: number, role: TrackRole): void {
+    const VALID_ROLES: readonly TrackRole[] = [
+      "base",
+      "delta",
+      "repair",
+      "single",
+    ];
+    if (!VALID_ROLES.includes(role)) {
+      throw new Error(
+        `[MmtpRouter] setPacketIdRole: unknown role '${role}'. Valid: ${VALID_ROLES.join(", ")}`,
+      );
+    }
+    this.#packetIdRoles.set(packetId, role);
+  }
+
+  /** Replace catalog-derived repair ownership before a catalog reconfiguration. */
+  clearRepairPacketIdOwners(): void {
+    this.#repairOwnersByPacketId.clear();
+  }
+
+  /** Bind one dedicated repair-track PID to its authoritative media PID. */
+  setRepairPacketIdOwner(repairPacketId: number, ownerPacketId: number): void {
+    const owners = this.#repairOwnersByPacketId.get(repairPacketId) ?? new Set<number>();
+    owners.add(ownerPacketId);
+    this.#repairOwnersByPacketId.set(repairPacketId, owners);
+  }
+
+  /**
+   * Register callback fired when a delta-track FEC block completes or fails.
+   *
+   * @param cb - (packetId, failed) — packetId identifies the delta track,
+   *             failed=false means clean/recovered, failed=true means unrecoverable.
+   *
+   * Called from both onBlockComplete (failed=false) and onBlockFailed (failed=true)
+   * for every packetId registered with role='delta' via setPacketIdRole().
+   */
+  onDeltaBlockComplete(cb: (packetId: number, failed: boolean) => void): void {
+    this.#onDeltaBlockCompleteCb = cb;
+  }
+
+  // ── Packet processing ───────────────────────────────────────────
+
+  /** Update framerate — delegates to FECManager for timeout refinement. */
+  setFramerate(fps: number): void {
+    this.#fecManager?.setFramerate(fps);
+  }
+
+  /** Set FEC block mapper (created when FEC config becomes known via configureFec). */
+  setFecMapper(mapper: FecBlockMapper, packetId?: number): void {
+    if (packetId == null) {
+      this.#defaultFecMapper = mapper;
+      return;
+    }
+    this.#fecMappersByPacketId.set(packetId, mapper);
+  }
+
+  registerManifestTrack(context: ManifestTrackContext): void {
+    if (!this.#manifestVerifier) throw new Error("manifest verifier is not configured");
+    this.#manifestVerifier.registerTrack(context);
+  }
+
+  feedManifestFrame(trackName: string, frame: Uint8Array): void {
+    this.#manifestVerifier?.ingestManifestFrame(trackName, frame);
+  }
+
+  setManifestAuthMode(mode: ManifestAuthMode): void {
+    this.#manifestVerifier?.setMode(mode);
+    if (mode !== "enforce") {
+      for (const queue of this.#manifestRecoveryQueues.values()) {
+        for (const item of queue) {
+          this.#routeProcessedFecSymbols(
+            item.blockId,
+            item.result,
+            item.ownerPacketId,
+            item.catalogTrackName,
+          );
+        }
+      }
+      this.#manifestRecoveryQueues.clear();
+    }
+  }
+
+  /**
+   * Main entry point: feed a raw MMTP packet for processing.
+   *
+   * Source packets are played immediately AND fed to FECManager for recovery.
+   * Repair packets are fed to FECManager only (no direct playback).
+   */
+  /**
+   * Feed one MMTP source packet.
+   *
+   * `source` is REQUIRED. It used to default to "multicast", which meant any
+   * caller that forgot it silently attributed its bytes to a multicast socket
+   * they may never have crossed — and that attribution is what the physical-
+   * delivery evidence path is built on. Absence is not multicast; say which.
+   */
+  feedPacket(
+    packet: Uint8Array,
+    source: "multicast" | "moq",
+    manifestIdentity?: ManifestObjectIdentity,
+    ingress?: MmtpIngressContext,
+  ): void {
+    if (this.#disposed) return;
+    this.#withDeferredFecPokes(() => {
+      this.#processMMTP(packet, source, manifestIdentity, false, ingress);
+    });
+  }
+
+  /**
+   * Feed a reliable MoQ duplicate of a source packet that the multicast leg
+   * also carries, during make-before-break overlap.
+   *
+   * The copy is parsed for playback (attributed to "moq") so a pending
+   * multicast decoder can warm. For an FEC-tagged packet the router keeps a
+   * per-symbol (SBN/ESI) parse ledger, so whichever of it and its multicast
+   * twin arrives first is parsed and the second is not. The MFU reassembler
+   * cannot be that dedup: complete (FI=0) MFUs bypass its #emitted set.
+   *
+   * The ledger exists only where a symbol coordinate does: a packet with no
+   * FEC payload ID, or a router with no FEC manager, has none, so it and its
+   * twin are BOTH parsed. On an audio track that delivers the sample twice
+   * (#emitDirectSourceAudio counts the regression and still emits). The
+   * intended deployment is safe because the multicast leg is FEC-protected,
+   * so its media packets carry the ID; the untagged timing packets
+   * (init/moof) take this path too, where a re-parse is benign. Do not feed
+   * untagged media through here.
+   *
+   * The copy never enters FEC
+   * accounting: no `feedSymbolFromSource`, `trackBlock` or
+   * `feedSourceSymbol`. Block completion and the repair deadline therefore
+   * follow the multicast leg alone, and a multicast erasure still starves its
+   * block and requests repair. Feeding the copy through `feedPacket` instead
+   * would let it close the block, hiding exactly the loss repair exists for.
+   *
+   * MoQ unicast fallback is not an overlap copy: it is the only source, so it
+   * uses `feedPacket(packet, "moq")` and counts toward completion.
+   */
+  feedOverlapCopy(packet: Uint8Array, ingress?: MmtpIngressContext): void {
+    if (this.#disposed) return;
+    this.#withDeferredFecPokes(() => {
+      this.#processMMTP(packet, "moq", undefined, false, ingress, true);
+    });
+  }
+
+  /**
+   * Feed a repair packet from MoQ (reliable QUIC) — parses MMTP repair
+   * header and delegates to FECManager for FEC recovery.
+   */
+  feedRepairPacket(
+    packet: Uint8Array,
+    ownerPacketIdHint?: number,
+    catalogTrackName?: string,
+  ): void {
+    if (this.#disposed) return;
+    this.#withDeferredFecPokes(() => {
+      this.#feedRepairPacket(packet, ownerPacketIdHint, catalogTrackName);
+    });
+  }
+
+  #feedRepairPacket(
+    packet: Uint8Array,
+    ownerPacketIdHint: number | undefined,
+    catalogTrackName: string | undefined,
+  ): void {
+    // One header parse per packet, as on the multicast repair branch: mmt-fec's
+    // parseRepairPacket() parsed it once more before this parse (BLO-36599).
+    let header: MMTPHeader;
+    try {
+      header = parseMMTPHeader(packet);
+    } catch {
+      return;
+    }
+    const parsed = parseMoqRepairFrameWithHeader(packet, header);
+    if (!parsed) return;
+
+    // A dedicated repair track can carry a packet ID that differs from the
+    // media packet ID. The subscribing track supplies the authoritative owner.
+    const repairPacketId = header.packetId;
+
+    const hintedOwner =
+      ownerPacketIdHint != null && this.#classifyPacketId(ownerPacketIdHint) !== null
+        ? ownerPacketIdHint
+        : null;
+    // A MoQ repair subscription owns a media track explicitly. Dedicated
+    // repair PIDs must carry that hint; only same-PID repair is self-describing.
+    const ownerPacketId = hintedOwner ??
+      (this.#classifyPacketId(repairPacketId) !== null ? repairPacketId : null);
+    if (ownerPacketId === null) {
+      debugRouter(
+        `[MmtpRouter] Dropping MoQ repair packet pid=${repairPacketId}: owner hint is required`,
+      );
+    }
+
+    if (ownerPacketId != null && this.#fecManager) {
+      this.#moqRepairPidCounts[repairPacketId] =
+        (this.#moqRepairPidCounts[repairPacketId] || 0) + 1;
+      this.#moqRepairOwnerCounts[ownerPacketId] =
+        (this.#moqRepairOwnerCounts[ownerPacketId] || 0) + 1;
+      const pidCount = this.#moqRepairPidCounts[repairPacketId]!;
+      const ownerCount = this.#moqRepairOwnerCounts[ownerPacketId]!;
+      if (pidCount <= 2 || pidCount % 500 === 0) {
+        console.log(
+          `[MOQ-REPAIR] pid=${repairPacketId} repairOwner=${ownerPacketId} pidCount=${pidCount} ownerCount=${ownerCount} ssbLength=${parsed.ssbLength} len=${packet.length}`,
+        );
+      }
+
+      if (this.#configuredBlockProfile(ownerPacketId) === undefined) {
+        this.#noteUnreadableFecPayloadId(ownerPacketId, "repair");
+        return;
+      }
+      if (this.#isIsoPacket(ownerPacketId)) {
+        this.#handleIsoRepair(ownerPacketId, catalogTrackName, parsed, "moq");
+        return;
+      }
+      const repairSbn = this.#deriveRepairSbn(parsed.ssStart, parsed.ssbLength, ownerPacketId);
+      if (repairSbn === null) return;
+      const repairEsi = this.#kForPacket(ownerPacketId) + parsed.rsId;
+
+      if (
+        !this.#feedFecTransportSymbol(
+          ownerPacketId,
+          repairSbn,
+          repairEsi,
+          parsed.symbolData,
+          "moq",
+          catalogTrackName,
+        )
+      ) return;
+
+      // NOTE: Do NOT call trackBlock for repair packets (same as multicast repair path).
+      const recovered = catalogTrackName === undefined
+        ? this.#fecManager.feedRepairSymbol(
+            ownerPacketId,
+            parsed.ssStart,
+            parsed.ssbLength,
+            parsed.rsId,
+            parsed.symbolData,
+          )
+        : this.#fecManager.feedRepairSymbol(
+            ownerPacketId,
+            parsed.ssStart,
+            parsed.ssbLength,
+            parsed.rsId,
+            parsed.symbolData,
+            catalogTrackName,
+          );
+      if (recovered) {
+        const alreadyCompleted = catalogTrackName === undefined
+          ? this.#fecManager.isBlockCompleted(repairSbn, ownerPacketId)
+          : this.#fecManager.isBlockCompleted(repairSbn, ownerPacketId, catalogTrackName);
+        if (catalogTrackName === undefined) {
+          this.#fecManager.cancelBlockTimeout(repairSbn, ownerPacketId);
+        } else {
+          this.#fecManager.cancelBlockTimeout(repairSbn, ownerPacketId, catalogTrackName);
+        }
+        if (!alreadyCompleted) {
+          this.#fecManager.countRecovery(ownerPacketId, repairSbn, catalogTrackName);
+          if (catalogTrackName === undefined) {
+            this.#fecManager.markBlockCompleted(repairSbn, ownerPacketId);
+          } else {
+            this.#fecManager.markBlockCompleted(repairSbn, ownerPacketId, catalogTrackName);
+          }
+          this.#routeRecoveredBlock(
+            repairSbn,
+            recovered,
+            ownerPacketId,
+            catalogTrackName,
+          );
+        }
+      }
+    }
+  }
+
+  // ── SBN/ESI derivation ──────────────────────────────────────────
+
+  #kForPacket(packetId?: number): number {
+    // Same packet-scoped rule as #deriveSbnEsi: once the packet ID is known,
+    // only its explicitly registered mapper may stand in for the FEC
+    // manager's per-packet K — never the default single-track mapper.
+    if (packetId != null)
+      return (
+        this.#fecManager?.kForPacket?.(packetId) ??
+        this.#fecMappersByPacketId.get(packetId)?.k ??
+        this.#fecManager?.k ??
+        4
+      );
+    return this.#defaultFecMapper?.k ?? this.#fecManager?.k ?? 4;
+  }
+
+  #symbolSizeForPacket(packetId?: number): number {
+    if (packetId != null) return this.#fecManager?.symbolSizeForPacket?.(packetId) ?? this.#fecManager?.symbolSize ?? 0;
+    return this.#fecManager?.symbolSize ?? 0;
+  }
+
+  /** Derive SBN/ESI from SS_ID using packet-scoped FEC geometry. */
+  #deriveSbnEsi(ssId: number, packetId?: number): { sbn: number; esi: number } {
+    // A default mapper describes legacy single-track geometry. Once a packet
+    // ID is known, only its explicitly registered mapper may override the
+    // FECManager's packet-scoped K. Falling back to the default video mapper
+    // here maps audio source symbols with video K while repair SBNs correctly
+    // use the audio SSB_length, splitting one block across two coordinates.
+    const mapper = packetId == null
+      ? this.#defaultFecMapper
+      : this.#fecMappersByPacketId.get(packetId) ?? null;
+    if (mapper) return mapper.fromSsId(ssId);
+    const k = this.#kForPacket(packetId);
+    return { sbn: Math.floor(ssId / k), esi: ssId % k };
+  }
+
+  #deriveRepairSbn(
+    ssStart: number,
+    ssbLength: number,
+    packetId?: number,
+  ): number | null {
+    const k = this.#kForPacket(packetId);
+    if (ssbLength <= 0 || ssbLength > k || ssStart % k !== 0) return null;
+    return Math.floor(ssStart / k);
+  }
+
+  /**
+   * The configured block profile of a packetId, or undefined while it is
+   * unconfigured. With an FEC manager its per-packet configuration is the
+   * only source. A router without one still recovers symbols through its
+   * registered mapper, built with the catalog's explicit profile: the
+   * packet's own mapper, else the default one (the #deriveSbnEsi rule).
+   */
+  #configuredBlockProfile(packetId: number): FecBlockProfile | undefined {
+    if (this.#fecManager) return this.#fecManager.blockProfileForPacket(packetId);
+    const mapper = this.#fecMappersByPacketId.get(packetId) ?? this.#defaultFecMapper;
+    return mapper?.blockProfile ?? undefined;
+  }
+
+  /**
+   * The block profile an FEC coordinate of `packetId` is read under. Throws
+   * while none is configured: the two profiles carry identical wire tuples
+   * with different block math, so there is no default to fall back to.
+   * Packet ingress leaves such a packet's FEC Payload ID unread first
+   * (#noteUnreadableFecPayloadId); a throw here is a wiring fault on a path
+   * that cannot hold an unconfigured packet.
+   */
+  #blockProfileFor(packetId: number): FecBlockProfile {
+    const profile = this.#configuredBlockProfile(packetId);
+    if (profile === undefined) {
+      throw new Error(
+        `[MmtpRouter] packetId=${packetId} carries an FEC payload ID but has no configured ` +
+          "fec.blockProfile; configure the track's FEC from its catalog before routing its packets",
+      );
+    }
+    return profile;
+  }
+
+  #isIsoPacket(packetId: number): boolean {
+    return this.#blockProfileFor(packetId) === "iso-ssbg1-v1";
+  }
+
+  /**
+   * Explicit refusal to read an FEC Payload ID: its (owner) packetId has no
+   * configured block profile. Ordering is the host's to guarantee (configure
+   * a track's FEC before its packets are routed). Until then a source packet
+   * plays as on a track without FEC and a repair packet is dropped; neither
+   * is read under a guessed profile or seeds FEC state. Counted and warned.
+   */
+  #noteUnreadableFecPayloadId(packetId: number, kind: "source" | "repair"): void {
+    this.#fecPayloadIdsWithoutProfile++;
+    const count = this.#fecPayloadIdsWithoutProfile;
+    if (count <= 5 || count % 500 === 0) {
+      console.warn(
+        `[MmtpRouter] packetId=${packetId} has no configured fec.blockProfile: ` +
+          (kind === "source"
+            ? "its FEC payload ID is not read and its media is routed without FEC"
+            : "dropping its repair packet") +
+          ` (${count} so far)`,
+      );
+    }
+  }
+
+  /**
+   * The release-gate anchor of a recovered symbol: its block (SBN) under
+   * k-padded-v1, its own SS_ID under iso-ssbg1-v1, where a frame is gated by
+   * the SS_IDs between it and the last released frame.
+   */
+  #fecAnchorForRecovered(ownerPacketId: number | undefined, blockId: number, index: number): number {
+    return ownerPacketId !== undefined && this.#isIsoPacket(ownerPacketId)
+      ? serial32Add(blockId, index)
+      : blockId;
+  }
+
+  /**
+   * One iso-ssbg1-v1 repair symbol (ISO/IEC 23008-1 C.5.3). It states the
+   * block `[SS_Start, SS_Start + SSB_length)`; repair ESI = SSB_length +
+   * RS_ID (K' = SSB_length). The held sources it placed (and those of a
+   * repair-less span in front of it) are fed as first-arrival sources, then
+   * the repair, the order they had on the wire, so a loss-free block is clean
+   * on its repair exactly as under k-padded-v1. A repair contradicting a known
+   * block is dropped.
+   */
+  #handleIsoRepair(
+    ownerPacketId: number,
+    catalogTrackName: string | undefined,
+    repair: { ssStart: number; ssbLength: number; rsId: number; symbolData: Uint8Array },
+    source: "multicast" | "moq",
+  ): void {
+    const fec = this.#fecManager;
+    if (!fec?.placeIsoRepair) {
+      throw new Error(
+        `[MmtpRouter] packetId=${ownerPacketId} is iso-ssbg1-v1 but its FEC manager cannot place ISO blocks`,
+      );
+    }
+    const placement = fec.placeIsoRepair(ownerPacketId, catalogTrackName, repair.ssStart, repair.ssbLength);
+    if (placement.status !== "placed") return;
+    const blockStart = placement.block.start;
+    if (placement.span !== undefined) {
+      this.#replayIsoSources(ownerPacketId, catalogTrackName, placement.span.block.start, placement.span.placed);
+    }
+    this.#replayIsoSources(ownerPacketId, catalogTrackName, blockStart, placement.placed);
+    if (this.#classifyPacketId(ownerPacketId) === null) return;
+    if (!this.#feedFecTransportSymbol(
+      ownerPacketId,
+      blockStart,
+      repair.ssbLength + repair.rsId,
+      repair.symbolData,
+      source,
+      catalogTrackName,
+    )) return;
+    fec.noteBlockActivity?.(blockStart, ownerPacketId, catalogTrackName);
+    const alreadyCompleted = fec.isBlockCompleted(blockStart, ownerPacketId, catalogTrackName);
+    const recovered = fec.feedRepairSymbol(
+      ownerPacketId,
+      repair.ssStart,
+      repair.ssbLength,
+      repair.rsId,
+      repair.symbolData,
+      catalogTrackName,
+    );
+    if (recovered && !alreadyCompleted) {
+      fec.cancelBlockTimeout(blockStart, ownerPacketId, catalogTrackName);
+      fec.countRecovery(ownerPacketId, blockStart, catalogTrackName);
+      fec.markBlockCompleted(blockStart, ownerPacketId, catalogTrackName);
+      this.#routeRecoveredBlock(blockStart, recovered, ownerPacketId, catalogTrackName);
+    }
+  }
+
+  /**
+   * Feed iso-ssbg1-v1 sources a repair just placed, in SS_ID order, exactly as
+   * a first-arrival source is fed once its block is known: transport
+   * accounting, block tracking with its own classification evidence, then the
+   * decoder. Their media was routed when they arrived.
+   */
+  #replayIsoSources(
+    ownerPacketId: number,
+    catalogTrackName: string | undefined,
+    blockStart: number,
+    placed: readonly IsoPlacedSource<IsoHeldSource>[],
+  ): void {
+    const fec = this.#fecManager;
+    if (!fec) return;
+    for (const { ssId, esi, payload } of placed) {
+      if (this.#classifyPacketId(ownerPacketId) === null) return;
+      if (!this.#feedFecTransportSymbol(
+        ownerPacketId,
+        blockStart,
+        esi,
+        payload.symbolData,
+        payload.source,
+        catalogTrackName,
+      )) continue;
+      if (fec.isTrackConfigured?.(ownerPacketId) !== false) {
+        fec.trackBlock(blockStart, ownerPacketId, catalogTrackName, esi, payload.evidence);
+        this.#requestFecPoke(ownerPacketId, catalogTrackName);
+      }
+      if (payload.oversized) continue;
+      const alreadyCompleted = fec.isBlockCompleted(blockStart, ownerPacketId, catalogTrackName);
+      const recovered = fec.feedSourceSymbol(ownerPacketId, ssId, payload.symbolData, undefined, catalogTrackName);
+      if (!recovered || alreadyCompleted) continue;
+      fec.cancelBlockTimeout(blockStart, ownerPacketId, catalogTrackName);
+      fec.countRecovery(ownerPacketId, blockStart, catalogTrackName);
+      fec.markBlockCompleted(blockStart, ownerPacketId, catalogTrackName);
+      this.#routeRecoveredBlock(blockStart, recovered, ownerPacketId, catalogTrackName);
+    }
+  }
+
+  #resolveRepairOwnerPacketId(
+    packetId: number,
+    ingress?: MmtpIngressContext,
+  ): number | null {
+    if (this.#classifyPacketId(packetId) !== null) return packetId;
+
+    if (this.#packetIdRoles.get(packetId) !== "repair") {
+      debugRouter(
+        `[MmtpRouter] Dropping repair packet pid=${packetId}: physical PID is unregistered`,
+      );
+      return null;
+    }
+
+    const registeredOwners = this.#repairOwnersByPacketId.get(packetId) ?? new Set<number>();
+    const owners = ingress === undefined
+      ? [...registeredOwners]
+      : [...registeredOwners].filter((ownerPacketId) =>
+          ingressHasPacketId(ingress, ownerPacketId));
+    if (owners.length === 1) return owners[0]!;
+
+    debugRouter(
+      `[MmtpRouter] Dropping repair packet pid=${packetId}: catalog owner is ${owners.length === 0 ? "absent" : "ambiguous"}`,
+    );
+    return null;
+  }
+
+  /** Route a recovered FEC block through the parser + dedup pipeline.
+   *  Sync WASM decoders return K fixed-width source symbols concatenated. */
+  routeRecoveredBlock(
+    blockId: number,
+    data: Uint8Array,
+    packetId: number,
+    catalogTrackName?: string,
+  ): void {
+    this.#routeRecoveredBlock(blockId, data, packetId, catalogTrackName);
+  }
+
+  /** Route a single recovered source symbol through the parser + dedup pipeline.
+   *  Worker-backed decoders emit one padded source symbol per frame event. */
+  routeRecoveredSymbol(
+    blockId: number,
+    data: Uint8Array,
+    packetId: number,
+    esi = 0,
+    catalogTrackName?: string,
+  ): void {
+    const blockProfile = this.#blockProfileFor(packetId);
+    const result = processFecSymbol(data, { ownerPacketId: packetId, index: esi, blockProfile });
+    this.#routeVerifiedFecSymbols(blockId, result, packetId, catalogTrackName);
+  }
+
+  // ── Keyframe timer cancellation ─────────────────────────────────
+
+  /** Cancel the active keyframe loss timer.
+   *  Call on failbackToMoq to prevent a stale timer from firing
+   *  onKeyframeLost after multicast is no longer the active source. */
+  cancelKeyframeLostTimer(): void {
+    if (this.#keyframeLostTimer) {
+      clearTimeout(this.#keyframeLostTimer);
+      this.#keyframeLostTimer = null;
+    }
+  }
+
+  // ── Dispose ─────────────────────────────────────────────────────
+
+  /** Emit parser frames buffered for a finite input before teardown. */
+  flush(): void {
+    if (this.#disposed) return;
+    this.#parser.flush();
+  }
+
+  /** Drop one rendition's parser/router/CMAF epoch without touching peers. */
+  resetTrack(packetId: number, catalogTrackName: string): void {
+    if (this.#disposed) return;
+    const staged = this.#staged;
+    if (staged !== null) {
+      const stream = { packetId, catalogTrackName };
+      // A new epoch of either side invalidates what the switch held about it.
+      if (isStream(stream, staged.to)) {
+        staged.droppedIncomingFrames += staged.held?.length ?? 0;
+        staged.held = null;
+        staged.heldInit = undefined;
+      }
+    }
+    this.#parser.resetTrack(packetId, catalogTrackName);
+    const streamKey = this.#mediaStreamKey(packetId, catalogTrackName);
+    this.#trackSynced.delete(streamKey);
+    this.#droppedPreSyncVideo.delete(streamKey);
+    this.#latestVideoSeqByStream.delete(streamKey);
+    this.#lastDirectSourceVideoTsByStream.delete(streamKey);
+    this.#lastDirectEmittedVideoTsByStream.delete(streamKey);
+    this.#pendingDirectRecoveredVideoByStream.delete(streamKey);
+    this.#lastDirectSourceAudioCursorByStream.delete(streamKey);
+    this.#lastDirectEmittedAudioCursorByStream.delete(streamKey);
+    this.#pendingDirectRecoveredAudioByStream.delete(streamKey);
+    this.#manifestRecoveryQueues.delete(streamKey);
+    this.#deliveredVideoHighWaterByStream.delete(streamKey);
+    this.#stream(packetId, catalogTrackName).duplicates.clear();
+    const assemblersToReset = new Set<CmafBlockAssembler>();
+    const exactAssembler = this.#mseAssemblers.get(streamKey);
+    if (exactAssembler) assemblersToReset.add(exactAssembler);
+    const selectedAssembler = this.#mseAssemblerFor(packetId, catalogTrackName);
+    if (selectedAssembler) assemblersToReset.add(selectedAssembler);
+    for (const assembler of assemblersToReset) assembler.reset();
+    this.#trackInitDelivered.delete(streamKey);
+    this.#parserDiagnostics.delete(streamKey);
+  }
+
+  /**
+   * Retire one packet ID, drop-only: remove every registration of it (media
+   * kind, codec, frame/packet/init callbacks, FEC mapper, role, repair
+   * ownership) and every stream state kept for it (sync gates, emission
+   * cursors, duplicate ledgers, queued recovered frames, MSE assemblers,
+   * parser buffers and authored timing, MFU reassembly per catalog stream).
+   * Nothing buffered is delivered, as on live dispose. A dedicated repair
+   * packet ID that this packet ID alone owned loses its repair role with it.
+   *
+   * Afterwards the packet ID is unknown to the router: its packets and
+   * frames are dropped until it is registered again. FEC state lives in the
+   * FEC manager and is released there (FECManager.releasePacket).
+   */
+  retirePacketId(packetId: number): void {
+    if (this.#disposed) return;
+    if (!Number.isInteger(packetId) || packetId < 0) {
+      throw new Error(`[MmtpRouter] retirePacketId: invalid packetId ${packetId}`);
+    }
+    const staged = this.#staged;
+    if (staged !== null && (staged.from.packetId === packetId || staged.to.packetId === packetId)) {
+      throw new Error(
+        `[MmtpRouter] retirePacketId(${packetId}): the packet ID is in a staged stream switch; ` +
+          "cancel the switch first",
+      );
+    }
+    const names = new Set<string>(this.#catalogTrackNamesByPacketId.get(packetId) ?? []);
+    const streams = this.#streams.get(packetId);
+    for (const [name, stream] of streams ?? []) {
+      if (name !== undefined) names.add(name);
+      const key = stream.key;
+      this.#trackSynced.delete(key);
+      this.#droppedPreSyncVideo.delete(key);
+      this.#latestVideoSeqByStream.delete(key);
+      this.#lastDirectSourceVideoTsByStream.delete(key);
+      this.#lastDirectEmittedVideoTsByStream.delete(key);
+      this.#pendingDirectRecoveredVideoByStream.delete(key);
+      this.#lastDirectSourceAudioCursorByStream.delete(key);
+      this.#lastDirectEmittedAudioCursorByStream.delete(key);
+      this.#pendingDirectRecoveredAudioByStream.delete(key);
+      this.#manifestRecoveryQueues.delete(key);
+      this.#trackInitDelivered.delete(key);
+      this.#parserDiagnostics.delete(key);
+      this.#pendingFecPokes.delete(key);
+      this.#deliveredVideoHighWaterByStream.delete(key);
+      const assembler = this.#mseAssemblers.get(key);
+      if (assembler) {
+        assembler.dispose();
+        this.#mseAssemblers.delete(key);
+      }
+    }
+    this.#streams.delete(packetId);
+
+    this.#videoPacketIds.delete(packetId);
+    this.#audioPacketIds.delete(packetId);
+    this.#trackCodecs.delete(packetId);
+    this.#trackCallbacks.delete(packetId);
+    this.#trackPacketCallbacks.delete(packetId);
+    this.#resolvedCallbacks.delete(packetId);
+    this.#trackInitCallbacks.delete(packetId);
+    this.#fecMappersByPacketId.delete(packetId);
+    this.#packetIdRoles.delete(packetId);
+    this.#catalogTrackNamesByPacketId.delete(packetId);
+    this.#repairOwnersByPacketId.delete(packetId);
+    delete this.#pidCounts[packetId];
+    delete this.#repairPidCounts[packetId];
+    delete this.#moqRepairPidCounts[packetId];
+    delete this.#moqRepairOwnerCounts[packetId];
+    for (const [repairPacketId, owners] of [...this.#repairOwnersByPacketId]) {
+      if (!owners.delete(packetId) || owners.size > 0) continue;
+      this.#repairOwnersByPacketId.delete(repairPacketId);
+      if (this.#packetIdRoles.get(repairPacketId) === "repair") {
+        this.#packetIdRoles.delete(repairPacketId);
+      }
+      delete this.#repairPidCounts[repairPacketId];
+      delete this.#moqRepairPidCounts[repairPacketId];
+    }
+
+    this.#parser.removeTrack(packetId, names);
+  }
+
+  /**
+   * Stage an in-place switch from one video stream to another, committed at
+   * a RAP of the incoming stream without leaving the multicast group.
+   *
+   * Until the commit the outgoing stream (`from`) is delivered as usual and
+   * the incoming stream (`to`) is not: its packets are parsed and feed FEC,
+   * so its first RAP arrives FEC-protected, but none of its frames, and not
+   * its init, reach any callback or MSE assembler. Incoming deltas before its
+   * first RAP are dropped. When that RAP arrives:
+   *
+   * - if the outgoing stream already delivered a frame at or past the RAP's
+   *   presentation time, the switch commits on it (`outgoing-ahead`);
+   * - otherwise the RAP and the incoming frames after it are held, and the
+   *   switch commits when the outgoing stream is about to deliver a frame at
+   *   or past the RAP (`outgoing-reached-rap`): that outgoing frame, and every
+   *   later one, is never delivered, so the splice is exact. If the incoming
+   *   stream reaches its next RAP first, the outgoing stream is a GOP or more
+   *   behind: the switch commits on the held RAP and delivers the held GOP
+   *   and then the newer RAP (`outgoing-overdue`), the smallest gap left once
+   *   the outgoing stream stops. The hold is bounded by the incoming stream's
+   *   own RAP cadence, so no timer is involved.
+   *
+   * The commit is one synchronous transition inside the frame path: the
+   * outgoing stream's already-admitted frames are released (its queued FEC
+   * gap fills only up to the RAP, since recovery can queue a frame ahead of
+   * the source cursor; its MSE assembler's ordering queue whole, as
+   * CmafBlockAssembler.flush has no bound, so on the MSE path a recovered
+   * outgoing frame at or past the RAP can still be emitted), its packet ID
+   * is retired
+   * (retirePacketId), `onCommit` runs, and then the incoming stream's newest
+   * init and its RAP are delivered, followed by any held frames. No outgoing
+   * frame is delivered after the commit and no incoming frame before it. If
+   * `onCommit` throws, `to` is retired too and none of it is delivered.
+   *
+   * Both packet IDs must be registered video streams; the commit reads RAPs.
+   * Admission (the transport allow-list and ingress tracks) is the caller's:
+   * MulticastManager.switchRendition drives both.
+   */
+  stageStreamSwitch(options: StreamSwitchOptions): StagedStreamSwitch {
+    if (this.#disposed) throw new Error("[MmtpRouter] stageStreamSwitch on a disposed router");
+    if (this.#staged !== null) {
+      throw new Error(
+        "[MmtpRouter] a stream switch is already staged; cancel it before staging another",
+      );
+    }
+    const { from, to, onCommit } = options;
+    assertStreamIdentity("from", from);
+    assertStreamIdentity("to", to);
+    if (typeof onCommit !== "function") {
+      throw new Error("[MmtpRouter] stageStreamSwitch requires an onCommit callback");
+    }
+    if (from.packetId === to.packetId) {
+      throw new Error(
+        `[MmtpRouter] stream switch ${from.catalogTrackName} -> ${to.catalogTrackName} keeps ` +
+          `packet ID ${from.packetId}: an in-place switch remaps packet IDs, so each stream needs its own`,
+      );
+    }
+    for (const stream of [from, to]) {
+      if (!this.#videoPacketIds.has(stream.packetId)) {
+        throw new Error(
+          `[MmtpRouter] stream switch: packet ID ${stream.packetId} (${stream.catalogTrackName}) ` +
+            "is not a registered video stream (setPacketIdType): a switch commits on a video RAP",
+        );
+      }
+    }
+    const state: StreamSwitchState = {
+      from: Object.freeze({ packetId: from.packetId, catalogTrackName: from.catalogTrackName }),
+      to: Object.freeze({ packetId: to.packetId, catalogTrackName: to.catalogTrackName }),
+      onCommit,
+      held: null,
+      heldInit: undefined,
+      droppedIncomingFrames: 0,
+    };
+    this.#staged = state;
+    return {
+      cancel: () => {
+        if (this.#staged !== state) return false;
+        this.#staged = null;
+        return true;
+      },
+    };
+  }
+
+  /**
+   * Apply the staged switch to one parser frame of either side. Returns true
+   * when the frame was consumed (held, dropped, or past the splice).
+   */
+  #interceptSwitchFrame(data: Uint8Array, meta: ParserFrameMeta): boolean {
+    const state = this.#staged!;
+    if (isStream(meta, state.to)) {
+      if (state.held === null) {
+        if (!meta.keyframe) {
+          state.droppedIncomingFrames++;
+          return true;
+        }
+        const high = this.#deliveredVideoHighWaterByStream.get(
+          this.#mediaStreamKey(state.from.packetId, state.from.catalogTrackName),
+        );
+        if (high !== undefined && comparePresentation(high, meta) >= 0) {
+          if (this.#commitStreamSwitch(state, meta, "outgoing-ahead")) this.#routeParsedFrame(data, meta);
+          return true;
+        }
+        state.held = [this.#holdSwitchFrame(data, meta)];
+        return true;
+      }
+      if (meta.keyframe) {
+        // The outgoing stream never reached the held RAP, so everything it
+        // delivered is before it: the held GOP is complete, overlaps nothing,
+        // and dropping it would only widen the gap by a whole incoming GOP.
+        const held = state.held;
+        if (this.#commitStreamSwitch(state, held[0]!.meta, "outgoing-overdue")) {
+          for (const frame of held) this.#replayHeldSwitchFrame(frame);
+          this.#routeParsedFrame(data, meta);
+        }
+        return true;
+      }
+      state.held.push(this.#holdSwitchFrame(data, meta));
+      return true;
+    }
+    if (!isStream(meta, state.from)) return false;
+    const rap = state.held?.[0];
+    if (rap !== undefined && comparePresentation(meta, rap.meta) >= 0) {
+      const held = state.held!;
+      if (this.#commitStreamSwitch(state, rap.meta, "outgoing-reached-rap")) {
+        for (const frame of held) this.#replayHeldSwitchFrame(frame);
+      }
+      return true;
+    }
+    return false;
+  }
+
+  #holdSwitchFrame(data: Uint8Array, meta: ParserFrameMeta): HeldSwitchFrame {
+    const fecInfo = this.#currentFecInfo;
+    return {
+      data,
+      meta: { ...meta },
+      fecInfo: fecInfo === undefined ? undefined : { ...fecInfo },
+    };
+  }
+
+  /**
+   * Replay a held incoming frame as if it completed now, under its own FEC
+   * coordinates, through the same gate as a parser frame, so a switch staged
+   * from inside the commit's onCommit sees it.
+   */
+  #replayHeldSwitchFrame(frame: HeldSwitchFrame): void {
+    if (this.#disposed) return;
+    const current = this.#currentFecInfo;
+    this.#currentFecInfo = frame.fecInfo;
+    try {
+      this.#routeParsedFrame(frame.data, frame.meta);
+    } finally {
+      this.#currentFecInfo = current;
+    }
+  }
+
+  /**
+   * The one path from a completed frame into delivery: parser frames, held
+   * frames a commit replays, and the frame that triggered a commit all pass
+   * a staged switch's interception here.
+   */
+  #routeParsedFrame(data: Uint8Array, meta: ParserFrameMeta): void {
+    // A frame of a packet ID retired while it was in flight has no route
+    // left: an in-place switch commits from inside the parser's emission,
+    // and the retired stream's remaining frames can still drain from the
+    // same call. Nothing registers a packet ID mid-frame, so this drops
+    // only frames that lost their registration.
+    if (this.#classifyPacketId(meta.packetId) === null) return;
+    if (this.#staged !== null && this.#interceptSwitchFrame(data, meta)) return;
+    this.#deliverParsedFrame(data, meta);
+  }
+
+  #commitStreamSwitch(
+    state: StreamSwitchState,
+    rap: ParserFrameMeta,
+    reason: StreamSwitchCommitReason,
+  ): boolean {
+    this.#staged = null;
+    // Release the outgoing stream's queued FEC gap fills that precede the
+    // splice before the packet ID is retired, which discards everything else.
+    // The queue can hold recovered frames ahead of the source cursor, so it is
+    // bounded at the RAP by the same comparison that decides the commit: a
+    // queued outgoing frame at or past the RAP is never delivered.
+    const outgoingKey = this.#mediaStreamKey(state.from.packetId, state.from.catalogTrackName);
+    this.#drainDirectRecoveredVideo(
+      outgoingKey,
+      state.from.packetId,
+      frame => comparePresentation(frame, rap) < 0,
+      this.#getFrameCallback(state.from.packetId),
+    );
+    this.#mseAssemblerFor(state.from.packetId, state.from.catalogTrackName)?.flush();
+    const outgoingHighWater = this.#deliveredVideoHighWaterByStream.get(outgoingKey);
+    this.retirePacketId(state.from.packetId);
+    const commit: StreamSwitchCommit = Object.freeze({
+      from: state.from,
+      to: state.to,
+      rap: Object.freeze({
+        ...switchPosition(rap),
+        ...(rap.mpuSequenceNumber === undefined ? {} : { mpuSequenceNumber: rap.mpuSequenceNumber }),
+      }),
+      outgoingHighWater,
+      reason,
+      droppedIncomingFrames: state.droppedIncomingFrames,
+    });
+    try {
+      state.onCommit(commit);
+    } catch (error) {
+      // The caller could not take the incoming stream (typically a decoder
+      // reconfiguration that threw). `from` is already retired, so there is
+      // nothing to fall back to, and delivering `to` would feed a decoder
+      // still configured for `from`. Fail closed: retire `to` too, so neither
+      // its init nor its held GOP nor anything after reaches a callback.
+      console.warn("[MmtpRouter] stream switch commit callback failed; retiring the incoming stream", error);
+      if (this.#disposed) return false;
+      // onCommit may have staged a new switch; one on `to` cannot outlive it
+      // (retirePacketId refuses a staged packet ID).
+      const restaged = this.#staged as StreamSwitchState | null;
+      if (restaged !== null && (restaged.from.packetId === state.to.packetId || restaged.to.packetId === state.to.packetId)) {
+        this.#staged = null;
+      }
+      this.retirePacketId(state.to.packetId);
+      return false;
+    }
+    if (this.#disposed) return false;
+    const init = state.heldInit;
+    if (init !== undefined) this.#deliverInit(state.to.packetId, init, state.to.catalogTrackName);
+    return true;
+  }
+
+  /** Live teardown is drop-only. Finite inputs must opt into a final flush. */
+  dispose(options: { flush?: boolean } = {}): void {
+    if (options.flush) this.flush();
+    this.#disposed = true;
+    this.#staged = null;
+    this.cancelKeyframeLostTimer();
+    this.#parser.dispose();
+    this.#streams.clear();
+    this.#trackPacketCallbacks.clear();
+    this.#latestVideoSeqByStream.clear();
+    this.#lastDirectSourceVideoTsByStream.clear();
+    this.#lastDirectEmittedVideoTsByStream.clear();
+    this.#pendingDirectRecoveredVideoByStream.clear();
+    this.#lastDirectSourceAudioCursorByStream.clear();
+    this.#lastDirectEmittedAudioCursorByStream.clear();
+    this.#pendingDirectRecoveredAudioByStream.clear();
+    this.#trackSynced.clear();
+    this.#droppedPreSyncVideo.clear();
+    this.#trackInitDelivered.clear();
+    this.#deliveredVideoHighWaterByStream.clear();
+    this.#repairPidCounts = {};
+    this.#moqRepairPidCounts = {};
+    this.#moqRepairOwnerCounts = {};
+    this.#parserDiagnostics.clear();
+    this.#catalogTrackNamesByPacketId.clear();
+    this.#repairOwnersByPacketId.clear();
+    if (this.#ownsManifestVerifier) this.#manifestVerifier?.dispose();
+    this.#manifestRecoveryQueues.clear();
+    for (const assembler of this.#mseAssemblers.values()) assembler.dispose();
+    this.#mseAssemblers.clear();
+  }
+
+  // ── Private: keyframe loss detection ────────────────────────────
+
+  /** Arm (or re-arm) the keyframe loss timer.
+   *  Clears any existing timer and sets a new one for keyframeLostTimeoutMs.
+   *  On timeout, fires onKeyframeLost with the next expected groupId.
+   *  A reader without a valid value leaves the timer cleared and unarmed. */
+  #armKeyframeLostTimer(): void {
+    if (this.#keyframeLostTimer) {
+      clearTimeout(this.#keyframeLostTimer);
+      this.#keyframeLostTimer = null;
+    }
+    const timeoutMs = this.#readKeyframeLostTimeoutMs();
+    if (timeoutMs === null) return;
+    const expectedNext = this.#lastKeyframeGroupId + 1;
+    this.#keyframeLostTimer = setTimeout(() => {
+      this.#keyframeLostTimer = null;
+      this.#onKeyframeLost?.(expectedNext);
+    }, timeoutMs);
+  }
+
+  /** The configured number, or the reader's current value; null when the
+   *  reader throws or either form yields a value no timer can honour. Warns
+   *  on entering that state or when its cause changes (a different exception,
+   *  or a different class of bad value), not once per keyframe. */
+  #readKeyframeLostTimeoutMs(): number | null {
+    const timeout = this.#keyframeLostTimeoutMs!;
+    let reason: string;
+    let detail: unknown;
+    try {
+      const ms = typeof timeout === "function" ? timeout() : timeout;
+      if (Number.isFinite(ms) && ms > 0 && ms <= MAX_TIMER_DELAY_MS) {
+        this.#keyframeLostUnarmedReason = null;
+        return ms;
+      }
+      reason =
+        typeof ms !== "number" ? "yielded a non-number"
+        : Number.isNaN(ms) ? "yielded NaN"
+        : !Number.isFinite(ms) ? "yielded an infinite value"
+        : ms <= 0 ? "yielded a non-positive value"
+        : `exceeds the ${MAX_TIMER_DELAY_MS} ms timer maximum`;
+      detail = ms;
+    } catch (error) {
+      // Keyed on the cause, so a real reader bug (say a TypeError) is still
+      // reported after the expected "unmeasured" throw.
+      reason = `threw ${error instanceof Error ? `${error.name}: ${error.message}` : String(error)}`;
+      detail = error;
+    }
+    if (reason !== this.#keyframeLostUnarmedReason) {
+      this.#keyframeLostUnarmedReason = reason;
+      console.warn(
+        `[MmtpRouter] keyframeLostTimeoutMs ${reason} — keyframe loss timer ` +
+          "not armed until it yields a finite positive value:",
+        detail,
+      );
+    }
+    return null;
+  }
+
+  #noteEmittedKeyframe(packetId: number, keyframe: boolean): void {
+    if (!keyframe) return;
+    if (!this.#videoPacketIds.has(packetId)) return;
+    if (this.#keyframeLostTimeoutMs === null) return;
+    // FEC tracks resolve lost keyframes through block deadlines and the
+    // release gate's stall decision, never through this timer.
+    if (this.#isFecTrack(packetId)) return;
+    this.#lastKeyframeGroupId++;
+    this.#armKeyframeLostTimer();
+  }
+
+  // ── Private: FEC release gate ───────────────────────────────────
+
+  /** A packetId is an FEC track once the FEC manager configured it. */
+  #isFecTrack(packetId: number): boolean {
+    return this.#fecManager?.isTrackConfigured?.(packetId) === true;
+  }
+
+  #withDeferredFecPokes(work: () => void): void {
+    this.#fecPokeDepth++;
+    try {
+      work();
+    } finally {
+      this.#fecPokeDepth--;
+      if (this.#fecPokeDepth === 0 && this.#pendingFecPokes.size > 0 && !this.#disposed) {
+        const pokes = [...this.#pendingFecPokes.values()];
+        this.#pendingFecPokes.clear();
+        for (const poke of pokes) {
+          this.#parser.pokeFecRelease(poke.packetId, poke.catalogTrackName);
+        }
+      }
+    }
+  }
+
+  #requestFecPoke(packetId: number, catalogTrackName: string | undefined): void {
+    if (this.#disposed) return;
+    if (this.#fecPokeDepth > 0) {
+      this.#pendingFecPokes.set(this.#mediaStreamKey(packetId, catalogTrackName), {
+        packetId,
+        ...(catalogTrackName === undefined ? {} : { catalogTrackName }),
+      });
+      return;
+    }
+    this.#parser.pokeFecRelease(packetId, catalogTrackName);
+  }
+
+  /**
+   * The release policy the parser applies to FEC tracks: a frame after a gap
+   * is held until every block that could hold the missing frames resolved,
+   * then released with the stall/conceal decision when media was lost.
+   */
+  #createFecReleaseGate(): FecReleaseGate {
+    if (this.#fecManager?.blockResolution && !this.#fecManager.terminalRetentionMsForPacket) {
+      throw new Error(
+        "[MmtpRouter] an FEC manager with blockResolution must provide terminalRetentionMsForPacket: " +
+          "it bounds how long the release gate holds a frame",
+      );
+    }
+    return {
+      gates: (packetId) => this.#isFecTrack(packetId),
+      resolvedLoss: (packetId, catalogTrackName, fromSbn, toSbn, releasedSbn) => {
+        const fec = this.#fecManager;
+        if (!fec?.blockResolution) return [];
+        if (this.#isIsoPacket(packetId)) {
+          // iso-ssbg1-v1 frames are anchored by their packet's SS_ID: wait
+          // until every block that could hold the SS_IDs between the last
+          // released frame and this one is stated and resolved.
+          const head = fromSbn === releasedSbn ? toSbn : fromSbn;
+          return fec.isoSpanResolution?.(packetId, catalogTrackName, releasedSbn, head) ?? null;
+        }
+        const highest = fec.highestSbn?.(packetId, catalogTrackName);
+        const lost: number[] = [];
+        for (let sbn = fromSbn; sbn <= toSbn; sbn++) {
+          const resolution = fec.blockResolution(sbn, packetId, catalogTrackName);
+          if (resolution === "pending") return null;
+          if (resolution === "failed") {
+            lost.push(sbn);
+          } else if (resolution === "untracked") {
+            // releasedSbn is the block of the frame the gate last released, so
+            // its media arrived: untracked there means it resolved and retired,
+            // not that it vanished. Counting it would conceal a delivered block.
+            if (sbn === releasedSbn) continue;
+            // Not seen yet: a block at or past the stream's frontier may
+            // still start. Behind the frontier it vanished without trace.
+            if (highest === undefined || sbn > highest) return null;
+            lost.push(sbn);
+          }
+        }
+        return lost;
+      },
+      // The retention window itself: a frame is never still held when a block
+      // it waits on retires. Only consulted while resolvedLoss holds a gap,
+      // which needs blockResolution, so the check above guarantees the method.
+      holdLimitMs: (packetId) => this.#fecManager?.terminalRetentionMsForPacket?.(packetId) ?? Infinity,
+      decide: (before, after, lostBlocks, discontinuity) => {
+        const decision = this.#decideGap(before, after, lostBlocks, discontinuity);
+        this.#onFrameGap?.(decision);
+        return decision;
+      },
+      onReleased: (data, meta) => {
+        if (meta.trackType !== "video" || meta.mpuSequenceNumber === undefined) return;
+        const timing = meta.authoredTiming;
+        if (!timing || !this.#isRapForGap(data, meta)) return;
+        this.#fecManager?.noteReleasedRap?.(
+          meta.packetId,
+          meta.catalogTrackName,
+          meta.mpuSequenceNumber,
+          timing.presentationTime,
+          timing.mediaTimescale,
+        );
+      },
+    };
+  }
+
+  /**
+   * Codec-aware RAP check for gap decisions: the bitstream, with the MMTP R
+   * bit only as the fallback for source frames. Recovered frames are
+   * bitstream-only, and the MFU priority hint never counts.
+   */
+  #isRapForGap(data: Uint8Array, meta: ParserFrameMeta): boolean {
+    const codec = this.#trackCodecs.get(meta.packetId) ??
+      this.#fecManager?.codecFor?.(meta.packetId) ?? "";
+    const rapFlag = meta.recovered ? false : meta.rapFlag === true;
+    return MmtpContainerParser.isKeyframe(data, rapFlag, codec);
+  }
+
+  #decideGap(
+    before: { data: Uint8Array; meta: ParserFrameMeta },
+    after: { data: Uint8Array; meta: ParserFrameMeta },
+    lostBlocks: readonly number[],
+    discontinuity: boolean,
+  ): FrameGapDecision {
+    const { packetId, catalogTrackName } = after.meta;
+    const trackKind = this.#classifyPacketId(packetId) === false ? "audio" : "video";
+    // Sample positions are MPU positions only while the classifier verified
+    // the geometry (one movie fragment per MPU, RAP at index 0).
+    const positionsTrusted =
+      this.#fecManager?.classifierModeFor?.(packetId, catalogTrackName).mode === "classifying";
+    // "Same MPU on both sides" proves a delta-only gap only while an MPU
+    // boundary bounds the stream's RAPs. Once a RAP was seen inside an MPU
+    // (or an MPU outran its GOP), a lost RAP can hide inside one MPU, so the
+    // MPU is withheld and a non-RAP after the gap stalls as rap-unknown. A
+    // manager that cannot answer is treated as unable to prove it.
+    const mpuTrusted =
+      this.#fecManager?.mpuBoundsRapsFor?.(packetId, catalogTrackName) === true;
+    const evidence = (frame: { data: Uint8Array; meta: ParserFrameMeta }): GapFrameEvidence => {
+      const timing = frame.meta.authoredTiming;
+      const sampleNumber = frame.meta.sampleNumber;
+      return {
+        rap: trackKind === "video" && this.#isRapForGap(frame.data, frame.meta),
+        ...(!mpuTrusted || frame.meta.mpuSequenceNumber === undefined
+          ? {}
+          : { mpu: frame.meta.mpuSequenceNumber }),
+        ...(positionsTrusted && sampleNumber !== undefined && sampleNumber >= 1
+          ? { idx: sampleNumber - 1 }
+          : {}),
+        ...(timing === undefined
+          ? {}
+          : {
+              pts: timing.presentationTime,
+              durationTicks: timing.durationTicks,
+              timescale: timing.mediaTimescale,
+            }),
+      };
+    };
+    return decideGap({
+      stream: { packetId, catalogTrackName: catalogTrackName ?? null },
+      trackKind,
+      before: evidence(before),
+      after: evidence(after),
+      discontinuity,
+      blocks: lostBlocks,
+      maxMissingUnits: this.#maxMissingUnits(before.meta, after.meta),
+      epoch: this.#fecManager?.epochFor?.(packetId) ?? 0,
+    });
+  }
+
+  /**
+   * The most media units a gap between two released frames can hold: the
+   * FEC blocks from `before`'s SBN to `after`'s, times D, the media units one
+   * block touches (ceil(interleaveDepthMs / unit duration), §5.1). Null when
+   * either SBN, the unit duration or the catalog interleave is unknown.
+   */
+  #maxMissingUnits(before: ParserFrameMeta, after: ParserFrameMeta): number | null {
+    const from = before.fecSbn;
+    const to = after.fecSbn;
+    const timing = before.authoredTiming;
+    const interleaveMs = this.#fecManager?.interleaveDepthMsForPacket?.(after.packetId);
+    if (from === undefined || to === undefined || !timing || interleaveMs === undefined) return null;
+    if (!(timing.durationTicks > 0) || !(timing.mediaTimescale > 0) || !(interleaveMs > 0)) return null;
+    // D = ceil(interleaveMs * timescale / (durationTicks * 1000)), in integers.
+    const numerator = BigInt(Math.ceil(interleaveMs)) * BigInt(timing.mediaTimescale);
+    const denominator = BigInt(timing.durationTicks) * 1000n;
+    const unitsPerBlock = (numerator + denominator - 1n) / denominator;
+    // iso-ssbg1-v1 anchors are SS_IDs: every block holds at least one, so the
+    // serial SS_ID distance bounds the blocks between them.
+    const blocks = BigInt(
+      (this.#isIsoPacket(after.packetId)
+        ? (serial32Precedes(from, to) ? serial32Distance(from, to) : serial32Distance(to, from))
+        : Math.abs(to - from)) + 1,
+    );
+    const bound = unitsPerBlock * blocks;
+    return bound > BigInt(Number.MAX_SAFE_INTEGER) ? null : Number(bound);
+  }
+
+  // ── Private: MMTP processing ────────────────────────────────────
+
+  /** Classify a packetId from the catalog. Returns true=video, false=audio, null=unknown (drop). */
+  #classifyPacketId(packetId: number): boolean | null {
+    if (this.#videoPacketIds.has(packetId)) return true;
+    if (this.#audioPacketIds.has(packetId)) return false;
+    return null;
+  }
+
+  /** Resolve callback for a packetId (cached per-packetId, invalidated on registration).
+   *  When a per-track callback is registered AND a legacy callback exists,
+   *  fires BOTH: per-track first, then legacy. This ensures element.ts wiring
+   *  (confirmAudio, feedMulticast) continues to fire even when TrackPipeline
+   *  registers per-track sources.
+   *  Returns null for unknown packetIds — callers must drop the packet. */
+  #getFrameCallback(packetId: number): FrameCallback | null {
+    const cached = this.#resolvedCallbacks.get(packetId);
+    if (cached) return cached;
+
+    const perTrack = this.#trackCallbacks.get(packetId);
+    const classification = this.#classifyPacketId(packetId);
+    const legacy =
+      classification === true
+        ? this.#onVideoFrame
+        : classification === false
+          ? this.#onAudioFrame
+          : null;
+
+    let resolved: FrameCallback | null;
+    if (perTrack && legacy) {
+      // Composite: fire both so per-track routing AND legacy confirm/feedMulticast work.
+      resolved = (data, meta) => {
+        perTrack(data, meta);
+        legacy(data, meta);
+      };
+    } else {
+      resolved = perTrack ?? legacy ?? null;
+    }
+
+    if (resolved) this.#resolvedCallbacks.set(packetId, resolved);
+    return resolved;
+  }
+
+  /** Deliver init segment for a track (deduped per physical stream). */
+  #deliverInit(packetId: number, data: Uint8Array, catalogTrackName?: string): void {
+    const staged = this.#staged;
+    if (staged !== null && isStream({ packetId, catalogTrackName }, staged.to)) {
+      // The incoming stream's init describes media delivered after the
+      // commit. Handing it over before would reconfigure a decoder that is
+      // still fed the outgoing stream, so it travels with the RAP instead.
+      if (data.byteLength > 8) staged.heldInit = data;
+      return;
+    }
+    const streamKey = this.#mediaStreamKey(packetId, catalogTrackName);
+    if (this.#trackInitDelivered.has(streamKey)) return;
+    if (data.byteLength <= 8) return;
+    this.#trackInitDelivered.add(streamKey);
+    const cb = this.#trackInitCallbacks.get(packetId);
+    if (cb) {
+      cb(data);
+    } else if (this.#onInitSegment) {
+      this.#onInitSegment(data);
+    }
+    console.log(
+      `[MmtpRouter] Init delivered for packetId=${packetId}${catalogTrackName === undefined ? "" : ` track=${catalogTrackName}`} (${data.byteLength}B)`,
+    );
+  }
+
+  /**
+   * Core MMTP packet processing — source packets → play + FEC, repair → FEC only.
+   * Both source and repair feed FECManager so RaptorQ has enough symbols (source + repair >= K).
+   *
+   * Two-phase parsing via MmtpContainerParser:
+   *   1. parseHeader() → extract packetId + fecPayloadId for FEC feeding
+   *   2. feed() → MFU extraction, reassembly, keyframe detection, emit via callbacks
+   */
+  #processMMTP(
+    packet: Uint8Array,
+    source: "multicast" | "moq",
+    manifestIdentity?: ManifestObjectIdentity,
+    manifestAdmitted = false,
+    ingress?: MmtpIngressContext,
+    overlapCopy = false,
+    releasedFromQuarantine = false,
+  ): void {
+    // One header parse per packet: the parser reuses it in feedParsed()
+    // below instead of parsing the same header again (BLO-36599).
+    const parsed = this.#parser.parsePacket(packet);
+    if (!parsed) return;
+    const info = parsed.info;
+    // Every multicast packet is a delivery-gap sample, including one dropped
+    // below: the gap is a property of the link the FEC deadlines run on, not
+    // of which packets this router routes. The re-entry after a manifest
+    // admission is the same arrival, not a new one.
+    if (source === "multicast" && !manifestAdmitted) {
+      this.#fecManager?.noteMulticastArrival?.(info.packetId, info.sequenceNumber);
+    }
+    if (source === "multicast" && !ingressHasPacketId(ingress, info.packetId)) {
+      debugRouter(
+        `[MmtpRouter] Dropping multicast packet pid=${info.packetId}: absent from ingress tracks`,
+      );
+      return;
+    }
+    const packetRole = this.#packetIdRoles.get(info.packetId);
+    if (
+      source === "multicast" &&
+      this.#classifyPacketId(info.packetId) === null &&
+      (!info.isRepair || packetRole !== "repair")
+    ) {
+      debugRouter(
+        `[MmtpRouter] Dropping multicast packet pid=${info.packetId}: physical PID is unregistered`,
+      );
+      return;
+    }
+    if (!info.isRepair && hasAmbiguousCatalogTrackName(ingress, info.packetId)) {
+      return;
+    }
+    // A source FEC Payload ID is read under the packet's block profile. Until
+    // the track's FEC is configured it has none: nothing (manifest identity,
+    // ledgers, FEC state) reads it as a block coordinate, and the media is
+    // routed as on a track without FEC.
+    const fecUnreadable =
+      !info.isRepair &&
+      info.fecPayloadId != null &&
+      this.#fecManager !== null &&
+      this.#classifyPacketId(info.packetId) !== null &&
+      this.#configuredBlockProfile(info.packetId) === undefined;
+    if (fecUnreadable && !manifestAdmitted) this.#noteUnreadableFecPayloadId(info.packetId, "source");
+
+    if (!info.isRepair && this.#manifestVerifier && !manifestAdmitted) {
+      let identity = manifestIdentity;
+      if (!identity && info.fecPayloadId && !fecUnreadable && (this.#resolveManifestIdentityForRoute || this.#resolveManifestIdentity)) {
+        const coordinates = this.#deriveSbnEsi(info.fecPayloadId.ssId, info.packetId);
+        const catalogTrackName = catalogTrackNameForPacket(ingress, info.packetId);
+        identity = (this.#resolveManifestIdentityForRoute
+          ? this.#resolveManifestIdentityForRoute({
+              packetId: info.packetId,
+              sbn: coordinates.sbn,
+              esi: coordinates.esi,
+              ...(catalogTrackName === undefined ? {} : { catalogTrackName }),
+              recovered: false,
+              sourceSymbolFormat: "full-mmtp-packet",
+            })
+          : this.#resolveManifestIdentity!(
+              info.packetId,
+              coordinates.sbn,
+              coordinates.esi,
+              catalogTrackName,
+            )) ?? undefined;
+      }
+      if (identity) {
+        identity = {
+          ...identity,
+          packetId: info.packetId,
+          ...(info.fecPayloadId ? { ssId: info.fecPayloadId.ssId } : {}),
+        };
+        const authenticated = info.fecPayloadId ? packet.subarray(0, packet.length - 4) : packet;
+        // A `stall` admission quarantines the packet and releases it later,
+        // after the stream has moved on; a synchronous release happens inside
+        // admitObject, before this flag is set.
+        let quarantined = false;
+        const admission = this.#manifestVerifier.admitObject(identity, authenticated, () => {
+          if (!this.#disposed) {
+            this.#processMMTP(packet, source, identity, true, ingress, overlapCopy, quarantined);
+          }
+        });
+        quarantined = admission.action === "stall";
+        return;
+      }
+      if (
+        this.#manifestVerifier.config.mode === "enforce" &&
+        this.#manifestVerifier.config.onMissingManifest === "stall"
+      ) {
+        console.warn(`[MmtpRouter] manifest identity absent; stalling packetId=${info.packetId}`);
+        return;
+      }
+    }
+
+    if (info.isRepair) {
+      // Repair packet — per ISO 23008-1 §C.5.3, carries (SS_Start, SSB_length, RS_ID).
+      // Read from the header parsed above rather than parsing it again
+      // (BLO-36599).
+      const repair = parseMoqRepairFrameWithHeader(packet, parsed.header);
+      if (!repair) return;
+
+        const ownerPacketId = this.#resolveRepairOwnerPacketId(info.packetId, ingress);
+        if (ownerPacketId != null && this.#fecManager) {
+          if (hasAmbiguousCatalogTrackName(ingress, ownerPacketId)) return;
+        this.#repairPidCounts[info.packetId] = (this.#repairPidCounts[info.packetId] || 0) + 1;
+        const count = this.#repairPidCounts[info.packetId]!;
+        if (count <= 2 || count % 500 === 0) {
+          console.log(
+            `[MC-PKT] pid=${info.packetId} repairOwner=${ownerPacketId} type=${info.packetType} count=${count} ssbLength=${repair.ssbLength} len=${packet.length}`,
+          );
+        }
+
+        if (this.#configuredBlockProfile(ownerPacketId) === undefined) {
+          this.#noteUnreadableFecPayloadId(ownerPacketId, "repair");
+          return;
+        }
+        // NOTE: Do NOT call trackBlock for repair packets. Only source symbols
+        // should count toward block completion — repair inflates blocksClean stats
+        // and masks blocks that actually needed FEC recovery.
+        if (this.#isIsoPacket(ownerPacketId)) {
+          this.#handleIsoRepair(ownerPacketId, catalogTrackNameForPacket(ingress, ownerPacketId), repair, source);
+          return;
+        }
+        const repairSbn = this.#deriveRepairSbn(repair.ssStart, repair.ssbLength, ownerPacketId);
+        if (repairSbn === null) return;
+        const repairEsi = this.#kForPacket(ownerPacketId) + repair.rsId;
+
+        if (
+          !this.#feedFecTransportSymbol(
+            ownerPacketId,
+            repairSbn,
+            repairEsi,
+            repair.symbolData,
+            source,
+            catalogTrackNameForPacket(ingress, ownerPacketId),
+          )
+        ) return;
+
+        // Repair symbols are block progress too. The deadline measures
+        // inactivity, not total block lifetime.
+        const repairCatalogTrackName = catalogTrackNameForPacket(ingress, ownerPacketId);
+        if (repairCatalogTrackName === undefined) {
+          this.#fecManager.noteBlockActivity?.(repairSbn, ownerPacketId);
+        } else {
+          this.#fecManager.noteBlockActivity?.(
+            repairSbn,
+            ownerPacketId,
+            repairCatalogTrackName,
+          );
+        }
+
+        const recovered = repairCatalogTrackName === undefined
+          ? this.#fecManager.feedRepairSymbol(
+              ownerPacketId,
+              repair.ssStart,
+              repair.ssbLength,
+              repair.rsId,
+              repair.symbolData,
+            )
+          : this.#fecManager.feedRepairSymbol(
+              ownerPacketId,
+              repair.ssStart,
+              repair.ssbLength,
+              repair.rsId,
+              repair.symbolData,
+              repairCatalogTrackName,
+            );
+        if (recovered) {
+          const alreadyCompleted = repairCatalogTrackName === undefined
+            ? this.#fecManager.isBlockCompleted(repairSbn, ownerPacketId)
+            : this.#fecManager.isBlockCompleted(
+                repairSbn,
+                ownerPacketId,
+                repairCatalogTrackName,
+              );
+          if (repairCatalogTrackName === undefined) {
+            this.#fecManager.cancelBlockTimeout(repairSbn, ownerPacketId);
+          } else {
+            this.#fecManager.cancelBlockTimeout(
+              repairSbn,
+              ownerPacketId,
+              repairCatalogTrackName,
+            );
+          }
+          // Skip routing if block was already completed via source path (all K sources
+          // arrived). The parser's feed() already played every frame.
+          if (!alreadyCompleted) {
+            this.#fecManager.countRecovery(ownerPacketId, repairSbn, repairCatalogTrackName);
+            if (repairCatalogTrackName === undefined) {
+              this.#fecManager.markBlockCompleted(repairSbn, ownerPacketId);
+            } else {
+              this.#fecManager.markBlockCompleted(
+                repairSbn,
+                ownerPacketId,
+                repairCatalogTrackName,
+              );
+            }
+            this.#routeRecoveredBlock(
+              repairSbn,
+              recovered,
+              ownerPacketId,
+              catalogTrackNameForPacket(ingress, ownerPacketId),
+            );
+          }
+        }
+      }
+    } else {
+      // Drop source packets with unknown packetId — not in catalog.
+      if (this.#classifyPacketId(info.packetId) === null) return;
+
+      // Debug: count packets per packetId
+      this.#pidCounts[info.packetId] = (this.#pidCounts[info.packetId] || 0) + 1;
+      const count = this.#pidCounts[info.packetId]!;
+      if (count <= 2 || count % 500 === 0) {
+        console.log(
+          `[MC-PKT] pid=${info.packetId} type=${info.packetType} count=${count} len=${packet.length}`,
+        );
+      }
+
+      // Source packet — parse for playback first, then feed FEC only if the
+      // source block did not complete cleanly. Feeding FEC before parser/feed
+      // lets a source-triggered recovery race ahead of the source timeline.
+      let fecInfo:
+        | { sbn: number; esi: number; oversized?: boolean }
+        | undefined;
+      let sourceFec:
+        | {
+            ssId: number;
+            sbn: number;
+            symbolData: Uint8Array;
+          }
+        | null = null;
+      let sourceSymbolAccepted = false;
+      let sourceSymbolTrackable = false;
+      let parseSourceSymbol = false;
+      const catalogTrackName = catalogTrackNameForPacket(ingress, info.packetId);
+      if (catalogTrackName !== undefined) {
+        const names = this.#catalogTrackNamesByPacketId.get(info.packetId) ?? new Set();
+        names.add(catalogTrackName);
+        this.#catalogTrackNamesByPacketId.set(info.packetId, names);
+      }
+
+      const duplicates = this.#stream(info.packetId, catalogTrackName).duplicates;
+      // The FEC Payload ID FEC may read: none while the packetId has no
+      // configured block profile (fecUnreadable above).
+      const fecPayloadId = fecUnreadable ? null : info.fecPayloadId;
+      // iso-ssbg1-v1 locates a source by range membership in a block a repair
+      // already stated; until then it is held, unplaced (BLO-35597 iso:3).
+      const isoSource = this.#fecManager !== null && fecPayloadId != null &&
+        this.#isIsoPacket(info.packetId);
+      const coords = this.#fecManager && fecPayloadId
+        ? (isoSource
+            ? this.#fecManager.locateIsoSource?.(info.packetId, catalogTrackName, fecPayloadId.ssId) ?? undefined
+            : this.#deriveSbnEsi(fecPayloadId.ssId, info.packetId))
+        : undefined;
+      // Note the packet's FEC block (none without an FEC coordinate) before
+      // any ledger lookup, the restart check below included.
+      duplicates.advance(coords?.sbn);
+      // A multicast packet that predates everything the stream has kept for a
+      // whole FEC horizon is a publisher that restarted its
+      // packet_sequence_number / SS_ID counters (BLO-36599,
+      // StreamDuplicateLedgers.predatesHorizon). Its first packets would
+      // otherwise read as duplicates or as frames behind the reorder cursor.
+      // Start a fresh epoch for the stream before this packet is looked up.
+      // The reset needs the catalog identity, so a stream without one is not
+      // checked; an overlap copy is MoQ bytes and says nothing about the
+      // multicast publisher, and neither does a packet the manifest verifier
+      // quarantined: it predates the horizon because it waited, not because the
+      // publisher restarted.
+      if (
+        source === "multicast" &&
+        !overlapCopy &&
+        !releasedFromQuarantine &&
+        catalogTrackName !== undefined &&
+        duplicates.predatesHorizon(info.sequenceNumber, fecPayloadId?.ssId)
+      ) {
+        this.#publisherRestarts++;
+        console.warn(
+          `[MmtpRouter] publisher restart on pid=${info.packetId} track=${catalogTrackName}: ` +
+            `packet_sequence_number=${info.sequenceNumber} predates the stream's FEC horizon; ` +
+            "starting a new epoch",
+        );
+        // Frames the release gate holds belong to the old epoch: release them
+        // as a discontinuity stall, as FECManager's source-discontinuity path
+        // does, before the reset discards the stream.
+        this.#parser.markFecDiscontinuity(info.packetId, catalogTrackName);
+        this.#parser.pokeFecRelease(info.packetId, catalogTrackName);
+        this.resetTrack(info.packetId, catalogTrackName);
+        this.#onPublisherRestart?.(info.packetId, catalogTrackName);
+        // The reset cleared the ledgers: note this packet's block in the new epoch.
+        duplicates.advance(coords?.sbn);
+      }
+      if (this.#fecManager && fecPayloadId && coords) {
+        const fecId = fecPayloadId;
+        const symbolSize = this.#symbolSizeForPacket(info.packetId);
+
+        // The mmtp-packet source symbol protects the complete MMTP packet
+        // before SS_ID is appended, self-delimiting and zero-padded to T.
+        const rawSymbol = packet.subarray(0, packet.length - 4);
+        // iso-ssbg1-v1 symbols carry a two-octet length (C.3.3): admission
+        // refuses length + 2 > T.
+        const oversized = isoSource
+          ? !(this.#fecManager.isoSourceFits?.(info.packetId, rawSymbol.length) ?? false)
+          : symbolSize > 0 && rawSymbol.length > symbolSize;
+
+        // NOTE: trackBlock() is deferred to AFTER #feedViaParser (below).
+        // Reason: trackBlock synchronously fires onBlockComplete when the
+        // K-th source symbol arrives, which synchronously calls
+        // CmafBlockAssembler.completeBlock → #flushBlock → emit. If
+        // trackBlock fires BEFORE parser.feed, the K-th packet's
+        // parser.onFrame → assembler.addFrame happens AFTER flushBlock
+        // already drained the block — the K-th frame is stranded in a
+        // newly-allocated empty block that never gets a completeBlock
+        // event again, because that SBN is already in fecManager's
+        // #completedBlocks set (BLO-3035 layer 4).
+        //
+        // Complete-packet symbols larger than T cannot be decoded but still
+        // represent a source-symbol arrival, so trackBlock counts them below.
+
+        let overlapBlockCompleted = false;
+        if (overlapCopy) {
+          // Playback only. The multicast twin still feeds FEC when it
+          // arrives. The per-symbol parse ledger below parses whichever copy
+          // arrives first and drops the second; the MFU reassembler cannot,
+          // because complete (FI=0) MFUs bypass its #emitted set. A completed
+          // block stays authoritative, as it does for FEC input.
+          overlapBlockCompleted = catalogTrackName === undefined
+            ? this.#fecManager.isBlockCompleted(coords.sbn, info.packetId)
+            : this.#fecManager.isBlockCompleted(
+                coords.sbn,
+                info.packetId,
+                catalogTrackName,
+              );
+        } else if (oversized) {
+          // Oversized packet — not FEC-encoded by FFmpeg, skip FEC feed.
+          // Still emitted via parser.feed() below (direct path).
+          sourceSymbolAccepted = this.#feedFecTransportSymbol(
+            info.packetId,
+            coords.sbn,
+            coords.esi,
+            rawSymbol,
+            source,
+            catalogTrackName,
+          );
+          sourceSymbolTrackable = sourceSymbolAccepted;
+        } else {
+          // FECManager zero-pads a short symbol to T itself and then owns that
+          // buffer outright, so it can transfer it to the FEC Worker without
+          // copying it again. Padding here as well cost a second T-byte
+          // allocation and copy per short packet (BLO-36599).
+          const symbolData = rawSymbol;
+
+          sourceSymbolAccepted = this.#feedFecTransportSymbol(
+            info.packetId,
+            coords.sbn,
+            coords.esi,
+            symbolData,
+            source,
+            catalogTrackName,
+          );
+          sourceSymbolTrackable = sourceSymbolAccepted;
+          if (sourceSymbolAccepted) {
+            sourceFec = { ssId: fecId.ssId, sbn: coords.sbn, symbolData };
+          }
+        }
+
+        // First copy wins per symbol, in either arrival order.
+        parseSourceSymbol =
+          (overlapCopy ? !overlapBlockCompleted : sourceSymbolAccepted) &&
+          !duplicates.parsedSymbols.has(fecId.ssId);
+
+        // Compute FEC block info for the MSE assembler.
+        fecInfo = { sbn: coords.sbn, esi: coords.esi, oversized };
+      } else if (isoSource && this.#fecManager && fecPayloadId) {
+        // iso-ssbg1-v1 source whose block no repair has stated yet: route its
+        // media now and hold its FEC symbol until a repair places it.
+        const ssId = fecPayloadId.ssId;
+        if (overlapCopy) {
+          parseSourceSymbol = !duplicates.parsedSymbols.has(ssId);
+        } else {
+          const rawSymbol = packet.subarray(0, packet.length - 4);
+          const held = this.#fecManager.holdIsoSource?.(info.packetId, catalogTrackName, ssId, {
+            symbolData: rawSymbol,
+            source,
+            evidence: sourceSymbolEvidence(packet, parsed.header, info.rapFlag, info.sequenceNumber),
+            oversized: !(this.#fecManager.isoSourceFits?.(info.packetId, rawSymbol.length) ?? false),
+          }) ?? false;
+          parseSourceSymbol = held && !duplicates.parsedSymbols.has(ssId);
+        }
+      } else if (fecUnreadable && info.fecPayloadId) {
+        // FEC is unavailable for this packetId: its media is routed as on a
+        // track without FEC, first copy per SS_ID. The parse ledger reads
+        // SS_ID only as a symbol identity, never as a block coordinate.
+        parseSourceSymbol = !duplicates.parsedSymbols.has(info.fecPayloadId.ssId);
+      }
+
+      // Parse only the first copy of an FEC source symbol. A late direct copy
+      // of a worker-recovered fragment has the same SBN/ESI and fragment
+      // counter; feeding it again can make the MFU buffer non-contiguous even
+      // when FI=1..3 were already complete. Non-FEC packets still always flow.
+      if (!this.#fecManager || !info.fecPayloadId || parseSourceSymbol) {
+        if (this.#fecManager && info.fecPayloadId) {
+          duplicates.parsedSymbols.add(info.fecPayloadId.ssId);
+        }
+        this.#noteSourcePacketSeq(
+          info.packetId,
+          info.sequenceNumber,
+          catalogTrackName,
+        );
+        this.#routeTrackPacket(packet, info.packetId, info.sequenceNumber, {
+          recovered: false,
+          skipFecPayloadId: false,
+          catalogTrackName,
+        });
+        this.#feedViaParser(packet, info, fecInfo, {
+          source,
+          catalogTrackName,
+          ...(isoSource && info.fecPayloadId
+            ? { fecSbn: info.fecPayloadId.ssId }
+            : fecInfo === undefined ? {} : { fecSbn: fecInfo.sbn }),
+        }, parsed);
+      }
+      // The frame this packet completed can commit an in-place switch that
+      // retires this very packet ID. Its FEC state is gone then, and feeding
+      // the rest of this packet would only rebuild it for a stream that ended.
+      if (this.#classifyPacketId(info.packetId) === null) return;
+
+      // Deferred trackBlock (BLO-3035 layer 4 race fix). Fire AFTER
+      // #feedViaParser → parser.feed → addFrame, so the K-th source
+      // packet's frame is buffered in CmafBlockAssembler.#blocks BEFORE
+      // trackBlock synchronously triggers onBlockComplete → completeBlock
+      // → #flushBlock. Without this ordering, the K-th frame was lost on
+      // every block — only K-1 frames per block were ever emitted to MSE.
+      // Only first-arriving symbols count toward completion or playback.
+      if (
+        this.#fecManager &&
+        fecPayloadId &&
+        sourceSymbolAccepted &&
+        sourceSymbolTrackable
+      ) {
+        const { sbn, esi } = isoSource && coords
+          ? coords
+          : this.#deriveSbnEsi(fecPayloadId.ssId, info.packetId);
+        if (
+          this.#classifyPacketId(info.packetId) !== null &&
+          this.#fecManager.isTrackConfigured?.(info.packetId) !== false
+        ) {
+          // Only this first-arrival network source symbol is classification
+          // evidence: the R bit and the MPU / DU identity it carries.
+          // Recovered and repair symbols never reach this call.
+          this.#fecManager.trackBlock(
+            sbn,
+            info.packetId,
+            catalogTrackName,
+            esi,
+            sourceSymbolEvidence(packet, parsed.header, info.rapFlag, info.sequenceNumber),
+          );
+          this.#requestFecPoke(info.packetId, catalogTrackName);
+        }
+      }
+
+      // Only now feed source symbols into FEC. The decoder must still receive
+      // the K-th source symbol after trackBlock() marks a clean block complete:
+      // Worker-backed decoders use that symbol for their own block lifecycle
+      // and stats. Suppress any synchronous recovered-block return when the
+      // manager already completed the block, because every source frame was
+      // parsed and emitted above.
+      if (this.#fecManager && sourceFec) {
+        const alreadyCompleted = catalogTrackName === undefined
+          ? this.#fecManager.isBlockCompleted(sourceFec.sbn, info.packetId)
+          : this.#fecManager.isBlockCompleted(
+              sourceFec.sbn,
+              info.packetId,
+              catalogTrackName,
+            );
+        const recovered = catalogTrackName === undefined
+          ? this.#fecManager.feedSourceSymbol(
+              info.packetId,
+              sourceFec.ssId,
+              sourceFec.symbolData,
+              undefined,
+            )
+          : this.#fecManager.feedSourceSymbol(
+              info.packetId,
+              sourceFec.ssId,
+              sourceFec.symbolData,
+              undefined,
+              catalogTrackName,
+            );
+        if (recovered) {
+          if (!alreadyCompleted && this.#classifyPacketId(info.packetId) !== null) {
+            if (catalogTrackName === undefined) {
+              this.#fecManager.cancelBlockTimeout(sourceFec.sbn, info.packetId);
+            } else {
+              this.#fecManager.cancelBlockTimeout(
+                sourceFec.sbn,
+                info.packetId,
+                catalogTrackName,
+              );
+            }
+          }
+          // Only route recovered blocks that needed actual repair.
+          if (!alreadyCompleted) {
+            this.#fecManager.countRecovery(info.packetId, sourceFec.sbn, catalogTrackName);
+            if (catalogTrackName === undefined) {
+              this.#fecManager.markBlockCompleted(sourceFec.sbn, info.packetId);
+            } else {
+              this.#fecManager.markBlockCompleted(
+                sourceFec.sbn,
+                info.packetId,
+                catalogTrackName,
+              );
+            }
+            this.#routeRecoveredBlock(
+              sourceFec.sbn,
+              recovered,
+              info.packetId,
+              catalogTrackName,
+            );
+          }
+        }
+      }
+    }
+  }
+
+  /**
+   * Set temp context and delegate to parser.feed() for MFU extraction,
+   * reassembly, keyframe detection, and frame emission via callbacks.
+   */
+  #feedViaParser(
+    packet: Uint8Array,
+    info: {
+      packetId: number;
+      sequenceNumber: number;
+      fecPayloadId?: { ssId: number } | null;
+    },
+    fecInfo?: { sbn: number; esi: number; oversized?: boolean },
+    parserOptions?: {
+      skipFecPayloadId?: boolean;
+      recovered?: boolean;
+      source?: MmtpSourcePath;
+      deliveryProvenance?: MmtpDeliveryProvenance;
+      catalogTrackName?: string;
+      fecSbn?: number;
+    },
+    parsed?: ParsedMmtpPacket,
+  ): void {
+    const diag = this.#diagFor(info.packetId, parserOptions?.catalogTrackName);
+    // Plain parser counters, not reassembler.getStatus(): on the wasm backend
+    // each status read is a stats() crossing, and this runs for every packet
+    // (BLO-36599). Buffer occupancy is read once, in getDiagnostics().
+    const fragmentsBefore = this.#parser.reassemblerFragmentsFed;
+    const reassembledBefore = this.#parser.reassemblerDataUnitsReturned;
+    diag.packets++;
+    diag.lastPacketLength = packet.byteLength;
+    diag.lastSequenceNumber = info.sequenceNumber;
+    if (info.fecPayloadId) diag.lastFecSsId = info.fecPayloadId.ssId;
+    this.#currentFecInfo = fecInfo;
+    this.#currentSeqNum = info.sequenceNumber;
+    try {
+      const feedOptions = {
+        skipFecPayloadId: parserOptions?.skipFecPayloadId,
+        recovered: parserOptions?.recovered,
+        source: parserOptions?.source,
+        deliveryProvenance: parserOptions?.deliveryProvenance,
+        catalogTrackName: parserOptions?.catalogTrackName,
+        ...(parserOptions?.fecSbn === undefined ? {} : { fecSbn: parserOptions.fecSbn }),
+      };
+      if (parsed) this.#parser.feedParsed(packet, parsed, feedOptions);
+      else this.#parser.feed(packet, feedOptions);
+    } finally {
+      this.#currentFecInfo = undefined;
+    }
+    const fragmentDelta = this.#parser.reassemblerFragmentsFed - fragmentsBefore;
+    const reassembledDelta =
+      this.#parser.reassemblerDataUnitsReturned - reassembledBefore;
+    if (fragmentDelta > 0) diag.fragments += fragmentDelta;
+    else diag.noFragment++;
+    if (reassembledDelta > 0) diag.reassembled += reassembledDelta;
+  }
+
+  #feedFecTransportSymbol(
+    packetId: number,
+    sbn: number,
+    esi: number,
+    data: Uint8Array,
+    source: MmtpSourcePath,
+    catalogTrackName?: string,
+  ): boolean {
+    const fecManager = this.#fecManager;
+    if (!fecManager) return false;
+    return catalogTrackName === undefined
+      ? fecManager.feedSymbolFromSource(packetId, sbn, esi, data, source)
+      : fecManager.feedSymbolFromSource(
+          packetId,
+          sbn,
+          esi,
+          data,
+          source,
+          catalogTrackName,
+        );
+  }
+
+  #diagFor(packetId: number, catalogTrackName?: string): ParserDiagnostics {
+    const streamKey = this.#mediaStreamKey(packetId, catalogTrackName);
+    let diag = this.#parserDiagnostics.get(streamKey);
+    if (!diag) {
+      diag = {
+        packets: 0,
+        frames: 0,
+        initSegments: 0,
+        noFragment: 0,
+        fragments: 0,
+        reassembled: 0,
+        pendingBuffers: 0,
+        pendingFragments: 0,
+        lastPacketLength: 0,
+        lastSequenceNumber: 0,
+        directAudioSourceEmitted: 0,
+        directAudioSourceRegressions: 0,
+        directAudioRecoveredQueued: 0,
+        directAudioRecoveredDrained: 0,
+        directAudioRecoveredStaleDropped: 0,
+      };
+      this.#parserDiagnostics.set(streamKey, diag);
+    }
+    return diag;
+  }
+
+  #shouldEmitFrame(
+    packetId: number,
+    keyframe: boolean,
+    catalogTrackName?: string,
+  ): boolean {
+    if (!this.#fecManager) return true;
+    if (!this.#videoPacketIds.has(packetId)) return true;
+    const streamKey = this.#mediaStreamKey(packetId, catalogTrackName);
+    if (this.#trackSynced.has(streamKey)) return true;
+    if (!keyframe) {
+      this.#droppedPreSyncVideo.add(streamKey);
+      return false;
+    }
+    this.#trackSynced.add(streamKey);
+    this.#droppedPreSyncVideo.delete(streamKey);
+    return true;
+  }
+
+  #opensFecSync(
+    packetId: number,
+    keyframe: boolean,
+    catalogTrackName?: string,
+  ): boolean {
+    const streamKey = this.#mediaStreamKey(packetId, catalogTrackName);
+    return !!this.#fecManager &&
+      this.#videoPacketIds.has(packetId) &&
+      !this.#trackSynced.has(streamKey) &&
+      this.#droppedPreSyncVideo.has(streamKey) &&
+      keyframe;
+  }
+
+  #noteEmittedVideoSeq(streamKey: string, packetSequenceNumber: number | undefined): void {
+    if (packetSequenceNumber === undefined || !Number.isFinite(packetSequenceNumber)) return;
+    const latest = this.#latestVideoSeqByStream.get(streamKey);
+    if (latest === undefined || packetSequenceNumber > latest) {
+      this.#latestVideoSeqByStream.set(streamKey, packetSequenceNumber);
+    }
+  }
+
+  #noteSourcePacketSeq(
+    packetId: number,
+    packetSequenceNumber: number | undefined,
+    catalogTrackName?: string,
+  ): void {
+    if (packetSequenceNumber === undefined || !Number.isFinite(packetSequenceNumber)) return;
+    this.#stream(packetId, catalogTrackName).duplicates.sourceSeqs.add(packetSequenceNumber);
+  }
+
+  #sourceSeqReceived(
+    packetId: number,
+    packetSequenceNumber: number,
+    catalogTrackName?: string,
+  ): boolean {
+    return this.#stream(packetId, catalogTrackName).duplicates.sourceSeqs.has(packetSequenceNumber);
+  }
+
+  #routeTrackPacket(
+    packet: Uint8Array,
+    packetId: number,
+    packetSequenceNumber: number,
+    meta: Pick<
+      RoutedPacketMeta,
+      "recovered" | "skipFecPayloadId" | "catalogTrackName" | "deliveryProvenance"
+    >,
+  ): void {
+    if (!Number.isFinite(packetSequenceNumber)) return;
+    const callback = this.#trackPacketCallbacks.get(packetId);
+    if (!callback) return;
+    const routedSeqs = this.#stream(packetId, meta.catalogTrackName).duplicates.routedSeqs;
+    if (routedSeqs.has(packetSequenceNumber)) return;
+    routedSeqs.add(packetSequenceNumber);
+    callback(packet, {
+      packetId,
+      packetSequenceNumber,
+      recovered: meta.recovered,
+      skipFecPayloadId: meta.skipFecPayloadId,
+      ...(meta.catalogTrackName === undefined
+        ? {}
+        : { catalogTrackName: meta.catalogTrackName }),
+      ...(meta.deliveryProvenance === undefined
+        ? {}
+        : { deliveryProvenance: meta.deliveryProvenance }),
+    });
+  }
+
+  #isStaleRecoveredVideo(
+    packetId: number,
+    packetSequenceNumber: number,
+    catalogTrackName?: string,
+  ): boolean {
+    const latest = this.#latestVideoSeqByStream.get(
+      this.#mediaStreamKey(packetId, catalogTrackName),
+    );
+    return latest !== undefined && packetSequenceNumber <= latest;
+  }
+
+  /**
+   * JSON tuple naming one physical stream. Built several times per packet, so
+   * each (packetId, catalog name) pair is serialized once and reused; the set
+   * of pairs is bounded by the catalog (BLO-36599).
+   */
+  #mediaStreamKey(packetId: number, catalogTrackName?: string): string {
+    return this.#stream(packetId, catalogTrackName).key;
+  }
+
+  /** The (packetId, catalog name) stream's key and duplicate ledgers. */
+  #stream(packetId: number, catalogTrackName?: string): StreamLedgers {
+    let byName = this.#streams.get(packetId);
+    if (!byName) {
+      byName = new Map();
+      this.#streams.set(packetId, byName);
+    }
+    let stream = byName.get(catalogTrackName);
+    if (stream === undefined) {
+      stream = {
+        key: JSON.stringify([packetId, catalogTrackName ?? null]),
+        duplicates: new StreamDuplicateLedgers(() => this.duplicateHorizonFor(packetId)),
+      };
+      byName.set(catalogTrackName, stream);
+    }
+    return stream;
+  }
+
+  #packetIdFromStreamKey(key: string): number {
+    try {
+      const decoded = JSON.parse(key);
+      if (Array.isArray(decoded) && typeof decoded[0] === "number") return decoded[0];
+    } catch {
+      // Internal keys are JSON tuples; malformed legacy keys should not happen.
+    }
+    return 0;
+  }
+
+  #mseAssemblerKey(packetId: number, catalogTrackName?: string): string {
+    return this.#mediaStreamKey(packetId, catalogTrackName);
+  }
+
+  #mseAssemblerFor(
+    packetId: number,
+    catalogTrackName?: string,
+  ): CmafBlockAssembler | undefined {
+    const exact = this.#mseAssemblers.get(
+      this.#mseAssemblerKey(packetId, catalogTrackName),
+    );
+    if (exact || catalogTrackName === undefined) return exact;
+    if (!this.#isCatalogTrackUnambiguous(packetId, catalogTrackName)) return undefined;
+    return this.#mseAssemblers.get(this.#mseAssemblerKey(packetId));
+  }
+
+  #isCatalogTrackUnambiguous(
+    packetId: number,
+    catalogTrackName?: string,
+  ): boolean {
+    if (catalogTrackName === undefined) return true;
+    const names = this.#catalogTrackNamesByPacketId.get(packetId);
+    return names?.size === 1 && names.has(catalogTrackName);
+  }
+
+  #resolveRecoveredTiming(
+    packetId: number,
+    mpuSequenceNumber: number,
+    movieFragmentSequenceNumber: number | undefined,
+    sampleNumber: number | undefined,
+    mmtpTimestamp: bigint,
+    catalogTrackName?: string,
+  ): { authoredTiming?: AuthoredTiming; timestamp: number; mmtpTimestamp: bigint } | null {
+    // Non-timed MFUs do not carry a movie-fragment/sample identity. They are
+    // outside the ISO-BMFF presentation timeline, so retain the raw MMTP
+    // timestamp path used by the untimed router contract.
+    if (movieFragmentSequenceNumber === undefined || sampleNumber === undefined) {
+      return {
+        timestamp: mmtpTimestampToMicros(mmtpTimestamp),
+        mmtpTimestamp,
+      };
+    }
+
+    // Claim the resolver entry before scaling it. The claim is the single
+    // consume operation for a recovered sample; doing lookup → scale → claim
+    // would leave an invalid entry live forever when scaling rejects it.
+    const authoredTiming = this.#parser.consumeAuthoredTimingFor(
+      packetId,
+      mpuSequenceNumber,
+      movieFragmentSequenceNumber,
+      sampleNumber,
+      catalogTrackName,
+    );
+    // Recovery is accepted only when the timed stream's FT=1 metadata names
+    // this exact sample. MMTP send timestamps describe transport arrival, not
+    // the authored presentation timeline, so they are never a fallback.
+    if (authoredTiming === null) return null;
+    const scaled = scaleAuthoredTiming(authoredTiming, 1_000_000);
+    if (scaled === null) return null;
+    return { authoredTiming, timestamp: scaled.timestamp, mmtpTimestamp };
+  }
+
+  #pendingRecoveredKey(meta: RoutedFrameMeta): string {
+    return `${meta.timestamp}:${meta.packetSequenceNumber ?? ""}`;
+  }
+
+  #pendingRecoveredQueue(streamKey: string): Map<string, PendingRecoveredVideoFrame> {
+    let queue = this.#pendingDirectRecoveredVideoByStream.get(streamKey);
+    if (!queue) {
+      queue = new Map();
+      this.#pendingDirectRecoveredVideoByStream.set(streamKey, queue);
+    }
+    return queue;
+  }
+
+  #comparePendingRecoveredVideo(
+    a: PendingRecoveredVideoFrame,
+    b: PendingRecoveredVideoFrame,
+  ): number {
+    if (a.meta.timestamp !== b.meta.timestamp) return a.meta.timestamp - b.meta.timestamp;
+    const aSeq = a.meta.packetSequenceNumber ?? Number.MAX_SAFE_INTEGER;
+    const bSeq = b.meta.packetSequenceNumber ?? Number.MAX_SAFE_INTEGER;
+    return aSeq - bSeq;
+  }
+
+  #noteDeliveredVideo(streamKey: string, meta: StreamSwitchPosition): void {
+    const high = this.#deliveredVideoHighWaterByStream.get(streamKey);
+    if (high === undefined || comparePresentation(meta, high) > 0) {
+      this.#deliveredVideoHighWaterByStream.set(streamKey, switchPosition(meta));
+    }
+  }
+
+  #emitDirectVideo(
+    packetId: number,
+    data: Uint8Array,
+    meta: RoutedFrameMeta,
+    cb: FrameCallback | null,
+  ): boolean {
+    const streamKey = this.#mediaStreamKey(packetId, meta.catalogTrackName);
+    const lastEmitted = this.#lastDirectEmittedVideoTsByStream.get(streamKey);
+    if (lastEmitted !== undefined && meta.timestamp <= lastEmitted) return false;
+    this.#lastDirectEmittedVideoTsByStream.set(streamKey, meta.timestamp);
+    this.#noteDeliveredVideo(streamKey, meta);
+    // Record the emitted sequence number HERE — at the real emit — not when a
+    // recovered frame is queued. #routeDirectRecoveredVideo may enqueue a frame
+    // that is ahead of the source cursor; noting its seq before it drains would
+    // make #isStaleRecoveredVideo drop an earlier gap frame that arrives later
+    // (it would look <= the queued-but-unemitted seq). The high-water mark must
+    // reflect what actually reached the decoder callback.
+    this.#noteEmittedVideoSeq(streamKey, meta.packetSequenceNumber);
+    cb?.(data, meta);
+    return true;
+  }
+
+  #drainDirectRecoveredVideo(
+    streamKey: string,
+    packetId: number,
+    releases: (meta: RoutedFrameMeta) => boolean,
+    cb: FrameCallback | null,
+  ): void {
+    const queue = this.#pendingDirectRecoveredVideoByStream.get(streamKey);
+    if (!queue || queue.size === 0) return;
+
+    const ready = [...queue.values()]
+      .filter(frame => releases(frame.meta))
+      .sort((a, b) => this.#comparePendingRecoveredVideo(a, b));
+
+    for (const frame of ready) {
+      queue.delete(this.#pendingRecoveredKey(frame.meta));
+      this.#emitDirectVideo(packetId, frame.data, frame.meta, cb);
+    }
+
+    if (queue.size === 0) {
+      this.#pendingDirectRecoveredVideoByStream.delete(streamKey);
+    }
+  }
+
+  #enqueueDirectRecoveredVideo(
+    packetId: number,
+    data: Uint8Array,
+    meta: RoutedFrameMeta,
+  ): void {
+    const streamKey = this.#mediaStreamKey(packetId, meta.catalogTrackName);
+    const lastEmitted = this.#lastDirectEmittedVideoTsByStream.get(streamKey);
+    if (lastEmitted !== undefined && meta.timestamp <= lastEmitted) return;
+
+    const queue = this.#pendingRecoveredQueue(streamKey);
+    queue.set(this.#pendingRecoveredKey(meta), { data, meta: { ...meta } });
+
+    if (queue.size > DIRECT_RECOVERED_VIDEO_QUEUE_LIMIT) {
+      const keep = [...queue.entries()]
+        .sort((a, b) => this.#comparePendingRecoveredVideo(a[1], b[1]))
+        .slice(-Math.floor(DIRECT_RECOVERED_VIDEO_QUEUE_LIMIT / 2));
+      queue.clear();
+      for (const [key, frame] of keep) queue.set(key, frame);
+    }
+  }
+
+  #routeDirectSourceVideo(
+    packetId: number,
+    data: Uint8Array,
+    meta: RoutedFrameMeta,
+    cb: FrameCallback | null,
+  ): void {
+    const streamKey = this.#mediaStreamKey(packetId, meta.catalogTrackName);
+    const lastSourceTs = this.#lastDirectSourceVideoTsByStream.get(streamKey);
+    if (lastSourceTs === undefined || meta.timestamp > lastSourceTs) {
+      this.#lastDirectSourceVideoTsByStream.set(streamKey, meta.timestamp);
+    }
+
+    // Recovered FEC may arrive before the source stream reaches the same media
+    // time. Drain those gap fills immediately before the source frame that proves
+    // the live cursor caught up, preserving the decoder dependency chain.
+    this.#drainDirectRecoveredVideo(streamKey, packetId, frame => frame.timestamp <= meta.timestamp, cb);
+    this.#emitDirectVideo(packetId, data, meta, cb);
+  }
+
+  #routeDirectRecoveredVideo(
+    packetId: number,
+    data: Uint8Array,
+    meta: RoutedFrameMeta,
+    cb: FrameCallback | null,
+  ): void {
+    const streamKey = this.#mediaStreamKey(packetId, meta.catalogTrackName);
+    this.#enqueueDirectRecoveredVideo(packetId, data, meta);
+    const lastSourceTs = this.#lastDirectSourceVideoTsByStream.get(streamKey);
+    this.#drainDirectRecoveredVideo(
+      streamKey,
+      packetId,
+      frame => lastSourceTs === undefined || frame.timestamp <= lastSourceTs,
+      cb,
+    );
+  }
+
+  #pendingRecoveredAudioQueue(streamKey: string): Map<string, PendingRecoveredAudioFrame> {
+    let queue = this.#pendingDirectRecoveredAudioByStream.get(streamKey);
+    if (!queue) {
+      queue = new Map();
+      this.#pendingDirectRecoveredAudioByStream.set(streamKey, queue);
+    }
+    return queue;
+  }
+
+  #directAudioCursor(meta: RoutedFrameMeta): DirectAudioCursor {
+    return {
+      timestamp: meta.timestamp,
+      // A recovered frame without transport sequence metadata must drain before
+      // an equal-timestamp source horizon instead of remaining queued forever.
+      sequenceNumber: meta.packetSequenceNumber ?? Number.MIN_SAFE_INTEGER,
+    };
+  }
+
+  #compareDirectAudioCursor(a: DirectAudioCursor, b: DirectAudioCursor): number {
+    if (a.timestamp !== b.timestamp) return a.timestamp - b.timestamp;
+    return a.sequenceNumber - b.sequenceNumber;
+  }
+
+  #emitDirectAudio(
+    packetId: number,
+    data: Uint8Array,
+    meta: RoutedFrameMeta,
+    cb: FrameCallback | null,
+  ): boolean {
+    const streamKey = this.#mediaStreamKey(packetId, meta.catalogTrackName);
+    const cursor = this.#directAudioCursor(meta);
+    const lastEmitted = this.#lastDirectEmittedAudioCursorByStream.get(streamKey);
+    if (
+      lastEmitted !== undefined &&
+      this.#compareDirectAudioCursor(cursor, lastEmitted) <= 0
+    ) return false;
+    this.#lastDirectEmittedAudioCursorByStream.set(streamKey, cursor);
+    cb?.(data, meta);
+    return true;
+  }
+
+  #emitDirectSourceAudio(
+    packetId: number,
+    data: Uint8Array,
+    meta: RoutedFrameMeta,
+    cb: FrameCallback | null,
+  ): void {
+    const streamKey = this.#mediaStreamKey(packetId, meta.catalogTrackName);
+    const cursor = this.#directAudioCursor(meta);
+    const lastEmitted = this.#lastDirectEmittedAudioCursorByStream.get(streamKey);
+    const diag = this.#diagFor(packetId, meta.catalogTrackName);
+    diag.directAudioSourceEmitted++;
+    if (
+      lastEmitted !== undefined &&
+      this.#compareDirectAudioCursor(cursor, lastEmitted) <= 0
+    ) {
+      // Source packets already passed transport/parser validation. Preserve
+      // them even when unordered multicast completion moves the callback
+      // cursor backward; only recovered frames are optional stale gap fills.
+      diag.directAudioSourceRegressions++;
+    } else {
+      this.#lastDirectEmittedAudioCursorByStream.set(streamKey, cursor);
+    }
+    cb?.(data, meta);
+  }
+
+  #drainDirectRecoveredAudioUpTo(
+    streamKey: string,
+    packetId: number,
+    horizon: DirectAudioCursor,
+    cb: FrameCallback | null,
+  ): void {
+    const queue = this.#pendingDirectRecoveredAudioByStream.get(streamKey);
+    if (!queue || queue.size === 0) return;
+
+    const ready = [...queue.values()]
+      .filter(frame => this.#compareDirectAudioCursor(
+        this.#directAudioCursor(frame.meta),
+        horizon,
+      ) <= 0)
+      .sort((a, b) => this.#compareDirectAudioCursor(
+        this.#directAudioCursor(a.meta),
+        this.#directAudioCursor(b.meta),
+      ));
+
+    for (const frame of ready) {
+      queue.delete(this.#pendingRecoveredKey(frame.meta));
+      if (this.#emitDirectAudio(packetId, frame.data, frame.meta, cb)) {
+        this.#diagFor(packetId, frame.meta.catalogTrackName)
+          .directAudioRecoveredDrained++;
+      } else {
+        this.#diagFor(packetId, frame.meta.catalogTrackName)
+          .directAudioRecoveredStaleDropped++;
+      }
+    }
+
+    if (queue.size === 0) {
+      this.#pendingDirectRecoveredAudioByStream.delete(streamKey);
+    }
+  }
+
+  #routeDirectSourceAudio(
+    packetId: number,
+    data: Uint8Array,
+    meta: RoutedFrameMeta,
+    cb: FrameCallback | null,
+  ): void {
+    const streamKey = this.#mediaStreamKey(packetId, meta.catalogTrackName);
+    const cursor = this.#directAudioCursor(meta);
+    const lastSource = this.#lastDirectSourceAudioCursorByStream.get(streamKey);
+    if (
+      lastSource === undefined ||
+      this.#compareDirectAudioCursor(cursor, lastSource) > 0
+    ) {
+      this.#lastDirectSourceAudioCursorByStream.set(streamKey, cursor);
+    }
+    this.#drainDirectRecoveredAudioUpTo(streamKey, packetId, cursor, cb);
+    this.#emitDirectSourceAudio(packetId, data, meta, cb);
+  }
+
+  #routeDirectRecoveredAudio(
+    packetId: number,
+    data: Uint8Array,
+    meta: RoutedFrameMeta,
+    cb: FrameCallback | null,
+  ): void {
+    const streamKey = this.#mediaStreamKey(packetId, meta.catalogTrackName);
+    const cursor = this.#directAudioCursor(meta);
+    const lastEmitted = this.#lastDirectEmittedAudioCursorByStream.get(streamKey);
+    if (
+      lastEmitted !== undefined &&
+      this.#compareDirectAudioCursor(cursor, lastEmitted) <= 0
+    ) {
+      this.#diagFor(packetId, meta.catalogTrackName)
+        .directAudioRecoveredStaleDropped++;
+      return;
+    }
+
+    const queue = this.#pendingRecoveredAudioQueue(streamKey);
+    queue.set(this.#pendingRecoveredKey(meta), { data, meta: { ...meta } });
+    this.#diagFor(packetId, meta.catalogTrackName).directAudioRecoveredQueued++;
+    if (queue.size > DIRECT_RECOVERED_AUDIO_QUEUE_LIMIT) {
+      const keep = [...queue.entries()]
+        .sort((a, b) => this.#compareDirectAudioCursor(
+          this.#directAudioCursor(a[1].meta),
+          this.#directAudioCursor(b[1].meta),
+        ))
+        .slice(-Math.floor(DIRECT_RECOVERED_AUDIO_QUEUE_LIMIT / 2));
+      queue.clear();
+      for (const [key, frame] of keep) queue.set(key, frame);
+    }
+
+    const lastSource = this.#lastDirectSourceAudioCursorByStream.get(streamKey);
+    if (lastSource !== undefined) {
+      this.#drainDirectRecoveredAudioUpTo(streamKey, packetId, lastSource, cb);
+    }
+  }
+
+  // ── Private: FEC recovery routing ───────────────────────────────
+
+  /** Route WASM-recovered block through appropriate path based on container kind. */
+  #routeRecoveredBlock(
+    blockId: number,
+    recovered: Uint8Array,
+    ownerPacketId?: number,
+    catalogTrackName?: string,
+  ): void {
+    // MMTP path: use processFecBlock for MMTP-wrapped recovery.
+    // Recovered symbols are individual MMTP packets that may be fragments
+    // (FI=1/2/3) of a larger MFU.  Route through the reassembler so
+    // multi-packet MFUs (e.g., keyframes spanning 15+ packets) are
+    // properly assembled before reaching the decoder.
+    const k = this.#kForPacket(ownerPacketId);
+    const packetSymbolSize = this.#symbolSizeForPacket(ownerPacketId);
+    if (ownerPacketId === undefined) {
+      throw new Error("[MmtpRouter] a recovered FEC block needs its owner packetId to read its fec.blockProfile");
+    }
+    const blockProfile = this.#blockProfileFor(ownerPacketId);
+    if (!(packetSymbolSize > 0)) {
+      throw new Error(
+        `[MmtpRouter] recovered FEC block for packetId=${ownerPacketId} needs a configured ` +
+          `symbol size (got T=${packetSymbolSize})`,
+      );
+    }
+    const symbolSize = packetSymbolSize;
+    // iso-ssbg1-v1 returns K' = SSB_length symbols; k-padded-v1 the authored
+    // prefix of a K-symbol block, walked up to K.
+    const result = processFecBlock(recovered, {
+      ...(blockProfile === "k-padded-v1" ? { k } : {}),
+      symbolSize,
+      ownerPacketId,
+      blockProfile,
+    });
+    this.#routeVerifiedFecSymbols(blockId, result, ownerPacketId, catalogTrackName);
+  }
+
+  #routeVerifiedFecSymbols(
+    blockId: number,
+    result: ProcessFecBlockResult,
+    ownerPacketId?: number,
+    catalogTrackName?: string,
+  ): void {
+    if (!this.#manifestVerifier || ownerPacketId == null) {
+      this.#routeProcessedFecSymbols(blockId, result, ownerPacketId, catalogTrackName);
+      return;
+    }
+    if (!this.#resolveManifestIdentity && !this.#resolveManifestIdentityForRoute) {
+      console.warn(`[MmtpRouter] manifest identity resolver unavailable; recovered media is fail-open for packetId=${ownerPacketId} block=${blockId}`);
+      this.#routeProcessedFecSymbols(blockId, result, ownerPacketId, catalogTrackName);
+      return;
+    }
+    const queueKey = this.#mediaStreamKey(ownerPacketId, catalogTrackName);
+    const queue = this.#manifestRecoveryQueues.get(queueKey) ?? [];
+    queue.push({ blockId, result, ownerPacketId, catalogTrackName });
+    this.#manifestRecoveryQueues.set(queueKey, queue);
+    if (queue.length > 1) return;
+    const drain = (): void => {
+      const next = queue[0];
+      if (!next) {
+        this.#manifestRecoveryQueues.delete(queueKey);
+        return;
+      }
+      this.#admitRecoveredResult(
+        next.blockId,
+        next.result,
+        next.ownerPacketId,
+        next.catalogTrackName,
+        () => {
+          queue.shift();
+          drain();
+        },
+      );
+    };
+    drain();
+  }
+
+  #admitRecoveredResult(
+    blockId: number,
+    result: ProcessFecBlockResult,
+    ownerPacketId: number,
+    catalogTrackName: string | undefined,
+    done: () => void,
+  ): void {
+    const verifier = this.#manifestVerifier;
+    const resolveIdentity = this.#resolveManifestIdentity;
+    const resolveIdentityForRoute = this.#resolveManifestIdentityForRoute;
+    if (!verifier) {
+      this.#routeProcessedFecSymbols(blockId, result, ownerPacketId, catalogTrackName);
+      done();
+      return;
+    }
+    if (!resolveIdentity && !resolveIdentityForRoute) throw new Error("manifest identity resolver disappeared during admission");
+    const symbols = result.symbols;
+    const admitNext = (index: number): void => {
+      const symbol = symbols[index];
+      if (!symbol) {
+        done();
+        return;
+      }
+      const identity = resolveIdentityForRoute
+        ? resolveIdentityForRoute({
+            packetId: ownerPacketId,
+            sbn: blockId,
+            esi: symbol.index,
+            ...(catalogTrackName === undefined ? {} : { catalogTrackName }),
+            recovered: true,
+            sourceSymbolFormat: "fec-padded-recovery",
+          })
+        : resolveIdentity!(ownerPacketId, blockId, symbol.index, catalogTrackName);
+      if (!identity) {
+        console.warn(`[MmtpRouter] manifest identity unresolved; recovered symbol is fail-open for packetId=${ownerPacketId} block=${blockId} esi=${symbol.index}`);
+        this.#routeProcessedFecSymbols(
+          blockId,
+          { ...result, symbols: [symbol] },
+          ownerPacketId,
+          catalogTrackName,
+        );
+        admitNext(index + 1);
+        return;
+      }
+      const admission = verifier.admitObject(
+        {
+          ...identity,
+          packetId: ownerPacketId,
+          ...(ownerPacketId !== undefined && this.#isIsoPacket(ownerPacketId)
+            ? {}
+            : { ssId: blockId * this.#kForPacket(ownerPacketId) + symbol.index }),
+        },
+        symbol.rawSymbol,
+        () => {
+          if (!this.#disposed) {
+            this.#routeProcessedFecSymbols(
+              blockId,
+              { ...result, symbols: [symbol] },
+              ownerPacketId,
+              catalogTrackName,
+            );
+          }
+          admitNext(index + 1);
+        },
+        // A stalled symbol that is later discarded instead of played must still
+        // advance this loop; enforce mode never calls the release callback for
+        // it (BLO-30095).
+        () => admitNext(index + 1),
+      );
+      if (admission.action === "drop") admitNext(index + 1);
+    };
+    admitNext(0);
+  }
+
+  #routeProcessedFecSymbols(
+    blockId: number,
+    result: ProcessFecBlockResult,
+    ownerPacketId?: number,
+    catalogTrackName?: string,
+  ): void {
+    // Route recovered symbols to the track's callback. The ownerPacketId tells us
+    // which track this block belongs to — resolves per-track, then legacy fallback.
+    if (ownerPacketId == null) return; // no track association
+    if (this.#classifyPacketId(ownerPacketId) === null) return; // unknown track
+    this.#stream(ownerPacketId, catalogTrackName).duplicates.advance(blockId);
+
+    // A recovered symbol is a function of EVERY symbol that entered its block,
+    // so its provenance is the block's, not the media path's. Repair symbols
+    // routinely arrive over reliable QUIC (`feedRepairPacket`), so a block that
+    // recovered with MoQ help produced bytes that never crossed a multicast
+    // socket. Without this, recovered frames reached the decoder carrying no
+    // attribution at all and were counted as multicast by default.
+    // A FEC manager that cannot report block provenance yields 'unknown', not
+    // a guess: these bytes are then never counted as physical-delivery
+    // evidence. `FECManagerLike` is a pluggable structural interface, so an
+    // implementation without this method must degrade, not throw.
+    const deliveryProvenance: MmtpDeliveryProvenance =
+      this.#fecManager?.blockDeliveryProvenance?.(
+        blockId,
+        ownerPacketId,
+        catalogTrackName,
+      ) ?? 'unknown';
+
+    for (const sym of result.symbols) {
+      this.#routeTrackPacket(sym.rawSymbol, ownerPacketId, sym.packetSequenceNumber, {
+        recovered: true,
+        skipFecPayloadId: true,
+        catalogTrackName,
+        deliveryProvenance,
+      });
+    }
+
+    // Feed recovered metadata before routing data. FT=0 initializes the timing
+    // resolver and FT=1 publishes the sample table that recovered FT=2 data
+    // must resolve against. The parser's callbacks dedupe repeated init
+    // delivery, while keeping this path in lockstep with direct source input.
+    for (const sym of result.symbols) {
+      if (sym.fragmentType !== 0 && sym.fragmentType !== 1) continue;
+      this.#feedViaParser(
+        sym.rawSymbol,
+        { packetId: ownerPacketId, sequenceNumber: sym.packetSequenceNumber },
+        undefined,
+        {
+          skipFecPayloadId: true,
+          recovered: true,
+          ...(catalogTrackName === undefined ? {} : { catalogTrackName }),
+        },
+      );
+    }
+
+    // MSE assembler path: route recovered block as pre-assembled frames (skip FT=0)
+    // BLO-3035 layer 3: recovered symbols are RAW MFU fragments, not complete
+    // frames. A keyframe can span multiple packets (FI=1/2/3); pushing each
+    // fragment as a "frame" produces garbage moof+mdat that fails decode.
+    // Mirror the non-MSE path's logic: FI=0 → emit single-packet MFU directly
+    // (after dedup against source path), FI=1/2/3 → feed reassembler, emit when
+    // the complete frame is available. Take the keyframe bit from the assembled
+    // frame's rapFlag (with `#detectKeyframe` as a bitstream fallback for
+    // publishers that don't set rapFlag) — `sym.isKeyframe` is just rapFlag
+    // from a single fragment's header (see `block-processor.ts` where
+    // `isKeyframe = hdr.rapFlag`) and isn't meaningful for the reassembled-
+    // frame keyframe decision when FI≠0.
+    // FEC tracks release recovered frames through the parser's FEC release
+    // gate, in authored order with the source frames they fill in for; the
+    // frame callback then applies sync gating and MSE/direct dispatch once.
+    const gated = this.#isFecTrack(ownerPacketId);
+    const assembler = this.#mseAssemblerFor(ownerPacketId, catalogTrackName);
+    if (assembler) {
+      // A staged switch holds and splices its two streams at the parser's
+      // frame callback, and the ungated batch below would bypass it: the
+      // incoming stream's recovered frames would be lost from the GOP it
+      // replays at the commit, and the outgoing stream's could reach MSE past
+      // the splice. Their recovered frames go through the parser instead, as
+      // an FEC-gated track's always do.
+      const staged = this.#staged;
+      const owner = { packetId: ownerPacketId, catalogTrackName };
+      const throughParser = gated ||
+        (staged !== null && (isStream(owner, staged.from) || isStream(owner, staged.to)));
+      const isVideoTrack = this.#classifyPacketId(ownerPacketId) === true;
+      const frames: Array<{
+        data: Uint8Array;
+        timestamp: number;
+        keyframe: boolean;
+        authoredTiming?: AuthoredTiming;
+        packetSequenceNumber?: number;
+        packetSequenceNumbers?: number[];
+        repairedPacketSequenceNumbers?: number[];
+        mmtpTimestamp?: bigint;
+        mpuSequenceNumber?: number;
+        movieFragmentSequenceNumber?: number;
+        sampleNumber?: number;
+        catalogTrackName?: string;
+        deliveryProvenance?: MmtpDeliveryProvenance;
+        sourceDiscontinuity?: boolean;
+      }> = [];
+      let dedupedAgainstSource = 0;
+      let droppedBeforeSync = 0;
+      for (const sym of result.symbols) {
+        // An in-place switch can retire this owner from inside this loop (a
+        // recovered frame that reaches the splice); the rest have no route.
+        if (this.#classifyPacketId(ownerPacketId) === null) return;
+        if (sym.fragmentType === 0 || sym.fragmentType === 1) continue;
+        // FT=0/FT=1 are MPU metadata (initialization/movie fragment), already
+        // consumed above to seed the authored timing resolver. Only FT=2 MFU
+        // payloads can become media samples here.
+        const fi = sym.fragment.fragmentationIndicator;
+        if (fi === 0) {
+          // Single-packet MFU. Dedup against source path so frames aren't
+          // emitted twice. The direct source frame may still be buffered by the
+          // parser reorder window, so use source-received sequence numbers.
+          if (this.#sourceSeqReceived(ownerPacketId, sym.packetSequenceNumber, catalogTrackName)) {
+            dedupedAgainstSource++;
+            continue;
+          }
+          const keyframe = isVideoTrack
+            ? this.#detectKeyframe(
+                ownerPacketId,
+                sym.fragment.data,
+                isMfuKeyframeMetadata(sym.fragment.rapFlag, sym.fragment.priority),
+              )
+            : sym.fragment.rapFlag;
+          if (throughParser) {
+            const gatedTiming = this.#resolveRecoveredTiming(
+              ownerPacketId,
+              sym.fragment.mpuSequenceNumber,
+              sym.fragment.movieFragmentSequenceNumber,
+              sym.fragment.sampleNumber,
+              sym.fragment.timestamp,
+              catalogTrackName,
+            );
+            if (!gatedTiming) continue;
+            this.#parser.routeFrame(sym.fragment.data, {
+              timestamp: gatedTiming.timestamp,
+              mmtpTimestamp: gatedTiming.mmtpTimestamp,
+              ...(gatedTiming.authoredTiming === undefined
+                ? {}
+                : { authoredTiming: gatedTiming.authoredTiming }),
+              keyframe: isVideoTrack ? keyframe : true,
+              packetId: ownerPacketId,
+              trackType: isVideoTrack ? "video" : "audio",
+              packetSequenceNumber: sym.packetSequenceNumber,
+              packetSequenceNumbers: [sym.packetSequenceNumber],
+              repairedPacketSequenceNumbers: [sym.packetSequenceNumber],
+              mpuSequenceNumber: sym.fragment.mpuSequenceNumber,
+              ...(sym.fragment.movieFragmentSequenceNumber === undefined
+                ? {}
+                : { movieFragmentSequenceNumber: sym.fragment.movieFragmentSequenceNumber }),
+              ...(sym.fragment.sampleNumber === undefined
+                ? {}
+                : { sampleNumber: sym.fragment.sampleNumber }),
+              rapFlag: sym.fragment.rapFlag,
+              recovered: true,
+              deliveryProvenance,
+              fecSbn: this.#fecAnchorForRecovered(ownerPacketId, blockId, sym.index),
+              ...(catalogTrackName === undefined ? {} : { catalogTrackName }),
+            });
+            continue;
+          }
+          const sourceDiscontinuity = this.#opensFecSync(
+            ownerPacketId,
+            keyframe,
+            catalogTrackName,
+          );
+          if (!this.#shouldEmitFrame(ownerPacketId, keyframe, catalogTrackName)) {
+            droppedBeforeSync++;
+            continue;
+          }
+          const recoveredTiming = this.#resolveRecoveredTiming(
+            ownerPacketId,
+            sym.fragment.mpuSequenceNumber,
+            sym.fragment.movieFragmentSequenceNumber,
+            sym.fragment.sampleNumber,
+            sym.fragment.timestamp,
+            catalogTrackName,
+          );
+          if (!recoveredTiming) continue;
+          frames.push({
+            data: sym.fragment.data,
+            timestamp: recoveredTiming.timestamp,
+            mmtpTimestamp: recoveredTiming.mmtpTimestamp,
+            keyframe,
+            authoredTiming: recoveredTiming.authoredTiming,
+            packetSequenceNumber: sym.packetSequenceNumber,
+            packetSequenceNumbers: [sym.packetSequenceNumber],
+            repairedPacketSequenceNumbers: [sym.packetSequenceNumber],
+            mpuSequenceNumber: sym.fragment.mpuSequenceNumber,
+            ...(sym.fragment.movieFragmentSequenceNumber === undefined
+              ? {}
+              : { movieFragmentSequenceNumber: sym.fragment.movieFragmentSequenceNumber }),
+            ...(sym.fragment.sampleNumber === undefined
+              ? {}
+              : { sampleNumber: sym.fragment.sampleNumber }),
+            ...(catalogTrackName === undefined ? {} : { catalogTrackName }),
+            // A single-packet MFU needs the block verdict just as much as a
+            // reassembled one. The multi-fragment branch below gets it via the
+            // reassembler fold (`assembled.deliveryProvenance`); this branch
+            // never touches the reassembler, so it must carry the block-level
+            // verdict directly or the sample reaches MSE unattributed.
+            deliveryProvenance,
+            ...(sourceDiscontinuity ? { sourceDiscontinuity: true } : {}),
+          });
+          this.#noteEmittedKeyframe(ownerPacketId, keyframe);
+        } else {
+          // Multi-packet MFU. Feed to reassembler; emit only when complete.
+          // A decoded block contains every source symbol, including fragments
+          // already accepted on the direct path. Re-feeding those fragments as
+          // recovered would replace their original attribution in the shared
+          // reassembler and overstate repairedPacketSequenceNumbers.
+          if (this.#sourceSeqReceived(ownerPacketId, sym.packetSequenceNumber, catalogTrackName)) {
+            dedupedAgainstSource++;
+            continue;
+          }
+          let assembled;
+          try {
+            assembled = this.#parser.reassembler.addFragment({
+              fragmentationIndicator: fi,
+              mpuSequenceNumber: sym.fragment.mpuSequenceNumber,
+              fragmentCounter: sym.fragment.fragmentCounter,
+              data: sym.fragment.data,
+              timestamp: sym.fragment.timestamp,
+              rapFlag: sym.fragment.rapFlag,
+              sampleNumber: sym.fragment.sampleNumber,
+              movieFragmentSequenceNumber: sym.fragment.movieFragmentSequenceNumber,
+              sampleOffset: sym.fragment.sampleOffset,
+              priority: sym.fragment.priority,
+              packetSequenceNumber: sym.packetSequenceNumber,
+              recovered: true,
+              // Without this the fold sees a fragment with neither `source`
+              // nor a verdict, returns 'unknown', and the block-level finding
+              // computed above is lost before the frame reaches any consumer.
+              deliveryProvenance,
+              packetId: ownerPacketId,
+              ...(catalogTrackName === undefined ? {} : { catalogTrackName }),
+            });
+          } catch (error) {
+            if (!isMfuReassemblyError(error)) throw error;
+            console.warn(
+              `[MmtpRouter] dropped rejected recovered MFU fragment: block=${blockId} ` +
+              `packetId=${ownerPacketId} code=${error.code}`,
+            );
+            continue;
+          }
+          if (assembled) {
+            const keyframe = isVideoTrack
+              ? this.#detectKeyframe(
+                  ownerPacketId,
+                  assembled.data,
+                  isMfuKeyframeMetadata(assembled.rapFlag, assembled.priority),
+                )
+              : assembled.rapFlag;
+            const recoveredCatalogTrackName = assembled.catalogTrackName ?? catalogTrackName;
+            if (throughParser) {
+              const gatedTiming = this.#resolveRecoveredTiming(
+                ownerPacketId,
+                assembled.mpuSequenceNumber,
+                assembled.movieFragmentSequenceNumber,
+                assembled.sampleNumber,
+                assembled.timestamp,
+                recoveredCatalogTrackName,
+              );
+              if (!gatedTiming) continue;
+              this.#parser.routeFrame(assembled.data, {
+                timestamp: gatedTiming.timestamp,
+                mmtpTimestamp: gatedTiming.mmtpTimestamp,
+                ...(gatedTiming.authoredTiming === undefined
+                  ? {}
+                  : { authoredTiming: gatedTiming.authoredTiming }),
+                keyframe: isVideoTrack ? keyframe : true,
+                packetId: ownerPacketId,
+                trackType: isVideoTrack ? "video" : "audio",
+                packetSequenceNumber: sym.packetSequenceNumber,
+                ...(assembled.packetSequenceNumbers === undefined
+                  ? {}
+                  : { packetSequenceNumbers: assembled.packetSequenceNumbers }),
+                ...(assembled.repairedPacketSequenceNumbers === undefined
+                  ? {}
+                  : { repairedPacketSequenceNumbers: assembled.repairedPacketSequenceNumbers }),
+                mpuSequenceNumber: assembled.mpuSequenceNumber,
+                ...(assembled.movieFragmentSequenceNumber === undefined
+                  ? {}
+                  : { movieFragmentSequenceNumber: assembled.movieFragmentSequenceNumber }),
+                ...(assembled.sampleNumber === undefined
+                  ? {}
+                  : { sampleNumber: assembled.sampleNumber }),
+                rapFlag: assembled.rapFlag,
+                recovered: true,
+                ...(assembled.deliveryProvenance === undefined
+                  ? {}
+                  : { deliveryProvenance: assembled.deliveryProvenance }),
+                fecSbn: this.#fecAnchorForRecovered(ownerPacketId, blockId, sym.index),
+                ...(recoveredCatalogTrackName === undefined
+                  ? {}
+                  : { catalogTrackName: recoveredCatalogTrackName }),
+              });
+              continue;
+            }
+            const sourceDiscontinuity = this.#opensFecSync(
+              ownerPacketId,
+              keyframe,
+              recoveredCatalogTrackName,
+            );
+            if (!this.#shouldEmitFrame(
+              ownerPacketId,
+              keyframe,
+              recoveredCatalogTrackName,
+            )) {
+              droppedBeforeSync++;
+              continue;
+            }
+            const recoveredTiming = this.#resolveRecoveredTiming(
+              ownerPacketId,
+              assembled.mpuSequenceNumber,
+              assembled.movieFragmentSequenceNumber,
+              assembled.sampleNumber,
+              assembled.timestamp,
+              recoveredCatalogTrackName,
+            );
+            if (!recoveredTiming) continue;
+            frames.push({
+              data: assembled.data,
+              timestamp: recoveredTiming.timestamp,
+              mmtpTimestamp: recoveredTiming.mmtpTimestamp,
+              keyframe,
+              authoredTiming: recoveredTiming.authoredTiming,
+              // The singular delivery identity is the fragment that completed
+              // and delivered the MFU, matching the callback/parser path.
+              packetSequenceNumber: sym.packetSequenceNumber,
+              ...(assembled.packetSequenceNumbers === undefined
+                ? {}
+                : { packetSequenceNumbers: assembled.packetSequenceNumbers }),
+              ...(assembled.repairedPacketSequenceNumbers === undefined
+                ? {}
+                : {
+                    repairedPacketSequenceNumbers:
+                      assembled.repairedPacketSequenceNumbers,
+                  }),
+              mpuSequenceNumber: assembled.mpuSequenceNumber,
+              ...(assembled.movieFragmentSequenceNumber === undefined
+                ? {}
+                : { movieFragmentSequenceNumber: assembled.movieFragmentSequenceNumber }),
+              ...(assembled.sampleNumber === undefined
+                ? {}
+                : { sampleNumber: assembled.sampleNumber }),
+              ...(assembled.catalogTrackName === undefined
+                ? {}
+                : { catalogTrackName: assembled.catalogTrackName }),
+              deliveryProvenance: assembled.deliveryProvenance,
+              ...(sourceDiscontinuity ? { sourceDiscontinuity: true } : {}),
+            });
+            this.#noteEmittedKeyframe(ownerPacketId, keyframe);
+          }
+        }
+      }
+      if (frames.length > 0) {
+        assembler.addRecoveredBlock(blockId, frames);
+        // The assembler owns MSE writes, but the normal frame callback still
+        // carries transport admission: MulticastManager uses it to confirm
+        // video/audio and MediaRouter uses that confirmation to complete the
+        // takeover. Recovered frames bypass parser.onFrame, so without this
+        // callback MSE can receive samples forever while takeover never fires.
+        const cb = this.#getFrameCallback(ownerPacketId);
+        for (const frame of frames) {
+          cb?.(frame.data, {
+            timestamp: frame.timestamp,
+            ...(frame.mmtpTimestamp === undefined ? {} : { mmtpTimestamp: frame.mmtpTimestamp }),
+            keyframe: frame.keyframe,
+            ...(frame.authoredTiming === undefined ? {} : { authoredTiming: frame.authoredTiming }),
+            packetId: ownerPacketId,
+            ...(frame.packetSequenceNumber === undefined
+              ? {}
+              : { packetSequenceNumber: frame.packetSequenceNumber }),
+            ...(frame.packetSequenceNumbers === undefined
+              ? {}
+              : { packetSequenceNumbers: frame.packetSequenceNumbers }),
+            ...(frame.repairedPacketSequenceNumbers === undefined
+              ? {}
+              : { repairedPacketSequenceNumbers: frame.repairedPacketSequenceNumbers }),
+            ...(frame.mpuSequenceNumber === undefined ? {} : { mpuSequenceNumber: frame.mpuSequenceNumber }),
+            ...(frame.movieFragmentSequenceNumber === undefined
+              ? {}
+              : { movieFragmentSequenceNumber: frame.movieFragmentSequenceNumber }),
+            ...(frame.sampleNumber === undefined ? {} : { sampleNumber: frame.sampleNumber }),
+            ...(frame.catalogTrackName === undefined ? {} : { catalogTrackName: frame.catalogTrackName }),
+            recovered: true,
+            deliveryProvenance: frame.deliveryProvenance,
+            ...(frame.sourceDiscontinuity ? { sourceDiscontinuity: true } : {}),
+          });
+        }
+        debugRouter(
+          `[MmtpRouter] Block ${blockId}: ${result.symbols.length} symbols → ${frames.length} reassembled frames → MSE assembler (packetId=${ownerPacketId}, dedupedAgainstSource=${dedupedAgainstSource}, droppedBeforeSync=${droppedBeforeSync})`,
+        );
+      } else if (result.symbols.length > 0) {
+        // Recovery yielded symbols but no complete frames emerged — either all
+        // FI=0 were source-path duplicates, or all FI=1/2/3 are still mid-
+        // reassembly. Surface this so an operator debugging "FEC recovered N
+        // symbols but no new frames rendered" has a signal.
+        debugRouter(
+          `[MmtpRouter] Block ${blockId}: ${result.symbols.length} symbols recovered → 0 emitted (dedupedAgainstSource=${dedupedAgainstSource}, droppedBeforeSync=${droppedBeforeSync}, pending-reassembly=${result.symbols.length - dedupedAgainstSource - droppedBeforeSync}, packetId=${ownerPacketId})`,
+        );
+      }
+      return;
+    }
+
+    const cb = this.#getFrameCallback(ownerPacketId);
+    const isVideo = this.#classifyPacketId(ownerPacketId) === true;
+    let droppedBeforeSync = 0;
+    let droppedStale = 0;
+    let dedupedAgainstSource = 0;
+
+    for (const sym of result.symbols) {
+      // An in-place switch can retire this owner from inside this loop (a
+      // recovered frame that reaches the splice); the rest have no route.
+      if (this.#classifyPacketId(ownerPacketId) === null) return;
+      // FT=0 init already delivered above — skip data routing
+      if (sym.fragmentType === 0 || sym.fragmentType === 1) continue;
+      // FT=0/FT=1 are metadata, not decoder samples. The metadata pass above
+      // has already used them to establish the timed-MFU contract.
+
+      if (isVideo) {
+        const fi = sym.fragment.fragmentationIndicator;
+        if (fi === 0) {
+          // Dedup: skip FI=0 frames already received via direct source path.
+          // The reassembler deduplicates FI=1/2/3 fragments via #emitted, but
+          // FI=0 (single-packet MFU) bypasses it. Without this check, recovery
+          // can re-emit a source frame that is only held in the reorder buffer,
+          // producing duplicate timestamps when the source path later flushes.
+          if (this.#sourceSeqReceived(ownerPacketId, sym.packetSequenceNumber, catalogTrackName)) {
+            dedupedAgainstSource++;
+            continue;
+          }
+          if (this.#isStaleRecoveredVideo(
+            ownerPacketId,
+            sym.packetSequenceNumber,
+            catalogTrackName,
+          )) {
+            droppedStale++;
+            continue;
+          }
+
+          const d = sym.fragment.data;
+          const keyframe = this.#detectKeyframe(
+            ownerPacketId,
+            d,
+            isMfuKeyframeMetadata(sym.fragment.rapFlag, sym.fragment.priority),
+          );
+          const recoveredTiming = this.#resolveRecoveredTiming(
+            ownerPacketId,
+            sym.fragment.mpuSequenceNumber,
+            sym.fragment.movieFragmentSequenceNumber,
+            sym.fragment.sampleNumber,
+            sym.fragment.timestamp,
+            catalogTrackName,
+          );
+          if (!recoveredTiming) continue;
+          this.#parser.routeFrame(d, {
+            timestamp: recoveredTiming.timestamp,
+            mmtpTimestamp: recoveredTiming.mmtpTimestamp,
+            authoredTiming: recoveredTiming.authoredTiming,
+            keyframe,
+            packetId: ownerPacketId,
+            trackType: "video",
+            packetSequenceNumber: sym.packetSequenceNumber,
+            packetSequenceNumbers: [sym.packetSequenceNumber],
+            repairedPacketSequenceNumbers: [sym.packetSequenceNumber],
+            mpuSequenceNumber: sym.fragment.mpuSequenceNumber,
+            ...(sym.fragment.movieFragmentSequenceNumber === undefined
+              ? {}
+              : { movieFragmentSequenceNumber: sym.fragment.movieFragmentSequenceNumber }),
+            ...(sym.fragment.sampleNumber === undefined
+              ? {}
+              : { sampleNumber: sym.fragment.sampleNumber }),
+            rapFlag: sym.fragment.rapFlag,
+            recovered: true,
+            deliveryProvenance,
+            fecSbn: this.#fecAnchorForRecovered(ownerPacketId, blockId, sym.index),
+            ...(catalogTrackName === undefined ? {} : { catalogTrackName }),
+          });
+        } else {
+          // Fragment of a multi-packet MFU — must go through reassembler
+          if (this.#sourceSeqReceived(ownerPacketId, sym.packetSequenceNumber, catalogTrackName)) {
+            dedupedAgainstSource++;
+            continue;
+          }
+          let assembled;
+          try {
+            assembled = this.#parser.reassembler.addFragment({
+              fragmentationIndicator: fi,
+              mpuSequenceNumber: sym.fragment.mpuSequenceNumber,
+              fragmentCounter: sym.fragment.fragmentCounter,
+              data: sym.fragment.data,
+              timestamp: sym.fragment.timestamp,
+              rapFlag: sym.fragment.rapFlag,
+              sampleNumber: sym.fragment.sampleNumber,
+              movieFragmentSequenceNumber: sym.fragment.movieFragmentSequenceNumber,
+              sampleOffset: sym.fragment.sampleOffset,
+              priority: sym.fragment.priority,
+              packetSequenceNumber: sym.packetSequenceNumber,
+              recovered: true,
+              // Without this the fold sees a fragment with neither `source`
+              // nor a verdict, returns 'unknown', and the block-level finding
+              // computed above is lost before the frame reaches any consumer.
+              deliveryProvenance,
+              packetId: ownerPacketId,
+              ...(catalogTrackName === undefined ? {} : { catalogTrackName }),
+            });
+          } catch (error) {
+            if (!isMfuReassemblyError(error)) throw error;
+            console.warn(
+              `[MmtpRouter] dropped rejected recovered MFU fragment: block=${blockId} ` +
+              `packetId=${ownerPacketId} code=${error.code}`,
+            );
+            continue;
+          }
+          if (assembled) {
+            if (this.#isStaleRecoveredVideo(
+              ownerPacketId,
+              sym.packetSequenceNumber,
+              assembled.catalogTrackName,
+            )) {
+              droppedStale++;
+              continue;
+            }
+            const keyframe = this.#detectKeyframe(
+              ownerPacketId,
+              assembled.data,
+              isMfuKeyframeMetadata(assembled.rapFlag, assembled.priority),
+            );
+            const recoveredCatalogTrackName = assembled.catalogTrackName ?? catalogTrackName;
+            const recoveredTiming = this.#resolveRecoveredTiming(
+              ownerPacketId,
+              assembled.mpuSequenceNumber,
+              assembled.movieFragmentSequenceNumber,
+              assembled.sampleNumber,
+              assembled.timestamp,
+              recoveredCatalogTrackName,
+            );
+            if (!recoveredTiming) continue;
+            this.#parser.routeFrame(assembled.data, {
+              timestamp: recoveredTiming.timestamp,
+              mmtpTimestamp: recoveredTiming.mmtpTimestamp,
+              authoredTiming: recoveredTiming.authoredTiming,
+              keyframe,
+              packetId: ownerPacketId,
+              trackType: "video",
+              packetSequenceNumber: sym.packetSequenceNumber,
+              ...(assembled.packetSequenceNumbers === undefined
+                ? {}
+                : { packetSequenceNumbers: assembled.packetSequenceNumbers }),
+              ...(assembled.repairedPacketSequenceNumbers === undefined
+                ? {}
+                : {
+                    repairedPacketSequenceNumbers:
+                      assembled.repairedPacketSequenceNumbers,
+                  }),
+              mpuSequenceNumber: assembled.mpuSequenceNumber,
+              ...(assembled.movieFragmentSequenceNumber === undefined
+                ? {}
+                : { movieFragmentSequenceNumber: assembled.movieFragmentSequenceNumber }),
+              ...(assembled.sampleNumber === undefined
+                ? {}
+                : { sampleNumber: assembled.sampleNumber }),
+              rapFlag: assembled.rapFlag,
+              recovered: true,
+              deliveryProvenance,
+              fecSbn: this.#fecAnchorForRecovered(ownerPacketId, blockId, sym.index),
+              ...(assembled.catalogTrackName === undefined
+                ? {}
+                : { catalogTrackName: assembled.catalogTrackName }),
+            });
+          }
+        }
+      } else {
+        // Audio recovery: dedup single-packet MFUs already emitted via direct source path
+        // (parity with video FI=0 path at line 993). Prevents re-delivering audio frames
+        // with duplicate timestamps — doubled samples in the FIFO ring buffer corrupt the
+        // 1kHz test tone (pitch/energy instability in FFT spectrum).
+        if (this.#sourceSeqReceived(ownerPacketId, sym.packetSequenceNumber, catalogTrackName)) {
+          dedupedAgainstSource++;
+          continue;
+        }
+        const recoveredTiming = this.#resolveRecoveredTiming(
+          ownerPacketId,
+          sym.fragment.mpuSequenceNumber,
+          sym.fragment.movieFragmentSequenceNumber,
+          sym.fragment.sampleNumber,
+          sym.fragment.timestamp,
+          catalogTrackName,
+        );
+        if (recoveredTiming === null) continue;
+        if (gated) {
+          this.#parser.routeFrame(sym.fragment.data, {
+            timestamp: recoveredTiming.timestamp,
+            mmtpTimestamp: recoveredTiming.mmtpTimestamp,
+            ...(recoveredTiming.authoredTiming === undefined
+              ? {}
+              : { authoredTiming: recoveredTiming.authoredTiming }),
+            keyframe: true,
+            packetId: ownerPacketId,
+            trackType: "audio",
+            packetSequenceNumber: sym.packetSequenceNumber,
+            packetSequenceNumbers: [sym.packetSequenceNumber],
+            repairedPacketSequenceNumbers: [sym.packetSequenceNumber],
+            mpuSequenceNumber: sym.fragment.mpuSequenceNumber,
+            ...(sym.fragment.movieFragmentSequenceNumber === undefined
+              ? {}
+              : { movieFragmentSequenceNumber: sym.fragment.movieFragmentSequenceNumber }),
+            ...(sym.fragment.sampleNumber === undefined
+              ? {}
+              : { sampleNumber: sym.fragment.sampleNumber }),
+            recovered: true,
+            deliveryProvenance,
+            fecSbn: this.#fecAnchorForRecovered(ownerPacketId, blockId, sym.index),
+            ...(catalogTrackName === undefined ? {} : { catalogTrackName }),
+          });
+          continue;
+        }
+        const meta = {
+          timestamp: recoveredTiming.timestamp,
+          mmtpTimestamp: recoveredTiming.mmtpTimestamp,
+          authoredTiming: recoveredTiming.authoredTiming,
+          keyframe: true,
+          packetId: ownerPacketId,
+          packetSequenceNumber: sym.packetSequenceNumber,
+          packetSequenceNumbers: [sym.packetSequenceNumber],
+          repairedPacketSequenceNumbers: [sym.packetSequenceNumber],
+          mpuSequenceNumber: sym.fragment.mpuSequenceNumber,
+          ...(sym.fragment.movieFragmentSequenceNumber === undefined
+            ? {}
+            : { movieFragmentSequenceNumber: sym.fragment.movieFragmentSequenceNumber }),
+          ...(sym.fragment.sampleNumber === undefined
+            ? {}
+            : { sampleNumber: sym.fragment.sampleNumber }),
+          recovered: true,
+          ...(catalogTrackName === undefined ? {} : { catalogTrackName }),
+        };
+        this.#routeDirectRecoveredAudio(
+          ownerPacketId,
+          sym.fragment.data,
+          meta,
+          cb,
+        );
+      }
+    }
+    if (result.symbols.length > 0) {
+      debugRouter(
+        `[MmtpRouter] Block ${blockId}: ${result.symbols.length} symbols recovered (packetId=${ownerPacketId}, dedupedAgainstSource=${dedupedAgainstSource}, droppedBeforeSync=${droppedBeforeSync}, droppedStale=${droppedStale})`,
+      );
+    }
+  }
+
+  // ── Private: keyframe detection ─────────────────────────────────
+
+  /** Codec-aware keyframe detection from bitstream data.
+   *  H.264 IDR (NAL type 5/7), AV1 OBU_SEQUENCE_HEADER (type 1), VP9 frame_type bit. */
+  #detectKeyframe(
+    packetId: number,
+    data: Uint8Array,
+    rapFlag = false,
+  ): boolean {
+    const codec = this.#trackCodecs.get(packetId) ?? "";
+    return MmtpContainerParser.isKeyframe(data, rapFlag, codec);
+  }
+}