@blockcast/mmt-container 0.4.1 → 0.5.0-main.2c1f81817995

package/src/mmtp-router.ts

@@ -67,10 +67,8 @@ import {
   type DuplicateHorizon,
 } from "./duplicate-ledger.js";
 import type {
-  ManifestAuthMode,
-  ManifestObjectIdentity,
-  ManifestTrackContext,
-  ManifestVerifier,
+  BcProvenanceV2Receiver,
+  BcpV2RecordPath,
 } from "@blockcast/mmt-manifest-verify";
 
 // ─── Constants ─────────────────────────────────────────────────────
@@ -177,6 +175,12 @@ export type RoutedFrameMeta = {
 
 export interface MmtpIngressContext {
   tracks: readonly Readonly<{ name: string; packetId: number }>[];
+  /**
+   * The bc-provenance v2 flow (draft-ramadan-moq-multicast-01 7.2.7) that
+   * delivered the packet, when its endpoint is protected: the key a receiver
+   * was registered under with `registerProvenanceFlow`.
+   */
+  flow?: string;
 }
 
 /** One physical stream: an MMTP packet ID and the catalog track it carries. */
@@ -558,6 +562,9 @@ export interface FECManagerLike {
     catalogTrackName?: string,
   ): Uint8Array | null;
 
+  /** How long ago the stream's oldest open block with an FEC deadline took its first symbol (optional). */
+  oldestOpenBlockAgeMs?(packetId: number, catalogTrackName: string): number | undefined;
+
   /** A block's RSB_length, from one of its repair symbols (optional). */
   noteRepairGroupLength?(sbn: number, packetId: number, rsbLength: number, catalogTrackName?: string): void;
 
@@ -703,6 +710,14 @@ export interface FECManagerLike {
     catalogTrackName: string | undefined,
     ssId: number,
   ): { sbn: number; esi: number } | null;
+  /** Begin a fresh decode epoch for one stream, dropping what it holds (FECManager.resetTrack). */
+  resetTrack?(packetId: number, catalogTrackName: string): void;
+  /**
+   * Run `fn` with `receivedAtMs` (performance.now() clock) as the receipt
+   * time of the packet it feeds: a block it opens takes that ts, and its
+   * deadlines run from it (fec-01 9, a datagram held and admitted later).
+   */
+  withReceiptTime?(receivedAtMs: number, fn: () => void): void;
   /** iso-ssbg1-v1: hold a first-arrival source until a repair states its block. */
   holdIsoSource?(
     packetId: number,
@@ -804,26 +819,6 @@ export interface FECManagerLike {
 
 // ─── MmtpRouter ─────────────────────────────────────────────────────
 
-export interface ManifestIdentityResolutionInput {
-  packetId: number;
-  sbn: number;
-  esi: number;
-  /**
-   * The packet's SS_ID and its MPU's mpu_sequence_number. Under
-   * iso-ssbg1-v1 blocks vary in length, so a packet's media group comes from
-   * its own MPU header, never from SBN arithmetic (BLO-35597 D2a).
-   */
-  ssId?: number;
-  mpuSequenceNumber?: number;
-  catalogTrackName?: string;
-  recovered: boolean;
-  sourceSymbolFormat: "full-mmtp-packet" | "fec-padded-recovery";
-}
-
-export type ManifestIdentityResolver = (
-  input: ManifestIdentityResolutionInput,
-) => ManifestObjectIdentity | null;
-
 /**
  * Classification evidence carried by one first-arrival network source
  * packet: the MMTP header R bit and the MPU / data-unit identity it states
@@ -860,26 +855,25 @@ export class MmtpRouter {
   readonly #fecManager: FECManagerLike | null;
   #defaultFecMapper: FecBlockMapper | null;
   #fecMappersByPacketId = new Map<number, FecBlockMapper>();
-  readonly #manifestVerifier: ManifestVerifier | null;
-  readonly #ownsManifestVerifier: boolean;
-  readonly #resolveManifestIdentity:
-    | ((
-        packetId: number,
-        sbn: number,
-        esi: number,
-        catalogTrackName?: string,
-      ) => ManifestObjectIdentity | null)
-    | null;
-  readonly #resolveManifestIdentityForRoute: ManifestIdentityResolver | null;
-  #manifestRecoveryQueues = new Map<
+  /** Protected flows: one 7.2.7 receiver each, and the ingress its datagrams arrive with. */
+  readonly #provenance = new Map<
     string,
-    Array<{
-      blockId: number;
-      result: ProcessFecBlockResult;
-      ownerPacketId: number;
-      catalogTrackName?: string;
-    }>
+    { receiver: BcProvenanceV2Receiver; ingress: MmtpIngressContext; protected?: boolean }
   >();
+  #onFlowProtected: ((flow: string) => void) | null = null;
+  #unadmittedListedDrops = 0;
+  #unlistedRepairSetAside = 0;
+  /** The ingress a held datagram arrived with; the receiver returns the same bytes on release. */
+  readonly #heldIngress = new WeakMap<Uint8Array, MmtpIngressContext>();
+  #unicastRepair = false;
+  /** How to route a held unicast (MoQ) datagram once a record admits it. */
+  readonly #heldReplay = new WeakMap<Uint8Array, () => void>();
+  /** When a held datagram was received: admitted later, it keeps that receipt time (fec-01 9). */
+  readonly #heldAt = new WeakMap<Uint8Array, number>();
+  /** The flow whose receiver admitted a stream's source datagrams, by packetId then catalog track name: recovered packets answer to it. */
+  readonly #provenanceStreamFlow = new Map<number, Map<string | undefined, string>>();
+  #unregisteredFlowDrops = 0;
+  #ambiguousRecoveredDrops = 0;
 
   // Temp state set by #processMMTP before calling parser.feed(),
   // read by the parser's onFrame callback for CMAF assembly + dedup.
@@ -1056,16 +1050,6 @@ export class MmtpRouter {
      *  Pass a reader when its inputs are measured later; see
      *  setKeyframeLostTimeoutMs. */
     keyframeLostTimeoutMs?: number | (() => number);
-    manifestVerifier?: ManifestVerifier;
-    /** Existing behavior is router ownership; shared browser plans opt into caller ownership. */
-    manifestVerifierOwnership?: "caller" | "router";
-    resolveManifestIdentity?: (
-      packetId: number,
-      sbn: number,
-      esi: number,
-      catalogTrackName?: string,
-    ) => ManifestObjectIdentity | null;
-    resolveManifestIdentityForRoute?: ManifestIdentityResolver;
     /** Internal terminal-failure sink owned by the composing transport. */
     onBlockFailed?: (
       sbn: number,
@@ -1088,10 +1072,6 @@ export class MmtpRouter {
     this.#fecManager = config?.fecManager ?? null;
     this.#onFrameGap = config?.onFrameGap ?? null;
     this.#defaultFecMapper = config?.fecMapper ?? null;
-    this.#manifestVerifier = config?.manifestVerifier ?? null;
-    this.#ownsManifestVerifier = config?.manifestVerifierOwnership !== "caller";
-    this.#resolveManifestIdentity = config?.resolveManifestIdentity ?? null;
-    this.#resolveManifestIdentityForRoute = config?.resolveManifestIdentityForRoute ?? null;
 
     // Create MMTP parser — handles MFU extraction, reassembly, keyframe detection.
     // Its MFUReassembler is the single reassembler for BOTH the source path
@@ -1822,32 +1802,216 @@ export class MmtpRouter {
     });
   }
 
-  registerManifestTrack(context: ManifestTrackContext): void {
-    if (!this.#manifestVerifier) throw new Error("manifest verifier is not configured");
-    this.#manifestVerifier.registerTrack(context);
+  /**
+   * Protect a flow (draft-ramadan-moq-multicast-01 7.2.7): every multicast
+   * datagram whose ingress names `ingress.flow`, source and repair alike, is
+   * admitted by `receiver` before anything reads it, and an unadmitted one is
+   * held or dropped. The caller owns the receiver's configuration; the router
+   * releases it on `releaseProvenanceFlow` and on dispose.
+   */
+  registerProvenanceFlow(
+    ingress: MmtpIngressContext & { flow: string },
+    receiver: BcProvenanceV2Receiver,
+  ): void {
+    this.#provenance.get(ingress.flow)?.receiver.release();
+    this.#provenance.set(ingress.flow, { receiver, ingress });
+    receiver.keepPendingAgeMs = () => this.#oldestOpenBlockAgeMs(ingress.flow);
   }
 
-  feedManifestFrame(trackName: string, frame: Uint8Array): void {
-    this.#manifestVerifier?.ingestManifestFrame(trackName, frame);
+  /**
+   * Declare that this receiver can request unicast repair (a repair FETCH
+   * scheduler is wired): a protected flow then keeps the pending entries of
+   * its open blocks for the repair to consume (7.2.7 step 2).
+   */
+  setUnicastRepair(enabled: boolean): void {
+    this.#unicastRepair = enabled;
   }
 
-  setManifestAuthMode(mode: ManifestAuthMode): void {
-    this.#manifestVerifier?.setMode(mode);
-    if (mode !== "enforce") {
-      for (const queue of this.#manifestRecoveryQueues.values()) {
-        for (const item of queue) {
-          this.#routeProcessedFecSymbols(
-            item.blockId,
-            item.result,
-            item.ownerPacketId,
-            item.catalogTrackName,
-          );
+  #oldestOpenBlockAgeMs(flow: string): number | undefined {
+    const entry = this.#provenance.get(flow);
+    if (!this.#unicastRepair || !entry) return undefined;
+    let age: number | undefined;
+    for (const { name, packetId } of entry.ingress.tracks) {
+      const a = name ? this.#fecManager?.oldestOpenBlockAgeMs?.(packetId, name) : undefined;
+      if (a !== undefined && (age === undefined || a > age)) age = a;
+    }
+    return age;
+  }
+
+  /**
+   * Replace a registered flow's ingress (a rendition switch staged, committed
+   * or cancelled) while keeping its receiver; a no-op for an unregistered flow.
+   */
+  updateProvenanceFlowIngress(ingress: MmtpIngressContext & { flow: string }): void {
+    const entry = this.#provenance.get(ingress.flow);
+    if (!entry) return;
+    this.#provenance.set(ingress.flow, { ...entry, ingress });
+    // A protected flow newly listing a track drops its MoQ copies from now
+    // on, so discard what its FEC instance holds of them first (7.2.7).
+    if (entry.protected) {
+      for (const { name, packetId } of ingress.tracks) {
+        if (name && !entry.ingress.tracks.some((t) => t.name === name && t.packetId === packetId)) {
+          this.#fecManager?.resetTrack?.(packetId, name);
         }
       }
-      this.#manifestRecoveryQueues.clear();
     }
   }
 
+  /**
+   * Called once per protection of a flow: at the admission that makes this
+   * router's consumers protected under it (7.2.7), after their unadmitted
+   * holdings of its listed tracks are discarded. Again after an unprotect.
+   */
+  onProvenanceFlowProtected(cb: ((flow: string) => void) | null): void {
+    this.#onFlowProtected = cb;
+  }
+
+  /**
+   * The receiver ceased to hold the flow's endpoint on failover (7.2.7): drop
+   * its state and hold queues (no expiry counted) and un-protect its tracks,
+   * which then take MoQ again. The registration stays, so multicast resuming
+   * protects the flow anew at its next admission.
+   */
+  unprotectProvenanceFlow(flow: string): void {
+    const entry = this.#provenance.get(flow);
+    if (!entry) return;
+    entry.receiver.release();
+    entry.protected = false;
+  }
+
+  /** MoQ packets of a track a protected flow lists, dropped on its unicast path: duplicate, overflow, or listed by more than one flow. */
+  get unadmittedListedDropCount(): number {
+    return this.#unadmittedListedDrops;
+  }
+
+  /** MoQ repair symbols of an unlisted track kept out of a governed FEC instance (7.2.7 step 2). */
+  get unlistedRepairSetAsideCount(): number {
+    return this.#unlistedRepairSetAside;
+  }
+
+  /**
+   * A MoQ repair symbol no protected flow lists, owned by a source track one
+   * does: its FEC instance is governed (7.2.7 step 2) and takes only admitted
+   * symbols, so the symbol is set aside. Un-listing needs no hook: an
+   * unprotected or released flow lists nothing.
+   * ponytail: set aside = dropped. 7.2.7 lets it enter a decode (MAY), only
+   * for a shortfall; the unlisted-symbol pool (BLO-49773 item 2) adds that.
+   */
+  #setAsideUnlistedRepair(ownerPacketId: number): boolean {
+    for (const entry of this.#provenance.values()) {
+      if (entry.protected && ingressHasPacketId(entry.ingress, ownerPacketId)) {
+        this.#unlistedRepairSetAside++;
+        return true;
+      }
+    }
+    return false;
+  }
+
+  /**
+   * The admission that makes this router protected under `flow` (7.2.7):
+   * its FEC instances discard what they hold of the flow's listed tracks so
+   * no unadmitted symbol stands for an admitted one, then notify. Before it
+   * nothing of the flow was admitted, so every such symbol is unadmitted.
+   * The playback parse ledger is kept: it records MoQ copies already played,
+   * not holdings, and clearing it re-emits that media (audio twice).
+   * The FEC reset is the whole 7.2.7 discard here: no keyframe-overlay
+   * instance exists to hold anything (repair-layers.ts is the catalog
+   * contract only, no decoder), and packet_id 0 is never a listed track
+   * (`ingressHasPacketId`), so nothing of it is held for the flow.
+   */
+  #noteFlowAdmitted(flow: string): void {
+    const entry = this.#provenance.get(flow);
+    if (!entry || entry.protected) return;
+    entry.protected = true;
+    for (const { name, packetId } of entry.ingress.tracks) {
+      if (name) this.#fecManager?.resetTrack?.(packetId, name);
+    }
+    this.#onFlowProtected?.(flow);
+  }
+
+  /**
+   * Admit a MoQ datagram of `packetId` on the unicast path of the protected
+   * flow that lists it (7.2.7). `unlisted`: no protected flow lists it, so it
+   * is read as before. A held datagram is routed by `replay` when a record
+   * admits it; one more than one protected flow lists is dropped. So is an
+   * overlap copy: it never enters FEC accounting, so admitting it would leave
+   * its multicast twin a duplicate and the block one symbol short.
+   */
+  #admitUnicast(
+    packetId: number,
+    packet: Uint8Array,
+    replay: () => void,
+    overlapCopy = false,
+  ): "unlisted" | "admitted" | "held" | "dropped" {
+    let receiver: BcProvenanceV2Receiver | undefined;
+    for (const entry of this.#provenance.values()) {
+      if (!entry.protected || !ingressHasPacketId(entry.ingress, packetId)) continue;
+      if (receiver || overlapCopy) {
+        this.#unadmittedListedDrops++;
+        return "dropped";
+      }
+      receiver = entry.receiver;
+    }
+    if (!receiver) return "unlisted";
+    const { verdict } = receiver.onDatagram(packet, "unicast");
+    if (verdict === "admitted") return "admitted";
+    if (verdict === "held") {
+      this.#heldReplay.set(packet, replay);
+      this.#heldAt.set(packet, performance.now());
+      return "held";
+    }
+    this.#unadmittedListedDrops++;
+    return "dropped";
+  }
+
+  /**
+   * Feed one bc-provenance record of `flow`: a datagram from `manifestPort`
+   * (`multicast`) or an object of the manifest track (`mirror`). Held
+   * datagrams the record admits are routed before this returns.
+   */
+  feedProvenanceRecord(flow: string, record: Uint8Array, path: BcpV2RecordPath): string {
+    const entry = this.#provenance.get(flow);
+    if (!entry || this.#disposed) return "unregistered";
+    const result = entry.receiver.onRecord(record, path);
+    if (result.admitted.length > 0) {
+      this.#noteFlowAdmitted(flow);
+      this.#withDeferredFecPokes(() => {
+        for (const datagram of result.admitted) {
+          const route = () => {
+            const replay = this.#heldReplay.get(datagram);
+            if (replay) replay();
+            else this.#processMMTP(datagram, "multicast", true, this.#heldIngress.get(datagram) ?? entry.ingress, false, true);
+          };
+          // A datagram held on a miss and admitted now keeps its receipt time
+          // as the block's ts (fec-01 9): its FEC deadline runs from then.
+          const heldAt = this.#heldAt.get(datagram);
+          if (heldAt !== undefined && this.#fecManager?.withReceiptTime) this.#fecManager.withReceiptTime(heldAt, route);
+          else route();
+        }
+      });
+    }
+    return result.verdict;
+  }
+
+  /** The receiver ceased to hold the flow: its hold queues are dropped, not expired. */
+  releaseProvenanceFlow(flow: string): void {
+    this.#provenance.get(flow)?.receiver.release();
+    this.#provenance.delete(flow);
+    for (const byName of this.#provenanceStreamFlow.values()) {
+      for (const [name, bound] of byName) if (bound === flow) byName.delete(name);
+    }
+  }
+
+  /** Multicast datagrams dropped because their ingress names a flow with no registered receiver. */
+  get unregisteredFlowDropCount(): number {
+    return this.#unregisteredFlowDrops;
+  }
+
+  /** Recovered packets dropped because more than one protected flow could own their stream. */
+  get ambiguousRecoveredDropCount(): number {
+    return this.#ambiguousRecoveredDrops;
+  }
+
   /**
    * Main entry point: feed a raw MMTP packet for processing.
    *
@@ -1865,12 +2029,11 @@ export class MmtpRouter {
   feedPacket(
     packet: Uint8Array,
     source: "multicast" | "moq",
-    manifestIdentity?: ManifestObjectIdentity,
     ingress?: MmtpIngressContext,
   ): void {
     if (this.#disposed) return;
     this.#withDeferredFecPokes(() => {
-      this.#processMMTP(packet, source, manifestIdentity, false, ingress);
+      this.#processMMTP(packet, source, false, ingress);
     });
   }
 
@@ -1906,7 +2069,7 @@ export class MmtpRouter {
   feedOverlapCopy(packet: Uint8Array, ingress?: MmtpIngressContext): void {
     if (this.#disposed) return;
     this.#withDeferredFecPokes(() => {
-      this.#processMMTP(packet, "moq", undefined, false, ingress, true);
+      this.#processMMTP(packet, "moq", false, ingress, true);
     });
   }
 
@@ -1931,6 +2094,7 @@ export class MmtpRouter {
     ownerPacketIdHint: number | undefined,
     catalogTrackName: string | undefined,
     repairTrackName: string | undefined,
+    admitted = false,
   ): void {
     // One header parse per packet, as on the multicast repair branch: mmt-fec's
     // parseRepairPacket() parsed it once more before this parse (BLO-36599).
@@ -1961,6 +2125,15 @@ export class MmtpRouter {
       );
     }
 
+    // Admission keys on the repair track's own packet id: a repair layer no
+    // protected flow lists is an unlisted track (7.2.7), not a datagram of the
+    // flow that lists its owner, where it would be held until expiry.
+    if (ownerPacketId != null && !admitted) {
+      const admit = this.#admitUnicast(repairPacketId, packet, () =>
+        this.#feedRepairPacket(packet, ownerPacketIdHint, catalogTrackName, repairTrackName, true));
+      if (admit === "held" || admit === "dropped") return;
+      if (admit === "unlisted" && this.#setAsideUnlistedRepair(ownerPacketId)) return;
+    }
     if (ownerPacketId != null && this.#fecManager) {
       this.#moqRepairPidCounts[repairPacketId] =
         (this.#moqRepairPidCounts[repairPacketId] || 0) + 1;
@@ -2147,10 +2320,11 @@ export class MmtpRouter {
       catalogTrackName,
     );
     if (recovered && !alreadyCompleted) {
-      fec.cancelBlockTimeout(blockStart, ownerPacketId, catalogTrackName);
-      fec.countRecovery(ownerPacketId, blockStart, catalogTrackName);
-      fec.markBlockCompleted(blockStart, ownerPacketId, catalogTrackName);
-      this.#routeRecoveredBlock(blockStart, recovered, ownerPacketId, catalogTrackName);
+      this.#routeRecoveredBlock(blockStart, recovered, ownerPacketId, catalogTrackName, () => {
+        fec.cancelBlockTimeout(blockStart, ownerPacketId, catalogTrackName);
+        fec.countRecovery(ownerPacketId, blockStart, catalogTrackName);
+        fec.markBlockCompleted(blockStart, ownerPacketId, catalogTrackName);
+      });
     }
   }
 
@@ -2203,10 +2377,11 @@ export class MmtpRouter {
       const alreadyCompleted = fec.isBlockCompleted(blockStart, ownerPacketId, catalogTrackName);
       const recovered = fec.feedSourceSymbol(ownerPacketId, ssId, payload.symbolData, catalogTrackName);
       if (!recovered || alreadyCompleted) continue;
-      fec.cancelBlockTimeout(blockStart, ownerPacketId, catalogTrackName);
-      fec.countRecovery(ownerPacketId, blockStart, catalogTrackName);
-      fec.markBlockCompleted(blockStart, ownerPacketId, catalogTrackName);
-      this.#routeRecoveredBlock(blockStart, recovered, ownerPacketId, catalogTrackName);
+      this.#routeRecoveredBlock(blockStart, recovered, ownerPacketId, catalogTrackName, () => {
+        fec.cancelBlockTimeout(blockStart, ownerPacketId, catalogTrackName);
+        fec.countRecovery(ownerPacketId, blockStart, catalogTrackName);
+        fec.markBlockCompleted(blockStart, ownerPacketId, catalogTrackName);
+      });
     }
   }
 
@@ -2244,10 +2419,14 @@ export class MmtpRouter {
     data: Uint8Array,
     packetId: number,
     catalogTrackName?: string,
-  ): void {
+  ): boolean {
     // A Worker-recovered block arrives here whole: defer the gate's drains
     // until all its frames are in, as the in-band recovery path does.
-    this.#withDeferredFecPokes(() => this.#routeRecoveredBlock(blockId, data, packetId, catalogTrackName));
+    let recovered = false;
+    this.#withDeferredFecPokes(() => {
+      recovered = this.#routeRecoveredBlock(blockId, data, packetId, catalogTrackName);
+    });
+    return recovered;
   }
 
   /** Route a single recovered source symbol through the parser + dedup pipeline.
@@ -2258,10 +2437,10 @@ export class MmtpRouter {
     packetId: number,
     esi = 0,
     catalogTrackName?: string,
-  ): void {
+  ): boolean {
     const blockProfile = this.#blockProfileFor(packetId);
     const result = processFecSymbol(data, { ownerPacketId: packetId, index: esi, blockProfile });
-    this.#routeVerifiedFecSymbols(blockId, result, packetId, catalogTrackName);
+    return this.#routeVerifiedFecSymbols(blockId, result, packetId, catalogTrackName);
   }
 
   // ── Keyframe timer cancellation ─────────────────────────────────
@@ -2310,7 +2489,6 @@ export class MmtpRouter {
     this.#lastDirectSourceAudioCursorByStream.delete(streamKey);
     this.#lastDirectEmittedAudioCursorByStream.delete(streamKey);
     this.#pendingDirectRecoveredAudioByStream.delete(streamKey);
-    this.#manifestRecoveryQueues.delete(streamKey);
     this.#deliveredVideoHighWaterByStream.delete(streamKey);
     this.#stream(packetId, catalogTrackName).duplicates.clear();
     const assemblersToReset = new Set<CmafBlockAssembler>();
@@ -2362,7 +2540,6 @@ export class MmtpRouter {
       this.#lastDirectSourceAudioCursorByStream.delete(key);
       this.#lastDirectEmittedAudioCursorByStream.delete(key);
       this.#pendingDirectRecoveredAudioByStream.delete(key);
-      this.#manifestRecoveryQueues.delete(key);
       this.#trackInitDelivered.delete(key);
       this.#parserDiagnostics.delete(key);
       this.#pendingFecPokes.delete(key);
@@ -2658,8 +2835,9 @@ export class MmtpRouter {
     this.#parserDiagnostics.clear();
     this.#catalogTrackNamesByPacketId.clear();
     this.#repairOwnersByPacketId.clear();
-    if (this.#ownsManifestVerifier) this.#manifestVerifier?.dispose();
-    this.#manifestRecoveryQueues.clear();
+    for (const { receiver } of this.#provenance.values()) receiver.release();
+    this.#provenance.clear();
+    this.#provenanceStreamFlow.clear();
     for (const assembler of this.#mseAssemblers.values()) assembler.dispose();
     this.#mseAssemblers.clear();
   }
@@ -3013,7 +3191,6 @@ export class MmtpRouter {
   #processMMTP(
     packet: Uint8Array,
     source: "multicast" | "moq",
-    manifestIdentity?: ManifestObjectIdentity,
     manifestAdmitted = false,
     ingress?: MmtpIngressContext,
     overlapCopy = false,
@@ -3062,57 +3239,43 @@ export class MmtpRouter {
       this.#classifyPacketId(info.packetId) !== null &&
       this.#configuredBlockProfile(info.packetId) === undefined;
     if (fecUnreadable && !manifestAdmitted) this.#noteUnreadableFecPayloadId(info.packetId, "source");
+    if (source === "multicast" && manifestAdmitted && !info.isRepair && ingress?.flow !== undefined) {
+      let byName = this.#provenanceStreamFlow.get(info.packetId);
+      if (!byName) this.#provenanceStreamFlow.set(info.packetId, (byName = new Map()));
+      byName.set(catalogTrackNameForPacket(ingress, info.packetId), ingress.flow);
+    }
 
-    if (!info.isRepair && this.#manifestVerifier && !manifestAdmitted) {
-      let identity = manifestIdentity;
-      if (!identity && info.fecPayloadId && !fecUnreadable && (this.#resolveManifestIdentityForRoute || this.#resolveManifestIdentity)) {
-        // A source resolves with its block coordinates (SS_Start, ESI), the
-        // pair a recovered symbol of the same block resolves with. SS_ID alone
-        // locates no block (C.5.3): until a repair states this source's block
-        // it has none, its identity stays absent, and the verifier's
-        // missing-identity policy below applies.
-        const catalogTrackName = catalogTrackNameForPacket(ingress, info.packetId);
-        const coordinates = this.#locateFecSource(info.packetId, catalogTrackName, info.fecPayloadId.ssId);
-        identity = coordinates === null ? undefined : (this.#resolveManifestIdentityForRoute
-          ? this.#resolveManifestIdentityForRoute({
-              packetId: info.packetId,
-              sbn: coordinates.sbn,
-              esi: coordinates.esi,
-              ...(catalogTrackName === undefined ? {} : { catalogTrackName }),
-              recovered: false,
-              sourceSymbolFormat: "full-mmtp-packet",
-            })
-          : this.#resolveManifestIdentity!(
-              info.packetId,
-              coordinates.sbn,
-              coordinates.esi,
-              catalogTrackName,
-            )) ?? undefined;
-      }
-      if (identity) {
-        identity = {
-          ...identity,
-          packetId: info.packetId,
-          ...(info.fecPayloadId ? { ssId: info.fecPayloadId.ssId } : {}),
-        };
-        const authenticated = info.fecPayloadId ? packet.subarray(0, packet.length - 4) : packet;
-        // A `stall` admission quarantines the packet and releases it later,
-        // after the stream has moved on; a synchronous release happens inside
-        // admitObject, before this flag is set.
-        let quarantined = false;
-        const admission = this.#manifestVerifier.admitObject(identity, authenticated, () => {
-          if (!this.#disposed) {
-            this.#processMMTP(packet, source, identity, true, ingress, overlapCopy, quarantined);
-          }
-        });
-        quarantined = admission.action === "stall";
+    // A protected flow admits every datagram, repair included, before it is
+    // read (7.2.7): an unadmitted repair symbol never reaches the decoder.
+    if (source === "multicast" && !manifestAdmitted && ingress?.flow !== undefined) {
+      const protectedFlow = this.#provenance.get(ingress.flow);
+      // Named but not registered (before registration, after release): the
+      // flow is protected, so nothing admits this datagram. Fail closed.
+      if (!protectedFlow) {
+        this.#unregisteredFlowDrops++;
+        debugRouter(`[MmtpRouter] Dropping multicast packet pid=${info.packetId}: flow ${ingress.flow} has no receiver`);
         return;
       }
-      if (
-        this.#manifestVerifier.config.mode === "enforce" &&
-        this.#manifestVerifier.config.onMissingManifest === "stall"
-      ) {
-        console.warn(`[MmtpRouter] manifest identity absent; stalling packetId=${info.packetId}`);
+      // Held: released by a record (feedProvenanceRecord) or expired. Duplicate / overflow: dropped.
+      const { verdict } = protectedFlow.receiver.onDatagram(packet, "multicast");
+      if (verdict === "admitted") {
+        this.#noteFlowAdmitted(ingress.flow);
+        this.#processMMTP(packet, source, true, ingress, overlapCopy);
+      }
+      else if (verdict === "held") {
+        this.#heldIngress.set(packet, ingress!);
+        this.#heldAt.set(packet, performance.now());
+      }
+      return;
+    }
+
+    // A MoQ packet of a track a protected flow lists is a datagram of that
+    // flow on its unicast path (7.2.7): admitted before it is read, or held.
+    if (source === "moq" && !manifestAdmitted) {
+      const admit = this.#admitUnicast(info.packetId, packet, () =>
+        this.#processMMTP(packet, source, true, ingress, overlapCopy, true), overlapCopy);
+      if (admit !== "unlisted") {
+        if (admit === "admitted") this.#processMMTP(packet, source, true, ingress, overlapCopy);
         return;
       }
     }
@@ -3127,6 +3290,8 @@ export class MmtpRouter {
         const ownerPacketId = this.#resolveRepairOwnerPacketId(info.packetId, ingress);
         if (ownerPacketId != null && this.#fecManager) {
           if (hasAmbiguousCatalogTrackName(ingress, ownerPacketId)) return;
+          // An unadmitted MoQ symbol reaching here is unlisted (#admitUnicast).
+          if (source === "moq" && !manifestAdmitted && this.#setAsideUnlistedRepair(ownerPacketId)) return;
         this.#repairPidCounts[info.packetId] = (this.#repairPidCounts[info.packetId] || 0) + 1;
         const count = this.#repairPidCounts[info.packetId]!;
         if (count <= 2 || count % 500 === 0) {
@@ -3203,8 +3368,8 @@ export class MmtpRouter {
       // Start a fresh epoch for the stream before this packet is looked up.
       // The reset needs the catalog identity, so a stream without one is not
       // checked; an overlap copy is MoQ bytes and says nothing about the
-      // multicast publisher, and neither does a packet the manifest verifier
-      // quarantined: it predates the horizon because it waited, not because the
+      // multicast publisher, and neither does a packet a provenance hold queue
+      // released: it predates the horizon because it waited, not because the
       // publisher restarted.
       if (
         source === "multicast" &&
@@ -3433,37 +3598,24 @@ export class MmtpRouter {
               sourceFec.symbolData,
               catalogTrackName,
             );
-        if (recovered) {
-          if (!alreadyCompleted && this.#classifyPacketId(info.packetId) !== null) {
+        // Only route recovered blocks that needed actual repair; complete
+        // one only once admission has released its recovered packets.
+        if (recovered && !alreadyCompleted) {
+          const fec = this.#fecManager;
+          const sbn = sourceFec.sbn;
+          const packetId = info.packetId;
+          const tracked = this.#classifyPacketId(packetId) !== null;
+          this.#routeRecoveredBlock(sbn, recovered, packetId, catalogTrackName, () => {
             if (catalogTrackName === undefined) {
-              this.#fecManager.cancelBlockTimeout(sourceFec.sbn, info.packetId);
+              if (tracked) fec.cancelBlockTimeout(sbn, packetId);
+              fec.countRecovery(packetId, sbn, catalogTrackName);
+              fec.markBlockCompleted(sbn, packetId);
             } else {
-              this.#fecManager.cancelBlockTimeout(
-                sourceFec.sbn,
-                info.packetId,
-                catalogTrackName,
-              );
+              if (tracked) fec.cancelBlockTimeout(sbn, packetId, catalogTrackName);
+              fec.countRecovery(packetId, sbn, catalogTrackName);
+              fec.markBlockCompleted(sbn, packetId, catalogTrackName);
             }
-          }
-          // Only route recovered blocks that needed actual repair.
-          if (!alreadyCompleted) {
-            this.#fecManager.countRecovery(info.packetId, sourceFec.sbn, catalogTrackName);
-            if (catalogTrackName === undefined) {
-              this.#fecManager.markBlockCompleted(sourceFec.sbn, info.packetId);
-            } else {
-              this.#fecManager.markBlockCompleted(
-                sourceFec.sbn,
-                info.packetId,
-                catalogTrackName,
-              );
-            }
-            this.#routeRecoveredBlock(
-              sourceFec.sbn,
-              recovered,
-              info.packetId,
-              catalogTrackName,
-            );
-          }
+          });
         }
       }
     }
@@ -4068,7 +4220,8 @@ export class MmtpRouter {
     recovered: Uint8Array,
     ownerPacketId?: number,
     catalogTrackName?: string,
-  ): void {
+    complete?: () => void,
+  ): boolean {
     // MMTP path: use processFecBlock for MMTP-wrapped recovery.
     // Recovered symbols are individual MMTP packets that may be fragments
     // (FI=1/2/3) of a larger MFU.  Route through the reassembler so
@@ -4092,118 +4245,83 @@ export class MmtpRouter {
       ownerPacketId,
       blockProfile,
     });
-    this.#routeVerifiedFecSymbols(blockId, result, ownerPacketId, catalogTrackName);
+    return this.#routeVerifiedFecSymbols(blockId, result, ownerPacketId, catalogTrackName, complete);
   }
 
+  /**
+   * A recovered source packet of a protected flow is admitted on its own
+   * digest: its bytes with the SS_ID it was sent with (SS_Start + ESI)
+   * appended are the datagram the record listed (7.2.7). One that no record
+   * lists is dropped; holding it would let it out later as a multicast arrival.
+   * Returns whether the decode recovered the block: every packet it yields
+   * that this router has not parsed already is admitted. A block one of whose
+   * recovered packets is refused is unrecovered (7.2.7): its caller leaves it
+   * open, so it reaches its FEC deadline and fails by class. Always true
+   * outside a protected flow.
+   */
   #routeVerifiedFecSymbols(
     blockId: number,
     result: ProcessFecBlockResult,
     ownerPacketId?: number,
     catalogTrackName?: string,
-  ): void {
-    if (!this.#manifestVerifier || ownerPacketId == null) {
-      this.#routeProcessedFecSymbols(blockId, result, ownerPacketId, catalogTrackName);
-      return;
-    }
-    if (!this.#resolveManifestIdentity && !this.#resolveManifestIdentityForRoute) {
-      console.warn(`[MmtpRouter] manifest identity resolver unavailable; recovered media is fail-open for packetId=${ownerPacketId} block=${blockId}`);
-      this.#routeProcessedFecSymbols(blockId, result, ownerPacketId, catalogTrackName);
-      return;
+    complete?: () => void,
+  ): boolean {
+    const receiver = ownerPacketId == null ? undefined : this.#provenanceFor(ownerPacketId, catalogTrackName);
+    let recovered = true;
+    if (receiver) {
+      const parsed = this.#stream(ownerPacketId!, catalogTrackName).duplicates.parsedSymbols;
+      result = {
+        ...result,
+        symbols: result.symbols.filter((sym) => {
+          const ssId = this.#fecAnchorForRecovered(blockId, sym.index);
+          // A received copy was admitted on arrival; its recovered twin is a duplicate.
+          if (parsed.has(ssId)) return false;
+          let admitted = false;
+          if (receiver === "ambiguous") {
+            this.#ambiguousRecoveredDrops++;
+          } else {
+            const wire = new Uint8Array(sym.rawSymbol.byteLength + 4);
+            wire.set(sym.rawSymbol);
+            new DataView(wire.buffer).setUint32(sym.rawSymbol.byteLength, ssId);
+            admitted = receiver.admitRecovered(wire);
+          }
+          if (!admitted) recovered = false;
+          return admitted;
+        }),
+      };
     }
-    const queueKey = this.#mediaStreamKey(ownerPacketId, catalogTrackName);
-    const queue = this.#manifestRecoveryQueues.get(queueKey) ?? [];
-    queue.push({ blockId, result, ownerPacketId, catalogTrackName });
-    this.#manifestRecoveryQueues.set(queueKey, queue);
-    if (queue.length > 1) return;
-    const drain = (): void => {
-      const next = queue[0];
-      if (!next) {
-        this.#manifestRecoveryQueues.delete(queueKey);
-        return;
-      }
-      this.#admitRecoveredResult(
-        next.blockId,
-        next.result,
-        next.ownerPacketId,
-        next.catalogTrackName,
-        () => {
-          queue.shift();
-          drain();
-        },
-      );
-    };
-    drain();
+    if (recovered) complete?.();
+    this.#routeProcessedFecSymbols(blockId, result, ownerPacketId, catalogTrackName);
+    return recovered;
   }
 
-  #admitRecoveredResult(
-    blockId: number,
-    result: ProcessFecBlockResult,
-    ownerPacketId: number,
+  /**
+   * The receiver a recovered packet of `packetId` answers to: the flow that
+   * admitted the stream's source datagrams. Before any was admitted, the one
+   * flow whose registration lists the stream; more than one (a repair flow
+   * also lists its owners' source tracks) cannot be told apart, so none.
+   */
+  #provenanceFor(
+    packetId: number,
     catalogTrackName: string | undefined,
-    done: () => void,
-  ): void {
-    const verifier = this.#manifestVerifier;
-    const resolveIdentity = this.#resolveManifestIdentity;
-    const resolveIdentityForRoute = this.#resolveManifestIdentityForRoute;
-    if (!verifier) {
-      this.#routeProcessedFecSymbols(blockId, result, ownerPacketId, catalogTrackName);
-      done();
-      return;
-    }
-    if (!resolveIdentity && !resolveIdentityForRoute) throw new Error("manifest identity resolver disappeared during admission");
-    const symbols = result.symbols;
-    const admitNext = (index: number): void => {
-      const symbol = symbols[index];
-      if (!symbol) {
-        done();
-        return;
-      }
-      const identity = resolveIdentityForRoute
-        ? resolveIdentityForRoute({
-            packetId: ownerPacketId,
-            sbn: blockId,
-            esi: symbol.index,
-            ...(catalogTrackName === undefined ? {} : { catalogTrackName }),
-            recovered: true,
-            sourceSymbolFormat: "fec-padded-recovery",
-          })
-        : resolveIdentity!(ownerPacketId, blockId, symbol.index, catalogTrackName);
-      if (!identity) {
-        console.warn(`[MmtpRouter] manifest identity unresolved; recovered symbol is fail-open for packetId=${ownerPacketId} block=${blockId} esi=${symbol.index}`);
-        this.#routeProcessedFecSymbols(
-          blockId,
-          { ...result, symbols: [symbol] },
-          ownerPacketId,
-          catalogTrackName,
-        );
-        admitNext(index + 1);
-        return;
+  ): BcProvenanceV2Receiver | "ambiguous" | undefined {
+    // A caller that names no track matches every name the packet id was admitted under.
+    const byName = this.#provenanceStreamFlow.get(packetId);
+    const flows = new Set(
+      catalogTrackName === undefined || !byName
+        ? byName?.values()
+        : byName.has(catalogTrackName) ? [byName.get(catalogTrackName)!] : [],
+    );
+    if (flows.size > 1) return "ambiguous";
+    for (const bound of flows) return this.#provenance.get(bound)?.receiver ?? "ambiguous";
+    let match: BcProvenanceV2Receiver | undefined;
+    for (const { receiver, ingress } of this.#provenance.values()) {
+      if (ingress.tracks.some((t) => t.packetId === packetId && (catalogTrackName === undefined || t.name === catalogTrackName))) {
+        if (match) return "ambiguous";
+        match = receiver;
       }
-      const admission = verifier.admitObject(
-        {
-          ...identity,
-          packetId: ownerPacketId,
-        },
-        symbol.rawSymbol,
-        () => {
-          if (!this.#disposed) {
-            this.#routeProcessedFecSymbols(
-              blockId,
-              { ...result, symbols: [symbol] },
-              ownerPacketId,
-              catalogTrackName,
-            );
-          }
-          admitNext(index + 1);
-        },
-        // A stalled symbol that is later discarded instead of played must still
-        // advance this loop; enforce mode never calls the release callback for
-        // it (BLO-30095).
-        () => admitNext(index + 1),
-      );
-      if (admission.action === "drop") admitNext(index + 1);
-    };
-    admitNext(0);
+    }
+    return match;
   }
 
   #routeProcessedFecSymbols(