@blockcast/mmt-container 0.4.1 → 0.5.0-main.34c7b9c2cfa0

package/dist/mmtp-router.js

@@ -6573,6 +6573,9 @@ function authoredGap(before, after) {
   if (!a || !b || a.mediaTimescale !== b.mediaTimescale) return false;
   return b.decodeTime > a.decodeTime + BigInt(a.durationTicks);
 }
+function ssIdAfter(a, b) {
+  return (a - b | 0) > 0;
+}
 var FecReleaseSequencer = class {
   #streams = /* @__PURE__ */ new Map();
   #gate;
@@ -6634,11 +6637,17 @@ var FecReleaseSequencer = class {
       stream.last = null;
       stream.lastSbn = void 0;
       stream.discontinuity = false;
+      stream.rapSsId = void 0;
     }
     if (stream.last !== null && compareFrameOrder(frame, stream.last) <= 0) {
       this.#recordStat("droppedStale");
       return;
     }
+    const ssId = meta.fecSbn;
+    if (meta.trackType === "video" && ssId !== void 0 && this.#gate.isRap?.(data, meta) === true) {
+      if (stream.rapSsId === void 0 || ssIdAfter(ssId, stream.rapSsId)) stream.rapSsId = ssId;
+      this.#gate.onRap?.(stream.packetId, stream.catalogTrackName, ssId);
+    }
     if (stream.last === null) {
       if (meta.trackType === "video" && !meta.keyframe) {
         this.#recordStat("droppedBeforeStartupKeyframe");
@@ -6674,6 +6683,22 @@ var FecReleaseSequencer = class {
     }
     return earliest;
   }
+  /**
+   * Whether a complete RAP above SS_ID `ssId` entered the gate of a stream of
+   * `packetId` (draft-ramadan-moq-fec 11.4.2: repair of a block below it is
+   * moot). Its SS_ID is the one its frame completed in; a frame's packets
+   * hold consecutive SS_IDs in authored order, so a complete RAP with a
+   * packet above `ssId` has every packet of it at or above the first SS_ID
+   * any loss at or below `ssId` could have taken.
+   */
+  rapAbove(packetId, catalogTrackName, ssId) {
+    for (const stream of this.#streams.values()) {
+      if (stream.packetId !== packetId) continue;
+      if (catalogTrackName !== void 0 && stream.catalogTrackName !== catalogTrackName) continue;
+      if (stream.rapSsId !== void 0 && ssIdAfter(stream.rapSsId, ssId)) return true;
+    }
+    return false;
+  }
   /** Re-evaluate held gaps after FEC state changed. */
   poke(streamKey) {
     if (streamKey !== void 0) {
@@ -6764,7 +6789,8 @@ var FecReleaseSequencer = class {
         buf: [],
         last: null,
         lastSbn: void 0,
-        discontinuity: false
+        discontinuity: false,
+        rapSsId: void 0
       };
       this.#streams.set(streamKey, stream);
     }
@@ -7127,6 +7153,10 @@ var MmtpContainerParser = class _MmtpContainerParser {
   fecReleaseEarliestHeldAtMs(packetId, catalogTrackName) {
     return this.#fecSequencer?.earliestHeldArrivalMs(packetId, catalogTrackName);
   }
+  /** See FecReleaseSequencer.rapAbove; false when no stream is FEC-gated. */
+  fecReleaseRapAbove(packetId, catalogTrackName, ssId) {
+    return this.#fecSequencer?.rapAbove(packetId, catalogTrackName, ssId) ?? false;
+  }
   /** Re-evaluate held gaps after FEC block state changed. */
   pokeFecRelease(packetId, catalogTrackName) {
     if (!this.#fecSequencer) return;
@@ -8459,6 +8489,10 @@ var NO_BLOCK_SPAN_HORIZON = Object.freeze({
   reason: "no-block-span"
 });
 var DIRECT_RECOVERED_VIDEO_QUEUE_LIMIT = 512;
+var ASSIST_BLOCK_LIMIT = 64;
+var ASSIST_FAILURE_LEDGER_LIMIT = 4 * ASSIST_BLOCK_LIMIT;
+var ASSIST_FAILED_DECODES_MAX = 2;
+var assistKey = (ownerPacketId, catalogTrackName, blockStart) => `${ownerPacketId}/${catalogTrackName ?? ""}/${blockStart}`;
 var DIRECT_RECOVERED_AUDIO_QUEUE_LIMIT = 512;
 function sourceSymbolEvidence(packet, header, rapFlag, packetSequenceNumber) {
   const identity = MmtpContainerParser.sourcePacketIdentity(packet, header);
@@ -8479,11 +8513,27 @@ var MmtpRouter = class {
   #fecManager;
   #defaultFecMapper;
   #fecMappersByPacketId = /* @__PURE__ */ new Map();
-  #manifestVerifier;
-  #ownsManifestVerifier;
-  #resolveManifestIdentity;
-  #resolveManifestIdentityForRoute;
-  #manifestRecoveryQueues = /* @__PURE__ */ new Map();
+  /** Protected flows: one 7.2.7 receiver each, and the ingress its datagrams arrive with. */
+  #provenance = /* @__PURE__ */ new Map();
+  #onFlowProtected = null;
+  #unadmittedListedDrops = 0;
+  #unlistedRepairSetAside = 0;
+  #assistBlocks = /* @__PURE__ */ new Map();
+  #assistFailures = /* @__PURE__ */ new Map();
+  #scratchDecoderFactory = null;
+  #unlistedAssistedRecoveries = 0;
+  #unlistedAssistedRefusals = 0;
+  /** The ingress a held datagram arrived with; the receiver returns the same bytes on release. */
+  #heldIngress = /* @__PURE__ */ new WeakMap();
+  #unicastRepair = false;
+  /** How to route a held unicast (MoQ) datagram once a record admits it. */
+  #heldReplay = /* @__PURE__ */ new WeakMap();
+  /** When a held datagram was received: admitted later, it keeps that receipt time (fec-01 9). */
+  #heldAt = /* @__PURE__ */ new WeakMap();
+  /** The flow whose receiver admitted a stream's source datagrams, by packetId then catalog track name: recovered packets answer to it. */
+  #provenanceStreamFlow = /* @__PURE__ */ new Map();
+  #unregisteredFlowDrops = 0;
+  #ambiguousRecoveredDrops = 0;
   // Temp state set by #processMMTP before calling parser.feed(),
   // read by the parser's onFrame callback for CMAF assembly + dedup.
   #currentFecInfo;
@@ -8565,6 +8615,7 @@ var MmtpRouter = class {
   #onBlockFailed = null;
   /** Typed observer of every gap decision the release gate makes. */
   #onFrameGap;
+  #fecRapObservers = /* @__PURE__ */ new Set();
   // Pokes requested while a packet is being processed are deferred to its
   // end: a synchronous recovery completes its block BEFORE routing the
   // recovered frames, and releasing a held gap in between would strand them.
@@ -8620,10 +8671,6 @@ var MmtpRouter = class {
     this.#fecManager = config?.fecManager ?? null;
     this.#onFrameGap = config?.onFrameGap ?? null;
     this.#defaultFecMapper = config?.fecMapper ?? null;
-    this.#manifestVerifier = config?.manifestVerifier ?? null;
-    this.#ownsManifestVerifier = config?.manifestVerifierOwnership !== "caller";
-    this.#resolveManifestIdentity = config?.resolveManifestIdentity ?? null;
-    this.#resolveManifestIdentityForRoute = config?.resolveManifestIdentityForRoute ?? null;
     this.#parser = new MmtpContainerParser({
       mfuTimeoutMs: config?.mfuTimeoutMs,
       reassemblyPolicy: config?.reassemblyPolicy,
@@ -9155,28 +9202,309 @@ var MmtpRouter = class {
       }
     });
   }
-  registerManifestTrack(context) {
-    if (!this.#manifestVerifier) throw new Error("manifest verifier is not configured");
-    this.#manifestVerifier.registerTrack(context);
-  }
-  feedManifestFrame(trackName, frame) {
-    this.#manifestVerifier?.ingestManifestFrame(trackName, frame);
-  }
-  setManifestAuthMode(mode) {
-    this.#manifestVerifier?.setMode(mode);
-    if (mode !== "enforce") {
-      for (const queue of this.#manifestRecoveryQueues.values()) {
-        for (const item of queue) {
-          this.#routeProcessedFecSymbols(
-            item.blockId,
-            item.result,
-            item.ownerPacketId,
-            item.catalogTrackName
-          );
-        }
+  /**
+   * Protect a flow (draft-ramadan-moq-multicast-01 7.2.7): every multicast
+   * datagram whose ingress names `ingress.flow`, source and repair alike, is
+   * admitted by `receiver` before anything reads it, and an unadmitted one is
+   * held or dropped. The caller owns the receiver's configuration; the router
+   * releases it on `releaseProvenanceFlow` and on dispose.
+   */
+  registerProvenanceFlow(ingress, receiver) {
+    this.#provenance.get(ingress.flow)?.receiver.release();
+    this.#provenance.set(ingress.flow, { receiver, ingress });
+    receiver.keepPendingAgeMs = () => this.#oldestOpenBlockAgeMs(ingress.flow);
+  }
+  /**
+   * Declare that this receiver can request unicast repair (a repair FETCH
+   * scheduler is wired): a protected flow then keeps the pending entries of
+   * its open blocks for the repair to consume (7.2.7 step 2).
+   */
+  setUnicastRepair(enabled) {
+    this.#unicastRepair = enabled;
+  }
+  #oldestOpenBlockAgeMs(flow) {
+    const entry = this.#provenance.get(flow);
+    if (!this.#unicastRepair || !entry) return void 0;
+    let age;
+    for (const { name, packetId } of entry.ingress.tracks) {
+      const a = name ? this.#fecManager?.oldestOpenBlockAgeMs?.(packetId, name) : void 0;
+      if (a !== void 0 && (age === void 0 || a > age)) age = a;
+    }
+    return age;
+  }
+  /**
+   * Replace a registered flow's ingress (a rendition switch staged, committed
+   * or cancelled) while keeping its receiver; a no-op for an unregistered flow.
+   */
+  updateProvenanceFlowIngress(ingress) {
+    const entry = this.#provenance.get(ingress.flow);
+    if (!entry) return;
+    const added = entry.protected ? ingress.tracks.filter(({ name, packetId }) => name && !entry.ingress.tracks.some((t) => t.name === name && t.packetId === packetId)) : [];
+    const governed = added.map(({ packetId }) => [...this.#repairOwnersByPacketId.get(packetId) ?? [packetId]].some((owner) => this.#governs(owner)));
+    this.#provenance.set(ingress.flow, { ...entry, ingress });
+    added.forEach(({ name, packetId }, i) => {
+      if (governed[i]) for (const block of this.#assistBlocks.values()) block.pooled.clear();
+      else this.#fecManager?.resetTrack?.(packetId, name);
+    });
+  }
+  /**
+   * Called once per protection of a flow: at the admission that makes this
+   * router's consumers protected under it (7.2.7), after their unadmitted
+   * holdings of its listed tracks are discarded. Again after an unprotect.
+   */
+  onProvenanceFlowProtected(cb) {
+    this.#onFlowProtected = cb;
+  }
+  /**
+   * The receiver ceased to hold the flow's endpoint on failover (7.2.7): drop
+   * its state and hold queues (no expiry counted) and un-protect its tracks,
+   * which then take MoQ again. The registration stays, so multicast resuming
+   * protects the flow anew at its next admission.
+   */
+  unprotectProvenanceFlow(flow) {
+    const entry = this.#provenance.get(flow);
+    if (!entry) return;
+    entry.receiver.release();
+    entry.protected = false;
+    this.#assistBlocks.clear();
+    this.#assistFailures.clear();
+  }
+  /** MoQ packets of a track a protected flow lists, dropped on its unicast path: duplicate, overflow, or listed by more than one flow. */
+  get unadmittedListedDropCount() {
+    return this.#unadmittedListedDrops;
+  }
+  /** MoQ repair symbols of an unlisted track kept out of a governed FEC instance (7.2.7 step 2). */
+  get unlistedRepairSetAsideCount() {
+    return this.#unlistedRepairSetAside;
+  }
+  /** Governed blocks recovered with the help of unlisted repair (7.2.7 step 2). */
+  get unlistedAssistedRecoveryCount() {
+    return this.#unlistedAssistedRecoveries;
+  }
+  /** Unlisted-assisted decodes refused because two already failed for the block (7.2.7 step 2). */
+  get unlistedAssistedRefusalCount() {
+    return this.#unlistedAssistedRefusals;
+  }
+  /** Unlisted repair symbols pooled now, across every governed block (7.2.7 step 2). */
+  get unlistedPoolSymbolCount() {
+    let n = 0;
+    for (const block of this.#assistBlocks.values()) n += block.pooled.size;
+    return n;
+  }
+  /**
+   * Wire the decoder an unlisted-assisted decode runs in: a fresh, configured
+   * decoder of the owner's track, used once and discarded, never the live one.
+   * Without it unlisted repair on a governed instance is set aside and dropped.
+   */
+  setScratchFecDecoderFactory(factory) {
+    this.#scratchDecoderFactory = factory;
+    if (!factory) {
+      this.#assistBlocks.clear();
+      this.#assistFailures.clear();
+    }
+  }
+  /** Whether a protected flow lists `ownerPacketId`: its FEC instance is governed (7.2.7). */
+  #governs(ownerPacketId) {
+    for (const entry of this.#provenance.values()) {
+      if (entry.protected && ingressHasPacketId(entry.ingress, ownerPacketId)) return true;
+    }
+    return false;
+  }
+  /**
+   * A MoQ repair symbol no protected flow lists, owned by a source track one
+   * does: its FEC instance is governed (7.2.7 step 2) and takes only admitted
+   * symbols, so the symbol is set aside: pooled for an unlisted-assisted
+   * decode of a block admitted repair already delimits, else dropped. It
+   * never states a block, so the live locator and decoder are unchanged.
+   * Un-listing needs no hook: an unprotected or released flow lists nothing.
+   */
+  #setAsideUnlistedRepair(ownerPacketId, catalogTrackName, repair) {
+    if (!this.#governs(ownerPacketId)) return false;
+    this.#unlistedRepairSetAside++;
+    const key = assistKey(ownerPacketId, catalogTrackName, repair.ssStart);
+    const block = this.#assistBlocks.get(key);
+    if (block !== void 0 && block.ssbLength === repair.ssbLength && !block.repairs.has(repair.rsId) && block.pooled.size < block.ssbLength && repair.symbolData.byteLength === this.#symbolSizeForPacket(ownerPacketId) && this.#fecManager?.admitRepairBlockLength?.(ownerPacketId, repair.ssbLength, repair.rsbLength, repair.rsId) !== false) {
+      block.pooled.set(repair.rsId, repair.symbolData);
+      this.#tryAssistedDecode(key, block, ownerPacketId, catalogTrackName, repair.ssStart);
+    }
+    return true;
+  }
+  /**
+   * An admitted repair placed a governed block (its SSB_length delimits it):
+   * open the block's record, which the symbols its live decoder takes join.
+   */
+  #openAssistBlock(ownerPacketId, catalogTrackName, blockStart, ssbLength) {
+    const key = assistKey(ownerPacketId, catalogTrackName, blockStart);
+    if (!this.#scratchDecoderFactory || this.#assistBlocks.has(key) || !this.#governs(ownerPacketId)) return;
+    this.#assistBlocks.set(key, { ssbLength, sources: /* @__PURE__ */ new Map(), repairs: /* @__PURE__ */ new Map(), pooled: /* @__PURE__ */ new Map() });
+    for (const oldest of this.#assistBlocks.keys()) {
+      if (this.#assistBlocks.size <= ASSIST_BLOCK_LIMIT) break;
+      this.#assistBlocks.delete(oldest);
+    }
+  }
+  /** A symbol fed to an open governed block's live decoder that did not recover it. */
+  #noteAssistAdmitted(ownerPacketId, catalogTrackName, blockStart, symbol, data) {
+    const key = assistKey(ownerPacketId, catalogTrackName, blockStart);
+    const block = this.#assistBlocks.get(key);
+    if (block === void 0) return;
+    if ("rsId" in symbol) {
+      block.repairs.set(symbol.rsId, data);
+      block.pooled.delete(symbol.rsId);
+    } else {
+      block.sources.set(symbol.esi, data);
+    }
+    this.#tryAssistedDecode(key, block, ownerPacketId, catalogTrackName, blockStart);
+  }
+  /**
+   * 7.2.7 step 2, phase two: a governed block its admitted symbols cannot
+   * decode (the live decoder already had them all) is decoded in a scratch
+   * decoder from its admitted symbols plus pooled unlisted repair, only as
+   * many as close the shortfall. What it recovers is released only through
+   * admission (#routeRecoveredBlock), so the live decoder is never touched and
+   * a refused recovery leaves the block to fail at its FEC deadline. At most
+   * two such decodes may fail per block; a third is refused.
+   */
+  #tryAssistedDecode(key, block, ownerPacketId, catalogTrackName, blockStart) {
+    const fec = this.#fecManager;
+    const admitted = block.sources.size + block.repairs.size;
+    if (!fec || block.pooled.size === 0) return;
+    if (admitted >= block.ssbLength || admitted + block.pooled.size < block.ssbLength) return;
+    if (fec.isBlockCompleted(blockStart, ownerPacketId, catalogTrackName)) {
+      this.#assistBlocks.delete(key);
+      return;
+    }
+    if ((this.#assistFailures.get(key) ?? 0) >= ASSIST_FAILED_DECODES_MAX) {
+      this.#unlistedAssistedRefusals++;
+      return;
+    }
+    const decoder = this.#scratchDecoderFactory?.(ownerPacketId, catalogTrackName);
+    if (!decoder) return;
+    let recovered = null;
+    const fed = [];
+    try {
+      for (const [esi, data] of block.sources) decoder.add_source(serial32Add(blockStart, esi), data, 0);
+      for (const [rsId, data] of block.repairs) {
+        recovered ??= decoder.add_repair(blockStart, block.ssbLength, rsId, data, 0);
       }
-      this.#manifestRecoveryQueues.clear();
+      for (const [rsId, data] of block.pooled) {
+        if (recovered || fed.length >= block.ssbLength - admitted) break;
+        fed.push(rsId);
+        recovered = decoder.add_repair(blockStart, block.ssbLength, rsId, data, 0);
+      }
+    } catch {
+      recovered = null;
+    } finally {
+      decoder.free?.();
+    }
+    if (recovered && this.#routeRecoveredBlock(blockStart, recovered, ownerPacketId, catalogTrackName, () => {
+      fec.cancelBlockTimeout(blockStart, ownerPacketId, catalogTrackName);
+      fec.countRecovery(ownerPacketId, blockStart, catalogTrackName);
+      fec.markBlockCompleted(blockStart, ownerPacketId, catalogTrackName);
+    })) {
+      this.#unlistedAssistedRecoveries++;
+      this.#assistBlocks.delete(key);
+      return;
+    }
+    for (const rsId of fed) block.pooled.delete(rsId);
+    const failed = (this.#assistFailures.get(key) ?? 0) + 1;
+    this.#assistFailures.delete(key);
+    this.#assistFailures.set(key, failed);
+    for (const oldest of this.#assistFailures.keys()) {
+      if (this.#assistFailures.size <= ASSIST_FAILURE_LEDGER_LIMIT) break;
+      this.#assistFailures.delete(oldest);
+    }
+  }
+  /**
+   * The admission that makes this router protected under `flow` (7.2.7):
+   * its FEC instances discard what they hold of the flow's listed tracks so
+   * no unadmitted symbol stands for an admitted one, then notify. Before it
+   * nothing of the flow was admitted, so every such symbol is unadmitted.
+   * The playback parse ledger is kept: it records MoQ copies already played,
+   * not holdings, and clearing it re-emits that media (audio twice).
+   * The FEC reset is the whole 7.2.7 discard here: no keyframe-overlay
+   * instance exists to hold anything (repair-layers.ts is the catalog
+   * contract only, no decoder), and packet_id 0 is never a listed track
+   * (`ingressHasPacketId`), so nothing of it is held for the flow.
+   */
+  #noteFlowAdmitted(flow) {
+    const entry = this.#provenance.get(flow);
+    if (!entry || entry.protected) return;
+    entry.protected = true;
+    for (const { name, packetId } of entry.ingress.tracks) {
+      if (name) this.#fecManager?.resetTrack?.(packetId, name);
     }
+    this.#onFlowProtected?.(flow);
+  }
+  /**
+   * Admit a MoQ datagram of `packetId` on the unicast path of the protected
+   * flow that lists it (7.2.7). `unlisted`: no protected flow lists it, so it
+   * is read as before. A held datagram is routed by `replay` when a record
+   * admits it; one more than one protected flow lists is dropped. So is an
+   * overlap copy: it never enters FEC accounting, so admitting it would leave
+   * its multicast twin a duplicate and the block one symbol short.
+   */
+  #admitUnicast(packetId, packet, replay, overlapCopy = false) {
+    let receiver;
+    for (const entry of this.#provenance.values()) {
+      if (!entry.protected || !ingressHasPacketId(entry.ingress, packetId)) continue;
+      if (receiver || overlapCopy) {
+        this.#unadmittedListedDrops++;
+        return "dropped";
+      }
+      receiver = entry.receiver;
+    }
+    if (!receiver) return "unlisted";
+    const { verdict } = receiver.onDatagram(packet, "unicast");
+    if (verdict === "admitted") return "admitted";
+    if (verdict === "held") {
+      this.#heldReplay.set(packet, replay);
+      this.#heldAt.set(packet, performance.now());
+      return "held";
+    }
+    this.#unadmittedListedDrops++;
+    return "dropped";
+  }
+  /**
+   * Feed one bc-provenance record of `flow`: a datagram from `manifestPort`
+   * (`multicast`) or an object of the manifest track (`mirror`). Held
+   * datagrams the record admits are routed before this returns.
+   */
+  feedProvenanceRecord(flow, record, path) {
+    const entry = this.#provenance.get(flow);
+    if (!entry || this.#disposed) return "unregistered";
+    const result = entry.receiver.onRecord(record, path);
+    if (result.admitted.length > 0) {
+      this.#noteFlowAdmitted(flow);
+      this.#withDeferredFecPokes(() => {
+        for (const datagram of result.admitted) {
+          const route = () => {
+            const replay = this.#heldReplay.get(datagram);
+            if (replay) replay();
+            else this.#processMMTP(datagram, "multicast", true, this.#heldIngress.get(datagram) ?? entry.ingress, false, true);
+          };
+          const heldAt = this.#heldAt.get(datagram);
+          if (heldAt !== void 0 && this.#fecManager?.withReceiptTime) this.#fecManager.withReceiptTime(heldAt, route);
+          else route();
+        }
+      });
+    }
+    return result.verdict;
+  }
+  /** The receiver ceased to hold the flow: its hold queues are dropped, not expired. */
+  releaseProvenanceFlow(flow) {
+    this.#provenance.get(flow)?.receiver.release();
+    this.#provenance.delete(flow);
+    for (const byName of this.#provenanceStreamFlow.values()) {
+      for (const [name, bound] of byName) if (bound === flow) byName.delete(name);
+    }
+  }
+  /** Multicast datagrams dropped because their ingress names a flow with no registered receiver. */
+  get unregisteredFlowDropCount() {
+    return this.#unregisteredFlowDrops;
+  }
+  /** Recovered packets dropped because more than one protected flow could own their stream. */
+  get ambiguousRecoveredDropCount() {
+    return this.#ambiguousRecoveredDrops;
   }
   /**
    * Main entry point: feed a raw MMTP packet for processing.
@@ -9192,10 +9520,10 @@ var MmtpRouter = class {
    * they may never have crossed — and that attribution is what the physical-
    * delivery evidence path is built on. Absence is not multicast; say which.
    */
-  feedPacket(packet, source, manifestIdentity, ingress) {
+  feedPacket(packet, source, ingress) {
     if (this.#disposed) return;
     this.#withDeferredFecPokes(() => {
-      this.#processMMTP(packet, source, manifestIdentity, false, ingress);
+      this.#processMMTP(packet, source, false, ingress);
     });
   }
   /**
@@ -9230,7 +9558,7 @@ var MmtpRouter = class {
   feedOverlapCopy(packet, ingress) {
     if (this.#disposed) return;
     this.#withDeferredFecPokes(() => {
-      this.#processMMTP(packet, "moq", void 0, false, ingress, true);
+      this.#processMMTP(packet, "moq", false, ingress, true);
     });
   }
   /**
@@ -9243,7 +9571,7 @@ var MmtpRouter = class {
       this.#feedRepairPacket(packet, ownerPacketIdHint, catalogTrackName, repairTrackName);
     });
   }
-  #feedRepairPacket(packet, ownerPacketIdHint, catalogTrackName, repairTrackName) {
+  #feedRepairPacket(packet, ownerPacketIdHint, catalogTrackName, repairTrackName, admitted = false) {
     let header;
     try {
       header = parseMMTPHeader(packet);
@@ -9260,6 +9588,11 @@ var MmtpRouter = class {
         `[MmtpRouter] Dropping MoQ repair packet pid=${repairPacketId}: owner hint is required`
       );
     }
+    if (ownerPacketId != null && !admitted) {
+      const admit = this.#admitUnicast(repairPacketId, packet, () => this.#feedRepairPacket(packet, ownerPacketIdHint, catalogTrackName, repairTrackName, true));
+      if (admit === "held" || admit === "dropped") return;
+      if (admit === "unlisted" && this.#fecManager && this.#setAsideUnlistedRepair(ownerPacketId, catalogTrackName, parsed)) return;
+    }
     if (ownerPacketId != null && this.#fecManager) {
       this.#moqRepairPidCounts[repairPacketId] = (this.#moqRepairPidCounts[repairPacketId] || 0) + 1;
       this.#moqRepairOwnerCounts[ownerPacketId] = (this.#moqRepairOwnerCounts[ownerPacketId] || 0) + 1;
@@ -9378,6 +9711,7 @@ var MmtpRouter = class {
     const placement = fec.placeIsoRepair(ownerPacketId, catalogTrackName, repair.ssStart, repair.ssbLength);
     if (placement.status !== "placed") return;
     const blockStart = placement.block.start;
+    this.#openAssistBlock(ownerPacketId, catalogTrackName, blockStart, repair.ssbLength);
     if (placement.span !== void 0) {
       this.#replayIsoSources(ownerPacketId, catalogTrackName, placement.span.block.start, placement.span.placed);
     }
@@ -9403,10 +9737,13 @@ var MmtpRouter = class {
       catalogTrackName
     );
     if (recovered && !alreadyCompleted) {
-      fec.cancelBlockTimeout(blockStart, ownerPacketId, catalogTrackName);
-      fec.countRecovery(ownerPacketId, blockStart, catalogTrackName);
-      fec.markBlockCompleted(blockStart, ownerPacketId, catalogTrackName);
-      this.#routeRecoveredBlock(blockStart, recovered, ownerPacketId, catalogTrackName);
+      this.#routeRecoveredBlock(blockStart, recovered, ownerPacketId, catalogTrackName, () => {
+        fec.cancelBlockTimeout(blockStart, ownerPacketId, catalogTrackName);
+        fec.countRecovery(ownerPacketId, blockStart, catalogTrackName);
+        fec.markBlockCompleted(blockStart, ownerPacketId, catalogTrackName);
+      });
+    } else if (!recovered) {
+      this.#noteAssistAdmitted(ownerPacketId, catalogTrackName, blockStart, { rsId: repair.rsId }, repair.symbolData);
     }
   }
   /**
@@ -9446,11 +9783,13 @@ var MmtpRouter = class {
       if (payload.oversized) continue;
       const alreadyCompleted = fec.isBlockCompleted(blockStart, ownerPacketId, catalogTrackName);
       const recovered = fec.feedSourceSymbol(ownerPacketId, ssId, payload.symbolData, catalogTrackName);
+      if (!recovered) this.#noteAssistAdmitted(ownerPacketId, catalogTrackName, blockStart, { esi }, payload.symbolData);
       if (!recovered || alreadyCompleted) continue;
-      fec.cancelBlockTimeout(blockStart, ownerPacketId, catalogTrackName);
-      fec.countRecovery(ownerPacketId, blockStart, catalogTrackName);
-      fec.markBlockCompleted(blockStart, ownerPacketId, catalogTrackName);
-      this.#routeRecoveredBlock(blockStart, recovered, ownerPacketId, catalogTrackName);
+      this.#routeRecoveredBlock(blockStart, recovered, ownerPacketId, catalogTrackName, () => {
+        fec.cancelBlockTimeout(blockStart, ownerPacketId, catalogTrackName);
+        fec.countRecovery(ownerPacketId, blockStart, catalogTrackName);
+        fec.markBlockCompleted(blockStart, ownerPacketId, catalogTrackName);
+      });
     }
   }
   #resolveRepairOwnerPacketId(packetId, ingress) {
@@ -9473,14 +9812,18 @@ var MmtpRouter = class {
    *  Sync WASM decoders return the block's K' = SSB_length fixed-width
    *  ssbg_mode1 source symbols concatenated. */
   routeRecoveredBlock(blockId, data, packetId, catalogTrackName) {
-    this.#withDeferredFecPokes(() => this.#routeRecoveredBlock(blockId, data, packetId, catalogTrackName));
+    let recovered = false;
+    this.#withDeferredFecPokes(() => {
+      recovered = this.#routeRecoveredBlock(blockId, data, packetId, catalogTrackName);
+    });
+    return recovered;
   }
   /** Route a single recovered source symbol through the parser + dedup pipeline.
    *  Worker-backed decoders emit one padded source symbol per frame event. */
   routeRecoveredSymbol(blockId, data, packetId, esi = 0, catalogTrackName) {
     const blockProfile = this.#blockProfileFor(packetId);
     const result = processFecSymbol(data, { ownerPacketId: packetId, index: esi, blockProfile });
-    this.#routeVerifiedFecSymbols(blockId, result, packetId, catalogTrackName);
+    return this.#routeVerifiedFecSymbols(blockId, result, packetId, catalogTrackName);
   }
   // ── Keyframe timer cancellation ─────────────────────────────────
   /** Cancel the active keyframe loss timer.
@@ -9511,6 +9854,9 @@ var MmtpRouter = class {
       }
     }
     this.#parser.resetTrack(packetId, catalogTrackName);
+    const assistPrefix = assistKey(packetId, catalogTrackName, 0).slice(0, -1);
+    for (const key of this.#assistBlocks.keys()) if (key.startsWith(assistPrefix)) this.#assistBlocks.delete(key);
+    for (const key of this.#assistFailures.keys()) if (key.startsWith(assistPrefix)) this.#assistFailures.delete(key);
     const streamKey = this.#mediaStreamKey(packetId, catalogTrackName);
     this.#trackSynced.delete(streamKey);
     this.#droppedPreSyncVideo.delete(streamKey);
@@ -9523,7 +9869,6 @@ var MmtpRouter = class {
     this.#lastDirectSourceAudioCursorByStream.delete(streamKey);
     this.#lastDirectEmittedAudioCursorByStream.delete(streamKey);
     this.#pendingDirectRecoveredAudioByStream.delete(streamKey);
-    this.#manifestRecoveryQueues.delete(streamKey);
     this.#deliveredVideoHighWaterByStream.delete(streamKey);
     this.#stream(packetId, catalogTrackName).duplicates.clear();
     const assemblersToReset = /* @__PURE__ */ new Set();
@@ -9573,7 +9918,6 @@ var MmtpRouter = class {
       this.#lastDirectSourceAudioCursorByStream.delete(key);
       this.#lastDirectEmittedAudioCursorByStream.delete(key);
       this.#pendingDirectRecoveredAudioByStream.delete(key);
-      this.#manifestRecoveryQueues.delete(key);
       this.#trackInitDelivered.delete(key);
       this.#parserDiagnostics.delete(key);
       this.#pendingFecPokes.delete(key);
@@ -9834,8 +10178,9 @@ var MmtpRouter = class {
     this.#parserDiagnostics.clear();
     this.#catalogTrackNamesByPacketId.clear();
     this.#repairOwnersByPacketId.clear();
-    if (this.#ownsManifestVerifier) this.#manifestVerifier?.dispose();
-    this.#manifestRecoveryQueues.clear();
+    for (const { receiver } of this.#provenance.values()) receiver.release();
+    this.#provenance.clear();
+    this.#provenanceStreamFlow.clear();
     for (const assembler of this.#mseAssemblers.values()) assembler.dispose();
     this.#mseAssemblers.clear();
   }
@@ -9929,6 +10274,24 @@ var MmtpRouter = class {
   fecReleaseEarliestHeldAtMs(packetId, catalogTrackName) {
     return this.#parser.fecReleaseEarliestHeldAtMs(packetId, catalogTrackName);
   }
+  /**
+   * Whether a complete RAP above SS_ID `ssId` entered this stream's FEC
+   * release gate (see FecReleaseSequencer.rapAbove).
+   */
+  fecReleaseRapAbove(packetId, catalogTrackName, ssId) {
+    return this.#parser.fecReleaseRapAbove(packetId, catalogTrackName, ssId);
+  }
+  /**
+   * Observe each complete RAP entering an FEC release gate, with the SS_ID
+   * its frame completed in. Called synchronously from the frame push: an
+   * observer that drives FEC state must defer that work.
+   */
+  addFecRapObserver(observer) {
+    this.#fecRapObservers.add(observer);
+    return () => {
+      this.#fecRapObservers.delete(observer);
+    };
+  }
   #requestFecPoke(packetId, catalogTrackName) {
     if (this.#disposed) return;
     if (this.#fecPokeDepth > 0) {
@@ -9974,6 +10337,10 @@ var MmtpRouter = class {
         this.#onFrameGap?.(decision);
         return decision;
       },
+      isRap: (data, meta) => this.#isRapForGap(data, meta),
+      onRap: (packetId, catalogTrackName, ssId) => {
+        for (const observer of this.#fecRapObservers) observer(packetId, catalogTrackName, ssId);
+      },
       onReleased: (data, meta) => {
         if (meta.trackType !== "video" || meta.mpuSequenceNumber === void 0) return;
         const timing = meta.authoredTiming;
@@ -10112,7 +10479,7 @@ var MmtpRouter = class {
    *   1. parseHeader() → extract packetId + fecPayloadId for FEC feeding
    *   2. feed() → MFU extraction, reassembly, keyframe detection, emit via callbacks
    */
-  #processMMTP(packet, source, manifestIdentity, manifestAdmitted = false, ingress, overlapCopy = false, releasedFromQuarantine = false) {
+  #processMMTP(packet, source, manifestAdmitted = false, ingress, overlapCopy = false, releasedFromQuarantine = false) {
     const parsed = this.#parser.parsePacket(packet);
     if (!parsed) return;
     const info = parsed.info;
@@ -10137,43 +10504,32 @@ var MmtpRouter = class {
     }
     const fecUnreadable = !info.isRepair && info.fecPayloadId != null && this.#fecManager !== null && this.#classifyPacketId(info.packetId) !== null && this.#configuredBlockProfile(info.packetId) === void 0;
     if (fecUnreadable && !manifestAdmitted) this.#noteUnreadableFecPayloadId(info.packetId, "source");
-    if (!info.isRepair && this.#manifestVerifier && !manifestAdmitted) {
-      let identity = manifestIdentity;
-      if (!identity && info.fecPayloadId && !fecUnreadable && (this.#resolveManifestIdentityForRoute || this.#resolveManifestIdentity)) {
-        const catalogTrackName = catalogTrackNameForPacket(ingress, info.packetId);
-        const coordinates = this.#locateFecSource(info.packetId, catalogTrackName, info.fecPayloadId.ssId);
-        identity = coordinates === null ? void 0 : (this.#resolveManifestIdentityForRoute ? this.#resolveManifestIdentityForRoute({
-          packetId: info.packetId,
-          sbn: coordinates.sbn,
-          esi: coordinates.esi,
-          ...catalogTrackName === void 0 ? {} : { catalogTrackName },
-          recovered: false,
-          sourceSymbolFormat: "full-mmtp-packet"
-        }) : this.#resolveManifestIdentity(
-          info.packetId,
-          coordinates.sbn,
-          coordinates.esi,
-          catalogTrackName
-        )) ?? void 0;
-      }
-      if (identity) {
-        identity = {
-          ...identity,
-          packetId: info.packetId,
-          ...info.fecPayloadId ? { ssId: info.fecPayloadId.ssId } : {}
-        };
-        const authenticated = info.fecPayloadId ? packet.subarray(0, packet.length - 4) : packet;
-        let quarantined = false;
-        const admission = this.#manifestVerifier.admitObject(identity, authenticated, () => {
-          if (!this.#disposed) {
-            this.#processMMTP(packet, source, identity, true, ingress, overlapCopy, quarantined);
-          }
-        });
-        quarantined = admission.action === "stall";
+    if (source === "multicast" && manifestAdmitted && !info.isRepair && ingress?.flow !== void 0) {
+      let byName = this.#provenanceStreamFlow.get(info.packetId);
+      if (!byName) this.#provenanceStreamFlow.set(info.packetId, byName = /* @__PURE__ */ new Map());
+      byName.set(catalogTrackNameForPacket(ingress, info.packetId), ingress.flow);
+    }
+    if (source === "multicast" && !manifestAdmitted && ingress?.flow !== void 0) {
+      const protectedFlow = this.#provenance.get(ingress.flow);
+      if (!protectedFlow) {
+        this.#unregisteredFlowDrops++;
+        debugRouter(`[MmtpRouter] Dropping multicast packet pid=${info.packetId}: flow ${ingress.flow} has no receiver`);
         return;
       }
-      if (this.#manifestVerifier.config.mode === "enforce" && this.#manifestVerifier.config.onMissingManifest === "stall") {
-        console.warn(`[MmtpRouter] manifest identity absent; stalling packetId=${info.packetId}`);
+      const { verdict } = protectedFlow.receiver.onDatagram(packet, "multicast");
+      if (verdict === "admitted") {
+        this.#noteFlowAdmitted(ingress.flow);
+        this.#processMMTP(packet, source, true, ingress, overlapCopy);
+      } else if (verdict === "held") {
+        this.#heldIngress.set(packet, ingress);
+        this.#heldAt.set(packet, performance.now());
+      }
+      return;
+    }
+    if (source === "moq" && !manifestAdmitted) {
+      const admit = this.#admitUnicast(info.packetId, packet, () => this.#processMMTP(packet, source, true, ingress, overlapCopy, true), overlapCopy);
+      if (admit !== "unlisted") {
+        if (admit === "admitted") this.#processMMTP(packet, source, true, ingress, overlapCopy);
         return;
       }
     }
@@ -10183,6 +10539,7 @@ var MmtpRouter = class {
       const ownerPacketId = this.#resolveRepairOwnerPacketId(info.packetId, ingress);
       if (ownerPacketId != null && this.#fecManager) {
         if (hasAmbiguousCatalogTrackName(ingress, ownerPacketId)) return;
+        if (source === "moq" && !manifestAdmitted && this.#setAsideUnlistedRepair(ownerPacketId, catalogTrackNameForPacket(ingress, ownerPacketId), repair)) return;
         this.#repairPidCounts[info.packetId] = (this.#repairPidCounts[info.packetId] || 0) + 1;
         const count = this.#repairPidCounts[info.packetId];
         if (count <= 2 || count % 500 === 0) {
@@ -10350,36 +10707,31 @@ var MmtpRouter = class {
           sourceFec.symbolData,
           catalogTrackName
         );
-        if (recovered) {
-          if (!alreadyCompleted && this.#classifyPacketId(info.packetId) !== null) {
-            if (catalogTrackName === void 0) {
-              this.#fecManager.cancelBlockTimeout(sourceFec.sbn, info.packetId);
-            } else {
-              this.#fecManager.cancelBlockTimeout(
-                sourceFec.sbn,
-                info.packetId,
-                catalogTrackName
-              );
-            }
-          }
-          if (!alreadyCompleted) {
-            this.#fecManager.countRecovery(info.packetId, sourceFec.sbn, catalogTrackName);
+        if (!recovered) {
+          this.#noteAssistAdmitted(
+            info.packetId,
+            catalogTrackName,
+            sourceFec.sbn,
+            { esi: serial32Distance(sourceFec.sbn, sourceFec.ssId) },
+            sourceFec.symbolData
+          );
+        }
+        if (recovered && !alreadyCompleted) {
+          const fec = this.#fecManager;
+          const sbn = sourceFec.sbn;
+          const packetId = info.packetId;
+          const tracked = this.#classifyPacketId(packetId) !== null;
+          this.#routeRecoveredBlock(sbn, recovered, packetId, catalogTrackName, () => {
             if (catalogTrackName === void 0) {
-              this.#fecManager.markBlockCompleted(sourceFec.sbn, info.packetId);
+              if (tracked) fec.cancelBlockTimeout(sbn, packetId);
+              fec.countRecovery(packetId, sbn, catalogTrackName);
+              fec.markBlockCompleted(sbn, packetId);
             } else {
-              this.#fecManager.markBlockCompleted(
-                sourceFec.sbn,
-                info.packetId,
-                catalogTrackName
-              );
+              if (tracked) fec.cancelBlockTimeout(sbn, packetId, catalogTrackName);
+              fec.countRecovery(packetId, sbn, catalogTrackName);
+              fec.markBlockCompleted(sbn, packetId, catalogTrackName);
             }
-            this.#routeRecoveredBlock(
-              sourceFec.sbn,
-              recovered,
-              info.packetId,
-              catalogTrackName
-            );
-          }
+          });
         }
       }
     }
@@ -10755,7 +11107,7 @@ var MmtpRouter = class {
   }
   // ── Private: FEC recovery routing ───────────────────────────────
   /** Route WASM-recovered block through appropriate path based on container kind. */
-  #routeRecoveredBlock(blockId, recovered, ownerPacketId, catalogTrackName) {
+  #routeRecoveredBlock(blockId, recovered, ownerPacketId, catalogTrackName, complete) {
     const packetSymbolSize = this.#symbolSizeForPacket(ownerPacketId);
     if (ownerPacketId === void 0) {
       throw new Error("[MmtpRouter] a recovered FEC block needs its owner packetId to read its fec.blockProfile");
@@ -10772,103 +11124,68 @@ var MmtpRouter = class {
       ownerPacketId,
       blockProfile
     });
-    this.#routeVerifiedFecSymbols(blockId, result, ownerPacketId, catalogTrackName);
+    return this.#routeVerifiedFecSymbols(blockId, result, ownerPacketId, catalogTrackName, complete);
   }
-  #routeVerifiedFecSymbols(blockId, result, ownerPacketId, catalogTrackName) {
-    if (!this.#manifestVerifier || ownerPacketId == null) {
-      this.#routeProcessedFecSymbols(blockId, result, ownerPacketId, catalogTrackName);
-      return;
-    }
-    if (!this.#resolveManifestIdentity && !this.#resolveManifestIdentityForRoute) {
-      console.warn(`[MmtpRouter] manifest identity resolver unavailable; recovered media is fail-open for packetId=${ownerPacketId} block=${blockId}`);
-      this.#routeProcessedFecSymbols(blockId, result, ownerPacketId, catalogTrackName);
-      return;
+  /**
+   * A recovered source packet of a protected flow is admitted on its own
+   * digest: its bytes with the SS_ID it was sent with (SS_Start + ESI)
+   * appended are the datagram the record listed (7.2.7). One that no record
+   * lists is dropped; holding it would let it out later as a multicast arrival.
+   * Returns whether the decode recovered the block: every packet it yields
+   * that this router has not parsed already is admitted. A block one of whose
+   * recovered packets is refused is unrecovered (7.2.7): its caller leaves it
+   * open, so it reaches its FEC deadline and fails by class. Always true
+   * outside a protected flow.
+   */
+  #routeVerifiedFecSymbols(blockId, result, ownerPacketId, catalogTrackName, complete) {
+    const receiver = ownerPacketId == null ? void 0 : this.#provenanceFor(ownerPacketId, catalogTrackName);
+    let recovered = true;
+    if (receiver) {
+      const parsed = this.#stream(ownerPacketId, catalogTrackName).duplicates.parsedSymbols;
+      result = {
+        ...result,
+        symbols: result.symbols.filter((sym) => {
+          const ssId = this.#fecAnchorForRecovered(blockId, sym.index);
+          if (parsed.has(ssId)) return false;
+          let admitted = false;
+          if (receiver === "ambiguous") {
+            this.#ambiguousRecoveredDrops++;
+          } else {
+            const wire = new Uint8Array(sym.rawSymbol.byteLength + 4);
+            wire.set(sym.rawSymbol);
+            new DataView(wire.buffer).setUint32(sym.rawSymbol.byteLength, ssId);
+            admitted = receiver.admitRecovered(wire);
+          }
+          if (!admitted) recovered = false;
+          return admitted;
+        })
+      };
     }
-    const queueKey = this.#mediaStreamKey(ownerPacketId, catalogTrackName);
-    const queue = this.#manifestRecoveryQueues.get(queueKey) ?? [];
-    queue.push({ blockId, result, ownerPacketId, catalogTrackName });
-    this.#manifestRecoveryQueues.set(queueKey, queue);
-    if (queue.length > 1) return;
-    const drain = () => {
-      const next = queue[0];
-      if (!next) {
-        this.#manifestRecoveryQueues.delete(queueKey);
-        return;
+    if (recovered) complete?.();
+    this.#routeProcessedFecSymbols(blockId, result, ownerPacketId, catalogTrackName);
+    return recovered;
+  }
+  /**
+   * The receiver a recovered packet of `packetId` answers to: the flow that
+   * admitted the stream's source datagrams. Before any was admitted, the one
+   * flow whose registration lists the stream; more than one (a repair flow
+   * also lists its owners' source tracks) cannot be told apart, so none.
+   */
+  #provenanceFor(packetId, catalogTrackName) {
+    const byName = this.#provenanceStreamFlow.get(packetId);
+    const flows = new Set(
+      catalogTrackName === void 0 || !byName ? byName?.values() : byName.has(catalogTrackName) ? [byName.get(catalogTrackName)] : []
+    );
+    if (flows.size > 1) return "ambiguous";
+    for (const bound of flows) return this.#provenance.get(bound)?.receiver ?? "ambiguous";
+    let match;
+    for (const { receiver, ingress } of this.#provenance.values()) {
+      if (ingress.tracks.some((t) => t.packetId === packetId && (catalogTrackName === void 0 || t.name === catalogTrackName))) {
+        if (match) return "ambiguous";
+        match = receiver;
       }
-      this.#admitRecoveredResult(
-        next.blockId,
-        next.result,
-        next.ownerPacketId,
-        next.catalogTrackName,
-        () => {
-          queue.shift();
-          drain();
-        }
-      );
-    };
-    drain();
-  }
-  #admitRecoveredResult(blockId, result, ownerPacketId, catalogTrackName, done) {
-    const verifier = this.#manifestVerifier;
-    const resolveIdentity = this.#resolveManifestIdentity;
-    const resolveIdentityForRoute = this.#resolveManifestIdentityForRoute;
-    if (!verifier) {
-      this.#routeProcessedFecSymbols(blockId, result, ownerPacketId, catalogTrackName);
-      done();
-      return;
     }
-    if (!resolveIdentity && !resolveIdentityForRoute) throw new Error("manifest identity resolver disappeared during admission");
-    const symbols = result.symbols;
-    const admitNext = (index) => {
-      const symbol = symbols[index];
-      if (!symbol) {
-        done();
-        return;
-      }
-      const identity = resolveIdentityForRoute ? resolveIdentityForRoute({
-        packetId: ownerPacketId,
-        sbn: blockId,
-        esi: symbol.index,
-        ...catalogTrackName === void 0 ? {} : { catalogTrackName },
-        recovered: true,
-        sourceSymbolFormat: "fec-padded-recovery"
-      }) : resolveIdentity(ownerPacketId, blockId, symbol.index, catalogTrackName);
-      if (!identity) {
-        console.warn(`[MmtpRouter] manifest identity unresolved; recovered symbol is fail-open for packetId=${ownerPacketId} block=${blockId} esi=${symbol.index}`);
-        this.#routeProcessedFecSymbols(
-          blockId,
-          { ...result, symbols: [symbol] },
-          ownerPacketId,
-          catalogTrackName
-        );
-        admitNext(index + 1);
-        return;
-      }
-      const admission = verifier.admitObject(
-        {
-          ...identity,
-          packetId: ownerPacketId
-        },
-        symbol.rawSymbol,
-        () => {
-          if (!this.#disposed) {
-            this.#routeProcessedFecSymbols(
-              blockId,
-              { ...result, symbols: [symbol] },
-              ownerPacketId,
-              catalogTrackName
-            );
-          }
-          admitNext(index + 1);
-        },
-        // A stalled symbol that is later discarded instead of played must still
-        // advance this loop; enforce mode never calls the release callback for
-        // it (BLO-30095).
-        () => admitNext(index + 1)
-      );
-      if (admission.action === "drop") admitNext(index + 1);
-    };
-    admitNext(0);
+    return match;
   }
   #routeProcessedFecSymbols(blockId, result, ownerPacketId, catalogTrackName) {
     if (ownerPacketId == null) return;