@blockcast/mmt-container 0.4.1 → 0.5.0-main.34c7b9c2cfa0

package/src/mmtp-router.ts

@@ -22,7 +22,7 @@ import {
   type FecBlockProfile,
   type MMTPHeader,
 } from "@blockcast/mmt-base";
-import type { IsoHeldSource } from "./fec-manager.js";
+import type { IsoHeldSource, WasmFecDecoder } from "./fec-manager.js";
 import type { IsoPlacedSource, IsoRepairPlacement } from "./iso-block-locator.js";
 import { isMfuReassemblyError } from "./mfu-reassembler.js";
 import type {
@@ -67,10 +67,8 @@ import {
   type DuplicateHorizon,
 } from "./duplicate-ledger.js";
 import type {
-  ManifestAuthMode,
-  ManifestObjectIdentity,
-  ManifestTrackContext,
-  ManifestVerifier,
+  BcProvenanceV2Receiver,
+  BcpV2RecordPath,
 } from "@blockcast/mmt-manifest-verify";
 
 // ─── Constants ─────────────────────────────────────────────────────
@@ -177,6 +175,12 @@ export type RoutedFrameMeta = {
 
 export interface MmtpIngressContext {
   tracks: readonly Readonly<{ name: string; packetId: number }>[];
+  /**
+   * The bc-provenance v2 flow (draft-ramadan-moq-multicast-01 7.2.7) that
+   * delivered the packet, when its endpoint is protected: the key a receiver
+   * was registered under with `registerProvenanceFlow`.
+   */
+  flow?: string;
 }
 
 /** One physical stream: an MMTP packet ID and the catalog track it carries. */
@@ -513,6 +517,32 @@ const NO_BLOCK_SPAN_HORIZON: DuplicateHorizon = Object.freeze({
 });
 
 const DIRECT_RECOVERED_VIDEO_QUEUE_LIMIT = 512;
+
+/**
+ * A governed block's admitted symbols, as fed to its live decoder, and the
+ * unlisted repair pooled for it: what an unlisted-assisted decode runs on
+ * (7.2.7 step 2). Keyed by ESI / RS_ID.
+ */
+interface AssistBlock {
+  readonly ssbLength: number;
+  readonly sources: Map<number, Uint8Array>;
+  readonly repairs: Map<number, Uint8Array>;
+  readonly pooled: Map<number, Uint8Array>;
+}
+// ponytail: FIFO over blocks (they arrive in order); an LRU if blocks interleave.
+const ASSIST_BLOCK_LIMIT = 64;
+/**
+ * Failed unlisted-assisted decodes per block, kept apart from the block record
+ * so evicting and reopening a record never resets the cap.
+ * ponytail: one LRU shared by every governed owner/track, refreshed only on a
+ * failure: a block may fail twice more once 256 other failing blocks (any
+ * track) have aged it out. Per-track ledgers if a multi-track flood matters.
+ */
+const ASSIST_FAILURE_LEDGER_LIMIT = 4 * ASSIST_BLOCK_LIMIT;
+/** 7.2.7 step 2: at most two unlisted-assisted decodes may fail per block. */
+const ASSIST_FAILED_DECODES_MAX = 2;
+const assistKey = (ownerPacketId: number, catalogTrackName: string | undefined, blockStart: number) =>
+  `${ownerPacketId}/${catalogTrackName ?? ""}/${blockStart}`;
 const DIRECT_RECOVERED_AUDIO_QUEUE_LIMIT = 512;
 
 type ParserDiagnostics = {
@@ -558,6 +588,9 @@ export interface FECManagerLike {
     catalogTrackName?: string,
   ): Uint8Array | null;
 
+  /** How long ago the stream's oldest open block with an FEC deadline took its first symbol (optional). */
+  oldestOpenBlockAgeMs?(packetId: number, catalogTrackName: string): number | undefined;
+
   /** A block's RSB_length, from one of its repair symbols (optional). */
   noteRepairGroupLength?(sbn: number, packetId: number, rsbLength: number, catalogTrackName?: string): void;
 
@@ -703,6 +736,14 @@ export interface FECManagerLike {
     catalogTrackName: string | undefined,
     ssId: number,
   ): { sbn: number; esi: number } | null;
+  /** Begin a fresh decode epoch for one stream, dropping what it holds (FECManager.resetTrack). */
+  resetTrack?(packetId: number, catalogTrackName: string): void;
+  /**
+   * Run `fn` with `receivedAtMs` (performance.now() clock) as the receipt
+   * time of the packet it feeds: a block it opens takes that ts, and its
+   * deadlines run from it (fec-01 9, a datagram held and admitted later).
+   */
+  withReceiptTime?(receivedAtMs: number, fn: () => void): void;
   /** iso-ssbg1-v1: hold a first-arrival source until a repair states its block. */
   holdIsoSource?(
     packetId: number,
@@ -804,26 +845,6 @@ export interface FECManagerLike {
 
 // ─── MmtpRouter ─────────────────────────────────────────────────────
 
-export interface ManifestIdentityResolutionInput {
-  packetId: number;
-  sbn: number;
-  esi: number;
-  /**
-   * The packet's SS_ID and its MPU's mpu_sequence_number. Under
-   * iso-ssbg1-v1 blocks vary in length, so a packet's media group comes from
-   * its own MPU header, never from SBN arithmetic (BLO-35597 D2a).
-   */
-  ssId?: number;
-  mpuSequenceNumber?: number;
-  catalogTrackName?: string;
-  recovered: boolean;
-  sourceSymbolFormat: "full-mmtp-packet" | "fec-padded-recovery";
-}
-
-export type ManifestIdentityResolver = (
-  input: ManifestIdentityResolutionInput,
-) => ManifestObjectIdentity | null;
-
 /**
  * Classification evidence carried by one first-arrival network source
  * packet: the MMTP header R bit and the MPU / data-unit identity it states
@@ -860,26 +881,30 @@ export class MmtpRouter {
   readonly #fecManager: FECManagerLike | null;
   #defaultFecMapper: FecBlockMapper | null;
   #fecMappersByPacketId = new Map<number, FecBlockMapper>();
-  readonly #manifestVerifier: ManifestVerifier | null;
-  readonly #ownsManifestVerifier: boolean;
-  readonly #resolveManifestIdentity:
-    | ((
-        packetId: number,
-        sbn: number,
-        esi: number,
-        catalogTrackName?: string,
-      ) => ManifestObjectIdentity | null)
-    | null;
-  readonly #resolveManifestIdentityForRoute: ManifestIdentityResolver | null;
-  #manifestRecoveryQueues = new Map<
+  /** Protected flows: one 7.2.7 receiver each, and the ingress its datagrams arrive with. */
+  readonly #provenance = new Map<
     string,
-    Array<{
-      blockId: number;
-      result: ProcessFecBlockResult;
-      ownerPacketId: number;
-      catalogTrackName?: string;
-    }>
+    { receiver: BcProvenanceV2Receiver; ingress: MmtpIngressContext; protected?: boolean }
   >();
+  #onFlowProtected: ((flow: string) => void) | null = null;
+  #unadmittedListedDrops = 0;
+  #unlistedRepairSetAside = 0;
+  readonly #assistBlocks = new Map<string, AssistBlock>();
+  readonly #assistFailures = new Map<string, number>();
+  #scratchDecoderFactory: ((ownerPacketId: number, catalogTrackName: string | undefined) => WasmFecDecoder | null) | null = null;
+  #unlistedAssistedRecoveries = 0;
+  #unlistedAssistedRefusals = 0;
+  /** The ingress a held datagram arrived with; the receiver returns the same bytes on release. */
+  readonly #heldIngress = new WeakMap<Uint8Array, MmtpIngressContext>();
+  #unicastRepair = false;
+  /** How to route a held unicast (MoQ) datagram once a record admits it. */
+  readonly #heldReplay = new WeakMap<Uint8Array, () => void>();
+  /** When a held datagram was received: admitted later, it keeps that receipt time (fec-01 9). */
+  readonly #heldAt = new WeakMap<Uint8Array, number>();
+  /** The flow whose receiver admitted a stream's source datagrams, by packetId then catalog track name: recovered packets answer to it. */
+  readonly #provenanceStreamFlow = new Map<number, Map<string | undefined, string>>();
+  #unregisteredFlowDrops = 0;
+  #ambiguousRecoveredDrops = 0;
 
   // Temp state set by #processMMTP before calling parser.feed(),
   // read by the parser's onFrame callback for CMAF assembly + dedup.
@@ -986,6 +1011,7 @@ export class MmtpRouter {
     | null = null;
   /** Typed observer of every gap decision the release gate makes. */
   readonly #onFrameGap: ((decision: FrameGapDecision) => void) | null;
+  readonly #fecRapObservers = new Set<(packetId: number, catalogTrackName: string | undefined, ssId: number) => void>();
   // Pokes requested while a packet is being processed are deferred to its
   // end: a synchronous recovery completes its block BEFORE routing the
   // recovered frames, and releasing a held gap in between would strand them.
@@ -1056,16 +1082,6 @@ export class MmtpRouter {
      *  Pass a reader when its inputs are measured later; see
      *  setKeyframeLostTimeoutMs. */
     keyframeLostTimeoutMs?: number | (() => number);
-    manifestVerifier?: ManifestVerifier;
-    /** Existing behavior is router ownership; shared browser plans opt into caller ownership. */
-    manifestVerifierOwnership?: "caller" | "router";
-    resolveManifestIdentity?: (
-      packetId: number,
-      sbn: number,
-      esi: number,
-      catalogTrackName?: string,
-    ) => ManifestObjectIdentity | null;
-    resolveManifestIdentityForRoute?: ManifestIdentityResolver;
     /** Internal terminal-failure sink owned by the composing transport. */
     onBlockFailed?: (
       sbn: number,
@@ -1088,10 +1104,6 @@ export class MmtpRouter {
     this.#fecManager = config?.fecManager ?? null;
     this.#onFrameGap = config?.onFrameGap ?? null;
     this.#defaultFecMapper = config?.fecMapper ?? null;
-    this.#manifestVerifier = config?.manifestVerifier ?? null;
-    this.#ownsManifestVerifier = config?.manifestVerifierOwnership !== "caller";
-    this.#resolveManifestIdentity = config?.resolveManifestIdentity ?? null;
-    this.#resolveManifestIdentityForRoute = config?.resolveManifestIdentityForRoute ?? null;
 
     // Create MMTP parser — handles MFU extraction, reassembly, keyframe detection.
     // Its MFUReassembler is the single reassembler for BOTH the source path
@@ -1822,32 +1834,385 @@ export class MmtpRouter {
     });
   }
 
-  registerManifestTrack(context: ManifestTrackContext): void {
-    if (!this.#manifestVerifier) throw new Error("manifest verifier is not configured");
-    this.#manifestVerifier.registerTrack(context);
+  /**
+   * Protect a flow (draft-ramadan-moq-multicast-01 7.2.7): every multicast
+   * datagram whose ingress names `ingress.flow`, source and repair alike, is
+   * admitted by `receiver` before anything reads it, and an unadmitted one is
+   * held or dropped. The caller owns the receiver's configuration; the router
+   * releases it on `releaseProvenanceFlow` and on dispose.
+   */
+  registerProvenanceFlow(
+    ingress: MmtpIngressContext & { flow: string },
+    receiver: BcProvenanceV2Receiver,
+  ): void {
+    this.#provenance.get(ingress.flow)?.receiver.release();
+    this.#provenance.set(ingress.flow, { receiver, ingress });
+    receiver.keepPendingAgeMs = () => this.#oldestOpenBlockAgeMs(ingress.flow);
+  }
+
+  /**
+   * Declare that this receiver can request unicast repair (a repair FETCH
+   * scheduler is wired): a protected flow then keeps the pending entries of
+   * its open blocks for the repair to consume (7.2.7 step 2).
+   */
+  setUnicastRepair(enabled: boolean): void {
+    this.#unicastRepair = enabled;
+  }
+
+  #oldestOpenBlockAgeMs(flow: string): number | undefined {
+    const entry = this.#provenance.get(flow);
+    if (!this.#unicastRepair || !entry) return undefined;
+    let age: number | undefined;
+    for (const { name, packetId } of entry.ingress.tracks) {
+      const a = name ? this.#fecManager?.oldestOpenBlockAgeMs?.(packetId, name) : undefined;
+      if (a !== undefined && (age === undefined || a > age)) age = a;
+    }
+    return age;
+  }
+
+  /**
+   * Replace a registered flow's ingress (a rendition switch staged, committed
+   * or cancelled) while keeping its receiver; a no-op for an unregistered flow.
+   */
+  updateProvenanceFlowIngress(ingress: MmtpIngressContext & { flow: string }): void {
+    const entry = this.#provenance.get(ingress.flow);
+    if (!entry) return;
+    // A protected flow newly listing a track drops its MoQ copies from now
+    // on (7.2.7). An instance already governed holds only admitted symbols,
+    // which stay admitted (multicast 7.2.7, 1720-1729): only its pooled
+    // unlisted repair is discarded. An instance governed from now on holds
+    // unadmitted symbols, so it is discarded whole.
+    const added = entry.protected
+      ? ingress.tracks.filter(({ name, packetId }) =>
+        name && !entry.ingress.tracks.some((t) => t.name === name && t.packetId === packetId))
+      : [];
+    const governed = added.map(({ packetId }) =>
+      [...(this.#repairOwnersByPacketId.get(packetId) ?? [packetId])].some((owner) => this.#governs(owner)));
+    this.#provenance.set(ingress.flow, { ...entry, ingress });
+    added.forEach(({ name, packetId }, i) => {
+      // ponytail: discards every block's pool, not only the newly listed track's symbols.
+      if (governed[i]) for (const block of this.#assistBlocks.values()) block.pooled.clear();
+      else this.#fecManager?.resetTrack?.(packetId, name!);
+    });
+  }
+
+  /**
+   * Called once per protection of a flow: at the admission that makes this
+   * router's consumers protected under it (7.2.7), after their unadmitted
+   * holdings of its listed tracks are discarded. Again after an unprotect.
+   */
+  onProvenanceFlowProtected(cb: ((flow: string) => void) | null): void {
+    this.#onFlowProtected = cb;
+  }
+
+  /**
+   * The receiver ceased to hold the flow's endpoint on failover (7.2.7): drop
+   * its state and hold queues (no expiry counted) and un-protect its tracks,
+   * which then take MoQ again. The registration stays, so multicast resuming
+   * protects the flow anew at its next admission.
+   */
+  unprotectProvenanceFlow(flow: string): void {
+    const entry = this.#provenance.get(flow);
+    if (!entry) return;
+    entry.receiver.release();
+    entry.protected = false;
+    // ponytail: drops every governed block's record, not only this flow's; per-flow if joins multiply.
+    this.#assistBlocks.clear();
+    this.#assistFailures.clear();
   }
 
-  feedManifestFrame(trackName: string, frame: Uint8Array): void {
-    this.#manifestVerifier?.ingestManifestFrame(trackName, frame);
+  /** MoQ packets of a track a protected flow lists, dropped on its unicast path: duplicate, overflow, or listed by more than one flow. */
+  get unadmittedListedDropCount(): number {
+    return this.#unadmittedListedDrops;
   }
 
-  setManifestAuthMode(mode: ManifestAuthMode): void {
-    this.#manifestVerifier?.setMode(mode);
-    if (mode !== "enforce") {
-      for (const queue of this.#manifestRecoveryQueues.values()) {
-        for (const item of queue) {
-          this.#routeProcessedFecSymbols(
-            item.blockId,
-            item.result,
-            item.ownerPacketId,
-            item.catalogTrackName,
-          );
-        }
+  /** MoQ repair symbols of an unlisted track kept out of a governed FEC instance (7.2.7 step 2). */
+  get unlistedRepairSetAsideCount(): number {
+    return this.#unlistedRepairSetAside;
+  }
+
+  /** Governed blocks recovered with the help of unlisted repair (7.2.7 step 2). */
+  get unlistedAssistedRecoveryCount(): number {
+    return this.#unlistedAssistedRecoveries;
+  }
+
+  /** Unlisted-assisted decodes refused because two already failed for the block (7.2.7 step 2). */
+  get unlistedAssistedRefusalCount(): number {
+    return this.#unlistedAssistedRefusals;
+  }
+
+  /** Unlisted repair symbols pooled now, across every governed block (7.2.7 step 2). */
+  get unlistedPoolSymbolCount(): number {
+    let n = 0;
+    for (const block of this.#assistBlocks.values()) n += block.pooled.size;
+    return n;
+  }
+
+  /**
+   * Wire the decoder an unlisted-assisted decode runs in: a fresh, configured
+   * decoder of the owner's track, used once and discarded, never the live one.
+   * Without it unlisted repair on a governed instance is set aside and dropped.
+   */
+  setScratchFecDecoderFactory(
+    factory: ((ownerPacketId: number, catalogTrackName: string | undefined) => WasmFecDecoder | null) | null,
+  ): void {
+    this.#scratchDecoderFactory = factory;
+    if (!factory) {
+      this.#assistBlocks.clear();
+      this.#assistFailures.clear();
+    }
+  }
+
+  /** Whether a protected flow lists `ownerPacketId`: its FEC instance is governed (7.2.7). */
+  #governs(ownerPacketId: number): boolean {
+    for (const entry of this.#provenance.values()) {
+      if (entry.protected && ingressHasPacketId(entry.ingress, ownerPacketId)) return true;
+    }
+    return false;
+  }
+
+  /**
+   * A MoQ repair symbol no protected flow lists, owned by a source track one
+   * does: its FEC instance is governed (7.2.7 step 2) and takes only admitted
+   * symbols, so the symbol is set aside: pooled for an unlisted-assisted
+   * decode of a block admitted repair already delimits, else dropped. It
+   * never states a block, so the live locator and decoder are unchanged.
+   * Un-listing needs no hook: an unprotected or released flow lists nothing.
+   */
+  #setAsideUnlistedRepair(
+    ownerPacketId: number,
+    catalogTrackName: string | undefined,
+    repair: { ssStart: number; ssbLength: number; rsbLength: number; rsId: number; symbolData: Uint8Array },
+  ): boolean {
+    if (!this.#governs(ownerPacketId)) return false;
+    this.#unlistedRepairSetAside++;
+    const key = assistKey(ownerPacketId, catalogTrackName, repair.ssStart);
+    const block = this.#assistBlocks.get(key);
+    // Pooled only up to the block's length: more never closes a shortfall.
+    if (
+      block !== undefined &&
+      block.ssbLength === repair.ssbLength &&
+      !block.repairs.has(repair.rsId) &&
+      block.pooled.size < block.ssbLength &&
+      repair.symbolData.byteLength === this.#symbolSizeForPacket(ownerPacketId) &&
+      this.#fecManager?.admitRepairBlockLength?.(ownerPacketId, repair.ssbLength, repair.rsbLength, repair.rsId) !== false
+    ) {
+      block.pooled.set(repair.rsId, repair.symbolData);
+      this.#tryAssistedDecode(key, block, ownerPacketId, catalogTrackName, repair.ssStart);
+    }
+    return true;
+  }
+
+  /**
+   * An admitted repair placed a governed block (its SSB_length delimits it):
+   * open the block's record, which the symbols its live decoder takes join.
+   */
+  #openAssistBlock(ownerPacketId: number, catalogTrackName: string | undefined, blockStart: number, ssbLength: number): void {
+    const key = assistKey(ownerPacketId, catalogTrackName, blockStart);
+    if (!this.#scratchDecoderFactory || this.#assistBlocks.has(key) || !this.#governs(ownerPacketId)) return;
+    this.#assistBlocks.set(key, { ssbLength, sources: new Map(), repairs: new Map(), pooled: new Map() });
+    for (const oldest of this.#assistBlocks.keys()) {
+      if (this.#assistBlocks.size <= ASSIST_BLOCK_LIMIT) break;
+      this.#assistBlocks.delete(oldest);
+    }
+  }
+
+  /** A symbol fed to an open governed block's live decoder that did not recover it. */
+  #noteAssistAdmitted(
+    ownerPacketId: number,
+    catalogTrackName: string | undefined,
+    blockStart: number,
+    symbol: { esi: number } | { rsId: number },
+    data: Uint8Array,
+  ): void {
+    const key = assistKey(ownerPacketId, catalogTrackName, blockStart);
+    const block = this.#assistBlocks.get(key);
+    if (block === undefined) return;
+    if ("rsId" in symbol) {
+      block.repairs.set(symbol.rsId, data);
+      block.pooled.delete(symbol.rsId); // an admitted copy wins over an unlisted one
+    } else {
+      block.sources.set(symbol.esi, data);
+    }
+    this.#tryAssistedDecode(key, block, ownerPacketId, catalogTrackName, blockStart);
+  }
+
+  /**
+   * 7.2.7 step 2, phase two: a governed block its admitted symbols cannot
+   * decode (the live decoder already had them all) is decoded in a scratch
+   * decoder from its admitted symbols plus pooled unlisted repair, only as
+   * many as close the shortfall. What it recovers is released only through
+   * admission (#routeRecoveredBlock), so the live decoder is never touched and
+   * a refused recovery leaves the block to fail at its FEC deadline. At most
+   * two such decodes may fail per block; a third is refused.
+   */
+  #tryAssistedDecode(
+    key: string,
+    block: AssistBlock,
+    ownerPacketId: number,
+    catalogTrackName: string | undefined,
+    blockStart: number,
+  ): void {
+    const fec = this.#fecManager;
+    const admitted = block.sources.size + block.repairs.size;
+    if (!fec || block.pooled.size === 0) return;
+    if (admitted >= block.ssbLength || admitted + block.pooled.size < block.ssbLength) return;
+    if (fec.isBlockCompleted(blockStart, ownerPacketId, catalogTrackName)) {
+      this.#assistBlocks.delete(key);
+      return;
+    }
+    if ((this.#assistFailures.get(key) ?? 0) >= ASSIST_FAILED_DECODES_MAX) {
+      this.#unlistedAssistedRefusals++;
+      return;
+    }
+    const decoder = this.#scratchDecoderFactory?.(ownerPacketId, catalogTrackName);
+    if (!decoder) return;
+    let recovered: Uint8Array | null = null;
+    const fed: number[] = [];
+    try {
+      for (const [esi, data] of block.sources) decoder.add_source(serial32Add(blockStart, esi), data, 0);
+      for (const [rsId, data] of block.repairs) {
+        recovered ??= decoder.add_repair(blockStart, block.ssbLength, rsId, data, 0);
+      }
+      // ponytail: exactly the shortfall; a RaptorQ decoder short of K+overhead
+      // fails here, burning one of the two decodes on fresh pooled symbols.
+      for (const [rsId, data] of block.pooled) {
+        if (recovered || fed.length >= block.ssbLength - admitted) break;
+        fed.push(rsId);
+        recovered = decoder.add_repair(blockStart, block.ssbLength, rsId, data, 0);
+      }
+    } catch {
+      recovered = null;
+    } finally {
+      (decoder as { free?(): void }).free?.();
+    }
+    if (recovered && this.#routeRecoveredBlock(blockStart, recovered, ownerPacketId, catalogTrackName, () => {
+      fec.cancelBlockTimeout(blockStart, ownerPacketId, catalogTrackName);
+      fec.countRecovery(ownerPacketId, blockStart, catalogTrackName);
+      fec.markBlockCompleted(blockStart, ownerPacketId, catalogTrackName);
+    })) {
+      this.#unlistedAssistedRecoveries++;
+      this.#assistBlocks.delete(key);
+      return;
+    }
+    // Any failed decode (null, throw, or refused recovery) drops the pooled
+    // symbols it fed: the shortfall cap would otherwise re-feed the same
+    // prefix and the retry fails the same way.
+    for (const rsId of fed) block.pooled.delete(rsId);
+    const failed = (this.#assistFailures.get(key) ?? 0) + 1;
+    this.#assistFailures.delete(key);
+    this.#assistFailures.set(key, failed);
+    for (const oldest of this.#assistFailures.keys()) {
+      if (this.#assistFailures.size <= ASSIST_FAILURE_LEDGER_LIMIT) break;
+      this.#assistFailures.delete(oldest);
+    }
+  }
+
+  /**
+   * The admission that makes this router protected under `flow` (7.2.7):
+   * its FEC instances discard what they hold of the flow's listed tracks so
+   * no unadmitted symbol stands for an admitted one, then notify. Before it
+   * nothing of the flow was admitted, so every such symbol is unadmitted.
+   * The playback parse ledger is kept: it records MoQ copies already played,
+   * not holdings, and clearing it re-emits that media (audio twice).
+   * The FEC reset is the whole 7.2.7 discard here: no keyframe-overlay
+   * instance exists to hold anything (repair-layers.ts is the catalog
+   * contract only, no decoder), and packet_id 0 is never a listed track
+   * (`ingressHasPacketId`), so nothing of it is held for the flow.
+   */
+  #noteFlowAdmitted(flow: string): void {
+    const entry = this.#provenance.get(flow);
+    if (!entry || entry.protected) return;
+    entry.protected = true;
+    for (const { name, packetId } of entry.ingress.tracks) {
+      if (name) this.#fecManager?.resetTrack?.(packetId, name);
+    }
+    this.#onFlowProtected?.(flow);
+  }
+
+  /**
+   * Admit a MoQ datagram of `packetId` on the unicast path of the protected
+   * flow that lists it (7.2.7). `unlisted`: no protected flow lists it, so it
+   * is read as before. A held datagram is routed by `replay` when a record
+   * admits it; one more than one protected flow lists is dropped. So is an
+   * overlap copy: it never enters FEC accounting, so admitting it would leave
+   * its multicast twin a duplicate and the block one symbol short.
+   */
+  #admitUnicast(
+    packetId: number,
+    packet: Uint8Array,
+    replay: () => void,
+    overlapCopy = false,
+  ): "unlisted" | "admitted" | "held" | "dropped" {
+    let receiver: BcProvenanceV2Receiver | undefined;
+    for (const entry of this.#provenance.values()) {
+      if (!entry.protected || !ingressHasPacketId(entry.ingress, packetId)) continue;
+      if (receiver || overlapCopy) {
+        this.#unadmittedListedDrops++;
+        return "dropped";
       }
-      this.#manifestRecoveryQueues.clear();
+      receiver = entry.receiver;
+    }
+    if (!receiver) return "unlisted";
+    const { verdict } = receiver.onDatagram(packet, "unicast");
+    if (verdict === "admitted") return "admitted";
+    if (verdict === "held") {
+      this.#heldReplay.set(packet, replay);
+      this.#heldAt.set(packet, performance.now());
+      return "held";
+    }
+    this.#unadmittedListedDrops++;
+    return "dropped";
+  }
+
+  /**
+   * Feed one bc-provenance record of `flow`: a datagram from `manifestPort`
+   * (`multicast`) or an object of the manifest track (`mirror`). Held
+   * datagrams the record admits are routed before this returns.
+   */
+  feedProvenanceRecord(flow: string, record: Uint8Array, path: BcpV2RecordPath): string {
+    const entry = this.#provenance.get(flow);
+    if (!entry || this.#disposed) return "unregistered";
+    const result = entry.receiver.onRecord(record, path);
+    if (result.admitted.length > 0) {
+      this.#noteFlowAdmitted(flow);
+      this.#withDeferredFecPokes(() => {
+        for (const datagram of result.admitted) {
+          const route = () => {
+            const replay = this.#heldReplay.get(datagram);
+            if (replay) replay();
+            else this.#processMMTP(datagram, "multicast", true, this.#heldIngress.get(datagram) ?? entry.ingress, false, true);
+          };
+          // A datagram held on a miss and admitted now keeps its receipt time
+          // as the block's ts (fec-01 9): its FEC deadline runs from then.
+          const heldAt = this.#heldAt.get(datagram);
+          if (heldAt !== undefined && this.#fecManager?.withReceiptTime) this.#fecManager.withReceiptTime(heldAt, route);
+          else route();
+        }
+      });
+    }
+    return result.verdict;
+  }
+
+  /** The receiver ceased to hold the flow: its hold queues are dropped, not expired. */
+  releaseProvenanceFlow(flow: string): void {
+    this.#provenance.get(flow)?.receiver.release();
+    this.#provenance.delete(flow);
+    for (const byName of this.#provenanceStreamFlow.values()) {
+      for (const [name, bound] of byName) if (bound === flow) byName.delete(name);
     }
   }
 
+  /** Multicast datagrams dropped because their ingress names a flow with no registered receiver. */
+  get unregisteredFlowDropCount(): number {
+    return this.#unregisteredFlowDrops;
+  }
+
+  /** Recovered packets dropped because more than one protected flow could own their stream. */
+  get ambiguousRecoveredDropCount(): number {
+    return this.#ambiguousRecoveredDrops;
+  }
+
   /**
    * Main entry point: feed a raw MMTP packet for processing.
    *
@@ -1865,12 +2230,11 @@ export class MmtpRouter {
   feedPacket(
     packet: Uint8Array,
     source: "multicast" | "moq",
-    manifestIdentity?: ManifestObjectIdentity,
     ingress?: MmtpIngressContext,
   ): void {
     if (this.#disposed) return;
     this.#withDeferredFecPokes(() => {
-      this.#processMMTP(packet, source, manifestIdentity, false, ingress);
+      this.#processMMTP(packet, source, false, ingress);
     });
   }
 
@@ -1906,7 +2270,7 @@ export class MmtpRouter {
   feedOverlapCopy(packet: Uint8Array, ingress?: MmtpIngressContext): void {
     if (this.#disposed) return;
     this.#withDeferredFecPokes(() => {
-      this.#processMMTP(packet, "moq", undefined, false, ingress, true);
+      this.#processMMTP(packet, "moq", false, ingress, true);
     });
   }
 
@@ -1931,6 +2295,7 @@ export class MmtpRouter {
     ownerPacketIdHint: number | undefined,
     catalogTrackName: string | undefined,
     repairTrackName: string | undefined,
+    admitted = false,
   ): void {
     // One header parse per packet, as on the multicast repair branch: mmt-fec's
     // parseRepairPacket() parsed it once more before this parse (BLO-36599).
@@ -1961,6 +2326,17 @@ export class MmtpRouter {
       );
     }
 
+    // Admission keys on the repair track's own packet id: a repair layer no
+    // protected flow lists is an unlisted track (7.2.7), not a datagram of the
+    // flow that lists its owner, where it would be held until expiry. The
+    // flow listing it governs the owner too: a repair flow also lists its
+    // owners' source tracks (#provenanceFor).
+    if (ownerPacketId != null && !admitted) {
+      const admit = this.#admitUnicast(repairPacketId, packet, () =>
+        this.#feedRepairPacket(packet, ownerPacketIdHint, catalogTrackName, repairTrackName, true));
+      if (admit === "held" || admit === "dropped") return;
+      if (admit === "unlisted" && this.#fecManager && this.#setAsideUnlistedRepair(ownerPacketId, catalogTrackName, parsed)) return;
+    }
     if (ownerPacketId != null && this.#fecManager) {
       this.#moqRepairPidCounts[repairPacketId] =
         (this.#moqRepairPidCounts[repairPacketId] || 0) + 1;
@@ -2122,6 +2498,7 @@ export class MmtpRouter {
     const placement = fec.placeIsoRepair(ownerPacketId, catalogTrackName, repair.ssStart, repair.ssbLength);
     if (placement.status !== "placed") return;
     const blockStart = placement.block.start;
+    this.#openAssistBlock(ownerPacketId, catalogTrackName, blockStart, repair.ssbLength);
     if (placement.span !== undefined) {
       this.#replayIsoSources(ownerPacketId, catalogTrackName, placement.span.block.start, placement.span.placed);
     }
@@ -2147,10 +2524,13 @@ export class MmtpRouter {
       catalogTrackName,
     );
     if (recovered && !alreadyCompleted) {
-      fec.cancelBlockTimeout(blockStart, ownerPacketId, catalogTrackName);
-      fec.countRecovery(ownerPacketId, blockStart, catalogTrackName);
-      fec.markBlockCompleted(blockStart, ownerPacketId, catalogTrackName);
-      this.#routeRecoveredBlock(blockStart, recovered, ownerPacketId, catalogTrackName);
+      this.#routeRecoveredBlock(blockStart, recovered, ownerPacketId, catalogTrackName, () => {
+        fec.cancelBlockTimeout(blockStart, ownerPacketId, catalogTrackName);
+        fec.countRecovery(ownerPacketId, blockStart, catalogTrackName);
+        fec.markBlockCompleted(blockStart, ownerPacketId, catalogTrackName);
+      });
+    } else if (!recovered) {
+      this.#noteAssistAdmitted(ownerPacketId, catalogTrackName, blockStart, { rsId: repair.rsId }, repair.symbolData);
     }
   }
 
@@ -2202,11 +2582,13 @@ export class MmtpRouter {
       if (payload.oversized) continue;
       const alreadyCompleted = fec.isBlockCompleted(blockStart, ownerPacketId, catalogTrackName);
       const recovered = fec.feedSourceSymbol(ownerPacketId, ssId, payload.symbolData, catalogTrackName);
+      if (!recovered) this.#noteAssistAdmitted(ownerPacketId, catalogTrackName, blockStart, { esi }, payload.symbolData);
       if (!recovered || alreadyCompleted) continue;
-      fec.cancelBlockTimeout(blockStart, ownerPacketId, catalogTrackName);
-      fec.countRecovery(ownerPacketId, blockStart, catalogTrackName);
-      fec.markBlockCompleted(blockStart, ownerPacketId, catalogTrackName);
-      this.#routeRecoveredBlock(blockStart, recovered, ownerPacketId, catalogTrackName);
+      this.#routeRecoveredBlock(blockStart, recovered, ownerPacketId, catalogTrackName, () => {
+        fec.cancelBlockTimeout(blockStart, ownerPacketId, catalogTrackName);
+        fec.countRecovery(ownerPacketId, blockStart, catalogTrackName);
+        fec.markBlockCompleted(blockStart, ownerPacketId, catalogTrackName);
+      });
     }
   }
 
@@ -2244,10 +2626,14 @@ export class MmtpRouter {
     data: Uint8Array,
     packetId: number,
     catalogTrackName?: string,
-  ): void {
+  ): boolean {
     // A Worker-recovered block arrives here whole: defer the gate's drains
     // until all its frames are in, as the in-band recovery path does.
-    this.#withDeferredFecPokes(() => this.#routeRecoveredBlock(blockId, data, packetId, catalogTrackName));
+    let recovered = false;
+    this.#withDeferredFecPokes(() => {
+      recovered = this.#routeRecoveredBlock(blockId, data, packetId, catalogTrackName);
+    });
+    return recovered;
   }
 
   /** Route a single recovered source symbol through the parser + dedup pipeline.
@@ -2258,10 +2644,10 @@ export class MmtpRouter {
     packetId: number,
     esi = 0,
     catalogTrackName?: string,
-  ): void {
+  ): boolean {
     const blockProfile = this.#blockProfileFor(packetId);
     const result = processFecSymbol(data, { ownerPacketId: packetId, index: esi, blockProfile });
-    this.#routeVerifiedFecSymbols(blockId, result, packetId, catalogTrackName);
+    return this.#routeVerifiedFecSymbols(blockId, result, packetId, catalogTrackName);
   }
 
   // ── Keyframe timer cancellation ─────────────────────────────────
@@ -2298,6 +2684,9 @@ export class MmtpRouter {
       }
     }
     this.#parser.resetTrack(packetId, catalogTrackName);
+    const assistPrefix = assistKey(packetId, catalogTrackName, 0).slice(0, -1);
+    for (const key of this.#assistBlocks.keys()) if (key.startsWith(assistPrefix)) this.#assistBlocks.delete(key);
+    for (const key of this.#assistFailures.keys()) if (key.startsWith(assistPrefix)) this.#assistFailures.delete(key);
     const streamKey = this.#mediaStreamKey(packetId, catalogTrackName);
     this.#trackSynced.delete(streamKey);
     this.#droppedPreSyncVideo.delete(streamKey);
@@ -2310,7 +2699,6 @@ export class MmtpRouter {
     this.#lastDirectSourceAudioCursorByStream.delete(streamKey);
     this.#lastDirectEmittedAudioCursorByStream.delete(streamKey);
     this.#pendingDirectRecoveredAudioByStream.delete(streamKey);
-    this.#manifestRecoveryQueues.delete(streamKey);
     this.#deliveredVideoHighWaterByStream.delete(streamKey);
     this.#stream(packetId, catalogTrackName).duplicates.clear();
     const assemblersToReset = new Set<CmafBlockAssembler>();
@@ -2362,7 +2750,6 @@ export class MmtpRouter {
       this.#lastDirectSourceAudioCursorByStream.delete(key);
       this.#lastDirectEmittedAudioCursorByStream.delete(key);
       this.#pendingDirectRecoveredAudioByStream.delete(key);
-      this.#manifestRecoveryQueues.delete(key);
       this.#trackInitDelivered.delete(key);
       this.#parserDiagnostics.delete(key);
       this.#pendingFecPokes.delete(key);
@@ -2658,8 +3045,9 @@ export class MmtpRouter {
     this.#parserDiagnostics.clear();
     this.#catalogTrackNamesByPacketId.clear();
     this.#repairOwnersByPacketId.clear();
-    if (this.#ownsManifestVerifier) this.#manifestVerifier?.dispose();
-    this.#manifestRecoveryQueues.clear();
+    for (const { receiver } of this.#provenance.values()) receiver.release();
+    this.#provenance.clear();
+    this.#provenanceStreamFlow.clear();
     for (const assembler of this.#mseAssemblers.values()) assembler.dispose();
     this.#mseAssemblers.clear();
   }
@@ -2778,6 +3166,28 @@ export class MmtpRouter {
     return this.#parser.fecReleaseEarliestHeldAtMs(packetId, catalogTrackName);
   }
 
+  /**
+   * Whether a complete RAP above SS_ID `ssId` entered this stream's FEC
+   * release gate (see FecReleaseSequencer.rapAbove).
+   */
+  fecReleaseRapAbove(packetId: number, catalogTrackName: string | undefined, ssId: number): boolean {
+    return this.#parser.fecReleaseRapAbove(packetId, catalogTrackName, ssId);
+  }
+
+  /**
+   * Observe each complete RAP entering an FEC release gate, with the SS_ID
+   * its frame completed in. Called synchronously from the frame push: an
+   * observer that drives FEC state must defer that work.
+   */
+  addFecRapObserver(
+    observer: (packetId: number, catalogTrackName: string | undefined, ssId: number) => void,
+  ): () => void {
+    this.#fecRapObservers.add(observer);
+    return () => {
+      this.#fecRapObservers.delete(observer);
+    };
+  }
+
   #requestFecPoke(packetId: number, catalogTrackName: string | undefined): void {
     if (this.#disposed) return;
     if (this.#fecPokeDepth > 0) {
@@ -2828,6 +3238,10 @@ export class MmtpRouter {
         this.#onFrameGap?.(decision);
         return decision;
       },
+      isRap: (data, meta) => this.#isRapForGap(data, meta),
+      onRap: (packetId, catalogTrackName, ssId) => {
+        for (const observer of this.#fecRapObservers) observer(packetId, catalogTrackName, ssId);
+      },
       onReleased: (data, meta) => {
         if (meta.trackType !== "video" || meta.mpuSequenceNumber === undefined) return;
         const timing = meta.authoredTiming;
@@ -3013,7 +3427,6 @@ export class MmtpRouter {
   #processMMTP(
     packet: Uint8Array,
     source: "multicast" | "moq",
-    manifestIdentity?: ManifestObjectIdentity,
     manifestAdmitted = false,
     ingress?: MmtpIngressContext,
     overlapCopy = false,
@@ -3062,57 +3475,43 @@ export class MmtpRouter {
       this.#classifyPacketId(info.packetId) !== null &&
       this.#configuredBlockProfile(info.packetId) === undefined;
     if (fecUnreadable && !manifestAdmitted) this.#noteUnreadableFecPayloadId(info.packetId, "source");
+    if (source === "multicast" && manifestAdmitted && !info.isRepair && ingress?.flow !== undefined) {
+      let byName = this.#provenanceStreamFlow.get(info.packetId);
+      if (!byName) this.#provenanceStreamFlow.set(info.packetId, (byName = new Map()));
+      byName.set(catalogTrackNameForPacket(ingress, info.packetId), ingress.flow);
+    }
 
-    if (!info.isRepair && this.#manifestVerifier && !manifestAdmitted) {
-      let identity = manifestIdentity;
-      if (!identity && info.fecPayloadId && !fecUnreadable && (this.#resolveManifestIdentityForRoute || this.#resolveManifestIdentity)) {
-        // A source resolves with its block coordinates (SS_Start, ESI), the
-        // pair a recovered symbol of the same block resolves with. SS_ID alone
-        // locates no block (C.5.3): until a repair states this source's block
-        // it has none, its identity stays absent, and the verifier's
-        // missing-identity policy below applies.
-        const catalogTrackName = catalogTrackNameForPacket(ingress, info.packetId);
-        const coordinates = this.#locateFecSource(info.packetId, catalogTrackName, info.fecPayloadId.ssId);
-        identity = coordinates === null ? undefined : (this.#resolveManifestIdentityForRoute
-          ? this.#resolveManifestIdentityForRoute({
-              packetId: info.packetId,
-              sbn: coordinates.sbn,
-              esi: coordinates.esi,
-              ...(catalogTrackName === undefined ? {} : { catalogTrackName }),
-              recovered: false,
-              sourceSymbolFormat: "full-mmtp-packet",
-            })
-          : this.#resolveManifestIdentity!(
-              info.packetId,
-              coordinates.sbn,
-              coordinates.esi,
-              catalogTrackName,
-            )) ?? undefined;
-      }
-      if (identity) {
-        identity = {
-          ...identity,
-          packetId: info.packetId,
-          ...(info.fecPayloadId ? { ssId: info.fecPayloadId.ssId } : {}),
-        };
-        const authenticated = info.fecPayloadId ? packet.subarray(0, packet.length - 4) : packet;
-        // A `stall` admission quarantines the packet and releases it later,
-        // after the stream has moved on; a synchronous release happens inside
-        // admitObject, before this flag is set.
-        let quarantined = false;
-        const admission = this.#manifestVerifier.admitObject(identity, authenticated, () => {
-          if (!this.#disposed) {
-            this.#processMMTP(packet, source, identity, true, ingress, overlapCopy, quarantined);
-          }
-        });
-        quarantined = admission.action === "stall";
+    // A protected flow admits every datagram, repair included, before it is
+    // read (7.2.7): an unadmitted repair symbol never reaches the decoder.
+    if (source === "multicast" && !manifestAdmitted && ingress?.flow !== undefined) {
+      const protectedFlow = this.#provenance.get(ingress.flow);
+      // Named but not registered (before registration, after release): the
+      // flow is protected, so nothing admits this datagram. Fail closed.
+      if (!protectedFlow) {
+        this.#unregisteredFlowDrops++;
+        debugRouter(`[MmtpRouter] Dropping multicast packet pid=${info.packetId}: flow ${ingress.flow} has no receiver`);
         return;
       }
-      if (
-        this.#manifestVerifier.config.mode === "enforce" &&
-        this.#manifestVerifier.config.onMissingManifest === "stall"
-      ) {
-        console.warn(`[MmtpRouter] manifest identity absent; stalling packetId=${info.packetId}`);
+      // Held: released by a record (feedProvenanceRecord) or expired. Duplicate / overflow: dropped.
+      const { verdict } = protectedFlow.receiver.onDatagram(packet, "multicast");
+      if (verdict === "admitted") {
+        this.#noteFlowAdmitted(ingress.flow);
+        this.#processMMTP(packet, source, true, ingress, overlapCopy);
+      }
+      else if (verdict === "held") {
+        this.#heldIngress.set(packet, ingress!);
+        this.#heldAt.set(packet, performance.now());
+      }
+      return;
+    }
+
+    // A MoQ packet of a track a protected flow lists is a datagram of that
+    // flow on its unicast path (7.2.7): admitted before it is read, or held.
+    if (source === "moq" && !manifestAdmitted) {
+      const admit = this.#admitUnicast(info.packetId, packet, () =>
+        this.#processMMTP(packet, source, true, ingress, overlapCopy, true), overlapCopy);
+      if (admit !== "unlisted") {
+        if (admit === "admitted") this.#processMMTP(packet, source, true, ingress, overlapCopy);
         return;
       }
     }
@@ -3127,6 +3526,11 @@ export class MmtpRouter {
         const ownerPacketId = this.#resolveRepairOwnerPacketId(info.packetId, ingress);
         if (ownerPacketId != null && this.#fecManager) {
           if (hasAmbiguousCatalogTrackName(ingress, ownerPacketId)) return;
+          // An unadmitted MoQ symbol reaching here is unlisted (#admitUnicast).
+          if (
+            source === "moq" && !manifestAdmitted &&
+            this.#setAsideUnlistedRepair(ownerPacketId, catalogTrackNameForPacket(ingress, ownerPacketId), repair)
+          ) return;
         this.#repairPidCounts[info.packetId] = (this.#repairPidCounts[info.packetId] || 0) + 1;
         const count = this.#repairPidCounts[info.packetId]!;
         if (count <= 2 || count % 500 === 0) {
@@ -3203,8 +3607,8 @@ export class MmtpRouter {
       // Start a fresh epoch for the stream before this packet is looked up.
       // The reset needs the catalog identity, so a stream without one is not
       // checked; an overlap copy is MoQ bytes and says nothing about the
-      // multicast publisher, and neither does a packet the manifest verifier
-      // quarantined: it predates the horizon because it waited, not because the
+      // multicast publisher, and neither does a packet a provenance hold queue
+      // released: it predates the horizon because it waited, not because the
       // publisher restarted.
       if (
         source === "multicast" &&
@@ -3433,37 +3837,30 @@ export class MmtpRouter {
               sourceFec.symbolData,
               catalogTrackName,
             );
-        if (recovered) {
-          if (!alreadyCompleted && this.#classifyPacketId(info.packetId) !== null) {
-            if (catalogTrackName === undefined) {
-              this.#fecManager.cancelBlockTimeout(sourceFec.sbn, info.packetId);
-            } else {
-              this.#fecManager.cancelBlockTimeout(
-                sourceFec.sbn,
-                info.packetId,
-                catalogTrackName,
-              );
-            }
-          }
-          // Only route recovered blocks that needed actual repair.
-          if (!alreadyCompleted) {
-            this.#fecManager.countRecovery(info.packetId, sourceFec.sbn, catalogTrackName);
+        if (!recovered) {
+          this.#noteAssistAdmitted(
+            info.packetId, catalogTrackName, sourceFec.sbn,
+            { esi: serial32Distance(sourceFec.sbn, sourceFec.ssId) }, sourceFec.symbolData,
+          );
+        }
+        // Only route recovered blocks that needed actual repair; complete
+        // one only once admission has released its recovered packets.
+        if (recovered && !alreadyCompleted) {
+          const fec = this.#fecManager;
+          const sbn = sourceFec.sbn;
+          const packetId = info.packetId;
+          const tracked = this.#classifyPacketId(packetId) !== null;
+          this.#routeRecoveredBlock(sbn, recovered, packetId, catalogTrackName, () => {
             if (catalogTrackName === undefined) {
-              this.#fecManager.markBlockCompleted(sourceFec.sbn, info.packetId);
+              if (tracked) fec.cancelBlockTimeout(sbn, packetId);
+              fec.countRecovery(packetId, sbn, catalogTrackName);
+              fec.markBlockCompleted(sbn, packetId);
             } else {
-              this.#fecManager.markBlockCompleted(
-                sourceFec.sbn,
-                info.packetId,
-                catalogTrackName,
-              );
+              if (tracked) fec.cancelBlockTimeout(sbn, packetId, catalogTrackName);
+              fec.countRecovery(packetId, sbn, catalogTrackName);
+              fec.markBlockCompleted(sbn, packetId, catalogTrackName);
             }
-            this.#routeRecoveredBlock(
-              sourceFec.sbn,
-              recovered,
-              info.packetId,
-              catalogTrackName,
-            );
-          }
+          });
         }
       }
     }
@@ -4068,7 +4465,8 @@ export class MmtpRouter {
     recovered: Uint8Array,
     ownerPacketId?: number,
     catalogTrackName?: string,
-  ): void {
+    complete?: () => void,
+  ): boolean {
     // MMTP path: use processFecBlock for MMTP-wrapped recovery.
     // Recovered symbols are individual MMTP packets that may be fragments
     // (FI=1/2/3) of a larger MFU.  Route through the reassembler so
@@ -4092,118 +4490,83 @@ export class MmtpRouter {
       ownerPacketId,
       blockProfile,
     });
-    this.#routeVerifiedFecSymbols(blockId, result, ownerPacketId, catalogTrackName);
+    return this.#routeVerifiedFecSymbols(blockId, result, ownerPacketId, catalogTrackName, complete);
   }
 
+  /**
+   * A recovered source packet of a protected flow is admitted on its own
+   * digest: its bytes with the SS_ID it was sent with (SS_Start + ESI)
+   * appended are the datagram the record listed (7.2.7). One that no record
+   * lists is dropped; holding it would let it out later as a multicast arrival.
+   * Returns whether the decode recovered the block: every packet it yields
+   * that this router has not parsed already is admitted. A block one of whose
+   * recovered packets is refused is unrecovered (7.2.7): its caller leaves it
+   * open, so it reaches its FEC deadline and fails by class. Always true
+   * outside a protected flow.
+   */
   #routeVerifiedFecSymbols(
     blockId: number,
     result: ProcessFecBlockResult,
     ownerPacketId?: number,
     catalogTrackName?: string,
-  ): void {
-    if (!this.#manifestVerifier || ownerPacketId == null) {
-      this.#routeProcessedFecSymbols(blockId, result, ownerPacketId, catalogTrackName);
-      return;
-    }
-    if (!this.#resolveManifestIdentity && !this.#resolveManifestIdentityForRoute) {
-      console.warn(`[MmtpRouter] manifest identity resolver unavailable; recovered media is fail-open for packetId=${ownerPacketId} block=${blockId}`);
-      this.#routeProcessedFecSymbols(blockId, result, ownerPacketId, catalogTrackName);
-      return;
+    complete?: () => void,
+  ): boolean {
+    const receiver = ownerPacketId == null ? undefined : this.#provenanceFor(ownerPacketId, catalogTrackName);
+    let recovered = true;
+    if (receiver) {
+      const parsed = this.#stream(ownerPacketId!, catalogTrackName).duplicates.parsedSymbols;
+      result = {
+        ...result,
+        symbols: result.symbols.filter((sym) => {
+          const ssId = this.#fecAnchorForRecovered(blockId, sym.index);
+          // A received copy was admitted on arrival; its recovered twin is a duplicate.
+          if (parsed.has(ssId)) return false;
+          let admitted = false;
+          if (receiver === "ambiguous") {
+            this.#ambiguousRecoveredDrops++;
+          } else {
+            const wire = new Uint8Array(sym.rawSymbol.byteLength + 4);
+            wire.set(sym.rawSymbol);
+            new DataView(wire.buffer).setUint32(sym.rawSymbol.byteLength, ssId);
+            admitted = receiver.admitRecovered(wire);
+          }
+          if (!admitted) recovered = false;
+          return admitted;
+        }),
+      };
     }
-    const queueKey = this.#mediaStreamKey(ownerPacketId, catalogTrackName);
-    const queue = this.#manifestRecoveryQueues.get(queueKey) ?? [];
-    queue.push({ blockId, result, ownerPacketId, catalogTrackName });
-    this.#manifestRecoveryQueues.set(queueKey, queue);
-    if (queue.length > 1) return;
-    const drain = (): void => {
-      const next = queue[0];
-      if (!next) {
-        this.#manifestRecoveryQueues.delete(queueKey);
-        return;
-      }
-      this.#admitRecoveredResult(
-        next.blockId,
-        next.result,
-        next.ownerPacketId,
-        next.catalogTrackName,
-        () => {
-          queue.shift();
-          drain();
-        },
-      );
-    };
-    drain();
+    if (recovered) complete?.();
+    this.#routeProcessedFecSymbols(blockId, result, ownerPacketId, catalogTrackName);
+    return recovered;
   }
 
-  #admitRecoveredResult(
-    blockId: number,
-    result: ProcessFecBlockResult,
-    ownerPacketId: number,
+  /**
+   * The receiver a recovered packet of `packetId` answers to: the flow that
+   * admitted the stream's source datagrams. Before any was admitted, the one
+   * flow whose registration lists the stream; more than one (a repair flow
+   * also lists its owners' source tracks) cannot be told apart, so none.
+   */
+  #provenanceFor(
+    packetId: number,
     catalogTrackName: string | undefined,
-    done: () => void,
-  ): void {
-    const verifier = this.#manifestVerifier;
-    const resolveIdentity = this.#resolveManifestIdentity;
-    const resolveIdentityForRoute = this.#resolveManifestIdentityForRoute;
-    if (!verifier) {
-      this.#routeProcessedFecSymbols(blockId, result, ownerPacketId, catalogTrackName);
-      done();
-      return;
-    }
-    if (!resolveIdentity && !resolveIdentityForRoute) throw new Error("manifest identity resolver disappeared during admission");
-    const symbols = result.symbols;
-    const admitNext = (index: number): void => {
-      const symbol = symbols[index];
-      if (!symbol) {
-        done();
-        return;
-      }
-      const identity = resolveIdentityForRoute
-        ? resolveIdentityForRoute({
-            packetId: ownerPacketId,
-            sbn: blockId,
-            esi: symbol.index,
-            ...(catalogTrackName === undefined ? {} : { catalogTrackName }),
-            recovered: true,
-            sourceSymbolFormat: "fec-padded-recovery",
-          })
-        : resolveIdentity!(ownerPacketId, blockId, symbol.index, catalogTrackName);
-      if (!identity) {
-        console.warn(`[MmtpRouter] manifest identity unresolved; recovered symbol is fail-open for packetId=${ownerPacketId} block=${blockId} esi=${symbol.index}`);
-        this.#routeProcessedFecSymbols(
-          blockId,
-          { ...result, symbols: [symbol] },
-          ownerPacketId,
-          catalogTrackName,
-        );
-        admitNext(index + 1);
-        return;
+  ): BcProvenanceV2Receiver | "ambiguous" | undefined {
+    // A caller that names no track matches every name the packet id was admitted under.
+    const byName = this.#provenanceStreamFlow.get(packetId);
+    const flows = new Set(
+      catalogTrackName === undefined || !byName
+        ? byName?.values()
+        : byName.has(catalogTrackName) ? [byName.get(catalogTrackName)!] : [],
+    );
+    if (flows.size > 1) return "ambiguous";
+    for (const bound of flows) return this.#provenance.get(bound)?.receiver ?? "ambiguous";
+    let match: BcProvenanceV2Receiver | undefined;
+    for (const { receiver, ingress } of this.#provenance.values()) {
+      if (ingress.tracks.some((t) => t.packetId === packetId && (catalogTrackName === undefined || t.name === catalogTrackName))) {
+        if (match) return "ambiguous";
+        match = receiver;
       }
-      const admission = verifier.admitObject(
-        {
-          ...identity,
-          packetId: ownerPacketId,
-        },
-        symbol.rawSymbol,
-        () => {
-          if (!this.#disposed) {
-            this.#routeProcessedFecSymbols(
-              blockId,
-              { ...result, symbols: [symbol] },
-              ownerPacketId,
-              catalogTrackName,
-            );
-          }
-          admitNext(index + 1);
-        },
-        // A stalled symbol that is later discarded instead of played must still
-        // advance this loop; enforce mode never calls the release callback for
-        // it (BLO-30095).
-        () => admitNext(index + 1),
-      );
-      if (admission.action === "drop") admitNext(index + 1);
-    };
-    admitNext(0);
+    }
+    return match;
   }
 
   #routeProcessedFecSymbols(