@blockcast/mmt-container 0.4.1 → 0.5.0-main.34c7b9c2cfa0

package/src/multicast-manager.ts

@@ -38,12 +38,12 @@ import type {
   RepairPriorityReason,
   RepairSendMeasurement,
   RepairSkipReason,
+  RepairStopReason,
   RepairSubscribeCallback,
 } from "./repair-fetch.js";
 import {
   MmtpRouter,
   type FrameCallback,
-  type ManifestIdentityResolver,
   type MmtpIngressContext,
   type MmtpStreamIdentity,
   type StagedStreamSwitch,
@@ -56,8 +56,11 @@ import {
   type MulticastFailbackReason,
   type MulticastJoinOutcome,
   type MulticastJoinStats,
+  type MulticastTransportConfig,
 } from "./multicast-transport.js";
 import { computeFecDeliveryWindowMs } from "./track-session.js";
+import { BcProvenanceV2Receiver, type BcpV2ReceiverConfig } from "@blockcast/mmt-manifest-verify";
+import type { ResolvedMulticastAuthConfig, ResolvedMulticastAuthFlow } from "./multicast-auth-catalog.js";
 import { DEFAULT_AMT_RELAY_PORT } from "./catalog-network-source.js";
 import { deriveFecInterleaveDepth, FecBlockMapper } from "@blockcast/mmt-fec";
 import type {
@@ -68,10 +71,6 @@ import type {
 } from "@blockcast/fec-worker";
 import type { MfuReassemblerBackend } from "./mfu-reassembler.js";
 import type { MfuReassemblyPolicy } from "./mfu-reassembly-policy.js";
-import type {
-  ManifestObjectIdentity,
-  ManifestVerifier,
-} from "@blockcast/mmt-manifest-verify";
 import type {
   BlockAssemblerConfig,
   CmafBlockSample,
@@ -104,6 +103,8 @@ export interface MulticastRepairEndpoint {
   repairOwners: ReadonlyArray<{ packetId: number; ownerPacketId: number }>;
   /** Ingress tracks: the owners' source tracks and the repair tracks. */
   tracks: MmtpIngressContext["tracks"];
+  /** The protected flow (`MmtpRouter.registerProvenanceFlow`) this group's datagrams belong to. */
+  flow?: string;
 }
 
 /**
@@ -116,8 +117,32 @@ export type MulticastRepairSubscribe = (
   onPacket: (packet: Uint8Array) => void,
 ) => (() => void) | Promise<() => void>;
 
+/**
+ * A protected endpoint's join (draft -01 7.2.7): the keys and flow
+ * `resolveMulticastAuthCatalog` resolved for it. The join registers the flow
+ * with the router and subscribes `manifestPort` on the same `(S, G)` beside
+ * the media, so every media datagram is admitted by a record before it is read.
+ */
+export interface MulticastProvenanceJoin {
+  auth: Pick<ResolvedMulticastAuthConfig, "keys" | "minEpoch">;
+  flow: ResolvedMulticastAuthFlow;
+  /** Receiver options beyond the catalog's (ctx, clock, freshness, W, lead). */
+  receiver?: Omit<Partial<BcpV2ReceiverConfig>, "endpoint" | "keys" | "minEpoch" | "bandwidth" | "maxAuthDelayMs" | "manifestTimerMs">;
+}
+
 export interface MulticastEndpointConfig {
-  sourceAddress: string;
+  /** SSM source; omitted on ASM. */
+  sourceAddress?: string;
+  /** ASM sender filter: `auth.senderAddress` of a protected ASM endpoint. Never beside `sourceAddress`. */
+  senderAddress?: string;
+  /**
+   * Present on a protected endpoint: the join admits through bc-provenance v2.
+   * From its first admission (`onProtected`) MoQ copies of the listed tracks
+   * are dropped until the media transport fails back (silence or a
+   * subscription error); the manager un-protects then whether or not a player
+   * registered `onFailback`.
+   */
+  provenance?: MulticastProvenanceJoin;
   groupAddress: string;
   port: number;
   /** Explicit gateway transport policy. Omitted means gateway-selected auto mode. */
@@ -190,15 +215,6 @@ export interface MulticastManagerOptions {
   reassemblyPolicy?: MfuReassemblyPolicy;
   reassembler?: MfuReassemblerBackend;
   maxBufferedMfus?: number;
-  manifestVerifier?: ManifestVerifier;
-  manifestVerifierOwnership?: "caller" | "router";
-  resolveManifestIdentity?: (
-    packetId: number,
-    sbn: number,
-    esi: number,
-    catalogTrackName?: string,
-  ) => ManifestObjectIdentity | null;
-  resolveManifestIdentityForRoute?: ManifestIdentityResolver;
   /**
    * Also write every repair lifecycle event to the console as one
    * `REPAIR_LIFECYCLE_LOG_PREFIX` JSON line. Off unless asked for: the lines
@@ -296,11 +312,13 @@ interface ActiveRenditionSwitch {
   state: RenditionSwitchState;
 }
 
-function freezeIngress(tracks: Iterable<Readonly<{ name: string; packetId: number }>>): MmtpIngressContext {
+/** `flow` is the live join's protected flow: every ingress a switch installs keeps it, or the router reads media unauthenticated. */
+function freezeIngress(tracks: Iterable<Readonly<{ name: string; packetId: number }>>, flow: string | undefined): MmtpIngressContext {
   return Object.freeze({
     tracks: Object.freeze(
       [...tracks].map(({ name, packetId }) => Object.freeze({ name, packetId })),
     ),
+    ...(flow === undefined ? {} : { flow }),
   });
 }
 
@@ -341,6 +359,9 @@ interface RepairSymbolCounts {
  *   the deadline) so a harness reads the budget instead of inferring it.
  * - `repair-preempted` / `repair-deferred`: the scheduler aborted a delta
  *   repair for keyframe work, or never ran it before its block resolved.
+ * - `repair-stopped`: the scheduler ended a running repair FETCH (its
+ *   transport cancels it on the wire) and why; `moot` is a RAP above the
+ *   block that arrived complete first (draft-ramadan-moq-fec 11.4.2).
  * - `repair-priority`: the catalog could not supply the SUBSCRIBER_PRIORITY a
  *   repair FETCH must carry (draft-ramadan-moq-fec §11.4.5), so the FETCH was
  *   sent without the parameter (`omitted`, keyframe/unknown blocks) or not
@@ -418,6 +439,12 @@ export type RepairLifecycleEvent =
       readonly rttMs: number | null;
       readonly budgetMs: number;
     }
+  | {
+      readonly version: 2;
+      readonly type: "repair-stopped";
+      readonly block: RepairBlockIdentity;
+      readonly reason: RepairStopReason;
+    }
   | {
       readonly version: 2;
       readonly type: "repair-priority";
@@ -488,6 +515,18 @@ export interface BlockPolicyStats {
    * §7.5 anchor (no epoch reference, or none it could be extended from).
    */
   repairsSkippedRangeNoAnchor: number;
+  /**
+   * `repairsSkipped` by reason: the block's repair group could not complete
+   * it (sources + RSB_length < K'), so no FETCH was sent.
+   */
+  repairsSkippedGroupCannotComplete: number;
+  /**
+   * `repairsSkipped` by reason: a keyframe-bearing block lay below a RAP
+   * that had already arrived complete (draft-ramadan-moq-fec 11.4.2).
+   */
+  repairsSkippedMootRap: number;
+  /** Running repair FETCHes the scheduler stopped, by reason (`repair-stopped`). */
+  repairStops: Record<RepairStopReason, number>;
   /**
    * The most recent skip: its reason, the measured RTT (null when
    * unmeasured), the time that was left to the deadline, and the request's
@@ -549,6 +588,9 @@ function newBlockPolicyStats(
     repairsSkippedRttExceedsBudget: 0,
     repairsSkippedPresentationDelayUnavailable: 0,
     repairsSkippedRangeNoAnchor: 0,
+    repairsSkippedGroupCannotComplete: 0,
+    repairsSkippedMootRap: 0,
+    repairStops: { preempted: 0, reprioritized: 0, expired: 0, resolved: 0, reset: 0, disposed: 0, moot: 0 },
     lastRepairSkip: null,
     keyframeRepairFetchesSent: 0,
     rangeRepairFetchesSent: 0,
@@ -701,6 +743,18 @@ const REPAIR_SKIP_REASONS: ReadonlySet<unknown> = new Set([
   "rtt-unmeasured",
   "rtt-exceeds-budget",
   "presentation-delay-unavailable",
+  "range-no-anchor",
+  "group-cannot-complete",
+  "moot-rap",
+]);
+const REPAIR_STOP_REASONS: ReadonlySet<unknown> = new Set([
+  "preempted",
+  "reprioritized",
+  "expired",
+  "resolved",
+  "reset",
+  "disposed",
+  "moot",
 ]);
 const REPAIR_DEADLINE_BOUNDS: ReadonlySet<unknown> = new Set(["wait", "presentation", "keyframe", "retention"]);
 const GAP_REASONS: Readonly<Record<string, "stall" | "conceal">> = {
@@ -815,6 +869,12 @@ export function isRepairLifecycleEvent(
         isNullableNonNegative(value["rttMs"]) &&
         isFiniteNumber(value["budgetMs"])
       );
+    case "repair-stopped":
+      return (
+        hasExactKeys(value, ["version", "type", "block", "reason"]) &&
+        isRepairBlockIdentity(block) &&
+        REPAIR_STOP_REASONS.has(value["reason"])
+      );
     case "repair-priority": {
       const blockClass = value["blockClass"];
       const action = value["action"];
@@ -1048,7 +1108,11 @@ export interface MultiTrackCatalog {
   tracks: MultiTrackCatalogTrack[];
 }
 
-/** Creates one stateful synchronous FEC decoder per physical catalog stream. */
+/**
+ * Creates one stateful synchronous FEC decoder per physical catalog stream.
+ * Every call must return a new decoder: a governed instance also calls it for
+ * one-shot scratch decoders, which the router frees after use.
+ */
 export type WasmFecDecoderFactory = (
   track: Readonly<MultiTrackCatalogTrack>,
 ) => WasmFecDecoder;
@@ -1211,6 +1275,10 @@ export class MulticastManager {
   readonly #router: MmtpRouter;
   #hostMfuTimeoutMs: number | null;
   readonly #transport: MulticastTransport<MmtpIngressContext>;
+  /** The protected flow of the current join and its manifestPort subscription. */
+  #provenanceJoin: { flow: string; manifest: MulticastTransport } | null = null;
+  #onFailback: ((reason: MulticastFailbackReason) => void) | null = null;
+  #failbackHooked = false;
   /** Live joinRepairEndpoints() releases → the repair owners they registered,
    *  re-applied after configureMultiTrack() clears catalog-derived owners. */
   readonly #repairReleases = new Map<() => void, MulticastRepairEndpoint["repairOwners"]>();
@@ -1276,10 +1344,6 @@ export class MulticastManager {
       reassemblyPolicy: options?.reassemblyPolicy,
       reassembler: options?.reassembler,
       maxBufferedMfus: options?.maxBufferedMfus,
-      manifestVerifier: options?.manifestVerifier,
-      manifestVerifierOwnership: options?.manifestVerifierOwnership,
-      resolveManifestIdentity: options?.resolveManifestIdentity,
-      resolveManifestIdentityForRoute: options?.resolveManifestIdentityForRoute,
       // The router has reset its own state for the stream; reset the rest.
       onPublisherRestart: (packetId, catalogTrackName) => {
         this.#resetStreamOutsideRouter(packetId, catalogTrackName);
@@ -1326,7 +1390,7 @@ export class MulticastManager {
     });
     this.#hostMfuTimeoutMs = this.#router.reassembler.timeoutMs;
     this.#transport = new MulticastTransport<MmtpIngressContext>((packet, ingress) => {
-      this.#router.feedPacket(packet, "multicast", undefined, ingress);
+      this.#router.feedPacket(packet, "multicast", ingress);
     });
     // Each joined subscription declares how it delivers packets. An ordered
     // relay decides FEC block fate by stream order instead of the datagram
@@ -1343,17 +1407,9 @@ export class MulticastManager {
       const recovered = new Uint8Array(data);
       const catalogTrackName = recoveredTrackName
         ?? this.#fec.catalogTrackNameForBlock(sbn, packetId);
-      if (catalogTrackName === undefined) {
-        this.#router.routeRecoveredSymbol(sbn, recovered, packetId, meta.esi);
-      } else {
-        this.#router.routeRecoveredSymbol(
-          sbn,
-          recovered,
-          packetId,
-          meta.esi,
-          catalogTrackName,
-        );
-      }
+      return catalogTrackName === undefined
+        ? this.#router.routeRecoveredSymbol(sbn, recovered, packetId, meta.esi)
+        : this.#router.routeRecoveredSymbol(sbn, recovered, packetId, meta.esi, catalogTrackName);
     };
 
     // D-28: release the in-flight repair slot when a repair-requested block
@@ -1438,6 +1494,11 @@ export class MulticastManager {
   get router(): MmtpRouter {
     return this.#router;
   }
+  /** Repair FETCH wiring (wireRepairFetch): this manager can request unicast repair. */
+  setUnicastRepair(enabled: boolean): void {
+    this.#router.setUnicastRepair(enabled);
+  }
+
   get transport(): MulticastTransport<MmtpIngressContext> {
     return this.#transport;
   }
@@ -2028,8 +2089,36 @@ export class MulticastManager {
   onTakeover(cb: () => void) {
     this.#transport.onTakeover(cb);
   }
+  /** Failback un-protects the join's flow (7.2.7 failover), so the fallback's MoQ packets are read. */
   onFailback(cb: (reason: MulticastFailbackReason) => void) {
-    this.#transport.onFailback(cb);
+    this.#onFailback = cb;
+    this.#hookFailback();
+  }
+
+  /**
+   * Install the manager's own failback listener on the media transport, which
+   * arms its silence watchdog: a protected join un-protects on failover even
+   * when no player listens, else its tracks' MoQ copies stay dropped.
+   */
+  #hookFailback(): void {
+    if (this.#failbackHooked) return;
+    this.#failbackHooked = true;
+    this.#transport.onFailback((reason) => {
+      const joined = this.#provenanceJoin;
+      if (joined !== null) this.#router.unprotectProvenanceFlow(joined.flow);
+      this.#onFailback?.(reason);
+    });
+  }
+  /**
+   * A protected join's handoff (draft -01 7.2.7), before `onTakeover`: its
+   * first admitted datagram. MoQ copies of the flow's tracks the router still
+   * held unadmitted are discarded, and later ones are dropped. Fires again
+   * after a failback once multicast resumes.
+   */
+  onProtected(cb: (() => void) | null) {
+    this.#router.onProvenanceFlowProtected(cb && ((flow) => {
+      if (this.#provenanceJoin?.flow === flow) cb();
+    }));
   }
   /** See MulticastTransport.onDataPlaneLive: the join's first accepted packet. */
   onDataPlaneLive(cb: () => void) {
@@ -2047,6 +2136,17 @@ export class MulticastManager {
   }
 
   async join(config: MulticastEndpointConfig): Promise<boolean> {
+    const provenanceFlow = config.provenance?.flow;
+    if (
+      provenanceFlow !== undefined &&
+      ((config.sourceAddress ?? config.senderAddress) !== provenanceFlow.source ||
+        config.groupAddress !== provenanceFlow.groupAddress ||
+        config.port !== provenanceFlow.port)
+    ) {
+      throw new RangeError(
+        "[MulticastManager] join: provenance flow (S, G, port) must match sourceAddress ?? senderAddress, groupAddress and port",
+      );
+    }
     // A join replaces the admission a staged switch was built on. The new
     // join's config decides what is admitted, so nothing is restored or
     // retired here: the switch just ends.
@@ -2071,22 +2171,27 @@ export class MulticastManager {
       : selectedPacketIds === null
         ? undefined
         : [...selectedPacketIds].map((packetId) => ({ name: "", packetId }));
-    const ingress = ingressTracks === undefined
+    this.#releaseProvenanceJoin();
+    const provenance = config.provenance;
+    const protectedTracks = ingressTracks ?? provenance?.flow.tracks;
+    const ingress: MmtpIngressContext | undefined = protectedTracks === undefined
       ? undefined
       : {
           tracks: Object.freeze(
-            ingressTracks.map(({ name, packetId }) =>
+            protectedTracks.map(({ name, packetId }) =>
               Object.freeze({ name, packetId }),
             ),
           ),
+          ...(provenance === undefined ? {} : { flow: multicastProvenanceFlowKey(provenance.flow) }),
         };
     // The single relay inlet: the player/UI override, or the catalog's
     // `multicast.networkSource[{type:"amt"}]` relay, which
     // `endpointToMulticastConfig` (packages/transport
     // multicast-catalog-policy.ts) resolves into `amtRelay` via `findAmtRelay`.
     const amtRelay = config.amtRelay;
-    const transportConfig = {
+    const transportConfig: MulticastTransportConfig = {
       sourceAddress: config.sourceAddress,
+      senderAddress: config.senderAddress,
       groupAddress: config.groupAddress,
       port: config.port,
       mode: config.mode,
@@ -2116,9 +2221,70 @@ export class MulticastManager {
       packetIds: config.packetIds,
       tracks: catalogTracks?.map(({ name, packetId }) => ({ name, packetId })),
     };
-    return ingress === undefined
+    if (provenance !== undefined) this.#joinProvenance(provenance, ingress as MmtpIngressContext & { flow: string }, transportConfig);
+    const protectedJoin = this.#provenanceJoin;
+    const joined = await (ingress === undefined
       ? this.#transport.join(transportConfig)
-      : this.#transport.join(transportConfig, ingress);
+      : this.#transport.join(transportConfig, ingress));
+    // No media: leave the manifest subscription and release the flow now, not at the next join.
+    if (!joined && protectedJoin !== null && this.#provenanceJoin === protectedJoin) this.#releaseProvenanceJoin();
+    return joined;
+  }
+
+  /**
+   * Register the protected flow and subscribe its `manifestPort` on the same
+   * `(S, G)` with its own listener (draft -01 7.2.7), so records reach the
+   * flow's receiver and media datagrams are held until one admits them. A
+   * manifest subscription that fails to join admits nothing: the media is
+   * held and expires, never read unauthenticated.
+   */
+  #joinProvenance(
+    provenance: MulticastProvenanceJoin,
+    ingress: MmtpIngressContext & { flow: string },
+    media: MulticastTransportConfig,
+  ): void {
+    const { flow, auth } = provenance;
+    const receiver = new BcProvenanceV2Receiver({
+      ...provenance.receiver,
+      // The caller's ctx when it passes one, else the catalog's: an explicit
+      // `catalogCtx: undefined` must not switch off the 7.2.4 ctx check.
+      catalogCtx: provenance.receiver?.catalogCtx ?? flow.ctx,
+      endpoint: {
+        sourceAddress: flow.source,
+        groupAddress: flow.groupAddress,
+        port: flow.port,
+        manifestPort: flow.manifestPort,
+        streamId: flow.streamId,
+      },
+      keys: auth.keys,
+      minEpoch: auth.minEpoch,
+      bandwidth: flow.bandwidth,
+      maxAuthDelayMs: flow.maxAuthDelayMs,
+      manifestTimerMs: flow.manifestTimerMs,
+    });
+    this.#router.registerProvenanceFlow(ingress, receiver);
+    this.#hookFailback();
+    const manifest = new MulticastTransport((record) => {
+      if (this.#provenanceJoin?.manifest === manifest) {
+        this.#router.feedProvenanceRecord(ingress.flow, record, "multicast");
+      }
+    });
+    this.#provenanceJoin = { flow: ingress.flow, manifest };
+    const { packetIds: _packetIds, tracks: _tracks, ...path } = media;
+    void manifest.join({ ...path, port: flow.manifestPort }).then((joined) => {
+      if (!joined && this.#provenanceJoin?.manifest === manifest) {
+        console.warn(`[MulticastManager] manifestPort ${flow.groupAddress}:${flow.manifestPort} not joined`, manifest.lastJoinOutcome);
+      }
+    });
+  }
+
+  /** Un-protect: drop the flow's hold queues (no expiry counted) and leave its manifestPort. */
+  #releaseProvenanceJoin(): void {
+    const joined = this.#provenanceJoin;
+    if (joined === null) return;
+    this.#provenanceJoin = null;
+    joined.manifest.dispose();
+    this.#router.releaseProvenanceFlow(joined.flow);
   }
 
   /**
@@ -2153,9 +2319,10 @@ export class MulticastManager {
     for (const endpoint of endpoints) {
       const ingress: MmtpIngressContext = {
         tracks: Object.freeze(endpoint.tracks.map(({ name, packetId }) => Object.freeze({ name, packetId }))),
+        ...(endpoint.flow === undefined ? {} : { flow: endpoint.flow }),
       };
       const onPacket = (packet: Uint8Array) => {
-        if (!released) this.#router.feedPacket(packet, "multicast", undefined, ingress);
+        if (!released) this.#router.feedPacket(packet, "multicast", ingress);
       };
       const fail = (error: unknown) =>
         console.warn(`[MulticastManager] repair group ${endpoint.group}:${endpoint.port} not joined`, error);
@@ -2323,7 +2490,7 @@ export class MulticastManager {
     for (const track of [...live.tracks, ...request.tracks]) {
       stagedTracks.set(`${track.packetId}\0${track.name}`, track);
     }
-    const stagedIngress = freezeIngress(stagedTracks.values());
+    const stagedIngress = freezeIngress(stagedTracks.values(), live.flow);
     const stagedPacketIds =
       committedPacketIds === undefined || livePacketIds === null
         ? null
@@ -2338,7 +2505,7 @@ export class MulticastManager {
       liveIngress: live,
       livePacketIds,
       widened,
-      committedIngress: freezeIngress(request.tracks),
+      committedIngress: freezeIngress(request.tracks, live.flow),
       committedPacketIds,
       router: null,
       state: "staged",
@@ -2352,7 +2519,7 @@ export class MulticastManager {
     let widening: Promise<void> | undefined;
     try {
       if (widened) widening = this.#transport.setPacketIds([...stagedPacketIds!]);
-      this.#transport.setContext(stagedIngress);
+      this.#setSwitchIngress(stagedIngress);
     } catch (error) {
       active.router.cancel();
       throw error;
@@ -2374,6 +2541,12 @@ export class MulticastManager {
     };
   }
 
+  /** Route a switch's ingress and keep a protected flow's registration in step (7.2.7). */
+  #setSwitchIngress(ingress: MmtpIngressContext): void {
+    this.#transport.setContext(ingress);
+    if (ingress.flow !== undefined) this.#router.updateProvenanceFlowIngress({ ...ingress, flow: ingress.flow });
+  }
+
   /** The router committed the staged switch (it already retired `from`). */
   #commitRenditionSwitch(active: ActiveRenditionSwitch, commit: StreamSwitchCommit): void {
     if (this.#renditionSwitch !== active) return;
@@ -2381,7 +2554,7 @@ export class MulticastManager {
     active.state = "committed";
     active.router = null;
     if (this.#transport.joined) {
-      this.#transport.setContext(active.committedIngress);
+      this.#setSwitchIngress(active.committedIngress);
       if (active.committedPacketIds !== undefined) {
         // The page-side filter narrows now; the provider may keep delivering
         // the retired IDs until it applies the narrower list, and the page
@@ -2429,7 +2602,7 @@ export class MulticastManager {
     active.router = null;
     if (restore) {
       if (this.#transport.joined) {
-        this.#transport.setContext(active.liveIngress);
+        this.#setSwitchIngress(active.liveIngress);
         if (active.widened && active.livePacketIds !== null) {
           this.#transport.setPacketIds([...active.livePacketIds]).catch((error: unknown) => {
             console.warn(
@@ -2518,8 +2691,8 @@ export class MulticastManager {
     data: Uint8Array,
     packetId: number,
     catalogTrackName?: string,
-  ) {
-    this.#router.routeRecoveredBlock(blockId, data, packetId, catalogTrackName);
+  ): boolean {
+    return this.#router.routeRecoveredBlock(blockId, data, packetId, catalogTrackName);
   }
 
   /** Route one Worker-recovered source symbol through the MMTP parser + dedup pipeline. */
@@ -2529,8 +2702,8 @@ export class MulticastManager {
     packetId: number,
     esi = 0,
     catalogTrackName?: string,
-  ) {
-    this.#router.routeRecoveredSymbol(blockId, data, packetId, esi, catalogTrackName);
+  ): boolean {
+    return this.#router.routeRecoveredSymbol(blockId, data, packetId, esi, catalogTrackName);
   }
 
   // ---------------------------------------------------------------------------
@@ -2719,6 +2892,18 @@ export class MulticastManager {
         }
       }
     }
+    // A factory also supplies the one-shot scratch decoder an unlisted-assisted
+    // decode on a governed instance runs in (7.2.7 step 2); without one the
+    // router drops unlisted repair there.
+    const factory = typeof wasmDecoderSource === "function" ? wasmDecoderSource : null;
+    const fecTracks = fecTrackIndexes.map((i) => catalog.tracks[i]!);
+    this.#router.setScratchFecDecoderFactory(factory && ((ownerPacketId, catalogTrackName) => {
+      const track = fecTracks.find((t) => t.packetId === ownerPacketId && t.name === catalogTrackName);
+      if (!track) return null;
+      const decoder = factory(track);
+      // A memoizing factory would hand back a live decoder the router then frees.
+      return [...fecDecoders.values()].includes(decoder) ? null : decoder;
+    }));
 
     // Reset switching-set index, repair packetId set and FEC availability.
     this.#switchingSets.clear();
@@ -2946,6 +3131,8 @@ export class MulticastManager {
     if (reason === "rtt-unmeasured") stats.repairsSkippedRttUnmeasured++;
     else if (reason === "rtt-exceeds-budget") stats.repairsSkippedRttExceedsBudget++;
     else if (reason === "range-no-anchor") stats.repairsSkippedRangeNoAnchor++;
+    else if (reason === "group-cannot-complete") stats.repairsSkippedGroupCannotComplete++;
+    else if (reason === "moot-rap") stats.repairsSkippedMootRap++;
     else stats.repairsSkippedPresentationDelayUnavailable++;
     stats.lastRepairSkip = {
       reason,
@@ -3027,6 +3214,37 @@ export class MulticastManager {
     });
   }
 
+  /** Record a running repair FETCH the scheduler stopped, and why. */
+  noteRepairStopped(
+    reason: RepairStopReason,
+    sbn: number,
+    packetId: number,
+    catalogTrackName?: string,
+  ): void {
+    this.#statsFor(packetId, catalogTrackName).repairStops[reason]++;
+    this.#emitRepairLifecycle({
+      version: 2,
+      type: "repair-stopped",
+      block: repairBlockIdentity(packetId, sbn, catalogTrackName),
+      reason,
+    });
+  }
+
+  /**
+   * Whether a complete RAP above SS_ID `ssId` reached the stream's in-order
+   * release gate (draft-ramadan-moq-fec 11.4.2: repair below it is moot).
+   */
+  rapCompleteAbove(packetId: number, catalogTrackName: string | undefined, ssId: number): boolean {
+    return this.#router.fecReleaseRapAbove(packetId, catalogTrackName, ssId);
+  }
+
+  /** Observe each complete RAP reaching a release gate (synchronous: defer FEC work). */
+  addRapCompleteObserver(
+    observer: (packetId: number, catalogTrackName: string | undefined, ssId: number) => void,
+  ): () => void {
+    return this.#router.addFecRapObserver(observer);
+  }
+
   /** Catalog/reset epoch of a packet's streams; gap decisions carry it. */
   epochFor(packetId: number): number {
     return this.#fec.epochFor(packetId);
@@ -3043,6 +3261,7 @@ export class MulticastManager {
       if (stats.epoch !== this.#fec.epochFor(stats.packetId)) continue;
       out[key] = {
         ...stats,
+        repairStops: { ...stats.repairStops },
         lastRepairSkip: stats.lastRepairSkip === null ? null : { ...stats.lastRepairSkip },
       };
     }
@@ -3196,6 +3415,7 @@ export class MulticastManager {
     this.#trackResetObservers.clear();
     this.#repairLifecycleObservers.clear();
     this.#transport.dispose();
+    this.#releaseProvenanceJoin();
     for (const release of [...this.#repairReleases.keys()]) release();
     this.#router.dispose();
     this.#fec.dispose();
@@ -3206,3 +3426,8 @@ export class MulticastManager {
 // (wireRepairFetch) drives.
 const repairFetchHost = (manager: MulticastManager): RepairFetchHost => manager;
 void repairFetchHost;
+
+/** The router's key of a protected flow: its `(S, G, port)`. */
+export function multicastProvenanceFlowKey(flow: Pick<ResolvedMulticastAuthFlow, "source" | "groupAddress" | "port">): string {
+  return JSON.stringify([flow.source, flow.groupAddress, flow.port]);
+}

package/src/multicast-transport.ts

@@ -19,7 +19,10 @@ import {
 } from '@blockcast/mmt-base'
 
 export interface MulticastTransportConfig {
-  sourceAddress: string
+  /** SSM source; omitted on ASM. */
+  sourceAddress?: string
+  /** ASM sender filter (multicast-contract 1.1.0 `senderAddress`); never beside `sourceAddress`. */
+  senderAddress?: string
   groupAddress: string
   port: number
   mode?: 'auto' | 'native' | 'tunnel'
@@ -368,10 +371,11 @@ export class MulticastTransport<TPacketContext = never> {
     try {
       const packetIds = config.packetIds?.length ? new Set(config.packetIds) : null
       console.log(
-        `[MulticastTransport] window.multicast.subscribe(${config.sourceAddress}, ${config.groupAddress}, ${config.port})`,
+        `[MulticastTransport] window.multicast.subscribe(${config.sourceAddress ?? config.senderAddress ?? '*'}, ${config.groupAddress}, ${config.port})`,
       )
       const subscribeConfig = toWindowMulticastSubscribeConfig({
         source: config.sourceAddress,
+        senderAddress: config.senderAddress,
         group: config.groupAddress,
         port: config.port,
         mode: config.mode,

package/src/no-modules.ts

@@ -19,9 +19,4 @@ export { MmtpToCmaf } from './mmtp-to-cmaf.js'
 // reach only this classic-script surface, so it has to be exported here as
 // well as from the barrel (BLO-49943).
 export { isFmp4InitSegment } from './codec-utils.js'
-export { createManifestAuthPlan } from './manifest-auth-plan.js'
-export {
-  ManifestVerifier,
-  createWebCryptoEd25519Verifier,
-  manifestBindingId,
-} from '@blockcast/mmt-manifest-verify'
+export { BcProvenanceV2Receiver } from '@blockcast/mmt-manifest-verify'