@blockcast/mmt-container 1.0.1 → 2.0.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blockcast/mmt-container",
-  "version": "1.0.1",
+  "version": "2.0.0",
   "description": "MMTP/LOC container parsing for MMT over MoQ and SSM",
   "type": "module",
   "main": "dist/index.js",
@@ -169,10 +169,10 @@
     "test:watch": "vitest"
   },
   "dependencies": {
-    "@blockcast/fec-worker": "^1.0.1",
-    "@blockcast/mmt-base": "^1.0.1",
-    "@blockcast/mmt-fec": "^1.0.1",
-    "@blockcast/mmt-manifest-verify": "^1.0.1",
+    "@blockcast/fec-worker": "^2.0.0",
+    "@blockcast/mmt-base": "^2.0.0",
+    "@blockcast/mmt-fec": "^2.0.0",
+    "@blockcast/mmt-manifest-verify": "^2.0.0",
     "@noble/curves": "^1.9.7",
     "@noble/hashes": "^1.8.0",
     "ajv": "^8.17.1",

package/schemas/catalog.schema.json

@@ -332,19 +332,27 @@
     "endpointAuth": {
       "type": "object",
       "additionalProperties": false,
-      "required": ["manifestPort", "streamId"],
-      "description": "draft-ramadan-moq-multicast-01 7.2.6: marks the endpoint's flow protected. Required on every endpoint when multicast.auth is present and forbidden otherwise; port clashes on one (S, G) are validateCmsfMmtpCatalog's.",
+      "required": ["streamId"],
+      "description": "draft-ramadan-moq-multicast-02 7.2.6 (Blockcast/moqcast-draft@5f49172): marks the endpoint's flow protected; its records ride in band on the endpoint's own port (7.2.3). Required on every endpoint when multicast.auth is present and forbidden otherwise. One endpoint per (S, G, port) and the address-literal rules are multicastCatalogIssues' (a receiver ignores the endpoint).",
       "properties": {
-        "manifestPort": { "type": "integer", "minimum": 1, "maximum": 65535 },
         "streamId": { "type": "integer", "minimum": 0, "maximum": 4294967295 },
         "senderAddress": {
           "type": "string",
           "minLength": 1,
           "description": "S of a protected ASM endpoint; must not appear on an SSM endpoint."
         },
-        "maxAuthDelayMs": { "type": "integer", "minimum": 50, "maximum": 1000, "default": 200 },
-        "manifestTimerMs": { "type": "integer", "minimum": 1, "maximum": 9007199254740991, "default": 20 },
-        "manifestTrack": { "type": "string", "minLength": 1 }
+        "maxAuthDelayMs": {
+          "default": 200,
+          "description": "A publisher emits an integer from 50 to 1000. A receiver clamps a number outside that range to the nearer bound and reads a non-number, or an in-range non-integer, as absent (7.2.6), so no value here makes the endpoint ignored."
+        },
+        "manifestTimerMs": {
+          "default": 20,
+          "not": { "type": "number", "exclusiveMaximum": 1 },
+          "description": "A publisher emits an integer of at least 1. A receiver ignores the endpoint when it is a number below 1 and reads any other non-integer as absent (7.2.6)."
+        },
+        "manifestTrack": {
+          "description": "MoQ track mirroring the records (7.2.5). A receiver reads a non-string as absent (7.2.6)."
+        }
       }
     },
     "networkSource": {
@@ -381,7 +389,7 @@
             "frequency": { "$ref": "#/$defs/positiveInteger", "description": "RF centre frequency in kHz (e.g. 587000 for 587 MHz)." },
             "plpId": { "type": "integer", "minimum": 0, "maximum": 63 },
             "serviceId": { "type": "integer", "minimum": 0, "maximum": 65535 },
-            "slsUri": { "type": "string", "format": "uri", "description": "SLS of an MMTP service, MP table included (A/331:2026-04 7.2). The SLS describes the MMTP session and nothing of this profile, so manifestPort and keys come from provisioning, not from the SLS." }
+            "slsUri": { "type": "string", "format": "uri", "description": "SLS of an MMTP service, MP table included (A/331:2026-04 7.2). The SLS describes the MMTP session and nothing of this profile, so the flow parameters and keys come from provisioning, not from the SLS." }
           }
         }
       ]

package/src/carp-catalog.ts

@@ -13,7 +13,7 @@ import {
 	MMTP_SIGNALING_PACKET_ID,
 	type FecBlockProfile,
 } from "@blockcast/mmt-base";
-import { multicastCatalogIssues, multicastEndpointSource } from "@blockcast/mmt-base";
+import { multicastEndpointSource } from "@blockcast/mmt-base";
 import type { EndpointAuthConfig, MulticastAuthConfig } from "./multicast-auth-catalog.js";
 
 // ── Track Role (Phase 14, D-02..D-05) ─────────────────────────
@@ -304,8 +304,8 @@ export type NetworkSource =
 			serviceId?: number;
 			/**
 			 * SLS of the MMTP service, MP table included (A/331:2026-04 7.2). It
-			 * describes the MMTP session and nothing of this profile: manifestPort
-			 * and keys come from provisioning. libmmt does not fetch it.
+			 * describes the MMTP session and nothing of this profile: the flow
+			 * parameters and keys come from provisioning. libmmt does not fetch it.
 			 */
 			slsUri?: string;
 	  };
@@ -676,14 +676,14 @@ function validateNetworkSourceRelays(sources: unknown, path: string): void {
 }
 
 /**
- * Validate the common CMSF shape and the MMTP required-field profile.
- * `catalogNamespace`, the namespace of the catalog track, sharpens the
- * foreign-namespace rule of draft -01 4.1; without it listed tracks are only
- * compared with each other.
+ * Validate the common CMSF shape and the MMTP required-field profile. It never
+ * throws on a draft -02 4.1 / 7.2.6 multicast rule: pass `catalogNamespace`
+ * (the namespace of the catalog track) to `admittedMulticastEndpoints` /
+ * `multicastCatalogIssues` instead. The option is accepted and unused.
  */
 export function validateCmsfMmtpCatalog(
 	value: unknown,
-	options: { catalogNamespace?: string } = {},
+	_options: { catalogNamespace?: string } = {},
 ): CmsfCatalog {
 	if (typeof value !== "object" || value === null || Array.isArray(value)) {
 		catalogError("catalog_object", "$", "catalog must be an object");
@@ -929,11 +929,12 @@ export function validateCmsfMmtpCatalog(
 		}
 	}
 
-	// draft -01 4.1 / 7.2.6: protocol and S, auth all-or-nothing, the key set,
-	// tuple and manifestPort uniqueness, foreign-namespace tracks. Receivers
-	// ignore what this rejects (`admittedMulticastEndpoints`).
-	const [multicastIssue] = multicastCatalogIssues(catalog, options);
-	if (multicastIssue) catalogError(multicastIssue.code, multicastIssue.path, multicastIssue.message);
+	// draft -02 4.1 / 7.2.6 (protocol and S, address literals, auth
+	// all-or-nothing, the key set, one endpoint per (S, G, port),
+	// foreign-namespace tracks) are never a catalog fault here: a receiver
+	// ignores the endpoint an issue names, and a catalog-level issue makes the
+	// multicast object yield no data (`admittedMulticastEndpoints`), while MoQ
+	// unicast stays usable. `multicastCatalogIssues` reports them.
 
 	validateArchive(catalog);
 

package/src/fec-manager.ts

@@ -26,6 +26,11 @@ import {
   serial32Precedes,
   ssbg1FitsSymbol,
   type FecBlockProfile,
+  admitMmtpRepairObject,
+  parseMoqRepairFrameWithHeader,
+  type MMTPHeader,
+  type MoqRepairFrame,
+  type RepairObjectReject,
 } from '@blockcast/mmt-base'
 import {
   IsoBlockLocator,
@@ -131,10 +136,22 @@ export interface FecStats {
   workers: Array<FecTrackStats & { packetId: number }>
   /** Main-thread repair symbols rejected before dispatch because their size did not match T. */
   repairSymbolSizeMismatches: number
+  /**
+   * Repair objects discarded on admission (draft-ramadan-moq-fec-core-00 7.5,
+   * draft-ramadan-moq-mmt-02 7.3), per FEC instance and reason. The instance
+   * keeps decoding; other instances are untouched.
+   */
+  repairObjectRejects: FecRepairObjectRejects[]
   /** Bounded Worker error counts keyed by stable code, or message text for legacy errors. */
   workerErrors: Record<string, number>
 }
 
+/** One FEC instance's repair-object admission discards, by reason. */
+export type FecRepairObjectRejects = {
+  packetId: number
+  catalogTrackName: string | undefined
+} & Record<RepairObjectReject, number>
+
 export interface FecPacketStats {
   packetId: number
   sourcePackets: number
@@ -514,6 +531,7 @@ export class FECManager {
   #heldLayerStates = new Map<string, HeldLayerAdmission>()
   /** Streams whose FEC failed closed at runtime (fec-01 6.3.9). */
   #fecFailClosed = new Map<string, FecFailClosedReason>()
+  #repairObjectRejects = new Map<string, FecRepairObjectRejects>()
   #onFecFailClosed: ((event: FecFailClosedEvent) => void) | null = null
   // Blocks already recovered — prevents late source symbols from restarting timeouts.
   // WASM removes blocks after recovery; late symbols create empty blocks returning null,
@@ -2395,6 +2413,7 @@ export class FECManager {
           packetId,
         })),
       repairSymbolSizeMismatches: this.#repairSymbolSizeMismatchCount,
+      repairObjectRejects: [...this.#repairObjectRejects.values()].map((r) => ({ ...r })),
       workerErrors: Object.fromEntries(this.#workerErrorCounts),
     }
   }
@@ -4140,15 +4159,7 @@ export class FECManager {
   ): boolean {
     const streamKey = this.#streamKey(packetId, catalogTrackName)
     if (this.#fecFailClosed.has(streamKey)) return false
-    const config = this.#trackConfigs.get(packetId)
-    const layers = config?.repairLayers
-    if (layers === undefined || layers.length === 0) return true
-    let admission = this.#heldLayerStates.get(streamKey)
-    if (admission === undefined) {
-      admission = new HeldLayerAdmission(layers, config!.heldLayers)
-      this.#heldLayerStates.set(streamKey, admission)
-    }
-    const verdict = admission.admit(
+    const verdict = this.#heldLayerAdmission(packetId, streamKey)?.admit(
       repairTrackName,
       ssStart,
       rsbLength,
@@ -4157,16 +4168,80 @@ export class FECManager {
     )
     if (verdict === 'discard') return false
     if (verdict !== undefined) {
-      this.#fecFailClosed.set(streamKey, verdict)
-      this.#onFecFailClosed?.({ ...verdict, packetId, catalogTrackName })
-      console.warn(
-        `[FECManager] FEC failed closed (fec-01 6.3.9) packetId=${packetId} track=${catalogTrackName ?? '-'}: ${JSON.stringify(verdict)}`,
-      )
+      this.#failClosed(streamKey, verdict, packetId, catalogTrackName)
       return false
     }
     return true
   }
 
+  #heldLayerAdmission(packetId: number, streamKey: string): HeldLayerAdmission | undefined {
+    const config = this.#trackConfigs.get(packetId)
+    const layers = config?.repairLayers
+    if (layers === undefined || layers.length === 0) return undefined
+    let admission = this.#heldLayerStates.get(streamKey)
+    if (admission === undefined) {
+      admission = new HeldLayerAdmission(layers, config!.heldLayers)
+      this.#heldLayerStates.set(streamKey, admission)
+    }
+    return admission
+  }
+
+  #failClosed(streamKey: string, verdict: FecFailClosedReason, packetId: number, catalogTrackName: string | undefined): void {
+    this.#fecFailClosed.set(streamKey, verdict)
+    this.#onFecFailClosed?.({ ...verdict, packetId, catalogTrackName })
+    console.warn(
+      `[FECManager] FEC failed closed (fec-01 6.3.9) packetId=${packetId} track=${catalogTrackName ?? '-'}: ${JSON.stringify(verdict)}`,
+    )
+  }
+
+  /**
+   * Admission of one iso-ssbg1-v1 repair object of `packetId`'s instance,
+   * before it takes any part in block state (draft-ramadan-moq-fec-core-00
+   * 7.5, draft-ramadan-moq-mmt-02 7.3): exactly 12 + 13 + T bytes, RS_ID below
+   * RSB_length under every scheme, and the scheme's bound. The instance is the
+   * one the repair track names (`packetId`, `catalogTrackName`), never one
+   * inferred from the fields. A discard is counted on `repairObjectRejects`
+   * and the instance keeps decoding; except that an object the RS_ID or
+   * scheme discard would take whose RSB_length is below a held layer's
+   * O_i + P_i on that layer's track or on an anchored block stops the
+   * instance's FEC instead (core-00 7.3.2). Returns the frame to admit.
+   */
+  admitRepairObject(
+    packetId: number,
+    catalogTrackName: string | undefined,
+    repairTrackName: string | undefined,
+    packet: Uint8Array,
+    header: MMTPHeader,
+  ): MoqRepairFrame | null {
+    const config = this.#trackConfigs.get(packetId)
+    // No T to measure against: the parse alone (the size check refuses later).
+    if (!config || !(config.symbolSize > 0)) return parseMoqRepairFrameWithHeader(packet, header)
+    const admission = admitMmtpRepairObject(packet, header, config.symbolSize, config.algorithm ?? 'raptorq')
+    if (!admission) return null
+    if ('frame' in admission && admission.reject === undefined) return admission.frame
+    const streamKey = this.#streamKey(packetId, catalogTrackName)
+    if ('frame' in admission && !this.#fecFailClosed.has(streamKey)) {
+      const verdict = this.#heldLayerAdmission(packetId, streamKey)?.failsClosed(
+        repairTrackName,
+        admission.frame.ssStart,
+        admission.frame.rsbLength,
+        this.#layerAnchorHorizon(packetId),
+        this.#sourceFrontiers.get(streamKey)?.sbn,
+      )
+      if (verdict) {
+        this.#failClosed(streamKey, verdict, packetId, catalogTrackName)
+        return null
+      }
+    }
+    let rejects = this.#repairObjectRejects.get(streamKey)
+    if (rejects === undefined) {
+      rejects = { packetId, catalogTrackName, repairLength: 0, repairRsId: 0, repairSchemeBound: 0 }
+      this.#repairObjectRejects.set(streamKey, rejects)
+    }
+    rejects[admission.reject!]++
+    return null
+  }
+
   /**
    * How far (in SS_Start symbols) behind the newest block a 6.3.9 anchor or
    * below-total block can still matter: the iso locator's retention in blocks

package/src/held-layer-admission.ts

@@ -99,6 +99,17 @@ export class HeldLayerAdmission {
     rsbLength: number,
     horizon: number,
     sourceFrontier?: number,
+  ): FecFailClosedReason | 'discard' | undefined {
+    return this.#admit(repairTrackName, ssStart, rsbLength, horizon, sourceFrontier, true)
+  }
+
+  #admit(
+    repairTrackName: string | undefined,
+    ssStart: number,
+    rsbLength: number,
+    horizon: number,
+    sourceFrontier: number | undefined,
+    retroactive: boolean,
   ): FecFailClosedReason | 'discard' | undefined {
     if (repairTrackName !== undefined && !this.#layerNames.has(repairTrackName)) return 'discard'
     // A repair may run ahead of the media, but one more than `horizon` past the
@@ -142,7 +153,7 @@ export class HeldLayerAdmission {
           }
         } else if (!state.settled && !stale(ssStart)) {
           if (state.anchor === undefined || serial32Precedes(ssStart, state.anchor)) state.anchor = ssStart
-          if (state.latestBelow !== undefined && !serial32Precedes(state.latestBelow, state.anchor)) {
+          if (retroactive && state.latestBelow !== undefined && !serial32Precedes(state.latestBelow, state.anchor)) {
             code = 'below_anchored_total'
             ssStart = state.latestBelow
             rsbLength = state.latestBelowRsb!
@@ -158,4 +169,30 @@ export class HeldLayerAdmission {
     }
     return undefined
   }
+
+  /**
+   * The core-00 7.5 carve-out for a repair object about to be discarded
+   * (RS_ID or scheme bound): whether its own RSB_length, below a held layer's
+   * total on that layer's track or on an anchored block, fails the instance
+   * closed under 7.3.2. Leaves the anchored state as it was: a discarded
+   * object anchors nothing.
+   */
+  failsClosed(
+    repairTrackName: string | undefined,
+    ssStart: number,
+    rsbLength: number,
+    horizon: number,
+    sourceFrontier?: number,
+  ): FecFailClosedReason | undefined {
+    const saved = this.#states.map((state) => ({ ...state }))
+    try {
+      // No retroactive verdict: a discarded object anchors nothing, so it
+      // cannot fail an earlier below-total block, and every held layer is
+      // still judged on the object's own RSB_length.
+      const verdict = this.#admit(repairTrackName, ssStart, rsbLength, horizon, sourceFrontier, false)
+      return typeof verdict === 'object' ? verdict : undefined
+    } finally {
+      saved.forEach((state, i) => { this.#states[i] = state })
+    }
+  }
 }

package/src/mmtp-fec-session.ts

@@ -29,11 +29,11 @@
  */
 
 import {
+  admitMmtpRepairObject,
   isoBlockContains,
   isoBlocksBehindLowerBound,
   parseFecBlockProfile,
   parseMMTPHeader,
-  parseMoqRepairFrameWithHeader,
   serial32Add,
   serial32Distance,
   serial32Precedes,
@@ -374,20 +374,28 @@ export class MmtpFecSession {
     } catch {
       return this.#drop('repair:malformed')
     }
-    const frame = parseMoqRepairFrameWithHeader(packet, header)
-    if (!frame) return this.#drop('repair:malformed')
-    if (this.#repairPacketId === undefined) {
-      this.#repairPacketId = frame.packetId
-    } else if (frame.packetId !== this.#repairPacketId) {
+    // core-00 7.5 / mmt-02 7.3: exactly 12 + 13 + T, judged before any field.
+    const admission = admitMmtpRepairObject(packet, header, this.symbolSize, this.algorithm)
+    if (!admission) return this.#drop('repair:malformed')
+    if (!('frame' in admission)) return this.#drop('repair:length')
+    const frame = admission.frame
+    if (this.#repairPacketId !== undefined && frame.packetId !== this.#repairPacketId) {
       return this.#drop('repair:foreign-packet-id')
     }
-    if (frame.symbolData.byteLength !== this.symbolSize) return this.#drop('repair:symbol-size')
-    if (frame.ssbLength > this.sourceSymbols) return this.#drop('repair:ssb-length')
-    // fec-01 4.5: a reed-solomon block holds at most 255 symbols. Discarded
-    // before any block bookkeeping, so the block state is unchanged.
-    if (this.algorithm === 'reed-solomon' && frame.ssbLength + frame.rsbLength > 255) {
-      return this.#drop('repair:rs-block-length')
+    if (admission.reject) {
+      // An RSB_length below a held layer's total goes to the 7.3.2 stop, not
+      // to the discard; the block state is unchanged either way.
+      const verdict = this.#heldLayers.failsClosed(
+        repairTrackName, frame.ssStart, frame.rsbLength, this.#anchorHorizon, this.#newestSource,
+      )
+      if (verdict) {
+        this.#stats.failClosed = verdict
+        return this.#drop('repair:fail-closed')
+      }
+      return this.#drop(admission.reject === 'repairRsId' ? 'repair:rs-id' : 'repair:scheme-bound')
     }
+    this.#repairPacketId ??= frame.packetId
+    if (frame.ssbLength > this.sourceSymbols) return this.#drop('repair:ssb-length')
     // fec-01 6.3.9, after the 4.5 discards and the size check, before a block
     // is placed. Without a track name only the anchored rule (b) applies.
     const verdict = this.#heldLayers.admit(

package/src/mmtp-router.ts

@@ -21,6 +21,7 @@ import {
   serial32Precedes,
   type FecBlockProfile,
   type MMTPHeader,
+  type MoqRepairFrame,
 } from "@blockcast/mmt-base";
 import type { IsoHeldSource, WasmFecDecoder } from "./fec-manager.js";
 import type { IsoPlacedSource, IsoRepairPlacement } from "./iso-block-locator.js";
@@ -66,9 +67,10 @@ import {
   StreamDuplicateLedgers,
   type DuplicateHorizon,
 } from "./duplicate-ledger.js";
-import type {
-  BcProvenanceV2Receiver,
-  BcpV2RecordPath,
+import {
+  isBcpV2RecordCandidate,
+  type BcProvenanceV2Receiver,
+  type BcpV2RecordPath,
 } from "@blockcast/mmt-manifest-verify";
 
 // ─── Constants ─────────────────────────────────────────────────────
@@ -176,9 +178,10 @@ export type RoutedFrameMeta = {
 export interface MmtpIngressContext {
   tracks: readonly Readonly<{ name: string; packetId: number }>[];
   /**
-   * The bc-provenance v2 flow (draft-ramadan-moq-multicast-01 7.2.7) that
+   * The bc-provenance v2 flow (draft-ramadan-moq-multicast-02 7.2.7) that
    * delivered the packet, when its endpoint is protected: the key a receiver
-   * was registered under with `registerProvenanceFlow`.
+   * was registered under with `registerProvenanceFlow`. Its records arrive on
+   * the same ingress and `feedPacket` splits them off.
    */
   flow?: string;
 }
@@ -597,6 +600,15 @@ export interface FECManagerLike {
   /** fec-01 4.5: refuse a repair header whose block length the track's scheme
    *  forbids, before it touches block state (optional). */
   admitRepairBlockLength?(packetId: number, ssbLength: number, rsbLength: number, rsId: number): boolean;
+  /** core-00 7.5 / mmt-02 7.3 admission of one repair object of the named
+   *  instance; counts a discard per instance (optional). */
+  admitRepairObject?(
+    packetId: number,
+    catalogTrackName: string | undefined,
+    repairTrackName: string | undefined,
+    packet: Uint8Array,
+    header: MMTPHeader,
+  ): MoqRepairFrame | null;
   admitRepairLayerTotal?(
     packetId: number,
     catalogTrackName: string | undefined,
@@ -2151,8 +2163,9 @@ export class MmtpRouter {
   }
 
   /**
-   * Feed one bc-provenance record of `flow`: a datagram from `manifestPort`
-   * (`multicast`) or an object of the manifest track (`mirror`). Held
+   * Feed one bc-provenance record of `flow`: a datagram on the flow's own
+   * `port` (`multicast`; `feedPacket` splits these off on "MHM2",
+   * multicast-02 7.2.7) or an object of the manifest track (`mirror`). Held
    * datagrams the record admits are routed before this returns.
    */
   feedProvenanceRecord(flow: string, record: Uint8Array, path: BcpV2RecordPath): string {
@@ -2218,6 +2231,16 @@ export class MmtpRouter {
     ingress?: MmtpIngressContext,
   ): void {
     if (this.#disposed) return;
+    // multicast-02 7.2.7: on a protected flow's `port`, a datagram whose first
+    // four octets are "MHM2" is a record candidate. The split precedes every
+    // other read: a candidate is never parsed as MMTP, held, hashed as data,
+    // sampled as an arrival or counted by packet_id, and one that fails step 1
+    // is dropped there.
+    if (source === "multicast" && ingress?.flow !== undefined && isBcpV2RecordCandidate(packet)) {
+      if (this.#provenance.has(ingress.flow)) this.feedProvenanceRecord(ingress.flow, packet, "multicast");
+      else this.#unregisteredFlowDrops++;
+      return;
+    }
     this.#withDeferredFecPokes(() => {
       this.#processMMTP(packet, source, false, ingress);
     });
@@ -2290,9 +2313,6 @@ export class MmtpRouter {
     } catch {
       return;
     }
-    const parsed = parseMoqRepairFrameWithHeader(packet, header);
-    if (!parsed) return;
-
     // A dedicated repair track can carry a packet ID that differs from the
     // media packet ID. The subscribing track supplies the authoritative owner.
     const repairPacketId = header.packetId;
@@ -2310,18 +2330,24 @@ export class MmtpRouter {
         `[MmtpRouter] Dropping MoQ repair packet pid=${repairPacketId}: owner hint is required`,
       );
     }
-
+    // The frame is read only once 7.2.7 admits the datagram: admission
+    // (core-00 7.5) counts rejects and can fail the instance closed. A
+    // malformed held datagram is judged, and counted, when a record admits it.
     // Admission keys on the repair track's own packet id: a repair layer no
     // protected flow lists is an unlisted track (7.2.7), not a datagram of the
     // flow that lists its owner, where it would be held until expiry. The
     // flow listing it governs the owner too: a repair flow also lists its
     // owners' source tracks (#provenanceFor).
+    let unlisted = false;
     if (ownerPacketId != null && !admitted) {
       const admit = this.#admitUnicast(repairPacketId, packet, () =>
         this.#feedRepairPacket(packet, ownerPacketIdHint, catalogTrackName, repairTrackName, true));
       if (admit === "held" || admit === "dropped") return;
-      if (admit === "unlisted" && this.#fecManager && this.#setAsideUnlistedRepair(ownerPacketId, catalogTrackName, parsed)) return;
+      unlisted = admit === "unlisted";
     }
+    const parsed = this.#readRepairObject(ownerPacketId, catalogTrackName, repairTrackName, packet, header);
+    if (!parsed) return;
+    if (unlisted && this.#fecManager && this.#setAsideUnlistedRepair(ownerPacketId!, catalogTrackName, parsed)) return;
     if (ownerPacketId != null && this.#fecManager) {
       this.#moqRepairPidCounts[repairPacketId] =
         (this.#moqRepairPidCounts[repairPacketId] || 0) + 1;
@@ -2432,6 +2458,25 @@ export class MmtpRouter {
     return serial32Add(blockStart, index);
   }
 
+  /**
+   * A repair packet's frame, admitted under its owner instance's T and scheme
+   * when that instance is configured (draft-ramadan-moq-fec-core-00 7.5,
+   * draft-ramadan-moq-mmt-02 7.3); otherwise only parsed.
+   */
+  #readRepairObject(
+    ownerPacketId: number | null,
+    catalogTrackName: string | undefined,
+    repairTrackName: string | undefined,
+    packet: Uint8Array,
+    header: MMTPHeader,
+  ): MoqRepairFrame | null {
+    const fec = this.#fecManager;
+    if (ownerPacketId != null && fec?.admitRepairObject && this.#configuredBlockProfile(ownerPacketId) !== undefined) {
+      return fec.admitRepairObject(ownerPacketId, catalogTrackName, repairTrackName, packet, header);
+    }
+    return parseMoqRepairFrameWithHeader(packet, header);
+  }
+
   /**
    * One iso-ssbg1-v1 repair symbol (ISO/IEC 23008-1 C.5.3). It states the
    * block `[SS_Start, SS_Start + SSB_length)`; repair ESI = SSB_length +
@@ -3505,12 +3550,16 @@ export class MmtpRouter {
       // Repair packet — per ISO 23008-1 §C.5.3, carries (SS_Start, SSB_length, RS_ID).
       // Read from the header parsed above rather than parsing it again
       // (BLO-36599).
-      const repair = parseMoqRepairFrameWithHeader(packet, parsed.header);
-      if (!repair) return;
-
         const ownerPacketId = this.#resolveRepairOwnerPacketId(info.packetId, ingress);
+        // An ambiguous name attributes the packet to no instance, so it is
+        // dropped before admission can count or fail closed against one.
+        if (ownerPacketId != null && this.#fecManager && hasAmbiguousCatalogTrackName(ingress, ownerPacketId)) return;
+        const repair = this.#readRepairObject(
+          ownerPacketId, ownerPacketId == null ? undefined : catalogTrackNameForPacket(ingress, ownerPacketId),
+          undefined, packet, parsed.header,
+        );
+        if (!repair) return;
         if (ownerPacketId != null && this.#fecManager) {
-          if (hasAmbiguousCatalogTrackName(ingress, ownerPacketId)) return;
           // An unadmitted MoQ symbol reaching here is unlisted (#admitUnicast).
           if (
             source === "moq" && !manifestAdmitted &&