@blockcast/mmt-container 2.1.0 → 2.2.0-main.10bec7edb00b

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blockcast/mmt-container",
-  "version": "2.1.0",
+  "version": "2.2.0-main.10bec7edb00b",
   "description": "MMTP/LOC container parsing for MMT over MoQ and SSM",
   "type": "module",
   "main": "dist/index.js",
@@ -169,10 +169,10 @@
     "test:watch": "vitest"
   },
   "dependencies": {
-    "@blockcast/fec-worker": "^2.1.0",
-    "@blockcast/mmt-base": "^2.1.0",
-    "@blockcast/mmt-fec": "^2.1.0",
-    "@blockcast/mmt-manifest-verify": "^2.1.0",
+    "@blockcast/fec-worker": "2.2.0-main.10bec7edb00b",
+    "@blockcast/mmt-base": "2.2.0-main.10bec7edb00b",
+    "@blockcast/mmt-fec": "2.2.0-main.10bec7edb00b",
+    "@blockcast/mmt-manifest-verify": "2.2.0-main.10bec7edb00b",
     "@noble/curves": "^1.9.7",
     "@noble/hashes": "^1.8.0",
     "ajv": "^8.17.1",

package/schemas/catalog.schema.json

@@ -138,6 +138,10 @@
           "$ref": "#/$defs/positiveInteger",
           "description": "Keyframe interval in the track's timescale ticks (moqcast-draft §4.4.3). Exact where keyframeIntervalMs rounds (e.g. 30000/1001 video); when both are present, keyframeIntervalTicks wins."
         },
+        "deliveryMode": {
+          "type": "string",
+          "description": "How the publisher sends this track's objects (draft-ramadan-moq-fec-catalog-00 §3.3, proposed in moqcast-draft#26): \"datagram\" or \"stream\". A receiver treats a missing or unrecognized value as \"datagram\", so any string is admitted here rather than rejected. Allowed on source, repair and symbol tracks."
+        },
         "fec": { "$ref": "#/$defs/fec" }
       },
       "allOf": [

package/src/catalog-fec-params.ts

@@ -30,6 +30,7 @@ import type {
 	RepairOverlayParams,
 } from "./repair-layers.js";
 import type { RepairTarget } from "./repair-fetch.js";
+import type { MoqRepairDelivery } from "./repair-layer-subscriptions.js";
 
 export { catalogFecInterleaveMs, type FecInterleaveCatalog };
 export { FEC_BLOCK_PROFILES, isFecBlockProfile, parseFecBlockProfile, type FecBlockProfile };
@@ -273,6 +274,9 @@ export type TrackFecParams = {
 	/** Keyframe overlay instances declared for this track. Present (possibly
 	 *  empty) whenever repairLayers is. */
 	repairOverlays?: readonly RepairOverlayParams[];
+	/** The publisher's MoQ delivery mode (`catalogTrackDeliveryMode`).
+	 *  Present whenever repairLayers is; `RepairLayerSubscriptions` reads it. */
+	deliveryMode?: MoqRepairDelivery;
 	fps?: number;
 	sampleRate?: number;
 };
@@ -368,6 +372,36 @@ export function resolveRepairLayers(
 	};
 }
 
+/** The catalog value a JSON Pointer (RFC 6901) names, or undefined. */
+function valueAt(catalog: unknown, pointer: string): unknown {
+	let node = catalog;
+	for (const segment of pointer.split("/").slice(1)) {
+		if (typeof node !== "object" || node === null) return undefined;
+		node = (node as Record<string, unknown>)[segment.replace(/~1/g, "/").replace(/~0/g, "~")];
+	}
+	return node;
+}
+
+/**
+ * The publisher's MoQ delivery mode for one source track: `deliveryMode` on
+ * its base track entry (the hang rendition or MSF `tracks[]` entry its FEC
+ * binds to). `stream` means QUIC retransmits, so the receiver subscribes no
+ * repair track. Absent or any other value is `datagram`, FFmpeg's
+ * `moq_delivery_mode` default: a receiver never silently drops repair on a
+ * lossy path. When a track is declared both as a hang rendition and as an
+ * MSF `tracks[]` entry, the rendition is authoritative: a `deliveryMode` on
+ * the shadowed `tracks[]` entry is not read (fails safe to `datagram`).
+ * Never throws.
+ */
+export function catalogTrackDeliveryMode(
+	catalog: RepairLayerCatalog | undefined,
+	source: string | CatalogTrackRef,
+): MoqRepairDelivery {
+	const binding = bindingOf(catalog, source);
+	const entry = binding ? valueAt(catalog, binding.pointer) : undefined;
+	return (entry as { deliveryMode?: unknown } | undefined)?.deliveryMode === "stream" ? "stream" : "datagram";
+}
+
 /** A MoQ Transport priority (0..255, lower first), or null. */
 function moqtPriority(value: unknown): number | null {
 	return Number.isSafeInteger(value) && (value as number) >= 0 && (value as number) <= 255 ? (value as number) : null;
@@ -444,6 +478,7 @@ function fecParams(
 		repairTrackName: base.repairTrack,
 		repairLayers: repair.baseLayers,
 		repairOverlays: repair.overlays,
+		deliveryMode: catalogTrackDeliveryMode(catalog, track!),
 		...mediaRate,
 	};
 }

package/src/cmcd-producer.ts

@@ -28,6 +28,11 @@ export interface ManifestVerificationStats {
 
 /** Transport state snapshot, built by the player wiring layer from SocketPool. */
 export interface TransportSnapshot {
+  /**
+   * CMCD has no user-agent value: report a `'user-agent'` join
+   * (`ResolvedMulticastTransport`, the browser's own MulticastReceiver) as
+   * `'native'`, since the browser does not say which leg it chose.
+   */
   transport: 'native' | 'amt' | 'moq'
   /** IPv4/IPv6 multicast group address */
   multicastGroup?: string

package/src/index.ts

@@ -546,6 +546,7 @@ export {
 	type TrackFecParams,
 	type TrackFecUnavailable,
 	catalogTrackFecUnavailable,
+	catalogTrackDeliveryMode,
 	catalogGroupDurationMs,
 	catalogKeyframeCadenceMs,
 	catalogFecMediaUnitsPerSecond,
@@ -602,11 +603,22 @@ export {
 	type MmtpFecSessionConfig,
 	type MmtpFecSessionDecoder,
 	type MmtpFecSessionDecoderConstructor,
+	type MmtpFecSessionMessageConfig,
+	type MmtpFecSessionMessageUpdate,
 	type MmtpFecSessionMixedPathStats,
 	type MmtpFecSessionPath,
 	type MmtpFecSessionPathCounts,
 	type MmtpFecSessionStats,
 } from "./mmtp-fec-session.js";
+// MoQ repair-layer subscriptions by measured loss (BLO-35456)
+export {
+	RepairLayerSubscriptions,
+	type MoqRepairDelivery,
+	type RepairLayerSource,
+	type RepairLayerSubscriptionsOptions,
+	type RepairLayerSubscriptionsSnapshot,
+	type RepairTrackSubscription,
+} from "./repair-layer-subscriptions.js";
 
 export {
 	catalogAmtNetworkSource,

package/src/mmtp-fec-session.ts

@@ -23,6 +23,15 @@
  * uses. A packet below B_0 at or after the anchor fails the session closed:
  * `stats.failClosed` reports why, and every later repair is refused.
  *
+ * Catalog-less (draft-ramadan-moq-mmt-02 8.3, 13.2): a receiver holding
+ * layer 0 under the AL-FEC message alone builds the session from the message's
+ * fec_flow entry (`alFecFlow`) instead. K, T, the code point and the repair
+ * packet_id come from that entry, and layer 0 is held at
+ * maximum_p_for_repair_flow, standing for O_0 + P_0, by the anchored clause of
+ * draft-ramadan-moq-fec-core-00 7.3.2 alone. A later version that raises the
+ * field raises the held total (updateAlFecFlow()); the message carries no
+ * millisecond budget, so the caller states the retention (fec-core-00 9.4).
+ *
  * Every repair packet that cannot be used is counted under the reason it was
  * refused, and every block ends under exactly one outcome, so a stream whose
  * FEC is doing nothing can be told apart from one with nothing to repair.
@@ -30,6 +39,8 @@
 
 import {
   admitMmtpRepairObject,
+  alFecRaptorQFlowConfig,
+  FEC_CODE_RAPTORQ,
   isoBlockContains,
   isoBlocksBehindLowerBound,
   parseFecBlockProfile,
@@ -39,6 +50,8 @@ import {
   serial32Precedes,
   ssbg1FitsSymbol,
   trimSsbg1SourceSymbol,
+  type AlFecFlow,
+  type AlFecRaptorQFlowConfig,
   type FecBlockProfile,
 } from '@blockcast/mmt-base'
 import { deriveFecRetentionBlocks, fecBlockBudgetMs } from '@blockcast/mmt-fec'
@@ -105,6 +118,25 @@ export interface MmtpFecSessionConfig {
   heldLayers?: readonly number[]
 }
 
+/**
+ * A catalog-less session: one fec_flow entry of the AL-FEC message
+ * (`parseAlFecMessage(...).flows[i]`), draft-ramadan-moq-mmt-02 8.3.
+ */
+export interface MmtpFecSessionMessageConfig {
+  /** The source track's entry; it must pass `alFecRaptorQFlowConfig`. */
+  alFecFlow: AlFecFlow
+  /**
+   * The decoder retention in blocks. The message carries no elapsed-time
+   * budget (mmt-02 7.5), so open-block state is bounded by local policy
+   * (fec-core-00 9.4); required, never defaulted.
+   */
+  retentionBlocks: number
+  Decoder: MmtpFecSessionDecoderConstructor
+}
+
+/** What updateAlFecFlow() did with a later version of the message. */
+export type MmtpFecSessionMessageUpdate = 'raised' | 'unchanged' | 'refused'
+
 /**
  * The path a symbol arrived on: its MoQT subscription, or the multicast
  * group (native SSM or AMT) carrying the same asset. The caller states it;
@@ -197,12 +229,17 @@ export class MmtpFecSession {
   readonly algorithm: 'raptorq' | 'reed-solomon'
   readonly sourceSymbols: number
   /** P_0 = B_0, the held total every repair packet is checked against. */
-  readonly repairSymbols: number
+  get repairSymbols(): number {
+    return this.#repairSymbols
+  }
   readonly symbolSize: number
   /** The decoder's retention, in blocks, derived from the catalog budget. */
   readonly retentionBlocks: number
 
   #decoder: MmtpFecSessionDecoder | null
+  #repairSymbols: number
+  /** The message entry a catalog-less session was built from; undefined under a catalog. */
+  #message: AlFecRaptorQFlowConfig | undefined
   /** Blocks a repair has defined and that are not settled yet, by SS_Start. */
   #blocks = new Map<number, BlockState>()
   /** SS_Starts of settled blocks, so a later repair for one is refused. */
@@ -240,7 +277,26 @@ export class MmtpFecSession {
    *   the scheme, the block profile, K, P_0 (`repairSymbols`), T,
    *   `interleaveDepthMs` or `reorderToleranceMs`. None is defaulted.
    */
-  constructor(config: MmtpFecSessionConfig) {
+  constructor(config: MmtpFecSessionConfig | MmtpFecSessionMessageConfig) {
+    if (config && 'alFecFlow' in config) {
+      const message = alFecRaptorQFlowConfig(config.alFecFlow)
+      if (!message) {
+        throw new Error('MmtpFecSession: the AL-FEC entry is outside draft-ramadan-moq-mmt-02 8.3 (iso-ssbg1-v1)')
+      }
+      this.#message = message
+      // Coding byte 0x14 is the iso-ssbg1-v1 profile (mmt-02 8.3).
+      this.blockProfile = parseFecBlockProfile('iso-ssbg1-v1', 'alFecFlow')
+      this.algorithm = message.fecCodeId === FEC_CODE_RAPTORQ ? 'raptorq' : 'reed-solomon'
+      this.sourceSymbols = message.maximumK
+      this.#repairSymbols = message.maximumP
+      this.symbolSize = message.repairSymbolSize
+      this.retentionBlocks = requirePositiveInteger(config.retentionBlocks, 'retentionBlocks')
+      this.#repairPacketId = message.repairFlowId
+      this.#heldLayers = layerZero(message.maximumP)
+      this.#anchorHorizon = heldLayerAnchorHorizon(this.retentionBlocks, this.sourceSymbols)
+      this.#decoder = buildDecoder(config.Decoder, this)
+      return
+    }
     const fec = config?.fec
     if (!fec || typeof fec !== 'object') {
       throw new Error('MmtpFecSession: the catalog fec instance is required')
@@ -251,7 +307,7 @@ export class MmtpFecSession {
     }
     this.algorithm = fec.scheme
     this.sourceSymbols = requirePositiveInteger(fec.sourceSymbols, 'fec.sourceSymbols')
-    this.repairSymbols = requirePositiveInteger(fec.repairSymbols, 'fec.repairSymbols')
+    this.#repairSymbols = requirePositiveInteger(fec.repairSymbols, 'fec.repairSymbols')
     this.symbolSize = requirePositiveInteger(fec.symbolSize, 'fec.symbolSize')
     const interleaveDepthMs = requireNumber(fec.interleaveDepthMs, 'fec.interleaveDepthMs')
     const reorderToleranceMs = requireNumber(fec.reorderToleranceMs, 'fec.reorderToleranceMs')
@@ -271,17 +327,38 @@ export class MmtpFecSession {
       config.heldLayers,
     )
     this.#anchorHorizon = heldLayerAnchorHorizon(this.retentionBlocks, this.sourceSymbols)
-    if (typeof config.Decoder !== 'function') {
-      throw new Error('MmtpFecSession: a decoder constructor (wasm_bindgen.MmtFecDecoder) is required')
-    }
-    const decoder = new config.Decoder(this.retentionBlocks, this.blockProfile, this.algorithm)
-    try {
-      decoder.configure_params(this.sourceSymbols, this.symbolSize)
-    } catch (error) {
-      decoder.free()
-      throw error
+    this.#decoder = buildDecoder(config.Decoder, this)
+  }
+
+  /**
+   * A later version of the AL-FEC message, catalog-less sessions only. A
+   * maximum_p_for_repair_flow above the held total raises it (`raised`): the
+   * anchored check restarts at the new total, so a block generated under the
+   * previous one stays valid before the first block carrying the new total
+   * (fec-core-00 7.3.2, mmt-02 8.3). A field at or below it changes nothing
+   * (`unchanged`): no publisher lowers it, and the check catches a wire that
+   * does. An entry with another asset, repair flow, code point, K or T, or
+   * one outside 8.3, is `refused`: that is a new source encoding, which needs
+   * a new session. A latched fail-closed stays latched either way.
+   */
+  updateAlFecFlow(flow: AlFecFlow): MmtpFecSessionMessageUpdate {
+    const held = this.#message
+    if (!held) throw new Error('MmtpFecSession: updateAlFecFlow() needs a session built from an AL-FEC entry')
+    const next = alFecRaptorQFlowConfig(flow)
+    if (
+      !next ||
+      next.sourcePacketIds[0] !== held.sourcePacketIds[0] ||
+      next.repairFlowId !== held.repairFlowId ||
+      next.fecCodeId !== held.fecCodeId ||
+      next.maximumK !== held.maximumK ||
+      next.repairSymbolSize !== held.repairSymbolSize
+    ) {
+      return 'refused'
     }
-    this.#decoder = decoder
+    if (next.maximumP <= this.#repairSymbols) return 'unchanged'
+    this.#repairSymbols = next.maximumP
+    this.#heldLayers = layerZero(next.maximumP)
+    return 'raised'
   }
 
   /** True once release() ran. */
@@ -386,7 +463,7 @@ export class MmtpFecSession {
       // An RSB_length below a held layer's total goes to the 7.3.2 stop, not
       // to the discard; the block state is unchanged either way.
       const verdict = this.#heldLayers.failsClosed(
-        repairTrackName, frame.ssStart, frame.rsbLength, this.#anchorHorizon, this.#newestSource,
+        this.#trackFor(repairTrackName), frame.ssStart, frame.rsbLength, this.#anchorHorizon, this.#newestSource,
       )
       if (verdict) {
         this.#stats.failClosed = verdict
@@ -399,7 +476,7 @@ export class MmtpFecSession {
     // fec-01 6.3.9, after the 4.5 discards and the size check, before a block
     // is placed. Without a track name only the anchored rule (b) applies.
     const verdict = this.#heldLayers.admit(
-      repairTrackName,
+      this.#trackFor(repairTrackName),
       frame.ssStart,
       frame.rsbLength,
       this.#anchorHorizon,
@@ -464,6 +541,11 @@ export class MmtpFecSession {
     return true
   }
 
+  /** Catalog-less: layer 0 has no own-track clause (mmt-02 8.3), so no track name is judged. */
+  #trackFor(repairTrackName: string | undefined): string | undefined {
+    return this.#message ? undefined : repairTrackName
+  }
+
   #drop(reason: string): Uint8Array[] {
     this.#stats.dropped[reason] = (this.#stats.dropped[reason] ?? 0) + 1
     return []
@@ -600,6 +682,24 @@ export class MmtpFecSession {
   }
 }
 
+function layerZero(total: number): HeldLayerAdmission {
+  return new HeldLayerAdmission([{ layer: 0, repairTrackName: '', rsIdOffset: 0, repairSymbols: total }])
+}
+
+function buildDecoder(Decoder: MmtpFecSessionDecoderConstructor, session: MmtpFecSession): MmtpFecSessionDecoder {
+  if (typeof Decoder !== 'function') {
+    throw new Error('MmtpFecSession: a decoder constructor (wasm_bindgen.MmtFecDecoder) is required')
+  }
+  const decoder = new Decoder(session.retentionBlocks, session.blockProfile, session.algorithm)
+  try {
+    decoder.configure_params(session.sourceSymbols, session.symbolSize)
+  } catch (error) {
+    decoder.free()
+    throw error
+  }
+  return decoder
+}
+
 function requirePositiveInteger(value: unknown, path: string): number {
   if (typeof value !== 'number' || !Number.isSafeInteger(value) || value <= 0) {
     throw new Error(`MmtpFecSession: ${path} must be a positive integer (got ${String(value)})`)

package/src/mmtp-router.ts

@@ -23,6 +23,7 @@ import {
   type MMTPHeader,
   type MoqRepairFrame,
 } from "@blockcast/mmt-base";
+import { USER_AGENT_VERIFIED } from "@blockcast/mmt-transport";
 import type { FECManager, IsoHeldSource, WasmFecDecoder } from "./fec-manager.js";
 import type { IsoPlacedSource, IsoRepairPlacement } from "./iso-block-locator.js";
 import { isMfuReassemblyError } from "./mfu-reassembler.js";
@@ -245,6 +246,14 @@ export interface MmtpIngressContext {
    * the same ingress and `feedPacket` splits them off.
    */
   flow?: string;
+  /**
+   * `USER_AGENT_VERIFIED` when the datagram came from the browser's own
+   * MulticastReceiver, which verified the flow's records itself and delivers
+   * only admitted data (`userAgentVerifiedIngress` in
+   * `@blockcast/mmt-transport`). A protected multicast datagram carrying it
+   * is admitted without a record. Any other value means nothing.
+   */
+  admittedBy?: symbol;
 }
 
 /** One physical stream: an MMTP packet ID and the catalog track it carries. */
@@ -946,6 +955,15 @@ function sourceSymbolEvidence(
   };
 }
 
+/** One protected flow: its 7.2.7 receiver, and the ingress its datagrams arrive with. */
+interface ProvenanceEntry {
+  receiver: BcProvenanceV2Receiver;
+  ingress: MmtpIngressContext;
+  protected?: boolean;
+  /** A datagram the user agent verified admitted the flow (`admittedBy`). */
+  userAgent?: boolean;
+}
+
 export class MmtpRouter {
   readonly #parser: MmtpContainerParser;
   // Source AND FEC-recovered MFU fragments share ONE reassembler — the parser's
@@ -955,10 +973,7 @@ export class MmtpRouter {
   #defaultFecMapper: FecBlockMapper | null;
   #fecMappersByPacketId = new Map<number, FecBlockMapper>();
   /** Protected flows: one 7.2.7 receiver each, and the ingress its datagrams arrive with. */
-  readonly #provenance = new Map<
-    string,
-    { receiver: BcProvenanceV2Receiver; ingress: MmtpIngressContext; protected?: boolean }
-  >();
+  readonly #provenance = new Map<string, ProvenanceEntry>();
   #onFlowProtected: ((flow: string) => void) | null = null;
   #unadmittedListedDrops = 0;
   #unlistedRepairSetAside = 0;
@@ -2329,12 +2344,13 @@ export class MmtpRouter {
     if (!entry) return;
     entry.receiver.release();
     entry.protected = false;
+    entry.userAgent = false;
     // ponytail: drops every governed block's record, not only this flow's; per-flow if joins multiply.
     this.#assistBlocks.clear();
     this.#assistFailures.clear();
   }
 
-  /** MoQ packets of a track a protected flow lists, dropped on its unicast path: duplicate, overflow, or listed by more than one flow. */
+  /** Packets of a track a protected flow lists, dropped unread: a MoQ copy (duplicate, overflow, or listed by more than one flow) or a multicast source datagram that names no flow, of a track a user-agent-admitted flow lists. */
   get unadmittedListedDropCount(): number {
     return this.#unadmittedListedDrops;
   }
@@ -2384,6 +2400,14 @@ export class MmtpRouter {
     return false;
   }
 
+  /** Whether a protected flow the user agent admitted lists `packetId`. */
+  #userAgentGoverns(packetId: number): boolean {
+    for (const entry of this.#provenance.values()) {
+      if (entry.protected && entry.userAgent && ingressHasPacketId(entry.ingress, packetId)) return true;
+    }
+    return false;
+  }
+
   /**
    * A MoQ repair symbol no protected flow lists, owned by a source track one
    * does: its FEC instance is governed (7.2.7 step 2) and takes only admitted
@@ -2503,7 +2527,7 @@ export class MmtpRouter {
       fec.cancelBlockTimeout(blockStart, ownerPacketId, catalogTrackName);
       fec.countRecovery(ownerPacketId, blockStart, catalogTrackName);
       fec.markBlockCompleted(blockStart, ownerPacketId, catalogTrackName);
-    })) {
+    }, true)) {
       this.#unlistedAssistedRecoveries++;
       this.#assistBlocks.delete(key);
       return;
@@ -3959,6 +3983,15 @@ export class MmtpRouter {
         debugRouter(`[MmtpRouter] Dropping multicast packet pid=${info.packetId}: flow ${ingress.flow} has no receiver`);
         return;
       }
+      // The user agent verified this datagram against the flow's records
+      // itself, and the records never reach the page: admitted as is. The
+      // flow stays registered, so its MoQ copies are still checked.
+      if (ingress.admittedBy === USER_AGENT_VERIFIED) {
+        this.#noteFlowAdmitted(ingress.flow);
+        protectedFlow.userAgent = true;
+        this.#processMMTP(packet, source, true, ingress, overlapCopy);
+        return;
+      }
       // Held: released by a record (feedProvenanceRecord) or expired. Duplicate / overflow: dropped.
       const { verdict } = protectedFlow.receiver.onDatagram(packet, "multicast");
       if (verdict === "admitted") {
@@ -3983,6 +4016,18 @@ export class MmtpRouter {
       }
     }
 
+    // A multicast datagram that names no flow is unverified. Of a track a
+    // user-agent-admitted flow lists it would feed that flow's live decoder,
+    // whose recoveries are kept without a record (#routeVerifiedFecSymbols):
+    // its source is dropped here and its repair set aside below, as for
+    // unlisted MoQ. Under a record-only flow it is read as before: those
+    // recoveries still need a record.
+    const flowless = source === "multicast" && !manifestAdmitted && ingress?.flow === undefined;
+    if (flowless && !info.isRepair && this.#userAgentGoverns(info.packetId)) {
+      this.#unadmittedListedDrops++;
+      return;
+    }
+
     if (info.isRepair) {
       // Repair packet — per ISO 23008-1 §C.5.3, carries (SS_Start, SSB_length, RS_ID).
       // Read from the header parsed above rather than parsing it again
@@ -4003,9 +4048,10 @@ export class MmtpRouter {
         );
         if (!repair) return;
         if (ownerPacketId != null && this.#fecManager) {
-          // An unadmitted MoQ symbol reaching here is unlisted (#admitUnicast).
+          // An unadmitted MoQ symbol reaching here is unlisted (#admitUnicast);
+          // a flow-less multicast one is unverified.
           if (
-            source === "moq" && !manifestAdmitted &&
+            ((flowless && this.#userAgentGoverns(ownerPacketId)) || (source === "moq" && !manifestAdmitted)) &&
             this.#setAsideUnlistedRepair(ownerPacketId, catalogTrackNameForPacket(ingress, ownerPacketId), repair)
           ) return;
         this.#repairPidCounts[info.packetId] = (this.#repairPidCounts[info.packetId] || 0) + 1;
@@ -4950,6 +4996,7 @@ export class MmtpRouter {
     ownerPacketId?: number,
     catalogTrackName?: string,
     complete?: () => void,
+    assisted = false,
   ): boolean {
     // MMTP path: use processFecBlock for MMTP-wrapped recovery.
     // Recovered symbols are individual MMTP packets that may be fragments
@@ -4974,7 +5021,7 @@ export class MmtpRouter {
       ownerPacketId,
       blockProfile,
     });
-    return this.#routeVerifiedFecSymbols(blockId, result, ownerPacketId, catalogTrackName, complete);
+    return this.#routeVerifiedFecSymbols(blockId, result, ownerPacketId, catalogTrackName, complete, assisted);
   }
 
   /**
@@ -4987,6 +5034,19 @@ export class MmtpRouter {
    * recovered packets is refused is unrecovered (7.2.7): its caller leaves it
    * open, so it reaches its FEC deadline and fails by class. Always true
    * outside a protected flow.
+   *
+   * On a flow the user agent admitted, the live decoder's recoveries are kept
+   * without a record: while the flow is protected that decoder takes only
+   * symbols the user agent or a record verified (a flow-less multicast
+   * datagram of a listed track is dropped or set aside in #processMMTP), so
+   * what it recovers is as verified as they are. An `assisted` (scratch-decoder) recovery mixes in
+   * unlisted MoQ repair and still needs a record.
+   * ponytail: per-flow flag; per-block provenance only if a protected flow
+   * ever mixes verified and unverified live inputs.
+   * ponytail: a worker frame computed before the protection reset can still
+   * arrive after it (frames carry no epoch); its inputs are MoQ copies read
+   * and played before protection, so it admits nothing new. Drop pre-reset
+   * frames by epoch only if pre-protection input ever matters.
    */
   #routeVerifiedFecSymbols(
     blockId: number,
@@ -4994,8 +5054,11 @@ export class MmtpRouter {
     ownerPacketId?: number,
     catalogTrackName?: string,
     complete?: () => void,
+    assisted = false,
   ): boolean {
-    const receiver = ownerPacketId == null ? undefined : this.#provenanceFor(ownerPacketId, catalogTrackName);
+    const entry = ownerPacketId == null ? undefined : this.#provenanceFor(ownerPacketId, catalogTrackName);
+    const receiver = entry === undefined || entry === "ambiguous" ? entry : entry.receiver;
+    const userAgent = !assisted && entry !== undefined && entry !== "ambiguous" && entry.protected === true && entry.userAgent === true;
     let recovered = true;
     if (receiver) {
       const parsed = this.#stream(ownerPacketId!, catalogTrackName).duplicates.parsedSymbols;
@@ -5008,6 +5071,8 @@ export class MmtpRouter {
           let admitted = false;
           if (receiver === "ambiguous") {
             this.#ambiguousRecoveredDrops++;
+          } else if (userAgent) {
+            admitted = true;
           } else {
             const wire = new Uint8Array(sym.rawSymbol.byteLength + 4);
             wire.set(sym.rawSymbol);
@@ -5033,7 +5098,7 @@ export class MmtpRouter {
   #provenanceFor(
     packetId: number,
     catalogTrackName: string | undefined,
-  ): BcProvenanceV2Receiver | "ambiguous" | undefined {
+  ): ProvenanceEntry | "ambiguous" | undefined {
     // A caller that names no track matches every name the packet id was admitted under.
     const byName = this.#provenanceStreamFlow.get(packetId);
     const flows = new Set(
@@ -5042,12 +5107,12 @@ export class MmtpRouter {
         : byName.has(catalogTrackName) ? [byName.get(catalogTrackName)!] : [],
     );
     if (flows.size > 1) return "ambiguous";
-    for (const bound of flows) return this.#provenance.get(bound)?.receiver ?? "ambiguous";
-    let match: BcProvenanceV2Receiver | undefined;
-    for (const { receiver, ingress } of this.#provenance.values()) {
-      if (ingress.tracks.some((t) => t.packetId === packetId && (catalogTrackName === undefined || t.name === catalogTrackName))) {
+    for (const bound of flows) return this.#provenance.get(bound) ?? "ambiguous";
+    let match: ProvenanceEntry | undefined;
+    for (const entry of this.#provenance.values()) {
+      if (entry.ingress.tracks.some((t) => t.packetId === packetId && (catalogTrackName === undefined || t.name === catalogTrackName))) {
         if (match) return "ambiguous";
-        match = receiver;
+        match = entry;
       }
     }
     return match;

package/src/multicast-manager.ts

@@ -50,7 +50,11 @@ import {
   type StreamSwitchCommit,
   type TrackPacketCallback,
 } from "./mmtp-router.js";
-import { isMulticastTrackPacketId, type WindowMulticastGateway } from "@blockcast/mmt-transport";
+import {
+  isMulticastTrackPacketId,
+  userAgentVerifiedIngress,
+  type WindowMulticastGateway,
+} from "@blockcast/mmt-transport";
 import {
   MulticastTransport,
   type MulticastFailbackReason,
@@ -94,6 +98,8 @@ export interface MulticastRepairEndpoint {
   mode?: string;
   amtRelay?: string;
   amtRelayPort?: number;
+  /** The media join's `'driad'` discovery (no relay pinned), carried so the repair group rides the same relay. */
+  amtDiscovery?: 'driad';
   /** The repair packet IDs this group carries. */
   packetIds: number[];
   /** Each repair packet ID bound to the media packet ID it repairs. */
@@ -2353,10 +2359,20 @@ export class MulticastManager {
    * repair roles and owners are registered here; in-band owners stay the
    * caller's. Joining is best effort: a group that fails to join is logged
    * and leaves the media join as it was.
+   *
+   * `options.gateway` names the gateway a subscribe callback reads through.
+   * When it is the browser's own MulticastReceiver provider, the callback's
+   * packets are fed as admitted by the user agent
+   * (`userAgentVerifiedIngress`); nothing the callback passes can mark them.
+   * The mark rests on this statement, not on the data path: every packet the
+   * callback delivers must come from a subscription opened on
+   * `options.gateway`. A callback that also merges another source (a MoQ or
+   * WebSocket repair feed) must not name a native provider here.
    */
   joinRepairEndpoints(
     endpoints: readonly MulticastRepairEndpoint[],
     provider?: WindowMulticastGateway | MulticastRepairSubscribe,
+    options?: { gateway?: WindowMulticastGateway },
   ): () => void {
     const releases: Array<() => void> = [];
     let released = false;
@@ -2382,22 +2398,26 @@ export class MulticastManager {
         ...(endpoint.flow === undefined ? {} : { flow: endpoint.flow }),
       };
       let sender: string | undefined;
-      const onPacket = (packet: Uint8Array, sourceAddress?: string) => {
+      const feed = (packet: Uint8Array, sourceAddress: string | undefined, ingressToFeed: MmtpIngressContext) => {
         if (released) return;
         // The media join's sender owns the repair too; this group's own first
         // sender stands in only until the media join has one.
         if (sourceAddress !== undefined && !sameDatagramSource(sourceAddress, this.#transport.sender ?? (sender ??= sourceAddress))) return;
-        this.#router.feedPacket(packet, "multicast", ingress);
+        this.#router.feedPacket(packet, "multicast", ingressToFeed);
       };
       const fail = (error: unknown) =>
         console.warn(`[MulticastManager] repair group ${endpoint.group}:${endpoint.port} not joined`, error);
       if (typeof provider === "function") {
+        const marked = userAgentVerifiedIngress(ingress, options?.gateway);
+        const onPacket = (packet: Uint8Array, sourceAddress?: string) => feed(packet, sourceAddress, marked);
         Promise.resolve()
           .then(() => provider(endpoint, onPacket))
           .then((release) => (released ? safely(release) : releases.push(release)), fail);
         continue;
       }
-      const transport = new MulticastTransport((packet) => onPacket(packet), {
+      // The transport marks what it delivers when its gateway is the user
+      // agent's MulticastReceiver provider; feedPacket would not.
+      const transport = new MulticastTransport<MmtpIngressContext>((packet, delivered) => feed(packet, undefined, delivered ?? ingress), {
         gateway: provider,
         lockedTo: () => this.#transport.sender,
       });
@@ -2409,11 +2429,12 @@ export class MulticastManager {
         mode: endpoint.mode as MulticastEndpointConfig["mode"],
         amtRelay: endpoint.amtRelay,
         amtRelayPort: endpoint.amtRelayPort ?? (endpoint.amtRelay?.trim() ? DEFAULT_AMT_RELAY_PORT : undefined),
+        amtDiscovery: endpoint.amtDiscovery,
         packetIds: endpoint.packetIds,
         tracks: endpoint.tracks.map(({ name, packetId }) => ({ name, packetId })),
         // A protected repair group's records ride in band on its port (7.2.3).
         ...(endpoint.flow === undefined ? {} : { protected: true }),
-      }).then((joined) => {
+      }, ingress).then((joined) => {
         if (!joined && !released) fail(transport.lastJoinOutcome);
       });
     }