@blockcast/fec-worker 0.1.0

package/src/fec-worker.ts

@@ -0,0 +1,1048 @@
+/**
+ * @blockcast/fec-worker — Worker Entry Point
+ *
+ * Runs inside DedicatedWorkerGlobalScope. Receives FecWorkerCommand messages,
+ * drives the MmtFecDecoder WASM module, emits FecWorkerEvent messages back.
+ *
+ * WASM bindings are resolved via:
+ *   1. (self as any).__MMT_WASM_BINDINGS__ — set by consumer's loader/importmap
+ *   2. Falls back to error if not available (no defaults)
+ *
+ * This file must NOT import DOM globals incompatible with Worker scope.
+ */
+
+import type {
+	FecWorkerCommand,
+	FecWorkerEvent,
+	FecTrackConfig,
+	FecTrackStats,
+	FecBlockSnapshot,
+	FrameMeta,
+} from "./fec-worker-types.js";
+import { toOwnedArrayBuffer } from "./transfer.js";
+
+// --- WASM binding types (from mmt-wasm) ---
+// Signatures MUST match a freshly generated external mmt_wasm.d.ts exactly.
+// The decoder derives SBN/ESI internally — do not pre-compute.
+interface WasmFecDecoder {
+	/** ISO 23008-1 §C.5.2: ss_id is the flat 32-bit Source Symbol ID. */
+	add_source(
+		ss_id: number,
+		data: Uint8Array,
+		timestamp: number,
+	): Uint8Array | undefined;
+	/** ISO 23008-1 §C.5.3: repair ESI = ssb_length + rs_id, SBN = ss_start / ssb_length. */
+	add_repair(
+		ss_start: number,
+		ssb_length: number,
+		rs_id: number,
+		data: Uint8Array,
+		timestamp: number,
+	): Uint8Array | undefined;
+	configure_params(k: number, symbolSize: number): void;
+	/** Block-scoped counterpart driven by the manager's exact deadlines. */
+	cleanup_blocks_detailed(sbns: Uint32Array): Uint8Array;
+	/** Remove decoder blocks below its configured live-SBN interleave horizon. */
+	cleanup_by_sbn(current_sbn: number): Uint32Array;
+	flush(): void;
+	pending_blocks(): number;
+	reset_stats(): void;
+	get_stats(): {
+		source_packets: bigint;
+		repair_packets: bigint;
+		blocks_complete: bigint;
+		blocks_recovered: bigint;
+		blocks_failed: bigint;
+		bytes_recovered: bigint;
+		recovery_rate(): number;
+	};
+	free(): void;
+}
+
+interface WasmBindings {
+	initSync(module: { module: WebAssembly.Module }): unknown;
+	MmtFecDecoder: new (
+		interleaveDepth: number,
+		greenFillEnabled: boolean,
+	) => WasmFecDecoder;
+}
+
+// --- Worker state (local to this Worker instance) ---
+
+let wasmDecoder: WasmFecDecoder | null = null;
+let config: FecTrackConfig | null = null;
+let altaEnabled = false;
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+let altaVerifier: any = null;  // JsAltaVerifier instance (loaded from ALTA WASM)
+let snapshotTimer: ReturnType<typeof setInterval> | null = null;
+
+// Block tracking
+const blocks = new Map<number, FecBlockSnapshot>();
+const acceptedSourceEsis = new Map<number, Set<number>>();
+const acceptedRepairEsis = new Map<number, Set<number>>();
+const UINT32_MAX = 0xffff_ffff;
+const UINT24_MAX = 0xff_ffff;
+// ISO/IEC 23008-1 AL-FEC signaling carries interleave_depth in one byte.
+const MAX_INTERLEAVE_DEPTH = 0xff;
+// Rust stores T as u16 and this decoder profile fixes RFC 6330 Al=8.
+const MAX_SYMBOL_SIZE = 0xfff8;
+// RFC 6330 systematic table limit, enforced by the vendored raptorq decoder.
+const MAX_RAPTORQ_SOURCE_SYMBOLS_PER_BLOCK = 56_403;
+
+// Aggregate counters
+let sourceSymbols = 0;
+let repairSymbols = 0;
+let blocksComplete = 0;
+let blocksRecovered = 0;
+let blocksFailed = 0;
+let greenFillFrames = 0;
+let altaVerified = 0;
+let altaFailed = 0;            // Crypto-confirmed tamper (MAC / sig / hash chain mismatch)
+const altaFailedDetails: Array<{
+	seq: number;
+	error: string;
+	authLen: number;
+	payloadLen: number;
+	path: string; // "direct" | "recovered" | "pending-retry"
+}> = [];
+let altaPending = 0;           // Unverifiable but not tamper (no trailer, verifier not ready, anchor missing)
+let altaPendingEvictedCap = 0; // Incoming "pending" packets rejected because the queue was at cap after stale-sweep (flood indicator)
+let altaPendingEvictedTtl = 0; // Deferred-queue entries dropped by TTL (retry window expired)
+let altaError = 0;             // verifyDetached threw — infrastructure flake, not tamper
+let altaInitFailed = false;    // ALTA configured but WASM init failed; altaEnabled was forced off
+let relayBlocksVerified = 0;
+let relayBlocksFailed = 0;
+let liveSbn = 0;
+// Highest SBN that has fallen strictly below the decoder's retained
+// interleave window. Numeric ordering is per decoder epoch; reset/configure
+// starts a new epoch before the 32-bit source-symbol counter can wrap.
+let retiredSbnFrontier = -1;
+let repairSymbolSizeMismatch = 0;
+
+// Recovery timing
+const recoveryTimes: number[] = [];
+
+// ── Deferred ALTA verification queue (08-07 Path 3) ───────────────────────
+//
+// When an ALTA packet arrives whose MAC references point at sequences not yet
+// in the verifier's ring buffer, we can't anchor trust — verify returns "No
+// trust anchor". Typical cause: a predecessor packet was lost and hasn't been
+// FEC-recovered yet. Rather than drop these, hold them in a bounded FIFO and
+// retry verification after every successful verify (direct or FEC-recovered)
+// that seeds the ring buffer with new raw bytes.
+//
+// Zero-copy (1B-B): the queue entry stores a Uint8Array view into the
+// original `data` ArrayBuffer. JS GC keeps the buffer alive via the view
+// reference; no bytes are copied on queue.
+//
+// Timeout entries (TTL exceeded) and cap-rejections count as `altaPending`
+// (2C-B): they're not tamper indicators, they're just packets that couldn't
+// be authenticated within the receive window — either loss or, in the cap
+// case, a flood of unanchorable arrivals (real or attacker-driven) that
+// exceeded the queue budget. See enqueuePendingVerify for the rate-limit
+// protocol.
+interface PendingVerify {
+	seq: number;
+	auth: Uint8Array;
+	payload: Uint8Array;
+	arrivalTs: number;
+}
+const pendingVerify = new Map<number, PendingVerify>();
+let pendingVerifyCap = 0;
+let pendingVerifyTtlMs = 0;
+
+// --- Helpers ---
+
+function emit(event: FecWorkerEvent, transfer?: Transferable[]): void {
+	self.postMessage(event, transfer ?? []);
+}
+
+function isUint32(value: number): boolean {
+	return Number.isInteger(value) && value >= 0 && value <= UINT32_MAX;
+}
+
+function isTerminalBlock(block: FecBlockSnapshot): boolean {
+	return block.state !== "collecting";
+}
+
+function retireAcceptedIds(sbn: number): void {
+	acceptedSourceEsis.delete(sbn);
+	acceptedRepairEsis.delete(sbn);
+}
+
+function clearBlockTracking(): void {
+	blocks.clear();
+	acceptedSourceEsis.clear();
+	acceptedRepairEsis.clear();
+	pendingVerify.clear();
+	recoveryTimes.length = 0;
+	liveSbn = 0;
+	retiredSbnFrontier = -1;
+}
+
+/**
+ * Retire terminal diagnostics only after the decoder's monotonic interleave
+ * horizon proves that the SBN can no longer be valid out-of-order media.
+ * Admission keeps the compact frontier as the durable tombstone, so deletion
+ * never reopens a finalized block.
+ */
+function trimBlockRetention(): void {
+	for (const [sbn, block] of blocks) {
+		if (!isTerminalBlock(block) || sbn > retiredSbnFrontier) continue;
+		blocks.delete(sbn);
+		retireAcceptedIds(sbn);
+	}
+}
+
+function advanceMediaHorizon(sbn: number): void {
+	if (!config || sbn <= liveSbn) return;
+	liveSbn = sbn;
+	const firstRetainedSbn = Math.max(0, liveSbn - config.interleaveDepth);
+	retiredSbnFrontier = Math.max(retiredSbnFrontier, firstRetainedSbn - 1);
+	trimBlockRetention();
+}
+
+function markBlockTerminal(
+	block: FecBlockSnapshot,
+	state: "complete" | "recovered" | "failed",
+): void {
+	block.state = state;
+	block.completedTs = performance.now();
+	retireAcceptedIds(block.sbn);
+	trimBlockRetention();
+}
+
+function synchronizeDecoderHorizon(): void {
+	if (!wasmDecoder) return;
+	const expired = wasmDecoder.cleanup_by_sbn(liveSbn);
+	for (const sbn of expired) {
+		const block = blocks.get(sbn);
+		if (!block || isTerminalBlock(block)) {
+			retireAcceptedIds(sbn);
+			continue;
+		}
+		markBlockTerminal(block, "failed");
+		blocksFailed++;
+		emitBlockUpdate(block);
+	}
+	trimBlockRetention();
+}
+
+/**
+ * Run detached ALTA verify against the current verifier. Four-state result:
+ *   - "valid":   crypto passed, packet authentic. Caller increments altaVerified.
+ *   - "failed":  crypto confirmed tamper (MAC/sig mismatch, hash chain mismatch).
+ *                Caller increments altaFailed. Not retryable.
+ *   - "pending": anchor missing (MAC refs not in buffer, no signature, not
+ *                early-warmup). Caller may enqueue for retry after the next
+ *                successful verify seeds the ring buffer.
+ *   - "error":   verifier threw — WASM trap, unmarshal panic, OOM. Caller
+ *                increments altaError (infrastructure flake, not tamper).
+ *                The distinction matters for ops alerting: a spike in
+ *                altaError indicates a runtime problem, not an attack.
+ */
+let _lastVerifyError = "";
+function runDetachedVerify(
+	auth: Uint8Array,
+	payload: Uint8Array,
+): "valid" | "failed" | "pending" | "error" {
+	if (!altaVerifier) return "pending";
+	try {
+		// eslint-disable-next-line @typescript-eslint/no-explicit-any
+		const r: any = altaVerifier.verifyDetached(auth, payload);
+		if (r.valid) {
+			_lastVerifyError = "";
+			return "valid";
+		}
+		const err = (r.error as string | undefined) ?? "";
+		_lastVerifyError = err;
+		// The bootstrap-friendly verifier returns this specific error string when
+		// the only obstacle to verification is a missing anchor (see alta-rs
+		// verifier.rs verify()). Distinguishing this from tamper cases keeps us
+		// from queuing packets that are definitively invalid.
+		if (err.startsWith("No trust anchor")) return "pending";
+		return "failed";
+	} catch (e) {
+		// Ratelimit: first ~N occurrences get logged. A sustained exception
+		// stream indicates a real problem — the altaError counter is the
+		// durable signal.
+		if (altaError < 5) {
+			console.warn("[FecWorker] verifyDetached threw:", e);
+		}
+		return "error";
+	}
+}
+
+/** Extract u32 BE sequence number from the ALTA authenticator header (offset 0..3). */
+function seqFromAuth(auth: Uint8Array): number {
+	return (
+		((auth[0]! << 24) | (auth[1]! << 16) | (auth[2]! << 8) | auth[3]!) >>> 0
+	);
+}
+
+/**
+ * Enqueue a packet whose ALTA verification returned "pending" (anchor
+ * missing). Dedupes by sequence number.
+ *
+ * Flood resistance (08-08 review): when the queue is at cap we do NOT
+ * evict the oldest entry. The oldest entry is typically the most
+ * load-bearing one — it's the packet whose anchor everything else in the
+ * queue is waiting on. Evict-oldest-on-insert let an attacker emitting a
+ * stream of "No trust anchor" packets flood out legitimate entries and
+ * prevent them from ever anchoring. Instead:
+ *   1. First try to free stale TTL'd entries (they'd be evicted on next
+ *      drain anyway — pulling that forward is free).
+ *   2. If still full, reject the NEW entry. altaPendingEvictedCap counts
+ *      these rejections (rate-limit trigger).
+ *
+ * Stores Uint8Array views into the original data + auth buffers — no copy.
+ * The views keep their underlying ArrayBuffers alive via GC references.
+ */
+function enqueuePendingVerify(
+	auth: Uint8Array,
+	payload: Uint8Array,
+): void {
+	const seq = seqFromAuth(auth);
+	if (pendingVerify.has(seq)) return;
+
+	if (pendingVerify.size >= pendingVerifyCap) {
+		// Step 1: sweep stale entries so legitimate traffic isn't penalized
+		// by TTL'd junk that happens to still occupy slots.
+		const now = performance.now();
+		for (const [staleSeq, entry] of pendingVerify) {
+			if (now - entry.arrivalTs > pendingVerifyTtlMs) {
+				pendingVerify.delete(staleSeq);
+				altaPendingEvictedTtl++;
+			}
+		}
+		// Step 2: if the queue is still at cap it's a genuine flood —
+		// reject the new entry rather than evict an existing one. The
+		// rejected packet counts as altaPendingEvictedCap (which is
+		// surfaced up through stats for rate-limit alerting).
+		if (pendingVerify.size >= pendingVerifyCap) {
+			altaPendingEvictedCap++;
+			return;
+		}
+	}
+
+	pendingVerify.set(seq, {
+		seq,
+		auth,
+		payload,
+		arrivalTs: performance.now(),
+	});
+}
+
+/**
+ * Retry every queued entry. Called after every successful verify (direct
+ * source or FEC-recovered) — new raw bytes in the verifier's ring buffer may
+ * unblock previously-pending MAC references.
+ *
+ * Three outcomes per entry:
+ *   - "valid"  → remove from queue, altaVerified++
+ *   - "failed" → remove from queue, altaFailed++ (tamper on retry)
+ *   - "pending" → keep in queue, unless TTL expired (then evict as altaPending)
+ *
+ * Iteration order: Map preserves insertion order, so we drain oldest-first.
+ * No-op when the queue is empty or the verifier isn't ready.
+ */
+function drainPendingVerify(): void {
+	if (pendingVerify.size === 0 || !altaVerifier) return;
+	const now = performance.now();
+	// Collect keys to avoid mutating Map during iteration
+	const keys = Array.from(pendingVerify.keys());
+	for (const seq of keys) {
+		const entry = pendingVerify.get(seq);
+		if (!entry) continue;
+		if (now - entry.arrivalTs > pendingVerifyTtlMs) {
+			pendingVerify.delete(seq);
+			altaPendingEvictedTtl++;
+			continue;
+		}
+		const result = runDetachedVerify(entry.auth, entry.payload);
+		if (result === "valid") {
+			pendingVerify.delete(seq);
+			altaVerified++;
+		} else if (result === "failed") {
+			pendingVerify.delete(seq);
+			altaFailed++;
+			if (altaFailedDetails.length < 16) {
+				altaFailedDetails.push({
+					seq: entry.seq,
+					error: _lastVerifyError,
+					authLen: entry.auth.length,
+					payloadLen: entry.payload.length,
+					path: "pending-retry",
+				});
+			}
+		} else if (result === "error") {
+			// Infrastructure failure — remove from queue, count as altaError.
+			// Keeping it around would just re-throw on every subsequent drain.
+			pendingVerify.delete(seq);
+			altaError++;
+		}
+		// "pending" → leave in queue for next drain
+	}
+}
+
+function getOrCreateBlock(sbn: number): FecBlockSnapshot {
+	let block = blocks.get(sbn);
+	if (!block) {
+		if (!config) throw new Error("[FecWorker] not configured");
+		const now = performance.now();
+		block = {
+			sbn,
+			state: "collecting",
+			sourceReceived: 0,
+			repairReceived: 0,
+			k: config.k,
+			repairCount: config.repairCount,
+			firstSymbolTs: now,
+			lastSymbolTs: now,
+			deadlineTs: now + config.deliveryWindowMs,
+			altaVerified: 0,
+			relayBlockSigValid: null,
+		};
+		blocks.set(sbn, block);
+		trimBlockRetention();
+	}
+	return block;
+}
+
+function buildStatsSnapshot(): FecTrackStats {
+	if (!config) throw new Error("[FecWorker] not configured");
+	const decoderStats = wasmDecoder?.get_stats();
+	const decoder = decoderStats
+		? {
+			sourcePackets: Number(decoderStats.source_packets),
+			repairPackets: Number(decoderStats.repair_packets),
+			blocksComplete: Number(decoderStats.blocks_complete),
+			blocksRecovered: Number(decoderStats.blocks_recovered),
+			blocksFailed: Number(decoderStats.blocks_failed),
+			bytesRecovered: Number(decoderStats.bytes_recovered),
+			pendingBlocks: wasmDecoder?.pending_blocks() ?? 0,
+		}
+		: undefined;
+
+	const avgRecoveryMs =
+		recoveryTimes.length > 0
+			? recoveryTimes.reduce((a, b) => a + b, 0) / recoveryTimes.length
+			: 0;
+	const maxRecoveryMs =
+		recoveryTimes.length > 0 ? Math.max(...recoveryTimes) : 0;
+
+	// Cap block array to interleave window
+	const maxBlocks = Math.max(config.interleaveDepth * 3, 24);
+	const blockArray = Array.from(blocks.values())
+		.sort((a, b) => b.sbn - a.sbn)
+		.slice(0, maxBlocks);
+
+	return {
+		config,
+		sourceSymbols,
+		repairSymbols,
+		blocksComplete,
+		blocksRecovered,
+		blocksFailed,
+		greenFillFrames,
+		recoveryRate:
+			blocksComplete + blocksRecovered > 0
+				? Math.round(
+						(blocksRecovered / (blocksRecovered + blocksFailed)) * 100,
+					) || 0
+				: 0,
+		altaVerified,
+		altaFailed,
+		altaPending,
+		altaPendingEvictedCap,
+		altaPendingEvictedTtl,
+		altaError,
+		altaInitFailed,
+		// eslint-disable-next-line @typescript-eslint/no-explicit-any
+		altaFailedDetails: altaFailedDetails.slice() as any,
+		relayBlocksVerified,
+		relayBlocksFailed,
+		liveSbn,
+		blocks: blockArray,
+		interleaveWindowBlocks: config.interleaveDepth,
+		avgRecoveryMs: Math.round(avgRecoveryMs * 100) / 100,
+		maxRecoveryMs: Math.round(maxRecoveryMs * 100) / 100,
+		repairSymbolSizeMismatch,
+		decoder,
+	};
+}
+
+function emitSnapshot(): void {
+	if (!config) return;
+	emit({ type: "snapshot", stats: buildStatsSnapshot() });
+}
+
+function emitBlockUpdate(block: FecBlockSnapshot): void {
+	emit({ type: "blockUpdate", block: { ...block } });
+}
+
+function emitRecoveredSymbols(
+	sbn: number,
+	recoveredBlock: Uint8Array,
+	block: FecBlockSnapshot,
+): void {
+	if (!config) return;
+	const symbolSize = config.symbolSize;
+	if (symbolSize <= 0) {
+		emit({
+			type: "error",
+			code: "recovered-symbol-size-unconfigured",
+			message: "[FecWorker] recovered block has no configured symbolSize",
+		});
+		return;
+	}
+	if (recoveredBlock.byteLength < symbolSize * config.k) {
+		emit({
+			type: "error",
+			code: "recovered-block-too-short",
+			message: `[FecWorker] recovered block too short: got ${recoveredBlock.byteLength}B, expected at least ${symbolSize * config.k}B`,
+		});
+		return;
+	}
+
+	for (let i = 0; i < config.k; i++) {
+		const symbol = recoveredBlock.subarray(i * symbolSize, (i + 1) * symbolSize);
+
+		// Source authentication now runs once at router admission in
+		// @blockcast/mmt-manifest-verify. The worker only records that this
+		// legacy ALTA-enabled symbol bypassed hot-path verification.
+		const recoveredAltaVerified: boolean | null = null;
+		if (altaEnabled) altaPending++;
+
+		const buf = toOwnedArrayBuffer(symbol);
+		const meta: FrameMeta = {
+			altaVerified: recoveredAltaVerified,
+			recovered: true,
+			sbn,
+			esi: i,
+		};
+		emit({ type: "frame", data: buf, meta }, [buf]);
+	}
+}
+
+function startSnapshotTimer(): void {
+	if (snapshotTimer !== null) clearInterval(snapshotTimer);
+	snapshotTimer = setInterval(() => emitSnapshot(), 200);
+}
+
+function resolveWasmBindings(): WasmBindings {
+	const bindings = (self as unknown as Record<string, unknown>)
+		.__MMT_WASM_BINDINGS__ as WasmBindings | undefined;
+	if (!bindings) {
+		throw new Error(
+			"[FecWorker] WASM bindings not available. Set self.__MMT_WASM_BINDINGS__ = { initSync, MmtFecDecoder } before configure.",
+		);
+	}
+	return bindings;
+}
+
+// --- Command handlers ---
+
+async function handleConfigure(
+	cmd: Extract<FecWorkerCommand, { type: "configure" }>,
+): Promise<void> {
+	if (!cmd.wasmModule) {
+		throw new Error("[FecWorker] configure: wasmModule required");
+	}
+	if (!cmd.config) {
+		throw new Error("[FecWorker] configure: config required");
+	}
+	if (
+		!Number.isFinite(cmd.config.interleaveDepth) ||
+		!Number.isInteger(cmd.config.interleaveDepth) ||
+		cmd.config.interleaveDepth <= 0 ||
+		cmd.config.interleaveDepth > MAX_INTERLEAVE_DEPTH
+	) {
+		throw new Error(
+			`[FecWorker] configure: interleaveDepth must be an integer in 1..${MAX_INTERLEAVE_DEPTH} (got ${cmd.config.interleaveDepth})`,
+		);
+	}
+	if (
+		!Number.isFinite(cmd.config.interleaveMs) ||
+		cmd.config.interleaveMs <= 0
+	) {
+		throw new Error(
+			`[FecWorker] configure: interleaveMs must be finite and > 0 (got ${cmd.config.interleaveMs})`,
+		);
+	}
+	if (
+		!Number.isFinite(cmd.config.deliveryWindowMs) ||
+		cmd.config.deliveryWindowMs <= 0
+	) {
+		throw new Error(
+			`[FecWorker] configure: deliveryWindowMs must be > 0 (got ${cmd.config.deliveryWindowMs})`,
+		);
+	}
+	if (
+		!Number.isInteger(cmd.config.k) ||
+		cmd.config.k <= 0 ||
+		cmd.config.k > MAX_RAPTORQ_SOURCE_SYMBOLS_PER_BLOCK
+	) {
+		throw new Error(
+			`[FecWorker] configure: k must be an integer in 1..${MAX_RAPTORQ_SOURCE_SYMBOLS_PER_BLOCK} (got ${cmd.config.k})`,
+		);
+	}
+	if (
+		!Number.isInteger(cmd.config.symbolSize) ||
+		cmd.config.symbolSize <= 0 ||
+		cmd.config.symbolSize > MAX_SYMBOL_SIZE ||
+		cmd.config.symbolSize % 8 !== 0
+	) {
+		throw new Error(
+			`[FecWorker] configure: symbolSize must be an 8-byte-aligned integer in 8..${MAX_SYMBOL_SIZE} (got ${cmd.config.symbolSize})`,
+		);
+	}
+
+	const wasm = resolveWasmBindings();
+
+	// Initialize WASM from pre-compiled Module (no fetch, no re-compile)
+	wasm.initSync({ module: cmd.wasmModule });
+
+	// A configure command starts a new decoder epoch. No terminal tombstone,
+	// accepted-symbol ID, or active block from the previous decoder may affect it.
+	wasmDecoder?.free();
+	wasmDecoder = null;
+	clearBlockTracking();
+
+	// Decoder policy and geometry are explicit at the epoch boundary. The WASM
+	// module has no guessed K/T/interleave slow path.
+	wasmDecoder = new wasm.MmtFecDecoder(
+		cmd.config.interleaveDepth,
+		cmd.config.trackType === "video",
+	);
+	config = cmd.config;
+	altaEnabled = !!cmd.altaPublicKey;
+
+	// Size the deferred-verify queue strictly from catalog-derived FEC
+	// parameters. CLAUDE.md bans Math.max(x, floor) magic — if catalog
+	// values are zero/missing, throw at init rather than silently applying
+	// a hardcoded floor. Consumers of an undersized queue cap would see
+	// altaPendingEvictedCap spike with no actionable signal.
+	// Cap: 1.5× interleave depth — wide enough to hold one full FEC recovery
+	// window plus jitter, narrow enough to bound memory.
+	pendingVerifyCap = Math.ceil(config.interleaveDepth * 1.5);
+	// TTL: 1.5× block duration (K symbols at one per interleave tick) —
+	// after this many ms, any unresolved entry has missed its FEC window.
+	pendingVerifyTtlMs = Math.ceil(config.interleaveMs * config.k * 1.5);
+
+	// Initialize ALTA WASM verifier if public key and WASM module provided (D-05, D-09)
+	altaVerifier = null;
+	altaInitFailed = false;
+	if (cmd.altaPublicKey && cmd.altaWasmModule) {
+		try {
+			// Load ALTA JS glue (wasm-bindgen output from wasm-pack build).
+			// Mirrors the RaptorQ WASM pattern: initSync({ module }) then construct.
+			// Dynamic import path matches the IWA static asset layout.
+			// Cast via string to prevent TypeScript from attempting static resolution
+			// of a runtime-only URL (same pattern as fec-worker-entry.js loading).
+			const altaGlueUrl = '/wasm/alta/alta_rs.js' as string;
+			// eslint-disable-next-line @typescript-eslint/no-explicit-any
+			const altaGlue: any = await import(/* webpackIgnore: true */ altaGlueUrl);
+			altaGlue.initSync({ module: cmd.altaWasmModule });
+			const keyBytes = new Uint8Array(cmd.altaPublicKey);
+			altaVerifier = new altaGlue.JsAltaVerifier(keyBytes);
+		} catch (e) {
+			// T-08-15: WASM init failure must NOT silently look like "not-ready-yet".
+			// Force altaEnabled = false so handleFeedSource takes the disabled
+			// branch instead of continuously bumping altaPending under the
+			// misleading "verifier not yet ready" comment. altaInitFailed
+			// flag in the snapshot tells consumers this is an error state, not
+			// an opt-out.
+			console.warn('[FecWorker] ALTA WASM init failed, verification disabled:', e);
+			altaVerifier = null;
+			altaEnabled = false;
+			altaInitFailed = true;
+		}
+	}
+
+	wasmDecoder.configure_params(config.k, config.symbolSize);
+
+	// Start periodic snapshot emission (200ms floor)
+	startSnapshotTimer();
+
+	// Emit initial snapshot
+	emitSnapshot();
+}
+
+function handleFeedSource(
+	cmd: Extract<FecWorkerCommand, { type: "feedSource" }>,
+): void {
+	if (!wasmDecoder) {
+		throw new Error("[FecWorker] feedSource: not configured");
+	}
+	if (!config) {
+		throw new Error("[FecWorker] feedSource: config missing");
+	}
+	if (
+		!isUint32(cmd.ssId) ||
+		!(cmd.data instanceof ArrayBuffer)
+	) {
+		throw new Error("[FecWorker] feedSource: invalid source symbol");
+	}
+
+	const view = new Uint8Array(cmd.data);
+
+	// Derive SBN locally for block-level accounting. WASM derives the same
+	// value internally (ISO 23008-1 §C.5.2: SBN = floor(SS_ID / K)).
+	const sbn = config.k > 0 ? Math.floor(cmd.ssId / config.k) : cmd.ssId;
+	const esi = cmd.ssId % config.k;
+	if (sbn <= retiredSbnFrontier) return;
+	const existingBlock = blocks.get(sbn);
+	if (existingBlock && isTerminalBlock(existingBlock)) return;
+	if (acceptedSourceEsis.get(sbn)?.has(esi)) return;
+
+	const result = wasmDecoder.add_source(cmd.ssId, view, cmd.ts);
+	advanceMediaHorizon(sbn);
+	let sourceEsis = acceptedSourceEsis.get(sbn);
+	if (!sourceEsis) {
+		sourceEsis = new Set<number>();
+		acceptedSourceEsis.set(sbn, sourceEsis);
+	}
+	sourceEsis.add(esi);
+
+	// Update block state
+	const block = getOrCreateBlock(sbn);
+	block.sourceReceived++;
+	block.lastSymbolTs = performance.now();
+	sourceSymbols++;
+
+	// The FEC worker must remain decode-only on the per-symbol hot path. ALTA
+	// WASM is retained temporarily for low-rate signaling users, but media is
+	// authenticated by the canonical manifest verifier at router admission.
+	if (altaEnabled) altaPending++;
+
+	// Check if block is complete (all K source symbols received)
+	if (
+		block.sourceReceived >= block.k &&
+		block.state === "collecting"
+	) {
+		markBlockTerminal(block, "complete");
+		blocksComplete++;
+		emitBlockUpdate(block);
+	}
+
+		// A source-triggered return can be either clean block completion or recovery
+		// of earlier missing symbols after repair arrived. Clean completion is
+		// already routed by the source path, so only emit when the block did not
+		// reach K source arrivals.
+		if (result && result.byteLength > 0 && block.sourceReceived < block.k) {
+			const recovered = new Uint8Array(toOwnedArrayBuffer(result));
+			const recoveryMs = performance.now() - block.firstSymbolTs;
+			recoveryTimes.push(recoveryMs);
+			if (recoveryTimes.length > 1000) recoveryTimes.shift();
+
+			if (block.state === "collecting") {
+				markBlockTerminal(block, "recovered");
+				blocksRecovered++;
+				emitBlockUpdate(block);
+			}
+			emitRecoveredSymbols(sbn, recovered, block);
+		}
+		synchronizeDecoderHorizon();
+	}
+
+function handleFeedRepair(
+	cmd: Extract<FecWorkerCommand, { type: "feedRepair" }>,
+): void {
+	if (!wasmDecoder) {
+		throw new Error("[FecWorker] feedRepair: not configured");
+	}
+	if (!config) {
+		throw new Error("[FecWorker] feedRepair: config missing");
+	}
+	if (
+		!isUint32(cmd.ssStart) ||
+		!isUint32(cmd.ssbLength) ||
+		cmd.ssbLength <= 0 ||
+		cmd.ssbLength !== config.k ||
+		cmd.ssStart % cmd.ssbLength !== 0 ||
+		!isUint32(cmd.rsId) ||
+		cmd.ssbLength + cmd.rsId > UINT24_MAX ||
+		!(cmd.data instanceof ArrayBuffer)
+	) {
+		throw new Error("[FecWorker] feedRepair: invalid repair symbol");
+	}
+
+	const view = new Uint8Array(cmd.data);
+	if (config.symbolSize > 0 && view.byteLength !== config.symbolSize) {
+		repairSymbolSizeMismatch++;
+		if (repairSymbolSizeMismatch <= 5 || repairSymbolSizeMismatch % 100 === 0) {
+			emit({
+				type: "error",
+				code: "repair-symbol-size-mismatch",
+				message: `[FecWorker] Dropping repair symbol with invalid size: got ${view.byteLength}B, expected ${config.symbolSize}B (ssStart=${cmd.ssStart}, ssbLength=${cmd.ssbLength}, rsId=${cmd.rsId})`,
+			});
+		}
+		return;
+	}
+	const sbn = Math.floor(cmd.ssStart / cmd.ssbLength);
+	const repairEsi = cmd.ssbLength + cmd.rsId;
+	if (sbn <= retiredSbnFrontier) return;
+	const existingBlock = blocks.get(sbn);
+	if (existingBlock && isTerminalBlock(existingBlock)) return;
+	if (acceptedRepairEsis.get(sbn)?.has(repairEsi)) return;
+
+	const result = wasmDecoder.add_repair(
+		cmd.ssStart,
+		cmd.ssbLength,
+		cmd.rsId,
+		view,
+		cmd.ts,
+	);
+	advanceMediaHorizon(sbn);
+	let repairEsis = acceptedRepairEsis.get(sbn);
+	if (!repairEsis) {
+		repairEsis = new Set<number>();
+		acceptedRepairEsis.set(sbn, repairEsis);
+	}
+	repairEsis.add(repairEsi);
+	const block = getOrCreateBlock(sbn);
+	block.repairReceived++;
+	block.lastSymbolTs = performance.now();
+	repairSymbols++;
+		// If WASM returned data, it is the recovered source block: K fixed-width
+		// source symbols concatenated. Split it before emitting so MmtpRouter gets
+		// the same one-symbol shape as a direct source packet.
+		if (result && result.byteLength > 0) {
+			const recovered = new Uint8Array(toOwnedArrayBuffer(result));
+			const recoveryMs = performance.now() - block.firstSymbolTs;
+			recoveryTimes.push(recoveryMs);
+		// Cap recovery times array at 1000 entries
+		if (recoveryTimes.length > 1000) recoveryTimes.shift();
+
+		if (block.state === "collecting") {
+			markBlockTerminal(block, "recovered");
+			blocksRecovered++;
+				emitBlockUpdate(block);
+			}
+			emitRecoveredSymbols(sbn, recovered, block);
+		}
+		synchronizeDecoderHorizon();
+	}
+
+function handleRelayBlockSig(
+	cmd: Extract<FecWorkerCommand, { type: "relayBlockSig" }>,
+): void {
+	// No-op AUTH stub: store sig on block, mark as not-yet-verified
+	const block = blocks.get(cmd.sbn);
+	if (block) {
+		// Real verification deferred to ALTA milestone
+		// For now, mark as null (not verified) — will be wired when ALTA is implemented
+		block.relayBlockSigValid = null;
+		emitBlockUpdate(block);
+	}
+}
+
+function handleCleanup(
+	cmd: Extract<FecWorkerCommand, { type: "cleanup" }>,
+): void {
+	if (
+		!Array.isArray(cmd.sbns) ||
+		cmd.sbns.length === 0 ||
+		!cmd.sbns.every(isUint32)
+	) {
+		throw new Error("[FecWorker] cleanup: invalid SBNs");
+	}
+	const sbns = [...new Set(cmd.sbns)].sort((a, b) => a - b);
+	const pendingSbns = sbns.filter((sbn) => sbn > retiredSbnFrontier);
+	try {
+		if (!wasmDecoder) {
+			throw new Error("[FecWorker] cleanup: not configured");
+		}
+
+		// Call WASM cleanup only after all earlier symbol commands have drained.
+		// The detailed API carries the true owner of every fill emitted by a
+		// single cleanup pass; command coalescing must not infer ownership from
+		// the largest timed-out SBN.
+		const cleanupRecords = pendingSbns.length > 0
+			? wasmDecoder.cleanup_blocks_detailed(Uint32Array.from(pendingSbns))
+			: new Uint8Array();
+		// Manager deadlines are block-scoped and may expire a newer SBN while an
+		// older interleaved block is still live. Only accepted media progression
+		// advances the shared JS/Rust horizon; cleanup creates exact tombstones.
+
+		// Rust already finalized every SBN behind the media frontier. For each
+		// remaining exact request, mirror the block-scoped WASM boundary immediately
+		// so JS never retains state for a decoder block that is gone, even if decoding
+		// the trusted cleanup framing were to fail.
+		for (const sbn of pendingSbns) {
+			let currentBlock = blocks.get(sbn);
+			if (currentBlock && isTerminalBlock(currentBlock)) {
+				retireAcceptedIds(sbn);
+				continue;
+			}
+			currentBlock ??= getOrCreateBlock(sbn);
+			if (currentBlock.sourceReceived >= currentBlock.k) {
+				markBlockTerminal(currentBlock, "complete");
+				blocksComplete++;
+			} else {
+				markBlockTerminal(currentBlock, "failed");
+				blocksFailed++;
+			}
+			emitBlockUpdate(currentBlock);
+		}
+
+		const greenFills = decodeCleanupRecords(cleanupRecords);
+		for (const { sbn, data } of greenFills) {
+			greenFillFrames++;
+			emit({ type: "greenFill", sbn, data }, [data]);
+		}
+	} finally {
+		// Message ordering makes this an acknowledgement that every source/repair
+		// command posted before cleanup has completed. The main thread must not
+		// commit failure accounting until it observes this event.
+		emit({ type: "cleanupComplete", sbns });
+	}
+}
+
+function decodeCleanupRecords(
+	framed: Uint8Array,
+): Array<{ sbn: number; data: ArrayBuffer }> {
+	const records: Array<{ sbn: number; data: ArrayBuffer }> = [];
+	const view = new DataView(framed.buffer, framed.byteOffset, framed.byteLength);
+	let offset = 0;
+	while (offset < framed.byteLength) {
+		if (framed.byteLength - offset < 8) {
+			throw new Error("[FecWorker] cleanup_blocks_detailed: truncated record header");
+		}
+		const sbn = view.getUint32(offset, false);
+		const length = view.getUint32(offset + 4, false);
+		offset += 8;
+		if (length > framed.byteLength - offset) {
+			throw new Error("[FecWorker] cleanup_blocks_detailed: truncated record payload");
+		}
+		const data = toOwnedArrayBuffer(framed.subarray(offset, offset + length));
+		records.push({ sbn, data });
+		offset += length;
+	}
+	return records;
+}
+
+function handleDispose(): void {
+	// Clear snapshot timer (MUST clear to prevent leaks)
+	if (snapshotTimer !== null) {
+		clearInterval(snapshotTimer);
+		snapshotTimer = null;
+	}
+
+	// Free ALTA verifier WASM object (MUST call to release WASM memory —
+	// Worker.terminate() fires immediately after dispose, so the FinalizationRegistry
+	// callback has no chance to run and this memory would leak without explicit free)
+	if (altaVerifier) {
+		try {
+			altaVerifier.free();
+		} catch (_e) {
+			// Best-effort — verifier may already be freed
+		}
+		altaVerifier = null;
+	}
+
+	// Free WASM decoder (MUST call to release WASM memory)
+	if (wasmDecoder) {
+		wasmDecoder.free();
+		wasmDecoder = null;
+	}
+
+	// Clear deferred-verify queue so pinned ArrayBuffers drop.
+	pendingVerify.clear();
+	pendingVerifyCap = 0;
+	pendingVerifyTtlMs = 0;
+
+	config = null;
+	clearBlockTracking();
+}
+
+function handleReset(): void {
+	try {
+		wasmDecoder?.flush();
+		wasmDecoder?.reset_stats();
+	} catch (err) {
+		emit({
+			type: "error",
+			code: "reset-failed",
+			message:
+				err instanceof Error
+					? `[FecWorker] reset failed: ${err.message}`
+					: `[FecWorker] reset failed: ${String(err)}`,
+		});
+		return;
+	}
+
+	clearBlockTracking();
+	sourceSymbols = 0;
+	repairSymbols = 0;
+	blocksComplete = 0;
+	blocksRecovered = 0;
+	blocksFailed = 0;
+	greenFillFrames = 0;
+	altaVerified = 0;
+	altaFailed = 0;
+	altaFailedDetails.length = 0;
+	altaPending = 0;
+	altaPendingEvictedCap = 0;
+	altaPendingEvictedTtl = 0;
+	altaError = 0;
+	relayBlocksVerified = 0;
+	relayBlocksFailed = 0;
+	repairSymbolSizeMismatch = 0;
+	emit({ type: "resetComplete" });
+	if (config) emitSnapshot();
+}
+
+// --- Main message handler ---
+
+async function dispatchCommand(cmd: FecWorkerCommand): Promise<void> {
+	try {
+		switch (cmd.type) {
+			case "configure":
+				// handleConfigure is async (ALTA WASM init uses dynamic import).
+				// Await it so feed/cleanup messages cannot run against a partially
+				// configured decoder.
+				await handleConfigure(cmd);
+				break;
+			case "feedSource":
+				handleFeedSource(cmd);
+				break;
+			case "feedRepair":
+				handleFeedRepair(cmd);
+				break;
+			case "relayBlockSig":
+				handleRelayBlockSig(cmd);
+				break;
+			case "cleanup":
+				handleCleanup(cmd);
+				break;
+			case "reset":
+				handleReset();
+				break;
+			case "dispose":
+				handleDispose();
+				break;
+			default:
+				emit({
+					type: "error",
+					code: "unknown-command",
+					message: `Unknown command type: ${(cmd as Record<string, unknown>).type}`,
+				});
+		}
+	} catch (err) {
+		emit({
+			type: "error",
+			code: "command-failed",
+			message:
+				err instanceof Error ? err.message : `[FecWorker] ${String(err)}`,
+		});
+	}
+}
+
+let commandQueue: Promise<void> = Promise.resolve();
+
+self.onmessage = (e: MessageEvent<FecWorkerCommand>) => {
+	const cmd = e.data;
+	commandQueue = commandQueue.then(() => dispatchCommand(cmd));
+};