@blockcast/fec-worker 0.3.0 → 0.4.0-main.86f861ac235a

package/src/fec-worker.ts

@@ -22,8 +22,6 @@ import type {
 } from "./fec-worker-types.js";
 import { toOwnedArrayBuffer } from "./transfer.js";
 import {
-	blockPrecedes,
-	blocksBehind,
 	isoBlockContains,
 	isoBlocksBehind,
 	isoBlocksOverlap,
@@ -36,10 +34,9 @@ import {
 // The decoder derives SBN/ESI internally — do not pre-compute.
 interface WasmFecDecoder {
 	/**
-	 * ISO 23008-1 §C.5.2: ss_id is the flat 32-bit Source Symbol ID.
-	 * `k-padded-v1`: data is the source symbol. `iso-ssbg1-v1`: data is the
-	 * protected packet, unpadded; the decoder builds the ssbg_mode1 symbol and
-	 * holds it until a repair names the block containing it.
+	 * ISO 23008-1 §C.5.2: ss_id is the flat 32-bit Source Symbol ID; data is
+	 * the protected packet, unpadded. The decoder builds the ssbg_mode1 symbol
+	 * and holds it until a repair names the block containing it.
 	 */
 	add_source(
 		ss_id: number,
@@ -47,11 +44,9 @@ interface WasmFecDecoder {
 		timestamp: number,
 	): Uint8Array | undefined;
 	/**
-	 * ISO 23008-1 §C.5.3. `k-padded-v1`: repair ESI = configured K + rs_id,
-	 * SBN = ss_start / configured K. `iso-ssbg1-v1`: the block is
-	 * `[ss_start, ss_start + ssb_length)` with K' = ssb_length and repair
-	 * ESI = ssb_length + rs_id; a recovered block is ssb_length x T bytes of
-	 * ssbg_mode1 symbols.
+	 * ISO 23008-1 §C.5.3: the block is `[ss_start, ss_start + ssb_length)`
+	 * with K' = ssb_length and repair ESI = ssb_length + rs_id; a recovered
+	 * block is ssb_length x T bytes of ssbg_mode1 symbols.
 	 */
 	add_repair(
 		ss_start: number,
@@ -68,14 +63,12 @@ interface WasmFecDecoder {
 	 */
 	cleanup_blocks_detailed(sbns: Uint32Array): void;
 	/**
-	 * `k-padded-v1` only (throws under `iso-ssbg1-v1`): remove decoder blocks
-	 * below its configured live-SBN interleave horizon; returns their SBNs.
-	 */
-	cleanup_by_sbn(current_sbn: number): Uint32Array;
-	/**
-	 * `iso-ssbg1-v1` only: remove decoder blocks, and held unplaced sources,
-	 * more than interleaveDepth `isoBlocksBehind` the live SS_ID; returns the
-	 * SS_Starts of the blocks it removed.
+	 * Remove decoder blocks, and held unplaced sources, more than
+	 * interleaveDepth `isoBlocksBehind` the live SS_ID; returns the SS_Starts
+	 * of the blocks it removed. It runs the decoder's `retire_unplaced` sweep
+	 * itself, so the Worker never calls that separately: synchronizeDecoderHorizon
+	 * calls this after every source and repair it accepts, which is what keeps
+	 * the decoder's unplaced pool bounded when a block's repairs never arrive.
 	 */
 	cleanup_by_ss_start(current: number): Uint32Array;
 	/** The block profile the decoder was constructed with. */
@@ -104,9 +97,6 @@ interface WasmBindings {
 
 let wasmDecoder: WasmFecDecoder | null = null;
 let config: FecTrackConfig | null = null;
-let altaEnabled = false;
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
-let altaVerifier: any = null;  // JsAltaVerifier instance (loaded from ALTA WASM)
 let snapshotTimer: ReturnType<typeof setInterval> | null = null;
 // blockUpdate events are posted only after a client subscribes (BLO-36599).
 let blockUpdatesSubscribed = false;
@@ -137,20 +127,6 @@ let repairSymbols = 0;
 let blocksComplete = 0;
 let blocksRecovered = 0;
 let blocksFailed = 0;
-let altaVerified = 0;
-let altaFailed = 0;            // Crypto-confirmed tamper (MAC / sig / hash chain mismatch)
-const altaFailedDetails: Array<{
-	seq: number;
-	error: string;
-	authLen: number;
-	payloadLen: number;
-	path: string; // "direct" | "recovered" | "pending-retry"
-}> = [];
-let altaPending = 0;           // Unverifiable but not tamper (no trailer, verifier not ready, anchor missing)
-let altaPendingEvictedCap = 0; // Incoming "pending" packets rejected because the queue was at cap after stale-sweep (flood indicator)
-let altaPendingEvictedTtl = 0; // Deferred-queue entries dropped by TTL (retry window expired)
-let altaError = 0;             // verifyDetached threw — infrastructure flake, not tamper
-let altaInitFailed = false;    // ALTA configured but WASM init failed; altaEnabled was forced off
 let relayBlocksVerified = 0;
 let relayBlocksFailed = 0;
 let liveSbn = 0;
@@ -188,35 +164,6 @@ let sourceUnplacedRetired = 0;
 // Recovery timing
 const recoveryTimes: number[] = [];
 
-// ── Deferred ALTA verification queue (08-07 Path 3) ───────────────────────
-//
-// When an ALTA packet arrives whose MAC references point at sequences not yet
-// in the verifier's ring buffer, we can't anchor trust — verify returns "No
-// trust anchor". Typical cause: a predecessor packet was lost and hasn't been
-// FEC-recovered yet. Rather than drop these, hold them in a bounded FIFO and
-// retry verification after every successful verify (direct or FEC-recovered)
-// that seeds the ring buffer with new raw bytes.
-//
-// Zero-copy (1B-B): the queue entry stores a Uint8Array view into the
-// original `data` ArrayBuffer. JS GC keeps the buffer alive via the view
-// reference; no bytes are copied on queue.
-//
-// Timeout entries (TTL exceeded) and cap-rejections count as `altaPending`
-// (2C-B): they're not tamper indicators, they're just packets that couldn't
-// be authenticated within the receive window — either loss or, in the cap
-// case, a flood of unanchorable arrivals (real or attacker-driven) that
-// exceeded the queue budget. See enqueuePendingVerify for the rate-limit
-// protocol.
-interface PendingVerify {
-	seq: number;
-	auth: Uint8Array;
-	payload: Uint8Array;
-	arrivalTs: number;
-}
-const pendingVerify = new Map<number, PendingVerify>();
-let pendingVerifyCap = 0;
-let pendingVerifyTtlMs = 0;
-
 // --- Helpers ---
 
 function emit(event: FecWorkerEvent, transfer?: Transferable[]): void {
@@ -241,7 +188,6 @@ function clearBlockTracking(): void {
 	acceptedSourceEsis.clear();
 	acceptedRepairEsis.clear();
 	unplacedSources.clear();
-	pendingVerify.clear();
 	recoveryTimes.length = 0;
 	liveSbn = 0;
 	liveSbnKnown = false;
@@ -255,15 +201,9 @@ function clearBlockTracking(): void {
  */
 function isRetiredSbn(sbn: number): boolean {
 	if (config === null || !liveSbnKnown) return false;
-	// iso-ssbg1-v1: `sbn` is an SS_ID (a block's SS_Start or a source's own
-	// SS_ID) and liveSbn the live SS_ID; K is only the maximum block length.
-	return config.blockProfile === "iso-ssbg1-v1"
-		? isoBlocksBehind(sbn, liveSbn, config.k) > config.interleaveDepth
-		: blocksBehind(sbn, liveSbn, config.k) > config.interleaveDepth;
-}
-
-function isIsoProfile(): boolean {
-	return config?.blockProfile === "iso-ssbg1-v1";
+	// `sbn` is an SS_ID (a block's SS_Start or a source's own SS_ID) and
+	// liveSbn the live SS_ID; K is only the maximum block length.
+	return isoBlocksBehind(sbn, liveSbn, config.k) > config.interleaveDepth;
 }
 
 /**
@@ -291,9 +231,7 @@ function findIsoBlock(ssId: number): FecBlockSnapshot | undefined {
  * retired, after which the SS_ID retirement check refuses every member.
  */
 function isRetiredBlock(key: number, block: FecBlockSnapshot): boolean {
-	return isIsoProfile()
-		? isRetiredSbn((key + isoKnownLength(block) - 1) % SS_ID_SPAN)
-		: isRetiredSbn(key);
+	return isRetiredSbn((key + isoKnownLength(block) - 1) % SS_ID_SPAN);
 }
 
 /**
@@ -310,15 +248,10 @@ function trimBlockRetention(): void {
 	}
 }
 
-/** Advance the live position: an SBN (k-padded-v1) or an SS_ID / SS_Start (iso-ssbg1-v1). */
+/** Advance the live position: an SS_ID / SS_Start, in serial order. */
 function advanceMediaHorizon(sbn: number): void {
 	if (!config) return;
-	if (liveSbnKnown) {
-		const ahead = config.blockProfile === "iso-ssbg1-v1"
-			? serialPrecedes(liveSbn, sbn)
-			: blockPrecedes(liveSbn, sbn, config.k);
-		if (!ahead) return;
-	}
+	if (liveSbnKnown && !serialPrecedes(liveSbn, sbn)) return;
 	liveSbn = sbn;
 	liveSbnKnown = true;
 	trimBlockRetention();
@@ -336,10 +269,7 @@ function markBlockTerminal(
 
 function synchronizeDecoderHorizon(): void {
 	if (!wasmDecoder || !liveSbnKnown) return;
-	const iso = isIsoProfile();
-	const expired = iso
-		? wasmDecoder.cleanup_by_ss_start(liveSbn)
-		: wasmDecoder.cleanup_by_sbn(liveSbn);
+	const expired = wasmDecoder.cleanup_by_ss_start(liveSbn);
 	for (const sbn of expired) {
 		const block = blocks.get(sbn);
 		if (!block || isTerminalBlock(block)) {
@@ -350,7 +280,7 @@ function synchronizeDecoderHorizon(): void {
 		blocksFailed++;
 		emitBlockUpdate(block);
 	}
-	if (iso) retireUnplacedSources();
+	retireUnplacedSources();
 	trimBlockRetention();
 }
 
@@ -373,163 +303,6 @@ function retireUnplacedSources(): void {
 	}
 }
 
-/**
- * Run detached ALTA verify against the current verifier. Four-state result:
- *   - "valid":   crypto passed, packet authentic. Caller increments altaVerified.
- *   - "failed":  crypto confirmed tamper (MAC/sig mismatch, hash chain mismatch).
- *                Caller increments altaFailed. Not retryable.
- *   - "pending": anchor missing (MAC refs not in buffer, no signature, not
- *                early-warmup). Caller may enqueue for retry after the next
- *                successful verify seeds the ring buffer.
- *   - "error":   verifier threw — WASM trap, unmarshal panic, OOM. Caller
- *                increments altaError (infrastructure flake, not tamper).
- *                The distinction matters for ops alerting: a spike in
- *                altaError indicates a runtime problem, not an attack.
- */
-let _lastVerifyError = "";
-function runDetachedVerify(
-	auth: Uint8Array,
-	payload: Uint8Array,
-): "valid" | "failed" | "pending" | "error" {
-	if (!altaVerifier) return "pending";
-	try {
-		// eslint-disable-next-line @typescript-eslint/no-explicit-any
-		const r: any = altaVerifier.verifyDetached(auth, payload);
-		if (r.valid) {
-			_lastVerifyError = "";
-			return "valid";
-		}
-		const err = (r.error as string | undefined) ?? "";
-		_lastVerifyError = err;
-		// The bootstrap-friendly verifier returns this specific error string when
-		// the only obstacle to verification is a missing anchor (see alta-rs
-		// verifier.rs verify()). Distinguishing this from tamper cases keeps us
-		// from queuing packets that are definitively invalid.
-		if (err.startsWith("No trust anchor")) return "pending";
-		return "failed";
-	} catch (e) {
-		// Ratelimit: first ~N occurrences get logged. A sustained exception
-		// stream indicates a real problem — the altaError counter is the
-		// durable signal.
-		if (altaError < 5) {
-			console.warn("[FecWorker] verifyDetached threw:", e);
-		}
-		return "error";
-	}
-}
-
-/** Extract u32 BE sequence number from the ALTA authenticator header (offset 0..3). */
-function seqFromAuth(auth: Uint8Array): number {
-	return (
-		((auth[0]! << 24) | (auth[1]! << 16) | (auth[2]! << 8) | auth[3]!) >>> 0
-	);
-}
-
-/**
- * Enqueue a packet whose ALTA verification returned "pending" (anchor
- * missing). Dedupes by sequence number.
- *
- * Flood resistance (08-08 review): when the queue is at cap we do NOT
- * evict the oldest entry. The oldest entry is typically the most
- * load-bearing one — it's the packet whose anchor everything else in the
- * queue is waiting on. Evict-oldest-on-insert let an attacker emitting a
- * stream of "No trust anchor" packets flood out legitimate entries and
- * prevent them from ever anchoring. Instead:
- *   1. First try to free stale TTL'd entries (they'd be evicted on next
- *      drain anyway — pulling that forward is free).
- *   2. If still full, reject the NEW entry. altaPendingEvictedCap counts
- *      these rejections (rate-limit trigger).
- *
- * Stores Uint8Array views into the original data + auth buffers — no copy.
- * The views keep their underlying ArrayBuffers alive via GC references.
- */
-function enqueuePendingVerify(
-	auth: Uint8Array,
-	payload: Uint8Array,
-): void {
-	const seq = seqFromAuth(auth);
-	if (pendingVerify.has(seq)) return;
-
-	if (pendingVerify.size >= pendingVerifyCap) {
-		// Step 1: sweep stale entries so legitimate traffic isn't penalized
-		// by TTL'd junk that happens to still occupy slots.
-		const now = performance.now();
-		for (const [staleSeq, entry] of pendingVerify) {
-			if (now - entry.arrivalTs > pendingVerifyTtlMs) {
-				pendingVerify.delete(staleSeq);
-				altaPendingEvictedTtl++;
-			}
-		}
-		// Step 2: if the queue is still at cap it's a genuine flood —
-		// reject the new entry rather than evict an existing one. The
-		// rejected packet counts as altaPendingEvictedCap (which is
-		// surfaced up through stats for rate-limit alerting).
-		if (pendingVerify.size >= pendingVerifyCap) {
-			altaPendingEvictedCap++;
-			return;
-		}
-	}
-
-	pendingVerify.set(seq, {
-		seq,
-		auth,
-		payload,
-		arrivalTs: performance.now(),
-	});
-}
-
-/**
- * Retry every queued entry. Called after every successful verify (direct
- * source or FEC-recovered) — new raw bytes in the verifier's ring buffer may
- * unblock previously-pending MAC references.
- *
- * Three outcomes per entry:
- *   - "valid"  → remove from queue, altaVerified++
- *   - "failed" → remove from queue, altaFailed++ (tamper on retry)
- *   - "pending" → keep in queue, unless TTL expired (then evict as altaPending)
- *
- * Iteration order: Map preserves insertion order, so we drain oldest-first.
- * No-op when the queue is empty or the verifier isn't ready.
- */
-function drainPendingVerify(): void {
-	if (pendingVerify.size === 0 || !altaVerifier) return;
-	const now = performance.now();
-	// Collect keys to avoid mutating Map during iteration
-	const keys = Array.from(pendingVerify.keys());
-	for (const seq of keys) {
-		const entry = pendingVerify.get(seq);
-		if (!entry) continue;
-		if (now - entry.arrivalTs > pendingVerifyTtlMs) {
-			pendingVerify.delete(seq);
-			altaPendingEvictedTtl++;
-			continue;
-		}
-		const result = runDetachedVerify(entry.auth, entry.payload);
-		if (result === "valid") {
-			pendingVerify.delete(seq);
-			altaVerified++;
-		} else if (result === "failed") {
-			pendingVerify.delete(seq);
-			altaFailed++;
-			if (altaFailedDetails.length < 16) {
-				altaFailedDetails.push({
-					seq: entry.seq,
-					error: _lastVerifyError,
-					authLen: entry.auth.length,
-					payloadLen: entry.payload.length,
-					path: "pending-retry",
-				});
-			}
-		} else if (result === "error") {
-			// Infrastructure failure — remove from queue, count as altaError.
-			// Keeping it around would just re-throw on every subsequent drain.
-			pendingVerify.delete(seq);
-			altaError++;
-		}
-		// "pending" → leave in queue for next drain
-	}
-}
-
 /**
  * Look up or create a block. `isoSsbLength` creates an iso-ssbg1-v1 block,
  * whose K' is its SSB_length (C.5.3); without it the block has the catalog K.
@@ -548,8 +321,9 @@ function getOrCreateBlock(sbn: number, isoSsbLength?: number): FecBlockSnapshot
 			repairCount: config.repairCount,
 			firstSymbolTs: now,
 			lastSymbolTs: now,
+			// A positive interleaveMs makes this the catalog completion deadline;
+			// zero makes deliveryWindowMs a receiver-local cleanup bound.
 			deadlineTs: now + config.deliveryWindowMs,
-			altaVerified: 0,
 			relayBlockSigValid: null,
 		};
 		if (isoSsbLength !== undefined) block.ssbLength = isoSsbLength;
@@ -583,8 +357,10 @@ function buildStatsSnapshot(): FecTrackStats {
 
 	// Cap block array to interleave window
 	const maxBlocks = Math.max(config.interleaveDepth * 3, 24);
+	// Newest first in SS_ID serial order, so the cap keeps the newest blocks
+	// across the 2^32 wrap too: every block start precedes the live SS_ID.
 	const blockArray = Array.from(blocks.values())
-		.sort((a, b) => b.sbn - a.sbn)
+		.sort((a, b) => serialDistance(a.sbn, liveSbn) - serialDistance(b.sbn, liveSbn))
 		.slice(0, maxBlocks);
 
 	return {
@@ -600,15 +376,6 @@ function buildStatsSnapshot(): FecTrackStats {
 						(blocksRecovered / (blocksRecovered + blocksFailed)) * 100,
 					) || 0
 				: 0,
-		altaVerified,
-		altaFailed,
-		altaPending,
-		altaPendingEvictedCap,
-		altaPendingEvictedTtl,
-		altaError,
-		altaInitFailed,
-		// eslint-disable-next-line @typescript-eslint/no-explicit-any
-		altaFailedDetails: altaFailedDetails.slice() as any,
 		relayBlocksVerified,
 		relayBlocksFailed,
 		liveSbn,
@@ -620,7 +387,7 @@ function buildStatsSnapshot(): FecTrackStats {
 		sourceDroppedRetired,
 		sourceDroppedTerminal,
 		sourceDroppedDuplicate,
-		...(config.blockProfile === "iso-ssbg1-v1" ? { sourceUnplacedRetired } : {}),
+		sourceUnplacedRetired,
 		decoder,
 	};
 }
@@ -662,33 +429,23 @@ function emitRecoveredSymbols(
 		return;
 	}
 
-	const iso = config.blockProfile === "iso-ssbg1-v1";
 	for (let i = 0; i < ssbLength; i++) {
 		const symbol = recoveredBlock.subarray(i * symbolSize, (i + 1) * symbolSize);
 		// ssbg_mode1 symbols are emitted whole: the router trims them by their
 		// length field. A field past T-2 or non-zero padding means the
 		// recovered symbol is not what was sent, so it is refused, not trimmed.
-		if (iso) {
-			const invalid = invalidSsbg1Symbol(symbol, symbolSize);
-			if (invalid !== null) {
-				emit({
-					type: "error",
-					code: "recovered-ssbg1-symbol-invalid",
-					message: `[FecWorker] Dropping recovered ssbg_mode1 symbol (ssStart=${sbn}, esi=${i}, SSB_length=${ssbLength}): ${invalid}`,
-				});
-				continue;
-			}
+		const invalid = invalidSsbg1Symbol(symbol, symbolSize);
+		if (invalid !== null) {
+			emit({
+				type: "error",
+				code: "recovered-ssbg1-symbol-invalid",
+				message: `[FecWorker] Dropping recovered ssbg_mode1 symbol (ssStart=${sbn}, esi=${i}, SSB_length=${ssbLength}): ${invalid}`,
+			});
+			continue;
 		}
 
-		// Source authentication now runs once at router admission in
-		// @blockcast/mmt-manifest-verify. The worker only records that this
-		// legacy ALTA-enabled symbol bypassed hot-path verification.
-		const recoveredAltaVerified: boolean | null = null;
-		if (altaEnabled) altaPending++;
-
 		const buf = toOwnedArrayBuffer(symbol);
 		const meta: FrameMeta = {
-			altaVerified: recoveredAltaVerified,
 			recovered: true,
 			sbn,
 			esi: i,
@@ -857,7 +614,6 @@ function feedIsoSource(
 		advanceMediaHorizon(cmd.ssId);
 		unplacedSources.set(cmd.ssId, performance.now());
 		sourceSymbols++;
-		if (altaEnabled) altaPending++;
 		// No repair has named this source's block, so the decoder cannot have
 		// one to recover; data here is a Worker/decoder disagreement that
 		// cannot be attributed to a block, and is refused rather than guessed.
@@ -893,7 +649,6 @@ function feedIsoSource(
 	block.sourceReceived++;
 	block.lastSymbolTs = performance.now();
 	sourceSymbols++;
-	if (altaEnabled) altaPending++;
 	settleSourceArrival(key, block, result);
 }
 
@@ -990,12 +745,12 @@ async function handleConfigure(
 	const blockProfile: unknown = cmd.config.blockProfile;
 	if (blockProfile === undefined) {
 		throw new Error(
-			'[FecWorker] configure: blockProfile is required: name the FEC block profile ("k-padded-v1" or "iso-ssbg1-v1")',
+			'[FecWorker] configure: blockProfile is required: name the FEC block profile ("iso-ssbg1-v1")',
 		);
 	}
-	if (blockProfile !== "k-padded-v1" && blockProfile !== "iso-ssbg1-v1") {
+	if (blockProfile !== "iso-ssbg1-v1") {
 		throw new Error(
-			`[FecWorker] configure: blockProfile must be "k-padded-v1" or "iso-ssbg1-v1" (got ${JSON.stringify(blockProfile)})`,
+			`[FecWorker] configure: blockProfile must be "iso-ssbg1-v1" (got ${JSON.stringify(blockProfile)})`,
 		);
 	}
 	if (
@@ -1010,10 +765,11 @@ async function handleConfigure(
 	}
 	if (
 		!Number.isFinite(cmd.config.interleaveMs) ||
-		cmd.config.interleaveMs <= 0
+		!Number.isSafeInteger(cmd.config.interleaveMs) ||
+		cmd.config.interleaveMs < 0
 	) {
 		throw new Error(
-			`[FecWorker] configure: interleaveMs must be finite and > 0 (got ${cmd.config.interleaveMs})`,
+			`[FecWorker] configure: interleaveMs must be a finite non-negative integer (got ${cmd.config.interleaveMs})`,
 		);
 	}
 	if (
@@ -1061,50 +817,6 @@ async function handleConfigure(
 	verifyDecoderProfile(decoder, blockProfile);
 	wasmDecoder = decoder;
 	config = cmd.config;
-	altaEnabled = !!cmd.altaPublicKey;
-
-	// Size the deferred-verify queue strictly from catalog-derived FEC
-	// parameters. CLAUDE.md bans Math.max(x, floor) magic — if catalog
-	// values are zero/missing, throw at init rather than silently applying
-	// a hardcoded floor. Consumers of an undersized queue cap would see
-	// altaPendingEvictedCap spike with no actionable signal.
-	// Cap: 1.5× interleave depth — wide enough to hold one full FEC recovery
-	// window plus jitter, narrow enough to bound memory.
-	pendingVerifyCap = Math.ceil(config.interleaveDepth * 1.5);
-	// TTL: 1.5× block duration (K symbols at one per interleave tick) —
-	// after this many ms, any unresolved entry has missed its FEC window.
-	pendingVerifyTtlMs = Math.ceil(config.interleaveMs * config.k * 1.5);
-
-	// Initialize ALTA WASM verifier if public key and WASM module provided (D-05, D-09)
-	altaVerifier = null;
-	altaInitFailed = false;
-	if (cmd.altaPublicKey && cmd.altaWasmModule) {
-		try {
-			// Load ALTA JS glue (wasm-bindgen output from wasm-pack build).
-			// Mirrors the RaptorQ WASM pattern: initSync({ module }) then construct.
-			// Dynamic import path matches the IWA static asset layout.
-			// Cast via string to prevent TypeScript from attempting static resolution
-			// of a runtime-only URL (same pattern as fec-worker-entry.js loading).
-			const altaGlueUrl = '/wasm/alta/alta_rs.js' as string;
-			// eslint-disable-next-line @typescript-eslint/no-explicit-any
-			const altaGlue: any = await import(/* webpackIgnore: true */ altaGlueUrl);
-			altaGlue.initSync({ module: cmd.altaWasmModule });
-			const keyBytes = new Uint8Array(cmd.altaPublicKey);
-			altaVerifier = new altaGlue.JsAltaVerifier(keyBytes);
-		} catch (e) {
-			// T-08-15: WASM init failure must NOT silently look like "not-ready-yet".
-			// Force altaEnabled = false so handleFeedSource takes the disabled
-			// branch instead of continuously bumping altaPending under the
-			// misleading "verifier not yet ready" comment. altaInitFailed
-			// flag in the snapshot tells consumers this is an error state, not
-			// an opt-out.
-			console.warn('[FecWorker] ALTA WASM init failed, verification disabled:', e);
-			altaVerifier = null;
-			altaEnabled = false;
-			altaInitFailed = true;
-		}
-	}
-
 	wasmDecoder.configure_params(config.k, config.symbolSize);
 
 	// Tell the client which optional commands this Worker accepts, so it can
@@ -1134,51 +846,7 @@ function handleFeedSource(
 		throw new Error("[FecWorker] feedSource: invalid source symbol");
 	}
 
-	const view = new Uint8Array(cmd.data);
-	if (config.blockProfile === "iso-ssbg1-v1") {
-		feedIsoSource(cmd, view, wasmDecoder, config);
-		return;
-	}
-
-	// Derive SBN locally for block-level accounting. WASM derives the same
-	// value internally (ISO 23008-1 §C.5.2: SBN = floor(SS_ID / K)).
-	const sbn = config.k > 0 ? Math.floor(cmd.ssId / config.k) : cmd.ssId;
-	const esi = cmd.ssId % config.k;
-	if (isRetiredSbn(sbn)) {
-		sourceDroppedRetired++;
-		return;
-	}
-	const existingBlock = blocks.get(sbn);
-	if (existingBlock && isTerminalBlock(existingBlock)) {
-		sourceDroppedTerminal++;
-		return;
-	}
-	if (acceptedSourceEsis.get(sbn)?.has(esi)) {
-		sourceDroppedDuplicate++;
-		return;
-	}
-
-	const result = wasmDecoder.add_source(cmd.ssId, view, cmd.ts);
-	advanceMediaHorizon(sbn);
-	let sourceEsis = acceptedSourceEsis.get(sbn);
-	if (!sourceEsis) {
-		sourceEsis = new Set<number>();
-		acceptedSourceEsis.set(sbn, sourceEsis);
-	}
-	sourceEsis.add(esi);
-
-	// Update block state
-	const block = getOrCreateBlock(sbn);
-	block.sourceReceived++;
-	block.lastSymbolTs = performance.now();
-	sourceSymbols++;
-
-	// The FEC worker must remain decode-only on the per-symbol hot path. ALTA
-	// WASM is retained temporarily for low-rate signaling users, but media is
-	// authenticated by the canonical manifest verifier at router admission.
-	if (altaEnabled) altaPending++;
-
-	settleSourceArrival(sbn, block, result);
+	feedIsoSource(cmd, new Uint8Array(cmd.data), wasmDecoder, config);
 }
 
 function handleFeedRepair(
@@ -1190,17 +858,14 @@ function handleFeedRepair(
 	if (!config) {
 		throw new Error("[FecWorker] feedRepair: config missing");
 	}
-	// k-padded-v1 blocks start at multiples of K and repair ESI = K + RS_ID;
 	// iso-ssbg1-v1 blocks start at any SS_ID and repair ESI = SSB_length + RS_ID.
-	const iso = config.blockProfile === "iso-ssbg1-v1";
 	if (
 		!isUint32(cmd.ssStart) ||
 		!isUint32(cmd.ssbLength) ||
 		cmd.ssbLength <= 0 ||
 		cmd.ssbLength > config.k ||
-		(!iso && cmd.ssStart % config.k !== 0) ||
 		!isUint32(cmd.rsId) ||
-		(iso ? cmd.ssbLength : config.k) + cmd.rsId > UINT24_MAX ||
+		cmd.ssbLength + cmd.rsId > UINT24_MAX ||
 		!(cmd.data instanceof ArrayBuffer)
 	) {
 		throw new Error("[FecWorker] feedRepair: invalid repair symbol");
@@ -1218,51 +883,7 @@ function handleFeedRepair(
 		}
 		return;
 	}
-	if (iso) {
-		feedIsoRepair(cmd, view, wasmDecoder);
-		return;
-	}
-	const sbn = Math.floor(cmd.ssStart / config.k);
-	const repairEsi = config.k + cmd.rsId;
-	// The repair path's mirror drops stay silent and uncounted: BLO-35597
-	// defect 2 is a source-symbol shortfall, so only the source side needed
-	// evidence. The asymmetry is deliberate, not an oversight — extend these
-	// the same way if a repair-side shortfall ever needs attributing.
-	if (isRetiredSbn(sbn)) return;
-	const existingBlock = blocks.get(sbn);
-	if (existingBlock && isTerminalBlock(existingBlock)) return;
-	if (acceptedRepairEsis.get(sbn)?.has(repairEsi)) return;
-	// One block has one authored SSB_length; a repair symbol naming another
-	// is dropped before it reaches the decoder (which rejects it too).
-	if (existingBlock?.ssbLength !== undefined && existingBlock.ssbLength !== cmd.ssbLength) {
-		emit({
-			type: "error",
-			code: "repair-ssb-length-conflict",
-			message: `[FecWorker] Dropping repair symbol whose SSB_length ${cmd.ssbLength} conflicts with ${existingBlock.ssbLength} (sbn=${sbn})`,
-		});
-		return;
-	}
-
-	const result = wasmDecoder.add_repair(
-		cmd.ssStart,
-		cmd.ssbLength,
-		cmd.rsId,
-		view,
-		cmd.ts,
-	);
-	advanceMediaHorizon(sbn);
-	let repairEsis = acceptedRepairEsis.get(sbn);
-	if (!repairEsis) {
-		repairEsis = new Set<number>();
-		acceptedRepairEsis.set(sbn, repairEsis);
-	}
-	repairEsis.add(repairEsi);
-	const block = getOrCreateBlock(sbn);
-	block.ssbLength = cmd.ssbLength;
-	block.repairReceived++;
-	block.lastSymbolTs = performance.now();
-	repairSymbols++;
-	settleRepairArrival(sbn, block, cmd.ssbLength, result);
+	feedIsoRepair(cmd, view, wasmDecoder);
 }
 
 function handleRelayBlockSig(
@@ -1271,8 +892,8 @@ function handleRelayBlockSig(
 	// No-op AUTH stub: store sig on block, mark as not-yet-verified
 	const block = blocks.get(cmd.sbn);
 	if (block) {
-		// Real verification deferred to ALTA milestone
-		// For now, mark as null (not verified) — will be wired when ALTA is implemented
+		// Relay block signatures are not verified here; source provenance is the
+		// signed per-group manifest checked at router admission.
 		block.relayBlockSigValid = null;
 		emitBlockUpdate(block);
 	}
@@ -1315,10 +936,9 @@ function handleCleanup(
 				continue;
 			}
 			currentBlock ??= getOrCreateBlock(sbn);
-			// k-padded-v1 compares with K, unchanged. iso-ssbg1-v1 compares with
-			// the block's SSB_length; a key no repair declared has none, so a
-			// block the Worker never knew can only have failed.
-			const authoredLength = isIsoProfile() ? currentBlock.ssbLength : currentBlock.k;
+			// Compare with the block's SSB_length; a key no repair declared has
+			// none, so a block the Worker never knew can only have failed.
+			const authoredLength = currentBlock.ssbLength;
 			if (authoredLength !== undefined && currentBlock.sourceReceived >= authoredLength) {
 				markBlockTerminal(currentBlock, "complete");
 				blocksComplete++;
@@ -1343,29 +963,12 @@ function handleDispose(): void {
 		snapshotTimer = null;
 	}
 
-	// Free ALTA verifier WASM object (MUST call to release WASM memory —
-	// Worker.terminate() fires immediately after dispose, so the FinalizationRegistry
-	// callback has no chance to run and this memory would leak without explicit free)
-	if (altaVerifier) {
-		try {
-			altaVerifier.free();
-		} catch (_e) {
-			// Best-effort — verifier may already be freed
-		}
-		altaVerifier = null;
-	}
-
 	// Free WASM decoder (MUST call to release WASM memory)
 	if (wasmDecoder) {
 		wasmDecoder.free();
 		wasmDecoder = null;
 	}
 
-	// Clear deferred-verify queue so pinned ArrayBuffers drop.
-	pendingVerify.clear();
-	pendingVerifyCap = 0;
-	pendingVerifyTtlMs = 0;
-
 	config = null;
 	clearBlockTracking();
 }
@@ -1392,13 +995,6 @@ function handleReset(): void {
 	blocksComplete = 0;
 	blocksRecovered = 0;
 	blocksFailed = 0;
-	altaVerified = 0;
-	altaFailed = 0;
-	altaFailedDetails.length = 0;
-	altaPending = 0;
-	altaPendingEvictedCap = 0;
-	altaPendingEvictedTtl = 0;
-	altaError = 0;
 	relayBlocksVerified = 0;
 	relayBlocksFailed = 0;
 	repairSymbolSizeMismatch = 0;
@@ -1448,8 +1044,7 @@ async function dispatchCommand(cmd: FecWorkerCommand): Promise<void> {
 	try {
 		switch (cmd.type) {
 			case "configure":
-				// handleConfigure is async (ALTA WASM init uses dynamic import).
-				// Await it so feed/cleanup messages cannot run against a partially
+				// Await handleConfigure so feed/cleanup messages cannot run against a partially
 				// configured decoder.
 				await handleConfigure(cmd);
 				break;