From 6a0be1196a2322f2ed7e42a231cfa08542894ca6 Mon Sep 17 00:00:00 2001
From: Luke Curley <kixelated@gmail.com>
Date: Sun, 20 Sep 2026 06:14:31 -0700
Subject: [PATCH 1/3] chore: claim quic one backend quest

Co-Authored-By: GPT-5 <noreply@openai.com>

From 23bfc21a7353332fda46755569296ac85c3ffa5d Mon Sep 17 00:00:00 2001
From: Luke Curley <kixelated@gmail.com>
Date: Sun, 20 Sep 2026 07:18:41 -0700
Subject: [PATCH 2/3] refactor(quic)!: keep only the noq backend

Co-Authored-By: GPT-5 <noreply@openai.com>
---
 Cargo.toml                                    |    6 +-
 bench/justfile                                |    2 +-
 bench/run.sh                                  |    4 +-
 cpp/obs/src/moq-settings.cpp                  |   18 +-
 cpp/obs/src/moq-settings.h                    |    2 +-
 deny.toml                                     |    2 -
 doc/bin/relay/config.md                       |   19 +-
 doc/bin/relay/http.md                         |    7 +-
 doc/lib/c/index.md                            |    2 +-
 doc/lib/rs/index.md                           |    8 +-
 doc/lib/rs/moq-net.md                         |    4 +-
 js/net/src/connection/stats.ts                |    4 +-
 nix/overlay.nix                               |    2 +-
 quest/m1/README.md                            |    6 +-
 quest/m1/quic-one-backend.md                  |   77 --
 ...relay-cpu-is-vdso-clock-reads-the-drive.md |    2 +-
 quest/m2/perf/README.md                       |    7 +-
 quest/m2/perf/egress-requeue.md               |    6 +-
 quest/m2/perf/uring-quiescence.md             |    4 +-
 quest/m2/quic/README.md                       |    8 +-
 quest/m2/quic/fork.md                         |    3 +-
 quest/m2/quic/reliable-reset.md               |    4 +-
 quest/m2/uring-flow-control-windows.md        |    2 +-
 quest/m3/multipath-spike.md                   |    5 +-
 rs/hang/Cargo.toml                            |    2 +-
 rs/justfile                                   |   51 +-
 rs/libmoq/src/api.rs                          |   42 -
 rs/libmoq/src/client.rs                       |    3 -
 rs/libmoq/src/test.rs                         |   49 +-
 rs/moq-bench/Cargo.toml                       |    2 -
 rs/moq-boy/Cargo.toml                         |    1 -
 rs/moq-cli/Cargo.toml                         |    6 +-
 rs/moq-gst/src/lib.rs                         |    1 -
 rs/moq-native/Cargo.toml                      |    2 -
 rs/moq-relay/Cargo.toml                       |   17 +-
 rs/moq-relay/src/relay.rs                     |    6 +-
 rs/moq-relay/src/uring.rs                     |    5 +-
 rs/moq-relay/src/web.rs                       |    5 +-
 rs/moq-relay/tests/drills.rs                  |    2 +-
 rs/moq-relay/tests/goaway_cluster.rs          |    4 +-
 rs/moq-relay/tests/released_cli.rs            |    2 -
 rs/moq-sock/src/bind.rs                       |    2 +-
 rs/moq-tokio/Cargo.toml                       |   33 +-
 rs/moq-tokio/README.md                        |    2 +-
 rs/moq-tokio/src/client.rs                    |  159 +--
 rs/moq-tokio/src/connect.rs                   |   35 +-
 rs/moq-tokio/src/error.rs                     |   40 -
 rs/moq-tokio/src/iroh.rs                      |    4 +-
 rs/moq-tokio/src/lib.rs                       |  136 +--
 rs/moq-tokio/src/listen.rs                    |   43 +-
 rs/moq-tokio/src/log.rs                       |    1 -
 rs/moq-tokio/src/quic.rs                      |   27 +-
 rs/moq-tokio/src/quiche.rs                    |  939 ---------------
 rs/moq-tokio/src/quinn.rs                     | 1051 -----------------
 rs/moq-tokio/src/resolve.rs                   |   11 +-
 rs/moq-tokio/src/server.rs                    |  217 +---
 rs/moq-tokio/src/settings.rs                  |    6 -
 rs/moq-tokio/src/tls.rs                       |  199 +---
 rs/moq-tokio/src/websocket.rs                 |    2 +-
 rs/moq-tokio/src/worker/mod.rs                |    4 +-
 rs/moq-tokio/tests/backend.rs                 |  334 ++----
 rs/moq-tokio/tests/broadcast.rs               |    2 +-
 rs/moq-tokio/tests/worker.rs                  |    2 +-
 rs/moq-transcode/Cargo.toml                   |    2 +-
 rs/moq-uring/Cargo.toml                       |   25 +-
 rs/moq-uring/README.md                        |   42 +-
 rs/moq-uring/benches/echo_noq.rs              |  167 +++
 rs/moq-uring/benches/echo_quiche.rs           |  148 ---
 rs/moq-uring/benches/session_lite.rs          |   12 +-
 rs/moq-uring/src/lib.rs                       |    7 +-
 rs/moq-uring/src/quic/endpoint.rs             |    2 +-
 rs/moq-uring/src/quic/mod.rs                  |   39 +-
 .../src/quic/{quinn => noq}/connection.rs     |  101 +-
 .../src/quic/{quinn => noq}/endpoint.rs       |   37 +-
 rs/moq-uring/src/quic/{quinn => noq}/mod.rs   |  113 +-
 .../src/quic/{quinn => noq}/stream.rs         |   40 +-
 rs/moq-uring/src/quic/qlog.rs                 |    4 +-
 rs/moq-uring/src/quic/quiche/connection.rs    | 1048 ----------------
 rs/moq-uring/src/quic/quiche/endpoint.rs      |  646 ----------
 rs/moq-uring/src/quic/quiche/mod.rs           |  265 -----
 rs/moq-uring/src/quic/quiche/stream.rs        |  439 -------
 rs/moq-uring/src/worker.rs                    |    2 +-
 rs/moq-uring/tests/echo.rs                    |  124 +-
 rs/moq-uring/tests/endpoint.rs                |   33 +-
 rs/moq-uring/tests/qlog.rs                    |   10 +-
 rs/moq-uring/tests/session.rs                 |    6 +-
 rs/moq-uring/tests/support.rs                 |  112 ++
 rs/moq-uring/tests/support/quiche.rs          |  468 --------
 rs/moq-uring/tests/teardown.rs                |    2 +-
 rs/moq-uring/tests/web.rs                     |  511 +-------
 rs/moq-uring/tests/workers.rs                 |    4 +-
 91 files changed, 848 insertions(+), 7214 deletions(-)
 delete mode 100644 quest/m1/quic-one-backend.md
 delete mode 100644 rs/moq-tokio/src/quiche.rs
 delete mode 100644 rs/moq-tokio/src/quinn.rs
 create mode 100644 rs/moq-uring/benches/echo_noq.rs
 delete mode 100644 rs/moq-uring/benches/echo_quiche.rs
 rename rs/moq-uring/src/quic/{quinn => noq}/connection.rs (88%)
 rename rs/moq-uring/src/quic/{quinn => noq}/endpoint.rs (91%)
 rename rs/moq-uring/src/quic/{quinn => noq}/mod.rs (76%)
 rename rs/moq-uring/src/quic/{quinn => noq}/stream.rs (90%)
 delete mode 100644 rs/moq-uring/src/quic/quiche/connection.rs
 delete mode 100644 rs/moq-uring/src/quic/quiche/endpoint.rs
 delete mode 100644 rs/moq-uring/src/quic/quiche/mod.rs
 delete mode 100644 rs/moq-uring/src/quic/quiche/stream.rs
 create mode 100644 rs/moq-uring/tests/support.rs
 delete mode 100644 rs/moq-uring/tests/support/quiche.rs

diff --git a/Cargo.toml b/Cargo.toml
index 0f703fcd92..0207602e3e 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -212,19 +212,17 @@ usage = { package = "usage-rs", version = "6.3.0" }
 web-async = { version = "0.1.5", features = ["tracing"] }
 web-transport-iroh = "0.7"
 # default-features off so the QUIC crypto provider is chosen by moq-tokio's
-# aws-lc-rs / ring features (mirroring how the quinn dependency is wired).
+# aws-lc-rs / ring features.
 # 0.3 for the `qlog` passthrough feature moq-tokio's `qlog` forwards to.
 web-transport-noq = { version = "0.3", default-features = false }
 web-transport-proto = "0.6"
-web-transport-quiche = "0.7"
-web-transport-quinn = { version = "0.12", default-features = false }
 web-transport-trait = "0.4"
 web-transport-wasm = "0.6"
 x11rb = { version = "0.14.0", features = ["randr", "xfixes"] }
 zeroize = { version = "1", features = ["derive"] }
 
 [patch.crates-io]
-# web-transport-quinn and web-transport-iroh depend on kio from crates.io. Without
+# web-transport-iroh depends on kio from crates.io. Without
 # this, the lock carries a second kio whose pin drifts behind the member, and the
 # next publish that reaches both fails to resolve a single version (#3551).
 kio = { path = "rs/kio" }
diff --git a/bench/justfile b/bench/justfile
index ba980173c1..b3fa64c392 100755
--- a/bench/justfile
+++ b/bench/justfile
@@ -16,4 +16,4 @@ runtime $ROUNDS="3" $WORKERS="":
 # Compile every binary and feature used by the repository-level harness.
 check:
     cargo check --locked --package moq-relay --package moq-bench \
-        --features moq-relay/io-uring-quinn
+        --features moq-relay/io-uring
diff --git a/bench/run.sh b/bench/run.sh
index 5e4ec3acae..db7c0a2c6e 100755
--- a/bench/run.sh
+++ b/bench/run.sh
@@ -394,10 +394,10 @@ run_runtime_comparison() {
         return 1
     fi
 
-    printf 'Building one relay binary with the Tokio and io_uring Quinn paths...\n'
+    printf 'Building one relay binary with the Tokio and io_uring paths...\n'
     CARGO_TARGET_DIR=$CURRENT_TARGET cargo build --locked --release \
         -p moq-relay -p moq-bench \
-        --features moq-relay/io-uring-quinn,moq-bench/uring
+        --features moq-relay/io-uring,moq-bench/uring
     LOAD_BIN=$CURRENT_TARGET/release/moq-bench
     HOST_BIN=$CURRENT_TARGET/release/moq-bench-host
 
diff --git a/cpp/obs/src/moq-settings.cpp b/cpp/obs/src/moq-settings.cpp
index 17cc2b8f57..8b3fc4b5a2 100644
--- a/cpp/obs/src/moq-settings.cpp
+++ b/cpp/obs/src/moq-settings.cpp
@@ -18,7 +18,6 @@ namespace {
 // Keys. These are stable: they land in scene collections and in the dock's settings
 // file, so renaming one silently drops whatever the user had configured.
 constexpr const char *VERSION = "version";
-constexpr const char *BACKEND = "backend";
 constexpr const char *BIND = "bind";
 constexpr const char *CONNECT_TIMEOUT = "connect_timeout_ms";
 constexpr const char *FAILOVER_DELAY = "failover_delay_ms";
@@ -110,15 +109,6 @@ std::vector<Option> VersionOptions()
 	return CapabilityOptions(moq_versions, "Automatic (offer all)", names);
 }
 
-// The QUIC backends this build of libmoq compiled in, so the menu can't offer one the
-// setter rejects. The backends are feature-gated, so listing the three names would put
-// dead options in front of the user on a release build.
-std::vector<Option> BackendOptions()
-{
-	static std::vector<std::string> names;
-	return CapabilityOptions(moq_backends, "Automatic", names);
-}
-
 // Shorthands so the table below reads as data rather than aggregate initializers.
 Field Toggle(const char *key, const char *label, bool value, const char *tooltip = nullptr)
 {
@@ -152,7 +142,7 @@ Field Directory(const char *key, const char *label, const char *tooltip = nullpt
 	return Field{key, label, tooltip, Kind::Directory, 0, 0, 0, false, 0, "", {}, false, nullptr};
 }
 
-// The tri-state used wherever the library default depends on the backend.
+// The tri-state used wherever the library default depends on the transport.
 std::vector<Option> AutoOnOff()
 {
 	return {{"Automatic", AUTO}, {"Enabled", "on"}, {"Disabled", "off"}};
@@ -226,9 +216,6 @@ const std::vector<Field> &Fields()
 		// default and so never listed, can still be typed in.
 		f.push_back(Choose(VERSION, "Protocol version", VersionOptions(), true,
 				   "Pin the handshake to one draft instead of offering every supported version."));
-		f.push_back(Choose(BACKEND, "QUIC backend", BackendOptions(), false,
-				   "Which QUIC implementation this session uses. Automatic picks the "
-				   "default compiled into this libmoq."));
 		f.push_back(Text(BIND, "Bind address",
 				 "Local UDP address to send from, e.g. 192.0.2.7:0 to pin the outgoing "
 				 "interface. Leave empty for any."));
@@ -400,7 +387,6 @@ bool BuildConfig(obs_data_t *settings, Config *out)
 		config.versions_len = 1;
 	}
 
-	borrow(OptionalString(settings, BACKEND), &out->backend, &config.backend, &config.backend_len);
 	borrow(OptionalString(settings, BIND), &out->bind, &config.bind, &config.bind_len);
 
 	config.connect_timeout_us = (uint64_t)Amount(settings, CONNECT_TIMEOUT) * 1000;
@@ -442,7 +428,7 @@ bool BuildConfig(obs_data_t *settings, Config *out)
 	config.has_quic_keep_alive = true;
 
 	// The tri-states stay unset when the user left them on Automatic, which is what
-	// keeps the backend free to pick. That is exactly what the has_* flag carries.
+	// keeps the transport free to pick. That is exactly what the has_* flag carries.
 	bool toggle = false;
 	if (TriState(settings, QUIC_GSO, &toggle)) {
 		config.quic_gso = toggle;
diff --git a/cpp/obs/src/moq-settings.h b/cpp/obs/src/moq-settings.h
index 878036b990..85915adc60 100644
--- a/cpp/obs/src/moq-settings.h
+++ b/cpp/obs/src/moq-settings.h
@@ -97,7 +97,7 @@ struct Config {
 
 	// Backing storage for the pointers in `value`. Held by value so a settings
 	// object released after BuildConfig can't dangle them.
-	std::string version, backend, bind, fingerprint, root, host_name, congestion, qlog;
+	std::string version, bind, fingerprint, root, host_name, congestion, qlog;
 	moq_string version_item{}, fingerprint_item{}, root_item{};
 };
 
diff --git a/deny.toml b/deny.toml
index 5983586a0b..a0a62cd751 100644
--- a/deny.toml
+++ b/deny.toml
@@ -18,8 +18,6 @@ ignore = [
     "RUSTSEC-2023-0071",
 
     # foundations (Cloudflare) pins serde_yaml 0.8 which uses yaml-rust 0.4.
-    # Reachable via tokio-quiche -> web-transport-quiche -> moq-tokio
-    # (quiche feature). Awaits upstream migration to serde_yaml 0.9+.
     "RUSTSEC-2024-0320",
 
     # gstreamer 0.23 pulls paste (proc-macro). gstreamer 0.25 drops it but
diff --git a/doc/bin/relay/config.md b/doc/bin/relay/config.md
index 489df037a0..450067dee0 100644
--- a/doc/bin/relay/config.md
+++ b/doc/bin/relay/config.md
@@ -6,7 +6,7 @@ description: TOML reference for moq-relay
 # Configuration
 
 `moq-relay relay.toml`. Every key is also a CLI flag and environment variable
-(`--listen-backend`, `MOQ_LISTEN_BACKEND`), named by joining the section and key.
+(`--listen-bind`, `MOQ_LISTEN_BIND`), named by joining the section and key.
 Precedence is CLI > env > file > defaults: a flag or environment variable that
 was actually supplied overrides the file, and a file key that was actually
 written (an empty list, a `false` boolean) overrides the built-in default.
@@ -23,7 +23,6 @@ cert = "cert.pem"                    # Certificate chain and key. Reloaded on ch
 key = "key.pem"
 generate = ["localhost"]             # Or: a self-signed cert for development.
 root = ["peer-ca.pem"]               # Optional: CAs for client certs (mTLS), reported to the auth server.
-                                     # The quiche backend fixes these at startup; restart to rotate them.
 
 [listen.tcp]                         # Plaintext qmux over TCP for trusted local workers.
 bind = "127.0.0.1:4444"
@@ -51,10 +50,8 @@ send_window = 33554432
 qlog = "/var/log/moq/qlog"           # Existing directory. Needs the `qlog` build feature.
 ```
 
-The `noq` (default), `quinn`, and `quiche` QUIC backends are compile-time
-features selected with `listen.backend` / `connect.backend`. Each ships a
-different BBR generation (BBRv1 on quinn, BBRv2 on quiche, BBRv3 on noq and
-iroh), which is why the knob names a family rather than an algorithm.
+The native QUIC stack uses BBRv3 for delay-based congestion control. Iroh also
+uses noq and the same congestion controller.
 
 Raise the receive windows when a fat, long path idles below the link rate: a
 window under the bandwidth-delay product stalls the sender waiting for credit.
@@ -63,12 +60,6 @@ cannot starve the connection. `send_window` caps unacknowledged outgoing data
 whatever the peer allows, bounding the transport send buffer. A zero window is refused, and the receive windows must fit a QUIC
 varint since they ride on the wire as transport parameters.
 
-quiche has no local send cap, so it refuses `send_window` rather than quietly
-dropping it: use the `quinn` or `noq` backend, or leave it unset. It also
-autotunes each receive window up to a ceiling, so the relay pins that ceiling to
-the configured value and the window is exactly what was asked for, as on the
-other backends.
-
 ## \[runtime]
 
 By default one work-stealing runtime serves every connection off one UDP
@@ -87,8 +78,8 @@ Packets are steered by connection ID, so a client that migrates stays with its
 worker. The group shares one port, including an ephemeral (zero) port: the
 first worker binds it and the rest join that port. Use an explicit port unless
 something reads the bound address at startup. `workers` needs the `noq`
-(default) or `quinn` backend and real certificate files rather than
-`tls.generate`. A build without a QUIC backend rejects `workers` instead of
+feature and real certificate files rather than `tls.generate`. A build without
+QUIC rejects `workers` instead of
 ignoring it. An embedding process leaves this group inside `Relay::run`;
 taking the sockets out and driving them yourself is how a later library
 update can drop QUIC while still compiling. `io_uring` additionally needs Linux 6.12+, the `io-uring` cargo
diff --git a/doc/bin/relay/http.md b/doc/bin/relay/http.md
index a9f61261bc..a9bcbe34c2 100644
--- a/doc/bin/relay/http.md
+++ b/doc/bin/relay/http.md
@@ -27,11 +27,8 @@ by convention a publisher announces each broadcast's exact path, so the list
 reads as broadcast names.
 
 A relay configured with more than one certificate has no single fingerprint to
-publish, and this endpoint answers for the first. On the quinn and noq backends
-the others are reachable over `https://`, which selects by SNI at handshake. The
-quiche backend serves the first pair to every handshake, so a name covered only
-by a later certificate needs an explicit `--client-tls-fingerprint`, which checks
-the fingerprint in place of the hostname.
+publish, and this endpoint answers for the first. The others are reachable over
+`https://`, which selects a certificate by SNI at the handshake.
 
 Tokens sent over plain HTTP are visible on the wire, so use HTTPS in
 production.
diff --git a/doc/lib/c/index.md b/doc/lib/c/index.md
index 59b173b2dd..27faf1fb5f 100644
--- a/doc/lib/c/index.md
+++ b/doc/lib/c/index.md
@@ -37,7 +37,7 @@ and `target/include/moq.h`.
 - **Raw playback.** Raw audio and video consumers start at the newest cached group when opened, so rebuilding a live decoder skips the retained backlog.
 - **Raw decode output.** `moq_video_decoder_output` selects the decoded CPU pixel format (`MOQ_VIDEO_PIXEL_FORMAT_I420` or `_RGBA`) and target size (`width`/`height`, both zero for native; otherwise even and non-zero). Unknown formats and invalid sizes fail `moq_decode_video` before subscribing; accepted requests deliver exactly that layout or fail on the terminal callback.
 - **Encoded video metadata.** `moq_video_init.hint` is a zero-initialized `moq_video_hint` with `has_*` flags for coded dimensions, bitrate (bits per second), frame rate, and latency preference. Hints seed a video codec track's catalog; detected dimensions take precedence.
-- **Client config.** A zeroed `moq_client_config` means the defaults for every knob, which is what lets a new one be appended without disturbing callers. Fields cover protocol (`versions`), TLS (`tls_fingerprints`, `tls_roots`, `tls_cert`/`_key`, `tls_host_name`), transport (`backend`, `bind`, `connect_timeout_us`, the Happy Eyeballs delays, `websocket_enabled`), and tuning (reconnect backoff, `quic_*`). Every duration is in microseconds. A knob whose default isn't zero carries a `has_*` flag, so setting `backoff_timeout_us = 0` needs `has_backoff_timeout = true` to mean "retry forever" rather than "use the default". `moq_client_defaults()` reports what a NULL config dials with.
+- **Client config.** A zeroed `moq_client_config` means the defaults for every knob, which is what lets a new one be appended without disturbing callers. Fields cover protocol (`versions`), TLS (`tls_fingerprints`, `tls_roots`, `tls_cert`/`_key`, `tls_host_name`), transport (`bind`, `connect_timeout_us`, the Happy Eyeballs delays, `websocket_enabled`), and tuning (reconnect backoff, `quic_*`). Every duration is in microseconds. A knob whose default isn't zero carries a `has_*` flag, so setting `backoff_timeout_us = 0` needs `has_backoff_timeout = true` to mean "retry forever" rather than "use the default". `moq_client_defaults()` reports what a NULL config dials with.
 - **Demand.** A watcher on a published track (`moq_publish_track_demand`, `moq_publish_media_demand`, `moq_encode_video_demand`, `moq_encode_audio_demand`) calls `on_demand` with `MOQ_DEMAND_USED` or `MOQ_DEMAND_UNUSED` right away and again on every change, so an encoder on a battery-powered device runs only while someone is watching. The first call is the current state, so a track that went unused before the watcher existed still reports it. `moq_publish_demand_cancel` stops it; the terminal callback still fires. A container has no single demand and is refused. Demand is counted at the producer: a session that served the track keeps a warm copy for 30 seconds after its last subscriber leaves, so an unused edge behind a relay arrives after that linger.
 - **Requests.** `moq_publish_dynamic` serves subscriptions to tracks the broadcast never declared: each arrives as a request handle, read its name with `moq_track_request_name`, then `moq_track_request_accept` (a raw track handle), `moq_track_request_video` / `_audio` (the media handle `moq_publish_video` / `_audio` return), or `moq_track_request_abort` with an application code the subscriber sees. Without a live handler an unknown name is refused. `moq_publish_track_dynamic` does the same for fetches of groups a track no longer has cached, delivered as `moq_group_request_*` (`sequence`, `priority`, `frame_start`); `moq_group_request_accept` starts the producer at `frame_start` so written frames keep their group indices. Register it with `moq_track_request_dynamic` before accepting a track that was itself requested by a fetch, so that pending group survives the transition. Both handlers stop with `moq_publish_dynamic_cancel`.
 - **Everything the bindings can do** ([list](/lib/#what-every-binding-can-do)): media publish and consume with the catalog managed for you, raw pixels and PCM with the codec inside (`moq_encode_video`, `moq_encode_audio`, and the `moq_decode_*` mirrors), raw tracks with timestamps and datagrams, JSON snapshot and stream tracks, group fetch, catalog sections, shared video properties, and stalled hints. The three advertising operations are `moq_origin_create_broadcast` (unadvertised producer), `moq_publish_announce` / `moq_publish_unannounce` (exact-path advertisement), and `moq_origin_dynamic` (a claim over a path prefix and everything beneath it; `""` for everything). A route is a capability, not an inventory; `moq_announce_update.prefix` is the concrete covered prefix relative to the origin root.
diff --git a/doc/lib/rs/index.md b/doc/lib/rs/index.md
index 0f692aad16..4479517b87 100644
--- a/doc/lib/rs/index.md
+++ b/doc/lib/rs/index.md
@@ -14,7 +14,7 @@ The reference implementation. Every crate is on
 | --- | --- |
 | [moq-net](/lib/rs/moq-net) | The pub/sub layer: sessions, origins, broadcasts, tracks, groups, frames. Transport-agnostic. |
 | [moq-pattern](https://docs.rs/moq-pattern) | Exact path patterns: grammar, matching, and set algebra. Re-exported by moq-net and moq-auth. |
-| [moq-tokio](https://docs.rs/moq-tokio) | Stands up QUIC (quinn, quiche, or noq), TLS, WebSocket fallback, and iroh, from config or CLI flags. |
+| [moq-tokio](https://docs.rs/moq-tokio) | Stands up QUIC with noq, TLS, WebSocket fallback, and iroh, from config or CLI flags. |
 | [hang](/lib/rs/hang) | The media layer: catalog, containers, ordered frame delivery. |
 | [moq-mux](/lib/rs/moq-mux) | Import and export fMP4/CMAF, MPEG-TS, Matroska, FLV, and Annex-B. |
 | [moq-video](/lib/rs/moq-video) | Native capture, hardware encode/decode (Apple, Windows, NVIDIA, VAAPI, V4L2, Android), and GPU rendering. |
@@ -94,9 +94,9 @@ quic.send_window = Some(32 << 20);          // unacknowledged data we may hold
 let client = moq_tokio::connect::Config::default().init(quic)?;
 ```
 
-Unset flow-control windows keep the selected backend defaults, and `init` errors on
-a knob that backend cannot honor rather than dropping it: quiche has no local
-send cap, and iroh cannot disable GSO. `quic::Resolved::default()` is what an
+Unset flow-control windows keep the transport defaults, and `init` errors on a
+knob the transport cannot honor rather than dropping it: iroh cannot disable
+GSO. `quic::Resolved::default()` is what an
 untouched config resolves to, so read the defaults from there. The
 [relay reference](/bin/relay/config#quic) documents each field.
 
diff --git a/doc/lib/rs/moq-net.md b/doc/lib/rs/moq-net.md
index a743c842a5..5ea1aceb5b 100644
--- a/doc/lib/rs/moq-net.md
+++ b/doc/lib/rs/moq-net.md
@@ -24,8 +24,8 @@ above ([hang](/lib/rs/hang)); relays and CDNs implement only this.
 - **Routes** record the relay hops and a cost, which is what the relay [cluster](/bin/relay/cluster) routes on. A hop of 0 marks the chain anonymous: `Route::is_anonymous()` is true, and that route ranks below every fully identified one.
 - **Stats** counters per broadcast and session, drained by [`moq-stats`](https://docs.rs/moq-stats).
 
-It runs over anything implementing `web_transport_trait::Session`: quinn,
-quiche, noq, the browser, iroh, or qmux over TCP, Unix sockets, and
+It runs over anything implementing `web_transport_trait::Session`: noq, the
+browser, iroh, or qmux over TCP, Unix sockets, and
 WebSockets. [`moq-tokio`](https://docs.rs/moq-tokio) wires those up.
 
 ```bash
diff --git a/js/net/src/connection/stats.ts b/js/net/src/connection/stats.ts
index 84ffbfcafc..adbf1989ce 100644
--- a/js/net/src/connection/stats.ts
+++ b/js/net/src/connection/stats.ts
@@ -17,8 +17,8 @@ import * as Time from "../time.ts";
  *
  * The field names match Rust's `moq_net::session::Stats` but the counters keep each
  * stack's own semantics rather than being normalized. Notably W3C excludes
- * retransmissions and QUIC overhead from the byte counts where quinn includes them,
- * and counts packets where quinn counts datagrams.
+ * retransmissions and QUIC overhead from the byte counts where native QUIC includes
+ * them, and counts packets where native QUIC counts datagrams.
  *
  * @public
  */
diff --git a/nix/overlay.nix b/nix/overlay.nix
index 4552981616..bf09d5cc59 100644
--- a/nix/overlay.nix
+++ b/nix/overlay.nix
@@ -32,7 +32,7 @@ let
   };
 
   # `[patch.crates-io] kio = { path = "rs/kio" }` in the root Cargo.toml points
-  # registry crates (web-transport-quinn, web-transport-iroh) at the workspace
+  # registry crates (web-transport-iroh) at the workspace
   # member. crane's dependency-only stage stubs every workspace crate down to an
   # empty lib.rs, so those registry crates no longer find kio's API and fail to
   # compile. Put kio's real source back into the dummy tree.
diff --git a/quest/m1/README.md b/quest/m1/README.md
index 9b232fb087..8b0e969e0f 100644
--- a/quest/m1/README.md
+++ b/quest/m1/README.md
@@ -20,13 +20,11 @@ quest here and merged main into dev. The auth API line is here for its
 request-side break (`mtls=<identity>` and the now-required fields) and ranks
 first because moq.pro adopts the release only once that contract is settled;
 it is priority, not a merge gate, and [Merge dev](/quest/m1/merge-dev.md)
-does not require it. [One QUIC backend](/quest/m1/quic-one-backend.md) ranks
-above it: it removes public features, so it cannot land after the merge, and
-the transport line in m2 assumes a single stack.
+does not require it. The transport line in m2 assumes the single noq stack.
 
 ## Quests
 
-- [One QUIC backend](/quest/m1/quic-one-backend.md) - quinn and quiche are deleted; noq (and iroh on it) is the only QUIC stack, with the qmux fallbacks untouched
+- [One auth path](/quest/m1/auth-one-path.md) - Server, Public, and Refuse become tasks on the `Admissions` queue; `admit()` stays send-plus-await; `Mode` is gone
 - [Announce event](/quest/m1/api-net-announce.md) - publishers announce prefixes on every wire, consumers scoped by a pattern read the covered path already trimmed, with no `as_prefix().expect()` at 89 call sites
 - [Bindings announce match](/quest/m1/api-origin-scopes.md) - every binding takes a pattern scope and reports the announce match with its captures
 - [PathPrefixes](/quest/m1/api-path-prefixes.md) - the unused moq_net::PathPrefixes type is deleted before the release
diff --git a/quest/m1/quic-one-backend.md b/quest/m1/quic-one-backend.md
deleted file mode 100644
index 1c5db082b6..0000000000
--- a/quest/m1/quic-one-backend.md
+++ /dev/null
@@ -1,77 +0,0 @@
-# [L] One QUIC backend
-
-## Goal
-
-noq is the only QUIC stack in the tree. `moq-tokio`, `moq-uring`, `moq-relay`,
-`moq-cli`, `moq-bench`, and `moq-boy` compile no quinn or quiche code, carry
-no `quinn`, `quiche`, `io-uring-quinn`, or `io-uring-quiche` feature, and
-offer no backend selection at runtime. The iroh backend stays, because it runs
-on noq. The qmux fallbacks over TCP, Unix sockets, and WebSocket stay
-untouched.
-
-Supporting several stacks bought nothing: every transport feature MoQ needs
-(ACK progress, reliable reset, hierarchical scheduling, probing, deadlines)
-lands in [our fork of noq](/quest/m2/quic/fork.md) and would be missing on
-the others. quiche is unmaintained upstream. moq.pro still builds `main` with
-quinn; it moves to noq with the dev merge, and nothing in its config names a
-backend that survives.
-
-## Plan
-
-Branch from `dev`. The break is a removed public feature and two removed
-config fields, so it cannot land on `main`.
-
-Delete, in `rs/moq-tokio`: `src/quinn.rs`, `src/quiche.rs`, the `quinn` and
-`quiche` features and their optional dependencies (`quinn`,
-`web-transport-quinn`, `web-transport-quiche`, `rustls-native-certs`), the
-`QuicBackend` enum, `--listen-backend` / `--connect-backend`, the
-`listen.backend` / `connect.backend` TOML fields, `default_quic_backend()`,
-and the `Quinn` / `Quiche` variants of the pending-request enum in
-`src/server.rs`. Keep the `noq` feature name so a consumer can still build
-without QUIC (tcp-only serves qmux), and keep the `aws-lc-rs` / `ring`
-compile_error.
-
-Delete, in `rs/moq-uring`: `src/quic/quiche/`, the `quinn` and `quiche`
-features, `quinn-proto`, `quiche`, and `boring` from the manifest, and the
-`use noq_proto as quinn_proto` alias: rename `src/quic/quinn/` to
-`src/quic/noq/` and name the types for what they are. Replace the raw quiche
-peer in `tests/support/quiche.rs` and `benches/echo_quiche.rs` with a tokio
-noq peer; cross-implementation interop is `just test smoke-full`'s job.
-
-Forward the deletion through every consumer manifest: `moq-relay`
-(`quinn`, `quiche`, `io-uring-quinn`, `io-uring-quiche`), `moq-cli`,
-`moq-bench`, `moq-boy`, and the `moq-native` shim's empty feature list. Drop
-the per-backend `send_window` refusal and the "each backend ships a different
-BBR generation" paragraph; there is one BBR now (v3).
-
-Docs: `doc/bin/relay/config.md` (backend selection, `[runtime] workers`,
-`io_uring`), `doc/bin/relay/http.md` (certificate selection), `doc/bin/cli.md`
-(the `cargo install` feature list), `doc/lib/rs/index.md`, `doc/lib/c/index.md`
-(the `backend` field of `moq_client_config`, which goes through moq-ffi and
-every binding: report the wire and API impact), `rs/moq-tokio/README.md`, and
-the `## Backends` table in `rs/moq-uring/README.md`. Search the repository for
-`--listen-backend`, `io-uring-quinn`, and `features "` invocations and fix
-every example.
-
-Tests: the existing backend integration tests run once, on noq; delete the
-per-backend matrix. `just check`, `just test`, the nightly feature-subset
-build, and `just test smoke-full` pass. Record the deleted line count in the
-PR.
-
-## Closes
-
-- [#3124](https://github.com/moq-dev/moq/issues/3124) - the matched
-  noq-versus-quiche measurement is moot: the decision was made without it
-- [#2296](https://github.com/moq-dev/moq/issues/2296) - quiche parity gaps
-  vanish with the backend
-- [#2853](https://github.com/moq-dev/moq/issues/2853) - the pinned-port dial
-  bug is quiche-only
-- [#2847](https://github.com/moq-dev/moq/issues/2847) - the cwnd/rtt estimate
-  is quinn-only; noq reports BBR3's estimate
-
-## Related
-
-- [The fork](/quest/m2/quic/fork.md) - why one stack: every transport feature
-  lands there
-- [io_uring feature check](/quest/m2/check-uring-feature.md) - checks the
-  `io-uring` feature once this rename lands
diff --git a/quest/m2/perf/3122-moq-uring-2-5-of-relay-cpu-is-vdso-clock-reads-the-drive.md b/quest/m2/perf/3122-moq-uring-2-5-of-relay-cpu-is-vdso-clock-reads-the-drive.md
index aafd6dc963..3d48f30a5c 100644
--- a/quest/m2/perf/3122-moq-uring-2-5-of-relay-cpu-is-vdso-clock-reads-the-drive.md
+++ b/quest/m2/perf/3122-moq-uring-2-5-of-relay-cpu-is-vdso-clock-reads-the-drive.md
@@ -29,7 +29,7 @@ Where the reads are:
   (`self.shared.timers.borrow_mut().fire(Instant::now())`,
   rs/moq-uring/src/worker.rs:183).
 - The noq driver reads the clock for
-  `close` (rs/moq-uring/src/quic/quinn/connection.rs:239), `handle_timeout`
+  `close` (rs/moq-uring/src/quic/noq/connection.rs:239), `handle_timeout`
   (:671), and `poll_transmit` (:786). The last one runs once per GSO train,
   since `flush` stages one train per turn (see
   [Egress requeue](/quest/m2/perf/egress-requeue.md)).
diff --git a/quest/m2/perf/README.md b/quest/m2/perf/README.md
index 7fcefd0d27..26302ddd88 100644
--- a/quest/m2/perf/README.md
+++ b/quest/m2/perf/README.md
@@ -18,11 +18,8 @@ Implementations start after the dev merge, on main; planning quests can settle
 their contracts independently. Facts from the 2026-09
 hot-path survey, so quests don't re-litigate them:
 
-- `moq-uring`'s only backend is noq once
-  [One QUIC backend](/quest/m1/quic-one-backend.md) lands; until then it is
-  compiled through the `quinn/` module, which aliases `noq_proto as
-  quinn_proto` (rs/moq-uring/src/quic/quinn/mod.rs:26). Every profile names
-  its backend. The quiche-flavor numbers cited in
+- `moq-uring`'s only backend is noq. Every profile names its backend. The
+  historical quiche-flavor numbers cited in
   [Egress requeue](/quest/m2/perf/egress-requeue.md) and
   [#3122](/quest/m2/perf/3122-moq-uring-2-5-of-relay-cpu-is-vdso-clock-reads-the-drive.md)
   are re-measured on noq.
diff --git a/quest/m2/perf/egress-requeue.md b/quest/m2/perf/egress-requeue.md
index af68fb5a30..742dddb6b5 100644
--- a/quest/m2/perf/egress-requeue.md
+++ b/quest/m2/perf/egress-requeue.md
@@ -3,9 +3,9 @@
 ## Goal
 
 The io_uring QUIC driver stages one GSO train per turn and then wakes
-itself (`Driver::flush`, rs/moq-uring/src/quic/quinn/connection.rs:744), so a
+itself (`Driver::flush`, rs/moq-uring/src/quic/noq/connection.rs:744), so a
 deep backlog on one connection pays a whole driver turn per train of
-`TRAIN_SEGMENTS = 63` segments (quinn/connection.rs:23; `MAX_GSO_SEGMENTS =
+`TRAIN_SEGMENTS = 63` segments (noq/connection.rs:23; `MAX_GSO_SEGMENTS =
 64` at udp.rs:56 is the kernel cap). That cadence is a hardcoded fairness choice.
 Make it a measured budget.
 
@@ -13,7 +13,7 @@ Make it a measured budget.
 
 The re-walk half of #3120 landed in #3134 (e6962b20e) on the since-deleted
 quiche driver; the noq driver drains an event queue instead of walking
-iterators (quinn/connection.rs:697) and never had that shape. What is left is
+iterators (noq/connection.rs:697) and never had that shape. What is left is
 the budget.
 
 - Add a trains-per-turn budget to `flush`. One train then
diff --git a/quest/m2/perf/uring-quiescence.md b/quest/m2/perf/uring-quiescence.md
index 3af4a687f1..650053f058 100644
--- a/quest/m2/perf/uring-quiescence.md
+++ b/quest/m2/perf/uring-quiescence.md
@@ -8,7 +8,7 @@ the same drive-loop turn, so one enter carries the reply. Today
 lands in the next turn by design (rs/kio/src/task.rs:246-257, test
 `a_mid_pass_wake_lands_in_the_next_pass`), so a datagram costs three turns:
 dispatch sets the demux bit, the demux drains packets and kicks each
-connection driver (rs/moq-uring/src/quic/quinn/endpoint.rs:208-220,
+connection driver (rs/moq-uring/src/quic/noq/endpoint.rs:208-220,
 :285-290), and the drivers stage `SendMsg` a turn later. Every hop is a turn
 and up to an enter. The other io_uring runtimes drain their local queue to
 exhaustion, or to a quantum, before touching the ring.
@@ -29,7 +29,7 @@ must not starve the socket.
   stale first pass a park-returning turn runs today (worker.rs:180 polls on
   readiness the previous turn already consumed).
 - The egress driver's one-train-then-self-wake shape
-  (rs/moq-uring/src/quic/quinn/connection.rs:743-751) interacts with the
+  (rs/moq-uring/src/quic/noq/connection.rs:743-751) interacts with the
   budget: a deep backlog would consume every pass. Fold the
   [egress requeue](/quest/m2/perf/egress-requeue.md) train budget into the
   same sweep so trains per turn and passes per turn are measured together.
diff --git a/quest/m2/quic/README.md b/quest/m2/quic/README.md
index 081ef50ae2..fea1ae70ae 100644
--- a/quest/m2/quic/README.md
+++ b/quest/m2/quic/README.md
@@ -15,10 +15,8 @@ timestamps, kernel pacing, buffer pools) live in m3.
 
 ## Plan
 
-[One QUIC backend](/quest/m1/quic-one-backend.md) deletes quinn and quiche
-on `dev` first; everything here assumes a single stack. The
-[fork](/quest/m2/quic/fork.md) is the first quest in the line and most
-others require it.
+Everything here assumes the single noq stack. The [fork](/quest/m2/quic/fork.md)
+is the first quest in the line and most others require it.
 
 Rules the line keeps:
 
@@ -80,8 +78,6 @@ This is a transport API change, not a MoQ wire change.
 
 ## Related
 
-- [One QUIC backend](/quest/m1/quic-one-backend.md) - the deletion this line
-  builds on
 - [Scope track priority](/quest/m2/track-priority-scope.md) - the
   per-broadcast fairness policy on cluster sessions
 - [Starvation](/quest/m2/qos/starvation.md) - the first consumer of ACK
diff --git a/quest/m2/quic/fork.md b/quest/m2/quic/fork.md
index dbaa0bb695..a4ba470751 100644
--- a/quest/m2/quic/fork.md
+++ b/quest/m2/quic/fork.md
@@ -40,8 +40,7 @@ waits on a review there.
 
 ## Related
 
-- [One QUIC backend](/quest/m1/quic-one-backend.md) - the reason a single
-  fork can carry every feature
+- The single noq backend lets one fork carry every feature.
 - [Release the stack](/quest/m2/quic/release.md) - how fork releases reach
   published MoQ crates
 - [Multipath spike](/quest/m3/multipath-spike.md) - noq's multipath support
diff --git a/quest/m2/quic/reliable-reset.md b/quest/m2/quic/reliable-reset.md
index 1629a2bbb3..a90a6fe9f8 100644
--- a/quest/m2/quic/reliable-reset.md
+++ b/quest/m2/quic/reliable-reset.md
@@ -66,5 +66,5 @@ provisional codepoints if the document changes before release.
 
 - [qmux on the QUIC stream state machine](/quest/m2/quic/qmux.md) - consumes
   the same reset state without a parallel implementation
-- [One QUIC backend](/quest/m1/quic-one-backend.md) - dropped quiche, the
-  one backend that had this, so it is the known browser-compliance gap
+- The removed quiche backend was the one stack that had this, so it is the
+  known browser-compliance gap.
diff --git a/quest/m2/uring-flow-control-windows.md b/quest/m2/uring-flow-control-windows.md
index 3a7a897a1e..595f5c1432 100644
--- a/quest/m2/uring-flow-control-windows.md
+++ b/quest/m2/uring-flow-control-windows.md
@@ -12,7 +12,7 @@ section tunes both worker runtimes.
 `moq_uring::quic::Transport` carries the per-connection knobs the relay maps
 its `[quic]` section onto, and today it has no window fields: the backend
 hardcodes them (`STREAM_WINDOW` / `CONNECTION_WINDOW` in
-`rs/moq-uring/src/quic/quinn/mod.rs`). `transport()` in
+`rs/moq-uring/src/quic/noq/mod.rs`). `transport()` in
 `rs/moq-relay/src/uring.rs` therefore refuses all three rather than dropping
 them.
 
diff --git a/quest/m3/multipath-spike.md b/quest/m3/multipath-spike.md
index 620698507c..4cb7984f56 100644
--- a/quest/m3/multipath-spike.md
+++ b/quest/m3/multipath-spike.md
@@ -28,9 +28,8 @@ browser WebTransport backend could never implement it.
 **What the spike is really for is the constraint nobody has written down.**
 `max_concurrent_multipath_paths` maps to the `initial_max_path_id` transport
 parameter, which both peers negotiate, so a multipath session needs noq on
-*both* ends. noq is the only backend on `dev` (`main` still
-defaults to quinn until the merge, and the browser and qmux transports have
-no such thing). So bonded contribution is not an opt-in client feature; it
+*both* ends. noq is the only native QUIC backend, while browser and qmux
+transports have no such thing. So bonded contribution is not an opt-in client feature; it
 constrains every relay and client on the path to run noq. Establish what that
 actually costs before anyone builds a fan-out socket.
 
diff --git a/rs/hang/Cargo.toml b/rs/hang/Cargo.toml
index d92909977b..c8ec526172 100644
--- a/rs/hang/Cargo.toml
+++ b/rs/hang/Cargo.toml
@@ -31,7 +31,7 @@ features = ["from", "display", "debug"]
 [dev-dependencies]
 anyhow = { workspace = true }
 moq-mux = { path = "../moq-mux" }
-moq-tokio = { workspace = true, features = ["quinn", "aws-lc-rs", "websocket"] }
+moq-tokio = { workspace = true, features = ["noq", "aws-lc-rs", "websocket"] }
 tokio = { workspace = true, features = ["macros", "fs"] }
 tracing = { workspace = true }
 url = { workspace = true }
diff --git a/rs/justfile b/rs/justfile
index 0d78986137..9d2beeb8e7 100644
--- a/rs/justfile
+++ b/rs/justfile
@@ -382,7 +382,7 @@ check-changed $FILES:
     	just rs wasm
     fi
 
-# Compile moq-tokio by itself at the feature extremes and with each QUIC backend.
+# Compile moq-tokio by itself at the feature extremes and with each crypto provider.
 # Its default-feature build is already part of the ordinary clippy pass above.
 tokio-features:
     #!/usr/bin/env bash
@@ -390,9 +390,6 @@ tokio-features:
 
     cargo clippy --locked -p moq-tokio --no-default-features -- -D warnings
     cargo clippy --locked -p moq-tokio --all-features -- -D warnings
-    cargo clippy --locked -p moq-tokio --no-default-features --features quiche -- -D warnings
-    cargo clippy --locked -p moq-tokio --no-default-features --features quinn,aws-lc-rs -- -D warnings
-    cargo clippy --locked -p moq-tokio --no-default-features --features quinn,ring -- -D warnings
     cargo clippy --locked -p moq-tokio --no-default-features --features noq,aws-lc-rs -- -D warnings
     cargo clippy --locked -p moq-tokio --no-default-features --features noq,ring -- -D warnings
 
@@ -401,17 +398,15 @@ tokio-features:
     done
 
     want='a rustls QUIC backend requires a crypto provider: enable either the `aws-lc-rs` or `ring` feature'
-    for backend in quinn noq; do
-        if output=$(cargo check --locked -p moq-tokio --no-default-features --features "$backend" 2>&1); then
-            echo "rs: moq-tokio with only $backend should reject its missing crypto provider" >&2
-            exit 1
-        fi
-        if ! grep -qF "$want" <<< "$output"; then
-            echo "rs: moq-tokio with only $backend should fail on: $want" >&2
-            echo "$output" | grep -E '^error' >&2 || true
-            exit 1
-        fi
-    done
+    if output=$(cargo check --locked -p moq-tokio --no-default-features --features noq 2>&1); then
+        echo "rs: moq-tokio with only noq should reject its missing crypto provider" >&2
+        exit 1
+    fi
+    if ! grep -qF "$want" <<< "$output"; then
+        echo "rs: moq-tokio with only noq should fail on: $want" >&2
+        echo "$output" | grep -E '^error' >&2 || true
+        exit 1
+    fi
 
 # Same as `fix`, but scoped the same way as `check-changed`.
 fix-changed $FILES:
@@ -440,8 +435,8 @@ fix-changed $FILES:
 # this once a day instead. A break there lands on main rather than being caught
 # in review, which is the same trade the other nightly gates make.
 #
-# Default features rather than `--all-features`: jemalloc and the quiche
-# backend don't build on MSVC, while moq-video's Linux-only `nvidia` default
+# Default features rather than `--all-features`: jemalloc doesn't build on
+# MSVC, while moq-video's Linux-only `nvidia` default
 # are already no-ops off Linux. moq-gst is excluded because it links
 # GStreamer via pkg-config, which the Windows runner doesn't have.
 #
@@ -456,25 +451,13 @@ windows *args:
 # Compile and test the io_uring relay path, which is off the default feature set.
 # Linux-only, and the tests below the 6.12 kernel floor skip themselves.
 #
-# The remaining pairs run the same suite over the alternative QUIC backends.
-# moq-uring compiles exactly one, so each gets its own invocation: feature
-# unification would otherwise fold the builds back together.
-#
-# `qlog` is a fourth axis on top of that, and the traces are what a debugging
-# run depends on, so each backend also gets a pass with it on.
+# `qlog` is a second axis, and the traces are what a debugging run depends on,
+# so it gets a separate pass.
 uring *args:
     cargo clippy --locked -p moq-uring -p moq-relay --features moq-relay/io-uring --all-targets {{ args }} -- -D warnings
     cargo nextest run --locked -p moq-uring -p moq-relay --features moq-relay/io-uring --all-targets {{ args }}
     cargo clippy --locked -p moq-uring -p moq-relay --features moq-relay/io-uring,moq-relay/qlog --all-targets {{ args }} -- -D warnings
     cargo nextest run --locked -p moq-uring --features qlog --all-targets {{ args }}
-    cargo clippy --locked -p moq-uring --no-default-features --features quinn --all-targets {{ args }} -- -D warnings
-    cargo nextest run --locked -p moq-uring --no-default-features --features quinn --all-targets {{ args }}
-    cargo nextest run --locked -p moq-uring --no-default-features --features quinn,qlog --all-targets {{ args }}
-    cargo clippy --locked -p moq-relay --features io-uring-quinn --all-targets {{ args }} -- -D warnings
-    cargo clippy --locked -p moq-uring --no-default-features --features quiche --all-targets {{ args }} -- -D warnings
-    cargo nextest run --locked -p moq-uring --no-default-features --features quiche --all-targets {{ args }}
-    cargo nextest run --locked -p moq-uring --no-default-features --features quiche,qlog --all-targets {{ args }}
-    cargo clippy --locked -p moq-relay --features io-uring-quiche --all-targets {{ args }} -- -D warnings
 
 # Runs the `#[cfg(target_os = "macos")]` code past the compiler: moq-video's
 # VideoToolbox encode/decode and its ScreenCaptureKit / AVFoundation capture,
@@ -640,7 +623,7 @@ c-tests:
 #
 # `--all-features` is the only thing that compiles moq-cli's play/capture, the
 # moq-video and moq-audio device features, the Linux bindgen codecs (vaapi,
-# v4l2), PipeWire, quiche, and jemalloc. `--no-default-features` is
+# v4l2), PipeWire, and jemalloc. `--no-default-features` is
 # the only thing that compiles the `#[cfg(not(feature = ...))]` arms.
 #
 # Cargo unifies features across a workspace selection. Check each package alone
@@ -808,10 +791,10 @@ bench-udp *args:
     cargo bench -p moq-uring --bench udp_tokio -- {{ args }}
     cargo bench -p moq-uring --bench udp_uring -- {{ args }}
 
-# Measure a raw-quiche echo through the io_uring worker, ablating receive
+# Measure a noq echo through the io_uring worker, ablating receive
 # batching, GRO, and GSO one at a time. Linux 6.12+ (skips loudly otherwise).
 bench-echo *args:
-    cargo bench -p moq-uring --bench echo_quiche -- {{ args }}
+    cargo bench -p moq-uring --bench echo_noq -- {{ args }}
 
 # Measure a full moq-lite session (publisher to subscriber) through the
 # io_uring worker, same ablations and per-iteration unit as bench-echo.
diff --git a/rs/libmoq/src/api.rs b/rs/libmoq/src/api.rs
index fb07918723..f30bde34f5 100644
--- a/rs/libmoq/src/api.rs
+++ b/rs/libmoq/src/api.rs
@@ -892,43 +892,6 @@ pub unsafe extern "C" fn moq_versions(dst: *mut moq_string, count: usize) -> i32
 	})
 }
 
-/// The QUIC backend names this build offers, spelled the way [moq_client_config]'s `backend`
-/// expects. Built once; the slices are valid for the life of the process.
-static BACKEND_NAMES: std::sync::LazyLock<Vec<&'static str>> =
-	std::sync::LazyLock::new(|| moq_tokio::QuicBackend::compiled().iter().map(|b| b.as_str()).collect());
-
-/// List the QUIC backends this build was compiled with.
-///
-/// Writes up to `count` names into `dst` and returns the total number available, which
-/// may be larger than `count`. Pass a NULL `dst` with a zero `count` to size the array
-/// first. Each name borrows a static string valid for the life of the process.
-///
-/// The backends are compile-time optional, so a caller building a menu must read this
-/// rather than listing names: an option this build lacks is rejected by
-/// a dial, which would leave a menu entry that can only fail.
-///
-/// Returns the total count on success, or a negative code on failure.
-///
-/// # Safety
-/// - The caller must ensure that `dst` is either NULL with a zero `count`, or a valid
-///   pointer to `count` writable [moq_string] values.
-#[unsafe(no_mangle)]
-pub unsafe extern "C" fn moq_backends(dst: *mut moq_string, count: usize) -> i32 {
-	ffi::enter(move || {
-		if !dst.is_null() {
-			let dst = unsafe { std::slice::from_raw_parts_mut(dst, count) };
-			for (slot, name) in dst.iter_mut().zip(BACKEND_NAMES.iter()) {
-				slot.data = name.as_ptr().cast::<c_char>();
-				slot.len = name.len();
-			}
-		} else if count != 0 {
-			return Err(Error::InvalidPointer);
-		}
-
-		Ok(BACKEND_NAMES.len())
-	})
-}
-
 /// Whether this build can capture qlog traces.
 ///
 /// Capture is compile-time optional. [moq_client_config]'s `quic_qlog` accepts a directory
@@ -965,11 +928,6 @@ pub struct moq_client_config {
 	pub versions: *const moq_string,
 	pub versions_len: usize,
 
-	/// QUIC backend name, or NULL for this build's choice. [moq_backends] lists
-	/// the names this build accepts, which are compile-time dependent.
-	pub backend: *const c_char,
-	pub backend_len: usize,
-
 	/// Local socket address to bind, or NULL for the wildcard address.
 	pub bind: *const c_char,
 	pub bind_len: usize,
diff --git a/rs/libmoq/src/client.rs b/rs/libmoq/src/client.rs
index e6a1aade92..0538df377f 100644
--- a/rs/libmoq/src/client.rs
+++ b/rs/libmoq/src/client.rs
@@ -43,9 +43,6 @@ pub unsafe fn parse_client(config: Option<&moq_client_config>) -> Result<Config,
 	}
 
 	// Transport
-	if let Some(backend) = unsafe { ffi::parse_str_optional(config.backend, config.backend_len)? } {
-		out.connect.backend = Some(moq_tokio::QuicBackend::from_str(backend).map_err(Error::InvalidConfig)?);
-	}
 	if let Some(bind) = unsafe { ffi::parse_str_optional(config.bind, config.bind_len)? } {
 		let addr: std::net::SocketAddr = bind
 			.parse()
diff --git a/rs/libmoq/src/test.rs b/rs/libmoq/src/test.rs
index f72c262984..cf1f58cb55 100644
--- a/rs/libmoq/src/test.rs
+++ b/rs/libmoq/src/test.rs
@@ -4243,49 +4243,18 @@ fn config_quic_and_backoff_knobs_apply() {
 	assert_eq!(parsed.quic.qlog.as_deref(), Some(std::path::Path::new(dir)));
 }
 
-/// The backend variants are feature-gated, so a hardcoded menu offers options this
-/// build rejects. Every name reported must be one a dial takes, same contract as
-/// `moq_versions`.
+/// An idle timeout outside QUIC's millisecond varint is an ordinary configuration
+/// error, and later calls remain usable.
 #[test]
-fn backends_lists_only_what_a_dial_accepts() {
-	let count = unsafe { moq_backends(std::ptr::null_mut(), 0) };
-	assert!(count > 0, "expected at least one compiled backend, got {count}");
-
-	let mut names = vec![
-		moq_string {
-			data: std::ptr::null(),
-			len: 0
-		};
-		count as usize
-	];
-	assert_eq!(unsafe { moq_backends(names.as_mut_ptr(), names.len()) }, count);
-
-	let accepts = |name: &str| {
-		let mut config = client_config();
-		config.backend = name.as_ptr() as *const c_char;
-		config.backend_len = name.len();
-		unsafe { crate::parse_client(Some(&config)) }.is_ok()
-	};
+fn dial_rejects_an_unrepresentable_idle_timeout() {
+	let mut config = client_config();
+	config.quic_idle_timeout_ms = u64::MAX;
+	config.has_quic_idle_timeout = true;
 
-	for name in &names {
-		let name = unsafe { ffi::parse_str(name.data, name.len) }.expect("backend name is UTF-8");
-		assert!(accepts(name), "listed backend {name} must be settable");
-	}
+	assert_eq!(dial(Some(&config)), Error::InvalidConfig(String::new()).code());
 
-	// And the converse: a backend this build lacks is not listed, so the menu can't
-	// offer a dead option.
-	for candidate in ["quinn", "quiche", "noq"] {
-		let listed = names.iter().any(|n| {
-			unsafe { ffi::parse_str(n.data, n.len) }
-				.map(|s| s == candidate)
-				.unwrap_or(false)
-		});
-		assert_eq!(
-			listed,
-			accepts(candidate),
-			"{candidate}: listed and accepted must agree"
-		);
-	}
+	// A rejected dial leaves the library usable.
+	assert!(moq_client_defaults().has_connect_timeout);
 }
 
 /// Whether a qlog directory works at all is a compile-time feature, so the capability
diff --git a/rs/moq-bench/Cargo.toml b/rs/moq-bench/Cargo.toml
index 9d1a71e456..0de559a2e6 100644
--- a/rs/moq-bench/Cargo.toml
+++ b/rs/moq-bench/Cargo.toml
@@ -38,8 +38,6 @@ doc = false
 default = ["noq", "websocket"]
 iroh = ["moq-tokio/iroh"]
 noq = ["moq-tokio/noq"]
-quinn = ["moq-tokio/quinn"]
-quiche = ["moq-tokio/quiche"]
 uring = ["dep:moq-uring"]
 websocket = ["moq-tokio/websocket"]
 
diff --git a/rs/moq-boy/Cargo.toml b/rs/moq-boy/Cargo.toml
index 3a66068261..217080af78 100644
--- a/rs/moq-boy/Cargo.toml
+++ b/rs/moq-boy/Cargo.toml
@@ -15,7 +15,6 @@ rust-version.workspace = true
 default = ["noq", "websocket"]
 jemalloc = ["moq-tokio/jemalloc"]
 noq = ["moq-tokio/noq"]
-quinn = ["moq-tokio/quinn"]
 websocket = ["moq-tokio/websocket"]
 
 [dependencies]
diff --git a/rs/moq-cli/Cargo.toml b/rs/moq-cli/Cargo.toml
index 31c61205bf..47d873dbcc 100644
--- a/rs/moq-cli/Cargo.toml
+++ b/rs/moq-cli/Cargo.toml
@@ -32,8 +32,6 @@ iroh = ["moq-tokio/iroh"]
 cluster-lan = ["moq-relay/cluster-lan"]
 jemalloc = ["moq-tokio/jemalloc"]
 noq = ["moq-tokio/noq"]
-quinn = ["moq-tokio/quinn"]
-quiche = ["moq-tokio/quiche"]
 # qlog trace capture (`--client-quic-qlog <DIR>`). Off by default: it compiles the
 # qlog machinery into the enabled backends and is only wanted for debugging or
 # congestion-control testing.
@@ -59,7 +57,7 @@ play = ["dep:moq-video", "moq-video/render", "dep:moq-audio", "moq-audio/playbac
 # the matching moq-video feature, so it only bites when something else pulls in
 # moq-video: `capture`, `transcode`, or `play`. For a build with no CUDA
 # dependencies, drop it:
-#   cargo build -p moq-cli --no-default-features --features "iroh noq websocket capture"
+#   cargo build -p moq-cli --no-default-features --features "iroh,noq,websocket,capture"
 nvidia = ["moq-video?/nvidia", "moq-transcode?/nvidia"]
 # Compatibility aliases for the pre-consolidation names, kept so a manifest that
 # already asks for the old split still resolves. Undocumented on purpose: the
@@ -101,7 +99,7 @@ moq-auth = { workspace = true, features = ["serve"] }
 moq-hls = { workspace = true, features = ["server"] }
 moq-mux = { workspace = true }
 # Cluster, LAN mesh, and inbound `/.cluster` auth. default-features off so the
-# CLI's own feature set (iroh, backends, cluster-lan) is what selects them.
+# CLI's own feature set (iroh, noq, cluster-lan) is what selects them.
 moq-relay = { workspace = true }
 moq-rtc = { workspace = true }
 moq-rtmp = { workspace = true }
diff --git a/rs/moq-gst/src/lib.rs b/rs/moq-gst/src/lib.rs
index cb804e9e80..05ece3bf4e 100644
--- a/rs/moq-gst/src/lib.rs
+++ b/rs/moq-gst/src/lib.rs
@@ -19,7 +19,6 @@ pub fn plugin_init(plugin: &gst::Plugin) -> Result<(), glib::BoolError> {
 		.with_default_directive(LevelFilter::INFO.into())
 		.from_env_lossy() // Allow overriding with RUST_LOG
 		.add_directive("h2=warn".parse().unwrap())
-		.add_directive("quinn=info".parse().unwrap())
 		.add_directive("noq=info".parse().unwrap())
 		.add_directive("tracing::span=off".parse().unwrap())
 		.add_directive("tracing::span::active=off".parse().unwrap());
diff --git a/rs/moq-native/Cargo.toml b/rs/moq-native/Cargo.toml
index 729c7600a9..9ea4cce4c4 100644
--- a/rs/moq-native/Cargo.toml
+++ b/rs/moq-native/Cargo.toml
@@ -14,9 +14,7 @@ categories = ["multimedia", "network-programming", "web-programming"]
 
 [features]
 default = ["noq", "aws-lc-rs", "websocket", "tcp", "uds"]
-quinn = []
 noq = []
-quiche = []
 watch = []
 qlog = []
 aws-lc-rs = []
diff --git a/rs/moq-relay/Cargo.toml b/rs/moq-relay/Cargo.toml
index d7cc4d9860..31cb9cdb04 100644
--- a/rs/moq-relay/Cargo.toml
+++ b/rs/moq-relay/Cargo.toml
@@ -29,8 +29,6 @@ iroh = ["moq-tokio/iroh"]
 cluster-lan = ["moq-tokio/mdns"]
 jemalloc = ["moq-tokio/jemalloc"]
 noq = ["_quic", "moq-tokio/noq"]
-quinn = ["_quic", "moq-tokio/quinn"]
-quiche = ["_quic", "moq-tokio/quiche"]
 # The tokio QUIC listener, and the thread-per-core worker group behind
 # `runtime.workers`. Not one to enable on its own: it names no backend, so
 # moq-tokio would have nothing to bind a socket with.
@@ -44,19 +42,10 @@ websocket = ["moq-tokio/websocket", "dep:qmux", "axum/ws"]
 # Unix-domain-socket stream listener (`--server-unix-bind`), unix-only. In the
 # default set; drop via --no-default-features on platforms without Unix sockets.
 uds = ["moq-tokio/uds"]
-# Serve QUIC from io_uring workers (`--runtime-io-uring`), Linux-only, in one of
-# three flavors. All are off by default: the relay is useful without io_uring.
-# `io-uring` uses noq-proto over rustls, matching the default tokio backend;
-# the suffixed features retain quinn-proto and quiche as explicit alternatives.
-#
-# Cargo features are additive, so asking for several compiles them and runs noq,
-# which is what the nightly `--all-features` pass does. `just rs uring` builds
-# each on its own.
+# Serve QUIC from io_uring workers (`--runtime-io-uring`), Linux-only.
+# This is off by default: the relay is useful without io_uring.
 io-uring = ["_uring", "moq-uring/noq"]
-io-uring-quinn = ["_uring", "moq-uring/quinn"]
-io-uring-quiche = ["_uring", "moq-uring/quiche"]
-# The listener all flavors share. Not one to enable on its own: moq-uring has
-# no `quic` module without a backend, so this alone does not build.
+# The listener machinery shared by the feature above.
 _uring = ["dep:moq-sock", "dep:moq-uring"]
 
 [dependencies]
diff --git a/rs/moq-relay/src/relay.rs b/rs/moq-relay/src/relay.rs
index 43cfa3e40a..3be7241ec9 100644
--- a/rs/moq-relay/src/relay.rs
+++ b/rs/moq-relay/src/relay.rs
@@ -136,7 +136,7 @@ impl Relay {
 		#[cfg(not(feature = "_quic"))]
 		anyhow::ensure!(
 			io_uring || config.runtime.workers().is_none(),
-			"runtime.workers needs moq-relay built with a QUIC backend: noq, quinn, or quiche"
+			"runtime.workers needs moq-relay built with the `noq` feature"
 		);
 
 		#[cfg(feature = "_quic")]
@@ -436,7 +436,7 @@ impl Relay {
 
 		// Before the readiness notify, for the same reason the cluster starts
 		// before it: an unsupported kernel, a refused ring, or a certificate
-		// quiche will not load fails here, and reporting ready first would
+		// certificate identity noq will not load fails here, and reporting ready first would
 		// release the units depending on a relay that is about to exit.
 		#[cfg(all(target_os = "linux", feature = "_uring"))]
 		let mut uring = uring;
@@ -671,7 +671,7 @@ mod tests {
 		};
 		assert_eq!(
 			error.to_string(),
-			"runtime.workers needs moq-relay built with a QUIC backend: noq, quinn, or quiche"
+			"runtime.workers needs moq-relay built with the `noq` feature"
 		);
 	}
 }
diff --git a/rs/moq-relay/src/uring.rs b/rs/moq-relay/src/uring.rs
index 76718741ed..3cd4c060fe 100644
--- a/rs/moq-relay/src/uring.rs
+++ b/rs/moq-relay/src/uring.rs
@@ -138,9 +138,6 @@ impl Workers {
 				 QUIC-LB server id (listen.lb_id)"
 			);
 		}
-		if let Some(backend) = listen.backend.as_ref() {
-			anyhow::bail!("io_uring workers serve their own QUIC stack; listen.backend={backend:?} cannot apply");
-		}
 		let (cert, key) = match (listen.tls.cert.as_slice(), listen.tls.key.as_slice()) {
 			([cert], [key]) => (cert.clone(), key.clone()),
 			([], []) => anyhow::bail!("io_uring workers need a certificate (listen.tls.cert/key)"),
@@ -241,7 +238,7 @@ impl Workers {
 		server.transport = transport(&quic)?;
 
 		// GSO is a property of the socket, not the connection, so it rides the
-		// worker's UDP config rather than quiche's.
+		// worker's UDP config rather than the connection's.
 		let mut udp = moq_uring::udp::Config::default();
 		udp.gso = quic.gso.unwrap_or(true);
 
diff --git a/rs/moq-relay/src/web.rs b/rs/moq-relay/src/web.rs
index 659866b1b9..4de3463208 100644
--- a/rs/moq-relay/src/web.rs
+++ b/rs/moq-relay/src/web.rs
@@ -667,9 +667,8 @@ async fn serve_fingerprint(State(state): State<Arc<WebState>>) -> Response {
 	// The first certificate in configuration order, deliberately. The endpoint
 	// exists so an `http://` client can pin a self-signed development
 	// certificate, where there is exactly one. With several configured there is
-	// no single answer: quinn and noq select by SNI at handshake, so those
-	// clients use `https://`, while quiche serves the first pair to everyone and
-	// the rest need an explicit `--client-tls-fingerprint` pin.
+	// no single answer: clients use `https://` so SNI selects the matching
+	// certificate at the handshake.
 	match state.certificates.fingerprints().into_iter().next() {
 		Some(fingerprint) => fingerprint.into_response(),
 		// A stream-only relay has no certificate to pin.
diff --git a/rs/moq-relay/tests/drills.rs b/rs/moq-relay/tests/drills.rs
index 95e9473002..12d4b2fbd2 100644
--- a/rs/moq-relay/tests/drills.rs
+++ b/rs/moq-relay/tests/drills.rs
@@ -15,7 +15,7 @@
 //! See `test/drill/README.md` for the recipe, the sensitivity proof that each
 //! drill fails when its recovery behavior is removed, and the loom/fuzz cases
 //! covering the primitives underneath.
-#![cfg(all(any(feature = "noq", feature = "quinn"), feature = "websocket"))]
+#![cfg(all(feature = "noq", feature = "websocket"))]
 
 use std::time::Duration;
 
diff --git a/rs/moq-relay/tests/goaway_cluster.rs b/rs/moq-relay/tests/goaway_cluster.rs
index e01adf2468..9ff0bef87d 100644
--- a/rs/moq-relay/tests/goaway_cluster.rs
+++ b/rs/moq-relay/tests/goaway_cluster.rs
@@ -28,8 +28,8 @@ async fn within<T>(step: &str, fut: impl std::future::Future<Output = T>) -> T {
 
 /// Run an integration-test future on a dedicated thread with a large stack.
 ///
-/// Under `--all-features`, `moq-tokio` compiles every transport backend
-/// (quinn, quiche, noq, iroh, websocket) into its `Session`/`Client` types.
+/// Under `--all-features`, `moq-tokio` compiles every transport
+/// (noq, iroh, websocket, and qmux) into its `Session`/`Client` types.
 /// These multi-relay tests hold several such values live across await points,
 /// so the single test future's state machine is large, and in an unoptimized
 /// build it overflows libtest's default 2 MiB per-test thread stack (a SIGABRT
diff --git a/rs/moq-relay/tests/released_cli.rs b/rs/moq-relay/tests/released_cli.rs
index 67672f13db..2ce58eeaf4 100644
--- a/rs/moq-relay/tests/released_cli.rs
+++ b/rs/moq-relay/tests/released_cli.rs
@@ -29,7 +29,6 @@ const RELEASED: &[(&str, Option<&str>)] = &[
 	("cache-capacity", Some("MOQ_CACHE_CAPACITY")),
 	("cache-duration", Some("MOQ_CACHE_DURATION")),
 	("cache-headroom", Some("MOQ_CACHE_HEADROOM")),
-	("client-backend", Some("MOQ_CLIENT_BACKEND")),
 	("client-bind", Some("MOQ_CLIENT_BIND")),
 	("client-connect", Some("MOQ_CLIENT_CONNECT")),
 	("client-connect-timeout", Some("MOQ_CLIENT_CONNECT_TIMEOUT")),
@@ -69,7 +68,6 @@ const RELEASED: &[(&str, Option<&str>)] = &[
 	("iroh-secret", Some("MOQ_IROH_SECRET")),
 	("listen", Some("MOQ_SERVER_BIND")),
 	("log-level", Some("MOQ_LOG_LEVEL")),
-	("server-backend", Some("MOQ_SERVER_BACKEND")),
 	("server-bind", Some("MOQ_SERVER_BIND")),
 	("server-max-streams", Some("MOQ_SERVER_QUIC_MAX_STREAMS")),
 	("server-preferred-v4", Some("MOQ_SERVER_PREFERRED_V4")),
diff --git a/rs/moq-sock/src/bind.rs b/rs/moq-sock/src/bind.rs
index 5dcddea400..0827e6e72e 100644
--- a/rs/moq-sock/src/bind.rs
+++ b/rs/moq-sock/src/bind.rs
@@ -27,7 +27,7 @@ const KEEPALIVE_INTERVAL: Duration = Duration::from_secs(10);
 /// UDP socket buffer size requested in each direction, in bytes.
 ///
 /// A QUIC stack absorbs bursts in the kernel socket buffer: whatever doesn't fit
-/// while the process is off the CPU is dropped before quinn ever sees it, and
+/// while the process is off the CPU is dropped before noq ever sees it, and
 /// congestion control reads those drops as congestion. The OS defaults are sized
 /// for a chatty TCP-era socket (208 KiB on Linux), which a single relay socket
 /// carrying every connection blows through in milliseconds. 8 MiB is roughly 64ms
diff --git a/rs/moq-tokio/Cargo.toml b/rs/moq-tokio/Cargo.toml
index 01b9599da3..1dd36912bb 100644
--- a/rs/moq-tokio/Cargo.toml
+++ b/rs/moq-tokio/Cargo.toml
@@ -14,9 +14,7 @@ categories = ["multimedia", "network-programming", "web-programming"]
 
 [features]
 default = ["noq", "aws-lc-rs", "websocket", "tcp", "uds"]
-quinn = ["_transport", "_certs", "dep:quinn", "dep:web-transport-quinn", "dep:reqwest", "watch", "dep:dns-lookup"]
 noq = ["_transport", "_certs", "dep:web-transport-noq", "dep:reqwest", "watch", "dep:dns-lookup"]
-quiche = ["_transport", "_certs", "dep:web-transport-quiche", "dep:reqwest", "dep:rustls-native-certs", "dep:dns-lookup", "watch"]
 # Server-side certificate handling: chains loaded from disk, self-signed generation,
 # in-memory identities, and per-SNI selection. Not one to enable on its own, since
 # nothing turns it into a listener: every QUIC backend needs it for its own TLS, and
@@ -28,24 +26,14 @@ _certs = ["dep:rcgen", "dep:rustls-webpki"]
 _transport = []
 # Filesystem watcher for hot-reloading on-disk TLS certs, keys, and root CAs.
 watch = ["dep:notify"]
-# Capture qlog traces (`--*-quic-qlog <DIR>`). Off by default: quinn and noq pull in
-# the qlog crate and its serde_json encoder, which a production build has no use for.
-# quiche compiles its qlog support in unconditionally, so this is empty for a
-# quiche-only build; it still gates the flag there, so one feature means one thing
-# across every backend.
-qlog = ["quinn?/qlog", "web-transport-noq?/qlog"]
-# The QUIC backends pull in their crypto provider from these features (default-features
-# are off on each backend dep), so a backend without aws-lc-rs/ring has no initial cipher.
+# Capture qlog traces (`--*-quic-qlog <DIR>`). Off by default so production
+# builds do not pull in the qlog crate and its serde_json encoder.
+qlog = ["web-transport-noq?/qlog"]
+# The QUIC backend pulls in its crypto provider from these features (default-features
+# are off on the dependency), so a backend without aws-lc-rs/ring has no initial cipher.
 # A provider is also all it takes to sign and serve certificates, so each turns on
 # `_certs` even where there is no QUIC backend to serve them for.
-aws-lc-rs = [
-    "_certs",
-    "rustls/aws-lc-rs",
-    "rcgen/aws_lc_rs",
-    "quinn?/rustls-aws-lc-rs",
-    "web-transport-noq?/aws-lc-rs",
-    "web-transport-quinn?/aws-lc-rs",
-]
+aws-lc-rs = ["_certs", "rustls/aws-lc-rs", "rcgen/aws_lc_rs", "web-transport-noq?/aws-lc-rs"]
 iroh = ["_transport", "dep:web-transport-iroh", "dep:web-transport-proto", "dep:noq-proto"]
 # LAN peer discovery over mDNS (the `mdns` module).
 mdns = ["dep:mdns-sd", "dep:hmac", "dep:sha2", "dep:subtle"]
@@ -56,7 +44,7 @@ tcp = ["_transport", "dep:qmux", "dep:dns-lookup"]
 # Unix-domain-socket qmux transport (`unix://`), unix-only. Adds peer-credential
 # inspection on accept. Pulls in `tcp` (shares qmux's stream transport).
 uds = ["tcp", "qmux/uds"]
-ring = ["_certs", "rustls/ring", "rcgen/ring", "quinn?/rustls-ring", "web-transport-noq?/ring", "web-transport-quinn?/ring"]
+ring = ["_certs", "rustls/ring", "rcgen/ring", "web-transport-noq?/ring"]
 android-logcat = ["dep:tracing-android"]
 
 [dependencies]
@@ -77,14 +65,11 @@ moq-sock = { workspace = true }
 noq-proto = { workspace = true, optional = true }
 notify = { version = "8", optional = true }
 qmux = { workspace = true, features = ["wss", "tls", "tcp"], optional = true }
-quinn = { version = "0.11", default-features = false, features = ["platform-verifier", "runtime-tokio", "bloom"], optional = true }
 rand = "0.10.1"
 rcgen = { version = "0.14", default-features = false, optional = true }
 reqwest = { version = "0.13", default-features = false, optional = true }
 rustls = "0.23"
-rustls-native-certs = { version = "0.8", optional = true }
-# OS-native server-cert verifier for the rustls backends. Version matched to the
-# copy quinn-proto already pulls in, to avoid duplication.
+# OS-native server-cert verifier for the rustls backend.
 rustls-platform-verifier = "0.7"
 rustls-webpki = { version = "0.103", features = ["aws-lc-rs"], optional = true }
 serde = { version = "1", features = ["derive"] }
@@ -104,8 +89,6 @@ usage = { workspace = true, features = ["config"] }
 web-transport-iroh = { workspace = true, optional = true }
 web-transport-noq = { workspace = true, optional = true }
 web-transport-proto = { workspace = true, optional = true }
-web-transport-quiche = { workspace = true, optional = true }
-web-transport-quinn = { workspace = true, optional = true }
 web-transport-trait = { workspace = true }
 x509-parser = "0.18"
 
diff --git a/rs/moq-tokio/README.md b/rs/moq-tokio/README.md
index 3af9f2a32d..4802a6760b 100644
--- a/rs/moq-tokio/README.md
+++ b/rs/moq-tokio/README.md
@@ -12,7 +12,7 @@ Tokio-based connection helpers for native [Media over QUIC](https://moq.dev) app
 
 Establishes MoQ connections over a few different transports, selectable via cargo features:
 
-- **WebTransport** (HTTP/3) via [noq](https://crates.io/crates/noq) (default), [quinn](https://crates.io/crates/quinn), or [quiche](https://crates.io/crates/quiche)
+- **WebTransport** (HTTP/3) via [noq](https://crates.io/crates/noq)
 - **Raw QUIC** with ALPN negotiation
 - **WebSocket** as a fallback when QUIC isn't available
 - **Iroh** P2P (`iroh` feature)
diff --git a/rs/moq-tokio/src/client.rs b/rs/moq-tokio/src/client.rs
index 237aab2032..b3adfaf208 100644
--- a/rs/moq-tokio/src/client.rs
+++ b/rs/moq-tokio/src/client.rs
@@ -4,11 +4,9 @@
 //! QUIC settings ([`crate::quic::Config`]) a binary shares with its accept half. The
 //! accept side is [`crate::server`].
 
-#[cfg(any(feature = "noq", feature = "quinn", feature = "quiche"))]
-use crate::QuicBackend;
 use crate::connection::Goaway;
 use crate::{Addrs, Backoff, Connection, Error};
-#[cfg(all(feature = "websocket", any(feature = "noq", feature = "quinn", feature = "quiche")))]
+#[cfg(all(feature = "websocket", feature = "noq"))]
 use std::future::Future;
 use url::Url;
 
@@ -45,18 +43,11 @@ impl Config {
 pub struct Client {
 	moq: moq_net::Client,
 	/// The single resolved set of protocol versions, used to advertise moq ALPNs across
-	/// every transport (passed into the QUIC backends' `connect` and used directly for
+	/// every transport (passed into the QUIC backend's `connect` and used directly for
 	/// raw TCP/UDS qmux and WebSocket). Resolved once in [`Client::new`] so the ALPN list
 	/// can't diverge between transports. iroh is the exception: it negotiates over the
 	/// full `moq_net::ALPNS` rather than the configured subset, so it reads nothing here.
-	#[cfg(any(
-		feature = "noq",
-		feature = "quinn",
-		feature = "quiche",
-		feature = "websocket",
-		feature = "tcp",
-		feature = "uds"
-	))]
+	#[cfg(any(feature = "noq", feature = "websocket", feature = "tcp", feature = "uds"))]
 	versions: moq_net::Versions,
 	/// The URL from [`connect.url`](crate::connect::Config::url), dialed by [`Client::publish`] / [`Client::consume`].
 	connect: Option<Url>,
@@ -67,7 +58,7 @@ pub struct Client {
 	pub(crate) backoff: Backoff,
 	pub(crate) goaway: Goaway,
 	/// The resolved Happy Eyeballs timings, used by the `tcp://` dial here; the
-	/// QUIC backends capture their own copy from the config.
+	/// QUIC backend captures its own copy from the config.
 	#[cfg(feature = "tcp")]
 	failover_delay: std::time::Duration,
 	#[cfg(feature = "tcp")]
@@ -77,16 +68,11 @@ pub struct Client {
 	/// The TLS server name override used by the WebSocket fallback.
 	#[cfg(feature = "websocket")]
 	tls_host_name: Option<String>,
-	/// Only the rustls-based dials read this. quiche builds its own TLS stack, and the
-	/// plaintext qmux transports have none.
-	#[cfg(any(feature = "noq", feature = "quinn", feature = "websocket"))]
+	/// Only the TLS-based dials read this; the plaintext qmux transports have none.
+	#[cfg(any(feature = "noq", feature = "websocket"))]
 	tls: rustls::ClientConfig,
 	#[cfg(feature = "noq")]
 	noq: Option<crate::noq::NoqClient>,
-	#[cfg(feature = "quinn")]
-	quinn: Option<crate::quinn::QuinnClient>,
-	#[cfg(feature = "quiche")]
-	quiche: Option<crate::quiche::QuicheClient>,
 	#[cfg(feature = "iroh")]
 	iroh: Option<crate::iroh::Endpoint>,
 	#[cfg(feature = "iroh")]
@@ -100,7 +86,7 @@ impl Client {
 	#[cfg(not(feature = "_transport"))]
 	pub fn new(_config: Config) -> crate::Result<Self> {
 		Err(Error::NoBackend(
-			"no backend compiled; enable noq, quinn, quiche, iroh, websocket, tcp, or uds feature",
+			"no backend compiled; enable noq, iroh, websocket, tcp, or uds feature",
 		))
 	}
 
@@ -119,36 +105,15 @@ impl Client {
 			return Err(Error::Deprecated(deprecated));
 		}
 
-		#[cfg(any(feature = "noq", feature = "quinn", feature = "quiche"))]
-		let backend = config.backend.clone().unwrap_or_else(crate::default_quic_backend);
-
 		quic.validate()?;
 
-		// Only the rustls-backed transports use this. Iroh, quiche, and the plaintext
+		// Only the rustls-backed transports use this. Iroh and the plaintext
 		// qmux transports must not require a rustls crypto provider.
-		#[cfg(any(feature = "noq", feature = "quinn", feature = "websocket"))]
+		#[cfg(any(feature = "noq", feature = "websocket"))]
 		let tls = config.tls.build()?;
 
 		#[cfg(feature = "noq")]
-		#[allow(unreachable_patterns)]
-		let noq = match backend {
-			QuicBackend::Noq => Some(crate::noq::NoqClient::new(&config, &quic)?),
-			_ => None,
-		};
-
-		#[cfg(feature = "quinn")]
-		#[allow(unreachable_patterns)]
-		let quinn = match backend {
-			QuicBackend::Quinn => Some(crate::quinn::QuinnClient::new(&config, &quic)?),
-			_ => None,
-		};
-
-		#[cfg(feature = "quiche")]
-		#[allow(unreachable_patterns)]
-		let quiche = match backend {
-			QuicBackend::Quiche => Some(crate::quiche::QuicheClient::new(&config, &quic)?),
-			_ => None,
-		};
+		let noq = Some(crate::noq::NoqClient::new(&config, &quic)?);
 
 		let versions = config.versions();
 		// Read before the struct literal below moves fields out of `config`.
@@ -163,14 +128,7 @@ impl Client {
 
 		Ok(Self {
 			moq: moq_net::Client::new().with_versions(versions.clone()),
-			#[cfg(any(
-				feature = "noq",
-				feature = "quinn",
-				feature = "quiche",
-				feature = "websocket",
-				feature = "tcp",
-				feature = "uds"
-			))]
+			#[cfg(any(feature = "noq", feature = "websocket", feature = "tcp", feature = "uds"))]
 			versions,
 			connect: config.url,
 			timeout,
@@ -185,14 +143,10 @@ impl Client {
 			websocket: config.websocket,
 			#[cfg(feature = "websocket")]
 			tls_host_name,
-			#[cfg(any(feature = "noq", feature = "quinn", feature = "websocket"))]
+			#[cfg(any(feature = "noq", feature = "websocket"))]
 			tls,
 			#[cfg(feature = "noq")]
 			noq,
-			#[cfg(feature = "quinn")]
-			quinn,
-			#[cfg(feature = "quiche")]
-			quiche,
 			#[cfg(feature = "iroh")]
 			iroh: None,
 			#[cfg(feature = "iroh")]
@@ -311,8 +265,6 @@ impl Client {
 	/// Errors if no transport feature is compiled in.
 	#[cfg(not(any(
 		feature = "noq",
-		feature = "quinn",
-		feature = "quiche",
 		feature = "iroh",
 		feature = "websocket",
 		feature = "tcp",
@@ -320,7 +272,7 @@ impl Client {
 	)))]
 	pub(crate) async fn dial(&self, _addr: crate::connect::Addr) -> crate::Result<moq_net::Session> {
 		Err(Error::NoBackend(
-			"no backend compiled; enable noq, quinn, quiche, iroh, websocket, tcp, or uds feature",
+			"no backend compiled; enable noq, iroh, websocket, tcp, or uds feature",
 		))
 	}
 
@@ -332,8 +284,6 @@ impl Client {
 	/// closes once the last returned handle drops.
 	#[cfg(any(
 		feature = "noq",
-		feature = "quinn",
-		feature = "quiche",
 		feature = "iroh",
 		feature = "websocket",
 		feature = "tcp",
@@ -362,8 +312,6 @@ impl Client {
 	/// The moq client builder, advertising `path` in the SETUP when there is one.
 	#[cfg(any(
 		feature = "noq",
-		feature = "quinn",
-		feature = "quiche",
 		feature = "iroh",
 		feature = "websocket",
 		feature = "tcp",
@@ -378,8 +326,6 @@ impl Client {
 
 	#[cfg(any(
 		feature = "noq",
-		feature = "quinn",
-		feature = "quiche",
 		feature = "iroh",
 		feature = "websocket",
 		feature = "tcp",
@@ -465,46 +411,6 @@ impl Client {
 			}
 		}
 
-		#[cfg(feature = "quinn")]
-		if let Some(quinn) = self.quinn.as_ref() {
-			let tls = self.tls.clone();
-			let quic_addr = addr.clone();
-			let quic_handle = async {
-				quinn
-					.connect(&tls, quic_addr, &self.versions)
-					.await
-					.map_err(Error::from)
-			};
-
-			#[cfg(feature = "websocket")]
-			{
-				return self.race_moq_connect(&moq, addr, quic_handle).await;
-			}
-
-			#[cfg(not(feature = "websocket"))]
-			{
-				let session = quic_handle.await?;
-				return Ok(moq.connect(crate::runtime::Runtime::new(), session).await?);
-			}
-		}
-
-		#[cfg(feature = "quiche")]
-		if let Some(quiche) = self.quiche.as_ref() {
-			let quic_addr = addr.clone();
-			let quic_handle = async { quiche.connect(quic_addr, &self.versions).await.map_err(Error::from) };
-
-			#[cfg(feature = "websocket")]
-			{
-				return self.race_moq_connect(&moq, addr, quic_handle).await;
-			}
-
-			#[cfg(not(feature = "websocket"))]
-			{
-				let session = quic_handle.await?;
-				return Ok(moq.connect(crate::runtime::Runtime::new(), session).await?);
-			}
-		}
-
 		#[cfg(feature = "websocket")]
 		return self.connect_websocket(addr).await;
 
@@ -533,7 +439,7 @@ impl Client {
 	///
 	/// Only compiled when there is a QUIC dial to race: a WebSocket-only build connects
 	/// over the fallback directly.
-	#[cfg(all(feature = "websocket", any(feature = "noq", feature = "quinn", feature = "quiche")))]
+	#[cfg(all(feature = "websocket", feature = "noq"))]
 	async fn race_moq_connect<Q, S>(
 		&self,
 		moq: &moq_net::Client,
@@ -575,8 +481,6 @@ impl Client {
 /// server's default path. A peer on published lite-05 rejects an empty value outright.
 #[cfg(any(
 	feature = "noq",
-	feature = "quinn",
-	feature = "quiche",
 	feature = "iroh",
 	feature = "websocket",
 	feature = "tcp",
@@ -603,8 +507,6 @@ fn request_target(url: &Url) -> Option<String> {
 /// [`crate::iroh::Binding`] and calls [`request_target`] itself.
 #[cfg(any(
 	feature = "noq",
-	feature = "quinn",
-	feature = "quiche",
 	feature = "iroh",
 	feature = "websocket",
 	feature = "tcp",
@@ -627,14 +529,14 @@ fn setup_path(url: &Url) -> Option<String> {
 	}
 }
 
-#[cfg(all(feature = "websocket", any(feature = "noq", feature = "quinn", feature = "quiche")))]
+#[cfg(all(feature = "websocket", feature = "noq"))]
 #[derive(Debug, PartialEq, Eq)]
 enum TransportRace<Q, W> {
 	Quic(Q),
 	WebSocket(W),
 }
 
-#[cfg(all(feature = "websocket", any(feature = "noq", feature = "quinn", feature = "quiche")))]
+#[cfg(all(feature = "websocket", feature = "noq"))]
 async fn race_transport_connect<Q, W, QT, WT>(quic: Q, websocket: W) -> crate::Result<TransportRace<QT, WT>>
 where
 	Q: Future<Output = crate::Result<QT>>,
@@ -702,25 +604,25 @@ where
 mod tests {
 	use super::*;
 
-	#[cfg(any(feature = "noq", feature = "quinn", feature = "quiche"))]
+	#[cfg(feature = "noq")]
 	#[tokio::test]
 	async fn fixed_target_preserves_request_and_refuses_redirect() {
 		check_fixed_redirect(false, true).await;
 	}
 
-	#[cfg(any(feature = "noq", feature = "quinn", feature = "quiche"))]
+	#[cfg(feature = "noq")]
 	#[tokio::test]
 	async fn one_shot_fixed_target_refuses_redirect() {
 		check_fixed_redirect(true, true).await;
 	}
 
-	#[cfg(any(feature = "noq", feature = "quinn", feature = "quiche"))]
+	#[cfg(feature = "noq")]
 	#[tokio::test]
 	async fn unused_fixed_fallback_does_not_restrict_connected_target() {
 		check_fixed_redirect(true, false).await;
 	}
 
-	#[cfg(any(feature = "noq", feature = "quinn", feature = "quiche"))]
+	#[cfg(feature = "noq")]
 	async fn check_fixed_redirect(once: bool, pinned: bool) {
 		let mut listen = crate::listen::Config {
 			bind: Some("127.0.0.1:0".parse().unwrap()),
@@ -798,8 +700,6 @@ mod tests {
 
 	#[cfg(any(
 		feature = "noq",
-		feature = "quinn",
-		feature = "quiche",
 		feature = "iroh",
 		feature = "websocket",
 		feature = "tcp",
@@ -851,8 +751,6 @@ mod tests {
 	/// only the negotiated binding says whether to send one.
 	#[cfg(any(
 		feature = "noq",
-		feature = "quinn",
-		feature = "quiche",
 		feature = "iroh",
 		feature = "websocket",
 		feature = "tcp",
@@ -1227,7 +1125,7 @@ mod tests {
 		assert_eq!(config.versions().alpns().len(), moq_net::ALPNS.len());
 	}
 
-	#[cfg(all(feature = "websocket", any(feature = "noq", feature = "quinn", feature = "quiche")))]
+	#[cfg(all(feature = "websocket", feature = "noq"))]
 	#[tokio::test]
 	async fn race_transport_connect_keeps_websocket_after_quic_auth_error() {
 		let quic = async { Err::<usize, _>(crate::ConnectError::Unauthorized.into()) };
@@ -1241,7 +1139,7 @@ mod tests {
 		assert_eq!(value, super::TransportRace::WebSocket(1));
 	}
 
-	#[cfg(all(feature = "websocket", any(feature = "noq", feature = "quinn", feature = "quiche")))]
+	#[cfg(all(feature = "websocket", feature = "noq"))]
 	#[tokio::test]
 	async fn race_transport_connect_keeps_quic_after_websocket_forbidden() {
 		let quic = async {
@@ -1254,7 +1152,7 @@ mod tests {
 		assert_eq!(value, super::TransportRace::Quic(3));
 	}
 
-	#[cfg(all(feature = "websocket", any(feature = "noq", feature = "quinn", feature = "quiche")))]
+	#[cfg(all(feature = "websocket", feature = "noq"))]
 	#[tokio::test]
 	async fn race_transport_connect_reports_auth_when_both_refuse() {
 		let quic = async { Err::<usize, _>(crate::ConnectError::Unauthorized.into()) };
@@ -1264,7 +1162,7 @@ mod tests {
 		assert!(err.is_auth(), "unexpected error: {err}");
 	}
 
-	#[cfg(all(feature = "websocket", any(feature = "noq", feature = "quinn", feature = "quiche")))]
+	#[cfg(all(feature = "websocket", feature = "noq"))]
 	#[tokio::test]
 	async fn race_transport_connect_reports_quic_error_when_websocket_forbidden() {
 		let quic = async {
@@ -1278,7 +1176,7 @@ mod tests {
 		assert!(!err.is_auth(), "mixed auth/non-auth must stay retryable: {err}");
 	}
 
-	#[cfg(all(feature = "websocket", any(feature = "noq", feature = "quinn", feature = "quiche")))]
+	#[cfg(all(feature = "websocket", feature = "noq"))]
 	#[tokio::test]
 	async fn race_transport_connect_keeps_websocket_after_quic_non_auth_error() {
 		let quic = async { Err::<usize, _>(Error::ConnectFailed) };
@@ -1288,7 +1186,7 @@ mod tests {
 		assert_eq!(value, super::TransportRace::WebSocket(7));
 	}
 
-	#[cfg(all(feature = "websocket", any(feature = "noq", feature = "quinn", feature = "quiche")))]
+	#[cfg(all(feature = "websocket", feature = "noq"))]
 	#[tokio::test]
 	async fn race_transport_connect_returns_when_quic_transport_connects() {
 		let quic = async { Ok("quic") };
@@ -1315,10 +1213,7 @@ mod tests {
 
 	/// Iroh carries no rustls state, so constructing its client must not require an
 	/// application-installed crypto provider.
-	#[cfg(all(
-		feature = "iroh",
-		not(any(feature = "noq", feature = "quinn", feature = "websocket"))
-	))]
+	#[cfg(all(feature = "iroh", not(any(feature = "noq", feature = "websocket"))))]
 	#[test]
 	fn iroh_only_client_does_not_require_a_tls_provider() {
 		crate::connect::Config::default().init().expect("iroh-only client");
diff --git a/rs/moq-tokio/src/connect.rs b/rs/moq-tokio/src/connect.rs
index 5d8020d97d..6d66b57a5b 100644
--- a/rs/moq-tokio/src/connect.rs
+++ b/rs/moq-tokio/src/connect.rs
@@ -3,8 +3,8 @@
 //! [`Addrs`] is the peer's address list, [`Config`] is how to reach it, and the
 //! accept side lives in [`crate::listen`].
 
+use crate::Backoff;
 use crate::connection::Goaway;
-use crate::{Backoff, QuicBackend};
 use std::net;
 use url::Url;
 
@@ -159,14 +159,6 @@ pub(crate) struct Legacy {
 	#[usage(name = "client-bind", long = "client-bind", env = "MOQ_CLIENT_BIND", hide = true)]
 	bind: Option<net::SocketAddr>,
 
-	#[usage(
-		name = "client-backend",
-		long = "client-backend",
-		env = "MOQ_CLIENT_BACKEND",
-		hide = true
-	)]
-	backend: Option<QuicBackend>,
-
 	#[usage(
 		name = "client-connect-timeout",
 		long = "client-connect-timeout",
@@ -245,13 +237,6 @@ impl Legacy {
 				"--connect-bind / MOQ_CONNECT_BIND",
 			);
 		}
-		if self.backend.is_some() {
-			found.flag(
-				"--client-backend",
-				Some("MOQ_CLIENT_BACKEND"),
-				"--connect-backend / MOQ_CONNECT_BACKEND",
-			);
-		}
 		if self.timeout.is_some() {
 			found.flag(
 				"--client-connect-timeout",
@@ -354,7 +339,7 @@ pub enum ConnectError {
 impl ConnectError {
 	/// Only the transports that carry an HTTP status (WebTransport, WebSocket) can
 	/// classify one; qmux over tcp/unix has no such response.
-	#[cfg(any(feature = "noq", feature = "quinn", feature = "quiche", feature = "websocket"))]
+	#[cfg(any(feature = "noq", feature = "websocket"))]
 	pub(crate) fn from_status_u16(status: u16) -> Option<Self> {
 		match status {
 			401 => Some(Self::Unauthorized),
@@ -370,10 +355,7 @@ impl ConnectError {
 	}
 }
 
-#[cfg(all(
-	test,
-	any(feature = "noq", feature = "quinn", feature = "quiche", feature = "websocket")
-))]
+#[cfg(all(test, any(feature = "noq", feature = "websocket")))]
 mod tests {
 	use super::*;
 
@@ -518,16 +500,6 @@ pub struct Config {
 	)]
 	pub bind: Option<net::SocketAddr>,
 
-	/// The QUIC backend to use.
-	/// Auto-detected from compiled features if not specified.
-	#[usage(
-		name = "connect-backend",
-		long = "connect-backend",
-		env = "MOQ_CONNECT_BACKEND",
-		setting = "connect.backend"
-	)]
-	pub backend: Option<QuicBackend>,
-
 	/// Delay before also dialing the next resolved address (Happy Eyeballs).
 	///
 	/// When DNS returns multiple addresses, attempts alternate between IPv6 and
@@ -703,7 +675,6 @@ impl Default for Config {
 			url: None,
 			connect: None,
 			bind: None,
-			backend: None,
 			race: DEFAULT_RACE,
 			race_arg: None,
 			failover_delay: None,
diff --git a/rs/moq-tokio/src/error.rs b/rs/moq-tokio/src/error.rs
index 756aee9587..209306d96a 100644
--- a/rs/moq-tokio/src/error.rs
+++ b/rs/moq-tokio/src/error.rs
@@ -200,21 +200,11 @@ pub enum Error {
 	#[error(transparent)]
 	Tls(Arc<crate::tls::Error>),
 
-	/// The Quinn backend failed.
-	#[cfg(feature = "quinn")]
-	#[error(transparent)]
-	Quinn(Arc<crate::quinn::Error>),
-
 	/// The noq backend failed.
 	#[cfg(feature = "noq")]
 	#[error(transparent)]
 	Noq(Arc<crate::noq::Error>),
 
-	/// The quiche backend failed.
-	#[cfg(feature = "quiche")]
-	#[error(transparent)]
-	Quiche(Arc<crate::quiche::Error>),
-
 	/// The Iroh backend failed.
 	#[cfg(feature = "iroh")]
 	#[error(transparent)]
@@ -244,12 +234,8 @@ impl Error {
 			Self::MoqNet(
 				moq_net::Error::Unauthorized | moq_net::Error::Session(moq_net::SessionError::Unauthorized),
 			) => Some(crate::ConnectError::Unauthorized),
-			#[cfg(feature = "quinn")]
-			Self::Quinn(err) => err.connect_error(),
 			#[cfg(feature = "noq")]
 			Self::Noq(err) => err.connect_error(),
-			#[cfg(feature = "quiche")]
-			Self::Quiche(err) => err.connect_error(),
 			#[cfg(feature = "websocket")]
 			Self::TransportRace { quic, websocket } => quic.connect_error().or_else(|| websocket.connect_error()),
 			#[cfg(feature = "websocket")]
@@ -282,12 +268,8 @@ impl Error {
 				_ => None,
 			},
 
-			#[cfg(feature = "quinn")]
-			Self::Quinn(err) => err.status(),
 			#[cfg(feature = "noq")]
 			Self::Noq(err) => err.status(),
-			#[cfg(feature = "quiche")]
-			Self::Quiche(err) => err.status(),
 			#[cfg(feature = "websocket")]
 			Self::WebSocket(err) => err.status(),
 			_ => None,
@@ -316,17 +298,6 @@ impl From<crate::tls::Error> for Error {
 	}
 }
 
-#[cfg(feature = "quinn")]
-impl From<crate::quinn::Error> for Error {
-	fn from(err: crate::quinn::Error) -> Self {
-		if let Some(err) = err.connect_error() {
-			return Self::Connect(err);
-		}
-
-		Self::Quinn(Arc::new(err))
-	}
-}
-
 #[cfg(feature = "noq")]
 impl From<crate::noq::Error> for Error {
 	fn from(err: crate::noq::Error) -> Self {
@@ -338,17 +309,6 @@ impl From<crate::noq::Error> for Error {
 	}
 }
 
-#[cfg(feature = "quiche")]
-impl From<crate::quiche::Error> for Error {
-	fn from(err: crate::quiche::Error) -> Self {
-		if let Some(err) = err.connect_error() {
-			return Self::Connect(err);
-		}
-
-		Self::Quiche(Arc::new(err))
-	}
-}
-
 #[cfg(feature = "iroh")]
 impl From<crate::iroh::Error> for Error {
 	fn from(err: crate::iroh::Error) -> Self {
diff --git a/rs/moq-tokio/src/iroh.rs b/rs/moq-tokio/src/iroh.rs
index fcbbd32014..7573821674 100644
--- a/rs/moq-tokio/src/iroh.rs
+++ b/rs/moq-tokio/src/iroh.rs
@@ -9,7 +9,7 @@ use std::{net, path::PathBuf, str::FromStr, sync::Arc};
 use crate::quic::CongestionControl;
 use url::Url;
 use web_transport_iroh::iroh::{self, SecretKey};
-// NOTE: web-transport-iroh should re-export proto like web-transport-quinn does.
+// NOTE: web-transport-iroh should re-export proto like web-transport-noq does.
 use web_transport_proto::{ConnectRequest, ConnectResponse};
 
 pub use iroh::Endpoint;
@@ -108,7 +108,7 @@ pub enum Error {
 	RecvRequest(String),
 
 	/// GSO is always on for iroh, so `--quic-gso=false` cannot be honored.
-	#[error("the iroh backend cannot disable GSO; drop --quic-gso=false or use the quinn backend")]
+	#[error("the iroh backend cannot disable GSO; drop --quic-gso=false or use the noq backend")]
 	GsoUnsupported,
 }
 
diff --git a/rs/moq-tokio/src/lib.rs b/rs/moq-tokio/src/lib.rs
index c22dea7175..3fd5cd762c 100644
--- a/rs/moq-tokio/src/lib.rs
+++ b/rs/moq-tokio/src/lib.rs
@@ -11,7 +11,7 @@
 //! See [`Client`] for connecting to relays and [`Server`] for accepting
 //! connections. The `mdns` feature finds peers to connect to on the local network.
 //!
-//! With `default-features = false`, the `quinn` and `noq` backends must be paired
+//! With `default-features = false`, the `noq` backend must be paired
 //! with the `aws-lc-rs` or `ring` crypto-provider feature. Every other subset
 //! compiles, including no transport at all: such a build cannot connect to
 //! anything, though a crypto provider on its own is still enough to configure TLS
@@ -22,10 +22,7 @@
 
 // The protocol crates need a compiled provider for reset and retry-token keys. A rustls provider
 // installed at runtime cannot supply constructors removed by their compile-time feature gates.
-#[cfg(all(
-	any(feature = "quinn", feature = "noq"),
-	not(any(feature = "aws-lc-rs", feature = "ring"))
-))]
+#[cfg(all(feature = "noq", not(any(feature = "aws-lc-rs", feature = "ring"))))]
 compile_error!("a rustls QUIC backend requires a crypto provider: enable either the `aws-lc-rs` or `ring` feature");
 
 mod abort;
@@ -37,13 +34,7 @@ pub mod connect;
 pub mod connection;
 pub mod crypto;
 mod error;
-#[cfg(any(
-	feature = "quinn",
-	feature = "noq",
-	feature = "quiche",
-	feature = "tcp",
-	feature = "websocket"
-))]
+#[cfg(any(feature = "noq", feature = "tcp", feature = "websocket"))]
 pub mod failover;
 #[cfg(feature = "jemalloc")]
 pub mod jemalloc;
@@ -53,15 +44,7 @@ mod log;
 pub mod noq;
 pub mod origin;
 pub mod quic;
-#[cfg(feature = "quinn")]
-pub mod quinn;
-#[cfg(any(
-	feature = "quinn",
-	feature = "noq",
-	feature = "quiche",
-	feature = "tcp",
-	feature = "websocket"
-))]
+#[cfg(any(feature = "noq", feature = "tcp", feature = "websocket"))]
 mod resolve;
 pub mod runtime;
 #[cfg(feature = "_transport")]
@@ -77,7 +60,7 @@ pub mod unix;
 pub mod worker;
 // Resolving a `host:port` bind string is a QUIC-listener concern; the stream
 // listeners take a `SocketAddr`/path straight from their config.
-#[cfg(any(feature = "noq", feature = "quinn", feature = "quiche"))]
+#[cfg(feature = "noq")]
 mod util;
 #[cfg(feature = "watch")]
 pub mod watch;
@@ -108,92 +91,12 @@ pub use notify;
 #[cfg(target_os = "android")]
 pub use jni;
 
-#[cfg(feature = "quiche")]
-pub mod quiche;
-
 #[cfg(feature = "iroh")]
 pub mod iroh;
 
 #[cfg(feature = "mdns")]
 pub mod mdns;
 
-/// The QUIC backend to use for connections.
-#[derive(Clone, Debug, serde::Serialize, serde::Deserialize)]
-#[cfg_attr(
-	any(feature = "quinn", feature = "quiche", feature = "noq"),
-	derive(usage::ValueEnum)
-)]
-#[cfg_attr(any(feature = "quinn", feature = "quiche", feature = "noq"), usage(ignore_case))]
-#[serde(rename_all = "lowercase")]
-#[non_exhaustive]
-pub enum QuicBackend {
-	/// [web-transport-quinn](https://crates.io/crates/web-transport-quinn)
-	#[cfg(feature = "quinn")]
-	Quinn,
-
-	/// [web-transport-quiche](https://crates.io/crates/web-transport-quiche)
-	#[cfg(feature = "quiche")]
-	Quiche,
-
-	/// [web-transport-noq](https://crates.io/crates/web-transport-noq)
-	#[cfg(feature = "noq")]
-	Noq,
-}
-
-#[cfg(not(any(feature = "quinn", feature = "quiche", feature = "noq")))]
-impl usage::argv::spec::ValueEnum for QuicBackend {
-	const CHOICES: &'static [&'static str] = &[];
-
-	fn from_choice(_value: &str) -> Option<Self> {
-		None
-	}
-}
-
-/// Parses the same spellings the CLI and TOML accept (`quinn`, `quiche`, `noq`),
-/// case-insensitively. A backend this build was compiled without is an error, since
-/// its variant doesn't exist.
-impl std::str::FromStr for QuicBackend {
-	type Err = String;
-
-	fn from_str(s: &str) -> std::result::Result<Self, Self::Err> {
-		<Self as usage::argv::spec::ValueEnum>::from_choice(s).ok_or_else(|| format!("unknown QUIC backend: {s}"))
-	}
-}
-
-impl QuicBackend {
-	/// Every backend this build was compiled with, spelled the way [`FromStr`] accepts.
-	///
-	/// The variants are feature-gated, so this is the only honest answer to "what can I
-	/// pass here". A caller building a menu should read it rather than listing the three
-	/// names, which would offer options that cannot parse.
-	///
-	/// [`FromStr`]: std::str::FromStr
-	pub fn compiled() -> &'static [Self] {
-		&[
-			#[cfg(feature = "quinn")]
-			Self::Quinn,
-			#[cfg(feature = "quiche")]
-			Self::Quiche,
-			#[cfg(feature = "noq")]
-			Self::Noq,
-		]
-	}
-
-	/// The name [`FromStr`] accepts for this backend.
-	///
-	/// [`FromStr`]: std::str::FromStr
-	pub fn as_str(&self) -> &'static str {
-		match *self {
-			#[cfg(feature = "quinn")]
-			Self::Quinn => "quinn",
-			#[cfg(feature = "quiche")]
-			Self::Quiche => "quiche",
-			#[cfg(feature = "noq")]
-			Self::Noq => "noq",
-		}
-	}
-}
-
 /// Whether this build can capture qlog traces, which the `qlog` feature gates.
 ///
 /// Setting a qlog directory without it is an error at dial time, so a caller offering
@@ -201,32 +104,3 @@ impl QuicBackend {
 pub fn qlog_supported() -> bool {
 	cfg!(feature = "qlog")
 }
-
-/// The backend a config without an explicit `--*-backend` gets.
-///
-/// Only compiled when there is one to pick: a build with no QUIC backend never
-/// reaches for a default, since `QuicBackend` has no variants there.
-#[cfg(any(feature = "noq", feature = "quinn", feature = "quiche"))]
-fn default_quic_backend() -> QuicBackend {
-	#[cfg(feature = "noq")]
-	{
-		QuicBackend::Noq
-	}
-	#[cfg(all(feature = "quinn", not(feature = "noq")))]
-	{
-		QuicBackend::Quinn
-	}
-	#[cfg(all(feature = "quiche", not(feature = "noq"), not(feature = "quinn")))]
-	{
-		QuicBackend::Quiche
-	}
-}
-
-#[cfg(test)]
-mod tests {
-	#[cfg(feature = "noq")]
-	#[test]
-	fn noq_is_the_default_backend() {
-		assert!(matches!(super::default_quic_backend(), super::QuicBackend::Noq));
-	}
-}
diff --git a/rs/moq-tokio/src/listen.rs b/rs/moq-tokio/src/listen.rs
index 003f0ac1d2..73ca1a0afb 100644
--- a/rs/moq-tokio/src/listen.rs
+++ b/rs/moq-tokio/src/listen.rs
@@ -3,8 +3,6 @@
 //! [`Config`] describes the listeners (QUIC, plus optional `tcp`/`unix` qmux)
 //! and the served TLS identity. The dial side lives in [`crate::connect`].
 
-use crate::QuicBackend;
-
 /// A QUIC listen address.
 #[derive(Clone, Debug, Eq, PartialEq)]
 #[non_exhaustive]
@@ -16,7 +14,7 @@ pub enum Bind {
 }
 
 impl Bind {
-	#[cfg(any(feature = "noq", feature = "quinn", feature = "quiche"))]
+	#[cfg(feature = "noq")]
 	pub(crate) fn resolve(&self) -> std::io::Result<std::net::SocketAddr> {
 		match self {
 			Self::Addr(addr) => Ok(*addr),
@@ -88,7 +86,7 @@ pub struct Config {
 	/// Listen for QUIC (UDP) on the given address. Defaults to `[::]:443`.
 	///
 	/// Text configuration accepts socket addresses and `host:port` names. Hostnames
-	/// are resolved when the listener binds. Leave unset while a
+	/// are resolved when the listener binds (first address only). Leave unset while a
 	/// `tcp`/`unix` listener is configured to run a stream-only server with no
 	/// QUIC.
 	#[usage(name = "listen", long = "listen", env = "MOQ_LISTEN", setting = "listen.bind")]
@@ -113,16 +111,6 @@ pub struct Config {
 	#[serde(default)]
 	pub unix: crate::unix::Config,
 
-	/// The QUIC backend to use.
-	/// Auto-detected from compiled features if not specified.
-	#[usage(
-		name = "listen-backend",
-		long = "listen-backend",
-		env = "MOQ_LISTEN_BACKEND",
-		setting = "listen.backend"
-	)]
-	pub backend: Option<QuicBackend>,
-
 	/// Restrict the server to specific MoQ protocol version(s).
 	///
 	/// By default, the server accepts all supported versions.
@@ -161,11 +149,11 @@ pub struct Config {
 
 	/// IPv4 address advertised as the QUIC preferred_address.
 	///
-	/// Supporting clients (Chrome M131+, native Quinn) migrate to this address
+	/// Supporting clients (Chrome M131+, native noq) migrate to this address
 	/// shortly after the handshake completes. Typical use: handshake on an
 	/// anycast IP, steady-state on this host's unicast IP.
 	///
-	/// Honored by the Quinn and noq backends. Accept-only, which is why it lives
+	/// Honored by noq. Accept-only, which is why it lives
 	/// here rather than in the shared [`crate::quic::Config`].
 	#[usage(
 		name = "listen-preferred-v4",
@@ -240,7 +228,7 @@ pub struct Config {
 /// outside one.
 #[cfg(feature = "_transport")]
 pub(crate) use moq_sock::shard::Member;
-#[cfg(any(feature = "noq", feature = "quinn"))]
+#[cfg(feature = "noq")]
 pub(crate) use moq_sock::shard::Shard;
 
 /// The `--server-*` flags from before the accept side was named `listen`.
@@ -254,14 +242,6 @@ pub(crate) struct Legacy {
 	#[usage(name = "server-bind", long = "server-bind", env = "MOQ_SERVER_BIND", hide = true)]
 	bind: Option<String>,
 
-	#[usage(
-		name = "server-backend",
-		long = "server-backend",
-		env = "MOQ_SERVER_BACKEND",
-		hide = true
-	)]
-	backend: Option<QuicBackend>,
-
 	#[usage(
 		name = "server-version",
 		long = "server-version",
@@ -326,13 +306,6 @@ impl Legacy {
 		if self.bind.is_some() {
 			found.flag("--server-bind", Some("MOQ_SERVER_BIND"), "--listen / MOQ_LISTEN");
 		}
-		if self.backend.is_some() {
-			found.flag(
-				"--server-backend",
-				Some("MOQ_SERVER_BACKEND"),
-				"--listen-backend / MOQ_LISTEN_BACKEND",
-			);
-		}
 		if !self.version.is_empty() {
 			found.flag(
 				"--server-version",
@@ -401,7 +374,7 @@ impl Config {
 		Ok(())
 	}
 
-	#[cfg(any(feature = "noq", feature = "quinn", feature = "quiche"))]
+	#[cfg(feature = "noq")]
 	pub(crate) fn load_balancer(&self) -> Option<crate::quic::LoadBalancer> {
 		self.lb_id
 			.clone()
@@ -524,7 +497,7 @@ mod tests {
 		assert!("relay.example.com:443:8443".parse::<Bind>().is_err());
 	}
 
-	#[cfg(any(feature = "noq", feature = "quinn", feature = "quiche"))]
+	#[cfg(feature = "noq")]
 	#[test]
 	fn cli_load_balancer_survives_the_merge_round_trip() {
 		let config = config_from(["test", "--listen-quic-lb-id", "ab", "--listen-quic-lb-nonce", "9"]);
@@ -540,7 +513,7 @@ mod tests {
 	}
 
 	/// Programmatic configuration keeps the QUIC-LB id and nonce paired.
-	#[cfg(any(feature = "noq", feature = "quinn", feature = "quiche"))]
+	#[cfg(feature = "noq")]
 	#[test]
 	fn load_balancer_is_a_single_typed_value() {
 		let config: Config = toml::from_str(
diff --git a/rs/moq-tokio/src/log.rs b/rs/moq-tokio/src/log.rs
index b3de382b8a..2e47016ade 100644
--- a/rs/moq-tokio/src/log.rs
+++ b/rs/moq-tokio/src/log.rs
@@ -54,7 +54,6 @@ impl Log {
 			.with_default_directive(self.level().into()) // Default to our -q/-v args
 			.from_env_lossy() // Allow overriding with RUST_LOG
 			.add_directive("h2=warn".parse()?)
-			.add_directive("quinn=info".parse()?)
 			.add_directive("noq=info".parse()?)
 			.add_directive("tungstenite=info".parse()?)
 			.add_directive("rustls=info".parse()?)
diff --git a/rs/moq-tokio/src/quic.rs b/rs/moq-tokio/src/quic.rs
index 41fc94eb00..da53d5c0c9 100644
--- a/rs/moq-tokio/src/quic.rs
+++ b/rs/moq-tokio/src/quic.rs
@@ -55,9 +55,7 @@ pub struct LoadBalancer {
 
 /// The congestion control family for a QUIC connection.
 ///
-/// This selects a family rather than a named algorithm because each backend ships a
-/// different generation: BBRv1 on quinn, BBRv2 on quiche, BBRv3 on noq and iroh. A
-/// `Bbr` variant would promise more than any one backend delivers.
+/// Noq uses CUBIC for loss-based control and BBRv3 for delay-based control.
 #[derive(Clone, Copy, Debug, PartialEq, Eq, usage::ValueEnum, serde::Serialize, serde::Deserialize)]
 #[usage(ignore_case)]
 #[serde(rename_all = "kebab-case")]
@@ -170,8 +168,7 @@ pub struct Config {
 	)]
 	pub mtu_discovery: Option<bool>,
 
-	/// Congestion control family. Defaults to `delay` on quinn and quiche, and to
-	/// `loss` on noq and iroh. Selecting `delay` there uses BBRv3.
+	/// Congestion control family. Defaults to `delay`, which uses BBRv3.
 	#[serde(skip_serializing_if = "Option::is_none")]
 	#[usage(
 		name = "quic-congestion-control",
@@ -213,8 +210,7 @@ pub struct Config {
 	/// Cap on unacknowledged outgoing data, in bytes, regardless of what the peer
 	/// allows. Unset leaves the backend default.
 	///
-	/// This bounds the transport send buffer. The quiche backend has no local send
-	/// cap and refuses this rather than dropping it.
+	/// This bounds the transport send buffer.
 	#[serde(skip_serializing_if = "Option::is_none")]
 	#[usage(
 		name = "quic-send-window",
@@ -226,9 +222,7 @@ pub struct Config {
 
 	/// Write qlog traces into this directory, which must already exist.
 	///
-	/// The layout is backend-specific: quiche and noq write one file per connection,
-	/// while quinn writes one file per endpoint and tags each event with the qlog
-	/// `group_id` of the connection it belongs to.
+	/// Noq writes one file per connection.
 	///
 	/// Requires the `qlog` feature; setting it errors at init otherwise.
 	#[serde(default, skip_serializing_if = "Option::is_none")]
@@ -600,8 +594,7 @@ pub struct Resolved {
 	pub keep_alive: Option<Duration>,
 	/// Whether to run path MTU discovery.
 	pub mtu_discovery: bool,
-	/// Congestion control override, or `None` for the backend's own default. Each
-	/// backend picks that default itself, since they don't all agree.
+	/// Congestion control override, or `None` for the default.
 	pub congestion_control: Option<CongestionControl>,
 	/// Connection-wide receive window in bytes, or `None` for the backend default.
 	pub receive_window: Option<u64>,
@@ -618,12 +611,8 @@ impl Resolved {
 	///
 	/// Delay-based unless the operator says otherwise: BBR keeps queues short and the
 	/// send rate steady enough for a live encoder to track, which is what this stack
-	/// carries. Every backend resolves the default here rather than each picking its
-	/// own, so the answer can't drift between them.
-	#[cfg_attr(
-		not(any(feature = "quinn", feature = "noq", feature = "quiche", feature = "iroh")),
-		allow(dead_code)
-	)]
+	/// carries.
+	#[cfg_attr(not(any(feature = "noq", feature = "iroh")), allow(dead_code))]
 	pub(crate) fn congestion(&self) -> CongestionControl {
 		self.congestion_control.unwrap_or(CongestionControl::Delay)
 	}
@@ -632,7 +621,7 @@ impl Resolved {
 	///
 	/// Only meaningful once [`Config::validate`] has passed; a build without the
 	/// `qlog` feature never gets here with a directory set.
-	#[cfg_attr(not(any(feature = "quinn", feature = "noq", feature = "quiche")), allow(dead_code))]
+	#[cfg_attr(not(feature = "noq"), allow(dead_code))]
 	pub(crate) fn qlog_dir(&self) -> Option<&std::path::Path> {
 		self.qlog.as_deref()
 	}
diff --git a/rs/moq-tokio/src/quiche.rs b/rs/moq-tokio/src/quiche.rs
deleted file mode 100644
index e9edecd84d..0000000000
--- a/rs/moq-tokio/src/quiche.rs
+++ /dev/null
@@ -1,939 +0,0 @@
-//! QUIC backend built on [`web_transport_quiche`], speaking WebTransport over HTTP/3
-//! (`https://`) or raw QUIC (`moqt://` / `moql://`).
-
-use crate::RedactedUrl;
-use crate::crypto;
-use crate::listen;
-use crate::quic::CongestionControl;
-use crate::quic::Resolved;
-use crate::tls::{Certified, ServeCerts};
-use rustls::pki_types::pem::PemObject;
-use rustls::pki_types::{CertificateDer, PrivateKeyDer};
-use std::net;
-use std::path::Path;
-use std::sync::Arc;
-use url::Url;
-
-/// Re-exported because this module's public API exposes its types. A major
-/// `web-transport-quiche` bump is therefore a breaking change for this crate.
-pub use web_transport_quiche;
-
-/// Errors specific to the quiche QUIC backend.
-#[derive(Debug, thiserror::Error)]
-#[non_exhaustive]
-pub enum Error {
-	/// The UDP socket failed to bind, or another I/O operation failed.
-	#[error(transparent)]
-	Io(#[from] std::io::Error),
-
-	/// The URL had no host to dial and use as the TLS SNI.
-	#[error("invalid DNS name")]
-	InvalidDnsName,
-
-	/// DNS lookup failed for the URL's host.
-	#[error("DNS lookup failed")]
-	DnsLookup(#[source] std::io::Error),
-
-	/// DNS lookup succeeded but returned no usable address.
-	#[error("no DNS entries found")]
-	NoDnsEntries,
-
-	/// The `http://` fingerprint bootstrap could not reach the relay.
-	#[error("failed to fetch certificate fingerprint: {0}")]
-	FetchFingerprint(String),
-
-	/// The relay answered the fingerprint bootstrap with a non-success status.
-	#[error("certificate fingerprint request failed with status {0}")]
-	FingerprintStatus(u16),
-
-	/// The fingerprint response body could not be read.
-	#[error("failed to read certificate fingerprint: {0}")]
-	ReadFingerprint(String),
-
-	/// The fetched fingerprint was not valid hex.
-	#[error("invalid certificate fingerprint: {0}")]
-	InvalidFingerprint(String),
-
-	/// The fetched fingerprint decoded to the wrong length, so it isn't a SHA-256.
-	#[error("certificate fingerprint must be 32 bytes (SHA-256), got {0}")]
-	FingerprintLength(usize),
-
-	/// The URL scheme is one this backend cannot dial.
-	#[error("url scheme must be 'https', 'moqt', or 'moql'")]
-	InvalidScheme,
-
-	/// quiche has no local cap on unacknowledged send data, so `quic.send_window`
-	/// cannot be honored.
-	#[error("the quiche backend cannot cap the send window; drop --quic-send-window or use the quinn backend")]
-	SendWindowUnsupported,
-
-	/// The handshake completed without negotiating an ALPN, so there is no protocol to speak.
-	#[error("missing ALPN")]
-	MissingAlpn,
-
-	/// The negotiated ALPN was not valid UTF-8.
-	#[error("failed to decode ALPN")]
-	DecodeAlpn(#[from] std::str::Utf8Error),
-
-	/// The peer negotiated an ALPN this server does not serve.
-	#[error("unsupported ALPN: {0}")]
-	UnsupportedAlpn(String),
-
-	/// The server's configured bind address could not be resolved.
-	#[error("failed to resolve bind address")]
-	ResolveBind(#[source] std::io::Error),
-
-	/// The server is not bound to any address, so there is no local address to report.
-	#[error("failed to get local address")]
-	NoLocalAddr,
-
-	/// This backend cannot encode the owning worker in its connection IDs, so a
-	/// reuseport group built on it would have no way to steer packets back.
-	#[error("the quiche backend cannot serve per-core workers; use the quinn backend")]
-	ShardUnsupported,
-
-	/// The QUIC connection could not be started, usually a bad address or an unusable socket.
-	#[error("failed to connect to quiche server")]
-	Connect(#[source] std::io::Error),
-
-	/// An established connection failed, including when accepting an incoming one.
-	#[error("{0}")]
-	Connection(String),
-
-	/// The QUIC handshake failed, most often TLS verification or a timeout.
-	#[error("failed to establish quiche connection: {0}")]
-	Establish(String),
-
-	/// The WebTransport CONNECT failed over an otherwise healthy QUIC connection.
-	#[error("failed to connect to quiche server: {message}")]
-	ClientConnect {
-		/// What the handshake reported.
-		message: String,
-		/// The HTTP status the server answered the CONNECT with, when it answered with one.
-		///
-		/// Read at conversion time rather than kept as a `web-transport-quiche` error, so the
-		/// classification survives without that crate appearing in this crate's public API.
-		status: Option<u16>,
-	},
-
-	/// The server refused the WebTransport CONNECT with a recognized status, such as
-	/// an auth failure. See [`crate::ConnectError`].
-	#[error(transparent)]
-	ConnectRejected(#[from] crate::ConnectError),
-
-	/// The server could not bind its socket or load the supplied certificate.
-	#[error("failed to create quiche server")]
-	ServerBuild(#[source] std::io::Error),
-
-	/// The client never sent a usable WebTransport CONNECT request.
-	#[error("failed to accept WebTransport request: {0}")]
-	AcceptRequest(String),
-
-	/// The `200 OK` response to a WebTransport CONNECT could not be sent.
-	#[error("failed to accept quiche WebTransport: {0}")]
-	Accept(String),
-
-	/// The rejection response to a WebTransport CONNECT could not be sent.
-	#[error("failed to close quiche WebTransport request: {0}")]
-	Reject(String),
-
-	/// The TLS configuration was invalid. See [`crate::tls::Error`].
-	#[error(transparent)]
-	Tls(#[from] crate::tls::Error),
-
-	/// Two or more addresses were raced and every attempt failed, each paired
-	/// with its own error in dial order. All of them are kept: picking one to
-	/// report would bury a rejected certificate or a refused port behind
-	/// whichever address happened to be unroutable or to blackhole until its
-	/// timeout. A host with a single address reports that error directly instead.
-	#[error("all {} connection attempts failed: {}", .0.len(), crate::failover::describe(.0))]
-	Failover(Vec<crate::failover::Attempt<Error>>),
-}
-
-impl crate::failover::Aggregate for Error {
-	fn aggregate(failures: Vec<crate::failover::Attempt<Self>>) -> Self {
-		Self::Failover(failures)
-	}
-
-	fn resolve(error: Option<std::io::Error>) -> Self {
-		match error {
-			Some(error) => Self::DnsLookup(error),
-			None => Self::NoDnsEntries,
-		}
-	}
-}
-
-crate::error::from_message! {
-	web_transport_quiche::ez::ConnectionError => Connection,
-}
-
-impl From<web_transport_quiche::ClientError> for Error {
-	fn from(err: web_transport_quiche::ClientError) -> Self {
-		Self::ClientConnect {
-			status: client_status(&err),
-			message: crate::error::message(err),
-		}
-	}
-}
-
-type Result<T> = std::result::Result<T, Error>;
-
-/// Apply the resolved QUIC settings that live in quiche's transport configuration.
-///
-/// Keep-alive and GSO are socket-driver settings, so they are applied to the
-/// client/server builders instead.
-fn apply_settings(settings: &mut web_transport_quiche::Settings, quic: &Resolved) -> Result<()> {
-	refuse_unsupported(quic)?;
-
-	settings.initial_max_streams_bidi = quic.max_streams;
-	settings.initial_max_streams_uni = quic.max_streams;
-	settings.max_idle_timeout = Some(quic.idle_timeout);
-	settings.discover_path_mtu = quic.mtu_discovery;
-
-	// quiche autotunes each window from its initial value up to a maximum and clamps
-	// it there, so raising only the initial value would be silently capped at
-	// quiche's own 24MB/16MB ceilings. Pinning both makes the window exactly what was
-	// asked for, which is what the other backends give.
-	if let Some(window) = quic.receive_window {
-		settings.initial_max_data = window;
-		settings.max_connection_window = window;
-	}
-	if let Some(window) = quic.stream_receive_window {
-		settings.initial_max_stream_data_bidi_local = window;
-		settings.initial_max_stream_data_bidi_remote = window;
-		settings.initial_max_stream_data_uni = window;
-		settings.max_stream_window = window;
-	}
-
-	settings.cc_algorithm = cc_algorithm(quic.congestion()).to_owned();
-
-	// quiche writes one file per connection itself, named after the connection ID.
-	if let Some(dir) = quic.qlog_dir() {
-		settings.qlog_dir = Some(dir.to_string_lossy().into_owned());
-		tracing::info!(dir = %dir.display(), "writing qlog");
-	}
-
-	Ok(())
-}
-
-/// Reject the knobs quiche has no setting for, rather than dropping them.
-///
-/// [`apply_settings`] calls this so no path can bypass it, and the client calls it
-/// when the endpoint is built: its settings are assembled per dial, which would
-/// otherwise put the error on the first connection instead of at startup.
-fn refuse_unsupported(quic: &Resolved) -> Result<()> {
-	// quiche sends as fast as the peer's flow control and congestion control allow,
-	// with no local ceiling to set.
-	match quic.send_window {
-		Some(_) => Err(Error::SendWindowUnsupported),
-		None => Ok(()),
-	}
-}
-
-/// The quiche controller name for a congestion control family. quiche's BBR is the
-/// v2 gcongestion port, and it takes the algorithm by name rather than by type.
-fn cc_algorithm(family: CongestionControl) -> &'static str {
-	match family {
-		CongestionControl::Loss => "cubic",
-		CongestionControl::Delay => "bbr2_gcongestion",
-	}
-}
-
-// ── Client ──────────────────────────────────────────────────────────
-
-#[derive(Clone)]
-pub(crate) struct QuicheClient {
-	pub bind: net::SocketAddr,
-	/// Resolved server-verification policy, shared with the other backends.
-	pub verification: crate::tls::Verification,
-	/// Whether an `http://` URL may bootstrap a pin (see [crate::tls::Connect::allows_http_bootstrap]).
-	pub http_bootstrap: bool,
-	pub quic: Resolved,
-	pub host_name: Option<String>,
-	/// Stagger between Happy Eyeballs connection attempts (see [`crate::failover`]).
-	pub failover_delay: std::time::Duration,
-	/// How long the first candidate waits for the full DNS answer, RFC 8305's
-	/// Resolution Delay (see [`crate::connect::Config::resolution_delay`]).
-	pub resolution_delay: std::time::Duration,
-	/// The mTLS client certificate to present, from files or an in-memory identity.
-	identity: Option<Arc<Certified>>,
-}
-
-impl QuicheClient {
-	pub fn new(config: &crate::connect::Config, quic: &crate::quic::Config) -> Result<Self> {
-		let quic = quic.resolve();
-		refuse_unsupported(&quic)?;
-
-		#[cfg(any(feature = "aws-lc-rs", feature = "ring"))]
-		let in_memory = config.tls.identity.as_ref().map(crate::tls::Identity::certified);
-		#[cfg(not(any(feature = "aws-lc-rs", feature = "ring")))]
-		let in_memory: Option<Arc<Certified>> = None;
-
-		let identity = match (in_memory, &config.tls.cert, &config.tls.key) {
-			(Some(_), Some(_), _) | (Some(_), _, Some(_)) => {
-				return Err(crate::tls::Error::ConflictingClientAuth.into());
-			}
-			(Some(identity), None, None) => Some(identity),
-			(None, Some(cert), Some(key)) => Some(Arc::new(load_certified(cert, key)?)),
-			(None, None, None) => None,
-			(None, _, _) => return Err(crate::tls::Error::IncompleteClientAuth.into()),
-		};
-
-		// Warn once here rather than on every dial: the constraint is a property of
-		// the config, and a relay reconnecting to its peers would repeat it forever.
-		let resolved = config.resolve();
-		let bind = resolved.bind;
-		if bind.port() != 0 {
-			tracing::warn!(
-				bind = %bind,
-				"pinned client bind port; only the first resolved address is dialed (address failover needs an ephemeral port on this backend)"
-			);
-		}
-
-		Ok(Self {
-			bind,
-			verification: config.tls.verification()?,
-			http_bootstrap: config.tls.allows_http_bootstrap(),
-			quic,
-			host_name: config.tls.host_name.clone(),
-			failover_delay: resolved.race,
-			resolution_delay: resolved.resolution_delay,
-			identity,
-		})
-	}
-
-	pub async fn connect(
-		&self,
-		addr: crate::connect::Addr,
-		versions: &moq_net::Versions,
-	) -> Result<web_transport_quiche::Connection> {
-		use crate::tls::Verification;
-
-		let url = addr.url().clone();
-		let host = url.host().ok_or(Error::InvalidDnsName)?.to_string();
-		let port = url.port().unwrap_or(443);
-
-		// `http://` fetches the relay's self-signed certificate fingerprint over
-		// an insecure request and pins it for this connection. It is only honored
-		// when no stronger verification is configured: an attacker who controls
-		// the plaintext fetch must not be able to weaken an explicit pin or
-		// re-enable verification we were told to skip.
-		let (url, verification) = if url.scheme() == "http" {
-			let mut https = url.clone();
-			https.set_scheme("https").expect("https is a valid scheme");
-
-			if self.http_bootstrap {
-				let pin = fetch_fingerprint(&url).await?;
-				(https, Verification::Fingerprints(vec![pin]))
-			} else {
-				tracing::warn!(
-					"ignoring insecure http:// fingerprint bootstrap; using the configured TLS verification"
-				);
-				(https, self.verification.clone())
-			}
-		} else {
-			(url, self.verification.clone())
-		};
-
-		let alpns: Vec<Vec<u8>> = match url.scheme() {
-			"https" => vec![web_transport_quiche::ALPN.as_bytes().to_vec()],
-			"moqt" | "moql" => versions.alpns().iter().map(|alpn| alpn.as_bytes().to_vec()).collect(),
-			_ => return Err(Error::InvalidScheme),
-		};
-
-		// Resolve the trust anchors once: loading the native root store can hit the
-		// disk, which shouldn't repeat for every raced address.
-		//
-		// quiche/boringssl takes a concrete root list rather than a rustls
-		// verifier, so the platform verifier the other backends use isn't
-		// available here. Trust the native store for system roots; on
-		// platforms without one (iOS/Android) this yields nothing and the
-		// handshake fails closed.
-		let roots = match &verification {
-			Verification::Roots { custom, system } => {
-				// Quiche takes concrete trust anchors per connection rather than a
-				// verifier, so refresh the custom bundle before each handshake.
-				let mut roots = custom.refresh();
-				if *system {
-					let native = rustls_native_certs::load_native_certs();
-					for err in native.errors {
-						tracing::warn!(%err, "failed to load native root cert");
-					}
-					roots.extend(native.certs);
-				}
-				roots
-			}
-			_ => Vec::new(),
-		};
-
-		// Bind the first attempt now so candidate selection uses the socket's actual
-		// family and dual-stack state. Later attempts bind their own ephemeral
-		// sockets because each quiche connection must own its socket.
-		let socket = crate::bind::udp(crate::bind::Udp::new(self.bind))?;
-		let local = socket.local_addr()?;
-		let dual_stack = crate::bind::udp_is_dual_stack(&socket);
-
-		// Resolve, adapted to the bound socket's reachability; the dial below races
-		// the answers Happy Eyeballs style as they land, so neither a broken family
-		// nor a lookup still waiting on its AAAA record can stall the connect.
-		let target = url.host().ok_or(Error::InvalidDnsName)?;
-		let mut candidates = match addr.addresses() {
-			Some(addrs) => crate::resolve::Candidates::fixed(addrs.iter().copied()),
-			None => crate::resolve::Candidates::resolve(target, port, self.resolution_delay),
-		}
-		.with_local(local, dual_stack);
-
-		// Each attempt binds its own socket, and a pinned non-zero source port only
-		// fits one socket at a time: an overlapping attempt would fail its bind with
-		// AddrInUse and burn a candidate for nothing. The attempts can't share a
-		// socket either (each quiche instance owns its socket and would consume the
-		// other's packets), so keep the preferred candidate only, the same single
-		// dial as before failover existed. `new` warns about this once.
-		if self.bind.port() != 0 {
-			candidates = candidates.with_limit(1);
-		}
-
-		tracing::debug!(peer = %crate::connect::Endpoint(&url), "connecting via quiche");
-
-		// Race only the QUIC handshake: the winner alone performs the WebTransport
-		// CONNECT below, so the server sees a single request no matter how many
-		// addresses were dialed.
-		let mut first_socket = Some(socket);
-		let conn = crate::failover::race(candidates, self.failover_delay, |addr| {
-			let socket = first_socket.take();
-			let this = self.clone();
-			let alpns = alpns.clone();
-			let verification = verification.clone();
-			let roots = roots.clone();
-			let host = host.clone();
-			async move {
-				let socket = match socket {
-					Some(socket) => socket,
-					None => crate::bind::udp(crate::bind::Udp::new(this.bind))?,
-				};
-				let builder = this.builder(socket, alpns, &verification, roots, &host)?;
-				let conn = builder
-					.connect(&addr.ip().to_string(), addr.port())
-					.await
-					.map_err(Error::Connect)?
-					.established()
-					.await
-					.map_err(|err| Error::Establish(crate::error::message(err)))?;
-				Ok::<_, Error>(conn)
-			}
-		})
-		.await?;
-
-		match url.scheme() {
-			"https" => {
-				// WebTransport over HTTP/3
-				let mut request = web_transport_quiche::proto::ConnectRequest::new(url.clone());
-				for alpn in versions.alpns() {
-					request = request.with_protocol(alpn.to_string());
-				}
-				let session = web_transport_quiche::Connection::connect(conn, request)
-					.await
-					.map_err(map_client_error)?;
-				Ok(session)
-			}
-			"moqt" | "moql" => {
-				// Raw QUIC mode
-				let alpn = conn.alpn().ok_or(Error::MissingAlpn)?;
-				std::str::from_utf8(&alpn)?;
-
-				Ok(web_transport_quiche::Connection::raw(conn))
-			}
-			_ => unreachable!("unsupported URL scheme: {}", url.scheme()),
-		}
-	}
-
-	/// Assemble the per-attempt client builder: settings, its bound socket, SNI,
-	/// client identity, and the verification policy
-	/// (with `roots` already resolved by the caller).
-	fn builder(
-		&self,
-		socket: net::UdpSocket,
-		alpns: Vec<Vec<u8>>,
-		verification: &crate::tls::Verification,
-		roots: Vec<CertificateDer<'static>>,
-		host: &str,
-	) -> Result<web_transport_quiche::ez::ClientBuilder> {
-		use crate::tls::Verification;
-
-		let mut settings = web_transport_quiche::Settings::default();
-		settings.verify_peer = !matches!(verification, Verification::Disabled);
-		settings.alpn = alpns;
-		apply_settings(&mut settings, &self.quic)?;
-
-		let mut builder = web_transport_quiche::ez::ClientBuilder::default()
-			.with_settings(settings)
-			.with_gso(self.quic.gso.unwrap_or(true))
-			.with_socket(socket)?;
-
-		if let Some(interval) = self.quic.keep_alive {
-			builder = builder.with_keep_alive(interval);
-		}
-
-		// The builder dials a resolved IP, so always set the original hostname
-		// explicitly for SNI and verification unless the caller overrides it.
-		builder = builder.with_server_name(self.host_name.as_deref().unwrap_or(host));
-
-		if let Some(identity) = &self.identity {
-			builder = builder.with_single_cert(identity.chain().to_vec(), identity.key.clone_key());
-		}
-
-		match verification {
-			// No hook: tokio-quiche's default config with verify_peer = false.
-			Verification::Disabled => {}
-			Verification::Fingerprints(hashes) => {
-				builder = builder.with_server_certificate_hashes(hashes.clone());
-			}
-			Verification::Roots { .. } => {
-				if !roots.is_empty() {
-					builder = builder.with_root_certificates(roots);
-				}
-			}
-		}
-
-		Ok(builder)
-	}
-}
-
-/// Fetch a relay's certificate SHA-256 over an insecure `http://` request.
-///
-/// This is the native equivalent of how a browser bootstraps trust for a
-/// self-signed relay: GET `/certificate.sha256` and pin the returned hash.
-async fn fetch_fingerprint(url: &Url) -> Result<[u8; 32]> {
-	let mut fp = url.clone();
-	fp.set_path("/certificate.sha256");
-	fp.set_query(None);
-	fp.set_fragment(None);
-
-	tracing::warn!(url = %RedactedUrl::new(&fp), "performing insecure HTTP request for certificate fingerprint");
-
-	let resp = reqwest::get(fp.as_str())
-		.await
-		.map_err(|err| Error::FetchFingerprint(crate::error::message(err)))?;
-	let status = resp.status().as_u16();
-	let resp = resp.error_for_status().map_err(|_| Error::FingerprintStatus(status))?;
-	let text = resp
-		.text()
-		.await
-		.map_err(|err| Error::ReadFingerprint(crate::error::message(err)))?;
-	let bytes = hex::decode(text.trim()).map_err(|err| Error::InvalidFingerprint(crate::error::message(err)))?;
-	bytes.try_into().map_err(|v: Vec<u8>| Error::FingerprintLength(v.len()))
-}
-
-impl Error {
-	pub(crate) fn connect_error(&self) -> Option<crate::ConnectError> {
-		match self {
-			Self::ConnectRejected(err) => Some(*err),
-			Self::ClientConnect {
-				status: Some(status), ..
-			} => crate::ConnectError::from_status_u16(*status),
-			Self::Failover(failures) => failures.iter().find_map(|failure| failure.error.connect_error()),
-			_ => None,
-		}
-	}
-
-	/// The HTTP status a server answered with, if it answered with one at all.
-	///
-	/// Two places see a real status: the insecure `http://` fingerprint bootstrap, and the
-	/// WebTransport CONNECT response. See [`crate::Error::status`].
-	pub(crate) fn status(&self) -> Option<u16> {
-		match self {
-			Self::FingerprintStatus(status) => Some(*status),
-			Self::ClientConnect { status, .. } => *status,
-			// Every raced address has to have answered, and answered with something not worth
-			// repeating, before the set counts as settled: one address refusing says nothing about
-			// the others, which may simply have been unroutable.
-			Self::Failover(failures) => {
-				let mut settled = None;
-				for failure in failures {
-					match failure.error.status() {
-						Some(status) if !crate::error::status_retryable(status) => settled = Some(status),
-						_ => return None,
-					}
-				}
-				settled
-			}
-			_ => None,
-		}
-	}
-}
-
-fn map_client_error(err: web_transport_quiche::ClientError) -> Error {
-	match client_status(&err).and_then(crate::ConnectError::from_status_u16) {
-		Some(rejected) => rejected.into(),
-		None => err.into(),
-	}
-}
-
-/// The HTTP status the server answered the WebTransport CONNECT with, when it answered with one at
-/// all (as opposed to the connection failing underneath the request).
-///
-/// Read once, when the error is converted: [`Error::connect_error`] turns an auth status into a
-/// [`crate::ConnectError`], and [`Error::status`] hands it to the caller, whose backoff consults
-/// the status. A `404` or `405` is the server's settled answer, so retrying
-/// it just burns the reconnect budget on a URL that will never work.
-fn client_status(err: &web_transport_quiche::ClientError) -> Option<u16> {
-	match err {
-		web_transport_quiche::ClientError::Connect(err) => connect_status(err),
-		_ => None,
-	}
-}
-
-fn connect_status(err: &web_transport_quiche::h3::ConnectError) -> Option<u16> {
-	match err {
-		web_transport_quiche::h3::ConnectError::Status(status) => Some(status.as_u16()),
-		web_transport_quiche::h3::ConnectError::Proto(err) => proto_status(err),
-		_ => None,
-	}
-}
-
-fn proto_status(err: &web_transport_quiche::proto::ConnectError) -> Option<u16> {
-	match err {
-		web_transport_quiche::proto::ConnectError::ErrorStatus(status)
-		| web_transport_quiche::proto::ConnectError::WrongStatus(Some(status)) => Some(status.as_u16()),
-		_ => None,
-	}
-}
-
-// ── Server ──────────────────────────────────────────────────────────
-
-pub(crate) struct QuicheServer {
-	pub server: web_transport_quiche::ez::Server,
-	certs: Arc<ServeCerts>,
-	_reload: crate::tls::Reload,
-}
-
-/// Serve the certificate whose subject names cover the client's SNI.
-///
-/// boringssl asks per handshake, so this reads the live set and picks up a hot
-/// reload without rebuilding the listener.
-impl web_transport_quiche::ez::CertResolver for ServeCerts {
-	fn resolve(&self, server_name: Option<&str>) -> Option<web_transport_quiche::ez::CertifiedKey> {
-		let certified = self.select(server_name)?;
-		Some(web_transport_quiche::ez::CertifiedKey {
-			chain: certified.chain().to_vec(),
-			key: certified.key.clone_key(),
-		})
-	}
-}
-
-impl QuicheServer {
-	pub fn new(config: listen::Config, quic: &crate::quic::Config, member: Option<listen::Member>) -> Result<Self> {
-		if config.load_balancer().is_some() {
-			tracing::warn!("QUIC-LB is not supported with the quiche backend; ignoring server ID");
-		}
-
-		// Refused rather than degraded: without connection-ID steering the kernel
-		// falls back to hashing addresses, and a client that changes address lands
-		// on a worker that has never seen its connection. `web-transport-quiche`
-		// exposes no connection ID hook to encode the owner with.
-		if member.is_some() {
-			return Err(Error::ShardUnsupported);
-		}
-
-		let quic = quic.resolve();
-
-		let listen = config
-			.bind
-			.as_ref()
-			.map(crate::listen::Bind::resolve)
-			.transpose()
-			.map_err(Error::ResolveBind)?
-			.unwrap_or(crate::server::DEFAULT_BIND);
-		let socket = crate::bind::udp(crate::bind::Udp::new(listen))?;
-
-		// Pinning client fingerprints needs a verifier that runs per handshake, which
-		// boringssl's client-auth path can't express: it validates the chain against a
-		// fixed root store. Refuse rather than accept peers the caller meant to pin out.
-		if config.tls.peers.is_some() {
-			return Err(crate::tls::Error::PeersUnsupported.into());
-		}
-
-		// The same certificate loader the other backends use: every cert/key pair,
-		// generated hostnames, and an in-memory identity, all selected by SNI and hot
-		// reloaded from disk below.
-		let certs = Arc::new(ServeCerts::new(crypto::provider()));
-		certs.load_certs(&config.tls)?;
-
-		// H3 is last because it requires WebTransport framing which not all H3 endpoints support.
-		let mut alpns: Vec<Vec<u8>> = config
-			.versions()
-			.alpns()
-			.iter()
-			.map(|alpn| alpn.as_bytes().to_vec())
-			.collect();
-		alpns.push(b"h3".to_vec());
-
-		let mut settings = web_transport_quiche::Settings::default();
-		settings.alpn = alpns;
-		apply_settings(&mut settings, &quic)?;
-
-		let mut builder = web_transport_quiche::ez::ServerBuilder::default()
-			.with_settings(settings)
-			.with_gso(quic.gso.unwrap_or(true));
-
-		if let Some(interval) = quic.keep_alive {
-			builder = builder.with_keep_alive(interval);
-		}
-
-		if !config.tls.root.is_empty() {
-			tracing::warn!("the quiche backend snapshots server mTLS roots; restart after rotating --listen-tls-root");
-			let roots = config
-				.tls
-				.root
-				.iter()
-				.map(|path| crate::tls::read_certs(path))
-				.collect::<crate::tls::Result<Vec<_>>>()?
-				.into_iter()
-				.flatten()
-				.collect();
-			builder = builder.with_client_auth(web_transport_quiche::ClientAuth::Optional(roots));
-		}
-
-		let server = builder
-			.with_socket(socket)?
-			.with_cert_resolver(certs.clone())
-			.map_err(Error::ServerBuild)?;
-
-		// Spawned only once the listener exists, so a failed bind leaves no watcher behind.
-		let _reload = crate::tls::Reload::spawn(certs.clone(), config.tls.clone());
-
-		Ok(Self { server, certs, _reload })
-	}
-
-	pub fn accept(&mut self) -> impl std::future::Future<Output = Option<web_transport_quiche::ez::Incoming>> + '_ {
-		self.server.accept()
-	}
-
-	pub fn certificates(&self) -> crate::tls::Certificates {
-		crate::tls::Certificates::new(self.certs.info.clone())
-	}
-
-	pub fn local_addr(&self) -> Result<net::SocketAddr> {
-		self.server.local_addrs().first().copied().ok_or(Error::NoLocalAddr)
-	}
-
-	pub fn close(&mut self) {
-		// quiche server doesn't have a close method; dropping it is sufficient
-	}
-}
-
-/// Load a PEM certificate chain and its key, checking that they actually pair up.
-///
-/// The client side only ever presents one certificate, so it loads directly rather
-/// than through [`ServeCerts`], which owns the SNI-selected set a listener serves.
-fn load_certified(cert_path: &Path, key_path: &Path) -> crate::tls::Result<Certified> {
-	let chain = crate::tls::read_certs(cert_path)?;
-	if chain.is_empty() {
-		return Err(crate::tls::Error::Empty);
-	}
-
-	let key = PrivateKeyDer::from_pem_file(key_path).map_err(crate::tls::Error::Key)?;
-
-	Certified::new(&crypto::provider(), chain, key)
-}
-
-// ── QuicheQuicRequest ───────────────────────────────────────────────
-
-/// A raw QUIC connection request via the quiche backend (not using HTTP/3).
-/// Accept a quiche QUIC connection, negotiate WebTransport or raw moq, and complete the
-/// handshake (a `200 OK` for WebTransport). Returns the established connection, the request
-/// URL and any validated client identity, and the dialed authority (the CONNECT authority
-/// on WebTransport, the TLS SNI on raw QUIC). Raw QUIC carries no request URL because the
-/// path rides the SETUP instead.
-pub(crate) async fn accept(
-	incoming: web_transport_quiche::ez::Incoming,
-	alpns: Vec<&'static str>,
-) -> Result<crate::server::Accepted<web_transport_quiche::Connection>> {
-	tracing::debug!(ip = %incoming.peer_addr(), "accepting via quiche");
-
-	// Accept the connection and wait for it to be established
-	let conn = incoming.accept().await?;
-
-	// Get the negotiated ALPN from the established connection
-	let alpn = conn.alpn().ok_or(Error::MissingAlpn)?;
-	let alpn = std::str::from_utf8(&alpn)?;
-	let identity = conn.peer_certificates().map(crate::tls::PeerIdentity::from_chain);
-	tracing::debug!(ip = %conn.peer_addr(), ?alpn, "accepted via quiche");
-
-	let link = crate::server::Link {
-		remote: Some(conn.peer_addr()),
-		local: None,
-		server_name: conn.server_name().filter(|h| !h.is_empty()),
-		alpn: None,
-	};
-
-	match alpn {
-		web_transport_quiche::ALPN => {
-			// WebTransport over HTTP/3
-			let request = web_transport_quiche::h3::Request::accept(conn)
-				.await
-				.map_err(|err| Error::AcceptRequest(crate::error::message(err)))?;
-			let url = Some(request.url.clone());
-			// The authority the client put in its CONNECT URL.
-			let authority = request.url.host_str().filter(|h| !h.is_empty()).map(str::to_owned);
-
-			let mut response = web_transport_quiche::proto::ConnectResponse::OK;
-			// Pick the first sub-protocol that we actually support.
-			// This is the WebTransport equivalent of ALPN negotiation.
-			let mut link = link;
-			if let Some(protocol) = request.protocols.iter().find(|p| alpns.contains(&p.as_str())) {
-				response = response.with_protocol(protocol);
-				link.alpn = Some(protocol.clone());
-			}
-			let session = request
-				.respond(response)
-				.await
-				.map_err(|err| Error::Accept(crate::error::message(err)))?;
-			Ok(crate::server::Accepted {
-				session,
-				url,
-				identity,
-				authority,
-				link,
-			})
-		}
-		// Recognize any moq ALPN this server actually offered (its configured versions),
-		// not the global default set, so opt-in / work-in-progress versions (e.g.
-		// moq-lite-06-wip) that are deliberately absent from `moq_net::ALPNS` still work.
-		alpn if alpns.contains(&alpn) => {
-			// Raw QUIC carries no request URL; the path rides the SETUP. The TLS SNI is the
-			// only authority the client can offer here, and it is optional.
-			let authority = conn.server_name().filter(|h| !h.is_empty());
-			let session = web_transport_quiche::Connection::raw(conn);
-			Ok(crate::server::Accepted {
-				session,
-				url: None,
-				identity,
-				authority,
-				link: crate::server::Link {
-					alpn: Some(alpn.to_string()),
-					..link
-				},
-			})
-		}
-		_ => Err(Error::UnsupportedAlpn(alpn.to_string())),
-	}
-}
-
-#[cfg(test)]
-mod tests {
-	use super::*;
-
-	/// quiche takes its controller by name, so a typo here is only caught when a
-	/// connection is built. Pin the strings against the set quiche's
-	/// `CongestionControlAlgorithm::from_str` accepts.
-	#[test]
-	fn cc_algorithm_names_are_valid() {
-		assert_eq!(cc_algorithm(CongestionControl::Loss), "cubic");
-		assert_eq!(cc_algorithm(CongestionControl::Delay), "bbr2_gcongestion");
-	}
-
-	/// A selected family must reach the settings quiche is built from, and an unset
-	/// one must land on BBR rather than quiche's own CUBIC default.
-	#[test]
-	fn apply_settings_writes_cc_algorithm() {
-		let mut quic = crate::quic::Config::default();
-		let mut settings = web_transport_quiche::Settings::default();
-
-		apply_settings(&mut settings, &quic.resolve()).unwrap();
-		assert_eq!(settings.cc_algorithm, "bbr2_gcongestion");
-
-		quic.congestion_control = Some(CongestionControl::Loss);
-		apply_settings(&mut settings, &quic.resolve()).unwrap();
-		assert_eq!(settings.cc_algorithm, "cubic");
-	}
-
-	/// quiche autotunes each flow-control window up to a maximum and clamps it there,
-	/// so writing only the initial value would leave a larger request silently capped.
-	/// Both halves have to land for the window to be what was asked for.
-	#[test]
-	fn apply_settings_pins_both_halves_of_each_window() {
-		let mut quic = crate::quic::Config::default();
-		quic.receive_window = Some(64 << 20);
-		quic.stream_receive_window = Some(8 << 20);
-
-		let mut settings = web_transport_quiche::Settings::default();
-		apply_settings(&mut settings, &quic.resolve()).unwrap();
-
-		assert_eq!(settings.initial_max_data, 64 << 20);
-		assert_eq!(settings.max_connection_window, 64 << 20);
-		assert_eq!(settings.initial_max_stream_data_bidi_local, 8 << 20);
-		assert_eq!(settings.initial_max_stream_data_bidi_remote, 8 << 20);
-		assert_eq!(settings.initial_max_stream_data_uni, 8 << 20);
-		assert_eq!(settings.max_stream_window, 8 << 20);
-	}
-
-	/// An unset window leaves quiche's own defaults alone rather than pinning ours.
-	#[test]
-	fn apply_settings_leaves_unset_windows_alone() {
-		let defaults = web_transport_quiche::Settings::default();
-		let mut settings = web_transport_quiche::Settings::default();
-		apply_settings(&mut settings, &crate::quic::Config::default().resolve()).unwrap();
-
-		assert_eq!(settings.initial_max_data, defaults.initial_max_data);
-		assert_eq!(settings.max_connection_window, defaults.max_connection_window);
-		assert_eq!(settings.max_stream_window, defaults.max_stream_window);
-	}
-
-	/// quiche has no local send cap, so a configured one is refused rather than
-	/// dropped: an operator must not believe a ceiling is in force that is not.
-	#[test]
-	fn send_window_is_refused() {
-		let mut quic = crate::quic::Config::default();
-		quic.send_window = Some(32 << 20);
-
-		let mut settings = web_transport_quiche::Settings::default();
-		assert!(matches!(
-			apply_settings(&mut settings, &quic.resolve()),
-			Err(Error::SendWindowUnsupported)
-		));
-	}
-
-	/// An in-memory identity is a client certificate like any other here: the DER is
-	/// kept alongside the rustls signer, so boringssl can present it.
-	#[cfg(any(feature = "aws-lc-rs", feature = "ring"))]
-	#[test]
-	fn accepts_an_in_memory_client_identity() {
-		let identity = crate::tls::Identity::generate(["client.invalid"]).unwrap();
-		let fingerprint = identity.fingerprint().to_string();
-
-		let mut tls = crate::tls::Connect::default();
-		tls.identity = Some(identity);
-		let config = crate::connect::Config {
-			tls,
-			..Default::default()
-		};
-
-		let client = QuicheClient::new(&config, &crate::quic::Config::default()).unwrap();
-		let presented = client.identity.expect("no client certificate");
-		assert_eq!(
-			hex::encode(crypto::sha256(&crypto::provider(), presented.leaf().as_ref())),
-			fingerprint
-		);
-	}
-
-	/// Only one client certificate can be presented, so the two sources are exclusive
-	/// rather than one silently winning.
-	#[cfg(any(feature = "aws-lc-rs", feature = "ring"))]
-	#[test]
-	fn rejects_an_identity_beside_a_certificate_file() {
-		let mut tls = crate::tls::Connect::default();
-		tls.identity = Some(crate::tls::Identity::generate(["client.invalid"]).unwrap());
-		tls.cert = Some("/tmp/client.pem".into());
-		tls.key = Some("/tmp/client.key".into());
-		let config = crate::connect::Config {
-			tls,
-			..Default::default()
-		};
-
-		assert!(matches!(
-			QuicheClient::new(&config, &crate::quic::Config::default()),
-			Err(Error::Tls(crate::tls::Error::ConflictingClientAuth))
-		));
-	}
-}
diff --git a/rs/moq-tokio/src/quinn.rs b/rs/moq-tokio/src/quinn.rs
deleted file mode 100644
index 5bb566fe2b..0000000000
--- a/rs/moq-tokio/src/quinn.rs
+++ /dev/null
@@ -1,1051 +0,0 @@
-//! The quinn QUIC backend, used for both WebTransport (`https://`) and raw QUIC (`moqt://`, `moql://`).
-
-use crate::RedactedUrl;
-use crate::connect;
-use crate::listen;
-use crate::quic::CongestionControl;
-use crate::quic::Resolved;
-use crate::quic::ServerId;
-use crate::tls::{FingerprintVerifier, ServeCerts};
-use std::net;
-use std::sync::Arc;
-use std::time::Duration;
-
-pub use web_transport_quinn;
-
-/// Attach a qlog stream writing into `dir`, if one was configured.
-///
-/// quinn's [`quinn::QlogStream`] is a shared handle: every connection on the endpoint
-/// writes into it, tagged with its own qlog `group_id`. So this is one file per
-/// endpoint rather than per connection, unlike the noq and quiche backends.
-fn apply_qlog(transport: &mut quinn::TransportConfig, quic: &Resolved, role: &str) -> Result<()> {
-	// `Client::validate` already rejected a directory this build can't honor, so the
-	// block below is only reached where capture actually works.
-	let Some(dir) = quic.qlog_dir() else {
-		return Ok(());
-	};
-
-	#[cfg(feature = "qlog")]
-	{
-		// The pid keeps concurrent processes sharing a directory from clobbering each other.
-		let path = dir.join(format!("moq-{role}-{}.sqlog", std::process::id()));
-		let file = std::fs::File::create(&path).map_err(Error::CreateQlog)?;
-
-		// Deliberately unbuffered: qlog's streamer only flushes on `finish_log`, which
-		// quinn never calls per event, so a BufWriter would hold every trace in memory
-		// until the endpoint drops and lose the lot if the process is killed. Killing a
-		// stuck process is exactly when these traces are worth having.
-		let mut config = quinn::QlogConfig::default();
-		config.writer(Box::new(file)).title(Some(format!("moq-tokio {role}")));
-
-		transport.qlog_stream(config.into_stream());
-		tracing::info!(path = %path.display(), "writing qlog");
-	}
-
-	#[cfg(not(feature = "qlog"))]
-	let _ = (transport, dir, role);
-
-	Ok(())
-}
-
-/// Apply the resolved quic knobs to a quinn transport config.
-fn apply_transport(transport: &mut quinn::TransportConfig, quic: &Resolved) {
-	transport.max_idle_timeout(Some(quic.idle_timeout.try_into().expect("idle timeout out of range")));
-	transport.keep_alive_interval(quic.keep_alive);
-
-	// quinn enables MTU discovery by default; disable it unless asked.
-	if !quic.mtu_discovery {
-		transport.mtu_discovery_config(None);
-	}
-
-	let max_streams = quinn::VarInt::from_u64(quic.max_streams).unwrap_or(quinn::VarInt::MAX);
-	transport.max_concurrent_bidi_streams(max_streams);
-	transport.max_concurrent_uni_streams(max_streams);
-
-	// GSO is on by default; only the quinn/noq backends can turn it off.
-	if let Some(gso) = quic.gso {
-		transport.enable_segmentation_offload(gso);
-	}
-
-	apply_windows(transport, quic);
-
-	transport.congestion_controller_factory(congestion_factory(quic.congestion()));
-}
-
-/// Apply the flow-control windows, leaving each at the backend default when unset.
-fn apply_windows(transport: &mut quinn::TransportConfig, quic: &Resolved) {
-	// Saturating rather than erroring: `Config::validate` already rejects a window
-	// past the varint, so this only bites a `Resolved` built without it.
-	if let Some(window) = quic.receive_window {
-		transport.receive_window(quinn::VarInt::from_u64(window).unwrap_or(quinn::VarInt::MAX));
-	}
-	if let Some(window) = quic.stream_receive_window {
-		transport.stream_receive_window(quinn::VarInt::from_u64(window).unwrap_or(quinn::VarInt::MAX));
-	}
-	if let Some(window) = quic.send_window {
-		transport.send_window(window);
-	}
-}
-
-/// The quinn controller factory for a congestion control family. quinn's BBR is v1.
-fn congestion_factory(family: CongestionControl) -> Arc<dyn quinn::congestion::ControllerFactory + Send + Sync> {
-	match family {
-		CongestionControl::Loss => Arc::new(quinn::congestion::CubicConfig::default()),
-		CongestionControl::Delay => Arc::new(quinn::congestion::BbrConfig::default()),
-	}
-}
-
-/// Errors specific to the quinn QUIC backend.
-#[derive(Debug, thiserror::Error)]
-#[non_exhaustive]
-pub enum Error {
-	/// The UDP socket couldn't be bound, usually because the address is already in use.
-	#[error("failed to bind UDP socket")]
-	BindSocket(#[source] std::io::Error),
-
-	/// The bound socket couldn't be turned into a QUIC endpoint.
-	#[error("failed to create QUIC endpoint")]
-	CreateEndpoint(#[source] std::io::Error),
-
-	/// The qlog trace file couldn't be created, usually a missing directory.
-	#[error("failed to create qlog file")]
-	CreateQlog(#[source] std::io::Error),
-
-	/// Quinn found no async runtime. Construct the client or server from within a tokio context.
-	#[error("no async runtime")]
-	NoRuntime,
-
-	/// The endpoint's local address couldn't be read back from the OS.
-	#[error("failed to get local address")]
-	LocalAddr(#[source] std::io::Error),
-
-	/// The server's configured bind address couldn't be resolved.
-	#[error("failed to resolve bind address")]
-	ResolveBind(#[source] std::io::Error),
-
-	/// The URL has no host to connect to.
-	#[error("invalid DNS name")]
-	InvalidDnsName,
-
-	/// Resolving the URL's host failed.
-	#[error("failed DNS lookup")]
-	DnsLookup(#[source] std::io::Error),
-
-	/// DNS resolved the host to no addresses at all.
-	#[error("no DNS entries")]
-	NoDnsEntries,
-
-	/// The insecure `http://` bootstrap couldn't fetch `/certificate.sha256`.
-	#[error("failed to fetch fingerprint: {0}")]
-	FetchFingerprint(String),
-
-	/// The `/certificate.sha256` fetch returned a non-success status.
-	#[error("fingerprint request failed with status {0}")]
-	FingerprintStatus(u16),
-
-	/// The fingerprint response body couldn't be read.
-	#[error("failed to read fingerprint: {0}")]
-	ReadFingerprint(String),
-
-	/// The fetched fingerprint wasn't valid hex.
-	#[error("invalid fingerprint: {0}")]
-	InvalidFingerprint(String),
-
-	/// The URL scheme isn't one this backend can dial.
-	#[error("url scheme must be 'https', 'moqt', or 'moql'")]
-	InvalidScheme,
-
-	/// The URL scheme passed the initial check but has no session type, which means it slipped through a scheme list.
-	#[error("unsupported URL scheme: {0}")]
-	UnsupportedScheme(String),
-
-	/// The connection came up without TLS handshake data, so the negotiated ALPN can't be read.
-	#[error("missing handshake data")]
-	MissingHandshake,
-
-	/// TLS negotiated no ALPN, so there's no protocol to speak.
-	#[error("missing ALPN")]
-	MissingAlpn,
-
-	/// The negotiated ALPN wasn't valid UTF-8.
-	#[error("failed to decode ALPN")]
-	DecodeAlpn(#[from] std::string::FromUtf8Error),
-
-	/// The peer negotiated an ALPN this endpoint doesn't handle.
-	#[error("unsupported ALPN: {0}")]
-	UnsupportedAlpn(String),
-
-	/// A raw QUIC client connected without SNI, so the server can't tell which host it wanted.
-	#[error("missing server name for raw QUIC connection")]
-	MissingServerName,
-
-	/// The client's SNI hostname didn't form a valid URL.
-	#[error("failed to construct URL from server name: {0}")]
-	BuildUrl(String),
-
-	/// The configured QUIC-LB nonce is too short to be unguessable.
-	#[error("quic_lb_nonce must be at least 4")]
-	QuicLbNonceTooSmall,
-
-	/// The QUIC-LB server ID plus nonce doesn't fit in a connection ID. Shorten one of them.
-	#[error("connection ID length ({0}) exceeds maximum of 20")]
-	QuicLbCidTooLong(usize),
-
-	/// Both QUIC-LB and reuseport steering want to own the connection ID, and
-	/// each reads back only its own encoding.
-	#[error("QUIC-LB connection IDs cannot be combined with per-core workers")]
-	ShardWithQuicLb,
-
-	/// The mTLS client verifier couldn't be built from the configured roots.
-	#[error("failed to build client certificate verifier")]
-	ClientVerifier(#[source] rustls::server::VerifierBuilderError),
-
-	/// The rustls crypto provider offers no cipher suite usable for QUIC initial packets.
-	#[error("no cipher suite available for QUIC initial packets")]
-	NoInitialCipherSuite,
-
-	/// Quinn refused to start the connection, before any packet was sent.
-	#[error("{0}")]
-	Connect(String),
-
-	/// The QUIC connection failed or was closed by the peer.
-	#[error("{0}")]
-	Connection(String),
-
-	/// The WebTransport client handshake failed.
-	#[error("{message}")]
-	Client {
-		/// What the handshake reported.
-		message: String,
-		/// The HTTP status the server answered the CONNECT with, when it answered with one.
-		///
-		/// Read at conversion time rather than kept as a `web-transport-quinn` error, so the
-		/// classification survives without that crate appearing in this crate's public API.
-		status: Option<u16>,
-	},
-
-	/// The server answered the WebTransport CONNECT with a rejection status.
-	#[error(transparent)]
-	ConnectRejected(#[from] crate::ConnectError),
-
-	/// The WebTransport server handshake failed while responding.
-	#[error("{0}")]
-	Server(String),
-
-	/// The QUIC handshake didn't complete for an incoming connection.
-	#[error("failed to establish QUIC connection: {0}")]
-	Establish(String),
-
-	/// The client never sent a usable WebTransport CONNECT request.
-	#[error("failed to receive WebTransport request: {0}")]
-	RecvRequest(String),
-
-	/// The TLS configuration or certificates couldn't be loaded.
-	#[error(transparent)]
-	Tls(#[from] crate::tls::Error),
-
-	/// Two or more addresses were raced and every attempt failed, each paired
-	/// with its own error in dial order. All of them are kept: picking one to
-	/// report would bury a rejected certificate or a refused port behind
-	/// whichever address happened to be unroutable or to blackhole until its
-	/// timeout. A host with a single address reports that error directly instead.
-	#[error("all {} connection attempts failed: {}", .0.len(), crate::failover::describe(.0))]
-	Failover(Vec<crate::failover::Attempt<Error>>),
-}
-
-impl crate::failover::Aggregate for Error {
-	fn aggregate(failures: Vec<crate::failover::Attempt<Self>>) -> Self {
-		Self::Failover(failures)
-	}
-
-	fn resolve(error: Option<std::io::Error>) -> Self {
-		match error {
-			Some(error) => Self::DnsLookup(error),
-			None => Self::NoDnsEntries,
-		}
-	}
-}
-
-crate::error::from_message! {
-	quinn::ConnectError => Connect,
-	quinn::ConnectionError => Connection,
-	web_transport_quinn::ServerError => Server,
-	hex::FromHexError => InvalidFingerprint,
-}
-
-impl From<quinn::crypto::rustls::NoInitialCipherSuite> for Error {
-	fn from(_: quinn::crypto::rustls::NoInitialCipherSuite) -> Self {
-		Self::NoInitialCipherSuite
-	}
-}
-
-impl From<web_transport_quinn::ClientError> for Error {
-	fn from(err: web_transport_quinn::ClientError) -> Self {
-		Self::Client {
-			status: client_status(&err),
-			message: crate::error::message(err),
-		}
-	}
-}
-
-type Result<T> = std::result::Result<T, Error>;
-
-// ── Client ──────────────────────────────────────────────────────────
-
-#[derive(Clone)]
-pub(crate) struct QuinnClient {
-	pub quic: quinn::Endpoint,
-	pub transport: Arc<quinn::TransportConfig>,
-	/// Whether an `http://` URL may bootstrap a pin (see [crate::tls::Connect::allows_http_bootstrap]).
-	pub http_bootstrap: bool,
-	/// Optional TLS SNI / verification hostname override (from config).
-	pub host_name: Option<String>,
-	/// Stagger between Happy Eyeballs connection attempts (see [`crate::failover`]).
-	pub failover_delay: Duration,
-	/// How long the first candidate waits for the full DNS answer, RFC 8305's
-	/// Resolution Delay (see [`crate::connect::Config::resolution_delay`]).
-	pub resolution_delay: Duration,
-	/// Whether the bound socket really came back dual-stack, which decides
-	/// whether an IPv4 destination is reachable at all. Captured here because the
-	/// endpoint owns the socket from here on and `local_addr` can't tell us.
-	dual_stack: bool,
-}
-
-impl QuinnClient {
-	pub fn new(config: &connect::Config, quic: &crate::quic::Config) -> Result<Self> {
-		let resolved = config.resolve();
-		let socket = crate::bind::udp(crate::bind::Udp::new(resolved.bind)).map_err(Error::BindSocket)?;
-		let dual_stack = crate::bind::udp_is_dual_stack(&socket);
-
-		let quic = quic.resolve();
-		let mut transport = quinn::TransportConfig::default();
-		apply_transport(&mut transport, &quic);
-		apply_qlog(&mut transport, &quic, "client")?;
-		let transport = Arc::new(transport);
-
-		// There's a bit more boilerplate to make a generic endpoint.
-		let runtime = quinn::default_runtime().ok_or(Error::NoRuntime)?;
-		let endpoint_config = quinn::EndpointConfig::default();
-
-		// Create the generic QUIC endpoint.
-		let quic = quinn::Endpoint::new(endpoint_config, None, socket, runtime).map_err(Error::CreateEndpoint)?;
-
-		Ok(Self {
-			quic,
-			transport,
-			http_bootstrap: config.tls.allows_http_bootstrap(),
-			host_name: config.tls.host_name.clone(),
-			failover_delay: resolved.race,
-			resolution_delay: resolved.resolution_delay,
-			dual_stack,
-		})
-	}
-
-	pub async fn connect(
-		&self,
-		tls: &rustls::ClientConfig,
-		addr: crate::connect::Addr,
-		versions: &moq_net::Versions,
-	) -> Result<web_transport_quinn::Session> {
-		let mut url = addr.url().clone();
-		let mut config = tls.clone();
-
-		let target = url.host().ok_or(Error::InvalidDnsName)?;
-		let host = target.to_string();
-		let port = url.port().unwrap_or(443);
-
-		// Resolve, adapted to the local socket's family; the dial below races the
-		// answers Happy Eyeballs style as they land, so neither a broken family nor a
-		// lookup still waiting on its AAAA record can stall the connect.
-		let local = self.quic.local_addr().map_err(Error::LocalAddr)?;
-		let candidates = match addr.addresses() {
-			Some(addrs) => crate::resolve::Candidates::fixed(addrs.iter().copied()),
-			None => crate::resolve::Candidates::resolve(target, port, self.resolution_delay),
-		}
-		.with_local(local, self.dual_stack);
-
-		if url.scheme() == "http" {
-			// Insecure per-connection bootstrap: only honored when no stronger
-			// verification is configured, so an attacker controlling the plaintext
-			// fetch can't weaken an explicit pin or re-enable disabled verification.
-			if self.http_bootstrap {
-				// Perform a HTTP request to fetch the certificate fingerprint.
-				let mut fingerprint = url.clone();
-				fingerprint.set_path("/certificate.sha256");
-				fingerprint.set_query(None);
-				fingerprint.set_fragment(None);
-
-				tracing::warn!(url = %RedactedUrl::new(&fingerprint), "performing insecure HTTP request for certificate");
-
-				let resp = reqwest::get(fingerprint.as_str())
-					.await
-					.map_err(|err| Error::FetchFingerprint(crate::error::message(err)))?;
-				let status = resp.status().as_u16();
-				let resp = resp.error_for_status().map_err(|_| Error::FingerprintStatus(status))?;
-
-				let fingerprint = resp
-					.text()
-					.await
-					.map_err(|err| Error::ReadFingerprint(crate::error::message(err)))?;
-				let fingerprint = hex::decode(fingerprint.trim())?;
-
-				let verifier = FingerprintVerifier::new(config.crypto_provider().clone(), vec![fingerprint]);
-				config.dangerous().set_certificate_verifier(Arc::new(verifier));
-			} else {
-				tracing::warn!(
-					"ignoring insecure http:// fingerprint bootstrap; using the configured TLS verification"
-				);
-			}
-
-			url.set_scheme("https").expect("failed to set scheme");
-		}
-
-		let alpns: Vec<Vec<u8>> = match url.scheme() {
-			"https" => vec![web_transport_quinn::ALPN.as_bytes().to_vec()],
-			"moqt" | "moql" => versions.alpns().iter().map(|alpn| alpn.as_bytes().to_vec()).collect(),
-			_ => return Err(Error::InvalidScheme),
-		};
-
-		config.alpn_protocols = alpns;
-		config.key_log = Arc::new(rustls::KeyLogFile::new());
-
-		let config: quinn::crypto::rustls::QuicClientConfig = config.try_into()?;
-		let mut config = quinn::ClientConfig::new(Arc::new(config));
-		config.transport_config(self.transport.clone());
-
-		tracing::debug!(peer = %crate::connect::Endpoint(&url), "connecting");
-
-		// Use the configured host_name override for SNI + cert verification, else the URL host.
-		let host_name = self.host_name.clone().unwrap_or(host);
-
-		// Race only the QUIC handshake: the winner alone performs the WebTransport
-		// CONNECT below, so the server sees a single request no matter how many
-		// addresses were dialed.
-		let connection = crate::failover::race(candidates, self.failover_delay, |addr| {
-			let endpoint = self.quic.clone();
-			let config = config.clone();
-			let host_name = host_name.clone();
-			async move { Ok::<_, Error>(endpoint.connect_with(config, addr, &host_name)?.await?) }
-		})
-		.await?;
-		tracing::Span::current().record("id", connection.stable_id());
-
-		let session = match url.scheme() {
-			"https" => {
-				let mut request = web_transport_quinn::proto::ConnectRequest::new(url.clone());
-				for alpn in versions.alpns() {
-					request = request.with_protocol(alpn.to_string());
-				}
-				web_transport_quinn::Session::connect(connection, request)
-					.await
-					.map_err(map_client_error)?
-			}
-			"moqt" | "moql" => web_transport_quinn::Session::raw(connection),
-			_ => return Err(Error::UnsupportedScheme(url.scheme().to_string())),
-		};
-
-		Ok(session)
-	}
-}
-
-impl Error {
-	pub(crate) fn connect_error(&self) -> Option<crate::ConnectError> {
-		match self {
-			Self::ConnectRejected(err) => Some(*err),
-			Self::Client {
-				status: Some(status), ..
-			} => crate::ConnectError::from_status_u16(*status),
-			Self::Failover(failures) => failures.iter().find_map(|failure| failure.error.connect_error()),
-			_ => None,
-		}
-	}
-
-	/// The HTTP status a server answered with, if it answered with one at all.
-	///
-	/// Two places see a real status: the insecure `http://` fingerprint bootstrap, and the
-	/// WebTransport CONNECT response. See [`crate::Error::status`].
-	pub(crate) fn status(&self) -> Option<u16> {
-		match self {
-			Self::FingerprintStatus(status) => Some(*status),
-			Self::Client { status, .. } => *status,
-			// Every raced address has to have answered, and answered with something not worth
-			// repeating, before the set counts as settled: one address refusing says nothing about
-			// the others, which may simply have been unroutable.
-			Self::Failover(failures) => {
-				let mut settled = None;
-				for failure in failures {
-					match failure.error.status() {
-						Some(status) if !crate::error::status_retryable(status) => settled = Some(status),
-						_ => return None,
-					}
-				}
-				settled
-			}
-			_ => None,
-		}
-	}
-}
-
-fn map_client_error(err: web_transport_quinn::ClientError) -> Error {
-	match client_status(&err).and_then(crate::ConnectError::from_status_u16) {
-		Some(rejected) => rejected.into(),
-		None => err.into(),
-	}
-}
-
-/// The HTTP status the server answered the WebTransport CONNECT with, when it answered with one at
-/// all (as opposed to the connection failing underneath the request).
-///
-/// Read once, when the error is converted: [`Error::connect_error`] turns an auth status into a
-/// [`crate::ConnectError`], and [`Error::status`] hands it to the caller, whose backoff consults
-/// the status. A `404` or `405` is the server's settled answer, so retrying
-/// it just burns the reconnect budget on a URL that will never work.
-fn client_status(err: &web_transport_quinn::ClientError) -> Option<u16> {
-	match err {
-		web_transport_quinn::ClientError::HttpError(err) => connect_status(err),
-		_ => None,
-	}
-}
-
-fn connect_status(err: &web_transport_quinn::ConnectError) -> Option<u16> {
-	match err {
-		web_transport_quinn::ConnectError::ErrorStatus(status) => Some(status.as_u16()),
-		web_transport_quinn::ConnectError::ProtoError(err) => proto_status(err),
-		_ => None,
-	}
-}
-
-fn proto_status(err: &web_transport_quinn::proto::ConnectError) -> Option<u16> {
-	match err {
-		web_transport_quinn::proto::ConnectError::ErrorStatus(status)
-		| web_transport_quinn::proto::ConnectError::WrongStatus(Some(status)) => Some(status.as_u16()),
-		_ => None,
-	}
-}
-
-// ── Server ──────────────────────────────────────────────────────────
-
-pub(crate) struct QuinnServer {
-	pub quic: quinn::Endpoint,
-	pub certs: Arc<ServeCerts>,
-	_reload: crate::tls::Reload,
-}
-
-impl QuinnServer {
-	pub fn new(config: listen::Config, quic: &crate::quic::Config, member: Option<listen::Member>) -> Result<Self> {
-		let quic = quic.resolve();
-		let mut transport = quinn::TransportConfig::default();
-		apply_transport(&mut transport, &quic);
-		apply_qlog(&mut transport, &quic, "server")?;
-		let transport = Arc::new(transport);
-
-		let provider = crate::crypto::provider();
-
-		let certs = ServeCerts::new(provider.clone());
-		certs.load_certs(&config.tls)?;
-		let certs = Arc::new(certs);
-
-		let tls_builder = rustls::ServerConfig::builder_with_provider(provider.clone())
-			.with_protocol_versions(&[&rustls::version::TLS13])
-			.map_err(crate::tls::Error::from)?;
-
-		let mut tls = match config.tls.client_auth(provider)? {
-			Some(verifier) => tls_builder
-				.with_client_cert_verifier(verifier)
-				.with_cert_resolver(certs.clone()),
-			None => tls_builder.with_no_client_auth().with_cert_resolver(certs.clone()),
-		};
-
-		// H3 is last because it requires WebTransport framing which not all H3 endpoints support.
-		let mut alpns: Vec<Vec<u8>> = config
-			.versions()
-			.alpns()
-			.iter()
-			.map(|alpn| alpn.as_bytes().to_vec())
-			.collect();
-		alpns.push(web_transport_quinn::ALPN.as_bytes().to_vec());
-
-		tls.alpn_protocols = alpns;
-		tls.key_log = Arc::new(rustls::KeyLogFile::new());
-		config.tls.disable_resumption(&mut tls);
-
-		let tls: quinn::crypto::rustls::QuicServerConfig = tls.try_into()?;
-		let mut tls = quinn::ServerConfig::with_crypto(Arc::new(tls));
-		tls.transport_config(transport);
-
-		// Advertise the preferred_address transport parameter (RFC 9000 §9.6).
-		// Quinn allocates a fresh CID + reset token for the address during the handshake.
-		if let Some(addr) = config.preferred_v4 {
-			tls.preferred_address_v4(Some(addr));
-		}
-		if let Some(addr) = config.preferred_v6 {
-			tls.preferred_address_v6(Some(addr));
-		}
-
-		// There's a bit more boilerplate to make a generic endpoint.
-		let runtime = quinn::default_runtime().ok_or(Error::NoRuntime)?;
-
-		let listen = config
-			.bind
-			.as_ref()
-			.map(crate::listen::Bind::resolve)
-			.transpose()
-			.map_err(Error::ResolveBind)?
-			.unwrap_or(crate::server::DEFAULT_BIND);
-		let load_balancer = config.load_balancer();
-
-		// Configure connection ID generator with server ID if provided
-		let mut endpoint_config = quinn::EndpointConfig::default();
-		if let Some(shard) = member.as_ref().map(listen::Member::shard) {
-			if load_balancer.is_some() {
-				return Err(Error::ShardWithQuicLb);
-			}
-			tracing::debug!(
-				index = shard.index(),
-				count = shard.count(),
-				"encoding the shard in connection IDs"
-			);
-			endpoint_config.cid_generator(move || Box::new(ShardIdGenerator::new(shard)));
-		} else if let Some(load_balancer) = load_balancer {
-			let server_id = load_balancer.id;
-			let nonce_len = load_balancer.nonce;
-			if nonce_len < 4 {
-				return Err(Error::QuicLbNonceTooSmall);
-			}
-
-			let cid_len = 1 + server_id.len() + nonce_len;
-			if cid_len > 20 {
-				return Err(Error::QuicLbCidTooLong(cid_len));
-			}
-
-			tracing::info!(
-				?server_id,
-				nonce_len,
-				"using QUIC-LB compatible connection ID generation"
-			);
-			endpoint_config.cid_generator(move || Box::new(ServerIdGenerator::new(server_id.clone(), nonce_len)));
-		}
-
-		// A group member binds the address its group holds, not the one this
-		// config resolved: the group is what guarantees every member shares one
-		// port, in the order the kernel steers by.
-		let socket = match member {
-			Some(member) => member.bind(),
-			None => crate::bind::udp(crate::bind::Udp::new(listen)),
-		}
-		.map_err(Error::BindSocket)?;
-
-		// Create the generic QUIC endpoint.
-		let quic = quinn::Endpoint::new(endpoint_config, Some(tls), socket, runtime).map_err(Error::CreateEndpoint)?;
-
-		// Spawn the cert reload watcher only after endpoint creation succeeds,
-		// so we don't leave a dangling watcher on failure.
-		let _reload = crate::tls::Reload::spawn(certs.clone(), config.tls.clone());
-
-		Ok(Self { quic, certs, _reload })
-	}
-
-	pub fn accept(&self) -> impl std::future::Future<Output = Option<quinn::Incoming>> + '_ {
-		self.quic.accept()
-	}
-
-	pub fn certificates(&self) -> crate::tls::Certificates {
-		crate::tls::Certificates::new(self.certs.info.clone())
-	}
-
-	pub fn local_addr(&self) -> Result<net::SocketAddr> {
-		self.quic.local_addr().map_err(Error::LocalAddr)
-	}
-
-	pub fn close(&self) {
-		self.quic.close(quinn::VarInt::from_u32(0), b"server shutdown");
-	}
-}
-
-// ── QuinnRequest ────────────────────────────────────────────────────
-
-/// Accept a QUIC connection, negotiate WebTransport or raw moq, and complete the
-/// handshake (a `200 OK` for WebTransport). Returns the established session, the request
-/// URL and validated mTLS identity (both captured before the response consumes the
-/// request), and the dialed authority (the CONNECT authority on WebTransport, the TLS
-/// SNI on raw QUIC). Raw QUIC carries no request URL (the path rides the SETUP instead).
-pub(crate) async fn accept(
-	conn: quinn::Incoming,
-	alpns: Vec<&'static str>,
-) -> Result<crate::server::Accepted<web_transport_quinn::Session>> {
-	let mut conn = conn.accept()?;
-
-	let handshake = conn
-		.handshake_data()
-		.await?
-		.downcast::<quinn::crypto::rustls::HandshakeData>()
-		.unwrap();
-
-	let alpn = handshake.protocol.ok_or(Error::MissingAlpn)?;
-	let alpn = String::from_utf8(alpn)?;
-	let host = handshake.server_name.unwrap_or_default();
-
-	tracing::debug!(%host, ip = %conn.remote_address(), %alpn, "accepting");
-
-	// Wait for the QUIC connection to be established.
-	let conn = conn.await.map_err(|err| Error::Establish(crate::error::message(err)))?;
-
-	let span = tracing::Span::current();
-	span.record("id", conn.stable_id()); // TODO can we get this earlier?
-	tracing::debug!(%host, ip = %conn.remote_address(), %alpn, "accepted");
-
-	let link = crate::server::Link {
-		remote: Some(conn.remote_address()),
-		local: None,
-		server_name: (!host.is_empty()).then(|| host.clone()),
-		alpn: None,
-	};
-
-	match alpn.as_str() {
-		web_transport_quinn::ALPN => {
-			// Wait for the CONNECT request, then capture its URL and mTLS identity before
-			// the response consumes it.
-			let request = web_transport_quinn::Request::accept(conn)
-				.await
-				.map_err(|err| Error::RecvRequest(crate::error::message(err)))?;
-			let url = Some(request.url.clone());
-			let identity = crate::tls::PeerIdentity::from_any(request.conn().peer_identity());
-			// The authority the client put in its CONNECT URL.
-			let authority = request.url.host_str().filter(|h| !h.is_empty()).map(str::to_owned);
-
-			let mut response = web_transport_quinn::proto::ConnectResponse::OK;
-			// Pick the first sub-protocol that we actually support.
-			// This is the WebTransport equivalent of ALPN negotiation.
-			// If no match is found, we default to no sub-protocol to support older
-			// clients that don't use ALPN. We assume moq-transport-14/moq-lite-02
-			// and perform the SETUP_x exchange instead.
-			let mut link = link;
-			if let Some(protocol) = request.protocols.iter().find(|p| alpns.contains(&p.as_str())) {
-				response = response.with_protocol(protocol);
-				link.alpn = Some(protocol.clone());
-			}
-			let session = request
-				.respond(response)
-				.await
-				.map_err(|err| Error::Server(crate::error::message(err)))?;
-			Ok(crate::server::Accepted {
-				session,
-				url,
-				identity,
-				authority,
-				link,
-			})
-		}
-		// Recognize any moq ALPN this server actually offered (its configured versions),
-		// not the global default set. rustls only negotiates an ALPN the server offered, so
-		// this covers opt-in / work-in-progress versions (e.g. moq-lite-06-wip) that are
-		// deliberately absent from `moq_net::ALPNS`.
-		alpn if alpns.contains(&alpn) => {
-			let identity = crate::tls::PeerIdentity::from_any(conn.peer_identity());
-			// Raw QUIC carries no request URL; the path rides the SETUP. The TLS SNI is the
-			// only authority the client can offer here, and it is optional.
-			let authority = (!host.is_empty()).then_some(host);
-			let session = web_transport_quinn::Session::raw(conn);
-			Ok(crate::server::Accepted {
-				session,
-				url: None,
-				identity,
-				authority,
-				link: crate::server::Link {
-					alpn: Some(alpn.to_string()),
-					..link
-				},
-			})
-		}
-		_ => Err(Error::UnsupportedAlpn(alpn)),
-	}
-}
-
-// ── ShardIdGenerator ────────────────────────────────────────────────
-
-/// Connection IDs whose first byte names the reuseport member that owns them,
-/// so the group's steering filter can route later packets back to it.
-struct ShardIdGenerator {
-	shard: crate::listen::Shard,
-}
-
-impl ShardIdGenerator {
-	/// Matches quinn's own default length. Only the first byte is spoken for.
-	const LEN: usize = 8;
-
-	fn new(shard: crate::listen::Shard) -> Self {
-		Self { shard }
-	}
-}
-
-impl quinn::ConnectionIdGenerator for ShardIdGenerator {
-	fn generate_cid(&mut self) -> quinn::ConnectionId {
-		use rand::RngExt;
-		let mut cid = Vec::with_capacity(Self::LEN);
-		cid.push(moq_sock::shard::cid_prefix(self.shard));
-		cid.extend(rand::rng().random_iter::<u8>().take(Self::LEN - 1));
-		quinn::ConnectionId::new(&cid)
-	}
-
-	fn cid_len(&self) -> usize {
-		Self::LEN
-	}
-
-	fn cid_lifetime(&self) -> Option<Duration> {
-		None
-	}
-}
-
-// ── ServerIdGenerator ───────────────────────────────────────────────
-
-struct ServerIdGenerator {
-	server_id: ServerId,
-	nonce_len: usize,
-}
-
-impl ServerIdGenerator {
-	fn new(server_id: ServerId, nonce_len: usize) -> Self {
-		Self { server_id, nonce_len }
-	}
-}
-
-impl quinn::ConnectionIdGenerator for ServerIdGenerator {
-	fn generate_cid(&mut self) -> quinn::ConnectionId {
-		use rand::RngExt;
-		let cid_len = self.cid_len();
-		let mut cid = Vec::with_capacity(cid_len);
-		// First byte has "self-encoded length" of server ID + nonce
-		cid.push((cid_len - 1) as u8);
-		cid.extend(self.server_id.0.iter());
-		cid.extend(rand::rng().random_iter::<u8>().take(self.nonce_len));
-		quinn::ConnectionId::new(cid.as_slice())
-	}
-
-	fn cid_len(&self) -> usize {
-		1 + self.server_id.len() + self.nonce_len
-	}
-
-	fn cid_lifetime(&self) -> Option<Duration> {
-		None
-	}
-}
-
-#[cfg(test)]
-mod tests {
-	use super::*;
-	use url::Url;
-
-	fn connect_rejected(status: u16) -> Error {
-		web_transport_quinn::ClientError::HttpError(web_transport_quinn::ConnectError::ErrorStatus(
-			web_transport_quinn::http::StatusCode::from_u16(status).unwrap(),
-		))
-		.into()
-	}
-
-	/// A CONNECT the relay answered carries its status through to the caller, so a wrong path or an
-	/// endpoint that doesn't speak WebTransport can surface immediately rather than after the whole
-	/// reconnect budget.
-	#[test]
-	fn a_rejected_connect_reports_its_status() {
-		for status in [400, 404, 405, 410, 501] {
-			assert_eq!(connect_rejected(status).status(), Some(status));
-			assert!(
-				!crate::error::status_retryable(status),
-				"{status} should stop the reconnect loop"
-			);
-		}
-
-		for status in [408, 429, 502, 503, 504] {
-			assert_eq!(connect_rejected(status).status(), Some(status));
-			assert!(crate::error::status_retryable(status), "{status} should be retried");
-		}
-
-		// Auth is peeled off into its own variant before reaching the generic client arm.
-		assert_eq!(
-			connect_rejected(401).connect_error(),
-			Some(crate::ConnectError::Unauthorized)
-		);
-		assert_eq!(
-			connect_rejected(403).connect_error(),
-			Some(crate::ConnectError::Forbidden)
-		);
-	}
-
-	/// quinn exposes no getters for the flow-control windows, but its `Debug` prints
-	/// them, which is enough to prove each one reached the transport config and that
-	/// an unset knob leaves quinn's own default in place.
-	#[test]
-	fn apply_windows_writes_each_field() {
-		let defaults = format!("{:?}", quinn::TransportConfig::default());
-
-		let mut quic = crate::quic::Config::default();
-		quic.receive_window = Some(64 << 20);
-		quic.stream_receive_window = Some(8 << 20);
-		quic.send_window = Some(32 << 20);
-
-		let mut transport = quinn::TransportConfig::default();
-		apply_windows(&mut transport, &quic.resolve());
-		let applied = format!("{:?}", transport);
-
-		for field in [
-			format!("receive_window: {}", 64 << 20),
-			format!("stream_receive_window: {}", 8 << 20),
-			format!("send_window: {}", 32 << 20),
-		] {
-			assert!(applied.contains(&field), "{field} missing from {applied}");
-		}
-
-		let mut untouched = quinn::TransportConfig::default();
-		apply_windows(&mut untouched, &crate::quic::Config::default().resolve());
-		assert_eq!(format!("{:?}", untouched), defaults);
-	}
-
-	/// Build a controller from each family's factory and downcast it to the
-	/// concrete quinn implementation it must map to.
-	#[test]
-	fn congestion_factory_maps_each_family() {
-		let now = std::time::Instant::now();
-		let mtu = 1200;
-
-		let loss = congestion_factory(CongestionControl::Loss).build(now, mtu);
-		assert!(loss.into_any().downcast::<quinn::congestion::Cubic>().is_ok());
-
-		let delay = congestion_factory(CongestionControl::Delay).build(now, mtu);
-		assert!(delay.into_any().downcast::<quinn::congestion::Bbr>().is_ok());
-	}
-
-	/// Loopback regression test: a config selecting BBR must produce live
-	/// connections that actually run quinn's BBR controller, on both ends.
-	#[tokio::test]
-	async fn delay_reaches_the_live_connection() {
-		let server_config = listen::Config {
-			bind: Some("127.0.0.1:0".parse().unwrap()),
-			tls: crate::tls::Listen {
-				generate: vec!["localhost".into()],
-				..Default::default()
-			},
-			..Default::default()
-		};
-
-		// One shared tuning for both roles, the way a binary composes them.
-		let mut quic = crate::quic::Config::default();
-		quic.congestion_control = Some(CongestionControl::Delay);
-
-		let server = QuinnServer::new(server_config, &quic, None).expect("server init");
-		let addr = server.local_addr().expect("local addr");
-
-		let accepted = tokio::spawn(async move {
-			let incoming = server.accept().await.expect("no incoming connection");
-			let conn = incoming.accept().expect("accept").await.expect("handshake");
-			conn.congestion_state()
-				.into_any()
-				.downcast::<quinn::congestion::Bbr>()
-				.is_ok()
-		});
-
-		// tls::Client has a private field, so it can't be built with a struct literal.
-		let mut tls_config = crate::tls::Connect::default();
-		tls_config.insecure = Some(true);
-
-		let client_config = connect::Config {
-			bind: Some("127.0.0.1:0".parse().unwrap()),
-			tls: tls_config,
-			..Default::default()
-		};
-
-		let tls = client_config.tls.build().expect("tls config");
-		let client = QuinnClient::new(&client_config, &quic).expect("client init");
-		// Dial the loopback IP directly so the system resolver is never involved.
-		let url: Url = format!("moqt://127.0.0.1:{}", addr.port()).parse().unwrap();
-
-		// Bound the whole connect + accept + assert flow so a handshake
-		// regression fails fast instead of stalling CI.
-		tokio::time::timeout(Duration::from_secs(5), async move {
-			let session = client
-				.connect(&tls, url.into(), &moq_net::Versions::default())
-				.await
-				.expect("connect failed");
-
-			// web_transport_quinn::Session derefs to the quinn connection.
-			assert!(
-				session
-					.congestion_state()
-					.into_any()
-					.downcast::<quinn::congestion::Bbr>()
-					.is_ok(),
-				"client connection is not running BBR"
-			);
-			assert!(
-				accepted.await.expect("server task panicked"),
-				"server connection is not running BBR"
-			);
-		})
-		.await
-		.expect("test timed out");
-	}
-	#[tokio::test]
-	async fn fixed_addresses_verify_hostname_fail_over_and_share_endpoint() {
-		tokio::time::pause();
-		let rcgen::CertifiedKey { cert, signing_key } =
-			rcgen::generate_simple_self_signed(["relay.invalid".to_string()]).unwrap();
-		let cert = rustls::pki_types::CertificateDer::from(cert);
-		let key = rustls::pki_types::PrivatePkcs8KeyDer::from(signing_key.serialize_der());
-		let provider = crate::crypto::provider();
-		let mut server_tls = rustls::ServerConfig::builder_with_provider(provider.clone())
-			.with_safe_default_protocol_versions()
-			.unwrap()
-			.with_no_client_auth()
-			.with_single_cert(vec![cert.clone()], key.into())
-			.unwrap();
-		server_tls.alpn_protocols = moq_net::Versions::default()
-			.alpns()
-			.iter()
-			.map(|a| a.as_bytes().to_vec())
-			.collect();
-		let server = quinn::Endpoint::server(
-			quinn::ServerConfig::with_crypto(Arc::new(
-				quinn::crypto::rustls::QuicServerConfig::try_from(server_tls).unwrap(),
-			)),
-			"127.0.0.1:0".parse().unwrap(),
-		)
-		.unwrap();
-		let peer = server.local_addr().unwrap();
-		let accepted = tokio::spawn(async move {
-			let mut conns = Vec::new();
-			for _ in 0..2 {
-				let conn = server.accept().await.unwrap().await.unwrap();
-				let handshake = conn
-					.handshake_data()
-					.unwrap()
-					.downcast::<quinn::crypto::rustls::HandshakeData>()
-					.unwrap();
-				assert_eq!(handshake.server_name.as_deref(), Some("relay.invalid"));
-				conns.push(conn);
-			}
-			assert_eq!(conns[0].remote_address(), conns[1].remote_address());
-			(server, conns)
-		});
-		let mut roots = rustls::RootCertStore::empty();
-		roots.add(cert).unwrap();
-		let tls = rustls::ClientConfig::builder_with_provider(provider)
-			.with_safe_default_protocol_versions()
-			.unwrap()
-			.with_root_certificates(roots)
-			.with_no_client_auth();
-		let client = QuinnClient::new(&connect::Config::default(), &crate::quic::Config::default()).unwrap();
-		let url = format!("moqt://relay.invalid:{}", peer.port()).parse().unwrap();
-		let blocked = std::net::SocketAddr::new("127.0.0.2".parse().unwrap(), peer.port());
-		let addr = connect::Addr::pinned(url, [blocked, peer]).unwrap();
-		let first = client
-			.connect(&tls, addr.clone(), &moq_net::Versions::default())
-			.await
-			.unwrap();
-		let second = client
-			.clone()
-			.connect(&tls, addr, &moq_net::Versions::default())
-			.await
-			.unwrap();
-		let _accepted = accepted.await.unwrap();
-		drop((first, second));
-	}
-}
diff --git a/rs/moq-tokio/src/resolve.rs b/rs/moq-tokio/src/resolve.rs
index 1b3e87919c..7410cae79a 100644
--- a/rs/moq-tokio/src/resolve.rs
+++ b/rs/moq-tokio/src/resolve.rs
@@ -284,7 +284,7 @@ impl Candidates {
 	/// are handed out anyway so the dial surfaces the OS error instead of a
 	/// confusing "no DNS entries". See <https://github.com/moq-dev/moq/issues/1375>
 	/// for the Windows failure this family matching originally fixed.
-	#[cfg(any(feature = "noq", feature = "quinn", feature = "quiche", test))]
+	#[cfg(any(feature = "noq", test))]
 	pub(crate) fn with_local(mut self, local: SocketAddr, dual_stack: bool) -> Self {
 		self.local = Some((local, dual_stack));
 		self
@@ -292,11 +292,7 @@ impl Candidates {
 
 	/// Hand out at most `max` candidates.
 	///
-	/// For a backend that can't run overlapping attempts: quiche binds a socket
-	/// per attempt, and a pinned source port only fits one at a time. That one
-	/// attempt goes to the platform's own first choice, so this must not be paired
-	/// with an order we invented.
-	#[cfg(any(feature = "quiche", test))]
+	#[cfg(test)]
 	pub(crate) fn with_limit(mut self, max: usize) -> Self {
 		self.limit = max;
 		self
@@ -619,8 +615,7 @@ mod tests {
 		assert_eq!(drain(candidates).await, addrs(&["[2001:db8::1]:443", "1.2.3.4:443"]));
 	}
 
-	/// quiche pins its source port and so gets one attempt only. It has to be the
-	/// address the platform put first, or an IPv4-only host loses its only shot.
+	/// A limited candidate set keeps the platform's first address.
 	#[tokio::test]
 	async fn a_single_attempt_follows_the_resolver() {
 		let candidates = answered(&["1.2.3.4:443", "[2001:db8::1]:443"]).with_limit(1);
diff --git a/rs/moq-tokio/src/server.rs b/rs/moq-tokio/src/server.rs
index 508798e9c3..1980499f4d 100644
--- a/rs/moq-tokio/src/server.rs
+++ b/rs/moq-tokio/src/server.rs
@@ -9,8 +9,6 @@ use std::net;
 use std::path::PathBuf;
 
 use crate::Error;
-#[cfg(any(feature = "noq", feature = "quinn", feature = "quiche"))]
-use crate::QuicBackend;
 #[cfg(feature = "iroh")]
 use crate::iroh;
 use moq_net::Session;
@@ -18,13 +16,7 @@ use url::Url;
 
 // Only the transports that finish their handshake in a spawned future need `.boxed()`;
 // the stream listeners hand back an already-built `Request`.
-#[cfg(any(
-	feature = "noq",
-	feature = "quinn",
-	feature = "quiche",
-	feature = "iroh",
-	feature = "websocket"
-))]
+#[cfg(any(feature = "noq", feature = "iroh", feature = "websocket"))]
 use futures::FutureExt;
 use futures::future::BoxFuture;
 use futures::stream::FuturesUnordered;
@@ -94,7 +86,7 @@ impl crate::listen::Config {
 }
 
 /// Default bind address used when [`crate::listen::Config::bind`] is not set.
-#[cfg(any(feature = "noq", feature = "quinn", feature = "quiche"))]
+#[cfg(feature = "noq")]
 pub(crate) const DEFAULT_BIND: net::SocketAddr =
 	net::SocketAddr::V6(net::SocketAddrV6::new(net::Ipv6Addr::UNSPECIFIED, 443, 0, 0));
 
@@ -117,10 +109,7 @@ pub(crate) enum Parts {
 	/// The QUIC listener only, as one member of a `SO_REUSEPORT` group. Folding
 	/// the member in here is what stops a group member and a stream-only server
 	/// from being asked for at once.
-	#[cfg_attr(
-		not(any(feature = "noq", feature = "quinn", feature = "quiche")),
-		expect(dead_code, reason = "no QUIC backend is compiled in")
-	)]
+	#[cfg_attr(not(feature = "noq"), expect(dead_code, reason = "no QUIC backend is compiled in"))]
 	Member(crate::listen::Member),
 }
 
@@ -142,10 +131,7 @@ impl Parts {
 	/// This server's claim on a slot in the group, when it is a member of one.
 	/// Consuming, because binding it is what joins the group and only one
 	/// backend does that.
-	#[cfg_attr(
-		not(any(feature = "noq", feature = "quinn", feature = "quiche")),
-		expect(dead_code, reason = "no QUIC backend is compiled in")
-	)]
+	#[cfg_attr(not(feature = "noq"), expect(dead_code, reason = "no QUIC backend is compiled in"))]
 	fn member(self) -> Option<crate::listen::Member> {
 		match self {
 			Self::Member(member) => Some(member),
@@ -202,7 +188,7 @@ impl Config {
 	}
 
 	/// Copy the settings one QUIC worker owns.
-	#[cfg(any(feature = "noq", feature = "quinn", feature = "quiche"))]
+	#[cfg(feature = "noq")]
 	pub(crate) fn worker(&self) -> Self {
 		Self {
 			listen: self.listen.clone(),
@@ -233,10 +219,6 @@ pub struct Server {
 	iroh: Option<iroh::Endpoint>,
 	#[cfg(feature = "noq")]
 	noq: Option<crate::noq::NoqServer>,
-	#[cfg(feature = "quinn")]
-	quinn: Option<crate::quinn::QuinnServer>,
-	#[cfg(feature = "quiche")]
-	quiche: Option<crate::quiche::QuicheServer>,
 	#[cfg(feature = "websocket")]
 	websocket: Option<crate::websocket::Listener>,
 }
@@ -253,12 +235,10 @@ pub struct Server {
 /// only caller.
 #[derive(Clone, Debug)]
 #[allow(dead_code)]
-#[cfg(any(feature = "noq", feature = "quinn", feature = "quiche"))]
+#[cfg(feature = "noq")]
 pub(crate) struct SocketRetainer {
 	#[cfg(feature = "noq")]
 	noq: Option<web_transport_noq::noq::Endpoint>,
-	#[cfg(feature = "quinn")]
-	quinn: Option<quinn::Endpoint>,
 }
 
 impl Server {
@@ -296,11 +276,6 @@ impl Server {
 		// gets the released spellings folded in too.
 		config.validate()?;
 
-		// `default_quic_backend` panics when no backend is compiled, so a WebSocket- or
-		// stream-only build must not ask it.
-		#[cfg(any(feature = "noq", feature = "quinn", feature = "quiche"))]
-		let backend = config.backend.clone().unwrap_or_else(crate::default_quic_backend);
-
 		let versions = config.versions();
 
 		// Build a QUIC backend when `--listen` is set, or when nothing else
@@ -315,28 +290,17 @@ impl Server {
 		// `parts.quic()` and not `build_quic`: a caller that asked for streams only
 		// is not asking for a backend, while leaving everything else configured is
 		// still the error it always was.
-		#[cfg(not(any(feature = "noq", feature = "quinn", feature = "quiche")))]
+		#[cfg(not(feature = "noq"))]
 		if config.bind.is_some() && parts.quic() {
-			return Err(Error::NoBackend(
-				"--listen requires a noq, quinn, or quiche backend feature",
-			));
+			return Err(Error::NoBackend("--listen requires the noq feature"));
 		}
 
 		if build_quic && !config.tls.root.is_empty() {
-			// Only a QUIC backend validates client certificates; the qmux listeners
+			// Only the QUIC backend validates client certificates; the qmux listeners
 			// (tcp/unix/websocket) carry no TLS of their own.
-			#[cfg(any(feature = "noq", feature = "quinn", feature = "quiche"))]
-			let mtls_supported = match backend {
-				#[cfg(feature = "quinn")]
-				QuicBackend::Quinn => true,
-				#[cfg(feature = "noq")]
-				QuicBackend::Noq => true,
-				#[cfg(feature = "quiche")]
-				QuicBackend::Quiche => true,
-				#[allow(unreachable_patterns)]
-				_ => false,
-			};
-			#[cfg(not(any(feature = "noq", feature = "quinn", feature = "quiche")))]
+			#[cfg(feature = "noq")]
+			let mtls_supported = true;
+			#[cfg(not(feature = "noq"))]
 			let mtls_supported = false;
 
 			if !mtls_supported {
@@ -345,33 +309,14 @@ impl Server {
 		}
 
 		// The member is a claim on a slot in a reuseport group, which binding
-		// spends, so exactly one backend may take it.
-		#[cfg(any(feature = "noq", feature = "quinn", feature = "quiche"))]
-		let mut member = parts.member();
-
+		// spends, so the backend may take it only once.
 		#[cfg(feature = "noq")]
-		#[allow(unreachable_patterns)]
-		let noq = match backend {
-			QuicBackend::Noq if build_quic => Some(crate::noq::NoqServer::new(config.clone(), &quic, member.take())?),
-			_ => None,
-		};
-
-		#[cfg(feature = "quinn")]
-		#[allow(unreachable_patterns)]
-		let quinn = match backend {
-			QuicBackend::Quinn if build_quic => {
-				Some(crate::quinn::QuinnServer::new(config.clone(), &quic, member.take())?)
-			}
-			_ => None,
-		};
+		let member = parts.member();
 
-		#[cfg(feature = "quiche")]
-		let quiche = match backend {
-			QuicBackend::Quiche if build_quic => {
-				Some(crate::quiche::QuicheServer::new(config.clone(), &quic, member.take())?)
-			}
-			_ => None,
-		};
+		#[cfg(feature = "noq")]
+		let noq = build_quic
+			.then(|| crate::noq::NoqServer::new(config.clone(), &quic, member))
+			.transpose()?;
 
 		// Collect the configured stream listeners (at most one TCP, one Unix).
 		#[cfg(any(feature = "tcp", all(feature = "uds", unix)))]
@@ -413,10 +358,6 @@ impl Server {
 			iroh,
 			#[cfg(feature = "noq")]
 			noq,
-			#[cfg(feature = "quinn")]
-			quinn,
-			#[cfg(feature = "quiche")]
-			quiche,
 			#[cfg(feature = "websocket")]
 			websocket,
 		})
@@ -492,14 +433,6 @@ impl Server {
 		if let Some(noq) = self.noq.as_ref() {
 			return noq.certificates();
 		}
-		#[cfg(feature = "quinn")]
-		if let Some(quinn) = self.quinn.as_ref() {
-			return quinn.certificates();
-		}
-		#[cfg(feature = "quiche")]
-		if let Some(quiche) = self.quiche.as_ref() {
-			return quiche.certificates();
-		}
 		// No QUIC backend (e.g. a stream-only `--listen-tcp-bind`): no certificates.
 		crate::tls::Certificates::empty()
 	}
@@ -508,21 +441,17 @@ impl Server {
 	/// group after this server is gone.
 	///
 	/// Crate-private: only the worker group retains sockets this way. A worker
-	/// member never serves quiche, so there is nothing to retain there.
-	#[cfg(any(feature = "noq", feature = "quinn", feature = "quiche"))]
+	/// member serves the same noq backend as the tokio listener.
+	#[cfg(feature = "noq")]
 	pub(crate) fn retain(&self) -> SocketRetainer {
 		SocketRetainer {
 			#[cfg(feature = "noq")]
 			noq: self.noq.as_ref().map(|server| server.quic.clone()),
-			#[cfg(feature = "quinn")]
-			quinn: self.quinn.as_ref().map(|server| server.quic.clone()),
 		}
 	}
 
 	#[cfg(not(any(
 		feature = "noq",
-		feature = "quinn",
-		feature = "quiche",
 		feature = "iroh",
 		feature = "websocket",
 		feature = "tcp",
@@ -584,8 +513,6 @@ impl Server {
 	/// The body of [`Listener::accept`]; the listeners are already running.
 	#[cfg(any(
 		feature = "noq",
-		feature = "quinn",
-		feature = "quiche",
 		feature = "iroh",
 		feature = "websocket",
 		feature = "tcp",
@@ -594,7 +521,7 @@ impl Server {
 	async fn accept_next(&mut self) -> Option<Request> {
 		loop {
 			// The QUIC endpoint address, reported as a QUIC session's local side.
-			#[cfg(any(feature = "noq", feature = "quinn", feature = "quiche"))]
+			#[cfg(feature = "noq")]
 			let local = self.local_addr().ok();
 
 			// tokio::select! does not support cfg directives on arms, so we need to create the futures here.
@@ -620,28 +547,6 @@ impl Server {
 			#[cfg(not(feature = "iroh"))]
 			let iroh_accept = async { None::<()> };
 
-			#[cfg(feature = "quinn")]
-			let quinn_accept = async {
-				#[cfg(feature = "quinn")]
-				if let Some(quinn) = self.quinn.as_mut() {
-					return quinn.accept().await;
-				}
-				None
-			};
-			#[cfg(not(feature = "quinn"))]
-			let quinn_accept = async { None::<()> };
-
-			#[cfg(feature = "quiche")]
-			let quiche_accept = async {
-				#[cfg(feature = "quiche")]
-				if let Some(quiche) = self.quiche.as_mut() {
-					return quiche.accept().await;
-				}
-				None
-			};
-			#[cfg(not(feature = "quiche"))]
-			let quiche_accept = async { None::<()> };
-
 			#[cfg(feature = "websocket")]
 			let ws_ref = self.websocket.as_ref();
 			#[cfg(feature = "websocket")]
@@ -687,30 +592,6 @@ impl Server {
 						}.boxed());
 					}
 				}
-				Some(_conn) = quinn_accept => {
-					#[cfg(feature = "quinn")]
-					{
-						let alpns = versions.alpns();
-						self.accept.push(async move {
-							let Accepted { session, url, identity, authority, mut link } = super::quinn::accept(_conn, alpns).await?;
-							link.local = local;
-							let request = server.accept_request(crate::runtime::Runtime::new(), session).await?;
-							Ok(Request { transport: Transport::Quic, url, identity, authority, link, kind: RequestKind::Quinn(Box::new(request)) })
-						}.boxed());
-					}
-				}
-				Some(_conn) = quiche_accept => {
-					#[cfg(feature = "quiche")]
-					{
-						let alpns = versions.alpns();
-						self.accept.push(async move {
-							let Accepted { session, url, identity, authority, mut link } = super::quiche::accept(_conn, alpns).await?;
-							link.local = local;
-							let request = server.accept_request(crate::runtime::Runtime::new(), session).await?;
-							Ok(Request { transport: Transport::Quic, url, identity, authority, link, kind: RequestKind::Quiche(Box::new(request)) })
-						}.boxed());
-					}
-				}
 				Some(_conn) = iroh_accept => {
 					#[cfg(feature = "iroh")]
 					self.accept.push(async move {
@@ -770,14 +651,6 @@ impl Server {
 		if let Some(noq) = self.noq.as_ref() {
 			return Ok(noq.local_addr()?);
 		}
-		#[cfg(feature = "quinn")]
-		if let Some(quinn) = self.quinn.as_ref() {
-			return Ok(quinn.local_addr()?);
-		}
-		#[cfg(feature = "quiche")]
-		if let Some(quiche) = self.quiche.as_ref() {
-			return Ok(quiche.local_addr()?);
-		}
 		// No QUIC backend (e.g. a stream-only `--listen-tcp-bind`).
 		Err(Error::NoBackend("no QUIC listener configured"))
 	}
@@ -799,14 +672,6 @@ impl Server {
 		if self.noq.is_some() {
 			tokio::time::sleep(std::time::Duration::from_millis(100)).await;
 		}
-		#[cfg(feature = "quinn")]
-		if self.quinn.is_some() {
-			tokio::time::sleep(std::time::Duration::from_millis(100)).await;
-		}
-		#[cfg(feature = "quiche")]
-		if self.quiche.is_some() {
-			tokio::time::sleep(std::time::Duration::from_millis(100)).await;
-		}
 		#[cfg(feature = "iroh")]
 		if let Some(iroh) = self.iroh.take() {
 			iroh.close().await;
@@ -823,14 +688,6 @@ impl Server {
 		if let Some(noq) = self.noq.as_mut() {
 			noq.close();
 		}
-		#[cfg(feature = "quinn")]
-		if let Some(quinn) = self.quinn.as_mut() {
-			quinn.close();
-		}
-		#[cfg(feature = "quiche")]
-		if let Some(quiche) = self.quiche.as_mut() {
-			quiche.close();
-		}
 	}
 }
 
@@ -1191,10 +1048,6 @@ type PendingRequest<S> = moq_net::server::Handshake<S, crate::runtime::Runtime<S
 pub(crate) enum RequestKind {
 	#[cfg(feature = "noq")]
 	Noq(Box<PendingRequest<crate::transport::Session<web_transport_noq::Session>>>),
-	#[cfg(feature = "quinn")]
-	Quinn(Box<PendingRequest<web_transport_quinn::Session>>),
-	#[cfg(feature = "quiche")]
-	Quiche(Box<PendingRequest<web_transport_quiche::Connection>>),
 	#[cfg(feature = "iroh")]
 	Iroh(Box<PendingRequest<crate::transport::Session<web_transport_iroh::Session>>>),
 	#[cfg(any(feature = "tcp", all(feature = "uds", unix), feature = "websocket"))]
@@ -1204,7 +1057,7 @@ pub(crate) enum RequestKind {
 /// The transport-level facts a backend captures while accepting a connection, before the
 /// MoQ SETUP. Grouped so the shared accept loop builds a [`Request`] from named fields
 /// rather than a wide tuple.
-#[cfg(any(feature = "noq", feature = "quinn", feature = "quiche", feature = "iroh"))]
+#[cfg(any(feature = "noq", feature = "iroh"))]
 pub(crate) struct Accepted<S> {
 	pub session: S,
 	pub url: Option<Url>,
@@ -1307,10 +1160,6 @@ macro_rules! request_ref {
 		match &$self.kind {
 			#[cfg(feature = "noq")]
 			RequestKind::Noq($r) => $body,
-			#[cfg(feature = "quinn")]
-			RequestKind::Quinn($r) => $body,
-			#[cfg(feature = "quiche")]
-			RequestKind::Quiche($r) => $body,
 			#[cfg(feature = "iroh")]
 			RequestKind::Iroh($r) => $body,
 			#[cfg(any(feature = "tcp", all(feature = "uds", unix), feature = "websocket"))]
@@ -1325,10 +1174,6 @@ macro_rules! request_into {
 		match $kind {
 			#[cfg(feature = "noq")]
 			RequestKind::Noq($r) => $body,
-			#[cfg(feature = "quinn")]
-			RequestKind::Quinn($r) => $body,
-			#[cfg(feature = "quiche")]
-			RequestKind::Quiche($r) => $body,
 			#[cfg(feature = "iroh")]
 			RequestKind::Iroh($r) => $body,
 			#[cfg(any(feature = "tcp", all(feature = "uds", unix), feature = "websocket"))]
@@ -1343,10 +1188,6 @@ macro_rules! request_map {
 		match $kind {
 			#[cfg(feature = "noq")]
 			RequestKind::Noq($r) => RequestKind::Noq(Box::new($body)),
-			#[cfg(feature = "quinn")]
-			RequestKind::Quinn($r) => RequestKind::Quinn(Box::new($body)),
-			#[cfg(feature = "quiche")]
-			RequestKind::Quiche($r) => RequestKind::Quiche(Box::new($body)),
 			#[cfg(feature = "iroh")]
 			RequestKind::Iroh($r) => RequestKind::Iroh(Box::new($body)),
 			#[cfg(any(feature = "tcp", all(feature = "uds", unix), feature = "websocket"))]
@@ -1475,8 +1316,8 @@ impl Request {
 	/// The host authority the client dialed, or `None` when the client offered none or the
 	/// transport carries no host (iroh, stream bindings).
 	///
-	/// Reported as offered: rustls clients send no SNI for an IP-literal dial (RFC 6066), so
-	/// quinn/noq see `None`, while BoringSSL clients do send one, so quiche sees the IP.
+	/// Reported as offered: rustls sends no SNI for an IP-literal dial (RFC 6066),
+	/// so noq reports `None`.
 	///
 	/// Not the moq-net IETF SETUP `Authority` parameter. Client-asserted and not authenticated,
 	/// so authorize on the token or [`Self::peer_identity`] rather than on this value.
@@ -1558,8 +1399,8 @@ impl Request {
 	/// The client certificate chain the peer presented, if any, validated
 	/// against a configured [`crate::tls::Listen::root`] during the handshake.
 	///
-	/// Captured at the transport handshake (before the SETUP). Only the Quinn and noq
-	/// backends support mTLS; other transports always return `None`. Use it to grant
+	/// Captured at the transport handshake (before the SETUP). Noq supports mTLS;
+	/// other transports always return `None`. Use it to grant
 	/// elevated access or to close the session once the certificate expires (see
 	/// [`crate::tls::PeerIdentity::expiry`]).
 	pub fn peer_identity(&self) -> Option<crate::tls::PeerIdentity> {
@@ -1793,7 +1634,7 @@ mod tests {
 	}
 
 	/// An explicit QUIC bind cannot be honored without a QUIC backend.
-	#[cfg(not(any(feature = "noq", feature = "quinn", feature = "quiche")))]
+	#[cfg(not(feature = "noq"))]
 	#[test]
 	fn quic_bind_without_a_quic_backend_is_rejected() {
 		let config = crate::listen::Config {
@@ -1813,7 +1654,7 @@ mod tests {
 
 	/// A QUIC-only server reports nothing. It multiplexes over one UDP socket and
 	/// never calls `accept`, so a zero counter would be a watch that cannot fire.
-	#[cfg(all(feature = "quinn", not(feature = "tcp")))]
+	#[cfg(all(feature = "noq", not(feature = "tcp")))]
 	#[test]
 	fn accept_health_is_empty_without_a_stream_listener() {
 		let server = crate::listen::Config::default()
@@ -1833,7 +1674,7 @@ mod tests {
 
 	/// Building the endpoint needs a runtime, and `certificates()` must stay
 	/// readable without one (no guard escapes to the caller).
-	#[cfg(feature = "quinn")]
+	#[cfg(feature = "noq")]
 	#[tokio::test]
 	async fn certificates_expose_generated_fingerprints() {
 		let mut config = crate::listen::Config {
diff --git a/rs/moq-tokio/src/settings.rs b/rs/moq-tokio/src/settings.rs
index 8821781aec..72211afdda 100644
--- a/rs/moq-tokio/src/settings.rs
+++ b/rs/moq-tokio/src/settings.rs
@@ -14,9 +14,6 @@ pub struct Listen {
 	#[usage(env = "MOQ_LISTEN", cli("--listen"))]
 	bind: Option<String>,
 
-	#[usage(env = "MOQ_LISTEN_BACKEND", cli("--listen-backend"))]
-	backend: Option<String>,
-
 	#[usage(env = "MOQ_LISTEN_VERSION", cli("--listen-version"), parse = "list_by_comma")]
 	version: Option<Vec<String>>,
 
@@ -124,9 +121,6 @@ pub struct Connect {
 	#[usage(env = "MOQ_CONNECT_BIND", cli("--connect-bind"))]
 	bind: Option<String>,
 
-	#[usage(env = "MOQ_CONNECT_BACKEND", cli("--connect-backend"))]
-	backend: Option<String>,
-
 	#[usage(env = "MOQ_CONNECT_RACE", cli("--connect-race"))]
 	race: Option<String>,
 
diff --git a/rs/moq-tokio/src/tls.rs b/rs/moq-tokio/src/tls.rs
index bace2a16b7..145a11b498 100644
--- a/rs/moq-tokio/src/tls.rs
+++ b/rs/moq-tokio/src/tls.rs
@@ -6,12 +6,9 @@
 //! startup, and optionally the roots that authenticate mTLS clients.
 //!
 //! Certificates, keys, and custom root CAs loaded from disk are hot reloaded for
-//! new handshakes. A quiche server is the exception for the mTLS client roots
-//! ([`Listen::root`]), which boringssl fixes when the listener is built; the
-//! certificates it serves reload like every other backend's. [`Certificates`]
-//! reads the current served set back out.
+//! new handshakes. [`Certificates`] reads the current served set back out.
 
-#[cfg(any(feature = "quinn", feature = "noq", feature = "quiche"))]
+#[cfg(feature = "noq")]
 use crate::abort::AbortOnDrop;
 use crate::crypto;
 use rustls::pki_types::pem::PemObject;
@@ -27,8 +24,7 @@ use rustls::pki_types::PrivatePkcs8KeyDer;
 
 /// Errors loading or generating TLS certificates and keys.
 ///
-/// Shared by the client TLS config and the quinn/noq servers so each backend's
-/// error type can compose it via `#[from]`.
+/// Shared by the client TLS config and noq server.
 #[derive(Debug, thiserror::Error)]
 #[non_exhaustive]
 pub enum Error {
@@ -83,10 +79,6 @@ pub enum Error {
 	)]
 	ConflictingClientAuth,
 
-	/// A pinned peer set was configured on a backend that cannot run a rustls verifier.
-	#[error("the quiche backend cannot pin client fingerprints; use the quinn or noq backend")]
-	PeersUnsupported,
-
 	/// Client pinning was combined with client CA roots. Pinning bypasses the chain,
 	/// so one of the two would be silently ignored.
 	#[error("a client fingerprint allowlist cannot be combined with client CA roots: pinning bypasses CA verification")]
@@ -201,19 +193,11 @@ fn read_roots(paths: &[PathBuf]) -> Result<Vec<CertificateDer<'static>>> {
 
 // ── Certified ───────────────────────────────────────────────────────
 
-/// A certificate chain with both usable forms of its private key.
-///
-/// rustls signs through an opaque [`rustls::sign::SigningKey`], which is all the
-/// quinn and noq backends need. quiche hands the key to boringssl itself, so the
-/// DER is kept alongside the signer instead of being dropped once loaded, and one
-/// certificate source feeds every backend.
+/// A certificate chain and its rustls signing key.
 #[cfg(feature = "_certs")]
 pub(crate) struct Certified {
 	/// The chain and its rustls signer, in leaf-first order.
 	pub rustls: Arc<rustls::sign::CertifiedKey>,
-	/// The same private key, still in DER, for backends that load it themselves.
-	#[cfg_attr(not(feature = "quiche"), allow(dead_code))]
-	pub key: PrivateKeyDer<'static>,
 }
 
 #[cfg(feature = "_certs")]
@@ -227,16 +211,9 @@ impl Certified {
 		let signer = provider.key_provider.load_private_key(key.clone_key())?;
 		Ok(Self {
 			rustls: Arc::new(rustls::sign::CertifiedKey::new(chain, signer)),
-			key,
 		})
 	}
 
-	/// The certificate chain, leaf first.
-	#[cfg_attr(not(feature = "quiche"), allow(dead_code))]
-	pub fn chain(&self) -> &[CertificateDer<'static>] {
-		&self.rustls.cert
-	}
-
 	/// The leaf certificate, which is what a fingerprint identifies.
 	pub fn leaf(&self) -> &CertificateDer<'static> {
 		// `new` and `Identity::generate` are the only constructors and both reject an
@@ -672,7 +649,7 @@ impl CustomRoots {
 		})
 	}
 
-	#[cfg(any(feature = "watch", feature = "quiche"))]
+	#[cfg(feature = "watch")]
 	fn load(&self) -> Result<Vec<CertificateDer<'static>>> {
 		read_roots(&self.paths)
 	}
@@ -689,33 +666,6 @@ impl CustomRoots {
 			.unwrap_or_else(std::sync::PoisonError::into_inner)
 			.clone()
 	}
-
-	/// Refresh from disk, retaining and returning the last valid roots on failure.
-	#[cfg(feature = "quiche")]
-	pub(crate) fn refresh(&self) -> Vec<CertificateDer<'static>> {
-		self.refresh_with(|| self.load())
-	}
-
-	#[cfg(feature = "quiche")]
-	fn refresh_with(
-		&self,
-		load: impl FnOnce() -> Result<Vec<CertificateDer<'static>>>,
-	) -> Vec<CertificateDer<'static>> {
-		let mut current = self.current.write().unwrap_or_else(std::sync::PoisonError::into_inner);
-		match load().and_then(|roots| {
-			root_store(&roots)?;
-			Ok(roots)
-		}) {
-			Ok(roots) => {
-				*current = roots.clone();
-				roots
-			}
-			Err(err) => {
-				tracing::warn!(%err, "failed to reload client root certificates; retaining previous roots");
-				current.clone()
-			}
-		}
-	}
 }
 
 #[cfg(feature = "watch")]
@@ -798,10 +748,7 @@ impl<T: ?Sized + Send + Sync + 'static> std::fmt::Debug for Reloading<T> {
 
 /// The resolved server-certificate verification policy.
 ///
-/// Computed once by [Client::verification] and shared by every backend (the
-/// rustls-based quinn/noq via [Client::build], and quiche directly) so they
-/// agree on precedence, the system-roots default, and which flag combinations
-/// are valid.
+/// Computed once by [Client::verification] and used by [Client::build].
 #[derive(Clone)]
 pub(crate) enum Verification {
 	/// No verification at all. Insecure; only via `--connect-tls-insecure`.
@@ -812,8 +759,7 @@ pub(crate) enum Verification {
 	Fingerprints(Vec<[u8; 32]>),
 
 	/// Standard CA verification. When `system` is set the platform/default trust
-	/// store is trusted too; each backend resolves that its own way (the rustls
-	/// backends use the OS platform verifier, quiche loads the native roots).
+	/// store is trusted too; noq uses the OS platform verifier.
 	/// `custom` are extra PEM roots trusted in addition.
 	Roots { custom: CustomRoots, system: bool },
 }
@@ -977,7 +923,7 @@ impl Connect {
 	/// plaintext fetch, and there is nothing to bootstrap when verification is
 	/// disabled. With CA roots (the default), `http://` is the deliberate
 	/// per-connection way to pin a self-signed relay, so it is allowed.
-	#[cfg(any(feature = "noq", feature = "quinn", feature = "quiche"))]
+	#[cfg(feature = "noq")]
 	pub(crate) fn allows_http_bootstrap(&self) -> bool {
 		self.fingerprint.is_empty() && !self.insecure.unwrap_or_default()
 	}
@@ -1173,8 +1119,7 @@ fn generate(provider: &crypto::Provider, hostnames: &[String]) -> Result<Certifi
 	Certified::new(provider, vec![cert.into()], key.into())
 }
 
-/// Refuse at runtime what the crate cannot do at all: quiche brings its own TLS,
-/// so it serves certificates without a rustls provider to sign a fresh one with.
+/// Refuse at runtime when no crypto provider can sign a fresh certificate.
 #[cfg(all(feature = "_certs", not(any(feature = "aws-lc-rs", feature = "ring"))))]
 fn generate(_provider: &crypto::Provider, _hostnames: &[String]) -> Result<Certified> {
 	Err(Error::NoCryptoProvider)
@@ -1295,9 +1240,7 @@ pub struct Listen {
 	/// do not present a certificate are unaffected.
 	///
 	/// Plain-TLS listeners built via [`Self::server_config`] also use these roots
-	/// for optional mTLS. Root files are hot reloaded for new handshakes on the
-	/// rustls-based backends; quiche servers require a restart because their TLS
-	/// hook fixes client-auth roots when the listener is built.
+	/// for optional mTLS. Root files are hot reloaded for new handshakes.
 	#[usage(
 		long = "listen-tls-root",
 		name = "listen-tls-root",
@@ -1440,8 +1383,8 @@ impl Listen {
 	/// The client-certificate policy for this listener, or `None` to ask for no
 	/// certificate at all.
 	///
-	/// The one place the three server backends agree on what mTLS means here, so
-	/// a new mode lands once rather than in each of them: pinned [`peers`](Self::peers),
+	/// The one place the TLS listeners agree on what mTLS means here, so a new
+	/// mode lands once rather than in each of them: pinned [`peers`](Self::peers),
 	/// else optional CA-rooted [`root`](Self::root), else nothing.
 	#[cfg(feature = "_certs")]
 	pub(crate) fn client_auth(
@@ -1552,10 +1495,10 @@ pub struct PeerIdentity {
 }
 
 impl PeerIdentity {
-	/// Wrap the type-erased identity from `quinn::Connection::peer_identity`.
+	/// Wrap the type-erased identity from the QUIC connection.
 	/// Returns `None` if the peer presented no certificate or the identity is
 	/// not a certificate chain.
-	#[cfg(any(feature = "quinn", feature = "noq"))]
+	#[cfg(feature = "noq")]
 	pub(crate) fn from_any(identity: Option<Box<dyn std::any::Any>>) -> Option<Self> {
 		let chain = identity?.downcast::<Vec<CertificateDer<'static>>>().ok()?;
 		Some(Self { chain: *chain })
@@ -2014,7 +1957,7 @@ impl rustls::client::danger::ServerCertVerifier for FingerprintVerifier {
 }
 
 #[cfg(test)]
-#[cfg(all(any(feature = "quinn", feature = "noq", feature = "quiche"), feature = "aws-lc-rs"))]
+#[cfg(all(feature = "noq", feature = "aws-lc-rs"))]
 mod tests {
 	/// Disabling verification cannot be combined with trust material that it would
 	/// otherwise ignore.
@@ -2076,7 +2019,7 @@ mod tests {
 		params.self_signed(&key).unwrap().into()
 	}
 
-	#[cfg(any(feature = "quinn", feature = "noq"))]
+	#[cfg(feature = "noq")]
 	#[test]
 	fn peer_identity_expiry_reads_not_after() {
 		// notAfter at a whole second so the round-trip is exact.
@@ -2087,7 +2030,7 @@ mod tests {
 		params.not_after = not_after;
 		let cert: CertificateDer<'static> = params.self_signed(&key).unwrap().into();
 
-		// quinn/noq hand back the chain as a boxed Vec<CertificateDer>.
+		// noq hand back the chain as a boxed Vec<CertificateDer>.
 		let identity: Box<dyn std::any::Any> = Box::new(vec![cert]);
 		let parsed = PeerIdentity::from_any(Some(identity)).expect("chain parsed");
 		let expiry = parsed.expiry().expect("expiry parsed");
@@ -2097,7 +2040,7 @@ mod tests {
 		);
 	}
 
-	#[cfg(any(feature = "quinn", feature = "noq"))]
+	#[cfg(feature = "noq")]
 	#[test]
 	fn peer_identity_none_without_chain() {
 		assert!(PeerIdentity::from_any(None).is_none());
@@ -2200,7 +2143,7 @@ mod tests {
 	/// keeps its task, an OS directory watch, and the certificate keys alive for the
 	/// rest of the process. The `Arc` is the observable half: while the task lives it
 	/// holds one, so a `Weak` that still upgrades is a watcher that never stopped.
-	#[cfg(all(feature = "watch", any(feature = "quinn", feature = "noq", feature = "quiche")))]
+	#[cfg(all(feature = "watch", feature = "noq"))]
 	#[tokio::test]
 	async fn dropping_the_reload_guard_stops_the_watcher() {
 		let key = rcgen::KeyPair::generate().unwrap();
@@ -2335,7 +2278,7 @@ mod tests {
 
 	/// A resumed handshake skips certificate verification, so a listener with a
 	/// live peer set must disable resumption for removals to take effect.
-	#[cfg(all(feature = "watch", any(feature = "quinn", feature = "noq", feature = "quiche")))]
+	#[cfg(all(feature = "watch", feature = "noq"))]
 	#[test]
 	fn removed_peers_cannot_resume() {
 		let server_identity = Identity::generate(["localhost"]).unwrap();
@@ -2476,7 +2419,7 @@ mod tests {
 		(file, path)
 	}
 
-	#[cfg(all(feature = "watch", any(feature = "quinn", feature = "noq", feature = "quiche")))]
+	#[cfg(all(feature = "watch", feature = "noq"))]
 	fn signed_certificates() -> (
 		String,
 		CertificateDer<'static>,
@@ -2513,7 +2456,7 @@ mod tests {
 		)
 	}
 
-	#[cfg(all(feature = "watch", any(feature = "quinn", feature = "noq", feature = "quiche")))]
+	#[cfg(all(feature = "watch", feature = "noq"))]
 	fn handshake_kinds(
 		client: Arc<rustls::ClientConfig>,
 		server: Arc<rustls::ServerConfig>,
@@ -2545,7 +2488,7 @@ mod tests {
 		panic!("TLS handshake did not settle");
 	}
 
-	#[cfg(all(feature = "watch", any(feature = "quinn", feature = "noq", feature = "quiche")))]
+	#[cfg(all(feature = "watch", feature = "noq"))]
 	#[test]
 	fn reloadable_roots_disable_session_resumption() {
 		use std::io::Write;
@@ -2596,7 +2539,7 @@ mod tests {
 		);
 	}
 
-	#[cfg(all(feature = "watch", any(feature = "quinn", feature = "noq", feature = "quiche")))]
+	#[cfg(all(feature = "watch", feature = "noq"))]
 	#[test]
 	fn reloadable_client_roots_disable_server_resumption() {
 		use std::io::Write;
@@ -2670,7 +2613,7 @@ mod tests {
 		assert!(handshake_kinds(reloadable_client, reloadable).is_err());
 	}
 
-	#[cfg(all(feature = "watch", any(feature = "quinn", feature = "noq", feature = "quiche")))]
+	#[cfg(all(feature = "watch", feature = "noq"))]
 	#[test]
 	fn custom_roots_reload_for_new_client_and_server_handshakes() {
 		use std::io::Write;
@@ -2738,88 +2681,6 @@ mod tests {
 		assert!(client_verifier.verify_client_cert(&client_b, &[], now).is_ok());
 	}
 
-	#[cfg(all(feature = "quiche", feature = "watch"))]
-	#[test]
-	fn custom_root_refresh_retains_last_valid_bundle() {
-		use std::io::Write;
-
-		let (ca_a, _, _, _, _) = signed_certificates();
-		let (ca_b, _, _, _, _) = signed_certificates();
-		let mut root_file = tempfile::NamedTempFile::new().unwrap();
-		root_file.write_all(ca_a.as_bytes()).unwrap();
-		let roots = CustomRoots::new(vec![root_file.path().to_path_buf()]).unwrap();
-		let initial = roots.current();
-
-		std::fs::write(root_file.path(), "not a PEM certificate").unwrap();
-		assert_eq!(roots.refresh(), initial);
-
-		std::fs::write(
-			root_file.path(),
-			"-----BEGIN CERTIFICATE-----\nAQID\n-----END CERTIFICATE-----\n",
-		)
-		.unwrap();
-		assert_eq!(roots.refresh(), initial);
-
-		std::fs::write(root_file.path(), ca_b).unwrap();
-		let rotated = roots.refresh();
-		assert_ne!(rotated, initial);
-		assert_eq!(roots.current(), rotated);
-	}
-
-	#[cfg(all(feature = "quiche", feature = "watch"))]
-	#[test]
-	fn custom_root_refresh_serializes_cache_updates() {
-		let (ca_a, _, _, _, _) = signed_certificates();
-		let (ca_b, _, _, _, _) = signed_certificates();
-		let (ca_c, _, _, _, _) = signed_certificates();
-		let parse = |pem: &str| {
-			CertificateDer::pem_slice_iter(pem.as_bytes())
-				.collect::<std::result::Result<Vec<_>, _>>()
-				.unwrap()
-		};
-		let initial = parse(&ca_a);
-		let bundle_b = parse(&ca_b);
-		let bundle_c = parse(&ca_c);
-		let roots = CustomRoots {
-			paths: Vec::new(),
-			current: Arc::new(RwLock::new(initial)),
-		};
-
-		let (first_loaded_tx, first_loaded_rx) = std::sync::mpsc::sync_channel(0);
-		let (release_first_tx, release_first_rx) = std::sync::mpsc::sync_channel(0);
-		let first_roots = roots.clone();
-		let first = std::thread::spawn(move || {
-			first_roots.refresh_with(|| {
-				first_loaded_tx.send(()).unwrap();
-				release_first_rx.recv().unwrap();
-				Ok(bundle_b)
-			})
-		});
-		first_loaded_rx.recv().unwrap();
-
-		let (second_ready_tx, second_ready_rx) = std::sync::mpsc::sync_channel(0);
-		let (second_loaded_tx, second_loaded_rx) = std::sync::mpsc::channel();
-		let second_roots = roots.clone();
-		let expected = bundle_c.clone();
-		let second = std::thread::spawn(move || {
-			second_ready_tx.send(()).unwrap();
-			second_roots.refresh_with(|| {
-				second_loaded_tx.send(()).unwrap();
-				Ok(bundle_c)
-			})
-		});
-		second_ready_rx.recv().unwrap();
-		let overlapped = second_loaded_rx
-			.recv_timeout(std::time::Duration::from_millis(100))
-			.is_ok();
-
-		release_first_tx.send(()).unwrap();
-		first.join().unwrap();
-		second.join().unwrap();
-		assert!(!overlapped, "root cache refresh transactions must not overlap");
-		assert_eq!(roots.current(), expected);
-	}
-
 	#[test]
 	fn build_uses_platform_verifier_by_default() {
 		// No custom roots, system trust on: resolves to the OS platform verifier
@@ -2963,7 +2824,7 @@ impl ServeCerts {
 	/// The certificate to serve for `server_name`, or the first configured one when
 	/// nothing matches. `None` only when nothing is configured at all.
 	///
-	/// Every backend selects through this, so the rustls-based ones and quiche agree
+	/// Noq selects through this
 	/// on which certificate a given SNI gets.
 	pub(crate) fn select(&self, server_name: Option<&str>) -> Option<Arc<Certified>> {
 		let info = self.info.read().expect("info read lock poisoned");
@@ -3007,14 +2868,14 @@ impl rustls::server::ResolvesServerCert for ServeCerts {
 /// its own, so a listener that goes away without this leaves the task, the keys it
 /// holds, and an OS directory watch behind. An embedder that builds listeners
 /// repeatedly in one process would accumulate all three.
-#[cfg(any(feature = "quinn", feature = "noq", feature = "quiche"))]
+#[cfg(feature = "noq")]
 #[derive(Debug)]
 pub(crate) struct Reload {
 	/// Named for the drop alone: nothing reads it, and losing it stops the watcher.
 	_task: AbortOnDrop,
 }
 
-#[cfg(any(feature = "quinn", feature = "noq", feature = "quiche"))]
+#[cfg(feature = "noq")]
 impl Reload {
 	/// A guard over a task with nothing to do, for a listener with nothing to watch.
 	fn inert() -> Self {
@@ -3066,7 +2927,7 @@ impl Reload {
 /// Reacting to the filesystem means cert-manager, Kubernetes secret mounts, and
 /// `mv`-into-place rotate certs with no external signal. [`Reload::spawn`] owns
 /// registering the watch and is the only caller.
-#[cfg(any(feature = "quinn", feature = "noq", feature = "quiche"))]
+#[cfg(feature = "noq")]
 async fn reload_certs(mut watcher: crate::watch::Files, certs: Arc<ServeCerts>, tls_config: Listen) {
 	loop {
 		watcher.changed().await;
@@ -3153,7 +3014,7 @@ mod legacy_tests {
 	/// The accept side, where a dropped `--server-tls-root` takes the mTLS client
 	/// CAs with it and leaves the listener accepting unauthenticated peers.
 	/// moq-cli's `export hls` flattens this type directly, so it is a live path.
-	#[cfg(any(feature = "noq", feature = "quinn", feature = "quiche"))]
+	#[cfg(feature = "noq")]
 	#[test]
 	fn the_server_builders_refuse_a_released_spelling() {
 		let tls = parse(&["--server-tls-root", "/tmp/ca.pem"]).listen;
diff --git a/rs/moq-tokio/src/websocket.rs b/rs/moq-tokio/src/websocket.rs
index df20f6bc77..5a748873bd 100644
--- a/rs/moq-tokio/src/websocket.rs
+++ b/rs/moq-tokio/src/websocket.rs
@@ -238,7 +238,7 @@ pub struct Resolved {
 
 /// The fallback arm of the QUIC-vs-WebSocket race, so only compiled when there is a
 /// QUIC dial to race against. A WebSocket-only build calls [`connect`] directly.
-#[cfg(any(feature = "noq", feature = "quinn", feature = "quiche"))]
+#[cfg(feature = "noq")]
 pub(crate) async fn race_handle(
 	config: &Config,
 	tls: &rustls::ClientConfig,
diff --git a/rs/moq-tokio/src/worker/mod.rs b/rs/moq-tokio/src/worker/mod.rs
index 8a8569d395..403835a4c0 100644
--- a/rs/moq-tokio/src/worker/mod.rs
+++ b/rs/moq-tokio/src/worker/mod.rs
@@ -20,10 +20,10 @@
 
 // Everything but the knobs: a group binds and serves QUIC, so it needs a backend
 // to bind with.
-#[cfg(any(feature = "noq", feature = "quinn", feature = "quiche"))]
+#[cfg(feature = "noq")]
 mod group;
 
-#[cfg(any(feature = "noq", feature = "quinn", feature = "quiche"))]
+#[cfg(feature = "noq")]
 pub use group::{Group, Member, Spawner, Workers};
 
 /// How many QUIC workers to run, and whether to pin them.
diff --git a/rs/moq-tokio/tests/backend.rs b/rs/moq-tokio/tests/backend.rs
index 82eb78fc5a..e3f2141c7a 100644
--- a/rs/moq-tokio/tests/backend.rs
+++ b/rs/moq-tokio/tests/backend.rs
@@ -1,15 +1,11 @@
-//! Integration tests that explicitly exercise each QUIC backend (quinn, quiche, iroh)
-//! with a simple client/server connect + broadcast flow.
-//!
-//! Each test is gated with `#[cfg(feature = "...")]` so it only compiles when the
-//! corresponding backend is enabled. Running `cargo test --all-features` exercises all.
+//! Integration tests for noq QUIC and the iroh transport.
 
 use std::time::Duration;
 
 const TIMEOUT: Duration = Duration::from_secs(10);
 
 /// Inputs for [`connect_test`].
-#[cfg(any(feature = "quinn", feature = "quiche", feature = "noq"))]
+#[cfg(feature = "noq")]
 struct ConnectTest<'a> {
 	/// URL scheme to dial (`moqt` for raw QUIC, `https` for WebTransport).
 	scheme: &'a str,
@@ -27,7 +23,6 @@ struct ConnectTest<'a> {
 	/// test cares. `None` skips the check; `Some(None)` asserts no authority (a bare-IP dial that
 	/// sends no SNI); `Some(Some(host))` asserts that host.
 	expect_authority: Option<Option<&'a str>>,
-	backend: moq_tokio::QuicBackend,
 	/// The transport knobs both ends are built with.
 	quic: moq_tokio::quic::Config,
 	/// The single frame the publisher writes, which the subscriber must read back.
@@ -35,12 +30,12 @@ struct ConnectTest<'a> {
 }
 
 /// Publish a broadcast on the server, subscribe on the client, and verify
-/// the data arrives correctly using the specified QUIC backend and URL scheme.
+/// the data arrives correctly using the requested URL scheme.
 ///
 /// Dials `localhost`, so the client sends an SNI. Use [`no_sni_test`] to cover
 /// the SNI-less path.
-#[cfg(any(feature = "quinn", feature = "quiche", feature = "noq"))]
-async fn backend_test(scheme: &str, backend: moq_tokio::QuicBackend) {
+#[cfg(feature = "noq")]
+async fn backend_test(scheme: &str) {
 	connect_test(ConnectTest {
 		scheme,
 		bind: "[::]:0",
@@ -49,7 +44,6 @@ async fn backend_test(scheme: &str, backend: moq_tokio::QuicBackend) {
 		path: "",
 		expect_path: Some(""),
 		expect_authority: Some(Some("localhost")),
-		backend,
 		quic: Default::default(),
 		payload: b"hello",
 	})
@@ -61,8 +55,8 @@ async fn backend_test(scheme: &str, backend: moq_tokio::QuicBackend) {
 /// Raw QUIC (`moqt`/`moql`) has no request URI, so the whole request target has to
 /// ride the SETUP; WebTransport carries it in the CONNECT URL instead. Either way the
 /// server reports the same route and query through [`moq_tokio::server::Request`].
-#[cfg(any(feature = "quinn", feature = "quiche", feature = "noq"))]
-async fn path_test(scheme: &str, backend: moq_tokio::QuicBackend) {
+#[cfg(feature = "noq")]
+async fn path_test(scheme: &str) {
 	connect_test(ConnectTest {
 		scheme,
 		bind: "[::]:0",
@@ -71,7 +65,6 @@ async fn path_test(scheme: &str, backend: moq_tokio::QuicBackend) {
 		path: "/room?jwt=abc",
 		expect_path: Some("/room"),
 		expect_authority: Some(Some("localhost")),
-		backend,
 		quic: Default::default(),
 		payload: b"hello",
 	})
@@ -82,8 +75,8 @@ async fn path_test(scheme: &str, backend: moq_tokio::QuicBackend) {
 /// in the server name). Raw QUIC has no in-band request URL, so this exercises
 /// the accept path with an empty server name, which must still establish rather
 /// than reject. Binds the loopback IP directly to avoid dual-stack flakiness.
-#[cfg(any(feature = "quinn", feature = "noq"))]
-async fn no_sni_test(scheme: &str, backend: moq_tokio::QuicBackend) {
+#[cfg(feature = "noq")]
+async fn no_sni_test(scheme: &str) {
 	connect_test(ConnectTest {
 		scheme,
 		bind: "127.0.0.1:0",
@@ -92,7 +85,6 @@ async fn no_sni_test(scheme: &str, backend: moq_tokio::QuicBackend) {
 		path: "",
 		expect_path: Some(""),
 		expect_authority: Some(None),
-		backend,
 		quic: Default::default(),
 		payload: b"hello",
 	})
@@ -100,8 +92,8 @@ async fn no_sni_test(scheme: &str, backend: moq_tokio::QuicBackend) {
 }
 
 /// Publish a broadcast on the server bound to `bind`, subscribe on a client that
-/// dials `authority`, and verify the data arrives over the given backend + scheme.
-#[cfg(any(feature = "quinn", feature = "quiche", feature = "noq"))]
+/// dials `authority`, and verify the data arrives over the requested scheme.
+#[cfg(feature = "noq")]
 async fn connect_test(config: ConnectTest<'_>) {
 	let ConnectTest {
 		scheme,
@@ -111,7 +103,6 @@ async fn connect_test(config: ConnectTest<'_>) {
 		path,
 		expect_path,
 		expect_authority,
-		backend,
 		quic,
 		payload,
 	} = config;
@@ -133,7 +124,6 @@ async fn connect_test(config: ConnectTest<'_>) {
 	let mut server_config = moq_tokio::listen::Config::default();
 	server_config.bind = Some(bind.parse().unwrap());
 	server_config.tls.generate = vec!["localhost".into()];
-	server_config.backend = Some(backend.clone());
 	let server = server_config.init(quic.clone()).expect("failed to init server");
 	let mut server = server.listen().await.expect("failed to listen");
 	let addr = server.local_addr().expect("failed to get local addr");
@@ -145,7 +135,6 @@ async fn connect_test(config: ConnectTest<'_>) {
 
 	let mut client_config = moq_tokio::connect::Config::default();
 	client_config.tls.insecure = Some(true);
-	client_config.backend = Some(backend);
 	// Bind the client to the same address family as the server so an IPv4 dial
 	// doesn't try to egress from an IPv6 socket (and vice versa).
 	client_config.bind = Some(client_bind.unwrap_or(bind).parse().expect("invalid bind address"));
@@ -229,7 +218,7 @@ async fn connect_test(config: ConnectTest<'_>) {
 /// Write a self-signed PEM cert + key for `name` to `dir`, prefixed by `stem`.
 ///
 /// Returns the two paths, in the order the `cert` and `key` lists want them.
-#[cfg(any(feature = "quinn", feature = "quiche"))]
+#[cfg(feature = "noq")]
 fn write_self_signed(dir: &std::path::Path, stem: &str, name: &str) -> (std::path::PathBuf, std::path::PathBuf) {
 	use std::io::Write;
 
@@ -257,8 +246,8 @@ fn write_self_signed(dir: &std::path::Path, stem: &str, name: &str) -> (std::pat
 /// when the server picked the certificate the SNI asked for. Without SNI
 /// selection every client would get the first configured certificate, so the
 /// `alt.localhost` pin below would never match.
-#[cfg(any(feature = "quinn", feature = "quiche"))]
-async fn sni_test(backend: moq_tokio::QuicBackend) {
+#[cfg(feature = "noq")]
+async fn sni_test() {
 	let dir = tempfile::tempdir().expect("tempdir");
 	let (first_cert, first_key) = write_self_signed(dir.path(), "first", "localhost");
 	let (second_cert, second_key) = write_self_signed(dir.path(), "second", "alt.localhost");
@@ -267,7 +256,6 @@ async fn sni_test(backend: moq_tokio::QuicBackend) {
 	server_config.bind = Some("127.0.0.1:0".parse().unwrap());
 	server_config.tls.cert = vec![first_cert, second_cert];
 	server_config.tls.key = vec![first_key, second_key];
-	server_config.backend = Some(backend.clone());
 
 	let server = server_config
 		.init(moq_tokio::quic::Config::default())
@@ -289,7 +277,6 @@ async fn sni_test(backend: moq_tokio::QuicBackend) {
 		let mut client_config = moq_tokio::connect::Config::default();
 		client_config.tls.fingerprint = vec![fingerprint.to_string()];
 		client_config.tls.host_name = Some(host_name.to_string());
-		client_config.backend = Some(backend.clone());
 		client_config.bind = Some("0.0.0.0:0".parse().unwrap());
 		let client = client_config
 			.init(moq_tokio::quic::Config::default())
@@ -316,8 +303,8 @@ async fn sni_test(backend: moq_tokio::QuicBackend) {
 }
 
 /// A generated certificate joins the file-backed ones rather than replacing them.
-#[cfg(any(feature = "quinn", feature = "quiche"))]
-async fn cert_sources_test(backend: moq_tokio::QuicBackend) {
+#[cfg(feature = "noq")]
+async fn cert_sources_test() {
 	let dir = tempfile::tempdir().expect("tempdir");
 	let (cert, key) = write_self_signed(dir.path(), "server", "localhost");
 
@@ -326,7 +313,6 @@ async fn cert_sources_test(backend: moq_tokio::QuicBackend) {
 	server_config.tls.cert = vec![cert];
 	server_config.tls.key = vec![key];
 	server_config.tls.generate = vec!["generated.localhost".into()];
-	server_config.backend = Some(backend);
 
 	let server = server_config
 		.init(moq_tokio::quic::Config::default())
@@ -342,8 +328,8 @@ async fn cert_sources_test(backend: moq_tokio::QuicBackend) {
 
 /// Rotate the certificate files under a running listener and assert the served
 /// set follows, without the listener being rebuilt.
-#[cfg(any(feature = "quinn", feature = "quiche"))]
-async fn reload_test(backend: moq_tokio::QuicBackend) {
+#[cfg(feature = "noq")]
+async fn reload_test() {
 	let dir = tempfile::tempdir().expect("tempdir");
 	let (cert, key) = write_self_signed(dir.path(), "server", "localhost");
 
@@ -351,7 +337,6 @@ async fn reload_test(backend: moq_tokio::QuicBackend) {
 	server_config.bind = Some("127.0.0.1:0".parse().unwrap());
 	server_config.tls.cert = vec![cert.clone()];
 	server_config.tls.key = vec![key.clone()];
-	server_config.backend = Some(backend);
 
 	#[cfg(feature = "watch")]
 	if moq_tokio::watch::Files::new(std::slice::from_ref(&cert)).is_err() {
@@ -406,7 +391,7 @@ async fn reload_test(backend: moq_tokio::QuicBackend) {
 /// Generate a CA, a server cert + key, and a client cert + key (all PEM, the
 /// leaf certs signed by the CA) written to a tempdir. Returns the dir plus the
 /// five paths so the caller can wire them into the TLS configs.
-#[cfg(any(feature = "quinn", feature = "quiche", feature = "noq"))]
+#[cfg(feature = "noq")]
 fn generate_mtls_certs() -> (tempfile::TempDir, MtlsPaths) {
 	use rcgen::{
 		BasicConstraints, CertificateParams, DnType, ExtendedKeyUsagePurpose, IsCa, Issuer, KeyPair, KeyUsagePurpose,
@@ -459,7 +444,7 @@ fn generate_mtls_certs() -> (tempfile::TempDir, MtlsPaths) {
 }
 
 /// Filesystem paths to the PEM material produced by [`generate_mtls_certs`].
-#[cfg(any(feature = "quinn", feature = "quiche", feature = "noq"))]
+#[cfg(feature = "noq")]
 struct MtlsPaths {
 	ca: std::path::PathBuf,
 	server_cert: std::path::PathBuf,
@@ -470,8 +455,8 @@ struct MtlsPaths {
 
 /// Connect with a client certificate signed by a CA the server trusts, and
 /// assert the server observes the validated peer certificate via mTLS.
-#[cfg(any(feature = "quinn", feature = "quiche", feature = "noq"))]
-async fn mtls_test(scheme: &str, backend: moq_tokio::QuicBackend, reject: bool) {
+#[cfg(feature = "noq")]
+async fn mtls_test(scheme: &str, reject: bool) {
 	let (_dir, paths) = generate_mtls_certs();
 
 	let pub_origin = moq_tokio::origin::spawn();
@@ -481,7 +466,6 @@ async fn mtls_test(scheme: &str, backend: moq_tokio::QuicBackend, reject: bool)
 	server_config.tls.cert = vec![paths.server_cert.clone()];
 	server_config.tls.key = vec![paths.server_key.clone()];
 	server_config.tls.root = vec![paths.ca.clone()];
-	server_config.backend = Some(backend.clone());
 	// One shared tuning, handed to both roles the way a binary would.
 	let mut quic = moq_tokio::quic::Config::default();
 	quic.gso = Some(false);
@@ -497,7 +481,6 @@ async fn mtls_test(scheme: &str, backend: moq_tokio::QuicBackend, reject: bool)
 	client_config.tls.cert = Some(paths.client_cert.clone());
 	client_config.tls.key = Some(paths.client_key.clone());
 	client_config.tls.host_name = Some("localhost".to_string());
-	client_config.backend = Some(backend);
 	client_config.bind = Some("0.0.0.0:0".parse().unwrap());
 	let client = client_config.init(quic.clone()).expect("failed to init client");
 	// Dial the IP while verifying the certificate's localhost SAN. This covers
@@ -545,160 +528,6 @@ async fn mtls_test(scheme: &str, backend: moq_tokio::QuicBackend, reject: bool)
 	}
 }
 
-// ── Quinn backend ───────────────────────────────────────────────────
-
-#[cfg(feature = "quinn")]
-#[tracing_test::traced_test]
-#[tokio::test]
-async fn quinn_raw_quic() {
-	backend_test("moqt", moq_tokio::QuicBackend::Quinn).await;
-}
-
-#[cfg(feature = "quinn")]
-#[tracing_test::traced_test]
-#[tokio::test]
-async fn quinn_raw_quic_no_sni() {
-	no_sni_test("moqt", moq_tokio::QuicBackend::Quinn).await;
-}
-
-#[cfg(feature = "quinn")]
-#[tracing_test::traced_test]
-#[tokio::test]
-async fn quinn_raw_quic_path() {
-	path_test("moqt", moq_tokio::QuicBackend::Quinn).await;
-}
-
-/// `moql://` derives its SETUP path exactly like `moqt://`; only the scheme differs.
-#[cfg(feature = "quinn")]
-#[tracing_test::traced_test]
-#[tokio::test]
-async fn quinn_raw_quic_moql_path() {
-	path_test("moql", moq_tokio::QuicBackend::Quinn).await;
-}
-
-#[cfg(feature = "quinn")]
-#[tracing_test::traced_test]
-#[tokio::test]
-async fn quinn_webtransport_path() {
-	path_test("https", moq_tokio::QuicBackend::Quinn).await;
-}
-
-/// The same certificate semantics the quiche backend now shares, checked here so
-/// the two can't drift apart.
-#[cfg(feature = "quinn")]
-#[tracing_test::traced_test]
-#[tokio::test]
-async fn quinn_sni_certificate() {
-	sni_test(moq_tokio::QuicBackend::Quinn).await;
-}
-
-#[cfg(feature = "quinn")]
-#[tracing_test::traced_test]
-#[tokio::test]
-async fn quinn_cert_sources() {
-	cert_sources_test(moq_tokio::QuicBackend::Quinn).await;
-}
-
-#[cfg(feature = "quinn")]
-#[tracing_test::traced_test]
-#[tokio::test]
-async fn quinn_cert_reload() {
-	reload_test(moq_tokio::QuicBackend::Quinn).await;
-}
-
-#[cfg(feature = "quinn")]
-#[tracing_test::traced_test]
-#[tokio::test]
-async fn quinn_mtls() {
-	mtls_test("https", moq_tokio::QuicBackend::Quinn, false).await;
-}
-
-#[cfg(feature = "quinn")]
-#[tracing_test::traced_test]
-#[tokio::test]
-async fn quinn_webtransport() {
-	backend_test("https", moq_tokio::QuicBackend::Quinn).await;
-}
-
-// ── Quiche backend ──────────────────────────────────────────────────
-
-#[cfg(feature = "quiche")]
-#[tracing_test::traced_test]
-#[tokio::test]
-async fn quiche_raw_quic() {
-	backend_test("moqt", moq_tokio::QuicBackend::Quiche).await;
-}
-
-#[cfg(feature = "quiche")]
-#[tracing_test::traced_test]
-#[tokio::test]
-async fn quiche_raw_quic_path() {
-	path_test("moqt", moq_tokio::QuicBackend::Quiche).await;
-}
-
-#[cfg(feature = "quiche")]
-#[tracing_test::traced_test]
-#[tokio::test]
-async fn quiche_dual_stack_ipv4() {
-	connect_test(ConnectTest {
-		scheme: "moqt",
-		bind: "[::]:0",
-		client_bind: Some("0.0.0.0:0"),
-		authority: "127.0.0.1",
-		path: "",
-		expect_path: None,
-		// BoringSSL sends an IP-literal SNI where rustls sends none, so the server sees it.
-		expect_authority: Some(Some("127.0.0.1")),
-		backend: moq_tokio::QuicBackend::Quiche,
-		quic: Default::default(),
-		payload: b"hello",
-	})
-	.await;
-}
-
-#[cfg(feature = "quiche")]
-#[tracing_test::traced_test]
-#[tokio::test]
-async fn quiche_sni_certificate() {
-	sni_test(moq_tokio::QuicBackend::Quiche).await;
-}
-
-#[cfg(feature = "quiche")]
-#[tracing_test::traced_test]
-#[tokio::test]
-async fn quiche_cert_sources() {
-	cert_sources_test(moq_tokio::QuicBackend::Quiche).await;
-}
-
-#[cfg(feature = "quiche")]
-#[tracing_test::traced_test]
-#[tokio::test]
-async fn quiche_cert_reload() {
-	reload_test(moq_tokio::QuicBackend::Quiche).await;
-}
-
-#[cfg(feature = "quiche")]
-#[tracing_test::traced_test]
-#[tokio::test]
-async fn quiche_mtls() {
-	// Avoid waiting on the separately tracked quiche WebTransport teardown bug.
-	mtls_test("https", moq_tokio::QuicBackend::Quiche, true).await;
-}
-
-#[cfg(feature = "quiche")]
-#[tracing_test::traced_test]
-#[tokio::test]
-#[ignore = "web-transport-quiche teardown bug. Two symptoms: the lite-05 TRACK stream, dropped \
-            after reading TRACK_INFO (closed early by design), surfaces as a connection-level \
-            `quiche error: Done` that tears down the whole session; and on CI it intermittently \
-            aborts with a SIGSEGV in the boring/quiche C stack (seen on aarch64 runners), inside \
-            web-transport-quiche / tokio-quiche / BoringSSL, not our code. lite-04 (no TRACK \
-            stream) and the quinn backend both work. Re-enable once the quiche backend handles the \
-            early stream drop."]
-async fn quiche_webtransport() {
-	backend_test("https", moq_tokio::QuicBackend::Quiche).await;
-}
-
 // ── Iroh backend ────────────────────────────────────────────────────
 
 #[cfg(feature = "iroh")]
@@ -845,35 +674,70 @@ async fn iroh_connect() {
 #[tracing_test::traced_test]
 #[tokio::test]
 async fn noq_raw_quic() {
-	backend_test("moqt", moq_tokio::QuicBackend::Noq).await;
+	backend_test("moqt").await;
 }
 
 #[cfg(feature = "noq")]
 #[tracing_test::traced_test]
 #[tokio::test]
 async fn noq_raw_quic_no_sni() {
-	no_sni_test("moqt", moq_tokio::QuicBackend::Noq).await;
+	no_sni_test("moqt").await;
 }
 
 #[cfg(feature = "noq")]
 #[tracing_test::traced_test]
 #[tokio::test]
 async fn noq_raw_quic_path() {
-	path_test("moqt", moq_tokio::QuicBackend::Noq).await;
+	path_test("moqt").await;
+}
+
+#[cfg(feature = "noq")]
+#[tracing_test::traced_test]
+#[tokio::test]
+async fn noq_raw_quic_moql_path() {
+	path_test("moql").await;
+}
+
+#[cfg(feature = "noq")]
+#[tracing_test::traced_test]
+#[tokio::test]
+async fn noq_webtransport_path() {
+	path_test("https").await;
 }
 
 #[cfg(feature = "noq")]
 #[tracing_test::traced_test]
 #[tokio::test]
 async fn noq_webtransport() {
-	backend_test("https", moq_tokio::QuicBackend::Noq).await;
+	backend_test("https").await;
 }
 
 #[cfg(feature = "noq")]
 #[tracing_test::traced_test]
 #[tokio::test]
 async fn noq_mtls() {
-	mtls_test("https", moq_tokio::QuicBackend::Noq, false).await;
+	mtls_test("https", false).await;
+}
+
+#[cfg(feature = "noq")]
+#[tracing_test::traced_test]
+#[tokio::test]
+async fn noq_sni_certificate() {
+	sni_test().await;
+}
+
+#[cfg(feature = "noq")]
+#[tracing_test::traced_test]
+#[tokio::test]
+async fn noq_cert_sources() {
+	cert_sources_test().await;
+}
+
+#[cfg(feature = "noq")]
+#[tracing_test::traced_test]
+#[tokio::test]
+async fn noq_cert_reload() {
+	reload_test().await;
 }
 
 // ── qlog ────────────────────────────────────────────────────────────
@@ -882,10 +746,9 @@ async fn noq_mtls() {
 /// files it left behind.
 ///
 /// Both ends write into one directory, so this covers the client and server paths
-/// at once. The layout differs per backend (one file per endpoint for quinn, one per
-/// connection for noq and quiche), so callers only assert on the count they expect.
-#[cfg(all(feature = "qlog", any(feature = "quinn", feature = "quiche", feature = "noq")))]
-async fn qlog_test(scheme: &str, backend: moq_tokio::QuicBackend) -> Vec<std::path::PathBuf> {
+/// at once. Noq writes one file per connection.
+#[cfg(all(feature = "qlog", feature = "noq"))]
+async fn qlog_test(scheme: &str) -> Vec<std::path::PathBuf> {
 	let dir = tempfile::tempdir().expect("failed to create tempdir");
 
 	let mut quic = moq_tokio::quic::Config::default();
@@ -899,7 +762,6 @@ async fn qlog_test(scheme: &str, backend: moq_tokio::QuicBackend) -> Vec<std::pa
 		path: "",
 		expect_path: None,
 		expect_authority: None,
-		backend,
 		quic,
 		payload: b"hello",
 	})
@@ -911,7 +773,7 @@ async fn qlog_test(scheme: &str, backend: moq_tokio::QuicBackend) -> Vec<std::pa
 		.collect();
 
 	for trace in &traces {
-		// Every backend writes JSON-SEQ (RFC 7464): each record is a 0x1e separator then
+		// Noq writes JSON-SEQ (RFC 7464): each record is a 0x1e separator then
 		// JSON, the first being the qlog header. Checking the bytes rather than just the
 		// length catches a writer that was buffered and never flushed.
 		let raw = std::fs::read(trace).expect("failed to read trace");
@@ -938,30 +800,10 @@ async fn qlog_test(scheme: &str, backend: moq_tokio::QuicBackend) -> Vec<std::pa
 	traces
 }
 
-/// quinn shares one [`quinn::QlogStream`] across an endpoint, so the client and the
-/// server each write exactly one file, with connections separated by `group_id`.
-#[cfg(all(feature = "qlog", feature = "quinn"))]
-#[tokio::test]
-async fn quinn_qlog() {
-	let traces = qlog_test("moqt", moq_tokio::QuicBackend::Quinn).await;
-	assert_eq!(traces.len(), 2, "expected one trace per endpoint, got {traces:?}");
-}
-
-/// noq's factory opens a file per connection, named after its initial destination
-/// connection ID, so both ends land in the same directory under different names.
 #[cfg(all(feature = "qlog", feature = "noq"))]
 #[tokio::test]
 async fn noq_qlog() {
-	let traces = qlog_test("moqt", moq_tokio::QuicBackend::Noq).await;
-	assert!(!traces.is_empty(), "expected at least one trace");
-}
-
-/// tokio-quiche writes a file per connection from `Settings::qlog_dir`.
-#[cfg(all(feature = "qlog", feature = "quiche"))]
-#[tokio::test]
-#[ignore = "shares the connect path that quiche_webtransport is ignored for; the qlog plumbing itself is verified by running this locally"]
-async fn quiche_qlog() {
-	let traces = qlog_test("https", moq_tokio::QuicBackend::Quiche).await;
+	let traces = qlog_test("moqt").await;
 	assert!(!traces.is_empty(), "expected at least one trace");
 }
 
@@ -989,14 +831,12 @@ async fn connect_once(
 /// The size is the point: a frame that fits inside one window would pass whether or
 /// not the setting ever reached the backend.
 ///
-/// `send_window` is a parameter because quiche has no local send cap and refuses one
-/// (see `quiche_refuses_send_window`), so only the backends that have it pass a size.
-#[cfg(any(feature = "quinn", feature = "quiche", feature = "noq"))]
-async fn window_test(scheme: &str, backend: moq_tokio::QuicBackend, send_window: Option<u64>) {
+#[cfg(feature = "noq")]
+async fn window_test(scheme: &str) {
 	let mut quic = moq_tokio::quic::Config::default();
 	quic.receive_window = Some(64 * 1024);
 	quic.stream_receive_window = Some(16 * 1024);
-	quic.send_window = send_window;
+	quic.send_window = Some(32 * 1024);
 
 	let payload: Vec<u8> = (0..256 * 1024).map(|i| i as u8).collect();
 
@@ -1008,46 +848,14 @@ async fn window_test(scheme: &str, backend: moq_tokio::QuicBackend, send_window:
 		path: "",
 		expect_path: Some(""),
 		expect_authority: Some(Some("localhost")),
-		backend,
 		quic,
 		payload: &payload,
 	})
 	.await;
 }
 
-#[cfg(feature = "quinn")]
-#[tokio::test]
-async fn quinn_windows() {
-	window_test("moqt", moq_tokio::QuicBackend::Quinn, Some(32 * 1024)).await;
-}
-
 #[cfg(feature = "noq")]
 #[tokio::test]
 async fn noq_windows() {
-	window_test("moqt", moq_tokio::QuicBackend::Noq, Some(32 * 1024)).await;
-}
-
-/// quiche takes the receive windows, so cover them over raw QUIC the same way.
-#[cfg(feature = "quiche")]
-#[tokio::test]
-async fn quiche_windows() {
-	window_test("moqt", moq_tokio::QuicBackend::Quiche, None).await;
-}
-
-/// The quiche backend refuses a send window rather than pretending to apply one, and
-/// it says so when the endpoint is built rather than at the first connection.
-#[cfg(feature = "quiche")]
-#[tokio::test]
-async fn quiche_refuses_send_window() {
-	let mut quic = moq_tokio::quic::Config::default();
-	quic.send_window = Some(32 * 1024);
-
-	let mut config = moq_tokio::connect::Config::default();
-	config.backend = Some(moq_tokio::QuicBackend::Quiche);
-
-	// `Client` is not `Debug`, so unwrap the error by pattern rather than `expect_err`.
-	let Err(err) = config.init(quic) else {
-		panic!("a send window must be refused");
-	};
-	assert!(err.to_string().contains("send window"), "{err}");
+	window_test("moqt").await;
 }
diff --git a/rs/moq-tokio/tests/broadcast.rs b/rs/moq-tokio/tests/broadcast.rs
index bf606c52fe..c736e6b15e 100644
--- a/rs/moq-tokio/tests/broadcast.rs
+++ b/rs/moq-tokio/tests/broadcast.rs
@@ -2118,7 +2118,7 @@ async fn quic_driver_task_inherits_connection_span() {
 		.expect("group closed prematurely");
 	assert_eq!(&frame.payload[..], b"hello");
 
-	// Other tasks (e.g. quinn's own internal per-connection IO loop) legitimately
+	// Other tasks (e.g. noq's own internal per-connection IO loop) legitimately
 	// carry the "conn" span too, since they're spawned while it's entered. So it's
 	// not enough for the marker to appear *somewhere* in the logs; it must be on
 	// the exact line moq-net emits from inside the driver task the runtime
diff --git a/rs/moq-tokio/tests/worker.rs b/rs/moq-tokio/tests/worker.rs
index 127ff6148b..e93bdafd6c 100644
--- a/rs/moq-tokio/tests/worker.rs
+++ b/rs/moq-tokio/tests/worker.rs
@@ -3,7 +3,7 @@
 //! Linux-only, because the mode is: every worker binds the listen address with
 //! `SO_REUSEPORT`, and no other platform load-balances a unicast UDP port across
 //! the group.
-#![cfg(all(target_os = "linux", feature = "quinn"))]
+#![cfg(target_os = "linux")]
 
 use std::net::{SocketAddr, UdpSocket};
 
diff --git a/rs/moq-transcode/Cargo.toml b/rs/moq-transcode/Cargo.toml
index 830f67ae5b..aa7a9fa5f8 100644
--- a/rs/moq-transcode/Cargo.toml
+++ b/rs/moq-transcode/Cargo.toml
@@ -47,7 +47,7 @@ tracing = { workspace = true }
 
 [dev-dependencies]
 anyhow = { workspace = true }
-moq-tokio = { workspace = true, features = ["quinn", "aws-lc-rs", "websocket"] }
+moq-tokio = { workspace = true, features = ["noq", "aws-lc-rs", "websocket"] }
 # test-util unlocks tokio::time::pause for the deterministic live-feed tests.
 tokio = { workspace = true, features = ["full", "test-util"] }
 url = { workspace = true }
diff --git a/rs/moq-uring/Cargo.toml b/rs/moq-uring/Cargo.toml
index 216e7cb438..5b97c7972a 100644
--- a/rs/moq-uring/Cargo.toml
+++ b/rs/moq-uring/Cargo.toml
@@ -13,24 +13,15 @@ keywords = ["quic", "io-uring", "networking", "linux"]
 categories = ["asynchronous", "network-programming", "os::linux-apis"]
 
 [features]
-# The sans-IO QUIC stack behind `quic`. Exactly one is compiled: a build that
-# asks for several (`--all-features`) gets `noq`.
 default = ["noq"]
 # noq-proto, with TLS through rustls.
 noq = ["dep:noq-proto", "dep:rustls", "dep:rustls-platform-verifier"]
-# Cloudflare's quiche, with TLS through BoringSSL. Building that needs cmake
-# and a C++ toolchain.
-quiche = ["dep:boring", "dep:quiche"]
-# quinn-proto, with TLS through rustls, which is what the rest of this
-# workspace speaks. No second TLS stack to build or ship.
-quinn = ["dep:quinn-proto", "dep:rustls", "dep:rustls-platform-verifier"]
 # Capture qlog traces (`quic::Transport::qlog`). Off by default: it compiles the
 # qlog crate and its serde_json encoder into whichever backend is selected, which
 # a production build has no use for.
-qlog = ["noq-proto?/qlog", "quinn-proto?/qlog", "quiche?/qlog"]
+qlog = ["noq-proto?/qlog"]
 
 [target.'cfg(target_os = "linux")'.dependencies]
-boring = { version = "4.22", optional = true }
 bytes = "1"
 http = "1"
 io-uring = { workspace = true }
@@ -40,10 +31,6 @@ moq-net = { workspace = true }
 moq-sock = { workspace = true }
 # default-features off so the crypto provider is ours to pick.
 noq-proto = { workspace = true, features = ["bloom", "tracing-log", "rustls-aws-lc-rs"], optional = true }
-quiche = { version = "0.29", optional = true }
-# default-features off so the crypto provider is ours to pick, matching how
-# moq-tokio wires its quinn dependency.
-quinn-proto = { version = "0.11", default-features = false, features = ["bloom", "log", "rustls-aws-lc-rs"], optional = true }
 rand = "0.10"
 rustc-hash = { workspace = true }
 rustls = { version = "0.23", optional = true }
@@ -65,12 +52,9 @@ tokio = { workspace = true, features = ["macros", "net", "rt", "time"] }
 [target.'cfg(target_os = "linux")'.dev-dependencies]
 io-uring = { workspace = true }
 libc = { workspace = true }
-moq-tokio = { workspace = true, features = ["quinn", "aws-lc-rs"] }
+moq-tokio = { workspace = true, features = ["noq", "aws-lc-rs"] }
 nix = { workspace = true }
 noq-udp = { workspace = true }
-# The raw peer the endpoint and WebTransport tests drive, whichever backend is
-# under test.
-quiche = "0.29"
 rcgen = { version = "0.14", default-features = false, features = ["pem", "aws_lc_rs"] }
 rustls = "0.23"
 # The qlog test parses every record of a trace, which is what catches a
@@ -78,7 +62,7 @@ rustls = "0.23"
 serde_json = { workspace = true }
 tempfile = { workspace = true }
 tracing = "0.1"
-web-transport-quinn = { workspace = true }
+web-transport-noq = { workspace = true }
 
 [[bench]]
 name = "udp_tokio"
@@ -89,7 +73,8 @@ name = "udp_uring"
 harness = false
 
 [[bench]]
-name = "echo_quiche"
+name = "echo_noq"
+path = "benches/echo_noq.rs"
 harness = false
 
 [[bench]]
diff --git a/rs/moq-uring/README.md b/rs/moq-uring/README.md
index 95d68f9f12..58fb24bf72 100644
--- a/rs/moq-uring/README.md
+++ b/rs/moq-uring/README.md
@@ -60,48 +60,36 @@ the tokio stack.
 
 ## Backends
 
-The sans-IO QUIC stack behind `quic` is a build-time choice, and exactly one of
-them is compiled:
+The `quic` module uses the sans-IO [noq-proto](https://github.com/kixelated/noq)
+stack with rustls. The `noq` feature is enabled by default and remains optional
+so the worker, timers, and UDP socket can be built without QUIC.
 
 | Feature | Stack | TLS |
 |---|---|---|
 | `noq` (default) | [noq-proto](https://github.com/kixelated/noq) | rustls |
-| `quinn` | [quinn-proto](https://github.com/quinn-rs/quinn) | rustls, the stack the rest of this workspace already links |
-| `quiche` | [quiche](https://github.com/cloudflare/quiche) | BoringSSL, which needs cmake and a C++ toolchain to build |
 
-Nothing above the module changes: the same `quic::{Endpoint, Connection,
-SendStream, RecvStream}`, the same WebTransport layer, the same tests. A build
-asking for several (`--all-features`) gets `noq`, and a build asking for
-neither leaves the `quic` module out entirely, keeping the worker, its timers,
-and `udp::Socket`.
+Building without default features leaves the `quic` module out entirely.
 
 ```bash
-cargo test -p moq-uring --no-default-features --features quinn
+cargo test -p moq-uring --features noq
 ```
 
-`moq-relay` uses noq with `--features io-uring`. The
-`io-uring-quinn` and `io-uring-quiche` features select the alternatives.
+`moq-relay` enables it with `--features io-uring`.
 
-The `qlog` feature is orthogonal to the three, turning on whichever backend's
-own qlog support is compiled. Its per-backend shape follows the tokio stack:
-noq and quiche write one file per connection, while quinn-proto takes one sink
-per transport config and so writes one file per endpoint, tagging each event
-with the connection's qlog `group_id`.
+The `qlog` feature turns on noq's capture support. It writes one file per
+connection.
 
 ## Validation
 
-Every test runs against whichever backend is compiled, so the suite is the
-parity check between the three.
-
-`tests/echo.rs` runs a raw [quiche](https://github.com/cloudflare/quiche) echo
-over the worker: handshake, half a megabyte each way, timers driven by
-quiche's own timeout. `tests/session.rs` runs full moq-lite sessions through
+`tests/echo.rs` runs an echo against a tokio noq peer over the worker:
+handshake, half a megabyte each way, and timers driven by noq's timeout.
+`tests/session.rs` runs full moq-lite sessions through
 `quic::Endpoint` (including two clients demuxed on one server socket), and
 `tests/endpoint.rs` covers the endpoint mechanics (dial+accept on one socket,
 version negotiation, the dial-only refusal), `tests/workers.rs` runs a
 steered two-worker reuseport group serving one port across threads, and
-`tests/web.rs` is WebTransport interop against `web-transport-quinn` (the
-stack browsers interop with): stream/datagram echo through the H3 framing,
+`tests/web.rs` is WebTransport interop against `web-transport-noq`: stream and
+datagram echo through the H3 framing,
 close codes through the capsule, and a full moq-lite session over
 WebTransport. All of them skip (loudly) below the kernel floor, which
 includes GitHub-hosted CI runners.
@@ -110,8 +98,8 @@ includes GitHub-hosted CI runners.
 
 `udp_tokio` and `udp_uring` are the disposable syscall-level matrices from the
 first spike (recv batching x GRO x GSO, epoll vs io\_uring); see git history
-for their methodology. `echo_quiche` is the ablation matrix over the real
-worker: the same quiche echo with receive batching, GRO, and GSO toggled one
+for their methodology. `echo_noq` is the ablation matrix over the real
+worker: the same noq echo with receive batching, GRO, and GSO toggled one
 at a time.
 
 ```bash
diff --git a/rs/moq-uring/benches/echo_noq.rs b/rs/moq-uring/benches/echo_noq.rs
new file mode 100644
index 0000000000..9797dd191d
--- /dev/null
+++ b/rs/moq-uring/benches/echo_noq.rs
@@ -0,0 +1,167 @@
+//! Echo a tokio noq peer through the io_uring worker while ablating UDP features.
+
+use criterion::{criterion_group, criterion_main};
+
+#[cfg(target_os = "linux")]
+#[path = "../tests/support.rs"]
+mod support;
+
+#[cfg(target_os = "linux")]
+mod linux {
+	use std::net::UdpSocket;
+	use std::time::Instant;
+
+	use criterion::{BenchmarkId, Criterion, Throughput};
+	use moq_uring::{Config, Error, Worker, quic, udp};
+	use web_transport_trait::poll::{RecvStream as _, SendStream as _, Session as _};
+
+	use super::support;
+
+	const PAYLOAD: usize = 1024 * 1024;
+
+	async fn drain(recv: &mut quic::web::RecvStream) -> Vec<u8> {
+		let mut out = Vec::new();
+		let mut buf = [0u8; 64 * 1024];
+		loop {
+			match std::future::poll_fn(|cx| recv.poll_read(cx, &mut buf))
+				.await
+				.expect("read")
+			{
+				Some(n) => out.extend_from_slice(&buf[..n]),
+				None => return out,
+			}
+		}
+	}
+
+	async fn write_finish(send: &mut quic::web::SendStream, mut buf: &[u8]) {
+		while !buf.is_empty() {
+			let n = std::future::poll_fn(|cx| send.poll_write(cx, buf))
+				.await
+				.expect("write");
+			buf = &buf[n..];
+		}
+		send.finish().expect("finish");
+	}
+
+	fn measure(udp_config: udp::Config, iterations: u64) -> std::time::Duration {
+		let mut worker = Worker::new(Config::default()).expect("worker");
+		let handle = worker.handle();
+		let certs = support::certs().expect("certificates");
+		let mut server = quic::server::Config::new(quic::Identity::open(&certs.cert, &certs.key).expect("identity"));
+		server.alpn = vec![web_transport_noq::ALPN.to_string()];
+		let socket = handle
+			.udp(UdpSocket::bind("127.0.0.1:0").expect("bind"), udp_config)
+			.expect("socket");
+		let endpoint = quic::Endpoint::new(&handle, socket, quic::endpoint::Config::default().with_server(server))
+			.expect("endpoint");
+		let addr = endpoint.local_addr();
+		let (start_tx, start_rx) = std::sync::mpsc::sync_channel::<()>(0);
+		let (done_tx, done_rx) = std::sync::mpsc::sync_channel::<()>(0);
+		let client = std::thread::spawn(move || {
+			let runtime = tokio::runtime::Builder::new_current_thread()
+				.enable_all()
+				.build()
+				.expect("runtime");
+			runtime.block_on(async move {
+				let client = web_transport_noq::ClientBuilder::new()
+					.dangerous()
+					.with_no_certificate_verification()
+					.expect("client");
+				let request = web_transport_noq::proto::ConnectRequest::new(
+					url::Url::parse(&format!("https://{addr}/echo")).expect("url"),
+				);
+				let session = client.connect(request).await.expect("connect");
+				let payload = vec![0x5a; PAYLOAD];
+				while start_rx.recv().is_ok() {
+					let (mut send, mut recv) = session.open_bi().await.expect("open stream");
+					send.write_all(&payload).await.expect("write");
+					send.finish().expect("finish");
+					assert_eq!(recv.read_to_end(PAYLOAD + 1).await.expect("read").len(), PAYLOAD);
+					done_tx.send(()).expect("done");
+				}
+			});
+		});
+
+		let mut session = worker
+			.block_on(async {
+				let conn = endpoint.accept().await.expect("accept");
+				quic::web::Request::accept(&handle, conn)
+					.await
+					.expect("handshake")
+					.ok()
+					.await
+					.expect("respond")
+			})
+			.expect("worker");
+
+		let start = Instant::now();
+		for _ in 0..iterations {
+			start_tx.send(()).expect("start");
+			worker
+				.block_on(async {
+					let (mut send, mut recv) = std::future::poll_fn(|cx| session.poll_accept_bi(cx))
+						.await
+						.expect("accept stream");
+					let payload = drain(&mut recv).await;
+					write_finish(&mut send, &payload).await;
+				})
+				.expect("worker");
+			done_rx.recv().expect("done");
+		}
+		let elapsed = start.elapsed();
+
+		drop(start_tx);
+		client.join().expect("client thread");
+		elapsed
+	}
+
+	pub fn benchmark(c: &mut Criterion) {
+		match Worker::new(Config::default()) {
+			Ok(worker) => drop(worker),
+			Err(Error::Unsupported(reason)) => {
+				eprintln!("skipping io_uring echo benchmark: {reason}");
+				return;
+			}
+			Err(err) => panic!("worker setup failed: {err}"),
+		}
+
+		let all = udp::Config::default();
+		let mut no_gso = all.clone();
+		no_gso.gso = false;
+		let mut no_gro = all.clone();
+		no_gro.gro = false;
+		let mut oneshot = all.clone();
+		oneshot.multishot = false;
+		let mut none = all.clone();
+		none.gso = false;
+		none.gro = false;
+		none.multishot = false;
+		let ablations = [
+			("all-on", all),
+			("no-gso", no_gso),
+			("no-gro", no_gro),
+			("oneshot", oneshot),
+			("all-off", none),
+		];
+
+		let mut group = c.benchmark_group("echo_noq");
+		group.throughput(Throughput::Bytes(PAYLOAD as u64));
+
+		for (name, udp_config) in ablations {
+			group.bench_function(BenchmarkId::new("udp", name), |b| {
+				b.iter_custom(|iterations| measure(udp_config.clone(), iterations));
+			});
+		}
+
+		group.finish();
+	}
+}
+
+#[cfg(target_os = "linux")]
+use linux::benchmark;
+
+#[cfg(not(target_os = "linux"))]
+fn benchmark(_: &mut Criterion) {}
+
+criterion_group!(benches, benchmark);
+criterion_main!(benches);
diff --git a/rs/moq-uring/benches/echo_quiche.rs b/rs/moq-uring/benches/echo_quiche.rs
deleted file mode 100644
index 63f4e1d827..0000000000
--- a/rs/moq-uring/benches/echo_quiche.rs
+++ /dev/null
@@ -1,148 +0,0 @@
-//! The PR-2 ablation matrix: a raw-quiche echo through the worker, toggling
-//! receive batching (multishot + provided buffers), GRO, and GSO one at a
-//! time. Run it with `just rs bench-echo` on a Linux 6.12+ kernel.
-
-use criterion::{criterion_group, criterion_main};
-
-#[cfg(target_os = "linux")]
-#[path = "../tests/support/quiche.rs"]
-mod support;
-
-#[cfg(target_os = "linux")]
-mod linux {
-	use std::net::UdpSocket;
-	use std::time::Instant;
-
-	use criterion::{BenchmarkId, Criterion, Throughput};
-	use moq_uring::{Config, Error, Worker, udp};
-
-	use super::support;
-
-	/// Bytes echoed per iteration (each direction).
-	const PAYLOAD: usize = 1024 * 1024;
-
-	struct Ablation {
-		name: &'static str,
-		config: udp::Config,
-	}
-
-	fn ablations() -> Vec<Ablation> {
-		let all = udp::Config::default();
-		let mut no_gso = all.clone();
-		no_gso.gso = false;
-		let mut no_gro = all.clone();
-		no_gro.gro = false;
-		let mut oneshot = all.clone();
-		oneshot.multishot = false;
-		let mut none = all.clone();
-		none.gso = false;
-		none.gro = false;
-		none.multishot = false;
-		vec![
-			Ablation {
-				name: "all-on",
-				config: all,
-			},
-			Ablation {
-				name: "no-gso",
-				config: no_gso,
-			},
-			Ablation {
-				name: "no-gro",
-				config: no_gro,
-			},
-			Ablation {
-				name: "oneshot",
-				config: oneshot,
-			},
-			Ablation {
-				name: "all-off",
-				config: none,
-			},
-		]
-	}
-
-	pub fn benchmark(c: &mut Criterion) {
-		// Kernel-gated like the tests: skip loudly below the 6.12 floor.
-		let probe = match Worker::new(Config::default()) {
-			Ok(worker) => worker,
-			Err(Error::Unsupported(reason)) => {
-				eprintln!("skipping io_uring echo benchmark: {reason}");
-				return;
-			}
-			Err(err) => panic!("worker setup failed: {err}"),
-		};
-		drop(probe);
-
-		let mut group = c.benchmark_group("echo_quiche");
-		group.throughput(Throughput::Bytes(PAYLOAD as u64));
-
-		for ablation in ablations() {
-			let mut worker = Worker::new(Config::default()).expect("worker");
-			let handle = worker.handle();
-
-			let certs = support::certs().expect("certificates");
-			let server_sock = handle
-				.udp(UdpSocket::bind("127.0.0.1:0").expect("bind"), ablation.config.clone())
-				.expect("server socket");
-			let server_addr = server_sock.local_addr().expect("server addr");
-			let client_sock = handle
-				.udp(UdpSocket::bind("127.0.0.1:0").expect("bind"), ablation.config.clone())
-				.expect("client socket");
-
-			let server_handle = handle.clone();
-			handle.spawn(async move {
-				support::echo_server(server_handle, server_sock, certs)
-					.await
-					.expect("echo server");
-			});
-
-			// Establish once; iterations then measure steady-state transfer.
-			let mut client = worker
-				.block_on(async {
-					let mut client = support::Peer::connect(&handle, client_sock, server_addr)?;
-					client.flush().await?;
-					while !client.conn.is_established() {
-						client.step().await?;
-						client.flush().await?;
-					}
-					anyhow::Ok(client)
-				})
-				.expect("worker")
-				.expect("handshake");
-
-			let payload: Vec<u8> = (0..PAYLOAD).map(|i| (i * 31 % 251) as u8).collect();
-			// Client-initiated bidirectional stream ids: 0, 4, 8, ...
-			let mut next_stream = 0u64;
-
-			group.bench_with_input(BenchmarkId::from_parameter(ablation.name), &ablation.config, |b, _| {
-				b.iter_custom(|iterations| {
-					worker
-						.block_on(async {
-							let start = Instant::now();
-							for _ in 0..iterations {
-								let stream = next_stream;
-								next_stream += 4;
-								let echoed = support::stream_echo(&mut client, stream, &payload).await?;
-								assert_eq!(echoed, PAYLOAD, "lost echo bytes");
-							}
-							anyhow::Ok(start.elapsed())
-						})
-						.expect("worker")
-						.expect("echo iteration")
-				});
-			});
-		}
-
-		group.finish();
-	}
-}
-
-#[cfg(target_os = "linux")]
-use linux::benchmark;
-
-#[cfg(not(target_os = "linux"))]
-fn benchmark(_: &mut criterion::Criterion) {}
-
-criterion_group!(benches, benchmark);
-criterion_main!(benches);
diff --git a/rs/moq-uring/benches/session_lite.rs b/rs/moq-uring/benches/session_lite.rs
index c0f418e40a..87e8bf9e17 100644
--- a/rs/moq-uring/benches/session_lite.rs
+++ b/rs/moq-uring/benches/session_lite.rs
@@ -1,7 +1,7 @@
 //! The PR-4 ablation matrix at session level: a full moq-lite session pair on
 //! one worker, publisher to subscriber over loopback QUIC, toggling receive
 //! batching, GRO, and GSO exactly like the raw echo. Each iteration delivers
-//! one group of 32 x 32 KiB frames (1 MiB, matching `echo_quiche`'s unit), so
+//! one group of 32 x 32 KiB frames (1 MiB, matching `echo_noq`'s unit), so
 //! the two matrices are directly comparable: the difference is the moq-net
 //! machine and container framing on top of the same wire path.
 //!
@@ -9,11 +9,11 @@
 
 use criterion::{criterion_group, criterion_main};
 
-#[cfg(all(target_os = "linux", any(feature = "noq", feature = "quiche", feature = "quinn")))]
-#[path = "../tests/support/quiche.rs"]
+#[cfg(all(target_os = "linux", feature = "noq"))]
+#[path = "../tests/support.rs"]
 mod support;
 
-#[cfg(all(target_os = "linux", any(feature = "noq", feature = "quiche", feature = "quinn")))]
+#[cfg(all(target_os = "linux", feature = "noq"))]
 mod linux {
 	use std::net::UdpSocket;
 	use std::pin::Pin;
@@ -253,10 +253,10 @@ mod linux {
 	}
 }
 
-#[cfg(all(target_os = "linux", any(feature = "noq", feature = "quiche", feature = "quinn")))]
+#[cfg(all(target_os = "linux", feature = "noq"))]
 use linux::benchmark;
 
-#[cfg(not(all(target_os = "linux", any(feature = "noq", feature = "quiche", feature = "quinn"))))]
+#[cfg(not(all(target_os = "linux", feature = "noq")))]
 fn benchmark(_: &mut criterion::Criterion) {}
 
 criterion_group!(benches, benchmark);
diff --git a/rs/moq-uring/src/lib.rs b/rs/moq-uring/src/lib.rs
index b7627cfc17..d5e1ca4859 100644
--- a/rs/moq-uring/src/lib.rs
+++ b/rs/moq-uring/src/lib.rs
@@ -17,9 +17,8 @@
 //! included), each a [`quic::Connection`] implementing the transport traits,
 //! so `moq_net::Client::connect_lite` and `Server::accept_lite` run real
 //! moq-lite sessions on the worker ([`Handle`] is their
-//! [`moq_net::Runtime`]). The stack underneath is the `noq` (default),
-//! `quinn`, or `quiche` feature; the module is the same either way, and a build with
-//! neither leaves it out.
+//! [`moq_net::Runtime`]). The stack underneath is enabled by the `noq` feature;
+//! a build without it leaves the module out.
 //!
 //! [`metrics::Metrics`] is how the worker's own health leaves its thread:
 //! relaxed counters for the buffer pools, the batching mechanisms, the ring,
@@ -36,7 +35,7 @@
 mod error;
 pub mod metrics;
 mod park;
-#[cfg(any(feature = "noq", feature = "quiche", feature = "quinn"))]
+#[cfg(feature = "noq")]
 pub mod quic;
 mod shared;
 mod timer;
diff --git a/rs/moq-uring/src/quic/endpoint.rs b/rs/moq-uring/src/quic/endpoint.rs
index 4c493c157a..e2d4aa12ed 100644
--- a/rs/moq-uring/src/quic/endpoint.rs
+++ b/rs/moq-uring/src/quic/endpoint.rs
@@ -22,7 +22,7 @@
 
 use super::server;
 
-pub use super::backend::Endpoint;
+pub use super::noq::Endpoint;
 
 /// Every connection id this endpoint issues is this long: long enough to be
 /// unguessable per socket, and fixed because a short header does not encode
diff --git a/rs/moq-uring/src/quic/mod.rs b/rs/moq-uring/src/quic/mod.rs
index 7aed10b3a7..e51f6b108a 100644
--- a/rs/moq-uring/src/quic/mod.rs
+++ b/rs/moq-uring/src/quic/mod.rs
@@ -16,20 +16,7 @@
 //! [`web`] layer's HTTP/3 CONNECT handshake on top of the same adapter, with
 //! [`web::Session`] as the one transport type covering both.
 //!
-//! # Backends
-//!
-//! The sans-IO stack underneath is a build-time choice, and only one of them
-//! is ever compiled:
-//!
-//! - `noq` (default): noq-proto, TLS through rustls.
-//! - `quinn`: quinn-proto, TLS through rustls, which is the same stack the
-//!   rest of this workspace uses.
-//! - `quiche`: Cloudflare's stack, TLS through BoringSSL.
-//!
-//! Everything above this module is the same either way: the types in here,
-//! the [`web`] layer, and the sessions they carry. Enabling several features at
-//! once selects `noq`, so a `--all-features` build has one backend like
-//! every other build.
+//! Noq is the sans-IO QUIC stack underneath the worker.
 
 pub mod client;
 pub mod endpoint;
@@ -38,20 +25,10 @@ pub mod qlog;
 pub mod server;
 pub mod web;
 
-// `noq` wins a build that asks for several, so `--all-features` compiles one
-// backend rather than failing.
-#[cfg(all(feature = "quiche", not(feature = "noq"), not(feature = "quinn")))]
-#[path = "quiche/mod.rs"]
-mod backend;
-#[cfg(all(feature = "quinn", not(feature = "noq")))]
-#[path = "quinn/mod.rs"]
-mod backend;
-#[cfg(feature = "noq")]
-#[path = "quinn/mod.rs"]
-mod backend;
+mod noq;
 
-pub use backend::{Connection, RecvStream, SendStream};
 pub use endpoint::Endpoint;
+pub use noq::{Connection, RecvStream, SendStream};
 
 /// The QUIC payload size every full datagram in a GSO train uses, and the
 /// stride GRO coalesces with.
@@ -132,9 +109,7 @@ pub struct Transport {
 	pub keep_alive: Option<std::time::Duration>,
 	/// Where to write qlog traces, or `None` (the default) to write none.
 	///
-	/// The layout follows the backend, as it does on the tokio stack: noq and
-	/// quiche write one file per connection, while quinn-proto takes one sink
-	/// per configuration and so writes one file per endpoint, tagging each
+	/// Noq takes one sink per configuration and writes one file per endpoint, tagging each
 	/// event with the qlog `group_id` of the connection it belongs to.
 	///
 	/// Only compiled with the `qlog` feature, so a build without it cannot ask
@@ -158,11 +133,9 @@ impl Default for Transport {
 
 /// The congestion control family a connection runs.
 ///
-/// A family rather than a named algorithm, because each backend ships a
-/// different generation: quiche's delay-based controller is BBRv2 and quinn's
-/// is BBRv1, so a `Bbr` variant would promise more than either delivers.
+/// Noq uses CUBIC for loss-based control and BBRv3 for delay-based control.
 ///
-/// The default is [`Loss`](Self::Loss), which is what both backends run
+/// The default is [`Loss`](Self::Loss), which is what noq runs
 /// unasked. An application carrying live media wants [`Delay`](Self::Delay)
 /// and should say so; the relay does.
 #[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
diff --git a/rs/moq-uring/src/quic/quinn/connection.rs b/rs/moq-uring/src/quic/noq/connection.rs
similarity index 88%
rename from rs/moq-uring/src/quic/quinn/connection.rs
rename to rs/moq-uring/src/quic/noq/connection.rs
index 55fd53d61c..a4164c641e 100644
--- a/rs/moq-uring/src/quic/quinn/connection.rs
+++ b/rs/moq-uring/src/quic/noq/connection.rs
@@ -6,9 +6,7 @@ use std::task::{Context, Poll};
 use std::time::Instant;
 
 use bytes::Bytes;
-#[cfg(feature = "noq")]
-use noq_proto as quinn_proto;
-use quinn_proto::{ConnectionHandle, Dir, StreamId, VarInt};
+use noq_proto::{ConnectionHandle, Dir, StreamId, VarInt};
 use rustc_hash::FxHashMap;
 
 use super::super::{Error, SEGMENT};
@@ -28,7 +26,7 @@ const TRAIN_SEGMENTS: usize = 63;
 /// operation can mutate the connection, drop that borrow, and then register a
 /// waiter without ever holding both.
 pub(crate) struct Inner {
-	pub(crate) conn: RefCell<quinn_proto::Connection>,
+	pub(crate) conn: RefCell<noq_proto::Connection>,
 	pub(crate) state: RefCell<State>,
 }
 
@@ -40,7 +38,7 @@ pub(crate) struct State {
 	established: bool,
 	establish_waiters: kio::WaiterList,
 
-	/// Whoever is waiting for a peer-initiated stream. quinn-proto hands the
+	/// Whoever is waiting for a peer-initiated stream. noq-proto hands the
 	/// ids out in order, so the queue is its own.
 	accept_bi_waiters: kio::WaiterList,
 	accept_uni_waiters: kio::WaiterList,
@@ -51,7 +49,7 @@ pub(crate) struct State {
 	/// Per-stream read/write parking, keyed by stream id.
 	///
 	/// FxHash rather than SipHash on all four of these: they sit on the
-	/// driver's per-event path, and quinn-proto assigns the ids.
+	/// driver's per-event path, and noq-proto assigns the ids.
 	readable: FxHashMap<StreamId, kio::WaiterList>,
 	writable: FxHashMap<StreamId, kio::WaiterList>,
 	/// Send streams waiting for their end: a FIN the peer acknowledged, or a
@@ -79,7 +77,7 @@ pub(crate) struct State {
 	dead: bool,
 
 	/// The close this side asked for, until the driver has put it on the wire.
-	/// quinn raises no event for it, so this is what the terminal error is
+	/// noq raises no event for it, so this is what the terminal error is
 	/// built from.
 	local_close: Option<(u64, String)>,
 }
@@ -185,13 +183,13 @@ impl Inner {
 
 	/// Start tracking send stream `id`, which a handle now owns.
 	///
-	/// Seeded from quinn rather than empty: a peer can open a bidirectional
+	/// Seeded from noq rather than empty: a peer can open a bidirectional
 	/// stream and stop it before the application ever accepts it, and that
-	/// event arrives with no handle to record it against. quinn still knows,
+	/// event arrives with no handle to record it against. noq still knows,
 	/// so a `poll_closed` on the fresh handle reports the stop instead of
 	/// waiting for an event that has already been and gone.
 	pub(crate) fn track(&self, id: StreamId) {
-		// Err means quinn has no send half for the id, which is nothing to
+		// Err means noq has no send half for the id, which is nothing to
 		// report either way.
 		let stopped = self.conn.borrow_mut().send_stream(id).stopped().ok().flatten();
 		self.state
@@ -240,7 +238,7 @@ impl Inner {
 			VarInt::from_u64(code).unwrap_or(VarInt::MAX),
 			Bytes::copy_from_slice(reason.as_bytes()),
 		);
-		// quinn raises no event for a close the application asked for, so the
+		// noq raises no event for a close the application asked for, so the
 		// terminal error is ours to publish. Not here though: the driver
 		// publishes it once it has staged the CONNECTION_CLOSE, so a caller
 		// that stops driving the worker the moment `poll_closed` resolves has
@@ -318,7 +316,7 @@ impl Clone for Connection {
 /// Build a connection's shared state and its driver.
 ///
 /// The driver future does timers, event sweeps, and egress; ingress arrives
-/// from the endpoint's demux task, which feeds quinn-proto directly and
+/// from the endpoint's demux task, which feeds noq-proto directly and
 /// [kicks](Inner::kick) the driver. The caller spawns the future and reclaims
 /// the connection's bookkeeping once it resolves.
 pub(crate) fn launch(
@@ -326,7 +324,7 @@ pub(crate) fn launch(
 	socket: Rc<udp::Socket>,
 	endpoint: Weak<endpoint::Inner>,
 	key: ConnectionHandle,
-	conn: quinn_proto::Connection,
+	conn: noq_proto::Connection,
 ) -> (Shared, impl Future<Output = ()> + use<>) {
 	let shared = Rc::new(Inner {
 		conn: RefCell::new(conn),
@@ -365,7 +363,7 @@ pub(crate) async fn establish(shared: Shared) -> Result<Connection, Error> {
 		let conn = shared.conn.borrow();
 		conn.crypto_session()
 			.handshake_data()
-			.and_then(|data| data.downcast::<quinn_proto::crypto::rustls::HandshakeData>().ok())
+			.and_then(|data| data.downcast::<noq_proto::crypto::rustls::HandshakeData>().ok())
 			.and_then(|data| data.protocol)
 			.map(|proto| String::from_utf8_lossy(&proto).into_owned())
 	};
@@ -469,7 +467,7 @@ impl web_transport_trait::poll::Session for Connection {
 				Poll::Ready(Ok(()))
 			}
 			// The send queue is full; a flush frees space.
-			Err(quinn_proto::SendDatagramError::Blocked(_)) => {
+			Err(noq_proto::SendDatagramError::Blocked(_)) => {
 				let mut state = self.shared.state.borrow_mut();
 				waiter.register(&mut state.datagram_send_waiters);
 				Poll::Pending
@@ -514,32 +512,20 @@ impl web_transport_trait::poll::Session for Connection {
 	}
 
 	fn stats(&self) -> impl web_transport_trait::Stats {
-		#[cfg(feature = "noq")]
 		let (stats, path) = {
 			let mut conn = self.shared.conn.borrow_mut();
 			let stats = conn.stats();
-			let path = conn.path_stats(quinn_proto::PathId::ZERO).unwrap_or_default();
+			let path = conn.path_stats(noq_proto::PathId::ZERO).unwrap_or_default();
 			(stats, path)
 		};
-		#[cfg(not(feature = "noq"))]
-		let stats = self.shared.conn.borrow().stats();
 		Stats {
 			bytes_sent: stats.udp_tx.bytes,
 			bytes_received: stats.udp_rx.bytes,
-			#[cfg(feature = "noq")]
 			bytes_lost: stats.lost_bytes,
-			#[cfg(not(feature = "noq"))]
-			bytes_lost: stats.path.lost_bytes,
 			packets_sent: stats.udp_tx.datagrams,
 			packets_received: stats.udp_rx.datagrams,
-			#[cfg(feature = "noq")]
 			packets_lost: stats.lost_packets,
-			#[cfg(not(feature = "noq"))]
-			packets_lost: stats.path.lost_packets,
-			#[cfg(feature = "noq")]
 			rtt: path.rtt,
-			#[cfg(not(feature = "noq"))]
-			rtt: stats.path.rtt,
 		}
 	}
 }
@@ -550,7 +536,7 @@ impl std::fmt::Debug for Connection {
 	}
 }
 
-/// A snapshot of quinn-proto's counters in [`web_transport_trait::Stats`]
+/// A snapshot of noq-proto's counters in [`web_transport_trait::Stats`]
 /// shape.
 struct Stats {
 	bytes_sent: u64,
@@ -591,7 +577,7 @@ impl web_transport_trait::Stats for Stats {
 		Some(self.rtt)
 	}
 
-	/// Nothing, because quinn-proto exposes no delivery or pacing rate.
+	/// Nothing, because noq-proto exposes no delivery or pacing rate.
 	///
 	/// The congestion window over the RTT is not a stand-in for one: BBR
 	/// deliberately holds about twice the bandwidth-delay product (nearly
@@ -608,7 +594,7 @@ impl web_transport_trait::Stats for Stats {
 
 /// The per-connection task: endpoint events, application events, timers, and
 /// packets out. Packets in come from the endpoint's demux task, which feeds
-/// quinn-proto directly and kicks this driver.
+/// noq-proto directly and kicks this driver.
 struct Driver {
 	shared: Shared,
 	socket: Rc<udp::Socket>,
@@ -618,7 +604,7 @@ struct Driver {
 	endpoint: Weak<endpoint::Inner>,
 	key: ConnectionHandle,
 	deadline: moq_net::runtime::Deadline<Handle>,
-	/// Egress staging: quinn-proto writes into a `Vec`, so a train is built
+	/// Egress staging: noq-proto writes into a `Vec`, so a train is built
 	/// here and copied into the socket's registered buffer.
 	scratch: Vec<u8>,
 	/// The last flush found the transmit pool drained, so nothing it owed the
@@ -649,7 +635,7 @@ impl Driver {
 			}
 			// A closed connection still owes the peer its CONNECTION_CLOSE
 			// (and a retransmit for each packet that arrives after), so the
-			// driver runs until quinn says the drain is over.
+			// driver runs until noq says the drain is over.
 			if self.shared.conn.borrow().is_drained() {
 				return Poll::Ready(());
 			}
@@ -703,26 +689,25 @@ impl Driver {
 
 			let mut state = self.shared.state.borrow_mut();
 			match event {
-				quinn_proto::Event::Connected => {
+				noq_proto::Event::Connected => {
 					state.established = true;
 					state.establish_waiters.wake();
 				}
-				quinn_proto::Event::ConnectionLost { reason } => state.fail(reason.into()),
-				quinn_proto::Event::DatagramReceived => state.datagram_recv_waiters.wake(),
-				quinn_proto::Event::DatagramsUnblocked => state.datagram_send_waiters.wake(),
-				quinn_proto::Event::HandshakeDataReady => {}
-				quinn_proto::Event::Stream(event) => sweep_stream(&mut state, event),
-				#[cfg(feature = "noq")]
-				quinn_proto::Event::HandshakeConfirmed
-				| quinn_proto::Event::Path(_)
-				| quinn_proto::Event::NatTraversal(_) => {}
+				noq_proto::Event::ConnectionLost { reason } => state.fail(reason.into()),
+				noq_proto::Event::DatagramReceived => state.datagram_recv_waiters.wake(),
+				noq_proto::Event::DatagramsUnblocked => state.datagram_send_waiters.wake(),
+				noq_proto::Event::HandshakeDataReady => {}
+				noq_proto::Event::Stream(event) => sweep_stream(&mut state, event),
+				noq_proto::Event::HandshakeConfirmed
+				| noq_proto::Event::Path(_)
+				| noq_proto::Event::NatTraversal(_) => {}
 			}
 		}
 	}
 
 	/// Publish the terminal error for a close this side asked for.
 	///
-	/// quinn raises no event for it, so the driver is what reports it, and
+	/// noq raises no event for it, so the driver is what reports it, and
 	/// only once the flush above has staged the CONNECTION_CLOSE, since an
 	/// application is free to stop driving the worker the moment
 	/// `poll_closed` resolves. Staged is not delivered: the send is
@@ -748,13 +733,13 @@ impl Driver {
 			// Backpressure, or nothing left to stage.
 			Poll::Pending => return Poll::Pending,
 		}
-		// Requeue behind the other ready tasks. If quinn is drained, the next
+		// Requeue behind the other ready tasks. If noq is drained, the next
 		// poll costs one empty acquire and then parks normally.
 		waiter.waker().wake_by_ref();
 		Poll::Pending
 	}
 
-	/// Fill one transmit buffer and stage it. Ignores quinn's pacing hint;
+	/// Fill one transmit buffer and stage it. Ignores noq's pacing hint;
 	/// the congestion controller still bounds each train.
 	fn flush_one(&mut self, waiter: &kio::Waiter) -> Poll<Result<(), Error>> {
 		let mut tx = match self.socket.poll_acquire(waiter) {
@@ -775,7 +760,6 @@ impl Driver {
 				tx.len()
 			))));
 		}
-		#[cfg(feature = "noq")]
 		let segments = std::num::NonZeroUsize::new(segments).expect("segments was checked above");
 
 		self.scratch.clear();
@@ -792,7 +776,7 @@ impl Driver {
 
 		tx[..transmit.size].copy_from_slice(&self.scratch[..transmit.size]);
 		// A lone datagram is its own segment size, and the socket's GSO
-		// stride has to match what quinn actually packed.
+		// stride has to match what noq actually packed.
 		let segment = transmit.segment_size.unwrap_or(transmit.size);
 		if let Err(err) = tx.send(transmit.size, transmit.destination, segment) {
 			return Poll::Ready(Err(Error::Io(err.to_string())));
@@ -826,25 +810,25 @@ fn end(state: &mut State, id: StreamId, end: End) {
 }
 
 /// Apply one stream event to the parking tables.
-fn sweep_stream(state: &mut State, event: quinn_proto::StreamEvent) {
+fn sweep_stream(state: &mut State, event: noq_proto::StreamEvent) {
 	// Waking removes the entry: a still-interested poller re-registers on its
 	// next poll, so the maps only hold streams somebody is parked on.
 	match event {
-		quinn_proto::StreamEvent::Opened { dir: Dir::Bi } => state.accept_bi_waiters.wake(),
-		quinn_proto::StreamEvent::Opened { dir: Dir::Uni } => state.accept_uni_waiters.wake(),
-		quinn_proto::StreamEvent::Available { .. } => state.open_waiters.wake(),
-		quinn_proto::StreamEvent::Readable { id } => {
+		noq_proto::StreamEvent::Opened { dir: Dir::Bi } => state.accept_bi_waiters.wake(),
+		noq_proto::StreamEvent::Opened { dir: Dir::Uni } => state.accept_uni_waiters.wake(),
+		noq_proto::StreamEvent::Available { .. } => state.open_waiters.wake(),
+		noq_proto::StreamEvent::Readable { id } => {
 			if let Some(mut waiters) = state.readable.remove(&id) {
 				waiters.wake();
 			}
 		}
-		quinn_proto::StreamEvent::Writable { id } => {
+		noq_proto::StreamEvent::Writable { id } => {
 			if let Some(mut waiters) = state.writable.remove(&id) {
 				waiters.wake();
 			}
 		}
-		quinn_proto::StreamEvent::Finished { id } => end(state, id, End::Delivered),
-		quinn_proto::StreamEvent::Stopped { id, error_code } => {
+		noq_proto::StreamEvent::Finished { id } => end(state, id, End::Delivered),
+		noq_proto::StreamEvent::Stopped { id, error_code } => {
 			end(state, id, End::Stopped(error_code.into_inner()));
 			// A writer blocked on capacity has to learn it will never come.
 			if let Some(mut waiters) = state.writable.remove(&id) {
@@ -856,12 +840,7 @@ fn sweep_stream(state: &mut State, event: quinn_proto::StreamEvent) {
 
 #[cfg(test)]
 mod tests {
-	// The parent's alias arrives through the glob below, which a build with both
-	// backend features on cannot tell apart from the quinn-proto crate itself.
-	#[cfg(feature = "noq")]
 	use noq_proto::Side;
-	#[cfg(not(feature = "noq"))]
-	use quinn_proto::Side;
 
 	use super::*;
 
diff --git a/rs/moq-uring/src/quic/quinn/endpoint.rs b/rs/moq-uring/src/quic/noq/endpoint.rs
similarity index 91%
rename from rs/moq-uring/src/quic/quinn/endpoint.rs
rename to rs/moq-uring/src/quic/noq/endpoint.rs
index 0911403078..8183121e37 100644
--- a/rs/moq-uring/src/quic/quinn/endpoint.rs
+++ b/rs/moq-uring/src/quic/noq/endpoint.rs
@@ -1,12 +1,12 @@
-//! The quinn endpoint: one socket, many quinn-proto connections.
+//! The noq endpoint: one socket, many noq-proto connections.
 //!
-//! quinn-proto's own [`quinn_proto::Endpoint`] is the routing table: it parses
+//! noq-proto's own [`noq_proto::Endpoint`] is the routing table: it parses
 //! each datagram, hands it to the connection its destination id names, mints
 //! and retires ids as peers consume them, and answers an unsupported version
 //! itself. What is left for us is the socket, the accept backlog, and a driver
 //! task per connection. Everything policy-shaped (the backlog, the shard
 //! steering, the id length) lives in [`super::super::endpoint`], which is
-//! shared with the other backend.
+//! shared with the rest of the endpoint implementation.
 
 use std::cell::{Cell, RefCell};
 use std::collections::VecDeque;
@@ -17,9 +17,7 @@ use std::task::Poll;
 use std::time::Instant;
 
 use bytes::BytesMut;
-#[cfg(feature = "noq")]
-use noq_proto as quinn_proto;
-use quinn_proto::{ConnectionHandle, DatagramEvent, Incoming, Transmit};
+use noq_proto::{ConnectionHandle, DatagramEvent, Incoming, Transmit};
 use rustc_hash::FxHashMap;
 
 use super::super::{Error, endpoint::Config};
@@ -40,11 +38,11 @@ pub(crate) struct Inner {
 	socket: Rc<udp::Socket>,
 	local: SocketAddr,
 	/// The routing table, and the server configuration it accepts with.
-	endpoint: RefCell<quinn_proto::Endpoint>,
+	endpoint: RefCell<noq_proto::Endpoint>,
 	accepting: RefCell<Option<Accepting>>,
 	/// Every live connection, looked up per received datagram.
 	///
-	/// FxHash rather than SipHash: quinn-proto hands out the handle, and it
+	/// FxHash rather than SipHash: noq-proto hands out the handle, and it
 	/// owns connection-id routing (and its hasher choices) itself, so nothing
 	/// a peer picks reaches this map.
 	conns: RefCell<FxHashMap<ConnectionHandle, connection::Shared>>,
@@ -79,7 +77,7 @@ impl Endpoint {
 		let server = match &config.server {
 			Some(server) => {
 				let mut server = super::server_config(server)?;
-				// quinn buffers half-open handshakes itself, so it enforces
+				// noq buffers half-open handshakes itself, so it enforces
 				// the same bound the accept queue does.
 				server.max_incoming(config.backlog);
 				Some(Arc::new(server))
@@ -89,10 +87,7 @@ impl Endpoint {
 		let accepting = server.is_some().then(|| Accepting { queue: VecDeque::new() });
 		// MTU discovery is off (the GSO pool sends fixed SEGMENT datagrams),
 		// so the endpoint has no reason to allow it either.
-		#[cfg(feature = "noq")]
-		let endpoint = quinn_proto::Endpoint::new(super::endpoint_config(config.shard)?, server, false);
-		#[cfg(not(feature = "noq"))]
-		let endpoint = quinn_proto::Endpoint::new(super::endpoint_config(config.shard)?, server, false, None);
+		let endpoint = noq_proto::Endpoint::new(super::endpoint_config(config.shard)?, server, false);
 
 		let inner = Rc::new(Inner {
 			handle: handle.clone(),
@@ -236,7 +231,6 @@ impl Inner {
 			// The socket does not report which local address a datagram
 			// arrived on, so the four-tuple stays half known, exactly as it
 			// does on a platform without `IP_PKTINFO`.
-			#[cfg(feature = "noq")]
 			let event = self.endpoint.borrow_mut().handle(
 				Instant::now(),
 				from.into(),
@@ -244,15 +238,6 @@ impl Inner {
 				BytesMut::from(&segment[..]),
 				&mut buf,
 			);
-			#[cfg(not(feature = "noq"))]
-			let event = self.endpoint.borrow_mut().handle(
-				Instant::now(),
-				from,
-				None,
-				None,
-				BytesMut::from(&segment[..]),
-				&mut buf,
-			);
 			match event {
 				Some(DatagramEvent::ConnectionEvent(key, event)) => {
 					let conn = self.conns.borrow().get(&key).cloned();
@@ -380,7 +365,7 @@ impl Inner {
 	}
 
 	/// Register `conn`, spawn its driver, and arrange its teardown.
-	fn launch(self: &Rc<Self>, key: ConnectionHandle, conn: quinn_proto::Connection) -> connection::Shared {
+	fn launch(self: &Rc<Self>, key: ConnectionHandle, conn: noq_proto::Connection) -> connection::Shared {
 		let (shared, driver) = connection::launch(&self.handle, self.socket.clone(), Rc::downgrade(self), key, conn);
 		self.conns.borrow_mut().insert(key, shared.clone());
 
@@ -397,8 +382,8 @@ impl Inner {
 	pub(crate) fn on_connection_event(
 		&self,
 		key: ConnectionHandle,
-		event: quinn_proto::EndpointEvent,
-	) -> Option<quinn_proto::ConnectionEvent> {
+		event: noq_proto::EndpointEvent,
+	) -> Option<noq_proto::ConnectionEvent> {
 		self.endpoint.borrow_mut().handle_event(key, event)
 	}
 
diff --git a/rs/moq-uring/src/quic/quinn/mod.rs b/rs/moq-uring/src/quic/noq/mod.rs
similarity index 76%
rename from rs/moq-uring/src/quic/quinn/mod.rs
rename to rs/moq-uring/src/quic/noq/mod.rs
index f1a6b29201..a0ae7507a9 100644
--- a/rs/moq-uring/src/quic/quinn/mod.rs
+++ b/rs/moq-uring/src/quic/noq/mod.rs
@@ -1,14 +1,13 @@
-//! The rustls backends: sans-IO noq-proto or quinn-proto on the worker's UDP path.
+//! The rustls-backed noq-proto stack on the worker's UDP path.
 //!
 //! TLS goes through rustls, which is what the rest of this workspace speaks,
 //! so a build selecting this backend links one TLS stack instead of two.
 //!
-//! quinn-proto owns more than quiche does: its [`quinn_proto::Endpoint`] holds
+//! [`noq_proto::Endpoint`] holds
 //! the connection-id routing table, mints and retires ids, answers unsupported
 //! versions, and buffers half-open handshakes. So [`Endpoint`] here is mostly
 //! the socket plumbing around it, and the parts that are ours (the accept
-//! backlog, shard steering, the driver task per connection) are the same
-//! shapes the quiche backend uses.
+//! backlog, shard steering, and the driver task per connection.
 
 mod connection;
 mod endpoint;
@@ -22,9 +21,7 @@ pub(crate) use connection::{End, Shared};
 
 use std::sync::Arc;
 
-#[cfg(feature = "noq")]
-use noq_proto as quinn_proto;
-use quinn_proto::crypto::rustls::{QuicClientConfig, QuicServerConfig};
+use noq_proto::crypto::rustls::{QuicClientConfig, QuicServerConfig};
 use rustls::pki_types::pem::PemObject;
 use rustls::pki_types::{CertificateDer, PrivateKeyDer};
 
@@ -32,17 +29,16 @@ use rustls::pki_types::{CertificateDer, PrivateKeyDer};
 use super::qlog;
 use super::{Congestion, Error, Identity, SEGMENT, Transport, client, endpoint::CID_LEN, server};
 
-/// Per-stream flow control credit, matching the quiche backend.
+/// Per-stream flow control credit.
 const STREAM_WINDOW: u32 = 4 * 1024 * 1024;
-/// Per-connection flow control credit, matching the quiche backend.
+/// Per-connection flow control credit.
 const CONNECTION_WINDOW: u32 = 16 * 1024 * 1024;
-/// How many datagrams to buffer in each direction, matching the quiche
-/// backend's 64.
+/// How many datagrams to buffer in each direction.
 const DATAGRAM_WINDOW: usize = 64 * SEGMENT;
 
-impl From<quinn_proto::ConnectionError> for Error {
-	fn from(err: quinn_proto::ConnectionError) -> Self {
-		use quinn_proto::ConnectionError;
+impl From<noq_proto::ConnectionError> for Error {
+	fn from(err: noq_proto::ConnectionError) -> Self {
+		use noq_proto::ConnectionError;
 		match err {
 			ConnectionError::ApplicationClosed(close) => Self::App {
 				code: close.error_code.into_inner(),
@@ -78,14 +74,9 @@ fn provider() -> Arc<rustls::crypto::CryptoProvider> {
 
 /// The endpoint-wide configuration: how connection ids are minted, and the
 /// largest datagram we tell peers we can receive.
-pub(crate) fn endpoint_config(
-	shard: Option<moq_sock::shard::Shard>,
-) -> Result<Arc<quinn_proto::EndpointConfig>, Error> {
-	let mut config = quinn_proto::EndpointConfig::default();
-	#[cfg(feature = "noq")]
+pub(crate) fn endpoint_config(shard: Option<moq_sock::shard::Shard>) -> Result<Arc<noq_proto::EndpointConfig>, Error> {
+	let mut config = noq_proto::EndpointConfig::default();
 	config.cid_generator(Arc::new(move || Box::new(Cids { shard })));
-	#[cfg(not(feature = "noq"))]
-	config.cid_generator(move || Box::new(Cids { shard }));
 	config
 		.max_udp_payload_size(SEGMENT as u16)
 		.map_err(|err| Error::Quic(err.to_string()))?;
@@ -94,7 +85,7 @@ pub(crate) fn endpoint_config(
 
 /// Mints the endpoint's connection ids, steering prefix included.
 ///
-/// quinn-proto asks its generator for every id it issues, dials and rotations
+/// noq-proto asks its generator for every id it issues, dials and rotations
 /// alike, so this is the one place the reuseport group's byte has to be
 /// stamped.
 #[derive(Debug)]
@@ -102,9 +93,9 @@ struct Cids {
 	shard: Option<moq_sock::shard::Shard>,
 }
 
-impl quinn_proto::ConnectionIdGenerator for Cids {
-	fn generate_cid(&mut self) -> quinn_proto::ConnectionId {
-		quinn_proto::ConnectionId::new(&super::endpoint::cid(self.shard))
+impl noq_proto::ConnectionIdGenerator for Cids {
+	fn generate_cid(&mut self) -> noq_proto::ConnectionId {
+		noq_proto::ConnectionId::new(&super::endpoint::cid(self.shard))
 	}
 
 	fn cid_len(&self) -> usize {
@@ -117,7 +108,7 @@ impl quinn_proto::ConnectionIdGenerator for Cids {
 }
 
 /// Dial as `config` says.
-pub(crate) fn client_config(config: &client::Config) -> Result<quinn_proto::ClientConfig, Error> {
+pub(crate) fn client_config(config: &client::Config) -> Result<noq_proto::ClientConfig, Error> {
 	let provider = provider();
 	let builder = rustls::ClientConfig::builder_with_provider(provider.clone())
 		.with_protocol_versions(&[&rustls::version::TLS13])
@@ -160,7 +151,7 @@ pub(crate) fn client_config(config: &client::Config) -> Result<quinn_proto::Clie
 	tls.alpn_protocols = alpn(&config.alpn);
 
 	let crypto = QuicClientConfig::try_from(tls).map_err(|err| Error::Tls(err.to_string()))?;
-	let mut client = quinn_proto::ClientConfig::new(Arc::new(crypto));
+	let mut client = noq_proto::ClientConfig::new(Arc::new(crypto));
 	let transport = transport_config(&config.transport)?;
 	#[cfg(feature = "qlog")]
 	let transport = with_qlog(transport, &config.transport, qlog::Side::Client);
@@ -169,7 +160,7 @@ pub(crate) fn client_config(config: &client::Config) -> Result<quinn_proto::Clie
 }
 
 /// Serve as `config` says.
-pub(crate) fn server_config(config: &server::Config) -> Result<quinn_proto::ServerConfig, Error> {
+pub(crate) fn server_config(config: &server::Config) -> Result<noq_proto::ServerConfig, Error> {
 	config.check()?;
 	let provider = provider();
 	let builder = rustls::ServerConfig::builder_with_provider(provider.clone())
@@ -199,7 +190,7 @@ pub(crate) fn server_config(config: &server::Config) -> Result<quinn_proto::Serv
 	tls.alpn_protocols = alpn(&config.alpn);
 
 	let crypto = QuicServerConfig::try_from(tls).map_err(|err| Error::Tls(err.to_string()))?;
-	let mut server = quinn_proto::ServerConfig::with_crypto(Arc::new(crypto));
+	let mut server = noq_proto::ServerConfig::with_crypto(Arc::new(crypto));
 	let transport = transport_config(&config.transport)?;
 	#[cfg(feature = "qlog")]
 	let transport = with_qlog(transport, &config.transport, qlog::Side::Server);
@@ -209,73 +200,60 @@ pub(crate) fn server_config(config: &server::Config) -> Result<quinn_proto::Serv
 
 /// Attach the configured qlog sink, if any.
 ///
-/// noq-proto asks a factory per connection, so each gets a file of its own.
-/// quinn-proto holds one sink per transport config instead, which is per
-/// endpoint on the accept side and per dial on the connect side; its events
-/// carry the connection's qlog `group_id` either way.
+/// Noq asks a factory per connection, so each gets a file of its own.
 #[cfg(feature = "qlog")]
 fn with_qlog(
-	mut transport: quinn_proto::TransportConfig,
+	mut transport: noq_proto::TransportConfig,
 	config: &Transport,
 	side: qlog::Side,
-) -> quinn_proto::TransportConfig {
+) -> noq_proto::TransportConfig {
 	let Some(sink) = config.qlog.clone() else {
 		return transport;
 	};
 
-	#[cfg(feature = "noq")]
-	{
-		// The factory is told each connection's own side, so the config's is
-		// not needed here.
-		let _ = side;
-		transport.qlog_factory(Arc::new(Traces { sink }));
-	}
-
-	#[cfg(not(feature = "noq"))]
-	{
-		let mut qlog = quinn_proto::QlogConfig::default();
-		qlog.writer(sink.endpoint_trace(side));
-		transport.qlog_stream(qlog.into_stream());
-	}
+	// The factory is told each connection's own side, so the config's is
+	// not needed here.
+	let _ = side;
+	transport.qlog_factory(Arc::new(Traces { sink }));
 
 	transport
 }
 
 /// Opens one trace per connection, which is what noq-proto's factory hook is
 /// for.
-#[cfg(all(feature = "qlog", feature = "noq"))]
+#[cfg(feature = "qlog")]
 #[derive(Debug)]
 struct Traces {
 	sink: qlog::Sink,
 }
 
-#[cfg(all(feature = "qlog", feature = "noq"))]
-impl quinn_proto::QlogFactory for Traces {
+#[cfg(feature = "qlog")]
+impl noq_proto::QlogFactory for Traces {
 	fn for_connection(
 		&self,
-		side: quinn_proto::Side,
+		side: noq_proto::Side,
 		_remote: std::net::SocketAddr,
-		initial_dst_cid: quinn_proto::ConnectionId,
+		initial_dst_cid: noq_proto::ConnectionId,
 		_now: std::time::Instant,
-	) -> Option<quinn_proto::QlogConfig> {
+	) -> Option<noq_proto::QlogConfig> {
 		let side = match side {
-			quinn_proto::Side::Client => qlog::Side::Client,
-			quinn_proto::Side::Server => qlog::Side::Server,
+			noq_proto::Side::Client => qlog::Side::Client,
+			noq_proto::Side::Server => qlog::Side::Server,
 		};
-		Some(quinn_proto::QlogConfig::new(self.sink.trace(&initial_dst_cid, side)))
+		Some(noq_proto::QlogConfig::new(self.sink.trace(&initial_dst_cid, side)))
 	}
 }
 
 /// The per-connection knobs both roles share.
-fn transport_config(config: &Transport) -> Result<quinn_proto::TransportConfig, Error> {
-	use quinn_proto::VarInt;
+fn transport_config(config: &Transport) -> Result<noq_proto::TransportConfig, Error> {
+	use noq_proto::VarInt;
 
-	let idle = quinn_proto::IdleTimeout::try_from(config.idle_timeout)
+	let idle = noq_proto::IdleTimeout::try_from(config.idle_timeout)
 		.map_err(|_| Error::Quic(format!("idle timeout out of range: {:?}", config.idle_timeout)))?;
 	let streams = VarInt::from_u64(config.max_streams)
 		.map_err(|_| Error::Quic(format!("stream limit out of range: {}", config.max_streams)))?;
 
-	let mut transport = quinn_proto::TransportConfig::default();
+	let mut transport = noq_proto::TransportConfig::default();
 	transport.max_idle_timeout(Some(idle));
 	transport.keep_alive_interval(config.keep_alive);
 	transport.max_concurrent_bidi_streams(streams);
@@ -286,17 +264,14 @@ fn transport_config(config: &Transport) -> Result<quinn_proto::TransportConfig,
 	transport.datagram_receive_buffer_size(Some(DATAGRAM_WINDOW));
 	transport.datagram_send_buffer_size(DATAGRAM_WINDOW);
 	// Every datagram in a GSO train is one SEGMENT, so the packet size is not
-	// quinn's to discover: pin it and turn the probing off.
+	// noq's to discover: pin it and turn the probing off.
 	transport.initial_mtu(SEGMENT as u16);
 	transport.min_mtu(SEGMENT as u16);
 	transport.mtu_discovery_config(None);
 	transport.congestion_controller_factory(match config.congestion {
-		Congestion::Loss => Arc::new(quinn_proto::congestion::CubicConfig::default())
-			as Arc<dyn quinn_proto::congestion::ControllerFactory + Send + Sync>,
-		#[cfg(feature = "noq")]
-		Congestion::Delay => Arc::new(quinn_proto::congestion::Bbr3Config::default()),
-		#[cfg(not(feature = "noq"))]
-		Congestion::Delay => Arc::new(quinn_proto::congestion::BbrConfig::default()),
+		Congestion::Loss => Arc::new(noq_proto::congestion::CubicConfig::default())
+			as Arc<dyn noq_proto::congestion::ControllerFactory + Send + Sync>,
+		Congestion::Delay => Arc::new(noq_proto::congestion::Bbr3Config::default()),
 	});
 	Ok(transport)
 }
diff --git a/rs/moq-uring/src/quic/quinn/stream.rs b/rs/moq-uring/src/quic/noq/stream.rs
similarity index 90%
rename from rs/moq-uring/src/quic/quinn/stream.rs
rename to rs/moq-uring/src/quic/noq/stream.rs
index 87a7d7e50e..cf662d079b 100644
--- a/rs/moq-uring/src/quic/quinn/stream.rs
+++ b/rs/moq-uring/src/quic/noq/stream.rs
@@ -1,6 +1,6 @@
-//! Stream handles: thin, direct calls into the shared quinn-proto connection.
+//! Stream handles: thin, direct calls into the shared noq-proto connection.
 //!
-//! Single-threaded sans-IO means a write goes straight into quinn's send
+//! Single-threaded sans-IO means a write goes straight into noq's send
 //! queue (no staging copy) and a read comes straight out of its reassembly
 //! buffer; the handles just kick the driver so egress reaches the wire and
 //! park on the per-stream waiter lists the driver wakes.
@@ -8,9 +8,7 @@
 use std::task::{Context, Poll};
 
 use bytes::{Buf, Bytes, BytesMut};
-#[cfg(feature = "noq")]
-use noq_proto as quinn_proto;
-use quinn_proto::{StreamId, VarInt};
+use noq_proto::{StreamId, VarInt};
 
 use super::super::Error;
 use super::{End, Shared};
@@ -53,7 +51,7 @@ impl SendStream {
 		self.fin || self.reset
 	}
 
-	/// Queue as much of `buf` as quinn will take right now, without parking.
+	/// Queue as much of `buf` as noq will take right now, without parking.
 	/// Best-effort, for the close path where nobody is left to poll.
 	pub(crate) fn try_write(&mut self, buf: &[u8]) -> usize {
 		if self.fin || self.reset {
@@ -107,14 +105,14 @@ impl web_transport_trait::poll::SendStream for SendStream {
 				self.shared.kick();
 				Poll::Ready(Ok(n))
 			}
-			// No capacity right now; the driver wakes us when quinn reports
+			// No capacity right now; the driver wakes us when noq reports
 			// the stream writable.
-			Err(quinn_proto::WriteError::Blocked) => {
+			Err(noq_proto::WriteError::Blocked) => {
 				self.shared.park_writable(self.id, waiter);
 				Poll::Pending
 			}
-			Err(quinn_proto::WriteError::Stopped(code)) => Poll::Ready(Err(Error::Stop(code.into_inner()))),
-			Err(quinn_proto::WriteError::ClosedStream) => {
+			Err(noq_proto::WriteError::Stopped(code)) => Poll::Ready(Err(Error::Stop(code.into_inner()))),
+			Err(noq_proto::WriteError::ClosedStream) => {
 				Poll::Ready(Err(Error::Quic("stream already finished".to_string())))
 			}
 		}
@@ -122,7 +120,7 @@ impl web_transport_trait::poll::SendStream for SendStream {
 
 	fn set_priority(&mut self, order: u8) {
 		// The trait (like W3C sendOrder) sends HIGHER values first, and so
-		// does quinn.
+		// does noq.
 		let _ = self
 			.shared
 			.conn
@@ -140,12 +138,12 @@ impl web_transport_trait::poll::SendStream for SendStream {
 			// A STOP_SENDING beat us here. Carry the code like `poll_write`
 			// does, or `moq_net::Error::from_transport` cannot decode a
 			// routine cancellation.
-			Err(quinn_proto::FinishError::Stopped(code)) => {
+			Err(noq_proto::FinishError::Stopped(code)) => {
 				self.reset = true;
 				return Err(Error::Stop(code.into_inner()));
 			}
 			// Already finished or reset, so the FIN it wanted is out.
-			Err(quinn_proto::FinishError::ClosedStream) => {}
+			Err(noq_proto::FinishError::ClosedStream) => {}
 		}
 		self.fin = true;
 		self.shared.kick();
@@ -161,7 +159,7 @@ impl web_transport_trait::poll::SendStream for SendStream {
 		if self.reset {
 			return Poll::Ready(Ok(()));
 		}
-		// quinn reports a send stream's end as an event, which the driver
+		// noq reports a send stream's end as an event, which the driver
 		// records: an acknowledged FIN, or the peer's STOP_SENDING.
 		match self.shared.ended(self.id) {
 			Some(End::Stopped(code)) => Poll::Ready(Err(Error::Stop(code))),
@@ -206,7 +204,7 @@ const READ_AHEAD: usize = 64 * 1024;
 /// How much to ask for per read-ahead chunk.
 const READ_CHUNK: usize = 8 * 1024;
 
-/// One read out of quinn's reassembly buffer.
+/// One read out of noq's reassembly buffer.
 enum Read {
 	/// Bytes, at most as many as were asked for.
 	Chunk(Bytes),
@@ -223,12 +221,12 @@ pub struct RecvStream {
 	shared: Shared,
 	id: StreamId,
 	park: kio::Park,
-	/// Every byte up to the FIN was read out of quinn; reads report the end
+	/// Every byte up to the FIN was read out of noq; reads report the end
 	/// once `backlog` is drained too.
 	finished: bool,
 	/// We stopped the stream; no more reads matter.
 	stopped: bool,
-	/// Bytes `poll_closed` read ahead, handed to `poll_read` before quinn's.
+	/// Bytes `poll_closed` read ahead, handed to `poll_read` before noq's.
 	backlog: BytesMut,
 }
 
@@ -268,7 +266,7 @@ impl RecvStream {
 		self.shared.kick();
 	}
 
-	/// Take up to `max` bytes out of quinn's reassembly buffer.
+	/// Take up to `max` bytes out of noq's reassembly buffer.
 	///
 	/// Reading is what returns the peer's flow control credit, so a read that
 	/// owes it a frame kicks the driver.
@@ -286,8 +284,8 @@ impl RecvStream {
 		let read = match chunks.next(max) {
 			Ok(Some(chunk)) => Read::Chunk(chunk.bytes),
 			Ok(None) => Read::Finished,
-			Err(quinn_proto::ReadError::Blocked) => Read::Blocked,
-			Err(quinn_proto::ReadError::Reset(code)) => Read::Reset(code.into_inner()),
+			Err(noq_proto::ReadError::Blocked) => Read::Blocked,
+			Err(noq_proto::ReadError::Reset(code)) => Read::Reset(code.into_inner()),
 		};
 		let transmit = chunks.finalize().should_transmit();
 		drop(conn);
@@ -358,7 +356,7 @@ impl web_transport_trait::poll::RecvStream for RecvStream {
 		if self.finished || self.stopped {
 			return Poll::Ready(Ok(()));
 		}
-		// The FIN sits behind whatever the peer sent before it, and quinn only
+		// The FIN sits behind whatever the peer sent before it, and noq only
 		// reports the stream finished once that is read out. Waiting on
 		// readability alone would park behind bytes nobody is reading, so read
 		// ahead into the backlog `poll_read` serves first: this watch resolves
diff --git a/rs/moq-uring/src/quic/qlog.rs b/rs/moq-uring/src/quic/qlog.rs
index 609dffadce..d6b5b3e939 100644
--- a/rs/moq-uring/src/quic/qlog.rs
+++ b/rs/moq-uring/src/quic/qlog.rs
@@ -118,16 +118,14 @@ impl Sink {
 	}
 
 	/// A writer for one connection's trace, named from its connection id.
-	#[cfg_attr(all(feature = "quinn", not(feature = "noq")), allow(dead_code))]
 	pub(crate) fn trace(&self, cid: &[u8], side: Side) -> Box<dyn io::Write + Send + Sync> {
 		self.open(Some(cid), side)
 	}
 
 	/// A writer for a trace covering a whole endpoint rather than one
-	/// connection, which is all quinn-proto's single per-config sink can
+	/// connection, which is all noq-proto's single per-config sink can
 	/// express. Each event carries the qlog `group_id` of the connection it
 	/// belongs to.
-	#[cfg_attr(any(not(feature = "quinn"), feature = "noq"), allow(dead_code))]
 	pub(crate) fn endpoint_trace(&self, side: Side) -> Box<dyn io::Write + Send + Sync> {
 		self.open(None, side)
 	}
diff --git a/rs/moq-uring/src/quic/quiche/connection.rs b/rs/moq-uring/src/quic/quiche/connection.rs
deleted file mode 100644
index 585fbde3a4..0000000000
--- a/rs/moq-uring/src/quic/quiche/connection.rs
+++ /dev/null
@@ -1,1048 +0,0 @@
-//! The connection: shared state, the driver task, and the session handle.
-
-use std::cell::RefCell;
-use std::collections::VecDeque;
-use std::net::SocketAddr;
-use std::rc::Rc;
-use std::task::{Context, Poll};
-
-use bytes::Bytes;
-use rustc_hash::FxHashMap;
-
-use super::{Error, RawConnection, SEGMENT};
-use crate::{Handle, udp};
-
-/// The state shared by every handle and the driver, single-threaded behind
-/// `Rc<RefCell>`.
-pub(crate) type Shared = Rc<Inner>;
-
-/// One GSO train is at most 64 segments; stay a hair under the kernel cap.
-const TRAIN_SEGMENTS: usize = 63;
-/// How many received datagrams to hold for the application before dropping
-/// the oldest.
-const DGRAM_QUEUE: usize = 64;
-/// The urgency a locally opened stream starts with, until the application
-/// sets one: quiche's own default, the middle of the range.
-const DEFAULT_URGENCY: u8 = 127;
-
-/// Everything the handles and the driver share, single-threaded.
-///
-/// The connection and the bookkeeping live in separate `RefCell`s so a stream
-/// operation can mutate the connection, drop that borrow, and then register a
-/// waiter without ever holding both.
-pub(crate) struct Inner {
-	pub(crate) conn: RefCell<RawConnection>,
-	pub(crate) state: RefCell<State>,
-}
-
-pub(crate) struct State {
-	/// Wakes the driver; handles kick it after mutating the connection so
-	/// fresh egress reaches the wire.
-	driver: kio::WaiterList,
-
-	/// The endpoint fed us packets since the driver's last sweep.
-	ingested: bool,
-	#[cfg(test)]
-	non_ingress_sweeps: usize,
-
-	established: bool,
-	establish_waiters: kio::WaiterList,
-
-	/// Peer-initiated streams not yet handed out, and the next ids expected.
-	/// QUIC creates every lower-numbered stream of a type implicitly, so a
-	/// readable id queues everything up to it.
-	accept_bi: VecDeque<u64>,
-	accept_uni: VecDeque<u64>,
-	next_accept_bi: u64,
-	next_accept_uni: u64,
-	accept_bi_waiters: kio::WaiterList,
-	accept_uni_waiters: kio::WaiterList,
-
-	/// The next locally initiated ids, and whoever is blocked on the peer's
-	/// MAX_STREAMS credit.
-	next_open_bi: u64,
-	next_open_uni: u64,
-	open_waiters: kio::WaiterList,
-
-	/// Per-stream read/write parking, keyed by stream id.
-	///
-	/// FxHash rather than SipHash on all four of these: they sit on the
-	/// driver's per-event path. A peer does shape which of its ids stay parked
-	/// here, but only by opening them in order, so clustering enough of them
-	/// into one bucket costs millions of stream opens for a cluster the
-	/// stream limit caps anyway.
-	readable: FxHashMap<u64, kio::WaiterList>,
-	writable: FxHashMap<u64, kio::WaiterList>,
-	/// Send streams waiting for their end (FIN acknowledged, a STOP, or a
-	/// reset); the driver probes these after connection events since quiche has
-	/// no event for stream collection.
-	finishing: FxHashMap<u64, kio::WaiterList>,
-	/// How each send stream ended, for the ones the driver saw collected while
-	/// the connection was still up: `None` for a FIN the peer acknowledged,
-	/// `Some(code)` for a `STOP_SENDING` the probe consumed on our behalf.
-	/// That is what makes a later close mean "already delivered" rather than
-	/// "we never found out". Cleared when the stream drops.
-	pub(crate) collected: FxHashMap<u64, Option<u64>>,
-
-	/// Received datagrams, oldest first; over [`DGRAM_QUEUE`] the oldest drop.
-	datagrams: VecDeque<Bytes>,
-	datagram_recv_waiters: kio::WaiterList,
-	datagram_send_waiters: kio::WaiterList,
-
-	/// The terminal error, set exactly once; everything fails with it after.
-	closed: Option<Error>,
-	closed_waiters: kio::WaiterList,
-}
-
-impl State {
-	fn new(is_server: bool) -> Self {
-		// Stream ids: bit 0 is the initiator (0 = client), bit 1 the
-		// directionality (set = uni).
-		let (next_accept_bi, next_accept_uni, next_open_bi, next_open_uni) = if is_server {
-			(0b00, 0b10, 0b01, 0b11)
-		} else {
-			(0b01, 0b11, 0b00, 0b10)
-		};
-		Self {
-			driver: kio::WaiterList::new(),
-			ingested: false,
-			#[cfg(test)]
-			non_ingress_sweeps: 0,
-			established: false,
-			establish_waiters: kio::WaiterList::new(),
-			accept_bi: VecDeque::new(),
-			accept_uni: VecDeque::new(),
-			next_accept_bi,
-			next_accept_uni,
-			accept_bi_waiters: kio::WaiterList::new(),
-			accept_uni_waiters: kio::WaiterList::new(),
-			next_open_bi,
-			next_open_uni,
-			open_waiters: kio::WaiterList::new(),
-			readable: FxHashMap::default(),
-			writable: FxHashMap::default(),
-			finishing: FxHashMap::default(),
-			collected: FxHashMap::default(),
-			datagrams: VecDeque::new(),
-			datagram_recv_waiters: kio::WaiterList::new(),
-			datagram_send_waiters: kio::WaiterList::new(),
-			closed: None,
-			closed_waiters: kio::WaiterList::new(),
-		}
-	}
-
-	/// Drop send stream `id`'s bookkeeping, parking included.
-	fn forget_send(&mut self, id: u64) {
-		self.collected.remove(&id);
-		self.finishing.remove(&id);
-		self.writable.remove(&id);
-	}
-
-	/// The same for the read half. Only its own table: the two halves of a
-	/// bidirectional stream are separate handles, and the other one may still
-	/// be parked.
-	fn forget_recv(&mut self, id: u64) {
-		self.readable.remove(&id);
-	}
-
-	/// Terminate with `err` (the first one wins) and wake absolutely everyone,
-	/// the driver included: an externally failed driver has to notice.
-	fn fail(&mut self, err: Error) {
-		if self.closed.is_none() {
-			self.closed = Some(err);
-		}
-		self.driver.wake();
-		self.closed_waiters.wake();
-		self.establish_waiters.wake();
-		self.accept_bi_waiters.wake();
-		self.accept_uni_waiters.wake();
-		self.open_waiters.wake();
-		self.datagram_recv_waiters.wake();
-		self.datagram_send_waiters.wake();
-		for waiters in self.readable.values_mut() {
-			waiters.wake();
-		}
-		for waiters in self.writable.values_mut() {
-			waiters.wake();
-		}
-		for waiters in self.finishing.values_mut() {
-			waiters.wake();
-		}
-	}
-}
-
-impl Inner {
-	/// The terminal error, if the connection has one.
-	pub(crate) fn closed(&self) -> Option<Error> {
-		self.state.borrow().closed.clone()
-	}
-
-	/// Wake the driver so it flushes what a handle just queued.
-	pub(crate) fn kick(&self) {
-		self.state.borrow_mut().driver.wake();
-	}
-
-	/// The endpoint fed packets into the connection; the driver's next sweep
-	/// treats them as ingress.
-	pub(crate) fn mark_ingested(&self) {
-		self.state.borrow_mut().ingested = true;
-	}
-
-	#[cfg(test)]
-	fn take_non_ingress_sweeps(&self) -> usize {
-		std::mem::take(&mut self.state.borrow_mut().non_ingress_sweeps)
-	}
-
-	/// Terminate from outside (the endpoint's socket died): everything fails
-	/// with `err`, and the driver exits on its next poll.
-	pub(crate) fn fail(&self, err: Error) {
-		self.state.borrow_mut().fail(err);
-	}
-
-	/// Park `waiter` until stream `id` is writable again.
-	pub(crate) fn park_writable(&self, id: u64, waiter: &kio::Waiter) {
-		let mut state = self.state.borrow_mut();
-		waiter.register(state.writable.entry(id).or_default());
-	}
-
-	/// Park `waiter` until stream `id` is readable again.
-	pub(crate) fn park_readable(&self, id: u64, waiter: &kio::Waiter) {
-		let mut state = self.state.borrow_mut();
-		waiter.register(state.readable.entry(id).or_default());
-	}
-
-	/// Park `waiter` until send stream `id` reaches its end.
-	pub(crate) fn park_finishing(&self, id: u64, waiter: &kio::Waiter) {
-		let mut state = self.state.borrow_mut();
-		waiter.register(state.finishing.entry(id).or_default());
-	}
-
-	/// How send stream `id` ended, if the driver saw it collected on a live
-	/// connection: `Some(None)` for an acknowledged FIN, `Some(Some(code))`
-	/// for a `STOP_SENDING`.
-	pub(crate) fn collected(&self, id: u64) -> Option<Option<u64>> {
-		self.state.borrow().collected.get(&id).copied()
-	}
-
-	/// Forget send stream `id`'s bookkeeping; called when its handle drops.
-	///
-	/// The parking table goes with it. A stream shut down on the way out is
-	/// never reported writable again, so nothing else would ever remove the
-	/// entry, and a peer withholding flow control credit could have streams
-	/// opened and cancelled against it without bound.
-	pub(crate) fn forget_send(&self, id: u64) {
-		self.state.borrow_mut().forget_send(id);
-	}
-
-	/// The same for the read half, which parks on its own table.
-	pub(crate) fn forget_recv(&self, id: u64) {
-		self.state.borrow_mut().forget_recv(id);
-	}
-
-	/// Wake anyone parked on stream `id` being readable.
-	pub(crate) fn wake_readable(&self, id: u64) {
-		let mut state = self.state.borrow_mut();
-		if let Some(mut waiters) = state.readable.remove(&id) {
-			waiters.wake();
-		}
-	}
-
-	/// Close the connection with a full-width application code.
-	///
-	/// The [`web_transport_trait::poll::Session::close`] surface narrows codes
-	/// to `u32`; the WebTransport layer maps its codes into HTTP/3's error
-	/// space, which needs the whole varint range.
-	pub(crate) fn close_code(&self, code: u64, reason: &str) {
-		// Err(Done) means already closed, which is what the caller wanted.
-		let _ = self.conn.borrow_mut().close(true, code, reason.as_bytes());
-		self.kick();
-	}
-}
-
-/// A QUIC connection driven by a [`crate::Worker`], usable as a MoQ transport.
-///
-/// Created by [`Endpoint`](super::Endpoint) (or its
-/// [`client::connect`](super::client::connect) /
-/// [`server::accept`](super::server::accept) shorthands), already
-/// established. Clones share the connection; each carries its own parking so
-/// concurrent pending operations don't trample each other's wakeups. Dropping
-/// every handle (and every stream) drops the driver's `Rc` peers, but the
-/// driver itself keeps the connection alive until it ends; close explicitly
-/// with [`close`](web_transport_trait::poll::Session::close) (which moq's
-/// session machine does).
-///
-/// That close only records the code: the driver task is what frames the
-/// CONNECTION_CLOSE and hands it to the socket. Drive the worker until
-/// [`poll_closed`](web_transport_trait::poll::Session::poll_closed) resolves
-/// before stopping it, or the packet is never built and the peer idles out
-/// instead.
-pub struct Connection {
-	shared: Shared,
-	// Retains this clone's waiter registrations across polls.
-	park: kio::Park,
-	/// The negotiated ALPN, cached at establishment so `protocol()` can
-	/// borrow from the handle.
-	alpn: Option<String>,
-}
-
-impl Connection {
-	/// Close the connection with a full-width application code.
-	///
-	/// The [`web_transport_trait::poll::Session::close`] surface narrows codes
-	/// to `u32`; the WebTransport layer maps its codes into HTTP/3's error
-	/// space, which needs the whole varint range.
-	pub(crate) fn close_code(&self, code: u64, reason: &str) {
-		self.shared.close_code(code, reason);
-	}
-
-	/// The peer's certificate chain in DER, leaf first, or `None` if it
-	/// presented none.
-	///
-	/// A server only sees one when it asked
-	/// ([`ClientAuth`](super::server::ClientAuth)), and TLS already validated
-	/// it against the configured roots by the time this connection exists: an
-	/// invalid chain fails the handshake instead. So a `Some` here is an
-	/// authenticated peer, and the chain is what names it.
-	pub fn peer_chain(&self) -> Option<Vec<Vec<u8>>> {
-		let conn = self.shared.conn.borrow();
-		Some(conn.peer_cert_chain()?.into_iter().map(<[u8]>::to_vec).collect())
-	}
-}
-
-impl Clone for Connection {
-	fn clone(&self) -> Self {
-		Self {
-			shared: self.shared.clone(),
-			park: kio::Park::default(),
-			alpn: self.alpn.clone(),
-		}
-	}
-}
-
-/// Build a connection's shared state and its driver.
-///
-/// The driver future does timers, event sweeps, and egress; ingress arrives
-/// from the endpoint's demux task, which feeds quiche directly and
-/// [kicks](Inner::kick) the driver. The caller spawns the future and reclaims
-/// the connection's routes once it resolves.
-pub(crate) fn launch(
-	handle: &Handle,
-	socket: Rc<udp::Socket>,
-	conn: RawConnection,
-	keep_alive: Option<std::time::Duration>,
-) -> (Shared, impl Future<Output = ()> + use<>) {
-	let is_server = conn.is_server();
-	let shared = Rc::new(Inner {
-		conn: RefCell::new(conn),
-		state: RefCell::new(State::new(is_server)),
-	});
-
-	let mut driver = Driver {
-		shared: shared.clone(),
-		socket,
-		deadline: moq_net::runtime::Deadline::new(handle),
-		keep_alive: match keep_alive {
-			Some(every) => moq_net::runtime::Deadline::after(handle, every),
-			None => moq_net::runtime::Deadline::new(handle),
-		},
-		keep_alive_every: keep_alive,
-		carry: None,
-	};
-	let future = async move { kio::wait(|waiter| driver.poll(waiter)).await };
-	(shared, future)
-}
-
-/// Wait out the handshake, yielding the connection's public handle.
-pub(crate) async fn establish(shared: Shared) -> Result<Connection, Error> {
-	kio::wait(|waiter| {
-		let mut state = shared.state.borrow_mut();
-		if let Some(err) = &state.closed {
-			return Poll::Ready(Err(err.clone()));
-		}
-		if state.established {
-			return Poll::Ready(Ok(()));
-		}
-		waiter.register(&mut state.establish_waiters);
-		Poll::Pending
-	})
-	.await?;
-
-	let alpn = {
-		let conn = shared.conn.borrow();
-		let proto = conn.application_proto();
-		(!proto.is_empty()).then(|| String::from_utf8_lossy(proto).into_owned())
-	};
-
-	Ok(Connection {
-		shared,
-		park: kio::Park::default(),
-		alpn,
-	})
-}
-
-impl web_transport_trait::poll::Session for Connection {
-	type SendStream = super::SendStream;
-	type RecvStream = super::RecvStream;
-	type Error = Error;
-
-	fn poll_accept_uni(&mut self, cx: &mut Context<'_>) -> Poll<Result<Self::RecvStream, Self::Error>> {
-		let waiter = self.park.hold(cx);
-		let mut state = self.shared.state.borrow_mut();
-		if let Some(id) = state.accept_uni.pop_front() {
-			return Poll::Ready(Ok(super::RecvStream::new(self.shared.clone(), id)));
-		}
-		if let Some(err) = &state.closed {
-			return Poll::Ready(Err(err.clone()));
-		}
-		waiter.register(&mut state.accept_uni_waiters);
-		Poll::Pending
-	}
-
-	fn poll_accept_bi(
-		&mut self,
-		cx: &mut Context<'_>,
-	) -> Poll<Result<(Self::SendStream, Self::RecvStream), Self::Error>> {
-		let waiter = self.park.hold(cx);
-		let mut state = self.shared.state.borrow_mut();
-		if let Some(id) = state.accept_bi.pop_front() {
-			return Poll::Ready(Ok((
-				super::SendStream::new(self.shared.clone(), id),
-				super::RecvStream::new(self.shared.clone(), id),
-			)));
-		}
-		if let Some(err) = &state.closed {
-			return Poll::Ready(Err(err.clone()));
-		}
-		waiter.register(&mut state.accept_bi_waiters);
-		Poll::Pending
-	}
-
-	fn poll_open_uni(&mut self, cx: &mut Context<'_>) -> Poll<Result<Self::SendStream, Self::Error>> {
-		let waiter = self.park.hold(cx);
-		if let Some(err) = self.shared.closed() {
-			return Poll::Ready(Err(err));
-		}
-		let id = self.shared.state.borrow().next_open_uni;
-		// Materialize the stream in quiche so the peer's MAX_STREAMS credit is
-		// what gates us, not our own bookkeeping.
-		match self
-			.shared
-			.conn
-			.borrow_mut()
-			.stream_priority(id, DEFAULT_URGENCY, false)
-		{
-			Ok(()) => {
-				self.shared.state.borrow_mut().next_open_uni += 4;
-				Poll::Ready(Ok(super::SendStream::new(self.shared.clone(), id)))
-			}
-			Err(quiche::Error::StreamLimit) => {
-				let mut state = self.shared.state.borrow_mut();
-				waiter.register(&mut state.open_waiters);
-				Poll::Pending
-			}
-			Err(err) => Poll::Ready(Err(err.into())),
-		}
-	}
-
-	fn poll_open_bi(
-		&mut self,
-		cx: &mut Context<'_>,
-	) -> Poll<Result<(Self::SendStream, Self::RecvStream), Self::Error>> {
-		let waiter = self.park.hold(cx);
-		if let Some(err) = self.shared.closed() {
-			return Poll::Ready(Err(err));
-		}
-		let id = self.shared.state.borrow().next_open_bi;
-		match self
-			.shared
-			.conn
-			.borrow_mut()
-			.stream_priority(id, DEFAULT_URGENCY, false)
-		{
-			Ok(()) => {
-				self.shared.state.borrow_mut().next_open_bi += 4;
-				Poll::Ready(Ok((
-					super::SendStream::new(self.shared.clone(), id),
-					super::RecvStream::new(self.shared.clone(), id),
-				)))
-			}
-			Err(quiche::Error::StreamLimit) => {
-				let mut state = self.shared.state.borrow_mut();
-				waiter.register(&mut state.open_waiters);
-				Poll::Pending
-			}
-			Err(err) => Poll::Ready(Err(err.into())),
-		}
-	}
-
-	fn poll_send_datagram(&mut self, cx: &mut Context<'_>, payload: &[u8]) -> Poll<Result<(), Self::Error>> {
-		let waiter = self.park.hold(cx);
-		if let Some(err) = self.shared.closed() {
-			return Poll::Ready(Err(err));
-		}
-		match self.shared.conn.borrow_mut().dgram_send(payload) {
-			Ok(()) => {
-				self.shared.kick();
-				Poll::Ready(Ok(()))
-			}
-			// The send queue is full; a flush frees space.
-			Err(quiche::Error::Done) => {
-				let mut state = self.shared.state.borrow_mut();
-				waiter.register(&mut state.datagram_send_waiters);
-				Poll::Pending
-			}
-			Err(err) => Poll::Ready(Err(err.into())),
-		}
-	}
-
-	fn poll_recv_datagram(&mut self, cx: &mut Context<'_>) -> Poll<Result<Bytes, Self::Error>> {
-		let waiter = self.park.hold(cx);
-		let mut state = self.shared.state.borrow_mut();
-		if let Some(datagram) = state.datagrams.pop_front() {
-			return Poll::Ready(Ok(datagram));
-		}
-		if let Some(err) = &state.closed {
-			return Poll::Ready(Err(err.clone()));
-		}
-		waiter.register(&mut state.datagram_recv_waiters);
-		Poll::Pending
-	}
-
-	fn max_datagram_size(&self) -> usize {
-		self.shared.conn.borrow().dgram_max_writable_len().unwrap_or(0)
-	}
-
-	fn protocol(&self) -> Option<&str> {
-		self.alpn.as_deref()
-	}
-
-	fn close(&mut self, code: u32, reason: &str) {
-		// Err(Done) means already closed, which is what the caller wanted.
-		let _ = self
-			.shared
-			.conn
-			.borrow_mut()
-			.close(true, u64::from(code), reason.as_bytes());
-		self.shared.kick();
-	}
-
-	fn poll_closed(&mut self, cx: &mut Context<'_>) -> Poll<Self::Error> {
-		let waiter = self.park.hold(cx);
-		let mut state = self.shared.state.borrow_mut();
-		if let Some(err) = &state.closed {
-			return Poll::Ready(err.clone());
-		}
-		waiter.register(&mut state.closed_waiters);
-		Poll::Pending
-	}
-
-	fn stats(&self) -> impl web_transport_trait::Stats {
-		let conn = self.shared.conn.borrow();
-		let stats = conn.stats();
-		let path = conn.path_stats().next();
-		Stats {
-			bytes_sent: stats.sent_bytes,
-			bytes_received: stats.recv_bytes,
-			bytes_lost: stats.lost_bytes,
-			packets_sent: stats.sent as u64,
-			packets_received: stats.recv as u64,
-			packets_lost: stats.lost as u64,
-			rtt: path.as_ref().map(|path| path.rtt),
-			// Bytes per second on the wire; the trait wants bits.
-			send_rate: path.as_ref().map(|path| path.delivery_rate.saturating_mul(8)),
-		}
-	}
-}
-
-impl std::fmt::Debug for Connection {
-	fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-		f.debug_struct("Connection").field("alpn", &self.alpn).finish()
-	}
-}
-
-/// A snapshot of quiche's counters in [`web_transport_trait::Stats`] shape.
-struct Stats {
-	bytes_sent: u64,
-	bytes_received: u64,
-	bytes_lost: u64,
-	packets_sent: u64,
-	packets_received: u64,
-	packets_lost: u64,
-	rtt: Option<std::time::Duration>,
-	send_rate: Option<u64>,
-}
-
-impl web_transport_trait::Stats for Stats {
-	fn bytes_sent(&self) -> Option<u64> {
-		Some(self.bytes_sent)
-	}
-
-	fn bytes_received(&self) -> Option<u64> {
-		Some(self.bytes_received)
-	}
-
-	fn bytes_lost(&self) -> Option<u64> {
-		Some(self.bytes_lost)
-	}
-
-	fn packets_sent(&self) -> Option<u64> {
-		Some(self.packets_sent)
-	}
-
-	fn packets_received(&self) -> Option<u64> {
-		Some(self.packets_received)
-	}
-
-	fn packets_lost(&self) -> Option<u64> {
-		Some(self.packets_lost)
-	}
-
-	fn rtt(&self) -> Option<std::time::Duration> {
-		self.rtt
-	}
-
-	fn estimated_send_rate(&self) -> Option<u64> {
-		self.send_rate
-	}
-}
-
-/// The per-connection task: timers, event sweeps, and packets out. Packets in
-/// come from the endpoint's demux task, which feeds quiche directly and kicks
-/// this driver.
-struct Driver {
-	shared: Shared,
-	socket: Rc<udp::Socket>,
-	deadline: moq_net::runtime::Deadline<Handle>,
-	/// Fires when the connection owes the peer an ack-eliciting packet, so an
-	/// idle path (and whatever NAT sits on it) stays open. Disarmed when the
-	/// caller asked for no keep-alive.
-	keep_alive: moq_net::runtime::Deadline<Handle>,
-	keep_alive_every: Option<std::time::Duration>,
-	/// A packet quiche handed us for a different path than the train being
-	/// packed; it opens the next one.
-	carry: Option<(SocketAddr, Vec<u8>)>,
-}
-
-#[derive(Clone, Copy, Debug, Eq, PartialEq)]
-enum Sweep {
-	Ingress,
-	Timeout,
-}
-
-impl Sweep {
-	fn after_ingress(ingested: bool) -> Option<Self> {
-		ingested.then_some(Self::Ingress)
-	}
-
-	fn ingested(self) -> bool {
-		self == Self::Ingress
-	}
-}
-
-impl Driver {
-	fn poll(&mut self, waiter: &kio::Waiter) -> Poll<()> {
-		// The endpoint fails the connection from outside when its socket dies.
-		let ingested = {
-			let mut state = self.shared.state.borrow_mut();
-			if state.closed.is_some() {
-				return Poll::Ready(());
-			}
-			// Register the kick first: a handle mutating the connection after
-			// this turn's sweeps still re-polls us.
-			waiter.register(&mut state.driver);
-			std::mem::take(&mut state.ingested)
-		};
-		let mut sweep = Sweep::after_ingress(ingested);
-
-		loop {
-			if let Some(sweep) = sweep.take() {
-				self.sweep(sweep.ingested());
-			}
-
-			if let Poll::Ready(err) = self.flush(waiter) {
-				self.fail(err);
-				return Poll::Ready(());
-			}
-
-			// A flush frees datagram-send queue space.
-			self.shared.state.borrow_mut().datagram_send_waiters.wake();
-
-			{
-				let conn = self.shared.conn.borrow();
-				self.deadline.set(conn.timeout_instant());
-				if conn.is_closed() {
-					let err = terminal(&conn);
-					drop(conn);
-					self.fail(err);
-					return Poll::Ready(());
-				}
-			}
-
-			// Arm, *then* poll: the poll is what registers the waiter, so
-			// polling before the set would leave the firing to wake nobody
-			// (fatal on a dial nobody answers, where no ingress ever re-polls
-			// us). Elapsed means the timer is due right now; restart the turn
-			// so its effects flush and the next deadline arms.
-			let timeout = self.deadline.poll(waiter);
-			let keep_alive = self.keep_alive.poll(waiter);
-			if timeout.is_pending() && keep_alive.is_pending() {
-				return Poll::Pending;
-			}
-			if timeout.is_ready() {
-				self.shared.conn.borrow_mut().on_timeout();
-				// A timeout can close the connection or change stream events.
-				sweep = Some(Sweep::Timeout);
-			}
-			if keep_alive.is_ready() {
-				// With nothing else queued quiche emits a PING, which is the
-				// point; with traffic in flight the flag just rides along.
-				let _ = self.shared.conn.borrow_mut().send_ack_eliciting();
-				self.arm_keep_alive();
-			}
-		}
-	}
-
-	/// Everything event-shaped: establishment, new and readable streams,
-	/// writability, finished sends, received datagrams.
-	fn sweep(&mut self, ingested: bool) {
-		let mut conn = self.shared.conn.borrow_mut();
-		let mut state = self.shared.state.borrow_mut();
-		#[cfg(test)]
-		{
-			state.non_ingress_sweeps += usize::from(!ingested);
-		}
-
-		if !state.established && conn.is_established() {
-			state.established = true;
-			state.establish_waiters.wake();
-		}
-
-		// Waking removes the entry: a still-interested poller re-registers on
-		// its next poll, so the maps only hold streams somebody is parked on.
-		for id in conn.readable() {
-			queue_accept(&mut state, id);
-			if let Some(mut waiters) = state.readable.remove(&id) {
-				waiters.wake();
-			}
-		}
-		for id in conn.writable() {
-			if let Some(mut waiters) = state.writable.remove(&id) {
-				waiters.wake();
-			}
-		}
-
-		// MAX_STREAMS (and everything else) only arrives with ingress.
-		if ingested {
-			state.open_waiters.wake();
-		}
-
-		// quiche has no stream-collected event, so probe: a send stream whose
-		// capacity query errors has ended one way or another. Record the result
-		// before a terminal error can be published this turn, so a close racing
-		// the acknowledgement cannot turn a delivered FIN into a failure.
-		let State {
-			finishing, collected, ..
-		} = &mut *state;
-		finishing.retain(|id, waiters| match conn.stream_capacity(*id) {
-			Ok(_) => true,
-			// This probe is the only reader of the stop code, so record it
-			// rather than letting the collection look like a clean delivery.
-			Err(quiche::Error::StreamStopped(code)) => {
-				collected.insert(*id, Some(code));
-				waiters.wake();
-				false
-			}
-			Err(_) => {
-				collected.insert(*id, None);
-				waiters.wake();
-				false
-			}
-		});
-
-		let mut received = false;
-		// The buffer factory already hands these out as `Bytes`, so moving one
-		// from quiche's queue to ours copies nothing, and no scratch buffer can
-		// be too small for a datagram and silently drop it.
-		while let Ok(dgram) = conn.dgram_recv_buf() {
-			if state.datagrams.len() >= DGRAM_QUEUE {
-				state.datagrams.pop_front();
-			}
-			state.datagrams.push_back(dgram);
-			received = true;
-		}
-		if received {
-			state.datagram_recv_waiters.wake();
-		}
-	}
-
-	/// Stage one GSO train, then yield so another connection sharing the
-	/// socket gets a chance at the transmit pool.
-	fn flush(&mut self, waiter: &kio::Waiter) -> Poll<Error> {
-		match self.flush_one(waiter) {
-			Poll::Ready(Ok(())) => {}
-			Poll::Ready(Err(err)) => return Poll::Ready(err),
-			// Backpressure, or nothing left to stage.
-			Poll::Pending => return Poll::Pending,
-		}
-		// Requeue behind the other ready tasks. If quiche is drained, the next
-		// poll costs one empty acquire and then parks normally.
-		waiter.waker().wake_by_ref();
-		Poll::Pending
-	}
-
-	/// Fill one transmit buffer and stage it. Ignores quiche's pacing hint;
-	/// the congestion controller still bounds each train.
-	fn flush_one(&mut self, waiter: &kio::Waiter) -> Poll<Result<(), Error>> {
-		let mut tx = match self.socket.poll_acquire(waiter) {
-			Poll::Ready(Ok(tx)) => tx,
-			Poll::Ready(Err(err)) => return Poll::Ready(Err(Error::Io(err.to_string()))),
-			// Backpressure: a completed send re-polls us.
-			Poll::Pending => return Poll::Pending,
-		};
-
-		let mut filled = 0;
-		let mut dest = None;
-		// One train, one destination, so a packet left over from the last one
-		// leads this one.
-		if let Some((to, packet)) = self.carry.take() {
-			tx[..packet.len()].copy_from_slice(&packet);
-			filled = packet.len();
-			dest = Some(to);
-		}
-		// A short packet must ride last in a GSO send, so a short carry goes
-		// out alone.
-		if filled == 0 || filled == SEGMENT {
-			let mut conn = self.shared.conn.borrow_mut();
-			// Pack uniform SEGMENT-sized packets back to back; a short packet
-			// ends the train (it must ride last in a GSO send).
-			while filled + SEGMENT <= tx.len() && filled / SEGMENT < TRAIN_SEGMENTS {
-				match conn.send(&mut tx[filled..filled + SEGMENT]) {
-					Ok((n, info)) => {
-						// Path validation and NAT rebinding make quiche alternate
-						// destinations; this packet must lead another train.
-						if dest.is_some_and(|to| to != info.to) {
-							self.carry = Some((info.to, tx[filled..filled + n].to_vec()));
-							break;
-						}
-						dest = Some(info.to);
-						filled += n;
-						if n < SEGMENT {
-							break;
-						}
-					}
-					Err(quiche::Error::Done) => break,
-					Err(err) => return Poll::Ready(Err(err.into())),
-				}
-			}
-		}
-
-		let Some(to) = dest else {
-			// Nothing to send; the buffer returns to the pool on drop.
-			return Poll::Pending;
-		};
-		if let Err(err) = tx.send(filled, to, SEGMENT) {
-			return Poll::Ready(Err(Error::Io(err.to_string())));
-		}
-		Poll::Ready(Ok(()))
-	}
-
-	/// Re-arm the keep-alive timer, if this connection asked for one.
-	fn arm_keep_alive(&mut self) {
-		let at = self
-			.keep_alive_every
-			.and_then(|every| std::time::Instant::now().checked_add(every));
-		self.keep_alive.set(at);
-	}
-
-	fn fail(&mut self, err: Error) {
-		self.shared.state.borrow_mut().fail(err);
-	}
-}
-
-/// Queue a peer-initiated stream (and every implicitly created lower one).
-fn queue_accept(state: &mut State, id: u64) {
-	let uni = id & 0b10 == 0b10;
-	let (next, queue, waiters) = if uni {
-		(
-			&mut state.next_accept_uni,
-			&mut state.accept_uni,
-			&mut state.accept_uni_waiters,
-		)
-	} else {
-		(
-			&mut state.next_accept_bi,
-			&mut state.accept_bi,
-			&mut state.accept_bi_waiters,
-		)
-	};
-	// Locally initiated ids (a different low-bit pattern) never match `next`'s
-	// parity walk, so this also filters our own streams out.
-	if id & 0b11 != *next & 0b11 || id < *next {
-		return;
-	}
-	let mut queued = false;
-	while *next <= id {
-		queue.push_back(*next);
-		*next += 4;
-		queued = true;
-	}
-	if queued {
-		waiters.wake();
-	}
-}
-
-/// The terminal error of a closed connection.
-fn terminal(conn: &RawConnection) -> Error {
-	let err = conn.peer_error().or_else(|| conn.local_error());
-	match err {
-		Some(err) if err.is_app => Error::App {
-			code: err.error_code,
-			reason: String::from_utf8_lossy(&err.reason).into_owned(),
-		},
-		Some(err) => Error::Transport {
-			code: err.error_code,
-			reason: String::from_utf8_lossy(&err.reason).into_owned(),
-		},
-		None => Error::TimedOut,
-	}
-}
-
-#[cfg(test)]
-mod tests {
-	use super::super::BytesFactory;
-	use super::*;
-	use std::net::UdpSocket;
-	use web_transport_trait::poll::{SendStream as _, Session as _};
-
-	#[test]
-	fn transmit_continuation_skips_event_sweep() {
-		let mut worker = match crate::Worker::new(crate::Config::default()) {
-			Ok(worker) => worker,
-			Err(crate::Error::Unsupported(reason)) => {
-				eprintln!("skipping io_uring connection test: {reason}");
-				return;
-			}
-			Err(err) => panic!("worker setup failed: {err}"),
-		};
-		let handle = worker.handle();
-
-		let signed = rcgen::generate_simple_self_signed(vec!["localhost".into()]).expect("certificate");
-		let certs = tempfile::tempdir().expect("certificate directory");
-		let cert = certs.path().join("cert.pem");
-		let key = certs.path().join("key.pem");
-		std::fs::write(&cert, signed.cert.pem()).expect("write certificate");
-		std::fs::write(&key, signed.signing_key.serialize_pem()).expect("write key");
-
-		let mut server_config =
-			crate::quic::server::Config::new(crate::quic::Identity::open(&cert, &key).expect("identity"));
-		server_config.alpn = vec!["moq-uring-sweep-test".to_string()];
-		let server_socket = handle
-			.udp(
-				UdpSocket::bind("127.0.0.1:0").expect("bind server"),
-				udp::Config::default(),
-			)
-			.expect("server socket");
-		let endpoint = crate::quic::Endpoint::new(
-			&handle,
-			server_socket,
-			crate::quic::endpoint::Config::default().with_server(server_config),
-		)
-		.expect("endpoint");
-
-		worker
-			.block_on(async {
-				let client_socket = handle
-					.udp(
-						UdpSocket::bind("127.0.0.1:0").expect("bind client"),
-						udp::Config::default(),
-					)
-					.expect("client socket");
-				let mut client_config = crate::quic::client::Config::new(endpoint.local_addr(), "localhost");
-				client_config.alpn = vec!["moq-uring-sweep-test".to_string()];
-				client_config.verify = false;
-
-				let client = crate::quic::client::connect(&handle, client_socket, &client_config)
-					.await
-					.expect("connect");
-				let server = endpoint.accept().await.expect("accept");
-				let mut session = crate::quic::web::Session::raw(server.clone());
-				let mut send = std::future::poll_fn(|cx| session.poll_open_uni(cx))
-					.await
-					.expect("open stream");
-
-				BytesFactory::reset_stream_copies();
-				std::future::poll_fn(|cx| send.poll_write(cx, b"copied"))
-					.await
-					.expect("queue copied stream data");
-				assert_eq!(
-					BytesFactory::stream_copies(),
-					1,
-					"slice write allocates a quiche buffer"
-				);
-
-				BytesFactory::reset_stream_copies();
-				let mut owned = Bytes::from_static(b"owned");
-				std::future::poll_fn(|cx| send.poll_write_buf(cx, &mut owned))
-					.await
-					.expect("queue owned stream data");
-				assert!(owned.is_empty(), "owned write consumes the buffer");
-				assert_eq!(
-					BytesFactory::stream_copies(),
-					0,
-					"owned write reuses the caller's buffer"
-				);
-
-				let payload = vec![0x5a; TRAIN_SEGMENTS * SEGMENT * 2];
-				let mut offset = 0;
-				while offset < payload.len() {
-					offset += std::future::poll_fn(|cx| send.poll_write(cx, &payload[offset..]))
-						.await
-						.expect("queue stream data");
-				}
-
-				server.shared.take_non_ingress_sweeps();
-				let mut yielded = false;
-				std::future::poll_fn(|cx| {
-					if std::mem::replace(&mut yielded, true) {
-						return Poll::Ready(());
-					}
-					cx.waker().wake_by_ref();
-					Poll::Pending
-				})
-				.await;
-
-				assert_eq!(
-					server.shared.take_non_ingress_sweeps(),
-					0,
-					"transmit-only wakes must resume at flush"
-				);
-				drop(client);
-			})
-			.expect("worker");
-	}
-
-	/// A dropped handle takes its parking with it.
-	///
-	/// Nothing else can: a stream shut down on the way out is never reported
-	/// writable or readable again, so an entry left behind sits there for the
-	/// life of the connection, one per cancelled stream.
-	#[test]
-	fn forgetting_a_handle_clears_its_parking() {
-		let mut state = State::new(false);
-		let id = 0;
-		state.writable.entry(id).or_default();
-		state.readable.entry(id).or_default();
-		state.finishing.entry(id).or_default();
-		state.collected.insert(id, None);
-
-		state.forget_send(id);
-		assert!(state.writable.is_empty(), "the write half's parking");
-		assert!(state.finishing.is_empty(), "the finish watch");
-		assert!(state.collected.is_empty(), "the end bookkeeping");
-		// The read half is a separate handle, which may still be parked.
-		assert!(!state.readable.is_empty(), "the read half's parking survives");
-
-		state.forget_recv(id);
-		assert!(state.readable.is_empty(), "the read half's parking");
-	}
-}
diff --git a/rs/moq-uring/src/quic/quiche/endpoint.rs b/rs/moq-uring/src/quic/quiche/endpoint.rs
deleted file mode 100644
index fa562592fd..0000000000
--- a/rs/moq-uring/src/quic/quiche/endpoint.rs
+++ /dev/null
@@ -1,646 +0,0 @@
-//! The quiche endpoint: one socket, many quiche connections.
-//!
-//! quiche connections are self-contained, so the routing table is ours: a
-//! demux task parses each datagram's destination connection id, feeds the
-//! connection it names, and mints replacement ids while the peer has credit.
-//! Everything policy-shaped (the backlog, the shard steering, the id length)
-//! lives in [`super::super::endpoint`], which is shared with the other
-//! backend.
-
-use std::cell::{Cell, RefCell};
-use std::collections::{HashMap, VecDeque};
-use std::net::SocketAddr;
-use std::rc::Rc;
-use std::task::Poll;
-
-use rustc_hash::FxHashMap;
-
-use super::{Connection, Error, connection};
-use crate::quic::endpoint::{CID_LEN, Config, cid};
-use crate::{Handle, udp};
-
-/// The accept side: the shared quiche config and handshaken connections
-/// nobody has claimed yet.
-struct Accepting {
-	config: quiche::Config,
-	/// The per-connection settings the server was configured with, for the
-	/// ones quiche takes on the connection rather than on its config: the
-	/// driver's keep-alive, and the qlog trace.
-	transport: crate::quic::Transport,
-	queue: VecDeque<Connection>,
-}
-
-/// One live connection: its shared state and the routes pointing at it.
-struct Conn {
-	shared: connection::Shared,
-	ids: ConnectionIds,
-}
-
-/// Every destination connection id routing to one connection.
-struct ConnectionIds {
-	/// The ids this endpoint issued, each [`CID_LEN`] bytes.
-	issued: Vec<[u8; CID_LEN]>,
-	/// The destination id the client chose for its Initial, for a connection
-	/// that arrived rather than one we dialed.
-	initial: Option<Vec<u8>>,
-}
-
-impl ConnectionIds {
-	/// The ids for a connection we dialed: just the one we issued.
-	fn issued(cid: [u8; CID_LEN]) -> Self {
-		Self {
-			issued: vec![cid],
-			initial: None,
-		}
-	}
-}
-
-/// Destination connection id -> the connection it belongs to, split by who
-/// chose the id.
-///
-/// The ids we issued are random and fixed width, so FxHash is enough: a peer
-/// cannot pick them, so it cannot aim at a bucket. A client picks its own
-/// Initial destination id, so those keep SipHash and its per-process seed.
-/// Otherwise a peer could open connections whose Initial ids all hash alike
-/// and turn a per-packet lookup into a scan of them.
-#[derive(Default)]
-struct Routes {
-	issued: FxHashMap<[u8; CID_LEN], usize>,
-	initial: HashMap<Vec<u8>, usize>,
-}
-
-impl Routes {
-	/// The connection `cid` names. Ids we issued win, so a client cannot
-	/// steal a live route by naming it as its Initial destination.
-	fn get(&self, cid: &[u8]) -> Option<usize> {
-		if let Ok(cid) = <[u8; CID_LEN]>::try_from(cid)
-			&& let Some(key) = self.issued.get(&cid)
-		{
-			return Some(*key);
-		}
-		self.initial.get(cid).copied()
-	}
-
-	fn insert(&mut self, key: usize, ids: &ConnectionIds) {
-		for cid in &ids.issued {
-			self.issued.insert(*cid, key);
-		}
-		if let Some(cid) = &ids.initial {
-			self.initial.insert(cid.clone(), key);
-		}
-	}
-
-	/// Drop `key`'s routes. Two clients may pick the same Initial destination
-	/// id, so only the entries still naming `key` go: the other connection
-	/// keeps the one it won.
-	fn remove(&mut self, key: usize, ids: &ConnectionIds) {
-		for cid in &ids.issued {
-			self.remove_issued(cid, key);
-		}
-		if let Some(cid) = &ids.initial
-			&& self.initial.get(cid) == Some(&key)
-		{
-			self.initial.remove(cid);
-		}
-	}
-
-	/// Drop `key`'s route for an id it issued and has now retired.
-	fn remove_issued(&mut self, cid: &[u8; CID_LEN], key: usize) {
-		if self.issued.get(cid) == Some(&key) {
-			self.issued.remove(cid);
-		}
-	}
-}
-
-/// State shared by the handles, the demux task, and the per-connection
-/// teardown tasks.
-struct Inner {
-	handle: Handle,
-	socket: Rc<udp::Socket>,
-	local: SocketAddr,
-	accepting: RefCell<Option<Accepting>>,
-	conns: RefCell<slab::Slab<Conn>>,
-	/// Destination connection id -> the connection it belongs to.
-	routes: RefCell<Routes>,
-	/// Incoming handshakes in flight. Together with the accept queue this is
-	/// bounded by [`Config::backlog`].
-	pending: Cell<usize>,
-	backlog: usize,
-	/// The reuseport slot every issued connection id steers to, if any.
-	shard: Option<moq_sock::shard::Shard>,
-	/// Live [`Endpoint`] handles; at zero the endpoint winds down (no new
-	/// accepts or dials, existing connections served until they end).
-	handles: Cell<usize>,
-	/// The socket's terminal error, if it died under us.
-	closed: RefCell<Option<Error>>,
-	/// Wakes the demux task to re-check its exit condition.
-	task_waiters: RefCell<kio::WaiterList>,
-	accept_waiters: RefCell<kio::WaiterList>,
-}
-
-/// A QUIC endpoint on one worker socket: accept, dial, or both.
-///
-/// Created by [`new`](Endpoint::new); clones share the endpoint. Dropping the
-/// last handle stops new accepts and dials, but connections already
-/// established (or still handshaking) are served until they end; the socket
-/// closes when the last one does.
-pub struct Endpoint {
-	inner: Rc<Inner>,
-}
-
-impl Endpoint {
-	/// Serve `socket` on the worker behind `handle`.
-	pub fn new(handle: &Handle, socket: udp::Socket, config: Config) -> Result<Self, Error> {
-		let local = socket.local_addr().map_err(|err| Error::Io(err.to_string()))?;
-		let accepting = match config.server {
-			Some(server) => Some(Accepting {
-				config: super::server_config(&server)?,
-				transport: server.transport.clone(),
-				queue: VecDeque::new(),
-			}),
-			None => None,
-		};
-		let inner = Rc::new(Inner {
-			handle: handle.clone(),
-			socket: Rc::new(socket),
-			local,
-			accepting: RefCell::new(accepting),
-			conns: RefCell::new(slab::Slab::new()),
-			routes: RefCell::new(Routes::default()),
-			pending: Cell::new(0),
-			backlog: config.backlog,
-			shard: config.shard,
-			handles: Cell::new(1),
-			closed: RefCell::new(None),
-			task_waiters: RefCell::new(kio::WaiterList::new()),
-			accept_waiters: RefCell::new(kio::WaiterList::new()),
-		});
-
-		let task = inner.clone();
-		handle.spawn(async move { kio::wait(|waiter| task.poll_run(waiter)).await });
-
-		Ok(Self { inner })
-	}
-
-	/// The socket's bound local address.
-	pub fn local_addr(&self) -> SocketAddr {
-		self.inner.local
-	}
-
-	/// The next handshaken incoming connection.
-	///
-	/// Fails immediately on an endpoint built without a
-	/// [`server`](Config::server) configuration, and with the socket's error
-	/// once the endpoint has died.
-	pub async fn accept(&self) -> Result<Connection, Error> {
-		kio::wait(|waiter| {
-			if let Some(err) = &*self.inner.closed.borrow() {
-				return Poll::Ready(Err(err.clone()));
-			}
-			let mut accepting = self.inner.accepting.borrow_mut();
-			let Some(accepting) = accepting.as_mut() else {
-				return Poll::Ready(Err(Error::NotServer));
-			};
-			if let Some(conn) = accepting.queue.pop_front() {
-				return Poll::Ready(Ok(conn));
-			}
-			waiter.register(&mut self.inner.accept_waiters.borrow_mut());
-			Poll::Pending
-		})
-		.await
-	}
-
-	/// Dial [`Config::peer`](super::client::Config::peer) through this
-	/// endpoint's socket, driving the handshake to completion.
-	pub async fn connect(&self, config: &super::client::Config) -> Result<Connection, Error> {
-		if let Some(err) = &*self.inner.closed.borrow() {
-			return Err(err.clone());
-		}
-		let mut quiche_config = super::client_config(config)?;
-		let scid = self.inner.cid();
-		let conn = quiche::connect_with_buffer_factory::<super::BytesFactory>(
-			Some(&config.server_name),
-			&quiche::ConnectionId::from_ref(&scid),
-			self.inner.local,
-			config.peer,
-			&mut quiche_config,
-		)?;
-		#[cfg(feature = "qlog")]
-		let conn = super::with_qlog(
-			conn,
-			super::Qlog {
-				sink: config.transport.qlog.as_ref(),
-				cid: &scid,
-				side: crate::quic::qlog::Side::Client,
-			},
-		);
-		let (shared, _key) = self
-			.inner
-			.launch(conn, ConnectionIds::issued(scid), config.transport.keep_alive);
-		// Flush the Initial flight; the demux task takes it from here.
-		shared.kick();
-		connection::establish(shared).await
-	}
-}
-
-impl Clone for Endpoint {
-	fn clone(&self) -> Self {
-		self.inner.handles.set(self.inner.handles.get() + 1);
-		Self {
-			inner: self.inner.clone(),
-		}
-	}
-}
-
-impl Drop for Endpoint {
-	fn drop(&mut self) {
-		let handles = self.inner.handles.get() - 1;
-		self.inner.handles.set(handles);
-		if handles > 0 {
-			return;
-		}
-		// Nobody will ever claim the queued connections; close them rather
-		// than leaving their drivers to idle out.
-		if let Some(accepting) = self.inner.accepting.borrow_mut().as_mut() {
-			for mut conn in accepting.queue.drain(..) {
-				web_transport_trait::poll::Session::close(&mut conn, 0, "endpoint closed");
-			}
-		}
-		self.inner.task_waiters.borrow_mut().wake();
-	}
-}
-
-impl std::fmt::Debug for Endpoint {
-	fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-		f.debug_struct("Endpoint")
-			.field("local", &self.inner.local)
-			.field("conns", &self.inner.conns.borrow().len())
-			.finish()
-	}
-}
-
-impl Inner {
-	/// The demux task: receive, route, and stop once nothing needs us.
-	fn poll_run(self: &Rc<Self>, waiter: &kio::Waiter) -> Poll<()> {
-		// Handle drops and connection teardowns re-check the exit condition.
-		waiter.register(&mut self.task_waiters.borrow_mut());
-
-		loop {
-			if self.handles.get() == 0 && self.conns.borrow().is_empty() {
-				return Poll::Ready(());
-			}
-			match self.socket.poll_recv(waiter) {
-				Poll::Ready(Ok(mut packet)) => self.demux(&mut packet),
-				Poll::Ready(Err(err)) => {
-					self.fail(Error::Io(err.to_string()));
-					return Poll::Ready(());
-				}
-				Poll::Pending => return Poll::Pending,
-			}
-		}
-	}
-
-	/// Route every datagram in one receive, then service the connections fed.
-	fn demux(self: &Rc<Self>, packet: &mut udp::Packet) {
-		let from = packet.from();
-		let info = quiche::RecvInfo { from, to: self.local };
-
-		// The connections this packet fed; almost always exactly one (a GRO
-		// coalesce is a single source, and ids rarely change mid-burst).
-		let mut fed: Vec<usize> = Vec::new();
-
-		for segment in packet.segments() {
-			// A datagram can coalesce several QUIC packets, but they all
-			// belong to one connection, so the first header routes it whole.
-			let hdr = match quiche::Header::from_slice(segment, CID_LEN) {
-				Ok(hdr) => hdr,
-				Err(err) => {
-					tracing::trace!(%err, "dropping an unparseable datagram");
-					continue;
-				}
-			};
-			let key = self.routes.borrow().get(hdr.dcid.as_ref());
-			match key {
-				Some(key) => {
-					let conn = self.conns.borrow()[key].shared.clone();
-					// A malformed/undecryptable datagram is UDP noise.
-					if let Err(err) = conn.conn.borrow_mut().recv(segment, info) {
-						tracing::debug!(%err, "quiche dropped a datagram");
-					}
-					conn.mark_ingested();
-					if !fed.contains(&key) {
-						fed.push(key);
-					}
-				}
-				None => {
-					if let Some(key) = self.greet(hdr, segment, info)
-						&& !fed.contains(&key)
-					{
-						fed.push(key);
-					}
-				}
-			}
-		}
-
-		for key in fed {
-			self.service(key);
-		}
-	}
-
-	/// A datagram no connection claims: the start of a handshake, or noise.
-	/// Returns the new connection's key when one is born.
-	fn greet(self: &Rc<Self>, hdr: quiche::Header<'_>, segment: &mut [u8], info: quiche::RecvInfo) -> Option<usize> {
-		// Nobody left to claim the connection, or a dial-only endpoint. This
-		// also suppresses stateless responses from a socket that does not serve.
-		if self.handles.get() == 0 || self.accepting.borrow().is_none() {
-			tracing::trace!(from = %info.from, "dropping an unsolicited handshake");
-			return None;
-		}
-		// Long-header packet types are version-specific. Negotiate an unknown
-		// nonzero version before interpreting those bits with our version's map.
-		if hdr.version != 0 && !quiche::version_is_supported(hdr.version) {
-			self.negotiate(&hdr, info.from);
-			return None;
-		}
-		if hdr.ty != quiche::Type::Initial {
-			tracing::trace!(from = %info.from, ty = ?hdr.ty, "dropping an unroutable datagram");
-			return None;
-		}
-		// Bound every connection the application has not claimed, whether its
-		// handshake is still pending or it is already queued for accept.
-		let queued = self.accepting.borrow().as_ref().expect("checked above").queue.len();
-		if self.pending.get() + queued >= self.backlog {
-			tracing::debug!(from = %info.from, "dropping a handshake over the backlog");
-			return None;
-		}
-
-		let scid = self.cid();
-		let keep_alive = self
-			.accepting
-			.borrow()
-			.as_ref()
-			.expect("checked above")
-			.transport
-			.keep_alive;
-		let mut conn = {
-			let mut accepting = self.accepting.borrow_mut();
-			let accepting = accepting.as_mut().expect("checked above");
-			match quiche::accept_with_buf_factory::<super::BytesFactory>(
-				&quiche::ConnectionId::from_ref(&scid),
-				None,
-				self.local,
-				info.from,
-				&mut accepting.config,
-			) {
-				Ok(conn) => conn,
-				Err(err) => {
-					tracing::debug!(%err, "failed to accept a connection");
-					return None;
-				}
-			}
-		};
-		// Named from the client's Initial destination id, like the noq backend,
-		// so a trace is findable from a packet capture. Before `recv`, since
-		// quiche records nothing that happened before the writer was attached.
-		#[cfg(feature = "qlog")]
-		{
-			conn = super::with_qlog(
-				conn,
-				super::Qlog {
-					sink: self
-						.accepting
-						.borrow()
-						.as_ref()
-						.expect("checked above")
-						.transport
-						.qlog
-						.as_ref(),
-					cid: &hdr.dcid,
-					side: crate::quic::qlog::Side::Server,
-				},
-			);
-		}
-		if let Err(err) = conn.recv(segment, info) {
-			// Without a valid first flight there is no handshake to continue.
-			tracing::debug!(%err, "dropping a connection whose Initial was rejected");
-			return None;
-		}
-
-		// Route our chosen id, and the client's Initial id: retransmitted
-		// Initials (and 0-RTT) keep carrying it until our id takes effect.
-		let ids = ConnectionIds {
-			issued: vec![scid],
-			initial: Some(hdr.dcid.to_vec()),
-		};
-		let (shared, key) = self.launch(conn, ids, keep_alive);
-		shared.mark_ingested();
-
-		// Hand the connection over once (if) its handshake completes.
-		self.pending.set(self.pending.get() + 1);
-		let inner = self.clone();
-		self.handle.spawn(async move {
-			let outcome = connection::establish(shared).await;
-			inner.pending.set(inner.pending.get() - 1);
-			let mut conn = match outcome {
-				Ok(conn) => conn,
-				Err(err) => {
-					tracing::debug!(%err, "incoming handshake failed");
-					return;
-				}
-			};
-			// The last handle may have left while we handshook; see Drop.
-			if inner.handles.get() == 0 {
-				web_transport_trait::poll::Session::close(&mut conn, 0, "endpoint closed");
-				return;
-			}
-			{
-				let mut accepting = inner.accepting.borrow_mut();
-				let accepting = accepting.as_mut().expect("accepted without a server config");
-				accepting.queue.push_back(conn);
-			}
-			inner.accept_waiters.borrow_mut().wake();
-		});
-
-		Some(key)
-	}
-
-	/// Tell a peer speaking an unknown QUIC version which ones we do speak.
-	/// Best effort: under send backpressure the packet is dropped and the
-	/// peer's retransmit tries again.
-	fn negotiate(&self, hdr: &quiche::Header<'_>, to: SocketAddr) {
-		let Poll::Ready(Ok(mut tx)) = self.socket.poll_acquire(&kio::Waiter::noop()) else {
-			return;
-		};
-		match quiche::negotiate_version(&hdr.scid, &hdr.dcid, &mut tx) {
-			Ok(len) => {
-				if let Err(err) = tx.send(len, to, len) {
-					tracing::debug!(%err, "failed to send a version negotiation packet");
-				}
-			}
-			Err(err) => tracing::debug!(%err, "failed to build a version negotiation packet"),
-		}
-	}
-
-	/// Register `conn`, spawn its driver, and arrange its teardown.
-	fn launch(
-		self: &Rc<Self>,
-		conn: super::RawConnection,
-		ids: ConnectionIds,
-		keep_alive: Option<std::time::Duration>,
-	) -> (connection::Shared, usize) {
-		let (shared, driver) = connection::launch(&self.handle, self.socket.clone(), conn, keep_alive);
-		let mut conns = self.conns.borrow_mut();
-		let key = conns.vacant_key();
-		self.routes.borrow_mut().insert(key, &ids);
-		conns.insert(Conn {
-			shared: shared.clone(),
-			ids,
-		});
-		drop(conns);
-
-		let inner = self.clone();
-		self.handle.spawn(async move {
-			driver.await;
-			inner.release(key);
-		});
-		(shared, key)
-	}
-
-	/// Post-ingress service for one connection: mint replacement connection
-	/// ids while the peer has credit, drop retired ones, and kick the driver
-	/// so fresh egress reaches the wire.
-	fn service(&self, key: usize) {
-		let shared = self.conns.borrow()[key].shared.clone();
-		{
-			let mut conn = shared.conn.borrow_mut();
-
-			// The peer's active_connection_id_limit is the credit; keep it
-			// spent so a migration always has a fresh id to switch to.
-			while conn.scids_left() > 0 {
-				let cid = self.cid();
-				if conn
-					.new_scid(&quiche::ConnectionId::from_ref(&cid), rand::random(), false)
-					.is_err()
-				{
-					break;
-				}
-				self.routes.borrow_mut().issued.insert(cid, key);
-				self.conns.borrow_mut()[key].ids.issued.push(cid);
-			}
-			while let Some(retired) = conn.retired_scid_next() {
-				// We only ever issue CID_LEN ids, so this is what we pushed.
-				let retired: [u8; CID_LEN] = retired.as_ref().try_into().expect("retired a foreign id");
-				self.routes.borrow_mut().remove_issued(&retired, key);
-				self.conns.borrow_mut()[key].ids.issued.retain(|cid| cid != &retired);
-			}
-		}
-		shared.kick();
-	}
-
-	/// A connection's driver ended; forget it and its routes.
-	fn release(&self, key: usize) {
-		let conn = self.conns.borrow_mut().remove(key);
-		self.routes.borrow_mut().remove(key, &conn.ids);
-		// The demux task may be waiting on us to exit.
-		self.task_waiters.borrow_mut().wake();
-	}
-
-	/// A fresh connection id no live connection already answers to.
-	///
-	/// A sharded endpoint spends a byte on steering, so the draw is 56 bits
-	/// rather than 64. Rerolling a duplicate keeps "one id, one connection" an
-	/// invariant instead of a probability, since a collision would otherwise
-	/// hand one connection's packets to another.
-	fn cid(&self) -> [u8; CID_LEN] {
-		loop {
-			let cid = cid(self.shard);
-			if self.routes.borrow().get(&cid).is_none() {
-				return cid;
-			}
-		}
-	}
-
-	/// The socket died: everything on it fails with `err`.
-	fn fail(&self, err: Error) {
-		*self.closed.borrow_mut() = Some(err.clone());
-		let conns: Vec<connection::Shared> = self
-			.conns
-			.borrow()
-			.iter()
-			.map(|(_, conn)| conn.shared.clone())
-			.collect();
-		for conn in conns {
-			conn.fail(err.clone());
-		}
-		self.accept_waiters.borrow_mut().wake();
-	}
-}
-
-#[cfg(test)]
-mod tests {
-	use super::*;
-
-	#[test]
-	fn routes_register_and_remove_issued_and_initial_ids() {
-		let issued = [1; CID_LEN];
-		// A client's Initial destination id is any width it likes.
-		let initial = vec![2; CID_LEN * 2];
-		let ids = ConnectionIds {
-			issued: vec![issued],
-			initial: Some(initial.clone()),
-		};
-		let mut routes = Routes::default();
-
-		routes.insert(7, &ids);
-		assert_eq!(routes.get(&issued), Some(7));
-		assert_eq!(routes.get(&initial), Some(7));
-
-		routes.remove(7, &ids);
-		assert_eq!(routes.get(&issued), None);
-		assert_eq!(routes.get(&initial), None);
-	}
-
-	#[test]
-	fn an_initial_id_cannot_capture_an_issued_route() {
-		let cid = [3; CID_LEN];
-		let mut routes = Routes::default();
-		routes.insert(1, &ConnectionIds::issued(cid));
-
-		// A second client names the first connection's id as its Initial
-		// destination: it must neither take the route nor take it away.
-		let squatter = ConnectionIds {
-			issued: vec![[4; CID_LEN]],
-			initial: Some(cid.to_vec()),
-		};
-		routes.insert(2, &squatter);
-		assert_eq!(routes.get(&cid), Some(1));
-
-		routes.remove(2, &squatter);
-		assert_eq!(routes.get(&cid), Some(1));
-	}
-
-	#[test]
-	fn releasing_a_connection_leaves_a_shared_initial_id_alone() {
-		// Nothing stops two clients picking the same Initial destination id.
-		let shared = vec![5; CID_LEN * 2];
-		let first = ConnectionIds {
-			issued: vec![[6; CID_LEN]],
-			initial: Some(shared.clone()),
-		};
-		let second = ConnectionIds {
-			issued: vec![[7; CID_LEN]],
-			initial: Some(shared.clone()),
-		};
-		let mut routes = Routes::default();
-		routes.insert(1, &first);
-		routes.insert(2, &second);
-		assert_eq!(routes.get(&shared), Some(2));
-
-		// The loser going away must not strand the winner's retransmits.
-		routes.remove(1, &first);
-		assert_eq!(routes.get(&shared), Some(2));
-
-		routes.remove(2, &second);
-		assert_eq!(routes.get(&shared), None);
-	}
-}
diff --git a/rs/moq-uring/src/quic/quiche/mod.rs b/rs/moq-uring/src/quic/quiche/mod.rs
deleted file mode 100644
index cfbb5475c4..0000000000
--- a/rs/moq-uring/src/quic/quiche/mod.rs
+++ /dev/null
@@ -1,265 +0,0 @@
-//! The quiche backend: sans-IO [`quiche`] on the worker's UDP path.
-//!
-//! TLS goes through BoringSSL, which is also why the trust store is built by
-//! hand here: [`quiche::Config::new`] loads the platform store before it
-//! returns, so "trust only these roots" cannot be expressed by omission.
-
-mod connection;
-mod endpoint;
-mod stream;
-
-pub use connection::Connection;
-pub use endpoint::Endpoint;
-pub use stream::{RecvStream, SendStream};
-
-pub(crate) use connection::Shared;
-
-#[cfg(feature = "qlog")]
-use super::qlog;
-use super::{Congestion, Error, Identity, SEGMENT, Transport, client, server};
-
-/// Keeps caller-owned chunks refcounted all the way through quiche's
-/// retransmission and datagram queues.
-///
-/// Both buffer types are [`bytes::Bytes`] so a stream write hands quiche the
-/// caller's own allocation, and a received datagram comes back out of the
-/// queue as one instead of being copied through a scratch buffer.
-#[derive(Clone, Debug, Default)]
-pub(crate) struct BytesFactory;
-
-impl quiche::BufFactory for BytesFactory {
-	type Buf = bytes::Bytes;
-	type DgramBuf = bytes::Bytes;
-
-	fn buf_from_slice(buf: &[u8]) -> Self::Buf {
-		#[cfg(test)]
-		STREAM_COPIES.with(|copies| copies.set(copies.get() + 1));
-		bytes::Bytes::copy_from_slice(buf)
-	}
-
-	fn dgram_buf_from_slice(buf: &[u8]) -> Self::DgramBuf {
-		bytes::Bytes::copy_from_slice(buf)
-	}
-}
-
-pub(crate) type RawConnection = quiche::Connection<BytesFactory>;
-
-/// The context needed to attach one connection's qlog trace.
-#[cfg(feature = "qlog")]
-struct Qlog<'a> {
-	sink: Option<&'a qlog::Sink>,
-	cid: &'a [u8],
-	side: qlog::Side,
-}
-
-/// Stream this connection's qlog trace into the configured sink, if any.
-///
-/// quiche takes the writer on the connection rather than the config, so the
-/// trace is per connection and has to be attached before the first packet is
-/// fed in: earlier events are simply not recorded.
-#[cfg(feature = "qlog")]
-fn with_qlog(mut conn: RawConnection, qlog: Qlog<'_>) -> RawConnection {
-	if let Some(sink) = qlog.sink {
-		conn.set_qlog(sink.trace(qlog.cid, qlog.side), "moq-uring".to_string(), String::new());
-	}
-	conn
-}
-
-#[cfg(test)]
-thread_local! {
-	static STREAM_COPIES: std::cell::Cell<usize> = const { std::cell::Cell::new(0) };
-}
-
-#[cfg(test)]
-impl BytesFactory {
-	fn reset_stream_copies() {
-		STREAM_COPIES.with(|copies| copies.set(0));
-	}
-
-	fn stream_copies() -> usize {
-		STREAM_COPIES.with(std::cell::Cell::get)
-	}
-}
-
-/// The platform trust store, loaded when a role config asks for it.
-const SYSTEM_ROOTS: &str = "/etc/ssl/certs";
-
-impl From<quiche::Error> for Error {
-	fn from(err: quiche::Error) -> Self {
-		match err {
-			quiche::Error::StreamReset(code) => Self::Reset(code),
-			quiche::Error::StreamStopped(code) => Self::Stop(code),
-			err => Self::Quic(err.to_string()),
-		}
-	}
-}
-
-impl Congestion {
-	/// quiche takes its controller by name, and its BBR is the v2 gcongestion
-	/// port.
-	fn name(self) -> &'static str {
-		match self {
-			Self::Loss => "cubic",
-			Self::Delay => "bbr2_gcongestion",
-		}
-	}
-}
-
-/// Who to trust and how hard to insist, resolved from a role's config.
-struct Trust {
-	/// Extra PEM root files to trust.
-	roots: Vec<std::path::PathBuf>,
-	/// Trust the platform store as well.
-	system: bool,
-	/// What to do about the peer's certificate.
-	verify: boring::ssl::SslVerifyMode,
-}
-
-/// The dialing half of [`tls`].
-pub(crate) fn client_config(config: &client::Config) -> Result<quiche::Config, Error> {
-	// Nothing is checked with verification off, so nothing is loaded: a root
-	// path that does not exist must not fail a connection that was never
-	// going to look at it.
-	let trust = match config.verify {
-		true => Trust {
-			roots: config.roots.clone(),
-			system: config.system_roots,
-			verify: boring::ssl::SslVerifyMode::PEER,
-		},
-		false => Trust {
-			roots: Vec::new(),
-			system: false,
-			verify: boring::ssl::SslVerifyMode::NONE,
-		},
-	};
-	tls(&config.alpn, config.identity.as_ref(), trust, &config.transport)
-}
-
-/// The accepting half of [`tls`].
-pub(crate) fn server_config(config: &server::Config) -> Result<quiche::Config, Error> {
-	use boring::ssl::SslVerifyMode;
-
-	config.check()?;
-	let (roots, verify) = match config.client_auth.roots() {
-		None => (Vec::new(), SslVerifyMode::NONE),
-		Some((roots, false)) => (roots.to_vec(), SslVerifyMode::PEER),
-		Some((roots, true)) => (
-			roots.to_vec(),
-			SslVerifyMode::PEER | SslVerifyMode::FAIL_IF_NO_PEER_CERT,
-		),
-	};
-	let trust = Trust {
-		roots,
-		// Client certificates chain to the roots configured here, never to the
-		// platform store for public sites.
-		system: false,
-		verify,
-	};
-	tls(&config.alpn, Some(&config.identity), trust, &config.transport)
-}
-
-/// Build the quiche config shared by both roles.
-fn tls(
-	alpn: &[String],
-	identity: Option<&Identity>,
-	trust: Trust,
-	transport: &Transport,
-) -> Result<quiche::Config, Error> {
-	use boring::ssl::{SslContextBuilder, SslMethod};
-
-	let mut builder = SslContextBuilder::new(SslMethod::tls()).map_err(|err| Error::Tls(err.to_string()))?;
-	apply_trust(&mut builder, &trust)?;
-
-	if let Some(identity) = identity {
-		apply_identity(&mut builder, identity)?;
-	}
-
-	let mut config = quiche::Config::with_boring_ssl_ctx_builder(quiche::PROTOCOL_VERSION, builder)?;
-	let alpn: Vec<&[u8]> = alpn.iter().map(|p| p.as_bytes()).collect();
-	config.set_application_protos(&alpn)?;
-	config.set_max_idle_timeout(transport.idle_timeout.as_millis() as u64);
-	config.set_max_recv_udp_payload_size(SEGMENT);
-	config.set_max_send_udp_payload_size(SEGMENT);
-	config.set_initial_max_data(16 * 1024 * 1024);
-	config.set_initial_max_stream_data_bidi_local(4 * 1024 * 1024);
-	config.set_initial_max_stream_data_bidi_remote(4 * 1024 * 1024);
-	config.set_initial_max_stream_data_uni(4 * 1024 * 1024);
-	config.set_initial_max_streams_bidi(transport.max_streams);
-	config.set_initial_max_streams_uni(transport.max_streams);
-	config.set_cc_algorithm_name(transport.congestion.name())?;
-	config.enable_dgram(true, 64, 64);
-	Ok(config)
-}
-
-/// Present `identity`, from the PEM it already holds.
-///
-/// The file-based boring setters would re-read the paths on every call, which
-/// is the whole reason [`Identity`] carries bytes.
-fn apply_identity(builder: &mut boring::ssl::SslContextBuilder, identity: &Identity) -> Result<(), Error> {
-	use boring::pkey::PKey;
-	use boring::x509::X509;
-
-	let tls = |err: boring::error::ErrorStack| Error::Tls(err.to_string());
-	let chain = X509::stack_from_pem(identity.cert()).map_err(tls)?;
-	let (leaf, intermediates) = chain
-		.split_first()
-		.ok_or_else(|| Error::Tls("certificate chain holds no certificates".to_string()))?;
-	builder.set_certificate(leaf).map_err(tls)?;
-	for cert in intermediates {
-		builder.add_extra_chain_cert(cert.clone()).map_err(tls)?;
-	}
-
-	let key = PKey::private_key_from_pem(identity.key()).map_err(tls)?;
-	builder.set_private_key(&key).map_err(tls)?;
-	Ok(())
-}
-
-/// Point `builder` at exactly the roots `trust` names.
-///
-/// With [`Trust::system`] off the store is built from scratch, which is the
-/// only way to mean it: adding to the store quiche's own constructor leaves
-/// behind would trust the platform's CAs on top of the configured ones.
-fn apply_trust(builder: &mut boring::ssl::SslContextBuilder, trust: &Trust) -> Result<(), Error> {
-	use boring::x509::store::X509StoreBuilder;
-
-	if trust.system {
-		builder
-			.set_default_verify_paths()
-			.map_err(|err| Error::Tls(format!("{SYSTEM_ROOTS}: {err}")))?;
-		for root in &trust.roots {
-			for cert in read_roots(root)? {
-				builder
-					.cert_store_mut()
-					.add_cert(cert)
-					.map_err(|err| Error::Tls(format!("{}: {err}", root.display())))?;
-			}
-		}
-	} else {
-		let mut store = X509StoreBuilder::new().map_err(|err| Error::Tls(err.to_string()))?;
-		for root in &trust.roots {
-			for cert in read_roots(root)? {
-				store
-					.add_cert(cert)
-					.map_err(|err| Error::Tls(format!("{}: {err}", root.display())))?;
-			}
-		}
-		builder.set_cert_store_builder(store);
-	}
-	builder.set_verify(trust.verify);
-	Ok(())
-}
-
-/// Read every PEM certificate in one root file, naming it when it fails.
-///
-/// A root is routinely a bundle of several CAs, and taking only the first
-/// would reject a peer chaining to any of the others while looking configured.
-/// A file holding none is an error rather than a store that trusts nothing.
-fn read_roots(path: &std::path::Path) -> Result<Vec<boring::x509::X509>, Error> {
-	let pem = std::fs::read(path).map_err(|err| Error::Tls(format!("{}: {err}", path.display())))?;
-	let certs =
-		boring::x509::X509::stack_from_pem(&pem).map_err(|err| Error::Tls(format!("{}: {err}", path.display())))?;
-	if certs.is_empty() {
-		return Err(Error::Tls(format!("{}: no certificates", path.display())));
-	}
-	Ok(certs)
-}
diff --git a/rs/moq-uring/src/quic/quiche/stream.rs b/rs/moq-uring/src/quic/quiche/stream.rs
deleted file mode 100644
index afaea7a484..0000000000
--- a/rs/moq-uring/src/quic/quiche/stream.rs
+++ /dev/null
@@ -1,439 +0,0 @@
-//! Stream handles: thin, direct calls into the shared quiche connection.
-//!
-//! Single-threaded sans-IO means a write goes straight into quiche's send
-//! queue (no staging copy) and a read comes straight out of its reassembly
-//! buffer; the handles just kick the driver so egress reaches the wire and
-//! park on the per-stream waiter lists the driver wakes.
-
-use std::task::{Context, Poll};
-
-use bytes::{Buf, Bytes, BytesMut};
-
-use super::{Error, Shared};
-
-/// An outgoing stream. Dropping it unfinished resets it with code 0.
-pub struct SendStream {
-	shared: Shared,
-	id: u64,
-	park: kio::Park,
-	/// The FIN went out; further writes are refused and `poll_closed` waits
-	/// for the acknowledgement.
-	fin: bool,
-	/// We reset the stream; it is as closed as it will ever be.
-	reset: bool,
-}
-
-impl SendStream {
-	pub(crate) fn new(shared: Shared, id: u64) -> Self {
-		Self {
-			shared,
-			id,
-			park: kio::Park::default(),
-			fin: false,
-			reset: false,
-		}
-	}
-
-	/// The QUIC stream id, which the WebTransport layer uses as the session id.
-	pub(crate) fn id(&self) -> u64 {
-		self.id
-	}
-
-	/// Whether the send side is already terminated, so [`Drop`] would do
-	/// nothing. The WebTransport wrapper asks before mapping a reset of its
-	/// own, since a finished stream must not be reset instead.
-	pub(crate) fn ended(&self) -> bool {
-		self.fin || self.reset
-	}
-
-	/// Queue as much of `buf` as quiche will take right now, without parking.
-	/// Best-effort, for the close path where nobody is left to poll.
-	pub(crate) fn try_write(&mut self, buf: &[u8]) -> usize {
-		if self.fin || self.reset {
-			return 0;
-		}
-		let n = self
-			.shared
-			.conn
-			.borrow_mut()
-			.stream_send(self.id, buf, false)
-			.unwrap_or(0);
-		if n > 0 {
-			self.shared.kick();
-		}
-		n
-	}
-
-	/// [`reset`](web_transport_trait::poll::SendStream::reset) with a
-	/// full-width code, for the WebTransport HTTP/3 error mapping.
-	pub(crate) fn reset_code(&mut self, code: u64) {
-		if self.reset {
-			return;
-		}
-		let _ = self
-			.shared
-			.conn
-			.borrow_mut()
-			.stream_shutdown(self.id, quiche::Shutdown::Write, code);
-		self.reset = true;
-		self.shared.kick();
-	}
-}
-
-impl web_transport_trait::poll::SendStream for SendStream {
-	type Error = Error;
-
-	fn poll_write(&mut self, cx: &mut Context<'_>, buf: &[u8]) -> Poll<Result<usize, Self::Error>> {
-		let waiter = self.park.hold(cx);
-		if self.fin || self.reset {
-			return Poll::Ready(Err(Error::Quic("stream already finished".to_string())));
-		}
-		if let Some(err) = self.shared.closed() {
-			return Poll::Ready(Err(err));
-		}
-		let result = self.shared.conn.borrow_mut().stream_send(self.id, buf, false);
-		match result {
-			Ok(n) if n > 0 || buf.is_empty() => {
-				self.shared.kick();
-				Poll::Ready(Ok(n))
-			}
-			// No capacity right now; the driver wakes us when quiche reports
-			// the stream writable.
-			Ok(_) | Err(quiche::Error::Done) => {
-				self.shared.park_writable(self.id, waiter);
-				Poll::Pending
-			}
-			Err(quiche::Error::StreamStopped(code)) => Poll::Ready(Err(Error::Stop(code))),
-			Err(err) => Poll::Ready(Err(err.into())),
-		}
-	}
-
-	fn poll_write_buf<B: Buf>(&mut self, cx: &mut Context<'_>, buf: &mut B) -> Poll<Result<usize, Self::Error>> {
-		let waiter = self.park.hold(cx);
-		if self.fin || self.reset {
-			return Poll::Ready(Err(Error::Quic("stream already finished".to_string())));
-		}
-		if let Some(err) = self.shared.closed() {
-			return Poll::Ready(Err(err));
-		}
-
-		let mut conn = self.shared.conn.borrow_mut();
-		let capacity = match conn.stream_capacity(self.id) {
-			Ok(capacity) => capacity,
-			// A locally allocated stream only exists in quiche after its first
-			// write. Create it with an empty append so capacity can be checked
-			// before taking ownership from `buf`.
-			Err(quiche::Error::InvalidStreamState(_)) => {
-				conn.stream_send_zc(self.id, Bytes::new(), false)?;
-				conn.stream_capacity(self.id)?
-			}
-			Err(quiche::Error::StreamStopped(code)) => return Poll::Ready(Err(Error::Stop(code))),
-			Err(err) => return Poll::Ready(Err(err.into())),
-		};
-
-		if capacity == 0 && buf.has_remaining() {
-			drop(conn);
-			self.shared.park_writable(self.id, waiter);
-			return Poll::Pending;
-		}
-
-		// `capacity` was read from the same borrow, so quiche takes the whole
-		// chunk and hands back no remainder. Ownership has already left `buf`
-		// by then, so a remainder is a hole in the stream rather than a short
-		// write the caller can retry: report it instead of dropping it.
-		let chunk = buf.copy_to_bytes(capacity.min(buf.remaining()));
-		let (written, remainder) = conn.stream_send_zc(self.id, chunk, false)?;
-		drop(conn);
-		if remainder.is_some_and(|remainder| !remainder.is_empty()) {
-			return Poll::Ready(Err(Error::Quic(
-				"stream send took less than its reported capacity".to_string(),
-			)));
-		}
-
-		self.shared.kick();
-		Poll::Ready(Ok(written))
-	}
-
-	fn set_priority(&mut self, order: u8) {
-		// The trait (like W3C sendOrder) sends HIGHER values first; quiche
-		// urgency is the opposite.
-		let _ = self
-			.shared
-			.conn
-			.borrow_mut()
-			.stream_priority(self.id, 255 - order, false);
-	}
-
-	fn finish(&mut self) -> Result<(), Self::Error> {
-		if self.fin || self.reset {
-			return Ok(());
-		}
-		// An empty FIN write succeeds even at zero capacity.
-		match self.shared.conn.borrow_mut().stream_send(self.id, &[], true) {
-			Ok(_) => {}
-			// A STOP_SENDING beat us here. Carry the code like `poll_write`
-			// does, or `moq_net::Error::from_transport` cannot decode a
-			// routine cancellation.
-			Err(quiche::Error::StreamStopped(code)) => {
-				self.reset = true;
-				return Err(Error::Stop(code));
-			}
-			Err(err) => return Err(err.into()),
-		}
-		self.fin = true;
-		self.shared.kick();
-		Ok(())
-	}
-
-	fn reset(&mut self, code: u32) {
-		self.reset_code(u64::from(code));
-	}
-
-	fn poll_closed(&mut self, cx: &mut Context<'_>) -> Poll<Result<(), Self::Error>> {
-		let waiter = self.park.hold(cx);
-		if self.reset {
-			return Poll::Ready(Ok(()));
-		}
-		// quiche collects a stream when its send side ends (FIN fully
-		// acknowledged, a STOP_SENDING, or a reset), and a collected stream
-		// refuses the capacity query. The driver probes this each turn.
-		let result = self.shared.conn.borrow_mut().stream_capacity(self.id);
-		match result {
-			Err(quiche::Error::StreamStopped(code)) => Poll::Ready(Err(Error::Stop(code))),
-			// The stream is gone. If the driver watched it end while the
-			// connection was up, that verdict stands and a close afterwards
-			// changes nothing. Otherwise we never found out, and the caller
-			// reads success as "every byte arrived".
-			Err(_) => match self.shared.collected(self.id) {
-				Some(Some(code)) => Poll::Ready(Err(Error::Stop(code))),
-				Some(None) => Poll::Ready(Ok(())),
-				None => match self.shared.closed() {
-					Some(err) => Poll::Ready(Err(err)),
-					None => Poll::Ready(Ok(())),
-				},
-			},
-			Ok(_) => {
-				if let Some(err) = self.shared.closed() {
-					return Poll::Ready(Err(err));
-				}
-				self.shared.park_finishing(self.id, waiter);
-				Poll::Pending
-			}
-		}
-	}
-}
-
-impl Drop for SendStream {
-	fn drop(&mut self) {
-		self.shared.forget_send(self.id);
-		if !self.fin && !self.reset {
-			let _ = self
-				.shared
-				.conn
-				.borrow_mut()
-				.stream_shutdown(self.id, quiche::Shutdown::Write, 0);
-			self.shared.kick();
-		}
-	}
-}
-
-impl std::fmt::Debug for SendStream {
-	fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-		f.debug_struct("SendStream").field("id", &self.id).finish()
-	}
-}
-
-/// How far [`RecvStream::poll_closed`] reads ahead of the application before
-/// it waits for the backlog to drain.
-const READ_AHEAD: usize = 64 * 1024;
-
-/// An incoming stream. Dropping it unfinished sends STOP_SENDING with code 0.
-pub struct RecvStream {
-	shared: Shared,
-	id: u64,
-	park: kio::Park,
-	/// Every byte up to the FIN was read out of quiche; reads report the end
-	/// once `backlog` is drained too.
-	finished: bool,
-	/// We stopped the stream; no more reads matter.
-	stopped: bool,
-	/// Bytes `poll_closed` read ahead, handed to `poll_read` before quiche's.
-	backlog: BytesMut,
-}
-
-impl RecvStream {
-	pub(crate) fn new(shared: Shared, id: u64) -> Self {
-		Self {
-			shared,
-			id,
-			park: kio::Park::default(),
-			finished: false,
-			stopped: false,
-			backlog: BytesMut::new(),
-		}
-	}
-
-	/// Whether the read side is already terminated, so [`Drop`] would do
-	/// nothing.
-	pub(crate) fn ended(&self) -> bool {
-		self.finished || self.stopped
-	}
-
-	/// [`stop`](web_transport_trait::poll::RecvStream::stop) with a
-	/// full-width code, for the WebTransport HTTP/3 error mapping.
-	pub(crate) fn stop_code(&mut self, code: u64) {
-		self.backlog.clear();
-		if self.stopped || self.finished {
-			return;
-		}
-		let _ = self
-			.shared
-			.conn
-			.borrow_mut()
-			.stream_shutdown(self.id, quiche::Shutdown::Read, code);
-		self.stopped = true;
-		self.shared.kick();
-	}
-
-	/// Move up to `dst.len()` read-ahead bytes out of the backlog.
-	///
-	/// Wakes a `poll_closed` parked at the read-ahead cap: the room it was
-	/// waiting for is what this just made.
-	fn drain(&mut self, dst: &mut [u8]) -> usize {
-		let n = dst.len().min(self.backlog.len());
-		dst[..n].copy_from_slice(&self.backlog[..n]);
-		self.backlog.advance(n);
-		if n > 0 {
-			self.shared.wake_readable(self.id);
-		}
-		n
-	}
-}
-
-impl web_transport_trait::poll::RecvStream for RecvStream {
-	type Error = Error;
-
-	fn poll_read(&mut self, cx: &mut Context<'_>, dst: &mut [u8]) -> Poll<Result<Option<usize>, Self::Error>> {
-		let waiter = self.park.hold(cx);
-		if dst.is_empty() {
-			return Poll::Ready(Ok(Some(0)));
-		}
-		if !self.backlog.is_empty() {
-			return Poll::Ready(Ok(Some(self.drain(dst))));
-		}
-		if self.finished {
-			return Poll::Ready(Ok(None));
-		}
-		let mut conn = self.shared.conn.borrow_mut();
-		match conn.stream_recv(self.id, dst) {
-			Ok((n, fin)) => {
-				if fin {
-					self.finished = true;
-					if n == 0 {
-						return Poll::Ready(Ok(None));
-					}
-				}
-				drop(conn);
-				// Reading frees flow control the peer is waiting on.
-				self.shared.kick();
-				Poll::Ready(Ok(Some(n)))
-			}
-			Err(quiche::Error::Done) => {
-				if conn.stream_finished(self.id) {
-					self.finished = true;
-					return Poll::Ready(Ok(None));
-				}
-				drop(conn);
-				if let Some(err) = self.shared.closed() {
-					return Poll::Ready(Err(err));
-				}
-				self.shared.park_readable(self.id, waiter);
-				Poll::Pending
-			}
-			Err(quiche::Error::StreamReset(code)) => Poll::Ready(Err(Error::Reset(code))),
-			Err(err) => Poll::Ready(Err(err.into())),
-		}
-	}
-
-	fn stop(&mut self, code: u32) {
-		// Giving up on the read side abandons whatever was read ahead, even
-		// when the FIN is already in and only the backlog is left.
-		self.stop_code(u64::from(code));
-	}
-
-	fn poll_closed(&mut self, cx: &mut Context<'_>) -> Poll<Result<(), Self::Error>> {
-		let waiter = self.park.hold(cx);
-		if self.finished || self.stopped {
-			return Poll::Ready(Ok(()));
-		}
-		// The FIN sits behind whatever the peer sent before it, and quiche only
-		// reports the stream finished once that is read out. Waiting on
-		// readability alone would park behind bytes nobody is reading, so read
-		// ahead into the backlog `poll_read` serves first: this watch resolves
-		// without the application draining the stream, and without losing what
-		// it might still want.
-		loop {
-			if self.backlog.len() >= READ_AHEAD {
-				// Enough held: reading further would let the peer send more
-				// still, so the memory bound wins over watch liveness here.
-				// `drain` wakes this once the application takes some, and a
-				// stream nobody reads past the cap keeps its watch pending
-				// until the connection's idle timeout.
-				self.shared.park_readable(self.id, waiter);
-				return Poll::Pending;
-			}
-			let mut chunk = [0u8; 8 * 1024];
-			let mut conn = self.shared.conn.borrow_mut();
-			match conn.stream_recv(self.id, &mut chunk) {
-				Ok((n, fin)) => {
-					drop(conn);
-					self.backlog.extend_from_slice(&chunk[..n]);
-					// Reading frees flow control the peer is waiting on.
-					self.shared.kick();
-					if fin {
-						self.finished = true;
-						return Poll::Ready(Ok(()));
-					}
-				}
-				Err(quiche::Error::Done) => {
-					// Nothing buffered: either the FIN is in (a reset comes
-					// back as `StreamReset` below, not as this) or more is
-					// still coming.
-					let finished = conn.stream_finished(self.id);
-					drop(conn);
-					if finished {
-						self.finished = true;
-						return Poll::Ready(Ok(()));
-					}
-					if let Some(err) = self.shared.closed() {
-						return Poll::Ready(Err(err));
-					}
-					self.shared.park_readable(self.id, waiter);
-					return Poll::Pending;
-				}
-				Err(quiche::Error::StreamReset(code)) => return Poll::Ready(Err(Error::Reset(code))),
-				Err(err) => return Poll::Ready(Err(err.into())),
-			}
-		}
-	}
-}
-
-impl Drop for RecvStream {
-	fn drop(&mut self) {
-		self.shared.forget_recv(self.id);
-		if !self.finished && !self.stopped {
-			let _ = self
-				.shared
-				.conn
-				.borrow_mut()
-				.stream_shutdown(self.id, quiche::Shutdown::Read, 0);
-			self.shared.kick();
-		}
-	}
-}
-
-impl std::fmt::Debug for RecvStream {
-	fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-		f.debug_struct("RecvStream").field("id", &self.id).finish()
-	}
-}
diff --git a/rs/moq-uring/src/worker.rs b/rs/moq-uring/src/worker.rs
index 43c2302da4..3d9f74b55d 100644
--- a/rs/moq-uring/src/worker.rs
+++ b/rs/moq-uring/src/worker.rs
@@ -546,7 +546,7 @@ impl moq_net::Timers for Handle {
 
 // Without a QUIC backend there is no transport to name, so the worker is a
 // task and timer runtime only.
-#[cfg(any(feature = "noq", feature = "quiche", feature = "quinn"))]
+#[cfg(feature = "noq")]
 impl moq_net::Runtime for Handle {
 	type Transport = crate::quic::web::Session;
 
diff --git a/rs/moq-uring/tests/echo.rs b/rs/moq-uring/tests/echo.rs
index e5fbc3141d..8b1ee1a133 100644
--- a/rs/moq-uring/tests/echo.rs
+++ b/rs/moq-uring/tests/echo.rs
@@ -1,18 +1,16 @@
-//! The PR-2 validation milestone: a raw-quiche echo over the worker's UDP
-//! path, exercising the ring, provided-buffer RX with GRO, GSO TX, userspace
-//! timers (quiche's timeout), local spawn, and parking together.
-//!
-//! Kernel-gated: skips loudly below the Linux 6.12 floor (GitHub-hosted CI),
-//! and runs everywhere else.
+//! A tokio noq peer echoing through the io_uring WebTransport server.
 
-#![cfg(target_os = "linux")]
+#![cfg(all(target_os = "linux", feature = "noq"))]
 
-#[path = "support/quiche.rs"]
+#[path = "support.rs"]
 mod support;
 
 use std::net::UdpSocket;
 
-use moq_uring::{Config, Error, Worker, udp};
+use moq_uring::{Config, Error, Worker, quic, udp};
+use web_transport_trait::poll::{RecvStream as _, SendStream as _, Session as _};
+
+const PAYLOAD: usize = 512 * 1024;
 
 fn worker() -> Option<Worker> {
 	match Worker::new(Config::default()) {
@@ -25,50 +23,80 @@ fn worker() -> Option<Worker> {
 	}
 }
 
-fn echo(config: udp::Config) {
-	let Some(mut worker) = worker() else { return };
-	let handle = worker.handle();
-
-	let server_sock = UdpSocket::bind("127.0.0.1:0").expect("bind server");
-	let client_sock = UdpSocket::bind("127.0.0.1:0").expect("bind client");
+async fn drain(recv: &mut quic::web::RecvStream) -> Vec<u8> {
+	let mut out = Vec::new();
+	let mut buf = [0u8; 64 * 1024];
+	loop {
+		match std::future::poll_fn(|cx| recv.poll_read(cx, &mut buf))
+			.await
+			.expect("read")
+		{
+			Some(n) => out.extend_from_slice(&buf[..n]),
+			None => return out,
+		}
+	}
+}
 
-	let payload: Vec<u8> = (0..512 * 1024).map(|i| (i * 31 % 251) as u8).collect();
-	let expect = payload.clone();
+async fn write_finish(send: &mut quic::web::SendStream, mut buf: &[u8]) {
+	while !buf.is_empty() {
+		let n = std::future::poll_fn(|cx| send.poll_write(cx, buf))
+			.await
+			.expect("write");
+		buf = &buf[n..];
+	}
+	send.finish().expect("finish");
+}
 
+#[test]
+fn echo_noq_peer() {
+	let Some(mut worker) = worker() else { return };
+	let handle = worker.handle();
 	let certs = support::certs().expect("certificates");
-	let server_sock = handle.udp(server_sock, config.clone()).expect("server socket");
-	let server_addr = server_sock.local_addr().expect("server addr");
-	let client_sock = handle.udp(client_sock, config).expect("client socket");
-
-	// The server runs as a spawned worker task; the client drives block_on.
-	let server_handle = handle.clone();
-	handle.spawn(async move {
-		support::echo_server(server_handle, server_sock, certs)
-			.await
-			.expect("echo server");
-	});
 
-	let echoed = worker
-		.block_on(async move { support::echo_client(&handle, client_sock, server_addr, &payload).await })
-		.expect("worker")
-		.expect("echo client");
+	let mut server = quic::server::Config::new(quic::Identity::open(&certs.cert, &certs.key).expect("identity"));
+	server.alpn = vec![web_transport_noq::ALPN.to_string()];
+	let socket = handle
+		.udp(UdpSocket::bind("127.0.0.1:0").expect("bind"), udp::Config::default())
+		.expect("socket");
+	let endpoint =
+		quic::Endpoint::new(&handle, socket, quic::endpoint::Config::default().with_server(server)).expect("endpoint");
+	let addr = endpoint.local_addr();
+	let payload: Vec<u8> = (0..PAYLOAD).map(|i| (i * 31 % 251) as u8).collect();
+	let expected = payload.clone();
 
-	assert_eq!(echoed.len(), expect.len(), "echoed byte count");
-	assert!(echoed == expect, "echoed bytes differ");
-}
+	let client = std::thread::spawn(move || {
+		let runtime = tokio::runtime::Builder::new_current_thread()
+			.enable_all()
+			.build()
+			.expect("runtime");
+		runtime.block_on(async move {
+			let client = web_transport_noq::ClientBuilder::new()
+				.dangerous()
+				.with_no_certificate_verification()
+				.expect("client");
+			let request = web_transport_noq::proto::ConnectRequest::new(
+				url::Url::parse(&format!("https://{addr}/echo")).expect("url"),
+			);
+			let session = client.connect(request).await.expect("connect");
+			let (mut send, mut recv) = session.open_bi().await.expect("open stream");
+			send.write_all(&payload).await.expect("write");
+			send.finish().expect("finish");
+			recv.read_to_end(PAYLOAD + 1).await.expect("read")
+		})
+	});
 
-#[test]
-fn echo_default() {
-	// The production path: multishot + GRO + GSO.
-	echo(udp::Config::default());
-}
+	worker
+		.block_on(async move {
+			let conn = endpoint.accept().await.expect("accept");
+			let request = quic::web::Request::accept(&handle, conn).await.expect("handshake");
+			let mut session = request.ok().await.expect("respond");
+			let (mut send, mut recv) = std::future::poll_fn(|cx| session.poll_accept_bi(cx))
+				.await
+				.expect("accept stream");
+			let payload = drain(&mut recv).await;
+			write_finish(&mut send, &payload).await;
+		})
+		.expect("worker");
 
-#[test]
-fn echo_ablated() {
-	// Everything off: oneshot receives, no GRO, one sendmsg per datagram.
-	let mut config = udp::Config::default();
-	config.gro = false;
-	config.gso = false;
-	config.multishot = false;
-	echo(config);
+	assert_eq!(client.join().expect("client thread"), expected);
 }
diff --git a/rs/moq-uring/tests/endpoint.rs b/rs/moq-uring/tests/endpoint.rs
index 8484b171d4..5a3da90a26 100644
--- a/rs/moq-uring/tests/endpoint.rs
+++ b/rs/moq-uring/tests/endpoint.rs
@@ -5,9 +5,9 @@
 //! Kernel-gated: skips loudly below the Linux 6.12 floor (GitHub-hosted CI),
 //! and runs everywhere else.
 
-#![cfg(all(target_os = "linux", any(feature = "noq", feature = "quiche", feature = "quinn")))]
+#![cfg(all(target_os = "linux", feature = "noq"))]
 
-#[path = "support/quiche.rs"]
+#[path = "support.rs"]
 mod support;
 
 use std::net::UdpSocket;
@@ -171,8 +171,8 @@ fn unsupported_version_is_negotiated_only_by_servers() {
 
 			// Junk first: it must not be fatal, and whatever answer it draws
 			// must be smaller than it was, so the socket is never an
-			// amplifier. quiche stays silent; quinn answers a packet naming
-			// no connection with a stateless reset, which is what tells a
+			// amplifier. Noq answers a packet naming no connection with a
+			// stateless reset, which is what tells a
 			// peer holding stale state to give up.
 			let junk = [0u8; 64];
 			sock.send_to(&junk, server)?;
@@ -221,7 +221,7 @@ fn unsupported_version_is_negotiated_only_by_servers() {
 		}
 	});
 
-	let mut response = worker
+	let response = worker
 		.block_on(std::future::poll_fn(move |cx| {
 			let mut verdict = verdict.lock().unwrap();
 			if let Some(result) = verdict.result.take() {
@@ -234,11 +234,18 @@ fn unsupported_version_is_negotiated_only_by_servers() {
 		.expect("version negotiation response");
 	probe.join().expect("probe thread");
 
-	let hdr = quiche::Header::from_slice(&mut response, 0).expect("parse response");
-	assert_eq!(hdr.ty, quiche::Type::VersionNegotiation);
-	let versions = hdr.versions.expect("advertised versions");
+	assert_eq!(&response[1..5], &[0; 4], "version negotiation has version zero");
+	let dcid = usize::from(response[5]);
+	let scid_len = 6 + dcid;
+	let scid = usize::from(response[scid_len]);
+	let versions = response[scid_len + 1 + scid..]
+		.chunks_exact(4)
+		.map(|version| u32::from_be_bytes(version.try_into().unwrap()))
+		.collect::<Vec<_>>();
 	assert!(
-		versions.contains(&quiche::PROTOCOL_VERSION),
+		versions
+			.iter()
+			.any(|version| noq_proto::DEFAULT_SUPPORTED_VERSIONS.contains(version)),
 		"the supported version is offered: {versions:?}"
 	);
 	drop((endpoint, dial_only));
@@ -295,10 +302,8 @@ fn a_peer_stop_reaches_the_accepted_stream() {
 			let (mut send, mut recv) = std::future::poll_fn(|cx| dialed.poll_open_bi(cx))
 				.await
 				.expect("open_bi");
-			// One byte, so both backends surface the stream: quiche queues an
-			// incoming stream for accept when it becomes readable, not when it
-			// is created. Nothing is awaited between the write and the stop, so
-			// both frames leave in the same flush and land in the same sweep.
+			// One byte makes the stream readable before the stop arrives. Nothing
+			// is awaited between them, so both frames leave in the same flush.
 			std::future::poll_fn(|cx| send.poll_write(cx, b"x"))
 				.await
 				.expect("write");
@@ -349,7 +354,7 @@ fn an_unanswered_dial_times_out() {
 		.udp(UdpSocket::bind("127.0.0.1:0").expect("bind"), udp::Config::default())
 		.expect("client socket");
 	let mut dial = dial_config(hole.local_addr().expect("addr"));
-	// quiche stretches this to 3x the initial probe timeout (RFC 9000 §10.1),
+	// QUIC stretches this to 3x the initial probe timeout (RFC 9000 §10.1),
 	// so the dial resolves in about three seconds.
 	dial.transport.idle_timeout = Duration::from_millis(500);
 
diff --git a/rs/moq-uring/tests/qlog.rs b/rs/moq-uring/tests/qlog.rs
index bf48b5f43e..e465842ef3 100644
--- a/rs/moq-uring/tests/qlog.rs
+++ b/rs/moq-uring/tests/qlog.rs
@@ -3,20 +3,16 @@
 //!
 //! The point of the test is the two halves the relay depends on: the sink
 //! actually produces a file for the connection (per connection on noq and
-//! quiche, per endpoint on quinn-proto, which takes one sink per config), and
+//! per connection on noq, and
 //! every record in it is JSON, so a reader is not handed a truncated or
 //! interleaved trace.
 //!
 //! Kernel-gated: skips loudly below the Linux 6.12 floor (GitHub-hosted CI),
 //! and runs everywhere else.
 
-#![cfg(all(
-	target_os = "linux",
-	feature = "qlog",
-	any(feature = "noq", feature = "quiche", feature = "quinn")
-))]
+#![cfg(all(target_os = "linux", feature = "qlog", feature = "noq"))]
 
-#[path = "support/quiche.rs"]
+#[path = "support.rs"]
 mod support;
 
 use std::net::UdpSocket;
diff --git a/rs/moq-uring/tests/session.rs b/rs/moq-uring/tests/session.rs
index fd6cdfd075..3a2cfe65e5 100644
--- a/rs/moq-uring/tests/session.rs
+++ b/rs/moq-uring/tests/session.rs
@@ -14,9 +14,9 @@
 //! Kernel-gated: skips loudly below the Linux 6.12 floor (GitHub-hosted CI),
 //! and runs everywhere else.
 
-#![cfg(all(target_os = "linux", any(feature = "noq", feature = "quiche", feature = "quinn")))]
+#![cfg(all(target_os = "linux", feature = "noq"))]
 
-#[path = "support/quiche.rs"]
+#[path = "support.rs"]
 mod support;
 
 use std::net::UdpSocket;
@@ -272,7 +272,7 @@ fn two_lite_sessions_share_the_server_socket() {
 }
 
 /// The client verifies for real, trusting only the certificate the server
-/// presents: nothing handshakes unless the configured roots reach quiche.
+/// presents: nothing handshakes unless the configured roots reach noq.
 #[test]
 fn configured_roots_verify_the_server() {
 	let Some(mut worker) = worker() else { return };
diff --git a/rs/moq-uring/tests/support.rs b/rs/moq-uring/tests/support.rs
new file mode 100644
index 0000000000..aed11c8030
--- /dev/null
+++ b/rs/moq-uring/tests/support.rs
@@ -0,0 +1,112 @@
+//! Shared test certificates and tokio timers.
+
+#![allow(dead_code)]
+
+use std::task::Poll;
+
+/// A `Send` [`moq_net::runtime::Timers`] over tokio, for the origin drivers
+/// the session tests run on a tokio thread.
+#[derive(Clone, Default)]
+pub struct TokioTimers;
+
+impl moq_net::runtime::Timers for TokioTimers {
+	type Timer = TokioTimer;
+
+	fn timer(&self) -> Self::Timer {
+		TokioTimer { at: None, sleep: None }
+	}
+
+	fn now(&self) -> moq_net::runtime::Instant {
+		tokio::time::Instant::now().into_std()
+	}
+}
+
+pub struct TokioTimer {
+	at: Option<moq_net::runtime::Instant>,
+	// Allocated on the first poll after arming, then re-armed in place;
+	// construction panics without a live tokio time driver.
+	sleep: Option<std::pin::Pin<Box<tokio::time::Sleep>>>,
+}
+
+impl moq_net::runtime::Timer for TokioTimer {
+	fn set(&mut self, at: Option<moq_net::runtime::Instant>) {
+		self.at = at;
+		if let (Some(at), Some(sleep)) = (at, &mut self.sleep) {
+			sleep.as_mut().reset(tokio::time::Instant::from_std(at));
+		}
+	}
+
+	fn poll(&mut self, waiter: &kio::Waiter) -> Poll<()> {
+		let Some(at) = self.at else { return Poll::Pending };
+		let sleep = self
+			.sleep
+			.get_or_insert_with(|| Box::pin(tokio::time::sleep_until(tokio::time::Instant::from_std(at))));
+		if sleep.is_elapsed() {
+			return Poll::Ready(());
+		}
+		waiter.poll_future(sleep.as_mut())
+	}
+}
+
+/// A self-signed localhost certificate on disk.
+pub struct Certs {
+	pub dir: tempfile::TempDir,
+	pub cert: std::path::PathBuf,
+	pub key: std::path::PathBuf,
+}
+
+pub fn certs() -> anyhow::Result<Certs> {
+	let signed = rcgen::generate_simple_self_signed(vec!["localhost".into()])?;
+	let dir = tempfile::tempdir()?;
+	let cert = dir.path().join("cert.pem");
+	let key = dir.path().join("key.pem");
+	std::fs::write(&cert, signed.cert.pem())?;
+	std::fs::write(&key, signed.signing_key.serialize_pem())?;
+	Ok(Certs { dir, cert, key })
+}
+
+/// A CA-signed server certificate plus a root file holding two CAs, only the
+/// second of which signed it.
+pub struct Bundle {
+	pub dir: tempfile::TempDir,
+	pub cert: std::path::PathBuf,
+	pub key: std::path::PathBuf,
+	/// Both CAs concatenated, in that order.
+	pub roots: std::path::PathBuf,
+}
+
+/// Build one, for a test that a root file is loaded whole rather than to its
+/// first certificate.
+pub fn bundle() -> anyhow::Result<Bundle> {
+	let ca = |name: &str| -> anyhow::Result<rcgen::CertifiedIssuer<'static, rcgen::KeyPair>> {
+		let key = rcgen::KeyPair::generate()?;
+		let mut params = rcgen::CertificateParams::new(Vec::new())?;
+		params.is_ca = rcgen::IsCa::Ca(rcgen::BasicConstraints::Unconstrained);
+		params.key_usages = vec![rcgen::KeyUsagePurpose::KeyCertSign, rcgen::KeyUsagePurpose::CrlSign];
+		params.distinguished_name.push(rcgen::DnType::CommonName, name);
+		Ok(rcgen::CertifiedIssuer::self_signed(params, key)?)
+	};
+	let unrelated = ca("moq unrelated ca")?;
+	let signer = ca("moq signing ca")?;
+
+	let key = rcgen::KeyPair::generate()?;
+	let mut params = rcgen::CertificateParams::new(vec!["localhost".into()])?;
+	params.use_authority_key_identifier_extension = true;
+	let cert = params.signed_by(&key, &signer)?;
+
+	let dir = tempfile::tempdir()?;
+	let cert_path = dir.path().join("cert.pem");
+	let key_path = dir.path().join("key.pem");
+	let roots_path = dir.path().join("roots.pem");
+	std::fs::write(&cert_path, cert.pem())?;
+	std::fs::write(&key_path, key.serialize_pem())?;
+	// The signer is second on purpose: reading only the first certificate
+	// leaves the store unable to verify anything this server presents.
+	std::fs::write(&roots_path, format!("{}{}", unrelated.pem(), signer.pem()))?;
+	Ok(Bundle {
+		dir,
+		cert: cert_path,
+		key: key_path,
+		roots: roots_path,
+	})
+}
diff --git a/rs/moq-uring/tests/support/quiche.rs b/rs/moq-uring/tests/support/quiche.rs
deleted file mode 100644
index f6e48eb0a9..0000000000
--- a/rs/moq-uring/tests/support/quiche.rs
+++ /dev/null
@@ -1,468 +0,0 @@
-//! Raw-quiche echo plumbing shared by the integration test and the ablation
-//! benchmark (`#[path]`-included by both, so each sees the subset it calls).
-//!
-//! quiche is sans-IO, which is the point: these helpers wire its packet-in /
-//! packet-out / timeout surface straight to a [`moq_uring::udp::Socket`] and a
-//! [`moq_net::runtime::Deadline`], with no other runtime underneath.
-#![allow(dead_code)]
-
-use std::net::SocketAddr;
-use std::task::Poll;
-use std::time::Duration;
-
-/// A `Send` [`moq_net::runtime::Timers`] over tokio, for the origin drivers
-/// the session tests run on a tokio thread.
-#[derive(Clone, Default)]
-pub struct TokioTimers;
-
-impl moq_net::runtime::Timers for TokioTimers {
-	type Timer = TokioTimer;
-
-	fn timer(&self) -> Self::Timer {
-		TokioTimer { at: None, sleep: None }
-	}
-
-	fn now(&self) -> moq_net::runtime::Instant {
-		tokio::time::Instant::now().into_std()
-	}
-}
-
-pub struct TokioTimer {
-	at: Option<moq_net::runtime::Instant>,
-	// Allocated on the first poll after arming, then re-armed in place;
-	// construction panics without a live tokio time driver.
-	sleep: Option<std::pin::Pin<Box<tokio::time::Sleep>>>,
-}
-
-impl moq_net::runtime::Timer for TokioTimer {
-	fn set(&mut self, at: Option<moq_net::runtime::Instant>) {
-		self.at = at;
-		if let (Some(at), Some(sleep)) = (at, &mut self.sleep) {
-			sleep.as_mut().reset(tokio::time::Instant::from_std(at));
-		}
-	}
-
-	fn poll(&mut self, waiter: &kio::Waiter) -> Poll<()> {
-		let Some(at) = self.at else { return Poll::Pending };
-		let sleep = self
-			.sleep
-			.get_or_insert_with(|| Box::pin(tokio::time::sleep_until(tokio::time::Instant::from_std(at))));
-		if sleep.is_elapsed() {
-			return Poll::Ready(());
-		}
-		waiter.poll_future(sleep.as_mut())
-	}
-}
-
-use anyhow::Context as _;
-use moq_net::runtime::Deadline;
-use moq_uring::{Handle, udp};
-
-/// The QUIC UDP payload size both sides use: every full datagram in a GSO
-/// train, and the GRO coalesce stride.
-pub const SEGMENT: usize = 1350;
-/// One GSO train is at most 64 segments; stay a hair under the kernel cap.
-const TRAIN_SEGMENTS: usize = 63;
-
-/// A self-signed localhost certificate on disk, for quiche's file-based API.
-pub struct Certs {
-	pub dir: tempfile::TempDir,
-	pub cert: std::path::PathBuf,
-	pub key: std::path::PathBuf,
-}
-
-pub fn certs() -> anyhow::Result<Certs> {
-	let signed = rcgen::generate_simple_self_signed(vec!["localhost".into()])?;
-	let dir = tempfile::tempdir()?;
-	let cert = dir.path().join("cert.pem");
-	let key = dir.path().join("key.pem");
-	std::fs::write(&cert, signed.cert.pem())?;
-	std::fs::write(&key, signed.signing_key.serialize_pem())?;
-	Ok(Certs { dir, cert, key })
-}
-
-/// A CA-signed server certificate plus a root file holding two CAs, only the
-/// second of which signed it.
-pub struct Bundle {
-	pub dir: tempfile::TempDir,
-	pub cert: std::path::PathBuf,
-	pub key: std::path::PathBuf,
-	/// Both CAs concatenated, in that order.
-	pub roots: std::path::PathBuf,
-}
-
-/// Build one, for a test that a root file is loaded whole rather than to its
-/// first certificate.
-pub fn bundle() -> anyhow::Result<Bundle> {
-	let ca = |name: &str| -> anyhow::Result<rcgen::CertifiedIssuer<'static, rcgen::KeyPair>> {
-		let key = rcgen::KeyPair::generate()?;
-		let mut params = rcgen::CertificateParams::new(Vec::new())?;
-		params.is_ca = rcgen::IsCa::Ca(rcgen::BasicConstraints::Unconstrained);
-		params.key_usages = vec![rcgen::KeyUsagePurpose::KeyCertSign, rcgen::KeyUsagePurpose::CrlSign];
-		params.distinguished_name.push(rcgen::DnType::CommonName, name);
-		Ok(rcgen::CertifiedIssuer::self_signed(params, key)?)
-	};
-	let unrelated = ca("moq unrelated ca")?;
-	let signer = ca("moq signing ca")?;
-
-	let key = rcgen::KeyPair::generate()?;
-	let mut params = rcgen::CertificateParams::new(vec!["localhost".into()])?;
-	params.use_authority_key_identifier_extension = true;
-	let cert = params.signed_by(&key, &signer)?;
-
-	let dir = tempfile::tempdir()?;
-	let cert_path = dir.path().join("cert.pem");
-	let key_path = dir.path().join("key.pem");
-	let roots_path = dir.path().join("roots.pem");
-	std::fs::write(&cert_path, cert.pem())?;
-	std::fs::write(&key_path, key.serialize_pem())?;
-	// The signer is second on purpose: reading only the first certificate
-	// leaves the store unable to verify anything this server presents.
-	std::fs::write(&roots_path, format!("{}{}", unrelated.pem(), signer.pem()))?;
-	Ok(Bundle {
-		dir,
-		cert: cert_path,
-		key: key_path,
-		roots: roots_path,
-	})
-}
-
-fn config(certs: Option<&Certs>, alpn: &[&[u8]]) -> anyhow::Result<quiche::Config> {
-	let mut config = quiche::Config::new(quiche::PROTOCOL_VERSION)?;
-	if let Some(certs) = certs {
-		config.load_cert_chain_from_pem_file(certs.cert.to_str().context("cert path")?)?;
-		config.load_priv_key_from_pem_file(certs.key.to_str().context("key path")?)?;
-	} else {
-		// The client trusts our self-signed server blindly; this is loopback.
-		config.verify_peer(false);
-	}
-	config.set_application_protos(alpn)?;
-	// Generous windows so the echo never stalls on flow control.
-	config.set_initial_max_data(64 * 1024 * 1024);
-	config.set_initial_max_stream_data_bidi_local(32 * 1024 * 1024);
-	config.set_initial_max_stream_data_bidi_remote(32 * 1024 * 1024);
-	config.set_initial_max_streams_bidi(16);
-	// Enough for a test that deliberately opens a lot of them.
-	config.set_initial_max_stream_data_uni(1024 * 1024);
-	config.set_initial_max_streams_uni(1024);
-	config.set_max_recv_udp_payload_size(SEGMENT);
-	config.set_max_send_udp_payload_size(SEGMENT);
-	config.set_max_idle_timeout(10_000);
-	Ok(config)
-}
-
-fn connection_id() -> quiche::ConnectionId<'static> {
-	let scid: [u8; quiche::MAX_CONN_ID_LEN] = rand::random();
-	quiche::ConnectionId::from_vec(scid.to_vec())
-}
-
-/// One QUIC endpoint: a worker socket plus a quiche connection and its timer.
-pub struct Peer {
-	pub sock: udp::Socket,
-	pub conn: quiche::Connection,
-	pub deadline: Deadline<Handle>,
-	pub local: SocketAddr,
-}
-
-impl Peer {
-	/// A client half-connected to `server`, first flight not yet sent.
-	pub fn connect(handle: &Handle, sock: udp::Socket, server: SocketAddr) -> anyhow::Result<Self> {
-		Self::connect_alpn(handle, sock, server, &[b"moq-uring-echo"])
-	}
-
-	/// A client offering `alpn`, for a test that needs to reach something
-	/// other than the echo server.
-	pub fn connect_alpn(
-		handle: &Handle,
-		sock: udp::Socket,
-		server: SocketAddr,
-		alpn: &[&[u8]],
-	) -> anyhow::Result<Self> {
-		Self::dial(handle, sock, server, alpn, None)
-	}
-
-	/// A client offering `alpn` that advertises only `max_data` bytes of
-	/// connection-level flow control, for a test that needs the server to run
-	/// out of credit. Reading a stream is what returns it, so a peer that
-	/// stops reading holds the server there.
-	pub fn connect_throttled(
-		handle: &Handle,
-		sock: udp::Socket,
-		server: SocketAddr,
-		alpn: &[&[u8]],
-		max_data: u64,
-	) -> anyhow::Result<Self> {
-		Self::dial(handle, sock, server, alpn, Some(max_data))
-	}
-
-	fn dial(
-		handle: &Handle,
-		sock: udp::Socket,
-		server: SocketAddr,
-		alpn: &[&[u8]],
-		max_data: Option<u64>,
-	) -> anyhow::Result<Self> {
-		let local = sock.local_addr()?;
-		let mut config = config(None, alpn)?;
-		if let Some(max_data) = max_data {
-			config.set_initial_max_data(max_data);
-		}
-		let conn = quiche::connect(Some("localhost"), &connection_id(), local, server, &mut config)?;
-		Ok(Self {
-			sock,
-			conn,
-			deadline: Deadline::new(handle),
-			local,
-		})
-	}
-
-	/// A server that will accept the first connection arriving on `sock`.
-	pub fn accept(handle: &Handle, sock: udp::Socket, certs: &Certs, from: SocketAddr) -> anyhow::Result<Self> {
-		let local = sock.local_addr()?;
-		let mut config = config(Some(certs), &[b"moq-uring-echo"])?;
-		let conn = quiche::accept(&connection_id(), None, local, from, &mut config)?;
-		Ok(Self {
-			sock,
-			conn,
-			deadline: Deadline::new(handle),
-			local,
-		})
-	}
-
-	/// Drain quiche's egress into GSO trains until it reports `Done`.
-	pub async fn flush(&mut self) -> anyhow::Result<()> {
-		loop {
-			let mut tx = self.sock.acquire().await?;
-			let mut filled = 0;
-			let mut dest = None;
-			// Pack uniform SEGMENT-sized packets back to back; a short packet
-			// ends the train (it must ride last in a GSO send).
-			while filled + SEGMENT <= tx.len() && filled / SEGMENT < TRAIN_SEGMENTS {
-				match self.conn.send(&mut tx[filled..filled + SEGMENT]) {
-					Ok((n, info)) => {
-						dest = Some(info.to);
-						filled += n;
-						if n < SEGMENT {
-							break;
-						}
-					}
-					Err(quiche::Error::Done) => break,
-					Err(err) => return Err(err.into()),
-				}
-			}
-			let Some(to) = dest else {
-				return Ok(());
-			};
-			tx.send(filled, to, SEGMENT)?;
-		}
-	}
-
-	/// Feed one received packet's datagrams into quiche.
-	pub fn ingest(&mut self, packet: &mut udp::Packet) -> anyhow::Result<()> {
-		let from = packet.from();
-		let to = self.local;
-		for segment in packet.segments() {
-			match self.conn.recv(segment, quiche::RecvInfo { from, to }) {
-				Ok(_) => {}
-				// A malformed/undecryptable datagram is UDP noise, not fatal.
-				Err(err) => tracing::debug!(?err, "quiche dropped a datagram"),
-			}
-		}
-		Ok(())
-	}
-
-	/// Wait for ingress or the connection's timeout, and process it. Returns
-	/// once quiche state may have advanced.
-	pub async fn step(&mut self) -> anyhow::Result<()> {
-		self.deadline.set(self.conn.timeout_instant());
-		enum Event {
-			Packet(udp::Packet),
-			Timeout,
-		}
-		let event = kio::wait(|waiter| {
-			if let Poll::Ready(result) = self.sock.poll_recv(waiter) {
-				return Poll::Ready(result.map(Event::Packet));
-			}
-			if self.deadline.poll(waiter).is_ready() {
-				return Poll::Ready(Ok(Event::Timeout));
-			}
-			Poll::Pending
-		})
-		.await?;
-		match event {
-			Event::Packet(mut packet) => {
-				self.ingest(&mut packet)?;
-				// Drain whatever else already queued without parking again.
-				while let Poll::Ready(result) = self.sock.poll_recv(&kio::Waiter::noop()) {
-					self.ingest(&mut result?)?;
-				}
-			}
-			Event::Timeout => self.conn.on_timeout(),
-		}
-		Ok(())
-	}
-}
-
-/// Echo every readable byte back on its stream, mirroring fins. Reads are
-/// bounded by the stream's send capacity so the echo write can never hit
-/// `Done`; a capacity-blocked stream stays readable and is retried after the
-/// next flush/receive round frees the congestion window.
-pub fn echo_streams(conn: &mut quiche::Connection, scratch: &mut [u8]) -> anyhow::Result<()> {
-	let readable: Vec<u64> = conn.readable().collect();
-	for stream in readable {
-		loop {
-			let cap = match conn.stream_capacity(stream) {
-				Ok(cap) => cap,
-				Err(quiche::Error::InvalidStreamState(_)) => break,
-				Err(err) => return Err(err.into()),
-			};
-			if cap == 0 {
-				break;
-			}
-			let take = cap.min(scratch.len());
-			match conn.stream_recv(stream, &mut scratch[..take]) {
-				Ok((n, fin)) => {
-					let mut offset = 0;
-					while offset < n {
-						offset += conn.stream_send(stream, &scratch[offset..n], false)?;
-					}
-					if fin {
-						// An empty fin write succeeds even at zero capacity.
-						conn.stream_send(stream, &[], true)?;
-						break;
-					}
-				}
-				Err(quiche::Error::Done) => break,
-				Err(err) => return Err(err.into()),
-			}
-		}
-	}
-	Ok(())
-}
-
-/// Run a whole client session against an already-listening echo server task:
-/// handshake, send `payload` with fin, collect the echo, close. Returns the
-/// echoed bytes.
-pub async fn echo_client(
-	handle: &Handle,
-	sock: udp::Socket,
-	server: SocketAddr,
-	payload: &[u8],
-) -> anyhow::Result<Vec<u8>> {
-	let mut peer = Peer::connect(handle, sock, server)?;
-	let mut echoed = Vec::with_capacity(payload.len());
-	let mut sent = 0;
-	let mut scratch = vec![0u8; 64 * 1024];
-	let mut watchdog = Deadline::after(handle, Duration::from_secs(30));
-
-	loop {
-		if peer.conn.is_established() && sent < payload.len() {
-			match peer.conn.stream_send(0, &payload[sent..], false) {
-				Ok(n) => {
-					sent += n;
-					if sent == payload.len() {
-						peer.conn.stream_send(0, &[], true)?;
-					}
-				}
-				Err(quiche::Error::Done) => {}
-				Err(err) => return Err(err.into()),
-			}
-		}
-		loop {
-			match peer.conn.stream_recv(0, &mut scratch) {
-				Ok((n, fin)) => {
-					echoed.extend_from_slice(&scratch[..n]);
-					if fin {
-						peer.conn.close(true, 0, b"done").ok();
-					}
-				}
-				Err(quiche::Error::Done) => break,
-				Err(quiche::Error::InvalidStreamState(_)) => break,
-				Err(err) => return Err(err.into()),
-			}
-		}
-		peer.flush().await?;
-		if peer.conn.is_closed() {
-			return Ok(echoed);
-		}
-
-		enum Event {
-			Stepped,
-			Watchdog,
-		}
-		let event = {
-			let mut step = std::pin::pin!(peer.step());
-			kio::wait(|waiter| {
-				if watchdog.poll(waiter).is_ready() {
-					return Poll::Ready(Ok(Event::Watchdog));
-				}
-				match waiter.poll_future(step.as_mut()) {
-					Poll::Ready(result) => Poll::Ready(result.map(|()| Event::Stepped)),
-					Poll::Pending => Poll::Pending,
-				}
-			})
-			.await?
-		};
-		if matches!(event, Event::Watchdog) {
-			anyhow::bail!("echo timed out after 30s (sent {sent}, echoed {})", echoed.len());
-		}
-	}
-}
-
-/// Echo `payload` over one fresh stream of an established connection and wait
-/// for it all to come back. Returns the echoed byte count.
-pub async fn stream_echo(peer: &mut Peer, stream: u64, payload: &[u8]) -> anyhow::Result<usize> {
-	let mut scratch = vec![0u8; 64 * 1024];
-	let mut sent = 0;
-	let mut fin_sent = false;
-	let mut received = 0;
-
-	loop {
-		while sent < payload.len() {
-			match peer.conn.stream_send(stream, &payload[sent..], false) {
-				Ok(0) => break,
-				Ok(n) => sent += n,
-				Err(quiche::Error::Done) => break,
-				Err(err) => return Err(err.into()),
-			}
-		}
-		if sent == payload.len() && !fin_sent {
-			peer.conn.stream_send(stream, &[], true)?;
-			fin_sent = true;
-		}
-		loop {
-			match peer.conn.stream_recv(stream, &mut scratch) {
-				Ok((n, fin)) => {
-					received += n;
-					if fin {
-						return Ok(received);
-					}
-				}
-				Err(quiche::Error::Done) | Err(quiche::Error::InvalidStreamState(_)) => break,
-				Err(err) => return Err(err.into()),
-			}
-		}
-		peer.flush().await?;
-		peer.step().await?;
-	}
-}
-
-/// The echo server body: accept whatever arrives on `sock` first, then echo
-/// until the connection closes.
-pub async fn echo_server(handle: Handle, sock: udp::Socket, certs: Certs) -> anyhow::Result<()> {
-	// The first packet tells us who is connecting.
-	let mut first = sock.recv().await?;
-	let mut peer = Peer::accept(&handle, sock, &certs, first.from())?;
-	peer.ingest(&mut first)?;
-	drop(first);
-
-	let mut scratch = vec![0u8; 64 * 1024];
-	loop {
-		echo_streams(&mut peer.conn, &mut scratch)?;
-		peer.flush().await?;
-		if peer.conn.is_closed() {
-			return Ok(());
-		}
-		peer.step().await?;
-	}
-}
diff --git a/rs/moq-uring/tests/teardown.rs b/rs/moq-uring/tests/teardown.rs
index b66a647453..c8ec9b145f 100644
--- a/rs/moq-uring/tests/teardown.rs
+++ b/rs/moq-uring/tests/teardown.rs
@@ -13,7 +13,7 @@
 
 #![cfg(target_os = "linux")]
 
-#[path = "support/quiche.rs"]
+#[path = "support.rs"]
 mod support;
 
 use std::net::UdpSocket;
diff --git a/rs/moq-uring/tests/web.rs b/rs/moq-uring/tests/web.rs
index 6f3d746f30..0baf0c7bf2 100644
--- a/rs/moq-uring/tests/web.rs
+++ b/rs/moq-uring/tests/web.rs
@@ -1,4 +1,4 @@
-//! WebTransport interop: the reference tokio stack (`web-transport-quinn`,
+//! WebTransport interop: the reference tokio stack (`web-transport-noq`,
 //! what browsers interop with) dials the uring server. One test hand-drives
 //! streams and datagrams through the H3 framing; the other runs a whole
 //! moq-lite session over it, which is exactly the browser-to-relay path.
@@ -6,9 +6,9 @@
 //! Kernel-gated: skips loudly below the Linux 6.12 floor (GitHub-hosted CI),
 //! and runs everywhere else.
 
-#![cfg(all(target_os = "linux", any(feature = "noq", feature = "quiche", feature = "quinn")))]
+#![cfg(all(target_os = "linux", feature = "noq"))]
 
-#[path = "support/quiche.rs"]
+#[path = "support.rs"]
 mod support;
 
 use std::net::UdpSocket;
@@ -45,9 +45,9 @@ fn h3_endpoint(handle: &moq_uring::Handle, certs: &support::Certs) -> quic::Endp
 }
 
 /// The tokio-side client, in its own runtime on its own thread.
-fn quinn_client(
+fn noq_client(
 	url: String,
-	body: impl FnOnce(web_transport_quinn::Session) -> ClientFuture + Send + 'static,
+	body: impl FnOnce(web_transport_noq::Session) -> ClientFuture + Send + 'static,
 ) -> std::thread::JoinHandle<()> {
 	std::thread::spawn(move || {
 		// May already be installed by a sibling test; either way one exists.
@@ -57,12 +57,12 @@ fn quinn_client(
 			.build()
 			.expect("tokio runtime");
 		rt.block_on(async move {
-			let client = web_transport_quinn::ClientBuilder::new()
+			let client = web_transport_noq::ClientBuilder::new()
 				.dangerous()
 				.with_no_certificate_verification()
 				.expect("client");
-			let request = web_transport_quinn::proto::ConnectRequest::new(url::Url::parse(&url).expect("url"))
-				.with_protocol(PROTO);
+			let request =
+				web_transport_noq::proto::ConnectRequest::new(url::Url::parse(&url).expect("url")).with_protocol(PROTO);
 			let session = client.connect(request).await.expect("connect");
 			body(session).await;
 		});
@@ -71,8 +71,8 @@ fn quinn_client(
 
 type ClientFuture = std::pin::Pin<Box<dyn Future<Output = ()> + Send>>;
 
-/// Read a quinn-side stream to its end.
-async fn read_all(recv: &mut web_transport_quinn::RecvStream) -> Vec<u8> {
+/// Read a noq-side stream to its end.
+async fn read_all(recv: &mut web_transport_noq::RecvStream) -> Vec<u8> {
 	let mut out = Vec::new();
 	let mut buf = [0u8; 4096];
 	while let Some(n) = recv.read(&mut buf).await.expect("read") {
@@ -118,7 +118,7 @@ fn webtransport_echo_end_to_end() {
 	let endpoint = h3_endpoint(&handle, &certs);
 	let addr = endpoint.local_addr();
 
-	let client = quinn_client(format!("https://{addr}/echo?token=abc"), |session| {
+	let client = noq_client(format!("https://{addr}/echo?token=abc"), |session| {
 		Box::pin(async move {
 			// Bidirectional echo.
 			let (mut send, mut recv) = session.open_bi().await.expect("open_bi");
@@ -231,7 +231,7 @@ fn lite_session_over_webtransport() {
 	let endpoint = h3_endpoint(&handle, &certs);
 	let addr = endpoint.local_addr();
 
-	let client = quinn_client(format!("https://{addr}/"), |session| {
+	let client = noq_client(format!("https://{addr}/"), |session| {
 		Box::pin(async move {
 			assert_eq!(session.protocol(), Some(PROTO), "negotiated subprotocol");
 			let (sub_origin, sub_driver) = origin::Producer::new(origin::Config::default());
@@ -239,7 +239,10 @@ fn lite_session_over_webtransport() {
 
 			let moq = moq_net::Client::new()
 				.with_subscriber(sub_origin.clone())
-				.connect_lite(moq_tokio::runtime::Runtime::new(), session)
+				.connect_lite(
+					moq_tokio::runtime::Runtime::new(),
+					moq_tokio::transport::Session::new(session),
+				)
 				.await
 				.expect("connect_lite");
 
@@ -298,109 +301,6 @@ fn lite_session_over_webtransport() {
 	origins.join().expect("origin driver");
 }
 
-/// A peer that opens unidirectional streams of an unknown type and never
-/// sends a control stream must not hold the handshake open forever.
-///
-/// Classification drops an unknown type rather than keeping it, and a
-/// finished stream returns its credit, so a cap counting only the streams the
-/// handshake *retains* never trips and the loop runs as long as the peer
-/// cares to feed it.
-#[test]
-fn unknown_streams_cannot_stall_the_handshake() {
-	let Some(mut worker) = worker() else { return };
-	let handle = worker.handle();
-	let certs = support::certs().expect("certificates");
-	let endpoint = h3_endpoint(&handle, &certs);
-	let server = endpoint.local_addr();
-
-	let peer_handle = handle.clone();
-	worker
-		.block_on(async move {
-			let sock = peer_handle
-				.udp(UdpSocket::bind("127.0.0.1:0").expect("bind"), udp::Config::default())
-				.expect("client socket");
-			// Raw quiche, because the misbehavior here is exactly what a real
-			// HTTP/3 client would refuse to produce. It drives from a task so it
-			// and the handshake below make progress against each other on this
-			// one worker thread.
-			let task_handle = peer_handle.clone();
-			peer_handle.spawn(async move {
-				let mut peer = support::Peer::connect_alpn(&task_handle, sock, server, &[b"h3"]).expect("client");
-				peer.flush().await.expect("first flight");
-				while !peer.conn.is_established() {
-					peer.step().await.expect("step");
-					peer.flush().await.expect("flush");
-				}
-
-				// Comfortably past the cap, each a single junk type byte,
-				// finished so its credit comes straight back.
-				for i in 0..80u64 {
-					let stream = 2 + i * 4; // client-initiated unidirectional
-					if peer.conn.stream_send(stream, &[0x3f], true).is_err() {
-						break;
-					}
-					peer.flush().await.expect("flush");
-					peer.step().await.expect("step");
-				}
-			});
-
-			let conn = endpoint.accept().await.expect("accepted connection");
-			let err = quic::web::Request::accept(&handle, conn)
-				.await
-				.expect_err("the handshake must give up");
-			assert!(
-				matches!(err, quic::Error::Web(ref reason) if reason.contains("too many streams")),
-				"got {err:?}"
-			);
-		})
-		.expect("worker");
-}
-
-// ── Handshake and teardown edge cases ───────────────────────────────
-
-/// Connection-level flow control the throttled peer advertises, which is what
-/// the server runs out of below. Big enough for the handshake, small enough to
-/// fill in a handful of writes.
-const THROTTLE: u64 = 64 * 1024;
-/// Mirrors the crate's own cap on unidirectional streams accepted before the
-/// control stream arrives.
-const HANDSHAKE_STREAMS: usize = 64;
-/// The client's first bidirectional stream, which the CONNECT rides.
-const CLIENT_BI: u64 = 0;
-/// The client's first two unidirectional streams. QUIC creates lower-numbered
-/// streams implicitly, so the server's accept queue hands them out in this
-/// order however the packets arrive.
-const CLIENT_UNI: [u64; 2] = [2, 6];
-
-/// A client offering `alpn` on its own socket, not yet handshaken.
-fn raw_peer(handle: &moq_uring::Handle, server: std::net::SocketAddr, throttle: Option<u64>) -> support::Peer {
-	let sock = handle
-		.udp(UdpSocket::bind("127.0.0.1:0").expect("bind"), udp::Config::default())
-		.expect("client socket");
-	match throttle {
-		Some(max_data) => support::Peer::connect_throttled(handle, sock, server, &[b"h3"], max_data).expect("client"),
-		None => support::Peer::connect_alpn(handle, sock, server, &[b"h3"]).expect("client"),
-	}
-}
-
-/// Queue the client half of the HTTP/3 handshake: SETTINGS on `control`, then
-/// the CONNECT request. Raw quiche, because these tests need arrivals a real
-/// WebTransport client would never produce.
-fn h3_request(peer: &mut support::Peer, control: u64, url: &str) {
-	let mut settings = web_transport_quinn::proto::Settings::default();
-	settings.enable_webtransport(1);
-	let mut buf = Vec::new();
-	settings.encode(&mut buf);
-	peer.conn.stream_send(control, &buf, false).expect("control stream");
-
-	let mut buf = Vec::new();
-	web_transport_quinn::proto::ConnectRequest::new(url::Url::parse(url).expect("url"))
-		.with_protocol(PROTO)
-		.encode(&mut buf)
-		.expect("encode CONNECT");
-	peer.conn.stream_send(CLIENT_BI, &buf, false).expect("connect stream");
-}
-
 /// Await `future`, failing rather than hanging if it takes too long.
 ///
 /// Everything here is a stall or a leak, so the failure mode without the fix
@@ -420,7 +320,7 @@ async fn within<T>(handle: &moq_uring::Handle, what: &str, future: impl Future<O
 }
 
 /// A client whose CONNECT is expected to fail, reporting how it failed.
-fn quinn_client_err(url: String) -> std::thread::JoinHandle<web_transport_quinn::ClientError> {
+fn noq_client_err(url: String) -> std::thread::JoinHandle<web_transport_noq::ClientError> {
 	std::thread::spawn(move || {
 		let _ = rustls::crypto::aws_lc_rs::default_provider().install_default();
 		let rt = tokio::runtime::Builder::new_current_thread()
@@ -428,12 +328,12 @@ fn quinn_client_err(url: String) -> std::thread::JoinHandle<web_transport_quinn:
 			.build()
 			.expect("tokio runtime");
 		rt.block_on(async move {
-			let client = web_transport_quinn::ClientBuilder::new()
+			let client = web_transport_noq::ClientBuilder::new()
 				.dangerous()
 				.with_no_certificate_verification()
 				.expect("client");
-			let request = web_transport_quinn::proto::ConnectRequest::new(url::Url::parse(&url).expect("url"))
-				.with_protocol(PROTO);
+			let request =
+				web_transport_noq::proto::ConnectRequest::new(url::Url::parse(&url).expect("url")).with_protocol(PROTO);
 			// The server answers by closing, so the failure has to arrive as
 			// that close. Waiting out the idle timeout would "fail" too, ten
 			// seconds later, which is what a peer sees when a close is
@@ -446,61 +346,6 @@ fn quinn_client_err(url: String) -> std::thread::JoinHandle<web_transport_quinn:
 	})
 }
 
-/// A unidirectional stream that names its type and then stalls must not hold
-/// off a control stream that has fully arrived.
-///
-/// The accept queue is strictly id-ordered, so the stalled stream is always
-/// adopted first. Classifying one at a time parked there for as long as the
-/// peer kept the connection alive, with a complete SETTINGS sitting behind it.
-#[test]
-fn a_stalled_stream_cannot_block_the_handshake() {
-	let Some(mut worker) = worker() else { return };
-	let handle = worker.handle();
-	let certs = support::certs().expect("certificates");
-	let endpoint = h3_endpoint(&handle, &certs);
-	let server = endpoint.local_addr();
-
-	let peer_handle = handle.clone();
-	worker
-		.block_on(async move {
-			peer_handle.clone().spawn(async move {
-				let mut peer = raw_peer(&peer_handle, server, None);
-				peer.flush().await.expect("first flight");
-				while !peer.conn.is_established() {
-					peer.step().await.expect("step");
-					peer.flush().await.expect("flush");
-				}
-
-				// A WebTransport unidirectional header, complete except for
-				// the session id it never sends.
-				let stalled = [0x40, 0x54];
-				peer.conn
-					.stream_send(CLIENT_UNI[0], &stalled, false)
-					.expect("stalled stream");
-				h3_request(&mut peer, CLIENT_UNI[1], "https://localhost/stall");
-				peer.flush().await.expect("flush");
-
-				// Keep turning so the handshake can complete against it.
-				while !peer.conn.is_closed() {
-					if peer.step().await.is_err() || peer.flush().await.is_err() {
-						break;
-					}
-				}
-			});
-
-			let conn = endpoint.accept().await.expect("accepted connection");
-			let request = within(
-				&handle,
-				"the handshake to get past the stalled stream",
-				quic::web::Request::accept(&handle, conn),
-			)
-			.await
-			.expect("handshake");
-			assert_eq!(request.url().path(), "/stall");
-		})
-		.expect("worker");
-}
-
 /// A handshake the server abandons must close the connection.
 ///
 /// Dropping the public `Connection` does not: the endpoint keeps it, its
@@ -515,7 +360,7 @@ fn an_abandoned_handshake_closes_the_connection() {
 	let endpoint = h3_endpoint(&handle, &certs);
 	let addr = endpoint.local_addr();
 
-	let client = quinn_client_err(format!("https://{addr}/"));
+	let client = noq_client_err(format!("https://{addr}/"));
 
 	worker
 		.block_on(async move {
@@ -555,7 +400,7 @@ fn a_rejection_reaches_the_peer() {
 	let endpoint = h3_endpoint(&handle, &certs);
 	let addr = endpoint.local_addr();
 
-	let client = quinn_client_err(format!("https://{addr}/nope"));
+	let client = noq_client_err(format!("https://{addr}/nope"));
 
 	worker
 		.block_on(async move {
@@ -575,8 +420,8 @@ fn a_rejection_reaches_the_peer() {
 	assert!(
 		matches!(
 			&err,
-			web_transport_quinn::ClientError::HttpError(web_transport_quinn::ConnectError::ProtoError(
-				web_transport_quinn::proto::ConnectError::WrongStatus(Some(status))
+			web_transport_noq::ClientError::HttpError(web_transport_noq::ConnectError::ProtoError(
+				web_transport_noq::proto::ConnectError::WrongStatus(Some(status))
 			)) if *status == http::StatusCode::NOT_FOUND
 		),
 		"got {err:?}"
@@ -596,7 +441,7 @@ fn a_dropped_stream_carries_a_webtransport_code() {
 	let endpoint = h3_endpoint(&handle, &certs);
 	let addr = endpoint.local_addr();
 
-	let client = quinn_client(format!("https://{addr}/"), |session| {
+	let client = noq_client(format!("https://{addr}/"), |session| {
 		Box::pin(async move {
 			// The server writes this and then drops the stream unfinished.
 			let mut recv = session.accept_uni().await.expect("accept_uni");
@@ -610,7 +455,7 @@ fn a_dropped_stream_carries_a_webtransport_code() {
 			ack.finish().expect("finish");
 
 			let err = recv.read(&mut buf).await.expect_err("the server dropped it");
-			assert!(matches!(err, web_transport_quinn::ReadError::Reset(0)), "got {err:?}");
+			assert!(matches!(err, web_transport_noq::ReadError::Reset(0)), "got {err:?}");
 
 			// And the other direction: the server drops the read half of this
 			// one, which must arrive as a WebTransport cancellation too.
@@ -621,10 +466,7 @@ fn a_dropped_stream_carries_a_webtransport_code() {
 					Err(err) => break err,
 				}
 			};
-			assert!(
-				matches!(err, web_transport_quinn::WriteError::Stopped(0)),
-				"got {err:?}"
-			);
+			assert!(matches!(err, web_transport_noq::WriteError::Stopped(0)), "got {err:?}");
 
 			session.close(CLOSE_CODE, CLOSE_REASON.as_bytes());
 			session.closed().await;
@@ -673,302 +515,3 @@ fn a_dropped_stream_carries_a_webtransport_code() {
 
 	client.join().expect("client thread");
 }
-
-/// Finishing a web-mode stream that cannot frame itself yet is backpressure,
-/// not a failure.
-///
-/// A stream opened while the connection's flow-control credit is spent still
-/// owes its WebTransport header, and callers drop (and so reset) a stream that
-/// reports a terminal error. The finish has to complete once credit returns.
-#[test]
-fn finishing_under_backpressure_is_not_an_error() {
-	let Some(mut worker) = worker() else { return };
-	let handle = worker.handle();
-	let certs = support::certs().expect("certificates");
-	let endpoint = h3_endpoint(&handle, &certs);
-	let server = endpoint.local_addr();
-
-	// Set by the server once it has filled the peer's credit: reading is what
-	// returns it, so the peer must not read before then.
-	let reading = std::rc::Rc::new(std::cell::Cell::new(false));
-	// How many streams the peer has seen end cleanly. A reset arrives instead
-	// of a FIN, so this never reaches its target if a finished stream is
-	// cancelled on the way out. A kio channel rather than a flag polled on a
-	// timer: the tests share a machine, and a wall clock loses that race.
-	let ended = kio::Producer::new(0usize);
-	let counted = ended.consume();
-
-	let peer_handle = handle.clone();
-	let peer_reading = reading.clone();
-	worker
-		.block_on(async move {
-			peer_handle.clone().spawn(async move {
-				let mut peer = raw_peer(&peer_handle, server, Some(THROTTLE));
-				peer.flush().await.expect("first flight");
-				while !peer.conn.is_established() {
-					peer.step().await.expect("step");
-					peer.flush().await.expect("flush");
-				}
-				h3_request(&mut peer, CLIENT_UNI[0], "https://localhost/backpressure");
-				peer.flush().await.expect("flush");
-
-				let mut scratch = vec![0u8; 64 * 1024];
-				while !peer.conn.is_closed() {
-					if peer.step().await.is_err() {
-						break;
-					}
-					if peer_reading.get() {
-						let readable: Vec<u64> = peer.conn.readable().collect();
-						for stream in readable {
-							loop {
-								match peer.conn.stream_recv(stream, &mut scratch) {
-									Ok((_, true)) => {
-										if let Ok(mut count) = ended.write() {
-											*count += 1;
-										}
-										break;
-									}
-									Ok((_, false)) => {}
-									Err(_) => break,
-								}
-							}
-						}
-					}
-					if peer.flush().await.is_err() {
-						break;
-					}
-				}
-			});
-
-			let conn = endpoint.accept().await.expect("accepted connection");
-			let request = quic::web::Request::accept(&handle, conn).await.expect("handshake");
-			let mut session = request
-				.respond(quic::web::Response::default().with_protocol(PROTO))
-				.await
-				.expect("respond");
-
-			// Spend the peer's connection-level credit on a stream it is not
-			// reading. Polling with a no-op waker stops at the first refusal
-			// rather than parking.
-			let mut filler = std::future::poll_fn(|cx| session.poll_open_uni(cx))
-				.await
-				.expect("open_uni");
-			let chunk = [0u8; 4096];
-			let mut cx = std::task::Context::from_waker(std::task::Waker::noop());
-			loop {
-				match filler.poll_write(&mut cx, &chunk) {
-					std::task::Poll::Ready(Ok(_)) => {}
-					std::task::Poll::Ready(Err(err)) => panic!("filling the credit failed: {err}"),
-					std::task::Poll::Pending => break,
-				}
-			}
-
-			// A fresh stream still owes its header and has no credit to write
-			// it with, which is exactly the case that used to fail.
-			let mut blocked = std::future::poll_fn(|cx| session.poll_open_uni(cx))
-				.await
-				.expect("open_uni");
-			blocked.finish().expect("finishing under backpressure");
-
-			// The same case, for a caller that finishes and drops rather than
-			// polling: the FIN is the stream's debt by then, so `Drop` has to
-			// pay it instead of resetting a stream that finished cleanly.
-			let mut dropped = std::future::poll_fn(|cx| session.poll_open_uni(cx))
-				.await
-				.expect("open_uni");
-			dropped.finish().expect("finishing under backpressure");
-
-			reading.set(true);
-			within(
-				&handle,
-				"the finished stream to close once credit returns",
-				std::future::poll_fn(|cx| blocked.poll_closed(cx)),
-			)
-			.await
-			.expect("closed");
-
-			// Credit is back by now, so the drop can make good on the finish.
-			// Both streams have to reach the peer as clean ends; a cancelled
-			// one arrives as a reset and never counts.
-			drop(dropped);
-			within(
-				&handle,
-				"both finished streams to arrive intact",
-				counted.wait(|count| match **count >= 2 {
-					true => std::task::Poll::Ready(()),
-					false => std::task::Poll::Pending,
-				}),
-			)
-			.await
-			.expect("the peer is still reading");
-		})
-		.expect("worker");
-}
-
-/// The arrival cap must not refuse a peer whose control stream is already
-/// first in the queue.
-///
-/// The cap bounds a peer that never sends a control stream. Counting arrivals
-/// before classifying any of them turned it into a limit on how much a valid
-/// client may pipeline: the control stream sat at the head of the queue,
-/// fully arrived, while the streams behind it tripped the cap.
-#[test]
-fn a_pipelining_peer_is_not_refused_by_the_arrival_cap() {
-	let Some(mut worker) = worker() else { return };
-	let handle = worker.handle();
-	let certs = support::certs().expect("certificates");
-	let endpoint = h3_endpoint(&handle, &certs);
-	let server = endpoint.local_addr();
-
-	// Closed once the server has acknowledged every stream, which is what
-	// proves they are all sitting in its accept queue rather than still on
-	// the wire. The handshake below must not start before that.
-	let queued = kio::Producer::new(());
-	let ready = queued.consume();
-
-	let peer_handle = handle.clone();
-	worker
-		.block_on(async move {
-			peer_handle.clone().spawn(async move {
-				let mut peer = raw_peer(&peer_handle, server, None);
-				peer.flush().await.expect("first flight");
-				while !peer.conn.is_established() {
-					peer.step().await.expect("step");
-					peer.flush().await.expect("flush");
-				}
-
-				// The control stream leads, then comfortably more than the cap
-				// behind it. The one that tips the cap over is a real
-				// WebTransport stream rather than junk, so losing it is
-				// visible: junk is dropped by classification either way.
-				h3_request(&mut peer, CLIENT_UNI[0], "https://localhost/pipelined");
-				for i in 1..90u64 {
-					let stream = CLIENT_UNI[0] + i * 4;
-					// Arrivals are in id order, and the control stream is the
-					// first, so this one is arrival HANDSHAKE_STREAMS + 1.
-					let payload: &[u8] = match i as usize == HANDSHAKE_STREAMS {
-						// `0x4054` is the WebTransport stream type, then the
-						// session id: the CONNECT stream, which is 0.
-						true => &[0x40, 0x54, 0x00],
-						false => &[0x3f],
-					};
-					if peer
-						.conn
-						.stream_send(stream, payload, i as usize != HANDSHAKE_STREAMS)
-						.is_err()
-					{
-						break;
-					}
-				}
-				peer.flush().await.expect("flush");
-				// Wait for the server to answer, which it must: the streams
-				// above are ack-eliciting, and an acknowledgement means its
-				// driver has already ingested them into the accept queue. That
-				// is what makes the handshake below start against a full queue
-				// instead of racing the packets into it, which is the
-				// difference between reproducing the bug and not.
-				//
-				// Exactly one round trip. Waiting for a second would hang
-				// until the idle timeout, since the server sends nothing more
-				// while it waits for the signal below.
-				let received = peer.conn.stats().recv;
-				while peer.conn.stats().recv == received {
-					peer.step().await.expect("step");
-					peer.flush().await.expect("flush");
-				}
-				let _ = queued.close();
-
-				while !peer.conn.is_closed() {
-					if peer.step().await.is_err() || peer.flush().await.is_err() {
-						break;
-					}
-				}
-			});
-
-			let conn = endpoint.accept().await.expect("accepted connection");
-			within(&handle, "the peer to queue every stream", ready.closed()).await;
-			let request = within(
-				&handle,
-				"the handshake to accept a pipelining peer",
-				quic::web::Request::accept(&handle, conn),
-			)
-			.await
-			.expect("handshake");
-			assert_eq!(request.url().path(), "/pipelined");
-
-			// And the stream that tipped the cap over is still the peer's to
-			// use, rather than one the handshake quietly cancelled.
-			let mut session = request
-				.respond(quic::web::Response::default().with_protocol(PROTO))
-				.await
-				.expect("respond");
-			within(
-				&handle,
-				"the stream that tipped the cap over to survive the handshake",
-				std::future::poll_fn(|cx| session.poll_accept_uni(cx)),
-			)
-			.await
-			.expect("accept_uni");
-		})
-		.expect("worker");
-}
-
-/// A rejection abandoned mid-grace still closes the connection.
-///
-/// `reject` waits for the peer to acknowledge the response before closing
-/// deliberately. Disarming the guard before that wait meant a cancelled
-/// `reject` skipped both, leaving the endpoint holding the connection, its
-/// routes, and its driver for a peer that keeps sending.
-#[test]
-fn an_abandoned_rejection_still_closes_the_connection() {
-	let Some(mut worker) = worker() else { return };
-	let handle = worker.handle();
-	let certs = support::certs().expect("certificates");
-	let endpoint = h3_endpoint(&handle, &certs);
-	let server = endpoint.local_addr();
-
-	let peer_handle = handle.clone();
-	worker
-		.block_on(async move {
-			peer_handle.clone().spawn(async move {
-				let mut peer = raw_peer(&peer_handle, server, None);
-				peer.flush().await.expect("first flight");
-				while !peer.conn.is_established() {
-					peer.step().await.expect("step");
-					peer.flush().await.expect("flush");
-				}
-				h3_request(&mut peer, CLIENT_UNI[0], "https://localhost/abandoned");
-				peer.flush().await.expect("flush");
-
-				// Deliberately never acknowledges the response, so the
-				// rejection stays parked in its grace period.
-				std::future::pending::<()>().await;
-			});
-
-			let conn = endpoint.accept().await.expect("accepted connection");
-			let mut watch = conn.clone();
-			let request = quic::web::Request::accept(&handle, conn).await.expect("handshake");
-
-			// Drive the rejection until it parks waiting for the peer, then
-			// walk away from it.
-			// Boxed, not `pin!`: dropping a `Pin<&mut F>` leaves the future
-			// itself alive in its hidden local, which is not the case here.
-			let mut reject = Box::pin(request.reject(quic::web::Rejected::NotFound));
-			let mut cx = std::task::Context::from_waker(std::task::Waker::noop());
-			for _ in 0..64 {
-				match reject.as_mut().poll(&mut cx) {
-					std::task::Poll::Ready(result) => panic!("the rejection must still be waiting: {result:?}"),
-					std::task::Poll::Pending => {}
-				}
-			}
-			drop(reject);
-
-			within(
-				&handle,
-				"the abandoned rejection to close the connection",
-				std::future::poll_fn(|cx| watch.poll_closed(cx)),
-			)
-			.await;
-		})
-		.expect("worker");
-}
diff --git a/rs/moq-uring/tests/workers.rs b/rs/moq-uring/tests/workers.rs
index 926ffd9d7a..475fb2eae8 100644
--- a/rs/moq-uring/tests/workers.rs
+++ b/rs/moq-uring/tests/workers.rs
@@ -9,9 +9,9 @@
 //! Kernel-gated: skips loudly below the Linux 6.12 floor (GitHub-hosted CI),
 //! and runs everywhere else.
 
-#![cfg(all(target_os = "linux", any(feature = "noq", feature = "quiche", feature = "quinn")))]
+#![cfg(all(target_os = "linux", feature = "noq"))]
 
-#[path = "support/quiche.rs"]
+#[path = "support.rs"]
 mod support;
 
 use std::net::UdpSocket;

From 7745cc5c5e6b6642856da04636280a9dd330f6bd Mon Sep 17 00:00:00 2001
From: Luke Curley <kixelated@gmail.com>
Date: Sun, 20 Sep 2026 17:41:54 -0700
Subject: [PATCH 3/3] fix(quic): finish noq backend migration

Co-Authored-By: GPT-5 <noreply@openai.com>
---
 Cargo.lock                       | 1172 +-----------------------------
 doc/bin/relay/config.md          |    6 +-
 quest/m1/README.md               |    1 -
 rs/libmoq/src/test.rs            |   14 -
 rs/moq-relay/src/uring.rs        |    5 +-
 rs/moq-tokio/src/listen.rs       |    5 +-
 rs/moq-tokio/src/util.rs         |    3 +-
 rs/moq-tokio/tests/worker.rs     |    2 +-
 rs/moq-uring/Cargo.toml          |    6 +-
 rs/moq-uring/benches/echo_noq.rs |   15 +-
 rs/moq-uring/src/quic/mod.rs     |    4 +-
 rs/moq-uring/src/quic/noq/mod.rs |   13 +-
 rs/moq-uring/src/quic/qlog.rs    |   37 +-
 rs/moq-uring/tests/echo.rs       |    6 +-
 14 files changed, 68 insertions(+), 1221 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index f94aec16fb..164a68870f 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -18,15 +18,6 @@ version = "0.1.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "366ffbaa4442f4684d91e2cd7c5ea7c4ed8add41959a31447066e279e432b618"
 
-[[package]]
-name = "addr2line"
-version = "0.25.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1b5d307320b3181d6d7954e663bd7c774a838b8220fe0593c86d9fb09f498b4b"
-dependencies = [
- "gimli",
-]
-
 [[package]]
 name = "adler2"
 version = "2.0.1"
@@ -647,21 +638,6 @@ dependencies = [
  "tokio",
 ]
 
-[[package]]
-name = "backtrace"
-version = "0.3.76"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bb531853791a215d7c62a30daf0dde835f381ab5de4589cfe7c649d2cbe92bd6"
-dependencies = [
- "addr2line",
- "cfg-if",
- "libc",
- "miniz_oxide 0.8.9",
- "object",
- "rustc-demangle",
- "windows-link",
-]
-
 [[package]]
 name = "base16ct"
 version = "0.2.0"
@@ -848,31 +824,6 @@ dependencies = [
  "objc2 0.6.4",
 ]
 
-[[package]]
-name = "boring"
-version = "4.22.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3b0e3bc837369e9e662d3845c374ac3771b054d4bc2dee5457591198d16d684c"
-dependencies = [
- "bitflags 2.13.1",
- "boring-sys",
- "foreign-types",
- "libc",
- "openssl-macros",
-]
-
-[[package]]
-name = "boring-sys"
-version = "4.22.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "15aad385759d3da2737772aefb391332227bef7cb71fb85c106cadd9d1e63a98"
-dependencies = [
- "bindgen 0.72.1",
- "cmake",
- "fs_extra",
- "fslock",
-]
-
 [[package]]
 name = "boytacean"
 version = "0.13.2"
@@ -1121,34 +1072,6 @@ dependencies = [
  "nom 7.1.3",
 ]
 
-[[package]]
-name = "cf-rustracing"
-version = "1.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9e708e4e7bd0aa8f03edc6befeb0b40587c202c503f00a7cc20e612d14af55d3"
-dependencies = [
- "backtrace",
- "rand 0.10.2",
- "tokio",
- "trackable",
-]
-
-[[package]]
-name = "cf-rustracing-jaeger"
-version = "1.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "16c0e4d8cce27f6a6eaff58d2b66f063a18b8ed0d6ef0947ae7a263afa3b7c08"
-dependencies = [
- "cf-rustracing",
- "hostname",
- "local-ip-address",
- "percent-encoding",
- "rand 0.10.2",
- "thrift_codec",
- "tokio",
- "trackable",
-]
-
 [[package]]
 name = "cfg-expr"
 version = "0.20.8"
@@ -1371,18 +1294,6 @@ dependencies = [
  "wasm-bindgen",
 ]
 
-[[package]]
-name = "const-hex"
-version = "1.19.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "33e2a781ebdf4467d1428dc4593067825fb646f6871475098d8577421af73558"
-dependencies = [
- "cfg-if",
- "cpufeatures 0.2.17",
- "proptest",
- "serde_core",
-]
-
 [[package]]
 name = "const-oid"
 version = "0.9.6"
@@ -1630,15 +1541,6 @@ version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "790eea4361631c5e7d22598ecd5723ff611904e3344ce8720784c93e3d83d40b"
 
-[[package]]
-name = "crossbeam"
-version = "0.8.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1137cd7e7fc0fb5d3c5a8678be38ec56e819125d8d7907411fe24ccb943faca8"
-dependencies = [
- "crossbeam-utils",
-]
-
 [[package]]
 name = "crossbeam-channel"
 version = "0.5.16"
@@ -1779,61 +1681,14 @@ dependencies = [
  "syn 2.0.119",
 ]
 
-[[package]]
-name = "darling"
-version = "0.20.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fc7f46116c46ff9ab3eb1597a45688b6715c6e628b5c133e288e709a29bcb4ee"
-dependencies = [
- "darling_core 0.20.11",
- "darling_macro 0.20.11",
-]
-
-[[package]]
-name = "darling"
-version = "0.23.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "25ae13da2f202d56bd7f91c25fba009e7717a1e4a1cc98a76d844b65ae912e9d"
-dependencies = [
- "darling_core 0.23.0",
- "darling_macro 0.23.0",
-]
-
 [[package]]
 name = "darling"
 version = "0.24.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ed17f5901b6630b993ca003def43f2f8ef4014fc13b047b57aad617ff32bc2ec"
 dependencies = [
- "darling_core 0.24.1",
- "darling_macro 0.24.1",
-]
-
-[[package]]
-name = "darling_core"
-version = "0.20.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0d00b9596d185e565c2207a0b01f8bd1a135483d02d9b7b0a54b11da8d53412e"
-dependencies = [
- "fnv",
- "ident_case",
- "proc-macro2",
- "quote",
- "strsim",
- "syn 2.0.119",
-]
-
-[[package]]
-name = "darling_core"
-version = "0.23.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9865a50f7c335f53564bb694ef660825eb8610e0a53d3e11bf1b0d3df31e03b0"
-dependencies = [
- "ident_case",
- "proc-macro2",
- "quote",
- "strsim",
- "syn 2.0.119",
+ "darling_core",
+ "darling_macro",
 ]
 
 [[package]]
@@ -1849,53 +1704,17 @@ dependencies = [
  "syn 3.0.5",
 ]
 
-[[package]]
-name = "darling_macro"
-version = "0.20.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fc34b93ccb385b40dc71c6fceac4b2ad23662c7eeb248cf10d529b7e055b6ead"
-dependencies = [
- "darling_core 0.20.11",
- "quote",
- "syn 2.0.119",
-]
-
-[[package]]
-name = "darling_macro"
-version = "0.23.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ac3984ec7bd6cfa798e62b4a642426a5be0e68f9401cfc2a01e3fa9ea2fcdb8d"
-dependencies = [
- "darling_core 0.23.0",
- "quote",
- "syn 2.0.119",
-]
-
 [[package]]
 name = "darling_macro"
 version = "0.24.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2ac7135c3ef02b2f7833bbeb1be5ba7f966dcde8a87c6b87f65a778d71a02785"
 dependencies = [
- "darling_core 0.24.1",
+ "darling_core",
  "quote",
  "syn 3.0.5",
 ]
 
-[[package]]
-name = "dashmap"
-version = "6.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e6361d5c062261c78a176addb82d4c821ae42bed6089de0e12603cd25de2059c"
-dependencies = [
- "cfg-if",
- "crossbeam-utils",
- "hashbrown 0.14.5",
- "lock_api",
- "once_cell",
- "parking_lot_core",
-]
-
 [[package]]
 name = "dasp_sample"
 version = "0.11.0"
@@ -1928,19 +1747,6 @@ dependencies = [
  "syn 3.0.5",
 ]
 
-[[package]]
-name = "datagram-socket"
-version = "0.8.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e352260f0c4539a6380c32001b3ca4912aa7a038030478d70d74bcffe3b0fc95"
-dependencies = [
- "bytes",
- "futures-util",
- "libc",
- "smallvec",
- "tokio",
-]
-
 [[package]]
 name = "deadpool"
 version = "0.12.3"
@@ -1959,12 +1765,6 @@ version = "0.1.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "092966b41edc516079bdf31ec78a2e0588d1d0c08f78b91d8307215928642b2b"
 
-[[package]]
-name = "debug_panic"
-version = "0.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9377eb110cece2e9431deb8d7d2ec8c116510b896741f9f2bf02b352147aa2a6"
-
 [[package]]
 name = "defmt"
 version = "1.1.1"
@@ -2054,37 +1854,6 @@ dependencies = [
  "serde_core",
 ]
 
-[[package]]
-name = "derive_builder"
-version = "0.20.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "507dfb09ea8b7fa618fcf76e953f4f5e192547945816d5358edffe39f6f94947"
-dependencies = [
- "derive_builder_macro",
-]
-
-[[package]]
-name = "derive_builder_core"
-version = "0.20.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2d5bcf7b024d6835cfb3d473887cd966994907effbe9227e8c8219824d06c4e8"
-dependencies = [
- "darling 0.20.11",
- "proc-macro2",
- "quote",
- "syn 2.0.119",
-]
-
-[[package]]
-name = "derive_builder_macro"
-version = "0.20.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ab63b0e2bf4d5928aff72e83a7dace85d7bba5fe12dcc3c5a572d78caffd3f3c"
-dependencies = [
- "derive_builder_core",
- "syn 2.0.119",
-]
-
 [[package]]
 name = "derive_more"
 version = "0.99.20"
@@ -2258,12 +2027,6 @@ version = "0.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d8b14ccef22fc6f5a8f4d7d768562a182c04ce9a3b3157b91390b52ddfdf1a76"
 
-[[package]]
-name = "dtoa"
-version = "1.0.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4c3cf4824e2d5f025c7b531afcb2325364084a16806f6d47fbc1f5fbd9960590"
-
 [[package]]
 name = "dunce"
 version = "1.0.5"
@@ -2415,18 +2178,6 @@ dependencies = [
  "syn 2.0.119",
 ]
 
-[[package]]
-name = "enum_dispatch"
-version = "0.3.13"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "aa18ce2bc66555b3218614519ac839ddb759a7d6720732f979ef8d13be147ecd"
-dependencies = [
- "once_cell",
- "proc-macro2",
- "quote",
- "syn 2.0.119",
-]
-
 [[package]]
 name = "enumflags2"
 version = "0.7.12"
@@ -2454,26 +2205,6 @@ version = "1.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f"
 
-[[package]]
-name = "erased-serde"
-version = "0.3.31"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6c138974f9d5e7fe373eb04df7cae98833802ae4b11c24ac7039a21d5af4b26c"
-dependencies = [
- "serde",
-]
-
-[[package]]
-name = "erased-serde"
-version = "0.4.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d2add8a07dd6a8d93ff627029c51de145e12686fbc36ecb298ac22e74cf02dec"
-dependencies = [
- "serde",
- "serde_core",
- "typeid",
-]
-
 [[package]]
 name = "errno"
 version = "0.3.14"
@@ -2584,7 +2315,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6e634e2e0ebac1ee034020da1ca582e17ffe4e0f5e985823721e168928136dcb"
 dependencies = [
  "crc32fast",
- "miniz_oxide 0.9.1",
+ "miniz_oxide",
  "zlib-rs",
 ]
 
@@ -2648,58 +2379,6 @@ dependencies = [
  "percent-encoding",
 ]
 
-[[package]]
-name = "foundations"
-version = "5.9.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "12a62fa20c0203e73a20912b2dacf0513133351c0486e12e4504be0008584ae7"
-dependencies = [
- "anyhow",
- "cf-rustracing",
- "cf-rustracing-jaeger",
- "crossbeam-utils",
- "erased-serde 0.4.10",
- "foundations-macros",
- "futures-util",
- "governor",
- "http",
- "indexmap 2.14.0",
- "libc",
- "opentelemetry-proto",
- "parking_lot",
- "pin-project-lite",
- "prometheus",
- "prometheus-client",
- "prometools",
- "rand 0.10.2",
- "serde",
- "serde_json",
- "serde_path_to_error",
- "serde_with",
- "serde_yaml",
- "slab",
- "slog",
- "slog-async",
- "slog-json",
- "slog-term",
- "thread_local",
- "tokio",
- "yaml-merge-keys",
- "zeroize",
-]
-
-[[package]]
-name = "foundations-macros"
-version = "5.9.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9fd77b60b7eeca55a566489846ff8454889fea71859e56249e9010f8d900f10c"
-dependencies = [
- "darling 0.23.0",
- "proc-macro2",
- "quote",
- "syn 2.0.119",
-]
-
 [[package]]
 name = "four-cc"
 version = "0.4.0"
@@ -2731,16 +2410,6 @@ dependencies = [
  "libc",
 ]
 
-[[package]]
-name = "fslock"
-version = "0.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "04412b8935272e3a9bae6f48c7bfff74c2911f60525404edfdd28e49884c3bfb"
-dependencies = [
- "libc",
- "winapi",
-]
-
 [[package]]
 name = "futures"
 version = "0.3.34"
@@ -2838,12 +2507,6 @@ version = "0.3.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cd417de3d1d015fc3bfd2b1ea46dfc7bab72ef86f1cc7cc9c78e728b34a6d1fd"
 
-[[package]]
-name = "futures-timer"
-version = "3.0.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "af43fadb8a98512d547e37b4e92e0ced13e205c061b87b4623eff01d918d6968"
-
 [[package]]
 name = "futures-util"
 version = "0.3.34"
@@ -2916,11 +2579,9 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "899def5c37c4fd7b2664648c28120ecec138e4d395b459e5ca34f9cce2dd77fd"
 dependencies = [
  "cfg-if",
- "js-sys",
  "libc",
  "r-efi 5.3.0",
  "wasip2",
- "wasm-bindgen",
 ]
 
 [[package]]
@@ -2937,17 +2598,6 @@ dependencies = [
  "wasm-bindgen",
 ]
 
-[[package]]
-name = "getset"
-version = "0.1.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6cf442baaabe4213ce7d1239afc26c039180b6456da2cededa316ae2c8a77a77"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.119",
-]
-
 [[package]]
 name = "ghash"
 version = "0.5.1"
@@ -2958,12 +2608,6 @@ dependencies = [
  "polyval",
 ]
 
-[[package]]
-name = "gimli"
-version = "0.32.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e629b9b98ef3dd8afe6ca2bd0f89306cec16d43d907889945bc5d6687f2f13c7"
-
 [[package]]
 name = "gio-sys"
 version = "0.20.10"
@@ -3093,29 +2737,6 @@ dependencies = [
  "scroll",
 ]
 
-[[package]]
-name = "governor"
-version = "0.10.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9efcab3c1958580ff1f25a2a41be1668f7603d849bb63af523b208a3cc1223b8"
-dependencies = [
- "cfg-if",
- "dashmap",
- "futures-sink",
- "futures-timer",
- "futures-util",
- "getrandom 0.3.4",
- "hashbrown 0.16.1",
- "nonzero_ext",
- "parking_lot",
- "portable-atomic",
- "quanta",
- "rand 0.9.5",
- "smallvec",
- "spinning_top",
- "web-time",
-]
-
 [[package]]
 name = "gpu-allocator"
 version = "0.28.0"
@@ -3266,12 +2887,6 @@ version = "0.12.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8a9ee70c43aaf417c914396645a0fa852624801b24ebb7ae78fe8272889ac888"
 
-[[package]]
-name = "hashbrown"
-version = "0.14.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e5274423e17b7c9fc20b6e7e208532f9b19825d82dfd615708b70edd83df41f1"
-
 [[package]]
 name = "hashbrown"
 version = "0.16.1"
@@ -3422,17 +3037,6 @@ dependencies = [
  "windows-sys 0.61.2",
 ]
 
-[[package]]
-name = "hostname"
-version = "0.4.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "617aaa3557aef3810a6369d0a99fac8a080891b68bd9f9812a1eeda0c0730cbd"
-dependencies = [
- "cfg-if",
- "libc",
- "windows-link",
-]
-
 [[package]]
 name = "http"
 version = "1.5.0"
@@ -3592,19 +3196,6 @@ dependencies = [
  "tower-service",
 ]
 
-[[package]]
-name = "hyper-timeout"
-version = "0.5.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2b90d566bffbce6a75bd8b09a05aa8c2cb1fabb6cb348f8840c9e4c90a0d83b0"
-dependencies = [
- "hyper",
- "hyper-util",
- "pin-project-lite",
- "tokio",
- "tower-service",
-]
-
 [[package]]
 name = "hyper-util"
 version = "0.1.20"
@@ -3850,15 +3441,6 @@ dependencies = [
  "generic-array",
 ]
 
-[[package]]
-name = "intrusive-collections"
-version = "0.9.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "189d0897e4cbe8c75efedf3502c18c887b05046e59d28404d4d8e46cbc4d1e86"
-dependencies = [
- "memoffset",
-]
-
 [[package]]
 name = "io-uring"
 version = "0.7.15"
@@ -3892,15 +3474,6 @@ dependencies = [
  "serde",
 ]
 
-[[package]]
-name = "ipnetwork"
-version = "0.20.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bf466541e9d546596ee94f9f69590f89473455f88372423e0008fc1a7daf100e"
-dependencies = [
- "serde",
-]
-
 [[package]]
 name = "iroh"
 version = "1.0.3"
@@ -4072,23 +3645,12 @@ name = "is"
 version = "0.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d08f9118d003d441f79c1070e84d0a2a89f35721ca8ae0cd5e1f9026dc4a2517"
-dependencies = [
- "crc",
- "serde",
- "str0m-proto",
- "subtle",
- "tracing",
-]
-
-[[package]]
-name = "is-terminal"
-version = "0.4.17"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3640c1c38b8e4e43584d8df18be5fc6b0aa314ce6ebf51b53313d4306cca8e46"
-dependencies = [
- "hermit-abi",
- "libc",
- "windows-sys 0.61.2",
+dependencies = [
+ "crc",
+ "serde",
+ "str0m-proto",
+ "subtle",
+ "tracing",
 ]
 
 [[package]]
@@ -4495,12 +4057,6 @@ dependencies = [
  "system-deps",
 ]
 
-[[package]]
-name = "linked-hash-map"
-version = "0.5.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0717cef1bc8b636c6e1c1bbdefc09e6322da8a9321966e8928ef80d20f7f770f"
-
 [[package]]
 name = "linux-raw-sys"
 version = "0.4.15"
@@ -4525,17 +4081,6 @@ version = "1.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "11d3d7f243d5c5a8b9bb5d6dd2b1602c0cb0b9db1621bafc7ed66e35ff9fe092"
 
-[[package]]
-name = "local-ip-address"
-version = "0.6.13"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "aa08fb2b1ec3ea84575e94b489d06d4ce0cbf052d12acd515838f50e3c3d63e3"
-dependencies = [
- "libc",
- "neli",
- "windows-sys 0.61.2",
-]
-
 [[package]]
 name = "lock_api"
 version = "0.4.14"
@@ -4678,15 +4223,6 @@ version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "68354c5c6bd36d73ff3feceb05efa59b6acb7626617f4962be322a825e61f79a"
 
-[[package]]
-name = "miniz_oxide"
-version = "0.8.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1fa76a2c86f704bdb222d66965fb3d63269ce38518b83cb0575fca855ebb6316"
-dependencies = [
- "adler2",
-]
-
 [[package]]
 name = "miniz_oxide"
 version = "0.9.1"
@@ -4814,7 +4350,7 @@ dependencies = [
  "moq-net",
  "moq-tokio",
  "moq-uring",
- "procfs 0.18.0",
+ "procfs",
  "rand 0.10.2",
  "serde",
  "serde_json",
@@ -5278,12 +4814,10 @@ dependencies = [
  "noq-proto",
  "notify",
  "qmux",
- "quinn",
  "rand 0.10.2",
  "rcgen",
  "reqwest",
  "rustls",
- "rustls-native-certs",
  "rustls-platform-verifier",
  "rustls-webpki",
  "serde",
@@ -5307,8 +4841,6 @@ dependencies = [
  "web-transport-iroh",
  "web-transport-noq",
  "web-transport-proto",
- "web-transport-quiche",
- "web-transport-quinn",
  "web-transport-trait",
  "webpki-roots",
  "x509-parser",
@@ -5338,7 +4870,6 @@ name = "moq-uring"
 version = "0.0.1"
 dependencies = [
  "anyhow",
- "boring",
  "bytes",
  "criterion",
  "http",
@@ -5348,11 +4879,9 @@ dependencies = [
  "moq-net",
  "moq-sock",
  "moq-tokio",
- "nix 0.31.3",
+ "nix",
  "noq-proto",
  "noq-udp",
- "quiche",
- "quinn-proto",
  "rand 0.10.2",
  "rcgen",
  "rustc-hash 2.1.3",
@@ -5365,8 +4894,8 @@ dependencies = [
  "tokio",
  "tracing",
  "url",
+ "web-transport-noq",
  "web-transport-proto",
- "web-transport-quinn",
  "web-transport-trait",
 ]
 
@@ -5637,35 +5166,6 @@ dependencies = [
  "jni-sys 0.3.1",
 ]
 
-[[package]]
-name = "neli"
-version = "0.7.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "22f9786d56d972959e1408b6a93be6af13b9c1392036c5c1fafa08a1b0c6ee87"
-dependencies = [
- "bitflags 2.13.1",
- "byteorder",
- "derive_builder",
- "getset",
- "libc",
- "log",
- "neli-proc-macros",
- "parking_lot",
-]
-
-[[package]]
-name = "neli-proc-macros"
-version = "0.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "05d8d08c6e98f20a62417478ebf7be8e1425ec9acecc6f63e22da633f6b71609"
-dependencies = [
- "either",
- "proc-macro2",
- "quote",
- "serde",
- "syn 2.0.119",
-]
-
 [[package]]
 name = "netdev"
 version = "0.45.0"
@@ -5779,19 +5279,6 @@ dependencies = [
  "wmi",
 ]
 
-[[package]]
-name = "nix"
-version = "0.30.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "74523f3a35e05aba87a1d978330aef40f67b0304ac79c1c00b294c9830543db6"
-dependencies = [
- "bitflags 2.13.1",
- "cfg-if",
- "cfg_aliases",
- "libc",
- "memoffset",
-]
-
 [[package]]
 name = "nix"
 version = "0.31.3"
@@ -5824,12 +5311,6 @@ dependencies = [
  "memchr",
 ]
 
-[[package]]
-name = "nonzero_ext"
-version = "0.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "38bf9645c8b145698bb0b18a4637dcacbc421ea49bef2317e4fd8065a387cf21"
-
 [[package]]
 name = "noq"
 version = "1.1.1"
@@ -6621,15 +6102,6 @@ dependencies = [
  "objc2-metal 0.3.2",
 ]
 
-[[package]]
-name = "object"
-version = "0.37.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ff76201f031d8863c38aa7f905eca4f53abbfa15f609db4277d44cd8938f33fe"
-dependencies = [
- "memchr",
-]
-
 [[package]]
 name = "object_store"
 version = "0.14.1"
@@ -6645,7 +6117,7 @@ dependencies = [
  "http",
  "humantime",
  "itertools 0.15.0",
- "nix 0.31.3",
+ "nix",
  "parking_lot",
  "percent-encoding",
  "thiserror 2.0.20",
@@ -6658,12 +6130,6 @@ dependencies = [
  "windows-sys 0.61.2",
 ]
 
-[[package]]
-name = "octets"
-version = "0.3.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "866cb5af6f3aa3c1b44c3c2d79d22165fbb1b102e1b3fb499864bfe34736ec4b"
-
 [[package]]
 name = "oid-registry"
 version = "0.8.1"
@@ -6722,69 +6188,12 @@ dependencies = [
  "walkdir",
 ]
 
-[[package]]
-name = "openssl-macros"
-version = "0.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a948666b637a0f465e8564c73e89d4dde00d72d4d473cc972f390fc3dcee7d9c"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.119",
-]
-
 [[package]]
 name = "openssl-probe"
 version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7c87def4c32ab89d880effc9e097653c8da5d6ef28e6b539d313baaacfbafcbe"
 
-[[package]]
-name = "opentelemetry"
-version = "0.31.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b84bcd6ae87133e903af7ef497404dda70c60d0ea14895fc8a5e6722754fc2a0"
-dependencies = [
- "futures-core",
- "futures-sink",
- "js-sys",
- "pin-project-lite",
- "thiserror 2.0.20",
- "tracing",
-]
-
-[[package]]
-name = "opentelemetry-proto"
-version = "0.31.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a7175df06de5eaee9909d4805a3d07e28bb752c34cab57fa9cff549da596b30f"
-dependencies = [
- "base64 0.22.1",
- "const-hex",
- "opentelemetry",
- "opentelemetry_sdk",
- "prost",
- "serde",
- "serde_json",
- "tonic",
- "tonic-prost",
-]
-
-[[package]]
-name = "opentelemetry_sdk"
-version = "0.31.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e14ae4f5991976fd48df6d843de219ca6d31b01daaab2dad5af2badeded372bd"
-dependencies = [
- "futures-channel",
- "futures-executor",
- "futures-util",
- "opentelemetry",
- "percent-encoding",
- "rand 0.9.5",
- "thiserror 2.0.20",
-]
-
 [[package]]
 name = "option-operations"
 version = "0.5.0"
@@ -7329,18 +6738,6 @@ dependencies = [
  "unicode-ident",
 ]
 
-[[package]]
-name = "procfs"
-version = "0.17.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cc5b72d8145275d844d4b5f6d4e1eef00c8cd889edb6035c21675d1bb1f45c9f"
-dependencies = [
- "bitflags 2.13.1",
- "hex",
- "procfs-core 0.17.0",
- "rustix 0.38.44",
-]
-
 [[package]]
 name = "procfs"
 version = "0.18.0"
@@ -7350,20 +6747,10 @@ dependencies = [
  "bitflags 2.13.1",
  "chrono",
  "flate2",
- "procfs-core 0.18.0",
+ "procfs-core",
  "rustix 1.1.4",
 ]
 
-[[package]]
-name = "procfs-core"
-version = "0.17.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "239df02d8349b06fc07398a3a1697b06418223b1c7725085e801e7c0fc6a12ec"
-dependencies = [
- "bitflags 2.13.1",
- "hex",
-]
-
 [[package]]
 name = "procfs-core"
 version = "0.18.0"
@@ -7381,96 +6768,6 @@ version = "1.0.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3d595e54a326bc53c1c197b32d295e14b169e3cfeaa8dc82b529f947fba6bcf5"
 
-[[package]]
-name = "prometheus"
-version = "0.14.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3ca5326d8d0b950a9acd87e6a3f94745394f62e4dae1b1ee22b2bc0c394af43a"
-dependencies = [
- "cfg-if",
- "fnv",
- "lazy_static",
- "libc",
- "memchr",
- "parking_lot",
- "procfs 0.17.0",
- "thiserror 2.0.20",
-]
-
-[[package]]
-name = "prometheus-client"
-version = "0.18.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "83cd1b99916654a69008fd66b4f9397fbe08e6e51dfe23d4417acf5d3b8cb87c"
-dependencies = [
- "dtoa",
- "itoa",
- "parking_lot",
- "prometheus-client-derive-text-encode",
-]
-
-[[package]]
-name = "prometheus-client-derive-text-encode"
-version = "0.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "66a455fbcb954c1a7decf3c586e860fd7889cddf4b8e164be736dbac95a953cd"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 1.0.109",
-]
-
-[[package]]
-name = "prometools"
-version = "0.2.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "06c0f1b9189e7361a3e32ded803ab2ecb9a829d86cc32ce3fba8cff1b0cd4b69"
-dependencies = [
- "itoa",
- "parking_lot",
- "prometheus-client",
- "ryu",
- "serde",
-]
-
-[[package]]
-name = "proptest"
-version = "1.11.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4b45fcc2344c680f5025fe57779faef368840d0bd1f42f216291f0dc4ace4744"
-dependencies = [
- "bitflags 2.13.1",
- "num-traits",
- "rand 0.9.5",
- "rand_chacha 0.9.0",
- "rand_xorshift",
- "regex-syntax",
- "unarray",
-]
-
-[[package]]
-name = "prost"
-version = "0.14.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "528ac67416ff8646872a3c02cad9cc4ee5dc9f9540c9b10771855c95cb2e5ae1"
-dependencies = [
- "bytes",
- "prost-derive",
-]
-
-[[package]]
-name = "prost-derive"
-version = "0.14.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b570b25f7617e43d59005d0990ccb79e950a423952cea19671b7a876da390adf"
-dependencies = [
- "anyhow",
- "itertools 0.14.0",
- "proc-macro2",
- "quote",
- "syn 2.0.119",
-]
-
 [[package]]
 name = "pulldown-cmark"
 version = "0.13.4"
@@ -7498,33 +6795,6 @@ dependencies = [
  "thiserror 1.0.69",
 ]
 
-[[package]]
-name = "qlog"
-version = "0.15.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0f15b83c59e6b945f2261c95a1dd9faf239187f32ff0a96af1d1d28c4557f919"
-dependencies = [
- "serde",
- "serde_json",
- "serde_with",
- "smallvec",
-]
-
-[[package]]
-name = "qlog"
-version = "0.18.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c65c0ae39cba4538fd935d376ba17f858046b386dc4597e3fa5c1aedb919ef30"
-dependencies = [
- "flate2",
- "foundations",
- "humantime",
- "serde",
- "serde_json",
- "serde_with",
- "zstd",
-]
-
 [[package]]
 name = "qmux"
 version = "0.5.1"
@@ -7544,55 +6814,14 @@ dependencies = [
  "web-transport-trait",
 ]
 
-[[package]]
-name = "quanta"
-version = "0.12.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f3ab5a9d756f0d97bdc89019bd2e4ea098cf9cde50ee7564dde6b81ccc8f06c7"
-dependencies = [
- "crossbeam-utils",
- "libc",
- "once_cell",
- "raw-cpuid",
- "wasi",
- "web-sys",
- "winapi",
-]
-
 [[package]]
 name = "quest"
 version = "0.1.0"
-dependencies = [
- "anyhow",
- "clap",
- "pulldown-cmark",
- "tempfile",
-]
-
-[[package]]
-name = "quiche"
-version = "0.29.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "61166d27591eb7cb1310eec2b8fc6ae0e0686e9e4ed742a3ffc6317171175e7d"
-dependencies = [
- "boring",
- "bytes",
- "debug_panic",
- "either",
- "enum_dispatch",
- "foreign-types-shared",
- "intrusive-collections",
- "libc",
- "libm",
- "log",
- "octets",
- "qlog 0.18.0",
- "serde",
- "serde_json",
- "serde_with",
- "slab",
- "smallvec",
- "windows-sys 0.59.0",
+dependencies = [
+ "anyhow",
+ "clap",
+ "pulldown-cmark",
+ "tempfile",
 ]
 
 [[package]]
@@ -7632,17 +6861,14 @@ checksum = "04759210543be93709136e28212294a659ef5001836ff4eab4d663e4529bba83"
 dependencies = [
  "aws-lc-rs",
  "bytes",
- "fastbloom",
  "getrandom 0.4.3",
  "lru-slab",
- "qlog 0.15.2",
  "rand 0.10.2",
  "rand_pcg",
  "ring",
  "rustc-hash 2.1.3",
  "rustls",
  "rustls-pki-types",
- "rustls-platform-verifier",
  "slab",
  "thiserror 2.0.20",
  "tinyvec",
@@ -7770,30 +6996,12 @@ dependencies = [
  "rand_core 0.10.1",
 ]
 
-[[package]]
-name = "rand_xorshift"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "513962919efc330f829edb2535844d1b912b0fbe2ca165d613e4e8788bb05a5a"
-dependencies = [
- "rand_core 0.9.5",
-]
-
 [[package]]
 name = "range-alloc"
 version = "0.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ca45419789ae5a7899559e9512e58ca889e41f04f1f2445e9f4b290ceccd1d08"
 
-[[package]]
-name = "raw-cpuid"
-version = "11.6.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "498cd0dc59d73224351ee52a95fee0f1a617a2eae0e7d9d720cc622c73a54186"
-dependencies = [
- "bitflags 2.13.1",
-]
-
 [[package]]
 name = "raw-window-handle"
 version = "0.6.2"
@@ -8084,12 +7292,6 @@ dependencies = [
  "windowfunctions",
 ]
 
-[[package]]
-name = "rustc-demangle"
-version = "0.1.28"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b74b56ffa8bb2830709a538c2cbcae9aa062db0d2a42563bfb09bdaae44020eb"
-
 [[package]]
 name = "rustc-hash"
 version = "1.1.0"
@@ -8618,24 +7820,12 @@ version = "3.23.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1d607aa01a3cb0ad757d6fd216136910db3c97b102fe686585689615a02dbcdc"
 dependencies = [
- "darling 0.24.1",
+ "darling",
  "proc-macro2",
  "quote",
  "syn 3.0.5",
 ]
 
-[[package]]
-name = "serde_yaml"
-version = "0.8.26"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "578a7433b776b56a35785ed5ce9a7e777ac0598aac5a6dd1b4b18a307c7fc71b"
-dependencies = [
- "indexmap 1.9.3",
- "ryu",
- "serde",
- "yaml-rust",
-]
-
 [[package]]
 name = "serdect"
 version = "0.4.3"
@@ -8802,78 +7992,6 @@ version = "0.4.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0c790de23124f9ab44544d7ac05d60440adc586479ce501c1d6d7da3cd8c9cf5"
 
-[[package]]
-name = "slog"
-version = "2.8.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9b3b8565691b22d2bdfc066426ed48f837fc0c5f2c8cad8d9718f7f99d6995c1"
-dependencies = [
- "anyhow",
- "erased-serde 0.3.31",
- "rustversion",
- "serde_core",
-]
-
-[[package]]
-name = "slog-async"
-version = "2.8.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "72c8038f898a2c79507940990f05386455b3a317d8f18d4caea7cbc3d5096b84"
-dependencies = [
- "crossbeam-channel",
- "slog",
- "take_mut",
- "thread_local",
-]
-
-[[package]]
-name = "slog-json"
-version = "2.6.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3e1e53f61af1e3c8b852eef0a9dee29008f55d6dd63794f3f12cef786cf0f219"
-dependencies = [
- "serde",
- "serde_json",
- "slog",
- "time",
-]
-
-[[package]]
-name = "slog-scope"
-version = "4.4.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "42b76cf645c92e7850d5a1c9205ebf2864bd32c0ab3e978e6daad51fedf7ef54"
-dependencies = [
- "arc-swap",
- "lazy_static",
- "slog",
-]
-
-[[package]]
-name = "slog-stdlog"
-version = "4.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6706b2ace5bbae7291d3f8d2473e2bfab073ccd7d03670946197aec98471fa3e"
-dependencies = [
- "log",
- "slog",
- "slog-scope",
-]
-
-[[package]]
-name = "slog-term"
-version = "2.9.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5cb1fc680b38eed6fad4c02b3871c09d2c81db8c96aa4e9c0a34904c830f09b5"
-dependencies = [
- "chrono",
- "is-terminal",
- "slog",
- "term",
- "thread_local",
- "time",
-]
-
 [[package]]
 name = "slotmap"
 version = "1.1.1"
@@ -8888,9 +8006,6 @@ name = "smallvec"
 version = "1.16.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ba467056f1b547ed52077911161fc86985becbc60e8e1857c8a144dab0def891"
-dependencies = [
- "serde",
-]
 
 [[package]]
 name = "smawk"
@@ -9068,15 +8183,6 @@ version = "0.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "023a211cb3138dbc438680b32560ad89f699977624c9f8dbb95a47d5b4c07dd3"
 
-[[package]]
-name = "spinning_top"
-version = "0.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d96d2d1d716fb500937168cc09353ffdc7a012be8475ac7308e1bdf0e3923300"
-dependencies = [
- "lock_api",
-]
-
 [[package]]
 name = "spirv"
 version = "0.4.0+sdk-1.4.341.0"
@@ -9420,29 +8526,12 @@ version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8bdb6fa0dfa67b38c1e66b7041ba9dcf23b99d8121907cd31c807a332f7a0bbb"
 
-[[package]]
-name = "take_mut"
-version = "0.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f764005d11ee5f36500a149ace24e00e3da98b0158b3e2d53a7495660d3f4d60"
-
 [[package]]
 name = "target-lexicon"
 version = "0.13.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "adb6935a6f5c20170eeceb1a3835a49e12e19d792f6dd344ccc76a985ca5a6ca"
 
-[[package]]
-name = "task-killswitch"
-version = "0.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4b2ba744ef0fcfe2d3fa7475ec61af0a9c76c1b0a75d58f0d20a9e10745ae44f"
-dependencies = [
- "dashmap",
- "parking_lot",
- "tokio",
-]
-
 [[package]]
 name = "tempfile"
 version = "3.27.0"
@@ -9456,15 +8545,6 @@ dependencies = [
  "windows-sys 0.61.2",
 ]
 
-[[package]]
-name = "term"
-version = "1.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d8c27177b12a6399ffc08b98f76f7c9a1f4fe9fc967c784c5a071fa8d93cf7e1"
-dependencies = [
- "windows-sys 0.61.2",
-]
-
 [[package]]
 name = "termcolor"
 version = "1.4.1"
@@ -9532,16 +8612,6 @@ dependencies = [
  "cfg-if",
 ]
 
-[[package]]
-name = "thrift_codec"
-version = "0.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "83d957f535b242b91aa9f47bde08080f9a6fef276477e55b0079979d002759d5"
-dependencies = [
- "byteorder",
- "trackable",
-]
-
 [[package]]
 name = "tikv-jemalloc-ctl"
 version = "0.6.1"
@@ -9693,41 +8763,6 @@ dependencies = [
  "syn 3.0.5",
 ]
 
-[[package]]
-name = "tokio-quiche"
-version = "0.19.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f5474b6d00a60bd3d87029a8cd7764af18e5f4a0cd6a4704d5b1d049d15b3e8d"
-dependencies = [
- "anyhow",
- "boring",
- "bytes",
- "crossbeam",
- "datagram-socket",
- "foundations",
- "futures",
- "futures-util",
- "ipnetwork",
- "libc",
- "log",
- "nix 0.30.1",
- "octets",
- "pin-project",
- "qlog 0.18.0",
- "quiche",
- "serde",
- "serde_with",
- "slog-scope",
- "slog-stdlog",
- "smallvec",
- "task-killswitch",
- "thiserror 2.0.20",
- "tokio",
- "tokio-stream",
- "tokio-util",
- "url",
-]
-
 [[package]]
 name = "tokio-rustls"
 version = "0.26.5"
@@ -9774,12 +8809,10 @@ checksum = "494815d09bf52b5548659851081238f0ca39ff638363907596da739561c62c52"
 dependencies = [
  "bytes",
  "futures-core",
- "futures-io",
  "futures-sink",
  "futures-util",
  "libc",
  "pin-project-lite",
- "slab",
  "tokio",
 ]
 
@@ -9922,43 +8955,6 @@ version = "1.1.2+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7d56353a2a665ad0f41a421187180aab746c8c325620617ad883a99a1cbe66d2"
 
-[[package]]
-name = "tonic"
-version = "0.14.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ac2a5518c70fa84342385732db33fb3f44bc4cc748936eb5833d2df34d6445ef"
-dependencies = [
- "async-trait",
- "base64 0.22.1",
- "bytes",
- "http",
- "http-body",
- "http-body-util",
- "hyper",
- "hyper-timeout",
- "hyper-util",
- "percent-encoding",
- "pin-project",
- "sync_wrapper",
- "tokio",
- "tokio-stream",
- "tower",
- "tower-layer",
- "tower-service",
- "tracing",
-]
-
-[[package]]
-name = "tonic-prost"
-version = "0.14.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "50849f68853be452acf590cde0b146665b8d507b3b8af17261df47e02c209ea0"
-dependencies = [
- "bytes",
- "prost",
- "tonic",
-]
-
 [[package]]
 name = "tower"
 version = "0.5.3"
@@ -9967,12 +8963,9 @@ checksum = "ebe5ef63511595f1344e2d5cfa636d973292adc0eec1f0ad45fae9f0851ab1d4"
 dependencies = [
  "futures-core",
  "futures-util",
- "indexmap 2.14.0",
  "pin-project-lite",
- "slab",
  "sync_wrapper",
  "tokio",
- "tokio-util",
  "tower-layer",
  "tower-service",
  "tracing",
@@ -10133,25 +9126,6 @@ dependencies = [
  "wasm-bindgen",
 ]
 
-[[package]]
-name = "trackable"
-version = "1.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b15bd114abb99ef8cee977e517c8f37aee63f184f2d08e3e6ceca092373369ae"
-dependencies = [
- "trackable_derive",
-]
-
-[[package]]
-name = "trackable_derive"
-version = "1.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ebeb235c5847e2f82cfe0f07eb971d1e5f6804b18dac2ae16349cc604380f82f"
-dependencies = [
- "quote",
- "syn 1.0.109",
-]
-
 [[package]]
 name = "try-lock"
 version = "0.2.5"
@@ -10182,12 +9156,6 @@ dependencies = [
  "thiserror 2.0.20",
 ]
 
-[[package]]
-name = "typeid"
-version = "1.0.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bc7d623258602320d5c55d1bc22793b57daff0ec7efc270ea7d55ce1d5f5471c"
-
 [[package]]
 name = "typenum"
 version = "1.20.1"
@@ -10205,12 +9173,6 @@ dependencies = [
  "windows-sys 0.61.2",
 ]
 
-[[package]]
-name = "unarray"
-version = "0.1.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eaea85b334db583fe3274d12b4cd1880032beab409c0d774be044d4480ab9a94"
-
 [[package]]
 name = "unicase"
 version = "2.9.0"
@@ -10886,49 +9848,6 @@ dependencies = [
  "url",
 ]
 
-[[package]]
-name = "web-transport-quiche"
-version = "0.7.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "723f409f2e2d440a53e3c44e64af9b4f9d0c8d49e815c7194b4c581df981632e"
-dependencies = [
- "boring",
- "bytes",
- "flume",
- "futures",
- "http",
- "kio",
- "rustls-pki-types",
- "thiserror 2.0.20",
- "tokio",
- "tokio-quiche",
- "tracing",
- "url",
- "web-transport-proto",
- "web-transport-trait",
-]
-
-[[package]]
-name = "web-transport-quinn"
-version = "0.12.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "63a239cba370789ab705c39b66d223e3b8aef85e2762046fd6b59e560f156756"
-dependencies = [
- "bytes",
- "futures",
- "http",
- "kio",
- "quinn",
- "rustls",
- "rustls-native-certs",
- "thiserror 2.0.20",
- "tokio",
- "tracing",
- "url",
- "web-transport-proto",
- "web-transport-trait",
-]
-
 [[package]]
 name = "web-transport-trait"
 version = "0.4.0"
@@ -11853,27 +10772,6 @@ dependencies = [
  "xml-rs",
 ]
 
-[[package]]
-name = "yaml-merge-keys"
-version = "0.5.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "af47d205071caaef70ebce5e04e1d88eba944833f8a6626dacdda700f86c285a"
-dependencies = [
- "lazy_static",
- "serde_yaml",
- "thiserror 1.0.69",
- "yaml-rust",
-]
-
-[[package]]
-name = "yaml-rust"
-version = "0.4.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "56c1936c4cc7a1c9ab21a1ebb602eb942ba868cbd44a99cb7cdc5892335e1c85"
-dependencies = [
- "linked-hash-map",
-]
-
 [[package]]
 name = "yasna"
 version = "0.6.0"
@@ -12087,34 +10985,6 @@ version = "1.0.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "29666d0abbfad1e3dc4dcf6144730dd3a3ab225bbbdac83319345b1b44ccfc1b"
 
-[[package]]
-name = "zstd"
-version = "0.13.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e91ee311a569c327171651566e07972200e76fcfe2242a4fa446149a3881c08a"
-dependencies = [
- "zstd-safe",
-]
-
-[[package]]
-name = "zstd-safe"
-version = "7.2.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8f49c4d5f0abb602a93fb8736af2a4f4dd9512e36f7f570d66e65ff867ed3b9d"
-dependencies = [
- "zstd-sys",
-]
-
-[[package]]
-name = "zstd-sys"
-version = "2.0.16+zstd.1.5.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "91e19ebc2adc8f83e43039e79776e3fda8ca919132d68a1fed6a5faca2683748"
-dependencies = [
- "cc",
- "pkg-config",
-]
-
 [[package]]
 name = "zune-core"
 version = "0.5.3"
diff --git a/doc/bin/relay/config.md b/doc/bin/relay/config.md
index 450067dee0..142bebd3f0 100644
--- a/doc/bin/relay/config.md
+++ b/doc/bin/relay/config.md
@@ -5,8 +5,10 @@ description: TOML reference for moq-relay
 
 # Configuration
 
-`moq-relay relay.toml`. Every key is also a CLI flag and environment variable
-(`--listen-bind`, `MOQ_LISTEN_BIND`), named by joining the section and key.
+`moq-relay relay.toml`. Every key is also a CLI flag and environment variable.
+Most names join the section and key: `listen.tls.cert` is
+`--listen-tls-cert` / `MOQ_LISTEN_TLS_CERT`. The `listen.bind` key deliberately
+uses the shorter `--listen` / `MOQ_LISTEN` spelling.
 Precedence is CLI > env > file > defaults: a flag or environment variable that
 was actually supplied overrides the file, and a file key that was actually
 written (an empty list, a `false` boolean) overrides the built-in default.
diff --git a/quest/m1/README.md b/quest/m1/README.md
index 8b0e969e0f..1c48d8b85d 100644
--- a/quest/m1/README.md
+++ b/quest/m1/README.md
@@ -24,7 +24,6 @@ does not require it. The transport line in m2 assumes the single noq stack.
 
 ## Quests
 
-- [One auth path](/quest/m1/auth-one-path.md) - Server, Public, and Refuse become tasks on the `Admissions` queue; `admit()` stays send-plus-await; `Mode` is gone
 - [Announce event](/quest/m1/api-net-announce.md) - publishers announce prefixes on every wire, consumers scoped by a pattern read the covered path already trimmed, with no `as_prefix().expect()` at 89 call sites
 - [Bindings announce match](/quest/m1/api-origin-scopes.md) - every binding takes a pattern scope and reports the announce match with its captures
 - [PathPrefixes](/quest/m1/api-path-prefixes.md) - the unused moq_net::PathPrefixes type is deleted before the release
diff --git a/rs/libmoq/src/test.rs b/rs/libmoq/src/test.rs
index cf1f58cb55..e19923e25b 100644
--- a/rs/libmoq/src/test.rs
+++ b/rs/libmoq/src/test.rs
@@ -4243,20 +4243,6 @@ fn config_quic_and_backoff_knobs_apply() {
 	assert_eq!(parsed.quic.qlog.as_deref(), Some(std::path::Path::new(dir)));
 }
 
-/// An idle timeout outside QUIC's millisecond varint is an ordinary configuration
-/// error, and later calls remain usable.
-#[test]
-fn dial_rejects_an_unrepresentable_idle_timeout() {
-	let mut config = client_config();
-	config.quic_idle_timeout_ms = u64::MAX;
-	config.has_quic_idle_timeout = true;
-
-	assert_eq!(dial(Some(&config)), Error::InvalidConfig(String::new()).code());
-
-	// A rejected dial leaves the library usable.
-	assert!(moq_client_defaults().has_connect_timeout);
-}
-
 /// Whether a qlog directory works at all is a compile-time feature, so the capability
 /// has to agree with what a dial does. Both branches matter: `just check` runs without
 /// `--all-features` and only ever sees the unsupported one, while CI runs with them and
diff --git a/rs/moq-relay/src/uring.rs b/rs/moq-relay/src/uring.rs
index 3cd4c060fe..81ad515b9e 100644
--- a/rs/moq-relay/src/uring.rs
+++ b/rs/moq-relay/src/uring.rs
@@ -132,7 +132,7 @@ impl Workers {
 		// beats starting and quietly behaving differently from what the
 		// operator configured, which is the whole failure mode this mode is
 		// most likely to produce.
-		if listen.lb_id.is_some() {
+		if listen.load_balancer().is_some() {
 			anyhow::bail!(
 				"io_uring workers issue shard-steered connection ids and cannot also carry a \
 				 QUIC-LB server id (listen.lb_id)"
@@ -168,8 +168,9 @@ impl Workers {
 			use std::net::ToSocketAddrs;
 			let bind = listen
 				.bind
-				.as_deref()
+				.as_ref()
 				.context("io_uring workers need an explicit listen.bind")?;
+			let bind = bind.to_string();
 			bind.to_socket_addrs()
 				.with_context(|| format!("failed to resolve {bind}"))?
 				.next()
diff --git a/rs/moq-tokio/src/listen.rs b/rs/moq-tokio/src/listen.rs
index 73ca1a0afb..4075c5055d 100644
--- a/rs/moq-tokio/src/listen.rs
+++ b/rs/moq-tokio/src/listen.rs
@@ -375,7 +375,8 @@ impl Config {
 	}
 
 	#[cfg(feature = "noq")]
-	pub(crate) fn load_balancer(&self) -> Option<crate::quic::LoadBalancer> {
+	/// Return the effective QUIC-LB connection-ID encoding.
+	pub fn load_balancer(&self) -> Option<crate::quic::LoadBalancer> {
 		self.lb_id
 			.clone()
 			.map(|id| crate::quic::LoadBalancer {
@@ -516,6 +517,8 @@ mod tests {
 	#[cfg(feature = "noq")]
 	#[test]
 	fn load_balancer_is_a_single_typed_value() {
+		assert_eq!(Config::default().load_balancer(), None);
+
 		let config: Config = toml::from_str(
 			r#"
 load_balancer = { id = "ab", nonce = 8 }
diff --git a/rs/moq-tokio/src/util.rs b/rs/moq-tokio/src/util.rs
index 909667957c..bf942847fb 100644
--- a/rs/moq-tokio/src/util.rs
+++ b/rs/moq-tokio/src/util.rs
@@ -5,8 +5,7 @@ use std::net::SocketAddr;
 ///
 /// Accepts both literal socket addresses (e.g. `[::]:443`) and DNS hostnames
 /// paired with a port (e.g. `fly-global-services:443`). Only the first
-/// resolved address is returned; Quinn only supports a single IP when
-/// binding.
+/// resolved address is returned because the listener binds one UDP address.
 pub(crate) fn resolve(addr: Option<&str>, default: &str) -> std::io::Result<SocketAddr> {
 	use std::net::ToSocketAddrs;
 	addr.unwrap_or(default)
diff --git a/rs/moq-tokio/tests/worker.rs b/rs/moq-tokio/tests/worker.rs
index e93bdafd6c..f35ce6641d 100644
--- a/rs/moq-tokio/tests/worker.rs
+++ b/rs/moq-tokio/tests/worker.rs
@@ -3,7 +3,7 @@
 //! Linux-only, because the mode is: every worker binds the listen address with
 //! `SO_REUSEPORT`, and no other platform load-balances a unicast UDP port across
 //! the group.
-#![cfg(target_os = "linux")]
+#![cfg(all(target_os = "linux", feature = "noq"))]
 
 use std::net::{SocketAddr, UdpSocket};
 
diff --git a/rs/moq-uring/Cargo.toml b/rs/moq-uring/Cargo.toml
index 5b97c7972a..4836961fb8 100644
--- a/rs/moq-uring/Cargo.toml
+++ b/rs/moq-uring/Cargo.toml
@@ -17,8 +17,8 @@ default = ["noq"]
 # noq-proto, with TLS through rustls.
 noq = ["dep:noq-proto", "dep:rustls", "dep:rustls-platform-verifier"]
 # Capture qlog traces (`quic::Transport::qlog`). Off by default: it compiles the
-# qlog crate and its serde_json encoder into whichever backend is selected, which
-# a production build has no use for.
+# qlog crate and its serde_json encoder into noq, which a production build has
+# no use for.
 qlog = ["noq-proto?/qlog"]
 
 [target.'cfg(target_os = "linux")'.dependencies]
@@ -47,7 +47,7 @@ web-transport-trait = { workspace = true }
 [dev-dependencies]
 anyhow = "1"
 criterion = { workspace = true }
-tokio = { workspace = true, features = ["macros", "net", "rt", "time"] }
+tokio = { workspace = true, features = ["macros", "net", "rt", "sync", "time"] }
 
 [target.'cfg(target_os = "linux")'.dev-dependencies]
 io-uring = { workspace = true }
diff --git a/rs/moq-uring/benches/echo_noq.rs b/rs/moq-uring/benches/echo_noq.rs
index 9797dd191d..aaa28142d7 100644
--- a/rs/moq-uring/benches/echo_noq.rs
+++ b/rs/moq-uring/benches/echo_noq.rs
@@ -55,8 +55,10 @@ mod linux {
 		let endpoint = quic::Endpoint::new(&handle, socket, quic::endpoint::Config::default().with_server(server))
 			.expect("endpoint");
 		let addr = endpoint.local_addr();
-		let (start_tx, start_rx) = std::sync::mpsc::sync_channel::<()>(0);
-		let (done_tx, done_rx) = std::sync::mpsc::sync_channel::<()>(0);
+		// Queue the first iteration while the worker finishes driving the client
+		// handshake. A zero-capacity channel would block this thread before it can
+		// poll the endpoint again, leaving the peer to time out mid-CONNECT.
+		let (start_tx, start_rx) = std::sync::mpsc::channel::<tokio::sync::oneshot::Sender<()>>();
 		let client = std::thread::spawn(move || {
 			let runtime = tokio::runtime::Builder::new_current_thread()
 				.enable_all()
@@ -72,12 +74,12 @@ mod linux {
 				);
 				let session = client.connect(request).await.expect("connect");
 				let payload = vec![0x5a; PAYLOAD];
-				while start_rx.recv().is_ok() {
+				while let Ok(done) = start_rx.recv() {
 					let (mut send, mut recv) = session.open_bi().await.expect("open stream");
 					send.write_all(&payload).await.expect("write");
 					send.finish().expect("finish");
 					assert_eq!(recv.read_to_end(PAYLOAD + 1).await.expect("read").len(), PAYLOAD);
-					done_tx.send(()).expect("done");
+					done.send(()).expect("notify server");
 				}
 			});
 		});
@@ -96,7 +98,8 @@ mod linux {
 
 		let start = Instant::now();
 		for _ in 0..iterations {
-			start_tx.send(()).expect("start");
+			let (done_tx, done_rx) = tokio::sync::oneshot::channel();
+			start_tx.send(done_tx).expect("start");
 			worker
 				.block_on(async {
 					let (mut send, mut recv) = std::future::poll_fn(|cx| session.poll_accept_bi(cx))
@@ -104,9 +107,9 @@ mod linux {
 						.expect("accept stream");
 					let payload = drain(&mut recv).await;
 					write_finish(&mut send, &payload).await;
+					done_rx.await.expect("peer received echo");
 				})
 				.expect("worker");
-			done_rx.recv().expect("done");
 		}
 		let elapsed = start.elapsed();
 
diff --git a/rs/moq-uring/src/quic/mod.rs b/rs/moq-uring/src/quic/mod.rs
index e51f6b108a..85374cb221 100644
--- a/rs/moq-uring/src/quic/mod.rs
+++ b/rs/moq-uring/src/quic/mod.rs
@@ -109,8 +109,8 @@ pub struct Transport {
 	pub keep_alive: Option<std::time::Duration>,
 	/// Where to write qlog traces, or `None` (the default) to write none.
 	///
-	/// Noq takes one sink per configuration and writes one file per endpoint, tagging each
-	/// event with the qlog `group_id` of the connection it belongs to.
+	/// Noq takes one sink per configuration and writes one file per connection,
+	/// named from that connection's Initial destination connection ID.
 	///
 	/// Only compiled with the `qlog` feature, so a build without it cannot ask
 	/// for traces the backends would not produce.
diff --git a/rs/moq-uring/src/quic/noq/mod.rs b/rs/moq-uring/src/quic/noq/mod.rs
index a0ae7507a9..b972cc35e5 100644
--- a/rs/moq-uring/src/quic/noq/mod.rs
+++ b/rs/moq-uring/src/quic/noq/mod.rs
@@ -154,7 +154,7 @@ pub(crate) fn client_config(config: &client::Config) -> Result<noq_proto::Client
 	let mut client = noq_proto::ClientConfig::new(Arc::new(crypto));
 	let transport = transport_config(&config.transport)?;
 	#[cfg(feature = "qlog")]
-	let transport = with_qlog(transport, &config.transport, qlog::Side::Client);
+	let transport = with_qlog(transport, &config.transport);
 	client.transport_config(Arc::new(transport));
 	Ok(client)
 }
@@ -193,7 +193,7 @@ pub(crate) fn server_config(config: &server::Config) -> Result<noq_proto::Server
 	let mut server = noq_proto::ServerConfig::with_crypto(Arc::new(crypto));
 	let transport = transport_config(&config.transport)?;
 	#[cfg(feature = "qlog")]
-	let transport = with_qlog(transport, &config.transport, qlog::Side::Server);
+	let transport = with_qlog(transport, &config.transport);
 	server.transport_config(Arc::new(transport));
 	Ok(server)
 }
@@ -202,18 +202,11 @@ pub(crate) fn server_config(config: &server::Config) -> Result<noq_proto::Server
 ///
 /// Noq asks a factory per connection, so each gets a file of its own.
 #[cfg(feature = "qlog")]
-fn with_qlog(
-	mut transport: noq_proto::TransportConfig,
-	config: &Transport,
-	side: qlog::Side,
-) -> noq_proto::TransportConfig {
+fn with_qlog(mut transport: noq_proto::TransportConfig, config: &Transport) -> noq_proto::TransportConfig {
 	let Some(sink) = config.qlog.clone() else {
 		return transport;
 	};
 
-	// The factory is told each connection's own side, so the config's is
-	// not needed here.
-	let _ = side;
 	transport.qlog_factory(Arc::new(Traces { sink }));
 
 	transport
diff --git a/rs/moq-uring/src/quic/qlog.rs b/rs/moq-uring/src/quic/qlog.rs
index d6b5b3e939..0fe2d8250c 100644
--- a/rs/moq-uring/src/quic/qlog.rs
+++ b/rs/moq-uring/src/quic/qlog.rs
@@ -8,7 +8,7 @@
 //! the worker would stall every connection sharing its core for as long as
 //! the filesystem takes.
 //!
-//! One file per trace, in the qlog JSON-SEQ format the tokio listener already
+//! One file per connection, in the qlog JSON-SEQ format the tokio listener already
 //! writes, so an existing workflow reads both without knowing which runtime
 //! produced them.
 
@@ -119,34 +119,21 @@ impl Sink {
 
 	/// A writer for one connection's trace, named from its connection id.
 	pub(crate) fn trace(&self, cid: &[u8], side: Side) -> Box<dyn io::Write + Send + Sync> {
-		self.open(Some(cid), side)
+		self.open(cid, side)
 	}
 
-	/// A writer for a trace covering a whole endpoint rather than one
-	/// connection, which is all noq-proto's single per-config sink can
-	/// express. Each event carries the qlog `group_id` of the connection it
-	/// belongs to.
-	pub(crate) fn endpoint_trace(&self, side: Side) -> Box<dyn io::Write + Send + Sync> {
-		self.open(None, side)
-	}
-
-	fn open(&self, cid: Option<&[u8]>, side: Side) -> Box<dyn io::Write + Send + Sync> {
+	fn open(&self, cid: &[u8], side: Side) -> Box<dyn io::Write + Send + Sync> {
 		use std::fmt::Write as _;
 
 		let inner = self.inner.clone();
 		let file = inner.next.fetch_add(1, Ordering::Relaxed);
 		// The trace slot stays unique within the sink even when a peer reuses
 		// the same Initial destination connection id.
-		let id = match cid {
-			Some(cid) => {
-				let cid = cid.iter().fold(String::with_capacity(cid.len() * 2), |mut id, byte| {
-					let _ = write!(id, "{byte:02x}");
-					id
-				});
-				format!("connection{file}-{cid}")
-			}
-			None => format!("endpoint{file}"),
-		};
+		let cid = cid.iter().fold(String::with_capacity(cid.len() * 2), |mut id, byte| {
+			let _ = write!(id, "{byte:02x}");
+			id
+		});
+		let id = format!("connection{file}-{cid}");
 		let path = inner.dir.join(format!(
 			"moq-{}-{}-{}-{id}-{}.qlog",
 			inner.started,
@@ -382,8 +369,8 @@ mod tests {
 		let first = Sink::directory(dir.path()).expect("first sink");
 		let second = Sink::directory(dir.path()).expect("second sink");
 
-		let mut first_trace = first.endpoint_trace(Side::Server);
-		let mut second_trace = second.endpoint_trace(Side::Server);
+		let mut first_trace = first.trace(b"first", Side::Server);
+		let mut second_trace = second.trace(b"second", Side::Server);
 		first_trace.write_all(b"first").expect("write first trace");
 		second_trace.write_all(b"second").expect("write second trace");
 		drop(first_trace);
@@ -424,7 +411,7 @@ mod tests {
 	fn an_open_trace_accounts_for_staging_and_close() {
 		let dir = tempfile::tempdir().expect("temp dir");
 		let sink = Sink::directory(dir.path()).expect("sink");
-		let trace = sink.endpoint_trace(Side::Server);
+		let trace = sink.trace(b"accounting", Side::Server);
 
 		let accounted = CHUNK + std::mem::size_of::<Msg>();
 		for _ in 0..10_000 {
@@ -446,7 +433,7 @@ mod tests {
 		let held = MEMORY_MAX - CHUNK + 1;
 		assert!(sink.inner.reserve(held));
 
-		let mut trace = sink.endpoint_trace(Side::Server);
+		let mut trace = sink.trace(b"dropped", Side::Server);
 		trace.write_all(b"dropped").expect("write dropped trace");
 		drop(trace);
 		sink.inner.release(held);
diff --git a/rs/moq-uring/tests/echo.rs b/rs/moq-uring/tests/echo.rs
index 8b1ee1a133..17112c7ad9 100644
--- a/rs/moq-uring/tests/echo.rs
+++ b/rs/moq-uring/tests/echo.rs
@@ -63,6 +63,7 @@ fn echo_noq_peer() {
 	let addr = endpoint.local_addr();
 	let payload: Vec<u8> = (0..PAYLOAD).map(|i| (i * 31 % 251) as u8).collect();
 	let expected = payload.clone();
+	let (done_tx, done_rx) = tokio::sync::oneshot::channel();
 
 	let client = std::thread::spawn(move || {
 		let runtime = tokio::runtime::Builder::new_current_thread()
@@ -81,7 +82,9 @@ fn echo_noq_peer() {
 			let (mut send, mut recv) = session.open_bi().await.expect("open stream");
 			send.write_all(&payload).await.expect("write");
 			send.finish().expect("finish");
-			recv.read_to_end(PAYLOAD + 1).await.expect("read")
+			let echoed = recv.read_to_end(PAYLOAD + 1).await.expect("read");
+			done_tx.send(()).expect("notify server");
+			echoed
 		})
 	});
 
@@ -95,6 +98,7 @@ fn echo_noq_peer() {
 				.expect("accept stream");
 			let payload = drain(&mut recv).await;
 			write_finish(&mut send, &payload).await;
+			done_rx.await.expect("peer received echo");
 		})
 		.expect("worker");