chore: release

[moq-bot]

🤖 New release

• kio: 0.5.9 -> 0.6.0
• moq-net: 0.2.22 -> 0.3.0
• hang: 0.20.13 -> 0.21.0
• moq-flate: 0.1.2 -> 0.1.3
• moq-binary: 0.1.0
• moq-json: 0.3.12 -> 0.4.0
• moq-loc: 0.2.8 -> 0.2.9
• moq-msf: 0.4.2 -> 0.5.0
• moq-mux: 0.9.16 -> 0.10.0
• moq-sock: 0.0.1
• moq-tokio: 0.19.11
• moq-audio: 0.0.25 -> 0.0.26
• moq-nvenc: 0.0.5 -> 0.0.6
• moq-v4l: 0.0.1
• moq-video: 0.0.25 -> 0.0.26
• libmoq: 0.5.16 -> 0.6.0
• moq-archive: 0.0.1
• moq-auth: 0.1.0
• moq-uring: 0.0.1
• moq-boy: 0.4.16 -> 0.5.0
• moq-hls: 0.4.16 -> 0.5.0
• moq-stats: 0.1.11 -> 0.2.0
• moq-relay: 0.14.18 -> 0.15.0
• moq-rtc: 0.2.11 -> 0.3.0
• moq-rtmp: 0.2.11 -> 0.3.0
• moq-srt: 0.2.11 -> 0.3.0
• moq-transcode: 0.0.19 -> 0.0.20
• moq-cli: 0.11.2 -> 0.12.0
• moq-e2ee: 0.0.1
• moq-ffi: 0.3.19 -> 0.4.0
• moq-gst: 0.3.12 -> 0.4.0
• moq-native: 0.19.19 -> 0.20.0
• moq-room: 0.1.2 -> 0.2.0

Changelog

kio

0.6.0 - 2026-09-23

Added

• [breaking] refuse released spellings and drop unused deprecated APIs (#3719)

Other

• pin rust 1.98.1 so macOS 27 loads our stripped dylibs (#3904)
• (net) [breaking] return the next deadline from driver polls (#3828)
• Merge remote-tracking branch 'origin/main' into merge-main-into-dev-20260914

moq-net

0.3.0 - 2026-09-23

Added

• (moq-net) reset an unanswered control request with CONTROL_TIMEOUT (#3913)
• (net) origin failover as a state machine (#3895)
• (moq-net) add moq-transport draft-22 (moqt-22) (#3858)
• (net) [breaking] simplify origin scoping (#3804)
• (net) [breaking] scope origins with any pattern union and report announce matches (#3746)
• (net) negotiate the cluster extension with HOP_ID (#3747)

Fixed

• (net) announce local broadcasts on origin cursors (#3928)
• tighten release APIs and preserve Lite compatibility (#3933)
• (net) retain spliced warm cache (#3814)
• (net) wake the demand aggregate when its widest subscriber changes (#3785)

Other

• allocation-free binary stats (#3918)
• (net) sweep the idle serve poll over a session's routes (#3924)
• (net) routed_broadcast waits on the watch alone (#3901)
• (net) sweep duplicate routes at one prefix (#3922)
• (net) wake a front only when a covering route changes (#3884)
• (net) key the origin route table by prefix (#3882)
• (net) build a route's prefix claim once, not per cursor visit (#3881)
• (mux) [breaking] share media rate policy (#3840)
• (just) consolidate full-suite actions (#3823)
• (net) [breaking] name path roles without new types (#3826)
• (net) [breaking] return the next deadline from driver polls (#3828)
• (net) [breaking] drive time and cache cleanup explicitly (#3825)
• (net) expose route cost fields (#3802)
• (net) format the merged track test (#3791)
• Merge remote-tracking branch 'origin/main' into dev

Added

• group::Producer::used waits until the group has a consumer, matching unused.
• StreamError::ControlTimeout (moq-lite stream code 0x31): a request stream torn down because the peer never answered, distinct from DeliveryTimeout. The moq-transport registry has no value for it, so an IETF peer is sent INTERNAL_ERROR.

Fixed

• An origin front drops the source track when its last reader leaves, instead of holding the upstream copy for TRACK_IDLE_LINGER.

Changed

• [breaking] stats::Registry::report refills a caller-owned &mut Report instead of returning a new one, so an interval drain reuses its buffers.
• [breaking] Dead exports removed: Hops::replace_first, origin::Dynamic::{hop, root}, DRAIN_COST / MAX_COST (use Cost::{DRAIN, MAX}), broadcast::Producer::remove_track, track::Producer::start_sequence, Subscriber::with_groups, Ordered::with_groups, group::Consumer::with_frames, cache::Pool::same_pool, Timestamp::new_const, Error::to_code, Route::with_hop (build Hops and use with_hops), and Cost: From<(u64, u64)> (use Cost { warm, cold }).
• [breaking] track::SubscriberControl is track::Control, track::GroupRequest is group::Request, ConnectionStats is session::Stats with estimated_send_rate / estimated_recv_rate as Option<bandwidth::Rate>, and the paused handshake Request<S, R> is server::Handshake.
• [breaking] create_track, reserve_track, unique_track, finish, create_group, and append_group take &self. track::Consumer::info() is query(). track::Demand gains is_used / poll_used / poll_unused. track::Producer::poll_unused returns Poll<Result<()>>. bandwidth::Producer::closed() returns the cause.
• [breaking] stats::Presence and stats::Traffic name both edges of each cumulative pair *_started / *_ended (sessions_started / sessions_ended, announces_started / announces_ended, broadcasts_*, subscriptions_*). Serialize still writes the previous announced / *_closed names beside the new ones; deserialize accepts either spelling, with the canonical name winning.
• [breaking] origin::Info is origin::Config with public fields and no with_* builders. Producer::info() is config().
• [breaking] origin::Config::default() mints a random hop, Config::id is hop, and origin handles expose hop() instead of dereferencing to Hop. Random hops now use the full 62-bit wire range; current @moq/net clients decode them as bigint, while legacy @moq/lite clients limited to Number.MAX_SAFE_INTEGER can reject larger values and must upgrade.
• [breaking] origin::Producer::scope(root, patterns) and origin::Consumer::scope(root, patterns) replace the separate with_root / scope calls and return Result with Unauthorized for an empty grant.
• [breaking] origin::Pending is origin::Requesting, the consumer-side wait for a request to resolve.
• origin::Producer::publish(path, route) creates and advertises a broadcast together.
• [breaking] track::Producer::write_datagram(Datagram) is now insert_datagram(sequence, timestamp, payload), matching TypeScript insertDatagram. The supplied sequence is preserved; append_datagram remains the next-sequence convenience.
• [breaking] Timescale no longer implements From<NonZero<u64>>. Use Timescale::new or TryFrom so values above the QUIC varint range are refused at construction.
• Register moq-lite stream codes NOT_FOUND 0x33, OLD 0x34, and EVICTED 0x35 so a cache miss round-trips as the named variant instead of an opaque reserved-range placeholder.
• Every received protocol code is Error::Session / Error::Stream, preserving
  its registry and numeric value, including cancellation and internal-error codes.

hang

0.21.0 - 2026-09-23

Added

• (net) [breaking] simplify origin scoping (#3804)
• (hang) [breaking] unify catalog APIs (#3813)
• (net) [breaking] slim the moq-net public surface (#3779)
• (net) [breaking] announce prefixes on every wire; consumers read paths (#3770)
• (hang) [breaking] one continuous broadcast clock at the catalog root (#3675)

Fixed

• (hang) refuse a malformed text catalog section in JS too

Other

• (net) [breaking] name path roles without new types (#3826)
• (quic) [breaking] keep only the noq backend (#3811)
• Merge origin/main into dev
• Merge remote-tracking branch 'origin/main' into merge-main-into-dev-20260914

Changed

• [breaking] Replace the catalog root timeline entry with archive. The
  flattened timeline fields (track, timescale, durationMax) stay;
  optional replay, store, and version advertise a durable recording.
• [breaking] Replace the archive timeline wall field with a root clock
  section ({wall, timescale}). Wall time is one fixed broadcast mapping: PTS zero in the
  clock timescale since the moq epoch, with every track and the archive index converting
  into it. Zero timescales, explicit null timescales, and wall values past the JSON-safe integer
  range are refused.

Added

• Human-readable labels for audio and video renditions.
• Shared catalog::stalled::Detector for publishers to set the per-rendition stalled catalog flag.

moq-flate

0.1.3 - 2026-09-23

Other

• (json) bound snapshot update allocations (#3929)

moq-binary

0.1.0 - 2026-09-23

Added

• (net) [breaking] slim the moq-net public surface (#3779)
• (json) [breaking] Config means the same thing in json and binary (#3718)
• (moq-net) [breaking] abort an oversized group instead of shedding its head (#3585)
• (hang) add json and binary data tracks to the catalog (#3109)

Fixed

• (moq-json) a lost snapshot group is not fatal (#3907)
• (net) commit an unused-driven track teardown atomically (#3455)
• (stream) detect a rolled log without waiting for the group to end (#3282)

moq-json

0.4.0 - 2026-09-23

Added

• (json) edit a snapshot value through a closure (#3889)
• (net) [breaking] slim the moq-net public surface (#3779)
• [breaking] borrow publisher finish so abort can still run (#3714)
• (json) [breaking] Config means the same thing in json and binary (#3718)

Fixed

• (moq-json) a lost snapshot group is not fatal (#3907)
• (moq-json) a snapshot edit fails on a shape mismatch instead of seeding a default (#3874)

Other

• (json) bound snapshot update allocations (#3929)
• (json) skip the snapshot baseline parse when deltas are disabled (#3916)
• Merge origin/main into dev
• Merge remote-tracking branch 'origin/main' into merge-main-into-dev-20260914

Changed

• [breaking] Codec options are Config in snapshot and stream. Track-owning options are
  producer::Config / consumer::Config. compression is a Compression enum (None / Deflate)
  instead of a bool, and with_compression is gone.

• [breaking] window::Producer::finish borrows (&mut self) instead of consuming, matching
  snapshot and stream, so the handle stays usable after a clean end.

• [breaking] snapshot::Producer::lock is now modify and returns a Result, refusing a closed
  track. A guard that fails to publish on drop aborts the track with the error instead of logging a
  warning, so consumers and the next modify both see it. Guard::commit is unchanged and leaves
  the track open on failure. A panic while a guard is held discards the in-flight edit.

Added

• snapshot::Producer::abort closes the track with an error, like moq_net::track::Producer::abort.

moq-loc

0.2.9 - 2026-09-23

Other

• updated the following local packages: moq-net

moq-msf

0.5.0 - 2026-09-23

Added

• (json) [breaking] Config means the same thing in json and binary (#3718)
• (ffi) [breaking] drop MoqCancel; Go cancels through context.Context (#3723)
• (drafts) specify the MPEG-TS catalog extension and carry it over MSF (#3720)

Fixed

• (msf) compile the extension collision check in release builds

moq-mux

0.10.0 - 2026-09-23

Added

• (json) edit a snapshot value through a closure (#3889)
• (moq-mux) record the TS mux rate and pad export to it (#3831)
• (net) [breaking] simplify origin scoping (#3804)
• (hang) [breaking] unify catalog APIs (#3813)
• (net) [breaking] slim the moq-net public surface (#3779)
• (net) [breaking] announce prefixes on every wire; consumers read paths (#3770)
• [breaking] borrow publisher finish so abort can still run (#3714)
• (net) [breaking] one name per announce, request, and origin config concept (#3725)
• (json) [breaking] Config means the same thing in json and binary (#3718)
• (hang) [breaking] one continuous broadcast clock at the catalog root (#3675)
• [breaking] refuse released spellings and drop unused deprecated APIs (#3719)
• (drafts) specify the MPEG-TS catalog extension and carry it over MSF (#3720)
• (hang) [breaking] timelines only move forward (#3711)

Fixed

• (moq-json) a lost snapshot group is not fatal (#3907)
• (moq-mux) keep a group's last frame duration at its own scale (#3906)
• (mux) read the inline SI form every published moq-cli writes (#3871)
• (ci) repair nightly and meta-review failures (#3799)

Other

• (rs) read constant-size chunks with as_chunks (#3899)
• (quest) complete the media release review (#3878)
• Unify mux track and rendition ownership (#3857)
• (mux) [breaking] share media rate policy (#3840)
• (net) [breaking] name path roles without new types (#3826)
• (net) [breaking] return the next deadline from driver polls (#3828)
• (net) [breaking] drive time and cache cleanup explicitly (#3825)
• (mux) stop copies_share_one_epoch racing the clock (#3752)
• Merge origin/main into dev
• Merge origin/main into dev

Changed

• [breaking] One handle publishes a rendition. catalog::Producer::{video,audio,text,track} and
  their Reserved counterparts take the media track, container, and an optional config and return
  a container::Producer<C, R> that owns the catalog entry: set publishes or replaces the config,
  modify edits it through a guard (Error::NotPublished before the first set), cut/finish
  publish the measured estimate, and dropping the producer retires the entry. catalog::Rendition,
  VideoTrack, AudioTrack, Reserved::producer, Producer::media_producer, and Producer::enroll
  are private; import::Track and import::TrackStream drop their catalog-extension parameter.
  RenditionConfig requires Clone + Send and opts into estimate detection with detects().

• [breaking] catalog::Producer::lock is now modify and returns a Result, refusing a
  finished catalog. A guard that fails to publish on drop aborts the catalog tracks with the error
  instead of logging a warning, so consumers and the next modify both see it. Guard::commit is
  unchanged and leaves the tracks open on failure.

• [breaking] Advertise the broadcast timeline through catalog.archive
  (hang::catalog::Archive). timeline::Producer::section returns Archive.

• [breaking] Replace timeline::Config::wall with the broadcast Clock's fixed wall
  mapping, advertised at the catalog root as clock: { wall, timescale } independently of
  any archive. catalog::Config::with_clock names the content's real start for an import;
  catalog::Producer::clock shares the epoch. Zero timescales, walls before the moq epoch,
  and walls past the JSON-safe integer range are refused.

• import::ContainerStream::new takes a bare ContainerFormat instead of a ContainerInit. It
  only ever read the format, so the init's leading bytes were accepted and dropped. A stream
  recovers its own framing, so push everything through decode instead.

• Import formats are typed: import::{AudioFormat, VideoFormat, ContainerFormat} replace the format
  string on each Init, so a format of the wrong kind no longer compiles. FromStr accepts every
  alias and is where a caller crossing a string boundary finds out, reporting Error::WrongKind
  with the kind that does take it. Display gives the canonical name, so aliases like h264 and
  avc3 no longer produce differently named tracks.

• Error::NotSelfDescribing replaces the unknown-format error TrackStream::video raised for a
  video codec a raw byte stream cannot be split into.

• import::Track::new splits into Track::audio and Track::video, import::TrackStream::new
  becomes TrackStream::video, and import::Init splits into AudioInit, VideoInit, and
  ContainerInit. Each entry point takes only the fields its kind can honor, so a video hint on an
  audio import or a label on a container is no longer expressible.

• Error::UnsupportedField becomes Error::WrongKind, which names the kind that does handle the
  format rather than reporting it as unknown. import::Kind::of exposes the same classification.

Added

• rate::{Policy, Control}, the media bitrate policy audio, video, and transcode senders share
  (moved from moq_video::encode::rate). An inverted policy starts at its ceiling.
• Propagate rendition labels through single-track media imports.
• Clock::with_wall / Clock::new_at for imports and synthetic sources, Clock::source
  translating a source's own zero onto the broadcast mapping (first frame anchors live, a
  reset re-anchors forward preserving the idle gap, in-group B-frame reordering survives),
  and Error::UnmappableTimestamp refusing a mapping that would move backwards past the
  broadcast's start or out of range.
• From<hang::catalog::VideoConfig> for catalog::VideoHint, a total conversion for a caller that
  already has a whole rendition. Replaces the per-field copy in moq-video, which dropped the label.

Changed

• import::Container::new and import::ContainerStream::new take an import::Init instead of a
  format and buffer, and reject the single-rendition label and video fields rather than
  dropping them.
• An audio format rejects an import::Init video hint instead of dropping it.
• catalog::VideoHint::label is no longer public. import::Init::label is the single source of a
  rendition label, matching the hang draft, which classifies it as a common rendition field.

moq-sock

0.0.1 - 2026-09-23

Added

• (sock) extract the shared listener plumbing and steer the uring endpoint (#3078)

Other

• (moq-sock) [breaking] complete groups before serving (#3832)
• (quic) [breaking] keep only the noq backend (#3811)
• (moq-sock) [breaking] centralize reuseport group formation (#3414)

moq-tokio

0.19.11 - 2026-09-23

Added

• (net) [breaking] promote moq-lite-06 ALPN on main (#3941)
• (relay) expose reusable embedding lifecycle and test fixture (#3927)
• (quic) [breaking] build on moq-noq, the MoQ fork of noq (#3866)
• (moq-net) add moq-transport draft-22 (moqt-22) (#3858)
• (net) [breaking] simplify origin scoping (#3804)
• (net) [breaking] scope origins with any pattern union and report announce matches (#3746)
• (net) [breaking] slim the moq-net public surface (#3779)
• (net) [breaking] announce prefixes on every wire; consumers read paths (#3770)
• (tokio) [breaking] settle moq-tokio names under their modules (#3745)
• (net) [breaking] scope origins with pattern unions (#3672)
• (net) [breaking] one name per announce, request, and origin config concept (#3725)
• [breaking] refuse released spellings and drop unused deprecated APIs (#3719)
• (tokio) [breaking] own the worker split group (#3673)
• (net) [breaking] name stats counter edges started and ended (#3712)
• (tokio) [breaking] rename ConnectionStatsReader to connection::Monitor (#3705)
• (relay) admit every session through a moq-auth lease (#3688)
• (net) [breaking] advertise wildcard routes with Pattern events (#3649)
• (ffi) [breaking] preserve session and stream protocol error details (#3615)
• (tokio) [breaking] partition LAN discovery by application (#3621)
• (moq-ffi) expose the reconnect epoch and QUIC stream cap (#3627)
• (relay) merge config with recorded provenance (#3587)
• (tokio) support pinned connection targets (#3595)
• (moq-tokio) expose the QUIC flow-control windows (#3446)
• (relay) [breaking] add --auth-api-mode proxy, where the endpoint decides (#3044)
• (moq-tokio) give the quiche backend the shared certificate semantics (#3418)
• (net) [breaking] fold serving into origin::Producer::dynamic and let broadcasts announce themselves (#3400)
• default QUIC backends to noq (#3342)
• (tokio) [breaking] run local futures on pinned workers (#3303)
• (net) [breaking] resume subscriptions across routes sharing a first hop (#3312)
• (net) [breaking] announcements are prefix routes (#3225)
• (cli) complete broadcast, track, and capture-source names at the prompt (#3156)
• (net) [breaking] resolve the subscribe start from max age, with Group Start as an absolute floor (#3158)
• (sock) extract the shared listener plumbing and steer the uring endpoint (#3078)
• (cli) [breaking] migrate command-line parsing to usage-rs (#3030)
• (net) [breaking] run moq-lite machines unboxed over any transport (#3031)
• (net) [breaking] inject an explicit Runtime for session timers and machines (#3007)
• (moq-tokio) identify peers by certificate fingerprint (#2944)
• (relay) serve QUIC from pinned per-core workers, steered by connection ID (M1) (#2921)
• (rs) [breaking] rename moq-native to moq-tokio (#2896)

Fixed

• tighten release APIs and preserve Lite compatibility (#3933)
• (tokio) start jemalloc sampling on demand instead of at startup (#3919)
• (tokio) fail a connect on auth only once every transport has (#3741)
• adapt main's NVENC VBV test and tokio Url imports to the dev API
• (moq-tokio) hold feature-extreme builds to -D warnings (#3584)
• (tokio) compile every subset of the transport features (#3439)
• (moq-tokio) default the GOAWAY redirect policy to same-host (#3448)
• repair draft-20 merge regressions (#3301)
• (tokio) require explicit QUIC crypto providers (#3210)
• (moq-tokio) check isolated feature builds (#3150)
• (relay) give the io_uring listener its certificate and mTLS (#3116)
• (moq-tokio) enforce peer identity configuration (#3040)
• (tokio) [breaking] leave process signals to the owner of the accept loop (#2952)
• (cli) [breaking] refuse the renamed flags with a migration instead of ignoring them (#2915)

Other

• release (#3730)
• (moq-sock) [breaking] complete groups before serving (#3832)
• (net) [breaking] name path roles without new types (#3826)
• (net) [breaking] return the next deadline from driver polls (#3828)
• (net) [breaking] drive time and cache cleanup explicitly (#3825)
• (quic) [breaking] keep only the noq backend (#3811)
• (tokio) make API shapes type-safe (#3816)
• Merge remote-tracking branch 'origin/main' into merge-main-into-dev-20260914
• (tokio) skip cert reload when the host cannot start an inotify watcher
• (tokio) skip the bare-filename watch probe when inotify is exhausted
• (tokio) watch certs from a unique tempdir, skip if inotify is exhausted
• merge main into dev
• merge main into dev
• merge main into dev
• (tokio) one abort-on-drop guard per crate instead of five (#3472)
• (moq-sock) [breaking] centralize reuseport group formation (#3414)
• Merge remote-tracking branch 'origin/dev' into dev
• Merge remote-tracking branch 'origin/main' into dev
• Merge main into dev
• Merge main into dev
• Merge main into dev
• (net) [breaking] name the hop identifier Hop, and fix three API shapes the review found (#3252)
• (rs) [breaking] keep dependency errors out of public APIs (#3243)
• merge main into dev
• Merge updated dev
• Merge remote-tracking branch 'origin/dev' into claude/merge-main-into-dev-3057
• Merge remote-tracking branch 'origin/main' into dev
• Merge remote-tracking branch 'origin/dev' into dev
• Merge branch 'main' into dev
• (net) [breaking] replace the Latency type with a plain max_age duration (#2955)
• Merge remote-tracking branch 'origin/main' into claude/merge-main-into-dev-b9f056
• merge main into dev
• (net) [breaking] make the origin lifecycle caller-driven (#2897)

moq-audio

0.0.26 - 2026-09-23

Added

• (hang) [breaking] unify catalog APIs (#3813)
• (net) [breaking] slim the moq-net public surface (#3779)
• [breaking] borrow publisher finish so abort can still run (#3714)
• (hang) [breaking] timelines only move forward (#3711)

Fixed

• (audio) [breaking] enforce exclusive AEC ownership (#3844)
• (moq-audio,moq-video) build capture and Android again, and gate both on PRs (#3850)
• (ci) repair nightly and meta-review failures (#3799)
• (net) drop origin source track when last reader leaves

Other

• (rs) read constant-size chunks with as_chunks (#3899)
• (quest) complete the media release review (#3878)
• Report dropped playback sample frames (#3845)
• (audio) [breaking] separate configuration contracts (#3843)
• (audio) [breaking] expose demand without track authority (#3842)
• Unify mux track and rendition ownership (#3857)
• Make media backends optional (#3839)
• (audio) [breaking] remove ineffective FEC flag (#3841)
• Merge origin/main into dev
• Merge remote-tracking branch 'origin/main' into merge-main-into-dev-20260914

Changed

• PipeWire and PulseAudio host flags no longer activate device I/O without
  capture or playback.
• [breaking] separate source PCM, codec settings, decoded output, and subscription policy;
  replace ambiguous channel counts with Layout and add explicit decoder backend selection.
• [breaking] encode::Producer::finish borrows (&mut self) instead of consuming, so a later
  abort(self) can still run after a clean end. Writes after finish fail with Closed.
• [breaking] encode::Producer::track is replaced by the watch-only demand(),
  publish_capture takes PublicationOptions, Resampler is no longer exported, and
  Frame and encode::Encoded are non-exhaustive with new constructors.
• [breaking] The fec flag is removed from encode::Settings and Options; it never
  produced redundancy.
• [breaking] aec::Canceller is aec::Control, playback::Engine::canceller returns
  Result, and capture::Config::aec takes a Control. An engine owns one AEC reference and a
  control attaches to one live microphone; conflicts fail with Error::Busy.
• [breaking] playback::Sink::write returns playback::Write, reporting accepted and
  dropped input sample frames instead of silently discarding overflow.

moq-nvenc

0.0.6 - 2026-09-23

Added

• [breaking] refuse released spellings and drop unused deprecated APIs (#3719)

Fixed

• (nvenc) [breaking] make driver loading fallible (#3838)
• (moq-nvenc) roll back failed resource mapping (#3834)
• (nvenc) [breaking] retain resources through completion (#3835)

Other

• (quest) complete the media release review (#3878)

Changed

• [breaking] Encoder::load validates the driver table and returns a non-exhaustive
  LoadError, as does Encoder::initialize_with_cuda; the public ENCODE_API and EncodeAPI
  are removed and loading never panics.
• [breaking] Buffers and registrations own the encoder lifetime, Session::encode_picture
  consumes its buffers and returns a Submission that holds them through completion, and raw
  registration and configuration entry points are unsafe. EncoderOutput and the raw picture
  parameters are removed.
• Failed resource mapping unregisters the registration before releasing its owner;
  EncodeError::cleanup exposes a rollback failure beside the primary error.

moq-v4l

0.0.1 - 2026-09-23

Added

• (video) fork v4l in-tree with checked-in V4L2 bindings (#3867)

moq-video

0.0.26 - 2026-09-23

Added

• (video) fork v4l in-tree with checked-in V4L2 bindings (#3867)
• (video) GPU color conversion and NVENC for imported Vulkan frames (#3869)
• (video) [breaking] type the group configuration and make cut fallible (#3876)
• preserve video capture timing (#3849)
• (video) import retained Vulkan images into CUDA (#3836)
• (net) [breaking] simplify origin scoping (#3804)
• (hang) [breaking] unify catalog APIs (#3813)
• (net) [breaking] slim the moq-net public surface (#3779)
• (net) [breaking] announce prefixes on every wire; consumers read paths (#3770)
• [breaking] borrow publisher finish so abort can still run (#3714)
• (hang) [breaking] timelines only move forward (#3711)

Fixed

• (video) compile the macOS capture backends after the Frame reshape (#3877)
• (nvenc) [breaking] make driver loading fallible (#3838)
• (video) convert CUDA device UUID bytes portably (#3861)
• (nvenc) [breaking] retain resources through completion (#3835)
• (video) [breaking] confine synchronous codecs to their thread (#3837)
• (moq-audio,moq-video) build capture and Android again, and gate both on PRs (#3850)
• (net) drop origin source track when last reader leaves

Other

• (rs) read constant-size chunks with as_chunks (#3899)
• (deps) bump the cargo group with 3 updates (#3905)
• (video) validate the GPU conversion and NVENC path on NVIDIA hardware (#3890)
• (quest) complete the media release review (#3878)
• (video) [breaking] separate decoder output from subscription policy (#3875)
• Unify mux track and rendition ownership (#3857)
• Make media backends optional (#3839)
• (video) [breaking] type frame conversions (#3846)
• (mux) [breaking] share media rate policy (#3840)
• (net) [breaking] return the next deadline from driver polls (#3828)
• (net) [breaking] drive time and cache cleanup explicitly (#3825)
• Merge origin/main into dev
• Merge remote-tracking branch 'origin/main' into merge-main-into-dev-20260914

Added

• Import retained Vulkan RGBA8 slots into CUDA with explicit timeline synchronization.
• frame::cuda::Converter converts imported Vulkan RGBA8/BGRA8 frames to NV12 on the GPU from a
  bounded buffer pool, and cuda::Frame::resize scales them there; vulkan::Image::bgra8 declares
  the other channel order.

Changed

• [breaking] OpenH264 is now the default openh264 feature, rendering is
  opt-in, and the deprecated nvenc and nvdec feature aliases are removed.
• [breaking] encode::Producer::finish borrows (&mut self) instead of consuming, so a later
  abort(self) can still run after a clean end.
• [breaking] Frame resize and RGB/BGRA conversion each have one configured
  operation: resize(size, config), to_rgba(config), and to_bgra(config).
• [breaking] Surface::into_i420 returns typed I420, preserving its size,
  color, and allocation. Use I420::into_data to extract packed bytes.
• [breaking] I420::new and I420::len take Size; Frame and
  encode::Encoded are non-exhaustive and remain constructible through new.
• [breaking] decode::Config describes only the decoder: kind, a
  native-or-CPU output, and a best-effort scale_hint. decode::Consumer
  takes decode::Options, which carries the subscription's start and
  max_age beside the decoder config. gpu_frames and
  resize::Acceleration are replaced by moq_video::Output, which
  resize::Config::output shares.
• [breaking] encode::Config::gop is the non-exhaustive encode::Gop
  enum (Gop::Keyframe { interval }, Gop::keyframe_every(duration, rate))
  instead of a bare u32; an interval of 0 is refused with Error::InvalidGop.
• [breaking] Encoder::keyframe and Sink::keyframe are cut() and
  return Result; a backend that cannot force a group boundary refuses at
  open with Error::CutUnsupported.
• [breaking] Frame rates are the reduced rational moq_video::Rate
  (encode::Config::new(width, height, rate), capture::Config::framerate),
  and capture reads return timestamped Frames stamped before queue
  replacement rather than bare Surfaces.
• [breaking] encode::rate::{Policy, Control} moved to moq_mux::rate.
• [breaking] The synchronous encode::Encoder and decode::Decoder are
  !Send and !Sync; the async Sink and Consumer stay Send and own
  codec execution.
• [breaking] RateError is non-exhaustive.

libmoq

0.6.0 - 2026-09-23

Added

• (video) [breaking] type the group configuration and make cut fallible (#3876)
• preserve video capture timing (#3849)
• (ffi) [breaking] scope announcement streams with patterns (#3856)
• (moq-net) add moq-transport draft-22 (moqt-22) (#3858)
• (net) [breaking] simplify origin scoping (#3804)
• (libmoq) [breaking] finalize release API (#3819)
• (hang) [breaking] unify catalog APIs (#3813)
• (net) [breaking] slim the moq-net public surface (#3779)
• (net) [breaking] announce prefixes on every wire; consumers read paths (#3770)
• (libmoq) track demand and dynamic track requests (#3748)
• (tokio) [breaking] settle moq-tokio names under their modules (#3745)
• (net) [breaking] fold the session placeholders into PROTOCOL_VIOLATION (#3755)
• [breaking] name every rate estimate estimated_*_rate
• (net) [breaking] rank anonymous hop chains last (#3724)
• [breaking] borrow publisher finish so abort can still run (#3714)
• (net) [breaking] one name per announce, request, and origin config concept (#3725)
• (json) [breaking] Config means the same thing in json and binary (#3718)
• (ffi) [breaking] use microseconds and matching origin verbs
• (tokio) [breaking] rename ConnectionStatsReader to connection::Monitor (#3705)
• (ffi) [breaking] carry the route cold cost through MoqRoute (#3669)
• (libmoq) [breaking] select decoded pixel format and size from C (#3674)
• (net) [breaking] make reader group and frame limits explicit (#3647)
• (net) [breaking] advertise wildcard routes with Pattern events (#3649)
• (e2ee) add the moq-e2ee-01 profile and shared vectors (#3629)
• (ffi) [breaking] preserve session and stream protocol error details (#3615)
• (ffi) [breaking] align create_broadcast, announce, and dynamic across bindings (#3577)
• (moq-net) [breaking] abort an oversized group instead of shedding its head (#3585)
• (ffi) [breaking] follow the connection's bandwidth share (#3622)
• (hang) [breaking] empty frames close the previous frame's duration (#3575)

Fixed

• (net) announce local broadcasts on origin cursors (#3928)
• (libmoq) build on the noq backend like the rest of dev (#3758)
• (json) [breaking] fallible modify(), abort the track when a dropped edit fails (#3644)
• (moq-mux) [breaking] make an fMP4 export fragment a group, on every track (#3573)
• (moq-mux) catalog jitter is the publisher's maximum flush span (#3513)

Other

• (net) routed_broadcast waits on the watch alone (#3901)
• (video) [breaking] separate decoder output from subscription policy (#3875)
• (audio) [breaking] separate configuration contracts (#3843)
• (audio) [breaking] expose demand without track authority (#3842)
• Unify mux track and rendition ownership (#3857)
• Make media backends optional (#3839)
• (video) [breaking] type frame conversions (#3846)
• (mux) [breaking] share media rate policy (#3840)
• (net) [breaking] name path roles without new types (#3826)
• (quic) [breaking] keep only the noq backend (#3811)
• (net) expose route cost fields (#3802)
• (tokio) make API shapes type-safe (#3816)
• Merge origin/main into dev
• Merge remote-tracking branch 'origin/dev' into merge-main-into-dev-20260914
• (libmoq) run the C decoder fixture outside cargo test (#3691)
• merge main into dev
• merge main into dev

Added

• moq_origin_create_broadcast, moq_publish_announce / _unannounce, and
  moq_origin_dynamic split creation from exact-path and prefix advertisements.
• moq_session_bandwidth, moq_bandwidth_reserve, moq_reservation_grant / _update /
  _close expose the connection's send estimate to app-owned encoders.
• moq_session_snapshot samples connection statistics and the negotiated protocol together;
  moq_connection_stats includes estimated_send_rate and estimated_receive_rate.
• moq_video_decoder_output selects the decoded pixel format and dimensions.
• moq_route carries the advertised warm and cold path costs.
• moq_audio_encoder_output.frame_duration_us configures the Opus packet duration.
• Publish and consume human-readable audio and video rendition labels.
• The generated header defines every MOQ_ERROR_* return code, every enum used by a struct,
  and one moq_status_callback type for asynchronous registrars.
• Demand watchers: moq_publish_track_demand, moq_publish_media_demand,
  moq_encode_video_demand, and moq_encode_audio_demand report MOQ_DEMAND_USED /
  MOQ_DEMAND_UNUSED (a moq_demand) immediately and on every change, closed by
  moq_publish_demand_cancel.
• Track requests: moq_publish_dynamic serves subscriptions to undeclared tracks as
  moq_track_request_* handles (name, accept, video, audio, abort, free).
  Group requests: moq_publish_track_dynamic and moq_track_request_dynamic serve fetches
  of uncached groups as moq_group_request_* handles (sequence, priority, frame_start,
  accept, abort, free). accept positions the producer at frame_start. Both
  handlers stop with moq_publish_dynamic_cancel.
• moq_error_protocol fills a moq_protocol_error (scope, verbatim wire code, kind) for
  the last protocol failure on this thread. Do not parse moq_error() for that. Local
  Unauthorized still returns status -34; a session-scoped unauthorized protocol close is
  Error::Moq (-2) with this record.

Changed

• Bare-integer durations are microseconds: max_age_us on decoder outputs,
  track info, subscriptions, and moq_consume_video / moq_consume_audio;
  every duration in moq_client_config is _us.
• The 41 moq_client_* setters are replaced by one zero-initializable moq_client_config.
• Asynchronous task shutdown is consistently _cancel; moq_origin_consume_announced is
  moq_origin_announced_broadcast. Registrars reject a NULL callback before retaining
  user_data.
• moq_publish_media splits into moq_publish_audio, moq_publish_video, and
  moq_publish_container, taking moq_audio_init, moq_video_init, and moq_container_init.
  Each carries only the fields its kind can honor, so a label on a container no longer compiles.
• moq_announced is moq_announce_update with prefix / prefix_len instead
  of path / path_len. The prefix is relative to the requested announcements
  scope. moq_broadcast_request_abort is moq_broadcast_request_reject; _free
  is unchanged.
• Formats are enums (moq_audio_format, moq_video_format, moq_container_format) rather than
  strings. As with moq_audio_sample_format, the struct field is a u32 and an out-of-range code
  is rejected, since matching an invalid discriminant as a Rust enum would be undefined behavior.
• A container has its own handle space and moq_publish_container_write / _cut / _seek /
  _finish. write takes no timestamp: a container carries its tracks' timing itself, and
  moq_publish_media_frame used to accept one and drop it. A handle from one family is rejected by
  the other's calls.
• The raw encoder entry points are moq_encode_audio* and moq_encode_video*, matching their
  existing moq_video_encoder_frame naming and freeing moq_publish_audio / moq_publish_video
  for the encoded path.
• moq_audio_format (the PCM sample layout) is now moq_audio_sample_format, matching
  moq_video_pixel_format.

moq-archive

0.0.1 - 2026-09-23

Added

• (archive) store versioned recording objects (#3613)

Other

• (archive) [breaking] scope listing queries to recordings (#3833)
• (archive) [breaking] use inclusive group ranges (#3829)

moq-auth

0.1.0 - 2026-09-23

Added

• (relay) push a re-check to live sessions (#3778)
• (auth) [breaking] one type per contract concept (#3776)
• (auth) [breaking] the lease reports what it ended with, and the relay Lease owns the recheck (#3739)
• (relay) let the embedder admit sessions in process (#3735)
• [breaking] refuse released spellings and drop unused deprecated APIs (#3719)
• (relay) admit every session through a moq-auth lease (#3688)
• (auth) moq auth serve is the reference auth server (#3686)
• (auth) moq-auth and @moq/auth own the contract and the token (#3684)

Fixed

• (auth) end a session when a re-check no longer grants (#3774)

Added

• Request, Grant, and Event: the JSON contract between a relay and an auth server.
• lease::{Producer, Consumer}: the handle a session holds for the grant that admitted it.
• Client: the HTTP implementation, driving a lease against --auth-url.
• lease::Consumer::revalidate asks the producer to re-check now; Producer::{poll_revalidate, revalidate_requested} resolve once per burst. A fixed lease is a no-op. The HTTP client POSTs at once when idle or in backoff, and once more when a nudge arrives during an in-flight re-check.
• lease::Reason::Invalid: a re-check whose grant fails validation (end.reason is invalid).

Fixed

• A re-check that answers 401 or a 2xx that fails Grant::validate ends the session instead of retrying until expires.
• Grant::validate and the lease expiry deadline tolerate a few seconds of clock skew.

Breaking

• Counters is gone. Client::connect takes only the request; lease::Consumer::close(reason, bytes) reports the totals, and Drop reports zero. Producer::closed returns (Reason, Bytes).
• Request::new(node, transport, path) mints the session id; the four-argument form and Request::connect are gone.
• An oct JWK without kty is refused rather than defaulted.
• serve::Rules is gone; Policy.public and Policy.mtls are Permissions.
• serve::Policy::decide authorizes a token at the dialed path with Claims::authorize and grants the residuals, instead of refusing when root != path.

Changed

• Renamed from moq-token. Claims and Scope carry moq-pattern unions under publish and subscribe; the prefix-shaped put and get fields are refused.
• Claims::authorize returns pattern residuals instead of prefixes.

moq-uring

0.0.1 - 2026-09-23

Added

• (quic) [breaking] build on moq-noq, the MoQ fork of noq (#3866)
• (uring) carry ECN on the io_uring UDP path (#3821)
• (net) [breaking] simplify origin scoping (#3804)
• (net) [breaking] slim the moq-net public surface (#3779)
• (net) [breaking] one name per announce, request, and origin config concept (#3725)
• (net) [breaking] fold serving into origin::Producer::dynamic and let broadcasts announce themselves (#3400)
• (uring) write qlog traces from the io_uring workers (#3420)
• (uring) report per-worker io_uring counters at /metrics (#3408)
• default QUIC backends to noq (#3342)
• (net) [breaking] announcements are prefix routes (#3225)
• (uring) serve QUIC from quinn-proto as well as quiche (#3131)
• (relay) serve QUIC from io_uring workers (#3082)
• (uring) speak WebTransport for browser peers (#3081)
• (sock) extract the shared listener plumbing and steer the uring endpoint (#3078)
• (uring) serve many QUIC connections per socket with an Endpoint (#3073)
• (uring) run moq-lite sessions over quiche on the worker (#3033)
• (uring) add the thread-per-core worker skeleton (#3014)
• (uring) add the M3 UDP batching spike (#3003)

Fixed

• (uring) name the backend crate directly in the connection tests (#3502)
• (uring) bound teardown submit retries
• (uring) finish mandatory teardown submits
• (uring) submit residual teardown work
• (uring) bound teardown completion dispatch
• (uring) bound worker teardown
• (uring) cancel staged receives on worker drop
• (uring) close abandoned handshakes and stop conflating H3 codes (#3110)
• (relay) give the io_uring listener its certificate and mTLS (#3116)

Other

• (rs) read constant-size chunks with as_chunks (#3899)
• (uring) [breaking] derive worker and steering identity from the socket (#3865)
• (moq-sock) [breaking] complete groups before serving (#3832)
• (net) [breaking] name path roles without new types (#3826)
• (net) [breaking] return the next deadline from driver polls (#3828)
• (net) [breaking] drive time and cache cleanup explicitly (#3825)
• (quic) [breaking] keep only the noq backend (#3811)
• (moq-sock) [breaking] centralize reuseport group formation (#3414)
• (uring) send owned stream buffers without copying (#3293)
• (uring) reuse egress driver allocations (#3292)
• (net) [breaking] name the hop identifier Hop, and fix three API shapes the review found (#3252)
• (uring) bound staged send guarantee
• (uring) clarify bounded worker teardown
• (uring) pin down what a send staged on the way out is owed (#3153)
• (uring) grow the UDP pools when a socket starves (#3133)
• (uring) use fast hashes for the quinn backend's trusted maps (#3155)
• (uring) use fast hashes for trusted packet maps (#3135)
• (uring) skip event sweeps between GSO trains (#3134)
• Compile the udp_tokio bench stub off Linux (#3010)

moq-boy

0.5.0 - 2026-09-23

Added

• (video) [breaking] type the group configuration and make cut fallible (#3876)
• preserve video capture timing (#3849)
• (net) [breaking] simplify origin scoping (#3804)
• (hang) [breaking] unify catalog APIs (#3813)
• (net) [breaking] announce prefixes on every wire; consumers read paths (#3770)
• (json) [breaking] Config means the same thing in json and binary (#3718)
• (hang) [breaking] timelines only move forward (#3711)

Other

• (rs) read constant-size chunks with as_chunks (#3899)
• (audio) [breaking] separate configuration contracts (#3843)
• (audio) [breaking] expose demand without track authority (#3842)
• Make media backends optional (#3839)
• (net) [breaking] name path roles without new types (#3826)
• (quic) [breaking] keep only the noq backend (#3811)
• Merge origin/main into dev
• Merge remote-tracking branch 'origin/main' into merge-main-into-dev-20260914

moq-hls

0.5.0 - 2026-09-23

Added

• (gateway) [breaking] align embedding APIs (#3818)
• (net) [breaking] simplify origin scoping (#3804)
• (hang) [breaking] unify catalog APIs (#3813)
• (net) [breaking] slim the moq-net public surface (#3779)
• (net) [breaking] announce prefixes on every wire; consumers read paths (#3770)
• (net) [breaking] one name per announce, request, and origin config concept (#3725)
• (hang) [breaking] one continuous broadcast clock at the catalog root (#3675)

Fixed

• (hls) advertise only playable renditions (#3824)

Other

• Unify mux track and rendition ownership (#3857)
• (net) [breaking] name path roles without new types (#3826)
• (net) [breaking] return the next deadline from driver polls (#3828)
• (net) [breaking] drive time and cache cleanup explicitly (#3825)
• (net) expose route cost fields (#3802)
• Merge origin/main into dev
• Merge remote-tracking branch 'origin/main' into merge-main-into-dev-20260914

Changed

• [breaking] Read the broadcast timeline from catalog.archive
  instead of the removed root timeline entry.

Fixed

• Answer 404 for a segment the relay cannot serve because the group is not cached or the publisher is gone, and 500 only for a genuine failure. Classification uses the named moq-lite stream codes (local variants and received Error::Stream codes), so a miss that crossed a session no longer looks like an internal error. IETF stream-reset misses still answer 500.

moq-stats

0.2.0 - 2026-09-23

Added

• (gateway) [breaking] align embedding APIs (#3818)
• (net) [breaking] simplify origin scoping (#3804)
• (net) [breaking] scope origins with any pattern union and report announce matches (#3746)
• (net) [breaking] slim the moq-net public surface (#3779)
• (net) [breaking] announce prefixes on every wire; consumers read paths (#3770)
• (net) [breaking] one name per announce, request, and origin config concept (#3725)
• (json) [breaking] Config means the same thing in json and binary (#3718)
• (net) [breaking] name stats counter edges started and ended (#3712)

Other

• allocation-free binary stats (#3918)
• (net) [breaking] name path roles without new types (#3826)
• (net) [breaking] return the next deadline from driver polls (#3828)
• (net) [breaking] drive time and cache cleanup explicitly (#3825)
• Merge origin/main into dev
• Merge remote-tracking branch 'origin/main' into merge-main-into-dev-20260914

Changed

• [breaking] Traffic and presence frames use *_started / *_ended (re-exported from moq-net) and still emit the previous announced / *_closed names for one release.

moq-relay

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: d5854dc4f5

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Include moq-e2ee's pending changes in the release

This lock update moves moq-e2ee onto kio 0.6 and moq-net 0.3, but the crate remains at 0.0.1 and its changelog still leaves the breaking moq-e2ee-00 rewrite under Unreleased, below a dated 0.0.1 entry describing the obsolete moq-e2ee-01 API. If 0.0.1 was already published, the changed crate cannot be republished; if it was not, the initial release will carry inaccurate release notes and omit its actual API changes. Version and roll the pending changelog into this release.

AGENTS.md reference: AGENTS.md:L26-L27

Useful? React with 👍 / 👎.

[kixelated]

Verdict: ITERATE

Looks like a normal release-plz automation PR in intent: package bump list in the body, Cargo.lock refresh (lru 0.18.4→0.18.5), and changelog work for moq-tokio. Positive as a release vehicle once the notes are clean.

Complexity is fine for bot release automation. However, rs/moq-tokio/CHANGELOG.md already had duplicate ## [0.19.11] sections on main, and this PR inserts a third overlapping 0.19.11 block (now including #3941) above the prior ones. That is not a trustworthy release note for a tag that Cargo.toml already pins at 0.19.11.

Before merge: collapse to a single 0.19.11 section (or bump if these notes were meant for a newer version), drop the duplicated historical bullets, and confirm the multi-crate version list in the PR body matches what this commit actually releases (this diff only touches the lockfile and one changelog). After that cleanup, MERGE is appropriate; no alternative approach needed beyond fixing the generated notes.

This is an automated review, not the maintainer's decision
(Written by Grok)