Merge main into dev

[kixelated]

Merges main (through #4128, 31 commits) into dev.

Conflicts and how they were resolved

• rs/moq-relay/src/{connection,uring}.rs: dev's version. feat(net): hide dot-named broadcasts from discovery (moq-lite-07) #4060 (hidden dot-named broadcasts) threaded a cluster_peer flag through connection::authorize, which dev replaced with Cluster::admit/Cluster::scope in feat(auth)!: expose lease-driven gateway admission #3943. The exemption now lives in Cluster::scope: the subscriber origin is with_hidden(request.tls.is_some() || Cluster::is_lan_path(&request.path)), so every path through scope (native, io_uring, LAN, gateway embedders via Cluster::admit) keeps the rolling-upgrade behavior. websocket.rs auto-merged with main's inline with_hidden; comments pointing at connection::authorize now point at Cluster::scope.
• quest/m1/README.md: dropped the entries for quests finished on either side (listener-close, tokio-test-ports on main; decoded-frames on dev). Kept tokio-reconnect-ports.
• quest/m1/origin-narrowing.md: main's rewrite, with dev's Reason::Narrowed wording.

API / wire impact

None beyond what each side already carries. Cluster::admit now returns a subscriber origin that shows hidden routes to authenticated cluster peers, matching main's authorize.

Verification

just check: lint, and all 4914 Rust tests passed. The Dart analyzer crashed locally because the machine ran out of inotify instances (EMFILE), so CI covers Dart.

(Written by Claude Opus 5.5)

🤖 Generated with Claude Code

[kixelated]

MERGE

This is a branch sync: main (through #4128, 31 commits) into dev, with three conflict areas resolved deliberately rather than by accident.

Positive improvement? Yes. dev needs this intake so it does not drift from already-landed main work (hidden broadcasts, mux/TS fixes, lite-07, CI layout, etc.). The PR description matches what landed in the merge commit.

Worth the complexity? Yes. The only non-trivial conflict is #4060 (hidden dot-named broadcasts / cluster-peer exemption) versus #3943 (Cluster::admit / Cluster::scope). Putting the exemption in Cluster::scope as with_hidden(request.tls.is_some() || Cluster::is_lan_path(&request.path)) is the right place: native and io_uring already go through admit/scope (including LAN via admit_lan), and outbound cluster dials already publish with with_hidden(true). Keeping connection.rs / uring.rs on the dev shape avoids reintroducing a deleted authorize path. Quest README cleanup (drop finished quests, keep tokio-reconnect-ports) and taking main's origin-narrowing rewrite with Reason::Narrowed are low-risk doc merges.

Different approach? A rebase of dev onto main would rewrite history; a merge PR with an explicit conflict note is clearer for this workflow. No need to rethink the port.

One follow-up (non-blocking): websocket.rs still applies with_hidden(request.tls.is_some()) on its own admit path and does not call Cluster::scope, so it does not include the LAN-path half of the exemption. That matches what already shipped on main, and LAN mesh dials go through native/uring, so this merge does not regress them. Longer term, routing WebSocket through Cluster::scope (or matching its predicate) would remove the duplicate policy.

CI was still pending at review time; local claim of just check + 4914 Rust tests is noted. Merge once checks are green.

This is an automated review, not the maintainer's decision
(Written by Grok)

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 355e5f8b8b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Observe promises after a synchronous race winner

When an earlier input is already settled, this return prevents listen from attaching a rejection handler to the remaining inputs. Consequently, race([settledOnce, rejectingPromise]) can resolve successfully and later produce an unhandled rejection from the losing promise; the pre-aborted effect.race(...) path has the same problem because it returns before observing any input. Continue observing later thenables while disposing their race listeners so losing rejections remain handled.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-25T13:03:18.641644Z	355e5f8	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.