chore(quest): audit the quest tree

quest/README.md

@@ -7,8 +7,8 @@ grouped into milestones ordered by priority.
 
 ## Plan
 
-m0 is everything in flight now: the release API gates, the release itself, and
-the reusable Pronto GPU path. m1 is the next wave across reliability, features,
+m0 is everything in flight now: announce and wildcard routing, the local
+origin, and audio playout (jitter target, quality harness, A/V clock). m1 is the next wave across reliability, features,
 performance, and planning. m2 holds later features, design studies, and
 experiments. m3 is deferred: work whose first step is outside this repository.
 m4 waits on an upstream release or external dependency to ship. Priority is
@@ -17,7 +17,7 @@ under the repository rules.
 
 ## Required
 
-- [m0: immediate priorities](/quest/m0/README.md) - everything in flight now: the release API gates, the release, and the Pronto GPU path
+- [m0: immediate priorities](/quest/m0/README.md) - everything in flight now: announce and wildcard routing, the local origin, and audio playout
 - [m1: next wave](/quest/m1/README.md) - reliability, capabilities, performance, and the planning that settles their contracts
 - [m2: later work](/quest/m2/README.md) - deferred features, design studies, and experiments
 - [m3: deferred](/quest/m3/README.md) - gated on the outside world: hardware nobody has, a partner, or a provider's offer

quest/m0/README.md

@@ -2,106 +2,41 @@
 
 ## Goal
 
-Settle the public contracts of `moq-archive`, `moq-e2ee`, `moq-sock`,
-`moq-uring`, `moq-audio`, `moq-video`, `moq-transcode`, and `moq-nvenc`
-before the imminent release, while supplying the reusable GPU media support
-needed to remove raw-pixel CPU transfers from the Pronto CARLA demo. These are
-independent immediate tracks rather than mutual prerequisites. Then cut the
-release moq.pro adopts from the merged tree.
+The work in flight now, in two independent tracks. Routing: a publisher stops
+sending announce updates the wire cannot tell apart, a service claims the
+prefix it could serve instead of enumerating broadcasts, and localhost workers
+read only what their relay ingested. Audio playout: the target is a measured
+estimate of arrival timing in both languages, a browser regression fails a
+nightly run, and the audio playhead becomes the clock video follows.
 
 ## Plan
 
-dev landed on main as #3793 on 2026-09-20;
-[Release](/quest/m0/release.md) names what gates the release that follows.
-Published API or wire breaks still land on dev; the quest's Plan says so.
+The release API gates (#3829..#3878) and the release that followed them are
+done. moq.pro tracks this repository as a submodule rather than a release, so
+no release quest gates this milestone. The Pronto GPU integration lives in
+moq.pro.
 
-The archive, E2EE, and uring crates are 0.0.x; socket, audio, video,
-transcode, and nvenc are 0.1.x so dependents can take compatible patches. Their
-API quests gate the release; a published break to a 0.1.x crate targets dev.
-Inspect transitive public exposure before changing a shared symbol: `moq-tokio`
-publicly re-exports `moq-sock`'s bind module. Keep that re-export and its
-current names.
+Routing: announce-update dedupe is a wire-compatible fix on every version. The
+wildcard line is prefix-only on the wire; its resolve and demand work is done
+on the line branch and waits to land. Local origin serves the relay's
+ingested-only view on the internal listener.
 
-Keep the useful boundaries: archive owns storage and codecs, E2EE owns
-protection rather than catalogs, sock owns runtime-neutral sockets, and uring
-owns the local worker and its I/O. Prefer standard Rust ranges to a new public
-range type. Keep uring's root `Config` reachable, since worker is private;
-renaming `TxBuf` or moving bind names does not improve an ownership contract.
+Audio playout: the jitter target replaces the round-trip guess. The harness's
+browser lane grades it nightly and records the traces it replays; the native
+lane is a standalone m1 quest, since nothing here waits on it. The A/V clock
+builds on the jitter target's per-track spread.
 
-Their package boundaries are explicit:
-
-- `moq-archive` replaces reversed integer-pair bounds with validated finite
-  `RangeInclusive<u64>` values, unifies streaming and paginated listing under
-  archive-owned query/entry types, and hides path helpers that are not consumer
-  APIs. Persisted object paths and bytes remain unchanged.
-- `moq-e2ee` replaces raw/profile-global construction with application-owned
-  secrets and epoch-scoped `Credential`, `Generation`, `Epoch`, and track/group
-  handles. Raw crypto, catalog policy, retransmission internals, and the global
-  `Publication` registry leave the public surface.
-- `moq-sock` makes incomplete reuseport groups unservable and retains every
-  member socket for the served group's lifetime.
-- `moq-uring` derives worker and steering identity from owned sockets and
-  connections instead of independently supplied handles or shard values.
-- Published `moq-tokio` keeps its worker signatures and `bind` re-export while
-  adapting internal plumbing. Its root names do not move.
-
-The media crates are 0.1.x too, so a published break to them targets dev.
-Adapt callers in other packages without breaking their published APIs, C
-layouts, or wire formats. Do not bump versions as part of these quests.
-
-Their package boundaries are explicit:
-
-- `moq-audio` owns the PCM/layout and codec configuration split, decoder entry
-  point, publication authority, and extensible audio frame and packet
-  construction.
-- `moq-video` owns frame conversion and construction, decoder output policy,
-  synchronous codec thread confinement, capture timestamps and rational rates,
-  extensible group configuration and `cut` naming, and its feature defaults.
-- `moq-transcode` adopts the video rate, group, output, and feature contracts in
-  its public configuration and observations without adding another media model.
-- `moq-nvenc` narrows its safe facade around owned resources and completion,
-  while loading and incompatibility become fallible public errors.
-- Published `moq-mux` gains only the additive shared `rate` namespace. Published
-  `moq-ffi`, `libmoq`, and language-binding signatures, layouts, and sentinel
-  behavior remain unchanged while their internals adapt.
-
-The agreed media direction is small, honest APIs: typed PCM layouts, rational
-video rates, extensible GOP and frame records, explicit ownership, and no knobs
-that claim behavior they do not provide. Synchronous codecs remain public and
-thread-confined; async sinks own codec execution. Native versus CPU output is a
-choice, not a promise that every native backend yields a GPU surface. OpenH264
-becomes optional but stays enabled by default. Rendering becomes opt-in;
-inexpensive native codec defaults remain.
-
-The Pronto GPU quests remain an independent deliverable within m0. They define
-portable Vulkan/CUDA ownership, safe partial NVENC initialization, and a strict
-GPU conversion path without changing either API audit. Product integration and
-installation live in moq.pro.
-
-Each implementation updates its existing README, examples, and affected docs
-inline and adds regression coverage to normal or nightly CI. Feature checks
-exercise each media crate independently, since workspace feature unification
-hides missing gates. Cross-platform compilation and hardware execution are
-separate evidence. The audits were source-based, not a cryptographic review,
-fresh compilation, benchmark, or Linux runtime validation.
-
-API-preserving implementation, codec additions, allocation work, and hardware
-proof remain in the existing backlog. Keep audio's integrated packetizing
-Producer and transcode's validated Ladder and coalescing active cursor. Keep
-one video Frame/Surface hierarchy and its deliberate native/wgpu type interop;
-do not add another media abstraction or a renderer crate during stabilization.
+Published API or wire breaks still land on dev; each quest's Plan says so.
 
 ## Required
 
-- [Release](/quest/m0/release.md) - the release moq.pro adopts: binding docs, an upgrade page, and a staging soak gate it rather than the merge
 - [Skip unchanged announce updates](/quest/m0/announce-update-dedupe.md) - a publisher sends an announce update only when the wire route changed
 - [Wildcard](/quest/m0/wildcard/README.md) - a relay resolves subscriptions against advertised prefixes, a service claims the prefix it could serve and refuses the rest instead of enumerating broadcasts, and the browser player treats a covering claim as availability
 - [Local origin](/quest/m0/local-origin.md) - localhost workers read only the broadcasts their relay ingested, from the internal listener
-- [Audio quality harness](/quest/m0/audio-quality-harness/README.md) - a playout latency regression fails a run instead of arriving as a bug report, and its recorder supplies the jitter target's replay traces
+- [Audio quality harness](/quest/m0/audio-quality-harness/README.md) - a browser playout latency regression fails a nightly run instead of arriving as a bug report, and its recorder supplies the jitter target's replay traces
 - [Audio jitter target](/quest/m0/audio-jitter-target/README.md) - the audio playout target is a measured estimate of arrival timing in both languages, not a round-trip guess
 - [A/V clock](/quest/m0/plan-av-clock.md) - the audio playhead drives Sync.reference while audio plays, through per-track sync handles
-- [SD rendition for bbb](/quest/m0/bbb-sd.md) - `just pub bbb` publishes a pre-encoded 360p rung beside the 720p source, for localhost demos and moq.pro's fleet demo
 
 ## Related
 
-- [Pronto GPU integration](https://github.com/moq-dev/moq.pro/tree/main/quest/main/pronto/gpu) - CARLA bridge, release adoption and desktop installation
+- [Pronto GPU integration](https://github.com/moq-dev/moq.pro/tree/main/quest/m0/pronto/gpu) - CARLA bridge, release adoption and desktop installation

quest/m0/audio-quality-harness/README.md

@@ -6,25 +6,28 @@ A regression in audio playout latency fails a run instead of arriving as a bug
 report. The harness plays a broadcast over an impaired path, counts what the
 listener would actually have heard (underruns, short quanta, discarded samples,
 skip-aheads) and what each stage of the pipeline contributed to the delay, and
-grades the result against a checked-in budget. It runs in the browser and
-natively, on the same jitter profiles, reporting the same numbers.
+grades the result against a checked-in budget. This line is the browser;
+the native lane is [Native audio
+quality](/quest/m1/audio-quality-native.md), on the same jitter profiles and
+reporting the same numbers.
 
 Boundaries: audio only. The stage breakdown is defined generically so video can
 adopt it later, but no video assertion ships here. No perceptual scoring: the
 grade is glitches and latency, not an opinion about how it sounds.
 
 ## Plan
 
-Two quests, browser first, because that is where the traces and the reported
-bug both are. The native lane follows against the same budgets and the same
-metric schema, so the two implementations can be compared rather than merely
-both passing.
+Browser only, because that is where the traces and the reported bug both
+are. The native lane moved to m1 as a standalone quest (decided in the
+2026-09-28 quest audit): nothing in m0 waits on it, and it follows against the
+same budgets and metric schema so the two implementations can be compared
+rather than merely both passing.
 
 The starting point is not a blank page. The reporter on #3477 already built a
-working browser harness on their fork (`fperex/moq`, branch `debug/rt-audio`):
-a CDP driver, a beacon sink, a trace analyzer, a ring replay, a five-scenario
-`bench.sh`, and a `compare.mjs` that prints before-and-after tables. Upstream
-that rather than reinventing it. The raw traces it shipped with are gone, so
+working browser lane on their fork (`fperex/moq`, branch
+`debug-findings-solution`, under `test/audio-quality/`): a Playwright-driven
+matrix over `moq-shaper`, a budget file graded under `--enforce`, a nightly
+job, and a replay runtime. Upstream that rather than reinventing it. The raw traces it shipped with are gone, so
 this harness records fresh ones, and the [jitter target's watch
 quest](/quest/m0/audio-jitter-target/watch.md) replays them (decided with the
 maintainer during the merged-PR audit).
@@ -47,10 +50,10 @@ each of those dimensions moves the expected floor.
 ## Required
 
 - [Browser](/quest/m0/audio-quality-harness/browser.md) - upstream the fork's harness, grade it against a budget, run it nightly
-- [Native](/quest/m0/audio-quality-harness/native.md) - the same profiles and budgets through `moq play` on a dummy device
 
 ## Related
 
+- [Native audio quality](/quest/m1/audio-quality-native.md) - the same profiles and budgets through `moq play` on a dummy device
 - [Audio jitter target](/quest/m0/audio-jitter-target/README.md) - the estimator this exists to keep honest
 - [Latency ledger](/quest/m2/latency-ledger.md) - promotes this harness's probes into a public API
 - [Time stretch](/quest/m1/watch-audio-time-stretch.md) - graded by this harness once it lands

quest/m0/audio-quality-harness/browser.md

@@ -13,16 +13,18 @@ production path is the one without cross-origin isolation.
 
 ## Plan
 
-Upstream the reporter's harness from `fperex/moq` branch `debug/rt-audio`
-rather than rebuilding it, keeping the attribution. It already has the CDP
-driver, the beacon sink, the analyzer, the ring replay, `bench.sh`'s five
-scenarios, and `compare.mjs`. What it does not have is a home in `test/`, a
-budget, or a schedule.
+Upstream the reporter's lane from `fperex/moq` branch
+`debug-findings-solution` rather than rebuilding it, keeping the attribution.
+It already has a built `test/audio-quality/` lane: `just test audio-quality`
+over `moq-shaper`, a Playwright-driven Chromium matrix, a `budgets.json`
+graded by `grade.ts` under `--enforce`, a nightly job that keeps a failure's
+run directory, and `chromium`, `safari`, and `replay` runtimes. It also
+carries player, estimator, and shaper changes (checked 2026-09-28: 222 commits
+ahead of and 148 behind `main`), so land the lane on its own and hold its
+schema to the contract below rather than taking the branch wholesale.
 
-- Land the driver and analyzer under `test/`, alongside the existing `interop`
-  and `drill` lanes, wired into the `justfile` the way they are. Playwright is
-  already in the tree for the harness quests, so prefer it over a bespoke CDP
-  driver if the switch is cheap; if it is not, say so and keep CDP.
+- Land the lane under `test/`, alongside the existing `interop` and `drill`
+  lanes, wired into the `justfile` the way they are.
 - Keep the instrumentation ad-hoc for now. The probes stay a debug surface, not
   public API; promoting them is [Latency
   ledger](/quest/m2/latency-ledger.md), which nothing here waits on.