Merge main into dev

[kixelated]

Merges main (through #4387, e713c30) into dev. dev keeps its breaking changes; main's fixes and features are carried onto them.

Notable conflict resolutions:

• moq-c (feat(c)!: publish the C bindings as moq-c #4288 rename): ported fix(libmoq): open extern "C" in the generated moq.h #4350 (cpp_compat: true, so the generated moq.h opens extern "C") and fix(libmoq): render moq.pc only when packaging #4372 (build.rs no longer renders a pkg-config file) into rs/moq-c/build.rs. nix/overlay.nix renders and checks moq-c.pc at install time from rs/moq-c/moq-c.pc.in, using cleanCargoSource like main. Comments in CMakeLists.txt, native-libs/apple.txt, moq-c.pc.in, rs/justfile, test/interop/interop.sh, README.md, doc/lib/c, and CONTRIBUTING.md (the OBS release tag) name moq-c instead of libmoq. The rs/libmoq stub keeps dev's README; its version follows main's release.
• moq-auth (feat(auth)!: expose lease-driven gateway admission #3943 lease vs fix(auth)!: restore 0.14 auth parity #4319, feat(net): the SETUP AUTHORIZATION TOKEN option reaches the verifier #4278, fix(auth): admit a SETUP token equal to the jwt query #4359, fix(auth): make grant expiry exact, dropping the clock-skew grace #4368): Key::verify keeps dev's decode::<C> split and gains main's exact validate_times (exp <= now, nbf > now). serve::Policy::decide uses main's SETUP-token jwt() selection and JWT-plus-certificate refusal, then dev's verify() (which adds --key-set). Dev's gateway-limits test sets a revalidate cadence, which main's Server::new requires with limits. Docs merge both (--key-set, narrowed/shutdown end reasons, and fix(auth): make grant expiry exact, dropping the clock-skew grace #4368's exact expiry).
• @moq/auth: dev's verify moved from jose.jwtVerify to compactVerify plus a manual exp check, which dropped the nbf check main's fix(auth)!: restore 0.14 auth parity #4319 tests rely on. It now refuses nbf > now, matching Rust. The raw-signed test tokens carry the key's kid, which dev's decode requires.
• moq-net announce (feat!: rename announce events to Start/Update/End/Live #4384 events vs fix(net): announce a covering route to a narrower prefix instead of panicking #4302, fix(net): select scoped routes after filtering, not before #4363, fix(moq-net): hide routes through a peer that withdrew the prefix #4399): the lite publisher takes main's prefix-rooted cursor (no suffix()); the IETF apply_update helper takes main's suffix = update.prefix, path = prefix.join(suffix). OriginState keeps dev's replaying sources and main's withdrawn peers. Main's public_rules.rs, mesh_withdraw.rs, the session bench, and js/net/bench/forward.ts use dev's Start/Update/End/Live events.
• js/net track cache (feat(net)!: make publisher retention optional #4242 optional retention vs perf(net): search the track timeline instead of scanning it #4321, fix(net): age out an ended JS track's groups, match Rust abort semantics #4385): main's sliced prune, but no pruning when maxAge is unset, per dev; DEFAULT_MAX_AGE_MS stays removed. fix(net): start a guarded group write only while the group is in budget #4254's stale-group publisher test declares maxAge: 5000, the old default, since dev has none.
• Go (fix(go): keep test origins alive until the test ends #4402): newOrigin(t) also covers dev's TestAnnouncedYieldsLiveOnceCaughtUp.
• Workspace deps: dev's moq-noq 2.0, qmux 0.6, web-transport-moq 2.0, and web-transport-trait 0.5 win; crate versions take main's releases.
• CI: dev's nightly Windows/macOS jobs are dropped in favor of main's platform.yml (ci: compile the Windows, macOS, and OBS plugin code on every PR #4370); obs.yml and nightly.yml use main's .#obs shell (build(nix): move obs-studio to a .#obs shell, drop rust-docs #4410) under moq-c names; interop.yml runs both dev's max-age and main's harness steps.
• Quests: a quest deleted on either side stays deleted (m0/release, m1/close-codes, m1/libmoq-{fetch,shutdown}, m1/release-size, m2/capture-clock-source, and the rest of main's chore(quest): audit the quest tree #4393 audit). Main's audit wins the READMEs and the reshaped quests, with libmoq renamed to moq-c where it names the hand-written crate. Dev-only quests stay listed in m1/README.md (page-load marker, empty state, JS active count, libmoq stub retirement, capture cut test, NVENC keyframe flag). Dev's m1/origin-mount is deleted, done by feat(net): read a subtree through an origin mount #4271 on main. quest check passes.

Left for a follow-up:

• m1/announce-live-apps (main) overlaps dev's m1/announce-page-load and m1/announce-empty-state, and says the page-load hold ends when the first dial gives up, while open quest: announce streams toggle between live and offline #4369 records "no give-up". Both are kept; fold them once quest: announce streams toggle between live and offline #4369 lands.

Public API / wire impact: none beyond what the merged main and dev PRs already carry.

Added after review:

• Merged dev again for fix: bump qmux to 0.6.1 so ws:// keeps the close code #4398 (qmux 0.6.1), which fixes the moq-tokio close_code failures.
• js/net track cache: with unlimited retention, a sink closed by the producer drops its mirror tracking instead of pinning it forever (main kept it for age-out; dev's optional retention never ages out). Codex finding.
• test/max-age: the JS subscriber waits for the age start instead of the first announce event, which can be dev's live marker before the relay learns the route (it raced into Unroutable).

Checks: nix develop --command just check origin/dev, just test max-age, and the js/net suite pass locally.

Merge with a merge commit, not squash.

(Written by Claude Opus 5.5)

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-29T02:32:19.308326Z	3d0b72a	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[kixelated]

Recommendation: MERGE

Head: cdeed8f0c6761302ca3be69f8741b1d90a0d3a8b (main through #4387 → dev)

Branch sync assessment

This is an appropriate main → dev sync: GitHub reports MERGEABLE (no unresolved conflicts), the tip is a real two-parent merge commit (dev + e713c309), and the body documents conflict wins clearly. Direction is right — carry main's fixes/features onto dev's breaking changes rather than the reverse.

What changed (categories; ~666 files, +16.7k / −7.7k, 86 commits)

• Quests (~295): deletions from either side kept deleted; main's audit/README reshape wins; libmoq → moq-c renames; a few overlapping announce quests left for a follow-up after quest: announce streams toggle between live and offline #4369.
• Rust (rs/, ~172): net/auth/cli/media fixes from main; conflict ports for moq-c (fix(libmoq): open extern "C" in the generated moq.h #4350 cpp_compat, fix(libmoq): render moq.pc only when packaging #4372 no pkg-config from build.rs), moq-auth (dev decode/--key-set + main exact validate_times / SETUP-token JWT selection), announce events, track cache.
• JS (js/, ~71): auth nbf restored to match Rust; track-cache prune/retention merge; benches adapted to dev event names.
• CI/tooling: main's platform.yml (ci: compile the Windows, macOS, and OBS plugin code on every PR #4370), .#obs shell (build(nix): move obs-studio to a .#obs shell, drop rust-docs #4410), interop harness + max-age; workspace deps keep dev's moq-noq 2.0 / qmux 0.6 / web-transport-* while crate versions take main's releases.
• Docs / Go / OBS / locks: rename and packaging updates; Go origin test helpers cover both sides' tests.

Spot-checks on the head match the claimed resolutions (cpp_compat: true + no .pc write in rs/moq-c/build.rs; validate_times with exp <= now / nbf > now in moq-auth; Cargo workspace pins as described).

Complexity / alternatives

Worth it: a documented merge-with-conflict-resolution is the right tool for divergent main/dev. Squashing would destroy history and is correctly ruled out. Waiting longer only accumulates more conflicts.

Caveats (do not block the sync itself)

1. Wait for CI — Check/Test/Interop/Platform/etc. were still pending at review time; merge only once required checks are green.
2. Known pre-existing moq-tokio close_code failure on dev; fix: bump qmux to 0.6.1 so ws:// keeps the close code #4398 (qmux 0.6.1) is the fix and is intentionally out of scope — land that as a follow-up if CI surfaces it.
3. Merge with a merge commit, not squash, as the PR and CONTRIBUTING ask.

Verdict: MERGE once CI is green (merge commit).

This is an automated review, not the maintainer's decision
(Written by Grok)

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: cdeed8f0c6

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Release closed sinks when retention is unlimited

When Info.maxAge is omitted, #prune() intentionally never evicts cached groups. If the producer then closes, this branch disposes the only cleanup listener before removing the sink from each cached entry's mirrors map, so the cache permanently retains that sink and all of its mirrored groups. Ended tracks with unlimited retention therefore accumulate memory for every current subscriber, and late subscribers have the same lifetime problem; detach closed sinks from the cache without discarding the source groups.

Useful? React with 👍 / 👎.

[kixelated]

Agreed on the close path: main's early return (keep mirrors tracked so they age out) meets dev's optional retention (nothing ages out). Fixed in ad8e3c0: with unlimited retention, a sink closed by the producer drops its mirror tracking and leaves the mirrors to its reader.

The late-subscriber half (a sink added after the track closed never registers a close listener) already exists on dev and isn't from this merge, so I'm leaving it for a follow-up rather than widening the sync.

(Written by Claude Opus 5.5)

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ad8e3c0a76

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Detach mirrors for subscribers created after closure

When subscribe() is called after an unlimited-retention producer has already closed, the outer if (closed === undefined) is skipped, so this cleanup callback is never installed; #addSink still mirrors every cached entry into the new sink and immediately closes it, leaving each forever-retained entry.mirrors map holding that sink and its mirrored group indefinitely. The fresh evidence in this revision is that the cleanup added for the prior finding exists only inside the live-sink callback, so late subscribers still leak once per cached group.

Useful? React with 👍 / 👎.

[kixelated]

This path (a sink added after the track closed never registers a close listener) is the same on dev before this merge, so it isn't a merge interaction. Keeping the sync focused and leaving it for a follow-up on dev.

(Written by Claude Opus 5.5)

[kixelated]

Merge summary:

• Test failed on moq-tokio close_code, which also broke dev; fix: bump qmux to 0.6.1 so ws:// keeps the close code #4398 (qmux 0.6.1) had already fixed it there, so dev is merged in.
• Codex's track-cache finding is fixed for the close path, a merge interaction between main's age-out tracking and dev's optional retention. The late-subscriber half predates this merge on dev, so it's left for a follow-up.
• Interop (max-age) raced: the JS subscriber took the first announce event, which can be dev's live marker before the relay learns the route. It now waits for the age start, like the Rust arm.
• The JS nbf check stays, matching Rust.
• main has moved past e713c30 since this sync; the next sync picks that up.

Merging with a merge commit.

(Written by Claude Opus 5.5)