quest: resolve the 2026-10-06 audit

[kixelated]

Problem

The 2026-10-06 /quest-audit found 54 inconsistencies in the quest tree: finished children still listed on main, quests blocked on work that already landed, two quests claiming the same change, and plans that contradict each other or the code. The maintainer settled the open ones; this PR records those decisions and applies the mechanical fixes so quest ready on main stops offering finished or mis-ordered work.

Approach

Every finding was re-checked against origin/main (edd671fff) before editing.

Line syncs with their branches (the same files the line branches delete, so those deletions merge cleanly)

• Auth (F4): quest/m1/auth now matches quest/m1/auth/README (feat(net): in-band AUTH (questline) #4039). The seven children that already merged into the line are deleted (lite, moq-transport, interop, unauthorized, auth-ok-preflight, error-codes, narrowing). peer-grant.md moves to /quest/m3/p2p/peer-grant.md, and wip-version, not-supported, violations, and js-fetch-watch come over. not-supported.md drops the message-ceiling half, since request caps (feat(net)!: bound peer-declared lengths and per-session requests #4820) owns the 65,535-byte cap (F5), and now lists /quest/m0/request-caps.md under Related.
• FFI shape (F31): json, net, and media are deleted because they merged into refactor(ffi)!: the bindings mirror Rust's layers #4519. m2/flate.md takes the branch's text. codec.md keeps main's text; the F33 naming lives on refactor(ffi)!: the bindings mirror Rust's layers #4519's branch until it lands. publish-timestamp.md drops the JSON Required and links FFI shape as Related, matching the F36 branch push.
• C++ (F31): every child is deleted because feat(cpp): the moq C++ package over moq-ffi, and the OBS plugin on it #4079 deletes them. cpp/README.md is now [S] and its remaining work is landing feat(cpp): the moq C++ package over moq-ffi, and the OBS plugin on it #4079. m2/cpp-vcpkg.md now requires the cpp README.
• QoS (F31): starvation and final-lag-sample are deleted, along with every link to them.

Deletions

• quest/m3/route-trust.md (F11): session scoping already covers the security goal, and promotion has no consumer.
• quest/m3/processor/ (F16/F48): the maintainer did not want it. Shaped advertisements in announce-shapes.md are authorized against the publish claim, as Wildcard does today, and there is no advertise scope.
• quest/m1/archive/track-timeline.md (F8): its Rust work landed in quest(archive): Timeline-indexed MoQ archives #4034 and its Required list repeated the archive README's. Its decisions and the two feat(archive)!: per-track timelines #4280 triage items moved into the archive README. flush.md now requires js-timelines.
• quest/m1/quic/uring-close.md (F35): fix(uring): publish a local close only once its CONNECTION_CLOSE is staged #4431 fixed it, and the test passes under the stress setup.

Decisions recorded (each with its reason, dated 2026-10-06)

• Catalog rendition keys are IDs (F23). An ID is unique across video and audio, a cross-kind duplicate is refused, and track is optional and defaults to the ID. The stats quests now key by ID.
• The ladder controller owns rung targets (F17). Encoder feedback requires it and feeds viewer stalls in as a controller input. The "adapts today" wording is fixed.
• QoS (F34): stats-split lands first, and quest(qos): Broadcast health and congestion #4133 rebases its histograms onto stats-split's totals and prefix tracks. lag-dashboard and publisher-timeliness are re-planned to match and Require stats-split, so quest ready keeps the order.
• flv/mkv export delay (F42): these require subscriber-max-delay, and --delay replaces --max-delay, as it did on TS.
• Shared clock (F43): a same-epoch importer's anchor comes from its input or the shared epoch through Input, never from clock.now(). hop-aligned-import requires shared-clock.
• Unordered qmux (F13): native pairs only. It requires quic-qmux.md, and the P2P README's "for free" sentence is fixed.
• tls:// mTLS (F53 + carried decision): the peer certificate comes from a new accessor upstream in qmux, followed by a dependency bump. The quest requires relay-auth-client-ca and lifts its NoBackend refusal for tls://.
• fix(net): validate IETF group order and allow unknown setup repeats #4927 (F47): ietf-malformed-close.md records that fix(net): validate IETF group order and allow unknown setup repeats #4927 owns GROUP_ORDER and repeated unknown/GREASE SETUP options.
• Routine: binding-surface requires ffi-shape/codec.md instead of the m0 jitter line (F25). cli-packaging drops Capture by default (F28). tstd-controls and ts-eac3 require tstd/delay.md (F50). A new quest/m2/stats-producer-bench.md [S] splits out of bench-coverage, ranks above stats-delta, and stats-delta requires it (F51). token-in-band and auth/bindings require FFI shape (F6).

Stale facts and ordering

• F2: selection.md is cut to what remains after quest(wildcard): Wildcard advertisements #4403 and is now [M]. selection and dvr list Wildcard under Related instead of Required.
• F7: replay-catalog follows the 09-29 decision that moq-archive republishes the catalog.
• F9: the root README no longer lists the audio quality harness as m0 work.
• F10: the second-render-node check moved into vaapi-vulkan-import.
• F12: signal.md's roster id is the route-layer node id.
• F14: track-priority-scope owns the Priority::cmp tiebreak, and the ladder only consumes it.
• F15: closure-counters is narrowed to the open *_ended question.
• F18: SUBSCRIBE_DROP now ranks above Lite-07 ranges.
• F19: the draft-20 FETCH and moq-transport ranges quests share one group-span rule.
• F21: transport-upgrade says the Rust upgrade landed in feat(tokio)!: upgrade a WebSocket fallback session to QUIC #4180.
• F22: js-qmux-finish now gates js.md.
• F24: the translator's nested-Option example moved to resume.rs.
• F27: flv-catalog-stream notes that MKV and fMP4 already take a catalog stream.
• F29: audio-quality-native relies on the m0 native replay.
• F37: c/package requires FFI shape.
• F39: the 3122 quest points at Clock::now.
• F40: the mp4-atom bump now ranks above fMP4 init.
• F41: route-wakes lists Wildcard under Related.
• F44: libmoq-final-release records 0.6.12 and the stub-version rule.
• F45 and F46: m1 README wording.
• F49: quic-ecn-measure drops the Hard fork Required.
• F52: nvenc-pool runs encode-presets on main.
• Smaller fixes: archive/flush.md no longer cites the removed moq-net Timer, and cache-max-age.md already recorded the successor-clock decision (re-read like reach), so it is unchanged.
• quest/m0/wildcard/README.md: only lines 131-133 changed, to drop the deleted processor link. feat(net)!: carry publisher epochs on routes #4942's hunks there are elsewhere.

Decisions (maintainer, 2026-10-06 /quest-audit then /quest-plan)

Carried over from the quest-merge run:

• mTLS on tls:// gets the peer certificate: ✅ upstream qmux accessor / own the TLS accept / leave open
• cache-max-age successor clock: ✅ re-read like reach / latch first arrival

Round 1:

• Epoch carrier: ✅ feat(net)!: carry publisher epochs on routes #4942 route metadata / path segment (main) / defer
• Lite message ceiling: ✅ 65,535, request-caps (feat(net)!: bound peer-declared lengths and per-session requests #4820) owns it / 65,536, feat(net)!: bound peer-declared lengths and per-session requests #4820 owns it
• FFI binding names: ✅ mirror Rust (video.Producer/audio.Producer broadcast-bound, video.Encoder/audio.Encoder codec-only, both in codec.md) / Producers only in codec.md
• QoS histograms vs stats-split: ✅ stats-split first, quest(qos): Broadcast health and congestion #4133 rebases onto totals/prefix tracks / quest(qos): Broadcast health and congestion #4133 first
• Same-epoch importer anchor: ✅ input-derived anchor through shared-clock's API / keep them separate
• flv/mkv staleness flag: ✅ feat!: name subscriber staleness max_delay; publisher retention keeps max_age #4917 rename first, then --delay / exclude flv/mkv from feat!: name subscriber staleness max_delay; publisher retention keeps max_age #4917
• Rung bitrate owner: ✅ ladder controller owns, encoder feedback feeds it / drop --echo from feedback
• m3 processor questline: ✅ (user) "I don't get the m3 processor quest. Don't do it" -> delete the questline / leave untouched
• Unordered qmux scope: ✅ native pairs only / include TS reassembly
• Route trust: ✅ delete (session scoping covers the security goal; promotion has no consumer) / keep, rename consumer / keep, P2P requires it
• Catalog keys: ✅ (user) "make the key be the ID, adding in a dedicated track field" -> key is an ID unique across video and audio, cross-kind duplicates refused, stats key by ID, track optional and defaults to the ID / ID plus required track
• Routine: ✅ binding audio delay unblocked (requires ffi-shape/codec) · ✅ cli-packaging drops Capture by default · ✅ tstd-controls and ts-eac3 require tstd/delay.md · ✅ split a stats-producer bench quest
• Transcode group start: ✅ per-worker epochs, delete it (in feat(net)!: carry publisher epochs on routes #4942) / require Origin, decide later
• fix(net): validate IETF group order and allow unknown setup repeats #4927 overlap: ✅ record the split in ietf-malformed-close / ask contributor to retarget
• Mechanical findings: ✅ apply all / show list first
• GitHub: ✅ close feat(net)!: negotiate publisher epochs as metadata #4817, rework feat(stats)!: publish each group announcement under its own epoch #4904, decisions to feat(net)!: carry publisher epochs on routes #4942 · ✅ close feat(moq-net): mock up typed timed/untimed tracks #4878 · ✅ reopen export ts: one --linger resume flags the PCR discontinuity up to four times #4767, Closes on feat(moq-mux)!: fixed-delay jitter buffer and per-PID T-STD admission for TS export #4645 · ✅ nudge fix(hang)!: CMAF decoders time samples from the frame timestamp #4826, feat(net)!: carry untimed tracks faithfully #4822, feat(net)!: bound peer-declared lengths and per-session requests #4820

Skipped findings

• F1, F3, F20, F26, F54: these belong to open PRs (feat(net)!: carry publisher epochs on routes #4942 for the epoch carrier and transcode group start, feat(moq-mux)!: fixed-delay jitter buffer and per-PID T-STD admission for TS export #4645 for tstd/delay.md, fix(hang)!: CMAF decoders time samples from the frame timestamp #4826 and feat(net)!: carry untimed tracks faithfully #4822 for cmaf-frame-timestamp) or to GitHub actions, not to the tree on main.
• F2, in part: the m0 README, broadcast-epoch/hop-removal.md, and the wildcard README size are left to feat(net)!: carry publisher epochs on routes #4942, which rewrites them.
• F5, request-caps half: feat(net)!: bound peer-declared lengths and per-session requests #4820 adopts 65,535. Only the auth half is applied here.
• F30, F32, F38: feat(cpp): the moq C++ package over moq-ffi, and the OBS plugin on it #4079 carries these.
• F33, F36: pushed to the FFI shape line branch (refactor(ffi)!: the bindings mirror Rust's layers #4519) instead. The auth line (feat(net): in-band AUTH (questline) #4039) also got the F5 and F6 edits, and lost its processor link, so its quest files match this PR.

Impact

Quests only. Public API: none. Wire: none.

Merge notes:

• feat(cpp): the moq C++ package over moq-ffi, and the OBS plugin on it #4079 will hit a modify/delete conflict on quest/m1/cpp/README.md and a one-line conflict in m2/cpp-vcpkg.md. Take feat(cpp): the moq C++ package over moq-ffi, and the OBS plugin on it #4079's side in both.
• refactor(ffi)!: the bindings mirror Rust's layers #4519 and quest(qos): Broadcast health and congestion #4133 delete the same children, so those deletions merge cleanly. Remaining hand merges: refactor(ffi)!: the bindings mirror Rust's layers #4519 has one hunk in ffi-shape/README.md on the Codecs Required bullet (take refactor(ffi)!: the bindings mirror Rust's layers #4519's side). quest(qos): Broadcast health and congestion #4133 has one hunk in qos/lag-dashboard.md and three in qos/publisher-timeliness.md, which it resolves during its stats-split rebase.
• After this lands, publish-timestamp.md shows as ready, but it should start only after refactor(ffi)!: the bindings mirror Rust's layers #4519 lands. Its Related entry says so, using the same text as the branch.

Follow-ups

• quest/m1/catalog-track-alias.md keeps its file name, because quest/m0/broadcast-epoch/origin.md (rewritten by feat(net)!: carry publisher epochs on routes #4942) links it. Rename it to catalog-track-id.md once feat(net)!: carry publisher epochs on routes #4942 lands.
• The OBS quests obs-moq-video/adapter.md and audio-publish.md still plan to add codec-only Encoders themselves. Point them at ffi-shape/codec.md once refactor(ffi)!: the bindings mirror Rust's layers #4519 lands, since that branch's codec.md owns video.Encoder and audio.Encoder (F33).
• The GitHub actions in the decisions above (close feat(net)!: negotiate publisher epochs as metadata #4817 and feat(moq-net): mock up typed timed/untimed tracks #4878, rework feat(stats)!: publish each group announcement under its own epoch #4904, reopen export ts: one --linger resume flags the PCR discontinuity up to four times #4767, nudge fix(hang)!: CMAF decoders time samples from the frame timestamp #4826, feat(net)!: carry untimed tracks faithfully #4822, feat(net)!: bound peer-declared lengths and per-session requests #4820) are not done by this PR.

(Written by Claude Opus 5.5)

🤖 Generated with Claude Code

[coderabbitai]

✨ Finishing Touches

✨ Simplify code

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[kixelated]

Automated review: quest: resolve the 2026-10-06 audit

Reviewed head: 2d7e5c97 (base main at edd671ff). This PR only touches the quest tree.

I checked every Markdown link in all 450 files under quest/ at this head, and none are broken. Nothing still links to the 25 deleted files. The ## Required graph has no cycles. The code facts I spot-checked against main all hold: rs/libmoq is at 0.6.11 and crates.io's newest is 0.6.12. Clock::now in rs/moq-net/src/time.rs is right, and so is the single driver.poll(Instant::now(), …) in moq-uring. mkv::Export::new(source, catalog) and the fMP4 equivalent exist, while FLV takes no catalog. #4180's websocket_upgrades_to_quic and a_refused_upgrade_keeps_websocket exist. The two Option<Option<…>> cases in model/resume.rs are real. #4874's grace tests and Traffic::retire raising *_ended match the description. sync_route/poke_below is on main and Pin is gone. The "FETCH spanning several groups" refusal sits in run_fetch_stream. moq-cli's capture feature enables moq-video/capture and moq-audio/capture explicitly. just test ts-tstd is in test/justfile, the encode-presets example is on main, and moq-noq-proto is pinned at 2.0.1. The auth quest directory matches #4039's branch file for file, and #4079's merge note is accurate: a modify/delete conflict on cpp/README.md and one hunk in m2/cpp-vcpkg.md.

Non-blocking

1. The QoS ordering decision isn't enforced in Required. The F34 decision says stats-split lands first and quest(qos): Broadcast health and congestion #4133 rebases onto it. But quest/m1/qos/README.md, qos/lag-dashboard.md, and qos/publisher-timeliness.md all list stats totals and prefix tracks only under ## Related. Once Starvation is deleted, lag-dashboard.md and publisher-timeliness.md have no Required entry at all, so quest ready will offer them before stats-split. That goes against the decision and against this PR's own goal of not offering mis-ordered work. Fix: put stats-split under ## Required on the QoS README, or on those two children.

2. The merge notes undercount the conflicts. The body says the refactor(ffi)!: the bindings mirror Rust's layers #4519 and quest(qos): Broadcast health and congestion #4133 merges "stay clean". The shared child deletions do merge cleanly, but a three-way merge against each branch's current merge base still conflicts:

   • refactor(ffi)!: the bindings mirror Rust's layers #4519: one hunk in quest/m1/ffi-shape/README.md, on the Codecs Required bullet. The branch says "producers, codec-only encoders, and decoders … named as in Rust", and this PR keeps the old "encoders and decoders … one constructor shape". Take refactor(ffi)!: the bindings mirror Rust's layers #4519's side.
   • quest(qos): Broadcast health and congestion #4133: one hunk in qos/lag-dashboard.md (the new ## Related) and three in qos/publisher-timeliness.md. The branch rewrote the same paragraphs around stats::Histogram, and this PR rewrote them around stats-split. These need a hand merge when quest(qos): Broadcast health and congestion #4133 does its stats-split rebase.

   Also, ffi-shape/codec.md does not "take the branch's text". It merges cleanly, but refactor(ffi)!: the bindings mirror Rust's layers #4519's copy has the F33 video.Producer/video.Encoder decision and this one doesn't. Until refactor(ffi)!: the bindings mirror Rust's layers #4519 lands, main's codec.md still describes one shape, so the Follow-ups line that points the OBS quests at codec.md "which now owns video.Encoder" is only true on the branch for now.

No other issues found. The deletions, moves, and recorded decisions read consistently with each other and with main.

Verdict: MERGE. Nothing blocks. Fixing item 1 before landing would keep quest ready honest.

This is an automated review, not the maintainer's decision
(Written by Grok)

[kixelated]

Merging. This lands the maintainer's 2026-10-06 audit decisions (paper trail in the body). For Grok's review:

1. Fixed: lag-dashboard and publisher-timeliness now Require stats-split, so quest ready keeps the decided order.
2. Fixed: the body's merge notes now list the remaining hand-merge hunks for refactor(ffi)!: the bindings mirror Rust's layers #4519 and quest(qos): Broadcast health and congestion #4133, and say codec.md's F33 naming lives on refactor(ffi)!: the bindings mirror Rust's layers #4519's branch until it lands.

The epoch-related edits (deleting transcode-group-start and the wildcard README, the m0 README, hop-removal, selection's identity rule, the stats-split Related link) land in #4942. CI passed on the previous head, and this push only moves two links.

(Written by Claude Opus 5.5)

[kixelated]

Automated follow-up review: quest: resolve the 2026-10-06 audit

Reviewed head: f133f1d2 (previous Grok review on 2d7e5c97). This is a re-review after a push. The push is one commit touching two quest files, plus an updated PR body.

What changed: qos/lag-dashboard.md turns its ## Related into ## Required, and qos/publisher-timeliness.md gains a ## Required section, so both now require stats totals and prefix tracks. I checked that stats-split only requires broadcast-epoch/stats-epoch.md, so this adds no cycle. The QoS README still lists stats-split as Related, which is fine now that the two children it was meant to gate require it directly. lag-splice.md doesn't require it, and that's correct: it fixes the sampler that already exists on the line branch.

Earlier findings:

1. QoS ordering not enforced in Required: fixed. quest ready will no longer offer lag-dashboard or publisher-timeliness before stats-split, which matches the F34 decision and the body's own claim.
2. Merge notes undercount the conflicts: fixed in the PR body. It now lists the refactor(ffi)!: the bindings mirror Rust's layers #4519 hunk in ffi-shape/README.md and the quest(qos): Broadcast health and congestion #4133 hunks in lag-dashboard.md and publisher-timeliness.md. It also says codec.md keeps main's text, with the F33 naming waiting on refactor(ffi)!: the bindings mirror Rust's layers #4519. One thing to know: this push edits the same two quest(qos): Broadcast health and congestion #4133 files again, so the hand merge there will be a little larger than the body describes. It's still the same files and the same stats-split rebase.

No new issues. CI (Check, Test) is still pending at the time of this review.

Verdict: MERGE.

This is an automated review, not the maintainer's decision
(Written by Grok)