test(relay): run the cluster burst drill across a flapping peer link

quest/m1/README.md

@@ -54,7 +54,7 @@ blocks. The quests that gated m0 lines moved under them.
 - [Subscribe ranges](/quest/m1/subscribe-ranges/README.md) - a lite-07 SUBSCRIBE asks for past and live ranges in either order and replaces FETCH; relays fill misses by range, including over moq-transport
 - [Live media time](/quest/m1/subscribe-live-time.md) - re-scoped against `set_live`: a lite-07 SUBSCRIBE_OK carries the publisher's current media time only if a reader still needs it
 - [Cross-relay bursts re-run](/quest/m1/cross-relay-bursts.md) - condition: the #4349 reporter re-runs their A/B/C comparison against current cdn.moq.pro
-- [Flapping peer drill](/quest/m1/cross-relay-flap-drill.md) - the cluster burst drill survives a flapping peer link, the regression for 0.15.6 route-flap drops
+- [IETF peer FETCH refused old](/quest/m1/ietf-peer-fetch-old.md) - a cross-relay FETCH over a moq-transport peer link returns groups the origin still holds
 - [Untimed lite-07](/quest/m1/lite-untimed.md) - lite-07 carries an untimed track in both languages; lite-05/06 write send time
 - [Finalize moq-lite-07](/quest/m1/lite07-finalize.md) - when the maintainer cuts it, lite-07 negotiates as `moq-lite-07` and the next release ships it
 - [Late lower groups](/quest/m1/lite-late-lower-group.md) - a moq-lite subscriber with a floor receives a group created below the first served one, as moq-transport does

quest/m1/cross-relay-bursts.md

@@ -30,8 +30,14 @@ used and against `main`:
   `rs/moq-relay/tests/drills.rs::bursts_cross_a_cluster` (bursts of 30
   across two clustered relays, every hop with 5% loss, delay, a 100 kbit/s
   bottleneck that each burst overflows, and 16-stream QUIC credit): every
-  group arrives within about 3.5 s, and the occasional live `Old` reset is recovered by FETCH. Several
+  group arrives within about 3.5 s, and the occasional live `Old` reset is
+  usually recovered by FETCH. Not always: on `main` at `fe0113ff2`, 1 of 40
+  runs lost group 89 to a live `Old` reset whose FETCH was also refused `old`
+  (seed 11025055814286623932). Several
   30 s timers of that era have since been removed or shortened (#4606, #4741).
+  That drill uses a lite peer link; over a `moq-transport-19` peer link, a
+  related refusal does reproduce: FETCHes answered `old` for groups the origin
+  still holds ([IETF peer FETCH refused old](/quest/m1/ietf-peer-fetch-old.md)).
 - **Queueing.** FETCHes beyond a session's stream credit wait for it, one
   cross-relay round trip per slot, so with tight credit a gap's FETCH can
   outlast a 2 s deadline without being lost.

quest/m1/ietf-peer-fetch-old.md

@@ -0,0 +1,19 @@
+# [S] IETF peer FETCH refused old
+
+## Goal
+
+A cross-relay FETCH over a `moq-transport` peer link returns every group the origin still holds, instead of refusing some as `old`.
+The cluster burst drill then runs a third peer link variant over `moq-transport-19`, and its impaired lane passes.
+
+## Plan
+
+Repro: in `rs/moq-relay/tests/drills.rs::cross_cluster`, pin the edge's peer link with `config.connect.version = ["moq-transport-19"]`.
+The steady impaired drill then failed in 5 of 5 runs with FETCHes refused `old` for groups the origin still held, e.g. `groups lost: [(5, Failed("old")), (37, Failed("old")), (41, Failed("old"))]`.
+Seeds: 11977074354257116273, 6755536760138253279, 17984197590923068922, 10974424043511566981.
+The loopback lane and the flapping drill passed.
+
+Find where the IETF FETCH path decides a group is `old`, fix it at the source, then add the IETF peer link as a `PeerLink` variant.
+
+## Related
+
+- [Cross-relay bursts re-run](/quest/m1/cross-relay-bursts.md) - the #4349 `Stream(Old)` stalls, not reproduced over a lite peer link

quest/m1/test-flakes-2/README.md

@@ -34,3 +34,4 @@ Public API: none. Wire: none.
 - [Media late join](/quest/m1/test-flakes-2/media-late-join.md) - `just test media` late join stays within one GOP, or the regression is fixed
 - [Import catalog finish](/quest/m1/test-flakes-2/import-catalog-finish.md) - `moq-cli`'s subprocess EOF catalog-finish test holds up under load with event-based fixture coordination
 - [Relay restart rebind](/quest/m1/test-flakes-2/relay-restart-rebind.md) - the crash drill restarts on its original UDP address under concurrent load
+- [Impaired handshake](/quest/m1/test-flakes-2/impaired-handshake.md) - the impaired cluster drills' clients never time out while connecting

quest/m1/test-flakes-2/impaired-handshake.md

@@ -0,0 +1,27 @@
+# [S] Impaired drill clients connect reliably
+
+## Goal
+
+The impaired cluster drills (`bursts_cross_a_cluster::impaired`,
+`bursts_cross_a_flapping_peer::impaired` in `rs/moq-relay/tests/drills.rs`)
+never fail while connecting their publisher or subscriber.
+
+## Plan
+
+Measured 2026-10-07 by running the built drill binary in a loop (four tests
+in parallel):
+
+- `main` at `fe0113ff2`: 1 of 40 runs failed `publisher connect failed:
+  Noq(Connection("timed out"))`, seed 3495212678159036442.
+- #4972, with both relays back on the default 10s idle timeout: 3 of 40 runs,
+  `subscriber connect failed: Noq(Connection("timed out"))` twice and once
+  `failed to exchange h3 settings: ... reset by peer`.
+
+So the relays' idle timeout is not the cause. The likely cause is the drills'
+2s client idle timeout (`quic()`) against a handshake over 5% loss and a
+100 kbit/s bottleneck: noq arms the idle timer at `max(idle, 3 * PTO)` with
+the base PTO, while a backed-off PTO can leave the client silent longer than
+that. Confirm with a qlog of a failing seed, then fix it at the cause, without
+raising a timeout or retrying the connect.
+
+Public API: none. Wire: none.