quest: plan follow-ups from the final-head PR audit

[kixelated]

Summary

An audit of PRs merged without a qualifying final-head review (64 code, doc, and quest PRs, plus a re-audit of 50 quest-only PRs) found defects worth tracking. This PR plans them.

New quests

• quest/m0/broadcast-epoch/dynamic-epoch.md [S]: Dynamic.update may change the epoch. The change is a source change downstream under main's Restart rule (announce Restart, subscribers drop the old copy and resubscribe, only an identical epoch splices), without overriding route selection, while the origin's served broadcasts and pending requests carry over. It also fixes the Rust doc, which promises the served broadcasts end (feat(net)!: carry publisher epochs on routes #4942). Requires Restart.
• quest/m1/quic/fork/input-validation.md [XS]: refuse RETIRE_CONNECTION_ID for the first never-issued sequence, and refuse duplicate grease_quic_bit / min_ack_delay parameters. Both come from the quinn import in feat(moq-quic): import quinn-proto as moq-quic #4879; upstream quinn has the same code.
• quest/m2/dash-rendition-uri.md [XS]: percent-encode rendition names in DASH init and media URLs, as HLS already does. The bug predates quest(archive): Timeline-indexed MoQ archives #4034.

Corrections to unreviewed quest PRs

• ts-passthrough.md (quest(m1): plan TS passthrough #4670): a flagged backward PCR discontinuity now restarts under a new epoch, as ts-restart.md decides, instead of starting a group with backward time. ts-restart is now Required. feat(moq-mux): import ts --passthrough carries the multiplex whole #5003 implements the old plan and is held for rework.
• ffi-shape/README.md: restores "MoqGroupRequest gains demand()", which quest: plan the merge-queue settings and today's loose ends #4868 decided and quest: resolve the 2026-10-06 audit #4946 lost when it deleted net.md.
• Auth: malformed-grant.md owns the lite AUTH_OK decode gap, and violations.md drops it. quest-flat-lines.md drops two finished steps.
• archive/flush.md is now Rust only, and the JS idle deadline and flush() move to js-timelines.md, so the Rust fix no longer waits on the JS port.
• capture-default.md is reframed as gate cleanup, since select.sh now runs capture-test.
• Stale facts fixed: p2p grants bind the node id, not the hop id (including the p2p and auth indexes); libmoq 0.6.12; max_delay_us, #checkMaxDelay, and max_delay; location-filter-22 covers the draft-22 wire-equality test; the refactor(net)!: own the poll transport interface #4709 blocker is gone; ?worklet is the precedent; group order is fixed newest first; the nonexistent pool_resolve bench is removed.

Handed to separate sessions

• fix: serve the best audio rendition on single-track egress #4993 (AC-3-only clients get E-AC-3) and quest: plan the lite-07 Live flag that unblocks #5000 #5029 (Next Group Start mapping): fixed in their own PRs.
• moq.pro quests left dangling by quest: resolve the 2026-10-06 audit #4946's deletions: re-planned in moq.pro.
• Archive re-scope (FETCH live only, archives over HTTP served by moq.pro, delete the MoQ replay path): no quest records it yet, so it needs its own /quest-plan. feat(hls)!: bounded playlists: capped window, sync-point gating, explicit replay mode #4978 and quest: plan four follow-ups from the quest-spawn round #5017 have since merged; nothing here touches merged code.

Public API and wire impact: none (quests only).

Decisions

Goal

• Plan quests for merged-code bugs and send open-PR findings back to their PRs
• ✅ Also re-audit the unreviewed quest-only PRs
• Quests only

Findings worth a quest

• ✅ Epoch cache reuse
• ✅ QUIC CID retire bound
• ✅ QUIC duplicate params
• ✅ DASH rendition URIs

Open-PR findings (#4993, #5029)

• ✅ Iterate each PR
• Comment only
• Leave them

Epoch fix

• Fix the epoch at announce
• Honor the rustdoc
• ✅ Other: allow the epoch update; two epochs may share content, so it only invalidates downstream caches

Epoch model

• ✅ Re-key only: carry over served and pending state, and fix the docs and tests
• Re-key and end served

Epoch home

• ✅ m0 broadcast-epoch child
• m1 standalone
• Fold into quest: plan idle fronts, claim-served epochs, and TRACK stream demand #5010

QUIC quest

• ✅ One quest, fork child, not blocking the switch
• One quest, blocks the switch
• Two quests

DASH milestone

• m1 [XS]
• ✅ m2 [XS]

TS restart (#4670)

• ✅ Amend the quest and hold feat(moq-mux): import ts --passthrough carries the multiplex whole #5003
• Amend the quest only
• Keep passthrough

moq.pro dangling links

• ✅ Re-plan in moq.pro
• Restore the contract here
• Skip

Archive root claim

• Test-only claim
• New in-repo quest
• moq.pro owns it
• ✅ Other: drop FETCH for VOD for now; archives go over HTTP and FETCH is live only

Batch fixes

• ✅ Restore GroupRequest demand
• ✅ Fold auth overlap
• ✅ P3 text corrections
• Delete capture-default (not selected, so it is reframed instead)

Archive venue

• ✅ Separate session
• In this PR

Shipped MoQ replay code

• ✅ Delete it
• Freeze it

Archive HTTP server

• moq-hls from the store
• Relay route
• ✅ moq.pro

Open archive PRs (#4978, #5017)

• ✅ Hold for re-plan (moot: both merged before this PR)
• Let them land

Iterate (2026-10-08)

• ✅ Maintainer 2026-10-08: "iterate then merge"
• Merged origin/main after quest: apply the 2026-10-08 quest-tree audit #5043. Main's version kept where both changed the same text (publish-timestamp.md keeps FFI shape as Related and drops the deleted untimed-model Required); the other stale-fact fixes here were not on main and stay.
• dynamic-epoch.md realigned with main's Restart rule: epoch-less routes never splice, an epoch change is announced as a Restart, and downstream subscribers (relays included) drop the old copy and resubscribe.
• Review fixes: dynamic-epoch scoped to this claim's copies, not route selection (OpenAI P3); Rust doc named as the wrong one; hop-to-node rename finished in quest/m3/p2p/README.md and quest/m1/auth/README.md; ts-passthrough.md rewrapped.

(Written by Claude Opus 5.5)

🤖 Generated with Claude Code

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 25 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used all 4 included reviews currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 521d9f89-e281-41ef-9987-2316eb588795

📥 Commits

Reviewing files that changed from the base of the PR and between 1e06fd7 and 10cf955.

📒 Files selected for processing (27)

• quest/m0/broadcast-epoch/README.md
• quest/m0/broadcast-epoch/dynamic-epoch.md
• quest/m0/ietf-location-filter-22.md
• quest/m1/archive/flush.md
• quest/m1/archive/js-timelines.md
• quest/m1/auth/README.md
• quest/m1/auth/malformed-grant.md
• quest/m1/auth/violations.md
• quest/m1/capture-default.md
• quest/m1/ffi-shape/README.md
• quest/m1/ffi-shape/codec.md
• quest/m1/js-startup-hole.md
• quest/m1/libmoq-final-release.md
• quest/m1/perf/demand-aggregate.md
• quest/m1/plan-watch-worker.md
• quest/m1/quest-flat-lines.md
• quest/m1/quic/fork/README.md
• quest/m1/quic/fork/input-validation.md
• quest/m1/route-wakes.md
• quest/m1/track-priority-scope.md
• quest/m1/ts-passthrough.md
• quest/m2/README.md
• quest/m2/dash-rendition-uri.md
• quest/m2/transport-adapter-dedup.md
• quest/m3/p2p/README.md
• quest/m3/p2p/peer-grant.md
• quest/m3/p2p/signal.md

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[kixelated]

Automated review of 4c4ac0b4: MERGE

This is a quests-only PR. I checked its claims against main, and nearly all of them hold: the QUIC gaps (cid_state.rs on_cid_retirement checks sequence > self.issued while issued is a count, and transport_parameters.rs sets grease_quic_bit / min_ack_delay without a duplicate check), the DASH routing example (mpd.rs interpolates the XML-escaped name raw, and Route::parse splits live/video/video/1080p/... into broadcast live/video), PATH_SEGMENT in master.rs, the draft21_and_draft22_match_draft20_on_the_wire test and its "editorial" comment, select.sh running just rs capture-test for moq-video/moq-audio, libmoq 0.6.12 on both main and crates.io, #checkMaxDelay / maxDelay, max_delay_us, the ?worklet import in processor.ts, no pool_resolve bench (only origin/pool_churn), group::Request::demand existing while MoqGroupRequest lacks it, and #4709 having merged. I found no blocking issues.

Non-blocking

1. The hop-to-node rename misses three spots. peer-grant.md and signal.md now say "node-bound", but quest/m3/p2p/README.md:131 still describes Peer grants as "a hop-bound, asymmetrically signed grant", and quest/m1/auth/README.md:19 and :120 still say "Hop-bound peer grants" and "P2P's hop-bound credential". It's worth fixing them in the same pass so the index lines match the quests they link to.
2. dynamic-epoch.md overstates the JS doc. The Plan says "both docs promise the served broadcasts end". The Rust Dynamic::update doc does (rs/moq-net/src/model/origin.rs:3571-3579, "the broadcasts served through the old one end"), but the JS Dynamic.update doc (js/net/src/origin.ts:1603-1607) only says another epoch "names another publisher instance". The quest still works, since it rewrites both docs, but the finding should name the Rust doc as the one that's wrong.
3. dynamic-epoch.md doesn't say what happens when the new epoch ranks below the old one. The Goal says the old epoch's fronts end "with the same hard switch as any newer epoch", and the tests include A to none. Route selection, though, ranks the newest epoch first and none last (js/net/src/origin.ts:225-232). For A to none, or A to an older B, a peer that still holds a route at A while the update propagates would keep preferring A rather than switching. Either state that an update always switches regardless of how the epochs rank, and test it with a second route still at A, or limit the contract to a newer epoch or none.
4. Small nit: the new sentence at quest/m1/ts-passthrough.md:107-108 ("A flagged backward PCR discontinuity publishes two broadcasts...") isn't wrapped like the rest of the file.

CI (Check, Quest, Test) is still queued on this head.

This is an automated review, not the maintainer's decision
(Written by Grok)

[kixelated]

Automated review by review (OpenAI)

Reviewed commit: 4c4ac0b

[P3] Scope the epoch-transition regression to the affected claim (quest/m0/broadcast-epoch/dynamic-epoch.md:5-9,32-35). As the existing discussion notes, A→none or A→an older B does not guarantee that a re-request globally selects B when another route still advertises A: compareRoutes in js/net/src/origin.ts:225-232 prefers the newest epoch and places none last. State the expected behavior with a second A route present, and distinguish invalidating this claim's old cache from overriding normal route selection.

Direction: sound planning cleanup. The checked CID boundary, unescaped DASH rendition path, Rust Dynamic::update doc mismatch, and separation of Rust flush from the JS port support the proposed follow-ups. No additional blocking finding in the changed plans; the epoch acceptance wording above should be clarified rather than left to an implementation guess.

Verification limits: static GitHub review of the 26-file quest diff, discussion and selected implementation paths; no quest checker, QUIC tests, or multi-relay epoch test executed. No duplicate inline thread added.

[kixelated]

Addressed the reviews of 4c4ac0b4 in 10cf9550:

• OpenAI P3 / Grok 3: dynamic-epoch.md now says the update invalidates this claim's old-epoch copies without overriding route selection; with a second route still at A, A to none leaves re-requests on that route, and the test covers it.
• Grok 1: finished the hop-to-node rename in quest/m3/p2p/README.md and quest/m1/auth/README.md.
• Grok 2: the Plan now names the Rust Dynamic::update doc as the one promising served broadcasts end.
• Grok 4: rewrapped ts-passthrough.md.

Also merged main (after #5043) and realigned dynamic-epoch.md with the Restart rule.

(Written by Claude Opus 5.5)

[kixelated]

Automated review by review (OpenAI)

Reviewed commit: 10cf955

The prior P3 is addressed: quest/m0/broadcast-epoch/dynamic-epoch.md:10–14 and 42–48 now separate this claim's cache invalidation from route selection and explicitly retain the competing A route for A→none. The follow-up also correctly identifies the Rust doc mismatch and finishes the node-bound wording in both indexes.

No new actionable findings in the PR-specific changes since 4c4ac0b, after separating the main merge. Direction is sound: the plan now depends on Restart, preserves served/pending state at the origin, and distinguishes retiring downstream copies for new requests from forcibly ending subscriptions. I checked that alignment against the current restart.md contract.

Verification limits: GitHub-only static review of the quest changes, prior discussion and Restart context. No quest checker, implementation tests or multi-relay experiment executed. Check, Test and Quest are still queued on this head.