[kixelated]

Problem

HTTP /announced and /fetch refusals bypass the relay's refusal metrics. Separately, replacing a route whose last group is u64::MAX turns its unbounded end into group 0.

Approach

Count auth failures in the shared HTTP admission path and missing subscribe permission as forbidden. Preserve overflow as an unbounded replacement cap, while an empty replaced copy still ends at group 0 and a reader's narrower bound remains intact. Add deterministic regressions for both fixes and retire the quest.

Rebased onto #5446's per-reader Delivered model: Copy::end now holds the replaced copy's exclusive end, shared by the wire request (Copy::wire) and the unread-group check in Reader::let_go, which had already inlined the same overflow-safe expression.

Impact

• Public API: unchanged.
• Wire: no format or negotiation change; the replaced copy's subscription keeps its correct upper bound.

Alternatives

Counting admission failures at each handler would duplicate the shared admission policy. Capping overflow at zero incorrectly discards the old copy's last group.

Decisions

No consequential decisions. Taking the recommended option unattended:

• Merge conflict: kept both tests and fix(net): hand each group sequence out once per reader #5446's #[cfg(feature = "async")] gates, and changed nothing else in fix(net): hand each group sequence out once per reader #5446's delivery model. ✅ Share one Copy::end helper between wire and let_go. The alternative was two copies of the same expression.

Validation

• cargo test -p moq-net --all-features resume passes: 50 tests, including the new regression.
• The selected-crate nextest run (all crates just check selects, --no-fail-fast): 6,392 passed, 3 failed. The failures were moq-cli::export restart/same-instance tests. All three pass in isolation on main. the_same_instance_within_the_linger_continues also times out 1 in 4 on unmodified main under --stress-count 4. Tracked by quest/m1/ts-same-instance-resume.md.
• auth::refresh::tests::an_outage_refuses_transiently_and_never_extends_the_expiry failed once under just check and passed on rerun. Tracked by quest/m1/test-flakes-2/auth-refresh-mock-time.md.
• just rs _lint -p moq-net -p moq-relay and quest check pass.

Follow-ups

None new. The existing quests above cover the flakes.

(Written by Claude Opus 5.5)

[kixelated]

The two focused regressions are reproduced and fixed. Rust lint/doc checks and quest validation pass. Keep this draft while the existing auth-refresh and same-instance export quests clear the unrelated full-check failures recorded above; no additional design decision is needed for these fixes.

(Written by GPT-6.1)

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 3 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used all 4 included reviews currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 8d405fd9-14f3-4f02-b986-ce3302762862

📥 Commits

Reviewing files that changed from the base of the PR and between 8353a20 and 71f5afd.

📒 Files selected for processing: 5

• quest/m1/README.md
• quest/m1/papercuts-rs.md
• quest/m2/http-fetch-stats.md
• rs/moq-net/src/model/resume.rs
• rs/moq-relay/src/web.rs

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-15T00:55:28.571819Z	71f5afd	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[kixelated]

Iterated and rebased onto #5446.

• Merged main. The only conflict was adjacent tests in resume.rs. Kept fix(net): hand each group sequence out once per reader #5446's async gates and its per-reader Delivered model as they were.
• let_go already carried the overflow-safe end that this PR adds to wire. Both now use one Copy::end helper.
• Validation: the resume tests pass, and just rs _lint and quest check pass. The full selected-crate suite had 6,392 passes. Its only failures were moq-cli::export restart tests and one auth::refresh test. The CLI tests also fail on unmodified main under stress (1 in 4), and existing quests track both flakes.
• Codex: thumbs-up on the final head, with no findings.

(Written by Claude Opus 5.5)