kixelated · Oct 17, 2026 · Oct 16, 2026 · Oct 16, 2026 · Oct 16, 2026 · Oct 16, 2026
diff --git a/doc/bin/cli.md b/doc/bin/cli.md
@@ -330,7 +330,11 @@ moq --cluster-lan --cluster-lan-secret /etc/moq/cluster.key import capture
 MoQ process and `moq-relay` on the LAN, with no other configuration. Without
 `--cluster-lan-secret`, anyone who can reach the listener joins, so leave it
 unset only on networks you trust. `--cluster-connect` is a MoQ side on its own,
-so it needs no `--connect`.
+so it needs no `--connect`. WAN cluster dials (`--cluster-connect`,
+`--cluster-connect-api`) share `--connect-bind` with `--connect`, and each binds
+it, while LAN dials take an ephemeral port. So a fixed `--connect-bind` port with
+both `--connect` and a WAN cluster peer is refused at startup: use port 0, or drop
+`--connect` (unset `MOQ_CONNECT` if it supplies the URL).
 
 ## Auth
 

diff --git a/doc/bin/relay/config.md b/doc/bin/relay/config.md
@@ -95,8 +95,21 @@ fetches = 10000                      # Independent simultaneous FETCH requests.
 announces = 100000
 subscriptions = 10000
 fetches = 10000
+
+[peer.quic]
+max_streams = 100000                 # Concurrent QUIC streams per direction.
+receive_window = 671088640           # Connection-wide receive window (640 MiB).
+send_window = 671088640              # Unacknowledged outgoing data (640 MiB).
 ```
 
+`[peer.quic]` takes only `max_streams`, `receive_window`, and `send_window`;
+any other `[quic]` key is refused. They replace the `[quic]` values for a
+peer's QUIC connection once its grant is known, before the SETUP reply. Links
+the relay dials get them from the handshake on. A link carrying a whole cluster is then
+not throttled by `[quic]` limits sized for one viewer, for example
+`--peer-quic-max-streams=200000`. Peers over WebSocket, TCP, or iroh keep
+their transport's own limits.
+
 These are the defaults. For example, `--peer-subscriptions=50000` raises the
 subscription cap on cluster links. `--session-fetches` and `--peer-fetches`
 set the independent FETCH caps; concurrent callers of the same group each

diff --git a/quest/m1/quic/README.md b/quest/m1/quic/README.md
@@ -69,8 +69,6 @@ cache limits remain separate; bitrate pacing composes with this memory cap.
   tail grace
 - [Schedule datagrams by subscription priority](/quest/m1/quic/datagram-priority.md) -
   datagrams join their subscription's send group instead of preempting every stream
-- [Relay peers get wider limits](/quest/m1/quic/peer-limits.md) - MAX_STREAMS
-  and MAX_DATA are raised after SETUP identifies a cluster peer
 - [A FIN below received data is a final size error](/quest/m1/quic/final-size-below-received.md) - a shrunken final size closes with FINAL_SIZE_ERROR instead of blocking the reader forever
 - [A stateless reset keeps a closed connection's reason](/quest/m1/quic/close-reason-after-reset.md) - a reset after a local transport error neither replaces the reason nor reports a second loss
 - [0-RTT streams adopt a raised stream window](/quest/m1/quic/zero-rtt-window-raise.md) - a server's larger stream window reaches the client's 0-RTT streams, so they no longer stall

diff --git a/quest/m1/quic/peer-limits.md b/quest/m1/quic/peer-limits.md
diff --git a/quest/m1/quic/receive-memory.md b/quest/m1/quic/receive-memory.md
@@ -107,4 +107,3 @@ separate guide quest is needed.
 - [Unbounded groups](/quest/m2/unbounded-groups/README.md) - removes the frame cap; frame payload credit becomes per segment
 - [Scope track priority](/quest/m1/track-priority-scope.md) - broadcast fairness domains and subscription priority semantics
 - [QUIC bitrate caps](/quest/m2/rate-quic.md) - pace credit grants inside the independently bounded memory allowance
-- [Relay peers get wider limits](/quest/m1/quic/peer-limits.md) - client and peer windows must both fit supported units
diff --git a/quest/m2/rate-quic.md b/quest/m2/rate-quic.md
@@ -49,18 +49,20 @@ backpressure the peer cannot ignore, rather than metering and closing.
   window for an uncapped session, paced credit for a capped one. A lowered
   rate (revalidation, a union shrinking) withholds future grants against
   outstanding credit rather than shrinking assembly memory below a legal
-  message. Memory-window reductions retain the shrink-as-debt semantics
-  described in [peer limits](/quest/m1/quic/peer-limits.md). Overshoot is
+  message. Memory-window reductions retain `moq-quic`'s shrink-as-debt
+  semantics. Overshoot is
   bounded by credit outstanding at the change and the test asserts that bound.
 - **Egress: cap the pacer.** The send rate is `min(controller rate, cap)`,
   so a subscriber below the broadcast's bitrate gets MoQ's normal group
   skipping, not a growing queue.
 - **Runtime, per connection.** The cap is known only after auth (the token
   rides the CONNECT URL or arrives in band), so it is set on a live
-  connection and reset on revalidation or a union change. Reuse the runtime
-  limits seam [peer limits](/quest/m1/quic/peer-limits.md) adds
-  (`set_limits(Limits)` on moq-net's transport trait, implemented by the
-  moq-tokio and moq-uring adapters), extended with the two rates.
+  connection and reset on revalidation or a union change. Extend the
+  runtime limits seam the relay widens cluster peers through
+  (`moq_tokio::server::Request::set_quic_limits` and
+  `moq_uring::quic::web::Session::set_limits`, each taking its backend's
+  `quic::Limits`) with the two rates, and reach it from the live session
+  so revalidation can change it after SETUP.
 - **Unions take the highest cap.** When in-band auth unions several grants
   on one session, each direction's cap is the highest among them, and an
   uncapped grant lifts it, matching the union's permissive meaning. Decided
@@ -89,5 +91,4 @@ that a one-second rate window can also be the complete assembly allowance.
 
 ## Required
 
-- [Peer limits](/quest/m1/quic/peer-limits.md) - adds the runtime `set_limits(Limits)` seam and shrink-as-debt behavior this extends
 - [Bound message assembly](/quest/m1/quic/receive-memory.md) - separate retained memory from paced outstanding credit
diff --git a/quest/m2/transport-adapter-dedup.md b/quest/m2/transport-adapter-dedup.md
@@ -27,4 +27,3 @@ Public API: possibly a feature-gated module. Wire: none.
 - [poll_acked on moq-net's send stream](/quest/m2/quic-ack-hook.md) - a backend-specific method the moq-tokio and moq-uring adapters keep
 - [Per-stream deadlines](/quest/m2/quic-deadline.md) - adds `set_deadline`, also kept out of the shared adapter
 - [QUIC caps](/quest/m2/rate-quic.md) - extends `set_limits` with the bitrate caps
-- [Peer limits](/quest/m1/quic/peer-limits.md) - adds the `set_limits` seam
diff --git a/rs/moq-cli/Cargo.toml b/rs/moq-cli/Cargo.toml
@@ -28,7 +28,7 @@ doc = false
 [features]
 default = ["cluster-lan", "quic", "websocket", "nvidia", "s3", "gcs", "azure"]
 # Experimental transport with a heavy dependency tree, enabled only on request.
-iroh = ["moq-tokio/iroh"]
+iroh = ["moq-relay/iroh", "moq-tokio/iroh"]
 # LAN discovery and meshing (`--cluster-lan`).
 cluster-lan = ["moq-relay/cluster-lan"]
 jemalloc = ["moq-tokio/jemalloc"]

diff --git a/rs/moq-cli/src/args.rs b/rs/moq-cli/src/args.rs
@@ -550,6 +550,15 @@ impl MoqSide {
 			self.client.url.is_some() || self.serves() || self.cluster_dials(),
 			"a MoQ side is required: pass --connect <url> to dial a relay, a --listen option to self-host, --cluster-lan to mesh over the LAN, or --cluster-connect to join a cluster"
 		);
+		// The `--connect` client and the cluster's WAN dials each bind
+		// `--connect-bind` for QUIC, so a fixed port would collide halfway through startup.
+		#[cfg(feature = "quic")]
+		anyhow::ensure!(
+			!(self.client.url.is_some()
+				&& self.cluster_dials()
+				&& self.client.bind.is_some_and(|bind| bind.port() != 0)),
+			"--connect-bind with a fixed port cannot serve both --connect and --cluster-connect / --cluster-connect-api, which each bind it: use port 0, or drop --connect (unset MOQ_CONNECT if it supplies the URL)"
+		);
 		#[cfg(feature = "cluster-lan")]
 		{
 			self.cluster.lan.validate()?;
@@ -2315,6 +2324,51 @@ mod tests {
 		parse(&[]).unserved().expect("nothing to refuse");
 	}
 
+	/// `--connect` and a WAN cluster peer each bind `--connect-bind` for QUIC, so a
+	/// fixed port is refused before anything binds; port 0 or either side alone is
+	/// fine, and a build without QUIC binds nothing to collide.
+	#[test]
+	fn a_fixed_connect_bind_serves_one_dialer() {
+		let parse = |flags: &[&str]| {
+			let args = ["moq"].iter().chain(flags).chain(&["import", "ts"]).copied();
+			Invocation::try_parse_from(args).expect("parse")
+		};
+		for peer in [
+			["--cluster-connect", "https://relay.example"],
+			["--cluster-connect-api", "https://api.example/peers"],
+		] {
+			let both = [
+				&["--connect", "https://relay.example", "--connect-bind", "127.0.0.1:4443"][..],
+				&peer,
+			]
+			.concat();
+			let result = parse(&both).moq.validate();
+			if cfg!(feature = "quic") {
+				let err = result.unwrap_err().to_string();
+				assert!(err.contains("--connect-bind") && err.contains(peer[0]), "{err}");
+			} else {
+				result.expect("without QUIC nothing binds the fixed port");
+			}
+
+			let ephemeral = [
+				&["--connect", "https://relay.example", "--connect-bind", "127.0.0.1:0"][..],
+				&peer,
+			]
+			.concat();
+			parse(&ephemeral).moq.validate().expect("an ephemeral bind serves both");
+
+			let cluster_only = [&["--connect-bind", "127.0.0.1:4443"][..], &peer].concat();
+			parse(&cluster_only)
+				.moq
+				.validate()
+				.expect("the cluster alone owns a fixed bind");
+		}
+		parse(&["--connect", "https://relay.example", "--connect-bind", "127.0.0.1:4443"])
+			.moq
+			.validate()
+			.expect("--connect alone owns a fixed bind");
+	}
+
 	/// `--cluster-connect` / `--cluster-connect-api` attach the process as a
 	/// cluster peer, so they are a MoQ side on their own. `--cluster-node` is
 	/// identity, not an attachment.