quest: audit the tree against main (2026-10-20)

bench/ffi-gen/README.md

@@ -217,7 +217,7 @@ and do not translate to BoltFFI's IR.
 | Call overhead | M: JNI or JNA direct mapping for Kotlin ([Kotlin calls](/quest/m2/kt-ffi-calls.md)); L: a C-extension Python backend, not yet planned | done |
 | Zero-copy byte returns | M: [Zero-copy byte returns](/quest/m2/ffi-bytes-return.md) | M: bytes cross its wire buffer, with no borrowed return |
 | Namespaced types | M: [Namespaced external types](/quest/m2/uniffi-namespaces.md) | M: same-name types collide (RFC #700, open) |
-| Poll-native async | M: [Poll-native async](/quest/m2/ffi-poll.md) | M: the same poll-plus-continuation model, with per-method poll exports |
+| Poll-native async | M: [Poll-native async](/quest/m2/ffi-poll-migrate.md) | M: the same poll-plus-continuation model, with per-method poll exports |
 | Binding moq-ffi as written | none | M: drop `Arc` returns, rework wasm gating, and fix the gaps above |
 
 Either way the fork owns a large codebase. BoltFFI's is about 134k lines, written mostly

quest/README.md

@@ -7,9 +7,10 @@ grouped into milestones ordered by priority.
 
 ## Plan
 
-m0 holds urgent fixes and release-line maintenance. m1 is the finite next
-breaking release: clustering stability first, the in-tree QUIC stack, and
-planned public API and format breaks with their correctness and validation.
+m0 holds urgent fixes and release-line maintenance. m1 is everything that
+lands before the next cut of `main` into `release`, breaking or not:
+clustering stability first, the in-tree QUIC stack, and planned public API and
+format breaks with their correctness and validation.
 m2 holds independently shippable capabilities and optimizations, plus the
 publication and adoption steps that follow m1. m3 holds external conditions
 and speculative work. A milestone is a priority horizon; m0 maintenance does
@@ -18,8 +19,9 @@ not make unrelated infrastructure a gate for the main-to-release cut.
 Milestones shift up after each major release (decided 2026-10-19): m0 is the
 current release line, m1 the next major, m2 the one after, and m3 stays the
 deferred bucket. The [release cut](/quest/m2/release/cut.md) recurs and
-performs the shift, and the hygiene audits at the end of m0 recur once per
-release behind it.
+performs the shift. The hygiene audits at the end of each milestone recur
+once per major release: each run adds its successor to the end of the next
+milestone.
 
 The [release execution](/quest/m2/release/README.md) starts after m1 is ready.
 It publishes artifacts before downstream adoption and rollout can complete.
@@ -28,6 +30,6 @@ Critical fixes continue to reach the existing release through backports.
 ## Required
 
 - [m0: immediate priorities](/quest/m0/README.md) - urgent correctness fixes and maintenance of the current release
-- [m1: next wave](/quest/m1/README.md) - the agreed next breaking cut, with its required correctness and validation
+- [m1: next wave](/quest/m1/README.md) - everything before the next release cut, breaking or not, with its required correctness and validation
 - [m2: later work](/quest/m2/README.md) - release execution first, then deferred features, optimization, and design studies
 - [m3: deferred](/quest/m3/README.md) - gated on the outside world (hardware, a partner, a consumer, a provider's offer, or an upstream release), or speculative with no named consumer

quest/m0/README.md

@@ -23,58 +23,13 @@ serve instead of enumerating broadcasts. Serving the relay's ingested-only
 view (`origin::Consumer::local()`) to localhost workers belongs to moq.pro's
 edge, which embeds moq-relay; it moved there on 2026-09-28.
 
-Interop: Fastly's moq-relay-interop report (run of 2026-09-23, build
-7ee2b02) was triaged against `main` on 2026-10-07. Its SETUP, UNSUBSCRIBE
-and error-code items were already fixed. Fastly's reruns that day found
-that a relay moves End of Track's Location and refuses imquic's End of
-Group status. The fixes below LOCATION_FILTER come from them and go ahead
-of Seattle. The cold-relay Largest stays compliant with INVALID_RANGE
-(decided 2026-10-08), and the deviations doc landed in #5022.
-An imquic draft-22 rig (2026-10-08) hit LOCATION_FILTER and a clear
-FIRST_OBJECT at object 0 (#5027). Both shipped with moq-noq 1.3.5 in
-moq-relay 0.17.3 and `@moq/net` 0.4.3.
-
 Identity: the [broadcast epoch](/quest/m0/broadcast-epoch/README.md) line
 gates the next release (decided 2026-10-03:
 #4741 resumes an un-epoched republish into the old broadcast and stalls its
 viewers). #4741 can merge to main, but no release ships until first-party
 publishers mint epochs. Backport patches cut from `release` don't carry
 #4741 and aren't gated (decided 2026-10-08).
 
-Liveness: a serve loop with work always ready never yields, which starved
-an FFI publisher's QUIC driver and fails hosted Interop's go lanes (found
-2026-10-08 landing #4225). The publish serve loops now yield through a
-`kio::coop::Budget`. The Go and Python interop cells it fails
-moved here from m1 the same day, because the stall masks interop on every
-wire PR and hides as slow passes; the harness now fails a cell whose
-connection idles out.
-
-Audio playout: the jitter target is default in both languages (#4162); the
-[line](/quest/m1/audio-jitter-target/README.md) moved to m1 in the
-2026-10-08 audit, since only a manual browser proof and a native trace replay
-remain and the release only requires the production clock and playback contracts
-that depend on them.
-
-Interop on main (2026-10-13): the cross-client matrix failed with `unroutable`
-whenever WebSocket won the connect race: since #5294, #4180's upgrade
-retired epochless handles before its held `Restart` reached anyone. Handles
-now retire only once it is deliverable. First-party consumers following it
-moved to m1 (maintainer, 2026-10-13), since the upgrade is removed.
-
-Crashes (2026-10-13, #5407): a publisher on a host whose wall clock reads
-before 2020 panics, and `panic = "abort"` turned any library panic into a
-dead host app. Both joined m0 (maintainer) and are fixed: the clock at its
-source, and unwinding so a panic closes only its connection.
-
-Nightly on main (triaged 2026-10-13): two build breaks from 2026-10-11 get
-quests here. The nixpkgs bump broke the Linux zigbuild release builds (its
-GCC 16 miscompiles lld 21; fixed by bumping nixpkgs past the upstream fix),
-and fat LTO in the release profile broke the fuzz build. Audio quality has been
-red since it landed, against budgets recorded locally; re-measuring them on
-the runner moved here from Watch (maintainer, 2026-10-13). The other red jobs
-have fixes on `main`: macOS tests (#5335), drill-sensitivity (#5338), loom
-(#5389) and Windows tests (#5339).
-
 Flakes (2026-10-20, maintainer): the redundant failover drift moved here from
 the m1 [load round](/quest/m1/test-flakes-2/README.md). It fails loaded
 `just check` runs, the local gate every merge waits on, and may hide a TS
@@ -87,14 +42,13 @@ Each lands its fixes in its own PR and plans only what needs a decision.
 
 ## Required
 
-- [CI cost and latency](/quest/m0/ci/README.md) - cloud CI runs only in the merge queue as one `just ci` pass, expensive checks run nightly and gate `release`, caches move to R2, and runners are chosen last
+- [Broadcast epochs](/quest/m0/broadcast-epoch/README.md) - every first-party publisher that can restart mints a fresh route epoch, the newest wins a path, and only routes with the same epoch resume a subscription
 - [Redundant failover drift](/quest/m0/redundant-failover-drift.md) - a stitching TS export switches back to the surviving importer behind bufferbloat instead of failing on a stalled clock
 - [qmux 0.5.3](/quest/m0/qmux-0.5.3.md) - crates.io publishes qmux 0.5.3 with the builder session config the release backport of #5609 needs
 - [Release shutdown backport](/quest/m0/ffi-shutdown-backport.md) - `release` publishes a non-breaking moq-ffi with an async `drain()` and qmux sessions on the QUIC stream limit
 - [Release fixed delay](/quest/m0/release-fixed-delay.md) - a fixed latency on `release`, which moq.dev runs, ignores the catalog's jitter and delay as `main` already does
 - [Publisher stall estimate](/quest/m0/publish-stall-estimate.md) - a live browser publish holds its viewers at the Auto target instead of ratcheting their buffer up with every stall
-- [Broadcast epochs](/quest/m0/broadcast-epoch/README.md) - every first-party publisher that can restart mints a fresh route epoch, the newest wins a path, and only routes with the same epoch resume a subscription
+- [CI cost and latency](/quest/m0/ci/README.md) - cloud CI runs only in the merge queue as one `just ci` pass, expensive checks run nightly and gate `release`, caches move to R2, and runners are chosen last
 - [Simplification audit](/quest/m0/audit-simplify.md) - overbuilt code and APIs are collapsed, merged, or narrowed into a net simpler whole
 - [Lint override and deprecation audit](/quest/m0/audit-lints.md) - every lint suppression is still needed and says why, nothing calls a deprecated API, and stale Rust overrides fail the build
-- [Quest tree audit](/quest/m0/audit-quests.md) - the tree agrees with itself and with main
 - [Interop audit](/quest/m0/audit-interop.md) - our interop runner entries match what we ship, and every red interop cell with a moq.dev side is fixed, reported, or noted as down

quest/m0/broadcast-epoch/reference-announcements.md

@@ -22,6 +22,9 @@ text; this quest owns the following behavior it left out.
   today, as `failed_binding_does_not_retry_a_later_publisher` asserts; that
   changes. The "no retarget" rule applies only to readers that follow no
   announcement.
+  Decided 2026-10-20 (maintainer): this quest owns `Source::follow` and
+  [sink restart follow](/quest/m1/sink-restart-follow.md) reuses it, so
+  no reader hand-rolls its own follow loop.
 - `moqsrc`: Start binds the rendition, End idles its pad, and Restart
   restarts its pump.
 - Exporters: a late first announcement starts the rendition and End ends
@@ -46,3 +49,4 @@ epoch, and concurrent old/new consumers, in the moq-mux unit tests and the
 
 - [Sink restart follow](/quest/m1/sink-restart-follow.md) - exporters and sinks that follow an epochless Restart of their own broadcast
 - [Export rendition rebind](/quest/m1/export-rendition-rebind.md) - exporters rebuild a rendition whose reference changes
+- [Hang contribution references](/quest/m2/contribution-ref.md) - builds its lazy contribution entries on these reference rules

quest/m0/ci/README.md

@@ -79,6 +79,6 @@ The historical samples locate candidates; they are not controlled benchmarks.
 - [Pin Quest's gate](/quest/m0/ci/quest-gate-pin.md) - make shared command admission available
 - [Share local check capacity](/quest/m0/ci/local-gate.md) - gate expensive phases and bound internal fanout
 - [Verify the R2 Rust cache](/quest/m0/ci/mbx-r2-verify.md) - condition: the maintainer bootstrap; then measure hits, restore time, and expiry
-- [Verify the Nix cache](/quest/m0/ci/nix-cache-verify.md) - condition: the `nix.moq.dev` PR merges; then confirm CI and releases use it and retire Cachix
+- [Verify the Nix cache](/quest/m0/ci/nix-cache-verify.md) - confirm CI and releases use `nix.moq.dev` and retire Cachix
 - [First shared FFI release](/quest/m0/ci/nightly-ffi-reuse.md) - condition: the first `moq-ffi-v*` tag that runs `Release FFI`, and a `Shipping sizes` run; verify the wrappers and size keys
 - [Faster runners](/quest/m0/ci/runners.md) - pick hosted, Blacksmith or the NixOS desktop from measurements of the optimized queue

quest/m0/ci/nix-cache-verify.md

@@ -2,8 +2,14 @@
 
 ## Goal
 
-Condition: the PR that wired `nix.moq.dev` into CI has merged. The maintainer
-ran the bootstrap in `infra/README.md` on 2026-10-19 and 2026-10-20 (the
+`nix.moq.dev` serves CI and releases: Nix jobs substitute the dev shell
+instead of building it, release tags substitute on a clean machine, its
+bucket sizes hold under the 30-day expiry, and Cachix is retired.
+
+## Plan
+
+[#5693](https://github.com/moq-dev/moq/pull/5693) wired `nix.moq.dev` into
+CI. The maintainer ran the bootstrap in `infra/README.md` on 2026-10-19 and 2026-10-20 (the
 release tag ruleset, both buckets and the Worker, the `cache-write`
 Environment's tag policies and secrets, and the signing key). Check it with
 `curl https://nix.moq.dev/nix-cache-info` and