quest(m1): reconcile the outstanding quest tree

quest/m1/README.md

@@ -124,7 +124,6 @@ lite-07 stream type here.
 - [Artifact size audit](/quest/m1/audit-size.md) - binary, FFI, WASM, and bundle growth since the m0 run is explained, fixed, or planned
 - [Compile time audit](/quest/m1/audit-compile-time.md) - build-time hotspots are measured against the m0 baselines and the worst are fixed or planned
 - [Performance audit](/quest/m1/audit-perf.md) - benchmarks that regressed since the m0 run are explained, fixed, or planned, and unbenched hot paths get coverage
-- [Quest tree audit](/quest/m1/audit-quests.md) - the tree agrees with itself and with main
 
 ## Related
 

quest/m1/audit-size.md

@@ -25,9 +25,11 @@ the quests below. The run finishes after
 before the breaking cut sees its result and the rest of m1.
 
 What to check first: whether the nightly `sizes` job (`sh/size/`) has run.
-It needs the Linux release builds, which still fail to link
-([moq-dev/moq#6090](https://github.com/moq-dev/moq/pull/6090) was open on
-2026-10-21). If it has, its history replaces the local method below. Then
+The Linux release-link fix
+[moq-dev/moq#6090](https://github.com/moq-dev/moq/pull/6090) merged on
+2026-10-22 UTC; verify the first scheduled Nightly after it before treating
+the sizes history as available. Once it runs, its history replaces the local
+method below. Then
 re-attribute the native rows for the erasure quest, and measure `@moq/net`
 with the track compression codec in `js/net`.
 

quest/m1/c/README.md

@@ -53,9 +53,13 @@ That change owns its C tests and `MIGRATE.md` entries; other API reshaping stays
 Decided 2026-10-20 (maintainer): m1 quests that change the C API
 ([exact binding timestamps](/quest/m1/binding-timestamps.md),
 [scope track priority](/quest/m1/track-priority-scope.md),
-[Rust identity enforcement](/quest/m1/catalog-identity-rs.md), and
-[dynamic subscribe ranges](/quest/m1/subscribe-ranges/dynamic.md)) Require this
+and [Rust identity enforcement](/quest/m1/catalog-identity-rs.md)) Require this
 line and land their C half on the generated package, so C users break once.
+[Dynamic subscribe ranges](/quest/m1/subscribe-ranges/dynamic.md) is the
+settled exception from its later plan in
+[moq-dev/moq#6123](https://github.com/moq-dev/moq/pull/6123): if generation
+has not landed, the frozen C crate splits fills into its existing per-group
+requests internally and keeps its ABI, so that quest does not wait here.
 
 ## Required
 

quest/m1/lazy-discovery/README.md

@@ -30,8 +30,11 @@ Shared rules for the children:
 - A pattern watch requests its literal head (`room/*/chat` watches `room/`;
   `**` watches the root), the rule `interests()` uses today; the origin
   filters locally.
-- When the last watcher of a prefix leaves, its request lingers for the
-  connection's existing `linger` (default 2s) before closing. No new option.
+- When the last watcher of a prefix leaves, its request lingers for a fixed
+  2s before closing, matching `LINGER` in `js/net/src/connection/forward.ts`
+  and the Rust child's plan. This discovery linger is separate from the
+  configurable shared-connection linger; one-shot sessions have no such
+  option. No new option.
 - A plain JS `request(path)` stays blind: it opens no announce request and
   subscribes at once. Rust has no blind requests or answers (decided
   2026-10-20, recorded in [the Rust child](/quest/m1/lazy-discovery/rust.md)).

quest/m1/test-flakes-2/README.md

@@ -47,7 +47,7 @@ Public API: none. Wire: none.
 
 ## Required
 
-- [OBS drain and JS allocation flakes](/quest/m1/test-flakes-2/three-flakes.md) - reproduce the OBS stop-drain failure and verify the existing RSS replacement under load
+- [OBS drain under load](/quest/m1/test-flakes-2/three-flakes.md) - verify the existing close-tail fix against the reproduced OBS stop-drain failure; the merged JS allocation replacement passed under load
 
 ## Related
 

quest/m1/test-flakes-2/three-flakes.md

@@ -1,28 +1,33 @@
-# [XS] OBS drain and JS allocation flakes
+# [XS] OBS drain holds up under load
 
 ## Goal
 
-Each passes reliably under a loaded `just check`, fixed at its cause:
-
-- OBS "stop drains the session" (`cpp/obs/test/moq-output-test.cpp`, a
-  16 MiB frame under TSan), seen in
-  [moq-dev/moq#6131](https://github.com/moq-dev/moq/pull/6131) and
-  [moq-dev/moq#6137](https://github.com/moq-dev/moq/pull/6137).
-- The js/net RSS memory test, which flakes under load
-  ([moq-dev/moq#6128](https://github.com/moq-dev/moq/pull/6128)).
+OBS "stop drains the session" (`cpp/obs/test/moq-output-test.cpp`, a
+16 MiB frame under TSan) passes reliably under a loaded `just check`, fixed
+at its cause. Seen in
+[moq-dev/moq#6131](https://github.com/moq-dev/moq/pull/6131) and
+[moq-dev/moq#6137](https://github.com/moq-dev/moq/pull/6137).
 
 ## Plan
 
 Reproduce before fixing, with no retries, sleeps, or raised timeouts.
-The unchanged OBS suite passed both a full TSan run and an output-only TSan
-run pinned to one CPU on 2026-10-21. Its artificial 16 MiB frame competes
-with the session's intentional one-second drain deadline, but a local
-failure has not yet established the right regression. Keep the lifecycle
-assertions when separating that contract from throughput.
-
-[moq-dev/moq#6188](https://github.com/moq-dev/moq/pull/6188) owns the RSS
-replacement: bounded algorithm assertions rather than process RSS. Do not
-duplicate it; verify its merged result under load.
+On 2026-10-22 UTC, the unchanged full OBS TSan suite on main
+`e0cde150d75fe6c00e18efcbfea773e3770f1a5d` failed the `ended` and final
+timestamp assertions (`moq-output-test.cpp:665-666`) at natural load 35-42
+on 24 CPUs. A temporary clean merge of
+[moq-dev/moq#5762](https://github.com/moq-dev/moq/pull/5762), head
+`f2e52db684f7c2cca6162bd417819820297815b5`, made the unchanged full suite
+pass. Baseline repeats also passed: this covers a reproduced failure,
+not proof that every historical flake has the same cause. That PR owns the
+close-tail drain fix; verify its merged result under load before closing
+this quest. Keep the lifecycle assertions rather than weakening them around
+throughput. `just obs test` is the repository entry point; exact original
+shell invocations were not retained.
+
+The JS obligation is complete: the loaded js/net suite passed all 2,493
+tests, including the bounded Path assertions merged in
+[moq-dev/moq#6188](https://github.com/moq-dev/moq/pull/6188). No RSS-based
+assertion remains to replace here.
 
 The original audio-quality RTT and fresh-worktree interop conditions are
 implemented: the sampler observes PROBE while sampling, and the interop

quest/m2/README.md

@@ -202,3 +202,5 @@ ranked just below deterministic TS legs, which it requires.
 - [Test coverage audit](/quest/m2/audit-test-coverage.md) - repeat the coverage audit against the m1 baselines after the next release ships
 - [Documentation audit](/quest/m2/audit-docs.md) - repeat the docs audit after the release ships, against the m1 baselines
 - [Test cost audit](/quest/m2/audit-test-cost.md) - the slowest, flakiest, and least valuable tests are fixed, deleted, or planned once the release ships
+
+- [Quest tree audit](/quest/m2/audit-quests.md) - repeat the whole-tree audit after the release ships, against the m1 baseline

quest/m2/audit-docs.md

@@ -62,8 +62,9 @@ freshest. Baselines:
   property `doc/bin/gstreamer.md` names.
 - Cross-Package Sync: walked from `9b90cdd569` through `7d2a91fe66`. Walk the
   next run from there. Go has no `Client` failure accessor because `Dial`
-  returns only once connected; the maintainer chose to leave that until a Go
-  caller needs it, so it is not a gap.
+  returns only once connected. The newer 2026-10-21 maintainer decision
+  plans that gap in [Go first-dial failure](/quest/m2/go-first-dial-failure.md);
+  verify its accessor and the Kotlin/Dart wording when that quest lands.
 
 ## Required
 

quest/m2/audit-quests.md

@@ -0,0 +1,73 @@
+# [M] Quest tree audit
+
+## Goal
+
+The quest tree agrees with itself and with `main`: done, stale,
+conflicting, and misranked quests are fixed.
+
+## Plan
+
+Recurs once per major release (decided 2026-10-19). The PR that finishes
+this run also adds the next one with the same file name at the end of the next
+milestone's `Required` (m0 to m1, m1 to m2). The successor keeps the Goal
+and this paragraph; the rest of its Plan is rewritten with what this run
+learned: baselines, results, and what to check first. A successor placed in m2
+also lists the [release cut](/quest/m2/release/cut.md) under `Required`, so it
+waits for the release in flight to ship. Only `/quest-delete` ends the
+recurrence. Fixes land in the run's PR, one commit each, rather than as follow-ups.
+Only a change that needs a maintainer decision (public API, scope) or is
+independently landable and too large to review alongside the rest becomes a
+follow-up through `/quest-plan`.
+
+Run `/quest-audit` after the release cut. Read every outstanding quest with
+parallel auditors, then verify source claims, active PR ownership, Required
+ordering, and the latest maintainer decisions before changing plans.
+
+Baseline from the m1 run, 2026-10-22 UTC, against `main` at `bce217e063`:
+
+- Read all 463 quest documents across m0-m3 and the root with parallel
+  read-only support. Checked 315 referenced GitHub items and the open-PR
+  inventory. Source checks were targeted to the factual claims; hardware
+  and deployment acceptance was not inferred from old inventory text.
+- Fixed timestamp provenance's rank before its IETF passthrough consumer,
+  the generated-C exception for dynamic range fills, discovery's fixed 2s
+  linger, and replacement linger's existing-reader semantics.
+- Carried m1's settled compression migration into deferred plans: one
+  compressed catalog/stats track, ordinary tracks for opaque bytes, no
+  moq-flate or `moq-mux::binary` helper, authenticated logical compression
+  in the e2ee wrapper, and bounded prefix reconstruction for front eviction.
+- Refreshed partly landed benchmark/report baselines and explicit
+  prerequisites for the JS encrypted-wrapper mirror and fMP4 ambisonics.
+- The JS allocation replacement passed all 2,493 js/net tests under load.
+  The OBS drain failure reproduced on unchanged main and passed with the
+  existing close-tail PR; its quest keeps the remaining merged-result proof.
+- No m2 implementation quest was started, no external-organization report
+  was posted, and ambiguous remote claim branches were left intact.
+
+Check first next run:
+
+- A moved quest can still be owned by a PR under its old branch name. The
+  redundant failover quest moved to m0 while
+  [moq-dev/moq#6113](https://github.com/moq-dev/moq/pull/6113) retained its
+  m1 branch. Search PR titles, bodies, and source scope as well as exact
+  branch names before taking a claim. Do not infer abandonment from age.
+- Refresh all linked open PRs before changing ownership or deleting a
+  quest. At this baseline, the TRACK_STATUS retirement, silent-peer
+  retirement, audio conformance, CI audit, and local gate each had owners;
+  an overlapping cleanup should finish through that PR.
+- Confirm the first scheduled size report after the Linux release-link
+  fix, the required count of post-change audio-budget nights, shared FFI
+  publication, and release-gate availability. Partial evidence does not
+  clear an external-condition quest. Safari WebKit bug 319818 was still
+  NEW with no fixed shipping version established.
+- Recheck local gate and binding-cost plans together: Bun `--no-orphans`
+  reaps newly spawned local descendants even after successful completion,
+  while the CI bypass preserves persistent queue daemons. A warm local
+  daemon policy needs an explicit choice; no dependency edge was invented.
+- Re-run the transitive Required rank check, including prerequisites added
+  within an epic, and compare plans against replaced designs before looking
+  for new implementation work.
+
+## Required
+
+- [Release cut](/quest/m2/release/cut.md) - the release in flight ships before this run starts

quest/m2/audit-test-cost.md

@@ -56,19 +56,22 @@ Check first:
   105 to 113 s at 8 threads (about 185% CPU), 60 s at 16 (315%), 47 s at 24
   (420%), and 41 s at 32 (500%): the suite needs about 200 CPU-seconds, and
   most slots wait on sockets, subprocesses, and wall-clock timeouts.
-  Oversubscribing the queue job is a maintainer decision, since it loads
-  every timing-sensitive test and a flake ejects a queue entry. Only the
-  known redundant-importer flake failed, once, at 16 threads.
-- moq-gst: about ten tests per run each pay 3 s, at random. `stop` closes the
-  client, which waits out the draining period (three PTOs at the 333 ms
-  initial RTT) of a dial to the tests' unreachable relay that never got an
-  answer. A user stopping a pipeline whose relay is down waits the same. Ask
-  whether moq-quic may skip draining for a connection that never heard from
-  its peer.
+  The maintainer selected 24 threads for the queue in
+  [CI housekeeping](/quest/m1/ci-housekeeping.md), which owns the loaded
+  proof before applying it. Only the known redundant-importer flake failed,
+  once, at 16 threads in this baseline.
+- moq-gst's unanswered-dial close wait was fixed by
+  [moq-dev/moq#6201](https://github.com/moq-dev/moq/pull/6201): the close
+  stops counting an unanswered handshake as active immediately while the
+  closing period still answers late packets. Do not repeat the old request
+  to skip draining. [moq-dev/moq#6240](https://github.com/moq-dev/moq/pull/6240)
+  proposes retiring the silent-peer quest as complete.
 - moq-uring: three endpoint tests wait out moq-quic's fixed 10 s handshake
   idle timeout (30 s together). Neither moq-uring's `Transport` nor
-  `--quic-idle-timeout` sets it; ask whether the configured idle timeout
-  should bound the handshake too (public API).
+  `--quic-idle-timeout` sets it. #6201 does not change that timeout. The
+  [retirement proposal](https://github.com/moq-dev/moq/pull/6240) records
+  keeping it separate with no new knob; follow its maintainer decision
+  rather than independently selecting another API in a cost audit.
 - CPU-bound simulations in a debug build: five TS export timing cases (3 to
   11 s each) and the jitter buffer's day of drift (6 to 13 s), whose `Steer`
   rebuilds the hull and median over its whole window on every step.

quest/m2/bench-sources.md

@@ -14,9 +14,10 @@ benchmark's JSON and the "Rust benchmark tests", "Rust bench targets" and "JS
 benchmarks" nightly jobs, converted to the history input format where they
 don't already emit one.
 
-- Most Rust Criterion targets run with `-- --test`, which measures nothing.
-  Switch the charted targets to a measuring mode (or add a measurement pass),
-  weighing the added nightly runtime.
+- Criterion targets now measure through `just gh criterion` in
+  `sh/gh/nightly.sh` (`rust-bench`, `rust-extra`, `rust-uring`), and the
+  comparison harness uses quick mode. Check their published histories
+  rather than converting them again; the unreported sources below remain.
 - The "Rust benchmark tests" job is not recorded yet: its nextest benchmarks
   print no structured measurements.
 - Check each JS bench reports a measurement before recording it.

quest/m2/carla-bridge.md

@@ -59,4 +59,4 @@ probe opens the camera's own backend with a CPU picture.
 
 ## Related
 
-- [GPU CI](/quest/m2/gpu-ci.md) - runs the NVIDIA half nightly
+- [GPU CI](/quest/m2/gpu-ci.md) - gates NVIDIA correctness on hardware in the merge queue

quest/m2/e2ee/README.md

@@ -35,7 +35,7 @@ The Rust and TypeScript cores expose the same surface, and nothing else:
 - A core produces only under an epoch it minted itself (decided 2026-10-08). Only `credential.produce()` mints a producing generation, and it takes no epoch: it mints a fresh UUIDv7 and returns a `generation::Producer` owning `epoch()` for the route and `name(semantic)` for opaque track names. `credential.consume(epoch)` binds a discovered epoch as a consume-only `generation::Consumer` with `name(semantic)`. The two are separate types, so producing under a discovered or shared epoch does not compile (names decided 2026-10-11 in [#5313](https://github.com/moq-dev/moq/pull/5313)). Clones of a producing generation share publisher claims so reopening a track cannot reset its nonce counters.
 - Applications only handle semantic track names (maintainer, 2026-10-17). `broadcast::Producer` wraps a `moq-net` broadcast under a producing generation and `broadcast::Consumer` wraps one under a consuming generation; each derives the physical name, so only the CDN sees physical names. `generation` no longer opens tracks itself. The broadcast wrappers merged in [#5876](https://github.com/moq-dev/moq/pull/5876).
 - The wrappers implement the [moq-net traits](/quest/m2/net-wrap/README.md) at the broadcast, track, group, and frame levels, datagrams included (decided 2026-10-20, maintainer, because one encrypted broadcast then works with every writer and reader). moq-mux, moq-json, hang, and the CLI publish and consume an encrypted broadcast unchanged, under semantic names, and every AEAD call still has the canonical physical name and transport identity. The e2ee mux bridge ([#5822](https://github.com/moq-dev/moq/pull/5822)) is closed and superseded.
-- Errors are the draft's typed codes plus the transport's. Nothing catalog-, hang-, or MSF-shaped lives here: a catalog is a track under a derived name, and compression is the catalog owner's job.
+- Errors are the draft's typed codes plus the transport's. Nothing catalog-, hang-, or MSF-shaped lives here: a catalog is a track under a derived name. The catalog owner sets logical `track::Info.compress`; the [e2ee wrapper](/quest/m2/net-wrap/e2ee.md) compresses before AEAD and authenticates the logical compression metadata.
 - Stateless `seal`/`open` primitives with caller-chosen identities, HKDF labels and info builders, raw key bytes, and process-global claims are not public. The vectors are tested inside each core.
 
 ### Application and platform shape