quest: audit the tree and record the 2026-10-25 decisions

quest/m0/README.md

@@ -2,8 +2,8 @@
 
 ## Goal
 
-The work in flight now: fixes for the `release` line, CI cost, and the
-recurring audits.
+The work in flight now: a passing Nightly, fixes for the `release` line, the
+quest merge driver, and CI cost and latency.
 
 ## Plan
 
@@ -18,11 +18,6 @@ serve instead of enumerating broadcasts. Serving the relay's ingested-only
 view (`origin::Consumer::local()`) to localhost workers belongs to moq.pro's
 edge, which embeds moq-relay; it moved there on 2026-09-28.
 
-Hygiene (decided 2026-10-19): the audits sit at the end of this list.
-Each recurs once per major release: its PR adds the next run to the following
-milestone, gated from m2 onward on the [release cut](/quest/m2/release/cut.md).
-Each lands its fixes in its own PR and plans only what needs a decision.
-
 ## Required
 
 - [Nightly passes on main](/quest/m0/nightly/README.md) - the scheduled Nightly passes end to end, so red means a new break

quest/m0/ci/README.md

@@ -84,7 +84,8 @@ feature permutations and release-profile builds. Expensive and optional checks
 run nightly on `main` and are required on `release`. Faster runners come last,
 chosen from measurements of the optimized pipeline. Each CI pass costs twice
 per merged PR today (PR and queue), at 13 minutes median and 26 minutes p90 of
-wall time per PR run.
+wall time per PR run. Superseded in part 2026-10-24: the PR gate checks
+feature shapes for the crates a branch changes; Nightly keeps the full matrix.
 
 Decided 2026-10-25 (maintainer): across moq's many CI and release builds
 (targets, features, FFI languages, Nix packages), each crate configuration

quest/m0/ci/nix-cache-verify.md

@@ -14,15 +14,12 @@ release tag ruleset, both buckets and the Worker, the `cache-write`
 Environment's tag policies and secrets, and the signing key). Check it with
 `curl https://nix.moq.dev/nix-cache-info`.
 
-Decided 2026-10-22 (maintainer):
-[#6040](https://github.com/moq-dev/moq/pull/6040) deleted `cache.yml`, so
-nothing pushes the dev shell to `nix.moq.dev`; only `release-nix.yml` pushes,
-on release tags. First measure one hosted Nightly job's dev-shell entry time,
-no earlier than 2026-11-20: `cache.yml`'s last push to `nix.moq.dev` ran
-2026-10-20, and those paths serve a warm entry until the 30-day expiry
-removes them. If it still compiles `uniffi-bindgen-go`, `uniffi-bindgen-cpp` and `quest`
-(the 12-14 minute baseline below), restore a dev-shell push. Otherwise this
-narrows to release-tag substitution and Cachix retirement.
+[#6588](https://github.com/moq-dev/moq/pull/6588) restored `cache.yml`
+after [#6040](https://github.com/moq-dev/moq/pull/6040) deleted it: every
+merge to `main` pushes the dev shell's build closure for x86 Linux, ARM Linux,
+and ARM macOS to `nix-ci-moq-dev` (`sh/gh/cache.sh`), and `release-nix.yml`
+pushes on release tags. So the dev-shell entry time can be measured on any
+scheduled Nightly now, and the expiry check below applies.
 
 Then confirm it, and record the numbers in the PR that closes this:
 

quest/m0/nightly/README.md

@@ -25,14 +25,14 @@ This README's own work, after the children:
   [audio jitter target](/quest/m1/audio-jitter-target/README.md), the
   macOS `receive_credit` timeout to
   [test flakes](/quest/m1/test-flakes-2/README.md), and the paired bench
-  threshold to [bench CI](/quest/m1/bench-ci.md). The `cli-export`
-  bufferbloat failure is expected to clear with
-  [moq-dev/moq#6656](https://github.com/moq-dev/moq/pull/6656).
+  threshold to [bench CI](/quest/m1/bench-ci.md).
 
 Public API: none. Wire: none.
 
 ## Required
 
+- [moq-net compiles in Fuzz and send-depth](/quest/m0/nightly/send-overflow.md) - the ietf publisher future stops overflowing the Send check
+- [The Python sdist builds](/quest/m0/nightly/py-sdist.md) - the sdist carries every workspace crate moq-ffi needs
 - [OBS audio-candidate test](/quest/m0/nightly/obs-audio-candidate.md) - the failed audio candidate check passes under TSan and load, fixed at its reproduced cause
 - [moq-net builds without async](/quest/m0/nightly/net-async-free.md) - the no-default-features lane stops pulling `async` back in
 - [Feature shapes per crate](/quest/m0/nightly/hls-poll-closed-gate.md) - moq-hls `Broadcaster::poll_closed` is gated on `server`, and the gate checks each crate's feature shapes in isolation

quest/m0/nightly/py-sdist.md

@@ -0,0 +1,17 @@
+# [XS] The Python sdist builds
+
+## Goal
+
+Nightly's Release Py FFI "Build sdist" job builds and installs the moq-ffi
+sdist.
+
+## Plan
+
+Nightly [40192013303](https://github.com/moq-dev/moq/actions/runs/40192013303)
+fails in maturin's `cargo metadata`: the sdist lacks
+`rs/moq-ice/Cargo.toml`, which `moq-tokio` depends on since moq-ice was split
+out. `pyproject.toml` lists the extra sdist paths by hand. Fix it so a new
+workspace dependency cannot drop out of the sdist again, and keep the sdist
+build in a lane that runs before release.
+
+Public API: none. Wire: none.

quest/m0/nightly/send-overflow.md

@@ -0,0 +1,18 @@
+# [S] moq-net compiles in Fuzz and send-depth
+
+## Goal
+
+Nightly's six Fuzz jobs and Tests (rs send-depth) compile `moq-net` again.
+
+## Plan
+
+Nightly [40192013303](https://github.com/moq-dev/moq/actions/runs/40192013303)
+(2026-10-25, at 66af72315b) fails both with "overflow evaluating the
+requirement ... Send" on the async block at
+`rs/moq-net/src/ietf/publisher/tracks.rs:826` (`run_publish` into
+`resume_publish`). The PR gate does not build these configurations, so the
+nesting grew unnoticed. Reproduce with the send-depth recipe, then make the
+future shallower at its source (box or split the nested publish future)
+rather than raising the recursion limit.
+
+Public API: none. Wire: none.

quest/m1/README.md

@@ -41,9 +41,11 @@ inline. Keep generic proofs here and deployments and their operational
 acceptance with the downstream operator.
 
 Keep one owner per shared code area and order prerequisites before consumers
-(re-ranked in the 2026-10-20 audit: auth before cluster routing, the C line
-before the binding breaks, and every lite-07 prerequisite before those
-quests).
+(re-ranked in the 2026-10-20 audit: auth before cluster routing, and every
+lite-07 prerequisite before those quests).
+Decided 2026-10-25 (maintainer): the hand-written `moq-c` ships at this cut
+with parity to moq-ffi for every m1 binding feature, so each binding quest
+lands its C half there; the generated C line moves after the cut.
 The moq-transport passthrough fields remain crate-private: no public moq-net
 item exists only for moq-transport (maintainer, 2026-10-23).
 
@@ -87,7 +89,6 @@ force another major (`announce="never"`, the unused OBS outputs, binding
 durations, and the remaining web-transport-trait adapters) land before the
 cut, as do the small hostile-input and container fixes from the 2026-10-22
 security audit, and the stuck-window scan.
-Binding durations wait on Duration support in the generated C.
 
 Added 2026-10-24 (maintainer, from a moq-hls audit): import and export
 hardening (URL redaction, ranged responses, redirect bases, sequence
@@ -112,16 +113,19 @@ surface and zero-copy texture import, land before the cut.
 
 ## Required
 
+- [Resume checked against a model](/quest/m1/resume-model-test.md) - a randomized test checks every resumed reader against a one-track reference model in Rust and JS, and passes before the cut
 - [Release audit findings](/quest/m1/release-audit/README.md) - resolve newly identified resource, parser, playback, and interoperability risks before the cut
 - [Pre-cut audit findings](/quest/m1/cut-audit/README.md) - fix the crashes, hostile-input costs, and correctness bugs the 2026-10-24 audit of main found
 - [Cancelled moq-transport requests stop](/quest/m1/ietf-request-cancel.md) - a cancelled request releases its state even when the peer withholds credit
 - [Empty segments refused](/quest/m1/empty-segments.md) - `room//cam` fails loud instead of naming `room/cam`
 - [In-band auth](/quest/m1/auth/README.md) - a session tells its peer what it may publish and subscribe to, unions tokens presented in band, and fails loud on an out-of-scope publish
 - [Cluster routing](/quest/m1/cluster-routing/README.md) - prove shared routing contracts, implement per-origin routes, and connect outbound local clusters
 - [Routing guide](/quest/m1/routing-guide.md) - concepts and practical outbound federation setup
-- [Generated C bindings](/quest/m1/c/README.md) - C generated from moq-ffi ships as `moq-c` 0.8.0 and replaces the hand-written libmoq
+- [moq-c at parity](/quest/m1/c/README.md) - the hand-written `moq-c` ships at the cut with every m1 binding feature moq-ffi gains
+- [Lite-05/06 timestamps pass through](/quest/m1/lite-timestamps-through.md) - a timed track received over lite-05/06 stays timed and is forwarded with its timestamps over every version
 - [Exact timestamps in every binding](/quest/m1/binding-timestamps.md) - bindings carry `{value, scale}` timestamps instead of lossy microseconds
 - [Announcement takeover](/quest/m1/announce-takeover.md) - a new independent route explicitly continues instances served through its predecessor, with shared Rust/JS semantics and lite-07 wire
+- [The transport may start a group mid-way](/quest/m1/transport-frame-offsets.md) - a hop may request and deliver a group from any frame it needs, while applications still ask for whole groups
 - [Subscribe ranges](/quest/m1/subscribe-ranges/README.md) - a lite-07 SUBSCRIBE asks for past and live ranges with absolute or relative ends, in either order, and replaces FETCH; merged ranges never starve a subscriber; relays fill misses by range, including over moq-transport
 - [Drop set](/quest/m1/drop-set.md) - each cursor judges missing groups against its own budget, so a narrow reader drops promptly and a widening re-offers groups already reported dropped on lite-07
 - [Broadcast archives](/quest/m1/archive/README.md) - ANNOUNCE, TRACKS, and a SUBSCRIBE per track record every track under a prefix to any object_store, a host serves a stored broadcast back, and the catalog drops its archive pointer for an opt-in `hls` field
@@ -149,7 +153,7 @@ surface and zero-copy texture import, land before the cut.
 - [Buffered playback subscribes in ascending order](/quest/m1/buffered-ascending.md) - a buffered `<moq-watch>` asks for the oldest group first, so a voice reply's opening arrives first, and audio's head hold shrinks to the floor
 - [TS fidelity and recovery](/quest/m1/ts-reliability/README.md) - both modes have explicit profiles, automated validation, loss tests, and a dedicated guide
 - [WebGPU on Safari](/quest/m1/webgpu-safari.md) - the WebGPU renderer is verified on Safari 26 for macOS and iOS
-- [CI housekeeping](/quest/m1/ci-housekeeping.md) - validate queue nextest at 24 threads and remove the actionlint queue ignore after its release
+- [CI housekeeping](/quest/m1/ci-housekeeping.md) - remove the actionlint queue ignore once a release after 1.7.12 reaches the dev shell
 - [Main is no slower than release](/quest/m1/release-perf/README.md) - every benchmark where main is slower than release is fixed or accepted with a reason, checked by a final paired run before the cut
 - [API Extractor checks](/quest/m1/api-extractor-checks.md) - API Extractor fails a PR on a forgotten export, an unresolved declaration, or an undocumented export, replacing the hand-rolled `.d.ts` checkers
 - [Generated JS API reference](/quest/m1/js-api-reference.md) - the doc site renders an API reference for every `@moq/*` package from API Extractor's doc model

quest/m1/api-audit/README.md

@@ -35,8 +35,9 @@ Rules every child follows:
   counts only when that quest is in m1.
 - Inherited debt is fixed here only when it is cheap or sits on a surface
   this release breaks anyway. Otherwise it joins the later quest that
-  reshapes it (the ordered track reader joins
-  [foreign poll](https://github.com/kixelated/rust2/blob/main/quest/m1/ffi-poll-protocol.md)).
+  reshapes it (the ordered track reader joins rust2's
+  [exporter](https://github.com/kixelated/rust2/blob/main/quest/m1/ffi-export.md),
+  which absorbed its foreign poll quest on 2026-10-25).
 - Each child lists its public API and wire impact in its PR, and its Impact
   bullet says how to migrate.
 
@@ -80,6 +81,7 @@ Rejected in planning:
 - [One lifecycle vocabulary](/quest/m1/api-audit/lifecycle.md) - finish, abort, closed, and close mean one thing on every handle, and Rust and JS observers fire alike
 - [moq-net names say one thing](/quest/m1/api-audit/net-names.md) - demand says `wanted`, colliding stats and transport names are renamed, and Rust and JS info lookups mirror
 - [Request handlers are named requests](/quest/m1/api-audit/requests.md) - `dynamic()` and `Dynamic` become `requests()` and `Requests` at every layer
+- [Demand is wanted, everywhere](/quest/m1/api-audit/wanted.md) - every `used`/`unused` pair becomes `wanted()` and `wanted_changed()`, and unused ones go
 - [One meaning for Credential](/quest/m1/api-audit/dial-credential.md) - the internal dial type gets its own name in JS and moq-tokio, and the `Presented` alias goes
 
 ## Related

quest/m1/api-audit/binding-publication.md

@@ -13,8 +13,9 @@ prepared broadcast no longer exposes announcement calls that can only fail.
 Decided 2026-10-23 (maintainer, on
 [moq-dev/moq#6464](https://github.com/moq-dev/moq/pull/6464)): ✅ land the
 announcement split in three PRs: native Rust in that PR, the
-[JS mirror](https://github.com/moq-dev/moq/pull/6795), and this binding rollout
-once the native PR merges. The native PR keeps private adapters that hold the
+[JS mirror](https://github.com/moq-dev/moq/pull/6795), and this binding rollout.
+Both merged on 2026-10-25, so this quest can start. The native PR kept
+private adapters that hold the
 `Publication` beside each binding fill handle (`rs/moq-ffi/src/producer.rs`
 `from_publication`, `rs/moq-c/src/publish.rs` `create_publication` and
 `admit`); this quest replaces them with public handles.
@@ -42,4 +43,13 @@ Test in each layer: clone/drop, explicit unannounce, prepared
 admission (including a mismatched fill), and a stale publication against a
 replacement. Run `just test interop --all`.
 
+Decided 2026-10-25 (maintainer): the hand-written moq-c ships at this cut
+with parity with moq-ffi for every m1 binding feature, so it takes this break
+too; it is not frozen. The generated C line moves after the cut and waits for
+rust2.
+
+[moq-dev/moq#6740](https://github.com/moq-dev/moq/pull/6740) already made
+closing a binding broadcast end its tracks; the public handles keep that
+`MoqBroadcastProducer` and `moq_publish_*` close path in every wrapper.
+
 Public API: breaking in moq-ffi, the C ABI, and every wrapper. Wire: none.

quest/m1/api-audit/requests.md

@@ -13,13 +13,14 @@ mechanism; `auth::Handle::requests() -> auth::Requests` is the precedent.
 
 - Rename `{origin,broadcast,track}::Producer::dynamic()` (and
   `track::Request::dynamic()`) to `requests()`, and each `Dynamic` type to
-  `Requests`. JS `dynamic()`/`Dynamic` mirror it. moq-ffi and its wrappers
-  follow; the frozen hand-written moq-c ABI stays as it is.
+  `Requests`. JS `dynamic()`/`Dynamic` mirror it. moq-ffi, its wrappers,
+  and moq-c (`moq_origin_dynamic*`) follow, since moq-c takes the same breaks
+  (decided 2026-10-25).
 - Rename the crate-private peer-route hatches (`dynamic_route`,
   `update_route`) with the rest.
 - Quests that say `Dynamic` (subscribe ranges, archive) switch
   to the new name in this PR.
 
 About 240 Rust, 30 binding, and 10 JS call sites; land it in one sweep.
 
-Public API: moq-net, `@moq/net`, moq-ffi and wrappers renamed. Wire: none.
+Public API: moq-net, `@moq/net`, moq-ffi, wrappers, and moq-c renamed. Wire: none.

quest/m1/api-audit/wanted.md

@@ -0,0 +1,47 @@
+# [M] Demand is wanted, everywhere
+
+## Goal
+
+Every demand signal reads as `wanted`: a snapshot `wanted()` plus an async
+`wanted_changed()` (and its poll), where "not wanted" is `false` or `None`.
+No `used`/`unused`/`is_used` methods remain in kio, moq-net, `@moq/net`,
+moq-ffi, moq-c, or the wrappers, and methods without a consumer are deleted
+instead of renamed.
+
+## Plan
+
+Decided 2026-10-25 (maintainer), extending
+[moq-net names](/quest/m1/api-audit/net-names.md)'s "Demand says `wanted`":
+
+- Yes/no demand returns `bool`; `track::Demand::wanted() -> Option<u64>`
+  keeps its meaning.
+- Broadcast demand is deleted: Rust's `broadcast::Demand` went in
+  [#6744](https://github.com/moq-dev/moq/pull/6744), and the `@internal` JS
+  `Broadcast.Demand` (read only by tests and a bench) goes too. The origin
+  closes a superseded producer explicitly instead of a publisher watching
+  demand.
+- `group::Demand` has no production consumer in Rust; delete it rather than
+  convert it, unless net-names lands the conversion first. The JS group
+  demand stays internal.
+- `bandwidth::Producer` gets a `demand()` handle with `wanted() -> bool` and
+  `wanted_changed()`, like track.
+- `track::Fill` merges `is_used()` and `next()` into
+  `wanted() -> Option<u64>` (the next group owed), with `wanted_changed()`
+  replacing `unused()`. Check that it returns `None` once no reader is left.
+- kio `Producer`/`ProducerWeak` rename too: `wanted() -> bool` and
+  `wanted_changed()`; delete the test-only async variants.
+- The Announce consumer count from
+  [lifecycle](/quest/m1/api-audit/lifecycle.md) is a `wanted`-shaped signal,
+  not a new `unused()`.
+- moq-c's `MOQ_DEMAND_USED/UNUSED` become `WANTED/UNWANTED`; moq-c takes the
+  break with every binding.
+
+Fix the stale `is_used()` advice in `rs/moq-json/MIGRATE.md`,
+`rs/moq-flate/MIGRATE.md`, and the Go wrapper README.
+
+Public API: breaking renames and deletions in every language. Wire: none.
+
+## Required
+
+- [moq-net names say one thing](/quest/m1/api-audit/net-names.md) - lands group demand's first `wanted` shape
+- [One lifecycle vocabulary](/quest/m1/api-audit/lifecycle.md) - settles close and demand semantics this renames

quest/m1/binding-timestamps.md

@@ -33,8 +33,8 @@ Decided with the maintainer on 2026-10-18:
 - **#5677 shipped** the data-value timestamps with the interim microsecond
   fields; this quest converts every site at once, `MoqJsonValue` included.
 - **Shape mirrors the core:** one `{value, scale}` per value, `value` bounded
-  as `Timestamp::new` bounds it (`2^61 - 1` once
-  [#6168](https://github.com/moq-dev/moq/pull/6168) lands, decided 2026-10-22)
+  as `Timestamp::new` bounds it (`2^61 - 1` since
+  [#6168](https://github.com/moq-dev/moq/pull/6168), decided 2026-10-22)
   and `scale` non-zero and at most `2^62 - 1`, matching `Timescale::new`. The FFI boundary refuses anything else with
   an error. Rejected: raw ticks at the track scale beside
   `MoqTrackInfo.timescale`, because a producer argument needs its own scale
@@ -57,13 +57,10 @@ Verification: round-trip a 90 kHz tick, a present zero, and untimed through
 moq-ffi, moq-c, C++ and every wrapper's tests; refuse scale 0, an
 out-of-range scale, and an out-of-range value; `just test interop --all`.
 
-Decided 2026-10-20 (maintainer): the moq-c half lands on the
-[generated C package](/quest/m1/c/README.md), not the frozen hand-written
-ABI, so C users break once.
+Decided 2026-10-25 (maintainer), reversing the 2026-10-20 decision to wait
+on the generated C package: the hand-written `moq-c` ships at this cut with
+parity to moq-ffi for every m1 binding feature, so the moq-c half lands
+there, and the generated C line follows after the cut.
 
 Wall and monotonic times stay `moq_clock::Wall` and `moq_clock::Instant`, not
 media timestamps; keep the types distinct.
-
-## Required
-
-- [Generated C bindings](/quest/m1/c/README.md) - `moq_timestamp` reaches C through the generated package, so C users break once