ci: drop loom and send-depth from the land gate; run send-depth in Nightly

.github/workflows/nightly.yml

@@ -366,15 +366,16 @@ jobs:
         # `test drill impaired` runs the relay drills over a freshly seeded shaper; PRs run loopback.
         # `rs cli-export` runs moq-cli's export process tests, which take tens of seconds of real time.
         # `gate` runs the queue's Check over every package, catching what a
-        # diff-scoped queue run let into main. That includes `rs send-depth` on
-        # the flake's pinned nightly.
+        # diff-scoped queue run let into main.
+        # `rs send-depth` proves moq-net's futures Send at the default recursion
+        # limit on the flake's pinned nightly, which the land gate leaves out.
         # `rs audio-devices` plays moq-audio's device tests into a private null sink.
         # `rs multicast` runs the mDNS tests, which loop multicast back on the runner.
         # `rs render-sw` renders through wgpu on Mesa's software Vulkan driver.
         # `test qmux` runs js/qmux against the in-tree Rust qmux, per draft.
         # `rs v4l2` streams moq-video's V4L2 capture from the kernel's vivid
         # virtual camera, a module load no pull request job should make.
-        recipe: ["gate", "rs doctest --workspace", "rs loom", "test drill-sensitivity", "rs uring", "test drain", "test json-properties", "test resume-model", "rs quic-sim", "test drill impaired", "rs cli-export", "rs quic-stress", "rs audio-devices", "rs multicast", "rs render-sw", "test qmux", "rs v4l2"]
+        recipe: ["gate", "rs doctest --workspace", "rs send-depth", "test drill-sensitivity", "rs uring", "test drain", "test json-properties", "test resume-model", "rs quic-sim", "test drill impaired", "rs cli-export", "rs quic-stress", "rs audio-devices", "rs multicast", "rs render-sw", "test qmux", "rs v4l2"]
     steps:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

flake.nix

@@ -604,8 +604,8 @@
 
           runner-userns-profile = import ./nix/runner/unshare.nix { inherit pkgs; };
 
-          # The nightly `just rs send-depth` proves native Send futures on.
-          # Pinned so a toolchain release alone never fails the merge gate;
+          # Nightly's `just rs send-depth` proves native Send futures on it.
+          # Pinned so a toolchain release alone never fails that job;
           # bump it on purpose, like the stable toolchain above. Kept out of
           # the dev shell, which every CI job downloads.
           rust-nightly = pkgs.rust-bin.nightly."2026-10-18".minimal;

quest/m0/ci/README.md

@@ -107,12 +107,23 @@ the wasm32 pass: "nobody uses it and it's going to be replaced soon"; on
 io_uring: "keep testing uring in CI, but I guess add it to the default features
 on CI". The land gate's Rust lane is the default-feature test build (with the
 device features, and on Linux the relay's io_uring runtime) plus fmt, doc,
-shear, sort, and the loom and Send-depth compiles. It drops the isolated feature
+shear, and sort. It drops the isolated feature
 shapes (`rs_shapes`, cargo-hack), the net, QUIC, tokio, and media feature
 contracts, and the wasm32 and io_uring clippy passes; `just rs features` keeps
 the feature matrix in the Features workflow (nightly and release PRs). On a host land batch the Rust lane had taken about 1,340 s, 691 s
 of it `rs_shapes` and 238 s `tokio-features`.
 
+Decided 2026-10-31 (maintainer), on the gate's remaining lint compiles: "Remove
+loom entirely": moq's history holds only upkeep of the loom models
+([moq-dev/moq#2543](https://github.com/moq-dev/moq/pull/2543) added them, later
+PRs bounded them so Nightly finishes, fixed them after code changes, and
+restored their gate compile checks) and no commit where loom found a race. The
+gate drops `loom-check` and Nightly its loom job; a separate PR deletes the
+models. On Send-depth: "Move it to Nightly." It guards a real downstream
+breakage (moq-net futures not Send at the default recursion limit), so
+`just rs send-depth` keeps its pinned nightly and runs as its own Nightly job
+instead of in the land gate.
+
 Decided 2026-10-25 (maintainer): across moq's many CI and release builds
 (targets, features, FFI languages, Nix packages), each crate configuration
 compiles once and is reused through the cache, and each run builds and tests

quest/m0/ci/five-minutes.md

@@ -71,8 +71,9 @@ What remains for a moq-net edit, largest first:
 - The test run is the [slow tests](/quest/m0/ci/slow-tests.md) quest's.
 - The lint's remaining 230 s: the dev loom compile and `cargo doc`. Decided
   2026-10-31 (maintainer, see the [epic](/quest/m0/ci/README.md)): the gate
-  drops the feature shapes, the feature contracts (net-features's 62 s among
-  them), and the wasm32 clippy pass, and tests the relay's io_uring runtime in
+  drops the loom compile, the Send-depth check (now its own Nightly job), the
+  feature shapes, the feature contracts (net-features's 62 s among them), and
+  the wasm32 clippy pass, and tests the relay's io_uring runtime in
   the one test build instead of a separate clippy pass.
 - Measure the other routes the same way: a moq-ffi edit, which selects every
   binding's lane under `CHECK_JOBS=3`, and a JS-only edit.

quest/m2/audit-ci.md

@@ -53,10 +53,6 @@ verdicts:
 - Nightly was red every night of the m1 run. The 2026-10-21 night failed 18
   jobs and the 2026-10-22 night 19 plus a cancelled Loom job. By the end of the
   run, merged fixes covered all but these, which had no owner:
-  - `just rs loom` on main `f42b336f0e`: `a_front_sees_a_reader_return`
-    exceeds Loom's branch limit, and the two
-    `a_*_reader_sees_the_front_end_a_refused_track` models run until the job's
-    60-minute timeout cancels it.
   - Windows only: `reconnect::a_protocol_violation_ends_reconnect`, added by
     [moq-dev/moq#6162](https://github.com/moq-dev/moq/pull/6162), redials
     after a protocol violation over TCP.

quest/m2/crossbeam-pin-fence.md

@@ -25,8 +25,9 @@ Decided 2026-10-28 (maintainer): keep crossbeam-epoch rather than replace it.
 refcounted segments and per-read refcounts, it supports loom, and moka pulls
 it into moq-relay anyway.
 
-Verify on ARM: the Nightly `Tests (rs loom)` job runs on `ubuntu-24.04-arm`.
-Without an ARM host, force crossbeam's non-x86 branch in a scratch copy, as
-#7134 did, and confirm the model passes without the fence.
+Verify on ARM: run `just rs loom` on an ARM host; Nightly no longer runs it
+(decided 2026-10-31, see the [CI epic](/quest/m0/ci/README.md)). Without an
+ARM host, force crossbeam's non-x86 branch in a scratch copy, as #7134 did,
+and confirm the model passes without the fence.
 
 Public API: none. Wire: none.

rs/justfile

@@ -65,7 +65,7 @@ fix *args:
 check-changed $LIST:
     sh/rs/select.sh check "$LIST"
 
-# Like `lint`, with the loom and Send-depth checks for the selected crates.
+# Like `lint`, but only the crates in a changed-file list plus their dependents.
 lint-changed $LIST:
     sh/rs/select.sh lint "$LIST"
 
@@ -317,7 +317,7 @@ doctest *args:
     bash sh/local.sh cargo test --locked --doc "$@"
 
 # `--cfg loom` swaps kio's primitives for loom's, so it rebuilds the world and
-# executes only in Nightly; the selected Rust gate compiles it with `loom-check`.
+# runs only on demand.
 # `--release` because a model check runs the body once
 # per interleaving (411s -> 51s); the assertions are plain `assert!`. kio's
 # models search every interleaving; moq-net's cap preemptions (see
@@ -351,7 +351,8 @@ quic-sim:
     # The bandwidth probe's acceptance suite, over fixed seeds: the merge gate runs only its short cases.
     bash sh/rs/nextest.sh cargo nextest run --locked --release -p moq-quic --lib --run-ignored only -E 'test(/^tests::probe::/)'
 
-# Prove downstream futures are Send at the default recursion limit on nightly.
+# Prove downstream futures are Send at the default recursion limit on the
+# flake's pinned nightly. Nightly runs it; the land gate does not.
 send-depth:
     bash sh/rs/send-depth.sh
 

sh/dispatch.sh

@@ -310,8 +310,8 @@ step() {
         check:js) just js check-changed "$js_list" ;;
         check:workers) just js workers ;;
         check:moq_sh) just infra moq-sh test ;;
-        # The check keeps docs and the loom and Send-depth compiles; the test phase
-        # enforces default-feature clippy without a second compile.
+        # The check keeps docs; the test phase enforces default-feature clippy
+        # without a second compile.
         check:rs) just rs lint-changed "$rs_list" ;;
         check:bench)
             python3 bench/compare.test.py

sh/rs/select.sh

@@ -20,7 +20,7 @@ select_packages() {
         echo ALL
         return
     fi
-    if [[ "$list" == --all ]] || grep -qE '^(\.cargo/.*|sh/local\.(sh|ts)|Cargo\.(toml|lock)|rust-toolchain\.toml|rs/justfile|sh/rs/(select|platform|nextest|send-depth)\.sh|\.config/nextest\.toml)$' "$list"; then
+    if [[ "$list" == --all ]] || grep -qE '^(\.cargo/.*|sh/local\.(sh|ts)|Cargo\.(toml|lock)|rust-toolchain\.toml|rs/justfile|sh/rs/(select|platform|nextest)\.sh|\.config/nextest\.toml)$' "$list"; then
         echo ALL
         return
     fi
@@ -150,10 +150,9 @@ case "$action" in
     check | check-test | lint)
         # The isolated feature builds (`just rs features`) stay out of the
         # gate; the Features workflow runs them nightly and on release PRs.
+        # Nightly runs the Send-depth proof (`just rs send-depth`) on its
+        # pinned toolchain.
         just rs "$action" "${flags[@]}"
-        if wants '(kio|moq-net)'; then just rs loom-check; fi
-        # Native Send proofs at the default recursion limit, on the pinned nightly.
-        if wants moq-net; then just rs send-depth; fi
         # Device code behind the off-by-default `capture` feature. check-test
         # lints it through the test build, as for the default features.
         if [[ "$action" != lint ]] && wants '(moq-video|moq-audio|moq-scene|moq-studio)'; then

sh/rs/select.test.py

@@ -66,23 +66,15 @@ def test_gate_runs_no_feature_matrix(self):
         for owner in ("tokio", "media", "net"):
             self.assertEqual(self.selected(f"sh/rs/{owner}-features.sh"), [])
 
-    def test_send_depth_follows_moq_net(self):
-        for action in ("check", "check-test", "lint"):
-            for path in ("rs/moq-net/src/lib.rs", "rs/kio/src/lib.rs", "sh/rs/send-depth.sh"):
-                with self.subTest(action=action, path=path):
-                    self.assertIn("rs send-depth", self.selected(path, action=action))
-            with self.subTest(action=action, path="rs/moq-tokio/src/lib.rs"):
-                self.assertNotIn("rs send-depth", self.selected("rs/moq-tokio/src/lib.rs", action=action))
-
-    def test_loom_compiles_only_when_its_model_changes(self):
-        for action in ("check", "check-test", "lint"):
-            for path in ("rs/kio/src/lib.rs", "rs/moq-net/tests/loom.rs", "Cargo.lock"):
-                with self.subTest(action=action, path=path):
-                    self.assertIn("rs loom-check", self.selected(path, action=action))
-            for path in ("rs/moq-tokio/src/lib.rs", "rs/moq-stats/benches/producer_tick.rs"):
-                with self.subTest(action=action, path=path):
-                    self.assertNotIn("rs loom-check", self.selected(path, action=action))
-        self.assertNotIn("rs loom-check", self.selected("rs/moq-net/src/lib.rs", action="test"))
+    def test_gate_leaves_send_depth_to_nightly(self):
+        # Nightly runs `rs send-depth` on the pinned toolchain; the gate's lint
+        # is the one cargo pass.
+        for path in ("rs/moq-net/src/lib.rs", "rs/kio/src/lib.rs", "Cargo.lock"):
+            with self.subTest(path=path):
+                calls = self.selected(path)
+                self.assertEqual(len(calls), 1, calls)
+                self.assertTrue(calls[0].startswith("rs lint "), calls)
+        self.assertEqual(self.selected("sh/rs/send-depth.sh"), [])
 
     def test_device_features_join_the_one_test_build(self):
         for path, features in (("rs/moq-audio/src/lib.rs", DEVICE_FEATURES),