Repository navigation
quest: plan the 2026-11-03 follow-ups - #7748
Conversation
Add 23 quests the maintainer settled in the 2026-11-03 follow-up planning interview, edit ten existing quests with the follow-ups they absorb, and delete m0/test-flakes-2/tokio-close-drain.md, fixed by #7634. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
No actionable comments were generated in the recent review. WalkthroughThis change updates quest indexes and planning documents across m0, m1, and m2. The documents record proposed work, decisions, verification steps, and milestone status for parsing bounds, CI and Nightly behavior, client and JavaScript behavior, audio, protocol changes, performance, and maintenance. It also removes the m0 close-drain quest document and its index entry. The pull request documents planned work; it does not implement the described behavior. Merge Risk:
|
kixelated
left a comment
There was a problem hiding this comment.
Automated review by review (OpenAI)
Reviewed commit: f6a3c02
- [P2] Bound every box before the generic decoder (
quest/m0/cmaf-receive-bounds.md:31-35). The proposed guard only checksmoofandmoov, butWire::from_init,fmp4::decode, andcmaf_moovcallAny::decode_maybebefore discarding other top-level boxes. A large top-leveltruntherefore bypasses the proposed guard and can still expand to hundreds of megabytes. Reject or skip irrelevant box types before decoding, or bound every metadata box passed toAny; test this layout. - [P2] Cover count-based amplification as well as box bytes (
quest/m0/cmaf-receive-bounds.md:31-35,39-41). The sole prerequisite, #7687, explicitly leaves the pinned mp4-atom'ssgpdzero-byte-entry expansion to a later release: a tiny box can allocate hundreds of megabytes despite a 2 MiB byte cap. Fieldless sample runs can also drive large receive-side sample vectors. Require the mp4-atom fix or equivalent preflight, bound receive-side sample counts, and include small-input/large-count peak-memory regressions before claiming the stated bound. - [P2] Reconcile the JS fills prerequisite when #7696 lands (
quest/m1/subscribe-ranges/js-fills.md:20-23,43-45). This new quest both links to and requiresjs.md, while #7696 deletes that file; the PR's merge instruction says to keep the deletion but does not remove or replace these new references. Because #7696's branch predates this file, its existing deletion cannot clean them up. Include a merge-order-safe update to the new quest, retaining the PR link as historical context and removing the completed Required edge.
Verification: static inspection through GitHub only; I did not run tests or merge either prerequisite PR.
There was a problem hiding this comment.
✅ No new issues found.
Reviewed changes
This is a docs-only quest-planning PR (52 files, 1 commit), so I focused on the tree's integrity and the factual claims the quests rest on.
- 26 new quest files record the maintainer's 2026-11-03 follow-up decisions across m0 (security, Nightly, CI), m1 (JS abort/resume/fills, bigint audit, fresh port, old-hop dial, MSF
__proto__), and m2 (benchmarks, auth, routing, rind, release). - Epic and milestone READMEs gained ranked links to the new quests, plus
## Requiredlists for the Nightly and CI epics. - Existing quests edited:
capped-budgets(AAC grouping fix),api-gaps(#7029 merged),announce-credit,ffi-exporter,miri-nightly-budget,mesh-session-cost,log-adoption,publish-done-codes,quic-realtime,socket/carla,cluster-routing/routes,subscribe-ranges/js,vendor-sync/uniffi. - Deletion:
quest/m0/test-flakes-2/tokio-close-drain.mdand its README bullet, since #7634 fixed it.
I verified that every /quest/... link in the changed files resolves on the branch, that every added quest is linked from a README, and that the deleted quest has no remaining references. I also spot-checked the code references the plans lean on (sh/rs/miri.sh:85, moq-video/src/decode/vui.rs:102/:263, fmp4/mod.rs:440/:556, mp4.rs:162, moq-bench/src/stats.rs as_millis/LATENCY_BUCKETS, send_failed, js/msf/src/catalog.ts's z.record, track.test.ts:1902/:1944/:2040, receive_credit.rs:1056) and the cited PR titles/states, including that #7702 adds rs/moq-crypto/benches/sign.rs. All matched. sh/markdown.sh check passes.
(Written by deepseek/deepseek-v4.1-flash-1017)
deepseek-v4.1-flash-1017 (free via Pullfrog for OSS) | 𝕏
…e resets Record the maintainer's SUBSCRIBE_STARTED decision in Lite-07 ranges, and plan two more 2026-11-03 follow-ups: the stale track_range_widening bench assertion (Nightly) and resetting an announce revoked after its OK (m2). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
There was a problem hiding this comment.
Important
One prerequisite link is already dead against main: #7703 merged and deleted quest/m1/auth-expiry-reset.md, so announce-revoke-reset.md's ## Required now points at a file this PR cannot carry into main.
Reviewed changes
The second commit (a1888e43f) added three follow-ups to the planning tree:
- Added the Nightly child
quest/m0/nightly/track-range-widening.mdand its README bullet, covering thetrack_range_widening/1r/64assertion #7536 bisected to #7545. - Added the m2 quest
quest/m2/announce-revoke-reset.mdand its README bullet, planning a reset withINTERNAL_ERRORfor a revoked announce after #7703's expiry path. - Recorded the SUBSCRIBE_STARTED decision (type
0x3) inquest/m1/subscribe-ranges/lite.md.
I verified the bench references (track.rs:1695/:1730, 1r/64 in WIDENING_READERS/WIDENING_CACHED, #7545's 64cba13, Nightly's criterion net ... --bench '*') and that 0x3 is free on the Subscribe Stream (OK 0x0, END 0x1, DROP 0x2). The one issue is inline.
deepseek-v4.1-flash-1017 (free via Pullfrog for OSS) | 𝕏
There was a problem hiding this comment.
✅ No new issues found.
Reviewed changes
The delta since the prior pullfrog review (a1888e4) is the origin/main merge (b5c5bb81) plus one follow-up commit (2bcd5fe0):
- Dropped
quest/m2/announce-revoke-reset.md's## Requiredsection, whose targetquest/m1/auth-expiry-reset.md#7703 deleted when it merged, and marked #7703 as merged in the Plan text. Noauth-expiry-resetreferences remain anywhere inquest/. - Merged
origin/mainatfb9a4fbb0, bringing main's quest-tree changes into the branch as base content.
The merge pulled in main-side code and quest edits, but those are base-branch content, not new PR material; the PR's own delta is the one file above.
deepseek-v4.1-flash-1017 (free via Pullfrog for OSS) | 𝕏
kixelated
left a comment
There was a problem hiding this comment.
Automated review by review (OpenAI)
Reviewed commit: 2bcd5fe
The added revoked-announce quest no longer requires the auth-expiry quest deleted by merged #7703, addressing the subsequent prerequisite-link finding. The three issues from my earlier review remain unchanged: both CMAF allocation-bound gaps and the JS fills prerequisite that #7696 deletes.
No additional actionable findings in the new plans or base-aware update. Verification: static GitHub inspection only; no tests were run.
Maintainer, 2026-11-03: m0 (options m2, m0, drop). The quest's PR decides whether the lock lives in moq's bench recipes or in quest gate. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
kixelated
left a comment
There was a problem hiding this comment.
Automated review by review (OpenAI)
Reviewed commit: 4e8cc3e against base 151ed38.
No new actionable issue found in the added benchmark-host-lock plan. The three findings in the earlier review remain open: the CMAF plan still bounds only selected box types and does not address count amplification, and the JS fills quest still requires a file that #7696 deletes.
Static GitHub-only review; no tests or merge-order simulations were run.
There was a problem hiding this comment.
Important
The new quest's ## Related link targets a quest that open PR #7742 deletes. Detail inline.
Reviewed changes
The delta since the prior pullfrog review (2bcd5fe) is the origin/main merge at 151ed3820d plus one commit (4e8cc3e1):
- Added
quest/m0/bench-host-lock.md, planning a host-level lock for benchmark and profile sessions, with the maintainer's m0 pick recorded and the in-moq and in-quest options laid out. - Added its ranked bullet to
quest/m0/README.md. - Merged
origin/mainat151ed3820d; its code and quest changes are base-branch content, not new PR material.
deepseek-v4.1-flash-1017 (free via Pullfrog for OSS) | 𝕏
There was a problem hiding this comment.
✅ No new issues found.
Reviewed changes
The delta since the prior pullfrog review (4e8cc3e) is one commit (7ef3984):
- Dropped the dead Related link in
quest/m0/bench-host-lock.md:log-lock-profile.mdis deleted by open #7742, so this quest now cites #7742 only in its Plan as the voided-run evidence. The relay-CPU bisect link stays, since #7605 only modifies its target.
The one other /quest/... reference to log-lock-profile.md (quest/m1/unbounded-groups/README.md:156) predates this PR and is #7742's cleanup, not this branch's.
deepseek-v4.1-flash-1017 (free via Pullfrog for OSS) | 𝕏
From #7693's iterate: a JSON snapshot consumer resyncs at the next group after a bad frame (m2), and the abort-wake quest gains its moq-boy repro. From #7498's iterate: the MSF ext quest widens to js/publish's rendition maps as one prototype-safe names quest (m1). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
There was a problem hiding this comment.
✅ No new issues found.
Reviewed changes
The delta since the prior pullfrog review (7ef3984) is one commit (0740289):
- Renamed and widened the prototype-name quest:
quest/m1/msf-ext-proto.mdbecamequest/m1/proto-safe-names.md,[XS]to[S], now coveringjs/publish's#renditions/#recordsplain-object collision (__proto__,constructor,toString) and the catalog/stats builders alongside the MSFextmap. The m1 README bullet was updated to match, and the## Requiredlink tocut-audit/catalog-proto-ids.mdresolves. - Added
quest/m2/json-snapshot-resync.mdand its m2 README bullet: a typed decode error, a group skip, and a delta-base reset in@moq/jsonandmoq-json, with@moq/roomand moq-boy resyncing on the next snapshot. - Clarified
quest/m1/js-follow-abort-wake.md: the goal now says the pending read rejects with the track's error instead of staying parked until cleanup, and the plan folds in the moq-boy repro.
I checked the plan's code references against the branch: broadcast.ts:147,163 are indeed plain objects and broadcast.ts:221 reads this.#renditions.peek()[name] before throwing "already registered"; js/msf/src/catalog.ts:76 is the z.record; the JSON consumer's stale #framesRead/delta base on a parse error matches js/json/src/snapshot/consumer.ts:127 and rs/moq-json/src/snapshot/consumer.rs:163; and the room/moq-boy loops exist at js/room/src/metadata.ts:273 and js/moq-boy/src/game.ts:275. Both prior review threads are resolved.
deepseek-v4.1-flash-1017 (free via Pullfrog for OSS) | 𝕏
Maintainer on #7679, 2026-11-03: "m1 please copy what NetEQ does". A sibling of Watch in the audio jitter target epic, sharing one algorithm and its test vectors. Also drop proto-safe-names' Required link: #7498 merged and deleted catalog-proto-ids.md. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Main still keeps the browser stretch in m2 Time stretch; open #7679 moves it into Watch. Cross-link both, and record the native m1 decision in the epic's boundaries. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
… cert CodeRabbit on #7748: vui.rs:263 is a test fixture, so the SPS walk replaces only the decoder's call at :102; and sub-millisecond bench latency needs a microsecond send time in the frame header. From #7700: the Moxygen smoke lane writes its own OpenSSL config, like ietf-conformance. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
kixelated
left a comment
There was a problem hiding this comment.
Automated review by review (OpenAI)
Reviewed commit: 961da68
- [P2] Make the native stretch links safe across #7679's merge (
quest/m1/audio-jitter-target/native-stretch.md:25-29,75-76). The new quest links the current m2 Time stretch file in both its plan and Related, but #7679 explicitly deletes that file when it folds browser stretch into Watch. If either PR lands first, the other cannot update these references automatically: #7679 predates this new file, and this PR's new file still names the deleted path. Link to Watch or specify a merge-order update for both references so the durable quest does not retain broken links.
The three findings in my previous review remain open: the CMAF plan bounds only selected box types and omits count amplification, and JS fills still requires a file #7696 deletes. The stale benchmark-lock prerequisite is removed, and the SPS call-site and benchmark timestamp plans address the two subsequent review comments. The new JSON resync, prototype-safe names, native stretch, and smoke certificate plans were inspected; no other actionable finding identified.
Verification: static GitHub-only inspection; no tests, live benchmarks, or merge-order simulations were run.
There was a problem hiding this comment.
Important
The prototype-name quest still plans an MSF ext fix that is already merged and tested, so its first gap would send an implementer to replace working code.
Reviewed changes
The delta since the prior pullfrog review (0740289) is three substantive commits plus two origin/main merges (af9df7381, 1c2fd132e):
- Added
quest/m1/audio-jitter-target/native-stretch.md[L], planning NetEq's accelerate and preemptive expand inmoq play, linked from the epic README's## Requiredand fromwatch.md. - Added
quest/m2/smoke-moxygen-cert.md[XS] and its m2 README bullet, planning a lane-owned OpenSSL config liketest/ietf-conformance/run.sh. - Cross-linked the native and browser stretches in
watch.mdandwatch-audio-time-stretch.md. - Corrected
video-sps-walk.mdso onlyvui.rs:102changes (:263is the fixed-fixture test), andbench-latency-resolution.mdto add an optional microsecond send time besidetimestamp_ms. - Updated
proto-safe-names.mdfor merged #7498: dropped its## Requiredlink, named hang'srenditions()/section(), and added the encoder note.
deepseek-v4.1-flash-1017 (free via Pullfrog for OSS) | 𝕏
Merge main (#7687 and #7693 merged): drop the CMAF quest's Required edge and the abort-wake quest's link to the deleted moq-boy quest. Per the OpenAI review, the CMAF quest bounds every top-level box before mp4-atom's Any decoder and bounds counts too. Per Pullfrog, js/msf's decode already keeps a __proto__ extension, so only its exported schema remains. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
quest land watch: the merge queue removed this pull request at 92c61a2 because it conflicts with The land fixer works on it in the background, and the watcher re-enqueues it at the back of the queue once it is fixed or judged flaky, or hands it back here with what it needs. (written by quest land watch) |
|
codex / Codex land fixer: +moq-crypto generates, signs, and verifies its Ed25519 keys with rind instead
+of aws-lc-rs, so its build compiles no C crypto.
+
+## Plan
+
+Decided 2026-11-03 (maintainer, follow-up planning after the 2026-11-03 /quest-afk and /quest-complete runs), milestone:
+
+- m0
+- m1
+- ✅ m2, in this epic
+
+moq-crypto exists on main since
+[moq-dev/moq#7702](https://github.com/moq-dev/moq/pull/7702). Model it on [moq-dev/moq#7570](https://github.com/moq-dev/moq/pull/7570),
+which moved moq-auth to rind and implements `mesh::Signer` for
+`rind::signature::Ed25519KeyPair`.
+
+- Keygen, sign, and verify move to rind; key, signature, and wire formats
+ stay byte-identical, checked against keys and signatures made before the
+ switch.
+- Map rind's errors by hand, as #7570 did, so its types stay out of
+ moq-crypto's API.
+- `cargo tree -p moq-crypto -e normal,build` holds no aws-lc or ring.
+- Compare `cargo bench -p moq-crypto --bench sign` before and after.
+
+Public API: none expected, unless a ready-made key type is exposed (as
+`mesh::Signer` names rind's). Wire: none.
M .github/actions/just/action.yml
M .github/actions/nextest/action.yml
M .github/workflows/oss-scanner.yml
M .github/workflows/release-kt-ffi.yml
M .github/workflows/release-kt-lib.yml
M .github/workflows/smoke.yml
M quest/m1/README.md
R quest/m2/rind/README.md -> quest/m1/rind/README.md
A quest/m1/rind/acme-remove.md
R quest/m2/rind/crypto.md -> quest/m1/rind/crypto.md
R quest/m2/rind/rtc.md -> quest/m1/rind/rtc.md
R quest/m2/rind/transport.md -> quest/m1/rind/transport.md
M quest/m1/ts-reliability/README.md
D quest/m1/ts-reliability/tdt-placement.md
R quest/m2/webrtc/rename.md -> quest/m1/webrtc-rename.md
R quest/m2/webrtc/vendor.md -> quest/m1/webrtc-vendor.md
M quest/m2/README.md
M quest/m2/p2p/native-quic.md
M quest/m2/rtc-pacing.md
M quest/m2/webrtc/README.md
M quest/m2/webrtc/clock.md
M quest/m2/webrtc/dtls-after-ice.md
M quest/m2/webrtc/dtls-timeout.md
M quest/m2/webrtc/sdp-bandwidth.md
M quest/m3/README.md
R quest/m2/rind/acme.md -> quest/m3/relay-acme.md
R quest/m2/rind/instant-acme.md -> quest/m3/rind-instant-acme.md
M rs/moq-mux/src/container/ts/export.rs
M rs/moq-mux/src/container/ts/export_test.rs
codex
The conflict is resolved, and `quest check` passes for all 587 documents. The PR changes only quest Markdown, so no package build applies. I also confirmed that protected paths match base exactly. I’ll commit the resolution and verify that base merges cleanly.
exec
/bin/bash -lc 'git commit -m "Merge base and follow rind quest directory rename"; git merge-tree --write-tree base pr-7748; git merge-base --is-ancestor 92c61a2d74fb7a3942261d467ce3564412f19a5c pr-7748; git diff --check base pr-7748; quest check; git rev-parse HEAD' in /work
succeeded in 2003ms:
[pr-7748 3ec3dbd48] Merge base and follow rind quest directory rename
102f5fa14473e0ef5b0e6be309261b940b512810
quest: 587 documents ok
3ec3dbd4876f9d4ed636be8bc8e491fbe956d42e
exec
/bin/bash -lc "python3 - <<'PY'
import json
from pathlib import Path
result = [{
'number': 7748,
'action': 'fixed',
'head': '3ec3dbd4876f9d4ed636be8bc8e491fbe956d42e',
'reason': 'Merged base, followed rind directory rename for crypto.md and updated its link; quest check (587 documents), git diff --check base pr-7748, and git merge-tree --write-tree base pr-7748 passed; quest Markdown only, no package build applies.',
'failure': 'merge: file location conflict for quest/m2/rind/crypto.md',
'blame': True
}]
Path('quest-land-result.json').write_text(json.dumps(result, indent=2) + '\\n')
PY
git status --short; git log -1 --format='%H %P' pr-7748" in /work
succeeded in 0ms:
?? quest-land-result.json
3ec3dbd4876f9d4ed636be8bc8e491fbe956d42e 92c61a2d74fb7a3942261d467ce3564412f19a5c fa80a02db749f8179a44b74c9bc423f98e9becbe
codex
Fixed #7748 on `pr-7748` at `3ec3dbd4876f9d4ed636be8bc8e491fbe956d42e`.
Followed base’s directory rename and updated the document link. Validation passed: 587 quest documents, whitespace check, and clean merge.
[quest-land-result.json](/work/quest-land-result.json) is written and uncommitted.
tokens used
33,120
Fixed #7748 on `pr-7748` at `3ec3dbd4876f9d4ed636be8bc8e491fbe956d42e`.
Followed base’s directory rename and updated the document link. Validation passed: 587 quest documents, whitespace check, and clean merge.
[quest-land-result.json](/work/quest-land-result.json) is written and uncommitted.
fixer result written
(written by codex / Codex) |
There was a problem hiding this comment.
Important
The moved quest/m1/rind/crypto.md still records ✅ m2, while the rind epic it now belongs to lives in m1. The planning record contradicts the milestone it is filed under.
Reviewed changes
The delta since the prior pullfrog review (352e671) is two base merges plus their reconciliation:
- Merged
origin/mainat4f0bbdb(92c61a2d7) with no PR-patch change. - Merged
origin/mainatfa80a02d(3ec3dbd48), which carries #7749's move of the rind epic from m2 to m1 and relay ACME to m3. - Moved
rind/crypto.mdtoquest/m1/rind/and added its bullet to the m1 rind epic's## Required. - Reconciled the m1 README by folding the webrtc/rind links into the ranked list.
I verified that every relative and /quest/ link under quest/ resolves, no m2/rind references remain, git diff --check is clean, there are no conflict markers, and every PR quest file is still referenced. The one issue is inline.
deepseek-v4.1-flash-1017 (free via Pullfrog for OSS) | 𝕏
Merge the queue fixer's 3ec3dbd (rind moved to m1 by #7749) and main. The Nightly epic lists both this PR's children and #7747's. Fold this PR's duplicate rind/crypto.md into #7747's rind/crypto-sign.md, and point miri-frame.md at m0/nightly/miri.md, where #7747 moved the Miri budget quest. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
kixelated
left a comment
There was a problem hiding this comment.
Automated review by review (OpenAI)
Reviewed head 6ddf97a, following 352e671 and accounting for the base merges.
The duplicate rind signing quest is folded into the existing m1 signing plan, preserving its error-mapping, dependency-tree and benchmark checks; the moved quest no longer carries the conflicting m2 milestone noted in the intervening review. The Miri child now points to its moved budget quest. I found no additional actionable issue in the reconciliation.
Verification: GitHub-only static review of the base-aware quest delta and linked plans. I did not run quest checks or merge simulations.
(Written by review (OpenAI))
There was a problem hiding this comment.
Important
The latest base merge leaves two PR quests duplicating quests that #7747 already planned on main.
Reviewed changes
The delta since the prior pullfrog review (3ec3dbd) is the origin/main merge at 13f5e43 plus its reconciliation:
- Removed the duplicate
rind/crypto.md, folding its three extra checks into main'scrypto-sign.md; this resolves the prior m2-pick finding by removal rather than repicking. - Merged
origin/mainat13f5e43, taking main's new quests and README bullets and following main'sm2/miri-nightly-budget.md->m0/nightly/miri.mdrename (miri-frame.mdrepointed). - Dropped the branch's redundant m1 webrtc/rind README bullets now that main carries them, while keeping the PR's own additions.
I verified all 632 quest Markdown links resolve, all 31 PR-added quest files are referenced, no conflict markers remain, and git diff --check is clean. The two duplicate pairs are inline.
deepseek-v4.1-flash-1017 (free via Pullfrog for OSS) | 𝕏
…quests Pullfrog on #7748: moq-e2ee-retire.md duplicates main's release/e2ee-retire.md, and smoke-moxygen-cert.md duplicates main's smoke-libressl.md (both from #7747). Remove this PR's copies with quest rm and move their extra evidence into main's. A sweep against #7747, #7795, and #7807 found no other duplicates. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
There was a problem hiding this comment.
✅ No new issues found.
Reviewed changes
The delta since the prior pullfrog review (6ddf97a) folds this PR's two duplicate quests into main's #7747 plans, then merges origin/main through #7792 and #7803.
- Folded the moq-e2ee retirement into main's quest: deleted
m2/release/moq-e2ee-retire.mdand its README bullet, moving thecurl … | jq -r .crate.max_versioncheck and the draft/profile-name grep exclusion intoe2ee-retire.md. - Folded the smoke-certificate work into main's quest: deleted
m2/smoke-moxygen-cert.mdand its README bullet, adding the LibreSSL 4.3.2 repro and its error text tosmoke-libressl.md. - Merged
origin/mainthrough #7792 and #7803 and reconciled the tree, so this PR's quests no longer reference the base-deletedrelay-test-macos.mdoracme-remove.md.
I verified that every relative and /quest/ link under quest/ resolves, no reference to smoke-moxygen-cert, moq-e2ee-retire, relay-test-macos, or acme-remove remains, all 29 added quest files are still referenced, git diff --check is clean, and no conflict markers remain. Both prior review threads were already resolved.
deepseek-v4.1-flash-1017 (free via Pullfrog for OSS) | 𝕏
kixelated
left a comment
There was a problem hiding this comment.
Automated review by review (OpenAI)
Reviewed head c77c416, accounting for the base changes. The duplicate E2EE retirement and smoke-certificate quests are removed, with their extra evidence and checks folded into the canonical plans. The intervening duplication findings are addressed; no additional actionable issue found in the reconciliation.
Verification: GitHub-only static review of the quest delta and related plans. I did not run quest checks or merge simulations.
(Written by review (OpenAI))
#7812 installed rust-src for Nightly Miri and rewrote miri.md to wait on the next scheduled run; take main's text. Fold this PR's miri-frame.md into it: its rust-src half has landed, and confirming #7508's frame tests ran is read from that same scheduled log. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
kixelated
left a comment
There was a problem hiding this comment.
Automated review by review (OpenAI)
Reviewed head 608f138c3aa8b2416e931ea73e61fb5e25b20d5d, following c77c4163f9d7f085a6fce200fa4af1be5108d387 and accounting for the base merge. The duplicate Miri frame quest is folded into the existing Miri budget quest, retaining the requirement to confirm the frame tests run in the scheduled log; #7812 has installed rust-src. No additional actionable issue found in this reconciliation.
Verification: GitHub-only static review of the quest delta, canonical plan and test-selection script. I did not run quest checks, tests or a merge simulation.
(Written by review (OpenAI))
There was a problem hiding this comment.
✅ No new issues found.
Reviewed changes
The delta since the prior pullfrog review (c77c416) is one merge commit (608f138), which brings origin/main at abb59726 into the branch and folds the PR's Nightly Miri child into main's quest:
- Merged
origin/mainatabb59726(#7812, #7814, #7809); its code and quest edits are base content, not PR material. - Folded
quest/m0/nightly/miri-frame.mdinto main'squest/m0/nightly/miri.mdand removed the file with its Nightly README bullet. #7812 already installsrust-src, so only the frame-test check survives:miri.md:29-33now asks the scheduled log to confirm moq-net'smodel::frame::tests ran, including #7508's single-delivery path, matchingsh/rs/miri.sh:85. - Dropped the Nightly README's audits bullet now that main deleted
quest/m0/nightly/audits.md.
I verified on the merged tree that every relative and /quest/ link under quest/ resolves, all 28 added quest files are still referenced, no miri-frame link remains (only the prose provenance note, matching the other folds), git diff --check and sh/markdown.sh check pass, and there are no conflict markers. All prior pullfrog threads are resolved.
deepseek-v4.1-flash-1017 (free via Pullfrog for OSS) | 𝕏
|
quest land watch: the merge queue removed this pull request at 608f138 because it conflicts with The land fixer works on it in the background, and the watcher re-enqueues it at the back of the queue once it is fixed or judged flaky, or hands it back here with what it needs. (written by quest land watch) |
|
The failure is environmental, not caused by this PR, so there is no code change to push. Diagnosis
Why it is unrelated
Recommendation
|

Plans the follow-ups the maintainer settled in the 2026-11-03 follow-up planning interview, after the 2026-11-03 /quest-afk and /quest-complete runs. Each new quest records its milestone decision in its Plan, with the options shown and the pick marked ✅, and is linked from its milestone or epic README at rank.
New quests
m0:
sps::parse_fullis on main).MAX_METADATA_BYTES. Requires that PR's quest.nixos2's rind agents and moq-dev/moq#7605's bisect voided two of moq-dev/moq#7742's three lock-profile runs. The quest's PR decides whether the lock lives in moq's bench recipes or inquest gate, and records why. The Plan lays out both.quest gatehas no exclusive mode today, so a moq-only lock would serialize benches but not other agents' gated builds.## Requiredlist and loses its size):track_range_widening/1r/64's assertion is stale since moq-dev/moq#7545; found by moq-dev/moq#7536. Placed under Nightly rather than test-flakes: it isn't a flake, and Nightly'scargo bench -p moq-net --bench '*'hits it.Nightly Miri installs rust-src and covers the lock-free frame path: folded into main's Nightly's Miri job stays inside its time budget. moq-dev/moq#7812 installedrust-src, and confirming perf(net): a frame's single delivery writes without the publication lock #7508'smodel::frame::tests ran is now read from the scheduled log that quest already waits on. Main's plan wins.m1:
time_stretch,accelerate,preemptive_expand, anddecision_logicwith their thresholds. It's a sibling of Watch, not a dependent: the shared design is NetEq's, specified once indoc/concept/audio-jitter.mdwith test vectors that whichever stretch lands first writes. On main the browser stretch is still m2 Time stretch; test(audio-quality): real-microphone baseline for time stretch, from the kixtop playout run #7679 folds that into Watch. Both quests now link each other, and the epic README records the native m1 decision.## Required. Covers the MSFext__proto__key and, from fix(hang)!: preserve prototype-named text and data IDs #7498's iterate,js/publishrefusing a__proto__orconstructorrendition as "already registered". It wasmsf-ext-proto.md[XS] before being widened.m2:
## Required.@moq/jsonandmoq-jsondrop the group with a typed decode error, so@moq/roomand moq-boy resume at the next snapshot.The Moxygen smoke lane makes its own certificate config: folded into main's Smoke tests make their certificates without a system OpenSSL config, from moq-dev/moq#7747. It already covered both smoke scripts; this PR added the LibreSSL 4.3.2 repro and its error message. Main's plan (share the conformance helper) wins.moq-crypto signs on rind: folded into main's moq-crypto's signing runs on rind (planned by moq-dev/moq#7747, m1 in the rind epic that moq-dev/moq#7749 moved to m1). Its extra checks (hand-mapped errors, an aws-lc-freecargo tree, the sign bench) were added there. quest: plan the 2026-11-03 follow-ups #7747's newer m1 decision replaces this PR's m2 pick.Retire the moq-e2ee stub: folded into main's Retire the moq-e2ee stub, from quest: plan the 2026-11-03 follow-ups #7747. This PR added thejqversion check and kept the draft and profile names out of the cleanup grep. Main's plan wins where they differ: it requires Cut and publish rather than waiting on crates.io.## Waitingon ScuffleCloud/scuffle#653 and ScuffleCloud/scuffle#654.Edits
wideruns dry 1 to 4 times a minute at a 323 ms target, moq-dev/moq#7679). Resized [XS] to [S] for the added fix.Subscription{}means max 0 (moq-dev/moq#7697); its uniffi Related line now says fixes join the carried-over list.MoqBroadcastConsumer::instance()accessor if sockets don't make the local lease counter moot (moq-dev/moq#7678).m1/subscribe-ranges/lite.md: no change left. This PR recorded the SUBSCRIBE_STARTED decision (type 0x3, carrying Range ID and Range Start) in the interim, but moq-dev/moq#7675 merged with the same decision, so the merge takes main's text.rust-src), plus the folded check that perf(net): a frame's single delivery writes without the publication lock #7508's frame tests ran.Edits that keep the tree consistent with the new quests:
Deletion
quest/m0/test-flakes-2/tokio-close-drain.md, withquest rm: fixed by moq-dev/moq#7634 (489 of 960 runs failed on main, 0 of 2400 with it). The maintainer picked merge and delete.Dropped
Not planned anywhere, per the maintainer: the moq-dev/moq#7551 release backport; moq-dev/moq#7028's Initial-cipher-suite validation (decision 1(a) stands); cargo-hack in the dev shell (unused since 2026-10-31).
Decisions
The second batch (SUBSCRIBE_STARTED, the widening bench, the revoked announce reset) the third (the bench host lock), the fourth (JSON snapshot resync and prototype-safe rendition names, from the #7693 and #7498 iterates), and the fifth (native time-stretch from #7679, the Moxygen smoke cert from #7700) came in follow-up messages from the maintainer the same day.
Decided 2026-11-03 (maintainer, follow-up planning after the 2026-11-03 /quest-afk and /quest-complete runs). Each quest's Plan shows the options m0, m1, and m2 with the pick marked ✅.
Placement notes, since some targets are still in open PRs:
socket/rust.md, which moq-dev/moq#7677 deletes. It requires Rust sockets until then.## Required. fix(net): end a lapsed request token's requests with EXPIRED_AUTH_TOKEN #7703, fix(hang)!: preserve prototype-named text and data IDs #7498, fix(mux): bound what an fMP4 moov or moof costs to parse and plan #7687, and fix(moq-boy): end the status loop on an errored track #7693 have since merged, and their edges and links are already dropped here.Merge order
These edges point at quests that an open PR deletes. Each is a real blocker or the current owner until that PR lands, so they stay. Whichever of the two PRs merges second hits
quest check's dangling-link error when it merges the other, and fixes it there: drop the## Requirededge, or repoint the link, and keep the PR cited in the Plan. This PR already did so for #7703, #7498, #7687, #7693, #7685, #7676, #7679, #7702, #7688, #7749, and #7747.m1/fuzz-findings/sps-overflow.mdm0/video-sps-walk.md(Required),m2/scuffle-sps-bump.md(Related)m1/cluster-routing/routes.mdtoroutes/README.mdm2/route-interest-prefixes.md,m2/perf/kio-channel-contention/relay-per-thread.md, the routes Related linem1/subscribe-ranges/lite.mdm1/subscribe-ranges/js.mdm1/subscribe-ranges/js-fills.md(Required, Plan)m1/socket/rust.mdm1/socket/old-hop-dial.md(Required)m1/moq-crypto.mdrind/crypto.md(Required),m2/release/moq-e2ee-retire.md(Related)m2/watch-audio-time-stretch.mdm1/audio-jitter-target/native-stretch.md(Plan, Related), epic READMEm1/unbounded-groups/log-lock-profile.mdm2/rind/tom1/rind/rind/crypto.mdcrypto-sign.mdm2/miri-nightly-budget.mdtom0/nightly/miri.md; addsm1/rind/crypto-sign.md,m2/release/e2ee-retire.md,m2/smoke-libressl.mdm0/nightly/miri-frame.md; duplicatesrind/crypto.md,release/moq-e2ee-retire.md,smoke-moxygen-cert.mdm0/nightly/miri.md, installsrust-srcm0/nightly/miri-frame.mdmiri-frame.mdfolded into itm1/resume-model-7542.md,m1/mesh-fresh-port.md(#7688)m1/js-resume-model-12345.md,m1/tokio-client-fresh-port.md(Related)m1/moxygen-pin-bump.mdChecks
quest check --base origin/main(dev shell): 626 documents ok, after mergingorigin/main.sh/markdown.sh check: pass.Review
mechanical fix by quest land watch:
merged main at df672865be7878701f457463b9c306106f7d99c5 with the quest merge driver(head d574a1a)Head: a merge of
origin/mainthat resolves conflicts only.miri.mdtakes main's text after #7812 installedrust-src. This PR'smiri-frame.mdis folded into it the same way as the earlier duplicates: removed withquest rm, with its one remaining check (that #7508's frame tests ran) moved in. The maintainer said this merge needs no review round. No other quest landed on main since the last merge (#7809 and #7814 only edit or delete) duplicates this PR's.Last reviewed: Codex (
quest review), gpt-6.1-sol at medium effort, round 1 of a new session, on961dd6c28f505971355999e9d990c976b1a30f27againstorigin/mainat066b7cbf9e. No findings. That head folds this PR'smoq-e2ee-retire.mdandsmoke-moxygen-cert.mdinto #7747'se2ee-retire.mdandsmoke-libressl.md(Pullfrog's two threads on6ddf97a). A sweep of every quest #7747, #7795, and #7807 added found no other duplicates. The closest wereresume-seed-17893651.md(the Rust model, a different seed and symptom),repeated-eof.md(a RustOk(None)contract), andprofile-lock-switches.md(perf switch records, not host exclusivity). The head adds only a conflict-free merge of that sameorigin/main(c77c416).Previous head: a third merge of
origin/main, through the queue fixer's3ec3dbd, which followed #7749's rind move. Conflicts resolved: the Nightly epic lists this PR's children and #7747's, andmiri-frame.mdpoints atm0/nightly/miri.md, where #7747 moved the budget quest. Beyond the conflicts, one reconciliation: this PR'srind/crypto.mdduplicated #7747'scrypto-sign.md, so it's removed withquest rmand its three extra checks were added tocrypto-sign.md. The maintainer said this merge needs no new review round. Pullfrog's thread on that file's m2 pick is resolved by the fold.Older history:
Previous head: a second conflict-only merge of
origin/main. It takes #7679's deletion of m2 Time stretch and its epic README text, keeps the Native stretch sentence, and applies the Merge order fixes for #7679, #7702, and the finishedresume-model-7542andmesh-fresh-portquests. It also merges the queue fixer's755b044, which had reconciled the same links against an older main; the overlapping hunks keep this branch's wording. The previous merge (daffb4a) was also conflict-only:lite.mdtakes main's #7675 text, and the routes Related line moves into #7676's epic README. It also applies the Merge order fixes for #7685 and #7676: dropping two edges to the deletedsps-overflow.mdand repointing threeroutes.mdlinks. These are recorded mechanical edits with no planning change, so per the maintainer's instruction no new local review round ran. The last reviewed content is below.Latest: Codex (
quest review), gpt-6.1-sol at medium effort, round 5 of its session, onc8d8471b3f85dc8a7b70ab3af6449bdb9e45de26againstorigin/mainat0eff070d67. No findings. Since then the head added a conflict-free merge of thatorigin/main(f42dba2180) Pullfrog's suggested CMAF Goal patch (d5070b58b2), and CodeRabbit's suggested native-stretch vector wording (the head). The merge is conflict-free and both patches are applied unchanged, so none needs a new local review.e81565d) found one: Native stretch said Watch owns the browser stretch, while on main the m2 Time stretch quest owns it. Fixed by naming the current owner, noting test(audio-quality): real-microphone baseline for time stretch, from the kixtop playout run #7679's move, cross-linking both, and recording the native m1 decision in the epic. Refuted the request to rewrite Watch and delete the m2 quest here: that's open test(audio-quality): real-microphone baseline for time stretch, from the kixtop playout run #7679's change (removed quest/m2/watch-audio-time-stretch.md,modified quest/m1/audio-jitter-target/{watch,README}.md). Round 4 accepted it.f6a3c02,a1888e4,2bcd5fe,4e8cc3e,7ef3984,0740289,961da68) had no findings.Online:
f6a3c02(repeated through961da68):moof/moov, whileAny::decode_maybedecodes every top-level box: fixed inc8d8471. The quest bounds every top-level box beforeAny.c8d8471. It bounds received sample counts likeMAX_FRAGMENT_SAMPLES, refusessgpdcounts until moq-mux on a fixed mp4-atom lands, and tests small-box/large-count inputs.js.md, which feat(net)!: JS tracks serve the groups readers miss (JS ranges) #7696 deletes: refuted. The edge is a real blocker until feat(net)!: JS tracks serve the groups readers miss (JS ranges) #7696 lands, andquest checkcatches the dangling link in whichever PR merges second (link does not resolve), as it did here for fix(net): end a lapsed request token's requests with EXPIRED_AUTH_TOKEN #7703, fix(hang)!: preserve prototype-named text and data IDs #7498, fix(mux): bound what an fMP4 moov or moof costs to parse and plan #7687, and fix(moq-boy): end the status loop on an errored track #7693. See Merge order.961da68, Native stretch links the m2 Time stretch file test(audio-quality): real-microphone baseline for time stretch, from the kixtop playout run #7679 deletes: refuted on the same grounds. That file is the browser stretch's owner on main until test(audio-quality): real-microphone baseline for time stretch, from the kixtop playout run #7679 lands, and the fix for whichever lands second is in Merge order.961da68, the MSFexthalf is already fixed: accepted inc8d8471.decodeandencodekeep__proto__(catalog.test.ts). Only the exportedCatalogSchema'sz.recordremains, and the quest is narrowed to that plusjs/publish.f42dba2, align the CMAF Goal with its widened Plan: suggestion applied unchanged ind5070b5.d5070b5, the native stretch's shared vectors don't grade the choice between accelerate, expand, and hold: suggested wording applied unchanged at the head.f42dba2: no findings; it accepted the Merge order plan for the JS fills and native stretch links.a1888e4and4e8cc3e: dangling links to quests fix(net): end a lapsed request token's requests with EXPIRED_AUTH_TOKEN #7703 and docs(quest): accept the log lock profile and delete its quest #7742 delete. Fixed in2bcd5feand7ef3984.video-sps-walk.md(:263is a test fixture) andbench-latency-resolution.md(millisecond send time): fixed in961da68. CodeRabbit confirmed the first.(Written by Claude Opus 5.5)
🤖 Generated with Claude Code