[kixelated]

Problem

On 1.3.5, one discarded Retry prevents the client from following a genuine Retry or processing Version Negotiation. This backports moq-dev/moq#5916 for /quest/m0/retry-backport.md.

Approach

Use the handshake's accepted server Initial/Retry state instead of counting authenticated packets. Include the source CID validation already present in moq-quic. Port four deterministic tests for invalid Retry, repeated Retry, subsequent genuine Retry, and subsequent Version Negotiation.

Impact

• Public API: none.
• Wire: no format change; invalid Retry packets are discarded without poisoning subsequent handshake processing.
• No package versions changed or publication triggered.

Validation

• Both handshake-progress regressions fail on unmodified 1.3.5.
• cargo nextest run --locked -p moq-noq-proto: 469 passed, including all four Retry tests; two BBR tests exceeded the existing six-second limit (probe_bw_exits_probe_down_to_probe_cruise_on_inflight, probe_bw_exits_probe_up_to_probe_down_on_bandwidth_plateau). No timeout changes or retries.
• cargo clippy --locked -p moq-noq-proto --all-targets -- -D warnings passed.
• Repository formatting check and git diff --check passed.
• Existing moq-ci runs the new tests on PRs.

Alternatives

Rely on the next MoQ release from main, where the fix is already present. Keeping the authenticated-packet counter cannot distinguish a discarded Retry from a processed server packet.

Follow-ups

Confirm the 1.3.6 publication: #42 and #43 were closed on October 17 with a decision against patching the release line, while the newer MoQ quest explicitly requests this backport. Recommended: approve this targeted handshake fix, publish 1.3.6, then update MoQ's release dependency pin. No merge or publication is part of this PR's execution. The two BBR test timeouts remain outside this fix.

(written by GPT-6.1-Sol)

[kixelated]

Checkpoint: 3dcbdf9 contains the source backport and four regression tests. All four pass; the full proto run passed 469 tests and hit the two BBR timeouts listed above. Formatting and clippy pass. Public API and wire formats are unchanged.

Handing off the 1.3.6 publication decision before any merge, release tag, or MoQ release pin update. Recommendation: ship this targeted fix, then adopt the published version. The quest remains incomplete until both release steps are done.

(written by GPT-6.1-Sol)

[kixelated]

Closing as abandoned: we're no longer patching noq and are switching to moq-quic. The release line will not get a moq-noq 1.3.x patch; the discarded-Retry fix ships from main (moq-quic, moq-dev/moq#5916) in the next release cut. The quest is removed in moq-dev/moq#6043. Branch kept.

(Written by Claude Opus 5.5)