fix(net): lite-05/06 close waits for the subscriber's FIN; drop the legacy close quest

.config/hakari.toml

@@ -0,0 +1,28 @@
+# This file contains settings for `cargo hakari`.
+# See https://docs.rs/cargo-hakari/latest/cargo_hakari/config for a full list of options.
+
+hakari-package = "workspace-hack"
+
+# Format version for hakari's output. Version 4 requires cargo-hakari 0.9.22 or above.
+dep-format-version = "4"
+
+# Setting workspace.resolver = "2" or higher in the root Cargo.toml is HIGHLY recommended.
+# Hakari works much better with the v2 resolver. (The v2 and v3 resolvers are identical from
+# hakari's perspective, so you're welcome to set either.)
+#
+# For more about the new feature resolver, see:
+# https://blog.rust-lang.org/2021/03/25/Rust-1.51.0.html#cargos-new-feature-resolver
+resolver = "2"
+
+# Add triples corresponding to platforms commonly used by developers here.
+# https://doc.rust-lang.org/rustc/platform-support.html
+platforms = ["aarch64-apple-darwin", "aarch64-unknown-linux-gnu", "x86_64-pc-windows-msvc", "x86_64-unknown-linux-gnu"]
+
+# Write out exact versions rather than a semver range. (Defaults to false.)
+# exact-versions = true
+
+[traversal-excludes]
+workspace-members = ["moq-net-fuzz", "moq-quic-fuzz"]
+
+[final-excludes]
+workspace-members = ["kio-macros"]

.config/nextest.toml

@@ -60,3 +60,12 @@ slow-timeout = { period = "60s", terminate-after = 2 }
 retries = 0
 # Repeat each failure at the end of the run, so it isn't buried in the log.
 failure-output = "immediate-final"
+
+# `just rs miri` interprets every instruction, orders of magnitude slower than
+# native, so a test that takes a second here takes minutes there. The cap still
+# turns a lost wakeup into a TIMEOUT; keep a test under it by shrinking its
+# workload under `cfg(miri)`, as with the native ceiling above.
+[profile.miri]
+slow-timeout = { period = "300s", terminate-after = 3 }
+retries = 0
+failure-output = "immediate-final"

.github/actionlint.yaml

@@ -1,3 +1,7 @@
+self-hosted-runner:
+  # The host's merge queue runner (kixelated/nixos modules/ci-runners.nix).
+  labels:
+    - moq-queue
 paths:
   # GitHub's `queue: max` on the shared Pages writers. actionlint learns it in
   # https://github.com/rhysd/actionlint/pull/661, unreleased after 1.7.12.

.github/actions/nasm/action.yml

@@ -0,0 +1,13 @@
+name: Install NASM
+description: Install the pinned NASM on a Windows runner, where aws-lc-rs assembles its x86_64 crypto with it.
+
+runs:
+  using: composite
+  steps:
+    # The Chocolatey package version, not NASM's own (3.2.0 installs NASM 3.02).
+    # GITHUB_PATH gets a constant directory, nothing an event can steer.
+    - name: Install NASM
+      shell: pwsh
+      run: | # zizmor: ignore[github-env]
+        choco install nasm --version=3.2.0 -y --no-progress
+        "C:\Program Files\NASM" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append

.github/actions/rust-cache/action.yml

@@ -12,14 +12,16 @@ inputs:
 runs:
   using: composite
   steps:
-    - name: Require the landing gate on self-hosted runners
-      if: runner.environment == 'self-hosted' && (github.workflow != 'Land' || github.ref != 'refs/heads/main')
+    # Only main's merge queue builds on the self-hosted runner: a maintainer
+    # picked each group's PR, so nothing unreviewed writes its persistent caches.
+    - name: Require main's merge queue on self-hosted runners
+      if: runner.environment == 'self-hosted' && !(github.workflow == 'Queue' && github.event_name == 'merge_group' && startsWith(github.ref, 'refs/heads/gh-readonly-queue/main/'))
       shell: bash
       run: |
-        echo "::error::Persistent self-hosted caches require Land on main." >&2
+        echo "::error::Persistent self-hosted caches require Queue on main's merge queue." >&2
         exit 1
 
-    # Hosted runs on `main` write; everything else reads. The landing worker
+    # Hosted runs on `main` write; everything else reads. The merge queue
     # uses only its local store and receives no remote credentials.
     #
     # The write key is the boundary. It lives in the `cache-write`

.github/actions/uniffi-bindgen/action.yml

@@ -0,0 +1,35 @@
+name: Install a uniffi binding generator
+description: Build the pinned uniffi-bindgen-cpp or uniffi-bindgen-go for jobs outside the nix dev shell, which already provides both.
+
+inputs:
+  generator:
+    description: "`cpp` for uniffi-bindgen-cpp (which also renders C) or `go` for uniffi-bindgen-go."
+    required: true
+
+runs:
+  using: composite
+  steps:
+    # The one CI pin for each generator. A tag can be moved and `--locked` pins
+    # only the dependencies, so each pin is the commit its flake.nix tag peels
+    # to: `git ls-remote <repo> 'refs/tags/<tag>^{}'`. Bump it with the tag in
+    # flake.nix; see the comments there.
+    - name: Install uniffi-bindgen-${{ inputs.generator }}
+      shell: bash
+      env:
+        GENERATOR: ${{ inputs.generator }}
+      run: |
+        case "$GENERATOR" in
+          cpp)
+            repo=https://github.com/kixelated/uniffi-bindgen-cpp
+            rev=a5a1ac411772b3f589859edf50aef7bc7538100b # v0.11.0-kixelated.7+v0.32.2
+            ;;
+          go)
+            repo=https://github.com/kixelated/uniffi-bindgen-go
+            rev=374a887fea3cde238ac3c5646dbd2963de7a6a83 # v0.10.0-kixelated.1+v0.32.0
+            ;;
+          *)
+            echo "::error::unknown uniffi generator: $GENERATOR"
+            exit 1
+            ;;
+        esac
+        cargo install --locked "uniffi-bindgen-$GENERATOR" --git "$repo" --rev "$rev"

.github/workflows/android.yml

@@ -31,6 +31,7 @@ concurrency:
 
 env:
   CARGO_NDK_VERSION: 4.1.2
+  CARGO_HAKARI_VERSION: 0.9.39
 
 jobs:
   android:
@@ -58,5 +59,13 @@ jobs:
       - name: Install cargo-ndk
         run: cargo install --locked "cargo-ndk@$CARGO_NDK_VERSION"
 
+      # The host dev-dependencies in the workspace-hack need the Nix shell's
+      # native libraries, which this cross-build deliberately runs without.
+      - name: Disable the workspace-hack
+        run: |
+          cargo install --locked "cargo-hakari@$CARGO_HAKARI_VERSION"
+          cargo hakari disable
+          cargo update --workspace
+
       - name: Check
         run: just rs android

.github/workflows/c.yml

@@ -35,8 +35,9 @@ jobs:
 
       - uses: ./.github/actions/just
 
-      - name: Install uniffi-bindgen-cpp
-        run: cargo install uniffi-bindgen-cpp --locked --git https://github.com/kixelated/uniffi-bindgen-cpp --tag v0.11.0-kixelated.7+v0.32.2
+      - uses: ./.github/actions/uniffi-bindgen
+        with:
+          generator: cpp
 
       - name: Check
         run: just c check

.github/workflows/check.yml

@@ -3,7 +3,7 @@ name: Check
 permissions:
   contents: read
 
-# Main PRs report Check as skipped; Land tests their combined prefix.
+# Main PRs report Check as skipped; the merge queue tests each one (queue.yml).
 # Release PRs run the same gate over every package.
 on:
   pull_request:

.github/workflows/cpp.yml

@@ -35,8 +35,9 @@ jobs:
 
       - uses: ./.github/actions/just
 
-      - name: Install uniffi-bindgen-cpp
-        run: cargo install uniffi-bindgen-cpp --locked --git https://github.com/kixelated/uniffi-bindgen-cpp --tag v0.11.0-kixelated.7+v0.32.2
+      - uses: ./.github/actions/uniffi-bindgen
+        with:
+          generator: cpp
 
       - name: Check
         run: just cpp check

.github/workflows/dependabot.yml

@@ -65,9 +65,10 @@ jobs:
           private-key: ${{ secrets.APP_PRIVATE_KEY }}
           owner: moq-dev
           repositories: moq
-          # Only the permissions needed to pin and request a landing.
+          # Only the permissions needed to pin and enqueue a landing.
           permission-contents: write
           permission-pull-requests: write
+          permission-merge-queues: write
 
       - name: Request checked landing
         env:
@@ -77,5 +78,4 @@ jobs:
           PR_HEAD: ${{ github.event.pull_request.head.sha }}
         run: |
           export GH_TOKEN="$BOT_TOKEN"
-          hold=$(quest merge "$PR_URL")
-          quest merge "$PR_URL" "$hold" --land "$PR_HEAD"
+          quest merge "$PR_URL" --land "$PR_HEAD"

.github/workflows/features.yml

@@ -32,6 +32,11 @@ jobs:
         with:
           access-key-id: ${{ secrets.MBX_R2_ACCESS_KEY_ID }}
           secret-access-key: ${{ secrets.MBX_R2_SECRET_ACCESS_KEY }}
+      # The workspace-hack unifies third-party features so the gate's builds
+      # share a cache, which would hide a crate using a feature it does not
+      # declare. Every build here checks declarations, so it runs without it.
+      - name: Disable the workspace-hack
+        run: nix develop --command bash -c 'cargo hakari disable && cargo update --workspace'
       - name: Check feature and profile variants
         run: nix develop --command just ${{ matrix.recipe }}
         env:

.github/workflows/nightly.yml

@@ -93,7 +93,7 @@ jobs:
   # cross-night history on the benchmark site stays informational.
   nightly:
     name: Nightly (${{ matrix.name }})
-    runs-on: ${{ matrix.runner || 'ubuntu-24.04-arm' }}
+    runs-on: ubuntu-24.04-arm
     # Hosted `main` jobs write the Rust cache; see .github/actions/rust-cache.
     environment: ${{ github.ref == 'refs/heads/main' && 'cache-write' || '' }}
     timeout-minutes: 60
@@ -104,21 +104,9 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        # Unset keys default to the ARM runner, the plain dev shell, the Rust
-        # cache, no perf sampling, and nextest's default profile.
+        # Unset keys default to the plain dev shell, the Rust cache, and
+        # nextest's default profile.
         include:
-          - name: Audio grouping relay benchmark
-            recipe: bench-audio
-          - name: Relay shard sweep
-            recipe: bench-shard
-          # Smoke-tests each capture path: exact off-CPU waits, CPU stacks, and
-          # heap snapshots, each refused without resolved relay stacks.
-          # x86: on the SVE-capable ARM runner, perf's DWARF unwinding asks for the SVE VG
-          # register, which the kernel refuses for the software context-switches event.
-          - name: Relay profiles
-            recipe: bench-profile "lock cpu heap" fanout-heavy 4
-            perf: true
-            runner: ubuntu-24.04
           - name: Rust benchmark tests
             recipe: gh nightly rust-test
           - name: Binding benchmark runners
@@ -221,11 +209,6 @@ jobs:
           access-key-id: ${{ secrets.MBX_R2_ACCESS_KEY_ID }}
           secret-access-key: ${{ secrets.MBX_R2_SECRET_ACCESS_KEY }}
 
-      # perf samples the relay in kernel context into large buffers; bench-profile refuses without it.
-      - name: Allow perf kernel sampling
-        if: matrix.perf
-        run: sudo sysctl -w kernel.perf_event_paranoid=-1
-
       - name: Run workload
         id: workload
         run: nix develop ${{ matrix.shell }} --command just ${{ matrix.recipe }}
@@ -369,6 +352,11 @@ jobs:
         # virtual camera, a module load no pull request job should make.
         # `js worklet-matrix` loads `?worklet` output through the bundlers pinned in test/worklet.
         recipe: ["gate", "rs doctest --workspace", "rs send-depth", "test drill-sensitivity", "rs uring", "test drain", "test json-properties", "test resume-model", "rs quic-sim", "test drill impaired", "rs cli-export", "rs quic-stress", "rs audio-devices", "rs multicast", "rs render-sw", "test qmux", "rs v4l2", "js worklet-matrix"]
+        include:
+          # Miri interprets kio's and moq-net's in-memory unsafe; too slow for the merge gate.
+          - recipe: rs miri
+            nightly: true
+            components: miri
     steps:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -380,6 +368,12 @@ jobs:
         with:
           access-key-id: ${{ secrets.MBX_R2_ACCESS_KEY_ID }}
           secret-access-key: ${{ secrets.MBX_R2_SECRET_ACCESS_KEY }}
+      - name: Install nightly Rust
+        if: matrix.nightly
+        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
+        with:
+          toolchain: nightly
+          components: ${{ matrix.components }}
       - name: Add a second IPv6 loopback address
         if: matrix.recipe == 'rs uring'
         # moq-uring's local address test reaches a wildcard socket on it.

.github/workflows/platform.yml

@@ -87,12 +87,9 @@ jobs:
           fetch-depth: 0
       - name: Install Rust
         uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
-      - name: Install NASM
-        shell: pwsh
-        run: |
-          choco install nasm -y --no-progress
-          "C:\Program Files\NASM" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append
+      - uses: ./.github/actions/nasm
       - uses: ./.github/actions/just
+      # Bump with the macOS job's copy and .oss-scanner/Dockerfile's NEXTEST_VERSION.
       - name: Install nextest
         if: needs.scope.outputs.rs == 'true'
         uses: taiki-e/install-action@1e29709c0ec63babbe8f266397a465f29a825f91 # v2.87.31
@@ -104,10 +101,10 @@ jobs:
         with:
           access-key-id: ${{ secrets.MBX_R2_ACCESS_KEY_ID }}
           secret-access-key: ${{ secrets.MBX_R2_SECRET_ACCESS_KEY }}
-      - name: Install uniffi-bindgen-cpp
+      - uses: ./.github/actions/uniffi-bindgen
         if: needs.scope.outputs.c == 'true' || needs.scope.outputs.cpp == 'true' || needs.scope.outputs.obs == 'true'
-        shell: bash
-        run: cargo install uniffi-bindgen-cpp --locked --git https://github.com/kixelated/uniffi-bindgen-cpp --tag v0.11.0-kixelated.7+v0.32.2
+        with:
+          generator: cpp
       - name: Rust compile and tests
         if: needs.scope.outputs.rs == 'true'
         shell: bash
@@ -155,9 +152,10 @@ jobs:
         with:
           access-key-id: ${{ secrets.MBX_R2_ACCESS_KEY_ID }}
           secret-access-key: ${{ secrets.MBX_R2_SECRET_ACCESS_KEY }}
-      - name: Install uniffi-bindgen-cpp
+      - uses: ./.github/actions/uniffi-bindgen
         if: needs.scope.outputs.obs == 'true'
-        run: cargo install uniffi-bindgen-cpp --locked --git https://github.com/kixelated/uniffi-bindgen-cpp --tag v0.11.0-kixelated.7+v0.32.2
+        with:
+          generator: cpp
       - name: Rust compile and tests
         if: needs.scope.outputs.rs == 'true'
         env: