[kixelated]

Problem

When a publisher withdraws a track it never finished, an FFI consumer sees Protocol/Unroutable over moq-lite and MoqError.Internal over the retained moq-transport drafts. The bindings' guides told readers to treat Unroutable as the publisher leaving. That cannot work over moq-transport: ietf::publisher::Served::status sends every failed track as PUBLISH_DONE/INTERNAL_ERROR, and group resets also carry INTERNAL_ERROR, because neither registry on draft 18, 20, or 22 has an Unroutable code.

Decision

Maintainer, 2026-11-01. The recommended option 1 was chosen:

1. ✅ Keep incoming wire errors as they are, and follow publisher runs by their announcement and broadcast lifecycle. A finished track already ends cleanly. Withdrawing unfinished content is still an error.
2. Choose a publisher-side cancellation mapping for route loss in Rust and JS.

Also decided: do not decode 0 as EOF, and do not send TRACK_ENDED for unfinished content. The maintainer approved the change this makes to the quest's error-kind-based Goal and to its milestone index entry.

Approach

• Wire: unchanged. Rust and JS already send INTERNAL_ERROR for a failed track and keep reset 0 as an error. JS's IETF publisher (js/net/src/ietf/publisher.ts) maps a failed track the same way Rust does, and @moq/watch already follows request.active and follow, never a track's error. So JS needed no change.
• Proof over every protocol. The live FFI server/client run-end test now runs on lite-07 and IETF drafts 18, 20, and 22. It reads the broadcast through follow(path), the way a player does, and checks each step:
  • finished media ends cleanly
  • the catalog ends and closed() resolves
  • the unfinished track keeps its wire error: Unroutable on lite, Internal on IETF
  • the announcement End arrives
  • a replacement run at the same path comes back from the next available() and delivers a frame
• Docs. The binding guides (C, C++, Dart, Go, Kotlin, Python, Swift) and the publisher doc comments (moq-ffi, moq-c, Go, Python, Swift) no longer say readers take Unroutable as the publisher leaving. They say the track ends with Unroutable (Internal over moq-transport, which has no such code). The guides also point readers to follow runs by announcement, citing identity and recovery. That concept page now names the moq-ffi bindings' follow(path)/available() and says that a track's error kind is not a signal to restart.
• Quest. This PR meets the rewritten goal, so it deletes quest/m1/ffi-ietf-run-end.md and its quest/m1/README.md entry with quest rm. The brief said to rewrite the Goal and the milestone description. Deleting the quest follows the guide's rule that the PR finishing a quest deletes it, rather than leaving behind a quest whose goal is already met. The moq.pro samples moving to available() belong to moq.pro's reader quest.

Impact

• Public API: unchanged. Doc comments only.
• Wire: unchanged.

Validation

On head a3732f575f, after merging origin/main e1e37dd4ed:

• just rs test -p moq-ffi: all 287 passed. This includes server_client_roundtrip (lite-07) and server_client_run_end_draft{18,20,22}. On today's main, a stream reset still sends INTERNAL_ERROR for Unroutable (rs/moq-net/src/ietf/error.rs, unregistered_conditions_are_internal). So the IETF assertion still holds.
• just check origin/main: passed (py, rs, c, cpp, js, markdown, gh, kt, swift, go, quest, shell, dart, and the rest).
• quest check --base origin/main: 550 documents ok.

Merge with main (2026-11-02)

The conflicts were all prose in the binding guides (C, Dart, Go, Kotlin, Python, Swift) and in doc/concept/identity.md. Both sides' intent is kept:

• From main: the newer Closing text (fix(net): lite-05/06 close waits for the subscriber's FIN; drop the legacy close quest #7296), the C guide's Discovery bullet (feat(ffi)!: require announcement captures #7484), and identity's "stream"/"broadcast" wording (feat(net)!: routes carry an instance and a per-instance epoch #7489).
• From this PR: the Ending cleanly text and the FFI follow(path)/available() sentence.

The FFI follow now takes an optional instance, which defaults to none, so follow(path) is still correct.

Review

Codex CLI, gpt-6.1-sol, medium effort (quest review --base origin/main --new), session 01a19ff5-44da-7f92-9bd2-8bf7164d0a7b, round 1, reviewed head a3732f575f25f72c597f7c7011e4b264b13542b6 against origin/main 5583782acd: no findings.

Automated reviews posted on the previous head 14a2271d5d, from OpenAI and Pullfrog, reported no findings. CodeRabbit was rate-limited.

🤖 Generated with Claude Code

(Written by Claude Opus 5.5)

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 6 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used all 4 included reviews currently available.

Learn how review limits work.

Review configuration:

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 38f8f836-7be7-4827-854e-a99439bbb593

Commits

Reviewing files that changed from the base of the PR and between e1e37dd and a3732f5.

Files selected for processing: 22

• dart/moq_ffi/lib/src/moq.dart
• doc/concept/identity.md
• doc/lib/c/index.md
• doc/lib/cpp/index.md
• doc/lib/dart/index.md
• doc/lib/go/index.md
• doc/lib/kt/index.md
• doc/lib/py/index.md
• doc/lib/swift/index.md
• go/wrapper/publish.go
• py/moq-rs/moq/publish.py
• quest/m1/README.md
• quest/m1/ffi-ietf-run-end.md
• rs/moq-c/src/api.rs
• rs/moq-c/src/publish.rs
• rs/moq-ffi/src/audio.rs
• rs/moq-ffi/src/json.rs
• rs/moq-ffi/src/media.rs
• rs/moq-ffi/src/producer.rs
• rs/moq-ffi/src/test.rs
• rs/moq-ffi/src/video.rs
• swift/Sources/Moq/Broadcast.swift

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

CodeRabbit Verify

• Run CodeRabbit Verify to test the changes in this pull request.

[kixelated]

Automated review by review (OpenAI)

Reviewed commit: 14a2271d5d23e1efeb8b4cd381b17d0ce8fa569e.

No actionable bugs found in the changed areas. Following publisher instances through the existing announcement lifecycle is simpler and more accurate than reclassifying an unfinished track as clean EOF. The shared FFI test covers finished media, unfinished-track errors, catalog/broadcast closure, and replacement-run delivery across lite-07 and IETF 18/20/22; the documentation now matches the existing Rust/JS error mappings without adding API or wire behavior.

Verification limits: static GitHub review of the diff and relevant lifecycle/error-handling code only. I did not run tests or independently verify the reported local checks.

(Written by OpenAI)

[pullfrog]

✅ No new issues found.

Reviewed changes — Documentation, test, and generated-binding updates for how the FFI follows publisher runs; no production logic and no wire change.

• Binding guides corrected — the c, cpp, dart, go, kt, py, and swift guides plus the Rust, Go, Python, and Swift wrapper docs no longer tell readers to take Unroutable as the publisher leaving. They state that a track withdrawn unfinished ends Unroutable (Internal over moq-transport, whose registry has no such code) and point at /concept/identity.
• identity.md names FFI following — adds the bindings' follow(path)/available() alongside the Rust and JS forms, and says a track's error kind is not the restart signal.
• Cross-protocol lifecycle test — server_client_run_end now runs over moq-lite-07-wip and moq-transport drafts 18, 20, and 22, proving a finished track ends cleanly, the catalog ends and closed() resolves, the unfinished track keeps its wire error (Unroutable on lite / Internal on IETF), the announcement End arrives, and a replacement run at the same path is handed out by the next available().
• Regenerated Dart checksum — the close() docstring moves the UniFFI method checksum, and only that line changes in the generated file (generated Dart strips doc comments); consistent.
• Quest removed — quest/m1/ffi-ietf-run-end.md and its README.md entry are deleted, following the maintainer-approved goal change.

I also checked for leftovers: no remaining occurrences of the removed "readers take as the publisher leaving" phrasing, no dangling references to the deleted quest, and the version strings used by the test are valid. The remaining publisher leaving comments (in moq-c/src/publish.rs, audio.rs:406, video.rs:546) describe the cause of Unroutable, not reader guidance, so they are accurate and in scope to leave.

  ^{｜ View workflow run ｜ Using deepseek-v4.1-flash (free via Pullfrog for OSS) ｜ 𝕏}

[pullfrog]

✅ No new issues found.

Reviewed changes — the delta since the prior Pullfrog review is a single merge of main (e1e37dd4e) into the branch, and its conflict resolution. The branch was far behind main, so the merge brought in a large body of upstream code; only the conflicts touch this PR's surface.

• identity.md merged — retains main's newer "stream"/"broadcast" wording alongside this PR's moq-ffi follow(path)/available() sentence and the "not a restart signal" note.
• Binding guides merged — each keeps main's newer Closing text (moq-lite-05 and newer wait for the peer to receive finished tails) with this PR's Ending cleanly text, so both intents survive.
• rs/moq-ffi/src/test.rs adapted — frame.timestamp_us became micros(frame.timestamp) for main's timestamp API; the micros/us helpers and the non-optional MoqMediaFrame::timestamp make it consistent.
• Dart checksum re-derived — moqbroadcastproducer_close moves 26090 → 21298, tracking only the close() docstring change (main did not churn the UniFFI checksum algorithm, so no mass rewrite).

Verified no conflict markers remain, no dangling reference to the deleted quest, and c/index.md still carries main's Discovery bullet. Test/just check claims were reviewed statically only.

  ^{｜ View workflow run ｜ Using deepseek-v4.1-flash (free via Pullfrog for OSS) ｜ 𝕏}