From d1c4e5bbe67999756ee8b3dbd686d5ada0e73c5f Mon Sep 17 00:00:00 2001
From: shermerL <xizhizeze@126.com>
Date: Thu, 5 Nov 2026 19:36:06 +0000
Subject: [PATCH 01/36] fix(publish): wait for video dimensions before showing
 previews (#7926)

---
 js/publish/src/element.ts                     |  11 +-
 quest/m2/README.md                            |   2 -
 quest/m2/publish-empty-previews.md            |  30 ---
 quest/m2/publish-video-loading.md             |  55 -----
 test/interop/clients/js/publish-ui.browser.ts | 200 ++++++++++++++++++
 5 files changed, 210 insertions(+), 88 deletions(-)
 delete mode 100644 quest/m2/publish-empty-previews.md
 delete mode 100644 quest/m2/publish-video-loading.md

diff --git a/js/publish/src/element.ts b/js/publish/src/element.ts
index 98f97576abd..b45048cf90f 100644
--- a/js/publish/src/element.ts
+++ b/js/publish/src/element.ts
@@ -392,8 +392,17 @@ export default class MoqPublish extends HTMLElement {
 				return;
 			}
 
+			// Keep the pre-metadata placeholder out of the UI's retained aspect ratio.
+			let ready = false;
+			const resize = () => {
+				if (ready || preview.videoWidth === 0) return;
+				// Later media resizes must preserve the page's display choice.
+				ready = true;
+				preview.style.display = "block";
+			};
+			effect.event(preview, "loadedmetadata", resize);
+			effect.event(preview, "resize", resize);
 			preview.srcObject = new MediaStream([Video.normalizeSource(source).track]);
-			preview.style.display = "block";
 
 			effect.cleanup(() => {
 				preview.srcObject = null;
diff --git a/quest/m2/README.md b/quest/m2/README.md
index 84e83de8cb9..cbfbba7a9ec 100644
--- a/quest/m2/README.md
+++ b/quest/m2/README.md
@@ -278,8 +278,6 @@ lite-07; bitrate enforcement is not part of this release.
 - [Open-GOP MPEG-2 export trims leading B-pictures in zero-stuffed CBR streams](/quest/m2/pes-hold-open-gop.md) - A TS export starting or resuming inside an open GOP of MPEG-2 video drops the orphaned leading B-pictures even when their PES ends on zero stuffing, as CBR encoders emit, without ever trimming part of a reference picture whose start code straddles two PES packets
 - [A multi-program TS import survives a source switch](/quest/m2/ts-multi-program-restart.md) - `--program all` restarts each affected program on an unannounced source switch, as a single-program import does after moq-dev/moq#7780, instead of ending the whole import
 - [The lite publisher tells transport faults from cancels](/quest/m2/publish-cancel-classify.md) - `rs/moq-net`'s lite publisher no longer counts every `Error::Transport` as a clean cancel
-- [moq-publish hides previews that show nothing](/quest/m2/publish-empty-previews.md) - `<moq-publish>` hides a preview that renders nothing
-- [A loading video preview takes no space](/quest/m2/publish-video-loading.md) - a `<video>` preview stays hidden until it reports its media size, so the empty publish player never keeps the 300x150 placeholder ratio
 - [moq-quic's sim pair fails a test that sends an oversized packet](/quest/m2/quic-sim-mtu.md) - A moq-quic test whose endpoint sends a datagram larger than the simulated path MTU fails, instead of the `Pair` silently dropping it
 - [A stalled reader within budget gets no Old resets through a relay](/quest/m2/relay-capped-credit-test.md) - A test proves that a subscriber which stalls before its first read, behind a relay over a transport with capped stream credit, receives no `Old` stream resets for groups still within its max-delay budget, and reads them in order once it resumes
 - [In-memory transports refuse a request without stream credit](/quest/m2/sim-credit-open.md) - moq-net's in-memory test transports model the peer's bidirectional stream credit, and `poll_open_request` returns `Ok(None)`
diff --git a/quest/m2/publish-empty-previews.md b/quest/m2/publish-empty-previews.md
deleted file mode 100644
index 8fe89ab55f8..00000000000
--- a/quest/m2/publish-empty-previews.md
+++ /dev/null
@@ -1,30 +0,0 @@
-# [XS] moq-publish hides previews that show nothing
-
-## Goal
-
-`<moq-publish>` hides a preview that renders nothing (an idle `<video>`
-placeholder, a hidden camera's canvas), so its UI sizes purely from the
-observed rendered size, with no capture gate.
-
-## Plan
-
-Decided 2026-10-31 (user, /quest-plan of the follow-ups from the 2026-10-31
-/quest-complete run), from
-[moq-dev/moq#7247](https://github.com/moq-dev/moq/pull/7247): m2, as
-recommended. [moq-dev/moq#7247](https://github.com/moq-dev/moq/pull/7247) (merged) sizes controls from the
-rendered preview and combines that with an `invisible` capture rule.
-
-- In `js/publish/src/element.ts`'s preview effect (`:279` as of
-  be39188000), set the empty previews to `display: none` while they have
-  nothing to show. A `<video>` already is with no visible source (`:314`),
-  but the `<canvas>` branch (`:285`) never hides, so an idle canvas keeps
-  its 300x150 placeholder and a hidden camera's canvas keeps its size. Check
-  the `<video>` idle state too, then drop
-  [moq-dev/moq#7247](https://github.com/moq-dev/moq/pull/7247)'s capture gate from the size observer
-  in `js/publish/src/ui/element.ts` (`:115`).
-- Test in `test/interop/clients/js/publish-ui.browser.ts`, beside
-  [moq-dev/moq#7247](https://github.com/moq-dev/moq/pull/7247)'s publish-controls cases, since sizing
-  needs real layout: idle and hidden-camera states report an empty size; a
-  live capture reports its rendered size.
-
-Public API: none. Wire: none.
diff --git a/quest/m2/publish-video-loading.md b/quest/m2/publish-video-loading.md
deleted file mode 100644
index dd8eefaba55..00000000000
--- a/quest/m2/publish-video-loading.md
+++ /dev/null
@@ -1,55 +0,0 @@
-# [XS] A loading video preview takes no space
-
-## Goal
-
-A `<video>` preview in `<moq-publish>` stays hidden until it reports its media
-size, so `<moq-publish-ui>` never retains the browser's pre-metadata
-placeholder ratio (300x150) as the empty player's aspect ratio. Hiding,
-showing, and quickly hiding the camera again leaves the empty player at the
-last real preview's ratio.
-
-Non-goals: the `<canvas>` preview and the UI's size observer, which
-[moq-publish hides previews that show nothing](/quest/m2/publish-empty-previews.md)
-owns.
-
-## Plan
-
-Decided 2026-11-03 (user, /quest-import of
-[moq-dev/moq#7826](https://github.com/moq-dev/moq/issues/7826)):
-
-- Goal ✅ Fix it, rather than won't fix (cosmetic and self-healing) or asking
-  [moq-dev/moq#7832](https://github.com/moq-dev/moq/pull/7832) to absorb it,
-  since that PR scoped it out.
-- Approach ✅ Hide until sized: in `js/publish/src/element.ts`'s preview
-  effect (the `<video>` branch, `preview.style.display = "block"` right after
-  setting `srcObject`, `:362` as of 57902187f6), keep the video
-  `display: none` until `videoWidth > 0` (`loadedmetadata` or `resize`), then
-  show it. This follows the required quest's rule that a preview showing
-  nothing is hidden, and leaves `js/publish/src/ui/element.ts` sizing purely
-  from the rendered size. Rejected: the UI ignoring a slotted video with no
-  `videoWidth` (couples the UI to the preview element type), and pre-sizing the
-  video from `track.getSettings()` (settings can be missing or pre-rotation,
-  so it needs this fallback anyway).
-- Milestone ✅ m2, after the required quest, since both edit the same preview
-  effect and the race is cosmetic.
-
-Confirm a `display: none` video with a `MediaStream` `srcObject` still reaches
-`HAVE_METADATA` in Chromium; if a browser withholds it, hide it without
-removing it from layout (such as `visibility: hidden` with zero size) instead.
-Remove the listener in the effect's cleanup so a stale stream can't show the
-element.
-
-Test in `test/interop/clients/js/publish-ui.browser.ts` beside the required
-quest's hide/show cases: restore the preview, set `invisible` on the next
-`loadedmetadata` (the report's targeted sequence, 10/10 on unmodified code),
-and assert the empty player keeps the previously observed height.
-
-Public API: none. Wire: none.
-
-## Required
-
-- [moq-publish hides previews that show nothing](/quest/m2/publish-empty-previews.md) - `<moq-publish>` hides a preview that renders nothing
-
-## Closes
-
-- [#7826](https://github.com/moq-dev/moq/issues/7826) - a quick hide during video restore retains the loading placeholder's aspect ratio
diff --git a/test/interop/clients/js/publish-ui.browser.ts b/test/interop/clients/js/publish-ui.browser.ts
index abd740abcdf..fb8c793547a 100644
--- a/test/interop/clients/js/publish-ui.browser.ts
+++ b/test/interop/clients/js/publish-ui.browser.ts
@@ -328,6 +328,206 @@ test.each(["video", "canvas"] as const)(
 	30_000,
 );
 
+test.each(["hold", "release"] as const)(
+	"a loading video preserves the last media aspect with capture=%s",
+	async (capture) => {
+		const server = await createServer({
+			configFile: false,
+			root: `${import.meta.dir}/publish-ui`,
+			plugins: [worklet()],
+			server: { host: "127.0.0.1", port: 0 },
+		});
+		await server.listen();
+		const browser = await launch(["--use-fake-device-for-media-stream", "--use-fake-ui-for-media-stream"]);
+		try {
+			const page = await browser.newPage({ viewport: { width: 960, height: 720 } });
+			await page.goto(server.resolvedUrls?.local[0] ?? "");
+			await page.getByRole("button", { name: "Settings", exact: true }).waitFor();
+			const fixture = await page.evaluateHandle((capture) => {
+				const publish = document.querySelector<MoqPublish>("moq-publish");
+				const player = publish?.parentElement?.shadowRoot?.querySelector<HTMLElement>(".player");
+				if (!publish || !player) throw new Error("missing publish controls");
+				const preview = document.createElement("video");
+				preview.autoplay = true;
+				preview.muted = true;
+				preview.style.width = "100%";
+				preview.style.height = "auto";
+				publish.append(preview);
+				publish.capture = capture;
+				publish.muted = true;
+				publish.invisible = false;
+				const fixture = { publish, preview, player, observed: -1, metadata: 0, unsized: false };
+				new ResizeObserver(([entry]) => {
+					fixture.observed = entry.contentRect.height;
+					if (fixture.observed > 0 && preview.videoWidth === 0) fixture.unsized = true;
+				}).observe(publish);
+				publish.source = "camera";
+				return fixture;
+			}, capture);
+			const shown = () =>
+				page.waitForFunction(({ publish, preview, player, observed }) => {
+					const height = publish.getBoundingClientRect().height;
+					const mediaHeight =
+						(preview.getBoundingClientRect().width * preview.videoHeight) / preview.videoWidth;
+					return (
+						preview.videoWidth > 0 &&
+						getComputedStyle(preview).display !== "none" &&
+						height > 0 &&
+						observed === height &&
+						Math.abs(height - mediaHeight) < 0.5 &&
+						Math.abs(player.getBoundingClientRect().height - height) < 0.5
+					);
+				}, fixture);
+			const hidden = () =>
+				page.waitForFunction(
+					({ preview, player, observed }) =>
+						observed === 0 &&
+						getComputedStyle(preview).display === "none" &&
+						player.classList.contains("player--empty"),
+					fixture,
+				);
+			await shown();
+			const height = await fixture.evaluate(({ player }) => player.getBoundingClientRect().height);
+			for (const control of ["invisible", "preview"] as const) {
+				await fixture.evaluate(({ publish }, control) => {
+					if (control === "invisible") publish.invisible = true;
+					else publish.preview = "none";
+				}, control);
+				await hidden();
+				await fixture.evaluate((fixture, control) => {
+					const { publish, preview } = fixture;
+					fixture.metadata = 0;
+					// Target the transition where ResizeObserver may still hold the loading size.
+					preview.addEventListener(
+						"loadedmetadata",
+						() => {
+							fixture.metadata++;
+							if (control === "invisible") publish.invisible = true;
+							else publish.preview = "none";
+						},
+						{ once: true },
+					);
+					if (control === "invisible") publish.invisible = false;
+					else publish.preview = "source";
+				}, control);
+				await page.waitForFunction(({ metadata }) => metadata === 1, fixture);
+				await hidden();
+				expect(await fixture.evaluate(({ player }) => player.getBoundingClientRect().height)).toBeCloseTo(
+					height,
+					0,
+				);
+				// A later normal restore must still display the stream after the interrupted binding.
+				await fixture.evaluate(({ publish }, control) => {
+					if (control === "invisible") publish.invisible = false;
+					else publish.preview = "source";
+				}, control);
+				await shown();
+			}
+			expect(await fixture.evaluate(({ unsized }) => unsized)).toBe(false);
+		} finally {
+			await browser.close();
+			await server.close();
+		}
+	},
+	30_000,
+);
+
+test.each(["hold", "release"] as const)(
+	"a ready video preserves page display choices across media resizes with capture=%s",
+	async (capture) => {
+		const server = await createServer({
+			configFile: false,
+			root: `${import.meta.dir}/publish-ui`,
+			plugins: [worklet()],
+			server: { host: "127.0.0.1", port: 0 },
+		});
+		await server.listen();
+		const browser = await launch(["--use-fake-device-for-media-stream", "--use-fake-ui-for-media-stream"]);
+		try {
+			const page = await browser.newPage();
+			await page.goto(server.resolvedUrls?.local[0] ?? "");
+			await page.getByRole("button", { name: "Settings", exact: true }).waitFor();
+			const fixture = await page.evaluateHandle((capture) => {
+				const publish = document.querySelector<MoqPublish>("moq-publish");
+				if (!publish) throw new Error("missing publisher");
+				const canvas = document.createElement("canvas");
+				canvas.width = 1280;
+				canvas.height = 720;
+				const context = canvas.getContext("2d");
+				if (!context) throw new Error("missing canvas context");
+				const draw = () => context.fillRect(0, 0, canvas.width, canvas.height);
+				draw();
+				const timer = setInterval(draw, 33);
+				const original = navigator.mediaDevices.getUserMedia.bind(navigator.mediaDevices);
+				navigator.mediaDevices.getUserMedia = async (constraints) =>
+					constraints?.video ? canvas.captureStream(30) : original(constraints);
+				const preview = document.createElement("video");
+				preview.autoplay = true;
+				preview.muted = true;
+				publish.append(preview);
+				publish.capture = capture;
+				publish.muted = true;
+				publish.backend = "2d";
+				publish.invisible = false;
+				publish.source = "camera";
+				return { publish, preview, canvas, draw, timer };
+			}, capture);
+			const shown = () =>
+				page.waitForFunction(
+					({ preview, canvas }) =>
+						preview.videoWidth === canvas.width && getComputedStyle(preview).display === "block",
+					fixture,
+				);
+			await shown();
+			// Check a second binding too: readiness belongs to each binding, not the element.
+			for (const display of ["none", "inline-block"]) {
+				await fixture.evaluate(async ({ preview }) => preview.play());
+				const result = await fixture.evaluate(async ({ preview, canvas, draw }, display) => {
+					const stream = preview.srcObject as MediaStream;
+					const track = stream.getVideoTracks()[0];
+					preview.style.display = display;
+					const width = canvas.width === 1280 ? 640 : 1280;
+					const resized = new Promise<boolean>((resolve) => {
+						const listener = (event: Event) => {
+							if (preview.videoWidth !== width) return;
+							preview.removeEventListener("resize", listener);
+							resolve(event.isTrusted);
+						};
+						preview.addEventListener("resize", listener);
+					});
+					canvas.width = width;
+					canvas.height = width === 640 ? 480 : 720;
+					draw();
+					const trusted = await resized;
+					return {
+						display: getComputedStyle(preview).display,
+						sameStream: preview.srcObject === stream,
+						sameTrack: (preview.srcObject as MediaStream).getVideoTracks()[0] === track,
+						trusted,
+					};
+				}, display);
+				expect(result).toEqual({ display, sameStream: true, sameTrack: true, trusted: true });
+				await fixture.evaluate(({ publish }) => {
+					publish.preview = "none";
+				});
+				await page.waitForFunction(({ preview }) => preview.srcObject === null, fixture);
+				await fixture.evaluate(({ publish }) => {
+					publish.preview = "source";
+				});
+				await shown();
+			}
+			await fixture.evaluate(({ publish, timer }) => {
+				publish.remove();
+				clearInterval(timer);
+			});
+		} finally {
+			await browser.close();
+			await server.close();
+		}
+	},
+	30_000,
+);
+
 test("canvas previews wait for dimensions and paint fresh frames under a strict style policy", async () => {
 	const server = await createServer({
 		configFile: false,

From 4216175138940d05ee060fd937c63b8c63bce701 Mon Sep 17 00:00:00 2001
From: Franz Heinzmann <frando@unbiskant.org>
Date: Thu, 5 Nov 2026 19:36:18 +0000
Subject: [PATCH 02/36] fix(video): time out V4L2 camera reads so a stalled
 camera can be dropped (#7878)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Luke Curley <kixelated@gmail.com>
---
 rs/moq-v4l/CHANGELOG.md                     |   4 +
 rs/moq-v4l/README.md                        |   2 +
 rs/moq-v4l/src/io/mmap/stream.rs            |  12 +-
 rs/moq-v4l/src/io/userptr/stream.rs         |  12 +-
 rs/moq-video/CHANGELOG.md                   |   5 +
 rs/moq-video/src/capture/pipewire/camera.rs | 165 +++++++++++++++-----
 rs/moq-video/src/capture/pump.rs            |  16 +-
 rs/moq-video/src/capture/v4l2.rs            |  22 ++-
 8 files changed, 186 insertions(+), 52 deletions(-)

diff --git a/rs/moq-v4l/CHANGELOG.md b/rs/moq-v4l/CHANGELOG.md
index 06176594c6d..e447273c881 100644
--- a/rs/moq-v4l/CHANGELOG.md
+++ b/rs/moq-v4l/CHANGELOG.md
@@ -7,6 +7,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Fixed
+
+- `CaptureStream::next` on the mmap and userptr streams can be called again after it returns `ErrorKind::TimedOut`, including on the first read after a restart. It used to queue a buffer the driver already held, which failed with EINVAL.
+
 ## [0.0.1](https://github.com/moq-dev/moq/releases/tag/moq-v4l-v0.0.1) - 2026-09-23
 
 ### Added
diff --git a/rs/moq-v4l/README.md b/rs/moq-v4l/README.md
index 6962d4dca7b..9eb4cf8c961 100644
--- a/rs/moq-v4l/README.md
+++ b/rs/moq-v4l/README.md
@@ -12,6 +12,8 @@ The `libv4l` backend did not survive the fork; every call is an ioctl on the
 device node and nothing links at build time.
 The unused high-level control API is removed; `moq-video` sets scalar controls
 through the raw `sys` and `v4l2` layers instead.
+`CaptureStream::next` can be retried after a timeout; upstream queues a buffer
+the driver already holds and fails with EINVAL.
 
 The bindings are arch-independent: layout tests are off, integer types are
 fixed-width, and `timeval` / `timespec` come from `libc`. Regenerate them on a
diff --git a/rs/moq-v4l/src/io/mmap/stream.rs b/rs/moq-v4l/src/io/mmap/stream.rs
index 57bb1a20730..93dfe2a7564 100644
--- a/rs/moq-v4l/src/io/mmap/stream.rs
+++ b/rs/moq-v4l/src/io/mmap/stream.rs
@@ -22,6 +22,9 @@ pub struct Stream<'a> {
 	timeout: Option<i32>,
 
 	active: bool,
+	/// Whether userspace holds the buffer at `arena_index`, so the next frame
+	/// queues it back first. A dequeue that timed out holds none.
+	held: bool,
 }
 
 impl<'a> Stream<'a> {
@@ -62,6 +65,7 @@ impl<'a> Stream<'a> {
 			buf_meta,
 			active: false,
 			timeout: None,
+			held: false,
 		})
 	}
 
@@ -175,6 +179,7 @@ impl<'a, 'b> CaptureStream<'b> for Stream<'a> {
 			)?;
 		}
 		self.arena_index = v4l2_buf.index as usize;
+		self.held = true;
 
 		self.buf_meta[self.arena_index] = Metadata {
 			bytesused: v4l2_buf.bytesused,
@@ -189,14 +194,19 @@ impl<'a, 'b> CaptureStream<'b> for Stream<'a> {
 
 	fn next(&'b mut self) -> io::Result<(&'b Self::Item, &'b Metadata)> {
 		if !self.active {
+			// STREAMOFF handed every buffer back, so none is held over.
+			self.held = false;
 			// Enqueue all buffers once on stream start
 			for index in 0..self.arena.bufs.len() {
 				CaptureStream::queue(self, index)?;
 			}
 
 			self.start()?;
-		} else {
+		} else if self.held {
+			// After a timed-out dequeue the driver already holds every buffer, and
+			// queueing one twice fails with EINVAL.
 			CaptureStream::queue(self, self.arena_index)?;
+			self.held = false;
 		}
 
 		self.arena_index = CaptureStream::dequeue(self)?;
diff --git a/rs/moq-v4l/src/io/userptr/stream.rs b/rs/moq-v4l/src/io/userptr/stream.rs
index 1f5b2b51c6f..816e3833d1a 100644
--- a/rs/moq-v4l/src/io/userptr/stream.rs
+++ b/rs/moq-v4l/src/io/userptr/stream.rs
@@ -22,6 +22,9 @@ pub struct Stream {
 	timeout: Option<i32>,
 
 	active: bool,
+	/// Whether userspace holds the buffer at `arena_index`, so the next frame
+	/// queues it back first. A dequeue that timed out holds none.
+	held: bool,
 }
 
 impl Stream {
@@ -62,6 +65,7 @@ impl Stream {
 			buf_meta,
 			active: false,
 			timeout: None,
+			held: false,
 		})
 	}
 
@@ -179,6 +183,7 @@ impl<'a> CaptureStream<'a> for Stream {
 			)?;
 		}
 		self.arena_index = v4l2_buf.index as usize;
+		self.held = true;
 
 		self.buf_meta[self.arena_index] = Metadata {
 			bytesused: v4l2_buf.bytesused,
@@ -193,14 +198,19 @@ impl<'a> CaptureStream<'a> for Stream {
 
 	fn next(&'a mut self) -> io::Result<(&'a Self::Item, &'a Metadata)> {
 		if !self.active {
+			// STREAMOFF handed every buffer back, so none is held over.
+			self.held = false;
 			// Enqueue all buffers once on stream start
 			for index in 0..self.arena.bufs.len() {
 				self.queue(index)?;
 			}
 
 			self.start()?;
-		} else {
+		} else if self.held {
+			// After a timed-out dequeue the driver already holds every buffer, and
+			// queueing one twice fails with EINVAL.
 			self.queue(self.arena_index)?;
+			self.held = false;
 		}
 
 		self.arena_index = self.dequeue()?;
diff --git a/rs/moq-video/CHANGELOG.md b/rs/moq-video/CHANGELOG.md
index fc664a92e53..1a00c33c991 100644
--- a/rs/moq-video/CHANGELOG.md
+++ b/rs/moq-video/CHANGELOG.md
@@ -7,6 +7,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Fixed
+
+- A V4L2 camera that opens and never delivers a frame no longer blocks its capture thread forever: reads time out after a second, so dropping the `capture::Stream` stops the thread and closes the device promptly.
+- The PipeWire camera listing hides nodes that offer no format the backend converts, such as an IR camera with only GREY, as the V4L2 listing already does.
+
 ### Added
 
 - `encode::Config::resize` scales a frame at another size inside the encoder, so a `Sink` does it on its own thread rather than the caller's.
diff --git a/rs/moq-video/src/capture/pipewire/camera.rs b/rs/moq-video/src/capture/pipewire/camera.rs
index d35cc531d18..5988686af7b 100644
--- a/rs/moq-video/src/capture/pipewire/camera.rs
+++ b/rs/moq-video/src/capture/pipewire/camera.rs
@@ -49,6 +49,7 @@ pub(in crate::capture) async fn cameras(v4l2: &[Camera]) -> Result<Vec<Camera>,
 	} else {
 		None
 	};
+	let v4l2 = v4l2.to_vec();
 	let nodes = crate::capture::blocking(move || {
 		pw::init();
 		let mainloop = pw::main_loop::MainLoopRc::new(None).map_err(|e| err("pipewire main loop", e))?;
@@ -64,14 +65,46 @@ pub(in crate::capture) async fn cameras(v4l2: &[Camera]) -> Result<Vec<Camera>,
 			Err(error) => return Err(err("pipewire connect", error)),
 		};
 		let registry = core.get_registry_rc().map_err(|e| err("pipewire registry", e))?;
-		scan(&mainloop, &core, &registry)
+		let nodes = unlisted(scan(&mainloop, &core, &registry)?, &v4l2);
+		// Hide a node with no format we convert, as the V4L2 listing does: an IR
+		// camera that offers only GREY would list an id `open` refuses. A node
+		// whose formats cannot be read stays, since `open` reports why.
+		let formats = match formats_each(&mainloop, &core, &registry, &nodes) {
+			Ok(formats) => formats,
+			Err(error) => {
+				tracing::debug!(%error, "could not list PipeWire camera formats");
+				return Ok(nodes);
+			}
+		};
+		Ok(nodes
+			.into_iter()
+			.zip(formats)
+			.filter_map(|(node, formats)| match formats {
+				Ok(formats) if formats.is_empty() => {
+					tracing::debug!(node = %node.name, "PipeWire camera offers no format we convert");
+					None
+				}
+				Ok(_) => Some(node),
+				Err(error) => {
+					tracing::debug!(node = %node.name, %error, "could not list PipeWire camera formats");
+					Some(node)
+				}
+			})
+			.collect())
 	})
 	.await?;
 
-	Ok(camera_list(nodes, v4l2))
+	Ok(nodes
+		.into_iter()
+		.map(|node| Camera {
+			id: format!("{PIPEWIRE}:{}", node.name),
+			name: node.description,
+		})
+		.collect())
 }
 
-fn camera_list(nodes: Vec<Node>, v4l2: &[Camera]) -> Vec<Camera> {
+/// Drop the nodes the V4L2 listing already enumerated.
+fn unlisted(nodes: Vec<Node>, v4l2: &[Camera]) -> Vec<Node> {
 	nodes
 		.into_iter()
 		.filter(|node| {
@@ -79,10 +112,6 @@ fn camera_list(nodes: Vec<Node>, v4l2: &[Camera]) -> Vec<Camera> {
 				.iter()
 				.any(|camera| node.v4l2_path.as_deref() == Some(camera.id.as_str()))
 		})
-		.map(|node| Camera {
-			id: format!("{PIPEWIRE}:{}", node.name),
-			name: node.description,
-		})
 		.collect()
 }
 
@@ -536,35 +565,95 @@ fn formats(
 	registry: &pw::registry::RegistryRc,
 	node: &Node,
 ) -> Result<Vec<Format>, Error> {
-	let proxy: pw::node::Node = registry
-		.bind(&pw::registry::GlobalObject {
-			id: node.id,
-			permissions: pw::permissions::PermissionFlags::empty(),
-			type_: pw::types::ObjectType::Node,
-			version: 0,
-			props: None::<&spa::utils::dict::DictRef>,
-		})
-		.map_err(|e| err("pipewire node", e))?;
-	let formats = Rc::new(RefCell::new(Vec::new()));
-	let _listener = proxy
-		.add_listener_local()
-		.param({
-			let formats = formats.clone();
-			move |_, id, _, _, param| {
-				if id != spa::param::ParamType::EnumFormat {
-					return;
+	let mut formats = formats_each(mainloop, core, registry, std::slice::from_ref(node))?;
+	formats.pop().expect("one result per node")
+}
+
+/// List the formats each of `nodes` offers that this backend converts, in one
+/// roundtrip so a stuck daemon costs one [`QUERY_TIMEOUT`] however many nodes
+/// there are.
+///
+/// The outer error is the daemon failing to answer. A node that answers with an
+/// error, or with only formats that cannot be read, gets an error of its own.
+fn formats_each(
+	mainloop: &pw::main_loop::MainLoopRc,
+	core: &pw::core::CoreRc,
+	registry: &pw::registry::RegistryRc,
+	nodes: &[Node],
+) -> Result<Vec<Result<Vec<Format>, Error>>, Error> {
+	#[derive(Default)]
+	struct Query {
+		formats: Vec<Format>,
+		failure: Option<String>,
+	}
+	let mut queries = Vec::with_capacity(nodes.len());
+	for node in nodes {
+		let proxy: pw::node::Node = registry
+			.bind(&pw::registry::GlobalObject {
+				id: node.id,
+				permissions: pw::permissions::PermissionFlags::empty(),
+				type_: pw::types::ObjectType::Node,
+				version: 0,
+				props: None::<&spa::utils::dict::DictRef>,
+			})
+			.map_err(|e| err("pipewire node", e))?;
+		let query = Rc::new(RefCell::new(Query {
+			formats: Vec::new(),
+			failure: None,
+		}));
+		let params = proxy
+			.add_listener_local()
+			.param({
+				let query = query.clone();
+				move |_, id, _, _, param| {
+					if id != spa::param::ParamType::EnumFormat {
+						return;
+					}
+					let Some(param) = param else { return };
+					let mut query = query.borrow_mut();
+					match spa::pod::deserialize::PodDeserializer::deserialize_any_from(param.as_bytes()) {
+						Ok((_, value)) => query.formats.extend(parse_format(&value)),
+						Err(e) => {
+							tracing::debug!(error = ?e, "unreadable PipeWire EnumFormat");
+							query
+								.failure
+								.get_or_insert_with(|| format!("unreadable EnumFormat: {e:?}"));
+						}
+					}
 				}
-				let Some(param) = param else { return };
-				match spa::pod::deserialize::PodDeserializer::deserialize_any_from(param.as_bytes()) {
-					Ok((_, value)) => formats.borrow_mut().extend(parse_format(&value)),
-					Err(e) => tracing::debug!(error = ?e, "unreadable PipeWire EnumFormat"),
+			})
+			.register();
+		// A node error (the device gone, or busy) arrives on the proxy, not the core.
+		let errors = pw::proxy::ProxyT::upcast_ref(&proxy)
+			.add_listener_local()
+			.error({
+				let query = query.clone();
+				move |_, _, message| {
+					query.borrow_mut().failure.get_or_insert_with(|| message.to_string());
 				}
+			})
+			.register();
+		proxy.enum_params(0, Some(spa::param::ParamType::EnumFormat), 0, u32::MAX);
+		// Tuple fields drop in order: unregister the listeners before destroying the
+		// proxy, whose `pw_proxy_destroy` frees their hook list when the server already
+		// removed the node.
+		queries.push((node, query, params, errors, proxy));
+	}
+	roundtrip(mainloop, core)?;
+	Ok(queries
+		.into_iter()
+		.map(|(node, query, ..)| {
+			let Query { formats, failure } = query.take();
+			match failure {
+				// Formats that were read still describe the node.
+				Some(failure) if formats.is_empty() => Err(Error::Codec(anyhow::anyhow!(
+					"PipeWire camera {} formats: {failure}",
+					node.name
+				))),
+				_ => Ok(formats),
 			}
 		})
-		.register();
-	proxy.enum_params(0, Some(spa::param::ParamType::EnumFormat), 0, u32::MAX);
-	roundtrip(mainloop, core)?;
-	Ok(formats.take())
+		.collect())
 }
 
 /// Read one `EnumFormat` or `Format` pod into the formats it offers that this
@@ -759,20 +848,20 @@ mod tests {
 			id: "/dev/video0".into(),
 			name: webcam.description.clone(),
 		}];
-		assert!(camera_list(vec![webcam.clone()], &v4l2).is_empty());
-		assert_eq!(camera_list(vec![webcam.clone()], &[]).len(), 1);
+		assert!(unlisted(vec![webcam.clone()], &v4l2).is_empty());
+		assert_eq!(unlisted(vec![webcam.clone()], &[]).len(), 1);
 		// An identical label on another device must not hide it.
 		props.pop();
 		props.push(("api.v4l2.path", "/dev/video2"));
-		assert_eq!(camera_list(vec![node(&props).unwrap()], &v4l2).len(), 1);
+		assert_eq!(unlisted(vec![node(&props).unwrap()], &v4l2).len(), 1);
 		// Missing paths and non-V4L2 backends are not proof of duplication.
 		props.pop();
-		assert_eq!(camera_list(vec![node(&props).unwrap()], &v4l2).len(), 1);
+		assert_eq!(unlisted(vec![node(&props).unwrap()], &v4l2).len(), 1);
 		props.pop();
 		props.extend([("device.api", "libcamera"), ("api.v4l2.path", "/dev/video0")]);
-		assert_eq!(camera_list(vec![node(&props).unwrap()], &v4l2).len(), 1);
+		assert_eq!(unlisted(vec![node(&props).unwrap()], &v4l2).len(), 1);
 		props.remove(props.len() - 2);
-		assert_eq!(camera_list(vec![node(&props).unwrap()], &v4l2).len(), 1);
+		assert_eq!(unlisted(vec![node(&props).unwrap()], &v4l2).len(), 1);
 		// Listing never removes nodes from explicit or priority-based resolution.
 		assert_eq!(
 			resolve(std::slice::from_ref(&webcam), Some(&webcam.name)).unwrap(),
diff --git a/rs/moq-video/src/capture/pump.rs b/rs/moq-video/src/capture/pump.rs
index 7a30767062a..fa4d7e12f1e 100644
--- a/rs/moq-video/src/capture/pump.rs
+++ b/rs/moq-video/src/capture/pump.rs
@@ -9,11 +9,12 @@
 //! drops, releasing the device. The stop flag is checked between reads, so on a
 //! live device (which delivers a frame per interval) shutdown is prompt; a read
 //! with no frame to hand back returns [`Read::Idle`] rather than blocking, which
-//! is what keeps a held capture (a minimized window) just as prompt. The join
-//! is what guarantees the device fd is closed before a subsequent reopen, so we
-//! don't race EBUSY. A wedged device that blocks a read forever would stall that
-//! join, the same as the original `spawn_blocking` path did, but that needs a
-//! driver that delivers neither a frame nor an error.
+//! is what keeps a held capture (a minimized window) and a V4L2 camera that
+//! stopped streaming (its reads time out) just as prompt. The join is what
+//! guarantees the device fd is closed before a subsequent reopen, so we don't
+//! race EBUSY. Media Foundation's synchronous `ReadSample` has no timeout, so a
+//! Windows camera that delivers neither a frame nor an error still stalls that
+//! join.
 
 use std::sync::Arc;
 use std::sync::atomic::{AtomicBool, Ordering};
@@ -30,8 +31,9 @@ pub(super) enum Read {
 	/// A captured frame with a timestamp in the device's private timeline.
 	FrameAt(Surface, moq_net::Timestamp),
 	/// No frame this turn, but the source is still live: the pump re-checks its
-	/// stop flag and calls again. A backend uses this to hold a capture (a
-	/// minimized or mid-resize window) without ending the stream. Only X11 holds one.
+	/// stop flag and calls again. X11 uses this to hold a capture (a minimized or
+	/// mid-resize window) without ending the stream, and V4L2 when no frame
+	/// arrives within its read timeout.
 	#[cfg(target_os = "linux")]
 	Idle,
 	/// The source stopped producing; the stream ends and the caller reopens.
diff --git a/rs/moq-video/src/capture/v4l2.rs b/rs/moq-video/src/capture/v4l2.rs
index 1a1f3b45dd8..8978c46f08f 100644
--- a/rs/moq-video/src/capture/v4l2.rs
+++ b/rs/moq-video/src/capture/v4l2.rs
@@ -295,6 +295,11 @@ pub(super) const DEFAULT_HEIGHT: u32 = 720;
 /// Driver buffers to keep in flight; a small ring lets capture overlap encode.
 const BUFFER_COUNT: u32 = 4;
 
+/// How long one read waits for a frame before it hands control back to the
+/// pump, which then checks its stop flag. A camera that opens and never
+/// streams would otherwise block the read, and the pump's join, forever.
+const READ_TIMEOUT: std::time::Duration = std::time::Duration::from_secs(1);
+
 /// The negotiated source format, chosen once at open.
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
 enum Source {
@@ -361,8 +366,9 @@ impl Camera {
 
 		// The stream owns a clone of the device's `Arc<Handle>`, so the fd stays
 		// open after `device` drops here; the mmap'd buffers live with the stream.
-		let stream = MmapStream::with_buffers(&device, BufType::VideoCapture, BUFFER_COUNT)
+		let mut stream = MmapStream::with_buffers(&device, BufType::VideoCapture, BUFFER_COUNT)
 			.map_err(|e| Error::Codec(anyhow::anyhow!("V4L2 stream init: {e}")))?;
+		stream.set_timeout(READ_TIMEOUT);
 
 		tracing::info!(device = %name, width, height, "opened V4L2 capture");
 		Ok(Self {
@@ -376,11 +382,17 @@ impl Camera {
 		})
 	}
 
-	/// Pull the next frame. Blocks one frame interval; the pump thread calls this
-	/// in a loop and checks its stop flag between calls.
+	/// Pull the next frame. Blocks one frame interval, or at most [`READ_TIMEOUT`];
+	/// the pump thread calls this in a loop and checks its stop flag between calls.
 	fn read(&mut self) -> Result<pump::Read, Error> {
-		let (buf, meta) = CaptureStream::next(&mut self.stream)
-			.map_err(|error| Error::SourceUnavailable(format!("V4L2 camera {}: {error}", self.name)))?;
+		let (buf, meta) = match CaptureStream::next(&mut self.stream) {
+			Ok(next) => next,
+			// No frame yet. The stream stays open, so a slow camera can still start.
+			Err(error) if error.kind() == std::io::ErrorKind::TimedOut => return Ok(pump::Read::Idle),
+			Err(error) => {
+				return Err(Error::SourceUnavailable(format!("V4L2 camera {}: {error}", self.name)));
+			}
+		};
 
 		let i420 = match self.source {
 			Source::Yuyv => I420::from_yuyv(buf, self.stride, crate::Size::new(self.width, self.height))?,

From 60eed563fcaf6295dd9b9fc52a0667c0e5407a28 Mon Sep 17 00:00:00 2001
From: Luke Curley <kixelated@gmail.com>
Date: Thu, 5 Nov 2026 19:58:38 +0000
Subject: [PATCH 03/36] feat(net): origins prove a route key in lite-07 SETUP
 (#7937)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: GPT-6.1 Sol <noreply@openai.com>
Co-authored-by: quest fixer <quest-fixer@localhost>
---
 Cargo.lock                                    |   3 +
 doc/bin/relay/config.md                       |   1 +
 drafts/draft-lcurley-moq-lite.md              |  30 +++
 js/net/src/lite/connection.ts                 |  14 +-
 js/net/src/lite/route_key.test.ts             |  88 +++++++++
 js/net/src/lite/route_key.ts                  |  52 +++++
 js/net/src/lite/setup.test.ts                 |  16 ++
 js/net/src/lite/setup.ts                      |  30 ++-
 js/net/src/lite/version.ts                    |  16 ++
 quest/m1/cluster-routing/README.md            |   5 +-
 quest/m1/cluster-routing/routes/README.md     |  11 +-
 quest/m1/cluster-routing/routes/proof.md      | 104 ++++------
 quest/m1/cluster-routing/routes/session.md    |  11 +-
 quest/m1/lite07-finalize.md                   |   7 +-
 rs/moq-crypto/src/sign/secret.rs              |   9 +
 rs/moq-net/Cargo.toml                         |   3 +
 rs/moq-net/MIGRATE.md                         |   5 +
 rs/moq-net/src/client.rs                      |   2 +
 rs/moq-net/src/lite/publisher.rs              |  28 +--
 rs/moq-net/src/lite/session.rs                |  19 +-
 rs/moq-net/src/lite/setup.rs                  | 113 ++++++++++-
 rs/moq-net/src/lite/subscriber.rs             |  14 +-
 rs/moq-net/src/lite/version.rs                |   8 +
 rs/moq-net/src/model/mod.rs                   |   2 +
 rs/moq-net/src/model/origin.rs                |  31 ++-
 rs/moq-net/src/route/mod.rs                   |   3 +
 rs/moq-net/src/route/proof.rs                 | 186 ++++++++++++++++++
 rs/moq-net/src/route/tests/routing.rs         |  13 +-
 rs/moq-net/src/server.rs                      |  59 +++++-
 rs/moq-net/src/transport.rs                   |  15 ++
 rs/moq-net/src/transport/boxed.rs             |   9 +
 rs/moq-net/src/transport/memory.rs            |  17 ++
 .../integration/routing_contracts/mod.rs      |  47 ++++-
 .../integration/routing_contracts/model.rs    |  37 ++--
 rs/moq-quic/src/connection/mod.rs             |  16 +-
 rs/moq-quic/src/crypto.rs                     |   2 -
 rs/moq-quic/src/tests/mod.rs                  |  17 +-
 rs/moq-relay/Cargo.toml                       |   1 +
 rs/moq-relay/src/cluster.rs                   |  20 ++
 rs/moq-relay/src/settings.rs                  |   3 +
 rs/moq-tokio/src/quic/driver/connection.rs    |   7 +
 rs/moq-tokio/src/quic/web/session.rs          |  55 ++++++
 rs/moq-uring/src/quic/driver/connection.rs    |   6 +
 rs/moq-uring/src/quic/web.rs                  |  25 +++
 rs/moq-uring/src/transport/local.rs           |   4 +
 45 files changed, 986 insertions(+), 178 deletions(-)
 create mode 100644 js/net/src/lite/route_key.test.ts
 create mode 100644 js/net/src/lite/route_key.ts
 create mode 100644 rs/moq-net/src/route/proof.rs

diff --git a/Cargo.lock b/Cargo.lock
index 60d2696e8e9..e9cec025184 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -4790,6 +4790,7 @@ dependencies = [
  "proptest",
  "rand 0.10.3",
  "rangemap",
+ "rind",
  "serde",
  "serde_json",
  "slab",
@@ -4798,6 +4799,7 @@ dependencies = [
  "tracing",
  "url",
  "workspace-hack",
+ "zeroize",
 ]
 
 [[package]]
@@ -4915,6 +4917,7 @@ dependencies = [
  "libc",
  "moq-auth 0.2.1",
  "moq-congestion",
+ "moq-crypto",
  "moq-net",
  "moq-quic",
  "moq-shaper",
diff --git a/doc/bin/relay/config.md b/doc/bin/relay/config.md
index 346e45ca086..20b76f970c7 100644
--- a/doc/bin/relay/config.md
+++ b/doc/bin/relay/config.md
@@ -306,6 +306,7 @@ connect = ["https://us-east.example.com/?cost=10"]   # Peers to dial. ?cost pric
 node = "https://us-west.example.com/"                 # This relay's own URL.
 token = "cluster.jwt"                                 # JWT for dials without an inline ?jwt=.
 id = 12345                                            # Stable Hop ID across restarts.
+route_key = "route.key"                               # Route key; relays sharing the file fail over as one to scoped peers.
 max_hops = 32                                         # Longest accepted/forwarded hop path (1 to 32).
 
 [cluster.api]
diff --git a/drafts/draft-lcurley-moq-lite.md b/drafts/draft-lcurley-moq-lite.md
index 544b7c04030..4b7b403629e 100644
--- a/drafts/draft-lcurley-moq-lite.md
+++ b/drafts/draft-lcurley-moq-lite.md
@@ -19,6 +19,7 @@ author:
 normative:
   moqt: I-D.ietf-moq-transport
   qmux: I-D.ietf-quic-qmux
+  webtrans-h3: I-D.ietf-webtrans-http3
   qmuxws:
     title: "QMux over WebSocket"
     target: https://datatracker.ietf.org/doc/draft-lcurley-qmux-websocket/
@@ -29,6 +30,8 @@ normative:
     date: false
   RFC3986:
   RFC6455:
+  RFC8032:
+  RFC8446:
   RFC8831:
   RFC9000:
   RFC9002:
@@ -922,6 +925,8 @@ The following Setup Parameters are defined:
 |------|----------------|-------------|
 | 0x7  | Token          | Token (b)   |
 |------|----------------|-------------|
+| 0x8  | Route Key      | Proof (..)  |
+|------|----------------|-------------|
 
 ### Probe Parameter {#probe-parameter}
 The Probe Parameter advertises the sender's capability level when acting as a publisher on a [Probe Stream](#probe).
@@ -997,6 +1002,30 @@ The URI is fixed before the version is negotiated, so a client that may negotiat
 
 Only the client sends it; a client that receives one MUST close the session with a PROTOCOL_VIOLATION. A relay MUST NOT forward it.
 
+### Route Key Parameter {#route-key-parameter}
+The Route Key Parameter proves that the sender holds an Ed25519 [RFC8032] key, bound to this session, so a receiver recognizes the sender, and endpoints sharing its key, across sessions.
+
+~~~
+Route Key Proof {
+  Public Key (256),
+  Signature (512),
+}
+~~~
+
+**Public Key**:
+The sender's Ed25519 public key.
+
+**Signature**:
+The key's Ed25519 signature over the ASCII bytes `moq-lite route key`, then one byte naming the sender's side of the session (0 for the client, 1 for the server), then 32 bytes of keying material exported from the session with the label `EXPORTER-moq-lite-route-key` and an empty context.
+
+Binding 1 exports with the TLS exporter (Section 7.5 of [RFC8446]), and binding 2 with the WebTransport session's exporter [webtrans-h3] (see [Transports](#transports)).
+An endpoint MUST NOT send the parameter on a session that provides no exporter.
+The exported material and the sender's side keep a proof from being replayed on another session or reflected back to its sender.
+
+Either endpoint MAY send it. A receiver MUST close the session with a PROTOCOL_VIOLATION if the value is not 96 bytes.
+A receiver that relies on the key MUST verify the signature first, closing the session with a PROTOCOL_VIOLATION if it does not verify; without an exporter on the session, it cannot rely on the key.
+A relay MUST NOT forward it.
+
 
 ## ANNOUNCE_REQUEST {#announce-request}
 A subscriber sends an ANNOUNCE_REQUEST message to indicate it wants to receive announcements for any broadcasts with a path that starts with the requested prefix.
@@ -1936,6 +1965,7 @@ The `Message Length` describes the payload size on the wire.
 - Added the reliable ordered RTCDataChannel binding, with one Qmux Record per binary message and no datagrams.
 - Added the SETUP `Implementation` parameter (0x6): the sender's software as `name/version` product tokens.
 - Added the client-only Token Setup Parameter (0x7), carrying the connection credential in SETUP instead of only the request URI.
+- Added the Route Key Setup Parameter (0x8): an Ed25519 public key and its signature over keying material exported from the session.
 - Added Padding Stream (0x2), read and discarded incrementally by either endpoint.
 - A Report-level publisher reads and ignores PROBE targets instead of resetting the Probe Stream.
 - A GOAWAY recipient MAY keep opening requests on the current session until it has moved to a replacement session; previously it MUST NOT open new streams. The sender SHOULD keep answering them and MAY reset one with GOING_AWAY, which the recipient SHOULD retry on another route.
diff --git a/js/net/src/lite/connection.ts b/js/net/src/lite/connection.ts
index d5aa87581aa..9c4ae23b308 100644
--- a/js/net/src/lite/connection.ts
+++ b/js/net/src/lite/connection.ts
@@ -24,6 +24,7 @@ import { Fetch } from "./fetch.ts";
 import { Goaway } from "./goaway.ts";
 import { Group } from "./group.ts";
 import { Publisher } from "./publisher.ts";
+import { proveRouteKey } from "./route_key.ts";
 import { SessionInfo } from "./session.ts";
 import { hasClientParameters, ProbeLevel, type Role, Setup } from "./setup.ts";
 import { DataType, StreamId } from "./stream.ts";
@@ -38,6 +39,7 @@ import {
 	hasGoaway,
 	hasPadding,
 	hasProbeRtt,
+	hasRouteKey,
 	hasSetupStream,
 	hasTrackStream,
 	hasTracks,
@@ -384,10 +386,14 @@ export class Connection implements Established {
 		try {
 			await writer.u53(DataType.Setup);
 			const probe = await probeLevel(this.#quic, this.#version);
-			await new Setup({ probe, hop: this.hop, token: this.#token, implementation: this.#implementation }).encode(
-				writer,
-				this.#version,
-			);
+			const routeKey = hasRouteKey(this.#version) ? await proveRouteKey(this.#quic, this.#client) : undefined;
+			await new Setup({
+				probe,
+				hop: this.hop,
+				token: this.#token,
+				implementation: this.#implementation,
+				routeKey,
+			}).encode(writer, this.#version);
 			writer.close();
 		} catch (err: unknown) {
 			writer.reset(err);
diff --git a/js/net/src/lite/route_key.test.ts b/js/net/src/lite/route_key.test.ts
new file mode 100644
index 00000000000..d782acdb8dd
--- /dev/null
+++ b/js/net/src/lite/route_key.test.ts
@@ -0,0 +1,88 @@
+import { expect, test } from "bun:test";
+import { proveRouteKey, sign } from "./route_key.ts";
+
+// PKCS#8 v1 (RFC 8410) prefix of an Ed25519 key, up to its 32-byte seed.
+const PKCS8_SEED_PREFIX = [
+	0x30, 0x2e, 0x02, 0x01, 0x00, 0x30, 0x05, 0x06, 0x03, 0x2b, 0x65, 0x70, 0x04, 0x22, 0x04, 0x20,
+];
+
+// Shared with rs/moq-net/src/route/proof.rs, so both sides sign the same transcript.
+const SEED = new Uint8Array(32).fill(1);
+const SECRET = new Uint8Array(32).fill(2);
+const CLIENT_PROOF =
+	"8a88e3dd7409f195fd52db2d3cba5d72ca6709bf1d94121bf3748801b40f6f5c" +
+	"e7ea4e34a65b8501185b805d09b58a61b5b8495654fcaac0949d4f98aa35002e" +
+	"6fca096329973e91e1105030dd88fa0eb543c68c00e18394f8300cb0574cf901";
+
+async function keyFromSeed(seed: Uint8Array): Promise<CryptoKeyPair> {
+	const der = new Uint8Array([...PKCS8_SEED_PREFIX, ...seed]);
+	const privateKey = await crypto.subtle.importKey("pkcs8", der, { name: "Ed25519" }, true, ["sign"]);
+	// WebCrypto derives the public key only through a JWK export.
+	const jwk = await crypto.subtle.exportKey("jwk", privateKey);
+	const publicKey = await crypto.subtle.importKey(
+		"jwk",
+		{ kty: jwk.kty, crv: jwk.crv, x: jwk.x },
+		{ name: "Ed25519" },
+		true,
+		["verify"],
+	);
+	return { privateKey, publicKey };
+}
+
+function hex(bytes: Uint8Array): string {
+	return Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+
+test("a proof matches the Rust transcript", async () => {
+	const proof = await sign(await keyFromSeed(SEED), SECRET, true);
+	expect(hex(proof)).toBe(CLIENT_PROOF);
+});
+
+test("the prover's side changes the signature", async () => {
+	const key = await keyFromSeed(SEED);
+	const client = await sign(key, SECRET, true);
+	const server = await sign(key, SECRET, false);
+	expect(client.subarray(0, 32)).toEqual(server.subarray(0, 32));
+	expect(client.subarray(32)).not.toEqual(server.subarray(32));
+});
+
+test("a transport without an exporter proves nothing", async () => {
+	expect(await proveRouteKey({} as WebTransport, true)).toBeUndefined();
+});
+
+test("a transport with an exporter proves one key per page", async () => {
+	const labels: string[] = [];
+	const transport = {
+		exportKeyingMaterial: async (label: BufferSource, context: BufferSource, length: number) => {
+			labels.push(new TextDecoder().decode(label));
+			expect((context as Uint8Array).byteLength).toBe(0);
+			return new Uint8Array(length).fill(3);
+		},
+	} as unknown as WebTransport;
+	const first = await proveRouteKey(transport, true);
+	const second = await proveRouteKey(transport, false);
+	expect(first?.byteLength).toBe(96);
+	expect(first?.subarray(0, 32)).toEqual(second?.subarray(0, 32));
+	expect(labels).toEqual(["EXPORTER-moq-lite-route-key", "EXPORTER-moq-lite-route-key"]);
+});
+
+test("unavailable Ed25519 leaves this page unproven across sessions", () => {
+	// A child has its own page capability cache, independent of the successful proof tests.
+	const moduleUrl = new URL("./route_key.ts", import.meta.url).href;
+	const child = Bun.spawnSync([
+		process.execPath,
+		"-e",
+		`
+		import { strict as assert } from "node:assert";
+		import { proveRouteKey } from ${JSON.stringify(moduleUrl)};
+		let calls = 0;
+		crypto.subtle.generateKey = async () => { calls++; throw new Error("unavailable"); };
+		const transport = { exportKeyingMaterial: async () => new Uint8Array(32) };
+		assert.equal(await proveRouteKey(transport, true), undefined);
+		assert.equal(await proveRouteKey(transport, true), undefined);
+		assert.equal(calls, 1);
+		`,
+	]);
+	expect(child.stderr.toString()).toBe("");
+	expect(child.exitCode).toBe(0);
+});
diff --git a/js/net/src/lite/route_key.ts b/js/net/src/lite/route_key.ts
new file mode 100644
index 00000000000..5c2c2fffa77
--- /dev/null
+++ b/js/net/src/lite/route_key.ts
@@ -0,0 +1,52 @@
+/**
+ * Route key proofs: an endpoint shows its peer that it holds an Ed25519 key, bound to the
+ * session by keying material both ends export from its handshake.
+ *
+ * A tab proves one key per page load, so a peer recognizes it across its sessions. Only a
+ * transport that exposes `exportKeyingMaterial` can bind a proof; elsewhere the tab sends
+ * none and stays unproven.
+ *
+ * @module
+ */
+
+const EXPORTER_LABEL = new TextEncoder().encode("EXPORTER-moq-lite-route-key");
+const DOMAIN = new TextEncoder().encode("moq-lite route key");
+const SECRET_SIZE = 32;
+
+/** The keying material export a WebTransport may offer; only some browsers ship it. */
+type Exporter = (label: BufferSource, context: BufferSource, outputLength: number) => Promise<ArrayBuffer | Uint8Array>;
+
+let pageKey: Promise<CryptoKeyPair | undefined> | undefined;
+
+/**
+ * The proof to send in SETUP for `transport`, or `undefined` when it cannot export keying
+ * material. `client` is whether this endpoint dialed the session.
+ */
+export async function proveRouteKey(transport: WebTransport, client: boolean): Promise<Uint8Array | undefined> {
+	const exporter = (transport as { exportKeyingMaterial?: Exporter }).exportKeyingMaterial;
+	if (typeof exporter !== "function") return undefined;
+	const secret = new Uint8Array(await exporter.call(transport, EXPORTER_LABEL, new Uint8Array(), SECRET_SIZE));
+	// Select page capability once: unavailable Ed25519 leaves sessions unproven.
+	pageKey ??= (
+		crypto.subtle.generateKey({ name: "Ed25519" }, false, ["sign", "verify"]) as Promise<CryptoKeyPair>
+	).catch(() => undefined);
+	const key = await pageKey;
+	return key ? sign(key, secret, client) : undefined;
+}
+
+/** Sign the proof for `secret`, the session's exported keying material. Exported for tests. */
+export async function sign(key: CryptoKeyPair, secret: Uint8Array, client: boolean): Promise<Uint8Array> {
+	if (secret.byteLength !== SECRET_SIZE) throw new Error("route key secret must be 32 bytes");
+	// The domain, then the prover's side of the session (0 dialed, 1 accepted), then the secret.
+	const message = new Uint8Array(DOMAIN.byteLength + 1 + SECRET_SIZE);
+	message.set(DOMAIN);
+	message[DOMAIN.byteLength] = client ? 0 : 1;
+	message.set(secret, DOMAIN.byteLength + 1);
+
+	const publicKey = new Uint8Array(await crypto.subtle.exportKey("raw", key.publicKey));
+	const signature = new Uint8Array(await crypto.subtle.sign({ name: "Ed25519" }, key.privateKey, message));
+	const proof = new Uint8Array(publicKey.byteLength + signature.byteLength);
+	proof.set(publicKey);
+	proof.set(signature, publicKey.byteLength);
+	return proof;
+}
diff --git a/js/net/src/lite/setup.test.ts b/js/net/src/lite/setup.test.ts
index 4cd56920cc2..361925a0021 100644
--- a/js/net/src/lite/setup.test.ts
+++ b/js/net/src/lite/setup.test.ts
@@ -231,6 +231,22 @@ test("SETUP refuses an empty token", async () => {
 	await expect(Setup.decode(new Reader(undefined, wire, Version.DRAFT_07), Version.DRAFT_07)).rejects.toThrow();
 });
 
+test("SETUP route key round-trips on lite-07 only, at exactly 96 bytes", async () => {
+	const proof = new Uint8Array(96).fill(7);
+	const msg = new Setup({ routeKey: proof });
+	const wire = await bytes((w) => msg.encode(w, Version.DRAFT_07), Version.DRAFT_07);
+	const got = await Setup.decode(new Reader(undefined, wire, Version.DRAFT_07), Version.DRAFT_07);
+	expect(got.routeKey).toEqual(proof);
+
+	await expect(bytes((w) => msg.encode(w, Version.DRAFT_06), Version.DRAFT_06)).rejects.toThrow();
+	// An older version ignores the parameter like any unknown one.
+	expect((await decodeParam(0x8n, proof, Version.DRAFT_06)).routeKey).toBeUndefined();
+
+	const short = new Setup({ routeKey: new Uint8Array(95) });
+	await expect(bytes((w) => short.encode(w, Version.DRAFT_07), Version.DRAFT_07)).rejects.toThrow();
+	await expect(decodeParam(0x8n, new Uint8Array(95), Version.DRAFT_07)).rejects.toThrow();
+});
+
 test("older SETUP versions ignore the unknown Implementation parameter before parsing it", async () => {
 	for (const version of [Version.DRAFT_05, Version.DRAFT_06]) {
 		for (const value of [new TextEncoder().encode("x/1"), new Uint8Array([0xff])]) {
diff --git a/js/net/src/lite/setup.ts b/js/net/src/lite/setup.ts
index 30694c8ddf5..f5c30b80c2c 100644
--- a/js/net/src/lite/setup.ts
+++ b/js/net/src/lite/setup.ts
@@ -9,7 +9,7 @@ import { type Hop, HopSchema, wireHop } from "../hop.ts";
 import { encodeVarint, Reader, type Writer } from "../stream.ts";
 import { decodeUtf8 } from "../util/utf8.ts";
 import * as Message from "./message.ts";
-import { hasAuth, hasImplementation, hasSetupStream, type Version } from "./version.ts";
+import { hasAuth, hasImplementation, hasRouteKey, hasSetupStream, type Version } from "./version.ts";
 
 const clientParameters = new WeakSet<Setup>();
 
@@ -30,6 +30,10 @@ const PARAM_HOP = 0x5n;
 const PARAM_IMPLEMENTATION = 0x6n;
 /** Setup Parameter id for the client's connection credential (client-only, lite-07+). */
 const PARAM_TOKEN = 0x7n;
+/** Setup Parameter id for the sender's route key proof (lite-07+). */
+const PARAM_ROUTE_KEY = 0x8n;
+/** A route key proof's size: an Ed25519 public key, then its signature. */
+const ROUTE_KEY_PROOF_SIZE = 96;
 
 /** SETUP only carries negotiation parameters, so it gets a far smaller cap than other messages. */
 const MAX_SETUP_SIZE = 0xffff;
@@ -179,6 +183,8 @@ export interface SetupProps {
 	token?: Uint8Array;
 	/** See {@link Setup.implementation}. Omitted by default. */
 	implementation?: string;
+	/** See {@link Setup.routeKey}. Omitted by default. */
+	routeKey?: Uint8Array;
 }
 
 /**
@@ -228,13 +234,20 @@ export class Setup {
 	 */
 	implementation?: string;
 
-	constructor({ probe, path, role, hop, token, implementation }: SetupProps = {}) {
+	/**
+	 * Proof that the sender holds its route key, bound to this session (lite-07+): the
+	 * Ed25519 public key, then its signature over keying material exported from the session.
+	 */
+	routeKey?: Uint8Array;
+
+	constructor({ probe, path, role, hop, token, implementation, routeKey }: SetupProps = {}) {
 		this.probe = probe ?? ProbeLevel.None;
 		this.path = path;
 		this.role = role ?? Role.Both;
 		this.hop = hop;
 		this.token = token;
 		this.implementation = implementation;
+		this.routeKey = routeKey;
 	}
 
 	static #guard(version: Version) {
@@ -267,6 +280,11 @@ export class Setup {
 			if (this.token.byteLength === 0) throw new Error("setup token cannot be empty");
 			params.setBytes(PARAM_TOKEN, this.token);
 		}
+		if (this.routeKey !== undefined) {
+			if (!hasRouteKey(version)) throw new Error("setup route key not supported for this version");
+			if (this.routeKey.byteLength !== ROUTE_KEY_PROOF_SIZE) throw new Error("setup route key must be 96 bytes");
+			params.setBytes(PARAM_ROUTE_KEY, this.routeKey);
+		}
 		await params.encode(w);
 	}
 
@@ -295,7 +313,13 @@ export class Setup {
 		const implementationBytes = hasImplementation(version) ? params.getBytes(PARAM_IMPLEMENTATION) : undefined;
 		const implementation = implementationBytes === undefined ? undefined : decodeUtf8(implementationBytes);
 
-		const setup = new Setup({ probe, path, role, hop, token, implementation });
+		// Kept but not verified: nothing here files routes under the sender's key.
+		const routeKey = hasRouteKey(version) ? params.getBytes(PARAM_ROUTE_KEY) : undefined;
+		if (routeKey !== undefined && routeKey.byteLength !== ROUTE_KEY_PROOF_SIZE) {
+			throw new Error("setup route key must be 96 bytes");
+		}
+
+		const setup = new Setup({ probe, path, role, hop, token, implementation, routeKey });
 		if (pathBytes !== undefined || roleCode !== undefined || token !== undefined) clientParameters.add(setup);
 		return setup;
 	}
diff --git a/js/net/src/lite/version.ts b/js/net/src/lite/version.ts
index 91c3310693d..228e7266344 100644
--- a/js/net/src/lite/version.ts
+++ b/js/net/src/lite/version.ts
@@ -657,6 +657,22 @@ export function hasSynced(version: Version): boolean {
 	}
 }
 
+/** Whether SETUP may carry a route key proof, added in lite-07. */
+export function hasRouteKey(version: Version): boolean {
+	// Explicitly list older versions so future versions default to carrying it.
+	switch (version) {
+		case Version.DRAFT_01:
+		case Version.DRAFT_02:
+		case Version.DRAFT_03:
+		case Version.DRAFT_04:
+		case Version.DRAFT_05:
+		case Version.DRAFT_06:
+			return false;
+		default:
+			return true;
+	}
+}
+
 /** Whether SETUP recognizes the Implementation parameter, added in lite-07. */
 export function hasImplementation(version: Version): boolean {
 	switch (version) {
diff --git a/quest/m1/cluster-routing/README.md b/quest/m1/cluster-routing/README.md
index 7561462e69b..21329a1909b 100644
--- a/quest/m1/cluster-routing/README.md
+++ b/quest/m1/cluster-routing/README.md
@@ -43,9 +43,8 @@ Decided with the maintainer, 2026-10-13:
   key proof is planned; if a use case needs a provable identity, moq-lite-07's
   route identity becomes a public key, independent of P2P. Decided 2026-11-04
   (maintainer, /quest-unblock): scoped forgery is that use case. A peer proves
-  a route key once per announce stream, its own identity derives from it, and
-  every identity it sends while scoped is qualified under it
-  ([Scoped peers prove a route key](/quest/m1/cluster-routing/routes/proof.md)).
+  a route key in its lite-07 SETUP, bound to the session, and every identity it
+  sends while scoped, its own included, is qualified under it.
   Receiver-stamped
   per-session identities were dropped 2026-10-26 (maintainer): in a mesh,
   two relays stamping their sessions from one origin forward its routes as
diff --git a/quest/m1/cluster-routing/routes/README.md b/quest/m1/cluster-routing/routes/README.md
index 7793203f1fe..625a899d88a 100644
--- a/quest/m1/cluster-routing/routes/README.md
+++ b/quest/m1/cluster-routing/routes/README.md
@@ -89,9 +89,11 @@ The wire sketch is in [wire](/quest/m1/cluster-routing/routes/wire.md); the bull
   planned; a provable identity, if a use case needs one, makes this route
   identity a public key, independent of P2P. Decided 2026-11-04 (maintainer,
   /quest-unblock): scoped forgery is that use case; a peer proves a route key
-  once per announce stream, its own identity derives from that key, and every
-  identity it sends while scoped is qualified under it
-  ([Scoped peers prove a route key](/quest/m1/cluster-routing/routes/proof.md)).
+  in its lite-07 SETUP (the Route Key parameter, bound to the session by its
+  exporter), and every identity it sends while scoped, its own included, is
+  qualified under it. The own identity stays a fresh random id per process:
+  peers cannot check one derived from the key and a private salt, so deriving
+  it adds nothing.
   Decided 2026-10-26 (maintainer): receivers do not stamp a fresh identity
   per session. In a mesh, two relays stamping their sessions from one origin
   forward its routes as two identities a third relay cannot recognize as
@@ -498,9 +500,10 @@ benchmarks.
 
 ## Required
 
+- [Scoped peers prove a route key](/quest/m1/cluster-routing/routes/proof.md) - records the session proof decision and implementation
+
 - [lite-07 route wire](/quest/m1/cluster-routing/routes/wire.md) - lite-07 and the draft carry ROUTE, ANNOUNCE_FLOOR, ROUTE_REQUEST, and path-less ANNOUNCE
 - [Route session integration](/quest/m1/cluster-routing/routes/session.md) - one router per origin node drives the origin and every lite-07 announce stream
-- [Scoped peers prove a route key](/quest/m1/cluster-routing/routes/proof.md) - a peer proves a route key once per announce stream, and its forwarded identities are qualified by it
 - [Announcement availability](/quest/m1/cluster-routing/routes/availability.md) - announcements report availability, and a let-go is offline rather than END, in Rust and JS
 - [js/net route layer](/quest/m1/cluster-routing/routes/js.md) - `js/net` encodes, decodes, and resolves the route layer
 - [Route layer acceptance](/quest/m1/cluster-routing/routes/acceptance.md) - forwarding fixtures ported and the model deleted, incident fixtures, end-to-end checks, and benchmarks
diff --git a/quest/m1/cluster-routing/routes/proof.md b/quest/m1/cluster-routing/routes/proof.md
index 3d39fee6050..26c62d66f01 100644
--- a/quest/m1/cluster-routing/routes/proof.md
+++ b/quest/m1/cluster-routing/routes/proof.md
@@ -2,73 +2,49 @@
 
 ## Goal
 
-A lite-07 peer proves a route key once per announce stream. The requester
-sends a nonce in ANNOUNCE_REQUEST, and the publisher's ANNOUNCE_OK carries its
-public key and a signature over that nonce, bound to the session. A relay
-files every identity a scoped, proven peer sends, its own included (the
-2026-10-26 rule in [Routes and announces](/quest/m1/cluster-routing/routes/README.md)),
-under H(domain, proven key, id), so a scoped peer that forges or inflates
-another origin's identity only affects claims inside its own grant. Relays
-that share one key file present an origin under the same qualified key
-whichever of them carries it, so a reader of relay l1's own broadcast fails
-over through sibling l2 when l1's direct uplink is lost. Unscoped peers stay
-bare, and a scoped peer that proves nothing gets a per-session key. This lands
-in lite-07 before the cut.
+A lite-07 peer proves a route key once per session in SETUP. A relay files
+every identity a scoped, proven peer sends, its own included, under
+H(domain, proven key, id). Relays sharing a key file fail over as one;
+unscoped peers stay bare and unproven scoped peers get a per-session key.
+Proof production and verification are implemented by this PR; filing belongs
+to [Route session integration](/quest/m1/cluster-routing/routes/session.md).
 
 ## Plan
 
-Decided 2026-11-04 (maintainer, /quest-unblock), from the keying question in
-[Route session integration](/quest/m1/cluster-routing/routes/session.md).
-This reverses the 2026-10-25 and 2026-11-02 decisions that no identity proof
-gates the lite-07 cut. Options shown for each:
-
-- Proof timing: ✅ before the lite-07 cut. Not chosen: an issuer-named route
-  label in the grant now with the proof after the cut, or a per-session key.
-- Where a relay's key comes from: ✅ a key file. An operator gives all its
-  relays the same file, so two separate relays (the l1/l2 two-uplink fixture,
-  `scoped_delivery_through_two_uplinks_reaches_one_key`) fail over as one key.
-  A relay without a file generates one. The own identity stays fresh per
-  restart as H(key, per-process salt), as `restart_reusing_identity_is_refused`
-  requires. Not chosen: a fresh key per process.
-- Browsers: ✅ prove with WebTransport's `exportKeyingMaterial(label, context,
-  outputLength)` where the browser exposes it, detected at session setup (no
-  runtime fallback); otherwise unproven with a per-session key. As of
-  2026-11-04 only Firefox ships it (spec-matching from Firefox 160); Chrome has
-  an Intent to Prototype and Safari nothing. Tabs do not forward routes, so an
-  unproven tab loses little. Not chosen: browsers never proven, or signing the
-  nonce with the dialed server name and role.
-- Identity on the wire: ✅ ROUTE keeps its u64 node ID, the first 64 bits of
-  H(key, salt), so the router's `Id` type and ROUTE stay as they are. Not
-  chosen: the full 32-byte key in each ROUTE.
-
-Own identity, settled in review of
-[moq-dev/moq#7919](https://github.com/moq-dev/moq/pull/7919): it is qualified
-like any other, not filed bare. Filed bare, l1's own origin would reach c1 as
-its bare id but c2 (through l2) as a qualified key, so the two would not fail
-over to each other. Extend the two-uplink fixture so l1 serves its own
-broadcast and loses its direct uplink, and the reader fails over through l2.
-
-Binding: a bare nonce can be relayed (a peer passes another relay's signed OK
-off as its own), so the signature covers the session too. Rust uses the TLS
-exporter (`rs/moq-quic` already exposes one); browsers use
-`exportKeyingMaterial`. Settle the exact signed transcript (nonce, exporter
-output, role, a domain label) and record it in the draft.
-
-Cost, estimated 2026-11-04: about 16 bytes of nonce in ANNOUNCE_REQUEST and
-about 90 bytes of key and signature in ANNOUNCE_OK, no extra round trip, and
-one Ed25519 sign and verify per announce stream rather than per route update.
-
-Reuse: `rs/moq-crypto`'s `sign::PublicKey` and `SecretKey::load_or_generate`,
-backed by `rind` Ed25519, and `js/crypto`'s WebCrypto Ed25519 signing.
-moq-crypto's `sign` feature depends on moq-net, so either moq-net calls `rind`
-directly or the key type moves to a lower crate. Decide which in the PR.
-
-Public API: moq-net gains the proof on announce streams; moq-relay and
-moq-tokio gain a route key file option. Wire: ANNOUNCE_REQUEST and ANNOUNCE_OK
-change in lite-07 and its draft.
+✅ Decided 2026-11-05 (maintainer, /quest-plan): prove the route key once per
+session in lite-07 SETUP parameter 0x8, without a nonce, and keep the node's
+own identity a random u64. This supersedes the 2026-11-04 bullets requiring
+proof per announce stream, a nonce in ANNOUNCE_REQUEST, a proof in
+ANNOUNCE_OK, and H(key, per-process salt) for the own identity. The signature
+already covers TLS exporter output unique to the session, so a nonce adds
+nothing. A session has one key, so proving it once in SETUP costs less than
+per announce stream. A peer cannot verify H(key, per-process salt), making
+it equivalent to random. ROUTE retains its u64 identity.
+
+The other five choices in the PR remain as made:
+
+- The own identity stays a fresh random u64, as decided above.
+- moq-net calls rind directly; moq-crypto's sign feature depends on moq-net,
+  so moving one key type into another crate adds unnecessary machinery.
+- The key lives on origin::Config. The relay's --cluster-route-key file
+  covers accepted and dialed sessions; moq-tokio needs no additional flag.
+- qmux currently provides no exporter and proves nothing. This is an
+  implementation limitation, not a prohibition on TLS bindings.
+- Browsers prove a per-page WebCrypto key when their transport exposes
+  exportKeyingMaterial, without adding a public JS API.
+
+The 2026-11-04 choices to ship before the lite-07 cut, share a relay key
+file, qualify the proven peer's own identity, and retain u64 ROUTE identities
+stand. A missing key file is generated; without a configured file, a relay
+generates a fresh key on startup.
+
+The signed transcript is ASCII `moq-lite route key`, one role byte (0 client,
+1 server), and 32 bytes from exporter label `EXPORTER-moq-lite-route-key`
+with empty context. The proof is the 32-byte public key plus 64-byte
+signature. No ANNOUNCE_OK proof body is needed by this draft or implementation;
+[lite-07 route wire](https://github.com/moq-dev/moq/pull/7764) owns its message changes.
 
 ## Related
 
-- [Route session integration](/quest/m1/cluster-routing/routes/session.md) - files identities under the key this proves
-- [lite-07 route wire](/quest/m1/cluster-routing/routes/wire.md) - the announce messages this extends
-- [P2P](/quest/m2/p2p/README.md) - its roster id is already planned as a public key
+- [Route session integration](/quest/m1/cluster-routing/routes/session.md) - files identities under the proven key
+- [lite-07 route wire](/quest/m1/cluster-routing/routes/wire.md) - coordinates announce messages
diff --git a/quest/m1/cluster-routing/routes/session.md b/quest/m1/cluster-routing/routes/session.md
index ee92c083059..c44d1a8ffb7 100644
--- a/quest/m1/cluster-routing/routes/session.md
+++ b/quest/m1/cluster-routing/routes/session.md
@@ -96,15 +96,16 @@ epoch. The route layer's own origin-node identity, with its seqno and
 revision, stays separate ("keep administrative identity and broadcast epoch
 separate", in the epic).
 
-Decided 2026-11-04 (maintainer, /quest-unblock): a scoped peer's identities
-are keyed by a route key the peer proves, specified in
-[Scoped peers prove a route key](/quest/m1/cluster-routing/routes/proof.md).
-Every identity a scoped, proven peer sends, its own included, is qualified
+Decided 2026-11-05 (maintainer, /quest-plan): a scoped peer's identities
+are keyed by a route key the peer proves in its lite-07 SETUP: the session's
+`PeerSetup::route_key` once its SETUP arrives, and `None` for a peer that proved
+none. Relays set theirs with `--cluster-route-key`. Every identity a scoped, proven peer sends, its own included, is qualified
 under its proven key, so relays sharing a key file fail over as one. A peer that proves no
 key gets a per-session key. `Scope::qualify` still takes the key from the
 caller, so this quest does not wait on the proof. Options shown:
 
-- ✅ A route key the peer proves once per announce stream, before the lite-07 cut
+- ✅ A route key the peer proves once per session in SETUP, before the lite-07 cut
+  (2026-11-05, maintainer, /quest-plan; supersedes the per-announce proof option)
 - A route label carried in the grant (the earlier recommendation), with the
   proven key added after the cut
 - A per-session key now
diff --git a/quest/m1/lite07-finalize.md b/quest/m1/lite07-finalize.md
index c9c7cd2b2e4..509dac6eadc 100644
--- a/quest/m1/lite07-finalize.md
+++ b/quest/m1/lite07-finalize.md
@@ -37,10 +37,9 @@ stability. Both are additive and, per the freeze policy, target whichever lite
 wip is current when they land. Decided 2026-10-25: no routing identity proof
 gates the cut, and lite-07 routing identities stay declared and unverified
 (2026-11-02: peer grants are dropped and no key proof is planned). Reversed
-2026-11-04 (maintainer, /quest-unblock): a peer proves a route key once per
-announce stream before the cut, through
-[Scoped peers prove a route key](/quest/m1/cluster-routing/routes/proof.md) in
-[Routes and announces](/quest/m1/cluster-routing/routes/README.md). Decided 2026-10-26
+2026-11-04 (maintainer, /quest-unblock): a peer proves a route key before the
+cut, which landed as lite-07's Route Key Setup Parameter; its routes are filed
+under it in [Routes and announces](/quest/m1/cluster-routing/routes/README.md). Decided 2026-10-26
 (maintainer): receivers do not stamp per-session identities either, since
 that splits one origin into several identities across a relay mesh.
 
diff --git a/rs/moq-crypto/src/sign/secret.rs b/rs/moq-crypto/src/sign/secret.rs
index 19c86a1ba37..70d45466126 100644
--- a/rs/moq-crypto/src/sign/secret.rs
+++ b/rs/moq-crypto/src/sign/secret.rs
@@ -125,6 +125,15 @@ impl SecretKey {
 	}
 }
 
+impl From<&SecretKey> for moq_net::origin::RouteKey {
+	/// The same key, for an origin to prove to its peers.
+	fn from(key: &SecretKey) -> Self {
+		let seed = key.0.pair.to_seed();
+		let seed: Zeroizing<[u8; KEY_LEN]> = Zeroizing::new(seed.as_ref().try_into().expect("a 32-byte Ed25519 seed"));
+		Self::from_seed(&seed)
+	}
+}
+
 impl fmt::Debug for SecretKey {
 	fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
 		f.debug_struct("SecretKey")
diff --git a/rs/moq-net/Cargo.toml b/rs/moq-net/Cargo.toml
index 0d6afe92b7a..c61ed607bde 100644
--- a/rs/moq-net/Cargo.toml
+++ b/rs/moq-net/Cargo.toml
@@ -42,11 +42,14 @@ moq-pattern = { workspace = true, features = ["serde"] }
 num_enum = { workspace = true }
 rand = { workspace = true }
 rangemap = { workspace = true }
+# Ed25519 for route key proofs, and HKDF for the in-memory transport's exporter.
+rind = { workspace = true }
 serde = { workspace = true }
 slab = { workspace = true }
 thiserror = { workspace = true }
 tracing = { workspace = true }
 url = { workspace = true }
+zeroize = { workspace = true }
 
 [dev-dependencies]
 criterion = { package = "bench-harness", path = "../bench-harness" }
diff --git a/rs/moq-net/MIGRATE.md b/rs/moq-net/MIGRATE.md
index 80a90640232..2b4b39be9b8 100644
--- a/rs/moq-net/MIGRATE.md
+++ b/rs/moq-net/MIGRATE.md
@@ -4,6 +4,11 @@ How to update your code for each breaking change, newest first.
 
 ## Unreleased
 
+### Origins prove a route key ([#7937](https://github.com/moq-dev/moq/pull/7937))
+
+`origin::Config::route_key` takes an `origin::RouteKey`, which every lite-07 session on the origin proves to its peer in SETUP. Origins sharing a key fail over as one to a peer that scopes them; `None`, the default, proves nothing.
+A proof binds to the session through the new `poll::Session::export_keying_material`, which defaults to `None`: a transport over TLS returns its exporter, and a wrapper around another transport forwards it.
+
 ### Group batch operations and `poll_next_frame` are crate-private ([#7874](https://github.com/moq-dev/moq/pull/7874))
 
 Read a frame in chunks with the async `group::Consumer::next_frame`, or read whole frames with `poll_read_frame` from a poll loop.
diff --git a/rs/moq-net/src/client.rs b/rs/moq-net/src/client.rs
index bbc75ffcf02..14f107bcfb3 100644
--- a/rs/moq-net/src/client.rs
+++ b/rs/moq-net/src/client.rs
@@ -331,6 +331,8 @@ impl Client {
 				token: self.setup_token.clone().filter(|_| version.has_auth()),
 				ietf: self.extensions.ietf && version.has_ietf(),
 				implementation: self.implementation(),
+				// Filled by `lite::start` from the attached origin handles.
+				route_key: None,
 			}
 		} else {
 			lite::Setup::default()
diff --git a/rs/moq-net/src/lite/publisher.rs b/rs/moq-net/src/lite/publisher.rs
index f0136e0c90c..e9cf3c1f39f 100644
--- a/rs/moq-net/src/lite/publisher.rs
+++ b/rs/moq-net/src/lite/publisher.rs
@@ -8564,7 +8564,7 @@ mod tests {
 
 		// A SETUP that declares no origin of its own, so only the assigned one applies.
 		let peer_setup = crate::lite::PeerSetup::new(false, crate::transport::Address::Setup);
-		peer_setup.set(crate::lite::Setup::default());
+		peer_setup.set(crate::lite::Setup::default()).unwrap();
 		let (_, goaway) = crate::goaway::Handle::new(true);
 
 		let publisher = Publisher::new(PublisherConfig {
@@ -9149,7 +9149,7 @@ mod tests {
 		}
 
 		let peer_setup = crate::lite::PeerSetup::new(false, crate::transport::Address::Setup);
-		peer_setup.set(crate::lite::Setup::default());
+		peer_setup.set(crate::lite::Setup::default()).unwrap();
 		let (_, goaway) = crate::goaway::Handle::new(true);
 		let publisher = Publisher::new(PublisherConfig {
 			runtime: crate::time::sim(),
@@ -9276,7 +9276,7 @@ mod tests {
 				.unwrap();
 
 			let peer_setup = crate::lite::PeerSetup::new(false, crate::transport::Address::Setup);
-			peer_setup.set(crate::lite::Setup::default());
+			peer_setup.set(crate::lite::Setup::default()).unwrap();
 			let (_, goaway) = crate::goaway::Handle::new(true);
 			let publisher = Publisher::new(PublisherConfig {
 				estimate: kio::Producer::default().weak(),
@@ -9339,7 +9339,7 @@ mod tests {
 		let _track = broadcast.create_track("video", crate::track::Info::timed()).unwrap();
 		broadcast.announce(Default::default()).unwrap();
 		let peer_setup = crate::lite::PeerSetup::new(false, crate::transport::Address::Setup);
-		peer_setup.set(crate::lite::Setup::default());
+		peer_setup.set(crate::lite::Setup::default()).unwrap();
 		let (_, goaway) = crate::goaway::Handle::new(true);
 		let publisher = Publisher::new(PublisherConfig {
 			estimate: kio::Producer::default().weak(),
@@ -9397,7 +9397,7 @@ mod tests {
 					broadcast.announce(Default::default()).unwrap();
 
 					let peer_setup = crate::lite::PeerSetup::new(false, crate::transport::Address::Setup);
-					peer_setup.set(crate::lite::Setup::default());
+					peer_setup.set(crate::lite::Setup::default()).unwrap();
 					let (_, goaway) = crate::goaway::Handle::new(true);
 					let publisher = Publisher::new(PublisherConfig {
 						estimate: kio::Producer::default().weak(),
@@ -9544,7 +9544,7 @@ mod tests {
 					}
 
 					let peer_setup = crate::lite::PeerSetup::new(false, crate::transport::Address::Setup);
-					peer_setup.set(crate::lite::Setup::default());
+					let _ = peer_setup.set(crate::lite::Setup::default());
 					let (_, goaway) = crate::goaway::Handle::new(true);
 					let log = Log::default();
 					let publisher = Publisher::new(PublisherConfig {
@@ -9674,7 +9674,7 @@ mod tests {
 		broadcast.announce(Default::default()).unwrap();
 
 		let peer_setup = crate::lite::PeerSetup::new(false, crate::transport::Address::Setup);
-		peer_setup.set(crate::lite::Setup::default());
+		peer_setup.set(crate::lite::Setup::default()).unwrap();
 		let (_, goaway) = crate::goaway::Handle::new(true);
 		let version = Version::Lite07;
 		let publisher = Publisher::new(PublisherConfig {
@@ -9803,7 +9803,7 @@ mod tests {
 		broadcast.announce(Default::default()).unwrap();
 
 		let peer_setup = crate::lite::PeerSetup::new(false, crate::transport::Address::Setup);
-		peer_setup.set(crate::lite::Setup::default());
+		peer_setup.set(crate::lite::Setup::default()).unwrap();
 		let (_, goaway) = crate::goaway::Handle::new(true);
 		let version = Version::Lite07;
 		let publisher = Publisher::new(PublisherConfig {
@@ -10055,7 +10055,7 @@ mod tests {
 		let track = broadcast.create_track("video", track::Info::timed()).unwrap();
 		let dynamic = track.requests();
 		let peer_setup = crate::lite::PeerSetup::new(false, crate::transport::Address::Setup);
-		peer_setup.set(crate::lite::Setup::default());
+		peer_setup.set(crate::lite::Setup::default()).unwrap();
 		let (_, goaway) = crate::goaway::Handle::new(true);
 		let publisher = Publisher::new(PublisherConfig {
 			runtime: crate::time::sim(),
@@ -10105,7 +10105,7 @@ mod tests {
 		open.write_frame(crate::Timestamp::ZERO, b"a".to_vec()).unwrap();
 
 		let peer_setup = crate::lite::PeerSetup::new(false, crate::transport::Address::Setup);
-		peer_setup.set(crate::lite::Setup::default());
+		peer_setup.set(crate::lite::Setup::default()).unwrap();
 		let (_, goaway) = crate::goaway::Handle::new(true);
 		let publisher = Publisher::new(PublisherConfig {
 			runtime: crate::time::sim(),
@@ -10267,7 +10267,7 @@ mod tests {
 				version,
 				&estimate,
 			);
-			probe.shared.peer_setup.set(lite::Setup::default());
+			probe.shared.peer_setup.set(lite::Setup::default()).unwrap();
 			let mut shared = probe.shared;
 			Arc::get_mut(&mut shared).expect("one owner").origin = origin.consume();
 			let mut control = Control {
@@ -10322,7 +10322,7 @@ mod tests {
 			version,
 			&estimate,
 		);
-		probe.shared.peer_setup.set(lite::Setup::default());
+		probe.shared.peer_setup.set(lite::Setup::default()).unwrap();
 		let mut shared = probe.shared;
 		Arc::get_mut(&mut shared).expect("one owner").origin = origin.consume();
 		let control = |stream| Control {
@@ -10379,7 +10379,7 @@ mod tests {
 				version,
 				&estimate,
 			);
-			probe.shared.peer_setup.set(lite::Setup::default());
+			probe.shared.peer_setup.set(lite::Setup::default()).unwrap();
 			let mut shared = probe.shared;
 			Arc::get_mut(&mut shared).expect("one owner").origin = origin.consume();
 			let mut control = Control {
@@ -10462,7 +10462,7 @@ mod tests {
 	/// A publisher on a session with send groups.
 	fn grouped_publisher(origin: origin::Consumer) -> (Publisher, crate::lite::test_transport::Log) {
 		let peer_setup = crate::lite::PeerSetup::new(false, crate::transport::Address::Setup);
-		peer_setup.set(crate::lite::Setup::default());
+		peer_setup.set(crate::lite::Setup::default()).unwrap();
 		let (_, goaway) = crate::goaway::Handle::new(true);
 		let session = ScriptedSession::new(Vec::new()).with_groups();
 		let log = session.log.clone();
diff --git a/rs/moq-net/src/lite/session.rs b/rs/moq-net/src/lite/session.rs
index 2d8a73d43f3..fc105f68d68 100644
--- a/rs/moq-net/src/lite/session.rs
+++ b/rs/moq-net/src/lite/session.rs
@@ -263,6 +263,22 @@ pub fn start(config: Config) -> Result<SessionStart, Error> {
 			.filter(|hop| hop.id() != 0);
 	}
 
+	// Prove our origin's route key, bound to this session, so a peer that scopes us files
+	// our routes under it. A transport without an exporter cannot bind a proof, so neither
+	// side proves anything there.
+	let transcript = version
+		.has_route_key()
+		.then(|| session.export_keying_material(crate::route::EXPORTER_LABEL, &[]))
+		.flatten()
+		.map(crate::route::Transcript::new);
+	let route_key = publish
+		.as_ref()
+		.and_then(|origin| origin.route_key())
+		.or_else(|| subscribe.as_ref().and_then(|origin| origin.route_key()));
+	if let (Some(transcript), Some(key)) = (&transcript, route_key) {
+		our_setup.route_key = Some(transcript.prove(&key, client));
+	}
+
 	// What the peer's connection credential earns by default: publishing what our
 	// subscribe half accepts, and subscribing to what our publish half serves. A
 	// missing half grants nothing.
@@ -303,6 +319,7 @@ pub fn start(config: Config) -> Result<SessionStart, Error> {
 	// Setup stream isn't expected on the wire again.
 	let peer_implementation = crate::setup::PeerImplementation::default();
 	let mut peer_setup_slot = PeerSetup::new(client, session.address())
+		.with_transcript(transcript)
 		.offer_ietf(our_setup.ietf)
 		.with_implementation(peer_implementation.clone());
 	// Without AUTH, the server checks a client's credential before its SETUP, which the
@@ -315,7 +332,7 @@ pub fn start(config: Config) -> Result<SessionStart, Error> {
 		peer_implementation.set(None);
 	}
 	let early = if let Some(accepted) = peer_setup {
-		peer_setup_slot.set(accepted.setup);
+		peer_setup_slot.set(accepted.setup)?;
 		accepted.early
 	} else {
 		Vec::new()
diff --git a/rs/moq-net/src/lite/setup.rs b/rs/moq-net/src/lite/setup.rs
index 6cdd9965762..8ac3d5b27d8 100644
--- a/rs/moq-net/src/lite/setup.rs
+++ b/rs/moq-net/src/lite/setup.rs
@@ -19,6 +19,8 @@ const PARAM_HOP: u64 = 0x5;
 const PARAM_IMPLEMENTATION: u64 = 0x6;
 /// Setup Parameter id for the client's connection credential (client-only, lite-07+).
 const PARAM_TOKEN: u64 = 0x7;
+/// Setup Parameter id for the sender's route key proof (lite-07+).
+const PARAM_ROUTE_KEY: u64 = 0x8;
 /// Setup Parameter id offering the `ietf` extension (draft-lcurley-moq-ietf): "IETF" in ASCII.
 const PARAM_IETF: u64 = 0x4945_5446;
 
@@ -207,6 +209,8 @@ pub struct Setup {
 	/// The sender's implementation, as space-separated `name/version` product tokens
 	/// (`moq-net-rs/0.3.10`). Opaque; `None` omits the parameter.
 	pub implementation: Option<String>,
+	/// Proof that the sender holds its route key, bound to this session (lite-07+).
+	pub route_key: Option<crate::route::Proof>,
 }
 
 impl std::fmt::Debug for Setup {
@@ -224,6 +228,7 @@ impl std::fmt::Debug for Setup {
 			.field("token", &self.token)
 			.field("ietf", &self.ietf)
 			.field("implementation", &self.implementation)
+			.field("route_key", &self.route_key)
 			.finish()
 	}
 }
@@ -280,6 +285,12 @@ impl<'a> Message<'a> for Setup {
 			}
 			params.set_bytes(PARAM_IETF, Vec::new());
 		}
+		if let Some(proof) = self.route_key {
+			if !version.has_route_key() {
+				return Err(EncodeError::Version);
+			}
+			params.set_bytes(PARAM_ROUTE_KEY, proof.to_bytes());
+		}
 
 		params.encode(w, version)
 	}
@@ -343,6 +354,12 @@ impl<'a> Message<'a> for ReceivedSetup {
 			},
 			_ => false,
 		};
+		let route_key = match params.get_bytes(PARAM_ROUTE_KEY) {
+			Some(value) if version.has_route_key() => {
+				Some(crate::route::Proof::from_bytes(value).ok_or(DecodeError::InvalidValue)?)
+			}
+			_ => None,
+		};
 
 		Ok(Self {
 			role_present: role_code.is_some(),
@@ -355,6 +372,7 @@ impl<'a> Message<'a> for ReceivedSetup {
 				token,
 				ietf,
 				implementation,
+				route_key,
 			},
 		})
 	}
@@ -383,6 +401,27 @@ struct PeerSetupState {
 	implementation: crate::setup::PeerImplementation,
 	/// The session's auth link to tell once the peer's SETUP accepts the connection.
 	accept: Option<crate::auth::Link>,
+	/// What the peer's route key proof must sign, or `None` when the transport cannot bind
+	/// one to this session, so any proof leaves the peer unproven.
+	transcript: Option<crate::route::Transcript>,
+	/// The route key the peer proved.
+	route_key: Option<[u8; 32]>,
+}
+
+impl PeerSetupState {
+	/// Keep the key the peer's SETUP proves, or refuse a proof whose signature fails.
+	fn prove(&mut self, setup: &Setup) -> Result<(), crate::Error> {
+		let (Some(proof), Some(transcript)) = (&setup.route_key, &self.transcript) else {
+			return Ok(());
+		};
+		// The peer holds the side of the session we do not.
+		if !transcript.verify(proof, !self.client) {
+			return Err(crate::Error::ProtocolViolation);
+		}
+		tracing::debug!(proof = ?proof, "peer proved its route key");
+		self.route_key = Some(proof.key);
+		Ok(())
+	}
 }
 
 impl PeerSetup {
@@ -395,9 +434,17 @@ impl PeerSetup {
 			setup: None,
 			implementation: Default::default(),
 			accept: None,
+			transcript: None,
+			route_key: None,
 		}))
 	}
 
+	/// Check the peer's route key proof against `transcript`, this session's.
+	pub fn with_transcript(self, transcript: Option<crate::route::Transcript>) -> Self {
+		self.0.lock().transcript = transcript;
+		self
+	}
+
 	/// Tell `link` once the peer's SETUP arrives that it accepted the connection credential.
 	pub fn accepting(self, link: crate::auth::Link) -> Self {
 		link.await_setup();
@@ -418,6 +465,7 @@ impl PeerSetup {
 		{
 			return Err(crate::Error::ProtocolViolation);
 		}
+		state.prove(&received.setup)?;
 		state.seen = true;
 		state.implementation.set(received.setup.implementation.clone());
 		state.setup = Some(received.setup);
@@ -454,12 +502,23 @@ impl PeerSetup {
 		}
 	}
 
-	/// Record the peer's SETUP.
-	pub fn set(&self, setup: Setup) {
+	/// Record the peer's SETUP, refusing a route key proof that does not hold.
+	pub fn set(&self, setup: Setup) -> Result<(), crate::Error> {
 		let mut state = self.0.lock();
+		state.prove(&setup)?;
 		state.seen = true;
 		state.implementation.set(setup.implementation.clone());
 		state.setup = Some(setup);
+		Ok(())
+	}
+
+	/// The route key the peer proved, once its SETUP arrived.
+	#[cfg_attr(
+		not(test),
+		expect(dead_code, reason = "session integration files a scoped peer's routes under it")
+	)]
+	pub fn route_key(&self) -> Option<[u8; 32]> {
+		self.0.lock().route_key
 	}
 
 	/// Claim the Setup Stream before decoding its body, refusing any second stream.
@@ -650,6 +709,56 @@ mod tests {
 		assert!(Setup::decode_slice(&valued, Version::Lite07).is_err());
 	}
 
+	/// Route key proofs are accepted only on lite-07 and must have the fixed wire size.
+	#[test]
+	fn route_key_is_lite07_only() {
+		let transcript = crate::route::Transcript::new([2; 32]);
+		let msg = Setup {
+			route_key: Some(transcript.prove(&crate::origin::RouteKey::generate(), true)),
+			..Default::default()
+		};
+		let buf = msg.encode_bytes(Version::Lite07).unwrap();
+		assert_eq!(Setup::decode_slice(&buf, Version::Lite07).unwrap().0, msg);
+		assert!(matches!(msg.encode_bytes(Version::Lite06), Err(EncodeError::Version)));
+
+		// One parameter, its id, then a 95-byte value: not a proof.
+		let mut short = vec![0x01, 0x08, 0x5f];
+		short.extend([0; 95]);
+		let mut framed = Vec::new();
+		Encoder::new(&mut framed, Version::Lite07.into())
+			.varint(short.len() as u64)
+			.unwrap();
+		framed.extend(short);
+		assert!(Setup::decode_slice(&framed, Version::Lite07).is_err());
+	}
+
+	/// A server checks the client's proof against this session, and refuses one that fails.
+	#[test]
+	fn peer_route_key_is_kept_only_when_its_proof_holds() {
+		let key = crate::origin::RouteKey::generate();
+		let session = || Some(crate::route::Transcript::new([2; 32]));
+		let proven = |client: bool| Setup {
+			route_key: Some(crate::route::Transcript::new([2; 32]).prove(&key, client)),
+			..Default::default()
+		};
+		let server = || PeerSetup::new(false, crate::transport::Address::Setup).with_transcript(session());
+
+		let peer = server();
+		peer.set(proven(true)).unwrap();
+		assert_eq!(peer.route_key(), proven(true).route_key.map(|proof| proof.key));
+
+		// A server's own proof reflected back as the client's.
+		assert!(matches!(
+			server().set(proven(false)),
+			Err(crate::Error::ProtocolViolation)
+		));
+
+		// A transport that cannot export leaves the peer unproven, whatever it sends.
+		let unbound = PeerSetup::new(false, crate::transport::Address::Setup);
+		unbound.set(proven(false)).unwrap();
+		assert_eq!(unbound.route_key(), None);
+	}
+
 	/// The connection credential rides lite-07+, which an older version ignores like any
 	/// unknown parameter, and only an untyped, non-empty token can be sent.
 	#[test]
diff --git a/rs/moq-net/src/lite/subscriber.rs b/rs/moq-net/src/lite/subscriber.rs
index a54e95cd82e..ae0924eff6b 100644
--- a/rs/moq-net/src/lite/subscriber.rs
+++ b/rs/moq-net/src/lite/subscriber.rs
@@ -3965,7 +3965,7 @@ mod tests {
 						.unwrap();
 					assert_eq!(accepted.early.len(), 2);
 					assert!(log.stops().is_empty());
-					peer_setup.set(accepted.setup);
+					peer_setup.set(accepted.setup).unwrap();
 					accepted.early
 				} else {
 					Vec::new()
@@ -4119,10 +4119,12 @@ mod tests {
 		}
 		let session = crate::lite::test_transport::ScriptedSession::eof(script);
 		let peer_setup = crate::lite::PeerSetup::new(false, crate::transport::Address::Setup).offer_ietf(true);
-		peer_setup.set(lite::Setup {
-			ietf: true,
-			..Default::default()
-		});
+		peer_setup
+			.set(lite::Setup {
+				ietf: true,
+				..Default::default()
+			})
+			.unwrap();
 		let subscriber = Subscriber::new(SubscriberConfig {
 			runtime: crate::time::sim(),
 			session: crate::driver::Transport::new(session.clone()),
@@ -5401,7 +5403,7 @@ mod tests {
 	/// A subscriber on `version` over `session`, whose peer's SETUP was already read.
 	fn pipelining(session: crate::driver::Transport, version: Version) -> Subscriber {
 		let peer_setup = crate::lite::PeerSetup::new(false, crate::transport::Address::Setup);
-		peer_setup.set(lite::Setup::default());
+		peer_setup.set(lite::Setup::default()).unwrap();
 		Subscriber::new(SubscriberConfig {
 			runtime: crate::time::sim(),
 			session,
diff --git a/rs/moq-net/src/lite/version.rs b/rs/moq-net/src/lite/version.rs
index 4732ac9958d..469ac26b633 100644
--- a/rs/moq-net/src/lite/version.rs
+++ b/rs/moq-net/src/lite/version.rs
@@ -327,6 +327,14 @@ impl Version {
 		)
 	}
 
+	/// Whether SETUP may carry a route key proof. Added in lite-07.
+	pub(crate) fn has_route_key(self) -> bool {
+		!matches!(
+			self,
+			Self::Lite01 | Self::Lite02 | Self::Lite03 | Self::Lite04 | Self::Lite05 | Self::Lite06
+		)
+	}
+
 	/// Whether the announce stream has ANNOUNCE_RESTART: another publisher instance
 	/// replacing an advertisement in place. Added in lite-07. Older versions send an
 	/// ANNOUNCE_END then an ANNOUNCE_START.
diff --git a/rs/moq-net/src/model/mod.rs b/rs/moq-net/src/model/mod.rs
index c2eb91bd28a..eec7b20bbdf 100644
--- a/rs/moq-net/src/model/mod.rs
+++ b/rs/moq-net/src/model/mod.rs
@@ -65,6 +65,8 @@ pub mod origin {
 		Config, Consumer, Cost, Driver, HopLimit, Link, Preference, Prepared, Producer, Publication, Request,
 		Requesting, Requests, Route, Source,
 	};
+	pub use crate::route::RouteKey;
+
 	// Relay-level: every route change, for forwarding and stats. Apps read
 	// `announce` and `follow` instead.
 	#[doc(hidden)]
diff --git a/rs/moq-net/src/model/origin.rs b/rs/moq-net/src/model/origin.rs
index c38abc84bb4..e1bc2bdd0c9 100644
--- a/rs/moq-net/src/model/origin.rs
+++ b/rs/moq-net/src/model/origin.rs
@@ -107,6 +107,11 @@ pub struct Config {
 	/// detection and shortest-path routing.
 	pub hop: Hop,
 
+	/// The key this origin proves to every lite-07 peer, which files the routes it sends
+	/// under it when its grant is scoped. Origins sharing a key fail over as one. `None`
+	/// proves nothing, so such a peer files them under a key of its session alone.
+	pub route_key: Option<super::origin::RouteKey>,
+
 	/// Longest hop path a session using this origin accepts or forwards (default 32).
 	///
 	/// Applies to moq-lite-03+ hop paths and the negotiated MoQ Cluster extension on
@@ -163,6 +168,7 @@ impl Default for Config {
 		let pool = cache::Pool::new(cache::Config::default().with_expiry(cache::DEFAULT_EXPIRY));
 		Self {
 			hop: Hop::random(),
+			route_key: None,
 			max_hops: HopLimit::default(),
 			pool,
 			cache_duration: Duration::MAX,
@@ -2138,7 +2144,7 @@ impl Producer {
 		let (tasks, set) = TaskSet::new();
 		let scope = OriginScope::default();
 		let timers = Deadlines::new(Instant::ZERO);
-		let shared = SendCell::new(kio::Shared::new(OriginState::new(config.update_hold)));
+		let shared = SendCell::new(kio::Shared::new(OriginState::new(config.update_hold, config.route_key)));
 		let pool = config.pool.clone();
 		let producer = Self {
 			hop: config.hop,
@@ -2218,12 +2224,14 @@ impl Producer {
 
 	/// This origin's construction config.
 	pub fn config(&self) -> Config {
+		let shared = self.shared.lock();
 		Config {
 			hop: self.hop,
 			max_hops: self.max_hops,
 			pool: self.pool.clone(),
 			cache_duration: self.cache_duration,
-			update_hold: self.shared.lock().update_hold,
+			update_hold: shared.update_hold,
+			route_key: shared.route_key.clone(),
 		}
 	}
 
@@ -2232,6 +2240,12 @@ impl Producer {
 		self.hop
 	}
 
+	/// The key sessions prove for this origin.
+	#[cfg_attr(not(feature = "async"), allow(dead_code, reason = "async-only"))]
+	pub(crate) fn route_key(&self) -> Option<super::origin::RouteKey> {
+		self.shared.lock().route_key.clone()
+	}
+
 	// Sessions enforce the policy configured once on the origin.
 	#[cfg_attr(not(feature = "async"), allow(dead_code, reason = "async-only"))]
 	pub(crate) fn max_hops(&self) -> HopLimit {
@@ -2252,7 +2266,7 @@ impl Producer {
 			scope: OriginScope::empty(),
 			max_hops: HopLimit::default(),
 			root: Path::default(),
-			shared: SendCell::new(kio::Shared::new(OriginState::new(DEFAULT_UPDATE_HOLD))),
+			shared: SendCell::new(kio::Shared::new(OriginState::new(DEFAULT_UPDATE_HOLD, None))),
 			pool: cache::Pool::default(),
 			cache_duration: Duration::MAX,
 			stats: stats::Session::default(),
@@ -5270,6 +5284,8 @@ struct OriginState {
 	// See [`Config::update_hold`]. No `Default`: every origin takes it from its
 	// config, so no path silently disables the hold.
 	update_hold: Duration,
+	// See [`Config::route_key`].
+	route_key: Option<super::origin::RouteKey>,
 
 	// The announced routes, keyed by prefix. The table holds one entry per live
 	// advertisement, not one per broadcast consumer.
@@ -5308,9 +5324,10 @@ struct OriginState {
 }
 
 impl OriginState {
-	fn new(update_hold: Duration) -> Self {
+	fn new(update_hold: Duration, route_key: Option<super::origin::RouteKey>) -> Self {
 		Self {
 			update_hold,
+			route_key,
 			routes: RouteTable::default(),
 			next_route: 0,
 			next_watch: 0,
@@ -6635,6 +6652,12 @@ impl Consumer {
 		self.hop
 	}
 
+	/// The key sessions prove for this origin.
+	#[cfg_attr(not(feature = "async"), allow(dead_code, reason = "async-only"))]
+	pub(crate) fn route_key(&self) -> Option<super::origin::RouteKey> {
+		self.shared.lock().route_key.clone()
+	}
+
 	/// A clone that never serves the given peer its own data: routes whose hop
 	/// chain contains `peer`, or whose announcing session is `peer`, are invisible
 	/// and never resolved from, matching what the announce loop advertises to them.
diff --git a/rs/moq-net/src/route/mod.rs b/rs/moq-net/src/route/mod.rs
index b14b9ffa373..a8e7611b51d 100644
--- a/rs/moq-net/src/route/mod.rs
+++ b/rs/moq-net/src/route/mod.rs
@@ -13,6 +13,7 @@
 
 #![cfg_attr(not(test), allow(dead_code, reason = "the lite-07 session does not drive it yet"))]
 
+mod proof;
 mod view;
 
 #[cfg(test)]
@@ -27,6 +28,8 @@ use std::{
 
 use crate::Path;
 
+pub use proof::RouteKey;
+pub(crate) use proof::{EXPORTER_LABEL, Proof, Transcript};
 pub(crate) use view::{View, overlaps, within};
 
 /// An opaque routing identity, declared by an origin or derived by [`Scope`].
diff --git a/rs/moq-net/src/route/proof.rs b/rs/moq-net/src/route/proof.rs
new file mode 100644
index 00000000000..7bc6fec6772
--- /dev/null
+++ b/rs/moq-net/src/route/proof.rs
@@ -0,0 +1,186 @@
+//! Route key proofs: an endpoint shows its peer that it holds a route key's secret.
+//!
+//! A proof is an Ed25519 signature over a secret both ends export from the session's
+//! handshake and the prover's side of the session, so it neither replays on another
+//! session nor reflects back to the peer that sent it.
+
+use std::{fmt, sync::Arc};
+
+use rind::signature::{Ed25519KeyPair, PublicKey, verify::ED25519};
+use zeroize::Zeroizing;
+
+/// The label every transport binding exports the session secret under.
+pub(crate) const EXPORTER_LABEL: &[u8] = b"EXPORTER-moq-lite-route-key";
+
+/// Bytes of exported secret a proof signs.
+const SECRET_LEN: usize = 32;
+
+/// Separates a route proof from anything else the same key signs.
+const DOMAIN: &[u8] = b"moq-lite route key";
+
+const KEY_LEN: usize = 32;
+const SIGNATURE_LEN: usize = 64;
+
+/// The PKCS#8 v1 (RFC 8410) encoding of an Ed25519 key, up to its 32-byte seed. rind loads a
+/// seed alone only this way.
+const PKCS8_SEED_PREFIX: [u8; 16] = [
+	0x30, 0x2e, 0x02, 0x01, 0x00, 0x30, 0x05, 0x06, 0x03, 0x2b, 0x65, 0x70, 0x04, 0x22, 0x04, 0x20,
+];
+
+/// The Ed25519 key an origin proves to its peers, so they file its routes under it.
+///
+/// Relays sharing one key present an origin under the same identity whichever of them
+/// carries it, so a scoped peer reached through either fails over as one. Cheap to clone;
+/// its `Debug` shows only the public key.
+#[derive(Clone)]
+pub struct RouteKey(Arc<Ed25519KeyPair>);
+
+impl RouteKey {
+	/// Generate a fresh key from the system's secure random source.
+	pub fn generate() -> Self {
+		Self(Arc::new(Ed25519KeyPair::generate().expect("system randomness")))
+	}
+
+	/// The key with this 32-byte Ed25519 seed.
+	pub fn from_seed(seed: &[u8; KEY_LEN]) -> Self {
+		let mut der = Zeroizing::new([0u8; PKCS8_SEED_PREFIX.len() + KEY_LEN]);
+		der[..PKCS8_SEED_PREFIX.len()].copy_from_slice(&PKCS8_SEED_PREFIX);
+		der[PKCS8_SEED_PREFIX.len()..].copy_from_slice(seed);
+		Self(Arc::new(
+			Ed25519KeyPair::from_pkcs8(der.as_ref()).expect("a PKCS#8 v1 Ed25519 key"),
+		))
+	}
+
+	fn public(&self) -> [u8; KEY_LEN] {
+		self.0
+			.public_key()
+			.as_ref()
+			.try_into()
+			.expect("a 32-byte Ed25519 public key")
+	}
+}
+
+impl fmt::Debug for RouteKey {
+	fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+		f.debug_tuple("RouteKey").field(&Hex(&self.public())).finish()
+	}
+}
+
+/// A proof that the sender holds a route key, as it travels in SETUP: the public key, then
+/// its signature.
+#[derive(Clone, Copy, PartialEq, Eq)]
+pub(crate) struct Proof {
+	pub key: [u8; KEY_LEN],
+	pub signature: [u8; SIGNATURE_LEN],
+}
+
+impl Proof {
+	/// Its encoded size; any other is malformed.
+	pub const LEN: usize = KEY_LEN + SIGNATURE_LEN;
+
+	pub fn to_bytes(self) -> Vec<u8> {
+		[self.key.as_slice(), self.signature.as_slice()].concat()
+	}
+
+	/// Decode a proof, or `None` when `bytes` is not exactly [`Self::LEN`] long.
+	pub fn from_bytes(bytes: &[u8]) -> Option<Self> {
+		let (key, signature) = bytes.split_first_chunk::<KEY_LEN>()?;
+		Some(Self {
+			key: *key,
+			signature: signature.try_into().ok()?,
+		})
+	}
+}
+
+impl fmt::Debug for Proof {
+	fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+		f.debug_struct("Proof")
+			.field("key", &Hex(&self.key))
+			.finish_non_exhaustive()
+	}
+}
+
+/// What a proof on one session signs: the secret both ends export from its handshake.
+pub(crate) struct Transcript(Zeroizing<[u8; SECRET_LEN]>);
+
+impl Transcript {
+	pub fn new(secret: [u8; SECRET_LEN]) -> Self {
+		Self(Zeroizing::new(secret))
+	}
+
+	/// The signed message: the domain, the prover's side (0 dialed, 1 accepted), and the secret.
+	fn message(&self, client: bool) -> Zeroizing<Vec<u8>> {
+		Zeroizing::new([DOMAIN, &[u8::from(!client)], self.0.as_slice()].concat())
+	}
+
+	/// Prove `key` as the side of this session `client` names.
+	pub fn prove(&self, key: &RouteKey, client: bool) -> Proof {
+		Proof {
+			key: key.public(),
+			signature: key
+				.0
+				.sign(&self.message(client))
+				.as_ref()
+				.try_into()
+				.expect("a 64-byte Ed25519 signature"),
+		}
+	}
+
+	/// Whether `proof` shows its key held by the side of this session `client` names.
+	pub fn verify(&self, proof: &Proof, client: bool) -> bool {
+		PublicKey::new(&ED25519, &proof.key)
+			.is_ok_and(|key| key.verify(&self.message(client), &proof.signature).is_ok())
+	}
+}
+
+struct Hex<'a>(&'a [u8]);
+
+impl fmt::Debug for Hex<'_> {
+	fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+		self.0.iter().try_for_each(|byte| write!(f, "{byte:02x}"))
+	}
+}
+
+#[cfg(test)]
+mod tests {
+	use super::*;
+
+	/// Shared with `js/net/src/lite/route_key.test.ts`, so both sides sign the same transcript.
+	const CLIENT_PROOF: &str = concat!(
+		"8a88e3dd7409f195fd52db2d3cba5d72ca6709bf1d94121bf3748801b40f6f5c",
+		"e7ea4e34a65b8501185b805d09b58a61b5b8495654fcaac0949d4f98aa35002e",
+		"6fca096329973e91e1105030dd88fa0eb543c68c00e18394f8300cb0574cf901",
+	);
+
+	#[test]
+	fn a_proof_matches_the_js_transcript() {
+		let proof = Transcript::new([2; 32]).prove(&RouteKey::from_seed(&[1; 32]), true);
+		assert_eq!(format!("{:?}", Hex(&proof.to_bytes())), CLIENT_PROOF);
+	}
+
+	#[test]
+	fn a_proof_holds_only_for_its_side_of_its_session() {
+		let transcript = Transcript::new([2; 32]);
+		let proof = transcript.prove(&RouteKey::generate(), true);
+		assert!(transcript.verify(&proof, true));
+		assert!(!transcript.verify(&proof, false), "reflected to its sender");
+		assert!(
+			!Transcript::new([3; 32]).verify(&proof, true),
+			"replayed on another session"
+		);
+
+		let other = RouteKey::generate().public();
+		assert!(
+			!transcript.verify(&Proof { key: other, ..proof }, true),
+			"claimed for another key"
+		);
+	}
+
+	#[test]
+	fn a_proof_decodes_only_at_its_size() {
+		let proof = Transcript::new([2; 32]).prove(&RouteKey::generate(), false);
+		assert_eq!(Proof::from_bytes(&proof.to_bytes()), Some(proof));
+		assert_eq!(Proof::from_bytes(&[0; Proof::LEN - 1]), None);
+		assert_eq!(Proof::from_bytes(&[0; Proof::LEN + 1]), None);
+	}
+}
diff --git a/rs/moq-net/src/route/tests/routing.rs b/rs/moq-net/src/route/tests/routing.rs
index 2397704c8c7..d3ea706bf08 100644
--- a/rs/moq-net/src/route/tests/routing.rs
+++ b/rs/moq-net/src/route/tests/routing.rs
@@ -605,7 +605,8 @@ fn forged_identity_is_filed_apart_under_a_scoped_grant() {
 
 /// A local mesh publishing through two uplinks, each admitted under the same
 /// subject. Both CDN relays file the local origin under one key, so it
-/// survives losing an uplink; a retracted identity leaves no alias behind.
+/// survives losing an uplink, and so does the local relay's own identity; a
+/// retracted identity leaves no alias behind.
 #[test]
 fn scoped_delivery_through_two_uplinks_reaches_one_key() {
 	let (c1, c2, l1, l2, origin) = (0, 1, 2, 3, 4);
@@ -627,6 +628,16 @@ fn scoped_delivery_through_two_uplinks_reaches_one_key() {
 	assert_eq!(next(&sim, c2, key), Some(l2));
 	assert_eq!(next(&sim, c1, qualified(LOCAL.subject, 20)), Some(l1));
 
+	sim.disconnect(l1, c1);
+	assert!(sim.run());
+	assert_eq!(
+		next(&sim, c1, qualified(LOCAL.subject, 20)),
+		Some(c2),
+		"the local relay's own fails over"
+	);
+	sim.connect(l1, c1);
+	assert!(sim.run());
+
 	sim.disconnect(l2, c2);
 	assert!(sim.run());
 	assert_eq!(next(&sim, c2, key), Some(c1));
diff --git a/rs/moq-net/src/server.rs b/rs/moq-net/src/server.rs
index b1b8e7249dc..994db90172e 100644
--- a/rs/moq-net/src/server.rs
+++ b/rs/moq-net/src/server.rs
@@ -198,6 +198,8 @@ impl Server {
 				token: None,
 				ietf: self.extensions.ietf && version.has_ietf(),
 				implementation: self.implementation(),
+				// Filled by `lite::start` from the attached origin handles.
+				route_key: None,
 			}
 		} else {
 			lite::Setup::default()
@@ -1105,7 +1107,6 @@ struct Answer {
 	/// The deadline's timer, armed once the reply first waits.
 	timer: Option<kio::clock::Sleep>,
 	unanswered: Unanswered,
-	stats: stats::Session,
 	/// When to give up on the peer taking the reply.
 	deadline: Option<Instant>,
 	/// The request being answered, emptied of what the start took.
@@ -1127,7 +1128,6 @@ impl Answer {
 			reply: None,
 			timer: None,
 			unanswered: Unanswered(Some((session, version, stats.clone()))),
-			stats,
 			deadline,
 			handshake,
 		}
@@ -1143,9 +1143,9 @@ impl Answer {
 			drop(std::mem::replace(&mut self.unanswered, Unanswered(None)));
 			return Poll::Ready(Err(Error::Timeout));
 		};
-		self.unanswered.0 = None;
-		if let Err(err) = &res {
-			self.stats.end(err);
+		match &res {
+			Ok(_) => self.unanswered.answered(),
+			Err(err) => self.unanswered.refuse(err),
 		}
 		Poll::Ready(res)
 	}
@@ -1197,6 +1197,20 @@ impl Answer {
 /// took too long.
 struct Unanswered(Option<(Transport, Version, stats::Session)>);
 
+impl Unanswered {
+	fn answered(&mut self) {
+		self.0 = None;
+	}
+
+	/// Close the session with `err`'s wire code, so the peer learns why it was refused.
+	fn refuse(&mut self, err: &Error) {
+		if let Some((mut session, version, stats)) = self.0.take() {
+			close(&mut session, err, Some(version));
+			stats.end(err);
+		}
+	}
+}
+
 impl Drop for Unanswered {
 	fn drop(&mut self) {
 		if let Some((mut session, version, stats)) = self.0.take() {
@@ -1415,6 +1429,9 @@ mod tests {
 		fn poll_closed(&self, _waiter: &kio::Waiter) -> std::task::Poll<Self::Error> {
 			std::task::Poll::Pending
 		}
+		fn export_keying_material(&self, _label: &[u8], _context: &[u8]) -> Option<[u8; 32]> {
+			Some([9; 32])
+		}
 	}
 
 	#[derive(Clone, Default)]
@@ -1484,6 +1501,7 @@ mod tests {
 			token: None,
 			ietf: false,
 			implementation: None,
+			route_key: None,
 		}
 		.encode(&mut crate::coding::Encoder::new(&mut buf, v.into()), v)
 		.unwrap();
@@ -1874,6 +1892,37 @@ mod tests {
 		assert_eq!(request.path(), "/closed");
 	}
 
+	/// A client whose route key proof fails is refused with PROTOCOL_VIOLATION, not left waiting.
+	#[kio::test]
+	async fn a_failed_route_key_proof_closes_with_its_code() {
+		let v = lite::Version::Lite07;
+		// Signed for another session's exported secret, so it fails against this one's.
+		let proof = crate::route::Transcript::new([1; 32]).prove(&crate::origin::RouteKey::generate(), true);
+		let mut setup = Vec::new();
+		lite::DataType::Setup
+			.encode(&mut crate::coding::Encoder::new(&mut setup, v.into()), v)
+			.unwrap();
+		lite::Setup {
+			route_key: Some(proof),
+			..Default::default()
+		}
+		.encode(&mut crate::coding::Encoder::new(&mut setup, v.into()), v)
+		.unwrap();
+
+		let session = FakeSession::new(ALPN_LITE_07_WIP, [setup]);
+		let transport = session.clone();
+		let request = Server::new()
+			.with_versions(Version::Lite(v).into())
+			.accept_request(kio::clock::now(), session)
+			.await
+			.unwrap();
+		assert!(matches!(request.ok().await, Err(Error::ProtocolViolation)));
+		assert_eq!(
+			transport.close_code(),
+			Some(Version::Lite(v).session_code(&SessionError::ProtocolViolation))
+		);
+	}
+
 	#[kio::test]
 	async fn accepted_lite_setup_refuses_a_second_setup_stream() {
 		let session = FakeSession::new(ALPN_LITE_05, [lite05_setup(None, None, None)]);
diff --git a/rs/moq-net/src/transport.rs b/rs/moq-net/src/transport.rs
index 195553bf134..30141b4e1dc 100644
--- a/rs/moq-net/src/transport.rs
+++ b/rs/moq-net/src/transport.rs
@@ -407,6 +407,17 @@ pub mod poll {
 			None
 		}
 
+		/// Export 32 bytes of keying material from this session's handshake under `label` and
+		/// `context` (RFC 8446 section 7.5), or `None` when the transport has no exporter.
+		///
+		/// Both ends of one session export the same bytes, and no other session does.
+		/// WebTransport derives them per session as its draft specifies, since other sessions
+		/// may share the connection.
+		fn export_keying_material(&self, label: &[u8], context: &[u8]) -> Option<[u8; 32]> {
+			let _ = (label, context);
+			None
+		}
+
 		/// Accept the next unidirectional stream opened by the peer.
 		fn accept_uni(&self) -> AcceptUni<'_, Self> {
 			AcceptUni::new(self)
@@ -615,6 +626,10 @@ pub mod poll {
 		fn stream_credit(&self, dir: super::Dir) -> Option<super::StreamCredit> {
 			(**self).stream_credit(dir)
 		}
+
+		fn export_keying_material(&self, label: &[u8], context: &[u8]) -> Option<[u8; 32]> {
+			(**self).export_keying_material(label, context)
+		}
 	}
 
 	/// A transport that the async client and server can box:
diff --git a/rs/moq-net/src/transport/boxed.rs b/rs/moq-net/src/transport/boxed.rs
index d37c209c833..27854c1e2d0 100644
--- a/rs/moq-net/src/transport/boxed.rs
+++ b/rs/moq-net/src/transport/boxed.rs
@@ -349,6 +349,7 @@ pub(super) trait ErasedSession: Send + Sync {
 	fn probe(&self) -> Option<Probe>;
 	fn receive_window(&self) -> Option<ReceiveWindow>;
 	fn stream_credit(&self, dir: Dir) -> Option<StreamCredit>;
+	fn export_keying_material(&self, label: &[u8], context: &[u8]) -> Option<[u8; 32]>;
 }
 
 trait ErasedGroup: Send + Sync {
@@ -488,6 +489,10 @@ impl<S: poll::Boxable> ErasedSession for S {
 	fn stream_credit(&self, dir: Dir) -> Option<StreamCredit> {
 		poll::Session::stream_credit(self, dir)
 	}
+
+	fn export_keying_material(&self, label: &[u8], context: &[u8]) -> Option<[u8; 32]> {
+		poll::Session::export_keying_material(self, label, context)
+	}
 }
 
 impl<G: poll::SendGroup + Send + Sync> ErasedGroup for G {
@@ -676,6 +681,10 @@ impl poll::Session for Session {
 	fn stream_credit(&self, dir: Dir) -> Option<StreamCredit> {
 		self.inner.session.stream_credit(dir)
 	}
+
+	fn export_keying_material(&self, label: &[u8], context: &[u8]) -> Option<[u8; 32]> {
+		self.inner.session.export_keying_material(label, context)
+	}
 }
 
 impl poll::SendStream for SendStream {
diff --git a/rs/moq-net/src/transport/memory.rs b/rs/moq-net/src/transport/memory.rs
index c1e54229394..fe0f1bec1f2 100644
--- a/rs/moq-net/src/transport/memory.rs
+++ b/rs/moq-net/src/transport/memory.rs
@@ -78,7 +78,10 @@ impl Default for Config {
 
 /// Create two connected sessions: streams one opens, the other accepts.
 pub fn pair(config: Config) -> (Session, Session) {
+	let mut secret = [0; 32];
+	rand::RngExt::fill(&mut kio::clock::rng(), &mut secret);
 	let conn = Arc::new(Conn {
+		secret: rind::hkdf::Salt::new(&rind::hkdf::HKDF_SHA256, &[]).extract(&secret),
 		close: Default::default(),
 		incoming: [Incoming::default(), Incoming::default()],
 		config,
@@ -158,6 +161,8 @@ fn closed(close: &Close) -> Option<Error> {
 /// State shared by both sides of a pair.
 struct Conn {
 	config: Config,
+	/// What both sides export keying material from, standing in for a TLS handshake's secret.
+	secret: rind::hkdf::Prk,
 	close: Close,
 	/// What each side has yet to accept.
 	incoming: [Incoming; 2],
@@ -442,6 +447,18 @@ impl poll::Session for Session {
 			super::Dir::Bi => stream_credit(&outgoing.bi_open, config.max_concurrent_bi_streams),
 		})
 	}
+
+	fn export_keying_material(&self, label: &[u8], context: &[u8]) -> Option<[u8; 32]> {
+		// Length-prefixed, so no label and context pair collides with another.
+		let lengths = [u8::try_from(label.len()).ok()?, u8::try_from(context.len()).ok()?];
+		let mut output = [0; 32];
+		self.conn()
+			.secret
+			.expand(&[&lengths, label, context], output.len())
+			.fill(&mut output)
+			.expect("32 bytes fit HKDF-SHA256");
+		Some(output)
+	}
 }
 
 /// One direction of a stream: the messages its writer queued for its reader.
diff --git a/rs/moq-net/tests/integration/routing_contracts/mod.rs b/rs/moq-net/tests/integration/routing_contracts/mod.rs
index b39e9ded6ef..5c341e1366d 100644
--- a/rs/moq-net/tests/integration/routing_contracts/mod.rs
+++ b/rs/moq-net/tests/integration/routing_contracts/mod.rs
@@ -1109,8 +1109,8 @@ fn transit_priority_depends_on_arrival_order() {
 /// claims outside the forger's namespace, and its seqno outlives it: after it
 /// leaves, the victim's real routes are refused until the victim counts past
 /// the forged seqno. Filed under `hash(subject, id)`, the forgery serves only
-/// claims inside the forger's scope. The forger's own proven identity stays
-/// bare either way.
+/// claims inside the forger's scope. The forger's own identity is filed the
+/// same way, so declaring the victim's identity as its own gains it nothing more.
 #[test]
 fn forged_identity_hijacks_claims_outside_the_forgers_scope() {
 	for scoped_admission in [false, true] {
@@ -1137,7 +1137,13 @@ fn forged_identity_hijacks_claims_outside_the_forgers_scope() {
 
 		net.forge(forger, 7, 1000);
 		assert!(net.run());
-		assert!(net.route(core, 3).is_some(), "a connection's own identity is bare");
+		let own = if scoped_admission { qualified("forger", 3) } else { 3 };
+		assert!(net.route(core, own).is_some());
+		assert_eq!(
+			net.route(core, 3).is_some(),
+			!scoped_admission,
+			"a scoped connection's own identity is qualified"
+		);
 		let served = served_by(&net.request(core, "other/x", Forward::Pinned));
 		if scoped_admission {
 			assert_eq!(served, Some((7, victim)));
@@ -1165,8 +1171,8 @@ fn forged_identity_hijacks_claims_outside_the_forgers_scope() {
 /// subject. Both CDN relays file the local origin under one key, so it survives
 /// losing an uplink: the first hop keeps its identity and the request follows
 /// the other uplink, named as the local relay knows it. Claims outside the
-/// scope are refused under that key, and the local relay's own identity stays
-/// bare.
+/// scope are refused under that key. The local relay's own identity is filed
+/// under the same key, so its own broadcast fails over the same way.
 #[test]
 fn scoped_delivery_through_two_uplinks_reaches_one_key() {
 	let (c1, c2, l1, l2, origin) = (0, 1, 2, 3, 4);
@@ -1182,13 +1188,38 @@ fn scoped_delivery_through_two_uplinks_reaches_one_key() {
 	net.originate(l1, 20, 0);
 	net.claim(9, "local/", 0, None);
 	net.claim(9, "cdn/", 0, None);
+	net.claim(20, "local/l1/", 0, None);
 	assert!(net.run());
 
 	let key = qualified(LOCAL.subject, 9);
 	assert!(net.route(c1, 9).is_none());
 	assert_eq!(net.route(c1, key).and_then(|route| route.next), Some(l1));
 	assert_eq!(net.route(c2, key).and_then(|route| route.next), Some(l2));
-	assert_eq!(net.route(c1, 20).and_then(|route| route.next), Some(l1));
+	let own = qualified(LOCAL.subject, 20);
+	assert!(
+		net.route(c1, 20).is_none(),
+		"the local relay's own identity is qualified"
+	);
+	assert_eq!(net.route(c1, own).and_then(|route| route.next), Some(l1));
+	assert_eq!(net.resolve(c2, "local/l1/x"), Some(own));
+
+	// The local relay loses its direct uplink, and its own broadcast fails over through its sibling.
+	net.disconnect(l1, c1);
+	assert!(net.run());
+	assert!(net.starved(c1, own), "the detour is longer than the lost uplink");
+	// Its own set of sessions changed, so the origin advances its seqno.
+	net.bump(l1);
+	assert!(net.run());
+	assert_eq!(net.resolve(c1, "local/l1/x"), Some(own));
+	assert_eq!(
+		net.request(c1, "local/l1/x", Forward::Pinned),
+		Outcome::Served {
+			by: 20,
+			path: vec![c1, c2, l2, l1]
+		}
+	);
+	net.connect(l1, c1);
+	assert!(net.run());
 	assert_eq!(net.resolve(c2, "local/x"), Some(key));
 	assert_eq!(
 		net.request(c2, "local/x", Forward::Pinned),
@@ -1212,10 +1243,10 @@ fn scoped_delivery_through_two_uplinks_reaches_one_key() {
 	);
 
 	// A retracted identity leaves no alias behind.
-	assert_eq!(net.aliases(c1), 1);
+	assert_eq!(net.aliases(c1), 2, "the origin's and the local relay's own");
 	net.kill(origin);
 	assert!(net.run());
-	assert_eq!(net.aliases(c1), 0);
+	assert_eq!(net.aliases(c1), 1);
 }
 
 /// A local relay missing its `upstream` mark leaks CDN routes back to the CDN,
diff --git a/rs/moq-net/tests/integration/routing_contracts/model.rs b/rs/moq-net/tests/integration/routing_contracts/model.rs
index 18af0b52ca9..2d094da842e 100644
--- a/rs/moq-net/tests/integration/routing_contracts/model.rs
+++ b/rs/moq-net/tests/integration/routing_contracts/model.rs
@@ -533,10 +533,10 @@ pub struct Retained {
 
 #[derive(Default)]
 struct State {
-	/// The identity this node's sessions prove, if it originates one.
+	/// This node's own identity, if it originates one.
 	proven: Option<Id>,
-	/// Identities this node serves itself, with their seqnos: its proven one,
-	/// plus any it forges.
+	/// Identities this node serves itself, with their seqnos: its own, plus any
+	/// it forges.
 	origins: BTreeMap<Id, Seqno>,
 	/// Whether this node advertises identities it does not serve.
 	transit: bool,
@@ -686,9 +686,6 @@ pub struct Net {
 	/// Every `(subject, scope)` a configured link grants.
 	grants: BTreeSet<(&'static str, &'static str)>,
 	up: BTreeSet<(Node, Node)>,
-	/// `(node, peer)`: the identity `node` proved on its session to `peer`. A
-	/// session proves one key, once.
-	proved: BTreeMap<(Node, Node), Id>,
 	/// `(at, peer)`: `peer` sent `at` a GOAWAY on their current session.
 	draining: BTreeSet<(Node, Node)>,
 	queues: BTreeMap<(Node, Node), VecDeque<Msg>>,
@@ -717,7 +714,6 @@ impl Net {
 			links: vec![vec![None; nodes]; nodes],
 			grants: BTreeSet::new(),
 			up: BTreeSet::new(),
-			proved: BTreeMap::new(),
 			draining: BTreeSet::new(),
 			queues: BTreeMap::new(),
 			acks: BTreeMap::new(),
@@ -773,11 +769,6 @@ impl Net {
 	pub fn connect(&mut self, a: Node, b: Node) {
 		assert!(self.links[a][b].is_some(), "unknown link {a}-{b}");
 		self.up.insert(Self::pair(a, b));
-		for (x, y) in [(a, b), (b, a)] {
-			if let Some(id) = self.nodes[x].proven {
-				self.proved.insert((x, y), id);
-			}
-		}
 		self.advertise(a);
 		self.advertise(b);
 	}
@@ -792,7 +783,6 @@ impl Net {
 		for (x, y) in [(a, b), (b, a)] {
 			self.queues.remove(&(x, y));
 			self.acks.remove(&(x, y));
-			self.proved.remove(&(x, y));
 			self.held.remove(&(x, y));
 			self.draining.remove(&(y, x));
 			let state = &mut self.nodes[y];
@@ -848,14 +838,9 @@ impl Net {
 		(0..self.nodes.len()).filter(move |&peer| self.links[node][peer].is_some() && self.connected(node, peer))
 	}
 
-	/// `node` starts originating `id` at seqno `seqno`, proving it on every session.
+	/// `node` starts originating `id` at seqno `seqno`.
 	pub fn originate(&mut self, node: Node, id: Id, seqno: Seqno) {
 		assert_eq!(id & QUALIFIED, 0, "a key-derived identity is never qualified");
-		let peers: Vec<Node> = self.peers(node).collect();
-		for peer in peers {
-			let proved = *self.proved.entry((node, peer)).or_insert(id);
-			assert_eq!(proved, id, "node {node}'s session to {peer} already proved another key");
-		}
 		let state = &mut self.nodes[node];
 		state.proven = Some(id);
 		state.origins.insert(id, seqno);
@@ -869,7 +854,7 @@ impl Net {
 		self.advertise(node);
 	}
 
-	/// `node` advertises `id` as if forwarding it, without proving it.
+	/// `node` advertises `id` as if forwarding it.
 	pub fn forge(&mut self, node: Node, id: Id, seqno: Seqno) {
 		self.nodes[node].origins.insert(id, seqno);
 		self.advertise(node);
@@ -889,9 +874,8 @@ impl Net {
 
 	/// The origin at `node` retires its identity for a fresh one and announces
 	/// its claims again there: what it does instead of advancing a seqno or a
-	/// revision to [`VARINT_MAX`]. A session proves one key once, so every
-	/// session closes and reopens to prove the new one, and every node lets the
-	/// old identity go.
+	/// revision to [`VARINT_MAX`]. Every session closes and reopens, so every
+	/// node lets the old identity go.
 	fn rotate(&mut self, node: Node) {
 		let peers: Vec<Node> = self.peers(node).collect();
 		for &peer in &peers {
@@ -917,7 +901,7 @@ impl Net {
 		self.nodes[node].views.get_mut(&id).unwrap().floors.insert("", rev);
 	}
 
-	/// The identity `node` proves.
+	/// The identity `node` originates.
 	pub fn proven(&self, node: Node) -> Id {
 		self.nodes[node].proven.expect("not an origin")
 	}
@@ -1185,9 +1169,12 @@ impl Net {
 	}
 
 	/// The key `at` files `id` under when `from` names it, or `None` when refused.
+	///
+	/// Under a scoped grant every identity is qualified, the sender's own included, by
+	/// the grant's subject, which stands in for the route key the sender proved.
 	fn key(&self, at: Node, from: Node, id: Id) -> Option<Id> {
 		match self.side(at, from).grant {
-			Some(grant) if self.proved.get(&(from, at)) != Some(&id) => {
+			Some(grant) => {
 				if id & QUALIFIED != 0 && !self.cfg.requalify {
 					return None;
 				}
diff --git a/rs/moq-quic/src/connection/mod.rs b/rs/moq-quic/src/connection/mod.rs
index f68fc7d416a..8feeb704302 100644
--- a/rs/moq-quic/src/connection/mod.rs
+++ b/rs/moq-quic/src/connection/mod.rs
@@ -1571,16 +1571,12 @@ impl Connection {
 		self.crypto.peer_identity()
 	}
 
-	/// Fill `output` with keying material exported from the TLS session (RFC 5705), using
-	/// `label` and `context` for domain separation
-	#[cfg(test)]
-	pub(crate) fn export_keying_material(
-		&self,
-		output: &mut [u8],
-		label: &[u8],
-		context: &[u8],
-	) -> Result<(), crypto::ExportKeyingMaterialError> {
-		self.crypto.export_keying_material(output, label, context)
+	/// 32 bytes of keying material exported from the TLS session (RFC 8446 section 7.5) under
+	/// `label` and `context`, or `None` before the handshake completes.
+	pub fn export_keying_material(&self, label: &[u8], context: &[u8]) -> Option<[u8; 32]> {
+		let mut output = [0; 32];
+		self.crypto.export_keying_material(&mut output, label, context).ok()?;
+		Some(output)
 	}
 
 	/// Whether the connection is in the process of being established
diff --git a/rs/moq-quic/src/crypto.rs b/rs/moq-quic/src/crypto.rs
index 7a49936e139..bf43d49322c 100644
--- a/rs/moq-quic/src/crypto.rs
+++ b/rs/moq-quic/src/crypto.rs
@@ -33,7 +33,6 @@ pub struct HandshakeData {
 
 /// The requested keying material is longer than the handshake's hash can export.
 #[derive(Debug, PartialEq, Eq)]
-#[cfg_attr(not(test), expect(dead_code, reason = "only tests export keying material"))]
 pub(crate) struct ExportKeyingMaterialError;
 
 /// A cryptographic session (commonly TLS)
@@ -85,7 +84,6 @@ pub(crate) trait Session: Send + Sync + 'static {
 	///
 	/// This function will fail, returning [ExportKeyingMaterialError],
 	/// if the requested output length is too large.
-	#[cfg_attr(not(test), expect(dead_code, reason = "only tests export keying material"))]
 	fn export_keying_material(
 		&self,
 		output: &mut [u8],
diff --git a/rs/moq-quic/src/tests/mod.rs b/rs/moq-quic/src/tests/mod.rs
index d3e5e6c9362..b6c7c19f826 100644
--- a/rs/moq-quic/src/tests/mod.rs
+++ b/rs/moq-quic/src/tests/mod.rs
@@ -898,19 +898,10 @@ fn export_keying_material() {
 	const LABEL: &[u8] = b"test_label";
 	const CONTEXT: &[u8] = b"test_context";
 
-	// client keying material
-	let mut client_buf = [0u8; 64];
-	pair.client_conn_mut(client_ch)
-		.export_keying_material(&mut client_buf, LABEL, CONTEXT)
-		.unwrap();
-
-	// server keying material
-	let mut server_buf = [0u8; 64];
-	pair.server_conn_mut(server_ch)
-		.export_keying_material(&mut server_buf, LABEL, CONTEXT)
-		.unwrap();
-
-	assert_eq!(&client_buf[..], &server_buf[..]);
+	let client = pair.client_conn_mut(client_ch).export_keying_material(LABEL, CONTEXT);
+	let server = pair.server_conn_mut(server_ch).export_keying_material(LABEL, CONTEXT);
+	assert!(client.is_some());
+	assert_eq!(client, server);
 }
 
 #[test]
diff --git a/rs/moq-relay/Cargo.toml b/rs/moq-relay/Cargo.toml
index 8fd61d1515c..1e8372107a0 100644
--- a/rs/moq-relay/Cargo.toml
+++ b/rs/moq-relay/Cargo.toml
@@ -69,6 +69,7 @@ hyper = { workspace = true, optional = true }
 hyper-util = { workspace = true, features = ["server-auto"] }
 kio = { workspace = true, features = ["runtime", "serde"] }
 moq-auth = { workspace = true, features = ["async", "client"] }
+moq-crypto = { workspace = true, features = ["sign"] }
 moq-net = { workspace = true }
 # The flow-control limits both QUIC runtimes take, for widening a peer's connection.
 moq-quic = { workspace = true }
diff --git a/rs/moq-relay/src/cluster.rs b/rs/moq-relay/src/cluster.rs
index 1dbce3da6d4..fed98c4e4ce 100644
--- a/rs/moq-relay/src/cluster.rs
+++ b/rs/moq-relay/src/cluster.rs
@@ -739,6 +739,20 @@ pub struct Config {
 	)]
 	pub id: Option<u64>,
 
+	/// Route key file: the Ed25519 key this relay proves to every moq-lite-07 peer,
+	/// which files the routes this relay sends under it when this relay's grant is scoped.
+	///
+	/// Relays given the same file present an origin under one key, so a scoped peer
+	/// reached through either fails over as one. A missing file is generated (mode 0600).
+	/// Unset generates a fresh key on every start.
+	#[usage(
+		name = "cluster-route-key",
+		long = "cluster-route-key",
+		env = "MOQ_CLUSTER_ROUTE_KEY",
+		setting = "cluster.route_key"
+	)]
+	pub route_key: Option<PathBuf>,
+
 	/// Longest hop path accepted or forwarded, from 1 to 32 (default 32).
 	#[usage(
 		name = "cluster-max-hops",
@@ -1393,6 +1407,12 @@ impl Cluster {
 		peer.quic.validate()?;
 		let mut work = kio::Tasks::new();
 		let mut origin_config = origin::Config::new(id);
+		origin_config.route_key = Some(match &config.route_key {
+			Some(path) => (&moq_crypto::sign::SecretKey::load_or_generate(path)
+				.with_context(|| format!("--cluster-route-key {}", path.display()))?)
+				.into(),
+			None => origin::RouteKey::generate(),
+		});
 		if let Some(max) = config.max_hops {
 			origin_config.max_hops = origin::HopLimit::new(max).context("--cluster-max-hops must be from 1 to 32")?;
 		}
diff --git a/rs/moq-relay/src/settings.rs b/rs/moq-relay/src/settings.rs
index 436558c2716..3b798f655e9 100644
--- a/rs/moq-relay/src/settings.rs
+++ b/rs/moq-relay/src/settings.rs
@@ -74,6 +74,9 @@ struct Cluster {
 	#[usage(env = "MOQ_CLUSTER_ID", cli("--cluster-id"))]
 	id: Option<u64>,
 
+	#[usage(env = "MOQ_CLUSTER_ROUTE_KEY", cli("--cluster-route-key"))]
+	route_key: Option<String>,
+
 	#[usage(env = "MOQ_CLUSTER_MAX_HOPS", cli("--cluster-max-hops"))]
 	max_hops: Option<usize>,
 
diff --git a/rs/moq-tokio/src/quic/driver/connection.rs b/rs/moq-tokio/src/quic/driver/connection.rs
index 2c57bc7c3df..6cec2479b92 100644
--- a/rs/moq-tokio/src/quic/driver/connection.rs
+++ b/rs/moq-tokio/src/quic/driver/connection.rs
@@ -476,6 +476,13 @@ impl Connection {
 		moq_net::transport::ReceiveWindow::new(state.inner.receive_window(), state.inner.stream_receive_window())
 	}
 
+	/// 32 bytes of keying material exported from the TLS session under `label` and `context`,
+	/// or `None` before the handshake completes.
+	#[cfg(feature = "net")]
+	pub(crate) fn export_keying_material(&self, label: &[u8], context: &[u8]) -> Option<[u8; 32]> {
+		self.0.state.lock().inner.export_keying_material(label, context)
+	}
+
 	/// The peer's stream credit in `dir`, as this connection last heard it.
 	#[cfg(feature = "net")]
 	pub(crate) fn stream_credit(&self, dir: moq_net::transport::Dir) -> moq_net::transport::StreamCredit {
diff --git a/rs/moq-tokio/src/quic/web/session.rs b/rs/moq-tokio/src/quic/web/session.rs
index 47b2b6f25ec..b81799c783c 100644
--- a/rs/moq-tokio/src/quic/web/session.rs
+++ b/rs/moq-tokio/src/quic/web/session.rs
@@ -1050,6 +1050,31 @@ impl moq_net::transport::poll::Session for Session {
 	fn stream_credit(&self, dir: moq_net::transport::Dir) -> Option<moq_net::transport::StreamCredit> {
 		Some(self.conn.stream_credit(dir))
 	}
+	/// The connection's exporter on raw QUIC; on WebTransport, this session's own.
+	fn export_keying_material(&self, label: &[u8], context: &[u8]) -> Option<[u8; 32]> {
+		match self.session_id {
+			None => self.conn.export_keying_material(label, context),
+			Some(id) => self.conn.export_keying_material(
+				WEBTRANSPORT_EXPORTER,
+				&webtransport_exporter_context(id.into_inner(), label, context)?,
+			),
+		}
+	}
+}
+
+/// The TLS exporter label WebTransport derives each session's exporter under.
+const WEBTRANSPORT_EXPORTER: &[u8] = b"EXPORTER-WebTransport";
+
+/// The TLS exporter context for WebTransport session `id`'s exporter (draft-ietf-webtrans-http3
+/// section 4.8), or `None` when `label` or `context` exceeds 255 bytes.
+fn webtransport_exporter_context(id: u64, label: &[u8], context: &[u8]) -> Option<Vec<u8>> {
+	let mut exporter = Vec::with_capacity(10 + label.len() + context.len());
+	exporter.extend_from_slice(&id.to_be_bytes());
+	exporter.push(u8::try_from(label.len()).ok()?);
+	exporter.extend_from_slice(label);
+	exporter.push(u8::try_from(context.len()).ok()?);
+	exporter.extend_from_slice(context);
+	Some(exporter)
 }
 
 #[cfg(all(test, feature = "_certs"))]
@@ -1318,6 +1343,36 @@ mod tests {
 		}
 	}
 
+	/// Both ends of a session export the same keying material as soon as it starts. A
+	/// WebTransport session derives its own from the connection's, so it differs from what
+	/// raw QUIC on the same connection would export.
+	#[tokio::test]
+	async fn both_ends_export_the_same_keying_material() {
+		use moq_net::transport::poll::Session as _;
+
+		for framed in [false, true] {
+			let (client, server, _endpoints) = pair().await;
+			let (client, server) = sessions(framed, client, server).await;
+			let exported = client.export_keying_material(b"label", b"context");
+			assert!(exported.is_some(), "framed: {framed}");
+			assert_eq!(
+				server.export_keying_material(b"label", b"context"),
+				exported,
+				"framed: {framed}"
+			);
+			assert_ne!(
+				client.export_keying_material(b"label", b""),
+				exported,
+				"framed: {framed}"
+			);
+			assert_eq!(
+				client.conn.export_keying_material(b"label", b"context") == exported,
+				!framed,
+				"framed: {framed}"
+			);
+		}
+	}
+
 	/// Once a read met the peer's reset, the close watch keeps reporting it rather than a clean end.
 	#[tokio::test]
 	async fn a_read_reset_stays_reset_for_the_close_watch() {
diff --git a/rs/moq-uring/src/quic/driver/connection.rs b/rs/moq-uring/src/quic/driver/connection.rs
index 144c6ebc1c2..11fc1800a66 100644
--- a/rs/moq-uring/src/quic/driver/connection.rs
+++ b/rs/moq-uring/src/quic/driver/connection.rs
@@ -283,6 +283,12 @@ impl Connection {
 		self.shared.conn.borrow().peer_identity()
 	}
 
+	/// 32 bytes of keying material exported from the TLS session under `label` and `context`,
+	/// or `None` before the handshake completes.
+	pub(crate) fn export_keying_material(&self, label: &[u8], context: &[u8]) -> Option<[u8; 32]> {
+		self.shared.conn.borrow().export_keying_material(label, context)
+	}
+
 	/// The peer's current UDP address, following any migration.
 	pub fn remote_address(&self) -> SocketAddr {
 		self.shared.conn.borrow().remote_address()
diff --git a/rs/moq-uring/src/quic/web.rs b/rs/moq-uring/src/quic/web.rs
index aea49b43106..fcde2f336b6 100644
--- a/rs/moq-uring/src/quic/web.rs
+++ b/rs/moq-uring/src/quic/web.rs
@@ -834,6 +834,31 @@ impl moq_net::transport::poll::Session for Session {
 	fn stream_credit(&self, dir: moq_net::transport::Dir) -> Option<moq_net::transport::StreamCredit> {
 		Some(self.conn.stream_credit(dir))
 	}
+	/// The connection's exporter on raw QUIC; on WebTransport, this session's own.
+	fn export_keying_material(&self, label: &[u8], context: &[u8]) -> Option<[u8; 32]> {
+		match &self.web {
+			None => self.conn.export_keying_material(label, context),
+			Some(web) => self.conn.export_keying_material(
+				WEBTRANSPORT_EXPORTER,
+				&webtransport_exporter_context(web.session_id, label, context)?,
+			),
+		}
+	}
+}
+
+/// The TLS exporter label WebTransport derives each session's exporter under.
+const WEBTRANSPORT_EXPORTER: &[u8] = b"EXPORTER-WebTransport";
+
+/// The TLS exporter context for WebTransport session `id`'s exporter (draft-ietf-webtrans-http3
+/// section 4.8), or `None` when `label` or `context` exceeds 255 bytes.
+fn webtransport_exporter_context(id: u64, label: &[u8], context: &[u8]) -> Option<Vec<u8>> {
+	let mut exporter = Vec::with_capacity(10 + label.len() + context.len());
+	exporter.extend_from_slice(&id.to_be_bytes());
+	exporter.push(u8::try_from(label.len()).ok()?);
+	exporter.extend_from_slice(label);
+	exporter.push(u8::try_from(context.len()).ok()?);
+	exporter.extend_from_slice(context);
+	Some(exporter)
 }
 
 /// Close the session: in web mode with a `CloseWebTransportSession` capsule
diff --git a/rs/moq-uring/src/transport/local.rs b/rs/moq-uring/src/transport/local.rs
index 0151df50605..bdae2cb556a 100644
--- a/rs/moq-uring/src/transport/local.rs
+++ b/rs/moq-uring/src/transport/local.rs
@@ -117,6 +117,10 @@ impl<S: poll::Session> poll::Session for Local<S> {
 	fn stream_credit(&self, dir: moq::Dir) -> Option<moq::StreamCredit> {
 		self.0.stream_credit(dir)
 	}
+
+	fn export_keying_material(&self, label: &[u8], context: &[u8]) -> Option<[u8; 32]> {
+		self.0.export_keying_material(label, context)
+	}
 }
 
 impl<T: poll::SendStream> poll::SendStream for Local<T> {

From 7e621623a80b7a9cf1425dd13c6133d29e32a76c Mon Sep 17 00:00:00 2001
From: Luke Curley <kixelated@gmail.com>
Date: Thu, 5 Nov 2026 20:03:14 +0000
Subject: [PATCH 04/36] docs(agents): never reserve a huge value as a marker
 (#7974)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 AGENTS.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/AGENTS.md b/AGENTS.md
index 1d7704bb98c..532551286e4 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -28,6 +28,7 @@ The API is the most important thing to get right: a bad shape costs a breaking c
 - Propose alternatives when a name or shape feels awkward.
 - Short names under a module namespace (`encode::Config`, not `EncoderConfig`), mirrored across Rust, JS, and the bindings.
 - Keep package boundaries modular and reusable; prefer a module in an existing package over a one-off package.
+- Never use a huge value like `u64::MAX` as a marker (it is the longest varint); use 0, a separate message or type, or a boolean.
 
 # Development
 

From 748e29f52bef468d830299ed23aa968308a1a3fa Mon Sep 17 00:00:00 2001
From: Luke Curley <kixelated@gmail.com>
Date: Thu, 5 Nov 2026 20:03:53 +0000
Subject: [PATCH 05/36] fix(video): share bounded H.265 SPS parsing (#7841)

Co-authored-by: GPT-6.1 Sol <noreply@openai.com>
---
 quest/m0/README.md                          |  1 -
 quest/m0/video-sps-walk.md                  | 39 ---------
 quest/m2/scuffle-sps-bump.md                |  4 -
 rs/moq-mux/MIGRATE.md                       |  7 ++
 rs/moq-mux/src/codec/h265/mod.rs            | 14 ++--
 rs/moq-mux/src/codec/h265/sps.rs            | 75 +++++++++++++-----
 rs/moq-mux/src/container/ts/video_timing.rs |  2 +-
 rs/moq-video/src/decode/vui.rs              | 88 ++++++---------------
 8 files changed, 95 insertions(+), 135 deletions(-)
 delete mode 100644 quest/m0/video-sps-walk.md

diff --git a/quest/m0/README.md b/quest/m0/README.md
index eec4d5c35f1..32d1c3dbb56 100644
--- a/quest/m0/README.md
+++ b/quest/m0/README.md
@@ -25,7 +25,6 @@ edge, which embeds moq-relay; it moved there on 2026-09-28.
 
 - [Nightly passes on main](/quest/m0/nightly/README.md) - the scheduled Nightly passes end to end, so red means a new break
 - [Interop and Video pass on main](/quest/m0/interop-green/README.md) - the scheduled Interop and Video workflows pass, so red means a new break
-- [moq-video shares moq-mux's bounded H.265 SPS walk](/quest/m0/video-sps-walk.md) - a hostile publisher's H.265 SPS can't panic a subscriber's decoder
 - [Publish the release line's drain() wrappers](/quest/m0/ffi-shutdown-backport.md) - Python `moq-rs` 0.5.2 and Dart `moq` 0.1.1 reach PyPI and pub.dev from `release`
 - [Backport audio groupDuration](/quest/m0/backport-audio-group-duration.md) - `@moq/publish` 0.5.4 on `release` can pack several Opus frames per group, making Cloudflare's relay drop audio less often
 - [Backport the SETUP-path and iroh-key fixes](/quest/m0/backport-security-fixes.md) - `release` refuses a conflicting SETUP Path and keeps persisted iroh keys private, in one patch release
diff --git a/quest/m0/video-sps-walk.md b/quest/m0/video-sps-walk.md
deleted file mode 100644
index ca22f514ef5..00000000000
--- a/quest/m0/video-sps-walk.md
+++ /dev/null
@@ -1,39 +0,0 @@
-# [S] moq-video shares moq-mux's bounded H.265 SPS walk
-
-## Goal
-
-A hostile publisher's H.265 SPS can't panic a subscriber's decoder.
-moq-video's VUI read (`rs/moq-video/src/decode/vui.rs:102`) stops
-calling `scuffle_h265::SpsNALUnit::parse` directly and go through moq-mux's
-bounded walk, `sps::parse_full` from
-[moq-dev/moq#7685](https://github.com/moq-dev/moq/pull/7685) (merged), which refuses an
-SPS that would reach scuffle-h265's overflowing lines. The regression inputs
-from #7685 pass through moq-video's decode path too.
-
-## Plan
-
-Decided 2026-11-03 (maintainer, follow-up planning after the 2026-11-03 /quest-afk and /quest-complete runs), milestone:
-
-- ✅ m0 (security: a remote input crashes a subscriber)
-- m1
-- m2
-
-From #7685's follow-ups: it bounds moq-mux's import path, but moq-video still
-parses the same SPS unchecked: scuffle-h265 itself overflows inside
-`SpsNALUnit::parse` before `:102` can map a failed parse to `Some(None)`.
-
-- Expose the walk from moq-mux (`codec/h265/sps.rs`) as a small public
-  function rather than copying it into moq-video, so both crates refuse the
-  same inputs.
-- Replace the decoder's call at `:102`, mapping a refusal the way a failed
-  parse already maps (`Some(None)`, which clears the label). The other parse,
-  at `:263`, is in the test `a_window_past_the_picture_is_refused` on a fixed
-  valid fixture, so it can stay.
-- Feed #7685's minimized inputs through moq-video's VUI read in a test that
-  panics without the fix.
-
-Public API: additive in moq-mux (the shared SPS walk). Wire: none.
-
-## Related
-
-- [Drop the H.265 SPS pre-walk](/quest/m2/scuffle-sps-bump.md) - removes this walk once scuffle ships fixed releases
diff --git a/quest/m2/scuffle-sps-bump.md b/quest/m2/scuffle-sps-bump.md
index e03a4628824..25f36b133bf 100644
--- a/quest/m2/scuffle-sps-bump.md
+++ b/quest/m2/scuffle-sps-bump.md
@@ -37,7 +37,3 @@ overflow on hostile SPS fields.
 
 Public API: removes the shared walk if moq-video no longer needs it.
 Wire: none.
-
-## Related
-
-- [moq-video shares moq-mux's bounded H.265 SPS walk](/quest/m0/video-sps-walk.md) - the second user of the walk
diff --git a/rs/moq-mux/MIGRATE.md b/rs/moq-mux/MIGRATE.md
index 383df17a179..466c3fcae12 100644
--- a/rs/moq-mux/MIGRATE.md
+++ b/rs/moq-mux/MIGRATE.md
@@ -4,6 +4,13 @@ How to adopt new APIs and update for breaking changes, newest first.
 
 ## Unreleased
 
+### Shared H.265 SPS parsing
+
+Use `codec::h265::Sps::parse` to read an SPS NAL unit through the same bounded
+walk as moq-mux before scuffle-h265 parses it. The `Sps` result exposes the
+checked picture size and any VUI `VideoSignal` without exposing scuffle-h265's
+types. moq-video clears the colour label when an SPS is refused. No wire change.
+
 ### The async API is opt-in
 
 Enable the `async` Cargo feature to keep awaiting moq-mux:
diff --git a/rs/moq-mux/src/codec/h265/mod.rs b/rs/moq-mux/src/codec/h265/mod.rs
index 7c3671b5b7f..89552bfdd42 100644
--- a/rs/moq-mux/src/codec/h265/mod.rs
+++ b/rs/moq-mux/src/codec/h265/mod.rs
@@ -15,13 +15,13 @@ mod sps;
 pub use export::*;
 pub use import::*;
 pub use split::*;
+pub use sps::{Sps, VideoSignal};
 
 use bytes::{Buf, Bytes, BytesMut};
 
 use crate::codec::annexb::{InBandCodec, ParameterSets};
 use scuffle_h265::NALUnitType;
-use sps::Sps;
-pub(crate) use sps::{id as sps_id, parse_full as parse_full_sps};
+pub(crate) use sps::{id as sps_id, parse_full as parse_full_rbsp};
 
 /// Wrap one hvc1 (length-prefixed NALU) access unit as a single
 /// [`Frame`](crate::container::Frame), with the keyframe flag set when it
@@ -237,7 +237,7 @@ pub(crate) fn apply_hvcc_sps(hvcc: &mp4_atom::Hvcc, config: &mut hang::catalog::
 
 /// Resolve either sample framing from the same SPS dimensions and VUI metadata.
 pub(crate) fn config_from_sps(sps_nal: &[u8], in_band: bool) -> Result<hang::catalog::VideoConfig> {
-	let sps = Sps::parse(sps_nal)?;
+	let sps = Sps::parse_or_head(sps_nal)?;
 	let color = sps.color();
 	let Sps { head, full } = sps;
 	let mut config = hang::catalog::VideoConfig::new(hang::catalog::H265 {
@@ -283,7 +283,7 @@ pub(crate) fn config_from_sps(sps_nal: &[u8], in_band: bool) -> Result<hang::cat
 /// The picture size an SPS NAL (header included) declares, inside its conformance window. `None`
 /// when it fails to parse.
 pub(crate) fn sps_size(nal: &[u8]) -> Option<(u32, u32)> {
-	let head = Sps::parse(nal).ok()?.head;
+	let head = Sps::parse_or_head(nal).ok()?.head;
 	Some((head.width, head.height))
 }
 
@@ -293,7 +293,7 @@ pub(crate) fn sps_size(nal: &[u8]) -> Option<(u32, u32)> {
 ///
 /// `None` when the SPS fails to parse.
 pub(crate) fn sps_reorder(nal: &[u8]) -> Option<crate::codec::video::Reorder> {
-	let sps = parse_full_sps(nal).ok()?;
+	let sps = parse_full_rbsp(nal).ok()?;
 	let highest = sps.sps_max_sub_layers_minus1 as usize;
 	let reorder = &sps.sub_layer_ordering_info.sps_max_num_reorder_pics;
 	let depth = *reorder.get(highest).or(reorder.last())?;
@@ -306,7 +306,7 @@ pub(crate) fn sps_reorder(nal: &[u8]) -> Option<crate::codec::video::Reorder> {
 /// The HRD an SPS NAL unit's VUI declares at its highest sub-layer, when it carries one: the
 /// NAL HRD's last schedule, or the VCL HRD's when that is all there is.
 pub(crate) fn sps_hrd(nal: &[u8]) -> Option<crate::codec::video::Hrd> {
-	let sps = parse_full_sps(nal).ok()?;
+	let sps = parse_full_rbsp(nal).ok()?;
 	let highest = sps.sps_max_sub_layers_minus1 as usize;
 	let hrd = sps
 		.vui_parameters
@@ -510,7 +510,7 @@ pub(crate) fn build_hvcc(vps_nals: &[Bytes], sps_nals: &[Bytes], pps_nals: &[Byt
 		}
 	}
 
-	let sps = Sps::parse(first_sps)?.head;
+	let sps = Sps::parse_or_head(first_sps)?.head;
 	let arrays = [
 		(NALUnitType::VpsNut, vps_nals),
 		(NALUnitType::SpsNut, sps_nals),
diff --git a/rs/moq-mux/src/codec/h265/sps.rs b/rs/moq-mux/src/codec/h265/sps.rs
index 2dc5aef54f5..552c4b2b22c 100644
--- a/rs/moq-mux/src/codec/h265/sps.rs
+++ b/rs/moq-mux/src/codec/h265/sps.rs
@@ -4,8 +4,9 @@
 //! into parse errors, and real encoders break some of them: cameras ship `matrix_coeffs` 0 on
 //! 4:2:0, which ITU-T H.265 E.3.1 forbids and libavcodec and GStreamer decode anyway. The codec
 //! string, coded size and hvcC header only need the SPS head, which ends at
-//! `bit_depth_chroma_minus8`. So when scuffle_h265 refuses a value (`InvalidData`), [`Sps::parse`]
-//! reads the head itself. A truncated SPS, or one whose head is invalid, is still an error.
+//! `bit_depth_chroma_minus8`. So when scuffle_h265 refuses a value (`InvalidData`),
+//! [`Sps::parse_or_head`] reads the head itself. A truncated SPS, or one whose head is invalid,
+//! is still an error.
 //!
 //! scuffle_h265 also overflows on hostile values, so [`parse_full`] walks the SPS with moq-mux's
 //! own reader before handing it over, and an SPS that walk refuses falls back to its head too.
@@ -35,15 +36,50 @@ pub(crate) struct SpsHead {
 	pub height: u32,
 }
 
-/// A parsed SPS: its head, plus scuffle_h265's full parse (with the VUI) when it accepted the SPS.
-pub(crate) struct Sps {
-	pub head: SpsHead,
-	pub full: Option<scuffle_h265::SpsRbsp>,
+/// An SPS with its cropped picture size and any parsed VUI signal.
+pub struct Sps {
+	pub(crate) head: SpsHead,
+	pub(crate) full: Option<scuffle_h265::SpsRbsp>,
+}
+
+/// The colour code points and range signalled by an H.265 VUI.
+pub struct VideoSignal {
+	/// The colour primaries code point.
+	pub primaries: u8,
+	/// The transfer characteristics code point.
+	pub transfer: u8,
+	/// The matrix coefficients code point.
+	pub matrix: u8,
+	/// Whether the samples use the full numeric range.
+	pub full_range: bool,
 }
 
 impl Sps {
+	/// Parse a complete SPS NAL unit after a bounded walk, including its header.
+	pub fn parse(nal: &[u8]) -> Result<Self> {
+		let full = parse_full(nal).map_err(|_| Error::SpsParse)?;
+		let head = SpsHead::from_rbsp(&full)?;
+		Ok(Self { head, full: Some(full) })
+	}
+
+	/// Return the picture size inside its conformance window.
+	pub fn size(&self) -> (u32, u32) {
+		(self.head.width, self.head.height)
+	}
+
+	/// Return the VUI's video signal when present.
+	pub fn video_signal(&self) -> Option<VideoSignal> {
+		let signal = &self.full.as_ref()?.vui_parameters.as_ref()?.video_signal_type;
+		Some(VideoSignal {
+			primaries: signal.colour_primaries,
+			transfer: signal.transfer_characteristics,
+			matrix: signal.matrix_coeffs,
+			full_range: signal.video_full_range_flag,
+		})
+	}
+
 	/// Parse an SPS NAL unit, keeping only its head when scuffle_h265 refuses a later value.
-	pub(crate) fn parse(nal: &[u8]) -> Result<Self> {
+	pub(crate) fn parse_or_head(nal: &[u8]) -> Result<Self> {
 		match parse_full(nal) {
 			Ok(rbsp) => Ok(Self {
 				head: SpsHead::from_rbsp(&rbsp)?,
@@ -254,9 +290,9 @@ fn skip_sub_layers(
 	Ok(())
 }
 
-/// Parse an SPS NAL unit with scuffle_h265, once [`check`] has walked it.
+/// Parse an SPS NAL unit, refusing values that would overflow scuffle_h265.
 ///
-/// Every scuffle_h265 SPS parse in moq-mux goes through here, so no hostile SPS reaches its overflows.
+/// The input includes the NAL header and emulation-prevention bytes.
 pub(crate) fn parse_full(nal: &[u8]) -> std::io::Result<scuffle_h265::SpsRbsp> {
 	check(nal)?;
 	Ok(SpsNALUnit::parse(&mut &nal[..])?.rbsp)
@@ -645,7 +681,7 @@ mod tests {
 	#[test]
 	fn head_matches_the_full_parse() {
 		for nal in [fixtures::SPS, fixtures::SPS_PYRAMID, SPS_SUB_LAYERS] {
-			let sps = Sps::parse(nal).unwrap();
+			let sps = Sps::parse_or_head(nal).unwrap();
 			assert!(sps.full.is_some(), "scuffle_h265 accepts this SPS");
 			assert_eq!(SpsHead::parse(nal), Some(sps.head));
 		}
@@ -676,13 +712,16 @@ mod tests {
 			max_sub_layers_minus1: 2,
 			..SpsHead::parse(fixtures::SPS).unwrap()
 		};
-		assert_eq!(Sps::parse(SPS_SUB_LAYER_PROFILE_AND_LEVEL).unwrap().head, expected);
+		assert_eq!(
+			Sps::parse_or_head(SPS_SUB_LAYER_PROFILE_AND_LEVEL).unwrap().head,
+			expected
+		);
 	}
 
 	/// Zeroed VUI colour fields on 4:2:0: scuffle_h265 refuses the SPS, the head carries on.
 	#[test]
 	fn zeroed_colour_description_falls_back_to_the_head() {
-		let sps = Sps::parse(fixtures::SPS_ZERO_COLOUR).unwrap();
+		let sps = Sps::parse_or_head(fixtures::SPS_ZERO_COLOUR).unwrap();
 		assert!(sps.full.is_none(), "scuffle_h265 refuses this SPS");
 		assert_eq!(
 			sps.head,
@@ -726,14 +765,14 @@ mod tests {
 	/// The fallback covers a refusal after the head, not a truncated or invalid head.
 	#[test]
 	fn truncated_or_invalid_head_is_still_an_error() {
-		assert!(Sps::parse(&fixtures::SPS[..8]).is_err());
-		assert!(Sps::parse(&fixtures::SPS_ZERO_COLOUR[..20]).is_err());
-		assert!(Sps::parse(&fixtures::SPS[..fixtures::SPS.len() - 6]).is_err());
+		assert!(Sps::parse_or_head(&fixtures::SPS[..8]).is_err());
+		assert!(Sps::parse_or_head(&fixtures::SPS_ZERO_COLOUR[..20]).is_err());
+		assert!(Sps::parse_or_head(&fixtures::SPS[..fixtures::SPS.len() - 6]).is_err());
 		// TemporalId 1, then a single sub-layer without temporal nesting.
 		for (index, byte) in [(1, 0x02), (2, 0x00)] {
 			let mut nal = fixtures::SPS_ZERO_COLOUR.to_vec();
 			nal[index] = byte;
-			assert!(Sps::parse(&nal).is_err());
+			assert!(Sps::parse_or_head(&nal).is_err());
 		}
 		assert_eq!(SpsHead::parse(fixtures::PPS), None);
 		assert_eq!(SpsHead::parse(fixtures::VPS), None);
@@ -933,11 +972,11 @@ mod tests {
 	}
 
 	/// An SPS `check` refuses: [`parse_full`] reports `InvalidData` without calling scuffle_h265,
-	/// and [`Sps::parse`] keeps the head.
+	/// and [`Sps::parse_or_head`] keeps the head.
 	fn assert_refused(nal: &[u8]) {
 		let err = parse_full(nal).unwrap_err();
 		assert_eq!(err.kind(), std::io::ErrorKind::InvalidData, "{err}");
-		assert!(Sps::parse(nal).unwrap().full.is_none());
+		assert!(Sps::parse_or_head(nal).unwrap().full.is_none());
 	}
 
 	/// Each SPS reaches an overflow in scuffle_h265 0.2.2 or scuffle-expgolomb 0.1.5.
diff --git a/rs/moq-mux/src/container/ts/video_timing.rs b/rs/moq-mux/src/container/ts/video_timing.rs
index 8eb7b1ed0f4..4145da2ee42 100644
--- a/rs/moq-mux/src/container/ts/video_timing.rs
+++ b/rs/moq-mux/src/container/ts/video_timing.rs
@@ -204,7 +204,7 @@ impl Clock {
 				let kind = (bytes[0] >> 1) & 63;
 				match kind {
 					33 => {
-						let sps = crate::codec::h265::parse_full_sps(&bytes).map_err(|err| err.to_string())?;
+						let sps = crate::codec::h265::parse_full_rbsp(&bytes).map_err(|err| err.to_string())?;
 						Arc::make_mut(&mut ctx)
 							.sets
 							.insert(sps.sps_seq_parameter_set_id, Arc::new(sps));
diff --git a/rs/moq-video/src/decode/vui.rs b/rs/moq-video/src/decode/vui.rs
index 169656cb7b4..07ee62e80c9 100644
--- a/rs/moq-video/src/decode/vui.rs
+++ b/rs/moq-video/src/decode/vui.rs
@@ -93,61 +93,28 @@ fn h264(nal: &[u8]) -> Option<Option<Color>> {
 }
 
 fn h265(nal: &[u8]) -> Option<Option<Color>> {
-	use scuffle_h265::{NALUnitType, SpsNALUnit};
+	use scuffle_h265::NALUnitType;
 
 	// The type is the six bits after the forbidden zero bit (H.265 7.3.1.2).
 	if NALUnitType::from((nal.first()? >> 1) & 0x3f) != NALUnitType::SpsNut {
 		return None;
 	}
-	let Ok(sps) = SpsNALUnit::parse(&mut &nal[..]) else {
-		return Some(None);
-	};
-	let sps = sps.rbsp;
-	let Some(size) = h265_size(&sps) else {
+	let Ok(sps) = moq_mux::codec::h265::Sps::parse(nal) else {
 		return Some(None);
 	};
+	let (width, height) = sps.size();
+	let size = Size::new(width, height);
 	// Absent, the range flag is 0 (limited) and the description unspecified
 	// (E.3.1); scuffle_h265 fills an absent description with 2 itself.
-	let Some(vui) = &sps.vui_parameters else {
+	let Some(signal) = sps.video_signal() else {
 		return Some(Color::from_code_points(None, Range::Limited, size));
 	};
-	let signal = &vui.video_signal_type;
 	let codes = CodePoints {
-		primaries: signal.colour_primaries,
-		transfer: signal.transfer_characteristics,
-		matrix: signal.matrix_coeffs,
-	};
-	Some(Color::from_code_points(
-		Some(codes),
-		range(signal.video_full_range_flag),
-		size,
-	))
-}
-
-/// The picture size inside the conformance window, or `None` for a window
-/// that crops past the picture.
-///
-/// `cropped_width` and `cropped_height` subtract unchecked, so they would
-/// overflow on such a window.
-fn h265_size(sps: &scuffle_h265::SpsRbsp) -> Option<Size> {
-	let window = &sps.conformance_window;
-	let crop = |size: u64, sub: u8, start: u64, end: u64| {
-		let offset = start.checked_add(end)?.checked_mul(sub.into())?;
-		u32::try_from(size.checked_sub(offset)?).ok()
+		primaries: signal.primaries,
+		transfer: signal.transfer,
+		matrix: signal.matrix,
 	};
-	let width = crop(
-		sps.pic_width_in_luma_samples.get(),
-		sps.sub_width_c(),
-		window.conf_win_left_offset,
-		window.conf_win_right_offset,
-	)?;
-	let height = crop(
-		sps.pic_height_in_luma_samples.get(),
-		sps.sub_height_c(),
-		window.conf_win_top_offset,
-		window.conf_win_bottom_offset,
-	)?;
-	Some(Size::new(width, height))
+	Some(Color::from_code_points(Some(codes), range(signal.full_range), size))
 }
 
 fn range(full: bool) -> Range {
@@ -218,6 +185,20 @@ mod tests {
 		assert_eq!(signalled(Codec::H265, &Bytes::from(unit)), Some(None));
 	}
 
+	/// Hostile SPS fields must clear the label without reaching scuffle_h265's overflows.
+	#[test]
+	fn overflowing_h265_sps_clear_the_label() {
+		for input in [
+			&include_bytes!("../../../moq-mux/fuzz/regressions/annexb/scuffle-h265-transform-depth")[..],
+			&include_bytes!("../../../moq-mux/fuzz/regressions/annexb/hevc-sps-exp-golomb-64-zeros")[..],
+			&include_bytes!("../../../moq-mux/fuzz/regressions/annexb/scuffle-expgolomb")[..],
+		] {
+			// The corpus's first byte selects the codec and write size, ahead of the Annex-B data.
+			let unit = Bytes::copy_from_slice(&input[1..]);
+			assert_eq!(signalled(Codec::H265, &unit), Some(None));
+		}
+	}
+
 	/// An H.265 VUI's colour description labels the pictures over the size guess
 	/// (moq-mux's `SPS_HDR10`, a 64x64 x265 encode signalling BT.2020 and PQ,
 	/// where the guess would be BT.601). Without one, the guess stands (moq-mux's
@@ -248,27 +229,4 @@ mod tests {
 		]);
 		assert_eq!(signalled(Codec::H265, &nvenc), Some(Some(Color::BT709)));
 	}
-
-	/// A conformance window past the picture is refused rather than wrapping
-	/// (moq-mux's `SPS_NVENC`, a 1280x720 hevc_nvenc SPS, with its window
-	/// widened).
-	#[test]
-	fn a_window_past_the_picture_is_refused() {
-		let nal: &[u8] = &[
-			0x42, 0x01, 0x01, 0x01, 0x60, 0x00, 0x00, 0x03, 0x00, 0x90, 0x00, 0x00, 0x03, 0x00, 0x00, 0x03, 0x00, 0x78,
-			0xa0, 0x02, 0x80, 0x80, 0x2e, 0x1f, 0x13, 0x96, 0x5d, 0x29, 0x08, 0x46, 0x45, 0xd5, 0x0c, 0x04, 0x04, 0x00,
-			0x00, 0x03, 0x00, 0x04, 0x00, 0x00, 0x03, 0x00, 0xf1, 0x80, 0x17, 0x79, 0x44, 0x00, 0x02, 0xdc, 0x6c, 0x00,
-			0x00, 0x2d, 0xc6, 0xc0, 0x40,
-		];
-		let sps = scuffle_h265::SpsNALUnit::parse(&mut &nal[..]).unwrap().rbsp;
-		assert_eq!(h265_size(&sps), Some(Size::new(1280, 720)));
-
-		let width = sps.pic_width_in_luma_samples.get() / u64::from(sps.sub_width_c());
-		for (right, bottom) in [(width + 1, 0), (0, u64::MAX)] {
-			let mut sps = sps.clone();
-			sps.conformance_window.conf_win_right_offset = right;
-			sps.conformance_window.conf_win_bottom_offset = bottom;
-			assert_eq!(h265_size(&sps), None);
-		}
-	}
 }

From 47dbef85307e3ca8f3db56391dd1660402039dce Mon Sep 17 00:00:00 2001
From: Luke Curley <kixelated@gmail.com>
Date: Thu, 5 Nov 2026 20:04:11 +0000
Subject: [PATCH 06/36] test: keep release registry metadata lookup offline
 (#7950)

Co-authored-by: GPT-6.1 Sol <noreply@openai.com>
---
 js/common/release.test.ts                     | 48 ++++++++++++++-----
 quest/m0/test-flakes-2/README.md              |  1 -
 .../m0/test-flakes-2/release-test-offline.md  | 18 -------
 3 files changed, 37 insertions(+), 30 deletions(-)
 delete mode 100644 quest/m0/test-flakes-2/release-test-offline.md

diff --git a/js/common/release.test.ts b/js/common/release.test.ts
index dc16e497e76..c8aba9e997d 100644
--- a/js/common/release.test.ts
+++ b/js/common/release.test.ts
@@ -11,7 +11,7 @@ type Manifest = {
 };
 type Reply = { status?: number; output?: string; error?: string };
 
-// Run the real release entrypoint with isolated command substitutes: no registry
+// Run the real release entrypoint with isolated command and fetch substitutes: no registry
 // credentials, builds, or publishing escape the fixture.
 function run(options: {
 	manifest: Manifest;
@@ -21,6 +21,7 @@ function run(options: {
 	dryRun?: boolean;
 	jsr?: boolean;
 	published?: boolean;
+	jsrPublished?: boolean;
 	jsrToken?: string;
 	sibling?: { name: string; version: string; private?: boolean; scripts?: { release: string } };
 }) {
@@ -55,6 +56,18 @@ function run(options: {
 			writeFileSync(join(packageDir, "package.json"), JSON.stringify(manifest));
 		}
 		writeFileSync(join(cwd, "fixture.json"), JSON.stringify(options));
+		const preload = join(cwd, "fetch.ts");
+		writeFileSync(
+			preload,
+			`import { appendFileSync, readFileSync } from "node:fs";
+const options = JSON.parse(readFileSync("${cwd}/fixture.json", "utf8"));
+globalThis.fetch = async (url) => {
+ appendFileSync("${cwd}/calls.jsonl", JSON.stringify(["fetch", String(url)]) + "\\n");
+ if (String(url) !== "https://jsr.io/@moq/fixture/meta.json") process.exit(1);
+ return Response.json({ versions: options.jsrPublished ? { "1.0.0": {} } : {} });
+};
+`,
+		);
 		for (const tool of ["bun", "npm", "deno"]) {
 			writeFileSync(
 				join(bin, tool),
@@ -85,17 +98,20 @@ if ("${tool}" === "bun") {
 				{ mode: 0o755 },
 			);
 		}
-		const result = Bun.spawnSync([process.execPath, release, ...(options.dryRun ? ["--dry-run"] : [])], {
-			cwd: packageDir,
-			env: {
-				PATH: bin,
-				HOME: cwd,
-				DRY_RUN: String(options.dryRun ?? false),
-				...(options.jsrToken ? { JSR_TOKEN: options.jsrToken } : {}),
+		const result = Bun.spawnSync(
+			[process.execPath, "--preload", preload, release, ...(options.dryRun ? ["--dry-run"] : [])],
+			{
+				cwd: packageDir,
+				env: {
+					PATH: bin,
+					HOME: cwd,
+					DRY_RUN: String(options.dryRun ?? false),
+					...(options.jsrToken ? { JSR_TOKEN: options.jsrToken } : {}),
+				},
+				stdout: "pipe",
+				stderr: "pipe",
 			},
-			stdout: "pipe",
-			stderr: "pipe",
-		});
+		);
 		const calls = readFileSync(join(cwd, "calls.jsonl"), "utf8")
 			.trim()
 			.split("\n")
@@ -204,6 +220,7 @@ test("JSR dry-run checks its import map once and runs when dependencies are publ
 test("the JSR token reaches only deno publish", () => {
 	const result = run({ jsr: true, jsrToken: "jsr-secret", manifest: {} });
 	expect(result.code).toBe(0);
+	expect(result.calls).toContainEqual(["fetch", "https://jsr.io/@moq/fixture/meta.json"]);
 	expect(result.calls.at(-1)).toEqual([
 		"deno",
 		"publish",
@@ -218,6 +235,15 @@ test("the JSR token reaches only deno publish", () => {
 	expect(result.leaks).toEqual([]);
 });
 
+test("an already-published version on both registries skips publishing", () => {
+	const result = run({ jsr: true, published: true, jsrPublished: true, manifest: {} });
+	expect(result.code).toBe(0);
+	expect(result.calls).toEqual([
+		["npm", "view", "@moq/fixture", "version"],
+		["fetch", "https://jsr.io/@moq/fixture/meta.json"],
+	]);
+});
+
 test("a local sibling cannot satisfy the registry check for a real publish", () => {
 	const result = run({
 		sibling: { name: "@moq/net", version: "999.0.0" },
diff --git a/quest/m0/test-flakes-2/README.md b/quest/m0/test-flakes-2/README.md
index 60278571419..17ff84fa08a 100644
--- a/quest/m0/test-flakes-2/README.md
+++ b/quest/m0/test-flakes-2/README.md
@@ -99,7 +99,6 @@ Public API: none. Wire: none.
 - [moq-gst's interleaved restart test passes under load](/quest/m0/test-flakes-2/gst-reconnect-interleave.md) - `restarts_under_reconnects_interleave_on_one_pad` passes in loaded runs and the merge queue, its missed delivery and its stray `Eos` each fixed at the cause
 - [reload.test.ts's close-drain tests pass under load](/quest/m0/test-flakes-2/reload-close-drain.md) - the drain cases in `js/net`'s reload tests pass in loaded multi-file runs
 - [dispatch-query's terminate test survives load](/quest/m0/test-flakes-2/dispatch-query-terminate.md) - `test_terminating_the_run_stops_the_running_phase` passes reliably under host load, re-enabled once fixed
-- [release.test.ts never reaches the network](/quest/m0/test-flakes-2/release-test-offline.md) - the JSR release test fakes its registry lookup and passes offline
 - [Diagnose and re-enable the FFI datagram connection test](/quest/m0/test-flakes-2/ffi-datagram-roundtrip.md) - diagnose the default-connection timeout and re-enable the quarantined test
 - [Test PulseAudio servers stay off the desktop's D-Bus](/quest/m0/test-flakes-2/pulse-dbus.md) - concurrent media runs on one desktop never collide on `org.PulseAudio1`
 - [The open-GOP browser fixture fails loudly](/quest/m0/test-flakes-2/open-gop-fixture.md) - its broadcast stub matches current stats dependencies and an effect exception fails the test
diff --git a/quest/m0/test-flakes-2/release-test-offline.md b/quest/m0/test-flakes-2/release-test-offline.md
deleted file mode 100644
index c2a08f3e5dd..00000000000
--- a/quest/m0/test-flakes-2/release-test-offline.md
+++ /dev/null
@@ -1,18 +0,0 @@
-# [XS] release.test.ts never reaches the network
-
-## Goal
-
-`js/common/release.test.ts` runs without network access and never times out
-on a live registry lookup, so it can't drop an unrelated PR from the merge
-queue.
-
-## Plan
-
-Decided 2026-11-05 (maintainer, follow-up from the queue drop of
-[moq-dev/moq#7867](https://github.com/moq-dev/moq/pull/7867)): ✅ m0.
-
-`the JSR token reaches only deno publish` timed out at 5 s in a
-`merge_group` build: its fixture runs `release.ts` with `jsr=true` and
-`dryRun=false`, which makes a live jsr.io metadata lookup. The land fixer
-reproduced the timeout under `unshare -rn`. Inject that lookup, the way the
-test already fakes the publish commands, so the whole suite passes offline.

From 8591ec35b7cf8f3412c777912f03ca824a206d81 Mon Sep 17 00:00:00 2001
From: Luke Curley <kixelated@gmail.com>
Date: Thu, 5 Nov 2026 20:04:34 +0000
Subject: [PATCH 07/36] feat(c)!: expose pre-encoded simulcast rate control
 (#7947)

Co-authored-by: GPT-6.1 <noreply@openai.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 doc/lib/c/index.md              |   2 +-
 quest/m1/c/README.md            |   4 -
 quest/m1/c/api-gaps.md          |  30 ------
 rs/moq-c/MIGRATE.md             |  10 ++
 rs/moq-c/README.md              |  21 ++++
 rs/moq-c/c-tests/rate-control.c |  16 +++
 rs/moq-c/src/api.rs             |  19 ++++
 rs/moq-c/src/bandwidth.rs       | 185 ++++++++++++++++++++++++++++++++
 rs/moq-c/src/publish.rs         |  62 +++++++++--
 rs/moq-c/src/test.rs            | 101 +++++++++++++++++
 10 files changed, 406 insertions(+), 44 deletions(-)
 delete mode 100644 quest/m1/c/api-gaps.md
 create mode 100644 rs/moq-c/c-tests/rate-control.c

diff --git a/doc/lib/c/index.md b/doc/lib/c/index.md
index d86d4e7af12..ee0d58cddfc 100644
--- a/doc/lib/c/index.md
+++ b/doc/lib/c/index.md
@@ -90,7 +90,7 @@ across restarts, and raise `epoch` on each: readers stitch every route of one in
 together, so restarting the sequences under an old instance splices unrelated groups into
 their tracks.
 
-Raw video encoders take an exact numerator/denominator frame rate, such as 30000/1001. Publication track names stay separate from codec settings. For simulcast, give each rendition the next one down as the `lower` handle in its `moq_video_encode_options`: it stops encoding, advertised as disabled, while its bandwidth grant cannot fund it, and resumes once the grant recovers. A rung only disables while the session probes for bandwidth, which on native transports takes moq-quic with BBR3.
+Raw video encoders take an exact numerator/denominator frame rate, such as 30000/1001. Publication track names stay separate from codec settings. For simulcast, give each rendition the next one down as the `lower` handle in its `moq_video_encode_options`: it stops encoding, advertised as disabled, while its bandwidth grant cannot fund it, and resumes once the grant recovers. A rung only disables while the session probes for bandwidth, which on native transports takes moq-quic with BBR3. For pre-encoded video, publish from the lowest rendition up and set `moq_video_init.lower` to the next lower media handle. Reserve each track with `moq_allocator_reserve_media`, then bind its reservation with `moq_rate_control_create` and call `moq_rate_control_update` on every frame. Apply changed targets to your encoder and `moq_publish_media_set_enabled`, resuming video on a keyframe; close the control and reservation separately when done.
 
 ## Things to know
 
diff --git a/quest/m1/c/README.md b/quest/m1/c/README.md
index 7e1845fc16c..1b6313edb19 100644
--- a/quest/m1/c/README.md
+++ b/quest/m1/c/README.md
@@ -26,7 +26,3 @@ twice (0.6 to 0.7, then to the generated 0.8); that is the accepted cost.
   release produces the C archive the samples are checked against.
 
 Public API: moq-c gains each m1 binding feature. Wire: none.
-
-## Required
-
-- [API gaps](/quest/m1/c/api-gaps.md) - disabling pre-encoded simulcast rungs after the shared importer support lands
diff --git a/quest/m1/c/api-gaps.md b/quest/m1/c/api-gaps.md
deleted file mode 100644
index 9f8e318afd8..00000000000
--- a/quest/m1/c/api-gaps.md
+++ /dev/null
@@ -1,30 +0,0 @@
-# [S] moq-c disables pre-encoded simulcast rungs
-
-## Goal
-
-moq-c can disable a simulcast rung on pre-encoded media, with its lower
-rendition's priority and a rate control driven by the reservation.
-
-## Plan
-
-- Add C ABI support for disabling simulcast rungs on pre-encoded media on
-  [moq-dev/moq#7029](https://github.com/moq-dev/moq/pull/7029)'s shared
-  importer support. It merged as
-  [61cb70456d](https://github.com/moq-dev/moq/commit/61cb70456dd0d70909bc2a1c18916331e90b51ea),
-  so this work is unblocked: main has `moq_mux::import::Track::set_enabled`,
-  `import::VideoInit.priority`, the AV1/VP8/VP9 importer setters, and the
-  moq-ffi `MoqRateControl`, `MoqVideoInit.lower`, and media producer
-  `set_enabled` interfaces.
-- Expose media `set_enabled`, lower-rendition ordering, and
-  a rate control over the C reservation. Inspect the final shared interfaces
-  first. Decided 2026-10-30 (maintainer, /quest-plan of the 2026-10-30
-  /quest-complete follow-ups): the C epic's rule (every m1 binding feature
-  missing from `moq.h` lands before the cut) overrides that PR's decision 4,
-  which parked it until a C consumer asked: ✅ add to m1 C gaps / exempt it.
-
-Update the generated `moq.h`, `rs/moq-c/README.md` and `doc/lib/c` as needed.
-The independent JSON window caller timestamp gap is implemented in
-[moq-dev/moq#7614](https://github.com/moq-dev/moq/pull/7614).
-
-Public API: moq-c gains pre-encoded rung disable, lower-rendition ordering,
-and reservation rate control. Wire: none.
diff --git a/rs/moq-c/MIGRATE.md b/rs/moq-c/MIGRATE.md
index 104b94f772b..c9acce77e19 100644
--- a/rs/moq-c/MIGRATE.md
+++ b/rs/moq-c/MIGRATE.md
@@ -4,6 +4,16 @@ How to update your code for each breaking change, newest first.
 
 ## Unreleased
 
+### Pre-encoded simulcast
+
+`moq_video_init` gains `lower`, changing its C ABI layout. Rebuild against the
+regenerated `moq.h` and matching library, zero-initialize the struct, and set
+`lower` to the next lower pre-encoded video media handle (0 for none).
+Use `moq_publish_media_set_enabled` to advertise disabled video renditions,
+and `moq_allocator_reserve_media` with the new `moq_rate_control_*` handles to
+adapt an external encoder to its reservation. Close controls and reservations
+separately. No wire format changes.
+
 ### Announcements are a listing ([#7678](https://github.com/moq-dev/moq/pull/7678))
 
 `moq_announce_kind` is `MOQ_ANNOUNCE_KIND_PRESENT` (0) or `MOQ_ANNOUNCE_KIND_ABSENT` (1), and `moq_announce_event` loses `predecessor` and `predecessor_len`, changing the C ABI.
diff --git a/rs/moq-c/README.md b/rs/moq-c/README.md
index 602d93adfd9..898d7ea1002 100644
--- a/rs/moq-c/README.md
+++ b/rs/moq-c/README.md
@@ -172,3 +172,24 @@ converted to the track's milliseconds; pass NULL to stamp the broadcast clock.
 int32_t moq_publish_json_window_push(uint32_t window, const char *value, uintptr_t value_len, const moq_timestamp *timestamp);
 int32_t moq_publish_json_window_pop(uint32_t window, uint64_t count, const moq_timestamp *timestamp);
 ```
+
+### Pre-encoded simulcast
+
+Publish video renditions from lowest to highest, passing the next lower media
+handle in `moq_video_init.lower` (0 for the lowest). This orders delivery so
+higher renditions yield to lower ones. `moq_publish_media_set_enabled` updates
+the catalog and marks a discontinuity when disabling; resume on a keyframe.
+Audio importers do not support this toggle.
+
+Reserve each media track with `moq_allocator_reserve_media`. Create a
+`moq_rate_control_create` handle bound to the reservation, with `moq_rate_policy.max_bps` and, for higher
+rungs, `has_lower` and `lower_bps`. Read its initial `moq_rate_control_target`,
+then call `moq_rate_control_update` on every frame,
+including while disabled. It returns 0 or a negative error; `target.changed`
+is true for a new target and false to hold the last one. Apply the target's `bitrate_bps`
+to your encoder and `enabled` through `moq_publish_media_set_enabled`.
+The shared controller drops immediately, ramps raises, ignores small changes,
+and holds without an estimate. A rung disables only with a probing session,
+which on native transports requires moq-quic with BBR3, so bandwidth can recover.
+Close controls with `moq_rate_control_close` and reservations with
+`moq_reservation_close`; neither owns or closes the media track.
diff --git a/rs/moq-c/c-tests/rate-control.c b/rs/moq-c/c-tests/rate-control.c
new file mode 100644
index 00000000000..89bb5ad3e65
--- /dev/null
+++ b/rs/moq-c/c-tests/rate-control.c
@@ -0,0 +1,16 @@
+// Exercise rate-control records and handle ownership across the generated C ABI.
+#include <moq.h>
+#include <assert.h>
+
+int main(void) {
+    moq_video_init video = {0};
+    assert(video.lower == 0);
+    moq_rate_policy policy = {.max_bps = 4000000, .lower_bps = 2000000, .has_lower = true};
+    // A control refuses an invalid reservation at setup.
+    assert(moq_rate_control_create(0, policy) < 0);
+    moq_rate_target target = {0};
+    assert(moq_rate_control_target(0, &target) < 0);
+    assert(moq_rate_control_update(0, &target) < 0);
+    assert(moq_rate_control_close(0) < 0);
+    return 0;
+}
diff --git a/rs/moq-c/src/api.rs b/rs/moq-c/src/api.rs
index f00cb6bf943..788405c5024 100644
--- a/rs/moq-c/src/api.rs
+++ b/rs/moq-c/src/api.rs
@@ -269,6 +269,9 @@ pub struct moq_video_init {
 
 	/// Catalog fields the bitstream cannot reveal itself. Zeroed means none.
 	pub hint: moq_video_hint,
+	/// Next lower pre-encoded video media handle, or 0 for the lowest rendition.
+	/// Publish it first; this track gets one priority below it, saturating at -128.
+	pub lower: u32,
 }
 
 /// Optional catalog fields for [moq_video_init::hint].
@@ -2622,6 +2625,12 @@ unsafe fn parse_video_init(
 	let mut video = moq_mux::import::VideoInit::new(video_format_from_u32(config.format)?, init.to_vec());
 	video.label = label.map(str::to_string);
 	video.hint = config.hint.resolve()?;
+	if config.lower != 0 {
+		video.priority = State::lock()
+			.publish
+			.media_video_priority(ffi::parse_id(config.lower)?)?
+			.saturating_sub(1);
+	}
 	Ok((video, config.hint.group_duration()?))
 }
 
@@ -2849,6 +2858,16 @@ pub unsafe extern "C" fn moq_publish_media_frame(
 	})
 }
 
+/// Enable or disable a pre-encoded media rendition in its catalog.
+///
+/// Disabling publishes a discontinuity and stops frames; resume video on a keyframe.
+/// Audio importers reject this operation.
+/// Returns zero on success or a negative error.
+#[unsafe(no_mangle)]
+pub extern "C" fn moq_publish_media_set_enabled(media: u32, enabled: bool) -> i32 {
+	ffi::enter(move || State::lock().publish.media_set_enabled(ffi::parse_id(media)?, enabled))
+}
+
 /// Mark a timeline break without lowering the advertised jitter or delay.
 ///
 /// Publishes a discontinuity marker; resumed frames must continue the broadcast media clock,
diff --git a/rs/moq-c/src/bandwidth.rs b/rs/moq-c/src/bandwidth.rs
index 19a1d2170ca..98fa9bc3ad4 100644
--- a/rs/moq-c/src/bandwidth.rs
+++ b/rs/moq-c/src/bandwidth.rs
@@ -13,9 +13,26 @@ pub(crate) struct Bandwidth {
 	reservations: NonZeroSlab<Arc<moq_net::bandwidth::Reservation>>,
 	consumers: NonZeroSlab<Arc<Consumer>>,
 	viewers: NonZeroSlab<moq_net::bandwidth::Viewers>,
+	controls: NonZeroSlab<RateControl>,
 	viewer: NonZeroSlab<moq_net::bandwidth::Viewer>,
 }
 
+struct RateControl {
+	inner: moq_mux::rate::Control,
+	grant: moq_net::bandwidth::Consumer,
+}
+
+impl RateControl {
+	fn update(&mut self) -> Option<moq_mux::rate::Target> {
+		self.apply(self.grant.peek(), self.grant.probed())
+	}
+
+	fn apply(&mut self, grant: Option<moq_net::bandwidth::Rate>, probed: bool) -> Option<moq_mux::rate::Target> {
+		self.inner.set_probed(probed);
+		self.inner.update(grant, kio::clock::now())
+	}
+}
+
 impl Bandwidth {
 	pub fn insert(&mut self, allocator: moq_net::bandwidth::Allocator) -> Result<Id, Error> {
 		self.allocators.insert(allocator)
@@ -403,8 +420,176 @@ pub extern "C" fn moq_bandwidth_consumer_close(consumer: u32) -> i32 {
 	})
 }
 
+/// Reserve up to `max_bps` for a pre-encoded media track, returning a reservation handle.
+/// Close it with `moq_reservation_close`; it does not own the media handle.
+#[unsafe(no_mangle)]
+pub extern "C" fn moq_allocator_reserve_media(allocator: u32, media: u32, max_bps: u64) -> i32 {
+	ffi::enter(move || {
+		let mut state = State::lock();
+		let demand = state.publish.media_demand(ffi::parse_id(media)?)?;
+		state.bandwidth.reserve(ffi::parse_id(allocator)?, &demand, max_bps)
+	})
+}
+
+/// How a rate control maps a reservation grant onto a sender's bitrate.
+#[repr(C)]
+pub struct moq_rate_policy {
+	/// Maximum bitrate the sender produces, in bits per second.
+	pub max_bps: u64,
+	/// Next lower rendition's maximum bitrate, when `has_lower` is true.
+	pub lower_bps: u64,
+	/// Whether this sender has a lower rendition; the lowest never disables.
+	pub has_lower: bool,
+}
+
+/// What the sender should produce until its rate control changes again.
+#[repr(C)]
+pub struct moq_rate_target {
+	/// Whether to produce frames and advertise the rendition as enabled.
+	pub enabled: bool,
+	/// Bitrate to produce in bits per second, or 0 when disabled.
+	pub bitrate_bps: u64,
+	/// Whether `moq_rate_control_update` changed the target; always false from `moq_rate_control_target`.
+	pub changed: bool,
+}
+
+impl From<moq_mux::rate::Target> for moq_rate_target {
+	fn from(target: moq_mux::rate::Target) -> Self {
+		match target {
+			moq_mux::rate::Target::Enabled(rate) => Self {
+				enabled: true,
+				bitrate_bps: rate.as_bps(),
+				changed: false,
+			},
+			moq_mux::rate::Target::Disabled => Self {
+				enabled: false,
+				bitrate_bps: 0,
+				changed: false,
+			},
+		}
+	}
+}
+
+/// Create a rate control following this reservation, starting at the policy's maximum bitrate.
+///
+/// A zero `max_bps` is rejected with `MOQ_ERROR_INVALID_CONFIG`.
+#[unsafe(no_mangle)]
+pub extern "C" fn moq_rate_control_create(reservation: u32, policy: moq_rate_policy) -> i32 {
+	ffi::enter(move || {
+		if policy.max_bps == 0 {
+			return Err(Error::InvalidConfig("max_bps must be nonzero".into()));
+		}
+		let mut native = moq_mux::rate::Policy::new(moq_net::bandwidth::Rate::from_bps(policy.max_bps));
+		native.lower = policy
+			.has_lower
+			.then(|| moq_net::bandwidth::Rate::from_bps(policy.lower_bps));
+		let mut state = State::lock();
+		let grant = state.bandwidth.reservation(ffi::parse_id(reservation)?)?.consume();
+		state.bandwidth.controls.insert(RateControl {
+			inner: moq_mux::rate::Control::new(native),
+			grant,
+		})
+	})
+}
+
+/// Read the current sender target, returning zero or a negative error.
+///
+/// # Safety
+/// - `target` must point to writable storage for one target.
+#[unsafe(no_mangle)]
+pub unsafe extern "C" fn moq_rate_control_target(control: u32, target: *mut moq_rate_target) -> i32 {
+	ffi::enter(move || {
+		let target = unsafe { target.as_mut() }.ok_or(Error::InvalidPointer)?;
+		*target = State::lock()
+			.bandwidth
+			.controls
+			.get(ffi::parse_id(control)?)
+			.ok_or(Error::NotFound)?
+			.inner
+			.target()
+			.into();
+		Ok(())
+	})
+}
+
+/// Follow the bound reservation's grant on every frame, returning zero or a negative error.
+///
+/// `target.changed` is true when the target changed and false to hold the last target.
+///
+/// Drops apply immediately; raises ramp and small moves are ignored. No estimate holds the
+/// target. Disabling requires a probing session so the grant can recover. Apply a changed
+/// target to your encoder and `moq_publish_media_set_enabled`. Closing the reservation holds
+/// the last target; the control owns neither the reservation nor media.
+///
+/// # Safety
+/// - `target` must point to writable storage; its other fields are written only when `changed` is true.
+#[unsafe(no_mangle)]
+pub unsafe extern "C" fn moq_rate_control_update(control: u32, target: *mut moq_rate_target) -> i32 {
+	ffi::enter(move || {
+		let target = unsafe { target.as_mut() }.ok_or(Error::InvalidPointer)?;
+		let mut state = State::lock();
+		let control = state
+			.bandwidth
+			.controls
+			.get_mut(ffi::parse_id(control)?)
+			.ok_or(Error::NotFound)?;
+		match control.update() {
+			Some(next) => {
+				*target = next.into();
+				target.changed = true;
+			}
+			None => target.changed = false,
+		}
+		Ok(())
+	})
+}
+
+/// Release a rate control without closing its reservation or media.
+#[unsafe(no_mangle)]
+pub extern "C" fn moq_rate_control_close(control: u32) -> i32 {
+	ffi::enter(move || {
+		State::lock()
+			.bandwidth
+			.controls
+			.remove(ffi::parse_id(control)?)
+			.ok_or(Error::NotFound)?;
+		Ok(())
+	})
+}
+
 #[cfg(test)]
 mod consumer_tests {
+	#[tokio::test(start_paused = true)]
+	async fn rate_control_probing_disables_and_recovers() {
+		use moq_mux::rate::{Control, Policy, Target};
+		use moq_net::bandwidth::Rate;
+		let estimate = moq_net::bandwidth::Producer::new();
+		let mut policy = Policy::new(Rate::from_bps(6_000_000));
+		policy.lower = Some(Rate::from_bps(2_000_000));
+		let mut control = RateControl {
+			inner: Control::new(policy),
+			grant: estimate.consume(),
+		};
+		assert_eq!(
+			control.apply(Some(Rate::from_bps(3_000_000)), true),
+			Some(Target::Disabled)
+		);
+		assert_eq!(control.apply(None, true), None);
+		tokio::time::advance(std::time::Duration::from_secs(4)).await;
+		assert!(matches!(
+			control.apply(Some(Rate::from_bps(6_000_000)), true),
+			Some(Target::Enabled(_))
+		));
+		assert_eq!(
+			control.apply(Some(Rate::from_bps(3_000_000)), true),
+			Some(Target::Disabled)
+		);
+		assert!(matches!(
+			control.apply(Some(Rate::from_bps(3_000_000)), false),
+			Some(Target::Enabled(_))
+		));
+	}
+
 	use super::*;
 	use crate::ffi::ReturnCode;
 
diff --git a/rs/moq-c/src/publish.rs b/rs/moq-c/src/publish.rs
index 9eb045961a6..9fc5eddc906 100644
--- a/rs/moq-c/src/publish.rs
+++ b/rs/moq-c/src/publish.rs
@@ -196,9 +196,27 @@ impl<T: Send + 'static> Kept<T> {
 	}
 }
 
-impl Abort for Kept<Box<import::Track>> {
+struct Media {
+	track: Box<import::Track>,
+	video_priority: Option<i8>,
+}
+
+impl std::ops::Deref for Media {
+	type Target = import::Track;
+	fn deref(&self) -> &Self::Target {
+		&self.track
+	}
+}
+
+impl std::ops::DerefMut for Media {
+	fn deref_mut(&mut self) -> &mut Self::Target {
+		&mut self.track
+	}
+}
+
+impl Abort for Kept<Media> {
 	fn abort(self, err: moq_net::Error) {
-		self.inner.abort(err);
+		self.inner.track.abort(err);
 	}
 }
 
@@ -285,7 +303,7 @@ pub struct Publish {
 
 	/// Single-codec media importers, fed timestamped frames.
 	// Boxed because the codec splitters/imports are much larger than the container ones.
-	media: NonZeroSlab<Kept<Box<import::Track>>>,
+	media: NonZeroSlab<Kept<Media>>,
 
 	/// Container importers, fed whole chunks. A separate space from `media` because a
 	/// container publishes several tracks and carries its own timing, so it takes no
@@ -525,9 +543,17 @@ impl Publish {
 	}
 
 	/// Insert a media importer as a child of the broadcast `children` belongs to.
-	fn insert_media(&mut self, track: import::Track, children: Children) -> Result<Id, Error> {
+	fn insert_media(
+		&mut self,
+		track: import::Track,
+		children: Children,
+		video_priority: Option<i8>,
+	) -> Result<Id, Error> {
 		let media = Kept {
-			inner: Box::new(track),
+			inner: Media {
+				track: Box::new(track),
+				video_priority,
+			},
 			children: children.clone(),
 		};
 		children.insert(&mut self.media, media, Child::Media)
@@ -555,7 +581,7 @@ impl Publish {
 
 		let track = import::Track::audio(request, catalog.reserve().with_interval(interval), init)?;
 		let children = children.clone();
-		self.insert_media(track, children)
+		self.insert_media(track, children, None)
 	}
 
 	/// `interval` as in [`Self::audio`].
@@ -575,9 +601,10 @@ impl Publish {
 		let name = broadcast.unique_name(&format!(".{}", init.format));
 		let request = broadcast.reserve_track(name)?;
 
+		let priority = init.priority;
 		let track = import::Track::video(request, catalog.reserve().with_interval(interval), init)?;
 		let children = children.clone();
-		self.insert_media(track, children)
+		self.insert_media(track, children, Some(priority))
 	}
 
 	pub fn container(&mut self, broadcast: Id, init: import::ContainerInit) -> Result<Id, Error> {
@@ -598,6 +625,22 @@ impl Publish {
 		children.insert(&mut self.containers, container, Child::Container)
 	}
 
+	pub fn media_video_priority(&self, media: Id) -> Result<i8, Error> {
+		self.media
+			.get(media)
+			.ok_or(Error::MediaNotFound)?
+			.video_priority
+			.ok_or_else(|| Error::InvalidConfig("the lower rendition is not video".into()))
+	}
+
+	pub fn media_set_enabled(&mut self, media: Id, enabled: bool) -> Result<(), Error> {
+		self.media
+			.get_mut(media)
+			.ok_or(Error::MediaNotFound)?
+			.set_enabled(enabled)?;
+		Ok(())
+	}
+
 	pub fn media_frame(&mut self, media: Id, data: &[u8], timestamp: hang::container::Timestamp) -> Result<(), Error> {
 		let track = self.media.get_mut(media).ok_or(Error::MediaNotFound)?;
 		track.decode(data, Some(timestamp))?;
@@ -1057,7 +1100,7 @@ impl Publish {
 		} = self.track_request.remove(request).ok_or(Error::NotFound)?;
 		let catalog = self.catalog(broadcast)?;
 		let track = import::Track::audio(request, catalog.reserve().with_interval(interval), init)?;
-		self.insert_media(track, children)
+		self.insert_media(track, children, None)
 	}
 
 	/// Accept a track request as a video track, returning a media handle like [`Self::video`].
@@ -1073,8 +1116,9 @@ impl Publish {
 			request,
 		} = self.track_request.remove(request).ok_or(Error::NotFound)?;
 		let catalog = self.catalog(broadcast)?;
+		let priority = init.priority;
 		let track = import::Track::video(request, catalog.reserve().with_interval(interval), init)?;
-		self.insert_media(track, children)
+		self.insert_media(track, children, Some(priority))
 	}
 
 	/// Reject a track request, failing every subscriber waiting on it with `error_code`.
diff --git a/rs/moq-c/src/test.rs b/rs/moq-c/src/test.rs
index c49fd18d9a8..427c06f00fd 100644
--- a/rs/moq-c/src/test.rs
+++ b/rs/moq-c/src/test.rs
@@ -413,6 +413,7 @@ fn publish_audio(broadcast: u32, format: moq_audio_format, init: &[u8], label: O
 fn publish_video(broadcast: u32, format: moq_video_format, init: &[u8], label: Option<&[u8]>) -> i32 {
 	let (label, label_len) = label_ptr(label);
 	let config = moq_video_init {
+		lower: 0,
 		format: format as u32,
 		init: init_ptr(init),
 		init_len: init.len(),
@@ -8229,6 +8230,7 @@ fn track_request_media_carries_hints() {
 	let request = id(request_cb.recv());
 	let h264 = h264_init();
 	let video_config = moq_video_init {
+		lower: 0,
 		format: moq_video_format::MOQ_VIDEO_FORMAT_AVC3 as u32,
 		init: h264.as_ptr(),
 		init_len: h264.len(),
@@ -8283,6 +8285,7 @@ fn invalid_hints_are_refused() {
 	};
 	let video = |hint: moq_video_hint| {
 		let config = moq_video_init {
+			lower: 0,
 			format: moq_video_format::MOQ_VIDEO_FORMAT_AVC3 as u32,
 			init: h264.as_ptr(),
 			init_len: h264.len(),
@@ -8392,3 +8395,101 @@ fn group_duration_hint_declares_the_join_interval() {
 	assert_eq!(moq_publish_close(broadcast), 0);
 	assert_eq!(moq_origin_close(origin), 0);
 }
+
+#[test]
+fn preencoded_rungs_and_rate_control() {
+	let origin = id(moq_origin_create());
+	let broadcast = publish_broadcast(origin, b"preencoded-rungs");
+	let init = h264_init();
+	let config = |lower| moq_video_init {
+		format: moq_video_format::MOQ_VIDEO_FORMAT_AVC3 as u32,
+		init: init.as_ptr(),
+		init_len: init.len(),
+		label: std::ptr::null(),
+		label_len: 0,
+		hint: moq_video_hint::default(),
+		lower,
+	};
+	let low = id(unsafe { moq_publish_video(broadcast, &config(0)) });
+	let high = id(unsafe { moq_publish_video(broadcast, &config(low)) });
+	{
+		let state = State::lock();
+		assert_eq!(
+			state
+				.publish
+				.media_video_priority(crate::ffi::parse_id(high).unwrap())
+				.unwrap(),
+			state
+				.publish
+				.media_video_priority(crate::ffi::parse_id(low).unwrap())
+				.unwrap() - 1
+		);
+	}
+	assert_eq!(moq_publish_media_set_enabled(high, false), 0);
+	assert_eq!(
+		published_catalog(broadcast)
+			.video
+			.renditions
+			.values()
+			.filter(|r| !r.enabled)
+			.count(),
+		1
+	);
+	assert_eq!(moq_publish_media_set_enabled(high, true), 0);
+	assert!(
+		published_catalog(broadcast)
+			.video
+			.renditions
+			.values()
+			.all(|r| r.enabled)
+	);
+	let (allocator, estimate) = test_allocator();
+	let reservation = id(moq_allocator_reserve_media(allocator, high, 4_000_000));
+	let control = id(moq_rate_control_create(
+		reservation,
+		moq_rate_policy {
+			max_bps: 4_000_000,
+			lower_bps: 2_000_000,
+			has_lower: true,
+		},
+	));
+	let mut target = moq_rate_target {
+		enabled: false,
+		bitrate_bps: 0,
+		changed: true,
+	};
+	assert!(
+		moq_rate_control_create(
+			reservation,
+			moq_rate_policy {
+				max_bps: 0,
+				lower_bps: 0,
+				has_lower: false,
+			},
+		) < 0
+	);
+	assert_eq!(unsafe { moq_rate_control_target(control, &mut target) }, 0);
+	assert!(target.enabled);
+	assert_eq!(target.bitrate_bps, 4_000_000);
+	assert!(!target.changed);
+	assert_eq!(unsafe { moq_rate_control_update(control, &mut target) }, 0);
+	assert!(!target.changed);
+	estimate
+		.set(Some(moq_net::bandwidth::Rate::from_bps(1_000_000)))
+		.unwrap();
+	assert_eq!(unsafe { moq_rate_control_update(control, &mut target) }, 0);
+	assert!(target.changed);
+	// Without a probing session a rung must stay on so its grant can recover.
+	assert!(target.enabled);
+	assert_eq!(target.bitrate_bps, 1_000_000);
+	assert_eq!(unsafe { moq_rate_control_update(control, &mut target) }, 0);
+	assert!(!target.changed);
+	assert_eq!(moq_reservation_close(reservation), 0);
+	assert_eq!(moq_rate_control_close(control), 0);
+	assert_eq!(moq_allocator_close(allocator), 0);
+	assert_eq!(moq_publish_media_finish(high), 0);
+	assert!(unsafe { moq_publish_video(broadcast, &config(high)) } < 0);
+	assert_eq!(moq_publish_media_finish(low), 0);
+	assert_eq!(moq_publish_close(broadcast), 0);
+	assert_eq!(moq_origin_close(origin), 0);
+}

From 1d407691a43f35e8cf06364c2c1eaaacb77bf115 Mon Sep 17 00:00:00 2001
From: Luke Curley <kixelated@gmail.com>
Date: Thu, 5 Nov 2026 20:04:45 +0000
Subject: [PATCH 08/36] fix(net): the ingest fuzz target finds no stall (#7808)

Co-authored-by: GPT-6.1 Sol <noreply@openai.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 js/net/src/ietf/subscriber.test.ts            |  35 ++++++++++
 js/net/src/ietf/subscriber.ts                 |  16 ++++-
 quest/m0/nightly/README.md                    |   1 -
 quest/m0/nightly/ingest-fuzz.md               |  35 ----------
 rs/moq-net/fuzz/README.md                     |   9 +--
 ...h-106ef498520f8a01c45bd62db14b8c6304ee223f | Bin 0 -> 16 bytes
 ...h-6d710cc187440b27892fefe8d78fb0c513357789 | Bin 0 -> 17 bytes
 ...h-fa9dbf405dc58a7708f42087bc2607604a07fd1c | Bin 0 -> 34 bytes
 rs/moq-net/src/fuzz/ingest.rs                 |  42 ++++++++---
 rs/moq-net/src/ietf/subscriber.rs             |  66 ++++++++++++++++--
 10 files changed, 149 insertions(+), 55 deletions(-)
 delete mode 100644 quest/m0/nightly/ingest-fuzz.md
 create mode 100644 rs/moq-net/fuzz/regressions/ingest/crash-106ef498520f8a01c45bd62db14b8c6304ee223f
 create mode 100644 rs/moq-net/fuzz/regressions/ingest/crash-6d710cc187440b27892fefe8d78fb0c513357789
 create mode 100644 rs/moq-net/fuzz/regressions/ingest/crash-fa9dbf405dc58a7708f42087bc2607604a07fd1c

diff --git a/js/net/src/ietf/subscriber.test.ts b/js/net/src/ietf/subscriber.test.ts
index c7d99a205f9..2a6b0ac0769 100644
--- a/js/net/src/ietf/subscriber.test.ts
+++ b/js/net/src/ietf/subscriber.test.ts
@@ -1232,6 +1232,41 @@ test("an END_OF_GROUP status on a marked stream finishes the group", async () =>
 	track.close();
 });
 
+/**
+ * Only the stream's end may follow an END_OF_GROUP or END_OF_TRACK status: an object past
+ * the final one makes the track malformed, rather than ending it or its group clean.
+ * Matches the Rust rule.
+ */
+test.each([
+	["END_OF_GROUP", [0], 0x3],
+	["END_OF_TRACK", [0], 0x4],
+	["a standalone END_OF_TRACK", [], 0x4],
+])("an object after %s is malformed", async (_, objects, status) => {
+	const { subscriber, track } = await subscribeTrack();
+
+	// The objects, the zero-length status object, then one more object.
+	const bytes = new Uint8Array([...encodeObjects(objects), 0, 0, status, ...encodeObjects([0])]);
+	const reader = new Reader(undefined, bytes, VERSION);
+	const stop = spyOn(reader, "stop");
+	await subscriber.handleGroup(
+		new GroupMessage({
+			trackAlias: ALIAS,
+			groupId: 3n,
+			subGroupId: 0n,
+			publisherPriority: 0,
+			flags: groupFlags(true),
+		}),
+		reader,
+	);
+
+	expect(stop).toHaveBeenCalledTimes(1);
+	const err = stop.mock.calls[0][0];
+	expect(err).toBeInstanceOf(StreamError);
+	expect((err as StreamError).code).toBe(StreamCode.MalformedTrack);
+	expect(track.closed.peek()).toBe(err as StreamError);
+	stop.mockRestore();
+});
+
 /**
  * A clear FIRST_OBJECT whose first ID is not 0 still has a hole at the front, so the
  * stream is dropped and the track resumes at the next group.
diff --git a/js/net/src/ietf/subscriber.ts b/js/net/src/ietf/subscriber.ts
index a97fbc8d720..7333b0b493f 100644
--- a/js/net/src/ietf/subscriber.ts
+++ b/js/net/src/ietf/subscriber.ts
@@ -1856,6 +1856,16 @@ export class Subscriber {
 			}
 			return producer;
 		};
+		// After an END_OF_GROUP or END_OF_TRACK status only the stream's end may follow: an
+		// object past the group's final one makes the track malformed.
+		const last = async () => {
+			const done = await race([stream.done(), producer?.closed ?? hooks.trackReleased(track)]);
+			if (done === false) {
+				throw new StreamError(StreamCode.MalformedTrack, {
+					message: `data past the group's final object: group=${group.groupId}`,
+				});
+			}
+		};
 
 		try {
 			// The alias binds after SUBSCRIBE_OK commits the track property; an omitted
@@ -1933,6 +1943,7 @@ export class Subscriber {
 					// No object at or past this location exists: after the group's last object
 					// the track ends with it, and at object 0 it ends before it.
 					if (producer && frame.idDelta !== 0) throw new ObjectIdGap(frame.idDelta);
+					await last();
 					const end = { group: group.groupId, frame: nextObject + frame.idDelta };
 					producer?.finish();
 					try {
@@ -1943,7 +1954,10 @@ export class Subscriber {
 					subscription.end ??= finalSequence(end);
 					return;
 				}
-				if (!frame.isObject) break;
+				if (!frame.isObject) {
+					await last();
+					break;
+				}
 
 				// A track that declared TIMESCALE stamps every object, so one without a Timestamp is
 				// malformed rather than something to invent a time for.
diff --git a/quest/m0/nightly/README.md b/quest/m0/nightly/README.md
index 3d0c5dea508..b896ebeb1de 100644
--- a/quest/m0/nightly/README.md
+++ b/quest/m0/nightly/README.md
@@ -44,7 +44,6 @@ Public API: none. Wire: none.
 
 ## Required
 
-- [moq-net's ingest fuzz target finds no stall](/quest/m0/nightly/ingest-fuzz.md) - the 13-byte stream that stalls ingest is fixed at its cause and kept as a regression test
 - [Nightly's shipping-size check passes](/quest/m0/nightly/shipping-size.md) - js/net, js/watch, and moq-relay growth over 5% is traced to its commits, then shrunk or accepted
 - [Nightly's Miri job stays inside its time budget](/quest/m0/nightly/miri.md) - both Miri passes go green, with ARM timings inside the 60-minute job and 15-minute-per-test budgets
 - [Nightly's macOS platform job passes](/quest/m0/nightly/macos.md) - `moq-audio`'s tests compile on macOS again and the websocket version test's timeout is fixed if it recurs
diff --git a/quest/m0/nightly/ingest-fuzz.md b/quest/m0/nightly/ingest-fuzz.md
deleted file mode 100644
index a4171c6ef3c..00000000000
--- a/quest/m0/nightly/ingest-fuzz.md
+++ /dev/null
@@ -1,35 +0,0 @@
-# [S] moq-net's ingest fuzz target finds no stall
-
-## Goal
-
-Nightly's moq-net `ingest` fuzz target runs its budget without a finding.
-The stall it found on a complete 13-byte stream is fixed at its cause, and
-that input is kept as a regression test.
-
-## Plan
-
-Decided 2026-11-03 (maintainer, /quest-plan of the follow-ups from
-[moq-dev/moq#7667](https://github.com/moq-dev/moq/pull/7667)): milestone m0,
-a child of the Nightly epic.
-
-- The scheduled run of 2026-11-03
-  ([job](https://github.com/moq-dev/moq/actions/runs/41656613559/job/125988510475))
-  panicked at `rs/moq-net/src/fuzz/ingest.rs:298` with "the ingest stalled
-  on a complete 13-byte stream". Its crash artifact is `crash-106ef498…`.
-  The 2026-11-01 E0391 build failure noted in
-  [the CI audit](/quest/m2/audit-ci.md) no longer occurs.
-- Download the artifact before it expires, then replay it with
-  `cargo fuzz run ingest <artifact>`. Decide whether the ingest really
-  stalls on that input or the harness's stall check is wrong, and fix
-  whichever it is.
-- Add the input as a fixed regression test next to the target, so `just
-  check` covers it without fuzzing.
-- The same run's `Fuzz (ts)` and `Fuzz (annexb)` failures are media
-  targets. They belong to [fuzz findings](/quest/m1/fuzz-findings/README.md),
-  or else to the Nightly epic's own triage, not to this quest.
-
-Public API: none expected. Wire: none expected.
-
-## Related
-
-- [Fuzz findings](/quest/m1/fuzz-findings/README.md) - the media fuzz targets' findings
diff --git a/rs/moq-net/fuzz/README.md b/rs/moq-net/fuzz/README.md
index 49ea5674b52..e3f3817067e 100644
--- a/rs/moq-net/fuzz/README.md
+++ b/rs/moq-net/fuzz/README.md
@@ -58,10 +58,11 @@ Beyond "does not panic":
 - `Path::relative` inverts `Path::resolve`, and never produces a reference that walks
   above the root.
 - A group stream ingests to the same frames and the same ending whether it arrives whole,
-  a byte at a time, or in chunks the input picks, and never stalls once complete. Every
-  frame matches its track's timeline, Object IDs only rise, and the frames hold no more
-  bytes than the stream carried. On a clean end, where no block length is hidden, every
-  byte is a frame, a header field, or a property block.
+  a byte at a time, or in chunks the input picks, and never stalls once complete while a
+  reader takes each frame as it lands. Every frame matches its track's timeline, Object
+  IDs only rise, and the frames hold no more bytes than the stream carried. On a clean
+  end, where no block length is hidden, every byte is a frame, a header field, or a
+  property block.
 - A request-stream message is its type, a two-byte length, and exactly that body; at
   most one GOAWAY migrates it. Its body decodes as each message its type names exactly
   when the control stream's length-prefixed reading accepts it, as the same message, and
diff --git a/rs/moq-net/fuzz/regressions/ingest/crash-106ef498520f8a01c45bd62db14b8c6304ee223f b/rs/moq-net/fuzz/regressions/ingest/crash-106ef498520f8a01c45bd62db14b8c6304ee223f
new file mode 100644
index 0000000000000000000000000000000000000000..20e6bda76ea5e8c1ddfbdd151573eeac756c327b
GIT binary patch
literal 16
XcmdO4WMGbD{PzF99Rou`BqIX=CI<v}

literal 0
HcmV?d00001

diff --git a/rs/moq-net/fuzz/regressions/ingest/crash-6d710cc187440b27892fefe8d78fb0c513357789 b/rs/moq-net/fuzz/regressions/ingest/crash-6d710cc187440b27892fefe8d78fb0c513357789
new file mode 100644
index 0000000000000000000000000000000000000000..cb1dc094209e6544929f318d359c19a3bc32e5e5
GIT binary patch
literal 17
Zcmd;LU}j*RKX=aG|9^iiNKH%60024~2o?YU

literal 0
HcmV?d00001

diff --git a/rs/moq-net/fuzz/regressions/ingest/crash-fa9dbf405dc58a7708f42087bc2607604a07fd1c b/rs/moq-net/fuzz/regressions/ingest/crash-fa9dbf405dc58a7708f42087bc2607604a07fd1c
new file mode 100644
index 0000000000000000000000000000000000000000..e59dafe636568f2c96520a226cdc974f2a708952
GIT binary patch
literal 34
mcmZS8Vl;?~Wnf^AWMnwP%D^1a@c;jR1~5=$PUNt&69WKynFloh

literal 0
HcmV?d00001

diff --git a/rs/moq-net/src/fuzz/ingest.rs b/rs/moq-net/src/fuzz/ingest.rs
index 6ce9547b480..f45a8d9ec04 100644
--- a/rs/moq-net/src/fuzz/ingest.rs
+++ b/rs/moq-net/src/fuzz/ingest.rs
@@ -219,10 +219,15 @@ fn run(session: Session, info: &track::Info, body: &[u8], chunk: usize) -> Optio
 			let mut reader = reader(Bytes::copy_from_slice(body), chunk, version);
 			let producer = track.append_group().ok()?;
 			let consumer = producer.consume();
+			let mut viewer = stored(producer.consume(), info.compress);
 			let mut group = crate::recv::Group::new(producer);
 			let framing = lite::Framing::new(info, version);
 			let mut ingest = lite::FrameIngest::new(framing, records, frame_start);
-			let end = drive(body.len(), |waiter| ingest.poll(&mut reader, &mut group, waiter));
+			let end = drive(body.len(), |waiter| {
+				let res = ingest.poll(&mut reader, &mut group, waiter);
+				keep_up(&mut viewer);
+				res
+			});
 			(end.map(|()| "fin".to_string()), (group, consumer))
 		}
 		Session::Ietf { version } => {
@@ -245,9 +250,14 @@ fn run(session: Session, info: &track::Info, body: &[u8], chunk: usize) -> Optio
 				})
 				.ok()?;
 			let consumer = producer.consume();
+			let mut viewer = stored(producer.consume(), info.compress);
 			let mut group = crate::recv::Group::new(producer);
 			let mut ingest = ietf::GroupIngest::new(version, &header, info.timescale);
-			let end = drive(body.len(), |waiter| ingest.poll(&mut reader, &mut group, waiter));
+			let end = drive(body.len(), |waiter| {
+				let res = ingest.poll(&mut reader, &mut group, waiter);
+				keep_up(&mut viewer);
+				res
+			});
 			(end.map(|ended| format!("{ended:?}")), (group, consumer))
 		}
 	};
@@ -283,8 +293,9 @@ fn reader<V: coding::StreamCodes>(payload: Bytes, chunk: usize, version: V) -> S
 /// Poll the ingest until it settles.
 ///
 /// The stream hands over a chunk every other poll and the ingest yields every few frames,
-/// so a stream of `len` bytes settles within a few polls per byte. One that does not is
-/// waiting on something other than the stream, which a peer could hold forever.
+/// so a stream of `len` bytes settles within a few polls per byte, given a reader that
+/// keeps up (see [`keep_up`]). One that does not is waiting on something other than the
+/// stream, which a peer could hold forever.
 fn drive<T>(
 	len: usize,
 	mut poll: impl FnMut(&kio::Waiter) -> std::task::Poll<Result<T, crate::Error>>,
@@ -298,12 +309,27 @@ fn drive<T>(
 	panic!("the ingest stalled on a complete {len}-byte stream");
 }
 
-/// Read every frame the group holds, in its stored form.
-fn read(consumer: group::Consumer, compress: bool) -> Vec<Seen> {
-	let mut consumer = match compress {
+/// Read a group's frames in their stored form, compressed on a compressed track.
+fn stored(consumer: group::Consumer, compress: bool) -> group::Consumer {
+	match compress {
 		true => consumer.compressed(),
 		false => consumer,
-	};
+	}
+}
+
+/// Take every frame that is ready, as a subscriber keeping up would, so the ingest's pace
+/// gate opens instead of waiting on a reader that never comes.
+///
+/// It records nothing: frames it took before an abort stay taken, while a later reader
+/// sees only the abort, so what it saw depends on where the stream split.
+fn keep_up(viewer: &mut group::Consumer) {
+	let waiter = &kio::Waiter::noop();
+	while let std::task::Poll::Ready(Ok(Some(_))) = viewer.poll_read_object(waiter) {}
+}
+
+/// Read every frame the group holds, in its stored form.
+fn read(consumer: group::Consumer, compress: bool) -> Vec<Seen> {
+	let mut consumer = stored(consumer, compress);
 	let waiter = &kio::Waiter::noop();
 	let mut frames = Vec::new();
 	while let std::task::Poll::Ready(Ok(Some(object))) = consumer.poll_read_object(waiter) {
diff --git a/rs/moq-net/src/ietf/subscriber.rs b/rs/moq-net/src/ietf/subscriber.rs
index e5553fb2adb..7779bd52ace 100644
--- a/rs/moq-net/src/ietf/subscriber.rs
+++ b/rs/moq-net/src/ietf/subscriber.rs
@@ -5860,6 +5860,11 @@ impl RecvGroup {
 				let _ = track.abort(Error::ProtocolViolation);
 				return Poll::Ready(Err(Error::ProtocolViolation));
 			}
+			Err(Error::MalformedTrack) => {
+				tracing::warn!(group = group.group_id, "malformed track");
+				let _ = track.abort(Error::MalformedTrack);
+				return Poll::Ready(Err(Error::MalformedTrack));
+			}
 			Err(err) => return Poll::Ready(Err(err)),
 			Ok(opened) => opened,
 		};
@@ -5987,6 +5992,8 @@ enum OpenStep {
 	PeekFirst,
 	/// Claiming the head a mid-group stream continues, from its first Object ID if it has one.
 	ClaimTail(Option<u64>),
+	/// A standalone END_OF_TRACK: consuming its marker, then refusing any byte past it.
+	EndOfTrack { object: u64, properties: bool },
 }
 
 impl OpenGroup {
@@ -6063,10 +6070,17 @@ impl OpenGroup {
 						}
 					};
 					if let Some(first) = first.filter(|first| first.end_of_track) {
-						return Poll::Ready(Ok(Opened::EndOfTrack {
+						// Only the stream's end may follow the track's end: an object past it
+						// makes the track malformed.
+						match header.flags.has_extensions {
+							true => ready!(stream.poll_decode::<PeekFirst<true>>(waiter)).map(drop)?,
+							false => ready!(stream.poll_decode::<PeekFirst<false>>(waiter)).map(drop)?,
+						}
+						self.step = OpenStep::EndOfTrack {
 							object: first.id,
 							properties: first.has_properties,
-						}));
+						};
+						continue;
 					}
 
 					// Without a fill, a relay preserves the subgroup's first Object ID and
@@ -6107,6 +6121,12 @@ impl OpenGroup {
 						start => self.step = OpenStep::ClaimTail(start),
 					}
 				}
+				OpenStep::EndOfTrack { object, properties } => {
+					if ready!(stream.poll_has_more(waiter))? {
+						return Poll::Ready(Err(Error::MalformedTrack));
+					}
+					return Poll::Ready(Ok(Opened::EndOfTrack { object, properties }));
+				}
 				OpenStep::ClaimTail(start) => {
 					let claimed = ready!(poll_claim_fill(fill, track, sequence, start, reading, waiter))?;
 					return Poll::Ready(match (start, claimed) {
@@ -6210,7 +6230,8 @@ enum IngestPhase {
 	Admit { header: frame::Header },
 	/// Streaming the object payload.
 	Payload { frame: frame::Producer },
-	/// An explicit end-of-group or end-of-track status arrived.
+	/// An explicit end-of-group or end-of-track status arrived, so only the stream end may
+	/// follow.
 	Finished(Ended),
 }
 
@@ -7784,9 +7805,10 @@ impl GroupIngest {
 		})
 	}
 
-	/// `Ready(Ok(_))` once the stream FINs on an object boundary, or an explicit
-	/// end-of-group or end-of-track status arrives. The caller finishes or aborts the
-	/// group; an object cut short mid-payload was already aborted here with the reason.
+	/// `Ready(Ok(_))` once the stream ends, whether on an object boundary or after an
+	/// explicit end-of-group or end-of-track status; a byte past that status is refused as
+	/// `MalformedTrack`. The caller finishes or aborts the group; an object cut short
+	/// mid-payload was already aborted here with the reason.
 	pub(crate) fn poll<R: crate::transport::poll::RecvStream + crate::coding::Pause>(
 		&mut self,
 		reader: &mut Reader<R, Version>,
@@ -7905,6 +7927,10 @@ impl GroupIngest {
 					}
 				}
 				IngestPhase::Finished(ended) => {
+					// An object past the group's final one makes the track malformed.
+					if ready!(reader.poll_has_more(waiter))? {
+						return Poll::Ready(Err(Error::MalformedTrack));
+					}
 					let ended = std::mem::replace(ended, Ended::Group);
 					return Poll::Ready(Ok(ended));
 				}
@@ -14413,6 +14439,34 @@ mod stitch_tests {
 		(sequence, frames)
 	}
 
+	/// Only the stream's end may follow an END_OF_GROUP or END_OF_TRACK status: an object
+	/// past the final one makes the track malformed, rather than ending it or its group clean.
+	#[kio::test]
+	async fn an_object_after_an_end_status_ends_the_track() {
+		use futures::FutureExt;
+
+		let header = tail_stream(SEQUENCE, 0, &[]).len();
+		let object = &tail_stream(SEQUENCE, 0, &[b"past"])[header..];
+		for (payloads, status) in [
+			(&[&b"last"[..]][..], END_OF_GROUP),
+			(&[&b"last"[..]][..], END_OF_TRACK),
+			// A standalone END_OF_TRACK, which opens no group.
+			(&[][..], END_OF_TRACK),
+		] {
+			let mut bytes = end_marker(tail_stream(SEQUENCE, 0, payloads), status);
+			bytes.extend_from_slice(object);
+
+			let h = Harness::new(Fill::Done, vec![bytes]);
+			let mut stream = h.stream().await;
+			let res = h.subscriber.clone().recv_group(&mut stream).await;
+			assert!(matches!(res, Err(Error::MalformedTrack)), "{status}: {res:?}");
+			assert!(
+				matches!(h.track.closed().now_or_never(), Some(Err(Error::MalformedTrack))),
+				"{status}"
+			);
+		}
+	}
+
 	/// The canonical join: the fill carries the objects published before we subscribed and
 	/// the subscription the ones after, and they land in one group in order.
 	///

From 99d5057eec30faf9fd865313a5f356679b3447e2 Mon Sep 17 00:00:00 2001
From: Luke Curley <kixelated@gmail.com>
Date: Thu, 5 Nov 2026 20:06:59 +0000
Subject: [PATCH 09/36] fix(msf)!: share resolved init data across tracks
 (#7949)

Co-authored-by: GPT-6.1 Sol <noreply@openai.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 Cargo.lock                             |   1 +
 rs/moq-msf/Cargo.toml                  |   7 +-
 rs/moq-msf/MIGRATE.md                  |   6 ++
 rs/moq-msf/benches/catalog.rs          |  44 +++++++++
 rs/moq-msf/src/lib.rs                  |  82 +++++++++++++----
 rs/moq-mux/src/catalog/msf/consumer.rs | 122 +++++++++++++++++--------
 rs/moq-mux/src/catalog/producer.rs     |  10 +-
 rs/workspace-hack/Cargo.toml           |   8 +-
 sh/gh/nightly.sh                       |   1 +
 9 files changed, 213 insertions(+), 68 deletions(-)
 create mode 100644 rs/moq-msf/benches/catalog.rs

diff --git a/Cargo.lock b/Cargo.lock
index e9cec025184..455b5dc925b 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -4708,6 +4708,7 @@ dependencies = [
 name = "moq-msf"
 version = "0.5.1"
 dependencies = [
+ "bench-harness",
  "serde",
  "serde_json",
  "serde_with",
diff --git a/rs/moq-msf/Cargo.toml b/rs/moq-msf/Cargo.toml
index 8da5ddeb3ed..a33b21a5ca6 100644
--- a/rs/moq-msf/Cargo.toml
+++ b/rs/moq-msf/Cargo.toml
@@ -13,12 +13,17 @@ keywords = ["quic", "http3", "webtransport", "media", "live"]
 categories = ["multimedia", "network-programming", "web-programming"]
 
 [dependencies]
-serde = { workspace = true }
+serde = { workspace = true, features = ["rc"] }
 serde_json = { workspace = true }
 serde_with = { workspace = true }
 
 [dev-dependencies]
+criterion = { package = "bench-harness", path = "../bench-harness" }
 workspace-hack = { path = "../workspace-hack" }
 
+[[bench]]
+name = "catalog"
+harness = false
+
 [lints]
 workspace = true
diff --git a/rs/moq-msf/MIGRATE.md b/rs/moq-msf/MIGRATE.md
index f9cc0333739..766acbdf840 100644
--- a/rs/moq-msf/MIGRATE.md
+++ b/rs/moq-msf/MIGRATE.md
@@ -4,6 +4,12 @@ How to update your code for each breaking change, newest first.
 
 ## Unreleased
 
+### `Track::init_data` shares referenced payloads
+
+`Track::init_data` is now `Option<Arc<str>>` instead of `Option<String>`.
+Convert owned strings with `.into()` when assigning the field. Use `.as_deref()`
+to read it as `Option<&str>`. Tracks resolving the same `initRef` share one allocation.
+
 ### `Catalog` parses through `FromStr` (#6471)
 
 The inherent `Catalog::from_str` is replaced by `impl FromStr for Catalog`, with the same `serde_json::Error`.
diff --git a/rs/moq-msf/benches/catalog.rs b/rs/moq-msf/benches/catalog.rs
new file mode 100644
index 00000000000..cf5d5f9a4b8
--- /dev/null
+++ b/rs/moq-msf/benches/catalog.rs
@@ -0,0 +1,44 @@
+//! Catalog parse and serialization cost across tracks and distinct init entries.
+
+use std::hint::black_box;
+use std::str::FromStr;
+
+use criterion::{Criterion, criterion_group, criterion_main};
+use moq_msf::Catalog;
+
+fn catalog(tracks: usize, entries: usize) -> String {
+	let suffix = "A".repeat(16 * 1024 - 8);
+	let init_data_list = (0..entries)
+		.map(
+			|id| serde_json::json!({ "id": format!("init{id}"), "type": "inline", "data": format!("{id:08x}{suffix}") }),
+		)
+		.collect::<Vec<_>>();
+	let tracks = (0..tracks)
+		.map(|index| {
+			serde_json::json!({
+				"name": format!("track{index}"), "packaging": "legacy",
+				"isLive": true, "role": "video", "initRef": format!("init{}", index % entries)
+			})
+		})
+		.collect::<Vec<_>>();
+	serde_json::json!({ "version": "draft-01", "initDataList": init_data_list, "tracks": tracks }).to_string()
+}
+
+fn bench(c: &mut Criterion) {
+	for tracks in [1, 16, 256] {
+		for entries in [1, 4, 16] {
+			let json = catalog(tracks, entries);
+			let parsed = Catalog::<()>::from_str(&json).unwrap();
+			let id = format!("{tracks}tracks/{entries}entries");
+			c.bench_function(&format!("msf_parse/{id}"), |b| {
+				b.iter(|| black_box(Catalog::<()>::from_str(black_box(&json)).unwrap()))
+			});
+			c.bench_function(&format!("msf_serialize/{id}"), |b| {
+				b.iter(|| black_box(black_box(&parsed).to_json().unwrap()))
+			});
+		}
+	}
+}
+
+criterion_group!(benches, bench);
+criterion_main!(benches);
diff --git a/rs/moq-msf/src/lib.rs b/rs/moq-msf/src/lib.rs
index 0da55733d83..81dd68c9bf2 100644
--- a/rs/moq-msf/src/lib.rs
+++ b/rs/moq-msf/src/lib.rs
@@ -21,6 +21,7 @@
 
 use std::fmt;
 use std::str::FromStr;
+use std::sync::Arc;
 use std::time::Duration;
 
 use serde::{Deserialize, Serialize};
@@ -155,12 +156,12 @@ pub struct Track {
 	/// Bitrate in bits per second.
 	pub bitrate: Option<u64>,
 
-	/// Resolved base64 initialization data.
+	/// Resolved base64 initialization data, shared by tracks with the same `initRef`.
 	///
 	/// On the wire this is carried indirectly through draft-01's `initDataList` +
 	/// `initRef`; [`Catalog`] (de)serialization resolves it so callers always see
 	/// the inline payload here. draft-00's inline `initData` is also accepted.
-	pub init_data: Option<String>,
+	pub init_data: Option<Arc<str>>,
 
 	/// Wire-only pointer into the catalog's `initDataList` (draft-01). Populated
 	/// only while (de)serializing; resolved into `init_data` on parse and never
@@ -283,13 +284,19 @@ impl<E: CatalogExt> Serialize for Catalog<E> {
 		// point each track at its entry via initRef. That's the draft-01 wire
 		// shape; identical payloads across tracks collapse to one entry.
 		let mut init_data_list: Vec<InitData> = Vec::new();
-		let mut ids: HashMap<String, String> = HashMap::new();
+		let mut ids: HashMap<Arc<str>, String> = HashMap::new();
+		let mut pointers: HashMap<(usize, usize), String> = HashMap::new();
 		let mut tracks = Vec::with_capacity(self.tracks.len());
 
 		for track in &self.tracks {
 			let mut track = track.clone();
 			if let Some(payload) = track.init_data.take() {
-				let id = if let Some(id) = ids.get(&payload) {
+				// A parsed initRef shares one Arc across tracks. Avoid hashing its
+				// entire payload again for each track when writing a catalog.
+				let pointer = (payload.as_ptr() as usize, payload.len());
+				let id = if let Some(id) = pointers.get(&pointer) {
+					id.clone()
+				} else if let Some(id) = ids.get(&payload) {
 					id.clone()
 				} else {
 					let id = format!("init{}", init_data_list.len());
@@ -301,6 +308,7 @@ impl<E: CatalogExt> Serialize for Catalog<E> {
 					ids.insert(payload, id.clone());
 					id
 				};
+				pointers.insert(pointer, id.clone());
 				track.init_ref = Some(id);
 			}
 			tracks.push(track);
@@ -343,8 +351,9 @@ impl<'de, E: CatalogExt> Deserialize<'de> for Catalog<E> {
 			.into_iter()
 			.map(|mut track| -> Result<Track, D::Error> {
 				// Resolve draft-01 initRef into inline init_data so callers never
-				// see the indirection. Inline init_data (draft-00) is kept as-is,
-				// but a catalog that carries both forms must not disagree.
+				// see the indirection. Inline init_data (draft-00) that matches its
+				// initRef entry shares that entry's allocation; a catalog that
+				// carries both forms must not disagree.
 				if let Some(id) = track.init_ref.take() {
 					let entry = by_id.get(id.as_str()).ok_or_else(|| {
 						serde::de::Error::custom(format!(
@@ -360,16 +369,13 @@ impl<'de, E: CatalogExt> Deserialize<'de> for Catalog<E> {
 						)));
 					}
 
-					match &track.init_data {
-						Some(inline) if inline != &entry.data => {
-							return Err(serde::de::Error::custom(format!(
-								"MSF track {:?} carries conflicting initData and initRef {:?}",
-								track.name, id
-							)));
-						}
-						Some(_) => {}
-						None => track.init_data = Some(entry.data.clone()),
+					if track.init_data.as_ref().is_some_and(|inline| inline != &entry.data) {
+						return Err(serde::de::Error::custom(format!(
+							"MSF track {:?} carries conflicting initData and initRef {:?}",
+							track.name, id
+						)));
 					}
+					track.init_data = Some(entry.data.clone());
 				}
 				track.init_ref = None;
 				Ok(track)
@@ -476,7 +482,7 @@ struct InitData {
 	#[serde(rename = "type")]
 	kind: String,
 	/// The init payload, interpreted per `kind`. For `"inline"`, base64.
-	data: String,
+	data: Arc<str>,
 }
 
 impl Track {
@@ -819,7 +825,7 @@ mod test {
 		track.max_grp_sap_starting_type = None;
 		track.max_obj_sap_starting_type = None;
 		track.jitter = None;
-		track.init_data = Some("AQID".to_string());
+		track.init_data = Some("AQID".into());
 
 		let catalog = Catalog::new(vec![track]);
 
@@ -1051,12 +1057,18 @@ mod test {
 			],
 			"tracks": [
 				{ "name": "video0", "packaging": "cmaf", "isLive": true, "role": "video",
+				  "codec": "avc1.640028", "initData": "AQID", "initRef": "v0" },
+				{ "name": "video1", "packaging": "cmaf", "isLive": true, "role": "video",
 				  "codec": "avc1.640028", "initData": "AQID", "initRef": "v0" }
 			]
 		}"#;
 
 		let catalog = Catalog::<()>::from_str(json).unwrap();
-		assert_eq!(catalog.tracks[0].init_data.as_deref(), Some("AQID"));
+		let first = catalog.tracks[0].init_data.as_ref().unwrap();
+		let second = catalog.tracks[1].init_data.as_ref().unwrap();
+		assert_eq!(first.as_ref(), "AQID");
+		// The matching inline copies are dropped in favor of the shared initRef payload.
+		assert!(Arc::ptr_eq(first, second));
 	}
 
 	#[test]
@@ -1078,6 +1090,36 @@ mod test {
 		assert_eq!(catalog.tracks[0].init_data.as_deref(), Some("AQID"));
 	}
 
+	#[test]
+	fn draft01_shared_init_ref_keeps_one_payload() {
+		let data = "A".repeat(64 * 1024);
+		let tracks = (0..32)
+			.map(|n| {
+				serde_json::json!({
+					"name": format!("video{n}"), "packaging": "cmaf",
+					"isLive": true, "role": "video", "initRef": "shared"
+				})
+			})
+			.collect::<Vec<_>>();
+		let json = serde_json::json!({
+			"version": "draft-01",
+			"initDataList": [{ "id": "shared", "type": "inline", "data": data }],
+			"tracks": tracks
+		})
+		.to_string();
+
+		let catalog = Catalog::<()>::from_str(&json).unwrap();
+		let first = catalog.tracks[0].init_data.as_ref().unwrap();
+		assert!(
+			catalog
+				.tracks
+				.iter()
+				.all(|track| Arc::ptr_eq(first, track.init_data.as_ref().unwrap()))
+		);
+		let encoded: serde_json::Value = serde_json::from_str(&catalog.to_json().unwrap()).unwrap();
+		assert_eq!(encoded["initDataList"].as_array().unwrap().len(), 1);
+	}
+
 	#[test]
 	fn serialize_hoists_and_dedups_init_data() {
 		// Two tracks sharing the same init payload must collapse to a single
@@ -1085,10 +1127,10 @@ mod test {
 		// inline initData left on the tracks.
 		let mut a = video_track();
 		a.name = "a".to_string();
-		a.init_data = Some("AQID".to_string());
+		a.init_data = Some("AQID".into());
 		let mut b = video_track();
 		b.name = "b".to_string();
-		b.init_data = Some("AQID".to_string());
+		b.init_data = Some("AQID".into());
 
 		let catalog = Catalog::new(vec![a, b]);
 		let value: serde_json::Value = serde_json::from_str(&catalog.to_json().unwrap()).unwrap();
diff --git a/rs/moq-mux/src/catalog/msf/consumer.rs b/rs/moq-mux/src/catalog/msf/consumer.rs
index 7f786fbdea1..db515153e71 100644
--- a/rs/moq-mux/src/catalog/msf/consumer.rs
+++ b/rs/moq-mux/src/catalog/msf/consumer.rs
@@ -1,3 +1,4 @@
+use std::collections::HashMap;
 use std::marker::PhantomData;
 use std::str::FromStr;
 use std::task::{Poll, ready};
@@ -107,6 +108,7 @@ impl<E: CatalogExt> From<moq_net::track::Subscriber> for Consumer<E> {
 pub(crate) fn from_msf<E: CatalogExt>(msf: &moq_msf::Catalog<E>, base: &moq_net::Path) -> Result<Catalog<E>> {
 	let mut catalog = Catalog::default();
 	catalog.ext = msf.ext.clone();
+	let mut init_cache = InitDataCache::new();
 
 	for track in &msf.tracks {
 		// The track name is the rendition ID, so a later track with the name replaces the earlier
@@ -136,7 +138,7 @@ pub(crate) fn from_msf<E: CatalogExt>(msf: &moq_msf::Catalog<E>, base: &moq_net:
 		};
 
 		match role {
-			moq_msf::Role::Video => match video_config_from_msf(track)? {
+			moq_msf::Role::Video => match video_config_from_msf(track, &mut init_cache)? {
 				Some(mut config) => {
 					config.broadcast = broadcast;
 					catalog.video.renditions.insert(track.name.clone(), config);
@@ -149,7 +151,7 @@ pub(crate) fn from_msf<E: CatalogExt>(msf: &moq_msf::Catalog<E>, base: &moq_net:
 					);
 				}
 			},
-			moq_msf::Role::Audio => match audio_config_from_msf(track)? {
+			moq_msf::Role::Audio => match audio_config_from_msf(track, &mut init_cache)? {
 				Some(mut config) => {
 					config.broadcast = broadcast;
 					catalog.audio.renditions.insert(track.name.clone(), config);
@@ -163,12 +165,12 @@ pub(crate) fn from_msf<E: CatalogExt>(msf: &moq_msf::Catalog<E>, base: &moq_net:
 				}
 			},
 			moq_msf::Role::Caption | moq_msf::Role::Subtitle => {
-				let mut config = text_config_from_msf(track)?;
+				let mut config = text_config_from_msf(track, &mut init_cache)?;
 				config.broadcast = broadcast;
 				catalog.text.renditions.insert(track.name.clone(), config);
 			}
 			moq_msf::Role::Unknown(_) if matches!(track.codec.as_deref(), Some("vtt" | "ttml" | "utf8")) => {
-				let mut config = text_config_from_msf(track)?;
+				let mut config = text_config_from_msf(track, &mut init_cache)?;
 				config.broadcast = broadcast;
 				catalog.text.renditions.insert(track.name.clone(), config);
 			}
@@ -190,20 +192,24 @@ pub(crate) fn from_msf<E: CatalogExt>(msf: &moq_msf::Catalog<E>, base: &moq_net:
 /// Returns `Err` when a CMAF track is missing or has malformed `init_data`. This is an
 /// intentional hard error: a CMAF rendition is unusable without its `ftyp+moov` init
 /// segment, and silently skipping it would mask a publisher bug.
-fn container_from_msf(track: &moq_msf::Track) -> Result<Option<Container>> {
+fn container_from_msf(track: &moq_msf::Track, init_cache: &mut InitDataCache) -> Result<Option<Container>> {
 	match &track.packaging {
 		// Neither is ISO-BMFF boxed, but they frame differently: a LOC property block against a varint
 		// timestamp prefix. Reading one as the other misparses the head of every frame.
 		moq_msf::Packaging::Loc => Ok(Some(Container::Loc)),
 		moq_msf::Packaging::Legacy => Ok(Some(Container::Legacy)),
 		moq_msf::Packaging::Cmaf => {
-			let init = decode_init_data(track)?.ok_or_else(|| Error::MissingCmafInit(track.name.clone()))?;
+			let init =
+				decode_init_data(track, init_cache)?.ok_or_else(|| Error::MissingCmafInit(track.name.clone()))?;
 			Ok(Some(Container::Cmaf { init }))
 		}
 		_ => Ok(None),
 	}
 }
 
+/// Decoded init data keyed by the shared `Arc<str>` allocation's address and length.
+type InitDataCache = HashMap<(usize, usize), bytes::Bytes>;
+
 /// Base64-decode `track.init_data` into a `Bytes` buffer, propagating a
 /// descriptive error on malformed input. Returns `Ok(None)` when no
 /// `init_data` is present.
@@ -212,33 +218,38 @@ fn container_from_msf(track: &moq_msf::Track) -> Result<Option<Container>> {
 /// For Legacy/LOC tracks the bytes are the codec-specific decoder
 /// description (e.g. an AVCC/HVCC config record or AAC AudioSpecificConfig)
 /// that downstream decoders need to configure their bitstream parsers.
-fn decode_init_data(track: &moq_msf::Track) -> Result<Option<bytes::Bytes>> {
-	track
-		.init_data
-		.as_ref()
-		.map(|b64| {
-			base64::engine::general_purpose::STANDARD
-				.decode(b64)
-				.map(bytes::Bytes::from)
-				.map_err(|_| Error::MalformedInitData(track.name.clone()).into())
-		})
-		.transpose()
+fn decode_init_data(track: &moq_msf::Track, init_cache: &mut InitDataCache) -> Result<Option<bytes::Bytes>> {
+	let Some(b64) = &track.init_data else {
+		return Ok(None);
+	};
+	// initRef gives every referencing track the same Arc. Decode that payload once
+	// and clone Bytes handles for renditions that retain it.
+	let pointer = (b64.as_ptr() as usize, b64.len());
+	if let Some(decoded) = init_cache.get(&pointer) {
+		return Ok(Some(decoded.clone()));
+	}
+	let decoded = base64::engine::general_purpose::STANDARD
+		.decode(b64.as_bytes())
+		.map(bytes::Bytes::from)
+		.map_err(|_| Error::MalformedInitData(track.name.clone()))?;
+	init_cache.insert(pointer, decoded.clone());
+	Ok(Some(decoded))
 }
 
 /// Pull the decoder description out of a Legacy/LOC MSF track's `init_data`.
 ///
 /// CMAF tracks carry their config inside `Container::Cmaf::init`, so this
 /// returns `Ok(None)` for them to avoid duplicating the bytes.
-fn legacy_description(track: &moq_msf::Track) -> Result<Option<bytes::Bytes>> {
+fn legacy_description(track: &moq_msf::Track, init_cache: &mut InitDataCache) -> Result<Option<bytes::Bytes>> {
 	match track.packaging {
-		moq_msf::Packaging::Loc | moq_msf::Packaging::Legacy => decode_init_data(track),
+		moq_msf::Packaging::Loc | moq_msf::Packaging::Legacy => decode_init_data(track, init_cache),
 		_ => Ok(None),
 	}
 }
 
-fn text_config_from_msf(track: &moq_msf::Track) -> Result<TextConfig> {
+fn text_config_from_msf(track: &moq_msf::Track, init_cache: &mut InitDataCache) -> Result<TextConfig> {
 	// A gateway must not silently delete text that its output is expected to preserve.
-	let container = container_from_msf(track)?.ok_or_else(|| Error::UnsupportedPackaging {
+	let container = container_from_msf(track, init_cache)?.ok_or_else(|| Error::UnsupportedPackaging {
 		name: track.name.clone(),
 		packaging: track.packaging.to_string(),
 	})?;
@@ -257,10 +268,10 @@ fn text_config_from_msf(track: &moq_msf::Track) -> Result<TextConfig> {
 	Ok(config)
 }
 
-fn video_config_from_msf(track: &moq_msf::Track) -> Result<Option<VideoConfig>> {
+fn video_config_from_msf(track: &moq_msf::Track, init_cache: &mut InitDataCache) -> Result<Option<VideoConfig>> {
 	// Unsupported packaging (e.g. MediaTimeline) bubbles up as Ok(None) so the caller can
 	// skip the track with a warning rather than fail the whole catalog.
-	let Some(container) = container_from_msf(track)? else {
+	let Some(container) = container_from_msf(track, init_cache)? else {
 		return Ok(None);
 	};
 
@@ -278,7 +289,7 @@ fn video_config_from_msf(track: &moq_msf::Track) -> Result<Option<VideoConfig>>
 	let mut config = VideoConfig::new(codec);
 	config.description = match &container {
 		Container::Cmaf { init } => cmaf_video_description(track, init, &config.codec)?,
-		_ => legacy_description(track)?,
+		_ => legacy_description(track, init_cache)?,
 	};
 	config.coded_width = track.width;
 	config.coded_height = track.height;
@@ -290,8 +301,8 @@ fn video_config_from_msf(track: &moq_msf::Track) -> Result<Option<VideoConfig>>
 	Ok(Some(config))
 }
 
-fn audio_config_from_msf(track: &moq_msf::Track) -> Result<Option<AudioConfig>> {
-	let Some(container) = container_from_msf(track)? else {
+fn audio_config_from_msf(track: &moq_msf::Track, init_cache: &mut InitDataCache) -> Result<Option<AudioConfig>> {
+	let Some(container) = container_from_msf(track, init_cache)? else {
 		return Ok(None);
 	};
 
@@ -313,7 +324,7 @@ fn audio_config_from_msf(track: &moq_msf::Track) -> Result<Option<AudioConfig>>
 	let (sample_rate, channel_count) = match (track.samplerate, channel_count_from_field) {
 		(Some(sr), Some(cc)) => (sr, cc),
 		(sr_opt, cc_opt) => {
-			let derived = derive_audio_params(track, &codec)?;
+			let derived = derive_audio_params(track, &codec, init_cache)?;
 			(
 				sr_opt.unwrap_or(derived.sample_rate),
 				cc_opt.unwrap_or(derived.channel_count),
@@ -327,7 +338,7 @@ fn audio_config_from_msf(track: &moq_msf::Track) -> Result<Option<AudioConfig>>
 		config.warmup = Some(crate::codec::opus::WARMUP);
 	}
 	config.bitrate = track.bitrate;
-	config.description = legacy_description(track)?;
+	config.description = legacy_description(track, init_cache)?;
 	config.container = container;
 	config.jitter = track.jitter;
 	config.delay = track.delay;
@@ -350,8 +361,12 @@ struct DerivedAudio {
 /// Returns an error if `init_data` is absent, malformed, or doesn't carry usable audio
 /// parameters. The caller is expected to surface this as a hard failure rather than
 /// substitute defaults: a wrong sample rate produces silent or distorted playback.
-fn derive_audio_params(track: &moq_msf::Track, codec: &AudioCodec) -> Result<DerivedAudio> {
-	let init = decode_init_data(track)?.ok_or_else(|| Error::MissingAudioParams(track.name.clone()))?;
+fn derive_audio_params(
+	track: &moq_msf::Track,
+	codec: &AudioCodec,
+	init_cache: &mut InitDataCache,
+) -> Result<DerivedAudio> {
+	let init = decode_init_data(track, init_cache)?.ok_or_else(|| Error::MissingAudioParams(track.name.clone()))?;
 
 	match track.packaging {
 		moq_msf::Packaging::Loc | moq_msf::Packaging::Legacy => derive_from_codec_config(track, codec, init),
@@ -600,11 +615,42 @@ mod test {
 		track.height = Some(1080);
 		track.framerate = Some(30.0);
 		track.bitrate = Some(5_000_000);
-		track.init_data = init_data.map(str::to_string);
+		track.init_data = init_data.map(Into::into);
 		track.render_group = Some(1);
 		track
 	}
 
+	#[test]
+	fn shared_init_ref_decodes_once_for_renditions() {
+		let data = base64::engine::general_purpose::STANDARD.encode(vec![0xAB; 64 * 1024]);
+		let tracks = (0..16)
+			.map(|n| {
+				serde_json::json!({
+					"name": format!("video{n}"), "packaging": "legacy",
+					"isLive": true, "role": "video", "codec": "avc1.640028",
+					"initRef": "shared"
+				})
+			})
+			.collect::<Vec<_>>();
+		let json = serde_json::json!({
+			"version": "draft-01",
+			"initDataList": [{ "id": "shared", "type": "inline", "data": data }],
+			"tracks": tracks
+		})
+		.to_string();
+		let msf = moq_msf::Catalog::<()>::from_str(&json).unwrap();
+		let catalog = from_msf(&msf, &moq_net::Path::empty()).unwrap();
+		let first = catalog.video.renditions["video0"].description.as_ref().unwrap();
+		for n in 1..16 {
+			let description = catalog.video.renditions[&format!("video{n}")]
+				.description
+				.as_ref()
+				.unwrap();
+			assert_eq!(first.as_ptr(), description.as_ptr());
+			assert_eq!(description.len(), 64 * 1024);
+		}
+	}
+
 	fn audio_track(name: &str, packaging: moq_msf::Packaging) -> moq_msf::Track {
 		let mut track = moq_msf::Track::new(name, packaging);
 		track.is_live = true;
@@ -744,7 +790,7 @@ mod test {
 		video.codec = Some("avc1.42c01e".to_string());
 
 		let mut audio = audio_track("audio0", moq_msf::Packaging::Loc);
-		audio.init_data = Some(init_b64);
+		audio.init_data = Some(init_b64.into());
 
 		let msf = moq_msf::Catalog::new(vec![video, audio]);
 
@@ -853,7 +899,7 @@ mod test {
 		audio.codec = Some("flac".to_string());
 		audio.samplerate = None;
 		audio.channel_config = None;
-		audio.init_data = Some(init_b64);
+		audio.init_data = Some(init_b64.into());
 
 		let msf = moq_msf::Catalog::new(vec![audio]);
 
@@ -963,7 +1009,7 @@ mod test {
 		track.codec = Some("opus".to_string());
 		track.samplerate = None;
 		track.channel_config = None;
-		track.init_data = Some(init_b64);
+		track.init_data = Some(init_b64.into());
 		let msf = moq_msf::Catalog::new(vec![track]);
 
 		let catalog = from_msf::<()>(&msf, &moq_net::Path::empty()).expect("Opus OpusHead should parse");
@@ -982,7 +1028,7 @@ mod test {
 		track.codec = Some("opus".to_string());
 		track.samplerate = None;
 		track.channel_config = None;
-		track.init_data = Some(init_b64);
+		track.init_data = Some(init_b64.into());
 		let msf = moq_msf::Catalog::new(vec![track]);
 
 		let err = from_msf::<()>(&msf, &moq_net::Path::empty()).expect_err("trailing bytes should error");
@@ -1004,7 +1050,7 @@ mod test {
 		track.codec = Some("mp4a.40.2".to_string());
 		track.samplerate = None;
 		track.channel_config = None;
-		track.init_data = Some(init_b64);
+		track.init_data = Some(init_b64.into());
 		let msf = moq_msf::Catalog::new(vec![track]);
 
 		let catalog = from_msf::<()>(&msf, &moq_net::Path::empty()).expect("AAC AudioSpecificConfig should parse");
@@ -1021,7 +1067,7 @@ mod test {
 		track.codec = Some("mp4a.40.29".to_string());
 		track.samplerate = None;
 		track.channel_config = None;
-		track.init_data = Some(base64::engine::general_purpose::STANDARD.encode(asc));
+		track.init_data = Some(base64::engine::general_purpose::STANDARD.encode(asc).into());
 		let msf = moq_msf::Catalog::new(vec![track]);
 
 		let catalog = from_msf::<()>(&msf, &moq_net::Path::empty()).expect("AAC AudioSpecificConfig should parse");
@@ -1046,7 +1092,7 @@ mod test {
 		track.codec = Some("opus".to_string());
 		track.samplerate = Some(24_000); // explicit, must be preserved
 		track.channel_config = None; // missing, derive from init_data
-		track.init_data = Some(init_b64);
+		track.init_data = Some(init_b64.into());
 		let msf = moq_msf::Catalog::new(vec![track]);
 
 		let catalog = from_msf::<()>(&msf, &moq_net::Path::empty()).expect("partial derivation should succeed");
diff --git a/rs/moq-mux/src/catalog/producer.rs b/rs/moq-mux/src/catalog/producer.rs
index 4f25c3fedaa..6be0cf0e0a9 100644
--- a/rs/moq-mux/src/catalog/producer.rs
+++ b/rs/moq-mux/src/catalog/producer.rs
@@ -1363,7 +1363,7 @@ fn to_msf_media<E: CatalogExt>(catalog: &hang::Catalog, base: &moq_net::Path) ->
 		track.height = config.coded_height;
 		track.framerate = config.framerate;
 		track.bitrate = config.bitrate;
-		track.init_data = init_data;
+		track.init_data = init_data.map(Into::into);
 		track.render_group = Some(1);
 		track.alt_group = if has_multiple_video { Some(1) } else { None };
 		track.max_grp_sap_starting_type = sap_type;
@@ -1396,7 +1396,7 @@ fn to_msf_media<E: CatalogExt>(catalog: &hang::Catalog, base: &moq_net::Path) ->
 		track.samplerate = Some(config.sample_rate);
 		track.channel_config = Some(config.channel_count.to_string());
 		track.bitrate = config.bitrate;
-		track.init_data = init_data;
+		track.init_data = init_data.map(Into::into);
 		track.render_group = Some(1);
 		track.alt_group = if has_multiple_audio { Some(1) } else { None };
 		track.max_grp_sap_starting_type = Some(1);
@@ -1419,7 +1419,7 @@ fn to_msf_media<E: CatalogExt>(catalog: &hang::Catalog, base: &moq_net::Path) ->
 		track.lang = config.lang.clone();
 		track.label = config.label.clone();
 		if let hang::catalog::Container::Cmaf { init, .. } = &config.container {
-			track.init_data = Some(base64::engine::general_purpose::STANDARD.encode(init));
+			track.init_data = Some(base64::engine::general_purpose::STANDARD.encode(init).into());
 		}
 		track.render_group = Some(1);
 		track.jitter = config.jitter;
@@ -3075,7 +3075,7 @@ mod test {
 
 		let msf = to_msf_media::<()>(&catalog, &moq_net::Path::empty());
 		let video = &msf.tracks[0];
-		assert_eq!(video.init_data, Some("AQID".to_string()));
+		assert_eq!(video.init_data.as_deref(), Some("AQID"));
 	}
 
 	#[test]
@@ -3111,7 +3111,7 @@ mod test {
 		let msf = to_msf_media::<()>(&catalog, &moq_net::Path::empty());
 		let video = &msf.tracks[0];
 		assert_eq!(video.packaging, moq_msf::Packaging::Cmaf);
-		assert_eq!(video.init_data, Some("AAAYZ2Z0eXA=".to_string()));
+		assert_eq!(video.init_data.as_deref(), Some("AAAYZ2Z0eXA="));
 	}
 
 	#[test]
diff --git a/rs/workspace-hack/Cargo.toml b/rs/workspace-hack/Cargo.toml
index b0e290810ca..ccb8acf9985 100644
--- a/rs/workspace-hack/Cargo.toml
+++ b/rs/workspace-hack/Cargo.toml
@@ -97,8 +97,8 @@ reqwest = { version = "0.13", default-features = false, features = ["gzip", "htt
 rustls = { version = "0.23", default-features = false, features = ["std", "tls12"] }
 rustls-pki-types = { version = "1", features = ["std"] }
 semver = { version = "1", features = ["serde"] }
-serde = { version = "1", features = ["alloc", "derive"] }
-serde_core = { version = "1", features = ["alloc"] }
+serde = { version = "1", features = ["alloc", "derive", "rc"] }
+serde_core = { version = "1", features = ["alloc", "rc"] }
 serde_json = { version = "1", features = ["preserve_order", "raw_value", "unbounded_depth"] }
 serde_spanned = { version = "1", default-features = false, features = ["serde", "std"] }
 serde_with = { version = "3", features = ["base64", "hex", "json"] }
@@ -211,8 +211,8 @@ reqwest = { version = "0.13", default-features = false, features = ["gzip", "htt
 rustls = { version = "0.23", default-features = false, features = ["std", "tls12"] }
 rustls-pki-types = { version = "1", features = ["std"] }
 semver = { version = "1", features = ["serde"] }
-serde = { version = "1", features = ["alloc", "derive"] }
-serde_core = { version = "1", features = ["alloc"] }
+serde = { version = "1", features = ["alloc", "derive", "rc"] }
+serde_core = { version = "1", features = ["alloc", "rc"] }
 serde_json = { version = "1", features = ["preserve_order", "raw_value", "unbounded_depth"] }
 serde_spanned = { version = "1", default-features = false, features = ["serde", "std"] }
 serde_with = { version = "3", features = ["base64", "hex", "json"] }
diff --git a/sh/gh/nightly.sh b/sh/gh/nightly.sh
index b4bd6fc31d4..f2b0e4e8862 100755
--- a/sh/gh/nightly.sh
+++ b/sh/gh/nightly.sh
@@ -140,6 +140,7 @@ case "$1" in
     # Keep added coverage out of the rust-bench and rust-shared legs.
     rust-extra)
         criterion qmux --manifest-path rs/qmux/Cargo.toml --bench receive
+        criterion msf -p moq-msf --bench catalog
         # The allocation/window/play-buffer/batch/receive-bursts tables keep their stdout in the run;
         # only Criterion estimates enter the trend report.
         criterion extra --no-fail-fast -p moq-crypto -p moq-json -p moq-archive -p moq-cli -p moq-mux -p moq-audio \

From c3ab5bfa903b3bdeb21d168882d0e7c31afcdca7 Mon Sep 17 00:00:00 2001
From: Luke Curley <kixelated@gmail.com>
Date: Thu, 5 Nov 2026 20:07:10 +0000
Subject: [PATCH 10/36] Agent build output can't fill the desktop's disk
 (#7960)

Co-authored-by: Grok 4.7 <noreply@x.ai>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 quest/m0/agent-disk-budget.md | 58 +++++++++--------------------------
 1 file changed, 14 insertions(+), 44 deletions(-)

diff --git a/quest/m0/agent-disk-budget.md b/quest/m0/agent-disk-budget.md
index 51a4748341d..cdadd17eb33 100644
--- a/quest/m0/agent-disk-budget.md
+++ b/quest/m0/agent-disk-budget.md
@@ -1,56 +1,26 @@
-# [S] Agent build output can't fill the desktop's disk
+# [XS] Agent build output can't fill the desktop's disk
 
 ## Goal
 
 The desktop host's agent checkouts reclaim their own build output, so parallel
 agent builds don't fill the root disk and nobody has to run `mbx clean` by
-hand. Done when a finished T3 or Claude Code checkout's managed target is
-reclaimed automatically, without touching a checkout whose owner is still
-using its outputs, and the PR records the free space over a busy day of
+hand. Done when the hourly cleaner from
+[kixelated/dotfiles#41](https://github.com/kixelated/dotfiles/pull/41) runs on
+the desktop and a PR records the root disk's free space over a busy day of
 parallel agents.
 
 ## Plan
 
-Planned 2026-11-04 with the maintainer, after the desktop's root disk filled
-three times on 2026-11-04: to 244 MB, then twice to 5-14 GB while ten iterate
-agents ran. Each time a human-run cleanup (`mbx gc`, `mbx clean`, worktree
-removal, nix gc) freed the space.
+The cleaner is built: it reclaims a checkout's managed mbx target once its T3
+thread, quest run, or Claude Code session has finished, and keeps anything live,
+unknown, or held open by a process. Its design and the read-only classification
+of 2026-11-05 (873 finished checkouts holding about 76.6 GiB of managed targets)
+are in [moq-dev/moq#7960](https://github.com/moq-dev/moq/pull/7960).
 
-What holds the space (measured 2026-11-04):
+Once it is installed, sample `df /` across a busy day, confirm
+`worktree-clean.service`'s journal shows reclaimed targets and no live checkout
+touched, and delete this quest in a PR recording both.
 
-- `~/.cache/mbx/targets` held 430 GiB of managed targets for about 420
-  checkouts, with single checkouts at 10-43 GiB. `mbx cache projects` attributes
-  nearly all of it to `~/worktrees/moq/t3-*` T3 thread worktrees, about 740 of
-  which existed. Cleaning the targets of those idle over six hours freed about
-  150 GiB.
-- The dotfiles `mbx/config.toml` sets `target.keep = ["/"]` and
-  `gc.min_free_size = "none"` on purpose (see dotfiles `docs/mbx.md`): a target
-  is kept while its checkout exists, because directly launched binaries hold no
-  mbx lease. So a target is only reclaimed when its checkout is removed.
-- Dotfiles' `worktree-clean.service` removes finished checkouts, but it runs
-  only when started by hand and scans `~/work`, `~/.codex/worktrees`,
-  `~/.worktrees` and `/tmp`, not `~/worktrees`, where T3 creates its checkouts.
-  Most T3 worktrees there sit at a base commit or an unmerged branch, so even
-  the merged-PR rule finds few: on 2026-11-04 only 2 of 742 were at a merged PR
-  head.
-- `docs/mbx.md` points quest repositories at `quest worktree` to reclaim
-  finished checkouts. It already keeps a per-user disk budget (`quest worktree
-  capacity`), runs commands supervised so it knows when a checkout's processes
-  stop, and removes a finished checkout without forcing. It manages the
-  checkouts it creates under `.worktrees/`: T3's bypass it, while Claude
-  Code's already go through `.claude/settings.json`'s `WorktreeCreate` and
-  `WorktreeRemove` hooks. Trace where finished Claude Code checkouts (such
-  as the 139 under `~/work/moq/.claude/worktrees` on 2026-11-04) leave their
-  targets before adding another cleaner; T3's need a new path either way.
+## Waiting
 
-The work lands mostly in [kixelated/dotfiles](https://github.com/kixelated/dotfiles)
-(cleaner scope, a schedule, mbx retention), and possibly in how T3 retires
-thread worktrees. Weigh routing T3's checkouts through `quest worktree`
-against extending the dotfiles cleaner. Keep the retention guarantee `docs/mbx.md` gives: never
-reclaim a target whose owner is still using it. Find the signal that a T3 or
-Claude Code checkout is finished (its thread or task ended, its PR merged or
-closed, no process using it) and reclaim on that, rather than on idle time
-alone. Also check `/tmp` test scratch, which filled the disk on 2026-11-04
-before the reboot.
-
-Public API: none. Wire: none.
+- Maintainer: merge and install [kixelated/dotfiles#41](https://github.com/kixelated/dotfiles/pull/41) on the desktop, since an agent session must not install over the live dotfiles or mass-delete targets; check that `systemctl --user list-timers` lists `worktree-clean.timer` with a last run that postdates the install.

From 3a07cacc1448e14e3323cc81604dfd0694efbf4b Mon Sep 17 00:00:00 2001
From: Luke Curley <kixelated@gmail.com>
Date: Thu, 5 Nov 2026 20:07:23 +0000
Subject: [PATCH 11/36] quest: plan audio language importers (#7964)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 quest/m2/README.md              |  2 ++
 quest/m2/hls-audio-languages.md | 38 +++++++++++++++++++++++++++++++
 quest/m2/import-lang-iso639.md  | 40 +++++++++++++++++++++++++++++++++
 3 files changed, 80 insertions(+)
 create mode 100644 quest/m2/hls-audio-languages.md
 create mode 100644 quest/m2/import-lang-iso639.md

diff --git a/quest/m2/README.md b/quest/m2/README.md
index cbfbba7a9ec..d745e0f675d 100644
--- a/quest/m2/README.md
+++ b/quest/m2/README.md
@@ -86,6 +86,8 @@ lite-07; bitrate enforcement is not part of this release.
 - [Shared group serving and ingest in JS](/quest/m2/shared-serve-js.md) - the same split in js/net, following the Rust seam
 - [Paired bench BASE](/quest/m2/bench-base-paired.md) - `just bench <base>` uses the nightly's paired comparison and the old one is deleted
 - [Audio renditions carry a language](/quest/m2/audio-lang.md) - audio renditions have an optional BCP-47 `lang`, and watch auto-picks within one language
+- [fMP4 and TS imports publish BCP-47 languages](/quest/m2/import-lang-iso639.md) - ISO 639-2 codes become `en`-style tags on audio and text
+- [HLS carries every audio language](/quest/m2/hls-audio-languages.md) - every `EXT-X-MEDIA` audio entry imports with its `LANGUAGE`, and exports write it back
 - [Receive pool](/quest/m2/receive-pool.md) - one byte budget per worker covers every connection's receive credit and the cache, billing each frame once
 - [Front parking](/quest/m2/origin-front-parks.md) - an unroutable request waits on a front instead of re-asking on every route-table move
 - [A refused follower asks a replacement handler](/quest/m2/follow-refused-retry.md) - a same-instance handler swap with identical route details re-asks a refused `Following`, while listeners still see no change
diff --git a/quest/m2/hls-audio-languages.md b/quest/m2/hls-audio-languages.md
new file mode 100644
index 00000000000..3a794725327
--- /dev/null
+++ b/quest/m2/hls-audio-languages.md
@@ -0,0 +1,38 @@
+# [M] HLS carries every audio language
+
+## Goal
+
+`moq import hls` publishes every `EXT-X-MEDIA` audio entry in the selected
+variant's audio group as its own audio rendition, with `lang` from `LANGUAGE`
+and `label` from `NAME`. The HLS and DASH exporters write those back as
+`LANGUAGE` and `lang`, so a multi-language source round-trips.
+
+## Plan
+
+Planned 2026-11-05 (maintainer, follow-up of
+[moq-dev/moq#7963](https://github.com/moq-dev/moq/pull/7963)). Today
+`select_audio` (`rs/moq-hls/src/import.rs`) keeps one entry from the group
+(`DEFAULT=YES`, else the first) and drops `LANGUAGE` and `NAME`; the master
+playlist exporter (`rs/moq-hls/src/export/master.rs`) and the MPD exporter
+(`export/mpd.rs`) write no language.
+
+Decided 2026-11-05 (maintainer): ✅ import every audio entry, each pulled as
+its own playlist, and write the language on export. Ingest then fetches
+every language's segments, which is the cost of carrying them. Not chosen:
+keeping single-audio import and only tagging the chosen entry.
+
+`LANGUAGE` is already BCP-47 per RFC 8216, so it passes through. An entry
+without a `URI` describes audio muxed into the variant: that muxed audio
+stays one rendition (`select_muxed()`), now tagged with the entry's
+`LANGUAGE` and `NAME`. A group mixing URI-less and URI-backed entries keeps
+the muxed audio and adds each URI-backed entry beside it, so the
+`self.audio` gate picks `select_video_only()` only when the group has no
+URI-less entry.
+
+Public API: none (the audio `label` field already exists). Wire: more
+audio renditions in the catalog, and audio `lang` and `label` now set from
+`LANGUAGE` and `NAME`.
+
+## Required
+
+- [Audio renditions carry a language](/quest/m2/audio-lang.md) - adds the audio `lang` field this fills in
diff --git a/quest/m2/import-lang-iso639.md b/quest/m2/import-lang-iso639.md
new file mode 100644
index 00000000000..acb165a861b
--- /dev/null
+++ b/quest/m2/import-lang-iso639.md
@@ -0,0 +1,40 @@
+# [S] fMP4 and TS imports publish BCP-47 languages
+
+## Goal
+
+`moq import` of fMP4 and TS sources sets `lang` (fMP4 audio and text, TS
+audio; TS imports publish no text renditions) to a BCP-47
+tag that browsers' `navigator.languages` can match: the ISO 639-1 code where
+one exists (`en`, not `eng`), else the three-letter code. `und` and absent
+codes leave `lang` unset.
+
+## Plan
+
+Planned 2026-11-05 (maintainer, follow-up of
+[moq-dev/moq#7963](https://github.com/moq-dev/moq/pull/7963)). fMP4 audio
+drops `mdhd.language`, and fMP4 text copies it raw
+(`rs/moq-mux/src/container/fmp4/import.rs`, `config.lang = Some(...)`), so
+text publishes `eng` and `und`. TS copies ISO_639_language_descriptor (0x0A)
+bytes only into the `mpegts` catalog extension
+(`rs/moq-mux/src/container/ts/catalog.rs`, parsed in `psi.rs`), and nothing
+reads a language from them.
+
+Decided 2026-11-05 (maintainer):
+
+- ✅ One quest for fMP4 and TS: both carry ISO 639-2 codes and share the
+  mapping. Not chosen: a quest per container.
+- ✅ Map with the `isolang` crate (both the /B and /T codes to 639-1, else
+  keep the three-letter code). `isolang` knows only 639-3 (= /T for these
+  codes), so the ~20 /B codes (`fre`, `ger`, `dut`, `chi`, ...) normalize to
+  /T through a small alias table first; an unmapped code never publishes a
+  /B form. An fMP4 `elng` box, already BCP-47, wins over `mdhd`; mp4-atom
+  0.17 does not decode `elng`, so this quest adds it to `Mdia` upstream. Not chosen: a hand-written table (data to keep correct), or
+  publishing codes raw and matching 639-2 in every player.
+
+Public API: none. Wire: fMP4 text `lang` changes from `eng` to `en` and
+from `und` to unset; fMP4 audio and TS audio `lang` become set where they
+were unset.
+
+## Required
+
+- [Audio renditions carry a language](/quest/m2/audio-lang.md) - adds the audio `lang` field this fills in

From f9142cacb58239fa76a0513cb31edce0199e878d Mon Sep 17 00:00:00 2001
From: Luke Curley <kixelated@gmail.com>
Date: Thu, 5 Nov 2026 20:10:06 +0000
Subject: [PATCH 12/36] feat(hang)!: catalog includes on the root timeline
 (#7943)

Co-authored-by: GPT-6.1 Sol <noreply@openai.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 doc/bin/hls.md                                |  14 +-
 doc/concept/hang.md                           |   2 +-
 drafts/draft-lcurley-moq-hang.md              |  38 ++--
 js/hang/api/catalog.api.md                    |  22 +-
 js/hang/src/catalog/consumer.test.ts          |  10 +-
 .../catalog/{contribution.ts => include.ts}   |  13 +-
 js/hang/src/catalog/index.ts                  |   6 +-
 js/hang/src/catalog/parity.test.ts            |   6 +-
 js/hang/src/catalog/root.test.ts              |  24 +-
 js/hang/src/catalog/root.ts                   |  10 +-
 js/hang/src/catalog/section.ts                |   4 +-
 js/watch/api/index.api.md                     |   2 +-
 js/watch/src/broadcast.ts                     |  18 +-
 .../{contribution.test.ts => include.test.ts} |  92 ++++----
 quest/m1/README.md                            |   1 -
 quest/m1/catalog-include.md                   |  41 ----
 rs/hang/fixtures/catalog-parity.json          |  14 +-
 rs/hang/src/catalog/consumer.rs               |  10 +-
 .../catalog/{contribution.rs => include.rs}   |  17 +-
 rs/hang/src/catalog/mod.rs                    |   4 +-
 rs/hang/src/catalog/root.rs                   |  56 ++---
 rs/moq-hls/Cargo.toml                         |   2 +-
 rs/moq-hls/MIGRATE.md                         |  10 +-
 .../benches/{contributions.rs => include.rs}  |  16 +-
 rs/moq-hls/src/export/driver.rs               |   4 +-
 .../export/{contributions.rs => include.rs}   |  54 ++---
 rs/moq-hls/src/export/master.rs               |   6 +-
 rs/moq-hls/src/export/mod.rs                  |  78 +++----
 rs/moq-hls/src/export/route.rs                |  56 ++---
 ...ontributions_tests.rs => include_tests.rs} | 209 ++++++++----------
 rs/moq-hls/src/server/mod.rs                  |   2 +-
 rs/moq-hls/src/server/routes.rs               |  13 +-
 sh/gh/nightly.sh                              |   2 +-
 33 files changed, 405 insertions(+), 451 deletions(-)
 rename js/hang/src/catalog/{contribution.ts => include.ts} (58%)
 rename js/watch/src/{contribution.test.ts => include.test.ts} (78%)
 delete mode 100644 quest/m1/catalog-include.md
 rename rs/hang/src/catalog/{contribution.rs => include.rs} (71%)
 rename rs/moq-hls/benches/{contributions.rs => include.rs} (87%)
 rename rs/moq-hls/src/export/{contributions.rs => include.rs} (85%)
 rename rs/moq-hls/src/server/{contributions_tests.rs => include_tests.rs} (76%)

diff --git a/doc/bin/hls.md b/doc/bin/hls.md
index 33f088adec9..4615307572b 100644
--- a/doc/bin/hls.md
+++ b/doc/bin/hls.md
@@ -56,7 +56,7 @@ What that means for you:
 
 - **The publisher declares the interval.** Only a broadcast whose catalog carries `media.join.interval` gets playlists. Rust publishers built on `moq-mux` (the CLI, the RTMP, SRT, and WebRTC gateways, and the native bindings) declare it: an encoder that knows its GOP passes it as a hint, and an ingest without one measures each track over its first second or group, whichever is longer, then declares the longest. `@moq/publish` declares its keyframe interval.
 - **Every rendition shares the grid.** A group spans from its first frame's timestamp to the next group's and belongs to the first grid line it contains, or, containing none, the line it starts after. Segment N therefore starts at the group containing N times the segment length, every rendition numbers its segments alike, and each cuts its boundaries at its own keyframes. A grid line no group starts a segment at, because a GOP ran past it or the content paused, is listed as an `EXT-X-GAP` so the numbering never skips: on a 2 s grid, a GOP from 0 to 7 s is segment 0, segments 1 and 2 are gaps, and the next GOP starts segment 3. Timestamps that go back start a discontinuity on that rendition alone; `EXT-X-PROGRAM-DATE-TIME`, written after every discontinuity when the catalog has a clock, lets players resync.
-- **Contribution media starts on selection.** The HTTP multivariant playlist reads each root `contributions` entry's catalog and lists its audio and video beside the broadcast's own. A contribution shares the broadcast's timeline: its renditions are segmented on the broadcast's join interval and clock, whatever its own catalog declares, so publish it on the same timestamps. One not yet routed is listed once its broadcast is announced. Reading its catalog starts no encoding: only a request to one of its rendition URLs subscribes to that rendition's media. Demand lasts through active responses and, after the last one finishes, for three target durations or the playlist window plus one target duration, whichever is longer (20 s by default); a later request starts it again. The broadcast's own renditions stay subscribed. A segment is servable for as long as the relay's [cache](/bin/relay/config#cache) retains it. Keep `--window` (the playlist length, default 16 s) within that retention and within the media's max age (30 s by default), after which a superseded segment's groups are stale.
+- **Include media starts on selection.** The HTTP multivariant playlist reads each root `include` entry's catalog and lists its audio and video beside the broadcast's own. An include shares the broadcast's timeline: its renditions are segmented on the broadcast's join interval and clock, whatever its own catalog declares, so publish it on the same timestamps. One not yet routed is listed once its broadcast is announced. Reading its catalog starts no encoding: only a request to one of its rendition URLs subscribes to that rendition's media. Demand lasts through active responses and, after the last one finishes, for three target durations or the playlist window plus one target duration, whichever is longer (20 s by default); a later request starts it again. The broadcast's own renditions stay subscribed. A segment is servable for as long as the relay's [cache](/bin/relay/config#cache) retains it. Keep `--window` (the playlist length, default 16 s) within that retention and within the media's max age (30 s by default), after which a superseded segment's groups are stale.
 - **Live joins cost the window.** The exporter subscribes 30 s behind the live edge and lists at most 256 segments. One joining partway through a segment lists nothing before the first segment it sees start.
 - **Segments are timed by the grid.** A segment is listed once a later one starts or the track ends. It starts at its first group's timestamp, or at its line when that group starts after it (as one resuming from a pause does), or a gap at its line, and lasts until the next segment starts, so a segment's bytes never change with a catalog estimate. A GOP longer than the segment is listed at its first line, so its duration understates its media.
 - **The target duration is twice the segment.** Every media playlist keeps one `EXT-X-TARGETDURATION` while its rendition stays in the catalog, even across a reconfigure: twice the segment length, rounded up to whole seconds (twice the interval for a GOP of a second or more, 2 s for 20 ms audio groups), since the GOP containing a grid line starts at most one interval before it, and a gap ends under two segment lengths after its line. Only a final GOP longer than that is listed past it, against RFC 8216's rule: hls.js plays it, but Apple's `mediastreamvalidator` flags it, so keep keyframe intervals within the declared interval.
@@ -65,13 +65,13 @@ What that means for you:
 - **URLs name the stream.** Every URL the multivariant playlist and DASH manifest list sits under `@<instance>`, the stream's instance, so every edge and every reload derive the same URLs and a CDN in front of export caches them. A restarted publisher gets URLs of its own, whose numbering starts over. The multivariant playlist and manifest switch to it at once, while the old stream's playlists end at the segments they listed before the switch, even if its publisher keeps sending; a player already on it plays those out and then has to reload the multivariant playlist. A stream that reached export over moq-lite-06 or older, or moq-transport, has an instance its session minted, so only that export serves its URLs.
 - **Only a clean finish ends a playlist.** `EXT-X-ENDLIST` and a `static` DASH manifest mean the media tracks finished, or, on a replaced stream's media playlists, that another publisher took the broadcast over. A rendition whose media track fails instead, such as a publisher dropping its session, answers HTTP 500 with `Cache-Control: no-store`, so a truncated recording never looks complete, and leaves the multivariant playlist and DASH manifest so players switch to a sibling. With none left, the DASH manifest answers the error too.
 
-Contribution URLs nest under the served broadcast's (see
-[`Contribution`](https://docs.rs/moq-hls/latest/moq_hls/export/struct.Contribution.html)), so
+Include URLs nest under the served broadcast's (see
+[`Include`](https://docs.rs/moq-hls/latest/moq_hls/export/struct.Include.html)), so
 access middleware sees the parent broadcast's path, while the server resolves each
-[contribution](/draft/moq-hang#contributions) through its own scoped origin and leaves out
-one it may not read. They follow contribution restarts unless the entry pins an `instance`;
-an unavailable contribution leaves the multivariant playlist until it returns. DASH and
-`--output` include only the broadcast's own renditions; record a contribution as its own
+[include](/draft/moq-hang#include) through its own scoped origin and leaves out
+one it may not read. They follow include restarts unless the entry pins an `instance`;
+an unavailable include leaves the multivariant playlist until it returns. DASH and
+`--output` include only the broadcast's own renditions; record an include as its own
 broadcast.
 
 A [broadcast archive](/concept/archives) is served the same
diff --git a/doc/concept/hang.md b/doc/concept/hang.md
index a7b9e77fbd4..c8ec33f8394 100644
--- a/doc/concept/hang.md
+++ b/doc/concept/hang.md
@@ -63,7 +63,7 @@ A few things the catalog can express beyond decoder config:
 
 - **Labels.** Any rendition may carry a human-readable `label` for a track picker. The map key stays the rendition's ID, so labels need not be unique and renaming one doesn't rename the track.
 - **Renditions in another broadcast.** A rendition may point at a relative broadcast path, so a transcoder can publish a ladder that adds low rungs and references the source's original rendition without re-publishing its bytes. The path resolves against where the consumer found the catalog, so a reference that escapes above the root names nothing and the catalog is rejected. `@moq/watch` and `moqsrc` follow a referenced path's announcements like their own, restarting the rendition on each instance that serves it; every other reader, such as `moq play`, the exporters, and the bindings, waits for the first one announced and keeps it, and an exporter ends the rendition with it. An optional `instance` beside the path names the [stream](/concept/moq-lite#publisher-instances) it expects: a route of another instance ends the rendition instead of falling back to it, while a route whose instance a session minted (one that crossed an older version) cannot prove one, so there it is best effort. Omit `instance` for a broadcast produced on demand, which has none until a worker answers; see [identity and recovery](/concept/identity).
-- **Whole contributions.** A root `contributions` map names whole broadcasts, such as each guest feed in a composed room, by the same relative path and optional `instance` as a rendition's reference. Listing one opens nothing, so a contribution produced on demand starts only once a viewer selects it, which `@moq/watch` does with `broadcast.contribution(effect, id)`. Its rendition IDs stay its own.
+- **Whole includes.** A root `include` map names whole broadcasts, such as transcoded renditions of the source, by the same relative path and optional `instance` as a rendition's reference. They share the listing catalog's PTS timeline and root settings, including its clock and join interval. Listing one opens nothing, so an include produced on demand starts only once a viewer selects it, which `@moq/watch` does with `broadcast.include(effect, id)`. Its rendition IDs stay its own.
 - **Track names.** The map key is a rendition's ID and, by default, its track name. A rendition sets `track` only when the two must differ, such as two renditions of same-named tracks in different broadcasts, or a rendition whose media changed and so needs a new name; readers subscribe to `track` when present. An ID can't name both a video and an audio rendition.
 - **Jitter.** A rendition can say how much media it writes behind a frame's timestamp, in whole milliseconds rounded up: the reorder delay of B-frames and the span of a fragment or batch written together. It is measured from media timestamps alone, never the time a frame was written, so neither a constant encoder delay nor a capture clock counts. It describes the publisher, never the network, only grows over the life of a stream, and a player sizes its buffer to at least this much. A `0` is read as absent.
 - **Delay.** A rendition can also say how far its frames' timestamps trail those another rendition already wrote, so a video encoder running 200 ms behind audio advertises `delay: 200` on video. A rendition alone measures none. It follows the same rules as jitter. A player holds the largest `delay + jitter` among the renditions it subscribes to, and never subtracts one rendition's `delay` from another's.
diff --git a/drafts/draft-lcurley-moq-hang.md b/drafts/draft-lcurley-moq-hang.md
index c8cf35e9acd..11a905b72f8 100644
--- a/drafts/draft-lcurley-moq-hang.md
+++ b/drafts/draft-lcurley-moq-hang.md
@@ -156,7 +156,7 @@ type Catalog = {
   "text": TextSchema | undefined,
   "json": JsonTracks | undefined,
   "binary": BinaryTracks | undefined,
-  "contributions": Record<string, {
+  "include": Record<string, {
     "broadcast": string,
     "instance": string | undefined,
   }> | undefined,
@@ -172,7 +172,7 @@ For example, a chat entry should name a chat track, not carry individual chat me
 This way catalog updates are rare and a client MAY choose to not subscribe.
 The `json` and `binary` sections ({{data}}) are how a track like that is listed.
 
-This specification defines audio, video, and text media tracks, an optional `media` section ({{media}}) holding the clock that maps content time to wall time and the interval a viewer can join on, the root `version` ({{catalog-version}}), the application data tracks in {{data}}, optional publisher statistics and solicited viewer feedback ({{media-stats}}), and whole broadcasts listed as `contributions` ({{contributions}}).
+This specification defines audio, video, and text media tracks, an optional `media` section ({{media}}) holding the clock that maps content time to wall time and the interval a viewer can join on, the root `version` ({{catalog-version}}), the application data tracks in {{data}}, optional publisher statistics and solicited viewer feedback ({{media-stats}}), and whole broadcasts listed in `include` ({{include}}).
 
 ## Version {#catalog-version}
 The root `version` field is the oldest draft of this specification that reads the catalog correctly, by draft number: `4` needs a consumer of moq-hang-04 or later.
@@ -188,7 +188,7 @@ This draft needs `version` 4 for:
 - a `track` ({{field-track}}) other than the entry's ID, which an older consumer subscribes to instead;
 - a video `warmup` ({{field-warmup}}) above zero, since an older consumer starts decoding a group at a picture that is not a keyframe.
 
-Every other catalog change in this draft is safe to ignore: `enabled` ({{field-enabled}}) leaves an older consumer selecting a disabled rendition, which plays nothing; `media` ({{media}}) only offers the clock and join interval, which an older consumer goes without; `stats` and `echo` ({{media-stats}}) only offer optional tracks; `contributions` ({{contributions}}) only offer broadcasts to open on selection; video `reorder` leaves an older consumer inferring decode times from timestamps; `jitter`, `delay`, audio `warmup`, and the data track estimates are hints.
+Every other catalog change in this draft is safe to ignore: `enabled` ({{field-enabled}}) leaves an older consumer selecting a disabled rendition, which plays nothing; `media` ({{media}}) only offers the clock and join interval, which an older consumer goes without; `stats` and `echo` ({{media-stats}}) only offer optional tracks; `include` ({{include}}) only offers broadcasts to open on selection; video `reorder` leaves an older consumer inferring decode times from timestamps; `jitter`, `delay`, audio `warmup`, and the data track estimates are hints.
 
 ## Media {#media}
 The catalog's root `media` field holds what applies to every audio and video track:
@@ -238,22 +238,25 @@ A group longer than the interval is an overrun, which an edge tolerates.
 A consumer that cannot decode `join`, including a zero `interval`, MUST treat it as absent.
 Nesting the interval under `join` leaves room for a later join mechanism that is not a fixed grid.
 
-## Contributions {#contributions}
-The optional root `contributions` map names whole broadcasts, such as each guest feed in a composed room, whose own catalogs describe their renditions.
-Each key is a contribution ID.
+## Includes {#include}
+The optional root `include` map names whole broadcasts, such as transcoded renditions of the source, whose own catalogs describe their renditions.
+Each key is an include ID.
 Each entry MUST contain a string `broadcast`, resolved against the catalog's broadcast as in {{field-broadcast}}, and MAY contain an `instance` as in {{field-instance}}.
 A consumer MUST reject a catalog with a malformed entry or a reference that escapes above the root.
 
-Listing an entry MUST NOT subscribe to the contribution: a consumer opens its catalog only when it selects the contribution or one of its renditions.
-An HLS master selects every contribution it lists, reading their catalogs to describe their renditions, but MUST NOT subscribe to their media until requested by a player.
-It segments a contribution's renditions on the listing catalog's `media` ({{media}}), whatever the contribution's own catalog declares.
+An include MUST share the listing catalog's PTS timeline and root settings, including its `media.clock` and `media.join.interval` ({{media}}).
+A consumer uses the listing catalog's settings without comparing the include's own settings; a mismatch is a publisher error.
+
+Listing an entry MUST NOT subscribe to the include: a consumer opens its catalog only when it selects the include or one of its renditions.
+An HLS master selects every include it lists, reading their catalogs to describe their renditions, but MUST NOT subscribe to their media until requested by a player.
+It segments an include's renditions on the listing catalog's `media` ({{media}}), whatever the include's own catalog declares.
 A publisher producing media on demand MUST answer its catalog without starting media production.
-A selected contribution resolves like a rendition's reference, under the same rules for `instance` and restarts ({{field-instance}}).
-A contribution produced on demand has no stream until it resolves, so a publisher omits its `instance` until then.
+A selected include resolves like a rendition's reference, under the same rules for `instance` and restarts ({{field-instance}}).
+An include produced on demand has no stream until it resolves, so a publisher omits its `instance` until then.
 
-A contribution's rendition IDs belong to its own catalog and MUST NOT replace IDs in the listing catalog, so the same ID MAY name a contribution, a rendition in the listing catalog, and a rendition in the contribution.
-An unavailable contribution does not invalidate the listing catalog.
-A consumer does not expand a contribution's own `contributions`: each needs a selection of its own.
+An include's rendition IDs belong to its own catalog and MUST NOT replace IDs in the listing catalog, so the same ID MAY name an include, a rendition in the listing catalog, and a rendition in the include.
+An unavailable include does not invalidate the listing catalog.
+A consumer does not expand an include's own `include`: each needs a selection of its own.
 
 ## Track Identity {#identity}
 A track name always means the same content, so a catalog update never redefines an audio or video track.
@@ -1096,7 +1099,7 @@ the broadcast path, not the payload. This track is distinct from an application'
 `hang/chat.json` snapshot extension.
 
 # Security Considerations
-A rendition's `broadcast` reference ({{field-broadcast}}), like a contribution's ({{contributions}}), resolves against the consumer's root, which is the subtree it is authorized for.
+A rendition's `broadcast` reference ({{field-broadcast}}), like an include's ({{include}}), resolves against the consumer's root, which is the subtree it is authorized for.
 Clamping a reference that escapes above that root would silently redirect the subscription to an unrelated broadcast, so a consumer rejects the catalog instead.
 
 TODO Security
@@ -1127,8 +1130,9 @@ This document has no IANA actions.
 - Added the optional video `preference` field: a consumer selects automatically among the highest preference it can decode.
 - Added the optional video `reorder` field: the most frames that can precede one in decode order and follow it in presentation, fixed for the track once declared. A consumer that authors decode times derives them from it and the current group alone, refusing deeper reordering; without it, a consumer infers them from timestamps.
 - Added an optional `instance` beside every rendition and data track `broadcast` reference ({{field-instance}}). A consumer reads each referenced path from the first broadcast it resolves for a catalog instance; a present `instance` fails a rendition that resolves another stream, and is best effort against an Instance a receiver minted.
-- Added the optional root `contributions` map ({{contributions}}): whole broadcasts named by a relative `broadcast` and an optional `instance`, opened only on selection, whose rendition IDs stay their own.
-- An HLS master selects the contributions it lists by reading their catalogs, without demanding media, and segments them on the listing catalog's `media`; an on-demand publisher answers its catalog without starting media production.
+- Added the optional root `include` map ({{include}}): whole broadcasts named by a relative `broadcast` and an optional `instance`, opened only on selection, whose rendition IDs stay their own.
+- Includes share the listing catalog's PTS timeline and root settings, including its clock and join interval.
+- An HLS master selects the includes it lists by reading their catalogs, without demanding media, and segments them on the listing catalog's `media`; an on-demand publisher answers its catalog without starting media production.
 - Added optional `stats` and `echo` catalog sections, publisher/viewer snapshots keyed by rendition ID, and the `.echo` feedback broadcast convention.
 - An Opus frame timestamp counts the OpusHead pre-skip: a consumer presents each decoded sample the pre-skip earlier than its frame timestamp places it.
 
diff --git a/js/hang/api/catalog.api.md b/js/hang/api/catalog.api.md
index 1c767ae7171..fe423896544 100644
--- a/js/hang/api/catalog.api.md
+++ b/js/hang/api/catalog.api.md
@@ -173,13 +173,6 @@ export const ContainerSchema: ZodMiniDefault<ZodMiniUnion<readonly [ZodMiniDiscr
 	kind: string;
 }>>]>>;
 
-export type Contribution = infer<typeof ContributionSchema>;
-
-export const ContributionSchema: ZodMiniObject<{
-	broadcast: ZodMiniType<RelativeBroadcast, string, $ZodTypeInternals<RelativeBroadcast, string>>;
-	instance: ZodMiniOptional<ZodMiniType<ReferenceInstance, string, $ZodTypeInternals<ReferenceInstance, string>>>;
-}, $strip>;
-
 export const DEFAULT_FORMAT: Format;
 
 export class DuplicateRendition extends Error {
@@ -204,6 +197,13 @@ export type Format = typeof FORMATS[number];
 
 export type Hex = infer<typeof hexSchema>;
 
+export type Include = infer<typeof IncludeSchema>;
+
+export const IncludeSchema: ZodMiniObject<{
+	broadcast: ZodMiniType<RelativeBroadcast, string, $ZodTypeInternals<RelativeBroadcast, string>>;
+	instance: ZodMiniOptional<ZodMiniType<ReferenceInstance, string, $ZodTypeInternals<ReferenceInstance, string>>>;
+}, $strip>;
+
 export const InstanceSchema: ZodMiniType<ReferenceInstance, string>;
 
 export type Join = infer<typeof JoinSchema>;
@@ -330,13 +330,13 @@ export const RootSchema: ZodMiniObject<{
 			track?: string | undefined;
 		}>, Record<string, unknown>>>;
 	}, $strip>, ZodMiniPipe<ZodMiniCustom<unknown, unknown>, ZodMiniTransform<undefined, unknown>>]>>;
-	contributions: ZodMiniOptional<ZodMiniPipe<ZodMiniCustom<Record<string, unknown>, Record<string, unknown>>, ZodMiniTransform<Record<string, {
-		broadcast: RelativeBroadcast;
-		instance?: ReferenceInstance | undefined;
-	}>, Record<string, unknown>>>>;
 	echo: ZodMiniOptional<ZodMiniUnion<readonly [ZodMiniObject<{
 		path: ZodMiniType<RelativeBroadcast, string, $ZodTypeInternals<RelativeBroadcast, string>>;
 	}, $strip>, ZodMiniPipe<ZodMiniCustom<unknown, unknown>, ZodMiniTransform<undefined, unknown>>]>>;
+	include: ZodMiniOptional<ZodMiniPipe<ZodMiniCustom<Record<string, unknown>, Record<string, unknown>>, ZodMiniTransform<Record<string, {
+		broadcast: RelativeBroadcast;
+		instance?: ReferenceInstance | undefined;
+	}>, Record<string, unknown>>>>;
 	json: ZodMiniOptional<ZodMiniUnion<readonly [ZodMiniObject<{
 		tracks: ZodMiniPipe<ZodMiniCustom<Record<string, unknown>, Record<string, unknown>>, ZodMiniTransform<Record<string, {
 			[x: string]: unknown;
diff --git a/js/hang/src/catalog/consumer.test.ts b/js/hang/src/catalog/consumer.test.ts
index 905ce6bc177..905f9c0ae94 100644
--- a/js/hang/src/catalog/consumer.test.ts
+++ b/js/hang/src/catalog/consumer.test.ts
@@ -46,11 +46,11 @@ test("the shared containment check covers every section carrying a broadcast ref
 		expect(checkResolvable(reference("../x"), base)).toBeDefined();
 	}
 
-	// A contribution is a whole broadcast, keyed directly under its section.
-	const contribution = (broadcast: string) =>
-		({ contributions: { entry: { broadcast: Moq.Path.normalizeRelative(broadcast) } } }) as Root;
-	expect(() => checkResolvable(contribution("../../x"), base)).toThrow(EscapingBroadcast);
-	expect(checkResolvable(contribution("../x"), base)).toBeDefined();
+	// An include is a whole broadcast, keyed directly under its section.
+	const include = (broadcast: string) =>
+		({ include: { entry: { broadcast: Moq.Path.normalizeRelative(broadcast) } } }) as Root;
+	expect(() => checkResolvable(include("../../x"), base)).toThrow(EscapingBroadcast);
+	expect(checkResolvable(include("../x"), base)).toBeDefined();
 });
 
 test("watch yields a catalog with many renditions", async () => {
diff --git a/js/hang/src/catalog/contribution.ts b/js/hang/src/catalog/include.ts
similarity index 58%
rename from js/hang/src/catalog/contribution.ts
rename to js/hang/src/catalog/include.ts
index 68368a85793..b59bf112e97 100644
--- a/js/hang/src/catalog/contribution.ts
+++ b/js/hang/src/catalog/include.ts
@@ -4,18 +4,21 @@ import { InstanceSchema, RelativeBroadcastSchema } from "./path";
 /**
  * A whole broadcast whose own catalog describes its renditions, listed without opening it.
  *
- * Listing one subscribes to nothing: a consumer opens the contribution's catalog only when it
+ * It shares the listing catalog's PTS timeline and root settings, including `media.clock` and
+ * `media.join.interval`; its own catalog's settings are ignored.
+ *
+ * Listing one subscribes to nothing: a consumer opens the include's catalog only when it
  * selects it, including an HLS master listing its renditions. An on-demand publisher answers
  * the catalog without starting media. Its rendition IDs belong to that broadcast, never the
  * listing catalog.
  */
-export const ContributionSchema = z.object({
-	// The contribution's broadcast, relative to the broadcast serving this catalog.
+export const IncludeSchema = z.object({
+	// The include's broadcast, relative to the broadcast serving this catalog.
 	broadcast: RelativeBroadcastSchema,
 	// The stream the reference names, with a rendition `instance`'s meaning. A composer leaves it
-	// out until the contribution resolves.
+	// out until the include resolves.
 	instance: z.optional(InstanceSchema),
 });
 
 /** A whole broadcast listed for explicit, lazy selection. */
-export type Contribution = z.infer<typeof ContributionSchema>;
+export type Include = z.infer<typeof IncludeSchema>;
diff --git a/js/hang/src/catalog/index.ts b/js/hang/src/catalog/index.ts
index e99954e9dbf..6ca97df89eb 100644
--- a/js/hang/src/catalog/index.ts
+++ b/js/hang/src/catalog/index.ts
@@ -2,8 +2,8 @@
  * JSON catalog schema and types describing a broadcast's tracks: audio/video decoder configs for
  * WebCodecs, container format, rendition layout, the `media` section (the broadcast's `clock` and
  * `join` interval),
- * plus the `json` and `binary` data sections, optional `stats` and `echo` discovery, and whole
- * `contributions` listed without opening them.
+ * plus the `json` and `binary` data sections, optional `stats` and `echo` discovery, and
+ * broadcasts listed in `include` without opening them.
  *
  * @module
  */
@@ -25,10 +25,10 @@ export { AudioConfigSchema, AudioSchema } from "./audio";
 export * from "./binary";
 export * from "./clock";
 export * from "./container";
-export * from "./contribution";
 export * from "./echo";
 export * from "./format";
 export * from "./hex";
+export * from "./include";
 export * from "./integers";
 export * from "./json";
 export * from "./media";
diff --git a/js/hang/src/catalog/parity.test.ts b/js/hang/src/catalog/parity.test.ts
index 9cb15ec7bfc..a33d90219a7 100644
--- a/js/hang/src/catalog/parity.test.ts
+++ b/js/hang/src/catalog/parity.test.ts
@@ -10,11 +10,11 @@ interface Case {
 	text?: string[];
 	json?: string[];
 	binary?: string[];
-	contributions?: string[];
+	include?: string[];
 }
 
 // The corpus rs/hang also loads: both languages accept the same catalogs and keep the same
-// rendition, data track, and contribution IDs, so a divergence fails CI on whichever side drifts.
+// rendition, data track, and include IDs, so a divergence fails CI on whichever side drifts.
 const cases = (await Bun.file(
 	new URL("../../../../rs/hang/fixtures/catalog-parity.json", import.meta.url),
 ).json()) as Case[];
@@ -35,6 +35,6 @@ for (const c of cases) {
 		expect(ids(root.text?.renditions)).toEqual(c.text ?? []);
 		expect(ids(root.json?.tracks)).toEqual(c.json ?? []);
 		expect(ids(root.binary?.tracks)).toEqual(c.binary ?? []);
-		expect(ids(root.contributions)).toEqual(c.contributions ?? []);
+		expect(ids(root.include)).toEqual(c.include ?? []);
 	});
 }
diff --git a/js/hang/src/catalog/root.test.ts b/js/hang/src/catalog/root.test.ts
index 1e8123f7cee..1abfc205ad0 100644
--- a/js/hang/src/catalog/root.test.ts
+++ b/js/hang/src/catalog/root.test.ts
@@ -54,7 +54,7 @@ test("rendition broadcast reference is parsed and normalized", () => {
 test("every reference-bearing section carries an optional instance", () => {
 	const INSTANCE = "01890a5d-ac96-774b-bcce-b302099a8057" as ReferenceInstance;
 	const catalog = (instance: string) => ({
-		contributions: { c: { broadcast: "./a", instance } },
+		include: { c: { broadcast: "./a", instance } },
 		video: {
 			renditions: {
 				v: { broadcast: "./a", instance, codec: "avc1.64001f", container: { kind: "legacy" } },
@@ -85,36 +85,36 @@ test("every reference-bearing section carries an optional instance", () => {
 	expect(parsed.text?.renditions.t?.instance).toBe(INSTANCE);
 	expect(parsed.json?.tracks.j?.instance).toBe(INSTANCE);
 	expect(parsed.binary?.tracks.b?.instance).toBe(INSTANCE);
-	expect(parsed.contributions?.c?.instance).toBe(INSTANCE);
+	expect(parsed.include?.c?.instance).toBe(INSTANCE);
 
 	// An empty instance refuses the catalog, as in Rust.
 	expect(RootSchema.safeParse(catalog("")).success).toBe(false);
 });
 
-// Mirrors Rust's `contributions_roundtrip_and_refuse_malformed_entries`.
-test("a contribution parses beside a same-ID rendition and a malformed one is refused", () => {
+// Mirrors Rust's `includes_roundtrip_and_refuse_malformed_entries`.
+test("an include parses beside a same-ID rendition and a malformed one is refused", () => {
 	const video = { alice: { codec: "avc1.64001f", container: { kind: "legacy" } } };
 	const parsed = RootSchema.parse({
-		contributions: { alice: { broadcast: "./alice.hang" } },
+		include: { alice: { broadcast: "./alice.hang" } },
 		video: { renditions: video },
 	});
-	expect(parsed.contributions?.alice).toEqual({ broadcast: "alice.hang" as RelativeBroadcast });
-	// Contribution IDs are their own namespace, so one may share a rendition's ID.
+	expect(parsed.include?.alice).toEqual({ broadcast: "alice.hang" as RelativeBroadcast });
+	// Include IDs are their own namespace, so one may share a rendition's ID.
 	expect(() => checkRenditions(parsed)).not.toThrow();
 	expect(encode(parsed).version).toBeUndefined();
 
-	for (const contributions of [
+	for (const include of [
 		[],
 		{ alice: null },
 		{ alice: {} },
 		{ alice: { broadcast: 42 } },
 		{ alice: { broadcast: "./alice.hang", instance: "" } },
 	]) {
-		expect(RootSchema.safeParse({ contributions }).success).toBe(false);
+		expect(RootSchema.safeParse({ include }).success).toBe(false);
 	}
-	// The issue names a contribution, not a rendition.
-	const refused = RootSchema.safeParse({ contributions: { alice: {} } });
-	expect(refused.error?.message).toContain("malformed contribution alice");
+	// The issue names an include, not a rendition.
+	const refused = RootSchema.safeParse({ include: { alice: {} } });
+	expect(refused.error?.message).toContain("malformed include alice");
 });
 
 test("rendition parent broadcast reference stays distinct from empty", () => {
diff --git a/js/hang/src/catalog/root.ts b/js/hang/src/catalog/root.ts
index b5c4a9fe29a..80f80eb11d4 100644
--- a/js/hang/src/catalog/root.ts
+++ b/js/hang/src/catalog/root.ts
@@ -4,9 +4,9 @@ import { Path } from "@moq/net";
 import * as z from "zod/mini";
 import { AudioSchema } from "./audio";
 import { BinarySchema } from "./binary";
-import { ContributionSchema } from "./contribution";
 import { EchoSchema } from "./echo";
 import { TRACK } from "./format";
+import { IncludeSchema } from "./include";
 import { JsonSchema } from "./json";
 import { MediaSchema } from "./media";
 import type { RelativeBroadcast } from "./path";
@@ -50,8 +50,8 @@ const VersionSchema = z.number().check(
  * to every audio and video track: the broadcast's `clock` (the one wall-clock mapping) and its
  * `join` interval. `json` and `binary` list application data tracks that aren't media. A section is omitted
  * when it holds no tracks. `stats` names the publisher's media snapshot track, `echo`
- * solicits viewer feedback under a relative broadcast prefix, and `contributions` lists whole
- * broadcasts without opening them.
+ * solicits viewer feedback under a relative broadcast prefix, and `include` lists whole
+ * broadcasts without opening them; each shares this catalog's PTS timeline and root settings.
  *
  * This is a *loose* object: unknown root sections pass through validation untouched, so an
  * application can add its own sections (e.g. `scte35`) without modifying hang. A base consumer
@@ -85,7 +85,7 @@ export const RootSchema = z.looseObject({
 	json: section(JsonSchema, "tracks"),
 	binary: section(BinarySchema, "tracks"),
 	// A new key, so a malformed entry fails the catalog, the same as Rust.
-	contributions: z.optional(renditions(ContributionSchema, "contribution")),
+	include: z.optional(renditions(IncludeSchema, "include")),
 });
 
 /** The root catalog object: the media sections, `media`, the data track sections, plus any app extensions. */
@@ -172,7 +172,7 @@ export function checkResolvable(root: Root, base: Moq.Path.Valid): Root {
 		root.text?.renditions,
 		root.json?.tracks,
 		root.binary?.tracks,
-		root.contributions,
+		root.include,
 	];
 	for (const section of sections) {
 		for (const { broadcast } of Object.values(section ?? {})) {
diff --git a/js/hang/src/catalog/section.ts b/js/hang/src/catalog/section.ts
index a6f0c1a15c8..b739c2944ad 100644
--- a/js/hang/src/catalog/section.ts
+++ b/js/hang/src/catalog/section.ts
@@ -35,7 +35,7 @@ export function section<T extends z.ZodMiniType>(schema: T, map: string) {
 }
 
 /**
- * A catalog map keyed by ID (renditions, data tracks, contributions), refusing the catalog if any
+ * A catalog map keyed by ID (renditions, data tracks, includes), refusing the catalog if any
  * entry is malformed.
  *
  * Each entry must parse with `schema`; the issue names the entry. An unknown container
@@ -43,7 +43,7 @@ export function section<T extends z.ZodMiniType>(schema: T, map: string) {
  * `deserialize_renditions`.
  *
  * @param schema - one entry's schema.
- * @param kind - what an entry is, naming it in the issue (`rendition`, `contribution`).
+ * @param kind - what an entry is, naming it in the issue (`rendition`, `include`).
  */
 export function renditions<T extends z.ZodMiniType>(schema: T, kind = "rendition") {
 	return z.pipe(
diff --git a/js/watch/api/index.api.md b/js/watch/api/index.api.md
index 14e18975ac4..707d73820c8 100644
--- a/js/watch/api/index.api.md
+++ b/js/watch/api/index.api.md
@@ -105,8 +105,8 @@ export namespace Audio {
 export class Broadcast {
 	constructor(props?: Signals.Inputs<BroadcastInput>);
 	close(): void;
-	contribution(effect: Signals.Effect, id: string): Broadcast;
 	readonly in: Signals.Readonlys<BroadcastInput>;
+	include(effect: Signals.Effect, id: string): Broadcast;
 	readonly out: Signals.Readonlys<BroadcastOutput>;
 }
 
diff --git a/js/watch/src/broadcast.ts b/js/watch/src/broadcast.ts
index ef63f0abde2..a71ab564d54 100644
--- a/js/watch/src/broadcast.ts
+++ b/js/watch/src/broadcast.ts
@@ -191,7 +191,7 @@ export class Broadcast {
 	// strands the filtered copy on the previous contents.
 	readonly #raw = new Signal<Catalog.Root | undefined>(undefined);
 
-	// Set only on a contribution: its broadcast resolves through the parent catalog's references,
+	// Set only on an include: its broadcast resolves through the parent catalog's references,
 	// so the two never resolve one path independently.
 	readonly #resolve = new Signal<((effect: Effect) => Moq.Broadcast.Consumer | undefined) | undefined>(undefined);
 
@@ -530,31 +530,31 @@ export class Broadcast {
 	}
 
 	/**
-	 * Select a whole contribution, opening its catalog only while the caller owns this effect.
+	 * Select a whole include, opening its catalog only while the caller owns this effect.
 	 *
-	 * Listing a contribution in the catalog opens nothing; this is the demand. The child tracks
+	 * Listing an include in the catalog opens nothing; this is the demand. The child tracks
 	 * the catalog entry and resolves through this broadcast's `relativeBroadcast`, sharing
-	 * its request: while following announcements it follows the contribution's restarts, and
+	 * its request: while following announcements it follows the include's restarts, and
 	 * otherwise it requests the first instance once. With an `instance` it is offline while its
 	 * broadcast resolves another stream. An absent entry leaves the child disabled, and an
-	 * unavailable contribution reads as offline. Its rendition IDs stay local to the child, so
+	 * unavailable include reads as offline. Its rendition IDs stay local to the child, so
 	 * they never shadow this catalog's IDs.
 	 *
 	 * ```ts
 	 * effects.run((effect) => {
-	 *   const child = broadcast.contribution(effect, "alice");
+	 *   const child = broadcast.include(effect, "alice");
 	 *   const source = new Video.Source({ broadcast: child, supported: Video.Decoder.supported });
 	 *   effect.cleanup(() => source.close());
 	 *   // Feed source into a decoder as with any broadcast.
 	 * });
 	 * ```
 	 */
-	contribution(effect: Effect, id: string): Broadcast {
+	include(effect: Effect, id: string): Broadcast {
 		// Each computed notifies only on a real change, so an update that leaves the child's path
 		// alone (such as a new `instance`) never restarts its catalog.
 		const entry = effect.computed((run) => {
-			const contributions = run.get(this.out.catalog)?.contributions;
-			return contributions && Object.hasOwn(contributions, id) ? contributions[id] : undefined;
+			const include = run.get(this.out.catalog)?.include;
+			return include && Object.hasOwn(include, id) ? include[id] : undefined;
 		});
 		const name = effect.computed((run) => {
 			// An empty reference is present: it names the catalog's own broadcast.
diff --git a/js/watch/src/contribution.test.ts b/js/watch/src/include.test.ts
similarity index 78%
rename from js/watch/src/contribution.test.ts
rename to js/watch/src/include.test.ts
index b87ead8372d..a8e1eab8973 100644
--- a/js/watch/src/contribution.test.ts
+++ b/js/watch/src/include.test.ts
@@ -35,20 +35,20 @@ async function unwanted(track: Track.Producer): Promise<void> {
 
 const video = (codec: string) => ({ codec, container: { kind: "legacy" as const } });
 
-it("opens a listed contribution only on selection, keeping its rendition IDs its own", async () => {
+it("opens a listed include only on selection, keeping its rendition IDs its own", async () => {
 	const origin = new Origin.Producer();
 	const parent = publish(origin, "room/main.hang");
-	const contribution = publish(origin, "room/extra.hang");
-	const contributionCatalog = contribution.createTrack(Catalog.TRACK);
-	const catalog = new Json.Snapshot.Producer<Catalog.Root>({ track: contributionCatalog, deltas: false });
+	const include = publish(origin, "room/extra.hang");
+	const includeCatalog = include.createTrack(Catalog.TRACK);
+	const catalog = new Json.Snapshot.Producer<Catalog.Root>({ track: includeCatalog, deltas: false });
 	parent.createTrack("video").writeFrame({ payload: new TextEncoder().encode("source frames") });
-	const contributionVideo = contribution.createTrack("video");
-	contributionVideo.writeFrame({ payload: new TextEncoder().encode("contribution frames") });
+	const includeVideo = include.createTrack("video");
+	includeVideo.writeFrame({ payload: new TextEncoder().encode("include frames") });
 
-	// The contribution and a source rendition share the ID "video".
+	// The include and a source rendition share the ID "video".
 	const root = Catalog.RootSchema.parse({
 		video: { renditions: { video: video("avc1.42001f") } },
-		contributions: { video: { broadcast: "./extra.hang" } },
+		include: { video: { broadcast: "./extra.hang" } },
 	});
 	const source = new Broadcast({
 		origin,
@@ -59,14 +59,14 @@ it("opens a listed contribution only on selection, keeping its rendition IDs its
 	const selection = new Effect();
 	try {
 		await settle();
-		expect(source.out.catalog.peek()?.contributions).toEqual(root.contributions);
+		expect(source.out.catalog.peek()?.include).toEqual(root.include);
 		// Listing the entry does not subscribe to its catalog.
-		expect(contributionCatalog.demand().wanted.peek()).toBeUndefined();
+		expect(includeCatalog.demand().wanted.peek()).toBeUndefined();
 
-		const child = source.contribution(selection, "video");
+		const child = source.include(selection, "video");
 		catalog.update({ value: { video: { renditions: { video: video("vp8") } } } });
 		await settle();
-		expect(contributionCatalog.demand().wanted.peek()).toBeDefined();
+		expect(includeCatalog.demand().wanted.peek()).toBeDefined();
 		expect(child.out.catalog.peek()?.video?.renditions.video?.codec).toBe("vp8");
 		expect(source.out.catalog.peek()?.video?.renditions.video?.codec).toBe("avc1.42001f");
 
@@ -81,7 +81,7 @@ it("opens a listed contribution only on selection, keeping its rendition IDs its
 			.ordered();
 		const original = source.relativeBroadcast(selection, undefined)?.track("video").subscribe().ordered();
 		try {
-			expect(await frames?.readString()).toBe("contribution frames");
+			expect(await frames?.readString()).toBe("include frames");
 			expect(await original?.readString()).toBe("source frames");
 		} finally {
 			frames?.close();
@@ -89,11 +89,11 @@ it("opens a listed contribution only on selection, keeping its rendition IDs its
 		}
 
 		// An unlisted ID leaves the child disabled.
-		expect(source.contribution(selection, "unknown").in.enabled.peek()).toBe(false);
+		expect(source.include(selection, "unknown").in.enabled.peek()).toBe(false);
 
 		selection.close();
-		await unwanted(contributionCatalog);
-		await unwanted(contributionVideo);
+		await unwanted(includeCatalog);
+		await unwanted(includeVideo);
 	} finally {
 		selection.close();
 		source.close();
@@ -101,7 +101,7 @@ it("opens a listed contribution only on selection, keeping its rendition IDs its
 	}
 });
 
-it("reads an unavailable contribution as offline without touching the parent", async () => {
+it("reads an unavailable include as offline without touching the parent", async () => {
 	const origin = new Origin.Producer();
 	publish(origin, "room/main.hang");
 	const claim = origin.requests(Path.from("room/absent.hang"));
@@ -112,19 +112,19 @@ it("reads an unavailable contribution as offline without touching the parent", a
 		catalogFormat: "manual",
 		catalog: Catalog.RootSchema.parse({
 			video: { renditions: { hd: video("avc1.42001f") } },
-			contributions: { missing: { broadcast: "./absent.hang" } },
+			include: { missing: { broadcast: "./absent.hang" } },
 		}),
 		follow: false,
 	});
 	const selection = new Effect();
 	try {
 		await settle();
-		const missing = source.contribution(selection, "missing");
+		const missing = source.include(selection, "missing");
 		const { value: request } = await requests.next();
 		expect(request?.path).toBe(Path.from("room/absent.hang"));
-		request?.reject(new Error("contribution unavailable"));
+		request?.reject(new Error("include unavailable"));
 		await settle();
-		// Like a rendition's reference, an unavailable contribution is offline, not an error.
+		// Like a rendition's reference, an unavailable include is offline, not an error.
 		expect(missing.out.active.peek()).toBeUndefined();
 		expect(missing.out.error.peek()).toBeUndefined();
 		expect(missing.out.status.peek()).toBe("offline");
@@ -138,7 +138,7 @@ it("reads an unavailable contribution as offline without touching the parent", a
 	}
 });
 
-it("reports a contribution outside the origin's scope as an error, leaving the parent live", async () => {
+it("reports an include outside the origin's scope as an error, leaving the parent live", async () => {
 	const origin = new Origin.Producer();
 	const scoped = origin.scope(Path.empty(), new Path.Patterns([Path.Pattern.parse("room/*")]));
 	publish(scoped, "room/main.hang");
@@ -146,12 +146,12 @@ it("reports a contribution outside the origin's scope as an error, leaving the p
 		origin: scoped,
 		name: Path.from("room/main.hang"),
 		catalogFormat: "manual",
-		catalog: Catalog.RootSchema.parse({ contributions: { outside: { broadcast: "../other/extra.hang" } } }),
+		catalog: Catalog.RootSchema.parse({ include: { outside: { broadcast: "../other/extra.hang" } } }),
 		follow: false,
 	});
 	const owner = new Effect();
 	try {
-		const child = parent.contribution(owner, "outside");
+		const child = parent.include(owner, "outside");
 		await settle();
 		expect(child.out.active.peek()).toBeUndefined();
 		expect(child.out.error.peek()?.message).toContain("outside the origin scope");
@@ -163,12 +163,12 @@ it("reports a contribution outside the origin's scope as an error, leaving the p
 	}
 });
 
-it("tracks the contribution entry without reopening it on unrelated catalog updates", async () => {
+it("tracks the include entry without reopening it on unrelated catalog updates", async () => {
 	const origin = new Origin.Producer();
 	publish(origin, "room/main.hang");
 	const firstCatalog = publish(origin, "room/first.hang").createTrack(Catalog.TRACK);
 	publish(origin, "room/second.hang");
-	const catalog = new Signal(Catalog.RootSchema.parse({ contributions: { extra: { broadcast: "./first.hang" } } }));
+	const catalog = new Signal(Catalog.RootSchema.parse({ include: { extra: { broadcast: "./first.hang" } } }));
 	const parent = new Broadcast({
 		origin,
 		name: Path.from("room/main.hang"),
@@ -178,7 +178,7 @@ it("tracks the contribution entry without reopening it on unrelated catalog upda
 	});
 	const owner = new Effect();
 	try {
-		const child = parent.contribution(owner, "extra");
+		const child = parent.include(owner, "extra");
 		await settle();
 		const active = child.out.active.peek();
 		expect(active?.path).toBe(Path.from("room/first.hang"));
@@ -193,7 +193,7 @@ it("tracks the contribution entry without reopening it on unrelated catalog upda
 		);
 		catalog.set(
 			Catalog.RootSchema.parse({
-				contributions: { extra: { broadcast: "./first.hang" }, other: { broadcast: "./other.hang" } },
+				include: { extra: { broadcast: "./first.hang" }, other: { broadcast: "./other.hang" } },
 				metadata: "changed",
 			}),
 		);
@@ -202,7 +202,7 @@ it("tracks the contribution entry without reopening it on unrelated catalog upda
 		expect(withdrawals).toBe(0);
 
 		// A changed path is a different reference, so the child follows it.
-		catalog.set(Catalog.RootSchema.parse({ contributions: { extra: { broadcast: "./second.hang" } } }));
+		catalog.set(Catalog.RootSchema.parse({ include: { extra: { broadcast: "./second.hang" } } }));
 		await settle();
 		expect(child.out.active.peek()?.path).toBe(Path.from("room/second.hang"));
 
@@ -228,7 +228,7 @@ it("follows a restarted contributor only for an entry that names no instance", a
 		name: Path.from("room/main.hang"),
 		catalogFormat: "manual",
 		catalog: Catalog.RootSchema.parse({
-			contributions: {
+			include: {
 				following: { broadcast: "./extra.hang" },
 				pinned: { broadcast: "./extra.hang", instance: oldInstance },
 			},
@@ -236,8 +236,8 @@ it("follows a restarted contributor only for an entry that names no instance", a
 	});
 	const owner = new Effect();
 	try {
-		const following = parent.contribution(owner, "following");
-		const pinned = parent.contribution(owner, "pinned");
+		const following = parent.include(owner, "following");
+		const pinned = parent.include(owner, "pinned");
 		await settle();
 		expect(following.out.active.peek()?.instance).toBe(oldInstance);
 		expect(pinned.out.active.peek()?.instance).toBe(oldInstance);
@@ -258,7 +258,7 @@ it("follows a restarted contributor only for an entry that names no instance", a
 	}
 });
 
-it("pins the first instance of a contribution when not following announcements", async () => {
+it("pins the first instance of an include when not following announcements", async () => {
 	const origin = new Origin.Producer();
 	publish(origin, "room/main.hang");
 	const first = publish(origin, "room/extra.hang", Instance.random());
@@ -266,12 +266,12 @@ it("pins the first instance of a contribution when not following announcements",
 		origin,
 		name: Path.from("room/main.hang"),
 		catalogFormat: "manual",
-		catalog: Catalog.RootSchema.parse({ contributions: { extra: { broadcast: "./extra.hang" } } }),
+		catalog: Catalog.RootSchema.parse({ include: { extra: { broadcast: "./extra.hang" } } }),
 		follow: false,
 	});
 	const owner = new Effect();
 	try {
-		const child = parent.contribution(owner, "extra");
+		const child = parent.include(owner, "extra");
 		await settle();
 		const pinned = child.out.active.peek();
 		expect(pinned?.path).toBe(Path.from("room/extra.hang"));
@@ -290,7 +290,7 @@ it("pins the first instance of a contribution when not following announcements",
 	}
 });
 
-it("never reads a contribution of another instance, but reads a minted one", async () => {
+it("never reads an include of another instance, but reads a minted one", async () => {
 	const origin = new Origin.Producer();
 	publish(origin, "room/main.hang");
 	const served = Instance.random();
@@ -299,14 +299,14 @@ it("never reads a contribution of another instance, but reads a minted one", asy
 	// A route over a wire that carries no instance has one its session minted.
 	publish(origin, "room/plain.hang", Instance.minted());
 	const named = Instance.random();
-	const contributions = (instance: Instance.Valid) =>
+	const include = (instance: Instance.Valid) =>
 		Catalog.RootSchema.parse({
-			contributions: {
+			include: {
 				proven: { broadcast: "./proven.hang", instance },
 				plain: { broadcast: "./plain.hang", instance: named },
 			},
 		});
-	const catalog = new Signal(contributions(named));
+	const catalog = new Signal(include(named));
 	const parent = new Broadcast({
 		origin,
 		name: Path.from("room/main.hang"),
@@ -316,8 +316,8 @@ it("never reads a contribution of another instance, but reads a minted one", asy
 	});
 	const owner = new Effect();
 	try {
-		const refused = parent.contribution(owner, "proven");
-		const accepted = parent.contribution(owner, "plain");
+		const refused = parent.include(owner, "proven");
+		const accepted = parent.include(owner, "plain");
 		await quietly(settle);
 		expect(refused.out.active.peek()).toBeUndefined();
 		expect(refused.out.error.peek()).toBeUndefined();
@@ -327,7 +327,7 @@ it("never reads a contribution of another instance, but reads a minted one", asy
 		expect(accepted.out.active.peek()?.path).toBe(Path.from("room/plain.hang"));
 
 		// A catalog update naming the served instance admits the stream the request already holds.
-		catalog.set(contributions(served));
+		catalog.set(include(served));
 		await settle();
 		expect(refused.out.active.peek()?.instance).toBe(served);
 	} finally {
@@ -344,7 +344,7 @@ it("shares the parent's resolution, so a new instance checks the held handle", a
 	const extraCatalog = publish(origin, "room/extra.hang", served).createTrack(Catalog.TRACK);
 	const entries = (instance?: Instance.Valid) =>
 		Catalog.RootSchema.parse({
-			contributions: {
+			include: {
 				sibling: { broadcast: "./extra.hang", instance },
 				self: { broadcast: "./main.hang", instance },
 				empty: { broadcast: "", instance },
@@ -360,15 +360,15 @@ it("shares the parent's resolution, so a new instance checks the held handle", a
 	});
 	const owner = new Effect();
 	try {
-		const sibling = parent.contribution(owner, "sibling");
-		const self = parent.contribution(owner, "self");
+		const sibling = parent.include(owner, "sibling");
+		const self = parent.include(owner, "self");
 		await settle();
 		const held = sibling.out.active.peek();
 		expect(held?.instance).toBe(served);
 		// A self-reference is the parent's own handle, not a request of its own. An empty one is
 		// too, and is named like the parent, so its own references resolve against the same base.
 		expect(self.out.active.peek()).toBe(parent.out.active.peek());
-		const empty = parent.contribution(owner, "empty");
+		const empty = parent.include(owner, "empty");
 		await settle();
 		expect(empty.in.name.peek()).toBe(Path.from("room/main.hang"));
 		expect(empty.in.enabled.peek()).toBe(true);
diff --git a/quest/m1/README.md b/quest/m1/README.md
index d759c4cbcd8..382b920ece0 100644
--- a/quest/m1/README.md
+++ b/quest/m1/README.md
@@ -172,7 +172,6 @@ their end report, so an embedder's drain alert pages on real cuts.
 - [Calibrate the paired nightly benchmarks](/quest/m1/bench-ci.md) - A/A and deliberately slowed Nightly runs set the paired comparison's threshold, so its regression alerts can be trusted
 - [moq-json's table/deltas bench measures the same work every iteration](/quest/m1/bench-json-deltas.md) - the `table/deltas/1%` cases stop flipping between snapshot and delta timings, so their trend history is usable
 - [Publish moq-bench to crates.io](/quest/m1/bench-publish.md) - `cargo install moq-bench` installs one binary, with the host sampler as `moq-bench host`, first as 0.1.0
-- [Catalog contributions become includes on the root's timeline](/quest/m1/catalog-include.md) - rename the unreleased `contributions` map before the cut and state that included broadcasts share the root's timeline
 - [Unbounded groups](/quest/m1/unbounded-groups/README.md) - groups and frames lose their size caps; a group keeps a 32 MB tail, and readers behind it replay through paced flights or refresh
 - [Session policy lives in moq-net](/quest/m1/session-policy/README.md) - accept and connect deadlines, admission, window widening and reconnect live once in moq-net; moq-tokio and moq-relay's io_uring path call them
 - [A replacement that fails before delivering never ends a live track](/quest/m1/route-swap-keeps-incumbent.md) - a route change whose replacement aborts before its first group leaves readers on the source that was serving
diff --git a/quest/m1/catalog-include.md b/quest/m1/catalog-include.md
deleted file mode 100644
index c34fa5c2529..00000000000
--- a/quest/m1/catalog-include.md
+++ /dev/null
@@ -1,41 +0,0 @@
-# [S] Catalog contributions become includes on the root's timeline
-
-## Goal
-
-The hang catalog's root `contributions` map is renamed to say what it is: other
-broadcasts the root includes, which share the root's PTS timeline and its
-catalog-root settings (clock, join interval). The rename covers the Rust and JS
-catalog types and schemas, `@moq/watch`'s `broadcast.contribution(effect, id)`,
-the parity fixture, `doc/concept/hang.md`, and the draft's
-`{#contributions}` section, with the shared-timeline rule stated in the draft.
-Done before the next release cut, while the field is still unreleased.
-
-## Plan
-
-Planned 2026-11-04 with the maintainer, while settling
-[moq-dev/moq#7836](https://github.com/moq-dev/moq/pull/7836)'s HLS listing.
-The maintainer: keep contributions; "consider renaming them. Afaik the
-use-case is moq.pro transcodes so they must share PTS and really everything in
-the catalog root. Its why I wanted to call the section `include` originally."
-
-- ✅ **Contributions stay** (maintainer, 2026-11-04). Not chosen: removing them.
-- ✅ **They share the root's timeline** (maintainer, 2026-11-04): consumers
-  such as moq-hls treat a contribution as on the root's PTS timeline and grid,
-  with no clock or interval comparison; a mismatch is the publisher's bug.
-  #7836 implements that for HLS.
-- **The name is the open decision.** `include` is the maintainer's original
-  preference; confirm it (or another) in this quest's PR before renaming, then
-  rename the field, the types (`Contribution`), the watch method and the draft
-  section consistently in Rust, JS and the bindings that expose them.
-- The field arrived in [moq-dev/moq#7312](https://github.com/moq-dev/moq/pull/7312)
-  (2026-11-01) and isn't on `release`, so no compatibility alias is needed and
-  the catalog `version` stays.
-- Update the HLS listing's code, landed in
-  [moq-dev/moq#7836](https://github.com/moq-dev/moq/pull/7836), to the new name.
-
-Public API: breaking but unreleased (Rust `hang`, `@moq/hang`, `@moq/watch`).
-Wire: the catalog JSON key changes; unreleased.
-
-## Related
-
-- [HLS lists contributions](https://github.com/moq-dev/moq/pull/7836) - the HLS consumer settled with the shared-timeline rule
diff --git a/rs/hang/fixtures/catalog-parity.json b/rs/hang/fixtures/catalog-parity.json
index 92cf1a0f078..c64baa31b66 100644
--- a/rs/hang/fixtures/catalog-parity.json
+++ b/rs/hang/fixtures/catalog-parity.json
@@ -3717,9 +3717,9 @@
 		"refused": true
 	},
 	{
-		"name": "contribution IDs are any string",
+		"name": "include IDs are any string",
 		"catalog": {
-			"contributions": {
+			"include": {
 				"": {
 					"broadcast": "./a.hang"
 				},
@@ -3734,12 +3734,12 @@
 				}
 			}
 		},
-		"contributions": ["", "__proto__", "constructor", "toString"]
+		"include": ["", "__proto__", "constructor", "toString"]
 	},
 	{
-		"name": "contribution malformed __proto__ refuses the catalog",
+		"name": "include malformed __proto__ refuses the catalog",
 		"catalog": {
-			"contributions": {
+			"include": {
 				"ok": {
 					"broadcast": "./a.hang"
 				},
@@ -3749,9 +3749,9 @@
 		"refused": true
 	},
 	{
-		"name": "contribution malformed bad refuses the catalog",
+		"name": "include malformed bad refuses the catalog",
 		"catalog": {
-			"contributions": {
+			"include": {
 				"__proto__": {
 					"broadcast": "./a.hang"
 				},
diff --git a/rs/hang/src/catalog/consumer.rs b/rs/hang/src/catalog/consumer.rs
index 20ac6b6768f..1a37fdf3d27 100644
--- a/rs/hang/src/catalog/consumer.rs
+++ b/rs/hang/src/catalog/consumer.rs
@@ -34,7 +34,7 @@ impl<E: DeserializeOwned + Default> Consumer<E> {
 	/// Get the next catalog update, or `None` when the track ends.
 	///
 	/// Fails with [`Error::EscapingBroadcast`](crate::Error::EscapingBroadcast) if any rendition's
-	/// `broadcast` reference, contribution, or echo prefix walks above the root. Such a reference names no broadcast, and the
+	/// `broadcast` reference, include, or echo prefix walks above the root. Such a reference names no broadcast, and the
 	/// root is the consumer's authorized subtree, so it is an attempt to reference content the
 	/// consumer cannot name. The whole catalog is rejected rather than the one rendition: a
 	/// publisher that emits one has a bug (or is hostile), and silently serving the rest hides
@@ -58,7 +58,7 @@ impl<E: DeserializeOwned + Default> Consumer<E> {
 	}
 }
 
-/// Reject the catalog if a track reference, contribution, or echo prefix walks above the root.
+/// Reject the catalog if a track reference, include, or echo prefix walks above the root.
 ///
 /// Every section carrying a relative broadcast path must be included here; a section left out
 /// silently exempts its paths from the containment check.
@@ -76,7 +76,7 @@ fn check_resolvable<E>(base: &Path, catalog: &Catalog<E>) -> Result<()> {
 		.chain(json.map(|(_, config)| config.broadcast.as_ref()))
 		.chain(binary.map(|(_, config)| config.broadcast.as_ref()))
 		.flatten()
-		.chain(catalog.contributions.values().map(|entry| &entry.broadcast))
+		.chain(catalog.include.values().map(|entry| &entry.broadcast))
 	{
 		if !rel.is_empty() && base.try_resolve(rel).is_none() {
 			return Err(crate::Error::EscapingBroadcast(rel.to_string()));
@@ -112,10 +112,10 @@ mod test {
 	}
 
 	#[test]
-	fn contributions_cannot_escape_the_root() {
+	fn includes_cannot_escape_the_root() {
 		let base = moq_net::Path::from_static("room/main.hang");
 		for (reference, accepted) in [("./alice.hang", true), ("../alice.hang", true), ("../../escape", false)] {
-			let json = serde_json::json!({ "contributions": { "alice": { "broadcast": reference } } }).to_string();
+			let json = serde_json::json!({ "include": { "alice": { "broadcast": reference } } }).to_string();
 			let catalog = Catalog::<()>::from_str(&json).unwrap();
 			match check_resolvable(&base, &catalog) {
 				Ok(()) => assert!(accepted, "{reference} must be refused"),
diff --git a/rs/hang/src/catalog/contribution.rs b/rs/hang/src/catalog/include.rs
similarity index 71%
rename from rs/hang/src/catalog/contribution.rs
rename to rs/hang/src/catalog/include.rs
index 823c4a546a5..5d7c893f421 100644
--- a/rs/hang/src/catalog/contribution.rs
+++ b/rs/hang/src/catalog/include.rs
@@ -2,18 +2,21 @@ use serde::{Deserialize, Serialize};
 
 /// A whole broadcast whose own catalog describes its renditions, listed without opening it.
 ///
-/// Listing one subscribes to nothing: a consumer opens the contribution's catalog only when it
+/// It shares the listing catalog's PTS timeline and root settings, including `media.clock` and
+/// `media.join.interval`; its own catalog's settings are ignored.
+///
+/// Listing one subscribes to nothing: a consumer opens the include's catalog only when it
 /// selects it, including an HLS master listing its renditions. An on-demand publisher answers
 /// the catalog without starting media. Its rendition IDs belong to that broadcast, never the
 /// listing catalog.
 ///
 /// Marked `#[non_exhaustive]` so optional fields can be added later. External callers build one
-/// with [`Contribution::new`].
+/// with [`Include::new`].
 #[serde_with::serde_as]
 #[derive(Serialize, Deserialize, Debug, Clone, PartialEq, Eq)]
 #[non_exhaustive]
-pub struct Contribution {
-	/// The contribution's broadcast, relative to the broadcast serving this catalog.
+pub struct Include {
+	/// The include's broadcast, relative to the broadcast serving this catalog.
 	///
 	/// Resolve it with [`Path::try_resolve`](moq_net::Path::try_resolve): a reference that walks
 	/// above the root names no broadcast, so the catalog is rejected.
@@ -21,14 +24,14 @@ pub struct Contribution {
 
 	/// The stream the reference names, with a rendition `instance`'s meaning: a route of another
 	/// instance refuses it, and against one a relay minted it is best effort. A composer leaves it
-	/// out until the contribution resolves.
+	/// out until the include resolves.
 	#[serde(default, skip_serializing_if = "Option::is_none")]
 	#[serde_as(as = "Option<serde_with::DisplayFromStr>")]
 	pub instance: Option<moq_net::Instance>,
 }
 
-impl Contribution {
-	/// A contribution at `broadcast`, accepting whichever stream resolves.
+impl Include {
+	/// An include at `broadcast`, accepting whichever stream resolves.
 	pub fn new(broadcast: impl Into<moq_net::path::Relative>) -> Self {
 		Self {
 			broadcast: broadcast.into(),
diff --git a/rs/hang/src/catalog/mod.rs b/rs/hang/src/catalog/mod.rs
index 8d792d033dc..634bf60a76e 100644
--- a/rs/hang/src/catalog/mod.rs
+++ b/rs/hang/src/catalog/mod.rs
@@ -10,9 +10,9 @@ mod binary;
 mod clock;
 mod consumer;
 mod container;
-mod contribution;
 mod echo;
 mod hex;
+mod include;
 mod json;
 mod m2ts;
 mod media;
@@ -30,8 +30,8 @@ pub use binary::*;
 pub use clock::*;
 pub use consumer::*;
 pub use container::*;
-pub use contribution::*;
 pub use echo::*;
+pub use include::*;
 pub use json::*;
 pub use m2ts::*;
 pub use media::*;
diff --git a/rs/hang/src/catalog/root.rs b/rs/hang/src/catalog/root.rs
index 495fda5738b..cbac094b9ca 100644
--- a/rs/hang/src/catalog/root.rs
+++ b/rs/hang/src/catalog/root.rs
@@ -12,7 +12,7 @@ use serde::{Deserialize, Serialize};
 /// section (the broadcast's one wall-clock mapping and join interval), the data sections
 /// (`json`, `binary`) for application tracks that aren't media, and the optional `m2ts` (a
 /// transport stream carried whole), plus `stats` naming the publisher's media snapshot track and
-/// `echo` soliciting viewer feedback under a relative broadcast prefix, and `contributions` naming
+/// `echo` soliciting viewer feedback under a relative broadcast prefix, and `include` naming
 /// whole broadcasts for explicit selection.
 /// Applications extend it with their own root sections (e.g. `scte35`) through `E`. The catalog
 /// does not deny unknown fields, so a base consumer ignores the extra sections and an extended
@@ -85,11 +85,13 @@ pub struct Catalog<E = ()> {
 	/// An `echo` value without a string `path` decodes as absent, the same as [`stats`](Self::stats).
 	pub echo: Option<crate::catalog::Echo>,
 
-	/// Whole broadcasts listed for explicit, lazy selection, keyed by contribution ID.
+	/// Whole broadcasts listed for explicit, lazy selection, keyed by include ID.
 	///
-	/// Listing one subscribes to nothing; see [`Contribution`](crate::catalog::Contribution).
+	/// Each shares this catalog's PTS timeline and root settings, including `media.clock` and
+	/// `media.join.interval`; its own settings are ignored. Listing one subscribes to nothing;
+	/// see [`Include`](crate::catalog::Include).
 	/// Omitted from the wire when empty. A malformed entry refuses the catalog.
-	pub contributions: std::collections::BTreeMap<String, crate::catalog::Contribution>,
+	pub include: std::collections::BTreeMap<String, crate::catalog::Include>,
 
 	/// Application-defined root sections, flattened alongside the base catalog sections.
 	///
@@ -166,7 +168,7 @@ struct Wire<E> {
 	echo: Option<crate::catalog::Echo>,
 
 	#[serde(default, skip_serializing_if = "std::collections::BTreeMap::is_empty")]
-	contributions: std::collections::BTreeMap<String, crate::catalog::Contribution>,
+	include: std::collections::BTreeMap<String, crate::catalog::Include>,
 
 	#[serde(flatten, serialize_with = "serialize_ext")]
 	ext: E,
@@ -202,7 +204,7 @@ impl<E> From<Wire<E>> for Catalog<E> {
 			m2ts,
 			stats,
 			echo,
-			contributions,
+			include,
 			ext,
 		} = wire;
 		Self {
@@ -215,7 +217,7 @@ impl<E> From<Wire<E>> for Catalog<E> {
 			m2ts,
 			stats,
 			echo,
-			contributions,
+			include,
 			ext,
 		}
 	}
@@ -441,11 +443,11 @@ mod test {
 		#[serde(default)]
 		binary: Vec<String>,
 		#[serde(default)]
-		contributions: Vec<String>,
+		include: Vec<String>,
 	}
 
 	/// The corpus `js/hang` also loads: both languages accept the same catalogs and keep the same
-	/// rendition, data track, and contribution IDs, so a divergence fails CI on whichever side drifts.
+	/// rendition, data track, and include IDs, so a divergence fails CI on whichever side drifts.
 	#[test]
 	fn shared_parity_fixtures() {
 		let cases: Vec<ParityCase> = serde_json::from_str(include_str!("../../fixtures/catalog-parity.json")).unwrap();
@@ -465,18 +467,18 @@ mod test {
 					let text: Vec<_> = catalog.text.renditions.keys().cloned().collect();
 					let json: Vec<_> = catalog.json.tracks.keys().cloned().collect();
 					let binary: Vec<_> = catalog.binary.tracks.keys().cloned().collect();
-					let contributions: Vec<_> = catalog.contributions.keys().cloned().collect();
-					if (&video, &audio, &text, &json, &binary, &contributions)
+					let include: Vec<_> = catalog.include.keys().cloned().collect();
+					if (&video, &audio, &text, &json, &binary, &include)
 						!= (
 							&case.video,
 							&case.audio,
 							&case.text,
 							&case.json,
 							&case.binary,
-							&case.contributions,
+							&case.include,
 						) {
 						failures.push(format!(
-							"{}: kept video {video:?} audio {audio:?} text {text:?} json {json:?} binary {binary:?} contributions {contributions:?}",
+							"{}: kept video {video:?} audio {audio:?} text {text:?} json {json:?} binary {binary:?} include {include:?}",
 							case.name
 						));
 					}
@@ -537,28 +539,28 @@ mod test {
 		assert_eq!(Catalog::<()>::from_str(&catalog.to_json().unwrap()).unwrap(), catalog);
 	}
 
-	/// A contribution round-trips, stays off the wire when none is listed, and a malformed entry
+	/// An include round-trips, stays off the wire when none is listed, and a malformed entry
 	/// refuses the catalog rather than being dropped.
 	#[test]
-	fn contributions_roundtrip_and_refuse_malformed_entries() {
-		let json = r#"{"contributions":{"alice":{"broadcast":"./alice.hang"}},"video":{"renditions":{"alice":{"codec":"avc1.64001f","container":{"kind":"legacy"}}}}}"#;
+	fn includes_roundtrip_and_refuse_malformed_entries() {
+		let json = r#"{"include":{"alice":{"broadcast":"./alice.hang"}},"video":{"renditions":{"alice":{"codec":"avc1.64001f","container":{"kind":"legacy"}}}}}"#;
 		let catalog = Catalog::<()>::from_str(json).unwrap();
 		assert_eq!(
-			catalog.contributions["alice"],
-			crate::catalog::Contribution::new(moq_net::path::Relative::new("./alice.hang").unwrap())
+			catalog.include["alice"],
+			crate::catalog::Include::new(moq_net::path::Relative::new("./alice.hang").unwrap())
 		);
-		// Contribution IDs are their own namespace, so one may share a rendition's ID.
+		// Include IDs are their own namespace, so one may share a rendition's ID.
 		assert!(catalog.check_renditions().is_ok());
 		assert!(catalog.video.renditions.contains_key("alice"));
 		assert_eq!(Catalog::<()>::from_str(&catalog.to_json().unwrap()).unwrap(), catalog);
-		assert!(!Catalog::<()>::default().to_json().unwrap().contains("contributions"));
+		assert!(!Catalog::<()>::default().to_json().unwrap().contains("include"));
 
 		for bad in [
-			r#"{"contributions":[]}"#,
-			r#"{"contributions":{"alice":null}}"#,
-			r#"{"contributions":{"alice":{}}}"#,
-			r#"{"contributions":{"alice":{"broadcast":42}}}"#,
-			r#"{"contributions":{"alice":{"broadcast":"./alice.hang","instance":""}}}"#,
+			r#"{"include":[]}"#,
+			r#"{"include":{"alice":null}}"#,
+			r#"{"include":{"alice":{}}}"#,
+			r#"{"include":{"alice":{"broadcast":42}}}"#,
+			r#"{"include":{"alice":{"broadcast":"./alice.hang","instance":""}}}"#,
 		] {
 			assert!(Catalog::<()>::from_str(bad).is_err(), "{bad} must be refused");
 		}
@@ -572,7 +574,7 @@ mod test {
 		const INSTANCE: &str = "01890a5d-ac96-774b-bcce-b302099a8057";
 		let encoded = format!(
 			r#"{{
-				"contributions": {{"c": {{"broadcast": "./a", "instance": "{INSTANCE}"}}}},
+				"include": {{"c": {{"broadcast": "./a", "instance": "{INSTANCE}"}}}},
 				"video": {{"renditions": {{"v": {{"broadcast": "./a", "instance": "{INSTANCE}", "codec": "avc1.64001f", "container": {{"kind": "legacy"}}}}}}}},
 				"audio": {{"renditions": {{"a": {{"broadcast": "./a", "instance": "{INSTANCE}", "codec": "opus", "sampleRate": 48000, "numberOfChannels": 2, "container": {{"kind": "legacy"}}}}}}}},
 				"text": {{"renditions": {{"t": {{"broadcast": "./a", "instance": "{INSTANCE}", "format": "vtt"}}}}}},
@@ -592,7 +594,7 @@ mod test {
 		for reference in references {
 			assert_eq!(reference.instance(), Some(&instance));
 		}
-		assert_eq!(catalog.contributions["c"].instance.as_ref(), Some(&instance));
+		assert_eq!(catalog.include["c"].instance.as_ref(), Some(&instance));
 		assert_eq!(Catalog::<()>::from_str(&catalog.to_json().unwrap()).unwrap(), catalog);
 
 		// Omitted stays omitted, and an empty instance refuses the catalog.
diff --git a/rs/moq-hls/Cargo.toml b/rs/moq-hls/Cargo.toml
index 61f2365a1da..8e85e323b2d 100644
--- a/rs/moq-hls/Cargo.toml
+++ b/rs/moq-hls/Cargo.toml
@@ -59,7 +59,7 @@ tracing-test = { workspace = true }
 workspace-hack = { path = "../workspace-hack" }
 
 [[bench]]
-name = "contributions"
+name = "include"
 harness = false
 required-features = ["server"]
 
diff --git a/rs/moq-hls/MIGRATE.md b/rs/moq-hls/MIGRATE.md
index 3b2877431ee..cd78e16c76d 100644
--- a/rs/moq-hls/MIGRATE.md
+++ b/rs/moq-hls/MIGRATE.md
@@ -16,15 +16,15 @@ and `poll_ready`, `Rendition::poll_playable`, and `poll_next` on the `renditions
 `segments::Consumer` cursors. A `segments::Consumer::next` dropped mid-fetch leaves that fetch to the
 next call, which resumes it rather than starting over.
 
-### HTTP HLS lists contributions without starting their media
+### HTTP HLS lists includes without starting their media
 
-`Server` follows the root catalog's contributions and lists their renditions from their
-catalogs, on the root catalog's join interval and clock. Contribution media starts
+`Server` follows the root catalog's includes and lists their renditions from their
+catalogs, on the root catalog's join interval and clock. Include media starts
 only when requested and stops once responses finish and it idles for the longer of three
 target durations and the playlist window plus one target duration.
 Their URLs include both instances:
-`@{instance}/contribution/{id}/{kind}/{rendition}/@{contribution-instance}/...`.
-`Route::contribution` identifies that contribution; `Resource::instance` still names the
+`@{instance}/include/{id}/{kind}/{rendition}/@{include-instance}/...`.
+`Route::include` identifies that include; `Resource::instance` still names the
 parent broadcast's instance. Embedders using `Server::respond` need no routing change.
 DASH, `Broadcaster::new`, and the recorder cursor continue serving the broadcast's own
 renditions only.
diff --git a/rs/moq-hls/benches/contributions.rs b/rs/moq-hls/benches/include.rs
similarity index 87%
rename from rs/moq-hls/benches/contributions.rs
rename to rs/moq-hls/benches/include.rs
index c8c22bdb77b..7ca1990666a 100644
--- a/rs/moq-hls/benches/contributions.rs
+++ b/rs/moq-hls/benches/include.rs
@@ -1,11 +1,11 @@
-//! Master rendering and one contribution lookup, swept over contributions x renditions.
+//! Master rendering and one include lookup, swept over includes x renditions.
 //! The catalogs have no media, so setup also verifies that listing does not need an encode.
 
 use std::hint::black_box;
 use std::time::Duration;
 
 use criterion::{BenchmarkId, Criterion, criterion_group, criterion_main};
-use hang::catalog::{Contribution, Join, VideoCodec, VideoConfig};
+use hang::catalog::{Include, Join, VideoCodec, VideoConfig};
 use moq_hls::{Server, export::Route};
 use moq_mux::catalog::hang::Catalog;
 
@@ -23,12 +23,12 @@ fn publish_catalog(
 	producer
 }
 
-fn contributions(c: &mut Criterion) {
+fn include(c: &mut Criterion) {
 	let runtime = tokio::runtime::Builder::new_current_thread()
 		.enable_all()
 		.build()
 		.unwrap();
-	let mut group = c.benchmark_group("hls/contributions");
+	let mut group = c.benchmark_group("hls/include");
 	for count in [1, 8, 64] {
 		for renditions in [1, 4, 16] {
 			let (server, broadcaster, route, _publications, _catalogs, _origin) = runtime.block_on(async {
@@ -56,9 +56,9 @@ fn contributions(c: &mut Criterion) {
 						.announce(moq_net::origin::Route::default().with_instance(instance, 0))
 						.unwrap();
 					publications.push(broadcast);
-					root.contributions.insert(
+					root.include.insert(
 						id.clone(),
-						Contribution::new(moq_net::path::Relative::new(&format!("./{id}")).unwrap()),
+						Include::new(moq_net::path::Relative::new(&format!("./{id}")).unwrap()),
 					);
 				}
 				let parent = moq_net::Instance::random();
@@ -79,7 +79,7 @@ fn contributions(c: &mut Criterion) {
 				.await
 				.expect("every catalog is listed without media");
 				let route = Route::parse(&format!(
-					"/room/live/@{parent}/contribution/c0/video/missing/@{}/media.m3u8",
+					"/room/live/@{parent}/include/c0/video/missing/@{}/media.m3u8",
 					first.unwrap()
 				))
 				.unwrap();
@@ -100,5 +100,5 @@ fn contributions(c: &mut Criterion) {
 	group.finish();
 }
 
-criterion_group!(benches, contributions);
+criterion_group!(benches, include);
 criterion_main!(benches);
diff --git a/rs/moq-hls/src/export/driver.rs b/rs/moq-hls/src/export/driver.rs
index abbbdf20005..17e7e668879 100644
--- a/rs/moq-hls/src/export/driver.rs
+++ b/rs/moq-hls/src/export/driver.rs
@@ -12,7 +12,7 @@ use std::task::Poll;
 /// Dropping it early stops all of that work.
 #[must_use = "the broadcaster does nothing until its driver runs"]
 pub struct Driver {
-	/// The catalog watchers, the broadcast's and each contribution's, polled before the other
+	/// The catalog watchers, the broadcast's and each include's, polled before the other
 	/// tasks in every pass: a reconfigure must retire its rendition before that rendition's
 	/// watcher reads groups published after it.
 	leads: kio::Tasks<Job>,
@@ -155,7 +155,7 @@ impl kio::Task for Job {
 mod tests {
 	use super::*;
 
-	/// A lead a spawner starts, such as a contribution's catalog watcher, runs before the tasks
+	/// A lead a spawner starts, such as an include's catalog watcher, runs before the tasks
 	/// started ahead of it.
 	#[test]
 	fn spawned_leads_run_first() {
diff --git a/rs/moq-hls/src/export/contributions.rs b/rs/moq-hls/src/export/include.rs
similarity index 85%
rename from rs/moq-hls/src/export/contributions.rs
rename to rs/moq-hls/src/export/include.rs
index a0c35d66f1f..6cdcfae29a1 100644
--- a/rs/moq-hls/src/export/contributions.rs
+++ b/rs/moq-hls/src/export/include.rs
@@ -1,11 +1,11 @@
-//! Catalog-only contribution discovery for the HTTP HLS master.
+//! Catalog-only include discovery for the HTTP HLS master.
 
 use std::collections::BTreeMap;
 use std::sync::Arc;
 use std::task::{Poll, ready};
 use std::time::Duration;
 
-use hang::catalog::{Contribution, Media};
+use hang::catalog::{Include, Media};
 use moq_mux::{catalog::hang::Catalog, follow};
 
 #[cfg(feature = "server")]
@@ -23,7 +23,7 @@ struct Context {
 	origin: moq_net::origin::Consumer,
 	window: Duration,
 	spawner: driver::Spawner,
-	/// The root catalog's `media`. A contribution is included in the root broadcast, so its
+	/// The root catalog's `media`. An include is part of the root broadcast, so its
 	/// renditions share the root's timeline and segment on the root's grid.
 	root: kio::Producer<Media>,
 }
@@ -34,7 +34,7 @@ struct State {
 }
 
 struct Entry {
-	reference: Contribution,
+	reference: Include,
 	current: kio::Producer<Current>,
 	_owner: Option<driver::Owner>,
 }
@@ -88,8 +88,8 @@ impl Producer {
 		}
 		state
 			.entries
-			.retain(|id, entry| catalog.contributions.get(id) == Some(&entry.reference));
-		for (id, reference) in &catalog.contributions {
+			.retain(|id, entry| catalog.include.get(id) == Some(&entry.reference));
+		for (id, reference) in &catalog.include {
 			if state.entries.contains_key(id) || !master::is_path_segment(id) {
 				continue;
 			}
@@ -117,7 +117,7 @@ impl Producer {
 		}
 	}
 
-	/// Stop following every contribution for good. Closing the state under the same lock
+	/// Stop following every include for good. Closing the state under the same lock
 	/// makes this terminal: a [`sync`](Self::sync) racing past its catalog await finds the
 	/// state closed and cannot re-add entries or spawn follow tasks.
 	pub fn clear(&self) {
@@ -179,7 +179,7 @@ impl Producer {
 				{
 					continue;
 				}
-				let uri = master::contribution_uri(parent, id, &instance.id, &rendition, query);
+				let uri = master::include_uri(parent, id, &instance.id, &rendition, query);
 				match rendition.kind {
 					Kind::Video => video.push(master::VideoVariant {
 						uri,
@@ -206,7 +206,7 @@ impl Producer {
 	pub fn poll_rendition(
 		&self,
 		waiter: &kio::Waiter,
-		at: &super::route::Contribution,
+		at: &super::route::Include,
 		kind: Kind,
 		name: &str,
 	) -> Poll<crate::Result<Option<Arc<Rendition>>>> {
@@ -231,7 +231,7 @@ impl Producer {
 	}
 }
 
-/// Follows a contribution's instances into its [`Current`], watching each one's catalog.
+/// Follows an include's instances into its [`Current`], watching each one's catalog.
 struct FollowInstances {
 	instances: follow::Instances,
 	current: kio::Producer<Current>,
@@ -256,7 +256,7 @@ impl kio::Task for FollowInstances {
 					let owner = self.context.spawner.lead(super::WatchCatalog::new(
 						source,
 						renditions.clone(),
-						super::Role::Contribution(self.context.root.consume()),
+						super::Role::Include(self.context.root.consume()),
 					));
 					Current::Online(Arc::new(Instance {
 						id,
@@ -265,9 +265,9 @@ impl kio::Task for FollowInstances {
 					}))
 				}
 				Ok(None) => Current::Offline,
-				// An authorization refusal is final: the contribution stays out and its URLs answer 403.
+				// An authorization refusal is final: the include stays out and its URLs answer 403.
 				Err(err @ moq_mux::Error::Moq(moq_net::Error::Unauthorized)) => {
-					tracing::debug!(%err, "contribution refused");
+					tracing::debug!(%err, "include refused");
 					if let Ok(mut state) = self.current.write() {
 						*state = Current::Failed(err.into());
 					}
@@ -282,7 +282,7 @@ impl kio::Task for FollowInstances {
 				// Not routed yet, or refused otherwise: wait for the path's next announcement, which
 				// the follower hands out, however long it takes. Until then nothing is listed.
 				Err(err) => {
-					tracing::debug!(%err, "contribution not routed; waiting for its next announcement");
+					tracing::debug!(%err, "include not routed; waiting for its next announcement");
 					match &*self.current.read() {
 						Current::Pending => Current::Offline,
 						_ => continue,
@@ -307,16 +307,16 @@ mod tests {
 		let _parent = origin.publish("room/live", Default::default()).unwrap();
 		let source = crate::resolved(&origin, "room/live").await;
 		let mut catalog = Catalog::default();
-		catalog.contributions.insert(
+		catalog.include.insert(
 			"child".into(),
-			Contribution::new(moq_net::path::Relative::new("./child").unwrap()),
+			Include::new(moq_net::path::Relative::new("./child").unwrap()),
 		);
 		let (spawner, _driver) = driver::Spawner::new();
-		let contributions = Producer::new(origin.consume(), Duration::from_secs(16), spawner);
-		contributions.clear();
+		let include = Producer::new(origin.consume(), Duration::from_secs(16), spawner);
+		include.clear();
 		// A watcher already past its catalog await syncs after the clear.
-		contributions.sync(&source, &catalog);
-		assert!(contributions.state.read().entries.is_empty());
+		include.sync(&source, &catalog);
+		assert!(include.state.read().entries.is_empty());
 	}
 
 	#[tokio::test(start_paused = true)]
@@ -344,24 +344,24 @@ mod tests {
 		json.update(moq_net::Timed::from(&catalog).at(moq_net::Timestamp::ZERO))
 			.unwrap();
 		catalog.video.renditions.clear();
-		catalog.contributions.insert(
+		catalog.include.insert(
 			"child".into(),
-			Contribution::new(moq_net::path::Relative::new("./child").unwrap()),
+			Include::new(moq_net::path::Relative::new("./child").unwrap()),
 		);
 		let (spawner, driver) = driver::Spawner::new();
-		let contributions = Producer::new(origin.consume(), Duration::from_secs(16), spawner);
-		contributions.sync(&source, &catalog);
-		let at = super::super::Contribution {
+		let include = Producer::new(origin.consume(), Duration::from_secs(16), spawner);
+		include.sync(&source, &catalog);
+		let at = super::super::Include {
 			id: "child".into(),
 			instance: child_id.to_string(),
 		};
-		let mut lookup = Box::pin(contributions.rendition(&at, Kind::Video, "v"));
+		let mut lookup = Box::pin(include.rendition(&at, Kind::Video, "v"));
 		// The catalog has been read, but the driver has not yet polled its follow task.
 		assert!(futures::poll!(lookup.as_mut()).is_pending());
 		let running = tokio::spawn(driver.run());
 		let rendition = lookup.await.unwrap().unwrap();
 		assert_eq!(rendition.name, "v");
-		drop((rendition, contributions));
+		drop((rendition, include));
 		running.await.unwrap();
 	}
 }
diff --git a/rs/moq-hls/src/export/master.rs b/rs/moq-hls/src/export/master.rs
index 0aa107bef89..53a38ef2ecb 100644
--- a/rs/moq-hls/src/export/master.rs
+++ b/rs/moq-hls/src/export/master.rs
@@ -46,7 +46,7 @@ pub(crate) fn rendition_uri(instance: &str, kind: Kind, name: &str, query: Optio
 	uri
 }
 
-pub(crate) fn contribution_uri(
+pub(crate) fn include_uri(
 	parent: &str,
 	id: &str,
 	instance: &str,
@@ -54,7 +54,7 @@ pub(crate) fn contribution_uri(
 	query: Option<&str>,
 ) -> String {
 	let mut uri = format!(
-		"@{}/contribution/{}/{}/{}/@{}/media.m3u8",
+		"@{}/include/{}/{}/{}/@{}/media.m3u8",
 		utf8_percent_encode(parent, PATH_SEGMENT),
 		utf8_percent_encode(id, PATH_SEGMENT),
 		rendition.kind.as_str(),
@@ -340,7 +340,7 @@ mod tests {
 				Route::parse(url.path()).unwrap(),
 				Route {
 					broadcast: "live".into(),
-					contribution: None,
+					include: None,
 					resource: Resource::Media {
 						instance: instance.into(),
 						kind: Kind::Video,
diff --git a/rs/moq-hls/src/export/mod.rs b/rs/moq-hls/src/export/mod.rs
index de216f0fc45..3cf54874fc5 100644
--- a/rs/moq-hls/src/export/mod.rs
+++ b/rs/moq-hls/src/export/mod.rs
@@ -32,9 +32,9 @@
 
 #[cfg(test)]
 mod archive_tests;
-mod contributions;
 mod driver;
 mod grid;
+mod include;
 pub mod master;
 mod mpd;
 mod playlist;
@@ -56,7 +56,7 @@ pub(crate) use playlist::render_media;
 #[cfg(feature = "server")]
 pub(crate) use rendition::Demand;
 pub use rendition::{Kind, Rendition};
-pub use route::{Contribution, Resource, Route};
+pub use route::{Include, Resource, Route};
 
 /// Backoff bounds for the initial catalog subscription.
 ///
@@ -109,7 +109,7 @@ pub struct Broadcaster {
 	instance: Arc<str>,
 	/// The current rendition set, reconciled from the catalog by the watcher task.
 	renditions: renditions::Producer,
-	contributions: Option<contributions::Producer>,
+	include: Option<include::Producer>,
 	/// Shared by every clone; its drop with the last one ends the catalog watcher.
 	_guard: Arc<Guard>,
 }
@@ -117,7 +117,7 @@ pub struct Broadcaster {
 /// What the last [`Broadcaster`] clone releases.
 struct Guard {
 	renditions: renditions::Producer,
-	contributions: Option<contributions::Producer>,
+	include: Option<include::Producer>,
 	/// Ends the catalog watcher when dropped, or when [`replaced`](Broadcaster::replaced) takes it.
 	watcher: Mutex<Option<driver::Owner>>,
 }
@@ -129,8 +129,8 @@ impl Drop for Guard {
 		// media flowing, so its final segments are not truncated. Each rendition stops
 		// following its media once no recording cursor holds it.
 		self.renditions.clear();
-		if let Some(contributions) = &self.contributions {
-			contributions.clear();
+		if let Some(include) = &self.include {
+			include.clear();
 		}
 	}
 }
@@ -160,25 +160,25 @@ impl Broadcaster {
 			.clone()
 			.unwrap_or_else(moq_net::Instance::random);
 		let (spawner, mut driver) = driver::Spawner::new();
-		let contributions = origin.map(|origin| contributions::Producer::new(origin, config.window, spawner.clone()));
+		let include = origin.map(|origin| include::Producer::new(origin, config.window, spawner.clone()));
 		let renditions = renditions::Producer::new(config.window, spawner);
 		// The watcher owns its own producer clone; dropping the `Broadcaster` ends it so the
 		// standing catalog subscription stops when nobody's serving from this broadcaster.
 		let watcher = driver.lead(WatchCatalog::new(
 			source,
 			renditions.clone(),
-			Role::Root(contributions.clone().map(Box::new)),
+			Role::Root(include.clone().map(Box::new)),
 		));
 		let broadcaster = Self {
 			broadcast,
 			instance: Arc::from(instance.as_str()),
 			_guard: Arc::new(Guard {
 				renditions: renditions.clone(),
-				contributions: contributions.clone(),
+				include: include.clone(),
 				watcher: Mutex::new(Some(watcher)),
 			}),
 			renditions,
-			contributions,
+			include,
 		};
 		(broadcaster, driver)
 	}
@@ -259,12 +259,12 @@ impl Broadcaster {
 	#[cfg_attr(any(test, feature = "server"), kio::wrapper)]
 	pub(crate) fn poll_advertised(&self, waiter: &kio::Waiter) -> Poll<()> {
 		let own = self.renditions.poll_advertised(waiter);
-		let contribution = self
-			.contributions
+		let include = self
+			.include
 			.as_ref()
-			.is_some_and(|contributions| contributions.poll_advertised(waiter).is_ready());
-		// Contributions alone answer only while no own rendition could still be listed.
-		if own.is_ready() || (!self.renditions.listable() && contribution) {
+			.is_some_and(|include| include.poll_advertised(waiter).is_ready());
+		// Includes alone answer only while no own rendition could still be listed.
+		if own.is_ready() || (!self.renditions.listable() && include) {
 			Poll::Ready(())
 		} else {
 			Poll::Pending
@@ -303,9 +303,9 @@ impl Broadcaster {
 	/// holding different tokens; a credential in `Config` would embed one viewer's in
 	/// another's playlist.
 	///
-	/// A broadcaster obtained from `Server` also lists contribution renditions from their
+	/// A broadcaster obtained from `Server` also lists include renditions from their
 	/// catalogs, starting their media only on request. `Broadcaster::new` exports the own
-	/// renditions only, so a recorder never demands contributions.
+	/// renditions only, so a recorder never demands includes.
 	///
 	/// Lists only enabled own renditions a player can start, i.e. ones listing at least one segment,
 	/// so an early render may list audio alone, or nothing at all. A disabled rendition (catalog `enabled: false`) is left out until
@@ -339,27 +339,27 @@ impl Broadcaster {
 				}),
 			}
 		}
-		if let Some(contributions) = &self.contributions {
-			let (extra_video, extra_audio) = contributions.variants(&self.instance, query);
+		if let Some(include) = &self.include {
+			let (extra_video, extra_audio) = include.variants(&self.instance, query);
 			video.extend(extra_video);
 			audio.extend(extra_audio);
 		}
 		(video, audio)
 	}
 
-	/// The contribution rendition `at` names, once the catalog is read.
+	/// The include rendition `at` names, once the catalog is read.
 	#[cfg(feature = "server")]
 	#[kio::wrapper]
-	pub(crate) fn poll_contribution(
+	pub(crate) fn poll_include(
 		&self,
 		waiter: &kio::Waiter,
-		at: &Contribution,
+		at: &Include,
 		kind: Kind,
 		name: &str,
 	) -> Poll<crate::Result<Option<Arc<Rendition>>>> {
 		ready!(self.renditions.poll_catalogued(waiter));
-		match &self.contributions {
-			Some(contributions) => contributions.poll_rendition(waiter, at, kind, name),
+		match &self.include {
+			Some(include) => include.poll_rendition(waiter, at, kind, name),
 			None => Poll::Ready(Ok(None)),
 		}
 	}
@@ -496,8 +496,8 @@ impl Broadcaster {
 		let watcher = self._guard.watcher.lock().unwrap().take();
 		drop(watcher);
 		self.renditions.cut();
-		if let Some(contributions) = &self.contributions {
-			contributions.clear();
+		if let Some(include) = &self.include {
+			include.clear();
 		}
 	}
 
@@ -513,11 +513,11 @@ impl Broadcaster {
 
 /// What a catalog watcher reconciles besides its own rendition set.
 enum Role {
-	/// A root broadcast, following its catalog's contributions when an HTTP server serves it.
-	Root(Option<Box<contributions::Producer>>),
-	/// A contribution included in a root broadcast. Its renditions take the root catalog's
-	/// `media`, so they share the root's timeline and grid whatever the contribution declares.
-	Contribution(kio::Consumer<hang::catalog::Media>),
+	/// A root broadcast, following its catalog's includes when an HTTP server serves it.
+	Root(Option<Box<include::Producer>>),
+	/// A broadcast included in a root broadcast. Its renditions take the root catalog's
+	/// `media`, so they share the root's timeline and grid whatever the include declares.
+	Include(kio::Consumer<hang::catalog::Media>),
 }
 
 /// Follows a broadcast's catalog into its rendition set, as a driver task.
@@ -547,7 +547,7 @@ enum Watch {
 	Backoff(kio::clock::Sleep),
 	Reading {
 		consumer: catalog::Consumer<()>,
-		/// A contribution's latest catalog, re-synced when the root's media changes.
+		/// An include's latest catalog, re-synced when the root's media changes.
 		latest: Option<catalog::hang::Catalog>,
 	},
 }
@@ -588,7 +588,7 @@ impl WatchCatalog {
 				err.into()
 			}));
 		}
-		if let (Role::Contribution(root), Some(catalog)) = (&self.role, &latest)
+		if let (Role::Include(root), Some(catalog)) = (&self.role, &latest)
 			&& let Poll::Ready(Ok(())) = root.poll(waiter, |media| match **media != catalog.media {
 				true => Poll::Ready(()),
 				false => Poll::Pending,
@@ -601,12 +601,12 @@ impl WatchCatalog {
 	/// Reconcile the renditions with `catalog`.
 	fn sync(&mut self, mut catalog: catalog::hang::Catalog) {
 		match &self.role {
-			Role::Root(Some(contributions)) => contributions.sync(&self.source, &catalog),
+			Role::Root(Some(include)) => include.sync(&self.source, &catalog),
 			Role::Root(None) => {}
-			Role::Contribution(root) => catalog.media = *root.read(),
+			Role::Include(root) => catalog.media = *root.read(),
 		}
 		self.renditions.sync(&self.source, &catalog);
-		if let (Role::Contribution(_), Watch::Reading { latest, .. }) = (&self.role, &mut self.state) {
+		if let (Role::Include(_), Watch::Reading { latest, .. }) = (&self.role, &mut self.state) {
 			*latest = Some(catalog);
 		}
 	}
@@ -615,11 +615,11 @@ impl WatchCatalog {
 	fn finish(&self, result: crate::Result<()>) {
 		let failed = result.is_err();
 		self.renditions.finish(result);
-		// The root catalog lists the contributions: once it fails, stop following and advertising
+		// The root catalog lists the includes: once it fails, stop following and advertising
 		// them too. A clean end freezes the final catalog, which keeps its entries, as the own
 		// renditions keep their final set.
-		if failed && let Role::Root(Some(contributions)) = &self.role {
-			contributions.clear();
+		if failed && let Role::Root(Some(include)) = &self.role {
+			include.clear();
 		}
 	}
 }
diff --git a/rs/moq-hls/src/export/route.rs b/rs/moq-hls/src/export/route.rs
index 122d1ea33da..230e39cfb2b 100644
--- a/rs/moq-hls/src/export/route.rs
+++ b/rs/moq-hls/src/export/route.rs
@@ -12,26 +12,26 @@ pub struct Route {
 	/// The broadcast path, percent-decoded. An embedder that scopes its origin rewrites
 	/// this relative to that scope before looking it up.
 	pub broadcast: String,
-	/// The contribution ID and publisher instance, when the resource belongs to one.
-	pub contribution: Option<Contribution>,
+	/// The include ID and publisher instance, when the resource belongs to one.
+	pub include: Option<Include>,
 	/// The resource requested under the broadcast.
 	pub resource: Resource,
 }
 
-/// The contribution catalog and stream named inside a broadcast's instance URL.
+/// The include catalog and stream named inside a broadcast's instance URL.
 ///
-/// A contribution's resource nests under the served broadcast as
-/// `{broadcast}/@{instance}/contribution/{id}/{kind}/{rendition}/@{contribution-instance}/`
+/// An include's resource nests under the served broadcast as
+/// `{broadcast}/@{instance}/include/{id}/{kind}/{rendition}/@{include-instance}/`
 /// followed by the [`Resource`] file (`media.m3u8`, `init.{hash}.mp4`, or `seg/{segment}.m4s`).
 /// The broadcast's own `@{instance}` comes first, so [`Route::broadcast`] stays the parent's
-/// path and a path-based policy check covers its contributions. A denied contribution answers
+/// path and a path-based policy check covers its includes. A denied include answers
 /// `403`.
 #[derive(Clone, Debug, PartialEq, Eq)]
 #[non_exhaustive]
-pub struct Contribution {
-	/// The contribution ID in the parent catalog, percent-decoded.
+pub struct Include {
+	/// The include ID in the parent catalog, percent-decoded.
 	pub id: String,
-	/// The contribution's publisher instance, percent-decoded and without its `@`.
+	/// The include's publisher instance, percent-decoded and without its `@`.
 	pub instance: String,
 }
 
@@ -114,23 +114,23 @@ impl Route {
 			_ => 0,
 		};
 		let end = parts.len() - tail;
-		let contribution = if tail != 0 {
+		let include = if tail != 0 {
 			match &parts[..end] {
 				[.., parent, directory, id, kind, _, child]
-					if directory == "contribution"
+					if directory == "include"
 						&& instance_id(parent).is_some()
 						&& Kind::parse(kind).is_some()
 						&& instance_id(child).is_some() =>
 				{
-					// Every slot has the contribution shape; otherwise the ordinary arms below
+					// Every slot has the include shape; otherwise the ordinary arms below
 					// parse the untouched parts as a longer broadcast path.
-					let contribution = Contribution {
+					let include = Include {
 						id: id.clone(),
 						instance: instance_id(child)?,
 					};
 					parts.remove(end - 1);
 					parts.drain(end - 5..end - 3);
-					Some(contribution)
+					Some(include)
 				}
 				_ => None,
 			}
@@ -175,7 +175,7 @@ impl Route {
 		}
 		Some(Self {
 			broadcast: broadcast.join("/"),
-			contribution,
+			include,
 			resource,
 		})
 	}
@@ -206,7 +206,7 @@ mod tests {
 			Route::parse("/project/live/@run/video/cam%231%2Fmain%3Falt/media.m3u8"),
 			Some(Route {
 				broadcast: "project/live".to_string(),
-				contribution: None,
+				include: None,
 				resource: Resource::Media {
 					instance: "run".to_string(),
 					kind: Kind::Video,
@@ -315,16 +315,16 @@ mod tests {
 	}
 
 	#[test]
-	fn contribution_resources_keep_the_parent_policy_path() {
+	fn include_resources_keep_the_parent_policy_path() {
 		for suffix in ["media.m3u8", "init.abcd.mp4", "seg/abcd.7.m4s"] {
 			let route = Route::parse(&format!(
-				"/room/live/@parent/contribution/a%2Fb/video/same%2Fname/@child/{suffix}"
+				"/room/live/@parent/include/a%2Fb/video/same%2Fname/@child/{suffix}"
 			))
 			.unwrap();
 			assert_eq!(route.broadcast, "room/live");
 			assert_eq!(
-				route.contribution,
-				Some(Contribution {
+				route.include,
+				Some(Include {
 					id: "a/b".into(),
 					instance: "child".into()
 				})
@@ -337,14 +337,14 @@ mod tests {
 			};
 			assert_eq!(instance, "parent");
 		}
-		let own = Route::parse("/room/@parent/contribution/id/@child/video/main/media.m3u8").unwrap();
-		assert_eq!(own.broadcast, "room/@parent/contribution/id");
-		assert!(own.contribution.is_none());
-		assert!(Route::parse("/room%2Flive/@parent/contribution/id/video/main/@child/media.m3u8").is_none());
-		// Contribution-shaped but for the child slot: an ordinary URL on a longer broadcast path.
-		let own = Route::parse("/room/@parent/contribution/id/video/@run/audio/seg/media.m3u8").unwrap();
-		assert_eq!(own.broadcast, "room/@parent/contribution/id/video");
-		assert!(own.contribution.is_none());
+		let own = Route::parse("/room/@parent/include/id/@child/video/main/media.m3u8").unwrap();
+		assert_eq!(own.broadcast, "room/@parent/include/id");
+		assert!(own.include.is_none());
+		assert!(Route::parse("/room%2Flive/@parent/include/id/video/main/@child/media.m3u8").is_none());
+		// Include-shaped but for the child slot: an ordinary URL on a longer broadcast path.
+		let own = Route::parse("/room/@parent/include/id/video/@run/audio/seg/media.m3u8").unwrap();
+		assert_eq!(own.broadcast, "room/@parent/include/id/video");
+		assert!(own.include.is_none());
 		match own.resource {
 			Resource::Media {
 				instance,
diff --git a/rs/moq-hls/src/server/contributions_tests.rs b/rs/moq-hls/src/server/include_tests.rs
similarity index 76%
rename from rs/moq-hls/src/server/contributions_tests.rs
rename to rs/moq-hls/src/server/include_tests.rs
index 5bfdc1ed23e..9eb3841ab26 100644
--- a/rs/moq-hls/src/server/contributions_tests.rs
+++ b/rs/moq-hls/src/server/include_tests.rs
@@ -2,7 +2,7 @@ use std::time::Duration;
 
 use axum::body::Body;
 use axum::http::{Request, StatusCode};
-use hang::catalog::{AudioCodec, AudioConfig, Contribution, Join, VideoCodec, VideoConfig};
+use hang::catalog::{AudioCodec, AudioConfig, Include, Join, VideoCodec, VideoConfig};
 use moq_mux::catalog::hang::Catalog;
 use moq_net::{Instance, Timestamp, track};
 use tower::ServiceExt;
@@ -101,29 +101,29 @@ async fn master(server: &Server, contains: &str, present: bool) -> String {
 fn parent_catalog() -> Catalog {
 	let mut catalog = catalog();
 	catalog.audio.renditions.get_mut("sound").unwrap().track = Some("audio".into());
-	catalog.contributions.insert(
+	catalog.include.insert(
 		"rung/a".into(),
-		Contribution::new(moq_net::path::Relative::new("./ladder").unwrap()),
+		Include::new(moq_net::path::Relative::new("./ladder").unwrap()),
 	);
 	catalog
 }
 
 #[tokio::test(start_paused = true)]
-async fn a_contribution_does_not_hide_the_parents_first_variants() {
+async fn an_include_does_not_hide_the_parents_first_variants() {
 	let origin = moq_tokio::origin::spawn();
 	let root = Instance::random();
 	let child = Instance::random();
 	let parent = publish(&origin, "room/live", &root, &parent_catalog());
-	let _contribution = publish(&origin, "room/ladder", &child, &catalog());
+	let _include = publish(&origin, "room/ladder", &child, &catalog());
 	let server = Server::new(origin.consume(), Default::default()).unwrap();
 	let broadcaster = server.broadcaster("room/live").await.unwrap();
-	let at = crate::export::Contribution {
+	let at = crate::export::Include {
 		id: "rung/a".into(),
 		instance: child.to_string(),
 	};
 	assert!(
 		broadcaster
-			.contribution(&at, crate::export::Kind::Video, "same")
+			.include(&at, crate::export::Kind::Video, "same")
 			.await
 			.unwrap()
 			.is_some()
@@ -135,7 +135,7 @@ async fn a_contribution_does_not_hide_the_parents_first_variants() {
 	let (status, body) = pending.await;
 	assert_eq!(status, StatusCode::OK);
 	assert!(body.contains(&format!("@{root}/video/same/media.m3u8")));
-	assert!(body.contains(&format!("contribution/rung%2Fa/video/same/@{child}/media.m3u8")));
+	assert!(body.contains(&format!("include/rung%2Fa/video/same/@{child}/media.m3u8")));
 }
 
 #[tokio::test(start_paused = true)]
@@ -146,20 +146,20 @@ async fn an_idle_predecessor_does_not_strand_a_requested_reconfigure() {
 	let parent = publish(&origin, "room/live", &root, &parent_catalog());
 	frames(&parent.video, 0);
 	let mut value = catalog();
-	let mut contribution = publish(&origin, "room/ladder", &child, &value);
-	frames(&contribution.video, 0);
+	let mut include = publish(&origin, "room/ladder", &child, &value);
+	frames(&include.video, 0);
 	let server = Server::new(origin.consume(), Default::default()).unwrap();
-	master(&server, "contribution/", true).await;
-	let uri = format!("/room/live/@{root}/contribution/rung%2Fa/video/same/@{child}/media.m3u8");
+	master(&server, "include/", true).await;
+	let uri = format!("/room/live/@{root}/include/rung%2Fa/video/same/@{child}/media.m3u8");
 	assert_eq!(request(&server, &uri).await.0, StatusCode::OK);
-	let next = contribution
+	let next = include
 		.publication
 		.create_track("next", hang::container::track_info(1))
 		.unwrap();
 	let video = value.video.renditions.get_mut("same").unwrap();
 	video.track = Some("next".into());
 	video.coded_width = Some(640);
-	contribution
+	include
 		.catalog
 		.update(moq_net::Timed::from(&value).at(Timestamp::ZERO))
 		.unwrap();
@@ -179,22 +179,22 @@ async fn an_idle_predecessor_does_not_strand_a_requested_reconfigure() {
 	})
 	.await
 	.expect("the requested replacement must start after the idle predecessor releases");
-	assert_eq!(contribution.video.demand().wanted(), None);
+	assert_eq!(include.video.demand().wanted(), None);
 	frames(&next, 3);
 	drop(held);
 }
 
 #[tokio::test(start_paused = true)]
-async fn a_finished_parent_catalog_keeps_its_contributions() {
+async fn a_finished_parent_catalog_keeps_its_includes() {
 	let origin = moq_tokio::origin::spawn();
 	let root = Instance::random();
 	let child = Instance::random();
 	let mut parent = publish(&origin, "room/live", &root, &parent_catalog());
 	frames(&parent.video, 0);
 	frames(&parent.audio, 0);
-	let _contribution = publish(&origin, "room/ladder", &child, &catalog());
+	let _include = publish(&origin, "room/ladder", &child, &catalog());
 	let server = Server::new(origin.consume(), Default::default()).unwrap();
-	let listed = format!("contribution/rung%2Fa/video/same/@{child}");
+	let listed = format!("include/rung%2Fa/video/same/@{child}");
 	master(&server, &listed, true).await;
 	// A clean end freezes the final catalog, entries included.
 	parent.catalog.finish().unwrap();
@@ -203,7 +203,7 @@ async fn a_finished_parent_catalog_keeps_its_contributions() {
 }
 
 #[tokio::test(start_paused = true)]
-async fn a_failed_parent_catalog_stops_its_contributions() {
+async fn a_failed_parent_catalog_stops_its_includes() {
 	let origin = moq_tokio::origin::spawn();
 	let root = Instance::random();
 	let child = Instance::random();
@@ -215,35 +215,27 @@ async fn a_failed_parent_catalog_stops_its_contributions() {
 	} = publish(&origin, "room/live", &root, &parent_catalog());
 	frames(&video, 0);
 	frames(&audio, 0);
-	let contribution = publish(&origin, "room/ladder", &child, &catalog());
+	let include = publish(&origin, "room/ladder", &child, &catalog());
 	let server = Server::new(origin.consume(), Default::default()).unwrap();
-	master(&server, "contribution/", true).await;
-	let uri = format!("/room/live/@{root}/contribution/rung%2Fa/video/same/@{child}/media.m3u8");
+	master(&server, "include/", true).await;
+	let uri = format!("/room/live/@{root}/include/rung%2Fa/video/same/@{child}/media.m3u8");
 	parent_catalog_track.abort(moq_net::Error::Cancel).unwrap();
 	let deadline = kio::clock::now() + Duration::from_secs(10);
-	// A live contribution's playlist waits for media this test never writes, so bound each request.
+	// A live include's playlist waits for media this test never writes, so bound each request.
 	while !matches!(
 		kio::clock::timeout(Duration::from_secs(1), request(&server, &uri)).await,
 		Ok((StatusCode::NOT_FOUND, _))
 	) {
-		assert!(
-			kio::clock::now() < deadline,
-			"the contribution outlived its parent catalog"
-		);
+		assert!(kio::clock::now() < deadline, "the include outlived its parent catalog");
 		kio::clock::sleep(Duration::from_millis(10)).await;
 	}
-	assert!(
-		!request(&server, "/room/live/master.m3u8")
-			.await
-			.1
-			.contains("contribution/")
-	);
-	let mut catalog = contribution.catalog.demand();
+	assert!(!request(&server, "/room/live/master.m3u8").await.1.contains("include/"));
+	let mut catalog = include.catalog.demand();
 	kio::clock::timeout(Duration::from_secs(1), async {
 		while catalog.wanted_changed().await.unwrap().is_some() {}
 	})
 	.await
-	.expect("the contribution catalog is released");
+	.expect("the include catalog is released");
 }
 
 #[tokio::test(start_paused = true)]
@@ -253,21 +245,21 @@ async fn idle_release_waits_out_the_playlist_window() {
 	let child = Instance::random();
 	let parent = publish(&origin, "room/live", &root, &parent_catalog());
 	frames(&parent.video, 0);
-	let contribution = publish(&origin, "room/ladder", &child, &catalog());
-	frames(&contribution.video, 0);
+	let include = publish(&origin, "room/ladder", &child, &catalog());
+	frames(&include.video, 0);
 	let server = Server::new(origin.consume(), Default::default()).unwrap();
-	master(&server, "contribution/", true).await;
-	let uri = format!("/room/live/@{root}/contribution/rung%2Fa/video/same/@{child}/media.m3u8");
+	master(&server, "include/", true).await;
+	let uri = format!("/room/live/@{root}/include/rung%2Fa/video/same/@{child}/media.m3u8");
 	assert_eq!(request(&server, &uri).await.0, StatusCode::OK);
 	let settle = || kio::clock::sleep(Duration::from_millis(10));
 	settle().await;
 	// Three target durations (12 s) would forget rows the 16 s window still lists.
 	tokio::time::advance(Duration::from_secs(13)).await;
 	settle().await;
-	assert!(contribution.video.demand().wanted().is_some());
+	assert!(include.video.demand().wanted().is_some());
 	tokio::time::advance(Duration::from_secs(8)).await;
 	settle().await;
-	assert_eq!(contribution.video.demand().wanted(), None);
+	assert_eq!(include.video.demand().wanted(), None);
 }
 
 #[tokio::test(start_paused = true)]
@@ -278,26 +270,26 @@ async fn idle_release_keeps_an_ended_playlists_inherited_segments() {
 	let parent = publish(&origin, "room/live", &root, &parent_catalog());
 	frames(&parent.video, 0);
 	let mut value = catalog();
-	let mut contribution = publish(&origin, "room/ladder", &child, &value);
-	frames(&contribution.video, 0);
+	let mut include = publish(&origin, "room/ladder", &child, &value);
+	frames(&include.video, 0);
 	let server = Server::new(origin.consume(), Default::default()).unwrap();
-	master(&server, "contribution/", true).await;
-	let uri = format!("/room/live/@{root}/contribution/rung%2Fa/video/same/@{child}/media.m3u8");
+	master(&server, "include/", true).await;
+	let uri = format!("/room/live/@{root}/include/rung%2Fa/video/same/@{child}/media.m3u8");
 	assert_eq!(request(&server, &uri).await.0, StatusCode::OK);
 	// Reconfigure onto another track; the predecessor ends with its own track.
-	let next = contribution
+	let next = include
 		.publication
 		.create_track("next", hang::container::track_info(1))
 		.unwrap();
 	let video = value.video.renditions.get_mut("same").unwrap();
 	video.track = Some("next".into());
 	video.coded_width = Some(640);
-	contribution
+	include
 		.catalog
 		.update(moq_net::Timed::from(&value).at(Timestamp::ZERO))
 		.unwrap();
 	master(&server, "RESOLUTION=640x240", true).await;
-	contribution.video.finish().unwrap();
+	include.video.finish().unwrap();
 	let held = server
 		.router()
 		.oneshot(Request::builder().uri(&uri).body(Body::empty()).unwrap())
@@ -331,12 +323,12 @@ async fn idle_release_keeps_an_ended_playlists_inherited_segments() {
 	assert_eq!(after, ended);
 	// The finished window keeps the track pin its retained groups are read through.
 	let broadcaster = server.broadcaster("room/live").await.unwrap();
-	let at = crate::export::Contribution {
+	let at = crate::export::Include {
 		id: "rung/a".into(),
 		instance: child.to_string(),
 	};
 	let rendition = broadcaster
-		.contribution(&at, crate::export::Kind::Video, "same")
+		.include(&at, crate::export::Kind::Video, "same")
 		.await
 		.unwrap()
 		.unwrap();
@@ -344,7 +336,7 @@ async fn idle_release_keeps_an_ended_playlists_inherited_segments() {
 }
 
 #[tokio::test(start_paused = true)]
-async fn a_contribution_rendition_whose_broadcast_failed_is_not_listed() {
+async fn an_include_rendition_whose_broadcast_failed_is_not_listed() {
 	let origin = moq_tokio::origin::spawn();
 	let root = Instance::random();
 	let parent = publish(&origin, "room/live", &root, &parent_catalog());
@@ -355,7 +347,7 @@ async fn a_contribution_rendition_whose_broadcast_failed_is_not_listed() {
 	let mut value = catalog();
 	value.audio.renditions.clear();
 	value.video.renditions.get_mut("same").unwrap().broadcast = Some(moq_net::path::Relative::new("./other").unwrap());
-	let _contribution = publish(&origin, "room/ladder", &child, &value);
+	let _include = publish(&origin, "room/ladder", &child, &value);
 	let server = Server::new(origin.consume(), Default::default()).unwrap();
 	master(&server, &format!("@{root}/video/same"), true).await;
 	// Not a denial, but its media still can't be read.
@@ -366,11 +358,11 @@ async fn a_contribution_rendition_whose_broadcast_failed_is_not_listed() {
 		.reject(moq_net::Error::Unroutable);
 	kio::clock::sleep(Duration::from_secs(1)).await;
 	let listed = master(&server, &format!("@{root}/video/same"), true).await;
-	assert!(!listed.contains("contribution/"), "{listed}");
+	assert!(!listed.contains("include/"), "{listed}");
 }
 
 #[tokio::test(start_paused = true)]
-async fn a_contribution_answers_the_master_when_no_own_rendition_is_listable() {
+async fn an_include_answers_the_master_when_no_own_rendition_is_listable() {
 	let origin = moq_tokio::origin::spawn();
 	let root = Instance::random();
 	let child = Instance::random();
@@ -378,16 +370,16 @@ async fn a_contribution_answers_the_master_when_no_own_rendition_is_listable() {
 	value.video.renditions.get_mut("same").unwrap().enabled = false;
 	value.audio.renditions.get_mut("sound").unwrap().enabled = false;
 	let _parent = publish(&origin, "room/live", &root, &value);
-	let _contribution = publish(&origin, "room/ladder", &child, &catalog());
+	let _include = publish(&origin, "room/ladder", &child, &catalog());
 	let server = Server::new(origin.consume(), Default::default()).unwrap();
 	let broadcaster = server.broadcaster("room/live").await.unwrap();
-	let at = crate::export::Contribution {
+	let at = crate::export::Include {
 		id: "rung/a".into(),
 		instance: child.to_string(),
 	};
 	assert!(
 		broadcaster
-			.contribution(&at, crate::export::Kind::Video, "same")
+			.include(&at, crate::export::Kind::Video, "same")
 			.await
 			.unwrap()
 			.is_some()
@@ -397,30 +389,30 @@ async fn a_contribution_answers_the_master_when_no_own_rendition_is_listable() {
 	let (status, body) = request(&server, "/room/live/master.m3u8").await;
 	assert_eq!(status, StatusCode::OK, "{body}");
 	assert!(
-		body.contains(&format!("contribution/rung%2Fa/video/same/@{child}")),
+		body.contains(&format!("include/rung%2Fa/video/same/@{child}")),
 		"{body}"
 	);
 	assert!(kio::clock::now() - start < Duration::from_secs(1));
 }
 
 #[tokio::test(start_paused = true)]
-async fn a_contribution_rendition_is_listed_once_its_broadcast_resolves() {
+async fn an_include_rendition_is_listed_once_its_broadcast_resolves() {
 	let origin = moq_tokio::origin::spawn();
 	let root = Instance::random();
 	let parent = publish(&origin, "room/live", &root, &parent_catalog());
 	frames(&parent.video, 0);
 	frames(&parent.audio, 0);
-	// The contribution's only rendition reads a sibling whose route has not answered yet.
+	// The include's only rendition reads a sibling whose route has not answered yet.
 	let other = origin.requests("room/other").unwrap();
 	let child = Instance::random();
 	let mut value = catalog();
 	value.audio.renditions.clear();
 	value.video.renditions.get_mut("same").unwrap().broadcast = Some(moq_net::path::Relative::new("./other").unwrap());
-	let _contribution = publish(&origin, "room/ladder", &child, &value);
+	let _include = publish(&origin, "room/ladder", &child, &value);
 	let server = Server::new(origin.consume(), Default::default()).unwrap();
 	let listed = master(&server, &format!("@{root}/video/same"), true).await;
 	assert!(
-		!listed.contains("contribution/"),
+		!listed.contains("include/"),
 		"a pending binding may yet be denied: {listed}"
 	);
 	let request = kio::clock::timeout(Duration::from_secs(5), other.requested_broadcast())
@@ -428,7 +420,7 @@ async fn a_contribution_rendition_is_listed_once_its_broadcast_resolves() {
 		.expect("the binding never asked")
 		.unwrap();
 	request.serve(moq_net::broadcast::Info::new().produce());
-	master(&server, &format!("contribution/rung%2Fa/video/same/@{child}"), true).await;
+	master(&server, &format!("include/rung%2Fa/video/same/@{child}"), true).await;
 }
 
 #[tokio::test(start_paused = true)]
@@ -442,29 +434,29 @@ async fn listing_is_catalog_only_and_requests_own_the_lazy_media_lifetime() {
 	frames(&parent.audio, 0);
 	let mut child_catalog = catalog();
 	child_catalog.audio.renditions.get_mut("sound").unwrap().track = Some("audio".into());
-	let contribution = publish(&origin, "room/ladder", &child, &child_catalog);
+	let include = publish(&origin, "room/ladder", &child, &child_catalog);
 	let server = Server::new(origin.consume(), Default::default()).unwrap();
-	let prefix = format!("@{root}/contribution/rung%2Fa");
+	let prefix = format!("@{root}/include/rung%2Fa");
 	let listed = master(&server, &prefix, true).await;
 	assert!(listed.contains(&format!("@{root}/video/same/media.m3u8?jwt=viewer")));
 	assert!(listed.contains(&format!("{prefix}/video/same/@{child}/media.m3u8?jwt=viewer")));
 	assert!(listed.contains("NAME=\"rung/a/sound\""));
-	assert_eq!(contribution.video.demand().wanted(), None);
-	assert_eq!(contribution.audio.demand().wanted(), None);
-	assert!(contribution.catalog.demand().wanted().is_some());
+	assert_eq!(include.video.demand().wanted(), None);
+	assert_eq!(include.audio.demand().wanted(), None);
+	assert!(include.catalog.demand().wanted().is_some());
 
 	let uri = format!("/room/live/{prefix}/video/same/@{child}/media.m3u8");
 	let mut pending = Box::pin(request(&server, &uri));
 	assert!(futures::poll!(pending.as_mut()).is_pending());
-	let mut demand = contribution.video.demand();
+	let mut demand = include.video.demand();
 	while demand.wanted_changed().await.unwrap().is_none() {}
-	assert_eq!(contribution.audio.demand().wanted(), None);
+	assert_eq!(include.audio.demand().wanted(), None);
 	// The idle window is 20 s (the 16 s playlist window plus TARGETDURATION 4), and this first
 	// encode is slower than all of it.
 	tokio::time::advance(Duration::from_secs(21)).await;
 	assert!(futures::poll!(pending.as_mut()).is_pending());
-	assert!(contribution.video.demand().wanted().is_some());
-	frames(&contribution.video, 0);
+	assert!(include.video.demand().wanted().is_some());
+	frames(&include.video, 0);
 	let (status, playlist) = pending.await;
 	assert_eq!(status, StatusCode::OK, "{playlist}");
 	assert!(playlist.contains("#EXT-X-MEDIA-SEQUENCE:0"));
@@ -478,35 +470,30 @@ async fn listing_is_catalog_only_and_requests_own_the_lazy_media_lifetime() {
 	assert_eq!(held.status(), StatusCode::OK);
 	tokio::time::advance(Duration::from_secs(21)).await;
 	assert!(
-		contribution.video.demand().wanted().is_some(),
+		include.video.demand().wanted().is_some(),
 		"a slow body still holds demand"
 	);
 	drop(held);
 	// The reload window starts at completion, and another request renews it.
 	tokio::time::advance(Duration::from_secs(19)).await;
-	assert!(contribution.video.demand().wanted().is_some());
+	assert!(include.video.demand().wanted().is_some());
 	assert_eq!(request(&server, &uri).await.0, StatusCode::OK);
 	tokio::time::advance(Duration::from_secs(19)).await;
-	assert!(contribution.video.demand().wanted().is_some());
+	assert!(include.video.demand().wanted().is_some());
 	tokio::time::advance(Duration::from_secs(2)).await;
 	while demand.wanted_changed().await.unwrap().is_some() {}
-	assert_eq!(contribution.audio.demand().wanted(), None);
+	assert_eq!(include.audio.demand().wanted(), None);
 	// A later request creates fresh demand and indexes later segments on the same grid.
 	let mut resumed = Box::pin(request(&server, &uri));
 	assert!(futures::poll!(resumed.as_mut()).is_pending());
 	while demand.wanted_changed().await.unwrap().is_none() {}
-	frames(&contribution.video, 3);
+	frames(&include.video, 3);
 	let (status, playlist) = resumed.await;
 	assert_eq!(status, StatusCode::OK);
 	assert!(playlist.contains("#EXT-X-MEDIA-SEQUENCE:3"), "{playlist}");
-	assert_eq!(contribution.audio.demand().wanted(), None);
-	// Neither the DASH manifest nor the recorder cursor expands the contribution.
-	assert!(
-		!request(&server, "/room/live/manifest.mpd")
-			.await
-			.1
-			.contains("contribution")
-	);
+	assert_eq!(include.audio.demand().wanted(), None);
+	// Neither the DASH manifest nor the recorder cursor expands the include.
+	assert!(!request(&server, "/room/live/manifest.mpd").await.1.contains("include"));
 	let broadcaster = server.broadcaster("room/live").await.unwrap();
 	let mut recorder = broadcaster.renditions();
 	for _ in 0..2 {
@@ -525,28 +512,28 @@ async fn late_instances_replace_unpinned_entries_and_do_not_replace_pins() {
 	let first = Instance::random();
 	let second = Instance::random();
 	let mut value = parent_catalog();
-	let mut pin = value.contributions["rung/a"].clone();
+	let mut pin = value.include["rung/a"].clone();
 	pin.instance = Some(first.clone());
-	value.contributions.insert("pinned".into(), pin);
+	value.include.insert("pinned".into(), pin);
 	let parent = publish(&origin, "room/live", &root, &value);
 	frames(&parent.video, 0);
 	frames(&parent.audio, 0);
 	let server = Server::new(origin.consume(), Default::default()).unwrap();
-	master(&server, "contribution/", false).await;
+	master(&server, "include/", false).await;
 	let old = publish(&origin, "room/ladder", &first, &catalog());
-	let old_uri = format!("contribution/rung%2Fa/video/same/@{first}");
+	let old_uri = format!("include/rung%2Fa/video/same/@{first}");
 	let listed = master(&server, &old_uri, true).await;
-	assert!(listed.contains(&format!("contribution/pinned/video/same/@{first}")));
+	assert!(listed.contains(&format!("include/pinned/video/same/@{first}")));
 	assert_eq!(old.video.demand().wanted(), None);
 	old.publication.unannounce();
-	master(&server, "contribution/", false).await;
+	master(&server, "include/", false).await;
 	old.publication
 		.announce(moq_net::origin::Route::default().with_instance(first.clone(), 0))
 		.unwrap();
-	master(&server, &format!("contribution/pinned/video/same/@{first}"), true).await;
+	master(&server, &format!("include/pinned/video/same/@{first}"), true).await;
 	let new = publish(&origin, "room/ladder", &second, &catalog());
-	let listed = master(&server, &format!("contribution/rung%2Fa/video/same/@{second}"), true).await;
-	assert!(!listed.contains("contribution/pinned/"));
+	let listed = master(&server, &format!("include/rung%2Fa/video/same/@{second}"), true).await;
+	assert!(!listed.contains("include/pinned/"));
 	assert!(!listed.contains(&old_uri));
 	assert_eq!(new.video.demand().wanted(), None);
 	assert_eq!(
@@ -556,59 +543,59 @@ async fn late_instances_replace_unpinned_entries_and_do_not_replace_pins() {
 		StatusCode::NOT_FOUND
 	);
 	new.publication.unannounce();
-	master(&server, &format!("contribution/pinned/video/same/@{first}"), true).await;
+	master(&server, &format!("include/pinned/video/same/@{first}"), true).await;
 }
 
 #[tokio::test(start_paused = true)]
 #[tracing_test::traced_test]
-async fn contributions_take_the_roots_grid_and_denied_ones_are_not_advertised() {
+async fn includes_take_the_roots_grid_and_denied_ones_are_not_advertised() {
 	let origin = moq_tokio::origin::spawn();
 	let root = Instance::random();
 	let parent = publish(&origin, "room/live", &root, &parent_catalog());
 	frames(&parent.video, 0);
 	frames(&parent.audio, 0);
 	let child = Instance::random();
-	// The contribution declares its own interval, which HLS ignores for the root's.
+	// The include declares its own interval, which HLS ignores for the root's.
 	let mut value = catalog();
 	value.media.join = Join::new(Duration::from_secs(1));
-	let contribution = publish(&origin, "room/ladder", &child, &value);
+	let include = publish(&origin, "room/ladder", &child, &value);
 	let server = Server::new(origin.consume(), Default::default()).unwrap();
-	master(&server, "contribution/", true).await;
+	master(&server, "include/", true).await;
 	let patterns = ["room/live".parse::<moq_net::Pattern>().unwrap()].into_iter().collect();
 	let denied = Server::new(origin.consume().scope("", &patterns).unwrap(), Default::default()).unwrap();
-	master(&denied, "contribution/", false).await;
+	master(&denied, "include/", false).await;
 	for resource in ["media.m3u8", "init.abcd.mp4", "seg/abcd.0.m4s"] {
 		assert_eq!(
 			request(
 				&denied,
-				&format!("/room/live/@{root}/contribution/rung%2Fa/video/same/@{child}/{resource}")
+				&format!("/room/live/@{root}/include/rung%2Fa/video/same/@{child}/{resource}")
 			)
 			.await
 			.0,
 			StatusCode::FORBIDDEN
 		);
 	}
-	assert_eq!(contribution.video.demand().wanted(), None);
-	let uri = format!("/room/live/@{root}/contribution/rung%2Fa/video/same/@{child}/media.m3u8");
+	assert_eq!(include.video.demand().wanted(), None);
+	let uri = format!("/room/live/@{root}/include/rung%2Fa/video/same/@{child}/media.m3u8");
 	let mut pending = Box::pin(request(&server, &uri));
 	assert!(futures::poll!(pending.as_mut()).is_pending());
-	let mut demand = contribution.video.demand();
+	let mut demand = include.video.demand();
 	kio::clock::timeout(Duration::from_secs(10), async {
 		while demand.wanted_changed().await.unwrap().is_none() {}
 	})
 	.await
-	.expect("the request never demanded the contribution's media");
-	frames(&contribution.video, 0);
+	.expect("the request never demanded the include's media");
+	frames(&include.video, 0);
 	let (status, playlist) = kio::clock::timeout(Duration::from_secs(10), pending)
 		.await
-		.expect("the contribution never listed a segment");
+		.expect("the include never listed a segment");
 	assert_eq!(status, StatusCode::OK, "{playlist}");
 	// Twice the root's 2 s interval; its own 1 s interval would give 2.
 	assert!(playlist.contains("#EXT-X-TARGETDURATION:4"), "{playlist}");
 }
 
 #[tokio::test(start_paused = true)]
-async fn a_refused_contribution_is_listed_once_announced() {
+async fn a_refused_include_is_listed_once_announced() {
 	let origin = moq_tokio::origin::spawn();
 	let root = Instance::random();
 	let parent = publish(&origin, "room/live", &root, &parent_catalog());
@@ -626,7 +613,7 @@ async fn a_refused_contribution_is_listed_once_announced() {
 	};
 	let own = format!("@{root}/video/same");
 	let (listed, ()) = futures::join!(master(&server, &own, true), refuse);
-	assert!(!listed.contains("contribution/"), "{listed}");
+	assert!(!listed.contains("include/"), "{listed}");
 	// The refusing route is not asked again on a timer.
 	assert!(
 		kio::clock::timeout(Duration::from_secs(30), claim.requested_broadcast())
@@ -635,6 +622,6 @@ async fn a_refused_contribution_is_listed_once_announced() {
 	);
 	drop(claim);
 	let child = Instance::random();
-	let _contribution = publish(&origin, "room/ladder", &child, &catalog());
-	master(&server, &format!("contribution/rung%2Fa/video/same/@{child}"), true).await;
+	let _include = publish(&origin, "room/ladder", &child, &catalog());
+	master(&server, &format!("include/rung%2Fa/video/same/@{child}"), true).await;
 }
diff --git a/rs/moq-hls/src/server/mod.rs b/rs/moq-hls/src/server/mod.rs
index 98399973d82..044295ab852 100644
--- a/rs/moq-hls/src/server/mod.rs
+++ b/rs/moq-hls/src/server/mod.rs
@@ -62,7 +62,7 @@
 //! ```
 
 #[cfg(test)]
-mod contributions_tests;
+mod include_tests;
 mod routes;
 
 use std::collections::HashMap;
diff --git a/rs/moq-hls/src/server/routes.rs b/rs/moq-hls/src/server/routes.rs
index e6d9261eb2d..d3021e0ef4e 100644
--- a/rs/moq-hls/src/server/routes.rs
+++ b/rs/moq-hls/src/server/routes.rs
@@ -213,15 +213,12 @@ async fn rendition_for(server: &Server, at: At<'_>) -> crate::Result<Option<Arc<
 	let Some(broadcaster) = server.instance(&at.route.broadcast, at.instance).await else {
 		return Ok(None);
 	};
-	if let Some(contribution) = &at.route.contribution {
-		// Resolve a cold edge's contribution before looking up its rendition. This
+	if let Some(include) = &at.route.include {
+		// Resolve a cold edge's include before looking up its rendition. This
 		// bounds discovery only; the requested rendition's first encode waits below.
-		return kio::clock::timeout(
-			READY_TIMEOUT,
-			broadcaster.contribution(contribution, at.kind, at.rendition),
-		)
-		.await
-		.unwrap_or(Ok(None));
+		return kio::clock::timeout(READY_TIMEOUT, broadcaster.include(include, at.kind, at.rendition))
+			.await
+			.unwrap_or(Ok(None));
 	}
 	let _ = kio::clock::timeout(READY_TIMEOUT, broadcaster.ready()).await;
 	Ok(broadcaster.rendition(at.kind, at.rendition))
diff --git a/sh/gh/nightly.sh b/sh/gh/nightly.sh
index f2b0e4e8862..2017e3f034e 100755
--- a/sh/gh/nightly.sh
+++ b/sh/gh/nightly.sh
@@ -147,7 +147,7 @@ case "$1" in
             -p moq-quic -p moq-sock -p moq-tokio -p moq-transcode -p moq-hls --features moq-quic/fuzz \
             --bench protect --bench sign --bench codec --bench table --bench allocations --bench window \
             --bench producer --bench play_buffer --bench jitter --bench timeline --bench decode_clock --bench ts_programs --bench ts_video \
-            --bench bus --bench batches --bench parameter_sets --bench sent_packets --bench demux --bench receive_bursts --bench ladder --bench fanout --bench contributions
+            --bench bus --bench batches --bench parameter_sets --bench sent_packets --bench demux --bench receive_bursts --bench ladder --bench fanout --bench include
         criterion audio-capture -p moq-audio --features capture --bench capture
         # moq-auth's published release is its own dev-dependency, so `-p moq-auth` is ambiguous.
         # The concurrent cases' latency percentiles stay in the run's stdout.

From 7a83632db7f29cb9d9dfadd1546d9711ff6681e4 Mon Sep 17 00:00:00 2001
From: Luke Curley <kixelated@gmail.com>
Date: Thu, 5 Nov 2026 20:12:30 +0000
Subject: [PATCH 13/36] fix(mux): recover underestimated TS mux rates (#7967)

Co-authored-by: GPT-6.1 Sol <noreply@openai.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 quest/m1/ts-reliability/README.md         |  1 -
 quest/m1/ts-reliability/mux-rate-raise.md | 49 ------------------
 rs/moq-mux/src/container/ts/import.rs     |  4 +-
 rs/moq-mux/src/container/ts/mux_rate.rs   | 62 ++++++++++++++++++++---
 rs/moq-mux/src/container/ts/schedule.rs   | 41 ++++++++++++---
 5 files changed, 92 insertions(+), 65 deletions(-)
 delete mode 100644 quest/m1/ts-reliability/mux-rate-raise.md

diff --git a/quest/m1/ts-reliability/README.md b/quest/m1/ts-reliability/README.md
index c748727a633..3557b6a4e99 100644
--- a/quest/m1/ts-reliability/README.md
+++ b/quest/m1/ts-reliability/README.md
@@ -135,7 +135,6 @@ catalog linger (#5305).
 
 ## Required
 
-- [A CBR import's muxRate can't stick low](/quest/m1/ts-reliability/mux-rate-raise.md) - a stable window above the published rate raises it, and an export's deadline miss names the rate it needed
 - [The TS export flags a PCR only where its clock jumps](/quest/m1/ts-reliability/pcr-jump-flag.md) - a padded skip goes out unflagged; a schedule that skips slots flags the jump
 
 ## Related
diff --git a/quest/m1/ts-reliability/mux-rate-raise.md b/quest/m1/ts-reliability/mux-rate-raise.md
deleted file mode 100644
index 1444cab70a0..00000000000
--- a/quest/m1/ts-reliability/mux-rate-raise.md
+++ /dev/null
@@ -1,49 +0,0 @@
-# [S] A CBR import's muxRate can't stick low
-
-## Goal
-
-`moq import ts` never keeps publishing a CBR `muxRate` below what the feed
-carries because one measurement window lost a few packets: a stable window
-that beats the published rate by more than about one packet raises it. When
-`moq export ts` misses a decode deadline at its padded rate, its error names
-the rate the content needed.
-
-## Plan
-
-Reported in [moq-dev/moq#7958](https://github.com/moq-dev/moq/issues/7958)
-and verified against `main`: `Meter::judge`
-(`rs/moq-mux/src/container/ts/mux_rate.rs`) publishes the first stable 2 s
-window and replaces it only past `DRIFT` (1%). A window about 63 packets short
-(an SRT reconnect under 1 s, so no reset) is still stable, so the import
-published 24,952,666 b/s for a 25 Mb/s feed and kept it for days. A
-supervised restart reuses that value (`Meter::measured`). An export padding to
-it with no source stuffing to give back missed a deadline every 10 to 20
-minutes, once its `--delay` was used up.
-
-Decided 2026-11-05 (maintainer, /quest-import):
-
-- ✅ Asymmetric hysteresis on the import. Lost or late packets only ever lower
-  a window, so a stable window above the published rate by more than about
-  one packet per window replaces it; a lower one replaces it only past
-  `DRIFT`, which keeps DRIFT's anti-churn intent. It converges in one good
-  window and republishes about once, and restart reuse carries the corrected
-  value. Not chosen: the reporter's cumulative average over every stable
-  window since the last discontinuity (approaches from below, republishes
-  several times early), or both combined (more state).
-- ✅ The export keeps failing on a missed deadline, and its `missed()` error
-  (`schedule.rs`) adds the rate the content needed, from the padded rate plus
-  the backlog over the elapsed time. Not chosen: a backlog-slope detector that
-  fails before the delay runs out (a window and threshold to tune for a case
-  the import fix removes), or the export raising its padded rate itself
-  (breaks the CBR contract that two exporters lay a slot the same way).
-
-Tests: a meter fed one short window, then exact ones, publishes the exact rate
-after one window and holds it; a window below by under 1% still doesn't
-republish. The export's deadline-miss error carries the needed rate.
-
-Public API: none. Wire: none; the catalog's `mpegts.muxRate` gets more
-accurate.
-
-## Closes
-
-- [#7958](https://github.com/moq-dev/moq/issues/7958) - `import ts` keeps a CBR feed's `muxRate` from one 2 s window
diff --git a/rs/moq-mux/src/container/ts/import.rs b/rs/moq-mux/src/container/ts/import.rs
index 030061de192..93315b93318 100644
--- a/rs/moq-mux/src/container/ts/import.rs
+++ b/rs/moq-mux/src/container/ts/import.rs
@@ -1769,8 +1769,8 @@ impl<E: catalog::Catalog> Import<E> {
 	}
 
 	/// Copy the measured multiplex rate into the `mpegts` section, publishing the
-	/// catalog. Called only when the measurement changed, so a steady source never
-	/// republishes.
+	/// catalog. Called only when the measurement changed, so a steady source republishes
+	/// only when a window sets a new high, ever more rarely.
 	fn record_mux_rate(&mut self) -> anyhow::Result<()> {
 		let rate = self.mux_rate.published();
 		if let Some(mpegts) = self.catalog.modify()?.ext.mpegts_mut() {
diff --git a/rs/moq-mux/src/container/ts/mux_rate.rs b/rs/moq-mux/src/container/ts/mux_rate.rs
index 1c2006d34c5..f28af7378aa 100644
--- a/rs/moq-mux/src/container/ts/mux_rate.rs
+++ b/rs/moq-mux/src/container/ts/mux_rate.rs
@@ -32,8 +32,8 @@ pub(super) const MAX_INTERVAL: u64 = PCR_HZ;
 /// samples while its whole-window average holds far tighter; a VBR source is off by
 /// multiples.
 const AGREEMENT: u64 = 20;
-/// How far a stable window must move before the published rate follows it, in
-/// thousandths, so measurement noise never touches the catalog.
+/// How far a stable window must fall before the published rate follows it, in
+/// thousandths, so packet loss does not keep lowering the catalog.
 const DRIFT: u64 = 10;
 
 /// Packets over the PCR ticks they were paced across.
@@ -148,6 +148,7 @@ impl Meter {
 		let window = std::mem::take(&mut self.window);
 		let mut whole = Interval::default();
 		window.iter().for_each(|s| whole.add(*s));
+		let packet = (PACKET_BITS * PCR_HZ).div_ceil(whole.ticks);
 		let rate = whole.rate();
 		let stable = window.iter().all(|s| s.agrees(rate));
 		match self.published {
@@ -156,9 +157,14 @@ impl Meter {
 				true
 			}
 			None => false,
-			// A stable window at a new rate replaces the old one once it has drifted.
+			// Loss only lowers a measurement. Recover after one good window, while
+			// tolerating one packet of rounding and retaining downward hysteresis.
 			Some(published) if stable => {
-				let drifted = rate.abs_diff(published) * 1000 > published * DRIFT;
+				let drifted = if rate > published {
+					rate - published > packet
+				} else {
+					(published - rate) * 1000 > published * DRIFT
+				};
 				if drifted {
 					self.published = Some(rate);
 				}
@@ -215,6 +221,50 @@ mod test {
 		assert_eq!(changes, vec![Some(2_499_999)], "published once, then held");
 	}
 
+	#[test]
+	fn a_short_window_recovers_after_one_good_window() {
+		let exact = (25_000, SAMPLE);
+		let expected = rate(exact.0 * 4, WINDOW);
+		let mut meter = Meter::default();
+		let short = [(24_937, SAMPLE), exact, exact, exact];
+		assert_eq!(feed(&mut meter, short), vec![Some(rate(99_937, WINDOW))]);
+		assert_eq!(feed(&mut meter, [exact; 4]), vec![Some(expected)]);
+		assert!(feed(&mut meter, [exact; 8]).is_empty());
+		assert!(feed(&mut meter, short).is_empty(), "small downward drift holds");
+
+		let mut reused = Meter::measured(Some(rate(99_937, WINDOW)));
+		assert_eq!(feed(&mut reused, [exact; 4]), vec![Some(expected)]);
+	}
+
+	#[test]
+	fn upward_rounding_of_one_packet_holds() {
+		// Real windows overshoot two seconds; one packet need not be an integer rate.
+		let ticks = SAMPLE + 75_000;
+		let published = rate(100_000, ticks * 4);
+		let mut meter = Meter::measured(Some(published));
+		assert!(
+			feed(
+				&mut meter,
+				[(25_000, ticks), (25_000, ticks), (25_000, ticks), (25_001, ticks)]
+			)
+			.is_empty()
+		);
+		assert_eq!(
+			feed(&mut meter, [(25_001, ticks); 4]),
+			vec![Some(rate(100_004, ticks * 4))]
+		);
+	}
+
+	#[test]
+	fn upward_noise_republishes_only_at_a_new_high() {
+		let (low, high) = ((25_000, SAMPLE), (25_002, SAMPLE));
+		let mut meter = Meter::measured(Some(rate(100_000, WINDOW)));
+		assert_eq!(feed(&mut meter, [high; 4]), vec![Some(rate(100_008, WINDOW))]);
+		// Each upward step raises the bar, so jitter below the high mark never republishes.
+		let jitter = [[low; 4], [high; 4], [low, high, low, high]].concat().repeat(4);
+		assert!(feed(&mut meter, jitter).is_empty());
+	}
+
 	#[test]
 	fn vbr_never_publishes() {
 		let mut meter = Meter::default();
@@ -237,8 +287,8 @@ mod test {
 		assert!(feed(&mut meter, glitch).is_empty());
 		assert_eq!(meter.published(), Some(2_499_999));
 
-		// Half a percent is noise; the catalog does not follow it.
-		let noise = std::iter::repeat_n((44, 711_000), PER_WINDOW);
+		// A downward half-percent fluctuation does not change the catalog.
+		let noise = std::iter::repeat_n((44, 718_400), PER_WINDOW);
 		assert!(feed(&mut meter, noise).is_empty());
 
 		// A stable window at a clearly different rate replaces the published one.
diff --git a/rs/moq-mux/src/container/ts/schedule.rs b/rs/moq-mux/src/container/ts/schedule.rs
index 930f72d8b35..cb17a1554d2 100644
--- a/rs/moq-mux/src/container/ts/schedule.rs
+++ b/rs/moq-mux/src/container/ts/schedule.rs
@@ -582,6 +582,9 @@ pub(super) struct Schedule {
 	window: u128,
 	/// The multiplex rate, in bits per second.
 	rate: Option<u64>,
+	/// Full padded slots at the current rate since one last had a spare null position: how
+	/// long, with the slot being laid out, the backlog a deadline miss reports has built.
+	busy_slots: u128,
 	/// The next slot to lay out.
 	next: Option<u128>,
 	/// The latest due slot pushed: the clock runs at least that far.
@@ -634,6 +637,7 @@ impl Schedule {
 			units: VecDeque::new(),
 			window: slot(window.as_nanos()),
 			rate: None,
+			busy_slots: 0,
 			next: None,
 			horizon: None,
 			last: None,
@@ -692,6 +696,9 @@ impl Schedule {
 
 	/// Pad to `rate` bits per second from the next slot on, or stop padding.
 	pub fn set_rate(&mut self, rate: Option<u64>) {
+		if self.rate != rate {
+			self.busy_slots = 0;
+		}
 		self.rate = rate;
 	}
 
@@ -1020,8 +1027,9 @@ impl Schedule {
 		let Some(program) = &self.units[i].tables else {
 			return false;
 		};
-		self.clock = Some(program.clock);
-		self.rate = program.rate;
+		let (clock, rate) = (program.clock, program.rate);
+		self.clock = Some(clock);
+		self.set_rate(rate);
 		if std::mem::take(&mut self.opening) {
 			self.clocked = self.clocked.max(index + OPENING);
 		}
@@ -1052,6 +1060,7 @@ impl Schedule {
 		self.system = None;
 		self.mb.clear();
 		self.next = None;
+		self.busy_slots = 0;
 		self.horizon = None;
 		self.last = None;
 		self.ended = false;
@@ -1493,7 +1502,7 @@ impl Schedule {
 					&& pid == unit.pid
 					&& done > unit.timing.decode as i128
 				{
-					return Err(self.missed(pid, rate));
+					return Err(self.missed(pid, index, rate));
 				}
 				self.transport.insert(tb, (arrived, since));
 				if let Some((empty, floor_empty, _)) = bsys {
@@ -1584,19 +1593,31 @@ impl Schedule {
 			&& let Some(unit) = self.units.iter().find(|unit| {
 				!unit.late && unit.place.is_none() && unit.timing.by as i128 <= end && unit.remaining() > 0
 			}) {
-			return Err(self.missed(unit.pid, rate));
+			return Err(self.missed(unit.pid, index, rate));
 		}
 		for unit in self.units.iter().filter(|unit| unit.remaining() == 0) {
 			self.decoding.extend(unit.leaving());
 		}
 		self.units.retain(|unit| unit.remaining() > 0);
+		self.busy_slots = if out.nulls > 0 { 0 } else { self.busy_slots + 1 };
 		Ok(out)
 	}
 
 	/// The error for a unit on `pid` that misses its decode deadline at `rate`, naming what
 	/// would carry it: the delay at which it goes as far ahead as its decoder buffer holds,
 	/// where the window cut it short, else a faster multiplex.
-	fn missed(&self, pid: u16, rate: u64) -> anyhow::Error {
+	fn missed(&self, pid: u16, index: u128, rate: u64) -> anyhow::Error {
+		// Every slot since the last with a spare null position went out full, so the packets
+		// released by now and still unsent built up over that stretch alone. Units not yet
+		// released are the delay's lookahead, not a deficit.
+		let backlog: u128 = self
+			.units
+			.iter()
+			.filter(|unit| self.release(unit) <= index)
+			.map(|unit| unit.remaining() as u128)
+			.sum();
+		let elapsed = (self.busy_slots + 1) * PCR_INTERVAL.as_nanos();
+		let needed = u128::from(rate) + (backlog * TsPacket::SIZE as u128 * 8 * 1_000_000_000).div_ceil(elapsed);
 		let reach = self
 			.buffers
 			.get(&pid)
@@ -1605,11 +1626,11 @@ impl Schedule {
 			.filter(|&reach| reach > self.window);
 		match reach {
 			Some(reach) => anyhow::anyhow!(
-				"MPEG-TS output missed a decode deadline on PID {pid} at {rate} b/s; raise the delay to {:?}, which sends it as far ahead as its decoder buffer holds, or the multiplex rate",
+				"MPEG-TS output missed a decode deadline on PID {pid} at {rate} b/s (estimated needed rate {needed} b/s); raise the delay to {:?}, which sends it as far ahead as its decoder buffer holds, or the multiplex rate",
 				PCR_INTERVAL * u32::try_from(reach).unwrap_or(u32::MAX)
 			),
 			None => anyhow::anyhow!(
-				"MPEG-TS output missed a decode deadline on PID {pid} at {rate} b/s, sent as far ahead as its decoder buffer holds; raise the multiplex rate"
+				"MPEG-TS output missed a decode deadline on PID {pid} at {rate} b/s (estimated needed rate {needed} b/s), sent as far ahead as its decoder buffer holds; raise the multiplex rate"
 			),
 		}
 	}
@@ -2704,10 +2725,16 @@ mod tests {
 					..VIDEO
 				},
 			);
+			// Padding with room to spare before the burst is no part of its deficit.
+			schedule.push(1, timing(950), unit(1, 10), true).unwrap();
 			schedule.push(1, timing(1_000), unit(1, 200), true).unwrap();
+			schedule.push(1, timing(2_000), unit(1, 10), false).unwrap();
 			let err = std::iter::from_fn(|| schedule.next(None).transpose()).find_map(Result::err);
 			let err = err.expect("a burst past the window must fail the export").to_string();
 			assert!(err.contains(fix), "window {window} ms, reach {reach} ms: {err}");
+			// Three full 40-packet slots each send 39 media packets. The 83 left over 75 ms
+			// add 1,664,427 b/s to the grid; the unreleased future unit adds nothing.
+			assert!(err.contains("estimated needed rate 4070827 b/s"), "{err}");
 		}
 	}
 

From a14995f8953875801452643d5fb401564e74e74c Mon Sep 17 00:00:00 2001
From: Luke Curley <kixelated@gmail.com>
Date: Thu, 5 Nov 2026 20:35:27 +0000
Subject: [PATCH 14/36] fix(mux,quic): clear the fmp4 and connection fuzz
 findings (#7961)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 quest/m1/fuzz-findings/README.md              |  46 ++++++++++--------
 rs/moq-mux/CHANGELOG.md                       |   1 +
 .../fuzz/regressions/cmaf/metadata-preflight  | Bin 0 -> 816 bytes
 .../regressions/fmp4/fieldless-trun-count     | Bin 0 -> 2036 bytes
 rs/moq-mux/src/container/fmp4/import.rs       |  32 +++++++++---
 rs/moq-mux/src/container/fmp4/metadata.rs     |  22 ++++++---
 rs/moq-mux/src/container/fmp4/mod.rs          |  20 +++++---
 ...h-a0ef11af573b106e4f66ab4007f9f5ebc61cffee | Bin 0 -> 966 bytes
 rs/moq-quic/src/fuzz/connection.rs            |   7 +--
 9 files changed, 86 insertions(+), 42 deletions(-)
 create mode 100644 rs/moq-mux/fuzz/regressions/cmaf/metadata-preflight
 create mode 100644 rs/moq-mux/fuzz/regressions/fmp4/fieldless-trun-count
 create mode 100644 rs/moq-quic/fuzz/regressions/connection/crash-a0ef11af573b106e4f66ab4007f9f5ebc61cffee

diff --git a/quest/m1/fuzz-findings/README.md b/quest/m1/fuzz-findings/README.md
index f80f6e21003..6878a9b6694 100644
--- a/quest/m1/fuzz-findings/README.md
+++ b/quest/m1/fuzz-findings/README.md
@@ -11,21 +11,32 @@ Each fixed finding's minimized input is committed under the target's
 ## Plan
 
 [moq-dev/moq#7313](https://github.com/moq-dev/moq/pull/7313) added the
-targets and landed with six nightly jobs red (decided 2026-10-30,
-maintainer). Its short local runs found the bugs the children fix; the
-minimized inputs are in [its PR comment](https://github.com/moq-dev/moq/pull/7313#issuecomment-6520535160).
-
-Each child commits its input under `regressions/` with its fix, since an
-input committed before the fix would fail the merge gate. Every known finding
-is now fixed: run every target nightly for a few sessions; a new finding
-becomes a child here.
-
-Decided 2026-11-05 (maintainer, /quest-plan): keep this epic as an `[S]` watcher after
-[moq-dev/moq#7690](https://github.com/moq-dev/moq/pull/7690) removed its last
-child, since Fuzz (annexb), (fmp4), (ts), and (ingest) were still red on
-2026-11-05. An agent triages each red target into a child quest (an
-intermittent failure joins m0's test flakes instead), and the epic is deleted
-once every target runs green. Not chosen: deleting it now.
+targets, and its children fixed the findings from its short local runs.
+Each fix commits its input under `regressions/` with the fix, since an
+input committed before the fix would fail the merge gate.
+
+Decided 2026-11-05 (maintainer, /quest-plan): this epic stays an `[S]`
+watcher. An agent triages each red target into a child quest; an
+intermittent failure joins m0's [test flakes](/quest/m0/test-flakes-2/README.md)
+instead. The epic is deleted once every target runs green. Not chosen:
+deleting it once its last child merged.
+
+Triage of the 2026-11-03 to 2026-11-05 scheduled runs
+([moq-dev/moq#7961](https://github.com/moq-dev/moq/pull/7961)):
+
+- `annexb` (scuffle-h265 SPS overflow) and `ts` (step look-ahead overflow),
+  2026-11-03: fixed by [moq-dev/moq#7685](https://github.com/moq-dev/moq/pull/7685)
+  and [moq-dev/moq#7683](https://github.com/moq-dev/moq/pull/7683), which
+  committed the inputs.
+- `cmaf` (out of memory on received metadata), 2026-11-04: fixed by
+  [moq-dev/moq#7843](https://github.com/moq-dev/moq/pull/7843); moq-dev/moq#7961
+  commits its input as `cmaf/metadata-preflight`.
+- `fmp4` (allocation bound), 2026-11-04 and 2026-11-05: a field-less `trun`
+  declared 65,792 samples in a 104-byte `moof`. Fixed in moq-dev/moq#7961 by
+  holding a fragment to one sample per metadata byte past a base.
+
+What remains: watch the next scheduled runs. When every media target has
+run green, delete this epic. A new finding becomes a child here.
 
 For the crates outside the `kixelated` and `moq-dev` orgs, moq-mux fixes
 the bug on its own side and the bug is reported upstream (decided
@@ -35,8 +46,3 @@ the bug on its own side and the bug is reported upstream (decided
 (scuffle-h265), and [ScuffleCloud/scuffle#654](https://github.com/ScuffleCloud/scuffle/issues/654)
 (scuffle-expgolomb). Posting anything further on those repos still needs the
 maintainer's approval.
-
-[moq-dev/moq#7234](https://github.com/moq-dev/moq/pull/7234) replaced
-webm-iterable's block parsing with moq-mux's own block-header reader, which
-fixed the MKV block-header panic; its input is
-`rs/moq-mux/fuzz/regressions/mkv/short-block-header`.
diff --git a/rs/moq-mux/CHANGELOG.md b/rs/moq-mux/CHANGELOG.md
index a9216f84097..b1e88798335 100644
--- a/rs/moq-mux/CHANGELOG.md
+++ b/rs/moq-mux/CHANGELOG.md
@@ -22,6 +22,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Fixed
 
+- A `moof` declares at most one sample per byte of its metadata past 4,096, besides `fmp4::MAX_FRAGMENT_SAMPLES`, or it is refused with `Error::TooManySamples` before planning. A run without per-sample fields stores only a count, so a 104-byte `moof` could plan 65,792 samples (7 MB) before any payload arrived; every run with per-sample fields already pays at least 4 bytes a sample.
 - Received CMAF init segments and fragments use the importer's metadata and sample limits before mp4-atom parses any box, including discarded known types and the children it keeps from spatial sample-entry boxes. MSF catalog derivation and regular MP4 recording share the checks; zero-byte entry counts cannot amplify a small input.
 
 - fMP4 import bounds what a `moov` or `moof` costs to parse and plan: a body over `fmp4::MAX_METADATA_BYTES` (2 MiB) is refused at its header, since parsing expands it up to tenfold, a `moof` of more than `fmp4::MAX_FRAGMENT_SAMPLES` (now 131,072) samples is refused before planning, and a `moov` of more than `fmp4::MAX_TRACKS` (256) tracks with `Error::TooManyTracks` before any is created. `fmp4::MAX_HELD_BYTES` (32 MiB) now bounds only a text sample. A 116-byte `moof` no longer plans 584 MB.
diff --git a/rs/moq-mux/fuzz/regressions/cmaf/metadata-preflight b/rs/moq-mux/fuzz/regressions/cmaf/metadata-preflight
new file mode 100644
index 0000000000000000000000000000000000000000..0deb7158b8ee771129bcd783be6b01b0bc81e12a
GIT binary patch
literal 816
zcmZRoXJBA>Q=DFq0;Cx-i}Q1V*etie#1P08DM?EyVFXElfktjwY6Xy`P*Mb@L4sge
z5Rp|@U|<0f0Rn^;2%mw`f#Cy#2b2S$m|vi985k5ZQgVu5Vr7{rsW3K-{+7#tp@{>V
zCdN9L76yiIxtV!sK(0y(h~{9BNhwMN@j(FOOrFxB{~+g~0{q5~1`;^5@COo53Gre7
kVFM7Tg9t1DWErD(Zc1h%D8fWaXlF8VYR62mAn$kp02>~R&;S4c

literal 0
HcmV?d00001

diff --git a/rs/moq-mux/fuzz/regressions/fmp4/fieldless-trun-count b/rs/moq-mux/fuzz/regressions/fmp4/fieldless-trun-count
new file mode 100644
index 0000000000000000000000000000000000000000..f488882380bf7ed3fc59c01723571854596460d2
GIT binary patch
literal 2036
zcmb_cO=uHQ5T4ylDq_)8QfX<iTN|i?q)Dr_c<I(EZNZ-&^iWW7n@yU~-E7!>S^qA3
zQ1Ivvf<G6p(&8T;1U(cH6}?yrdeq)TL=Y4N(K_?8Nw(Xx_RvY*&b*m<GjHB}?`Z(g
znqg-PIos?75P^8g$fS(It|UNMGECD!AKh@W8gd^=pZP=pz<-q%O;8<}D^<^0l8Ad~
zWR^OK#^Y>~=ahVofoLmO0-g%GhH;4RXpQjD&~hpYvY`d*Ix#~Y$6nAE_GLBQ;u3zG
zoR%)j#J3Obkh>F!J@SxgPUvZQB%g}QPNFZK?1_^;jy}SWk;`XLh&l$(<lk3JE7@8#
zD@{H`WUnt;x?GZlbv7H<QGRMOyW9ctnNpn;c8HTdCRc>1&S4a35CuHwBm&g5uz;E*
zMjaG1Xj_<v<_YA}u?vE-<!eX*kN`jR9WU#z3J}hI>wf(J7eorGT|iC=Xhg@E#gGGR
z9Y4(n`q+%wTvz(w+)nxCQJkOi%}GR`lv&jYvnzlCL9>JeUU8u8;4vtRmI=o4pqSoI
zuC+j6o5j38%&I^kd7y~chF)$e1z80k;FSl6^8r9i;+0jsomA@<Aws&+{-GyrYrGSZ
z>$=<Ux`&WQl}2(AzFeabMvb^RQin{SgRM5yb3ol1G!%vnCw&HE$;{#$#R`Z>E|cF*
z`>B>z@=%K!qq4`0H0Pvk_upD<s-+eRbcZUmGpE~x(%4;Q63SXNl`rPO52{Y4HyOuY
zB7rs?pFp~t5hGK1D#-6BB9innBfSWFQ6@bO{xp6lK@g%WqcI*BjR4o_)5NS|9(8mN
z$;3Pee>89-IG;;ja$Twa@6TTcj`X~3c`Wx|JoNtd^EX!>J)8f%yA#2Pk7D^hdh^D>
z?ESgey*pgD=@c}~K#Ky06`>8JClGOA48%Uz@Ci<WC__VaX(a{<UFCRw<(kRL0G5@l
zag<c~XpN)vdL2SDa3CTN93`1hS2{{MMjG@OHPA7(!^mZ^89H24)Jlxy{x|V@uP=eb
zd{fIOmRC+pt7}y(@cmD5@N_N(4_#7j<B4&C{!}opxXS}h$H1-7#=-tS-)r|6+gbPH
EACNEzbpQYW

literal 0
HcmV?d00001

diff --git a/rs/moq-mux/src/container/fmp4/import.rs b/rs/moq-mux/src/container/fmp4/import.rs
index 7552c86dcc3..d11125c7c14 100644
--- a/rs/moq-mux/src/container/fmp4/import.rs
+++ b/rs/moq-mux/src/container/fmp4/import.rs
@@ -355,9 +355,9 @@ impl<E: crate::catalog::hang::CatalogExt> Import<E> {
 	/// bounded: a `moov` or `moof` body larger than
 	/// [`MAX_METADATA_BYTES`](super::MAX_METADATA_BYTES), or a text sample larger than
 	/// [`MAX_HELD_BYTES`](super::MAX_HELD_BYTES), is refused before it is held. A `moof` declaring
-	/// more than [`MAX_FRAGMENT_SAMPLES`](super::MAX_FRAGMENT_SAMPLES) samples is refused before
-	/// they are planned, and a `moov` declaring more than [`MAX_TRACKS`](super::MAX_TRACKS)
-	/// tracks before any is created.
+	/// more than [`MAX_FRAGMENT_SAMPLES`](super::MAX_FRAGMENT_SAMPLES) samples, or more than its
+	/// size accepts, is refused before they are planned, and a `moov` declaring more than
+	/// [`MAX_TRACKS`](super::MAX_TRACKS) tracks before any is created.
 	///
 	/// A decode error is terminal: later decodes, cuts, seeks and discontinuities return the same
 	/// error without reading input or changing the tracks.
@@ -2100,10 +2100,18 @@ mod tests {
 			import.finish().unwrap();
 		}
 
-		// At the bound, the moof is accepted.
-		let (mut import, id, _) = initialized(false);
-		import.decode(&inherited_moof(id, &[half, half])).unwrap();
+		// A short moof declares one field-less sample per body byte past the base, and no more.
+		let (_, id, _) = initialized(false);
+		let fit = (super::super::FRAGMENT_SAMPLE_BASE as usize + inherited_moof(id, &[0]).len() - 8) as u32;
+		let (mut import, _, _) = initialized(false);
+		import.decode(&inherited_moof(id, &[fit])).unwrap();
 		assert!(import.moof.is_some());
+		let (mut import, _, _) = initialized(false);
+		let err = import.decode(&inherited_moof(id, &[fit + 1])).unwrap_err();
+		assert!(
+			matches!(err, crate::Error::Cmaf(Error::TooManySamples(count)) if count == u64::from(fit) + 1),
+			"{err:?}"
+		);
 	}
 
 	/// A fragment within the bounds plans within [`MAX_HELD_BYTES`](super::super::MAX_HELD_BYTES)
@@ -2145,12 +2153,22 @@ mod tests {
 				.collect()
 		};
 		let start = runs_moof(id, gapped(0)).len() + 8;
+		// Field-less samples past the base need a byte each, which entries supply here.
+		let mut paid = entries(MAX_FRAGMENT_SAMPLES as usize / 4, small);
+		paid.push(mp4_atom::Trun {
+			data_offset: None,
+			samples: mp4_atom::TrunSamples::Inherited {
+				count: (MAX_FRAGMENT_SAMPLES - MAX_FRAGMENT_SAMPLES / 4) as u32,
+				first_flags: None,
+			},
+		});
 		let inputs = [
 			(
 				"field-less runs",
 				inherited_moof(id, &[MAX_FRAGMENT_SAMPLES as u32]),
-				None,
+				Some(MAX_FRAGMENT_SAMPLES as usize),
 			),
+			("field-less runs paid in bytes", runs_moof(id, paid), None),
 			("full entries", runs_moof(id, entries(room / 16, full)), None),
 			(
 				"4-byte entries",
diff --git a/rs/moq-mux/src/container/fmp4/metadata.rs b/rs/moq-mux/src/container/fmp4/metadata.rs
index 6dee8d2de80..e8a3fe28de0 100644
--- a/rs/moq-mux/src/container/fmp4/metadata.rs
+++ b/rs/moq-mux/src/container/fmp4/metadata.rs
@@ -5,20 +5,20 @@
 
 use mp4_atom::{Decode, FourCC, Header};
 
-use super::{Error, MAX_FRAGMENT_SAMPLES, MAX_METADATA_BYTES, MAX_TRACKS, Result};
+use super::{Error, FRAGMENT_SAMPLE_BASE, MAX_FRAGMENT_SAMPLES, MAX_METADATA_BYTES, MAX_TRACKS, Result};
 
 /// Check every box, including ones a caller or mp4-atom will discard.
 pub(crate) fn check(data: &[u8]) -> Result<()> {
 	let mut scan = Scan::default();
 	scan.boxes(data, Namespace::Any)?;
-	scan.finish()
+	scan.finish(data.len())
 }
 
 /// Check a body already framed by the streaming importer.
 pub(super) fn body(kind: FourCC, data: &[u8]) -> Result<()> {
 	let mut scan = Scan::default();
 	scan.body(kind, data)?;
-	scan.finish()
+	scan.finish(data.len())
 }
 
 #[derive(Clone, Copy)]
@@ -43,8 +43,9 @@ struct Scan {
 }
 
 impl Scan {
-	fn finish(self) -> Result<()> {
-		if self.samples > MAX_FRAGMENT_SAMPLES {
+	/// Check the counts gathered from `len` bytes of metadata.
+	fn finish(self, len: usize) -> Result<()> {
+		if self.samples > MAX_FRAGMENT_SAMPLES.min(FRAGMENT_SAMPLE_BASE + len as u64) {
 			return Err(Error::TooManySamples(self.samples));
 		}
 		if self.groups > MAX_FRAGMENT_SAMPLES {
@@ -278,8 +279,17 @@ pub(crate) mod tests {
 
 	#[test]
 	fn counts_are_checked_across_runs_and_tracks_before_parsing() {
+		// A field-less run stores only a count, so a short moof gets one sample per byte past the base.
+		let short = |count| check(&boxed(b"moof", &boxed(b"traf", &inherited(count))));
+		let fit = (FRAGMENT_SAMPLE_BASE as usize + boxed(b"moof", &boxed(b"traf", &inherited(0))).len()) as u32;
+		short(fit).unwrap();
+		assert!(matches!(short(fit + 1), Err(Error::TooManySamples(count)) if count == u64::from(fit) + 1));
+
+		// Bytes the moof carries, here a padding box, pay for samples up to the cap, which sums
+		// across runs and tracks.
 		let half = (MAX_FRAGMENT_SAMPLES / 2) as u32;
-		let mut data = boxed(b"traf", &inherited(half));
+		let mut data = boxed(b"free", &vec![0; MAX_FRAGMENT_SAMPLES as usize]);
+		data.extend(boxed(b"traf", &inherited(half)));
 		data.extend(boxed(b"traf", &inherited(half)));
 		check(&boxed(b"moof", &data)).unwrap();
 		data.extend(boxed(b"traf", &inherited(1)));
diff --git a/rs/moq-mux/src/container/fmp4/mod.rs b/rs/moq-mux/src/container/fmp4/mod.rs
index 53d6d7f108b..9fb800207fa 100644
--- a/rs/moq-mux/src/container/fmp4/mod.rs
+++ b/rs/moq-mux/src/container/fmp4/mod.rs
@@ -46,10 +46,18 @@ pub const MAX_METADATA_BYTES: usize = MAX_HELD_BYTES / 16;
 ///
 /// Every sample's byte range is resolved before any of the fragment publishes, at about 200 bytes
 /// a sample, so a fragment at this bound plans within [`MAX_HELD_BYTES`]. A `moof` at
-/// [`MAX_METADATA_BYTES`] holds this many 16-byte `trun` entries; a run without per-sample fields
-/// could otherwise declare billions of samples in a few bytes.
+/// [`MAX_METADATA_BYTES`] holds this many 16-byte `trun` entries. A shorter fragment is also held
+/// to one sample per metadata byte past the first 4,096.
 pub const MAX_FRAGMENT_SAMPLES: u64 = (MAX_METADATA_BYTES / 16) as u64;
 
+/// Samples a fragment may declare beyond one per byte of its metadata.
+///
+/// A `trun` entry is at least 4 bytes, so only a run without per-sample fields, which stores just
+/// a count, can declare more samples than it has bytes. Its plan is reserved before any payload
+/// arrives, so this keeps a few-byte `moof` from planning megabytes. A live fragment is a handful
+/// of samples.
+pub(crate) const FRAGMENT_SAMPLE_BASE: u64 = 4096;
+
 /// The most tracks [`Import`] accepts from one `moov`, refused before any is created.
 ///
 /// Each track costs about 16 KiB to parse and set up, and keeps its catalog entry and output
@@ -241,10 +249,10 @@ pub enum Error {
 	#[error("text sample of {0} bytes is more than the {MAX_HELD_BYTES} an importer holds")]
 	TextSampleTooLarge(usize),
 
-	/// A fragment declaring more than [`MAX_FRAGMENT_SAMPLES`] is refused before parsing.
-	/// A `trun` without per-sample fields declares its
-	/// count in four bytes, so the byte bound alone does not limit it.
-	#[error("moof declares {0} samples, more than the {MAX_FRAGMENT_SAMPLES} a fragment accepts")]
+	/// A fragment declaring more than [`MAX_FRAGMENT_SAMPLES`], or more than one sample per byte
+	/// of its metadata past a small base, is refused before parsing. A `trun` without per-sample
+	/// fields declares its count in four bytes, so the byte bound alone does not limit it.
+	#[error("moof declares {0} samples, more than a fragment of its size accepts")]
 	TooManySamples(u64),
 
 	/// A `moov` declaring more than [`MAX_TRACKS`] tracks is refused before any is created.
diff --git a/rs/moq-quic/fuzz/regressions/connection/crash-a0ef11af573b106e4f66ab4007f9f5ebc61cffee b/rs/moq-quic/fuzz/regressions/connection/crash-a0ef11af573b106e4f66ab4007f9f5ebc61cffee
new file mode 100644
index 0000000000000000000000000000000000000000..b45e537dcd55afd5d5830b861c8fb8e21bc7ee42
GIT binary patch
literal 966
zcmb2&cS2-ix2%ud>Y6u>40SB~xn{Upv%M*8TBX^c6ZE=nlhKys2q9xb)fZdW+4j}B
z&RlT6spLt=pNI#^3Xk<QPD|Z0SANrEWE-?pq)p#7#N*Ar3IG59ug}*xyUAW_clGhp
zVgJ+4COB+e_DT1w>gG4CMz1<dUv)fHUm>|6NgihRDyrGNW7jO{CG}Q<ep{AYx9DH=
zP3)#l$*(DY7cxKq%j^a1bBsL_#P=jfpR7N=Xkny&L&fp3#s#`FE2B&`V|XKU_vc@C
zkykcoH@!do+?3ONW|^j2?5_k0JiNaYmw3eKw-2JKbab+7x47t=*KgCPn^-WRxg{&8
zeHjFp06km}^fAzq^HHX|zt0YqFH`yOt=mb{)pqAj^@Q{1SD%^i+i3QlYb>XL?zG>}
zFrnkM7~cxH$w~|6Yn|&bH-6yd)RXh%y2R3dL9cBkSiRpKUrLw2!wkDT>|tjuI<@7X
zQtr1m=Z~CPake@c8t+?|ZQd*+V{h6Di}GU)9$ma8n~d)e3^Y(Gfd(3(Fhhjbz4(O7
zM28n6G*OV9&@mGm?ZWFwSY~SHd;X86?&l*CTi!38_5Uo>)DwCCt~Javj^_jb?hDGY

literal 0
HcmV?d00001

diff --git a/rs/moq-quic/src/fuzz/connection.rs b/rs/moq-quic/src/fuzz/connection.rs
index 3c08ec8610c..62efbfd2dbc 100644
--- a/rs/moq-quic/src/fuzz/connection.rs
+++ b/rs/moq-quic/src/fuzz/connection.rs
@@ -257,8 +257,9 @@ impl Peer {
 	/// so a frame they accept is never missed. Over-counting only skips a check.
 	///
 	/// `from` is the first byte that may differ from what the sender sent. Packets ending
-	/// before it are untouched, and a change inside a packet's tag alters nothing: the tag
-	/// is never checked and bounds no packet.
+	/// before it are untouched, and so are the frames of the packet whose tag holds it: the
+	/// tag is never checked and bounds no packet. Every later byte may differ, so every later
+	/// coalesced packet is decoded.
 	fn taint(&mut self, datagram: &[u8], from: usize) {
 		let parser = FixedLengthConnectionIdParser::new(CID_LEN);
 		let mut rest = Some(BytesMut::from(datagram));
@@ -274,7 +275,7 @@ impl Peer {
 				continue;
 			}
 			if start <= from && from + TAG_LEN >= end {
-				return;
+				continue;
 			}
 
 			let Ok(packet) = partial.finish(Some(&Clear)) else {

From acd799e1f9351eeeadcb46bd08738de4782daa90 Mon Sep 17 00:00:00 2001
From: Luke Curley <kixelated@gmail.com>
Date: Thu, 5 Nov 2026 12:41:13 -0800
Subject: [PATCH 15/36] chore(quest): claim quest/m0/nightly/macos.md

Quest-Claim: 19966b04994b0ad3

From 9d6ff119d9c7ca8943cabdac0d46858e6f61b42d Mon Sep 17 00:00:00 2001
From: Luke Curley <kixelated@gmail.com>
Date: Thu, 5 Nov 2026 12:43:48 -0800
Subject: [PATCH 16/36] fix(audio): drive the capture gap test on its local
 task

Co-Authored-By: GPT-6.1 Sol <noreply@openai.com>
---
 quest/m0/nightly/macos.md   | 48 +++++++++++++++++++++++++------------
 rs/moq-audio/src/capture.rs | 11 +++++----
 2 files changed, 40 insertions(+), 19 deletions(-)

diff --git a/quest/m0/nightly/macos.md b/quest/m0/nightly/macos.md
index 19577268b65..46627e90c9b 100644
--- a/quest/m0/nightly/macos.md
+++ b/quest/m0/nightly/macos.md
@@ -15,20 +15,38 @@ Planned 2026-11-05 (maintainer, /quest-plan of the follow-ups from the
 [moq-dev/moq#7653](https://github.com/moq-dev/moq/pull/7653), which saw the
 timeout. Milestone: ✅ m0.
 
-Since 2026-11-04 the job fails before any test runs
-([run 41979277343](https://github.com/moq-dev/moq/actions/runs/41979277343),
-`just rs macos-test`): the test `an_empty_gap_buffer_marks_the_next_samples`
-(`rs/moq-audio/src/capture.rs:859`) hands `tokio::spawn` a
-`capture::Producer::run()` future that is not `Send` on macOS, because
-`Producer` holds the ScreenCaptureKit `SCStream` across an await. It came with
-[moq-dev/moq#7706](https://github.com/moq-dev/moq/pull/7706). Decide from the
-type whether `Producer` should be `Send` (fix the field) or the test should
-drive it without spawning; don't paper over it in the test if real callers
-spawn it too. Check why the PR gate didn't catch a macOS-only test build
-error, and close that gap if it is cheap.
-
-Then read the job's next run for the websocket timeout. Reproduce it on macOS
-before fixing; if it never recurs across a week of scheduled runs, record that
-and finish.
+The capture gap-buffer test now drives `Producer::run()` and its reader in
+one task. `Producer::run` documents the macOS local-task requirement, and the
+CLI uses a `LocalSet` for capture (`rs/moq-cli/src/main.rs`). ScreenCaptureKit's
+handles stay non-Send; there is no new unsafe guarantee.
+
+The Linux-only PR gate cannot detect this macOS-only type error. Platform's
+existing `cargo check --all-targets` catches it, but runs nightly and on release
+PRs, with manual Platform dispatch available for platform changes. Adding a
+native macOS runner to every main PR is not a cheap check. Independent Nightly
+error reporting remains owned by
+[moq-dev/moq#7667](https://github.com/moq-dev/moq/pull/7667).
+
+The recorded websocket timeout in
+[November 2's scheduled job](https://github.com/moq-dev/moq/actions/runs/41483654426/job/125408628726)
+was already reproduced and fixed by
+[moq-dev/moq#7829](https://github.com/moq-dev/moq/pull/7829), merged November 4.
+The client could close before server admission finished; that PR joins both
+negotiation results before dropping it, and reports 100/100 native macOS passes.
+Do not duplicate that fix or infer a new failure from the old log.
+
+The [November 5 scheduled job](https://github.com/moq-dev/moq/actions/runs/42050683248/job/127326015410)
+still stops at the capture test's non-Send compile error, before any tests run.
+After the capture fix lands, inspect the next scheduled macOS job. Reproduce
+any recurring websocket timeout on macOS before changing it; if none recurs
+across a week of scheduled runs, record that evidence and finish.
 
 Public API: none. Wire: none.
+
+## Waiting
+
+- moq-dev/moq: after the capture fix lands, verify a green scheduled macOS job
+  on main and inspect the websocket test's results across a week of scheduled
+  runs. Recommendation: land the reviewed capture fix, then retain this quest
+  until the scheduled evidence is available. A branch dispatch can check the
+  fix but cannot establish the required scheduled-main history.
diff --git a/rs/moq-audio/src/capture.rs b/rs/moq-audio/src/capture.rs
index 16a8ad74325..ac65213af04 100644
--- a/rs/moq-audio/src/capture.rs
+++ b/rs/moq-audio/src/capture.rs
@@ -856,10 +856,13 @@ mod tests {
 		samples.try_push(Ok(Samples::plain(Vec::new(), true))).unwrap();
 		samples.try_push(Ok(Samples::plain(vec![0.25; 960], false))).unwrap();
 		samples.try_push(Ok(Samples::plain(vec![0.5; 960], false))).unwrap();
-		let run = tokio::spawn(producer.run());
-		assert!(reader.read().await.unwrap().gap);
-		assert!(!reader.read().await.unwrap().gap);
-		run.abort();
+		tokio::select! {
+			result = producer.run() => panic!("capture stopped: {result:?}"),
+			_ = async {
+				assert!(reader.read().await.unwrap().gap);
+				assert!(!reader.read().await.unwrap().gap);
+			} => {},
+		}
 	}
 
 	fn reader() -> (buffer::Writer, kio::Producer<Option<cpal::Error>>, MicrophoneReader) {

From ac64fc04a33bf69a93479117d50340057a5da60e Mon Sep 17 00:00:00 2001
From: Luke Curley <kixelated@gmail.com>
Date: Thu, 5 Nov 2026 12:48:26 -0800
Subject: [PATCH 17/36] docs(quest): explain the synthetic non-Send alternative

Co-Authored-By: GPT-6.1 Sol <noreply@openai.com>
---
 quest/m0/nightly/macos.md | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/quest/m0/nightly/macos.md b/quest/m0/nightly/macos.md
index 46627e90c9b..d9fe7628bb5 100644
--- a/quest/m0/nightly/macos.md
+++ b/quest/m0/nightly/macos.md
@@ -23,7 +23,12 @@ handles stay non-Send; there is no new unsafe guarantee.
 The Linux-only PR gate cannot detect this macOS-only type error. Platform's
 existing `cargo check --all-targets` catches it, but runs nightly and on release
 PRs, with manual Platform dispatch available for platform changes. Adding a
-native macOS runner to every main PR is not a cheap check. Independent Nightly
+native macOS runner to every main PR is not a cheap check. A test-only
+non-Send marker in the synthetic Linux stream was also considered: it would
+catch test spawns, but not production callers, and would remove coverage of
+Linux's supported Send contract from test builds. Keep the real platform
+types and the existing non-macOS Send assertions rather than change the test
+backend's contract to simulate one macOS constraint. Independent Nightly
 error reporting remains owned by
 [moq-dev/moq#7667](https://github.com/moq-dev/moq/pull/7667).
 

From 5d03931948872daf1c97a3fa7dddd09ada4f5ec8 Mon Sep 17 00:00:00 2001
From: Luke Curley <kixelated@gmail.com>
Date: Thu, 5 Nov 2026 20:49:39 +0000
Subject: [PATCH 18/36] fix(dev): keep the dev shell out of the MOQ_* namespace
 (#7979)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 flake.nix                 | 79 ++++++++++++++++++++++-----------------
 sh/dispatch-query.test.py |  2 +-
 sh/js/workspace.test.py   |  2 +-
 sh/local.test.py          |  6 +--
 sh/quest.sh               |  6 +--
 5 files changed, 53 insertions(+), 42 deletions(-)

diff --git a/flake.nix b/flake.nix
index 2d0545d981e..94ebd0dc3cf 100644
--- a/flake.nix
+++ b/flake.nix
@@ -691,40 +691,51 @@
             PATH=$(printf '%s' "$PATH" | awk -v RS=: '!seen[$0]++ { printf "%s%s", sep, $0; sep = ":" }')
           '';
 
-          env = {
-            # What sh/dispatch.sh checks before a scoped `just check` or `just
-            # fix`. IN_NIX_SHELL would also pass inside another project's shell.
-            IN_MOQ_DEV_SHELL = "1";
-
-            # Local launchers need the exact build without evaluating the flake again.
-            MOQ_QUEST = "${quest-cli}/bin/quest";
-
-            PLAYWRIGHT_BROWSERS_PATH = "${pkgs.playwright-driver.browsers}";
-            PLAYWRIGHT_VERSION = pkgs.playwright-driver.version;
-            PLAYWRIGHT_SKIP_VALIDATE_HOST_REQUIREMENTS = "true";
-
-            # Where `just obs compile` and `just obs test` look for libobs. Set
-            # on every platform so the plugin type-checks against the pinned OBS
-            # release everywhere, rather than whatever the host happens to have.
-            OBS_INCLUDE_DIR = "${obs-headers}/include/obs";
-
-            # What `just obs check` compares the two in-repo OBS pins against.
-            # Exported rather than read back out of nix, so the guard costs a
-            # variable lookup instead of a nested evaluation of this flake.
-            OBS_LINKED_VERSION = obs-linked-version;
-
-            # Link libvpx statically for moq-video's `vpx` feature, the shape the
-            # quest ships: no system codec library at runtime.
-            VPX_STATIC = "1";
-          }
-          // pkgs.lib.optionalAttrs (!pkgs.stdenv.hostPlatform.isDarwin) {
-            ALSA_PLUGIN_DIR = "${alsaPlugins}/lib/alsa-lib";
-            # Firefox loads these at runtime; harness.ts exposes them only to its process.
-            PLAYWRIGHT_FIREFOX_LIBRARY_PATH = pkgs.lib.makeLibraryPath [
-              pkgs.ffmpeg
-              pkgs.libpulseaudio
-            ];
-          };
+          # moq binaries reject any MOQ_* variable they don't read, so the
+          # shell must export none.
+          env =
+            let
+              vars = {
+                # What sh/dispatch.sh checks before a scoped `just check` or `just
+                # fix`. IN_NIX_SHELL would also pass inside another project's shell.
+                IN_MOQ_DEV_SHELL = "1";
+
+                # Local launchers need the exact build without evaluating the flake again.
+                # QUEST_* belongs to quest itself.
+                DEV_SHELL_QUEST = "${quest-cli}/bin/quest";
+
+                PLAYWRIGHT_BROWSERS_PATH = "${pkgs.playwright-driver.browsers}";
+                PLAYWRIGHT_VERSION = pkgs.playwright-driver.version;
+                PLAYWRIGHT_SKIP_VALIDATE_HOST_REQUIREMENTS = "true";
+
+                # Where `just obs compile` and `just obs test` look for libobs. Set
+                # on every platform so the plugin type-checks against the pinned OBS
+                # release everywhere, rather than whatever the host happens to have.
+                OBS_INCLUDE_DIR = "${obs-headers}/include/obs";
+
+                # What `just obs check` compares the two in-repo OBS pins against.
+                # Exported rather than read back out of nix, so the guard costs a
+                # variable lookup instead of a nested evaluation of this flake.
+                OBS_LINKED_VERSION = obs-linked-version;
+
+                # Link libvpx statically for moq-video's `vpx` feature, the shape the
+                # quest ships: no system codec library at runtime.
+                VPX_STATIC = "1";
+              }
+              // pkgs.lib.optionalAttrs (!pkgs.stdenv.hostPlatform.isDarwin) {
+                ALSA_PLUGIN_DIR = "${alsaPlugins}/lib/alsa-lib";
+                # Firefox loads these at runtime; harness.ts exposes them only to its process.
+                PLAYWRIGHT_FIREFOX_LIBRARY_PATH = pkgs.lib.makeLibraryPath [
+                  pkgs.ffmpeg
+                  pkgs.libpulseaudio
+                ];
+              };
+              moq = builtins.filter (pkgs.lib.hasPrefix "MOQ_") (builtins.attrNames vars);
+            in
+            assert pkgs.lib.assertMsg (
+              moq == [ ]
+            ) "dev shell must not export MOQ_* (moq binaries reject them): ${toString moq}";
+            vars;
         };
 
         formatter = pkgs.nixfmt-tree;
diff --git a/sh/dispatch-query.test.py b/sh/dispatch-query.test.py
index 346f8fe7454..b2669c5149d 100644
--- a/sh/dispatch-query.test.py
+++ b/sh/dispatch-query.test.py
@@ -288,7 +288,7 @@ def stub_ci(self, just=""):
         nix.chmod(0o755)
         quest = self.bin / "quest"
         quest.write_text('#!/usr/bin/env bash\nprintf "pinned quest %s\\n" "$*" >>"$CALLS"\n')
-        self.env.update(IN_MOQ_DEV_SHELL="1", MOQ_QUEST=str(quest), CALLS=str(self.root / "calls"))
+        self.env.update(IN_MOQ_DEV_SHELL="1", DEV_SHELL_QUEST=str(quest), CALLS=str(self.root / "calls"))
         (self.root / "calls").unlink(missing_ok=True)
         for script in ("markdown.sh", "shell.sh", "large-files.sh", "text.sh"):
             path = self.repo / "sh" / script
diff --git a/sh/js/workspace.test.py b/sh/js/workspace.test.py
index cdae09e53c9..9f9ad2bac50 100644
--- a/sh/js/workspace.test.py
+++ b/sh/js/workspace.test.py
@@ -79,7 +79,7 @@ def test_dispatcher_passes_only_js_impact_paths(self):
             env = dispatch_env(
                 PATH=f"{tools}:{os.environ['PATH']}",
                 ALLOW_HOST_TOOLCHAIN="1",
-                MOQ_QUEST=str(tools / "quest"),
+                DEV_SHELL_QUEST=str(tools / "quest"),
                 SELECT_CALLS=str(calls),
             )
         for script in ("markdown.sh", "shell.sh", "large-files.sh", "text.sh"):
diff --git a/sh/local.test.py b/sh/local.test.py
index b2cdb5a7ff4..74e6dc913bd 100644
--- a/sh/local.test.py
+++ b/sh/local.test.py
@@ -25,7 +25,7 @@ def env(self, **changes):
             "LOCAL_SUPERVISED",
             "GITHUB_ACTIONS",
             "NEXTEST_TEST_THREADS",
-            "MOQ_QUEST",
+            "DEV_SHELL_QUEST",
             "ALLOW_HOST_TOOLCHAIN",
             "BASH_ENV",
         ):
@@ -78,7 +78,7 @@ def test_admission_precedes_launch_and_nested_calls_skip_it(self):
                 f"sys.exit(subprocess.call([{BASH!r}, {str(LAUNCHER)!r}, "
                 'sys.executable, "-c", "print(\'inner\'); exit(11)"]))'
             )
-            result = self.run_command(script, PATH=directory, MOQ_QUEST=str(quest))
+            result = self.run_command(script, PATH=directory, DEV_SHELL_QUEST=str(quest))
             self.assertEqual(result.returncode, 11, result.stderr)
             self.assertEqual(result.stdout.splitlines(), ["admitted", "outer", "inner"])
 
@@ -101,7 +101,7 @@ def test_pinned_review_preserves_arguments_cwd_and_failure_without_host_fallback
             result = subprocess.run(
                 [BASH, str(ROOT / "sh/quest.sh"), "review", "--base", "origin/main", "--responses", "a file.json"],
                 cwd=directory,
-                env=self.env(PATH=directory, MOQ_QUEST=str(quest)),
+                env=self.env(PATH=directory, DEV_SHELL_QUEST=str(quest)),
                 capture_output=True,
                 text=True,
             )
diff --git a/sh/quest.sh b/sh/quest.sh
index e211493fe8f..9af9b60f4e8 100644
--- a/sh/quest.sh
+++ b/sh/quest.sh
@@ -3,9 +3,9 @@
 set -euo pipefail
 
 root=$(cd "${BASH_SOURCE[0]%/*}/.." && pwd)
-if [[ -n ${MOQ_QUEST:-} ]]; then
-    printf 'Dev-shell quest: %s\n' "$MOQ_QUEST" >&2
-    exec "$MOQ_QUEST" "$@"
+if [[ -n ${DEV_SHELL_QUEST:-} ]]; then
+    printf 'Dev-shell quest: %s\n' "$DEV_SHELL_QUEST" >&2
+    exec "$DEV_SHELL_QUEST" "$@"
 fi
 
 if [[ -n ${ALLOW_HOST_TOOLCHAIN:-} || $OSTYPE == msys || $OSTYPE == cygwin ]]; then

From 83d0bc46ba040a75f2f891767fee957760dbb8eb Mon Sep 17 00:00:00 2001
From: Luke Curley <kixelated@gmail.com>
Date: Thu, 5 Nov 2026 20:57:25 +0000
Subject: [PATCH 19/36] ci: run kio tests in the macOS suite (#7955)

Co-authored-by: GPT-6.1 Sol <noreply@openai.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: moq-bot <moq-bot@users.noreply.github.com>
---
 quest/m0/ci/README.md    |  1 -
 quest/m0/ci/macos-kio.md | 16 ----------------
 rs/justfile              |  4 ++--
 3 files changed, 2 insertions(+), 19 deletions(-)
 delete mode 100644 quest/m0/ci/macos-kio.md

diff --git a/quest/m0/ci/README.md b/quest/m0/ci/README.md
index 8f7a0456e01..46d974deebc 100644
--- a/quest/m0/ci/README.md
+++ b/quest/m0/ci/README.md
@@ -184,4 +184,3 @@ The historical samples locate candidates; they are not controlled benchmarks.
 - [Measure the Linux cache effect of native media exclusions](/quest/m0/ci/hakari-followups.md) - scheduled Linux jobs measure cache reuse after unrelated tests stop compiling PipeWire and libclang
 - [A release merge opens no stale release PR](/quest/m0/ci/release-pr-after-release.md) - `just rs release` publishes before it proposes, so a merged release isn't re-proposed
 - [Build two queue entries at once if it helps](/quest/m0/ci/queue-concurrency.md) - a measured trial of `maximumEntriesToBuild: 2` against the serial lane's burst latency
-- [macOS CI runs kio's tests](/quest/m0/ci/macos-kio.md) - `just rs macos-test` includes kio
diff --git a/quest/m0/ci/macos-kio.md b/quest/m0/ci/macos-kio.md
deleted file mode 100644
index c947390a165..00000000000
--- a/quest/m0/ci/macos-kio.md
+++ /dev/null
@@ -1,16 +0,0 @@
-# [XS] macOS CI runs kio's tests
-
-## Goal
-
-The macOS test job runs `kio`'s tests, so platform-dependent kio failures,
-such as the `Mutex` size assumption
-[moq-dev/moq#7914](https://github.com/moq-dev/moq/pull/7914) fixed, fail CI
-instead of reaching main.
-
-## Plan
-
-Decided 2026-11-05 (maintainer, follow-up from #7914): ✅ m0.
-
-`just rs macos-test` (`rs/justfile`) tests hang, moq-tokio, moq-sock,
-moq-video, and moq-auth, but not kio. Add it, and check the job's time stays
-reasonable.
diff --git a/rs/justfile b/rs/justfile
index 552fe6ff9ea..57ee63a5771 100644
--- a/rs/justfile
+++ b/rs/justfile
@@ -102,7 +102,7 @@ windows $BASE="":
 # Test the platform-sensitive crates on Windows, independent of the diff.
 windows-test:
     just rs test --manifest-path rs/moq-auth/Cargo.toml
-    just rs test -p hang -p moq-tokio -p moq-sock -p moq-relay
+    just rs test -p kio -p hang -p moq-tokio -p moq-sock -p moq-relay
     just rs test -p moq-video --no-default-features --features render -E 'test(/^render::export::/)'
 
 # Run io_uring tests when the branch affects the relay or its dependencies.
@@ -145,7 +145,7 @@ macos $BASE="":
 # Test the platform-sensitive crates on macOS, independent of the diff.
 macos-test:
     just rs test --manifest-path rs/moq-auth/Cargo.toml
-    just rs test -p hang -p moq-tokio -p moq-sock
+    just rs test -p kio -p hang -p moq-tokio -p moq-sock
     just rs test -p moq-sock --features fast-apple-datapath
     just rs test -p moq-video --no-default-features -E 'test(encode::backend::videotoolbox::tests)'
     just rs test -p moq-video --no-default-features --features render -E 'test(/^render::export::/)'

From 6b008527d37004b1f5e59f2b875d110a412149f2 Mon Sep 17 00:00:00 2001
From: Luke Curley <kixelated@gmail.com>
Date: Thu, 5 Nov 2026 21:01:01 +0000
Subject: [PATCH 20/36] ci: cache Smoke's Nix runtime packages on main (#7662)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: GPT-6.1 Sol <noreply@openai.com>
---
 .github/justfile                    |  4 ++
 .github/workflows/cache.yml         | 29 +++++++++-
 .github/workflows/smoke.yml         |  7 ++-
 flake.nix                           | 12 ++--
 infra/README.md                     |  9 ++-
 quest/m0/ci/README.md               |  2 +-
 quest/m0/ci/mbx-r2-verify.md        |  2 +-
 quest/m0/ci/nix-cache-verify.md     | 86 +++++++++++++----------------
 quest/m0/ci/publish-release-only.md |  2 +-
 quest/m2/README.md                  |  1 +
 quest/m2/release-nix-cache.md       | 59 ++++++++++++++++++++
 sh/gh/cache-runtime.sh              | 18 ++++++
 12 files changed, 169 insertions(+), 62 deletions(-)
 create mode 100644 quest/m2/release-nix-cache.md
 create mode 100755 sh/gh/cache-runtime.sh

diff --git a/.github/justfile b/.github/justfile
index 6d395fdd0d3..21238a2f744 100644
--- a/.github/justfile
+++ b/.github/justfile
@@ -4,6 +4,10 @@ set working-directory := '..'
 cache:
     bash sh/gh/cache.sh
 
+# Publish Smoke's runtime packages and their build artifacts to nix.moq.dev.
+cache-runtime:
+    bash sh/gh/cache-runtime.sh
+
 # Build the runner image with a temporary policy on a disposable hosted runner.
 runner-vm-ci:
     #!/usr/bin/env bash
diff --git a/.github/workflows/cache.yml b/.github/workflows/cache.yml
index 8a63655fb9b..13dcb685fbd 100644
--- a/.github/workflows/cache.yml
+++ b/.github/workflows/cache.yml
@@ -1,6 +1,6 @@
 name: Cache
 
-# Publish development environments independently of the landing worker's local caches.
+# Publish dev shells and Smoke's runtime packages independently of the landing worker's local caches.
 permissions:
   contents: read
 
@@ -33,3 +33,30 @@ jobs:
           AWS_ACCESS_KEY_ID: ${{ secrets.NIX_R2_ACCESS_KEY_ID }}
           AWS_SECRET_ACCESS_KEY: ${{ secrets.NIX_R2_SECRET_ACCESS_KEY }}
         run: just gh cache
+
+  runtime:
+    name: Runtime (ubuntu-24.04)
+    if: github.ref == 'refs/heads/main'
+    # Smoke's only current nix platform. Keep its Rust builds independent of
+    # the dev-shell matrix and use Smoke's cold-build budget.
+    runs-on: ubuntu-24.04
+    timeout-minutes: 75
+    environment: cache-write
+    # Finish the active publication; new pushes replace only the pending run.
+    # Canceling active builds could starve cold dependency uploads on busy main.
+    concurrency:
+      group: cache-runtime-${{ github.ref }}
+      cancel-in-progress: false
+
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: ./.github/actions/nix
+      - uses: ./.github/actions/just
+      - name: Cache runtime packages and dependencies
+        env:
+          NIX_SIGNING_KEY: ${{ secrets.NIX_SIGNING_KEY }}
+          AWS_ACCESS_KEY_ID: ${{ secrets.NIX_R2_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.NIX_R2_SECRET_ACCESS_KEY }}
+        run: just gh cache-runtime
diff --git a/.github/workflows/smoke.yml b/.github/workflows/smoke.yml
index a6af6efe653..d40964896a2 100644
--- a/.github/workflows/smoke.yml
+++ b/.github/workflows/smoke.yml
@@ -41,8 +41,8 @@ jobs:
     runs-on: ${{ matrix.os }}
     # The matrix runs in real time (ffmpeg -re pacing + per-subscriber timeouts);
     # this is just a safety net against a hung relay/client. The nix channel
-    # gets longer: nix.moq.dev serves the toolchain but not moq's packages at
-    # HEAD, and compiling them has taken 43 minutes.
+    # gets longer for a cold build when Cache has not finished publishing
+    # HEAD's packages yet; compiling them has taken 43 minutes.
     timeout-minutes: ${{ matrix.channel == 'nix' && 75 || 45 }}
 
     # smoke.sh resolves the latest libmoq release via the GitHub API. Without a
@@ -74,7 +74,8 @@ jobs:
           - os: ubuntu-latest
             channel: docker
           # macOS cells temporarily disabled to cut CI spend (over budget this
-          # month). Re-enable by uncommenting; nothing else depends on them.
+          # month). Re-enable by uncommenting; the nix cell also needs its
+          # platform added to cache.yml's runtime job.
           # - os: macos-latest
           #   channel: cargo
           # - os: macos-latest
diff --git a/flake.nix b/flake.nix
index 94ebd0dc3cf..21edb2d260f 100644
--- a/flake.nix
+++ b/flake.nix
@@ -1,16 +1,16 @@
 {
   description = "MoQ - Media over QUIC";
 
-  # Pre-built binaries live in our binary cache at nix.moq.dev. Of the
-  # packages, only tagged releases are pushed (moq-relay-v*, moq-cli-v*, etc.),
-  # so pin the flake ref to a recent tag to get a hit. The default branch HEAD
-  # builds from source, though its dev shell is cached:
-  #   nix run github:moq-dev/moq/moq-relay-v0.12.4#moq-relay --accept-flake-config
+  # nix.moq.dev caches the default branch's dev shell, along with moq-relay
+  # and moq on x86 Linux, with a 30-day expiry:
+  #   nix run github:moq-dev/moq#moq-relay --accept-flake-config
+  # Release Nix retains tagged packages permanently once a release cut
+  # carries that workflow from main; earlier tags still build from source.
   #
   # --accept-flake-config opts into the nixConfig below for one command. To
   # trust the cache permanently instead, add these settings to nix.conf.
   #
-  # The dev shell paths expire 30 days after upload, possibly before a path
+  # The CI paths expire 30 days after upload, possibly before a path
   # that depends on them; `fallback` builds whatever is missing instead of
   # failing the substitution.
   nixConfig = {
diff --git a/infra/README.md b/infra/README.md
index ff4d6a36191..0451046f908 100644
--- a/infra/README.md
+++ b/infra/README.md
@@ -270,7 +270,14 @@ expires. `nix-ci-moq-dev` holds the dev shells `cache.yml` pushes after every
 merge to `main`, for x86 Linux, ARM Linux, and ARM macOS. It publishes the full
 build closure from `nix develop --profile`, uploading only missing paths, plus
 `moq-libav`, its wasm build, and its downloaded sources, which `bun install`
-builds outside the dev shell.
+builds outside the dev shell. An independent x86 Linux job builds and pushes
+the `moq-relay` and `moq` runtime closures for Smoke's nix channel, which
+reads them without write keys. Their existing Crane `cargoArtifacts` outputs
+are published first so later builds can substitute them when their inputs
+are unchanged; those inputs include the patched `kio` sources. The other
+platforms have no Smoke nix lane. Runtime warms serialize: the active run
+finishes and new pushes replace only the pending run, avoiding duplicate
+builds without starving publication or delaying the dev-shell matrix.
 Its lifecycle rule (`infra/nix/lifecycle.json`) deletes each object 30 days
 after upload; the next warm re-uploads what it still needs. `flake.nix`
 sets `fallback = true` because that expiry can remove a path before one that
diff --git a/quest/m0/ci/README.md b/quest/m0/ci/README.md
index 46d974deebc..6ae82407f3e 100644
--- a/quest/m0/ci/README.md
+++ b/quest/m0/ci/README.md
@@ -177,7 +177,7 @@ The historical samples locate candidates; they are not controlled benchmarks.
 - [Read-only pull-request CI](/quest/m0/ci/read-only-secrets.md) - write secrets and publisher identities reach only protected branches and tags, never a pushed branch
 - [Gate each diff in under five minutes](/quest/m0/ci/five-minutes.md) - `just check`, test phases included, finishes within a worker's 5-minute prompt cache, admission wait included
 - [Verify the R2 Rust cache](/quest/m0/ci/mbx-r2-verify.md) - confirm the hosted Nightly jobs reuse the previous Nightly, then measure restore time and expiry
-- [Verify the Nix cache](/quest/m0/ci/nix-cache-verify.md) - confirm releases use `nix.moq.dev`, check its bucket sizes, and retire Cachix
+- [Verify the Nix runtime cache](/quest/m0/ci/nix-cache-verify.md) - hosted Cache uploads `main`'s relay and CLI, and Smoke's nix channel substitutes them
 - [Record hosted cargo-hakari evidence](/quest/m0/ci/hakari.md) - compare scheduled macOS and Windows cache hits and estimated compiler work saved before and after the workspace-hack
 - [Drop main from the publish Environment](/quest/m0/ci/publish-release-only.md) - the maintainer narrows `publish` to `release` and release tags once no job naming it runs as `main`
 - [Binary release publishers run on their tag](/quest/m0/ci/release-tag-publishers.md) - brew, Go and Swift releases stop running through `workflow_run` on main
diff --git a/quest/m0/ci/mbx-r2-verify.md b/quest/m0/ci/mbx-r2-verify.md
index a1cbe7eeda2..1d5945d59fa 100644
--- a/quest/m0/ci/mbx-r2-verify.md
+++ b/quest/m0/ci/mbx-r2-verify.md
@@ -142,4 +142,4 @@ feature unification, so changed compiler inputs remain a separate cause.
 
 ## Related
 
-- [Verify the Nix cache](/quest/m0/ci/nix-cache-verify.md) - the same R2 and Environment bootstrap for Nix
+- [Verify the Nix runtime cache](/quest/m0/ci/nix-cache-verify.md) - the same R2 and Environment bootstrap for Nix
diff --git a/quest/m0/ci/nix-cache-verify.md b/quest/m0/ci/nix-cache-verify.md
index 3b67f7bc579..d86532056a9 100644
--- a/quest/m0/ci/nix-cache-verify.md
+++ b/quest/m0/ci/nix-cache-verify.md
@@ -1,61 +1,51 @@
-# [S] Verify the Nix cache
+# [XS] Verify the Nix runtime cache
 
 ## Goal
 
-`nix.moq.dev` serves releases: release tags substitute on a clean machine,
-its bucket sizes hold under the 30-day expiry, and Cachix is retired.
+Hosted CI proves `main`'s `moq-relay` and `moq` runtime closures reach
+`nix.moq.dev`: a successful Cache run uploads both, and a later Smoke nix run
+substitutes them instead of compiling.
 
 ## Plan
 
 [#5693](https://github.com/moq-dev/moq/pull/5693) wired `nix.moq.dev` into
-CI. The maintainer ran the bootstrap in `infra/README.md` on 2026-10-19 and 2026-10-20 (the
-release tag ruleset, both buckets and the Worker, the `cache-write`
-Environment's tag policies and secrets, and the signing key). Check it with
-`curl https://nix.moq.dev/nix-cache-info`.
+CI. The maintainer ran the bootstrap in `infra/README.md` on 2026-10-19 and
+2026-10-20. Check it with `curl https://nix.moq.dev/nix-cache-info`.
 
 [#6588](https://github.com/moq-dev/moq/pull/6588) restored `cache.yml`:
 every merge to `main` pushes the dev shell's build closure for x86 Linux, ARM
-Linux, and ARM macOS to `nix-ci-moq-dev` (`sh/gh/cache.sh`), and
-`release-nix.yml` pushes on release tags. Hosted CI entering the dev shell is
-verified: Nightly run 40506938673 (2026-10-27) substituted it in about a
-minute with nothing compiled, against 12-14 minutes of source builds in the
-2026-10-16 baseline.
-
-Then confirm the rest, and record the numbers in the PR that closes this:
-
-- The first `moq-relay-v*` or `moq-cli-v*` tag cut after `release` carries
-  `release-nix.yml` pushes from all three legs, and `nix run github:moq-dev/moq/<tag>#moq-relay
-  --accept-flake-config` substitutes on a clean machine.
-  Tags are cut from `release`, which still has `cachix.yml` and `cache.yml`
-  and no `release-nix.yml`, so every tag so far, through `moq-relay-v0.17.9`
-  and `moq-cli-v0.14.9` on 2026-10-28, ran Cachix push and never reached
-  `nix.moq.dev`. Check with `gh run list --workflow release-nix.yml`; it stays
-  empty until a release cut merges `main` into `release`.
-- Both bucket sizes after a month, against the 30-day expiry in
-  `infra/nix/lifecycle.json`, so no earlier than 2026-11-24: the first
-  `cache.yml` push to `nix-ci-moq-dev` ran 2026-10-24. Sizes need a
-  `wrangler login` to the Cloudflare account. A path expires 30 days after
-  its upload even while CI still reads it, and `nix copy` re-uploads it on the
-  next merge. Look for Nightly jobs that fell back to source builds once
-  paths expired (`building '/nix/store/...uniffi-bindgen` in a job log), and
-  refresh on a schedule or switch to a closure-aware collector (niks3) if
-  they recur.
-- Retire Cachix once the first release cut from `main` shows
-  `release-nix.yml` succeeding on all three legs and the clean-machine
-  `nix run` above substitutes (decided 2026-10-29): that is the first release
-  a downstream user could fetch from `nix.moq.dev`. Then delete the
-  `CACHIX_AUTH_TOKEN` secret and the `kixelated` Cachix cache.
-  [moq-dev/moq#7431](https://github.com/moq-dev/moq/pull/7431) already
-  dropped Cachix from `main` (decided 2026-11-02, in place of moving its token
-  into `cache-write`): Smoke's nix channel substitutes from `nix.moq.dev` and
-  no longer pushes. `release` keeps `cachix.yml` until that cut merges `main`
-  into it.
-- Also push the `moq-relay` and `moq` runtime closures to `nix-ci-moq-dev`
-  (decided 2026-10-29). The smoke nix channel builds `main` HEAD's
-  `moq-relay` and `moq` packages, which nothing caches since Smoke stopped
-  pushing to Cachix, so each new HEAD compiles for 20-43 minutes there.
-  `cache.yml` already holds the write credentials on every merge, so smoke
-  needs no secret.
+Linux, and ARM macOS to `nix-ci-moq-dev` (`sh/gh/cache.sh`). Hosted CI
+entering the dev shell is verified: Nightly run 40506938673 (2026-10-27)
+substituted it in about a minute with nothing compiled, against 12-14
+minutes of source builds in the 2026-10-16 baseline.
+
+[moq-dev/moq#7662](https://github.com/moq-dev/moq/pull/7662) adds a Cache
+`runtime` job (`sh/gh/cache-runtime.sh`) that pushes the `moq-relay` and `moq`
+runtime closures, after their Crane dependency artifacts, on x86 Linux,
+Smoke's only current nix platform (runtime caching decided 2026-10-29).
+[moq-dev/moq#7431](https://github.com/moq-dev/moq/pull/7431) dropped Cachix
+from `main` (decided 2026-11-02), so Smoke reads `nix.moq.dev` without write
+credentials.
+
+Decided 2026-11-05 (maintainer, /quest-audit,
+[moq-dev/moq#7975](https://github.com/moq-dev/moq/pull/7975)): ✅ keep only
+this `main` evidence in m0 and move the release-tag proof, Cachix retirement,
+and bucket sizes to
+[Release tags substitute from nix.moq.dev](/quest/m2/release-nix-cache.md)
+behind the release cut. Not chosen: moving the whole quest to m2; merging
+`main` into `release` now.
+
+Use the scheduled and push runs; never dispatch Nightly for this evidence.
+
+## Waiting
+
+- moq-dev/moq: Once
+  [moq-dev/moq#7662](https://github.com/moq-dev/moq/pull/7662) merges, record the first successful Cache run's
+  `Runtime (ubuntu-24.04)` job uploading both closures
+  (`gh run list --workflow cache.yml --branch main`), then the next Smoke run
+  on that head or later (the 08:00 UTC schedule) whose
+  `ubuntu-latest / nix` job copies `moq-relay` and `moq` from
+  `https://nix.moq.dev` instead of compiling them.
 
 ## Related
 
diff --git a/quest/m0/ci/publish-release-only.md b/quest/m0/ci/publish-release-only.md
index e7143de7624..ed1dabc46f8 100644
--- a/quest/m0/ci/publish-release-only.md
+++ b/quest/m0/ci/publish-release-only.md
@@ -25,7 +25,7 @@ Environment and `CACHIX_AUTH_TOKEN` needs no new home. The alternatives were
 moving the token into `cache-write`, or deleting Cachix everywhere now with a
 `release` backport. `release` keeps its Cachix workflows until the next cut
 merges `main` into it, and
-[nix-cache-verify](/quest/m0/ci/nix-cache-verify.md) deletes the Cachix
+[Release tags substitute from nix.moq.dev](/quest/m2/release-nix-cache.md) deletes the Cachix
 cache and token once a release tag substitutes from `nix.moq.dev`.
 
 What remains is the maintainer's, in order:
diff --git a/quest/m2/README.md b/quest/m2/README.md
index d745e0f675d..2881ca995a9 100644
--- a/quest/m2/README.md
+++ b/quest/m2/README.md
@@ -35,6 +35,7 @@ lite-07; bitrate enforcement is not part of this release.
 - [JS announced coalescing](/quest/m2/js-announced-coalesce.md) - `@moq/net`'s `Announced` keeps one pending event per path, like Rust
 - [An audio track's final flush joins its open group](/quest/m2/audio-flush-group.md) - a zero-`delay.max` subscriber gets the tail, not `Old`
 - [Release execution](/quest/m2/release/README.md) - publication, installed-artifact proof, cleanup, and downstream adoption after m1
+- [Release tags substitute from nix.moq.dev](/quest/m2/release-nix-cache.md) - the first tag after the cut substitutes on a clean machine, bucket sizes hold, and Cachix is retired
 - [One policy for oversized container metadata](/quest/m2/import-metadata-policy.md) - fMP4 and MKV refuse or stream huge metadata by one documented rule
 - [Wire fuzz coverage](/quest/m2/wire-fuzz-coverage.md) - the cmsg walks in moq-sock and moq-uring have invariant fuzz targets, and the unsafe peer input reaches runs under Miri
 - [VA-API renderer tests](/quest/m2/vaapi-render-tests.md) - the VA-API renderer, decode, and transcode tests run in `just rs gpu` on AMD and Intel and fail instead of skipping, and hosted CI reports them ignored
diff --git a/quest/m2/release-nix-cache.md b/quest/m2/release-nix-cache.md
new file mode 100644
index 00000000000..cd0cca0cc3c
--- /dev/null
+++ b/quest/m2/release-nix-cache.md
@@ -0,0 +1,59 @@
+# [S] Release tags substitute from nix.moq.dev
+
+## Goal
+
+The first release tag cut from `main` substitutes from `nix.moq.dev` on a
+clean machine, both bucket sizes hold under the CI bucket's 30-day expiry, and
+Cachix is retired.
+
+## Plan
+
+Decided 2026-11-05 (maintainer, /quest-audit,
+[moq-dev/moq#7975](https://github.com/moq-dev/moq/pull/7975)): ✅ split from
+[Verify the Nix runtime cache](/quest/m0/ci/nix-cache-verify.md) and moved to
+m2 behind [the cut](/quest/m2/release/cut.md), which brings `main`'s
+`release-nix.yml` to `release` when it merges `main` into it. Not chosen:
+moving the whole verification quest; merging `main` into `release` now,
+which reverses the 2026-11-04 decision.
+
+Tags run `release`'s copies of the workflows. `release` still has
+`cachix.yml` and `cache.yml` and no `release-nix.yml`, so every tag so far,
+through `moq-relay-v0.17.9` and `moq-cli-v0.14.9` on 2026-10-28, pushed to
+Cachix and never reached `nix.moq.dev`;
+`gh run list --workflow release-nix.yml` stays empty until the cut.
+
+Once the cut lands:
+
+1. Record the first `moq-relay-v*` or `moq-cli-v*` tag's `release-nix.yml`
+   pushes from all three legs.
+2. Record `nix run github:moq-dev/moq/<tag>#moq-relay --accept-flake-config`
+   substituting on a clean machine (`#moq` for a CLI tag), such as a fresh
+   container with only Nix installed.
+3. Retire Cachix (decided 2026-10-29): that tag is the first release a
+   downstream user could fetch from `nix.moq.dev`. The cut also brings
+   `main`'s removal of `cachix.yml` to `release`.
+
+Public API: none. Wire: none.
+
+## Waiting
+
+- Maintainer: Record both bucket sizes no earlier than 2026-11-24, a month
+  after the first `cache.yml` push to `nix-ci-moq-dev` on 2026-10-24, against
+  the 30-day expiry in `infra/nix/lifecycle.json`. Sizes need a
+  `wrangler login` to the Cloudflare account, which agents lack. A path
+  expires 30 days after upload even while CI still reads it, and `nix copy`
+  re-uploads it on the next merge. Look for Nightly jobs that fell back to
+  source builds once paths expired (`building '/nix/store/...uniffi-bindgen`
+  in a job log), and refresh on a schedule or switch to a closure-aware
+  collector (niks3) if they recur.
+- Maintainer: After step 2, delete the `CACHIX_AUTH_TOKEN` secret and the
+  `kixelated` Cachix cache; the Cachix account is the maintainer's, and
+  deleting the cache is irreversible.
+
+## Required
+
+- [Cut and publish the prepared breaking release](/quest/m2/release/cut.md) - brings `release-nix.yml` to `release`, where tags run it
+
+## Related
+
+- [Verify the Nix runtime cache](/quest/m0/ci/nix-cache-verify.md) - the same cache's `main` evidence
diff --git a/sh/gh/cache-runtime.sh b/sh/gh/cache-runtime.sh
new file mode 100755
index 00000000000..cc235ba9578
--- /dev/null
+++ b/sh/gh/cache-runtime.sh
@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+# Publish Smoke's runtime packages and their reusable dependency artifacts.
+set -euo pipefail
+
+: "${NIX_SIGNING_KEY:?not set; the job needs the cache-write Environment}"
+: "${AWS_ACCESS_KEY_ID:?not set}"
+: "${AWS_SECRET_ACCESS_KEY:?not set}"
+
+roots=$(mktemp -d)
+trap 'rm -rf "$roots"' EXIT
+
+# Publish Crane's existing dependency outputs first so later package builds
+# can substitute them. Their inputs include the patched kio sources.
+nix build .#moq-relay.cargoArtifacts .#moq.cargoArtifacts --out-link "$roots/deps" --print-build-logs
+just infra nix push nix-ci-moq-dev "$roots"/deps*
+
+nix build .#moq-relay .#moq --out-link "$roots/runtime" --print-build-logs
+just infra nix push nix-ci-moq-dev "$roots"/runtime*

From f53e495be51af46e2b90dec38503188b8bfa5067 Mon Sep 17 00:00:00 2001
From: Luke Curley <kixelated@gmail.com>
Date: Thu, 5 Nov 2026 21:22:14 +0000
Subject: [PATCH 21/36] feat(net): match Rust WebSocket receive windows (#7939)

Co-authored-by: GPT-6.1 Sol <noreply@openai.com>
Co-authored-by: moq-bot <moq-bot@users.noreply.github.com>
---
 js/net/MIGRATE.md                     |  8 ++++
 js/net/api/index.api.md               |  2 +
 js/net/src/connection/connect.test.ts | 60 +++++++++++++++++++++++----
 js/net/src/connection/connect.ts      | 27 ++++++++++--
 quest/m0/README.md                    |  1 -
 quest/m0/qmux-receive-windows.md      | 21 ----------
 6 files changed, 85 insertions(+), 34 deletions(-)
 delete mode 100644 quest/m0/qmux-receive-windows.md

diff --git a/js/net/MIGRATE.md b/js/net/MIGRATE.md
index e88a594fd64..2804c5431d1 100644
--- a/js/net/MIGRATE.md
+++ b/js/net/MIGRATE.md
@@ -4,6 +4,14 @@ How to update your code for each breaking change, newest first.
 
 ## Unreleased
 
+### WebSocket receive windows match Rust
+
+The fallback now grants 4 MiB per connection and 1 MiB per stream, up from
+1 MiB and 256 KiB. Set `websocket.receiveWindow` and
+`websocket.streamReceiveWindow` in connection options to tune these byte budgets
+or retain the old limits. Both accept positive safe integers, like
+`websocket.maxStreams`. `@moq/qmux`'s standalone defaults are unchanged.
+
 ### Datagrams use separate track types ([#7846](https://github.com/moq-dev/moq/pull/7846))
 
 Create a datagram track with `broadcast.createDatagrams(name, info)` and read it with
diff --git a/js/net/api/index.api.md b/js/net/api/index.api.md
index 31794468923..3d7994b6aa3 100644
--- a/js/net/api/index.api.md
+++ b/js/net/api/index.api.md
@@ -232,6 +232,8 @@ export namespace Connection {
 		delay?: Milli;
 		enabled?: boolean;
 		maxStreams?: number;
+		receiveWindow?: number;
+		streamReceiveWindow?: number;
 		url?: URL;
 	}
 	export interface WebTransportProps extends Omit<WebTransportOptions, "serverCertificateHashes" | "protocols"> {
diff --git a/js/net/src/connection/connect.test.ts b/js/net/src/connection/connect.test.ts
index d69fa3b64e7..1a8d2b5e234 100644
--- a/js/net/src/connection/connect.test.ts
+++ b/js/net/src/connection/connect.test.ts
@@ -647,13 +647,24 @@ test("the WebSocket fallback offers the same versions", async () => {
 	expect(asked.some((protocol) => protocol.endsWith(ALPN_05))).toBe(false);
 });
 
+// Read wire parameters without making qmux's private codec part of net's TS project.
+const { decodeRecord } = require("../../../qmux/src/frame.ts");
+
+interface ReceiveWindows {
+	initialMaxData: bigint;
+	initialMaxStreamDataBidiLocal: bigint;
+	initialMaxStreamDataBidiRemote: bigint;
+	initialMaxStreamDataUni: bigint;
+}
+
 // How many streams the WebSocket fallback lets a server open in each direction: a qmux
 // server accepts the dial and opens streams until the client's limit refuses one.
-async function websocketStreamLimits(props: Omit<ConnectProps, "url">): Promise<{ bidi: number; uni: number }> {
+async function websocketStreamLimits(props: Omit<ConnectProps, "url">) {
 	const original = globalThis.WebTransport;
 	// No WebTransport, so the WebSocket attempt goes at once.
 	globalThis.WebTransport = undefined as unknown as typeof WebTransport;
 	const accepted = Promise.withResolvers<Qmux>();
+	const parameters = Promise.withResolvers<ReceiveWindows>();
 	// Bun's server socket, shaped as the `WebSocketLike` that `Qmux.accept` adopts.
 	let adopted: WebSocketLike | undefined;
 	const server = Bun.serve<{ protocol: string }>({
@@ -691,6 +702,10 @@ async function websocketStreamLimits(props: Omit<ConnectProps, "url">): Promise<
 				accepted.resolve(Qmux.accept(adopted, { protocol: socket.data.protocol }));
 			},
 			message(_socket, data) {
+				if (typeof data === "string") throw new Error("expected binary QMux record");
+				for (const frame of decodeRecord(new Uint8Array(data))) {
+					if (frame.type === "transport_parameters") parameters.resolve(frame.params);
+				}
 				adopted?.onmessage?.({ data });
 			},
 			close(_socket, code, reason) {
@@ -723,21 +738,50 @@ async function websocketStreamLimits(props: Omit<ConnectProps, "url">): Promise<
 		controller.abort();
 		await attempt;
 		session.close();
-		return limits;
+		return { ...limits, params: await parameters.promise };
 	} finally {
 		globalThis.WebTransport = original;
 		server.stop(true);
 	}
 }
 
-test("the WebSocket fallback grants the server websocket.maxStreams in each direction", async () => {
-	expect(await websocketStreamLimits({})).toEqual({ bidi: 10_000, uni: 10_000 });
-	expect(await websocketStreamLimits({ websocket: { maxStreams: 3 } })).toEqual({ bidi: 3, uni: 3 });
+test("the WebSocket fallback grants stream limits and receive windows", async () => {
+	const defaults = await websocketStreamLimits({});
+	expect(defaults).toMatchObject({
+		bidi: 10_000,
+		uni: 10_000,
+		params: {
+			initialMaxData: 4_194_304n,
+			initialMaxStreamDataBidiLocal: 1_048_576n,
+			initialMaxStreamDataBidiRemote: 1_048_576n,
+			initialMaxStreamDataUni: 1_048_576n,
+		},
+	});
+	expect(
+		await websocketStreamLimits({
+			websocket: {
+				maxStreams: 3,
+				receiveWindow: 65_537,
+				streamReceiveWindow: 16_385,
+			},
+		}),
+	).toMatchObject({
+		bidi: 3,
+		uni: 3,
+		params: {
+			initialMaxData: 65_537n,
+			initialMaxStreamDataBidiLocal: 16_385n,
+			initialMaxStreamDataBidiRemote: 16_385n,
+			initialMaxStreamDataUni: 16_385n,
+		},
+	});
 });
 
-test("websocket.maxStreams must be a positive integer", async () => {
-	for (const maxStreams of [0, -1, 1.5, Number.NaN]) {
-		await expect(connect(url, { websocket: { maxStreams } })).rejects.toThrow(RangeError);
+test("WebSocket limits must be positive safe integers", async () => {
+	for (const key of ["maxStreams", "receiveWindow", "streamReceiveWindow"] as const) {
+		for (const value of [0, -1, 1.5, Number.NaN, Infinity, Number.MAX_SAFE_INTEGER + 1]) {
+			await expect(connect(url, { websocket: { [key]: value } })).rejects.toThrow(RangeError);
+		}
 	}
 });
 
diff --git a/js/net/src/connection/connect.ts b/js/net/src/connection/connect.ts
index 27298bf1831..abd98caa73f 100644
--- a/js/net/src/connection/connect.ts
+++ b/js/net/src/connection/connect.ts
@@ -40,6 +40,10 @@ const WEBSOCKET_REDIAL = Milli(10_000);
 // `moq-tokio`'s `quic.max_streams`, the limit of Rust's sessions and the relay.
 const DEFAULT_MAX_STREAMS = 10_000;
 
+// Match moq-tokio so WebSocket readers have the same bandwidth-delay budget.
+const DEFAULT_RECEIVE_WINDOW = 4 << 20;
+const DEFAULT_STREAM_RECEIVE_WINDOW = 1 << 20;
+
 // RESET_STREAM and CONNECTION_CLOSE are separate transport notifications. Give the latter
 // time to surface its authoritative code without letting a reset-only peer stall SETUP forever.
 const SETUP_CLOSE_GRACE = Nano.fromMilli(Milli(100));
@@ -66,6 +70,12 @@ export interface WebSocketProps {
 	 * Must be a positive integer.
 	 */
 	maxStreams?: number;
+
+	/** Connection receive window in bytes (default: 4 MiB). Must be a positive safe integer. */
+	receiveWindow?: number;
+
+	/** Per-stream receive window in bytes (default: 1 MiB). Must be a positive safe integer. */
+	streamReceiveWindow?: number;
 }
 
 /**
@@ -177,9 +187,11 @@ export function normalizeVersions(props?: {
 		throw new TypeError("webtransport.protocols was removed; set versions instead");
 	if (props?.websocket && "protocols" in props.websocket)
 		throw new TypeError("websocket.protocols was removed; set versions instead");
-	const maxStreams = props?.websocket?.maxStreams;
-	if (maxStreams !== undefined && !(Number.isSafeInteger(maxStreams) && maxStreams > 0))
-		throw new RangeError(`websocket.maxStreams must be a positive integer: ${maxStreams}`);
+	for (const key of ["maxStreams", "receiveWindow", "streamReceiveWindow"] as const) {
+		const value = props?.websocket?.[key];
+		if (value !== undefined && !(Number.isSafeInteger(value) && value > 0))
+			throw new RangeError(`websocket.${key} must be a positive safe integer: ${value}`);
+	}
 	return props?.versions === undefined ? undefined : checkVersions(props.versions);
 }
 
@@ -441,7 +453,14 @@ async function connectInner(
 					// wire-format version.
 					protocols: offered.alpns,
 					versions: Object.fromEntries(offered.alpns.map((alpn) => [alpn, QMUX[alpn] ?? null])),
-					config: { maxStreamsBidi: maxStreams, maxStreamsUni: maxStreams },
+					config: {
+						maxStreamsBidi: maxStreams,
+						maxStreamsUni: maxStreams,
+						receiveWindow: BigInt(props.websocket?.receiveWindow ?? DEFAULT_RECEIVE_WINDOW),
+						streamReceiveWindow: BigInt(
+							props.websocket?.streamReceiveWindow ?? DEFAULT_STREAM_RECEIVE_WINDOW,
+						),
+					},
 				})
 			: undefined;
 
diff --git a/quest/m0/README.md b/quest/m0/README.md
index 32d1c3dbb56..c5bdcb1feb9 100644
--- a/quest/m0/README.md
+++ b/quest/m0/README.md
@@ -33,4 +33,3 @@ edge, which embeds moq-relay; it moved there on 2026-09-28.
 - [More tests under load](/quest/m0/test-flakes-2/README.md) - load-only and queue failures, one quest per flake, fixed at the cause, since each one fails a whole batch
 - [Backport the relay and auth hardening to release](/quest/m0/backport-release-hardening.md) - `release`'s relay refuses dot-segment paths, serves its HTTP routes with main's response hardening, and withdraws advertisements a peer starves of send credit; its auth client refuses redirects
 - [Agent build output can't fill the desktop's disk](/quest/m0/agent-disk-budget.md) - finished agent checkouts reclaim their mbx targets automatically, so parallel agent builds stop filling the root disk
-- [@moq/net's WebSocket receive windows match Rust](/quest/m0/qmux-receive-windows.md) - WebSocket JS throughput stops being capped below Rust's
diff --git a/quest/m0/qmux-receive-windows.md b/quest/m0/qmux-receive-windows.md
deleted file mode 100644
index 804c9a2e46b..00000000000
--- a/quest/m0/qmux-receive-windows.md
+++ /dev/null
@@ -1,21 +0,0 @@
-# [S] @moq/net's WebSocket receive windows match Rust
-
-## Goal
-
-`@moq/net`'s WebSocket fallback gives each qmux session the same receive
-windows Rust's `moq-tokio` uses (4 MiB per connection, and its per-stream
-default), configurable beside `websocket.maxStreams`, with a measured
-throughput comparison before and after recorded in the PR.
-
-## Plan
-
-Planned 2026-11-04 (maintainer, m0) from
-[qmux stream limits](https://github.com/moq-dev/moq/pull/7893): `@moq/net`
-still uses `@moq/qmux`'s defaults (`receiveWindow` 1 MiB per connection, 256
-KiB per stream, in `js/qmux/src/session.ts`), while `moq-tokio` uses
-`DEFAULT_RECEIVE_WINDOW` 4 MiB (`rs/moq-tokio/src/quic.rs`, sized for about
-270 Mbps at its RTT). Nothing fails, but WebSocket JS throughput is capped
-below Rust's. Measure a WebSocket JS reader's throughput through a relay at a
-few RTTs, then match Rust's defaults and expose them on the same
-`ConnectProps.websocket` settings as `maxStreams`, with the same validation.
-Keep `@moq/qmux`'s own defaults unchanged, as #7893 did for stream limits.

From 70789be5cd5b51c0bdadd19874739a5d2204090f Mon Sep 17 00:00:00 2001
From: Luke Curley <kixelated@gmail.com>
Date: Thu, 5 Nov 2026 21:44:13 +0000
Subject: [PATCH 22/36] feat(net)!: specify the lite-07 route wire and decode
 its messages (#7764)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: GPT-6.1 Sol <noreply@openai.com>
---
 drafts/draft-lcurley-moq-lite.md              | 591 +++++++++++-------
 quest/m1/announce-takeover.md                 |   5 +-
 quest/m1/api-audit/route/handle.md            |   2 +-
 quest/m1/bench-ci.md                          |  24 +-
 quest/m1/cluster-routing/routes/README.md     |  65 +-
 quest/m1/cluster-routing/routes/acceptance.md |   4 +-
 quest/m1/cluster-routing/routes/js.md         |   3 +-
 quest/m1/cluster-routing/routes/proof.md      |   1 -
 quest/m1/cluster-routing/routes/session.md    |  30 +-
 quest/m1/cluster-routing/routes/wire.md       |  91 ---
 quest/m2/route-interest-prefixes.md           |  14 +-
 rs/moq-net/src/fuzz.rs                        |  32 +-
 rs/moq-net/src/lite/announce.rs               | 419 ++++++++++++-
 rs/moq-net/src/lite/subscriber.rs             |   7 +
 rs/moq-net/src/lite/version.rs                |  10 +
 rs/moq-net/src/route/mod.rs                   |  18 +-
 rs/moq-net/src/route/tests/routing.rs         |  41 +-
 17 files changed, 994 insertions(+), 363 deletions(-)
 delete mode 100644 quest/m1/cluster-routing/routes/wire.md

diff --git a/drafts/draft-lcurley-moq-lite.md b/drafts/draft-lcurley-moq-lite.md
index 4b7b403629e..246d26ddd5a 100644
--- a/drafts/draft-lcurley-moq-lite.md
+++ b/drafts/draft-lcurley-moq-lite.md
@@ -38,6 +38,7 @@ normative:
 
 informative:
   I-D.lcurley-moq-cluster:
+  RFC8966:
   moqflate:
     title: "DEFLATE Compressed Tracks for MoQ"
     target: https://datatracker.ietf.org/doc/draft-lcurley-moq-flate/
@@ -134,16 +135,16 @@ A Broadcast is a collection of Tracks named by a path.
 This corresponds to a MoqTransport's "track namespace".
 A path is a sequence of non-empty segments joined by `/` (0x2F), so it never starts or ends with `/` or contains two in a row; the empty path has no segments and prefixes every path.
 A `\` (0x5C) escapes the `\` or `/` that follows it, as a MoqTransport namespace field holding either is spelled; a path with any other `\` is a PROTOCOL_VIOLATION.
-A continuous stream is named by an Instance, carried on its routes (see [ANNOUNCE_START](#announce-start)): a path and an Instance name one Broadcast, and a publisher MUST NOT serve different content under the same pair.
-Within one Instance, group sequences never restart and never name two different groups, so routes sharing it serve the same bytes; two Instances are independent streams, never stitched together.
+A continuous stream is named by an Instance, carried on its claims (see [ANNOUNCE_START](#announce-start)): a path and an Instance name one Broadcast, and a publisher MUST NOT serve different content under the same pair.
+Within one Instance, group sequences never restart and never name two different groups, so claims sharing it serve the same bytes; two Instances are independent streams, never stitched together.
 A publisher that starts its group sequences over, such as a restarted process, uses a new Instance, while replicas of the same content share one.
 A publisher MAY keep an Instance across restarts only if it continues the sequence space and announces a higher Epoch each time.
-The Epoch is a counter within one Instance that picks its live incarnation while a stale route lingers; it is never compared across Instances.
+The Epoch is a counter within one Instance that picks its live incarnation while a stale claim lingers; it is never compared across Instances.
 
-A publisher advertises what it can serve via ANNOUNCE_START messages, each carrying a path prefix: a route covering every broadcast path beneath it.
-A route is the only shape an advertisement takes: a publisher that serves only some of the paths beneath a prefix, such as a transcoder for any broadcast's derivative, advertises the covering prefix and refuses the requests it will not serve (see [Resolution](#resolution)); no message narrows a route.
-The subscriber uses the ANNOUNCE_REQUEST message to discover these routes, then subscribes to specific paths under them; which paths name broadcasts is an application convention.
-The common convention is that a publisher announces each broadcast's exact path as its own route, so subscribers can enumerate broadcasts, while a service announces one short prefix and serves whatever is requested beneath it.
+A publisher advertises what it can serve via ANNOUNCE_START messages, each carrying a path prefix: a claim covering every broadcast path beneath it.
+A claim is the only shape an advertisement takes: a publisher that serves only some of the paths beneath a prefix, such as a transcoder for any broadcast's derivative, advertises the covering prefix and refuses the requests it will not serve (see [Resolution](#resolution)); no message narrows a claim.
+The subscriber uses the ANNOUNCE_REQUEST message to discover these claims, then subscribes to specific paths under them; which paths name broadcasts is an application convention.
+The common convention is that a publisher announces each broadcast's exact path as its own claim, so subscribers can enumerate broadcasts, while a service announces one short prefix and serves whatever is requested beneath it.
 Announcements are live and can change over time, allowing for dynamic origin discovery.
 
 A broadcast consists of any number of Tracks.
@@ -395,113 +396,157 @@ There's a 1-byte STREAM_TYPE at the beginning of each stream.
 | ------- | ------------- | ----------- |
 
 ### Announce
-A subscriber can open an Announce Stream to discover routes matching a prefix.
-A route is an advertisement that paths under its prefix can be served; it claims capability, not inventory, so it never asserts that any specific broadcast exists.
+A subscriber can open an Announce Stream to discover claims matching a prefix.
+A claim is an announcement that paths under its prefix can be served by one origin node; it claims capability, not inventory, so it never asserts that any specific broadcast exists.
+A route is how the publisher reaches an origin node, and every claim on the stream travels under the route to its origin (see [Routing](#routing)).
 
 The subscriber creates the stream with an ANNOUNCE_REQUEST message.
-The publisher replies with a single ANNOUNCE_OK message followed by announcements for any matching routes and any future changes:
-
-- ANNOUNCE_START: a matching route over a path prefix is available.
-- ANNOUNCE_END: a previously started route is no longer advertised.
-- ANNOUNCE_UPDATE: a previously started advertisement was atomically updated (new hops or cost).
-- ANNOUNCE_RESTART: a previously started advertisement now serves another Instance, or a higher Epoch of the same one.
-- ANNOUNCE_TAKEOVER: a matching route is available and continues what a previously started advertisement served beneath it.
+The publisher replies with a single ANNOUNCE_OK message followed by the matching routes and claims and any future changes:
+
+- ROUTE_START: the publisher reaches an origin node.
+- ROUTE_UPDATE: a route's seqno, metric, or down-only bit changed.
+- ROUTE_HOLD: the publisher has no usable route but holds it while it recovers.
+- ROUTE_END: the publisher let go of a route and every claim under it.
+- ANNOUNCE_START: a matching claim of a route's origin node.
+- ANNOUNCE_END: the origin withdrew a claim.
+- ANNOUNCE_UPDATE: a claim's cost changed.
+- ANNOUNCE_RESTART: a claim now serves another Instance, or a higher Epoch of the same one.
+- ANNOUNCE_TAKEOVER: a matching claim continues what a live claim served beneath it.
+- ANNOUNCE_FLOOR: a batch of a route's claims is complete.
 - SYNCED: the initial set is complete.
 
-ANNOUNCE_OK carries metadata that applies to every announcement on the stream: the publisher's own `Hop ID` (the implicit trailing entry of every announcement's path) (see [ANNOUNCE_OK](#announce-ok)).
+In the other direction, the subscriber sends ROUTE_REQUEST and echoes every ROUTE_END (see [Routing](#routing)).
+
 The publisher MUST send [SYNCED](#synced) exactly once, after the initial set.
-The subscriber MAY batch announcements until SYNCED; subsequent announcements are live updates.
+The subscriber MAY batch messages until SYNCED; subsequent ones are live updates.
 The initial set is relative to this hop: a relay answers with what it holds without waiting for upstreams.
-The publisher MAY coalesce changes to a route it has not yet sent, and sends no more events before SYNCED than the initial set holds routes.
-A retraction of a route already sent MAY precede SYNCED.
+The publisher MAY coalesce changes to a claim it has not yet sent, and sends no more claims before SYNCED than the initial set holds.
+A retraction of a claim or route already sent MAY precede SYNCED.
 
-Each ANNOUNCE_START or ANNOUNCE_TAKEOVER implicitly assigns the next Announce ID on the stream: a counter starting at 0 that increments by 1 per advertisement.
-The id never appears on the wire; both endpoints derive it from the message order on the (reliable, ordered) stream.
-ANNOUNCE_END, ANNOUNCE_UPDATE, ANNOUNCE_RESTART, and ANNOUNCE_TAKEOVER reference an Announce ID instead of repeating the route's prefix.
+Each ROUTE_START implicitly assigns the next Route ID on the stream, and each ANNOUNCE_START or ANNOUNCE_TAKEOVER the next Announce ID: two counters starting at 0 that increment by 1 per assignment.
+Neither id appears on the wire where it is assigned; both endpoints derive it from the message order on the (reliable, ordered) stream, and other messages reference it instead of repeating the origin node or the claim's prefix.
+Ids are never reused within a stream.
+A ROUTE_END retires its Route ID and the Announce ID of every claim under the route; an ANNOUNCE_END retires one Announce ID.
 
-Each route has at most one current advertisement per stream.
-A second ANNOUNCE_START for an already-advertised route is a protocol violation; an ANNOUNCE_UPDATE or ANNOUNCE_RESTART atomically replaces the current advertisement while keeping its id live, and an ANNOUNCE_TAKEOVER at its predecessor's own prefix replaces it under a new id.
+A stream has at most one live route per origin node, and each route at most one live claim per prefix.
+Another origin claiming the same prefix is another claim, under its own route.
+An ANNOUNCE_UPDATE or ANNOUNCE_RESTART atomically replaces a claim while keeping its id live, and an ANNOUNCE_TAKEOVER at its predecessor's own prefix replaces it under a new id; a claim never moves to another route.
 
-The subscriber MUST close the session with a PROTOCOL_VIOLATION if it receives an ANNOUNCE_END, ANNOUNCE_UPDATE, ANNOUNCE_RESTART, or ANNOUNCE_TAKEOVER referencing an Announce ID that was never assigned or already retired, an ANNOUNCE_START or ANNOUNCE_TAKEOVER for a route that is already advertised other than as its predecessor, or any announcement before ANNOUNCE_OK.
-When the stream is closed, the subscriber MUST assume that all routes are now unavailable.
+The subscriber MUST close the session with a PROTOCOL_VIOLATION if it receives a message referencing a Route ID or Announce ID that was never assigned or already retired, a ROUTE_START for an origin node that already has a live route on the stream, an ANNOUNCE_START or ANNOUNCE_TAKEOVER for a prefix its route already claims other than as its predecessor, or any message before ANNOUNCE_OK.
+When the stream is closed, the subscriber MUST assume that every route and claim on it is gone.
 
 A broadcast path has at most 32 segments and at most 4,096 bytes; a receiver MUST close the session with a PROTOCOL_VIOLATION on a longer one, including one resolved by [Compression](#announce-compression).
-A route covers a path when its prefix is a leading run of the path's segments; matching is per path segment, so a prefix never matches half a segment, and equality is byte-by-byte within each segment.
-A publisher answering a request stream presents each of its routes clamped to the intersection with the requested prefix: a route above the request's prefix appears as the request prefix itself (an empty suffix), which is exactly the covered set the subscriber may see.
-There MAY be multiple Announce Streams, potentially containing overlapping prefixes, that get their own ANNOUNCE_OK + announcements.
+A claim covers a path when its prefix is a leading run of the path's segments; matching is per path segment, so a prefix never matches half a segment, and equality is byte-by-byte within each segment.
+A publisher answering a request stream presents, per route, each claim inside the requested prefix and only the most specific claim at or above it, at the requested prefix itself (an empty suffix), which is exactly the covered set the subscriber may see.
+When that most specific covering claim changes, such as when it is withdrawn and a broader one still covers the request, the publisher moves the presented claim to the new one with an ANNOUNCE_UPDATE or ANNOUNCE_RESTART, and ends it only when no claim of the route covers the requested prefix.
+There MAY be multiple Announce Streams, potentially containing overlapping prefixes, that get their own ANNOUNCE_OK and messages.
+
+#### Floors {#floors}
+Each origin node numbers the changes to its own claims with a Revision, starting at 0 for each Node ID.
+A stream carries a route's claims in batches: the ANNOUNCE messages under the route since its last ANNOUNCE_FLOOR, closed by the next one.
+The publisher sends a ROUTE_START before any claim under it, and SYNCED only once every route it sent has a floor.
+
+A floor names a Revision and certifies that the stream's claims for the route, across the whole requested prefix, are the origin's claims at that Revision as the request presents them (see [Announce](#announce)).
+It certifies only what its own request shows: a stream whose ANNOUNCE_REQUEST did not set `Hidden` certifies nothing about hidden claims.
+A publisher that does not know the route's claims across the whole requested prefix at one Revision, such as a relay that knows them only beneath part of it, still closes each batch, with a floor that certifies nothing.
+
+The subscriber applies a batch whole, once its floor arrives.
+A receiver that hears one origin's claims on several streams merges them claim by claim, each at the prefix its stream presents it: of the streams whose floor certifies the claim, the one with the highest Revision decides whether it exists, and a claim no floor certifies exists while some stream carries it.
+An older floor never revives a claim whose withdrawal a newer one delivered.
+A floor that certifies nothing proves no claim absent: the stream's claims stay until its ANNOUNCE_END or ROUTE_END.
+While a receiver has a usable route to the origin and every peer whose last advertised route to it is feasible here has answered the current request, it lets go of a claim none of those peers certifies or carries: it goes offline, which is not an ANNOUNCE_END.
 
 #### Compression {#announce-compression}
-An ANNOUNCE_START, ANNOUNCE_UPDATE, ANNOUNCE_RESTART, or ANNOUNCE_TAKEOVER MAY copy the head of a path or the tail of a Hop ID list from a live advertisement on the same stream, its base.
-A `Base` field names it by distance: the base's Announce ID is the next unassigned Announce ID minus `Base`, so 1 names the latest ANNOUNCE_START or ANNOUNCE_TAKEOVER, and 0 names no base.
-The receiver resolves every base against the advertisements live when the message arrives, and the result is identical to the literal encoding: a base ending later changes nothing, including a predecessor that the ANNOUNCE_TAKEOVER naming it as a base retires.
-A publisher MAY always send a `Base` of 0.
+An ANNOUNCE_START or ANNOUNCE_TAKEOVER MAY copy the head of its path from a live claim on the same stream, its base.
+`Path Base` names it by distance: the base's Announce ID is the next unassigned Announce ID minus `Path Base`, so 1 names the latest ANNOUNCE_START or ANNOUNCE_TAKEOVER, and 0 names no base.
+The receiver resolves the base against the claims live when the message arrives, and the result is identical to the literal encoding: a base ending later changes nothing, including a predecessor that the ANNOUNCE_TAKEOVER naming it as a base retires.
+The base need not share the new claim's route.
+A publisher MAY always send a `Path Base` of 0.
 
-The subscriber MUST close the session with a PROTOCOL_VIOLATION if a non-zero `Base` names an Announce ID that was never assigned or already retired, a `Keep` is non-zero with a `Base` of 0 or exceeds what the base has, or the resolved path or Hop ID list breaks its own rules.
+The subscriber MUST close the session with a PROTOCOL_VIOLATION if a non-zero `Path Base` names an Announce ID that was never assigned or already retired, a `Path Keep` is non-zero with a `Path Base` of 0 or exceeds the base's segments, or the resolved path breaks its own rules.
 
 #### Hidden Paths {#hidden}
-A route is hidden from a request when a segment of its path below the requested prefix starts with `.` (0x2E).
-A segment inside the prefix never hides anything, so a request that names the hidden segment itself (`.stats`) lists what is under it, and a route at or above the prefix has no segment below it.
+A claim is hidden from a request when a segment of its path below the requested prefix starts with `.` (0x2E).
+A segment inside the prefix never hides anything, so a request that names the hidden segment itself (`.stats`) lists what is under it, and a claim at or above the prefix has no segment below it.
 Only the first byte counts: `catalog.v2` is not hidden.
 
-A publisher SHOULD NOT announce a hidden route unless the ANNOUNCE_REQUEST set `Hidden`.
+A publisher SHOULD NOT announce a hidden claim unless the ANNOUNCE_REQUEST set `Hidden`.
 Hiding is a convenience for discovery, not access control: a publisher MAY treat a subscriber it trusts, such as another relay in its own cluster, as opted in, and MUST authorize hidden paths like any other.
 SUBSCRIBE, FETCH, and TRACK resolve a hidden path exactly as any other.
 
 #### Routing {#routing}
-Each advertisement carries the path of Hop IDs it traversed and an accumulated Route Cost (see [ANNOUNCE_START](#announce-start)), which relays use to build a loop-free mesh.
-
-A receiver MUST discard an announcement whose reconstructed path contains its own Hop ID: it has looped back, so forwarding it would extend the loop and subscribing through it would route the receiver back to itself.
-This is the only loop defense moq-lite requires, and it catches loops of any length.
-A conforming sender never sends one (see below), so a receiver MAY instead close the session with a protocol violation; discarding is what keeps a mesh working when one member does not conform.
-A Hop ID of 0 means unknown and never matches anything; withholding an ID trades loop detection for privacy.
-A Hop ID spans 64 bits.
-A receiver MAY assign an identity of its own to a peer that declared 0, as local selection state for filtering that session; it MUST NOT forward that identity as a Hop ID.
-
-A publisher MUST NOT advertise a path whose entries contain the Hop ID the subscriber declared in its SETUP (see [Hop Parameter](#hop-parameter)).
-The receiver can only discard it, and acting on it would form a loop, so sending one is never useful.
-Of the paths that remain a publisher SHOULD advertise the best, and nothing when every known path contains that Hop ID.
-Selection is per subscriber, so a subscriber that the serving path flows through still receives the best standby path, which is what lets it fail over if its own copy dies.
-The per-subscriber winner changing travels as an ANNOUNCE_UPDATE when the new winner serves the same Instance at the same Epoch, and as an ANNOUNCE_RESTART when it serves another Instance or a higher Epoch of the same one; the last qualifying path appearing or disappearing travels as an ANNOUNCE_START or ANNOUNCE_END.
-A route continuing what the subscriber was sent for its predecessor travels as an ANNOUNCE_TAKEOVER (see [ANNOUNCE_TAKEOVER](#announce-takeover)); where continuity does not hold, it travels as an ANNOUNCE_START, or an ANNOUNCE_RESTART at the predecessor's own prefix.
-
-When serving a subscription, a publisher MUST select the source by that same exclusion; if only excluded sources remain, the subscription is unroutable.
-Applying one rule to both advertisement and dispatch keeps advertised paths truthful, which is what prevents subscription cycles of any length.
-
-When resolving a path covered by several routes (across any number of streams), the subscriber SHOULD prefer the most specific covering route (see [Resolution](#resolution)).
-Among those, a route is ineligible while another route of the same prefix carries its Instance at a higher Epoch, however cheap it is.
-Among the eligible routes, the subscriber SHOULD prefer a path that contains no 0 Hop ID over one that does, then the lowest Route Cost after adding each arriving link's cost (see [Cost Parameter](#cost-parameter)), then a broadcast the receiver publishes itself, breaking ties toward the shortest path, then toward the lowest Instance Hash, then, among routes of one Instance, toward the lowest Chain Hash, and then toward the most recently received, so a reconnecting publisher is not outranked by the stale session it replaced.
-
-Both hashes are the 64-bit FNV-1a hash, with offset basis `0x420C0DECB00B` and the standard FNV-64 prime, of the requested path's UTF-8 bytes followed by more bytes: for the Instance Hash, the route's Instance; for the Chain Hash, each Hop ID of the route's path, oldest first, as 8 little-endian bytes.
-They are keyed on the requested path rather than the route's prefix, so equal-cost advertisers of one prefix, each under its own Instance, share its paths instead of the first one taking them all.
-The Instance reads the same on every relay, so one path resolves to the same stream on every relay that holds the same routes.
-When choosing which route to advertise for a prefix, the requested path is the prefix itself.
-A relay skips both hashes for a route a publisher announced to it directly at the requested path, which no other relay ranks, so a restarted publisher under a new Instance wins at once over its lingering session.
-
-Routes with the same Instance serve the same Broadcast, so a relay MAY move a live subscription between them, including onto a higher Epoch, continuing from the first frame the subscriber lacks, and a route change (a reconnect, a cheaper path, a draining session) is invisible to the subscriber.
-A relay MUST NOT move a subscription to a route with a different Instance: it stays on its Instance's routes and ends with the last of them.
-When another Broadcast wins the path, subscriptions already open stay on theirs until the subscriber drops them or the route goes; new requests resolve the winner, and the ANNOUNCE_RESTART tells subscribers to request again.
-A receiver of an ANNOUNCE_RESTART (or of the ANNOUNCE_END and ANNOUNCE_START standing in for one) MUST NOT serve a new request under its prefix from anything resolved through the replaced advertisement.
-An ANNOUNCE_TAKEOVER is the one exception to staying on an Instance: what was resolved through its predecessor beneath its prefix is the Broadcast the new route serves, so those subscriptions continue on the new route and new requests MAY join them, whatever either route's Instance.
-A version before this one carries no Instance, so a receiver of such a session mints one for each ANNOUNCE_START it receives, with Epoch 0, and forwards it as the route's Instance.
+Routing follows the Babel routing protocol [RFC8966], keyed by origin node: each node selects one route per origin node and advertises it to its neighbours.
+
+An origin node names itself with a Node ID: a non-zero 64-bit value, fresh for each process restart and shared by every session of that process.
+An origin MUST NOT declare a Node ID with the most significant bit set.
+That bit marks a qualified Node ID: a relay files every Node ID a peer with a scoped publish grant sends (see [AUTH_OK](#auth-ok)), the peer's own included, under a qualified Node ID of its own derivation, collision-resistant at 64 bits, and translates it back when it forwards a request on that session.
+The derivation is keyed by the key the peer proved with the [Route Key Parameter](#route-key-parameter), so peers sharing one key are filed alike and fail over as one, or by a key unique to the session when the peer proved none.
+A relay MUST ignore a qualified Node ID received from such a peer, and claims under its qualified Node IDs outside that peer's grant.
+A Node ID is otherwise declared, not proven.
+
+An origin advertises its own route with a Metric of 0 and a Seqno that only it advances.
+A receiver adds the session's link cost (see [Cost Parameter](#cost-parameter)) to the Metric of every route the peer sends; the sum is its metric through that peer.
+Each link adds at least 1, so a route's metric strictly increases away from its origin.
+A metric that overflows 64 bits makes the route unusable.
+
+A node keeps a feasibility distance per Node ID: the highest Seqno of any route it advertised, and the lowest metric it advertised at that Seqno, as in [RFC8966] Section 3.5.1.
+A route is feasible when no feasibility distance is kept for its Node ID yet, when its Seqno is greater than the distance's, or when its Seqno is equal and its advertised Metric is lower.
+A node selects, per Node ID, among its feasible routes that are not held: a session that has not received a GOAWAY, then the highest local priority, then the lowest metric.
+It MUST NOT select an infeasible route, and a distance only ever falls within a Seqno, so advertising a longer route never raises it.
+A node MAY mark a session upstream.
+A route is down-only when it arrived on an upstream session or with its Down Only bit set; a node sends a down-only route with the bit set, and never on an upstream session.
+
+A node sends its selected route to every origin node it knows on each Announce Stream it answers, and MAY omit routes with no claim matching the stream's request.
+A node that does not forward, such as a client, sends only its own route, and holds no feasibility distance for any other.
+An origin advances its Seqno whenever its own set of sessions changes.
+It never advertises a Seqno or Revision of 2^64-1: a change that would reach it instead rotates its Node ID, ending the old route everywhere and announcing its claims again under the new one.
+
+A node with no usable route to an origin node holds it while it can still recover: while every route it has to the node is infeasible, or a peer holds a route whose last advertisement is feasible here.
+A held route travels as a ROUTE_HOLD, and its claims stay shown but unavailable until a ROUTE_UPDATE makes it usable again.
+Otherwise the node lets go, sending ROUTE_END wherever it advertised the route, and its claims go offline.
+Neither proves that the origin withdrew its claims.
+
+A node whose routes to an origin node are all infeasible sends a ROUTE_REQUEST with its distance's Seqno plus 1 to the peer whose route it would select were it feasible.
+A node holding a selected route at least that new answers by advertising it, and the origin answers by raising its Seqno to at least the requested one; a request for 2^64-1 rotates the origin's Node ID.
+Any other node forwards the request to the peer whose route it would select, even the requester.
+Every node keeps one pending request per origin node, its own or forwarded, at the highest Seqno requested, dropping requests no newer, until it selects a route at least that new or has no route left, and sends it again whenever its Seqno rises or that peer changes.
+
+The receiver of a ROUTE_END echoes it back on the same stream once it dropped the route.
+A node drops a feasibility distance once it neither selects nor advertises the route and every ROUTE_END it sent for it was echoed; a closed session counts as an echo.
+
+A SUBSCRIBE, FETCH, TRACK, TRACKS, or DATAGRAMS request names the origin node that serves it.
+A subscriber that names 0 lets the publisher select one (see [Resolution](#resolution)), and a relay forwarding a request names the origin node it selected or was given.
+A relay forwards a request naming an origin node only on its selected route to that node, and resets it with UNROUTABLE when it has no usable route to it, so the request never reaches another origin.
+
+Claims with the same Instance serve the same Broadcast, so a relay MAY move a live subscription between them, including onto a higher Epoch, continuing from the first frame the subscriber lacks, and a route change (a reconnect, a cheaper path, a draining session) is invisible to the subscriber.
+A relay MUST NOT move a subscription to a claim with a different Instance: it stays on its Instance's claims and ends with the last of them.
+When another Broadcast wins the path, subscriptions already open stay on theirs until the subscriber drops them or the claim goes; new requests resolve the winner, and the ANNOUNCE_RESTART tells subscribers to request again.
+A receiver of an ANNOUNCE_RESTART (or of the ANNOUNCE_END and ANNOUNCE_START standing in for one) MUST NOT serve a new request under its prefix from anything resolved through the replaced claim.
+An ANNOUNCE_TAKEOVER is the one exception to staying on an Instance: what was resolved through its predecessor beneath its prefix is the Broadcast the new claim serves, so those subscriptions continue on the new claim and new requests MAY join them, whatever either claim's Instance.
+A version before this one carries no Instance, so a receiver of such a session mints one for each ANNOUNCE_START it receives, with Epoch 0, and forwards it as the claim's Instance.
 A minted Instance SHOULD start with `~` (0x7E), so a reader can tell it names an announcement rather than the publisher's stream; a publisher SHOULD NOT name its own Instance with that prefix.
 A minted Instance is new for every announcement, so a publisher reconnecting or re-announcing through such a hop is another stream.
 
 #### Resolution {#resolution}
-A SUBSCRIBE, FETCH, or TRACK request names a path, and the receiver resolves it against the routes covering that path, after the per-subscriber exclusion above.
+A SUBSCRIBE, FETCH, or TRACK request naming no origin node names a path, and the receiver resolves it against the claims covering that path whose route it selected and is usable.
 
-Only the most specific covering routes are consulted: those with the longest prefix.
-A route strictly inside another's paths always ranks above it, and a broadcast's exact path is the most specific route there is, so a concrete announcement shadows every broader route covering it at any cost; routes over the same prefix form one tier.
-The winning tier is the whole answer: a refusal from it never falls through to a less specific route, so a service refusing a path does not leak the request to a catch-all, and one unserved path costs one round trip rather than a walk down the candidates.
-Nor is a refusal retried at another route of the same prefix.
+Only the most specific covering claims are consulted: those with the longest prefix.
+A claim strictly inside another's paths always ranks above it, and a broadcast's exact path is the most specific claim there is, so a concrete announcement shadows every broader claim covering it at any cost; claims over the same prefix form one tier.
+The winning tier is the whole answer: a refusal from it never falls through to a less specific claim, so a service refusing a path does not leak the request to a catch-all, and one unserved path costs one round trip rather than a walk down the candidates.
+Nor is a refusal retried at another claim of the same prefix.
 
-Within the tier, cost and the tie-breaks of [Routing](#routing) order the routes.
+Within the tier, a claim is ineligible while another claim of the same prefix carries its Instance at a higher Epoch, however cheap it is.
+Among the eligible claims, the receiver SHOULD prefer a route whose session has not received a GOAWAY, then the highest local priority of the route's session, then the lowest cost, the claim's Announce Cost plus its route's metric, then the lowest Rendezvous Hash, and then the most recently received, so a reconnecting publisher is not outranked by the stale session it replaced.
+The Rendezvous Hash is the 64-bit FNV-1a hash, with offset basis `0x420C0DECB00B` and the standard FNV-64 prime, of the requested path's UTF-8 bytes followed by the origin's Node ID as 8 little-endian bytes.
+Every node that knows the same claims ranks them the same, so equal-cost origins of one prefix share its paths and every relay sends one path to the same origin.
+When choosing which claim to advertise for a prefix, the requested path is the prefix itself.
 
-A route resolved this way serves the request like any other, and the route is not consumed by it.
-A relay MUST NOT announce a path merely because it resolved it: the covering route stays the only advertisement until the advertiser announces the concrete path, which it SHOULD do once it is producing, so a later request finds the running broadcast by its exact path instead of resolving a second producer.
+A claim resolved this way serves the request like any other, and the claim is not consumed by it.
+A relay MUST NOT announce a path merely because it resolved it: the covering claim stays the only advertisement until the advertiser announces the concrete path, which it SHOULD do once it is producing, so a later request finds the running broadcast by its exact path instead of resolving a second producer.
 
 An advertiser that will not serve a resolved request resets the request stream with a typed code (see [Error Codes](#error-codes)).
 Every refusal is terminal and propagates without re-resolution, so probing unserved paths costs one round trip per path.
-An advertiser signals capacity through its route alone, withdrawing or re-pricing it before it runs out.
+An advertiser signals capacity through its claim alone, withdrawing or re-pricing it before it runs out.
 
 ### Subscribe
 A subscriber opens Subscribe Streams to request a Track.
@@ -514,7 +559,7 @@ A Track that finished before producing any Group is the one case with nothing to
 A requested start past the publisher's largest position is the exception: the publisher MUST send SUBSCRIBE_OK without waiting, so a subscriber resuming just past what it holds learns where the live feed is from the answer alone (a quiet track may not reach the start for a long time).
 A relay knows that position only from its upstream's answer, never from its cache: a group it cached earlier says nothing about where the live feed is now.
 A rejection is a stream reset: a publisher that cannot serve the subscription (no such track, an ended broadcast, or any other refusal) MUST promptly reset the stream rather than leave it pending, so a subscriber distinguishes "pending" from "refused" by the reset, not by a timeout.
-A route claims capability rather than inventory, so a subscription for a covered path that names nothing is refused this way too.
+A claim asserts capability rather than inventory, so a subscription for a covered path that names nothing is refused this way too.
 
 The track's immutable publisher properties are not carried here; they are fetched once via a [Track Stream](#track-stream).
 The subscriber needs the track's TRACK_INFO (notably its timescale) to interpret FRAME messages, and MAY open the Track and Subscribe streams concurrently, buffering frames until it arrives.
@@ -572,7 +617,7 @@ The publisher replies with listing events, then FINs the stream once the Broadca
 A Broadcast lists the Tracks its publisher produces, except datagram Tracks, which are never listed: TRACK_INFO does not say which kind a Track is, so a subscriber could not tell whether to SUBSCRIBE or send DATAGRAMS.
 A Track the publisher serves only on request, such as any name a transcoder answers for, is never listed, and listing never creates one.
 A removal, either TRACKS_REMOVE or TRACKS_FINISH, promises only that the Track is no longer listed; a SUBSCRIBE for its name MAY still succeed.
-TRACKS_FINISH says the Track's publisher declared its end, so its Groups are all the Track will hold; TRACKS_REMOVE says it left unfinished, such as a publisher that went away or a route that was withdrawn, so it may go on elsewhere.
+TRACKS_FINISH says the Track's publisher declared its end, so its Groups are all the Track will hold; TRACKS_REMOVE says it left unfinished, such as a publisher that went away or a claim that was withdrawn, so it may go on elsewhere.
 A relay forwards each removal as its upstream reported it, never as its own cache would suggest.
 A Track listed again under a removed name is the same Track: within one Broadcast a name always means the same content.
 
@@ -586,7 +631,7 @@ A removal of a Track already sent MAY precede SYNCED.
 
 The subscriber MUST close the session with a PROTOCOL_VIOLATION on a TRACKS_ADD for a name already listed on the stream, a TRACKS_REMOVE or TRACKS_FINISH for a name not listed, a second SYNCED, or an unknown event type.
 A FIN before SYNCED means the Broadcast ended.
-A publisher MUST reset a Tracks Stream with NOT_FOUND when the route it would serve the path from covers it by a shorter prefix: a route claims capability, not inventory, so it names no Broadcast to list.
+A publisher MUST reset a Tracks Stream with NOT_FOUND when the claim it would serve the path from covers it by a shorter prefix: a claim asserts capability, not inventory, so it names no Broadcast to list.
 A subscriber MAY skip the Track Stream for a Track it learned from TRACKS_ADD, since the properties are the same immutable ones.
 
 ### Datagrams {#datagrams-stream}
@@ -919,8 +964,6 @@ The following Setup Parameters are defined:
 |------|----------------|-------------|
 | 0x4  | Cost           | Cost (i)    |
 |------|----------------|-------------|
-| 0x5  | Hop            | Hop ID (i)  |
-|------|----------------|-------------|
 | 0x6  | Implementation | Tokens (s)  |
 |------|----------------|-------------|
 | 0x7  | Token          | Token (b)   |
@@ -967,23 +1010,15 @@ The role is a hint that only ever narrows the session: a server MUST still enfor
 Only the client sends it; a client that receives one MUST close the session with a PROTOCOL_VIOLATION. A relay MUST NOT forward it.
 
 ### Cost Parameter {#cost-parameter}
-The Cost Parameter declares what subscribing from this endpoint costs: a receiver adds the value the sender declared to the Route Cost of every announcement that sender forwards (see [Routing](#routing)).
+The Cost Parameter declares what reaching this endpoint costs: a receiver adds the value the sender declared to the Metric of every route that sender sends (see [Routing](#routing)).
 
-The Parameter Value is a variable-length integer in deployment-chosen units, the same units as the Route Cost.
-An absent parameter means the default cost of 1, under which the accumulated Route Cost equals the hop count and routing degenerates to shortest-path.
-A value of 0 is meaningful and distinct from absent: it makes that direction free, e.g. between two relays in the same datacenter.
+The Parameter Value is a variable-length integer in deployment-chosen units, the same units as the Metric and the Announce Cost.
+An absent parameter means the default cost of 1, under which a route's metric is its hop count.
+A value of 0 is a PROTOCOL_VIOLATION: a free link would leave a route as close as the one it came from, which the feasibility condition relies on never happening.
 
 Both endpoints send it and the two values need not match: the parameter prices the sender's own egress. A relay MUST NOT forward it.
 
-A declared cost is an assertion, not an instruction: a receiver MAY charge a locally configured value instead, so a peer cannot reprice its neighbours by declaring itself cheap.
-
-### Hop Parameter {#hop-parameter}
-The Hop Parameter declares the sender's Hop ID: the identity that names it in the paths of announcements it forwards.
-The Parameter Value is a variable-length integer; a value of 0 carries no identity and is equivalent to omitting the parameter.
-
-Declaring it at setup gives the receiver the peer's identity before any other stream arrives, so route selection applies the same exclusion to the peer's subscriptions as to its announcements (see [Routing](#routing)), even on a session that never opens an Announce Stream.
-Either endpoint MAY send it; a subscriber-only endpoint with no identity MAY omit it, but a publisher SHOULD have a Hop ID regardless (see [ANNOUNCE_OK](#announce-ok)).
-A relay MUST NOT forward it.
+A declared cost is an assertion, not an instruction: a receiver MAY charge a locally configured value of at least 1 instead, so a peer cannot reprice its neighbours by declaring itself cheap.
 
 ### Implementation Parameter {#implementation-parameter}
 The Implementation Parameter names the sender's software, so a peer can attribute a session to its build.
@@ -1028,7 +1063,7 @@ A relay MUST NOT forward it.
 
 
 ## ANNOUNCE_REQUEST {#announce-request}
-A subscriber sends an ANNOUNCE_REQUEST message to indicate it wants to receive announcements for any broadcasts with a path that starts with the requested prefix.
+A subscriber sends an ANNOUNCE_REQUEST message to indicate it wants to receive the claims, and the routes they travel under, for any broadcasts with a path that starts with the requested prefix.
 
 ~~~
 ANNOUNCE_REQUEST Message {
@@ -1042,30 +1077,24 @@ ANNOUNCE_REQUEST Message {
 Indicate interest for any broadcasts with a path that starts with this prefix.
 
 **Hidden**:
-1 to also receive hidden routes (see [Hidden Paths](#hidden)), 0 otherwise.
+1 to also receive hidden claims (see [Hidden Paths](#hidden)), 0 otherwise.
 Any other value is a PROTOCOL_VIOLATION.
 
-The publisher MUST respond with an ANNOUNCE_OK message followed by ANNOUNCE_START messages for any matching routes, followed by ANNOUNCE_START, ANNOUNCE_END, ANNOUNCE_UPDATE, ANNOUNCE_RESTART, and ANNOUNCE_TAKEOVER messages for any future updates, subject to [Routing](#routing).
-Implementations SHOULD consider reasonable limits on the number of matching broadcasts to prevent resource exhaustion.
+The publisher MUST respond with an ANNOUNCE_OK message followed by the matching routes and claims and any future changes, subject to [Routing](#routing).
+The subscriber then sends only [ROUTE_REQUEST](#route-request) and [ROUTE_END](#route-end) echoes on the stream.
+Implementations SHOULD consider reasonable limits on the number of matching claims and routes to prevent resource exhaustion.
 
 
 ## ANNOUNCE_OK {#announce-ok}
 A publisher sends an ANNOUNCE_OK message exactly once, as the first message on the response side of an Announce Stream.
-It carries metadata that is constant for the lifetime of the stream and applies to every announcement that follows.
 
 ~~~
 ANNOUNCE_OK Message {
-  Message Length (i)
-  Hop ID (i)
+  Message Length (i) = 0
 }
 ~~~
 
-**Hop ID**:
-The publisher's own Hop ID.
-This is treated as the implicit trailing entry of every ANNOUNCE_START, ANNOUNCE_UPDATE, ANNOUNCE_RESTART, and ANNOUNCE_TAKEOVER Hop ID list on this stream; those messages MUST NOT repeat this value as the last entry of their `Hop ID` list.
-The value 0 is reserved to mean "unknown": either no Hop ID was assigned (e.g. when bridging from an older protocol version) or the endpoint deliberately withholds it to obscure the underlying routing.
-A publisher that assigns a Hop ID MUST choose a non-zero value, and SHOULD assign itself one (a fresh random value per session suffices), so downstream receivers can detect loops through it.
-Receivers reconstruct the full path as `Hop IDs ++ [ANNOUNCE_OK.Hop ID]`.
+ANNOUNCE_OK has no body and reserves no fields for a route-key proof.
 
 ## SYNCED {#synced}
 The initial set on a discovery stream has been delivered.
@@ -1077,16 +1106,144 @@ SYNCED Message {
 }
 ~~~
 
-SYNCED has no body and assigns no Announce ID.
+SYNCED has no body and assigns no id.
 A second SYNCED on the same stream is a PROTOCOL_VIOLATION.
 An Announce Stream ending before SYNCED is a PROTOCOL_VIOLATION; a Tracks Stream FIN before SYNCED means the Broadcast ended (see [Tracks](#tracks-stream)).
 
 
+## ROUTE_START {#route-start}
+A publisher sends a ROUTE_START message when it reaches an origin node (see [Routing](#routing)).
+Each ROUTE_START implicitly assigns the next Route ID on the stream, later referenced by ROUTE_UPDATE, ROUTE_HOLD, ROUTE_END, ANNOUNCE_FLOOR, ANNOUNCE_START, and ANNOUNCE_TAKEOVER (see [Announce](#announce)).
+
+~~~
+ROUTE_START Message {
+  Type (i) = 0x6
+  Message Length (i)
+  Node ID (i),
+  Seqno (i),
+  Metric (i),
+  Down Only (8),
+}
+~~~
+
+**Type**:
+Set to 0x6 to indicate a ROUTE_START message.
+
+**Node ID**:
+The origin node, as the publisher names it on this session.
+0 is a PROTOCOL_VIOLATION.
+
+**Seqno**:
+The origin's sequence number of the route, which only the origin advances.
+2^64-1 is a PROTOCOL_VIOLATION.
+
+**Metric**:
+The publisher's metric to the origin node, 0 when it is the origin.
+
+**Down Only**:
+1 if the route is down-only (see [Routing](#routing)), 0 otherwise.
+Any other value is a PROTOCOL_VIOLATION.
+
+
+## ROUTE_UPDATE {#route-update}
+A publisher sends a ROUTE_UPDATE message when a route it sent changes, referencing its Route ID.
+
+~~~
+ROUTE_UPDATE Message {
+  Type (i) = 0x7
+  Message Length (i)
+  Route ID (i),
+  Seqno (i),
+  Metric (i),
+  Down Only (8),
+}
+~~~
+
+**Type**:
+Set to 0x7 to indicate a ROUTE_UPDATE message.
+
+**Route ID**:
+The ordinal implicitly assigned by a prior ROUTE_START on this stream.
+
+**Seqno**, **Metric**, and **Down Only**:
+As defined for [ROUTE_START](#route-start), replacing the route's.
+A ROUTE_UPDATE for a held route makes it usable again.
+
+
+## ROUTE_HOLD {#route-hold}
+A publisher sends a ROUTE_HOLD message when it has no usable route to the origin node but still holds the route and its claims while it recovers (see [Routing](#routing)), referencing its Route ID.
+The receiver keeps the route's last Seqno, Metric, and Down Only, and does not select it until a ROUTE_UPDATE.
+
+~~~
+ROUTE_HOLD Message {
+  Type (i) = 0xB
+  Message Length (i)
+  Route ID (i)
+}
+~~~
+
+**Type**:
+Set to 0xB to indicate a ROUTE_HOLD message.
+
+**Route ID**:
+The ordinal implicitly assigned by a prior ROUTE_START on this stream.
+
+
+## ROUTE_END {#route-end}
+A publisher sends a ROUTE_END message when it lets go of a route, referencing its Route ID.
+It retires the Route ID and every claim under the route, whose ANNOUNCE_END the publisher does not send.
+It claims nothing about the origin's claims, which may still be served elsewhere.
+
+The subscriber sends the same message back on the stream once it dropped the route, its echo (see [Routing](#routing)).
+A subscriber MUST send exactly one echo for each ROUTE_END, and a publisher MUST close the session with a PROTOCOL_VIOLATION on an echo naming a Route ID it has not ended or already saw echoed.
+
+~~~
+ROUTE_END Message {
+  Type (i) = 0x8
+  Message Length (i)
+  Route ID (i)
+}
+~~~
+
+**Type**:
+Set to 0x8 to indicate a ROUTE_END message.
+
+**Route ID**:
+The ordinal implicitly assigned by a prior ROUTE_START on this stream.
+
+
+## ROUTE_REQUEST {#route-request}
+A subscriber sends a ROUTE_REQUEST message to ask for a route to an origin node at least as new as a Seqno (see [Routing](#routing)).
+It names the origin node rather than a Route ID, so it stays valid while a ROUTE_END for that route is in flight.
+
+~~~
+ROUTE_REQUEST Message {
+  Type (i) = 0xA
+  Message Length (i)
+  Node ID (i),
+  Seqno (i),
+}
+~~~
+
+**Type**:
+Set to 0xA to indicate a ROUTE_REQUEST message.
+
+**Node ID**:
+The origin node, as the publisher names it on this session.
+0 is a PROTOCOL_VIOLATION.
+
+**Seqno**:
+The Seqno the subscriber needs.
+A publisher with no route to the origin node drops the request.
+
+A publisher MUST close the session with a PROTOCOL_VIOLATION if it receives any message type other than ROUTE_REQUEST or ROUTE_END after the ANNOUNCE_REQUEST.
+
+
 ## ANNOUNCE_START {#announce-start}
-A publisher sends an ANNOUNCE_START message to advertise a route: a claim that paths under a prefix can be served.
+A publisher sends an ANNOUNCE_START message to advertise a claim of a route's origin node: that paths under a prefix can be served.
 Each ANNOUNCE_START implicitly assigns the next Announce ID on the stream, later referenced by ANNOUNCE_END, ANNOUNCE_UPDATE, ANNOUNCE_RESTART, and ANNOUNCE_TAKEOVER (see [Announce](#announce)).
 
-Only the suffix is encoded on the wire, as the full route prefix can be constructed by prepending the requested prefix.
+Only the suffix is encoded on the wire, as the full claim prefix can be constructed by prepending the requested prefix.
 
 ~~~
 ANNOUNCE_START Message {
@@ -1094,18 +1251,11 @@ ANNOUNCE_START Message {
   Message Length (i)
   Path Base (i),
   Path Keep (i),
-  Route Prefix Suffix (s),
+  Claim Prefix Suffix (s),
+  Route ID (i),
   Instance (b),
   Epoch (i),
-  Hops (..),
-  Route Cost (i),
-}
-
-Hops {
-  Hop Base (i),
-  Hop Count (i),
-  Hop ID (i) ...,
-  Hop Keep (i),
+  Announce Cost (i),
 }
 ~~~
 
@@ -1113,53 +1263,34 @@ Hops {
 Set to 0x0 to indicate an ANNOUNCE_START message.
 
 **Path Base** and **Path Keep**:
-The suffix begins with the first `Path Keep` segments of the suffix advertised by the base that `Path Base` names (see [Compression](#announce-compression)).
+The suffix begins with the first `Path Keep` segments of the suffix claimed by the base that `Path Base` names (see [Compression](#announce-compression)).
+
+**Claim Prefix Suffix**:
+The remaining segments of the suffix, which is combined with the requested prefix to form the claim's full prefix.
+An empty suffix claims the requested prefix itself, which is how a claim covering more than the request presents (see [Announce](#announce)).
 
-**Route Prefix Suffix**:
-The remaining segments of the suffix, which is combined with the requested prefix to form the route's full prefix.
-An empty suffix advertises the requested prefix itself, which is how a route covering more than the request presents (see [Announce](#announce)).
+**Route ID**:
+The route the claim travels under: its origin node is the claim's.
+A claim never changes its Route ID.
 
 **Instance**:
-The stream the route serves (see [Broadcast](#broadcast)): non-empty UTF-8 text.
+The stream the claim serves (see [Broadcast](#broadcast)): non-empty UTF-8 text.
 An empty or non-UTF-8 Instance is a PROTOCOL_VIOLATION.
 A relay forwards the Instance unchanged.
 
 **Epoch**:
-Which incarnation of the Instance the route serves: a counter the publisher raises within one Instance, 0 unless it keeps an Instance across restarts.
+Which incarnation of the Instance the claim serves: a counter the publisher raises within one Instance, 0 unless it keeps an Instance across restarts.
 A relay forwards the Epoch unchanged.
 
 Only an ANNOUNCE_RESTART or ANNOUNCE_TAKEOVER changes the Instance or the Epoch; ANNOUNCE_UPDATE never does.
 
-**Hop Base** and **Hop Keep**:
-The Hop ID list ends with the last `Hop Keep` entries of the list advertised by the base that `Hop Base` names (see [Compression](#announce-compression)), following the literal `Hop ID` entries.
-The two bases are independent.
-
-**Hop Count**:
-The number of literal Hop ID entries that follow.
-The resolved list does NOT include the publisher's own `Hop ID` from ANNOUNCE_OK.
-An empty list indicates either that the announcement originated locally on the publisher (the publisher itself is the origin) or that the upstream peer does not support hop tracking.
-A receiver MUST close the session with a PROTOCOL_VIOLATION if the Hop Count does not match the number of subsequent Hop ID entries.
-
-**Hop ID**:
-A unique identifier for each relay in the path from the origin publisher, ordered from origin to the upstream of the responding publisher.
-The responding publisher's own Hop ID is NOT included in the resolved list; it is carried once in ANNOUNCE_OK, so the total path length is the resolved list's length plus 1 (`Hop Count + Hop Keep + 1`).
-When forwarding an announcement received from an upstream peer, a relay MUST append the upstream peer's ANNOUNCE_OK `Hop ID` to the resolved list, since that ID is no longer implicit downstream.
-A Hop ID value of 0 means the hop is unknown: either it was never assigned or a relay deliberately withholds it (see [Routing](#routing)).
-A received 0 is forwarded unchanged.
-When bridging an announcement from an upstream that sent no hop list, a relay writes 0 for that hop.
-An identity a receiver assigned that upstream is local selection state and MUST NOT be forwarded as a Hop ID.
-
-A receiver MUST close the session with a PROTOCOL_VIOLATION if a non-zero Hop ID appears twice in the resolved list.
-Duplicate values of 0 are not a violation, since 0 identifies nothing and any number of hops may be unknown.
-
-**Route Cost**:
-The static production and link price, in units chosen by the deployment.
-The publisher seeds its production cost (0 for content it already produces, larger for a standby that starts work on demand). Each forwarding relay adds the upstream peer's declared link cost (see [Cost Parameter](#cost-parameter)).
-Each sum MUST saturate at 2^62-1.
+**Announce Cost**:
+The origin's price for this prefix, in the units of the [Cost Parameter](#cost-parameter): 0 for content it already produces, larger for a standby that starts work on demand.
+A relay forwards it unchanged; the cost of a path through the claim is the Announce Cost plus the route's metric.
 
 
 ## ANNOUNCE_END {#announce-end}
-A publisher sends an ANNOUNCE_END message to retract a previously started route, referencing its Announce ID.
+A publisher sends an ANNOUNCE_END message when the origin withdrew a claim, referencing its Announce ID.
 The id is retired and MUST NOT be referenced again.
 Retraction claims nothing about the content: a broadcast whose publisher stops advertising may remain readable by exact path, serving its stored groups over FETCH.
 Retraction does not disturb subscriptions already in flight, which conclude normally with SUBSCRIBE_FINISH.
@@ -1177,23 +1308,21 @@ ANNOUNCE_END Message {
 Set to 0x1 to indicate an ANNOUNCE_END message.
 
 **Announce ID**:
-The ordinal implicitly assigned by a prior ANNOUNCE_START on this stream.
-Referencing an id that was never assigned, or one already retired, is a protocol violation.
-Announce IDs are never reused within a stream; a route that is announced again after an ANNOUNCE_END gets a fresh id from its next ANNOUNCE_START.
+The ordinal implicitly assigned by a prior ANNOUNCE_START or ANNOUNCE_TAKEOVER on this stream.
+A claim that is announced again after an ANNOUNCE_END gets a fresh id from its next ANNOUNCE_START.
 
 
 ## ANNOUNCE_UPDATE {#announce-update}
-A publisher sends an ANNOUNCE_UPDATE message to atomically update a previously started advertisement's metadata, referencing its Announce ID.
-The route's prefix is unchanged and the id stays live; the Hop ID list MAY differ from the original (e.g. after a relay failover or upstream restart).
-An update carries no content claim: in-flight subscriptions under the route are undisturbed.
+A publisher sends an ANNOUNCE_UPDATE message when the origin re-prices a claim, referencing its Announce ID.
+The claim's prefix and route are unchanged and the id stays live.
+An update carries no content claim: in-flight subscriptions under the claim are undisturbed.
 
 ~~~
 ANNOUNCE_UPDATE Message {
   Type (i) = 0x2
   Message Length (i)
   Announce ID (i),
-  Hops (..),
-  Route Cost (i),
+  Announce Cost (i),
 }
 ~~~
 
@@ -1201,19 +1330,16 @@ ANNOUNCE_UPDATE Message {
 Set to 0x2 to indicate an ANNOUNCE_UPDATE message.
 
 **Announce ID**:
-The ordinal implicitly assigned by a prior ANNOUNCE_START on this stream.
-Referencing an id that was never assigned, or one already retired by an ANNOUNCE_END, is a protocol violation.
+As defined for [ANNOUNCE_END](#announce-end).
 
-**Hops** and **Route Cost**:
-As defined for [ANNOUNCE_START](#announce-start).
-`Hop Base` may name this advertisement itself, which resolves against the list being replaced.
-An update whose only change is a Route Cost is valid: it is how a relay re-prices a route without disturbing it.
+**Announce Cost**:
+As defined for [ANNOUNCE_START](#announce-start), replacing the claim's.
 
 
 ## ANNOUNCE_RESTART {#announce-restart}
-A publisher sends an ANNOUNCE_RESTART message when a previously started advertisement now serves another Instance, or a higher Epoch of the same one (see [Routing](#routing)), referencing its Announce ID.
-The route's prefix is unchanged and the id stays live.
-Under another Instance, whatever the subscriber resolved under the prefix through the advertisement is the old stream: in-flight subscriptions on it are undisturbed, and a new request resolves afresh.
+A publisher sends an ANNOUNCE_RESTART message when a claim now serves another Instance, or a higher Epoch of the same one (see [Routing](#routing)), referencing its Announce ID.
+The claim's prefix and route are unchanged and the id stays live.
+Under another Instance, whatever the subscriber resolved under the prefix through the claim is the old stream: in-flight subscriptions on it are undisturbed, and a new request resolves afresh.
 Under a higher Epoch of the same Instance the stream continues, and so do its subscriptions.
 
 ~~~
@@ -1223,8 +1349,7 @@ ANNOUNCE_RESTART Message {
   Announce ID (i),
   Instance (b),
   Epoch (i),
-  Hops (..),
-  Route Cost (i),
+  Announce Cost (i),
 }
 ~~~
 
@@ -1232,15 +1357,14 @@ ANNOUNCE_RESTART Message {
 Set to 0x3 to indicate an ANNOUNCE_RESTART message.
 
 **Announce ID**:
-As defined for [ANNOUNCE_UPDATE](#announce-update).
+As defined for [ANNOUNCE_END](#announce-end).
 
-**Instance**, **Epoch**, **Hops**, and **Route Cost**:
-As defined for [ANNOUNCE_START](#announce-start), replacing the advertisement's.
-`Hop Base` may name this advertisement itself, which resolves against the list being replaced.
+**Instance**, **Epoch**, and **Announce Cost**:
+As defined for [ANNOUNCE_START](#announce-start), replacing the claim's.
 
 ## ANNOUNCE_TAKEOVER {#announce-takeover}
-A publisher sends an ANNOUNCE_TAKEOVER message to advertise a route that continues what a live advertisement, its predecessor, served beneath the new route's prefix.
-A worker advertising a prefix under its own Instance answers a request under it by publishing that path under a fresh Instance; the ANNOUNCE_TAKEOVER keeps subscriptions already resolved through the prefix rather than resetting them to the more specific route.
+A publisher sends an ANNOUNCE_TAKEOVER message to advertise a claim that continues what a live claim, its predecessor, served beneath the new claim's prefix.
+A worker advertising a prefix under its own Instance answers a request under it by publishing that path under a fresh Instance; the ANNOUNCE_TAKEOVER keeps subscriptions already resolved through the prefix rather than resetting them to the more specific claim.
 It is an ANNOUNCE_START in every other respect and assigns the next Announce ID.
 
 ~~~
@@ -1250,11 +1374,11 @@ ANNOUNCE_TAKEOVER Message {
   Predecessor (i),
   Path Base (i),
   Path Keep (i),
-  Route Prefix Suffix (s),
+  Claim Prefix Suffix (s),
+  Route ID (i),
   Instance (b),
   Epoch (i),
-  Hops (..),
-  Route Cost (i),
+  Announce Cost (i),
 }
 ~~~
 
@@ -1262,19 +1386,40 @@ ANNOUNCE_TAKEOVER Message {
 Set to 0x5 to indicate an ANNOUNCE_TAKEOVER message.
 
 **Predecessor**:
-The Announce ID of a live advertisement whose prefix covers the new route's prefix.
-One at the predecessor's own prefix retires the predecessor's id, which this advertisement replaces; otherwise the predecessor stays live.
-The receiver MUST close the session with a PROTOCOL_VIOLATION if the predecessor was never assigned, is already retired, or does not cover the new prefix.
+The Announce ID of a live claim under the same route whose prefix covers the new claim's prefix.
+One at the predecessor's own prefix retires the predecessor's id, which this claim replaces; otherwise the predecessor stays live.
+The receiver MUST close the session with a PROTOCOL_VIOLATION if the predecessor was never assigned, is already retired, is under another route, or does not cover the new prefix.
 
-**Path Base**, **Path Keep**, **Route Prefix Suffix**, **Instance**, **Epoch**, **Hops**, and **Route Cost**:
+**Path Base**, **Path Keep**, **Claim Prefix Suffix**, **Route ID**, **Instance**, **Epoch**, and **Announce Cost**:
 As defined for [ANNOUNCE_START](#announce-start), resolved before the predecessor retires.
 
-The receiver treats whatever it resolved through the predecessor beneath the new prefix as served by the new route: subscriptions on it continue, and a new request for those paths MAY join them.
-Only what the predecessor's current advertisement resolved continues; anything resolved before an earlier ANNOUNCE_RESTART of it does not.
+The receiver treats whatever it resolved through the predecessor beneath the new prefix as served by the new claim: subscriptions on it continue, and a new request for those paths MAY join them.
+Only what the predecessor's current claim resolved continues; anything resolved before an earlier ANNOUNCE_RESTART of it does not.
+
+A publisher MUST send an ANNOUNCE_TAKEOVER only when the new claim serves exactly what the subscriber resolved through the predecessor beneath its prefix: the publisher that answered requests through the predecessor now advertises their paths.
+A relay forwards one only when the subscriber was last sent that predecessor, and every claim the relay sent at its prefix serves the same Instance; otherwise it sends an ANNOUNCE_START, or an ANNOUNCE_RESTART at the predecessor's own prefix.
+
+
+## ANNOUNCE_FLOOR {#announce-floor}
+A publisher sends an ANNOUNCE_FLOOR message to close a batch of a route's claims (see [Floors](#floors)).
+
+~~~
+ANNOUNCE_FLOOR Message {
+  Type (i) = 0x9
+  Message Length (i)
+  Route ID (i),
+  Revision (i),
+}
+~~~
+
+**Type**:
+Set to 0x9 to indicate an ANNOUNCE_FLOOR message.
 
-A publisher MUST send an ANNOUNCE_TAKEOVER only when the new route serves exactly what the subscriber resolved through the predecessor beneath its prefix: the publisher that answered requests through the predecessor now advertises their paths.
-A relay forwards one only when the subscriber was last sent that predecessor, and every route the relay presented there serves the same Instance; otherwise it sends an ANNOUNCE_START, or an ANNOUNCE_RESTART at the predecessor's own prefix.
-Before moq-lite-07, a publisher sends an ANNOUNCE_START instead, or an ANNOUNCE_END and then an ANNOUNCE_START at the predecessor's own prefix.
+**Route ID**:
+The ordinal implicitly assigned by a prior ROUTE_START on this stream.
+
+**Revision**:
+The origin's Revision at which the floor certifies the stream's claims for the route, plus one, or 0 when it certifies nothing.
 
 
 ## SUBSCRIBE
@@ -1286,6 +1431,7 @@ SUBSCRIBE Message {
   Subscribe ID (i)
   Broadcast Path (s)
   Instance (b)
+  Node ID (i)
   Track Name (s)
   Subscriber Priority (8)
   Group Order (8)
@@ -1313,6 +1459,9 @@ Anchor {
 A unique identifier chosen by the subscriber.
 A Subscribe ID MUST NOT be reused within the same session, even if the prior subscription has been closed.
 
+**Instance** and **Node ID**:
+As in [TRACK](#track).
+
 **Subscriber Priority**:
 The priority of the subscription within the session, represented as a u8 with 128 as the midpoint.
 The publisher SHOULD transmit *higher* values first during congestion.
@@ -1418,6 +1567,7 @@ TRACK Message {
   Message Length (i)
   Broadcast Path (s)
   Instance (b)
+  Node ID (i)
   Track Name (s)
 }
 ~~~
@@ -1427,8 +1577,12 @@ The broadcast path of the track.
 
 **Instance**:
 The stream the subscriber expects, encoded as in [ANNOUNCE_START](#announce-start), or empty for whichever wins the path.
-A publisher MUST refuse a request with UNROUTABLE when no route of that Instance serves the path, so a request is never answered by a different stream than the one it named.
-A relay fills in the Instance of the route it resolved when forwarding a request upstream; TRACKS, SUBSCRIBE and FETCH carry it the same way.
+A publisher MUST refuse a request with UNROUTABLE when no claim of that Instance serves the path, so a request is never answered by a different stream than the one it named.
+A relay fills in the Instance of the claim it resolved when forwarding a request upstream; TRACKS, SUBSCRIBE, FETCH, and DATAGRAMS carry it the same way.
+
+**Node ID**:
+The origin node that serves the request, as the publisher names it on this session, or 0 for whichever the publisher selects (see [Routing](#routing)).
+TRACKS, SUBSCRIBE, FETCH, and DATAGRAMS carry it the same way.
 
 **Track Name**:
 The name of the track.
@@ -1495,14 +1649,15 @@ TRACKS Message {
   Message Length (i)
   Broadcast Path (s)
   Instance (b)
+  Node ID (i)
 }
 ~~~
 
 **Broadcast Path**:
 The path of the Broadcast to list.
 
-**Instance**:
-The stream the subscriber expects, as in [TRACK](#track).
+**Instance** and **Node ID**:
+As in [TRACK](#track).
 The listing is pinned to the stream that answers it and ends with that stream.
 
 ## TRACKS_ADD {#tracks-add}
@@ -1561,6 +1716,7 @@ DATAGRAMS Message {
   Subscribe ID (i)
   Broadcast Path (s)
   Instance (b)
+  Node ID (i)
   Track Name (s)
   Subscriber Priority (8)
 }
@@ -1713,6 +1869,7 @@ FETCH Message {
   Message Length (i)
   Broadcast Path (s)
   Instance (b)
+  Node ID (i)
   Track Name (s)
   Subscriber Priority (8)
   Subscriber Max Age (i)
@@ -1725,6 +1882,9 @@ FETCH Message {
 **Broadcast Path**:
 The broadcast path of the track to fetch from.
 
+**Instance** and **Node ID**:
+As in [TRACK](#track).
+
 **Track Name**:
 The name of the track to fetch from.
 
@@ -1803,7 +1963,7 @@ An endpoint MUST close the session with a protocol violation if it receives more
 
 A peer that reconnects to a provided URI SHOULD keep using that URI for subsequent reconnects rather than reverting to the original.
 
-Routes that arrived on a session that received a GOAWAY stay usable until the session ends.
+Routes that arrived on a session that received a GOAWAY stay usable until the session ends, ranked below every other (see [Routing](#routing)).
 
 ## AUTH {#auth-message}
 AUTH is the first message on an Auth Stream, presenting a token.
@@ -1960,7 +2120,7 @@ The `Message Length` describes the payload size on the wire.
 
 - Switched every variable-length integer, including SETUP parameter values, from QUIC's two-bit length prefix to moq-transport's leading-ones encoding, widening the range to 64 bits.
 - Capped the Message Length of every message except FRAME at 65,535 bytes. SETUP parameter counts are bounded by Message Length, without a separate count cap.
-- Any Setup Stream or bidirectional stream message that fails to decode closes the session with PROTOCOL_VIOLATION; previously only an unexpected Message Length did, as a SHOULD. This includes a frame bound without its group bound, and a Hop Count that disagrees with its Hop ID entries, each of which previously reset only the stream. A stream ending mid-message outside the Setup and Auth Streams, a malformed GROUP or FRAME on a Group or Fetch Stream, and an unknown stream type still affect only that stream.
+- Any Setup Stream or bidirectional stream message that fails to decode closes the session with PROTOCOL_VIOLATION; previously only an unexpected Message Length did, as a SHOULD. This includes a frame bound without its group bound, which previously reset only the stream. A stream ending mid-message outside the Setup and Auth Streams, a malformed GROUP or FRAME on a Group or Fetch Stream, and an unknown stream type still affect only that stream.
 - A session without a negotiated subprotocol negotiates the version in a draft-14 CLIENT_SETUP and SERVER_SETUP exchange.
 - Added the reliable ordered RTCDataChannel binding, with one Qmux Record per binary message and no datagrams.
 - Added the SETUP `Implementation` parameter (0x6): the sender's software as `name/version` product tokens.
@@ -1992,16 +2152,22 @@ The `Message Length` describes the payload size on the wire.
 - Limited a broadcast path to 32 segments and 4,096 bytes.
 - A path never has an empty segment, so a leading, trailing, or doubled `/` is a PROTOCOL_VIOLATION rather than a second spelling of the same path.
 - A `\` in a path escapes only `\` or `/`; any other `\` is a PROTOCOL_VIOLATION rather than a second spelling of the same namespace field.
-- Hid routes with a `.`-prefixed segment below the requested prefix from announce discovery, and added the ANNOUNCE_REQUEST `Hidden` field to opt in.
-- Replaced ANNOUNCE_OK Active Count with an ordered, empty SYNCED event (0x4), marking the initial set without retaining routes that end before delivery.
-- Added `Instance` and `Epoch` to ANNOUNCE_START and ANNOUNCE_RESTART, and `Instance` to TRACK, TRACKS, SUBSCRIBE, and FETCH. The Instance is non-empty UTF-8 text naming one continuous stream, and a path and an Instance name one Broadcast; the Epoch is a counter within one Instance. A relay MAY move a subscription between routes with the same Instance, continuing from the first frame the subscriber lacks instead of at a group boundary, and never between routes with different Instances. Within one Instance only its highest Epoch is eligible. A request's Instance is empty when it pins none. Replaces the first-hop identity.
+- Hid claims with a `.`-prefixed segment below the requested prefix from announce discovery, and added the ANNOUNCE_REQUEST `Hidden` field to opt in.
+- Replaced ANNOUNCE_OK Active Count with an ordered, empty SYNCED event (0x4), marking the initial set without retaining claims that end before delivery.
+- Added `Instance` and `Epoch` to ANNOUNCE_START and ANNOUNCE_RESTART, and `Instance` to TRACK, TRACKS, SUBSCRIBE, and FETCH. The Instance is non-empty UTF-8 text naming one continuous stream, and a path and an Instance name one Broadcast; the Epoch is a counter within one Instance. A relay MAY move a subscription between claims with the same Instance, continuing from the first frame the subscriber lacks instead of at a group boundary, and never between claims with different Instances. Within one Instance only its highest Epoch is eligible. A request's Instance is empty when it pins none. Replaces the first-hop identity.
 - Added ANNOUNCE_RESTART (0x3): a live advertisement now serves another Instance, or a higher Epoch of the same one.
-- Added ANNOUNCE_TAKEOVER (0x5): a route that continues what a live advertisement served beneath it, such as a job answering a request through a worker's prefix at its exact path, so subscriptions resolved through the prefix are not reset.
+- Added ANNOUNCE_TAKEOVER (0x5): a claim that continues what a live claim served beneath it, such as a job answering a request through a worker's prefix at its exact path, so subscriptions resolved through the prefix are not reset.
 - A receiver mints an Instance, starting with `~`, for each announcement a session of an earlier version delivers.
-- Added announce compression: ANNOUNCE_START gains `Path Base` and `Path Keep` to copy the head of a live advertisement's suffix, and ANNOUNCE_START and ANNOUNCE_UPDATE gain `Hop Base` and `Hop Keep` to copy the tail of a live advertisement's Hop ID list.
-- Hop IDs span 64 bits.
-- Replaced Warm and Cold Route Cost with one static Route Cost.
-- Added the Instance Hash and Chain Hash tie-breaks after the shortest path: hashes of the requested path with the route's Instance, then with its Hop IDs, so equal-cost advertisers of one prefix share its paths. Both are skipped for a route a publisher announced directly at the requested path.
+- Added announce compression: ANNOUNCE_START and ANNOUNCE_TAKEOVER gain `Path Base` and `Path Keep` to copy the head of a live claim's suffix.
+- Split routing into two layers on the Announce Stream. ROUTE_START (0x6), ROUTE_UPDATE (0x7), and ROUTE_END (0x8) advertise how the publisher reaches an origin node, named by a Node ID, with a seqno, an additive metric, and a down-only bit, and loops are prevented by Babel's feasibility condition. Every ANNOUNCE_START and ANNOUNCE_TAKEOVER names its route's Route ID in place of the Hop ID list, so a link change sends one ROUTE_UPDATE per origin rather than an update per claim. Removed the Hop ID list, ANNOUNCE_OK's Hop ID, and the SETUP Hop parameter (0x5).
+- Added ROUTE_HOLD (0xB), which holds a route while it recovers; ROUTE_END lets it go. Neither withdraws the origin's claims, and the subscriber echoes every ROUTE_END back.
+- Added ROUTE_REQUEST (0xA), sent by the subscriber on the Announce Stream to ask for a route with a newer seqno when every route it has is infeasible.
+- Added ANNOUNCE_FLOOR (0x9), closing each batch of a route's claims with the origin Revision at which the stream's claims across the requested prefix are certified plus one, or 0 to certify nothing, so a stale copy never revives a claim whose withdrawal a newer one delivered. A floor certifies only the claims its own request shows.
+- A route presents only its most specific claim covering the requested prefix, moved to the next covering claim when it is withdrawn rather than ended.
+- Added `Node ID` to TRACK, TRACKS, SUBSCRIBE, FETCH, and DATAGRAMS: the origin node the first hop selected, followed by every later hop.
+- Replaced Warm and Cold Route Cost with the origin's Announce Cost, unchanged in transit. ANNOUNCE_UPDATE carries only the Announce Cost.
+- The Cost parameter must be at least 1.
+- Replaced the shortest-path, Hop ID, Instance Hash, and Chain Hash tie-breaks with the local priority of the route's session, the Announce Cost plus the route's metric, and a Rendezvous Hash of the requested path and the origin's Node ID.
 - Removed the standby-ordering deployment requirements on Route Cost seeds and bounds.
 
 ### Tracks {#changelog-07-tracks}
@@ -2219,10 +2385,11 @@ A token presented on an Auth Stream is as sensitive as one in the request URI, a
 GOAWAY carries an optional New Session URI that asks the peer to reconnect elsewhere. A malicious or compromised peer could use this to redirect a client to an attacker-controlled server. A recipient MUST validate the URI against local policy (scheme, authority, and port) before reconnecting, and MUST NOT reconnect if validation fails (see [GOAWAY](#goaway)). Migrated subscriptions carry no implicit trust from the prior session; the new session is authenticated independently.
 
 ## Routing Metadata and Privacy
-Hop IDs (see [ANNOUNCE_OK](#announce-ok) and [ANNOUNCE_START](#announce-start)) expose the relay path of a broadcast, which may reveal internal topology. A relay that does not wish to disclose its position MAY use the reserved value 0 ("unknown") instead of a stable identifier, at the cost of losing loop detection through itself (see [Routing](#routing)). The Hop ID announcement filter (see [Hop Parameter](#hop-parameter)) exists for loop avoidance, not access control: a subscriber cannot verify that a publisher honored it, so it MUST NOT be relied upon to hide a broadcast from a peer that declared its Hop ID.
+A Node ID (see [Routing](#routing)) is opaque and fresh for each restart: it tells a peer which claims share an origin, and a route's metric how far that origin is, but not the relays in between.
+A Node ID is declared, not proven, so a peer can forge another origin's Node ID or advertise a better route than it has. Qualifying the Node IDs of a peer with a scoped publish grant, under the key it proved in SETUP, confines such a forgery to the claims inside that grant; an unscoped peer is trusted with every origin.
 
 ## Resource Exhaustion
-A peer can open many streams (subscriptions, announcements, fetches), request large announce prefixes, or advertise broad routes. Implementations SHOULD bound the number of concurrent subscriptions, announce matches, and cached groups; an endpoint whose peer goes past its bound on subscriptions or announcements SHOULD close the session with TOO_MANY_REQUESTS, and SHOULD rely on QUIC flow control and stream limits to backpressure a misbehaving peer (see [ANNOUNCE_REQUEST](#announce-request)). Expiration (see [Expiration](#expiration)) bounds how long stale groups consume memory and flow control. A broad route invites a request for any covered path, each of which may start work: an advertiser SHOULD bound the work it starts, withdrawing its route before it runs out, and every refusal is terminal, so a flood of requests costs the mesh one round trip each rather than a search (see [Resolution](#resolution)).
+A peer can open many streams (subscriptions, announcements, fetches), request large announce prefixes, or advertise broad claims. Implementations SHOULD bound the number of concurrent subscriptions, announce matches, routes, and cached groups; an endpoint whose peer goes past its bound on subscriptions or announcements SHOULD close the session with TOO_MANY_REQUESTS, and SHOULD rely on QUIC flow control and stream limits to backpressure a misbehaving peer (see [ANNOUNCE_REQUEST](#announce-request)). Expiration (see [Expiration](#expiration)) bounds how long stale groups consume memory and flow control. A broad claim invites a request for any covered path, each of which may start work: an advertiser SHOULD bound the work it starts, withdrawing its claim before it runs out, and every refusal is terminal, so a flood of requests costs the mesh one round trip each rather than a search (see [Resolution](#resolution)).
 
 ## Datagram Injection
 Datagrams are routed to a subscription solely by Subscribe ID and carry no per-group authentication beyond that of the QUIC connection. On an unmodified QUIC/WebTransport connection this is sufficient, since datagrams are protected by the transport. A subscriber MUST silently drop any datagram with an unknown Subscribe ID (see [Datagrams](#datagrams)).
diff --git a/quest/m1/announce-takeover.md b/quest/m1/announce-takeover.md
index 2de4418c268..c97f34a3699 100644
--- a/quest/m1/announce-takeover.md
+++ b/quest/m1/announce-takeover.md
@@ -130,9 +130,8 @@ separate from the identity rewrite of this Plan, which landed with
 
 - Reword "takeover" as an event or operation, in terms of identity
   continuity, in [moq-bench pins the instances it measures](/quest/m2/bench-epoch-pin.md)
-  (Goal and Plan), [the HLS server follows each path once](/quest/m2/hls-follow-once.md)
-  (Goal and Tests), and [lite-07 route wire](/quest/m1/cluster-routing/routes/wire.md)
-  (the wire sketch, "the separately proven Takeover operation").
+  (Goal and Plan) and [the HLS server follows each path once](/quest/m2/hls-follow-once.md)
+  (Goal and Tests).
 - Rewrite the EPOCH references in `drafts/draft-lcurley-moq-cluster.md` and
   `drafts/draft-lcurley-moq-epoch.md` in terms of IDENTITY.
 - Add a regression test where a publisher restart's new announcement
diff --git a/quest/m1/api-audit/route/handle.md b/quest/m1/api-audit/route/handle.md
index edceeef3fb7..d3ba60ceb48 100644
--- a/quest/m1/api-audit/route/handle.md
+++ b/quest/m1/api-audit/route/handle.md
@@ -43,7 +43,7 @@ Non-goals: the instance model ([Instance and epoch](https://github.com/moq-dev/m
 announce events (a path listing plus `follow` since
 [moq-dev/moq#7678](https://github.com/moq-dev/moq/pull/7678)),
 the read side, which instance owns, and the route layer's wire metric
-([lite-07 route wire](/quest/m1/cluster-routing/routes/wire.md)).
+(`drafts/draft-lcurley-moq-lite.md`).
 
 ## Plan
 
diff --git a/quest/m1/bench-ci.md b/quest/m1/bench-ci.md
index d2d41824766..79a1e73bfb6 100644
--- a/quest/m1/bench-ci.md
+++ b/quest/m1/bench-ci.md
@@ -11,16 +11,26 @@ runs on the hosted ARM runners, and a deliberately slowed bench fails the job.
 
 - Maintainer: dispatch the slowed-bench Nightly run below. Agents never
   dispatch Nightly; the 2026-11-04 authorization covered the two A/A runs only.
-- moq-dev/moq: once A/A run
-  [41921320690](https://github.com/moq-dev/moq/actions/runs/41921320690)
-  finishes, dispatch the second A/A run under the same authorization
-  (`gh workflow run nightly.yml --ref main -f bench-base=<main's head>`; as of
-  2026-11-04 it is not dispatched yet), then read both runs' `paired.json` (the
-  `bench-rust*` artifacts). Find the second with `gh run list --repo
-  moq-dev/moq --workflow nightly.yml --event workflow_dispatch`.
+- Maintainer: authorize one more A/A Nightly run for the moq-net
+  (`bench-rust`) and `bench-rust-relay` groups, now that
+  [moq-dev/moq#7940](https://github.com/moq-dev/moq/pull/7940) lets moq-net's
+  benches run to completion.
+  Neither group produced a `paired.json` in either 2026-11-04 run, because
+  their benches panic. Check: both groups' `paired.json` exist in that run.
 
 ## Plan
 
+A/A results, 2026-11-04 (/quest-unblock): runs
+[41921320690](https://github.com/moq-dev/moq/actions/runs/41921320690) and
+[41933525520](https://github.com/moq-dev/moq/actions/runs/41933525520) both
+produced `paired.json` for the shared, extra, and uring groups. The first was
+cancelled by Nightly's concurrency group after its bench artifacts uploaded.
+At a 10% threshold over 3 rounds, neither run confirmed a regression: every
+case the 20-case confirmation budget (`CONFIRMATIONS`) reached came back as
+noise. Single-pass crossings: shared 18 and 26 of 716, extra 10 and 15 of 460,
+uring 1 and 1 of 41, so the second run left 6 shared cases `unconfirmed`. |delta| p95 was
+3.7-8.3%, p99 10-23%. Tune the threshold for those groups from these.
+
 Decided 2026-11-04 (maintainer, /quest-unblock): ✅ authorize one-time agent
 dispatch of the two A/A Nightly runs on `main`, with `bench-base` set to each
 run's own commit. Not chosen: the maintainer dispatching them, or skipping.
diff --git a/quest/m1/cluster-routing/routes/README.md b/quest/m1/cluster-routing/routes/README.md
index 625a899d88a..57623772c93 100644
--- a/quest/m1/cluster-routing/routes/README.md
+++ b/quest/m1/cluster-routing/routes/README.md
@@ -13,6 +13,22 @@ claim whose withdrawal is already known.
 
 ## Plan
 
+1. ✅ Decided 2026-11-05 (maintainer, /quest-plan): **The draft describes the target before the code switches.** A hop-less ANNOUNCE cannot run before the router drives sessions; the quest's own Plan says so. So the draft now specifies the whole lite-07 route wire, while main's lite-07 session keeps sending hop-based ANNOUNCEs until [Route session integration](https://github.com/moq-dev/moq/blob/main/quest/m1/cluster-routing/routes/session.md) lands. lite-07 is unpublished `-wip`, off by default, and the epic lands in one release before the cut. The other option was to put only the new message sections in the draft and leave ANNOUNCE hop-based. I rejected it because ANNOUNCE_FLOOR's "for that route" and the Route ID would then be undefined in the draft.
+2. ✅ Decided 2026-11-05 (maintainer, /quest-plan): **The request field is `Node ID (i)`, with 0 meaning "the publisher selects".** It is added to every request that resolves a path: TRACK, TRACKS, SUBSCRIBE, FETCH, and DATAGRAMS. Node ID 0 is reserved everywhere.
+3. ✅ Decided 2026-11-05 (maintainer, /quest-plan): **ROUTE_REQUEST names a Node ID, not a Route ID.** A request can then never race a ROUTE_END into a protocol violation.
+4. ~~A held ROUTE_UPDATE carries a seqno and down-only bit of 0.~~ Superseded by item 14: a held route is its own message and carries no seqno or bit.
+5. ✅ Decided 2026-11-05 (maintainer, /quest-plan): **Floor regions have no order, and a repeated region is a violation.** A sorted order would need Rust's `Path` ordering reproduced exactly in JS. Decoding into a map rejects duplicates at the same cost. Superseded the same day by item 10, which removes regions.
+6. ✅ Decided 2026-11-05 (maintainer, /quest-plan): **The Hop setup parameter and ANNOUNCE_OK's Hop ID are dropped from lite-07.** Their only roles were path-vector exclusion and the implicit trailing hop. ANNOUNCE_OK reserves no body for a route-key proof: [moq-dev/moq#7937](https://github.com/moq-dev/moq/pull/7937), accepted the same day, proves the route key once per session in SETUP. The live hop-based codec still switches in session integration, as choice 1 requires.
+7. ✅ Decided 2026-11-05 (maintainer, /quest-plan): **An echo naming a Route ID that was never ended, or was already echoed, is a violation at the publisher.** The publisher can check this from its live and unacknowledged ids alone, with no growing state.
+8. ✅ Decided 2026-11-05 (maintainer, /quest-plan): **ANNOUNCE_TAKEOVER keeps its shape, with a Route ID in place of hops, and its predecessor must be under the same route.** [quest/m1/announce-takeover.md](https://github.com/moq-dev/moq/blob/main/quest/m1/announce-takeover.md) deletes the message, so this keeps the change minimal.
+9. ✅ Decided 2026-11-05 (maintainer, /quest-plan): **Unknown announce types stay skipped by length on lite-06+**, as before. An unknown reply type is refused.
+10. ✅ Decided 2026-11-05 (maintainer, /quest-plan): **ANNOUNCE_FLOOR is a marker, not a region list:** `{Route ID, Revision}`. It closes a batch and certifies the stream's claims for that route across the whole requested prefix as the origin's at that Revision. A publisher that cannot vouch for the whole requested prefix at one Revision still closes the batch, with a floor that certifies nothing, encoded per item 13. Regions, the replacing list, and the 65,535-byte overflow go away. Accepted cost: a relay with partial knowledge of an origin certifies nothing for that route, so a receiver lets its stale claims go only on ROUTE_END. Rejected: one region per message; a multipart atomic list.
+11. ✅ Decided 2026-11-05 (maintainer, /quest-plan): **Clamped claims collapse to the best one.** When several of a route's claims cover a request's prefix (`live` at cost 10 and `live/a` at cost 1, request `live/a/x`), the publisher presents only the most specific, and when it is withdrawn moves the presented claim to the next covering one with ANNOUNCE_UPDATE or ANNOUNCE_RESTART instead of ending it. No wire change; one live claim per prefix per route holds, and a receiver merges claims at the prefix each stream presents them. Rejected: carrying each claim's ancestor depth.
+12. ✅ Decided 2026-11-05 (maintainer, /quest-plan): **A floor certifies only what its own request shows.** A stream whose request did not set `Hidden` certifies nothing about hidden claims. No new wire field. Rejected: isolating differently filtered views.
+13. ✅ Decided 2026-11-05 (maintainer): **ANNOUNCE_FLOOR encodes `Revision + 1`, with 0 meaning the floor certifies nothing,** the same offset as `Max Age`. Rust decodes it to `Option`. It replaces a Revision of 2^64-1 as the marker: a huge sentinel is a bad pattern and costs 9 bytes as a lite-07 varint. Rejected: a separate message; a boolean field.
+14. ✅ Decided 2026-11-05 (maintainer: "use 0 as a sentinel, or make a new message type"; the agent picked the message): **A held route is ROUTE_HOLD (0xB), `{Route ID}`,** replacing a ROUTE_UPDATE with a Metric of 2^64-1. A metric of 0 is real (the origin's own route), so 0 cannot mark held, and offsetting every metric by one would still leave a held update's seqno and down-only bit meaningless and refused. The message carries only what a hold means, item 4's rule goes away, and a metric is now only bounded by overflow, so the wire refuses no metric. The 2^64-1 Seqno and Revision bounds stay: they are bounds, not markers, leaving room for a ROUTE_REQUEST's successor and for the floor's offset.
+
+
 The route layer's core landed in
 [moq-dev/moq#7676](https://github.com/moq-dev/moq/pull/7676): a
 crate-private, sans-IO `Router` in `rs/moq-net/src/route/`, generic over the
@@ -39,7 +55,10 @@ Settled by the core, for review:
   interest overlaps it (`a_claim_above_an_interest_overlaps_it`).
 - Letting go of a region keeps the proof's rule: keep every still-certified
   region, or rebuild them all if a lost floor is newer than a kept one, a
-  collection whose replay is bounded like any other.
+  collection whose replay is bounded like any other. The core and the proof
+  keep per-region floors internally; the wire carries only item 10's
+  whole-interest marker, which [session integration](/quest/m1/cluster-routing/routes/session.md)
+  projects the view onto.
 - A rotated identity ends the old one with ROUTE_END on every stream rather
   than closing sessions, since the own identity is no longer proven per
   session.
@@ -51,7 +70,10 @@ contract below. The routing contract's remaining model fixtures live in
 port each topology to the implementation as acceptance, then delete the model.
 The handoff contract below, decided 2026-10-16, settles claim freshness:
 
-The wire sketch is in [wire](/quest/m1/cluster-routing/routes/wire.md); the bullets below are the contract it carries.
+The lite-07 wire is specified in `drafts/draft-lcurley-moq-lite.md` (Announce,
+Floors, and Routing), and `rs/moq-net/src/lite/announce.rs` encodes and decodes
+its new messages ([moq-dev/moq#7764](https://github.com/moq-dev/moq/pull/7764));
+the bullets below are the contract it carries.
 
 - The announce cost is the origin's per-prefix seed (`transcode/**` at 10 and
   `transcode/foobar` at 1 from one node, decided 2026-10-01) and nobody
@@ -149,8 +171,8 @@ The wire sketch is in [wire](/quest/m1/cluster-routing/routes/wire.md); the bull
   by metric overflow.
 - Loop freedom is Babel's feasibility condition (RFC 8966) keyed by node:
   accept a route if its seqno is newer, or equal with a metric below the
-  feasibility distance. Only the origin advances its seqno. Retraction is an
-  infinite metric or ROUTE_END; there is no count to infinity.
+  feasibility distance. Only the origin advances its seqno. Retraction is
+  ROUTE_HOLD or ROUTE_END; there is no count to infinity.
 - Starvation recovery is Babel's seqno request (RFC 8966 s3.8, decided
   2026-10-12). A node whose routes to an origin are all infeasible sends
   ROUTE_REQUEST for that origin, with its feasibility seqno plus one, to the
@@ -239,18 +261,20 @@ loss never reports an END:
 - Each origin numbers the changes to its own claims with a revision that
   starts at zero for each routing identity, separate from the route seqno.
   Both are varints. An origin never advertises the last value, 2^64-1 (the
-  largest lite-07 varint, as for the infinite metric): a
+  largest lite-07 varint): a
   seqno advance, claim change, or seqno request that would reach it rotates
   the identity instead, ending the old one everywhere and announcing the
   claims again under a fresh one, so nothing wraps and every advertised
   seqno leaves room for the successor a request names
   (`exhausted_counters_rotate_the_identity`).
   A session sends an origin's announcements in batches, each closed by its
-  floors: per region, the revision as of which the stream's announcements
-  for that route within the region are complete. A bare identity's region is
-  the stream's interest. A qualified key certifies only within the
-  grant scopes it arrived through, and one key can arrive through grants
-  whose pattern unions differ, so its view carries one floor per scope.
+  floor: the revision at which the stream's announcements for that route,
+  across the whole interest, are the origin's, or nothing when the sender
+  does not know them across the interest at one revision (Plan item 10). A
+  qualified key is known only within the grant scopes it arrived through,
+  and one key can arrive through grants whose pattern unions differ, so the
+  view inside a node carries one floor per scope, and a stream whose
+  interest is wider than those scopes certifies nothing.
 - A receiver keeps each session's last view, to apply the next batch, and
   merges every session's view into its own claim by claim: whichever view
   covers the claim with the newer floor decides. A floor certifies only the
@@ -290,7 +314,7 @@ loss never reports an END:
   withdrawing one origin's wildcard leaves another origin's copy
   (`wildcard_claims_end_per_origin_and_are_certified_below`).
 - A node tracks the regions each neighbour's last view certifies. Only a
-  neighbour whose last finite advertisement is feasible here counts, held or
+  neighbour whose last advertisement is feasible here counts, held or
   not: feasible edges strictly decrease the metric toward the origin, so two
   nodes never keep a region alive through each other. While the node has a
   usable route and every such neighbour has answered the current interest, a
@@ -321,9 +345,8 @@ loss never reports an END:
   withdrawal.
 - Per identity, a node is usable (a feasible selected route: announcements
   shown available), held, or let go. It is held while starved, or while a
-  neighbor's held route has a last finite advertisement feasible here; it
-  keeps showing the announcements as unavailable and sends ROUTE_UPDATE with
-  an infinite metric. Holds therefore follow strictly decreasing metrics
+  neighbor's held route has a last advertisement feasible here; it
+  keeps showing the announcements as unavailable and sends ROUTE_HOLD. Holds therefore follow strictly decreasing metrics
   down to a starved node and cannot prop each other up. Otherwise the node
   lets go: ROUTE_END to every neighbor it advertised to, and its reader sees
   the announcements go offline, a distinct event from an END the origin
@@ -393,8 +416,10 @@ Decided with the maintainer 2026-10-16, from the handoff proof:
    which adds bytes and removes no state, since a receiver still needs each
    session's last view to apply a batch from a sender whose own view jumped;
    and the floor on ROUTE_UPDATE, which ties claim churn to route processing.
-2. Held encoding: ✅ an infinite metric (2^64-1) means held and ROUTE_END
-   means let go, with no new field. Rejected: an explicit held bit.
+2. Held encoding: ~~an infinite metric (2^64-1) means held and ROUTE_END
+   means let go, with no new field. Rejected: an explicit held bit.~~
+   Superseded 2026-11-05 by Plan item 14: ROUTE_HOLD means held, and
+   ROUTE_END still means let go.
 3. Reader API: ✅ an announcement carries availability, and letting go is a
    distinct offline event, separate from the origin's END, in Rust and JS.
    Rejected: presence alone, which gives a reader nothing to re-request on
@@ -436,7 +461,8 @@ Decided with the maintainer 2026-10-16, from the handoff proof:
    which grows with publisher churn times uptime on every relay that saw an
    identity, about 16 bytes each, until a restart; and Babel's source GC
    timer, which assumes stale echoes are gone by then rather than proving it.
-7. Scope coverage under one key: ✅ per-region floors. ANNOUNCE_FLOOR
+7. Scope coverage under one key: ✅ per-region floors (superseded on the
+   wire 2026-11-05 by Plan item 10; the core keeps regions internally). ANNOUNCE_FLOOR
    names the region it certifies, a suffix of the stream's interest prefix
    (the scope met with the interest), each node tracks which regions each
    feasible neighbour's last view certifies, and a region none certifies
@@ -449,7 +475,8 @@ Decided with the maintainer 2026-10-16, from the handoff proof:
    implementation, which leaves the proof's freshness claim false for scoped
    delivery.
 
-8. Region-set framing: ✅ one ANNOUNCE_FLOOR per batch lists every region
+8. Region-set framing (superseded 2026-11-05 by Plan item 10, a
+   whole-interest marker): ✅ one ANNOUNCE_FLOOR per batch lists every region
    the sender certifies for the route: (Route ID, count, then a region suffix
    and revision per region). The list replaces the last, so a sender stops
    certifying a region it lost by leaving it out, and a count of zero answers
@@ -501,8 +528,6 @@ benchmarks.
 ## Required
 
 - [Scoped peers prove a route key](/quest/m1/cluster-routing/routes/proof.md) - records the session proof decision and implementation
-
-- [lite-07 route wire](/quest/m1/cluster-routing/routes/wire.md) - lite-07 and the draft carry ROUTE, ANNOUNCE_FLOOR, ROUTE_REQUEST, and path-less ANNOUNCE
 - [Route session integration](/quest/m1/cluster-routing/routes/session.md) - one router per origin node drives the origin and every lite-07 announce stream
 - [Announcement availability](/quest/m1/cluster-routing/routes/availability.md) - announcements report availability, and a let-go is offline rather than END, in Rust and JS
 - [js/net route layer](/quest/m1/cluster-routing/routes/js.md) - `js/net` encodes, decodes, and resolves the route layer
diff --git a/quest/m1/cluster-routing/routes/acceptance.md b/quest/m1/cluster-routing/routes/acceptance.md
index cec1981c155..b4eda63a89f 100644
--- a/quest/m1/cluster-routing/routes/acceptance.md
+++ b/quest/m1/cluster-routing/routes/acceptance.md
@@ -28,8 +28,8 @@ replace are retired.
   go out to a stream whose interest meets none of the origin's claims:
   - a transit node forwarding requests for paths outside its own interest;
   - a node holding or forwarding a seqno request for that identity;
-  - a sender whose certified regions miss the interest, which must still
-    answer with an empty floor list
+  - a sender that cannot certify the interest, which must still close the
+    batch with a floor that certifies nothing
     (`a_disjoint_interest_is_answered_with_nothing`).
 
 The counterexamples from #4349 (closed; this epic still owns the fix) are the `residual_*` tests in
diff --git a/quest/m1/cluster-routing/routes/js.md b/quest/m1/cluster-routing/routes/js.md
index 8a97d15c8f4..ddc67171a1c 100644
--- a/quest/m1/cluster-routing/routes/js.md
+++ b/quest/m1/cluster-routing/routes/js.md
@@ -17,11 +17,10 @@ Decided 2026-10-27 (maintainer), from
 `origin.ts` a detached request stays on its own route instead of following
 the cheapest one; fix it with the route-selection rework here.
 - Feed the availability API from [Announcement availability](/quest/m1/cluster-routing/routes/availability.md).
-- Rust/JS interop covers the route messages, the floor list, and the echo.
+- Rust/JS interop covers the route messages, the floor marker, and the echo.
 
 ## Required
 
-- [lite-07 route wire](/quest/m1/cluster-routing/routes/wire.md) - the messages
 - [Announcement availability](/quest/m1/cluster-routing/routes/availability.md) - the API this feeds
 
 ## Related
diff --git a/quest/m1/cluster-routing/routes/proof.md b/quest/m1/cluster-routing/routes/proof.md
index 26c62d66f01..c585f4ea172 100644
--- a/quest/m1/cluster-routing/routes/proof.md
+++ b/quest/m1/cluster-routing/routes/proof.md
@@ -47,4 +47,3 @@ signature. No ANNOUNCE_OK proof body is needed by this draft or implementation;
 ## Related
 
 - [Route session integration](/quest/m1/cluster-routing/routes/session.md) - files identities under the proven key
-- [lite-07 route wire](/quest/m1/cluster-routing/routes/wire.md) - coordinates announce messages
diff --git a/quest/m1/cluster-routing/routes/session.md b/quest/m1/cluster-routing/routes/session.md
index c44d1a8ffb7..34f60fc1e9e 100644
--- a/quest/m1/cluster-routing/routes/session.md
+++ b/quest/m1/cluster-routing/routes/session.md
@@ -10,6 +10,18 @@ to the identity it selected. A lite-06 peer is translated at the relay. A
 peer can make the router hold only bounded state. The configuration
 changes the contract decided ship with it.
 
+lite-07's live wire switches to the route layer that
+`drafts/draft-lcurley-moq-lite.md` specifies, in Rust: ANNOUNCE_START, ANNOUNCE_UPDATE, ANNOUNCE_RESTART, and
+ANNOUNCE_TAKEOVER name a Route ID and carry the Announce Cost in place of
+the Hop ID list (`HopsRef`, `Hop Base`/`Hop Keep`, and `cluster.max_hops`
+go from lite-07); ANNOUNCE_OK loses its Hop ID and SETUP its Hop parameter;
+TRACK, TRACKS, SUBSCRIBE, FETCH, and DATAGRAMS carry the Node ID; a Cost
+parameter of 0 is refused; the subscriber sends ROUTE_REQUEST and echoes
+ROUTE_END. The new messages' codecs already exist (`AnnounceBroadcast`'s
+route variants and `AnnounceReply`); until this lands the subscriber
+refuses route messages. A hop-less ANNOUNCE cannot run before the router
+drives sessions, which is why the switch lands here.
+
 ## Plan
 
 - Scope route state to interested origins, not the CDN's whole node table.
@@ -56,6 +68,21 @@ changes the contract decided ship with it.
 - A batch carries changes against the last batch on its stream. Restricting
   a view to an interest is still linear in that origin's claims per change;
   make it incremental here.
+- Decided 2026-11-05 (maintainer, /quest-plan, the epic's Plan items 10 to
+  12): each stream's floor is a whole-interest marker. Project the router's
+  per-region view onto it, certifying nothing unless the view knows the
+  route's claims across the stream's interest at one revision; present per
+  route only the most specific claim covering the interest, moved rather
+  than ended when it is withdrawn; and certify absence only for what the
+  stream's `Hidden` filter shows. Rerun the handoff sweeps through that
+  projection: a scope a relay lost now goes offline downstream only on
+  ROUTE_END, the accepted cost, so update the scoped fixtures' expectations
+  to it, while no sweep may revive a known withdrawal or report a false END.
+  Also cover a fresh claim that arrives only on an uncertified stream while
+  an older certified floor on another stream proves it absent
+  ([review](https://github.com/moq-dev/moq/pull/7764#discussion_r4485081975)):
+  the merge rule hides it until the certifying peer refreshes or lets go,
+  and the test pins that bound.
 - Bound what a peer makes the router hold (routes, claims, views per
   session) by design, as the session caps announcements today.
 - Public API: the route-change surface on `broadcast::Route` and its
@@ -76,7 +103,7 @@ Update/Restart split as the only takeover rule. Once each origin is its own
 ANNOUNCE and the first hop pins the request to its identity, the first hop's
 route is the instance, so the per-hop renewal has nothing left to protect.
 An epochless change of serving route stays a Restart, including the
-same-origin next-hop change in the [wire sketch](/quest/m1/cluster-routing/routes/wire.md), and the routing
+same-origin next-hop change with no epoch (test it), and the routing
 contract's epochless fixtures keep passing. Minting an epoch for every route
 instead was tried and rejected
 ([moq-dev/moq#6948](https://github.com/moq-dev/moq/pull/6948)): each relay
@@ -121,7 +148,6 @@ admission.
 
 ## Required
 
-- [lite-07 route wire](/quest/m1/cluster-routing/routes/wire.md) - the messages this drives
 - [One Route handle](/quest/m1/api-audit/route/handle.md) - the origin's route surface this rewrites
 
 ## Related
diff --git a/quest/m1/cluster-routing/routes/wire.md b/quest/m1/cluster-routing/routes/wire.md
deleted file mode 100644
index 581fd5b6857..00000000000
--- a/quest/m1/cluster-routing/routes/wire.md
+++ /dev/null
@@ -1,91 +0,0 @@
-# [L] lite-07 route wire
-
-## Goal
-
-lite-07 carries the route layer of [Routes and announces](/quest/m1/cluster-routing/routes/README.md) on
-the announce stream: ROUTE_START, ROUTE_UPDATE, ROUTE_END, and
-ANNOUNCE_FLOOR toward the subscriber, and ROUTE_REQUEST and the ROUTE_END
-echo back toward the publisher. ANNOUNCE_START and ANNOUNCE_UPDATE carry a
-Route ID and the origin's seed in place of the hop list. Rust encodes and
-decodes it, and `drafts/draft-lcurley-moq-lite.md` specifies it. Driving the
-router with it is [session integration](/quest/m1/cluster-routing/routes/session.md).
-
-## Plan
-
-- Wire sketch, flexible in detail. ROUTE_START carries the node id, a seqno,
-  the metric, and the down-only bit (the epic's one-selection decision), and implicitly takes the next
-  stream-local Route ID, as ANNOUNCE_START takes the next Announce ID today.
-  ROUTE_UPDATE (Route ID, seqno, metric, down-only) and ROUTE_END (Route
-  ID) reference it; the bit rides UPDATE so a route moving between a
-  mesh path and a CDN fallback changes it without retracting its announces.
-  ANNOUNCE_START carries the prefix (keeping today's Path Base/Keep
-  compression), a Route ID, the origin's cost for that prefix, and the epoch,
-  and lite-07's restart message from
-  Restart keeps its meaning. On a
-  route without an epoch, the source is the origin node and its ANNOUNCE: a
-  new one at the same path is a restart. This is routing provenance, not
-  permission to stitch. A concrete serving-route change without an epoch
-  remains Restart even when the origin node is unchanged; only a matching
-  explicit epoch or the separately proven Takeover operation preserves an
-  instance (superseded 2026-10-30: a shared route `instance` preserves it, per
-  [Instance and epoch](https://github.com/moq-dev/moq/pull/7489)). Test a same-origin next-hop change with no epoch.
-  ANNOUNCE_UPDATE re-prices it and ANNOUNCE_END withdraws this origin's claim
-  while the route stays up. A wildcard claim is capability, not an inventory
-  of broadcasts; another origin may still serve the same epoch. An announce
-  never changes its Route ID: another origin
-  serving the same path is another ANNOUNCE. An ANNOUNCE naming an unknown
-  Route ID is a protocol violation. A ROUTE_UPDATE with an infinite metric
-  (2^64-1, the largest lite-07 varint; a sum reaching it is unreachable)
-  means held: the sender has no usable route but still holds the origin's
-  announcements while it recovers. ROUTE_END means the sender let go of the
-  origin on this stream; neither is proof that the origin withdrew its
-  claims (see the epic's handoff contract). Each batch of ANNOUNCEs for a route
-  closes with one ANNOUNCE_FLOOR listing every region the sender certifies
-  for that route: a count, then per region a suffix of the stream's interest
-  prefix (empty for the whole interest) and the origin revision as of which
-  the stream's set for that route in that region is complete. The list
-  replaces the previous one, so a region left out is no longer certified,
-  and a count of zero answers a stream whose interest none of the sender's
-  regions meets.
-  ROUTE_REQUEST (node id, seqno) travels
-  the other way on the same stream, toward the neighbour that sent the route,
-  and so does the echo of every ROUTE_END: the receiver sends the same
-  ROUTE_END (Route ID) back once it has dropped the route, which tells the
-  sender no neighbour still holds its advertisement (see the epic's
-  handoff contract). Every receiver echoes, clients included; a closed session
-  counts as the echo.
-  The hop list leaves lite-07, and with it the
-  `Hop Base`/`Hop Keep` compression; `cluster.max_hops` then stops applying
-  to lite-07. Most of the 62% saving measured in
-  [moq-dev/moq#4196](https://github.com/moq-dev/moq/pull/4196) came from hop
-  chains, so rerun its announce bench on path-less ANNOUNCE and drop
-  `Path Base`/`Path Keep` too unless it still pays for its rules.
-
-  ```text
-  ROUTE_START  node=0x7a3f seqno=41 metric=12   -> route 0
-  ANNOUNCE_START prefix=transcode/ route=0 cost=10    -> announce 0
-  ANNOUNCE_START prefix=transcode/foobar route=0 cost=1 -> announce 1
-  ANNOUNCE_FLOOR route=0 count=1 ""@7           # complete as of revision 7
-  ROUTE_UPDATE route=0 seqno=42 metric=15
-  ANNOUNCE_END announce=1                       # this origin withdraws a claim
-  ANNOUNCE_FLOOR route=0 count=1 ""@8
-  ANNOUNCE_FLOOR route=1 count=2 "live/a/"@3 "live/b/"@5  # a scoped key
-  ANNOUNCE_FLOOR route=1 count=1 "live/b/"@6    # live/a/ is no longer certified
-  ROUTE_UPDATE route=0 seqno=42 metric=inf      # held: unusable, still recovering
-  ROUTE_END    route=0                          # let go: forget it on this stream
-  ROUTE_END    route=0                          # <- the receiver echoes it back
-  ```
-- Requests forwarded between routing nodes name the serving identity
-  (decided 2026-10-13). ROUTE carries one down-only bit and no export metric.
-- The region list's order and any other wire detail of it are settled here
-  with Rust and JS interop, not in the proof. The core keeps regions sorted
-  by path.
-- A hop-less ANNOUNCE_START cannot run before the router drives sessions, so
-  the new messages may land first and the ANNOUNCE layout switch with
-  [session integration](/quest/m1/cluster-routing/routes/session.md), as long as every lite-07 build
-  between them still interoperates with itself.
-
-## Related
-
-- [Routes and announces](/quest/m1/cluster-routing/routes/README.md) - the contract the wire carries
-- [A job's exact route continues its claim's readers](/quest/m1/announce-takeover.md) - also edits lite-07's ANNOUNCE messages
diff --git a/quest/m2/route-interest-prefixes.md b/quest/m2/route-interest-prefixes.md
index b1024bbec41..7607934fe9c 100644
--- a/quest/m2/route-interest-prefixes.md
+++ b/quest/m2/route-interest-prefixes.md
@@ -4,9 +4,9 @@
 
 A route-layer Announce Stream's interest is a set of prefixes instead of
 one, so a subscriber that wants several disjoint subtrees opens one stream
-rather than one per prefix. ANNOUNCE_FLOOR regions and certification hold
-across the set, and the proof's floor and certification sweeps pass over
-multi-prefix interests.
+rather than one per prefix. An ANNOUNCE_FLOOR certifies the whole set at
+one revision or nothing, and the proof's floor and certification sweeps pass
+over multi-prefix interests.
 
 ## Plan
 
@@ -21,15 +21,15 @@ Split out of [Routes and announces](/quest/m1/cluster-routing/routes/README.md)
 the route layer's core with a single interest prefix per stream (its
 regions are suffixes of that prefix) and leaves this as a separate m2 quest.
 
-- Define how ANNOUNCE_FLOOR names a region under a set (which prefix it
-  extends), and what a count of zero means when no prefix meets the sender's
-  regions.
+- Define what a whole-set floor certifies (lite-07's floor is a marker over
+  its one prefix, decided 2026-11-05), and how a sender that knows only some
+  of the set's prefixes answers.
 - Redo the proof's floor and certification sweeps with multi-prefix
   interests, including overlapping prefixes and a set that changes.
 - Update the lite draft and both implementations together.
 
 Public API: the route layer's interest type. Wire: an Announce Stream's
-interest and ANNOUNCE_FLOOR regions on the next unpublished lite version.
+interest and what ANNOUNCE_FLOOR certifies on the next unpublished lite version.
 
 ## Related
 
diff --git a/rs/moq-net/src/fuzz.rs b/rs/moq-net/src/fuzz.rs
index 22a12c4db0d..ce956c6edeb 100644
--- a/rs/moq-net/src/fuzz.rs
+++ b/rs/moq-net/src/fuzz.rs
@@ -185,7 +185,7 @@ const LITE_VERSIONS: &[lite::Version] = &[
 const IETF_VERSIONS: &[ietf::Version] = &[ietf::Version::Draft18, ietf::Version::Draft20, ietf::Version::Draft22];
 
 /// How many types [`lite_wire`] dispatches over.
-const LITE_KINDS: u8 = 33;
+const LITE_KINDS: u8 = 34;
 
 /// How many types [`ietf_wire`] dispatches over.
 const IETF_KINDS: u8 = 27;
@@ -353,6 +353,7 @@ pub fn lite_wire(data: &[u8]) -> bool {
 		30 => roundtrip::<lite::Datagrams<'_>, _>(rest, &mut Vec::new(), version),
 		31 => roundtrip::<lite::DatagramsUpdate, _>(rest, &mut Vec::new(), version),
 		32 => roundtrip::<lite::DatagramsInfo, _>(rest, &mut Vec::new(), version),
+		33 => roundtrip::<lite::AnnounceReply, _>(rest, &mut Vec::new(), version),
 		_ => unreachable!("kind is taken modulo LITE_KINDS"),
 	}
 }
@@ -1268,6 +1269,22 @@ pub fn pattern(data: &[u8]) -> bool {
 	true
 }
 
+/// Lite seeds whose envelope bytes the uniform sweep never forms, on the newest
+/// version: a typed empty TRACKS_SYNCED, an AUTH_OK reply, every route message
+/// (the sweep sets ROUTE_START's type byte but fills its size byte with the body
+/// pattern, so none decodes whole), the ROUTE_END echo, and ROUTE_REQUEST.
+const TYPED_LITE_SEEDS: &[(u8, &[u8])] = &[
+	(23, &[4, 0]),
+	(27, &[0, 3, 0, 0, 0]),
+	(5, &[6, 4, 1, 0, 1, 0]),
+	(5, &[7, 4, 0, 1, 2, 0]),
+	(5, &[8, 1, 0]),
+	(5, &[9, 2, 0, 1]),
+	(5, &[11, 1, 0]),
+	(33, &[8, 1, 0]),
+	(33, &[10, 2, 1, 0]),
+];
+
 /// The inputs the fuzzer starts from: every (version, type) pair the dispatch knows,
 /// bodied with byte patterns that decode as small valid fields.
 ///
@@ -1312,8 +1329,7 @@ pub fn seeds() -> Vec<Seed> {
 		}
 	}
 
-	// A typed empty TRACKS_SYNCED and AUTH_OK reply need nonuniform envelope bytes.
-	for (kind, body) in [(23, &[4, 0][..]), (27, &[0, 3, 0, 0, 0][..])] {
+	for &(kind, body) in TYPED_LITE_SEEDS {
 		let mut data = vec![(LITE_VERSIONS.len() - 1) as u8, kind];
 		data.extend_from_slice(body);
 		seeds.push(Seed {
@@ -1953,6 +1969,16 @@ mod tests {
 		assert!(missing.is_empty(), "no seed decodes for {missing:?}");
 	}
 
+	/// Each typed seed exists to reach one message, so each must decode whole.
+	#[test]
+	fn typed_lite_seeds_decode() {
+		for (kind, body) in TYPED_LITE_SEEDS {
+			let mut data = vec![(LITE_VERSIONS.len() - 1) as u8, *kind];
+			data.extend_from_slice(body);
+			assert!(lite_wire(&data), "kind {kind} body {body:?} does not decode");
+		}
+	}
+
 	/// The stream seeds are built from our own framing, one per version and protocol, so
 	/// each must decode whole: one that does not leaves its version's path unseeded. Those
 	/// at a cap must not, or they sit beside no rejection path.
diff --git a/rs/moq-net/src/lite/announce.rs b/rs/moq-net/src/lite/announce.rs
index 83c962eb072..8e9d42770b4 100644
--- a/rs/moq-net/src/lite/announce.rs
+++ b/rs/moq-net/src/lite/announce.rs
@@ -1,6 +1,11 @@
 use num_enum::{IntoPrimitive, TryFromPrimitive};
 
-use crate::{Hop, Hops, Instance, Path, coding::*, origin::Cost};
+use crate::{
+	Hop, Hops, Instance, Path,
+	coding::*,
+	origin::Cost,
+	route::{self, Advert},
+};
 
 use super::{
 	Message, Version,
@@ -18,6 +23,17 @@ const ANNOUNCE_RESTART: u64 = 3;
 const SYNCED: u64 = 4;
 // lite-07: a new advertisement continues what a live one served beneath its prefix.
 const ANNOUNCE_TAKEOVER: u64 = 5;
+// lite-07: the route layer. ROUTE_END also travels back as the echo.
+const ROUTE_START: u64 = 6;
+const ROUTE_UPDATE: u64 = 7;
+const ROUTE_END: u64 = 8;
+const ANNOUNCE_FLOOR: u64 = 9;
+#[cfg_attr(
+	not(any(test, feature = "fuzz")),
+	allow(dead_code, reason = "the lite-07 session does not drive the route layer yet")
+)]
+const ROUTE_REQUEST: u64 = 10;
+const ROUTE_HOLD: u64 = 11;
 
 /// Whether the negotiated version can update a live advertisement's metadata. On lite-05 an
 /// update travels as a duplicate ANNOUNCE (a second `active` for an already-announced path); on
@@ -95,6 +111,62 @@ pub enum AnnounceBroadcast {
 	Skipped,
 	/// The initial set has been delivered (lite-07+).
 	Synced,
+	/// ROUTE_START (lite-07+): the sender has a route to the origin node `node`, and
+	/// assigns it the next Route ID.
+	RouteStart { node: route::Id, advert: Advert },
+	/// ROUTE_UPDATE (lite-07+): the route with this id changed, and is usable.
+	RouteUpdate { id: u64, advert: Advert },
+	/// ROUTE_HOLD (lite-07+): the sender has no usable route with this id, but still
+	/// holds its advertisements while it recovers.
+	RouteHold { id: u64 },
+	/// ROUTE_END (lite-07+): the sender let go of the route with this id, and of every
+	/// advertisement under it. The receiver echoes it back.
+	RouteEnd { id: u64 },
+	/// ANNOUNCE_FLOOR (lite-07+): closes the batch of advertisements under the route
+	/// with this id, certifying them across the whole requested prefix at the origin's
+	/// revision, or certifying nothing (`None`).
+	Floor { id: u64, revision: Option<route::Rev> },
+}
+
+/// Encode a seqno, metric, and down-only bit. No origin advertises the last seqno,
+/// which would leave no room for the successor a ROUTE_REQUEST names.
+fn encode_advert(w: &mut Encoder<'_>, advert: &Advert) -> Result<(), EncodeError> {
+	if advert.seqno == route::MAX {
+		return Err(EncodeError::InvalidState);
+	}
+	w.varint(advert.seqno)?;
+	w.varint(advert.metric)?;
+	w.bool(advert.down_only);
+	Ok(())
+}
+
+fn decode_advert(r: &mut Decoder<'_>) -> Result<Advert, DecodeError> {
+	let seqno = r.varint()?;
+	if seqno == route::MAX {
+		return Err(DecodeError::InvalidValue);
+	}
+	Ok(Advert {
+		seqno,
+		metric: r.varint()?,
+		down_only: r.bool()?,
+	})
+}
+
+/// Encode an ANNOUNCE_FLOOR body: the revision plus one, or 0 to certify nothing.
+fn encode_floor(w: &mut Encoder<'_>, id: u64, revision: Option<route::Rev>) -> Result<(), EncodeError> {
+	w.varint(id)?;
+	match revision {
+		// No origin advertises the last revision, so it never needs the offset.
+		Some(route::MAX) => Err(EncodeError::InvalidState),
+		Some(rev) => w.varint(rev + 1),
+		None => w.varint(0),
+	}
+}
+
+fn decode_floor(r: &mut Decoder<'_>) -> Result<AnnounceBroadcast, DecodeError> {
+	let id = r.varint()?;
+	let revision = r.varint()?.checked_sub(1);
+	Ok(AnnounceBroadcast::Floor { id, revision })
 }
 
 /// A path suffix as it travels: the first `keep` segments of a base announcement's
@@ -244,6 +316,16 @@ impl Encode<Version> for AnnounceBroadcast {
 				Self::Takeover { .. } if version.has_announce_takeover() => ANNOUNCE_TAKEOVER,
 				// Older versions send a start instead.
 				Self::Takeover { .. } => return Err(EncodeError::Version),
+				Self::RouteStart { .. } if version.has_routes() => ROUTE_START,
+				Self::RouteUpdate { .. } if version.has_routes() => ROUTE_UPDATE,
+				Self::RouteHold { .. } if version.has_routes() => ROUTE_HOLD,
+				Self::RouteEnd { .. } if version.has_routes() => ROUTE_END,
+				Self::Floor { .. } if version.has_routes() => ANNOUNCE_FLOOR,
+				Self::RouteStart { .. }
+				| Self::RouteUpdate { .. }
+				| Self::RouteHold { .. }
+				| Self::RouteEnd { .. }
+				| Self::Floor { .. } => return Err(EncodeError::Version),
 				// The pre-lite-06 path-form retraction has no place on lite-06.
 				Self::Ended { .. } => return Err(EncodeError::Version),
 				// Decode-only: an unknown type is never sent.
@@ -298,6 +380,19 @@ impl Encode<Version> for AnnounceBroadcast {
 					cost.encode(w, version)?;
 				}
 				Self::Synced => {}
+				Self::RouteStart { node, advert } => {
+					if *node == 0 {
+						return Err(EncodeError::InvalidState);
+					}
+					w.varint(*node)?;
+					encode_advert(w, advert)?;
+				}
+				Self::RouteUpdate { id, advert } => {
+					w.varint(*id)?;
+					encode_advert(w, advert)?;
+				}
+				Self::RouteHold { id } | Self::RouteEnd { id } => w.varint(*id)?,
+				Self::Floor { id, revision } => encode_floor(w, *id, *revision)?,
 				Self::Ended { .. } | Self::Skipped => unreachable!("refused above"),
 			}
 			if w.since(&prefix) > MAX_MESSAGE_SIZE {
@@ -332,7 +427,12 @@ impl Encode<Version> for AnnounceBroadcast {
 			| Self::Restart { .. }
 			| Self::Takeover { .. }
 			| Self::Skipped
-			| Self::Synced => {
+			| Self::Synced
+			| Self::RouteStart { .. }
+			| Self::RouteUpdate { .. }
+			| Self::RouteHold { .. }
+			| Self::RouteEnd { .. }
+			| Self::Floor { .. } => {
 				return Err(EncodeError::Version);
 			}
 		}
@@ -396,6 +496,21 @@ impl<'a> Decode<'a, Version> for AnnounceBroadcast {
 							cost: Cost::decode(&mut body, version)?,
 						}
 					}
+					ROUTE_START if version.has_routes() => {
+						let node = body.varint()?;
+						let advert = decode_advert(&mut body)?;
+						if node == 0 {
+							return Err(DecodeError::InvalidValue);
+						}
+						Self::RouteStart { node, advert }
+					}
+					ROUTE_UPDATE if version.has_routes() => Self::RouteUpdate {
+						id: body.varint()?,
+						advert: decode_advert(&mut body)?,
+					},
+					ROUTE_HOLD if version.has_routes() => Self::RouteHold { id: body.varint()? },
+					ROUTE_END if version.has_routes() => Self::RouteEnd { id: body.varint()? },
+					ANNOUNCE_FLOOR if version.has_routes() => decode_floor(&mut body)?,
 					// Unknown types are skipped by length so an earlier Lite06 build
 					// negotiating the same ALPN does not kill the announce stream.
 					_ => {
@@ -529,6 +644,75 @@ impl<'a> Message<'a> for AnnounceRequest {
 	}
 }
 
+/// A message the subscriber sends on the Announce Stream after its ANNOUNCE_REQUEST
+/// (lite-07+), toward the publisher that sent the routes.
+#[cfg_attr(
+	not(any(test, feature = "fuzz")),
+	allow(dead_code, reason = "the lite-07 session does not drive the route layer yet")
+)]
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub enum AnnounceReply {
+	/// ROUTE_REQUEST: asks for a route to `node`, as the publisher named it, at least
+	/// as new as `seqno`.
+	RouteRequest { node: route::Id, seqno: route::Seqno },
+	/// The echo of the ROUTE_END that retired this Route ID, sent once the subscriber
+	/// dropped the route.
+	RouteEnd { id: u64 },
+}
+
+impl Encode<Version> for AnnounceReply {
+	fn encode(&self, w: &mut Encoder<'_>, version: Version) -> Result<(), EncodeError> {
+		w.control = Some(crate::stats::Message::Announce);
+		if !version.has_routes() {
+			return Err(EncodeError::Version);
+		}
+		w.varint(match self {
+			Self::RouteRequest { .. } => ROUTE_REQUEST,
+			Self::RouteEnd { .. } => ROUTE_END,
+		})?;
+		let prefix = w.prefix_varint();
+		match self {
+			Self::RouteRequest { node: 0, .. } => return Err(EncodeError::InvalidState),
+			Self::RouteRequest { node, seqno } => {
+				w.varint(*node)?;
+				w.varint(*seqno)?;
+			}
+			Self::RouteEnd { id } => w.varint(*id)?,
+		}
+		w.fill(prefix)
+	}
+}
+
+impl<'a> Decode<'a, Version> for AnnounceReply {
+	fn decode(buf: &mut Decoder<'a>, version: Version) -> Result<Self, DecodeError> {
+		buf.control = Some(crate::stats::Message::Announce);
+		if !version.has_routes() {
+			return Err(DecodeError::Version);
+		}
+		let typ = buf.varint()?;
+		let size = decode_size(buf, MAX_MESSAGE_SIZE)?;
+		let mut body = buf.sub(size)?;
+		let msg = (|| {
+			Ok(match typ {
+				ROUTE_REQUEST => match body.varint()? {
+					0 => return Err(DecodeError::InvalidValue),
+					node => Self::RouteRequest {
+						node,
+						seqno: body.varint()?,
+					},
+				},
+				ROUTE_END => Self::RouteEnd { id: body.varint()? },
+				typ => return Err(DecodeError::InvalidMessage(typ)),
+			})
+		})()
+		.map_err(DecodeError::complete)?;
+		if !body.is_empty() {
+			return Err(DecodeError::Long);
+		}
+		Ok(msg)
+	}
+}
+
 /// Send by the publisher, used to determine the message that follows.
 #[derive(Clone, Copy, Debug, IntoPrimitive, TryFromPrimitive)]
 #[repr(u8)]
@@ -1279,4 +1463,235 @@ mod tests {
 			assert!(input.is_empty());
 		}
 	}
+
+	fn advert(seqno: u64, metric: u64, down_only: bool) -> Advert {
+		Advert {
+			seqno,
+			metric,
+			down_only,
+		}
+	}
+
+	/// Encode a typed lite-07 announce message from its raw body, bypassing the encoder's checks.
+	fn forge(typ: u64, body: impl FnOnce(&mut Encoder<'_>)) -> Vec<u8> {
+		let version = Version::Lite07;
+		let mut inner = Vec::new();
+		body(&mut Encoder::new(&mut inner, version.into()));
+		let mut buf = Vec::new();
+		let mut w = Encoder::new(&mut buf, version.into());
+		w.varint(typ).unwrap();
+		w.varint(inner.len() as u64).unwrap();
+		buf.extend_from_slice(&inner);
+		buf
+	}
+
+	fn decode_broadcast(buf: &[u8], version: Version) -> Result<AnnounceBroadcast, DecodeError> {
+		let mut slice = buf;
+		crate::coding::decode_buf(&mut slice, version, |r, v| AnnounceBroadcast::decode(r, v))
+	}
+
+	fn decode_reply(buf: &[u8], version: Version) -> Result<AnnounceReply, DecodeError> {
+		let mut slice = buf;
+		crate::coding::decode_buf(&mut slice, version, |r, v| AnnounceReply::decode(r, v))
+	}
+
+	#[test]
+	fn route_messages_round_trip_on_lite07() {
+		for msg in [
+			AnnounceBroadcast::RouteStart {
+				node: 0x7a3f,
+				advert: advert(41, 12, false),
+			},
+			AnnounceBroadcast::RouteStart {
+				node: route::QUALIFIED | 9,
+				advert: advert(route::MAX - 1, route::MAX, true),
+			},
+			AnnounceBroadcast::RouteUpdate {
+				id: 0,
+				advert: advert(42, 0, true),
+			},
+			AnnounceBroadcast::RouteHold { id: 3 },
+			AnnounceBroadcast::RouteEnd { id: 0 },
+			AnnounceBroadcast::Floor {
+				id: 0,
+				revision: Some(0),
+			},
+			AnnounceBroadcast::Floor {
+				id: 1,
+				revision: Some(route::MAX - 1),
+			},
+			AnnounceBroadcast::Floor { id: 2, revision: None },
+		] {
+			assert_eq!(broadcast_round_trip(&msg, Version::Lite07), msg);
+		}
+	}
+
+	/// A floor is a marker: the Route ID and the revision plus one, 0 when it certifies
+	/// nothing.
+	#[test]
+	fn a_floor_is_its_route_and_revision() {
+		let encode = |revision| {
+			let mut buf = Vec::new();
+			AnnounceBroadcast::Floor { id: 0, revision }
+				.encode(&mut Encoder::new(&mut buf, Version::Lite07.into()), Version::Lite07)
+				.unwrap();
+			buf
+		};
+		assert_eq!(encode(Some(0)), vec![9, 2, 0, 1]);
+		assert_eq!(encode(Some(7)), vec![9, 2, 0, 8]);
+		assert_eq!(encode(None), vec![9, 2, 0, 0]);
+	}
+
+	#[test]
+	fn route_messages_need_lite07() {
+		for msg in [
+			AnnounceBroadcast::RouteStart {
+				node: 1,
+				advert: advert(0, 1, false),
+			},
+			AnnounceBroadcast::RouteUpdate {
+				id: 0,
+				advert: advert(0, 1, false),
+			},
+			AnnounceBroadcast::RouteHold { id: 0 },
+			AnnounceBroadcast::RouteEnd { id: 0 },
+			AnnounceBroadcast::Floor { id: 0, revision: None },
+		] {
+			for version in [Version::Lite05, Version::Lite06] {
+				let mut buf = Vec::new();
+				let res = msg.encode(&mut Encoder::new(&mut buf, version.into()), version);
+				assert!(matches!(res, Err(EncodeError::Version)), "{msg:?} on {version:?}");
+			}
+		}
+		// A lite-06 receiver skips the type like any other it does not know.
+		let wire = forge(ROUTE_END, |w| w.varint(0u64).unwrap());
+		assert_eq!(
+			decode_broadcast(&wire, Version::Lite06).unwrap(),
+			AnnounceBroadcast::Skipped
+		);
+
+		for reply in [
+			AnnounceReply::RouteRequest { node: 1, seqno: 0 },
+			AnnounceReply::RouteEnd { id: 0 },
+		] {
+			let mut buf = Vec::new();
+			let res = reply.encode(&mut Encoder::new(&mut buf, Version::Lite06.into()), Version::Lite06);
+			assert!(matches!(res, Err(EncodeError::Version)));
+		}
+		assert!(matches!(
+			decode_reply(&wire, Version::Lite06),
+			Err(DecodeError::Version)
+		));
+	}
+
+	/// What no node advertises is refused on both ends: node 0, and the last seqno or
+	/// revision.
+	#[test]
+	fn route_messages_refuse_what_no_node_advertises() {
+		let refused = [
+			AnnounceBroadcast::RouteStart {
+				node: 0,
+				advert: advert(0, 1, false),
+			},
+			AnnounceBroadcast::RouteStart {
+				node: 1,
+				advert: advert(route::MAX, 1, false),
+			},
+			AnnounceBroadcast::RouteUpdate {
+				id: 0,
+				advert: advert(route::MAX, 1, false),
+			},
+			// The last revision has no room for the offset.
+			AnnounceBroadcast::Floor {
+				id: 0,
+				revision: Some(route::MAX),
+			},
+		];
+		for msg in refused {
+			let mut buf = Vec::new();
+			let res = msg.encode(&mut Encoder::new(&mut buf, Version::Lite07.into()), Version::Lite07);
+			assert!(matches!(res, Err(EncodeError::InvalidState)), "{msg:?}");
+		}
+
+		let advert = |node: u64, seqno: u64, metric: u64, down_only: u8| {
+			move |w: &mut Encoder<'_>| {
+				w.varint(node).unwrap();
+				w.varint(seqno).unwrap();
+				w.varint(metric).unwrap();
+				w.u8(down_only);
+			}
+		};
+		let malformed = [
+			forge(ROUTE_START, advert(0, 0, 1, 0)),
+			forge(ROUTE_START, advert(1, route::MAX, 1, 0)),
+			forge(ROUTE_START, advert(1, 0, 1, 2)),
+			// ROUTE_UPDATE's leading field is the Route ID, so 0 is a valid id here.
+			forge(ROUTE_UPDATE, advert(0, route::MAX, 1, 0)),
+			// A hold carries only its Route ID.
+			forge(ROUTE_HOLD, |w| {
+				w.varint(0u64).unwrap();
+				w.varint(0u64).unwrap();
+			}),
+			// A floor without its revision, and one with trailing bytes.
+			forge(ANNOUNCE_FLOOR, |w| w.varint(0u64).unwrap()),
+			forge(ANNOUNCE_FLOOR, |w| {
+				w.varint(0u64).unwrap();
+				w.varint(1u64).unwrap();
+				w.u8(0);
+			}),
+			// Trailing bytes after a complete body.
+			forge(ROUTE_END, |w| {
+				w.varint(0u64).unwrap();
+				w.u8(0);
+			}),
+		];
+		for wire in malformed {
+			assert!(decode_broadcast(&wire, Version::Lite07).is_err(), "{wire:?}");
+		}
+	}
+
+	#[test]
+	fn announce_reply_round_trips_on_lite07() {
+		for reply in [
+			AnnounceReply::RouteRequest {
+				node: 0x7a3f,
+				seqno: 42,
+			},
+			// A request may name the last seqno: only a rotation answers it.
+			AnnounceReply::RouteRequest {
+				node: route::QUALIFIED | 1,
+				seqno: route::MAX,
+			},
+			AnnounceReply::RouteEnd { id: 0 },
+		] {
+			let mut buf = Vec::new();
+			reply
+				.encode(&mut Encoder::new(&mut buf, Version::Lite07.into()), Version::Lite07)
+				.unwrap();
+			assert_eq!(decode_reply(&buf, Version::Lite07).unwrap(), reply);
+		}
+	}
+
+	#[test]
+	fn announce_reply_refuses_node_zero_and_unknown_types() {
+		let mut buf = Vec::new();
+		let res = AnnounceReply::RouteRequest { node: 0, seqno: 1 }
+			.encode(&mut Encoder::new(&mut buf, Version::Lite07.into()), Version::Lite07);
+		assert!(matches!(res, Err(EncodeError::InvalidState)));
+
+		let zero = forge(ROUTE_REQUEST, |w| {
+			w.varint(0u64).unwrap();
+			w.varint(1u64).unwrap();
+		});
+		assert!(matches!(
+			decode_reply(&zero, Version::Lite07),
+			Err(DecodeError::InvalidValue)
+		));
+		// Only routes travel back: an announcement type is not a reply.
+		let start = forge(ROUTE_START, |w| w.varint(1u64).unwrap());
+		assert!(matches!(
+			decode_reply(&start, Version::Lite07),
+			Err(DecodeError::InvalidMessage(ROUTE_START))
+		));
+	}
 }
diff --git a/rs/moq-net/src/lite/subscriber.rs b/rs/moq-net/src/lite/subscriber.rs
index ae0924eff6b..e64801e968c 100644
--- a/rs/moq-net/src/lite/subscriber.rs
+++ b/rs/moq-net/src/lite/subscriber.rs
@@ -597,6 +597,13 @@ impl Subscriber {
 				)?;
 			}
 			lite::AnnounceBroadcast::Skipped | lite::AnnounceBroadcast::Synced => {}
+			// Nothing drives the route layer on this stream yet, so a peer relying on it
+			// cannot be served.
+			lite::AnnounceBroadcast::RouteStart { .. }
+			| lite::AnnounceBroadcast::RouteUpdate { .. }
+			| lite::AnnounceBroadcast::RouteHold { .. }
+			| lite::AnnounceBroadcast::RouteEnd { .. }
+			| lite::AnnounceBroadcast::Floor { .. } => return Err(Error::ProtocolViolation),
 		}
 		Ok(())
 	}
diff --git a/rs/moq-net/src/lite/version.rs b/rs/moq-net/src/lite/version.rs
index 469ac26b633..20f33e84d05 100644
--- a/rs/moq-net/src/lite/version.rs
+++ b/rs/moq-net/src/lite/version.rs
@@ -345,6 +345,16 @@ impl Version {
 		)
 	}
 
+	/// Whether the announce stream carries the route layer: ROUTE_START, ROUTE_UPDATE,
+	/// ROUTE_HOLD, ROUTE_END, and ANNOUNCE_FLOOR toward the subscriber, and ROUTE_REQUEST
+	/// and the ROUTE_END echo back. Added in lite-07.
+	pub(crate) fn has_routes(self) -> bool {
+		!matches!(
+			self,
+			Self::Lite01 | Self::Lite02 | Self::Lite03 | Self::Lite04 | Self::Lite05 | Self::Lite06
+		)
+	}
+
 	/// Whether the announce stream has ANNOUNCE_TAKEOVER: a new advertisement that
 	/// continues what a live one served beneath its prefix. Added in lite-07. Older
 	/// versions send an ANNOUNCE_START, which the receiver treats as another instance.
diff --git a/rs/moq-net/src/route/mod.rs b/rs/moq-net/src/route/mod.rs
index a8e7611b51d..3029687e5b2 100644
--- a/rs/moq-net/src/route/mod.rs
+++ b/rs/moq-net/src/route/mod.rs
@@ -48,9 +48,9 @@ pub(crate) type Seqno = u64;
 /// An origin's claim revision, advancing on every change to its own claims.
 pub(crate) type Rev = u64;
 
-/// The largest lite-07 varint. As a metric it means held; no origin ever
-/// advertises it as a seqno or revision, rotating its identity instead, so every
-/// advertised seqno leaves room for the successor a request names.
+/// The largest lite-07 varint. No origin ever advertises it as a seqno or revision,
+/// rotating its identity instead, so every advertised seqno leaves room for the
+/// successor a request names, and every revision for ANNOUNCE_FLOOR's offset.
 pub(crate) const MAX: u64 = u64::MAX;
 
 /// A neighbor key, bounded so per-identity state can be read as one range.
@@ -131,15 +131,15 @@ pub(crate) struct Advert {
 pub(crate) enum Reach {
 	/// A usable route.
 	Finite(Advert),
-	/// An infinite metric: unusable, but the sender still holds the identity's
-	/// announcements while it recovers. Only follows a finite route.
+	/// Unusable, but the sender still holds the identity's announcements while it
+	/// recovers. Only follows a finite route.
 	Held,
 }
 
 /// A message for one neighbor.
 #[derive(Clone, Debug, PartialEq, Eq)]
 pub(crate) enum Out<N, A> {
-	/// ROUTE_START or ROUTE_UPDATE, or ROUTE_END for `None`.
+	/// ROUTE_START or ROUTE_UPDATE, ROUTE_HOLD for a held reach, or ROUTE_END for `None`.
 	Route { to: N, id: Id, reach: Option<Reach> },
 	/// A batch of announcement changes for `id`, closed by its floor list, which
 	/// replaces the last one sent for that route.
@@ -1349,8 +1349,8 @@ impl<N: Key, A: Clone + Eq> Router<N, A> {
 	}
 }
 
-/// `metric` plus a strictly positive link `cost`, or `None` when it reaches the
-/// infinite metric: overflow is unreachable, never saturated.
+/// `metric` plus a strictly positive link `cost`, or `None` when it overflows: an
+/// overflowed route is unreachable, never saturated.
 fn add(metric: Metric, cost: Metric) -> Option<Metric> {
-	metric.checked_add(cost).filter(|&metric| metric < MAX)
+	metric.checked_add(cost)
 }
diff --git a/rs/moq-net/src/route/tests/routing.rs b/rs/moq-net/src/route/tests/routing.rs
index d3ea706bf08..01316c3c763 100644
--- a/rs/moq-net/src/route/tests/routing.rs
+++ b/rs/moq-net/src/route/tests/routing.rs
@@ -762,6 +762,45 @@ fn an_unanswerable_request_stops() {
 	assert_eq!(sim.retained().pending, 0);
 }
 
+/// A request newer than the one pending raises it and is sent on again, so the
+/// newer requester is not left waiting on an answer that only meets the older
+/// one; a repeat of the pending Seqno, or an older one, is a duplicate.
+#[test]
+fn a_newer_request_raises_the_pending_one() {
+	let (up, a, b) = (0, 1, 2);
+	let mut relay = Router::<Node, Item>::new(9);
+	for neighbor in [up, a, b] {
+		relay.connect(neighbor, Link::default()).unwrap();
+	}
+	let advert = Advert {
+		seqno: 0,
+		metric: 1,
+		down_only: false,
+	};
+	relay.route(up, 7, Some(Reach::Finite(advert)));
+	relay.drain();
+
+	let requests = |relay: &mut Router<Node, Item>| -> Vec<(Node, Seqno)> {
+		relay
+			.drain()
+			.into_iter()
+			.filter_map(|out| match out {
+				Out::Request { to, id: 7, seqno } => Some((to, seqno)),
+				_ => None,
+			})
+			.collect()
+	};
+
+	relay.request(a, 7, 1);
+	assert_eq!(requests(&mut relay), [(up, 1)]);
+	relay.request(b, 7, 1);
+	assert_eq!(requests(&mut relay), [], "a duplicate");
+	relay.request(b, 7, 2);
+	assert_eq!(requests(&mut relay), [(up, 2)], "raised and sent again");
+	relay.request(a, 7, 1);
+	assert_eq!(requests(&mut relay), [], "older than the pending one");
+}
+
 /// Each message recomputes only the identity it names, so the work a message
 /// costs does not grow with how many other origins a node routes to.
 #[test]
@@ -813,7 +852,7 @@ fn an_overflowing_route_neither_certifies_nor_holds() {
 	};
 	let (near, far) = (1, 2);
 	let far_link = Link {
-		cost: MAX - 1,
+		cost: MAX,
 		..Link::default()
 	};
 

From 6f92d4499c5f1fe929caebe4fe7800565bf85e1a Mon Sep 17 00:00:00 2001
From: Luke Curley <kixelated@gmail.com>
Date: Thu, 5 Nov 2026 22:03:29 +0000
Subject: [PATCH 23/36] chore(runner)!: remove the runner-migrate disk tool
 (#7985)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 nix/modules/github-runner-vm.nix |  2 +-
 nix/runner/README.md             | 38 +---------------------
 nix/runner/guest.nix             | 19 +----------
 nix/runner/image-test.nix        | 44 +++-----------------------
 nix/runner/migrate.sh            | 54 --------------------------------
 sh/dispatch-query.test.py        |  1 -
 6 files changed, 7 insertions(+), 151 deletions(-)
 delete mode 100644 nix/runner/migrate.sh

diff --git a/nix/modules/github-runner-vm.nix b/nix/modules/github-runner-vm.nix
index 9b9e27178bb..2fa269b87ba 100644
--- a/nix/modules/github-runner-vm.nix
+++ b/nix/modules/github-runner-vm.nix
@@ -164,7 +164,7 @@ let
           fi
           if ! test -e "$STATE_DIRECTORY/root.raw"; then
             if test -e "$STATE_DIRECTORY/root.qcow2"; then
-              echo "Migrate the existing runner disk to XFS before starting ${name}." >&2
+              echo "Delete the legacy $STATE_DIRECTORY/root.qcow2 and install a fresh registration token at ${cfg.tokenFile} so ${name} boots and registers a fresh image (see nix/runner/README.md)." >&2
               exit 1
             fi
             cp --reflink=auto ${guest.config.system.build.image}/${guest.config.image.fileName} "$STATE_DIRECTORY/root.raw.tmp"
diff --git a/nix/runner/README.md b/nix/runner/README.md
index 0ab20e780a3..ceb6a81367f 100644
--- a/nix/runner/README.md
+++ b/nix/runner/README.md
@@ -90,41 +90,6 @@ Then deploy with `nixos-rebuild switch --flake .#queue-ci --target-host
 root@10.231.0.2`, using the dedicated deployment key. Host rebuilds update the VM
 launcher. Back up the deployment private key separately.
 
-## Migrating an existing ext4 guest
-
-An existing `root.qcow2` must be migrated before activating the new host
-configuration. The launcher refuses to replace it with an empty guest.
-Build the migration tool and the host configuration first, while the old guest
-continues running:
-
-```bash
-nix build .#nixosConfigurations.queue-ci.config.system.build.runner-migrate -o runner-migrate
-nixos-rebuild build --flake .#build-host
-```
-
-Once the runner is idle, stop its VM and copy its filesystem into the new image:
-
-```bash
-sudo systemctl stop queue-ci
-sudo ./runner-migrate/bin/runner-migrate /var/lib/queue-ci/root.qcow2 /var/lib/queue-ci/root.raw
-```
-
-The tool keeps the source read-only, preserves registration, caches, ownership,
-permissions and hard links, and grows the new XFS filesystem to `resources.disk`.
-It refuses an open source disk or an existing destination. Guest filesystems stay
-inside libguestfs appliances rather than being mounted in the host kernel.
-
-Activate the built host configuration and start the VM:
-
-```bash
-nixos-rebuild switch --sudo --flake .#build-host
-sudo systemctl start queue-ci
-```
-
-Verify the runner is online, its root filesystem is XFS, and a representative
-job passes before removing the old disk. To roll back, stop the VM, reactivate
-the previous host configuration, and start it with its retained `root.qcow2`.
-
 The runner's home is `/var/cache/github-runner-home`; mbx uses
 `/var/cache/github-runner-home/.cache/mbx`. Workflows must select mbx's local backend
 on this runner. There is no cache-warming service or cache server. Persistent job
@@ -158,7 +123,6 @@ settings, the runner's locked-memory budget, symlink-free home and work director
 with state migrated from the former DynamicUser layout, free page reporting and
 idle cache drops, killing a job that fills memory before it thrashes the disk, and
 Nix/mbx persistence across runner and guest restarts.
-It also migrates a disposable ext4 disk, boots the resulting XFS image through
-UEFI, checks filesystem growth and a second boot, and measures ordinary copies
+It also boots the built XFS image through UEFI, checks filesystem growth and a second boot, and measures ordinary copies
 against reflinks at 1, 16, and 64 MiB. Timings are reported without a flaky
 performance threshold; reflink support and copy-on-write isolation are required.
diff --git a/nix/runner/guest.nix b/nix/runner/guest.nix
index 1fe0bc8d774..fd06ffa7f56 100644
--- a/nix/runner/guest.nix
+++ b/nix/runner/guest.nix
@@ -20,7 +20,7 @@
   assertions = [
     {
       assertion = resources.disk >= 8;
-      message = "Runner guests and migrations need at least 8 GiB for the base image.";
+      message = "Runner guests need at least 8 GiB for the base image.";
     }
   ];
 
@@ -65,23 +65,6 @@
   };
   system.stateVersion = "26.05";
 
-  # Build the offline migration tool with the same image and disk budget.
-  system.build.runner-migrate = pkgs.writeShellApplication {
-    name = "runner-migrate";
-    runtimeInputs = with pkgs; [
-      coreutils
-      gptfdisk
-      libguestfs-with-appliance
-      psmisc
-      qemu_kvm
-    ];
-    text = ''
-      runner_image=${config.system.build.image}/${config.image.fileName}
-      runner_capacity=${toString resources.disk}G
-      ${builtins.readFile ./migrate.sh}
-    '';
-  };
-
   services.openssh = {
     enable = true;
     settings = {
diff --git a/nix/runner/image-test.nix b/nix/runner/image-test.nix
index 166030fbf14..db5ab47edf7 100644
--- a/nix/runner/image-test.nix
+++ b/nix/runner/image-test.nix
@@ -23,45 +23,14 @@ pkgs.testers.runNixOSTest {
     import subprocess
     import tempfile
 
+    # Grow the virtual disk past the image, as the host launcher does, so the
+    # root filesystem must expand on first boot.
     directory = tempfile.TemporaryDirectory()
-    os.environ["LIBGUESTFS_BACKEND"] = "direct"
-    legacy = Path(directory.name) / "legacy.raw"
-    source = Path(directory.name) / "legacy.qcow2"
-    migrated = Path(directory.name) / "root.raw"
-    guestfish = "${pkgs.libguestfs-with-appliance}/bin/guestfish"
-    migrate = "${nodes.machine.system.build.runner-migrate}/bin/runner-migrate"
-    subprocess.run([guestfish, "-N", f"{legacy}=fs:ext4:512M"], input="""
-    mount /dev/sda1 /
-    mkdir-p /var/cache/github-runner-home/.cache/mbx
-    write /var/cache/github-runner-home/.cache/mbx/fixture cached
-    ln /var/cache/github-runner-home/.cache/mbx/fixture /var/cache/github-runner-home/.cache/mbx/linked
-    mkdir-p /var/lib/github-runner/runner
-    write /var/lib/github-runner/runner/.runner registered
-    chmod 0600 /var/lib/github-runner/runner/.runner
-    write /var/lib/runner-owner-marker owned
-    chown 12345 12346 /var/lib/runner-owner-marker
-    write /nix-path-registration stale
-    """, text=True, check=True)
-    subprocess.run([
-        "${pkgs.qemu_kvm}/bin/qemu-img", "convert", "-f", "raw", "-O", "qcow2",
-        str(legacy), str(source),
-    ], check=True)
-    with subtest("migration refuses an active source disk"):
-        with source.open("rb"):
-            assert subprocess.run([migrate, source, migrated]).returncode != 0
-        assert not migrated.exists()
-    subprocess.run([migrate, source, migrated], check=True)
-    with subtest("migration preserves its source and refuses to overwrite a destination"):
-        subprocess.run([
-            "${pkgs.qemu_kvm}/bin/qemu-img", "compare", "-f", "raw", "-F", "qcow2",
-            str(legacy), str(source),
-        ], check=True)
-        assert subprocess.run([migrate, source, migrated]).returncode != 0
-
     disk = Path(directory.name) / "boot.qcow2"
     subprocess.run([
         "${pkgs.qemu_kvm}/bin/qemu-img", "create", "-f", "qcow2",
-        "-b", str(migrated), "-F", "raw", str(disk), "20G",
+        "-b", "${nodes.machine.system.build.image}/${nodes.machine.image.fileName}",
+        "-F", "raw", str(disk), "20G",
     ], check=True)
     os.environ["NIX_DISK_IMAGE"] = str(disk)
 
@@ -76,11 +45,6 @@ pkgs.testers.runNixOSTest {
         machine.succeed("test ! -e /nix-path-registration")
         machine.succeed("grep -F 'init=' /boot/loader/entries/nixos-*.conf")
         machine.succeed("test ! -e /boot/EFI/Linux/${nodes.machine.system.boot.loader.ukiFile}")
-        machine.succeed("test $(cat /var/lib/github-runner/runner/.runner) = registered")
-        machine.succeed("test $(stat -c %a /var/lib/github-runner/runner/.runner) = 600")
-        machine.succeed("test $(stat -c %u:%g /var/lib/runner-owner-marker) = 12345:12346")
-        machine.succeed("test $(cat /var/cache/github-runner-home/.cache/mbx/fixture) = cached")
-        machine.succeed("test /var/cache/github-runner-home/.cache/mbx/fixture -ef /var/cache/github-runner-home/.cache/mbx/linked")
 
     with subtest("the build and cache directories share copy-on-write storage"):
         machine.succeed("install -d /var/cache/github-runner-work")
diff --git a/nix/runner/migrate.sh b/nix/runner/migrate.sh
deleted file mode 100644
index 983dfbe4e8a..00000000000
--- a/nix/runner/migrate.sh
+++ /dev/null
@@ -1,54 +0,0 @@
-#!/usr/bin/env bash
-# Copy an offline ext4 runner into a new XFS image, retaining its original disk.
-set -euo pipefail
-export LIBGUESTFS_BACKEND=direct
-: "${runner_image:?}" "${runner_capacity:?}"
-
-if [[ $# != 2 ]]; then
-    echo "usage: runner-migrate SOURCE.qcow2 DESTINATION.raw" >&2
-    exit 2
-fi
-source_disk=$(realpath -e -- "$1")
-destination=$(realpath -m -- "$2")
-if [[ -e "$destination" ]]; then
-    echo "Destination already exists: $destination" >&2
-    exit 1
-fi
-if fuser "$source_disk" >/dev/null 2>&1; then
-    echo "Source disk is in use; stop its VM before migrating." >&2
-    exit 1
-fi
-
-temporary=$(mktemp --tmpdir="$(dirname "$destination")" .runner-migrate.XXXXXXXX)
-trap 'rm -f -- "$temporary"' EXIT
-cp --reflink=auto --sparse=always "$runner_image" "$temporary"
-chmod 0600 "$temporary"
-chown --reference="$source_disk" "$temporary"
-image_size=$(stat -c %s "$temporary")
-qemu-img resize -f raw "$temporary" "$runner_capacity"
-
-# Let GPT tooling preserve its metadata reservation rather than guessing the
-# last usable sector from the disk size.
-grow_partition=
-if (($(stat -c %s "$temporary") > image_size)); then
-    sgdisk --move-second-header "$temporary"
-    last_sector=$(sgdisk --end-of-largest "$temporary")
-    grow_partition="part-resize /dev/sda 2 $last_sector"
-fi
-guestfish --rw --format=raw -a "$temporary" <<EOF
-run
-$grow_partition
-mount /dev/sda2 /
-xfs-growfs /
-EOF
-
-# guestfish keeps guest filesystems inside an appliance rather than mounting
-# them in the host kernel. The new image's bootstrap manifest must survive.
-guestfish --ro --format=qcow2 -a "$source_disk" -m /dev/sda1 \
-    tar-out / - numericowner:true xattrs:true acls:true excludes:./nix-path-registration |
-    guestfish --rw --format=raw -a "$temporary" -m /dev/sda2 \
-        tar-in - / xattrs:true acls:true
-
-mv -n -- "$temporary" "$destination"
-test ! -e "$temporary"
-echo "Migrated to $destination; original disk retained at $source_disk."
diff --git a/sh/dispatch-query.test.py b/sh/dispatch-query.test.py
index b2669c5149d..aa92096a508 100644
--- a/sh/dispatch-query.test.py
+++ b/sh/dispatch-query.test.py
@@ -661,7 +661,6 @@ def test_flake_checks_follow_nix_inputs_instead_of_rust_source(self):
             ("flake.nix", True),
             ("flake.lock", True),
             ("nix/runner/hog.py", True),
-            ("nix/runner/migrate.sh", True),
             ("infra/example.nix", True),
             ("quest/m1/example.md", False),
         ):

From 068ddc9dbc8426acdcdfa27400a13de139bb023b Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 5 Nov 2026 22:03:36 +0000
Subject: [PATCH 24/36] chore(deps): Bump the nix group with 2 updates (#7910)

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 flake.lock | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/flake.lock b/flake.lock
index edd04036caf..47cb813c537 100644
--- a/flake.lock
+++ b/flake.lock
@@ -35,11 +35,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1792842277,
-        "narHash": "sha256-pGPnZGi8y9d76xNeracniXO3dsYVROEmMkMc8jD0Ihc=",
+        "lastModified": 1793166571,
+        "narHash": "sha256-3+DlA8JY6abKt8G9hoZgTiSNLxdkGTn2a5MeiNDXmIc=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "d3b13ad75cc492690728f9307e443dec9ef9a20e",
+        "rev": "fa45202b90a351983649116adb577827b2a9a679",
         "type": "github"
       },
       "original": {
@@ -123,11 +123,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1793086596,
-        "narHash": "sha256-ObKS44vw4IIVpQ69YJzUGjZ0IwnpWoUlwjJSY7gefdo=",
+        "lastModified": 1793174968,
+        "narHash": "sha256-u5nUf4cewaT36iIzG1s/VECktqUMiZaGF5BsgervsvQ=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "c7e9d512653a35ef4d5879c3df4d44d7b78d0e6d",
+        "rev": "19ecdd08213836b36c4296a3a4f4af5a3d5308db",
         "type": "github"
       },
       "original": {

From f3ddaee5b169c938e195682545121ea070ca2090 Mon Sep 17 00:00:00 2001
From: Luke Curley <kixelated@gmail.com>
Date: Thu, 5 Nov 2026 22:11:55 +0000
Subject: [PATCH 25/36] feat!: push-to-talk suppresses silence instead of
 toggling the catalog (#7942)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: GPT-6.1 Sol <noreply@openai.com>
---
 cpp/obs/src/moq-source.cpp                    |  27 +-
 cpp/obs/test/moq-source-test.cpp              |  43 +-
 dart/moq_ffi/lib/src/moq.dart                 |   4 +-
 doc/bin/cli.md                                |   6 +-
 doc/bin/gstreamer.md                          |   7 +-
 doc/bin/obs.md                                |   2 +-
 doc/concept/audio-jitter.md                   |  32 +-
 doc/concept/audio-jitter/corpus.ts            |  16 +-
 doc/concept/audio-jitter/reference.ts         |  26 +-
 doc/concept/audio-jitter/silence.json         |   1 +
 doc/concept/hang.md                           |   2 +-
 doc/lib/c/index.md                            |   2 +-
 doc/lib/cpp/index.md                          |   2 +-
 doc/lib/dart/index.md                         |   2 +-
 doc/lib/go/index.md                           |   2 +-
 doc/lib/js/publish.md                         |  11 +-
 doc/lib/js/room.md                            |   4 +-
 doc/lib/kt/index.md                           |   2 +-
 doc/lib/py/index.md                           |   2 +-
 doc/lib/swift/index.md                        |   2 +-
 drafts/draft-lcurley-moq-hang.md              |   5 +-
 js/hang/src/catalog/audio.ts                  |   3 +-
 js/hang/src/catalog/video.ts                  |   3 +-
 js/hang/src/container/consumer.test.ts        |  45 ++
 js/hang/src/container/consumer.ts             |  22 +
 js/hang/src/container/jitter.test.ts          |  15 +
 js/hang/src/container/jitter.ts               |  30 +-
 js/publish/MIGRATE.md                         |   7 +
 js/publish/api/index.api.md                   |   2 +
 js/publish/src/audio/encoder.test.ts          | 253 ++++++---
 js/publish/src/audio/encoder.ts               | 215 ++++----
 js/publish/src/element.ts                     |  11 +-
 js/room/MIGRATE.md                            |   4 +
 js/room/src/local.ts                          |   6 +-
 js/watch/MIGRATE.md                           |   6 +
 js/watch/src/audio/buffer.test.ts             |   3 +-
 js/watch/src/audio/buffer.ts                  |  31 +-
 js/watch/src/audio/comfort.ts                 |  59 +++
 js/watch/src/audio/decoder.test.ts            | 155 ++++--
 js/watch/src/audio/decoder.ts                 |  37 +-
 js/watch/src/audio/render-worklet.test.ts     |  96 +++-
 js/watch/src/audio/render-worklet.ts          |  65 ++-
 js/watch/src/audio/render.ts                  |  12 +-
 js/watch/src/audio/replay.ts                  |  15 +-
 js/watch/src/audio/ring-buffer.test.ts        | 168 ++++++
 js/watch/src/audio/ring-buffer.ts             | 132 ++++-
 js/watch/src/audio/source.test.ts             |  86 +--
 js/watch/src/audio/source.ts                  |  39 +-
 js/watch/src/audio/terminal.ts                |   5 +
 .../src/ui/components/buffering-indicator.ts  |  10 +-
 js/watch/src/video/decoder.test.ts            |  22 -
 js/watch/src/video/decoder.ts                 |   4 +-
 js/watch/src/video/source.test.ts             |  84 +--
 js/watch/src/video/source.ts                  |  36 +-
 quest/m1/audio-jitter-target/README.md        |   6 +
 quest/m1/push-to-talk-latency.md              |  13 +-
 quest/m1/push-to-talk/README.md               |  30 +-
 quest/m1/push-to-talk/dtx.md                  |  66 ---
 quest/m1/push-to-talk/native-comfort-noise.md |   7 -
 quest/m2/chromium-opus-timestamps.md          |   7 +-
 quest/m3/ladder/README.md                     |   2 +-
 rs/hang/src/catalog/audio/mod.rs              |   3 +-
 rs/hang/src/catalog/video/mod.rs              |   3 +-
 rs/moq-audio/src/decode/consumer.rs           |  45 +-
 rs/moq-audio/src/jitter.rs                    |  63 ++-
 rs/moq-c/MIGRATE.md                           |   4 +
 rs/moq-c/src/api.rs                           |  16 +-
 rs/moq-c/src/consume.rs                       |  53 +-
 rs/moq-c/src/test.rs                          |  12 +-
 rs/moq-cli/src/play/media.rs                  |  77 +--
 rs/moq-ffi/MIGRATE.md                         |   4 +
 rs/moq-ffi/src/audio.rs                       |  14 +-
 rs/moq-ffi/src/media.rs                       |   8 +-
 rs/moq-ffi/src/test.rs                        |  67 ---
 rs/moq-ffi/src/video.rs                       |  13 +-
 rs/moq-gst/MIGRATE.md                         |   6 +
 rs/moq-gst/src/source/imp.rs                  | 501 ++++++++++--------
 rs/moq-mux/MIGRATE.md                         |  11 +
 rs/moq-mux/src/catalog/select.rs              |  76 +--
 rs/moq-mux/src/select.rs                      | 189 ++-----
 rs/moq-rtmp/src/server.rs                     |   6 +-
 test/audio-quality/README.md                  |  18 +-
 .../clients/js/ptt-analyze.test.ts            |  27 +-
 test/audio-quality/clients/js/ptt-analyze.ts  |   9 +-
 test/audio-quality/clients/js/ptt.ts          |   6 +-
 test/audio-quality/clients/js/src/ptt.ts      |  38 +-
 86 files changed, 1894 insertions(+), 1387 deletions(-)
 create mode 100644 doc/concept/audio-jitter/silence.json
 create mode 100644 js/watch/src/audio/comfort.ts
 delete mode 100644 quest/m1/push-to-talk/dtx.md

diff --git a/cpp/obs/src/moq-source.cpp b/cpp/obs/src/moq-source.cpp
index e656fa88d5e..91733783cbb 100644
--- a/cpp/obs/src/moq-source.cpp
+++ b/cpp/obs/src/moq-source.cpp
@@ -611,18 +611,15 @@ moq_source_ranked_audio(const std::unordered_map<std::string, moq::Audio> &rendi
 	});
 }
 
-// The ranked renditions to try in turn: the enabled ones. With none enabled, a consumer
-// should not select a rendition but holds the one it has, so only those `held` accepts.
-template<typename Rendition, typename Held>
+// The ranked renditions to try in turn: the enabled ones, since a consumer must not select a
+// disabled rendition.
+template<typename Rendition>
 static std::vector<const CatalogEntry<Rendition> *>
-moq_source_candidates(std::vector<const CatalogEntry<Rendition> *> ranked, Held held)
+moq_source_candidates(std::vector<const CatalogEntry<Rendition> *> ranked)
 {
-	const bool any_enabled =
-		std::any_of(ranked.begin(), ranked.end(), [](const auto *entry) { return entry->second.enabled; });
-	ranked.erase(
-		std::remove_if(ranked.begin(), ranked.end(),
-			       [&](const auto *entry) { return any_enabled ? !entry->second.enabled : !held(*entry); }),
-		ranked.end());
+	ranked.erase(std::remove_if(ranked.begin(), ranked.end(),
+				    [](const auto *entry) { return !entry->second.enabled; }),
+		     ranked.end());
 	return ranked;
 }
 
@@ -976,10 +973,7 @@ static void moq_source_subscribe_track(struct moq_source *ctx, const std::shared
 static void moq_source_subscribe_video(struct moq_source *ctx, const std::shared_ptr<Connection> &conn,
 				       const moq::Catalog &catalog)
 {
-	const auto candidates = moq_source_candidates(moq_source_ranked_video(catalog.video), [&](const auto &entry) {
-		return moq_source_same_video(conn->video.get(), entry.first, entry.second) ||
-		       moq_source_same_video(conn->pending_video.get(), entry.first, entry.second);
-	});
+	const auto candidates = moq_source_candidates(moq_source_ranked_video(catalog.video));
 	if (candidates.empty()) {
 		LOG_INFO("Catalog has no enabled video rendition; audio only");
 		moq_source_clear_video_locked(ctx);
@@ -1021,10 +1015,7 @@ static void moq_source_subscribe_video(struct moq_source *ctx, const std::shared
 static void moq_source_subscribe_audio(struct moq_source *ctx, const std::shared_ptr<Connection> &conn,
 				       const moq::Catalog &catalog)
 {
-	const auto candidates = moq_source_candidates(moq_source_ranked_audio(catalog.audio), [&](const auto &entry) {
-		return moq_source_same_audio(conn->audio.get(), entry.first, entry.second) ||
-		       moq_source_same_audio(conn->pending_audio.get(), entry.first, entry.second);
-	});
+	const auto candidates = moq_source_candidates(moq_source_ranked_audio(catalog.audio));
 	if (candidates.empty()) {
 		LOG_INFO("Catalog has no enabled audio rendition; video only");
 		moq_source_clear_audio_locked(ctx);
diff --git a/cpp/obs/test/moq-source-test.cpp b/cpp/obs/test/moq-source-test.cpp
index 16ad9730569..91a11c9690d 100644
--- a/cpp/obs/test/moq-source-test.cpp
+++ b/cpp/obs/test/moq-source-test.cpp
@@ -1187,24 +1187,12 @@ int main()
 		       std::vector<std::string>{"f-stereo", "d-mono", "e-slow", "c-low", "b-unknown-bitrate",
 						"a-disabled"}));
 
-		// Only enabled renditions are candidates while any is, even one the source holds.
-		const auto all = [](const auto &) {
-			return true;
-		};
-		const auto none = [](const auto &) {
-			return false;
-		};
-		CHECK((names(moq_source_candidates(moq_source_ranked_audio(audios), all)) ==
+		// Only enabled renditions are candidates.
+		CHECK((names(moq_source_candidates(moq_source_ranked_audio(audios))) ==
 		       std::vector<std::string>{"f-stereo", "d-mono", "e-slow", "c-low", "b-unknown-bitrate"}));
-		// With every rendition disabled, only a held one remains, and nothing when none is held.
 		for (auto &entry : audios)
 			entry.second.enabled = false;
-		const auto held = [](const auto &entry) {
-			return entry.first == "c-low";
-		};
-		CHECK((names(moq_source_candidates(moq_source_ranked_audio(audios), held)) ==
-		       std::vector<std::string>{"c-low"}));
-		CHECK(moq_source_candidates(moq_source_ranked_audio(audios), none).empty());
+		CHECK(moq_source_candidates(moq_source_ranked_audio(audios)).empty());
 	}
 	report("renditions rank like hang");
 
@@ -1308,8 +1296,8 @@ int main()
 	}
 	report("disabled and undecodable renditions fall through");
 
-	// With every rendition disabled, the source holds the one it plays; with none of them
-	// held, the section is handled like an absent one.
+	// With every rendition disabled, the section is handled like an absent one, even the
+	// rendition the source plays.
 	{
 		TestRelay relay;
 		reset(relay.Url());
@@ -1318,29 +1306,10 @@ int main()
 		CHECK(publisher.WriteUntil([] { return g_output_frames > 0 && g_output_audio > 0; }));
 		auto snapshot = CatalogSnapshot(publisher);
 		auto *ctx = static_cast<moq_source *>(source);
-		std::weak_ptr<Track> video;
-		std::weak_ptr<Track> audio;
 		for (auto &entry : snapshot.video)
 			entry.second.enabled = false;
 		for (auto &entry : snapshot.audio)
 			entry.second.enabled = false;
-		{
-			std::lock_guard<std::mutex> lock(ctx->mutex);
-			const auto &conn = ctx->connection;
-			video = conn->video;
-			audio = conn->audio;
-			moq_source_subscribe_video(ctx, conn, snapshot);
-			moq_source_subscribe_audio(ctx, conn, snapshot);
-			CHECK(conn->video && conn->video == video.lock() && !conn->pending_video);
-			CHECK(conn->audio && conn->audio == audio.lock() && !conn->pending_audio);
-		}
-		const int frames = g_output_frames;
-		CHECK(publisher.WriteUntil([&] { return g_output_frames >= frames + 3; }));
-
-		// A disabled rendition the source does not play is not held.
-		auto &config = snapshot.video.begin()->second;
-		config.coded = moq::Dimensions{(config.coded ? config.coded->width : 0) + 16, 16};
-		snapshot.audio.begin()->second.sample_rate += 1;
 		const int blanks = g_blank_calls;
 		{
 			std::lock_guard<std::mutex> lock(ctx->mutex);
@@ -1353,7 +1322,7 @@ int main()
 		CHECK(g_blank_calls > blanks);
 		destroySource(source);
 	}
-	report("all-disabled section holds the playing rendition");
+	report("an all-disabled section clears the playing rendition");
 
 	// A rendition's stream instance is part of what names it, for the active and the pending
 	// track alike: a sibling publisher restarting behind a stable catalog resubscribes.
diff --git a/dart/moq_ffi/lib/src/moq.dart b/dart/moq_ffi/lib/src/moq.dart
index 0d4c40af414..65f0f46f21a 100644
--- a/dart/moq_ffi/lib/src/moq.dart
+++ b/dart/moq_ffi/lib/src/moq.dart
@@ -23989,7 +23989,7 @@ void _checkApiChecksums() {
     throw UniffiInternalError.panicked("UniFFI API checksum mismatch");
   }
   if (uniffi_moq_ffi_checksum_constructor_moqaudioconsumer_subscribe() !=
-      42847) {
+      37967) {
     throw UniffiInternalError.panicked("UniFFI API checksum mismatch");
   }
   if (uniffi_moq_ffi_checksum_constructor_moqaudioencoder_new() != 52616) {
@@ -24075,7 +24075,7 @@ void _checkApiChecksums() {
     throw UniffiInternalError.panicked("UniFFI API checksum mismatch");
   }
   if (uniffi_moq_ffi_checksum_constructor_moqvideoconsumer_subscribe() !=
-      59752) {
+      7811) {
     throw UniffiInternalError.panicked("UniFFI API checksum mismatch");
   }
   if (uniffi_moq_ffi_checksum_constructor_moqvideoencoder_new() != 22531) {
diff --git a/doc/bin/cli.md b/doc/bin/cli.md
index 74f33f1bb20..8172d1dd97a 100644
--- a/doc/bin/cli.md
+++ b/doc/bin/cli.md
@@ -277,11 +277,7 @@ audio-device dependencies:
 cargo install moq-cli --no-default-features --features "quic,websocket,play,openh264"
 ```
 
-`moq play` skips disabled renditions when it picks one. If no enabled rendition
-matches its name and codec filters, it waits for a later catalog. Disabling the
-current rendition switches to an enabled one of its kind that matches the
-filters; with none, it stays subscribed, so re-enabling it (an unmute) plays at
-once.
+`moq play` skips disabled renditions. If none are enabled, it waits for a later catalog. Disabling the current rendition stops it and selects an enabled replacement.
 
 ## Capture
 
diff --git a/doc/bin/gstreamer.md b/doc/bin/gstreamer.md
index 51011a50dc1..4d89b85551b 100644
--- a/doc/bin/gstreamer.md
+++ b/doc/bin/gstreamer.md
@@ -185,9 +185,4 @@ To decrypt a capture, set `quic-keylog=true` on either element along with
 `SSLKEYLOGFILE`; the variable alone writes nothing, and the flag without it fails
 the start. Existing Unix log files must be private (mode 0600); files accessible to group or others are refused.
 
-`moqsrc` initially selects only enabled renditions. When a selected rendition is
-disabled, it keeps reading on the same pad while no rendition of its kind is
-enabled, so media arriving before the re-enable catalog update still plays. An
-enabled alternative stops the disabled reader but keeps its pad idle without EOS;
-enabling it again resumes on that pad. Removing a rendition drains its track and
-ends its pad.
+`moqsrc` creates source pads only for enabled renditions. Disabling a rendition stops its media and ends its pad with EOS; enabling it again adds a new pad, which starts at the live edge like any added rendition. Removing a rendition drains its track and ends its pad.
diff --git a/doc/bin/obs.md b/doc/bin/obs.md
index b91e8ea8992..d16f18be7cb 100644
--- a/doc/bin/obs.md
+++ b/doc/bin/obs.md
@@ -17,7 +17,7 @@ reconnects keep the same instance. A
 stop/start, or an OBS auto-reconnect after the client gives up, republishes
 the broadcast under a new instance, which viewers see as a new stream.
 
-MoQ Source plays the best enabled audio and video rendition it can decode and place. It follows catalog changes while keeping the current audio and video playing until a replacement produces decoded output. A decoder setup refusal tries the next ranked rendition, including when a supported codec name carries a description the decoder cannot use. A later peer or decode failure leaves the current rendition playing. Disabling every rendition of a media kind keeps the one already playing; removing the media kind from the catalog clears it. It also follows a restarted or replaced publisher, including a sibling broadcast the catalog points at, playing the new one from its first keyframe.
+MoQ Source plays the best enabled audio and video rendition it can decode and place. It follows catalog changes while keeping the current audio and video playing until a replacement produces decoded output. A decoder setup refusal tries the next ranked rendition, including when a supported codec name carries a description the decoder cannot use. A later peer or decode failure leaves the current rendition playing. Disabling or removing every rendition of a media kind clears it. It also follows a restarted or replaced publisher, including a sibling broadcast the catalog points at, playing the new one from its first keyframe.
 
 The source plays Opus, AAC-LC (mono or stereo), and PCM audio. A channel count names its speakers by the WAVE convention: 1, 2, 3 (2.1), 6 (5.1), and 8 (7.1) play on the matching OBS layout, while quad and 5.0 are upmixed to 5.1 and 6.1 to 7.1, which OBS lacks. Other counts are refused.
 
diff --git a/doc/concept/audio-jitter.md b/doc/concept/audio-jitter.md
index 9c44549f6ef..cfd03a5d28c 100644
--- a/doc/concept/audio-jitter.md
+++ b/doc/concept/audio-jitter.md
@@ -103,13 +103,20 @@ observe(arrival, media):
         origin = arrival; interval = 0; peak = delay; return
 
     index = floor((arrival - origin) / RESAMPLE)
+    resumed = ended; ended = false
     if index <= interval:
         peak = max(peak, delay); return
 
     fold(bucket of peak)
-    fold(nothing) for each elapsed empty interval, at most IDLE_MAX
+    if resumed:                         # a declared silence folds nothing
+        origin = arrival; index = 0
+    else:
+        fold(nothing) for each elapsed empty interval, at most IDLE_MAX
     interval = index; peak = delay
 
+end():                                  # a declared end precedes the next observation
+    if not first observation: ended = true
+
 fold(bucket):                           # prior starts at 1
     rest = 1 - FORGET * (1 - prior)     # what the decayed evidence leaves
     fresh = min(FRESH_MAX, rest) if bucket else 0
@@ -474,6 +481,25 @@ keeps decaying at the base rate. Only the weight the prior regained is replaced
 quickly, the same way it is at cold start, since it stands for no evidence at
 all.
 
+### Declared silence
+
+A publisher that stops sending on purpose, such as a muted push-to-talk
+speaker, marks the stop with a declared end. The silence after it says
+nothing about the path, so relaxing toward the prior would only make a
+listener who sat through a long mute come back over-buffered. `end()` tells
+the estimator that a declared end lies between the previous observation and
+the next. The next measured observation then folds the pending interval as
+usual and starts a fresh interval at its own arrival instead of folding the
+intervals in between. If it lands in the pending interval it is merged as
+usual, since there is nothing to skip. Either way the end is spent, so a
+later gap the publisher did not declare still relaxes the estimate. The
+reference history, the histogram, and the prior are untouched, and an end
+before the first observation, or under a fixed target, does nothing.
+
+The receiver calls `end()` before observing the first frame from a group later
+than the declared end's own: the stopped encoder's final packets may follow the
+marker in its group, and they belong to the speech before the silence, not after it.
+
 ## Fixed targets
 
 An explicit delay **fixes the target and disables adaptation**. It is taken
@@ -552,7 +578,8 @@ directly, so neither is graded against the other.
 `arrival` and `media` are parallel arrays in **delivery order**, the order the
 receiver observes them, so `media` is deliberately out of order in the
 `reorder` and `backlog` cases. `advertised` and `delay` are present only where the case uses
-them. `target` lists `[frame index, target]` at every frame where the target
+them, as is `ends`: the indices, ascending, of the frames observed right after a
+[declared end](#declared-silence), each of which calls `end()` before it is observed. `target` lists `[frame index, target]` at every frame where the target
 differs from the previous frame's, starting at frame 0, so an implementation
 folds the trace one frame at a time and compares its target at each listed
 index. Tolerance is 1e-6 ms, which the `f64` rules above make generous.
@@ -566,6 +593,7 @@ index. Tolerance is 1e-6 ms, which the `f64` rules above make generous.
 | `reorder` | A run delivered after a newer one is measured against the frames before it, so the target covers waiting for it |
 | `backlog` | A backlog delivered newest first behind the live edge is not measured, so its media span never reaches the target |
 | `idle` | A 30 s gap relaxes the histogram toward the prior |
+| `silence` | A declared 60 s silence and a declared pause leave the target where it was, and a later undeclared gap still relaxes it |
 | `tunein` | A stale frame then the live edge 14.5 s later leaves the target near the frame duration. This is the #3517 regression |
 | `spike` | A recurring stall raises the target, and it decays once the stalls stop |
 | `straggler` | One late interval after the prior is spent leaves the target where it was |
diff --git a/doc/concept/audio-jitter/corpus.ts b/doc/concept/audio-jitter/corpus.ts
index 6af6626f491..299328f8170 100644
--- a/doc/concept/audio-jitter/corpus.ts
+++ b/doc/concept/audio-jitter/corpus.ts
@@ -24,6 +24,8 @@ export interface Case {
 	arrival: number[];
 	/** Each frame's container timestamp in milliseconds, in the same order. */
 	media: number[];
+	/** Indices of the frames observed right after a declared end, in ascending order. */
+	ends?: number[];
 	/** `[frame index, target]` wherever the target differs from the previous frame's. */
 	target: [number, number][];
 }
@@ -87,14 +89,19 @@ function paced(frames: number, frame: number, base: number): Trace {
 }
 
 /** Replay a trace through the reference and keep only the frames where the target moved. */
-function run(trace: Trace, config: { frame: number; advertised?: number; delay?: number }): [number, number][] {
+function run(
+	trace: Trace & { ends?: number[] },
+	config: { frame: number; advertised?: number; delay?: number },
+): [number, number][] {
 	if (config.delay !== undefined) return [[0, config.delay]];
 
 	const estimator = new Estimator({ frame: config.frame, advertised: config.advertised });
 	const target: [number, number][] = [];
 	let previous: number | undefined;
 
+	const ends = new Set(trace.ends);
 	for (let i = 0; i < trace.arrival.length; i++) {
+		if (ends.has(i)) estimator.end();
 		estimator.observe({ arrival: trace.arrival[i], media: trace.media[i] });
 		const value = estimator.target;
 		if (value !== previous) target.push([i, value]);
@@ -171,6 +178,13 @@ const traces: Omit<Case, "target">[] = [
 		frame: FRAME,
 		...gap(paced(1000, FRAME, 50), 500, 30_000),
 	},
+	{
+		name: "silence",
+		about: "Even audio, a declared end and 60 s of silence, 5 s more, a declared 100 ms pause inside one interval, 5 s more, then an undeclared 30 s gap. Unlike `idle`, a declared silence is not evidence, so the target holds through both; the undeclared gap still relaxes it, since an end covers only the silence it declares.",
+		frame: FRAME,
+		...gap(gap(gap(paced(1500, FRAME, 50), 500, 60_000), 760, 100), 1000, 30_000),
+		ends: [500, 760],
+	},
 	{
 		name: "tunein",
 		about: "One frame from a stale group, then the live edge 14.5 s later, then 30 s of even audio. The #3517 branch reported 14.56 s here; the target must stay near the frame duration.",
diff --git a/doc/concept/audio-jitter/reference.ts b/doc/concept/audio-jitter/reference.ts
index f2d92ee387f..ecd7a2fd3aa 100644
--- a/doc/concept/audio-jitter/reference.ts
+++ b/doc/concept/audio-jitter/reference.ts
@@ -73,6 +73,8 @@ export class Estimator {
 	#interval = 0;
 	/** The largest delay seen in that interval. */
 	#peak = 0;
+	/** A declared end precedes the next measured observation, so the silence before it is not idle. */
+	#ended = false;
 
 	#histogram = prior();
 	/** How much of the histogram is still the prior's rather than evidence. */
@@ -119,6 +121,8 @@ export class Estimator {
 		}
 
 		const interval = Math.floor((arrival - this.#origin) / RESAMPLE);
+		const resumed = this.#ended;
+		this.#ended = false;
 		if (interval <= this.#interval) {
 			this.#peak = Math.max(this.#peak, delay);
 			return;
@@ -126,15 +130,27 @@ export class Estimator {
 
 		this.#fold(Math.min(BUCKETS - 1, Math.floor(this.#peak / BUCKET)));
 
-		const idle = Math.min(interval - this.#interval - 1, IDLE_MAX);
-		for (let i = 0; i < idle; i++) {
-			this.#fold(undefined);
+		if (resumed) {
+			// The publisher declared the silence, so it is not evidence of anything: the
+			// estimate keeps what it had and a fresh interval starts at this arrival.
+			this.#origin = arrival;
+			this.#interval = 0;
+		} else {
+			const idle = Math.min(interval - this.#interval - 1, IDLE_MAX);
+			for (let i = 0; i < idle; i++) {
+				this.#fold(undefined);
+			}
+			this.#interval = interval;
 		}
-
-		this.#interval = interval;
 		this.#peak = delay;
 	}
 
+	/** A declared end lies between the previous observation and the next. */
+	end(): void {
+		// Before any observation there is no interval for the silence to stretch.
+		if (this.#origin !== undefined) this.#ended = true;
+	}
+
 	/** The target the receiver holds, in milliseconds. */
 	get target(): number {
 		let cumulative = 0;
diff --git a/doc/concept/audio-jitter/silence.json b/doc/concept/audio-jitter/silence.json
new file mode 100644
index 00000000000..60df4c38167
--- /dev/null
+++ b/doc/concept/audio-jitter/silence.json
@@ -0,0 +1 @@
+{"name":"silence","about":"Even audio, a declared end and 60 s of silence, 5 s more, a declared 100 ms pause inside one interval, 5 s more, then an undeclared 30 s gap. Unlike `idle`, a declared silence is not evidence, so the target holds through both; the undeclared gap still relaxes it, since an end covers only the silence it declares.","frame":20,"arrival":[50,70,90,110,130,150,170,190,210,230,250,270,290,310,330,350,370,390,410,430,450,470,490,510,530,550,570,590,610,630,650,670,690,710,730,750,770,790,810,830,850,870,890,910,930,950,970,990,1010,1030,1050,1070,1090,1110,1130,1150,1170,1190,1210,1230,1250,1270,1290,1310,1330,1350,1370,1390,1410,1430,1450,1470,1490,1510,1530,1550,1570,1590,1610,1630,1650,1670,1690,1710,1730,1750,1770,1790,1810,1830,1850,1870,1890,1910,1930,1950,1970,1990,2010,2030,2050,2070,2090,2110,2130,2150,2170,2190,2210,2230,2250,2270,2290,2310,2330,2350,2370,2390,2410,2430,2450,2470,2490,2510,2530,2550,2570,2590,2610,2630,2650,2670,2690,2710,2730,2750,2770,2790,2810,2830,2850,2870,2890,2910,2930,2950,2970,2990,3010,3030,3050,3070,3090,3110,3130,3150,3170,3190,3210,3230,3250,3270,3290,3310,3330,3350,3370,3390,3410,3430,3450,3470,3490,3510,3530,3550,3570,3590,3610,3630,3650,3670,3690,3710,3730,3750,3770,3790,3810,3830,3850,3870,3890,3910,3930,3950,3970,3990,4010,4030,4050,4070,4090,4110,4130,4150,4170,4190,4210,4230,4250,4270,4290,4310,4330,4350,4370,4390,4410,4430,4450,4470,4490,4510,4530,4550,4570,4590,4610,4630,4650,4670,4690,4710,4730,4750,4770,4790,4810,4830,4850,4870,4890,4910,4930,4950,4970,4990,5010,5030,5050,5070,5090,5110,5130,5150,5170,5190,5210,5230,5250,5270,5290,5310,5330,5350,5370,5390,5410,5430,5450,5470,5490,5510,5530,5550,5570,5590,5610,5630,5650,5670,5690,5710,5730,5750,5770,5790,5810,5830,5850,5870,5890,5910,5930,5950,5970,5990,6010,6030,6050,6070,6090,6110,6130,6150,6170,6190,6210,6230,6250,6270,6290,6310,6330,6350,6370,6390,6410,6430,6450,6470,6490,6510,6530,6550,6570,6590,6610,6630,6650,6670,6690,6710,6730,6750,6770,6790,6810,6830,6850,6870,6890,6910,6930,6950,6970,6990,7010,7030,7050,7070,7090,7110,7130,7150,7170,7190,7210,7230,7250,7270,7290,7310,7330,7350,7370,7390,7410,7430,7450,7470,7490,7510,7530,7550,7570,7590,7610,7630,7650,7670,7690,7710,7730,7750,7770,7790,7810,7830,7850,7870,7890,7910,7930,7950,7970,7990,8010,8030,8050,8070,8090,8110,8130,8150,8170,8190,8210,8230,8250,8270,8290,8310,8330,8350,8370,8390,8410,8430,8450,8470,8490,8510,8530,8550,8570,8590,8610,8630,8650,8670,8690,8710,8730,8750,8770,8790,8810,8830,8850,8870,8890,8910,8930,8950,8970,8990,9010,9030,9050,9070,9090,9110,9130,9150,9170,9190,9210,9230,9250,9270,9290,9310,9330,9350,9370,9390,9410,9430,9450,9470,9490,9510,9530,9550,9570,9590,9610,9630,9650,9670,9690,9710,9730,9750,9770,9790,9810,9830,9850,9870,9890,9910,9930,9950,9970,9990,10010,10030,70050,70070,70090,70110,70130,70150,70170,70190,70210,70230,70250,70270,70290,70310,70330,70350,70370,70390,70410,70430,70450,70470,70490,70510,70530,70550,70570,70590,70610,70630,70650,70670,70690,70710,70730,70750,70770,70790,70810,70830,70850,70870,70890,70910,70930,70950,70970,70990,71010,71030,71050,71070,71090,71110,71130,71150,71170,71190,71210,71230,71250,71270,71290,71310,71330,71350,71370,71390,71410,71430,71450,71470,71490,71510,71530,71550,71570,71590,71610,71630,71650,71670,71690,71710,71730,71750,71770,71790,71810,71830,71850,71870,71890,71910,71930,71950,71970,71990,72010,72030,72050,72070,72090,72110,72130,72150,72170,72190,72210,72230,72250,72270,72290,72310,72330,72350,72370,72390,72410,72430,72450,72470,72490,72510,72530,72550,72570,72590,72610,72630,72650,72670,72690,72710,72730,72750,72770,72790,72810,72830,72850,72870,72890,72910,72930,72950,72970,72990,73010,73030,73050,73070,73090,73110,73130,73150,73170,73190,73210,73230,73250,73270,73290,73310,73330,73350,73370,73390,73410,73430,73450,73470,73490,73510,73530,73550,73570,73590,73610,73630,73650,73670,73690,73710,73730,73750,73770,73790,73810,73830,73850,73870,73890,73910,73930,73950,73970,73990,74010,74030,74050,74070,74090,74110,74130,74150,74170,74190,74210,74230,74250,74270,74290,74310,74330,74350,74370,74390,74410,74430,74450,74470,74490,74510,74530,74550,74570,74590,74610,74630,74650,74670,74690,74710,74730,74750,74770,74790,74810,74830,74850,74870,74890,74910,74930,74950,74970,74990,75010,75030,75050,75070,75090,75110,75130,75150,75170,75190,75210,75230,75350,75370,75390,75410,75430,75450,75470,75490,75510,75530,75550,75570,75590,75610,75630,75650,75670,75690,75710,75730,75750,75770,75790,75810,75830,75850,75870,75890,75910,75930,75950,75970,75990,76010,76030,76050,76070,76090,76110,76130,76150,76170,76190,76210,76230,76250,76270,76290,76310,76330,76350,76370,76390,76410,76430,76450,76470,76490,76510,76530,76550,76570,76590,76610,76630,76650,76670,76690,76710,76730,76750,76770,76790,76810,76830,76850,76870,76890,76910,76930,76950,76970,76990,77010,77030,77050,77070,77090,77110,77130,77150,77170,77190,77210,77230,77250,77270,77290,77310,77330,77350,77370,77390,77410,77430,77450,77470,77490,77510,77530,77550,77570,77590,77610,77630,77650,77670,77690,77710,77730,77750,77770,77790,77810,77830,77850,77870,77890,77910,77930,77950,77970,77990,78010,78030,78050,78070,78090,78110,78130,78150,78170,78190,78210,78230,78250,78270,78290,78310,78330,78350,78370,78390,78410,78430,78450,78470,78490,78510,78530,78550,78570,78590,78610,78630,78650,78670,78690,78710,78730,78750,78770,78790,78810,78830,78850,78870,78890,78910,78930,78950,78970,78990,79010,79030,79050,79070,79090,79110,79130,79150,79170,79190,79210,79230,79250,79270,79290,79310,79330,79350,79370,79390,79410,79430,79450,79470,79490,79510,79530,79550,79570,79590,79610,79630,79650,79670,79690,79710,79730,79750,79770,79790,79810,79830,79850,79870,79890,79910,79930,79950,79970,79990,80010,80030,80050,80070,80090,80110,80130,110150,110170,110190,110210,110230,110250,110270,110290,110310,110330,110350,110370,110390,110410,110430,110450,110470,110490,110510,110530,110550,110570,110590,110610,110630,110650,110670,110690,110710,110730,110750,110770,110790,110810,110830,110850,110870,110890,110910,110930,110950,110970,110990,111010,111030,111050,111070,111090,111110,111130,111150,111170,111190,111210,111230,111250,111270,111290,111310,111330,111350,111370,111390,111410,111430,111450,111470,111490,111510,111530,111550,111570,111590,111610,111630,111650,111670,111690,111710,111730,111750,111770,111790,111810,111830,111850,111870,111890,111910,111930,111950,111970,111990,112010,112030,112050,112070,112090,112110,112130,112150,112170,112190,112210,112230,112250,112270,112290,112310,112330,112350,112370,112390,112410,112430,112450,112470,112490,112510,112530,112550,112570,112590,112610,112630,112650,112670,112690,112710,112730,112750,112770,112790,112810,112830,112850,112870,112890,112910,112930,112950,112970,112990,113010,113030,113050,113070,113090,113110,113130,113150,113170,113190,113210,113230,113250,113270,113290,113310,113330,113350,113370,113390,113410,113430,113450,113470,113490,113510,113530,113550,113570,113590,113610,113630,113650,113670,113690,113710,113730,113750,113770,113790,113810,113830,113850,113870,113890,113910,113930,113950,113970,113990,114010,114030,114050,114070,114090,114110,114130,114150,114170,114190,114210,114230,114250,114270,114290,114310,114330,114350,114370,114390,114410,114430,114450,114470,114490,114510,114530,114550,114570,114590,114610,114630,114650,114670,114690,114710,114730,114750,114770,114790,114810,114830,114850,114870,114890,114910,114930,114950,114970,114990,115010,115030,115050,115070,115090,115110,115130,115150,115170,115190,115210,115230,115250,115270,115290,115310,115330,115350,115370,115390,115410,115430,115450,115470,115490,115510,115530,115550,115570,115590,115610,115630,115650,115670,115690,115710,115730,115750,115770,115790,115810,115830,115850,115870,115890,115910,115930,115950,115970,115990,116010,116030,116050,116070,116090,116110,116130,116150,116170,116190,116210,116230,116250,116270,116290,116310,116330,116350,116370,116390,116410,116430,116450,116470,116490,116510,116530,116550,116570,116590,116610,116630,116650,116670,116690,116710,116730,116750,116770,116790,116810,116830,116850,116870,116890,116910,116930,116950,116970,116990,117010,117030,117050,117070,117090,117110,117130,117150,117170,117190,117210,117230,117250,117270,117290,117310,117330,117350,117370,117390,117410,117430,117450,117470,117490,117510,117530,117550,117570,117590,117610,117630,117650,117670,117690,117710,117730,117750,117770,117790,117810,117830,117850,117870,117890,117910,117930,117950,117970,117990,118010,118030,118050,118070,118090,118110,118130,118150,118170,118190,118210,118230,118250,118270,118290,118310,118330,118350,118370,118390,118410,118430,118450,118470,118490,118510,118530,118550,118570,118590,118610,118630,118650,118670,118690,118710,118730,118750,118770,118790,118810,118830,118850,118870,118890,118910,118930,118950,118970,118990,119010,119030,119050,119070,119090,119110,119130,119150,119170,119190,119210,119230,119250,119270,119290,119310,119330,119350,119370,119390,119410,119430,119450,119470,119490,119510,119530,119550,119570,119590,119610,119630,119650,119670,119690,119710,119730,119750,119770,119790,119810,119830,119850,119870,119890,119910,119930,119950,119970,119990,120010,120030,120050,120070,120090,120110,120130],"media":[0,20,40,60,80,100,120,140,160,180,200,220,240,260,280,300,320,340,360,380,400,420,440,460,480,500,520,540,560,580,600,620,640,660,680,700,720,740,760,780,800,820,840,860,880,900,920,940,960,980,1000,1020,1040,1060,1080,1100,1120,1140,1160,1180,1200,1220,1240,1260,1280,1300,1320,1340,1360,1380,1400,1420,1440,1460,1480,1500,1520,1540,1560,1580,1600,1620,1640,1660,1680,1700,1720,1740,1760,1780,1800,1820,1840,1860,1880,1900,1920,1940,1960,1980,2000,2020,2040,2060,2080,2100,2120,2140,2160,2180,2200,2220,2240,2260,2280,2300,2320,2340,2360,2380,2400,2420,2440,2460,2480,2500,2520,2540,2560,2580,2600,2620,2640,2660,2680,2700,2720,2740,2760,2780,2800,2820,2840,2860,2880,2900,2920,2940,2960,2980,3000,3020,3040,3060,3080,3100,3120,3140,3160,3180,3200,3220,3240,3260,3280,3300,3320,3340,3360,3380,3400,3420,3440,3460,3480,3500,3520,3540,3560,3580,3600,3620,3640,3660,3680,3700,3720,3740,3760,3780,3800,3820,3840,3860,3880,3900,3920,3940,3960,3980,4000,4020,4040,4060,4080,4100,4120,4140,4160,4180,4200,4220,4240,4260,4280,4300,4320,4340,4360,4380,4400,4420,4440,4460,4480,4500,4520,4540,4560,4580,4600,4620,4640,4660,4680,4700,4720,4740,4760,4780,4800,4820,4840,4860,4880,4900,4920,4940,4960,4980,5000,5020,5040,5060,5080,5100,5120,5140,5160,5180,5200,5220,5240,5260,5280,5300,5320,5340,5360,5380,5400,5420,5440,5460,5480,5500,5520,5540,5560,5580,5600,5620,5640,5660,5680,5700,5720,5740,5760,5780,5800,5820,5840,5860,5880,5900,5920,5940,5960,5980,6000,6020,6040,6060,6080,6100,6120,6140,6160,6180,6200,6220,6240,6260,6280,6300,6320,6340,6360,6380,6400,6420,6440,6460,6480,6500,6520,6540,6560,6580,6600,6620,6640,6660,6680,6700,6720,6740,6760,6780,6800,6820,6840,6860,6880,6900,6920,6940,6960,6980,7000,7020,7040,7060,7080,7100,7120,7140,7160,7180,7200,7220,7240,7260,7280,7300,7320,7340,7360,7380,7400,7420,7440,7460,7480,7500,7520,7540,7560,7580,7600,7620,7640,7660,7680,7700,7720,7740,7760,7780,7800,7820,7840,7860,7880,7900,7920,7940,7960,7980,8000,8020,8040,8060,8080,8100,8120,8140,8160,8180,8200,8220,8240,8260,8280,8300,8320,8340,8360,8380,8400,8420,8440,8460,8480,8500,8520,8540,8560,8580,8600,8620,8640,8660,8680,8700,8720,8740,8760,8780,8800,8820,8840,8860,8880,8900,8920,8940,8960,8980,9000,9020,9040,9060,9080,9100,9120,9140,9160,9180,9200,9220,9240,9260,9280,9300,9320,9340,9360,9380,9400,9420,9440,9460,9480,9500,9520,9540,9560,9580,9600,9620,9640,9660,9680,9700,9720,9740,9760,9780,9800,9820,9840,9860,9880,9900,9920,9940,9960,9980,70000,70020,70040,70060,70080,70100,70120,70140,70160,70180,70200,70220,70240,70260,70280,70300,70320,70340,70360,70380,70400,70420,70440,70460,70480,70500,70520,70540,70560,70580,70600,70620,70640,70660,70680,70700,70720,70740,70760,70780,70800,70820,70840,70860,70880,70900,70920,70940,70960,70980,71000,71020,71040,71060,71080,71100,71120,71140,71160,71180,71200,71220,71240,71260,71280,71300,71320,71340,71360,71380,71400,71420,71440,71460,71480,71500,71520,71540,71560,71580,71600,71620,71640,71660,71680,71700,71720,71740,71760,71780,71800,71820,71840,71860,71880,71900,71920,71940,71960,71980,72000,72020,72040,72060,72080,72100,72120,72140,72160,72180,72200,72220,72240,72260,72280,72300,72320,72340,72360,72380,72400,72420,72440,72460,72480,72500,72520,72540,72560,72580,72600,72620,72640,72660,72680,72700,72720,72740,72760,72780,72800,72820,72840,72860,72880,72900,72920,72940,72960,72980,73000,73020,73040,73060,73080,73100,73120,73140,73160,73180,73200,73220,73240,73260,73280,73300,73320,73340,73360,73380,73400,73420,73440,73460,73480,73500,73520,73540,73560,73580,73600,73620,73640,73660,73680,73700,73720,73740,73760,73780,73800,73820,73840,73860,73880,73900,73920,73940,73960,73980,74000,74020,74040,74060,74080,74100,74120,74140,74160,74180,74200,74220,74240,74260,74280,74300,74320,74340,74360,74380,74400,74420,74440,74460,74480,74500,74520,74540,74560,74580,74600,74620,74640,74660,74680,74700,74720,74740,74760,74780,74800,74820,74840,74860,74880,74900,74920,74940,74960,74980,75000,75020,75040,75060,75080,75100,75120,75140,75160,75180,75300,75320,75340,75360,75380,75400,75420,75440,75460,75480,75500,75520,75540,75560,75580,75600,75620,75640,75660,75680,75700,75720,75740,75760,75780,75800,75820,75840,75860,75880,75900,75920,75940,75960,75980,76000,76020,76040,76060,76080,76100,76120,76140,76160,76180,76200,76220,76240,76260,76280,76300,76320,76340,76360,76380,76400,76420,76440,76460,76480,76500,76520,76540,76560,76580,76600,76620,76640,76660,76680,76700,76720,76740,76760,76780,76800,76820,76840,76860,76880,76900,76920,76940,76960,76980,77000,77020,77040,77060,77080,77100,77120,77140,77160,77180,77200,77220,77240,77260,77280,77300,77320,77340,77360,77380,77400,77420,77440,77460,77480,77500,77520,77540,77560,77580,77600,77620,77640,77660,77680,77700,77720,77740,77760,77780,77800,77820,77840,77860,77880,77900,77920,77940,77960,77980,78000,78020,78040,78060,78080,78100,78120,78140,78160,78180,78200,78220,78240,78260,78280,78300,78320,78340,78360,78380,78400,78420,78440,78460,78480,78500,78520,78540,78560,78580,78600,78620,78640,78660,78680,78700,78720,78740,78760,78780,78800,78820,78840,78860,78880,78900,78920,78940,78960,78980,79000,79020,79040,79060,79080,79100,79120,79140,79160,79180,79200,79220,79240,79260,79280,79300,79320,79340,79360,79380,79400,79420,79440,79460,79480,79500,79520,79540,79560,79580,79600,79620,79640,79660,79680,79700,79720,79740,79760,79780,79800,79820,79840,79860,79880,79900,79920,79940,79960,79980,80000,80020,80040,80060,80080,110100,110120,110140,110160,110180,110200,110220,110240,110260,110280,110300,110320,110340,110360,110380,110400,110420,110440,110460,110480,110500,110520,110540,110560,110580,110600,110620,110640,110660,110680,110700,110720,110740,110760,110780,110800,110820,110840,110860,110880,110900,110920,110940,110960,110980,111000,111020,111040,111060,111080,111100,111120,111140,111160,111180,111200,111220,111240,111260,111280,111300,111320,111340,111360,111380,111400,111420,111440,111460,111480,111500,111520,111540,111560,111580,111600,111620,111640,111660,111680,111700,111720,111740,111760,111780,111800,111820,111840,111860,111880,111900,111920,111940,111960,111980,112000,112020,112040,112060,112080,112100,112120,112140,112160,112180,112200,112220,112240,112260,112280,112300,112320,112340,112360,112380,112400,112420,112440,112460,112480,112500,112520,112540,112560,112580,112600,112620,112640,112660,112680,112700,112720,112740,112760,112780,112800,112820,112840,112860,112880,112900,112920,112940,112960,112980,113000,113020,113040,113060,113080,113100,113120,113140,113160,113180,113200,113220,113240,113260,113280,113300,113320,113340,113360,113380,113400,113420,113440,113460,113480,113500,113520,113540,113560,113580,113600,113620,113640,113660,113680,113700,113720,113740,113760,113780,113800,113820,113840,113860,113880,113900,113920,113940,113960,113980,114000,114020,114040,114060,114080,114100,114120,114140,114160,114180,114200,114220,114240,114260,114280,114300,114320,114340,114360,114380,114400,114420,114440,114460,114480,114500,114520,114540,114560,114580,114600,114620,114640,114660,114680,114700,114720,114740,114760,114780,114800,114820,114840,114860,114880,114900,114920,114940,114960,114980,115000,115020,115040,115060,115080,115100,115120,115140,115160,115180,115200,115220,115240,115260,115280,115300,115320,115340,115360,115380,115400,115420,115440,115460,115480,115500,115520,115540,115560,115580,115600,115620,115640,115660,115680,115700,115720,115740,115760,115780,115800,115820,115840,115860,115880,115900,115920,115940,115960,115980,116000,116020,116040,116060,116080,116100,116120,116140,116160,116180,116200,116220,116240,116260,116280,116300,116320,116340,116360,116380,116400,116420,116440,116460,116480,116500,116520,116540,116560,116580,116600,116620,116640,116660,116680,116700,116720,116740,116760,116780,116800,116820,116840,116860,116880,116900,116920,116940,116960,116980,117000,117020,117040,117060,117080,117100,117120,117140,117160,117180,117200,117220,117240,117260,117280,117300,117320,117340,117360,117380,117400,117420,117440,117460,117480,117500,117520,117540,117560,117580,117600,117620,117640,117660,117680,117700,117720,117740,117760,117780,117800,117820,117840,117860,117880,117900,117920,117940,117960,117980,118000,118020,118040,118060,118080,118100,118120,118140,118160,118180,118200,118220,118240,118260,118280,118300,118320,118340,118360,118380,118400,118420,118440,118460,118480,118500,118520,118540,118560,118580,118600,118620,118640,118660,118680,118700,118720,118740,118760,118780,118800,118820,118840,118860,118880,118900,118920,118940,118960,118980,119000,119020,119040,119060,119080,119100,119120,119140,119160,119180,119200,119220,119240,119260,119280,119300,119320,119340,119360,119380,119400,119420,119440,119460,119480,119500,119520,119540,119560,119580,119600,119620,119640,119660,119680,119700,119720,119740,119760,119780,119800,119820,119840,119860,119880,119900,119920,119940,119960,119980,120000,120020,120040,120060,120080],"ends":[500,760],"target":[[0,120],[75,100],[175,80],[225,60],[250,40],[1000,100],[1070,80],[1120,60],[1145,40]]}
diff --git a/doc/concept/hang.md b/doc/concept/hang.md
index c8ec33f8394..2962d673e7a 100644
--- a/doc/concept/hang.md
+++ b/doc/concept/hang.md
@@ -70,7 +70,7 @@ A few things the catalog can express beyond decoder config:
 - **Reorder depth.** A video rendition may declare `reorder`, the most frames that can precede one in decode order and follow it in presentation, as H.264 `max_num_reorder_frames` counts them; `0` declares none, which is not the same as absent. The Rust H.264 and H.265 importers copy it from the SPS when the SPS declares one (progressive H.264 only), and `@moq/publish` declares `0`. The MPEG-TS, Matroska, and FLV exporters then derive each group's decode times from that group's frames alone, so exports that joined at different groups agree, and they end the export on a frame reordered deeper than declared or a depth the codec level cannot reach. Without it they infer decode times from the timestamps they have read, as before. A publisher never changes it once declared.
 - **Colour.** A video rendition may carry `color`: the H.273 primaries, transfer, matrix, and range, plus the HDR10 mastering display and content light levels, so a renderer can set up HDR without parsing the bitstream. The Rust importers fill it from the SPS VUI, AV1 sequence header, and VP9 header, then fill gaps from a container's `colr` box or Matroska `Colour` element; the stream wins a disagreement. The HDR10 values come from H.264 and H.265 SEI or AV1 metadata OBUs in MPEG-TS and raw elementary streams, an AV1 track's av1C, or Matroska, but not yet from H.264 or H.265 in fMP4 or FLV. Nothing in `@moq/watch` reads it yet.
 - **Spatial media.** A video rendition may carry `projection` (flat `rectilinear`, or `equirectangular` with the degrees of longitude it spans, 180 for VR180) and `stereo` (`mono`, `left-right`, or `top-bottom` frame packing), and an audio rendition may carry `layout: "ambisonic"` for AmbiX channels. Readers treat a value they don't recognize as absent. Nothing in `@moq/watch` renders them yet.
-- **Disabled renditions.** An audio or video rendition with `enabled: false` has no new frames coming, and a player should not select it. A subscriber may still get audio retained from before the disable, as when it subscribed a moment earlier. A player may keep a disabled rendition selected, and subscribed, while no enabled alternative exists, so a re-enable plays without a resubscribe; `@moq/watch` does. Pausing a rendition in `@moq/publish` keeps it in the catalog this way rather than removing it, so a mute is a one-field update; a disabled video rendition encodes one black keyframe first, so a player that predates the field shows black instead of a frozen picture. The field is written only when false. The older video `stalled` field is no longer written, and readers ignore it.
+- **Disabled renditions.** An audio or video rendition with `enabled: false` has no new frames coming, and a player must not select it. A subscriber may still get audio retained from before the disable, as when it subscribed a moment earlier. Disabling a rendition in `@moq/publish`, as hiding video does, keeps it in the catalog this way rather than removing it, so it is a one-field update; a disabled video rendition encodes one black keyframe first, so a player that predates the field shows black instead of a frozen picture. The field is written only when false. The older video `stalled` field is no longer written, and readers ignore it. A muted `@moq/publish` microphone is not disabled: it stays enabled and sends nothing, ending each utterance with a discontinuity marker, so listeners stay subscribed and play the gap as intentional silence.
 - **Preference.** A video rendition may carry a signed `preference`, default `0`. A player keeps only the highest preference it can decode, then picks by size and bitrate within it, as do the single-rendition egresses (RTMP play, WHEP, FLV, the transcoder's source). A publisher that adds its own H.264 copy of an H.265 source marks the copy `-1`, so only a viewer that can't decode H.265 pulls it. Picking a rendition by name still overrides it. The field is written only when nonzero.
 - **Join interval.** The root `media.join.interval` promises that every audio and video track starts a group at least that often: the longest GOP any of them publishes. It is fixed for the broadcast, and the [HLS gateway](/bin/hls) numbers every rendition's segments on the grid it fixes, segments the smallest whole multiple of it at least a second long, from each group's first timestamp, so renditions share segment numbers. A publisher that knows its GOP declares it; Rust publishers (`moq-mux` and everything built on it) without one measure each track over its first second or group, whichever is longer, and `@moq/publish` declares its keyframe interval. A broadcast without it gets no HLS playlists.
 - **Clock.** The optional `media.clock` maps PTS zero to wall time so every media track shares one fixed epoch after timescale conversion. Publish independent sources as sibling broadcasts under one prefix, such as `robot/front.hang` and `robot/rear.hang`; each broadcast's audio and video entries are renditions of that source. In one Rust publisher, pass the same `moq_mux::Clock` to each `catalog::Config::with_clock`; JS publishers on one page already share the page clock. Consumers discover the siblings by prefix and align their timestamps through the advertised wall mapping; `@moq/watch` plays one broadcast at a time.
diff --git a/doc/lib/c/index.md b/doc/lib/c/index.md
index ee0d58cddfc..10ee8b867f6 100644
--- a/doc/lib/c/index.md
+++ b/doc/lib/c/index.md
@@ -119,7 +119,7 @@ inside. The header is the reference: each function carries a doc comment.
 - **Stats.** `moq_session_stats()` fills `moq_connection_stats` with `rtt_us`, `estimated_send_rate_bps`, and the byte and packet counters (`bytes_sent`, `bytes_received`, `bytes_lost`, `packets_sent`, `packets_received`, `packets_lost`). Each has a `<field>_valid` flag, false when the transport does not report it, which is not the same as zero. `moq_session_snapshot()` adds the negotiated `protocol`. A failed dial or dropped connection reaches the session's `on_state` with its `failure` code, and `moq_error()` gives the reason during that callback. Hold the handle returned by `moq_session_recv_bandwidth()` to request receive estimates. `moq_bandwidth_consumer_peek()` reads the estimate and `moq_bandwidth_consumer_changed()` waits for a change. `moq_bandwidth_consumer_close()` releases demand; the last consumer stops PROBE. Stats snapshots do not request it.
 - **Viewers.** `moq_session_viewers()` returns a handle that divides the receive estimate among the broadcasts you watch, max-min fair by each one's ceiling. `moq_viewers_watch()` returns a viewer claiming up to `max_bps`, the bitrate of the largest rendition you would switch to; `moq_viewer_rate()` reads its share in bits per second, with `present` false while there is no estimate (keep the current rendition), and `moq_viewer_update()` changes the ceiling. Holding a viewer requests the estimate like a `moq_session_recv_bandwidth()` consumer, and `moq_viewer_close()` releases the claim. The session sends the summed ceilings as its PROBE target; `moq_viewers_set_target()` with `present` true overrides that, a `0` target sends none, and `present` false follows the viewers again. `moq_viewers_watch()`, `moq_viewer_update()`, and `moq_viewers_set_target()` return `MOQ_ERROR_OUT_OF_RANGE`, changing nothing, when the ceilings or the target would pass 2^53 - 1 bps, the most a PROBE target carries. `moq_viewers_close()` releases the registry handle; viewers watched through it stay until each is closed.
 - **Demand.** A watcher from `moq_publish_track_demand()` (or the media, video, and audio variants) calls back `MOQ_DEMAND_WANTED` or `MOQ_DEMAND_UNWANTED`, again whenever the wanted group moves. `moq_publish_demand_wanted()` reads that group: start a new one once it passes your largest. Set `refresh` in `moq_track_info` to have a joining subscriber ask for a new group once the newest has grown past `refresh` times its first frame. A producer publishes everything you write, subscribed or not, so a late subscriber can fetch the recent past. Capturing only while the watcher reports `MOQ_DEMAND_WANTED` is an opt-in that saves the encode but leaves nothing from before the first subscriber.
-- **Disabled renditions.** A rendition with `enabled: false` has no frames coming until its publisher re-enables it. Query the latest catalog with `moq_consume_audio_enabled` or `moq_consume_video_enabled` before selecting a rendition and opening a decoder. Keep one already playing while every rendition of its kind is disabled: the convenience decoders accept a disabled configuration, and a re-enable, such as an unmute, then plays without a resubscribe. Among the video renditions you can decode, prefer the highest `preference`; `0` is the default and `-1` marks a compatibility transcode.
+- **Disabled renditions.** Audio and video consumers and decoders reject a rendition with `enabled: false`. Query the latest catalog with `moq_consume_audio_enabled` or `moq_consume_video_enabled` before selecting a rendition and opening a decoder. Among the video renditions you can decode, prefer the highest `preference`; `0` is the default and `-1` marks a compatibility transcode.
 
 ## Reference
 
diff --git a/doc/lib/cpp/index.md b/doc/lib/cpp/index.md
index 56f5d8c7fe3..62b42ad3d5e 100644
--- a/doc/lib/cpp/index.md
+++ b/doc/lib/cpp/index.md
@@ -208,7 +208,7 @@ future completed, which is the executor thread.
 
 ## Disabled renditions
 
-A rendition with `enabled: false` has no frames coming until its publisher re-enables it. Select an enabled rendition from the latest catalog before opening a decoder. Keep one already playing while every rendition of its kind is disabled: the convenience decoders accept a disabled configuration, and a re-enable, such as an unmute, then plays without a resubscribe. Among the video renditions you can decode, prefer the highest `preference`; `0` is the default and `-1` marks a compatibility transcode. Audio and video subscribe setup returns `moq::Error::kUnsupportedConfig` when the decoder refuses the codec, layout, or description; a player can then try its next ranked rendition. Decoder faults and later peer or decode failures do not report that setup refusal.
+Audio and video convenience decoders reject a catalog configuration with `enabled: false`. Select an enabled rendition from the latest catalog before opening a decoder. Among the video renditions you can decode, prefer the highest `preference`; `0` is the default and `-1` marks a compatibility transcode. Audio and video subscribe setup returns `moq::Error::kUnsupportedConfig` when the decoder refuses the codec, layout, or description; a player can then try its next ranked rendition. Decoder faults and later peer or decode failures do not report that setup refusal.
 
 ## Bandwidth estimates
 
diff --git a/doc/lib/dart/index.md b/doc/lib/dart/index.md
index 23552e5633c..c5df8857bf0 100644
--- a/doc/lib/dart/index.md
+++ b/doc/lib/dart/index.md
@@ -159,7 +159,7 @@ shows which module holds each.
 - **Authorization.** On `moq-lite-07-wip` (opt in with `ConnectOptions(versions: ...)`) and on moq-transport draft-18+ with the [MoQ Auth extension](/draft/moq-auth), listen to `moq.grants().updates()` for the `Grant` the relay sent back and each change, `null` until it answers and while a client session reconnects.
 - **Tokens.** Pass `ConnectOptions(tokens: [...])` instead of putting the credential in the URL. The first is the connection credential, sent in SETUP and, while an offered version can't carry it there (lite before 07), as the URL's `?jwt=`; each other token widens the grant over AUTH. `moq.tokens().set_(tokens: [...])` replaces them before they expire: the next dial presents them, a live AUTH session at once, and after an authorization refusal the session redials only if they changed. `await tokens().answered()` returns once the relay accepts them and throws its refusal with the relay's code. A `?jwt=` already in the URL stays the connection credential, which is how to reach a relay older than this release.
 - **Errors.** Read diagnostic payloads from `reason` and structured protocol failures from `details`.
-- **Disabled renditions.** A rendition with `enabled: false` has no frames coming until its publisher re-enables it. Select an enabled rendition from the latest catalog before opening a decoder. Keep one already playing while every rendition of its kind is disabled: the convenience decoders accept a disabled configuration, and a re-enable, such as an unmute, then plays without a resubscribe. Among the video renditions you can decode, prefer the highest `preference`; `0` is the default and `-1` marks a compatibility transcode. Audio and video subscribe setup returns `UnsupportedConfigMoqException` when the decoder refuses the codec, layout, or description; a player can then try its next ranked rendition. Decoder faults and later peer or decode failures do not report that setup refusal.
+- **Disabled renditions.** Audio and video convenience decoders reject a catalog configuration with `enabled: false`. Select an enabled rendition from the latest catalog before opening a decoder. Among the video renditions you can decode, prefer the highest `preference`; `0` is the default and `-1` marks a compatibility transcode. Audio and video subscribe setup returns `UnsupportedConfigMoqException` when the decoder refuses the codec, layout, or description; a player can then try its next ranked rendition. Decoder faults and later peer or decode failures do not report that setup refusal.
 - **Subscription defaults.** A bare `Subscription()`, passing no subscription, and `defaultSubscription()` all mean moq-net's defaults, whose zero `delay` starts at the newest group and skips a superseded one at once. `Delay` defaults both bounds to zero: pass `max: null` for no subscriber limit, or `min: null` to leave the target latency unstated. Decoders take the same `Delay`.
 - **Track demand.** Obtain a dynamic track request’s `demand()` before accepting it to watch subscribers through the handoff to its producer. The watch does not keep the track alive and ends when the track closes or the request is rejected. A producer publishes everything you write, subscribed or not, so a late subscriber can fetch the recent past. Capturing only while a producer's `demand()` reports a subscriber is an opt-in that saves the encode but leaves nothing from before the first one.
 
diff --git a/doc/lib/go/index.md b/doc/lib/go/index.md
index b595ded6eb4..f364497668d 100644
--- a/doc/lib/go/index.md
+++ b/doc/lib/go/index.md
@@ -137,7 +137,7 @@ shows which module holds each.
 - **Authorization.** On `moq-lite-07-wip` (opt in with `ClientConfig.Versions`) and on moq-transport draft-18+ with the [MoQ Auth extension](/draft/moq-auth), `Session().Grants()` returns a `GrantConsumer`: `Grant()` is the `Grant` the relay sent back, nil until it answers and while a client session reconnects, and `Changed(ctx)` waits for the next one. `Close()` it when done.
 - **Tokens.** Set `ClientConfig.Tokens` instead of putting the credential in the URL. The first is the connection credential, sent in SETUP and, while an offered version can't carry it there (lite before 07), as the URL's `?jwt=`; each other token widens the grant over AUTH. `Session().Tokens().Set(...)` replaces a client session's tokens before they expire: the next dial presents them, a live AUTH session at once, and after an authorization refusal the session redials only if they changed. `Answered(ctx)` returns nil once the relay accepts them, or its refusal with the relay's code. A `?jwt=` already in the URL stays the connection credential, which is how to reach a relay older than this release.
 - **Errors.** Read diagnostic payloads from `Reason` and structured protocol failures from `Details`.
-- **Disabled renditions.** A rendition with `enabled: false` has no frames coming until its publisher re-enables it. Select an enabled rendition from the latest catalog before opening a decoder. Keep one already playing while every rendition of its kind is disabled: the convenience decoders accept a disabled configuration, and a re-enable, such as an unmute, then plays without a resubscribe. Among the video renditions you can decode, prefer the highest `Preference`; `0` is the default and `-1` marks a compatibility transcode. Audio and video subscribe setup returns `moq.ErrUnsupportedConfig` when the decoder refuses the codec, layout, or description; a player can then try its next ranked rendition. Decoder faults and later peer or decode failures do not report that setup refusal.
+- **Disabled renditions.** Audio and video convenience decoders reject a catalog configuration with `enabled: false`. Select an enabled rendition from the latest catalog before opening a decoder. Among the video renditions you can decode, prefer the highest `Preference`; `0` is the default and `-1` marks a compatibility transcode. Audio and video subscribe setup returns `moq.ErrUnsupportedConfig` when the decoder refuses the codec, layout, or description; a player can then try its next ranked rendition. Decoder faults and later peer or decode failures do not report that setup refusal.
 - **Subscription defaults.** A zero `moq.Subscription{}`, a nil `*Subscription`, and `moq.DefaultSubscription()` all mean moq-net's defaults, whose zero `Delay` starts at the newest group and skips a superseded one at once. Set `Delay.MaxUnlimited` for no subscriber limit, and `Delay.MinUnstated` to leave the target latency unstated. Decoders take the same `moq.Delay`.
 - **Track demand.** Obtain a dynamic track request’s `Demand()` before accepting it to watch subscribers through the handoff to its producer. The watch does not keep the track alive and ends when the track closes or the request is rejected. A producer publishes everything you write, subscribed or not, so a late subscriber can fetch the recent past. Capturing only while a producer's `Demand()` reports a subscriber is an opt-in that saves the encode but leaves nothing from before the first one.
 
diff --git a/doc/lib/js/publish.md b/doc/lib/js/publish.md
index aeff8755be2..5b4d8e84856 100644
--- a/doc/lib/js/publish.md
+++ b/doc/lib/js/publish.md
@@ -31,7 +31,7 @@ WebCodecs, writes the catalog, and publishes a hang broadcast.
 | `url`, `name` | Relay URL (with `?jwt=` if needed) and broadcast name. |
 | `versions` | Protocol versions to offer, most preferred first, comma-separated like `moq-transport-18,moq-lite-06`. Every stable version by default. |
 | `source` | `camera`, `screen`, or `file`. |
-| `muted`, `invisible` | Stop publishing audio or video. By default the microphone and camera stay open, so unmuting or unhiding is instant and the browser's capture indicators stay lit. |
+| `muted`, `invisible` | Stop sending audio, or stop publishing video. A muted rendition stays in the catalog and its listeners stay subscribed, so the next word reaches them at once, as push-to-talk needs; they play the pause as comfort noise. By default the microphone and camera stay open, so unmuting or unhiding is instant and the browser's capture indicators stay lit. |
 | `capture` | What a muted or invisible track does with its device: `hold` (default) keeps it open, `release` closes it so its capture indicator goes dark, and resuming reopens it. A screen share or file stops once both tracks are off. Clearing `source` or removing the element releases everything either way. |
 | `preview` | What the nested element shows: the raw `source` (default), a decoded copy of the `encoded` stream to see what viewers get, or `none`. |
 | `backend` | How a `<canvas>` preview is drawn; see [@moq/video](/lib/js/video). `auto` (default), `webgpu`, or `2d`. |
@@ -82,9 +82,12 @@ audio still keeps 30 seconds, since raw history needs a bound. The catalog and
 HLS record tracks keep `@moq/net`'s zero default, since a viewer needs only
 their newest group. Capture stays open. Disabling an audio encoder keeps what it retained: a
 subscriber still gets that history, and it expires on its own. Players skip a
-disabled rendition, so that history reaches subscribers that are already held
-on it or that subscribe directly. The codec stays
-configured across the disable, so re-enabling resumes at once.
+disabled rendition, so that history reaches only subscribers that ask for the
+track directly. The codec stays configured across the disable, so re-enabling
+resumes at once. To pause audio that comes back, such as push-to-talk, set the
+encoder's `muted` instead: it sends nothing, keeps the rendition enabled, and
+marks where each utterance ends, so listeners stay subscribed and treat the gap
+as intentional silence.
 
 Pass `onDemand: false` to `Publish.Broadcast` to encode audio continuously too.
 `onDemand: true` also gates video, which then loses its unsubscribed past.
diff --git a/doc/lib/js/room.md b/doc/lib/js/room.md
index e97f4a7f367..e3c8c5dbd77 100644
--- a/doc/lib/js/room.md
+++ b/doc/lib/js/room.md
@@ -41,7 +41,9 @@ const room = new Room({ connection, identity: Path.from("alice") });
 the camera's hd and sd renditions encode even when nobody in the room watches,
 so a member who arrives late can fetch the last few seconds. While
 `microphoneEnabled` is on, the microphone keeps raw audio and encodes it once
-someone listens. Turn either off to stop that capture.
+someone listens. Turn either off to stop that capture. Turning the microphone
+off mutes it rather than removing it, so listeners stay subscribed and hear
+the next word at once.
 
 On a public prefix, skip the token and dial that path directly. The conferencing
 demo at [`demo/web`](https://github.com/moq-dev/moq/tree/main/demo/web) (`meet.html`)
diff --git a/doc/lib/kt/index.md b/doc/lib/kt/index.md
index b2c524ba5ba..11786fe0fef 100644
--- a/doc/lib/kt/index.md
+++ b/doc/lib/kt/index.md
@@ -113,7 +113,7 @@ shows which module holds each.
 - **Authorization.** On `moq-lite-07-wip` (opt in with `ClientConfig(versions = ...)`) and on moq-transport draft-18+ with the [MoQ Auth extension](/draft/moq-auth), collect `moq.grants().updates()` for the `Grant` the relay sent back and each change, `null` until it answers and while a client session reconnects. Ending the collection cancels the consumer.
 - **Tokens.** Pass `ClientConfig(tokens = listOf(...))` instead of putting the credential in the URL. The first is the connection credential, sent in SETUP and, while an offered version can't carry it there (lite before 07), as the URL's `?jwt=`; each other token widens the grant over AUTH. `moq.tokens().set(listOf(...))` replaces them before they expire: the next dial presents them, a live AUTH session at once, and after an authorization refusal the session redials only if they changed. Suspending `tokens().answered()` returns once the relay accepts them and throws its refusal with the relay's code. A `?jwt=` already in the URL stays the connection credential, which is how to reach a relay older than this release.
 - **Errors.** Read diagnostic payloads from `reason` and structured protocol failures from `details`.
-- **Disabled renditions.** A rendition with `enabled: false` has no frames coming until its publisher re-enables it. Select an enabled rendition from the latest catalog before opening a decoder. Keep one already playing while every rendition of its kind is disabled: the convenience decoders accept a disabled configuration, and a re-enable, such as an unmute, then plays without a resubscribe. Among the video renditions you can decode, prefer the highest `preference`; `0` is the default and `-1` marks a compatibility transcode. Audio and video subscribe setup returns `MoqException.UnsupportedConfig` when the decoder refuses the codec, layout, or description; a player can then try its next ranked rendition. Decoder faults and later peer or decode failures do not report that setup refusal.
+- **Disabled renditions.** Audio and video convenience decoders reject a catalog configuration with `enabled: false`. Select an enabled rendition from the latest catalog before opening a decoder. Among the video renditions you can decode, prefer the highest `preference`; `0` is the default and `-1` marks a compatibility transcode. Audio and video subscribe setup returns `MoqException.UnsupportedConfig` when the decoder refuses the codec, layout, or description; a player can then try its next ranked rendition. Decoder faults and later peer or decode failures do not report that setup refusal.
 - **Subscription defaults.** `Subscription.default()` returns moq-net's defaults, whose zero `delay` starts at the newest group and skips a superseded one at once; passing no subscription means the same. `copy` it to change a field; building a `Subscription(...)` must name its `Delay(min, max)`, where a null `max` sets no subscriber limit and a null `min` leaves the target latency unstated. Decoders take the same `Delay`.
 - **Track demand.** Obtain a dynamic track request’s `demand()` before accepting it to watch subscribers through the handoff to its producer. The watch does not keep the track alive and ends when the track closes or the request is rejected. A producer publishes everything you write, subscribed or not, so a late subscriber can fetch the recent past. Capturing only while a producer's `demand()` reports a subscriber is an opt-in that saves the encode but leaves nothing from before the first one.
 
diff --git a/doc/lib/py/index.md b/doc/lib/py/index.md
index 3d2fd2640a7..a9578d94f9b 100644
--- a/doc/lib/py/index.md
+++ b/doc/lib/py/index.md
@@ -129,7 +129,7 @@ shows which module holds each.
 - **Authorization.** On `moq-lite-07-wip` (opt in with `versions=`) and on moq-transport draft-18+ with the [MoQ Auth extension](/draft/moq-auth), `async for grant in session.grants()` yields the `Grant` the relay sent back and each change, `None` until it answers and while a client session reconnects. `grants().grant()` reads it once; cancelling or leaving an `async with` releases the wait.
 - **Tokens.** Pass `tokens=[...]` instead of putting the credential in the URL. The first is the connection credential, sent in SETUP and, while an offered version can't carry it there (lite before 07), as the URL's `?jwt=`; each other token widens the grant over AUTH. `session.tokens().set([...])` replaces a client session's tokens before they expire: the next dial presents them, a live AUTH session at once, and after an authorization refusal the session redials only if they changed. `await tokens.answered()` returns once the relay accepts them and raises its refusal with the relay's code. A `?jwt=` already in the URL stays the connection credential, which is how to reach a relay older than this release.
 - **Errors.** Read diagnostic payloads from `reason` and structured protocol failures from `details`.
-- **Disabled renditions.** A rendition with `enabled: false` has no frames coming until its publisher re-enables it. Select an enabled rendition from the latest catalog before opening a decoder. Keep one already playing while every rendition of its kind is disabled: the convenience decoders accept a disabled configuration, and a re-enable, such as an unmute, then plays without a resubscribe. Among the video renditions you can decode, prefer the highest `preference`; `0` is the default and `-1` marks a compatibility transcode. Audio and video subscribe setup returns `moq.Error.UnsupportedConfig` when the decoder refuses the codec, layout, or description; a player can then try its next ranked rendition. Decoder faults and later peer or decode failures do not report that setup refusal.
+- **Disabled renditions.** Audio and video convenience decoders reject a catalog configuration with `enabled: false`. Select an enabled rendition from the latest catalog before opening a decoder. Among the video renditions you can decode, prefer the highest `preference`; `0` is the default and `-1` marks a compatibility transcode. Audio and video subscribe setup returns `moq.Error.UnsupportedConfig` when the decoder refuses the codec, layout, or description; a player can then try its next ranked rendition. Decoder faults and later peer or decode failures do not report that setup refusal.
 - **Subscription defaults.** A bare `moq.Subscription()`, passing no subscription, and `moq.Subscription.default()` all mean moq-net's defaults, whose zero `delay` starts at the newest group and skips a superseded one at once. Pass `delay=moq.Delay(max=None)` for no subscriber limit, or `min=None` to leave the target latency unstated. Decoders take the same `moq.Delay`.
 - **Track demand.** Obtain a dynamic track request’s `demand()` before accepting it to watch subscribers through the handoff to its producer. The watch does not keep the track alive and ends when the track closes or the request is rejected. A producer publishes everything you write, subscribed or not, so a late subscriber can fetch the recent past. Capturing only while a producer's `demand()` reports a subscriber is an opt-in that saves the encode but leaves nothing from before the first one.
 
diff --git a/doc/lib/swift/index.md b/doc/lib/swift/index.md
index 4cf0183aee2..726940de7e6 100644
--- a/doc/lib/swift/index.md
+++ b/doc/lib/swift/index.md
@@ -111,7 +111,7 @@ shows which module holds each.
 - **Authorization.** On `moq-lite-07-wip` (opt in with `Client(versions:)`) and on moq-transport draft-18+ with the [MoQ Auth extension](/draft/moq-auth), `for try await grant in session.grants()` yields the `Grant` the relay sent back and each change, `nil` until it answers and while a client session reconnects. Cancelling the iterating task cancels the native wait.
 - **Tokens.** Pass `Client(tokens: [...])` instead of putting the credential in the URL. The first is the connection credential, sent in SETUP and, while an offered version can't carry it there (lite before 07), as the URL's `?jwt=`; each other token widens the grant over AUTH. `try session.tokens()?.set([...])` replaces them before they expire: the next dial presents them, a live AUTH session at once, and after an authorization refusal the session redials only if they changed. `try await tokens.answered()` returns once the relay accepts them and throws its refusal with the relay's code. A `?jwt=` already in the URL stays the connection credential, which is how to reach a relay older than this release.
 - **Errors.** Diagnostic cases use the `reason:` argument label; match their associated value to inspect it. Protocol errors carry `details`.
-- **Disabled renditions.** A rendition with `enabled: false` has no frames coming until its publisher re-enables it. Select an enabled rendition from the latest catalog before opening a decoder. Keep one already playing while every rendition of its kind is disabled: the convenience decoders accept a disabled configuration, and a re-enable, such as an unmute, then plays without a resubscribe. Among the video renditions you can decode, prefer the highest `preference`; `0` is the default and `-1` marks a compatibility transcode. Audio and video subscribe setup returns `MoqError.UnsupportedConfig` when the decoder refuses the codec, layout, or description; a player can then try its next ranked rendition. Decoder faults and later peer or decode failures do not report that setup refusal.
+- **Disabled renditions.** Audio and video convenience decoders reject a catalog configuration with `enabled: false`. Select an enabled rendition from the latest catalog before opening a decoder. Among the video renditions you can decode, prefer the highest `preference`; `0` is the default and `-1` marks a compatibility transcode. Audio and video subscribe setup returns `MoqError.UnsupportedConfig` when the decoder refuses the codec, layout, or description; a player can then try its next ranked rendition. Decoder faults and later peer or decode failures do not report that setup refusal.
 - **Subscription defaults.** `Subscription.default` holds moq-net's defaults, whose zero `delay` starts at the newest group and skips a superseded one at once; passing no subscription means the same. Copy it to change a field; building a `Subscription(...)` must name its `Delay(min:max:)`, where a `nil` `max` sets no subscriber limit and a `nil` `min` leaves the target latency unstated. Decoders take the same `Delay`.
 - **Track demand.** Obtain a dynamic track request’s `demand()` before accepting it to watch subscribers through the handoff to its producer. The watch does not keep the track alive and ends when the track closes or the request is rejected. A producer publishes everything you write, subscribed or not, so a late subscriber can fetch the recent past. Capturing only while a producer's `demand()` reports a subscriber is an opt-in that saves the encode but leaves nothing from before the first one.
 
diff --git a/drafts/draft-lcurley-moq-hang.md b/drafts/draft-lcurley-moq-hang.md
index 11a905b72f8..fa80b68944b 100644
--- a/drafts/draft-lcurley-moq-hang.md
+++ b/drafts/draft-lcurley-moq-hang.md
@@ -829,8 +829,7 @@ For example, with video at 20 millisecond intervals and audio at 15 written as v
 
 ### enabled {#field-enabled}
 The `enabled` field says whether a consumer may select an audio or video rendition; a text rendition does not carry it.
-When `enabled` is false, no frames are coming, and a consumer SHOULD NOT select the rendition.
-A consumer MAY keep a rendition it already selected while that rendition is disabled and no enabled one it can decode remains, so a re-enable needs no new subscription.
+When `enabled` is false, no frames are coming, and a consumer MUST NOT select the rendition.
 If absent, `enabled` defaults to true; a publisher SHOULD only write it when false.
 
 Earlier versions defined a video `stalled` field instead.
@@ -1148,7 +1147,7 @@ This document has no IANA actions.
 - Added the optional `delay` rendition field: how far a rendition's timestamps trail those other renditions already wrote, never lowered once advertised and never subtracted across renditions.
 - Recommended namespaced keys for application root sections.
 - Added the optional `delay` field to `json` and `binary` track entries, measured only from payloads stamped with their capture time on the broadcast clock.
-- Replaced the video `stalled` field with an optional `enabled` field on audio and video renditions. A consumer SHOULD NOT select a disabled rendition, MAY keep one it already selected while no enabled alternative remains, and ignores `stalled`. A consumer that predates `enabled` keeps selecting a disabled rendition.
+- Replaced the video `stalled` field with an optional `enabled` field on audio and video renditions. A consumer MUST NOT select a disabled rendition and ignores `stalled`. A consumer that predates `enabled` keeps selecting a disabled rendition.
 - Audio `sampleRate` and `numberOfChannels` describe the decoded output, so HE-AAC names its SBR rate and parametric stereo names two channels.
 - Added an optional `track` field to video, audio, text, `json`, and `binary` entries naming the track in its broadcast; the entry's key is its ID and names the track when `track` is absent. A consumer MUST reject a catalog using one ID for both a video and an audio rendition.
 - Defined video `displayAspectWidth` and `displayAspectHeight` as the whole picture's display aspect, not the sample aspect.
diff --git a/js/hang/src/catalog/audio.ts b/js/hang/src/catalog/audio.ts
index c84397adf74..1ca49041eb7 100644
--- a/js/hang/src/catalog/audio.ts
+++ b/js/hang/src/catalog/audio.ts
@@ -61,8 +61,7 @@ const AudioConfigFields = z.object({
 	bitrate: z.optional(u53Schema),
 
 	// Whether this rendition may be selected. When false, no frames are coming and a consumer
-	// should not select it, though one may keep it selected while no enabled alternative exists.
-	// Default: true, so publishers only write it when false.
+	// must not select it. Default: true, so publishers only write it when false.
 	enabled: z.optional(z.boolean()),
 
 	// The maximum delay between a frame being ready and the publisher flushing it, in whole
diff --git a/js/hang/src/catalog/video.ts b/js/hang/src/catalog/video.ts
index adbb69f3bbc..a04b81d3aad 100644
--- a/js/hang/src/catalog/video.ts
+++ b/js/hang/src/catalog/video.ts
@@ -178,8 +178,7 @@ export const VideoConfigSchema = z.object({
 	bitrate: z.optional(u53Schema),
 
 	// Whether this rendition may be selected. When false, no frames are coming and a consumer
-	// should not select it, though one may keep it selected while no enabled alternative exists.
-	// Default: true, so publishers only write it when false.
+	// must not select it. Default: true, so publishers only write it when false.
 	enabled: z.optional(z.boolean()),
 
 	// Higher is preferred: a player selects among the highest preference it can decode, then by
diff --git a/js/hang/src/container/consumer.test.ts b/js/hang/src/container/consumer.test.ts
index 159acea7fb6..d5090a4762a 100644
--- a/js/hang/src/container/consumer.test.ts
+++ b/js/hang/src/container/consumer.test.ts
@@ -856,6 +856,51 @@ test("Consumer measures arrivals as they land", async () => {
 	}
 });
 
+test("Consumer does not relax its measurement across a declared silence", async () => {
+	const clock = new Manual();
+	const installed = clock.install();
+	// Two identical paths, except that one publisher declares its silence and the other just stops.
+	const declared = new Track.Producer("declared");
+	const undeclared = new Track.Producer("undeclared");
+	const options = { format: new LegacyFormat("audio"), delay: { max: 5000 as Milli } };
+	const quiet = new Consumer(declared.subscribe(), options);
+	const lapsed = new Consumer(undeclared.subscribe(), options);
+	const producers = [new LegacyProducer(declared, options.format), new LegacyProducer(undeclared, options.format)];
+	const payload = new Uint8Array([1]);
+	let media = 0;
+	const send = async (count: number) => {
+		for (let i = 0; i < count; i++) {
+			for (const producer of producers) producer.encode(payload, (media * 1000) as Micro, true);
+			media += 520;
+			await clock.advance(Nano.fromMilli(Milli(520)));
+		}
+	};
+
+	try {
+		// Arrivals exactly as fast as their media until the cold-start prior is spent.
+		await send(40);
+		const settled = quiet.spread.peek();
+		expect(lapsed.spread.peek()).toBe(settled);
+
+		// A minute of silence on both, declared on one.
+		producers[0].discontinuity();
+		media += 60_000;
+		await clock.advance(Nano.fromMilli(Milli(60_000)));
+		await send(2);
+
+		expect(quiet.spread.peek()).toBe(settled);
+		expect(lapsed.spread.peek()).toBeGreaterThan(settled);
+	} finally {
+		for (const track of [declared, undeclared]) {
+			track.finish();
+			track.close();
+		}
+		quiet.close();
+		lapsed.close();
+		installed.close();
+	}
+});
+
 // --- Ordering ---
 
 test("Consumer delivers groups in sequence order regardless of arrival order", async () => {
diff --git a/js/hang/src/container/consumer.ts b/js/hang/src/container/consumer.ts
index 50c8e5afbca..9ee90a2fef3 100644
--- a/js/hang/src/container/consumer.ts
+++ b/js/hang/src/container/consumer.ts
@@ -221,6 +221,11 @@ export class Consumer {
 	 * floor. Starts at the predecessor's estimate, or the cold-start estimate without one.
 	 */
 	readonly spread: Getter<Milli>;
+	// The newest group opened by a declared end, until a later group's first frame tells the jitter
+	// estimator the silence is over. Not at the marker itself: the stopped encoder's final packets may
+	// follow it in its own group, and they belong to the speech before the silence.
+	#declared?: bigint;
+	#mediaSequence?: bigint;
 
 	#signals = new Effect();
 	#closed = new Once<Error | null>();
@@ -378,6 +383,13 @@ export class Consumer {
 		}
 	}
 
+	// Note an end the publisher declared in `group`, which a later group's first frame resumes from.
+	#declare(group: Group): void {
+		const sequence = group.consumer.sequence;
+		if (this.#mediaSequence !== undefined && sequence < this.#mediaSequence) return;
+		if (this.#declared === undefined || sequence > this.#declared) this.#declared = sequence;
+	}
+
 	// Decode one wire frame into `group`, charging what it buffers. A payload that fails to decode sets
 	// the group's fault, which next() raises once the frames ahead of it are read.
 	#decode(group: Group, wire: Moq.Group.Frame): void {
@@ -401,6 +413,7 @@ export class Consumer {
 				return;
 			}
 			group.bare = decoded.length === 0;
+			if (group.bare) this.#declare(group);
 		}
 
 		// Decoded payloads are views of the wire payload, which stays allocated until the last of them is
@@ -412,8 +425,17 @@ export class Consumer {
 			// Observed here, before any gap handling or age budget: a target derived from
 			// what survives the budget would only ever confirm the budget it was cut to.
 			if (!marker) {
+				if (this.#mediaSequence === undefined || group.consumer.sequence > this.#mediaSequence)
+					this.#mediaSequence = group.consumer.sequence;
+				if (this.#declared !== undefined && group.consumer.sequence > this.#declared) {
+					this.#jitter.end();
+					this.#declared = undefined;
+				}
 				this.#jitter.observe(arrival, Milli.fromMicro(sample.timestamp));
 				this.#spread.set(this.#jitter.measured);
+			} else if (!group.media) {
+				// Only a marker ahead of any media declares an end; one after it is a frame's endpoint.
+				this.#declare(group);
 			}
 			const frame: ReceivedFrame = {
 				arrival,
diff --git a/js/hang/src/container/jitter.test.ts b/js/hang/src/container/jitter.test.ts
index 4e2c8c32bcc..c346af8d378 100644
--- a/js/hang/src/container/jitter.test.ts
+++ b/js/hang/src/container/jitter.test.ts
@@ -16,6 +16,7 @@ interface Case {
 	delay?: number;
 	arrival: number[];
 	media: number[];
+	ends?: number[];
 	target: [number, number][];
 }
 
@@ -41,6 +42,7 @@ describe("audio jitter conformance", () => {
 			"idle",
 			"paced",
 			"reorder",
+			"silence",
 			"spike",
 			"straggler",
 			"tunein",
@@ -51,8 +53,10 @@ describe("audio jitter conformance", () => {
 		it(c.name, () => {
 			const jitter = new Jitter();
 			const expected = new Map(c.target);
+			const ends = new Set(c.ends);
 			let current: number | undefined;
 			for (let i = 0; i < c.arrival.length; i++) {
+				if (ends.has(i)) jitter.end();
 				jitter.observe(c.arrival[i] as Milli, c.media[i] as Milli);
 				const value = target(jitter, c);
 				const listed = expected.get(i);
@@ -84,6 +88,17 @@ describe("Jitter", () => {
 		expect(jitter.measured).toBe(20 as Milli);
 	});
 
+	it("ignores an end before any observation", () => {
+		// A cold estimator has no interval for a silence to stretch, so the end must not linger and
+		// excuse the first unexplained gap.
+		const jitter = new Jitter();
+		jitter.end();
+		for (let i = 0; i < 500; i++) jitter.observe((50 + i * 20) as Milli, (i * 20) as Milli);
+		const settled = jitter.measured;
+		jitter.observe((50 + 500 * 20 + 30_000) as Milli, (500 * 20 + 30_000) as Milli);
+		expect(jitter.measured).toBeGreaterThan(settled);
+	});
+
 	it("does not follow the absolute delay", () => {
 		// Only the spread of arrivals matters, not how far away the sender is.
 		const near = new Jitter();
diff --git a/js/hang/src/container/jitter.ts b/js/hang/src/container/jitter.ts
index 0759bf70b6d..257beda9c2d 100644
--- a/js/hang/src/container/jitter.ts
+++ b/js/hang/src/container/jitter.ts
@@ -61,6 +61,8 @@ export class Jitter {
 	#interval = 0;
 	/** The largest delay seen in that interval. */
 	#peak = 0;
+	/** A declared end precedes the next measured observation, so the silence before it is not idle. */
+	#ended = false;
 
 	#histogram = Float64Array.from(PRIOR);
 	/** How much of the histogram is still the prior's rather than evidence. */
@@ -93,6 +95,8 @@ export class Jitter {
 		}
 
 		const interval = Math.floor((arrival - this.#origin) / RESAMPLE);
+		const resumed = this.#ended;
+		this.#ended = false;
 		if (interval <= this.#interval) {
 			this.#peak = Math.max(this.#peak, delay);
 			return;
@@ -100,14 +104,30 @@ export class Jitter {
 
 		this.#fold(Math.min(BUCKETS - 1, Math.floor(this.#peak / BUCKET)));
 
-		// An interval with no arrival relaxes the estimate toward the prior at the same rate.
-		const idle = Math.min(interval - this.#interval - 1, IDLE_MAX);
-		for (let i = 0; i < idle; i++) this.#fold(undefined);
-
-		this.#interval = interval;
+		if (resumed) {
+			// A silence the publisher declared says nothing about the path, so the estimate keeps
+			// what it had and a fresh interval starts here.
+			this.#origin = arrival;
+			this.#interval = 0;
+		} else {
+			// An interval with no arrival relaxes the estimate toward the prior at the same rate.
+			const idle = Math.min(interval - this.#interval - 1, IDLE_MAX);
+			for (let i = 0; i < idle; i++) this.#fold(undefined);
+			this.#interval = interval;
+		}
 		this.#peak = delay;
 	}
 
+	/**
+	 * A declared end lies between the previous observation and the next, so the silence it declares
+	 * does not relax the estimate the way an unexplained gap does. Call it before observing the first
+	 * frame after the end, not at the marker: the stopped encoder's final packets may still follow it.
+	 */
+	end(): void {
+		// Before any observation there is no interval for the silence to stretch.
+		if (this.#origin !== undefined) this.#ended = true;
+	}
+
 	/**
 	 * A new estimator that keeps what this one learned but measures arrivals afresh, for a track that
 	 * replaces this one on the same path. Its frames are measured against their own fastest, never
diff --git a/js/publish/MIGRATE.md b/js/publish/MIGRATE.md
index bbe065a4282..b3ec5506455 100644
--- a/js/publish/MIGRATE.md
+++ b/js/publish/MIGRATE.md
@@ -4,6 +4,13 @@ How to update your code for each breaking change, newest first.
 
 ## Unreleased
 
+### Muting suppresses audio instead of disabling the rendition ([#7942](https://github.com/moq-dev/moq/pull/7942))
+
+`<moq-publish muted>` no longer marks the audio rendition `enabled: false`: it sends nothing, the rendition stays enabled in the catalog, and listeners stay subscribed, so the next word reaches them at once.
+Each muted span ends with a discontinuity marker, which players treat as intentional silence.
+The same is available on `Audio.Encoder` as the new `muted` knob; keep `enabled: false` for a stop the rendition does not come back from soon.
+A viewer that read `enabled: false` in the catalog as "muted" no longer sees one; publish that state in your own catalog section or data track.
+
 ### The capture graph renders to no output device ([#7881](https://github.com/moq-dev/moq/pull/7881))
 
 `Audio.Capture`'s and `Audio.Encoder`'s `root` now sit in an `AudioContext` built with `sinkId: { type: "none" }`, which shortens the bursts capture hands the encoder.
diff --git a/js/publish/api/index.api.md b/js/publish/api/index.api.md
index 9ecb9d909da..c1005dd60ac 100644
--- a/js/publish/api/index.api.md
+++ b/js/publish/api/index.api.md
@@ -42,6 +42,7 @@ export namespace Audio {
 		codec: Signals.Signal<Audio.Codec>;
 		groupDuration: Signals.Signal<Clock.Milli>;
 		readonly in: Signals.Readonlys<Audio.EncoderInput>;
+		muted: Signals.Signal<boolean>;
 		readonly name: string;
 		readonly out: Signals.Readonlys<Audio.EncoderOutput>;
 		volume: Signals.Signal<number>;
@@ -62,6 +63,7 @@ export namespace Audio {
 	export type EncoderProps = Signals.Inputs<Audio.EncoderInput> & {
 		codec?: Audio.Codec | Signals.Signal<Audio.Codec>;
 		groupDuration?: Clock.Milli | Signals.Signal<Clock.Milli>;
+		muted?: boolean | Signals.Signal<boolean>;
 		volume?: number | Signals.Signal<number>;
 	};
 	export interface Format {
diff --git a/js/publish/src/audio/encoder.test.ts b/js/publish/src/audio/encoder.test.ts
index f31e1f2ffe5..578b318b146 100644
--- a/js/publish/src/audio/encoder.test.ts
+++ b/js/publish/src/audio/encoder.test.ts
@@ -96,14 +96,15 @@ describe("toEncoderConfig", () => {
 	});
 });
 
-// Like Chrome's Opus encoder, it holds the newest chunks until later input pushes them out, and
-// stamps each chunk from the first input's timestamp plus the audio encoded since, so a jump in
-// input timestamps never reaches the output.
-class LaggingAudioEncoder {
-	static instances: LaggingAudioEncoder[] = [];
+// Like Chrome's Opus encoder, it emits one chunk per input and stamps each from the first input's
+// timestamp plus the audio encoded since, so a jump in input timestamps never reaches the output.
+// `LAG` holds that many of the newest chunks until later input pushes them out, a slower codec than
+// any browser measured, for the tests that need one.
+class FakeAudioEncoder {
+	static instances: FakeAudioEncoder[] = [];
 	static probes: AudioEncoderConfig[] = [];
 	static description: ((config: AudioEncoderConfig) => Uint8Array) | undefined;
-	static readonly LAG = 2;
+	static LAG = 0;
 
 	// Called on configure; the encoder publishes its pipeline synchronously right after.
 	static onConfigure: ((config: AudioEncoderConfig) => void) | undefined;
@@ -122,7 +123,7 @@ class LaggingAudioEncoder {
 	constructor(init: AudioEncoderInit) {
 		this.#output = init.output;
 		this.#error = init.error;
-		LaggingAudioEncoder.instances.push(this);
+		FakeAudioEncoder.instances.push(this);
 	}
 
 	fail(error: Error): void {
@@ -136,7 +137,7 @@ class LaggingAudioEncoder {
 		this.#fresh = true;
 		queueMicrotask(() => {
 			this.#fresh = false;
-			if (!this.#probe) LaggingAudioEncoder.onConfigure?.(config);
+			if (!this.#probe) FakeAudioEncoder.onConfigure?.(config);
 		});
 	}
 
@@ -145,7 +146,7 @@ class LaggingAudioEncoder {
 		this.#base ??= data.timestamp;
 		this.#held.push({ timestamp: this.#base + this.#encoded, duration });
 		this.#encoded += duration;
-		while (this.#held.length > LaggingAudioEncoder.LAG) {
+		while (this.#held.length > FakeAudioEncoder.LAG) {
 			this.#emit(this.#held.shift() as { timestamp: number; duration: number });
 		}
 	}
@@ -153,7 +154,7 @@ class LaggingAudioEncoder {
 	#emit({ timestamp, duration }: { timestamp: number; duration: number }): void {
 		const chunk = { type: "key", timestamp, duration, byteLength: 1, copyTo: (dest: Uint8Array) => dest.set([1]) };
 		const config = this.#config;
-		const description = config && LaggingAudioEncoder.description?.(config);
+		const description = config && FakeAudioEncoder.description?.(config);
 		const metadata =
 			config && description
 				? {
@@ -171,9 +172,9 @@ class LaggingAudioEncoder {
 	async flush(): Promise<void> {
 		if (this.#fresh) {
 			this.#probe = true;
-			if (this.#config) LaggingAudioEncoder.probes.push(structuredClone(this.#config));
-			const index = LaggingAudioEncoder.instances.indexOf(this);
-			if (index !== -1) LaggingAudioEncoder.instances.splice(index, 1);
+			if (this.#config) FakeAudioEncoder.probes.push(structuredClone(this.#config));
+			const index = FakeAudioEncoder.instances.indexOf(this);
+			if (index !== -1) FakeAudioEncoder.instances.splice(index, 1);
 		}
 		for (const chunk of this.#held.splice(0)) this.#emit(chunk);
 	}
@@ -206,12 +207,13 @@ class FakeAudioData {
 }
 
 function installFakeWebCodecs() {
-	LaggingAudioEncoder.instances = [];
-	LaggingAudioEncoder.probes = [];
-	LaggingAudioEncoder.description = undefined;
+	FakeAudioEncoder.instances = [];
+	FakeAudioEncoder.probes = [];
+	FakeAudioEncoder.LAG = 0;
+	FakeAudioEncoder.description = undefined;
 	const names = ["AudioEncoder", "AudioDecoder", "AudioData"] as const;
 	const originals = names.map((name) => Object.getOwnPropertyDescriptor(globalThis, name));
-	const fakes = [LaggingAudioEncoder, class {}, FakeAudioData];
+	const fakes = [FakeAudioEncoder, class {}, FakeAudioData];
 	names.forEach((name, i) => {
 		Object.defineProperty(globalThis, name, { configurable: true, writable: true, value: fakes[i] });
 	});
@@ -284,8 +286,8 @@ function fakeCapture(feed: Feed) {
 // Resolves on the next AudioEncoder configure; the encoder publishes its pipeline synchronously after.
 function configured(): Promise<AudioEncoderConfig> {
 	return new Promise((resolve) => {
-		LaggingAudioEncoder.onConfigure = (config) => {
-			LaggingAudioEncoder.onConfigure = undefined;
+		FakeAudioEncoder.onConfigure = (config) => {
+			FakeAudioEncoder.onConfigure = undefined;
 			resolve(config);
 		};
 	});
@@ -371,6 +373,7 @@ async function setup(order = new Order(), codec?: Codec, groupDuration?: Milli)
 // not the encoder's gap-blind one, or they trail the next gap's marker and are dropped as pre-gap.
 test("an on-demand gap marks where submitted audio ends and drops the chunks held across it", async () => {
 	using _webcodecs = installFakeWebCodecs();
+	FakeAudioEncoder.LAG = 2;
 	using env = await setup();
 	const { track, rendition, feed, written, writes } = env;
 
@@ -407,8 +410,8 @@ test("an on-demand gap marks where submitted audio ends and drops the chunks hel
 
 // A pause with a subscriber attached breaks the timeline just as losing demand does: a subscriber
 // that stays across it, or joins during it, must not read the audio before it as live. The codec
-// keeps its configuration, so the audio it still held is flushed out before the marker.
-test("disabling with a subscriber attached flushes the held audio, then marks where it ends", async () => {
+// keeps its configuration and is not flushed.
+test("disabling with a subscriber attached marks where the submitted audio ends", async () => {
 	using _webcodecs = installFakeWebCodecs();
 	using env = await setup();
 	const { enabled, feed, written } = env;
@@ -421,14 +424,14 @@ test("disabling with a subscriber attached flushes the held audio, then marks wh
 		await feed.drain();
 	};
 
-	await push(4); // two written, two held
+	await push(4);
 
 	enabled.set(false);
 	await settle();
 
 	await push(2); // nothing publishing
 	enabled.set(true);
-	await push(3); // the restarted codec, so one written and two held
+	await push(3);
 
 	expect(written).toEqual([
 		[20_000, 1],
@@ -437,14 +440,18 @@ test("disabling with a subscriber attached flushes the held audio, then marks wh
 		[80_000, 1],
 		[100_000, 0],
 		[140_000, 1],
+		[160_000, 1],
+		[180_000, 1],
 	]);
-	expect(LaggingAudioEncoder.instances).toHaveLength(1);
+	expect(FakeAudioEncoder.instances).toHaveLength(1);
 });
 
-// The codec has to restart across a capture gap to re-base its output clock, but the audio it still
-// held predates the gap: it is flushed out first, and the marker follows it.
-test("a capture gap flushes the held audio, then marks where it ends", async () => {
+// A codec that still holds chunks at a capture gap stamps them, and the input after the gap, as one
+// contiguous run. Stamping from what was submitted keeps each on its capture clock, and the marker
+// waits behind the held chunks rather than dropping them as pre-gap.
+test("a capture gap marks where the audio before it ends, after the chunks the codec holds", async () => {
 	using _webcodecs = installFakeWebCodecs();
+	FakeAudioEncoder.LAG = 2;
 	using _now = manualAt(0);
 	using env = await setup();
 	const { feed, written } = env;
@@ -457,7 +464,7 @@ test("a capture gap flushes the held audio, then marks where it ends", async ()
 	};
 
 	await push(20_000, 4); // two written, two held
-	await push(200_000, 4); // the restarted codec, so two written and two held
+	await push(200_000, 4); // the held two, the marker, then two more written and two held
 
 	expect(written).toEqual([
 		[20_000, 1],
@@ -468,13 +475,14 @@ test("a capture gap flushes the held audio, then marks where it ends", async ()
 		[200_000, 1],
 		[220_000, 1],
 	]);
-	expect(LaggingAudioEncoder.instances).toHaveLength(1);
+	expect(FakeAudioEncoder.instances).toHaveLength(1);
 });
 
 // A lost track already marked where its audio ends, so what the codec held for it must not open the
 // track that replaces it.
 test("a closed track's held audio stays off its replacement", async () => {
 	using _webcodecs = installFakeWebCodecs();
+	FakeAudioEncoder.LAG = 2;
 	using _now = manualAt(0);
 	using env = await setup();
 	const { track, rendition, feed } = env;
@@ -542,7 +550,7 @@ test("re-enabling with an unchanged capture reuses the probe", async () => {
 	const { encoder, enabled } = env;
 
 	const before = encoder.out.catalog.peek();
-	expect(LaggingAudioEncoder.probes).toHaveLength(1);
+	expect(FakeAudioEncoder.probes).toHaveLength(1);
 
 	enabled.set(false);
 	await settle();
@@ -551,7 +559,7 @@ test("re-enabling with an unchanged capture reuses the probe", async () => {
 	enabled.set(true);
 	await settle(2);
 	expect(encoder.out.catalog.peek()).toEqual(before);
-	expect(LaggingAudioEncoder.probes).toHaveLength(1);
+	expect(FakeAudioEncoder.probes).toHaveLength(1);
 });
 
 test("re-enabling with a changed sample rate probes again", async () => {
@@ -568,7 +576,7 @@ test("re-enabling with a changed sample rate probes again", async () => {
 	for (let config = await configuring; config.sampleRate !== 24_000; config = await configuring) {
 		configuring = configured();
 	}
-	expect(LaggingAudioEncoder.probes.map((probe) => probe.sampleRate)).toEqual([48_000, 24_000]);
+	expect(FakeAudioEncoder.probes.map((probe) => probe.sampleRate)).toEqual([48_000, 24_000]);
 	expect(encoder.out.catalog.peek()?.enabled).toBe(false);
 
 	enabled.set(true);
@@ -577,6 +585,71 @@ test("re-enabling with a changed sample rate probes again", async () => {
 	expect(encoder.out.catalog.peek()?.enabled).toBeUndefined();
 });
 
+// Push-to-talk: a mute sends nothing and ends the utterance with a marker, while the rendition stays
+// enabled and its track stays the same, so a listener hears the next press with no catalog update.
+test("muting sends nothing and marks where the audio ends, keeping the rendition enabled", async () => {
+	using _webcodecs = installFakeWebCodecs();
+	using env = await setup();
+	const { encoder, feed, written, rendition } = env;
+
+	const push = async (start: number, count: number) => {
+		for (let i = 0; i < count; i++) {
+			await feed.push({ timestamp: Micro(start + i * 20_000), channels: [new Float32Array(960)] });
+		}
+		await feed.drain();
+	};
+
+	const before = encoder.out.catalog.peek();
+	expect(before?.enabled).toBeUndefined();
+	await push(20_000, 2);
+
+	encoder.muted.set(true);
+	await settle();
+	expect(encoder.out.active.peek()).toBe(false);
+	await push(60_000, 3); // sent nowhere
+	expect(rendition.config.peek()).toEqual(before as never);
+
+	encoder.muted.set(false);
+	await settle();
+	expect(encoder.out.active.peek()).toBe(true);
+	await push(120_000, 2);
+
+	expect(written).toEqual([
+		[20_000, 1],
+		[40_000, 1],
+		[60_000, 0],
+		[120_000, 1],
+		[140_000, 1],
+	]);
+	expect(rendition.config.peek()).toEqual(before as never);
+	expect(FakeAudioEncoder.instances).toHaveLength(1);
+	expect(FakeAudioEncoder.probes).toHaveLength(1);
+});
+
+// With `capture="release"` a mute closes the microphone, taking its format away. The rendition stays
+// advertised, still enabled, through the mute and while the reopened microphone resolves.
+test("a muted rendition keeps its config enabled while its capture is released", async () => {
+	using _webcodecs = installFakeWebCodecs();
+	using env = await setup();
+	const { encoder, capture } = env;
+
+	const before = encoder.out.catalog.peek();
+	encoder.muted.set(true);
+	const format = capture.out.format.peek();
+	capture.out.format.set(undefined as never);
+	await settle();
+	expect(encoder.out.catalog.peek()).toEqual(before);
+
+	encoder.muted.set(false);
+	await settle();
+	expect(encoder.out.catalog.peek()).toEqual(before);
+
+	capture.out.format.set(format);
+	await settle(10);
+	expect(encoder.out.catalog.peek()).toEqual(before);
+	expect(FakeAudioEncoder.probes).toHaveLength(1);
+});
+
 // Chrome stamps encoder output from its first input, ignoring later jumps, so audio resumed after a
 // long mute must still carry its capture timestamps rather than trail them by the mute.
 test("audio resumed after a multi-second mute carries its capture timestamps", async () => {
@@ -591,7 +664,7 @@ test("audio resumed after a multi-second mute carries its capture timestamps", a
 		await feed.drain();
 	};
 
-	await push(20_000, 4); // two written, two held
+	await push(20_000, 4);
 
 	enabled.set(false);
 	await settle();
@@ -599,7 +672,7 @@ test("audio resumed after a multi-second mute carries its capture timestamps", a
 	// Capture keeps running through a five-second mute.
 	await push(100_000, 250);
 	enabled.set(true);
-	await push(5_100_000, 4); // two written, two held
+	await push(5_100_000, 4);
 
 	expect(written).toEqual([
 		[20_000, 1],
@@ -609,8 +682,10 @@ test("audio resumed after a multi-second mute carries its capture timestamps", a
 		[100_000, 0],
 		[5_100_000, 1],
 		[5_120_000, 1],
+		[5_140_000, 1],
+		[5_160_000, 1],
 	]);
-	expect(LaggingAudioEncoder.probes).toHaveLength(1);
+	expect(FakeAudioEncoder.probes).toHaveLength(1);
 });
 
 // Closing tears down the subscription and the pipeline, which both end the epoch; cleanups run
@@ -623,21 +698,23 @@ test("closing with a subscriber attached marks the end once before the track clo
 	for (let i = 0; i < 4; i++) {
 		await feed.push({ timestamp: Micro(20_000 + i * 20_000), channels: [new Float32Array(960)] });
 	}
-	await feed.drain(); // two written, two held
+	await feed.drain();
 
 	encoder.close();
 
 	expect(written).toEqual([
 		[20_000, 1],
 		[40_000, 1],
+		[60_000, 1],
+		[80_000, 1],
 		[100_000, 0],
 	]);
 	expect(track.closed.peek()).toBeDefined();
 });
 
-// A push that completes several frames is still one continuous stream, so it must not restart the
-// encoder and drop the chunks it holds.
-test("a push completing several frames keeps the encoder running", async () => {
+// A push that completes several frames is still one continuous stream, so it must not break the
+// timeline between them.
+test("a push completing several frames stays one stream", async () => {
 	using _webcodecs = installFakeWebCodecs();
 	using env = await setup();
 	const { feed, written } = env;
@@ -653,6 +730,8 @@ test("a push completing several frames keeps the encoder running", async () => {
 		[38_700, 1],
 		[58_700, 1],
 		[78_700, 1],
+		[98_700, 1],
+		[118_700, 1],
 	]);
 });
 
@@ -671,7 +750,7 @@ test("a group duration packs frames until the minimum and restarts after a break
 		await feed.drain();
 	};
 
-	await push(7); // five written, two held
+	await push(5);
 	expect(groups).toEqual([5]);
 	expect(appended[0].closed.peek()).toBeUndefined();
 	await push(2); // the next frame opens a new group and closes the first
@@ -681,15 +760,16 @@ test("a group duration packs frames until the minimum and restarts after a break
 	enabled.set(false);
 	await settle();
 
+	await push(2); // nothing publishing
 	enabled.set(true);
-	await push(4); // the restarted codec, so two written and two held
+	await push(2);
 
 	expect(written.map(([timestamp]) => timestamp)).toEqual([
-		20_000, 40_000, 60_000, 80_000, 100_000, 120_000, 140_000, 160_000, 180_000, 200_000, 200_000, 220_000,
+		20_000, 40_000, 60_000, 80_000, 100_000, 120_000, 140_000, 160_000, 200_000, 220_000,
 	]);
-	// 120ms opens the next group, closing the five frames at 20-100ms. The break flushes 160-180ms
-	// into that group and ends it early, so resumed frames start a fresh group after the marker.
-	expect(groups).toEqual([5, 4, 1, 2]);
+	// 120ms opens the next group, closing the five frames at 20-100ms. The break ends that group
+	// early, so resumed frames start a fresh group after the marker.
+	expect(groups).toEqual([5, 2, 1, 2]);
 });
 
 test("default audio groups carry twenty milliseconds", async () => {
@@ -705,7 +785,7 @@ test("default audio groups carry twenty milliseconds", async () => {
 			{ mime: "opus", frameDuration: Milli(frameMs) },
 			groupMs === undefined ? undefined : Milli(groupMs),
 		);
-		for (let index = 0; index < packets * 2 + LaggingAudioEncoder.LAG; index++) {
+		for (let index = 0; index < packets * 2 + FakeAudioEncoder.LAG; index++) {
 			await env.feed.push({
 				timestamp: Micro(20_000 + index * frameMs * 1000),
 				channels: [new Float32Array(frameMs * 48)],
@@ -750,6 +830,8 @@ test("the catalog bitrate only rises", async () => {
 // this one trailing it, which the catalog advertises as `delay` once a second of it has been measured.
 test("a rendition written behind another advertises delay", async () => {
 	using _webcodecs = installFakeWebCodecs();
+	// Each push writes the frame captured two before it, so the sibling stays ahead.
+	FakeAudioEncoder.LAG = 2;
 	const clock = manualAt(200);
 
 	try {
@@ -760,8 +842,7 @@ test("a rendition written behind another advertises delay", async () => {
 		expect(encoder.out.catalog.peek()?.delay).toBeUndefined();
 
 		// A sibling that stays 100ms ahead of the frames written, with a clock origin that keeps
-		// timestamps nonnegative. The encoder holds two frames, so each push writes the frame captured
-		// two before it.
+		// timestamps nonnegative.
 		const sibling = new Estimator();
 		const start = Nano.toMicro(Nano(now())) - 100_000;
 		const push = async (index: number) => {
@@ -853,7 +934,7 @@ test("a failed audio encoder keeps its last catalog config disabled", async () =
 	using _now = manualAt(0);
 	using _error = spyOn(console, "error").mockImplementation(() => {});
 	using env = await setup();
-	const live = LaggingAudioEncoder.instances.at(-1);
+	const live = FakeAudioEncoder.instances.at(-1);
 	if (!live) throw new Error("expected live audio encoder");
 	const failure = new Error("audio encoder failed");
 	live.fail(failure);
@@ -862,7 +943,7 @@ test("a failed audio encoder keeps its last catalog config disabled", async () =
 	expect(env.encoder.out.error.peek()).toBe(failure);
 	expect(env.encoder.out.catalog.peek()).toMatchObject({ codec: "opus", enabled: false });
 	expect(env.encoder.out.active.peek()).toBe(false);
-	expect(LaggingAudioEncoder.instances).toHaveLength(1);
+	expect(FakeAudioEncoder.instances).toHaveLength(1);
 });
 
 test("audio failure stays local through demand changes and capture format re-arms a fresh track", async () => {
@@ -910,11 +991,11 @@ test("audio failure stays local through demand changes and capture format re-arm
 		const siblingTrack = sibling.track.peek();
 		if (!siblingTrack) throw new Error("expected demanded sibling track");
 		expect(siblingTrack.appendGroup().sequence).toBe(0n);
-		await push(0, 1);
-		expect((await subscriber.largest())?.group).toBe(0n);
+		await push(0, 1); // a group per frame
+		expect((await subscriber.largest())?.group).toBe(2n);
 		catalog = new Json.Snapshot.Consumer<Catalog.Root>({ track: net.track(Broadcast.CATALOG_TRACK) });
 		expect((await catalog.latest())?.value.audio?.renditions.audio?.enabled).not.toBe(false);
-		const live = LaggingAudioEncoder.instances.at(-1);
+		const live = FakeAudioEncoder.instances.at(-1);
 		if (!live) throw new Error("expected live audio encoder");
 		const failure = new Error("audio codec failed");
 		live.fail(failure);
@@ -923,7 +1004,7 @@ test("audio failure stays local through demand changes and capture format re-arm
 		expect(encoder.out.error.peek()).toBe(failure);
 		expect((await catalog.latest())?.value.audio?.renditions.audio?.enabled).toBe(false);
 		expect(encoder.out.active.peek()).toBe(false);
-		const instances = LaggingAudioEncoder.instances.length;
+		const instances = FakeAudioEncoder.instances.length;
 		subscriber.close();
 		subscriber = net.track("audio").subscribe();
 		broadcast.audio("audio/new");
@@ -935,7 +1016,7 @@ test("audio failure stays local through demand changes and capture format re-arm
 		expect(subscriber.closed.peek()).toBeDefined();
 		expect(encoder.out.error.peek()).toBe(failure);
 		expect(encoder.out.catalog.peek()?.enabled).toBe(false);
-		expect(LaggingAudioEncoder.instances).toHaveLength(instances);
+		expect(FakeAudioEncoder.instances).toHaveLength(instances);
 		expect(broadcast.net.peek()).toBe(net);
 		expect(announced?.active.peek()?.instance).toBe(epoch);
 		expect(siblingTrack.appendGroup().sequence).toBe(1n);
@@ -953,7 +1034,7 @@ test("audio failure stays local through demand changes and capture format re-arm
 		recovered = net.track(config.track).subscribe();
 		await settle();
 		await push(3, 2);
-		expect((await recovered.largest())?.group).toBe(0n);
+		expect((await recovered.largest())?.group).toBe(2n);
 		expect(encoder.out.active.peek()).toBe(true);
 		expect(recovered.closed.peek()).toBeUndefined();
 		expect(broadcast.net.peek()).toBe(net);
@@ -983,7 +1064,7 @@ test("an audio failure without demand still recovers under a fresh track name",
 		await settle();
 		const net = broadcast.net.peek();
 		if (!net) throw new Error("expected network broadcast");
-		const live = LaggingAudioEncoder.instances.at(-1);
+		const live = FakeAudioEncoder.instances.at(-1);
 		if (!live) throw new Error("expected audio encoder without demand");
 		const failure = new Error("idle audio encoder failed");
 		live.fail(failure);
@@ -1028,7 +1109,7 @@ test.each(["failure first", "config first"])(
 			await settle();
 			const net = broadcast.net.peek();
 			if (!net) throw new Error("expected network broadcast");
-			const live = LaggingAudioEncoder.instances.at(-1);
+			const live = FakeAudioEncoder.instances.at(-1);
 			if (!live) throw new Error("expected idle audio encoder");
 			const reconfiguring = configured();
 			if (order === "config first") encoder.codec.set({ mime: "opus", bitrate: 64_000 });
@@ -1084,7 +1165,7 @@ test.each([undefined, false, true])(
 			};
 
 			await push(4);
-			expect(encoder.out.stats.peek().frames).toBe(onDemand === false ? 2 : 0);
+			expect(encoder.out.stats.peek().frames).toBe(onDemand === false ? 4 : 0);
 			late = net.track("audio").subscribe({ delay: { max: Milli(10_000) } });
 			await settle();
 			expect(encoder.out.active.peek()).toBe(true);
@@ -1155,7 +1236,7 @@ test("a backlog encode refusal aborts its rendition when demand arrives", async
 		await settle();
 		await feed.push({ timestamp: Micro(0), channels: [new Float32Array(960)] });
 		await feed.drain();
-		const live = LaggingAudioEncoder.instances.at(-1);
+		const live = FakeAudioEncoder.instances.at(-1);
 		if (!live) throw new Error("expected configured encoder");
 		const failure = new Error("codec refused buffered input");
 		using _encode = spyOn(live, "encode").mockImplementation(() => {
@@ -1203,13 +1284,14 @@ test("default audio replays the last second after three seconds without a subscr
 		if (!net) throw new Error("expected network broadcast");
 		late = net.track("audio").subscribe({ delay: { max: Milli(1000) } });
 		await settle();
-		expect(encoder.out.stats.peek().frames).toBe(50 - LaggingAudioEncoder.LAG);
+		expect(encoder.out.stats.peek().frames).toBe(50);
 		for (let index = 150; index < 153; index++) {
 			await feed.push({ timestamp: Micro(index * 20_000), channels: [new Float32Array(960)] });
 		}
 		await feed.drain();
+		// The subscription's one second reaches back from the newest frame, 152, to 102.
 		const reader = late.ordered();
-		for (let index = 100; index < 151; index++) {
+		for (let index = 102; index < 153; index++) {
 			const group = await reader.nextGroup();
 			if (!group) throw new Error("expected buffered group");
 			const frame = await group.readFrame();
@@ -1324,7 +1406,7 @@ test("expired raw audio ends the epoch before the replay resumes", async () => {
 
 test("Opus description is probed with the exact live config before advertising", async () => {
 	using _codecs = installFakeWebCodecs();
-	LaggingAudioEncoder.description = (config) => new TextEncoder().encode(JSON.stringify(config));
+	FakeAudioEncoder.description = (config) => new TextEncoder().encode(JSON.stringify(config));
 	using env = await setup(new Order(), {
 		mime: "opus",
 		frameDuration: Milli(2.5),
@@ -1334,14 +1416,14 @@ test("Opus description is probed with the exact live config before advertising",
 		bitrate: 64000,
 	});
 	expect(env.encoder.out.catalog.peek()?.description).toBe(Buffer.from(JSON.stringify(env.config)).toString("hex"));
-	expect(LaggingAudioEncoder.probes).toEqual([env.config]);
-	expect(LaggingAudioEncoder.instances).toHaveLength(1);
+	expect(FakeAudioEncoder.probes).toEqual([env.config]);
+	expect(FakeAudioEncoder.instances).toHaveLength(1);
 	expect(env.written).toHaveLength(0);
 	const configuring = configured();
 	env.capture.in.source.set({ track: {}, kind: "voice" } as never);
 	const voice = await configuring;
 	expect(voice.opus).toMatchObject({ application: "voip", signal: "voice" });
-	expect(LaggingAudioEncoder.probes.at(-1)).toEqual(voice);
+	expect(FakeAudioEncoder.probes.at(-1)).toEqual(voice);
 	expect(env.encoder.out.catalog.peek()?.description).toBe(Buffer.from(JSON.stringify(voice)).toString("hex"));
 });
 
@@ -1385,7 +1467,7 @@ test.each([false, true])("audio retained before a disable is encoded on demand (
 			expect(encoder.out.stats.peek().frames).toBe(0);
 			return;
 		}
-		// The codec is flushed after the history, since nothing follows it while disabled.
+		// The history is encoded and its marker follows at once, since nothing else is owed while disabled.
 		expect(encoder.out.stats.peek().frames).toBe(4);
 		const reader = late.ordered();
 		for (let index = 0; index < 4; index++) {
@@ -1404,7 +1486,7 @@ test.each([false, true])("audio retained before a disable is encoded on demand (
 });
 
 // Re-enabled before anyone wanted it, the retained audio stays ahead of the break: all of it is
-// encoded and flushed before the marker, then the resumed audio starts a fresh epoch.
+// encoded before the marker, then the resumed audio starts a fresh epoch.
 test("audio retained across a disable and re-enable is served before the break", async () => {
 	using _webcodecs = installFakeWebCodecs();
 	const clock = new Manual();
@@ -1443,8 +1525,8 @@ test("audio retained across a disable and re-enable is served before the break",
 		if (!net) throw new Error("expected network broadcast");
 		late = net.track("audio").subscribe({ delay: { max: Milli(1000) } });
 		await settle(20);
-		// The four retained frames are flushed before the marker, then the restarted codec holds two.
-		expect(encoder.out.stats.peek().frames).toBe(5);
+		// The four retained frames, then the marker, then the three resumed.
+		expect(encoder.out.stats.peek().frames).toBe(7);
 		expect(discontinuity.mock.calls.map(([end]) => end)).toEqual([Micro(80_000)]);
 		const reader = late.ordered();
 		const read: [number, number][] = [];
@@ -1473,8 +1555,8 @@ test("audio retained across a disable and re-enable is served before the break",
 	}
 });
 
-// A replay submits the whole backlog at once, so restarting the codec at a gap inside it would drop
-// every frame of that drain still queued in a real codec. The gap flushes them out first instead.
+// A replay submits the whole backlog at once, so a gap inside it must break the timeline without
+// dropping any frame of that drain still owed by the codec.
 test("a capture gap inside replayed audio keeps every frame on both sides of it", async () => {
 	using _webcodecs = installFakeWebCodecs();
 	const clock = new Manual();
@@ -1507,8 +1589,8 @@ test("a capture gap inside replayed audio keeps every frame on both sides of it"
 		if (!net) throw new Error("expected network broadcast");
 		late = net.track("audio").subscribe({ delay: { max: Milli(1000) } });
 		await settle(20);
-		// Every frame before the gap, then the restarted codec holds two of the four after it.
-		expect(encoder.out.stats.peek().frames).toBe(6);
+		// Every frame on both sides of the gap.
+		expect(encoder.out.stats.peek().frames).toBe(8);
 		expect(discontinuity.mock.calls.map(([end]) => end)).toEqual([Micro(80_000)]);
 		const reader = late.ordered();
 		const read: [number, number][] = [];
@@ -1538,8 +1620,8 @@ test("a capture gap inside replayed audio keeps every frame on both sides of it"
 	}
 });
 
-// A zero max age retains nothing, not even the frame waiting behind a gap's flush, so the gap must not
-// depend on the backlog to be noticed, or every frame after it would wait forever.
+// A zero max age retains nothing, so a gap must not depend on the backlog to be noticed, or every
+// frame after it would wait forever.
 test("a capture gap without retention resumes the audio after it", async () => {
 	using _webcodecs = installFakeWebCodecs();
 	const clock = new Manual();
@@ -1570,12 +1652,11 @@ test("a capture gap without retention resumes the audio after it", async () => {
 		subscriber = net.track("audio").subscribe();
 		await settle();
 
-		await push(0, 4); // two written, two held
-		// The first frame after the gap waits behind the flush, where nothing is retained.
+		await push(0, 4);
 		await push(200_000, 4);
 
 		expect(encode.mock.calls.map(([, timestamp]) => timestamp)).toEqual(
-			[0, 20_000, 40_000, 60_000, 220_000].map((t) => Micro(t)),
+			[0, 20_000, 40_000, 60_000, 200_000, 220_000, 240_000, 260_000].map((t) => Micro(t)),
 		);
 		expect(discontinuity.mock.calls.map(([end]) => end)).toEqual([Micro(80_000)]);
 	} finally {
@@ -1588,7 +1669,7 @@ test("a capture gap without retention resumes the audio after it", async () => {
 	}
 });
 
-// Two disables before anyone listens leave two breaks in the backlog: each flushes the audio before it.
+// Two disables before anyone listens leave two breaks in the backlog: each follows the audio before it.
 test("every disable retained before demand gets its own break", async () => {
 	using _webcodecs = installFakeWebCodecs();
 	const clock = new Manual();
@@ -1676,10 +1757,9 @@ test("a break after expired history keeps the resumed audio flowing", async () =
 		if (!net) throw new Error("expected network broadcast");
 		late = net.track("audio").subscribe({ delay: { max: Milli(1000) } });
 		await settle(20);
-		// The codec holds two of the three resumed frames.
-		expect(encoder.out.stats.peek().frames).toBe(1);
-		await push(2_060_000, 2);
 		expect(encoder.out.stats.peek().frames).toBe(3);
+		await push(2_060_000, 2);
+		expect(encoder.out.stats.peek().frames).toBe(5);
 	} finally {
 		late?.close();
 		encoder.close();
@@ -1689,8 +1769,8 @@ test("a break after expired history keeps the resumed audio flowing", async () =
 });
 
 // Demand that arrives after a re-enable but before any resumed frame drains the retained audio first,
-// so the break still flushes it rather than cutting it off with the codec mid-flight.
-test("demand between a re-enable and the resumed audio still flushes the break", async () => {
+// so the break follows it rather than cutting it off with the codec mid-flight.
+test("demand between a re-enable and the resumed audio still breaks after the retained audio", async () => {
 	using _webcodecs = installFakeWebCodecs();
 	const clock = new Manual();
 	const installed = clock.install();
@@ -1729,8 +1809,7 @@ test("demand between a re-enable and the resumed audio still flushes the break",
 		expect(discontinuity.mock.calls.map(([end]) => end)).toEqual([Micro(80_000)]);
 
 		await push(200_000, 3);
-		// The restarted codec holds two of the three resumed frames.
-		expect(encoder.out.stats.peek().frames).toBe(5);
+		expect(encoder.out.stats.peek().frames).toBe(7);
 		expect(discontinuity).toHaveBeenCalledTimes(1);
 	} finally {
 		discontinuity.mockRestore();
diff --git a/js/publish/src/audio/encoder.ts b/js/publish/src/audio/encoder.ts
index c1203ad7bd7..61722066205 100644
--- a/js/publish/src/audio/encoder.ts
+++ b/js/publish/src/audio/encoder.ts
@@ -91,11 +91,12 @@ export interface Stats {
 
 /** Signals the encoder reads. */
 export type EncoderInput = {
-	// Whether to encode this rendition. Defaults to true. When false it stops taking capture, ending the
+	// Whether to serve this rendition. Defaults to true. When false it stops taking capture, ending the
 	// epoch, but stays in the catalog with `enabled: false` and its last config, and stays registered so a
 	// subscriber still gets an idle track. Audio retained before the disable stays too: a subscriber
 	// still gets it encoded, and it expires on the broadcast's `maxAge`. The codec stays configured, so
-	// re-enabling resumes at once.
+	// re-enabling resumes at once. For a pause the rendition comes back from, such as push-to-talk, use
+	// `muted` instead, which costs subscribers no catalog update.
 	enabled: Getter<boolean>;
 
 	// The broadcast to register the rendition on. Undefined resolves the config but has nowhere to publish.
@@ -116,6 +117,9 @@ export type EncoderProps = Inputs<EncoderInput> & {
 	// User tuning knobs. Seed a value or wire a Signal; also live-editable via the matching field.
 	volume?: number | Signal<number>;
 
+	// Send no audio while true, keeping the rendition enabled and its subscribers attached. Defaults to false.
+	muted?: boolean | Signal<boolean>;
+
 	// Codec selection plus encoder settings. Defaults to "opus".
 	codec?: Codec | Signal<Codec>;
 
@@ -135,9 +139,9 @@ export type EncoderOutput = {
 	// browser supports `sinkId`, so nothing connected to its destination is heard. Undefined for a
 	// source that isn't a track.
 	root: Signal<AudioNode | undefined>;
-	// True while encoding capture: enabled with a captured format and a track, which also takes a
-	// subscriber unless the broadcast's `onDemand` is false. Retained audio encoded for a subscriber
-	// while disabled does not count.
+	// True while encoding capture: enabled and unmuted with a captured format and a track, which also
+	// takes a subscriber unless the broadcast's `onDemand` is false. Retained audio encoded for a
+	// subscriber while paused does not count.
 	active: Signal<boolean>;
 	// Cumulative output totals (frames, bytes) measured while serving, and the target bitrate.
 	stats: Signal<Stats>;
@@ -168,6 +172,12 @@ export class Encoder {
 
 	/** Linear gain applied before encoding, where 1 is unity. Each change ramps over 50 ms, so a mute is silent once it passes. */
 	volume: Signal<number>;
+	/**
+	 * Whether to send nothing, as push-to-talk does between presses. Unlike `enabled`, the rendition
+	 * stays enabled in the catalog and its subscribers stay attached, so the next audio reaches them
+	 * at once; each muted span is a declared end, which a player fills as intentional silence.
+	 */
+	muted: Signal<boolean>;
 	/** The live-editable codec selection plus its encoder settings. */
 	codec: Signal<Codec>;
 	/**
@@ -261,6 +271,9 @@ export class Encoder {
 	// config as disabled until the re-enabled capture resolves a new one. A capture that never reopens
 	// leaves it disabled, which is accurate: no frames are coming.
 	#paused = false;
+	// Whether it was muted since a config last resolved, so it keeps advertising its last config,
+	// enabled, while a released capture is closed and until the reopened one resolves.
+	#muted = false;
 
 	constructor(name: string, props?: EncoderProps) {
 		// `source` moved to Audio.Capture, which renditions share. TypeScript catches this, but a
@@ -278,6 +291,7 @@ export class Encoder {
 			bandwidth: getter(props?.bandwidth),
 		};
 		this.volume = Signal.from(props?.volume ?? 1);
+		this.muted = Signal.from(props?.muted ?? false);
 		this.codec = Signal.from<Codec>(props?.codec ?? "opus");
 		this.groupDuration = Signal.from(props?.groupDuration ?? Milli(20));
 
@@ -463,7 +477,7 @@ export class Encoder {
 		});
 
 		effect.run((effect) => {
-			const enabled = effect.get(this.in.enabled);
+			const enabled = effect.get(this.in.enabled) && !effect.get(this.muted);
 			const capture = effect.get(this.in.capture);
 			const format = capture ? effect.get(capture.out.format) : undefined;
 			const track = effect.get(rendition.track);
@@ -473,7 +487,7 @@ export class Encoder {
 
 			const onDemand = effect.get(broadcast.in.onDemand) ?? true;
 			const demanded = !!track && effect.get(track.demand().wanted) !== undefined;
-			// Not gated on `enabled`: a disabled rendition takes no capture, but still encodes what it retained.
+			// Not gated on `enabled` or `muted`: a paused rendition takes no capture, but still encodes what it retained.
 			this.#encoding = !!format && !!track && !fatal && (!onDemand || demanded);
 			effect.set(this.#out.active, enabled && this.#encoding, false);
 			try {
@@ -490,7 +504,7 @@ export class Encoder {
 		// encoder's share is honest. Wait for a bitrate so we never claim 0. The grant is ignored:
 		// following it for Opus is out of scope.
 		effect.run((effect) => {
-			const enabled = effect.get(this.in.enabled);
+			const enabled = effect.get(this.in.enabled) && !effect.get(this.muted);
 			const track = effect.get(rendition.track);
 			const allocator = effect.get(this.in.bandwidth);
 			if (!enabled || !track || !allocator || effect.get(this.#out.error)) return;
@@ -608,21 +622,23 @@ export class Encoder {
 		effect.cleanup(() => this.#failures.update((n) => n - 1));
 	}
 
-	// Publish the probed config before the first frame reaches the track. A
-	// disabled rendition keeps its last config, since muting also releases the capture, and stays
-	// disabled after re-enabling until the reopened capture reports its format.
+	// Publish the probed config before the first frame reaches the track. A disabled rendition keeps its
+	// last config, since a disable may also release the capture, and stays disabled after re-enabling
+	// until the reopened capture reports its format. A muted one keeps it enabled throughout.
 	#runCatalog(effect: Effect): void {
 		const estimate = effect.get(this.#estimate);
 		const enabled = effect.get(this.in.enabled) && !effect.get(this.#out.error);
 		const slot = this.#current(effect);
 		if (!enabled) this.#paused = true;
+		if (effect.get(this.muted)) this.#muted = true;
 		const config = enabled ? effect.get(this.#config)?.catalog : undefined;
 		if (!config) {
-			const last = this.#paused ? slot.last : undefined;
-			effect.set(this.#out.catalog, last && { ...last, ...estimate, enabled: false });
+			const last = this.#paused || this.#muted ? slot.last : undefined;
+			effect.set(this.#out.catalog, last && { ...last, ...estimate, ...(this.#paused && { enabled: false }) });
 			return;
 		}
 		this.#paused = false;
+		this.#muted = false;
 
 		// The catalog bitrate is the most this track has been configured for, so lowering the knob
 		// retunes the encoder without lowering what the catalog advertises.
@@ -646,15 +662,19 @@ export class Encoder {
 		return opus;
 	}
 
-	// End the epoch with a discontinuity marker (see Container.Legacy.Producer.discontinuity) where the
-	// submitted media ends, so a subscriber that stays across the break, or joins during it, doesn't
-	// read the audio before it as live. Called whenever the track goes away or the pipeline stops.
-	#cut(): void {
-		const end = this.#next;
-		this.#next = undefined;
-		const live = this.#live;
-		if (end === undefined || !live || live.track.closed.peek() !== undefined) return;
+	// End the epoch with a discontinuity marker (see Container.Legacy.Producer.discontinuity) at `end`,
+	// by default where the submitted media ends, so a subscriber that stays across the break, or joins
+	// during it, doesn't read the audio before it as live. A marker at or below the newest one is
+	// already covered by it.
+	#cut(end = this.#next): void {
+		if (end === undefined) return;
+		if (this.#next !== undefined && this.#next <= end) this.#next = undefined;
+		if (this.#floor !== undefined && end <= this.#floor) return;
+		// The epoch ends here even when no track is left to mark, so whatever the codec still owes for
+		// it stays off the next track.
 		this.#floor = end;
+		const live = this.#live;
+		if (!live || live.track.closed.peek() !== undefined) return;
 		live.producer.discontinuity(end);
 		live.start = undefined;
 	}
@@ -692,11 +712,31 @@ export class Encoder {
 				let resampler = createResampler();
 				let framer = createFramer(resolved, config.sampleRate);
 
+				// What the codec still owes, in submission order: each input's timestamp, or a break whose
+				// marker goes down once every chunk before it is out. Chunks are stamped from here, never
+				// by the codec: Chrome and Firefox stamp input after a gap as if it were contiguous.
+				// Every browser emits one chunk per input, in order, so a codec that holds a chunk only
+				// delays its stamp, and a break needs no flush.
+				const owed: ({ timestamp: Micro } | { cut: Micro })[] = [];
+				// Write the marker of every break the codec has caught up with.
+				const settle = () => {
+					for (let next = owed[0]; next && "cut" in next; next = owed[0]) {
+						owed.shift();
+						this.#cut(next.cut);
+					}
+				};
+
 				const encoder = new AudioEncoder({
 					output: (frame) => {
 						if (frame.type !== "key") {
 							throw new Error("only key frames are supported");
 						}
+						const input = owed.shift();
+						if (!input || "cut" in input) {
+							this.#abort(new Error("the audio encoder emitted a chunk for no input"));
+							return;
+						}
+						const timestamp = input.timestamp;
 
 						this.#out.stats.update((stats) => ({
 							...stats,
@@ -705,21 +745,20 @@ export class Encoder {
 						}));
 
 						const live = this.#live;
-						if (!live) return;
-						const timestamp = frame.timestamp as Micro;
-						if (this.#floor !== undefined && timestamp < this.#floor) return;
-
-						// Every audio frame decodes on its own, so any of them can open a group: the
-						// first one at or past the minimum after the open group's start. Frames forward
-						// as they are written rather than waiting for the group to fill. A dropped
-						// group leaves a gap for the codec's PLC.
-						const keyframe = live.start === undefined || timestamp - live.start >= this.#groupDuration;
-						if (keyframe) live.start = timestamp;
-						live.producer.encode(frame, timestamp, keyframe);
-						const history = this.#history !== undefined && timestamp < this.#history;
-						if (!history && this.#estimator.write(frame.timestamp, order, keyframe)) {
-							this.#estimate.set({ ...this.#estimator.estimate });
+						if (live && (this.#floor === undefined || timestamp >= this.#floor)) {
+							// Every audio frame decodes on its own, so any of them can open a group: the
+							// first one at or past the minimum after the open group's start. Frames forward
+							// as they are written rather than waiting for the group to fill. A dropped
+							// group leaves a gap for the codec's PLC.
+							const keyframe = live.start === undefined || timestamp - live.start >= this.#groupDuration;
+							if (keyframe) live.start = timestamp;
+							live.producer.encode(frame, timestamp, keyframe);
+							const history = this.#history !== undefined && timestamp < this.#history;
+							if (!history && this.#estimator.write(timestamp, order, keyframe)) {
+								this.#estimate.set({ ...this.#estimator.estimate });
+							}
 						}
+						settle();
 					},
 					error: (err) => {
 						if (!aborted.aborted) this.#abort(err);
@@ -738,15 +777,13 @@ export class Encoder {
 					return;
 				}
 
-				// Where the next frame starts if it continues the last one encoded.
+				// Where the next frame starts if it continues the last one submitted, unset after a break.
 				let contiguous: Micro | undefined;
 
-				// Disabled: capture is dropped, while the retained audio stays reachable.
+				// Disabled or muted: capture is dropped, while the retained audio stays reachable.
 				let paused = false;
-				// A disable left retained audio, so the timeline breaks after it rather than at once.
+				// A pause left retained audio, so the timeline breaks after it rather than at once.
 				let breakPending = false;
-				// The codec is flushing before a break, so nothing new reaches it until the marker is down.
-				let flushing = false;
 
 				const backlog = new Backlog(retention, config.sampleRate);
 				const deadline = new Signal<Micro | undefined>(undefined);
@@ -763,18 +800,22 @@ export class Encoder {
 					);
 				});
 
-				// Whether a gap (a lost track, or a capture discontinuity) separates `data` from the last
-				// frame the codec took. Chrome stamps encoder output from the first input's timestamp
-				// plus the samples encoded since, ignoring any later jump, so across a gap the output
-				// would trail the capture clock by the gap, and the next gap's marker would then sit
-				// ahead of everything encoded after it. So a gap restarts the codec, which re-bases it.
-				// Timestamps round to whole microseconds, so a chunk's timestamp and the marker placed
-				// at the next frame's start agree exactly.
-				const gap = (data: AudioFrame) => contiguous !== undefined && Math.round(data.timestamp) !== contiguous;
+				// End the epoch where the submitted audio ends, once the codec has emitted all of it: a
+				// marker placed while chunks are still owed would drop them as pre-gap.
+				const cut = () => {
+					if (contiguous === undefined) return;
+					owed.push({ cut: contiguous });
+					contiguous = undefined;
+					settle();
+				};
 
-				// Encode one frame, which must not follow a gap: the gap's flush and restart come first.
+				// Encode one frame, breaking the timeline first if it does not continue the last one.
+				// Timestamps round to whole microseconds, so a chunk's timestamp and the marker placed at
+				// the next frame's start agree exactly.
 				const submit = (data: AudioFrame) => {
 					const timestamp = Math.round(data.timestamp) as Micro;
+					if (contiguous !== undefined && timestamp !== contiguous) cut();
+
 					const joinedLength = data.channels.reduce((total, channel) => total + channel.length, 0);
 					const joined = new Float32Array(joinedLength);
 
@@ -793,6 +834,7 @@ export class Encoder {
 						transfer: [joined.buffer],
 					});
 
+					owed.push({ timestamp });
 					encoder.encode(frame);
 					frame.close();
 					contiguous = Math.round(
@@ -800,64 +842,29 @@ export class Encoder {
 					) as Micro;
 					this.#next = contiguous;
 				};
-				// The next frame starts a new epoch, so it starts the codec afresh too.
-				const restart = () => {
-					encoder.reset();
-					encoder.configure(encoderConfig);
-					contiguous = undefined;
-				};
-				// End the epoch where the submitted audio ends, once the codec has emitted all of it: a
-				// marker placed while chunks are still in flight would drop them as pre-gap.
-				const cutAfterFlush = () => {
-					if (flushing) return;
-					// Nothing reached the codec since it last started, so nothing is in flight.
-					if (contiguous === undefined) return this.#cut();
-					// The epoch already ended without a flush (a lost track, or expired history), so what
-					// the codec holds sits below that marker and has nowhere to go.
-					if (this.#next === undefined) return restart();
-					flushing = true;
-					encoder
-						.flush()
-						.then(() => {
-							if (aborted.aborted) return;
-							flushing = false;
-							this.#cut();
-							restart();
-							if (this.#encoding) pipeline.drain();
-						})
-						.catch((error) => {
-							if (!aborted.aborted) this.#abort(error);
-						});
-				};
 
 				const pipeline: Pipeline = {
 					channelCount: config.numberOfChannels,
 					drain: () => {
-						if (flushing) return;
 						backlog.expire(clock());
-						// Expired history is a real gap, unlike a loss of demand: end the epoch where
-						// the encoded audio stops, so its last frame isn't stretched across the gap.
-						// What the codec still holds is older than the expired audio, so it is dropped.
-						if (backlog.takeEvicted()) this.#cut();
+						// Expired history is a real gap, unlike a loss of demand: end the epoch where the
+						// encoded audio stops, so its last frame isn't stretched across the gap.
+						if (backlog.takeEvicted()) cut();
 						for (;;) {
 							const frame = backlog.peek();
 							if (!frame) break;
-							// A disable or a gap broke the timeline here; the rest follows once the marker
-							// is down. A cut with nothing in flight lands at once.
-							if (backlog.takeCut() || gap(frame)) {
-								cutAfterFlush();
-								if (flushing) break;
-							}
+							// A pause broke the timeline here.
+							if (backlog.takeCut()) cut();
 							backlog.shift();
 							submit(frame);
 							this.#history = this.#next;
 						}
 						deadline.set(backlog.deadline);
-						// The audio retained before a disable is all encoded, so the break follows it, even
-						// when re-enabled since: resumed audio then waits behind the flush.
+						// The audio retained before a pause is all encoded, so the break follows it, even
+						// when resumed since.
 						if (breakPending && backlog.empty) {
 							breakPending = false;
-							cutAfterFlush();
+							cut();
 						}
 					},
 					push: (captured: AudioFrame) => {
@@ -867,28 +874,28 @@ export class Encoder {
 						const frames = framer.push(input);
 						for (const [i, data] of frames.entries()) {
 							if (!this.#live) continue;
-							const cut = breakPending;
+							const pending = breakPending;
 							breakPending = false;
-							const live = this.#encoding && !flushing && backlog.empty;
-							// Started here rather than from the backlog, which may not keep the frame: a
-							// zero max age retains nothing.
-							if (live && (cut || gap(data))) cutAfterFlush();
-							if (live && !flushing) {
+							if (this.#encoding && backlog.empty) {
+								if (pending) cut();
 								submit(data);
 								continue;
 							}
-							// It waits for a subscriber, or behind the flush before a break.
+							// It waits for a subscriber. Started here rather than from the backlog, which
+							// may not keep the frame: a zero max age retains nothing.
 							const end = frames[i + 1]?.timestamp ?? framer.next;
-							backlog.push(data, end, clock(), cut && !live);
+							backlog.push(data, end, clock(), pending);
 						}
 						deadline.set(backlog.deadline);
 					},
 				};
 
-				// A disable stops taking capture but keeps the codec and retained audio, so a subscriber
-				// still gets that history and re-enabling resumes without reconfiguring.
+				// A disable or a mute stops taking capture but keeps the codec and retained audio, so a
+				// subscriber still gets that history and resuming needs no reconfigure. Neither flushes:
+				// the codec emits what it owes on its own, and a flush would send its lookahead tail at
+				// once, a frame ahead of its media.
 				effect.run((toggle) => {
-					if (toggle.get(this.in.enabled)) {
+					if (toggle.get(this.in.enabled) && !toggle.get(this.muted)) {
 						paused = false;
 						return;
 					}
@@ -896,7 +903,7 @@ export class Encoder {
 					// The capture resumes on a later timeline, so drop the partial frame and filter state.
 					resampler = createResampler();
 					framer = createFramer(resolved, config.sampleRate);
-					if (backlog.empty) cutAfterFlush();
+					if (backlog.empty) cut();
 					else breakPending = true;
 				});
 
diff --git a/js/publish/src/element.ts b/js/publish/src/element.ts
index b45048cf90f..997339c5ec6 100644
--- a/js/publish/src/element.ts
+++ b/js/publish/src/element.ts
@@ -196,7 +196,8 @@ export default class MoqPublish extends HTMLElement {
 	// The preview element, either a <video> (raw source via srcObject) or a <canvas> (rendered frames).
 	#preview = new Signal<HTMLVideoElement | HTMLCanvasElement | undefined>(undefined);
 
-	// Whether to encode each track: connected and allowed by `muted` and `invisible`.
+	// Whether each track publishes: connected and allowed by `muted` and `invisible`. Video encodes only
+	// while it does; muted audio stays served and sends nothing, so an unmute needs no catalog update.
 	#videoEnabled = new Signal(false);
 	#audioEnabled = new Signal(false);
 
@@ -284,7 +285,8 @@ export default class MoqPublish extends HTMLElement {
 
 		this.audio = new Audio.Encoder("audio", {
 			broadcast: this.broadcast,
-			enabled: this.#audioEnabled,
+			enabled: this.#enabled,
+			muted: this.controls.muted,
 			capture: audioCapture,
 			bandwidth: this.connection.allocator,
 		});
@@ -639,8 +641,9 @@ export default class MoqPublish extends HTMLElement {
 	}
 
 	/**
-	 * Whether audio is muted, mirrored by the `muted` attribute. Muting stops encoding; `capture`
-	 * decides whether the microphone stays open.
+	 * Whether audio is muted, mirrored by the `muted` attribute. Muting sends nothing while keeping the
+	 * rendition live, so unmuting reaches every listener at once; `capture` decides whether the
+	 * microphone stays open.
 	 */
 	get muted(): boolean {
 		return this.controls.muted.peek();
diff --git a/js/room/MIGRATE.md b/js/room/MIGRATE.md
index fcc8d39410c..aa3255c32e4 100644
--- a/js/room/MIGRATE.md
+++ b/js/room/MIGRATE.md
@@ -4,6 +4,10 @@ How to update your code for each breaking change, newest first.
 
 ## Unreleased
 
+### Turning the microphone off mutes it ([#7942](https://github.com/moq-dev/moq/pull/7942))
+
+`local.microphoneEnabled.set(false)` still releases the microphone, but the camera broadcast's audio rendition now stays enabled in the catalog, sending nothing, so listeners stay subscribed and hear the next word at once.
+
 ### `claims` refuses an identity with an empty segment ([#6648](https://github.com/moq-dev/moq/pull/6648))
 
 `claims(room, identity)` throws on an identity with a leading, trailing, or doubled `/` instead of collapsing it: pass `alice`, not `alice/`.
diff --git a/js/room/src/local.ts b/js/room/src/local.ts
index aea6db869a0..ff40720cbfb 100644
--- a/js/room/src/local.ts
+++ b/js/room/src/local.ts
@@ -205,10 +205,14 @@ export class Local {
 		});
 		this.#signals.cleanup(() => cameraAudioCapture.close());
 
+		// A muted microphone stays in the catalog and its listeners stay subscribed, so the next word
+		// reaches them at once; its capture is still released.
+		const microphoneMuted = new Signal(!this.microphoneEnabled.peek());
+		this.#signals.run((effect) => microphoneMuted.set(!effect.get(this.microphoneEnabled)));
 		const cameraAudio = new Publish.Audio.Encoder("audio", {
 			broadcast: this.camera,
 			capture: cameraAudioCapture,
-			enabled: this.microphoneEnabled,
+			muted: microphoneMuted,
 			bandwidth,
 		});
 		this.#signals.cleanup(() => cameraAudio.close());
diff --git a/js/watch/MIGRATE.md b/js/watch/MIGRATE.md
index 2131df329e4..85e8af56df0 100644
--- a/js/watch/MIGRATE.md
+++ b/js/watch/MIGRATE.md
@@ -4,6 +4,12 @@ How to update your code for each breaking change, newest first.
 
 ## Unreleased
 
+### A disabled rendition is deselected; a declared silence is not a stall ([#7942](https://github.com/moq-dev/moq/pull/7942))
+
+The audio and video sources no longer keep a rendition selected, and subscribed, once its publisher disables it and no enabled one remains: they deselect it, as the hang draft's MUST NOT select requires, and select it again when it re-enables.
+Push-to-talk no longer needs that hold, since `@moq/publish` mutes by sending nothing instead of disabling.
+When a publisher declares where its audio ends, the player fills the silence that follows with comfort noise at most -60 dBFS, and counts it as neither an underrun nor a stall: `stalled` stays false and the buffering indicator stays hidden.
+
 ### Element reflection and invalid configuration
 
 Property and built-in UI changes now reflect into attributes. Invalid rendering/catalog modes, URLs, numbers, durations, and version lists throw instead of selecting defaults; remove an attribute to use its default.
diff --git a/js/watch/src/audio/buffer.test.ts b/js/watch/src/audio/buffer.test.ts
index aacabd46e21..ab2ac43a6ed 100644
--- a/js/watch/src/audio/buffer.test.ts
+++ b/js/watch/src/audio/buffer.test.ts
@@ -32,6 +32,7 @@ function open(): {
 				stalled,
 				anchored: timestamp !== undefined,
 				underruns: 0,
+				silent: false,
 				epoch,
 			};
 			const handled = new Promise<void>((resolve) =>
@@ -432,7 +433,7 @@ function fake(delay: Milli, buffered = false) {
 		buffered,
 	});
 	const state = (timestamp: Micro, stalled: boolean, epoch: number) => {
-		const data: State = { type: "state", timestamp, stalled, anchored: true, underruns: 0, epoch };
+		const data: State = { type: "state", timestamp, stalled, anchored: true, underruns: 0, silent: false, epoch };
 		port.dispatchEvent(new MessageEvent("message", { data }));
 	};
 	return { buffer, sent, state };
diff --git a/js/watch/src/audio/buffer.ts b/js/watch/src/audio/buffer.ts
index 1bd9e2641bf..446e3c31e44 100644
--- a/js/watch/src/audio/buffer.ts
+++ b/js/watch/src/audio/buffer.ts
@@ -1,7 +1,7 @@
 import { Micro, Milli, type Second } from "@moq/clock";
 import { Effect, type Getter, Signal } from "@moq/signals";
 import { ringHold, ringSamples } from "./latency";
-import type { Data, Init, Latency, Playing, Reset, State, Truncate } from "./render";
+import type { Data, End, Init, Latency, Playing, Reset, State, Truncate } from "./render";
 
 /**
  * Decides when the decode loop may decode a frame, which is how the target delay is split between
@@ -270,6 +270,10 @@ export class AudioBuffer {
 	/** How many times the ring has run dry mid-playback, cumulative. */
 	readonly underruns: Getter<number> = this.#underruns;
 
+	readonly #silent = new Signal<boolean>(false);
+	/** Whether playback is at a declared end, reached or announced before any audio, and nothing has played since. */
+	readonly silent: Getter<boolean> = this.#silent;
+
 	// Backpressure runs off the playhead the worklet reports in its state messages.
 	#backpressure: Backpressure;
 	// Bumped per reset or park. A state message posted before the worklet saw it reports the ring
@@ -322,6 +326,7 @@ export class AudioBuffer {
 				this.#timestamp.set(data.timestamp);
 				this.#stalled.set(data.stalled);
 				this.#underruns.set(data.underruns);
+				this.#silent.set(data.silent);
 				if (data.epoch === this.#epoch) {
 					this.#backpressure.observe(data.anchored ? data.timestamp : undefined, data.stalled);
 				}
@@ -396,12 +401,36 @@ export class AudioBuffer {
 		this.#worklet.port.postMessage(msg);
 	}
 
+	/**
+	 * Note that the publisher declared its audio ends at `timestamp`, less any codec delay that leaves
+	 * the decoded audio short of it, so running dry there plays comfort noise rather than counting as
+	 * an underrun, until the next audio plays.
+	 */
+	end(timestamp: Micro): void {
+		const msg: End = { type: "end", timestamp };
+		this.#worklet.port.postMessage(msg);
+	}
+
 	/** Flush buffered samples and re-stall, ready to anchor the next utterance (buffered mode). */
 	reset(): void {
+		this.#reset(false);
+	}
+
+	/**
+	 * The next utterance after a declared end: flush and re-anchor once playback ran out at the end,
+	 * or keep playing into it while the end's audio still plays. The playhead is unknown here until
+	 * the worklet reports which.
+	 */
+	next(): void {
+		this.#reset(true);
+	}
+
+	#reset(next: boolean): void {
 		this.#epoch++;
 		const msg: Reset = {
 			type: "reset",
 			epoch: this.#epoch,
+			...(next && { next }),
 			...(this.#playing && { playing: this.#playing.peek() }),
 		};
 		this.#worklet.port.postMessage(msg);
diff --git a/js/watch/src/audio/comfort.ts b/js/watch/src/audio/comfort.ts
new file mode 100644
index 00000000000..55bf76b9882
--- /dev/null
+++ b/js/watch/src/audio/comfort.ts
@@ -0,0 +1,59 @@
+// The loudest comfort noise, in RMS: -60 dBFS. Audio that never falls quiet, such as music, would
+// otherwise fill a pause with noise as loud as itself.
+const MAX_LEVEL = 0.001;
+
+/**
+ * Fills a declared silence with white noise at the level of the quietest stretch heard before it, so
+ * a muted talker's background continues instead of the line going dead. The publisher sends nothing
+ * while muted, so the level is measured from the audio the listener played: the quietest 20 ms block
+ * since playback last resumed is the closest thing to the talker's background, and a source that was
+ * already silent there, such as a noise-suppressed microphone, gets none.
+ */
+export class ComfortNoise {
+	readonly #block: number;
+	// The block being measured: summed squares across channels, and the frames in it so far.
+	#sum = 0;
+	#frames = 0;
+	// The mean square of the quietest whole block since playback last resumed.
+	#quietest = Number.POSITIVE_INFINITY;
+	// The RMS of the noise for the current silence.
+	#level = 0;
+	#filling = false;
+
+	constructor(rate: number) {
+		this.#block = Math.max(1, Math.round(rate / 50));
+	}
+
+	/** Measure `output` from `from` up to `to`, just played. */
+	played(output: Float32Array[], from: number, to: number): void {
+		if (to <= from) return;
+		if (this.#filling) {
+			this.#filling = false;
+			this.#quietest = Number.POSITIVE_INFINITY;
+			this.#sum = 0;
+			this.#frames = 0;
+		}
+		for (let i = from; i < to; i++) {
+			for (const channel of output) this.#sum += channel[i] * channel[i];
+			if (++this.#frames < this.#block) continue;
+			this.#quietest = Math.min(this.#quietest, this.#sum / (this.#block * output.length));
+			this.#sum = 0;
+			this.#frames = 0;
+		}
+	}
+
+	/** Fill `output` from `from` up to `to`, or its end, with comfort noise. */
+	fill(output: Float32Array[], from: number, to = output[0].length): void {
+		if (!this.#filling) {
+			this.#filling = true;
+			// A silence after too little audio to measure keeps the previous level.
+			if (Number.isFinite(this.#quietest)) this.#level = Math.min(Math.sqrt(this.#quietest), MAX_LEVEL);
+		}
+		if (this.#level === 0) return;
+		// Uniform noise on [-a, a] has an RMS of a / sqrt(3).
+		const amplitude = this.#level * Math.sqrt(3);
+		for (const channel of output) {
+			for (let i = from; i < to; i++) channel[i] = (Math.random() * 2 - 1) * amplitude;
+		}
+	}
+}
diff --git a/js/watch/src/audio/decoder.test.ts b/js/watch/src/audio/decoder.test.ts
index 9f4646adef9..d87a7b73617 100644
--- a/js/watch/src/audio/decoder.test.ts
+++ b/js/watch/src/audio/decoder.test.ts
@@ -78,8 +78,10 @@ class FakeWorklet {
 					this.#epoch = msg.park;
 				}
 			} else if (msg.type === "truncate") this.ring?.truncate(msg.timestamp);
+			else if (msg.type === "end") this.ring?.end(msg.timestamp);
 			else if (msg.type === "reset") {
-				this.ring?.reset();
+				if (msg.next) this.ring?.next();
+				else this.ring?.reset();
 				this.#epoch = msg.epoch;
 				this.#playing = msg.playing ?? true;
 			} else if (msg.type === "playing" && msg.epoch === this.#epoch) this.#playing = msg.playing;
@@ -106,6 +108,7 @@ class FakeWorklet {
 			stalled: ring.stalled,
 			anchored: ring.anchored,
 			underruns: ring.underruns,
+			silent: ring.silent,
 			epoch: this.#epoch,
 		};
 		this.port.dispatchEvent(new MessageEvent("message", { data: state }));
@@ -356,6 +359,8 @@ async function play(initial: Delay, buffered = false, cmaf = false) {
 		enabled,
 		decoding,
 		context: decoder.out.context,
+		stalled: () => decoder.out.stalled.peek(),
+		stats: () => decoder.out.stats.peek(),
 		arrivals: () => decoder.arrivals(),
 		error: decoder.out.error,
 		play,
@@ -682,6 +687,18 @@ function drain(ring: FakeWorklet): number {
 	}
 }
 
+// Like `drain`, but letting the decode loop catch up between quanta, as a paced buffered decode needs.
+async function playOut(ring: FakeWorklet): Promise<number> {
+	const output = [new Float32Array(128), new Float32Array(128)];
+	let total = 0;
+	for (;;) {
+		const read = ring.read(output);
+		await microtasks();
+		if (read === 0) return total;
+		total += read;
+	}
+}
+
 describe("Decoder across a rendition's absence", () => {
 	it("plays the tail, suspends once drained, and resumes on return", async () => {
 		const playback = await play(Milli(100));
@@ -726,83 +743,89 @@ describe("Decoder across a rendition's absence", () => {
 		}
 	});
 
-	it("holds a disabled rendition and keeps one subscription across mute and unmute", async () => {
+	// Back-to-back presses: the next utterance arrives while the last one's tail still plays, which
+	// must neither flush that tail, pause it behind a clock reset, nor stall.
+	for (const buffered of [false, true]) {
+		it(`follows a declared end straight into the next utterance without a stall${buffered ? " (buffered)" : ""}`, async () => {
+			const playback = await play(Milli(100), buffered);
+			const reanchor = spyOn(playback.sync, "reset");
+			try {
+				await playback.play(12);
+				const [ring] = playback.rings();
+				expect(ring.read([new Float32Array(128), new Float32Array(128)])).toBe(128);
+				const end = frameTimestamp + 20_000;
+				playback.push({ kind: "end", group: 0n, end: Micro(end) });
+				for (let i = 0; i < 6; i++) {
+					const read = frame();
+					read.group = 1n;
+					playback.push(read);
+					await microtasks();
+				}
+				expect(playback.resets()).toBe(0);
+				expect(reanchor).not.toHaveBeenCalled();
+				playback.push({ kind: "end", group: 1n, end: Micro(frameTimestamp + 20_000) });
+				await microtasks();
+				expect(await playOut(ring)).toBeGreaterThan(0);
+				await microtasks();
+				expect(playback.subscriptions()).toBe(1);
+				expect(playback.stats()).toMatchObject({ underruns: 0, stalls: 0 });
+			} finally {
+				playback.close();
+			}
+		});
+	}
+
+	it("deselects a disabled rendition and resubscribes once it is re-enabled", async () => {
 		const playback = await play(Milli(100));
 		try {
 			await playback.play(12);
-			expect(playback.track()).toBe("audio");
-
 			playback.disable();
 			await microtasks();
-			expect(playback.track()).toBe("audio");
-			expect(contexts).toHaveLength(1);
-			drain(playback.rings()[0]);
-			await microtasks();
-			expect(contexts[0].state).toBe("suspended");
+			expect(playback.track()).toBeUndefined();
 
 			playback.restore();
 			await microtasks();
 			expect(playback.track()).toBe("audio");
-			expect(contexts[0].state).toBe("running");
-			expect(playback.supportProbes).toHaveBeenCalledTimes(1);
-			const before = playback.inserted().length;
-			const timestamps = await playback.play(6);
-
-			expect(contexts).toHaveLength(1);
-			expect(contexts[0].calls.close).toBe(0);
-			expect(playback.subscriptions()).toBe(1);
-			expect(playback.inserted().slice(before)).toEqual(timestamps);
+			await playback.play(6);
+			expect(playback.subscriptions()).toBe(2);
 		} finally {
 			playback.close();
 		}
 	});
 
-	it("suspends a held muted tile once drained, and resumes on unmute", async () => {
+	// A push-to-talk publisher stays enabled and declares where each utterance ends. The silence that
+	// follows is intentional: no stall, no underrun, the context keeps running for its comfort noise,
+	// and the next utterance plays on the same subscription.
+	it("plays through a declared silence on one subscription without a stall or underrun", async () => {
 		const playback = await play(Milli(100));
 		try {
 			await playback.play(12);
 			const [ring] = playback.rings();
-			expect(ring.read([new Float32Array(128), new Float32Array(128)])).toBe(128);
+			const end = frameTimestamp + 20_000;
+			playback.push({ kind: "end", group: 0n, end: Micro(end) });
 			await microtasks();
-
-			playback.disable();
-			await microtasks();
-			const [context] = contexts;
-			expect(context.calls.suspend).toBe(0);
-
 			expect(drain(ring)).toBeGreaterThan(0);
 			await microtasks();
-			expect(context.calls.suspend).toBe(1);
-			expect(context.state).toBe("suspended");
-			expect(playback.track()).toBe("audio");
-
-			playback.restore();
-			await microtasks();
-			expect(context.state).toBe("running");
-			expect(playback.subscriptions()).toBe(1);
-		} finally {
-			playback.close();
-		}
-	});
+			expect(ring.ring?.silent).toBe(true);
+			expect(playback.stalled()).toBe(false);
+			expect(contexts[0].state).toBe("running");
 
-	it("drops a held rendition once it is removed", async () => {
-		const playback = await play(Milli(100));
-		try {
-			await playback.play(12);
-			playback.disable();
+			// The next utterance, five seconds on, from the publisher's next group.
+			frameTimestamp = end + 5_000_000;
+			for (let i = 0; i < 12; i++) {
+				const read = frame();
+				read.group = 1n;
+				playback.push(read);
+				await microtasks();
+			}
+			expect(playback.stalled()).toBe(false);
+			playback.push({ kind: "end", group: 1n, end: Micro(frameTimestamp + 20_000) });
 			await microtasks();
-			expect(playback.track()).toBe("audio");
-
-			playback.remove();
+			expect(drain(ring)).toBeGreaterThan(0);
 			await microtasks();
-			expect(playback.track()).toBeUndefined();
 
-			// Its return is a fresh selection, with a fresh subscription.
-			playback.restore();
-			await microtasks();
-			expect(playback.track()).toBe("audio");
-			await playback.play(6);
-			expect(playback.subscriptions()).toBe(2);
+			expect(playback.subscriptions()).toBe(1);
+			expect(playback.stats()).toMatchObject({ underruns: 0, stalls: 0 });
 		} finally {
 			playback.close();
 		}
@@ -904,6 +927,32 @@ describe("Decoder across a rendition's absence", () => {
 		}
 	});
 
+	it("declares the silence of an end read before the worklet loads", async () => {
+		let load = () => {};
+		moduleLoaded = new Promise((resolve) => {
+			load = resolve;
+		});
+
+		const playback = await play(Milli(100));
+		try {
+			// A cold join during a mute: the first read is the marker.
+			playback.push({ kind: "end", group: 0n, end: Micro(frameTimestamp) });
+			await microtasks();
+			load();
+			await microtasks();
+
+			// No audio was written, so the ring is the latest worklet rather than one with inserts.
+			const ring = worklets.at(-1);
+			if (!ring) throw new Error("no worklet was built");
+			expect(drain(ring)).toBe(0);
+			await microtasks();
+			expect(ring.ring?.silent).toBe(true);
+			expect(playback.stalled()).toBe(false);
+		} finally {
+			playback.close();
+		}
+	});
+
 	it("decodes the frames that arrive before the worklet loads", async () => {
 		let load = () => {};
 		moduleLoaded = new Promise((resolve) => {
diff --git a/js/watch/src/audio/decoder.ts b/js/watch/src/audio/decoder.ts
index 98eec787190..2fdc33a3b1f 100644
--- a/js/watch/src/audio/decoder.ts
+++ b/js/watch/src/audio/decoder.ts
@@ -75,7 +75,8 @@ export type DecoderOutput = {
 	// Current playback timestamp from worklet
 	timestamp: Signal<Milli | undefined>;
 
-	// Whether the audio buffer is stalled (waiting to fill)
+	// Whether the audio buffer is stalled (waiting to fill). A silence the publisher declared, such as
+	// a push-to-talk mute, is not a stall.
 	stalled: Signal<boolean>;
 
 	// Combined buffered ranges (network jitter + decode buffer)
@@ -220,9 +221,7 @@ export class Decoder {
 		const startup = this.#signals.computed((effect) => {
 			if (!effect.get(this.in.enabled)) return undefined;
 			if (effect.get(this.source.pending)) return null;
-			// A held disabled rendition has no frames coming, so startup does not wait on it.
-			const config = effect.get(this.source.out.config);
-			if (!config || config.enabled === false) return undefined;
+			if (!effect.get(this.source.out.config)) return undefined;
 			const span = effect.get(this.#decodeBuffered)[0];
 			if (!span) return null;
 			// Deep targets stay encoded, so count the audio queued past the decoded span. Sum it across
@@ -240,10 +239,10 @@ export class Decoder {
 			const config = effect.get(this.source.out.config);
 			return config ? playbackIdentity(config) : undefined;
 		});
-		// A held disabled rendition idles too, so a muted tile suspends its AudioContext.
 		this.#idle = this.#signals.computed((effect) => {
-			const config = effect.get(this.source.out.config);
-			return (!config || config.enabled === false) && effect.get(this.#out.stalled);
+			if (effect.get(this.source.out.config) !== undefined) return false;
+			const ring = effect.get(this.#ring);
+			return effect.get(this.#out.stalled) || (!!ring && effect.get(ring.silent));
 		});
 
 		this.#signals.run(this.#runSubscribeMaxDelay.bind(this));
@@ -390,6 +389,10 @@ export class Decoder {
 				playing: this.sync.playing,
 			});
 			effect.cleanup(() => ring.close());
+			// An end read before the ring existed, such as a cold join during a mute, still declares
+			// the silence.
+			const end = this.#terminal.end;
+			if (end !== undefined) ring.end((end - this.#terminal.delay) as Micro);
 			effect.set(this.#ring, ring);
 
 			// Mirror ring state (timestamp/stalled) onto our public signals.
@@ -399,7 +402,7 @@ export class Decoder {
 				this.#trimDecodeBuffered(ts);
 			});
 			effect.run((inner) => {
-				this.#out.stalled.set(inner.get(ring.stalled));
+				this.#out.stalled.set(inner.get(ring.stalled) && !inner.get(ring.silent));
 			});
 			// Each ring counts from zero, so add only what this one counted to the cumulative stats.
 			let counted = 0;
@@ -607,7 +610,7 @@ export class Decoder {
 					// The track ending, or a gap or end, cuts a held head short.
 					if (!(await play(order.flush()))) return;
 					if (!next) break;
-					if (this.#terminal.update(next)) {
+					if (this.#onRead(next)) {
 						this.#reprime(decoder, decoderConfig, order);
 					}
 					if (next.kind === "gap") this.#arrivals.write(gap(next));
@@ -694,7 +697,7 @@ export class Decoder {
 					// The track ending, or a gap or end, cuts a held head short.
 					if (!(await play(order.flush()))) return;
 					if (!next) break;
-					if (this.#terminal.update(next)) {
+					if (this.#onRead(next)) {
 						this.#reprime(decoder, decoderConfig, order);
 					}
 					if (next.kind === "gap") this.#arrivals.write(gap(next));
@@ -731,7 +734,7 @@ export class Decoder {
 		reads: FrameRead[],
 	): Promise<boolean> {
 		for (const read of reads) {
-			if (this.#terminal.update(read)) {
+			if (this.#onRead(read)) {
 				this.#reprime(decoder, config, order);
 			}
 			if (!order.admit(read)) continue;
@@ -989,6 +992,18 @@ export class Decoder {
 		this.#ring.peek()?.reset();
 	}
 
+	// Apply an ordered container read before handling it, reporting whether a codec epoch ended: a
+	// gap, or a later group after a declared end. The ring learns where a declared silence starts and
+	// that the next utterance follows it; the timeline and the shared clock carry on through both.
+	#onRead(read: Container.Read): boolean {
+		// Decoded audio stops a pre-skip short of a declared end when the publisher left its codec's
+		// lookahead unflushed, so the ring takes the end that early.
+		if (read.kind === "end") this.#ring.peek()?.end((read.end - this.#terminal.delay) as Micro);
+		if (!this.#terminal.update(read)) return false;
+		if (read.kind === "frame") this.#ring.peek()?.next();
+		return true;
+	}
+
 	/**
 	 * Observe every frame and gap received from now until the handle or this decoder closes.
 	 *
diff --git a/js/watch/src/audio/render-worklet.test.ts b/js/watch/src/audio/render-worklet.test.ts
index b6afeadb67e..044e1e7c960 100644
--- a/js/watch/src/audio/render-worklet.test.ts
+++ b/js/watch/src/audio/render-worklet.test.ts
@@ -78,7 +78,15 @@ describe("render dispatch", () => {
 		send({ type: "data", timestamp: Micro(500_000), data: [new Float32Array(100).fill(2)] });
 		for (let i = 0; i < 3; i++) read(20);
 		expect(sent).toEqual([
-			{ type: "state", epoch: 7, timestamp: Micro(560_000), stalled: false, anchored: true, underruns: 0 },
+			{
+				type: "state",
+				epoch: 7,
+				timestamp: Micro(560_000),
+				stalled: false,
+				anchored: true,
+				underruns: 0,
+				silent: false,
+			},
 		]);
 	});
 
@@ -98,7 +106,15 @@ describe("render dispatch", () => {
 		expect(read(20)[19]).toBe(1);
 		read(20);
 		expect(sent).toEqual([
-			{ type: "state", epoch: 3, timestamp: Micro(60_000), stalled: false, anchored: true, underruns: 0 },
+			{
+				type: "state",
+				epoch: 3,
+				timestamp: Micro(60_000),
+				stalled: false,
+				anchored: true,
+				underruns: 0,
+				silent: false,
+			},
 		]);
 	});
 
@@ -115,6 +131,72 @@ describe("render dispatch", () => {
 	});
 });
 
+// A declared end plays comfort noise at the level of the quietest audio heard before it, through the
+// refill of the next utterance, and none of it counts as an underrun.
+it("fills a declared silence with comfort noise and counts no underrun", () => {
+	const { send, read, sent } = renderer();
+	const quiet = 0.0002;
+	send({ type: "data", timestamp: Micro(0), data: [new Float32Array(200).fill(quiet)] });
+	send({ type: "end", timestamp: Micro(200_000) });
+	for (let i = 0; i < 10; i++) expect(read(20)[0]).toBeCloseTo(quiet, 9);
+
+	const rms = (samples: Float32Array) => Math.sqrt(samples.reduce((sum, x) => sum + x * x, 0) / samples.length);
+	const noise = read(2000);
+	expect(Math.max(...noise.map(Math.abs))).toBeLessThanOrEqual(quiet * Math.sqrt(3));
+	expect(rms(noise)).toBeCloseTo(quiet, 4);
+	for (let i = 0; i < 4; i++) read(20);
+	expect(sent.at(-1)).toMatchObject({ underruns: 0, silent: true });
+
+	// The next utterance refills before it plays, and the noise carries on meanwhile.
+	send({ type: "reset", epoch: 1, next: true });
+	send({ type: "data", timestamp: Micro(9_000_000), data: [new Float32Array(50).fill(1)] });
+	expect(rms(read(20))).toBeGreaterThan(0);
+	send({ type: "data", timestamp: Micro(9_050_000), data: [new Float32Array(50).fill(1)] });
+	read(20);
+	for (let i = 0; i < 3; i++) read(20);
+	expect(sent.at(-1)).toMatchObject({ underruns: 0, silent: false, stalled: false });
+});
+
+// Back-to-back presses leave a short declared silence buffered between two utterances, which plays as
+// the same comfort noise as a longer one.
+it("fills a declared silence between buffered utterances with comfort noise", () => {
+	const { send, read, sent } = renderer();
+	const quiet = 0.0002;
+	send({ type: "data", timestamp: Micro(0), data: [new Float32Array(200).fill(quiet)] });
+	send({ type: "end", timestamp: Micro(200_000) });
+	for (let i = 0; i < 9; i++) read(20);
+	send({ type: "reset", epoch: 1, next: true });
+	send({ type: "data", timestamp: Micro(400_000), data: [new Float32Array(200).fill(1)] });
+
+	const output = read(20);
+	expect(output[0]).toBeCloseTo(quiet, 9);
+	const noise = read(200);
+	expect(noise.some((value) => value !== 0)).toBe(true);
+	expect(Math.max(...noise.map(Math.abs))).toBeLessThanOrEqual(quiet * Math.sqrt(3));
+	// The next utterance fades in from the noise and then plays as sent.
+	const resumed = read(150);
+	expect(resumed[0]).toBeLessThan(1);
+	expect(resumed[149]).toBe(1);
+	for (let i = 0; i < 4; i++) read(10);
+	expect(sent.at(-1)).toMatchObject({ underruns: 0, stalled: false });
+});
+
+it("caps comfort noise at -60 dBFS after loud audio", () => {
+	const { send, read } = renderer();
+	send({ type: "data", timestamp: Micro(0), data: [new Float32Array(200).fill(0.5)] });
+	send({ type: "end", timestamp: Micro(200_000) });
+	for (let i = 0; i < 10; i++) read(20);
+	expect(Math.max(...read(2000).map(Math.abs))).toBeLessThanOrEqual(0.001 * Math.sqrt(3));
+});
+
+it("adds no noise to a source that was already silent", () => {
+	const { send, read } = renderer();
+	send({ type: "data", timestamp: Micro(0), data: [new Float32Array(200)] });
+	send({ type: "end", timestamp: Micro(200_000) });
+	for (let i = 0; i < 10; i++) read(20);
+	expect([...read(100)]).toEqual(Array(100).fill(0));
+});
+
 it("holds PCM without consuming it until the shared startup gate opens", () => {
 	const { send, read, sent } = renderer();
 	send({ type: "playing", playing: false, epoch: 0 });
@@ -130,3 +212,13 @@ it("holds PCM without consuming it until the shared startup gate opens", () => {
 	send({ type: "playing", playing: true, epoch: 1 });
 	expect(read(100)[99]).toBe(2);
 });
+
+it("clears comfort noise when the timeline resets", () => {
+	const { send, read } = renderer();
+	send({ type: "data", timestamp: Micro(0), data: [new Float32Array(200).fill(0.0002)] });
+	send({ type: "end", timestamp: Micro(200_000) });
+	for (let i = 0; i < 10; i++) read(20);
+	expect(read(20).some((value) => value !== 0)).toBe(true);
+	send({ type: "reset", epoch: 1 });
+	expect([...read(20)]).toEqual(Array(20).fill(0));
+});
diff --git a/js/watch/src/audio/render-worklet.ts b/js/watch/src/audio/render-worklet.ts
index 6cafe639a57..230dba0e782 100644
--- a/js/watch/src/audio/render-worklet.ts
+++ b/js/watch/src/audio/render-worklet.ts
@@ -1,3 +1,4 @@
+import { ComfortNoise } from "./comfort";
 import type { Message, State } from "./render";
 import { AudioRingBuffer } from "./ring-buffer";
 
@@ -8,6 +9,7 @@ const RAMP = 64;
 class Render extends AudioWorkletProcessor {
 	// Created by the main thread's init message.
 	#ring?: AudioRingBuffer;
+	#comfort?: ComfortNoise;
 	#underflow = 0;
 	#stateCounter = 0;
 	#epoch = 0;
@@ -22,6 +24,7 @@ class Render extends AudioWorkletProcessor {
 			const msg = event.data;
 			if (msg.type === "init") {
 				this.#ring = new AudioRingBuffer(msg);
+				this.#comfort = new ComfortNoise(msg.rate);
 				this.#playing = msg.playing ?? true;
 				this.#underflow = 0;
 				this.#short = false;
@@ -33,10 +36,16 @@ class Render extends AudioWorkletProcessor {
 					this.#ring?.park();
 					this.#epoch = msg.park;
 				}
+			} else if (msg.type === "end") {
+				this.#ring?.end(msg.timestamp);
 			} else if (msg.type === "truncate") {
 				this.#ring?.truncate(msg.timestamp);
 			} else if (msg.type === "reset") {
-				this.#ring?.reset();
+				if (msg.next) this.#ring?.next();
+				else {
+					this.#ring?.reset();
+					this.#comfort = this.#ring ? new ComfortNoise(this.#ring.rate) : undefined;
+				}
 				this.#epoch = msg.epoch;
 				this.#playing = msg.playing ?? true;
 			} else if (msg.type === "playing" && msg.epoch === this.#epoch) {
@@ -49,28 +58,31 @@ class Render extends AudioWorkletProcessor {
 		const output = outputs[0];
 		const ring = this.#ring;
 		const samplesRead = this.#playing ? (ring?.read(output) ?? 0) : 0;
+		// A declared silence between two buffered utterances plays as comfort noise, faded like any other.
+		const quiet = this.#playing ? ring?.quiet : undefined;
+		if (quiet) {
+			const [from, to] = quiet;
+			this.#comfort?.played(output, 0, from);
+			fadeOut(output, from);
+			fadeIn(output, to, samplesRead);
+			this.#comfort?.fill(output, from, to);
+			this.#comfort?.played(output, to, samplesRead);
+		} else {
+			this.#comfort?.played(output, 0, samplesRead);
+		}
 
 		if (samplesRead < output[0].length) {
 			// Fade the tail of what we did read down to the silence that follows it.
-			for (const channel of output) {
-				const ramp = Math.min(RAMP, samplesRead);
-				for (let i = 0; i < ramp; i++) {
-					channel[samplesRead - ramp + i] *= 1 - (i + 1) / ramp;
-				}
-			}
-			if (this.#playing) this.#underflow += output[0].length - samplesRead;
+			fadeOut(output, samplesRead);
+			// The publisher declared this silence, including the refill before its next utterance.
+			if (ring?.silent) this.#comfort?.fill(output, samplesRead);
+			else if (this.#playing) this.#underflow += output[0].length - samplesRead;
 			this.#short = true;
 		} else {
-			if (this.#short) {
-				// Fade back in from the silence the shortfall left behind.
-				const ramp = Math.min(RAMP, samplesRead);
-				for (const channel of output) {
-					for (let i = 0; i < ramp; i++) {
-						channel[i] *= (i + 1) / ramp;
-					}
-				}
-				this.#short = false;
-			}
+			// Fade back in from the silence the shortfall left behind.
+			if (this.#short) fadeIn(output, 0, samplesRead);
+			// A declared silence running to the end of the quantum fades the next one in.
+			this.#short = quiet !== undefined && quiet[1] === samplesRead;
 			if (this.#underflow > 0 && ring) {
 				console.debug(`audio underflow: ${Math.round((1000 * this.#underflow) / ring.rate)}ms`);
 				this.#underflow = 0;
@@ -88,6 +100,7 @@ class Render extends AudioWorkletProcessor {
 					stalled: ring.stalled,
 					anchored: ring.anchored,
 					underruns: ring.underruns,
+					silent: ring.silent,
 					epoch: this.#epoch,
 				};
 				this.port.postMessage(state);
@@ -98,4 +111,20 @@ class Render extends AudioWorkletProcessor {
 	}
 }
 
+// Fade `output` down over the samples just before `at`.
+function fadeOut(output: Float32Array[], at: number): void {
+	const ramp = Math.min(RAMP, at);
+	for (const channel of output) {
+		for (let i = 0; i < ramp; i++) channel[at - ramp + i] *= 1 - (i + 1) / ramp;
+	}
+}
+
+// Fade `output` up over the samples from `at`, short of `end`.
+function fadeIn(output: Float32Array[], at: number, end: number): void {
+	const ramp = Math.min(RAMP, end - at);
+	for (const channel of output) {
+		for (let i = 0; i < ramp; i++) channel[at + i] *= (i + 1) / ramp;
+	}
+}
+
 registerProcessor("render", Render);
diff --git a/js/watch/src/audio/render.ts b/js/watch/src/audio/render.ts
index 13689ab7f76..f60f1612000 100644
--- a/js/watch/src/audio/render.ts
+++ b/js/watch/src/audio/render.ts
@@ -1,7 +1,7 @@
 import type { Micro, Milli } from "@moq/clock";
 
 /** Everything the main thread sends the render worklet over its port. */
-export type Message = Init | Data | Latency | Reset | Truncate | Playing;
+export type Message = Init | Data | Latency | Reset | Truncate | Playing | End;
 
 /** Create the worklet's ring. */
 export interface Init {
@@ -18,6 +18,8 @@ export interface Init {
 /** Flush the buffer and re-stall. */
 export interface Reset {
 	type: "reset";
+	// The next utterance after a declared end: flush only once playback ran out at the end.
+	next?: boolean;
 	// Echoed in every later state message, so the main thread can tell state from before the reset.
 	epoch: number;
 	playing?: boolean;
@@ -29,6 +31,12 @@ export interface Truncate {
 	timestamp: Micro;
 }
 
+/** The publisher declared its audio ends here, less any codec delay, so running dry there is silence. */
+export interface End {
+	type: "end";
+	timestamp: Micro;
+}
+
 /** Audio samples, with their buffers transferred. */
 export interface Data {
 	type: "data";
@@ -54,6 +62,8 @@ export interface State {
 	anchored: boolean;
 	// How many times the ring has run dry mid-playback, cumulative.
 	underruns: number;
+	// Whether playback is at a declared end, reached or announced before any audio, and nothing has played since.
+	silent: boolean;
 	// The epoch of the last reset or park the worklet applied.
 	epoch: number;
 }
diff --git a/js/watch/src/audio/replay.ts b/js/watch/src/audio/replay.ts
index d8a6766cfc9..8e9cc3f172a 100644
--- a/js/watch/src/audio/replay.ts
+++ b/js/watch/src/audio/replay.ts
@@ -3,9 +3,9 @@
  *
  * Every frame is written into its group at the instant the trace says it arrived, and the player's
  * real `Container.Consumer` decides what to deliver, wait for, and skip, at the max delay the delay
- * sets. Delivered frames go into the real ring, and a new codec epoch resets it, the way the decoder
- * does. One render quantum is read every quantum's worth of that same clock, which is what the
- * AudioWorklet does. A real {@link Sync} resolves the delay from the playout target the decoder
+ * sets. Delivered frames go into the real ring, which carries on through a gap the way the decoder's
+ * does: a gap restarts only the codec. One render quantum is read every quantum's worth of that same
+ * clock, which is what the AudioWorklet does. A real {@link Sync} resolves the delay from the playout target the decoder
  * registers, measured by that same consumer from the recorded catalog config, and the ring and the
  * decode gate follow it the way the decoder's audio buffer moves them, so a change to any of them
  * moves what a replay hears. Decoding is taken as instant and sample exact.
@@ -27,7 +27,6 @@ import { Backpressure } from "./buffer";
 import { frameDuration } from "./config";
 import { target } from "./latency";
 import { AudioRingBuffer } from "./ring-buffer";
-import { Terminal } from "./terminal";
 
 /** An AudioWorklet render quantum, in frames. */
 export const QUANTUM = 128;
@@ -169,8 +168,8 @@ export async function* replay(trace: Arrival[], options: Options): AsyncGenerato
 		if (gate.queued(newest)) ring.setLatency(millis(rate, gate.floor));
 	});
 
-	// The decoder's read loop, with the codec taken out. A failure is rethrown at the next quantum.
-	const terminal = new Terminal();
+	// The decoder's read loop, with the codec taken out. Traces record no declared ends, so a gap is
+	// the only codec epoch a replay meets. A failure is rethrown at the next quantum.
 	const arrivals: Diagnostic[] = [];
 	const delivery = Promise.withResolvers<void>();
 	if (options.decodeAfter === undefined) delivery.resolve();
@@ -181,10 +180,6 @@ export async function* replay(trace: Arrival[], options: Options): AsyncGenerato
 		for (;;) {
 			const next = await consumer.next();
 			if (!next) return;
-			if (terminal.update(next)) {
-				ring.reset();
-				gate.reset();
-			}
 			if (next.kind === "gap") arrivals.push(gap(next));
 			if (next.kind !== "frame") continue;
 
diff --git a/js/watch/src/audio/ring-buffer.test.ts b/js/watch/src/audio/ring-buffer.test.ts
index 1d1c4f3d779..238dd6144d5 100644
--- a/js/watch/src/audio/ring-buffer.test.ts
+++ b/js/watch/src/audio/ring-buffer.test.ts
@@ -535,6 +535,174 @@ describe("re-buffer", () => {
 	});
 });
 
+// A publisher that stops sending, such as a push-to-talk mute, declares where its audio ends. Running
+// dry there is the silence it announced, not an underrun, through the refill of the next utterance.
+describe("declared end", () => {
+	it("is declared silence before any audio, and the next utterance anchors", () => {
+		const buffer = new AudioRingBuffer({ rate: 1000, channels: 1, latency: 40 as Milli });
+		buffer.end(Micro(5_000_000));
+		expect(buffer.silent).toBe(true);
+		expect(read(buffer, 20, 1)[0].length).toBe(0);
+		expect(buffer.underruns).toBe(0);
+
+		buffer.next();
+		expect(buffer.silent).toBe(true);
+		write(buffer, 6000 as Milli, 40, { channels: 1 });
+		expect(read(buffer, 20, 1)[0].length).toBe(20);
+		expect(buffer.silent).toBe(false);
+		expect(Milli.fromMicro(buffer.timestamp)).toBe(6020 as Milli);
+	});
+
+	it("clears declared silence on a timeline reset", () => {
+		const buffer = new AudioRingBuffer({ rate: 1000, channels: 1, latency: 40 as Milli });
+		write(buffer, 0 as Milli, 40, { channels: 1 });
+		buffer.end(Micro(30_000));
+		read(buffer, 50, 1);
+		expect(buffer.silent).toBe(true);
+		buffer.reset();
+		expect(buffer.silent).toBe(false);
+		expect(buffer.stalled).toBe(true);
+	});
+
+	it("runs dry at the end without an underrun, and stays silent across the next utterance", () => {
+		const buffer = new AudioRingBuffer({ rate: 1000, channels: 1, latency: 40 as Milli });
+		write(buffer, 0 as Milli, 40, { channels: 1 });
+		buffer.end(Micro(30_000));
+
+		expect(read(buffer, 20, 1)[0].length).toBe(20);
+		expect(buffer.silent).toBe(false);
+		// A partial quantum past the end is silence too, so playback waits for the next utterance.
+		expect(read(buffer, 30, 1)[0].length).toBe(20);
+		expect(buffer.silent).toBe(true);
+		expect(buffer.stalled).toBe(true);
+		expect(read(buffer, 20, 1)[0].length).toBe(0);
+		expect(buffer.underruns).toBe(0);
+
+		// The next utterance re-anchors and refills, still silent until it plays.
+		buffer.next();
+		expect(buffer.silent).toBe(true);
+		write(buffer, 5000 as Milli, 40, { channels: 1 });
+		expect(read(buffer, 20, 1)[0].length).toBe(20);
+		expect(buffer.silent).toBe(false);
+
+		// The reset forgot the old end, so running dry now is an underrun.
+		read(buffer, 20, 1);
+		read(buffer, 20, 1);
+		expect(buffer.underruns).toBe(1);
+		expect(buffer.silent).toBe(false);
+	});
+
+	it("counts running dry short of the end as an underrun", () => {
+		const buffer = new AudioRingBuffer({ rate: 1000, channels: 1, latency: 20 as Milli });
+		write(buffer, 0 as Milli, 20, { channels: 1 });
+		buffer.end(Micro(40_000));
+		read(buffer, 20, 1);
+		read(buffer, 20, 1);
+		expect(buffer.underruns).toBe(1);
+		expect(buffer.silent).toBe(false);
+	});
+
+	// Back-to-back presses: the next utterance arrives while the last one's tail is still buffered.
+	it("plays the next utterance after the end's tail without flushing it", () => {
+		const buffer = new AudioRingBuffer({ rate: 1000, channels: 1, latency: 40 as Milli });
+		write(buffer, 0 as Milli, 40, { channels: 1, value: 1 });
+		buffer.end(Micro(40_000));
+		expect(read(buffer, 20, 1)[0].length).toBe(20);
+
+		buffer.next();
+		write(buffer, 50 as Milli, 40, { channels: 1, value: 2 });
+		// The rest of the tail, the short gap to the next utterance, then the utterance itself.
+		const [played] = read(buffer, 70, 1);
+		expect([...played.slice(0, 20)]).toEqual(Array(20).fill(1));
+		expect([...played.slice(20, 30)]).toEqual(Array(10).fill(0));
+		expect([...played.slice(30)]).toEqual(Array(40).fill(2));
+		// The gap is the declared silence, for the reader to fill with comfort noise.
+		expect(buffer.quiet).toEqual([20, 30]);
+		expect(buffer.underruns).toBe(0);
+		expect(buffer.silent).toBe(false);
+
+		// The end no longer applies, so running dry now is an underrun.
+		read(buffer, 20, 1);
+		expect(buffer.underruns).toBe(1);
+	});
+
+	// The declared silence between them must not count toward the live band and push the unplayed
+	// tail out; once the tail has played, the band catches up by skipping the silence instead.
+	it("keeps the end's tail when the next utterance starts after a gap", () => {
+		const buffer = new AudioRingBuffer({ rate: 1000, channels: 1, latency: 40 as Milli });
+		write(buffer, 0 as Milli, 40, { channels: 1, value: 1 });
+		expect(read(buffer, 20, 1)[0].length).toBe(20);
+		buffer.end(Micro(40_000));
+		buffer.next();
+
+		write(buffer, 100 as Milli, 20, { channels: 1, value: 2 });
+		expect([...read(buffer, 20, 1)[0]]).toEqual(Array(20).fill(1));
+
+		write(buffer, 120 as Milli, 20, { channels: 1, value: 2 });
+		expect([...read(buffer, 40, 1)[0]]).toEqual(Array(40).fill(2));
+		expect(buffer.underruns).toBe(0);
+	});
+
+	it("reports a declared silence across reads until the next utterance plays", () => {
+		const buffer = new AudioRingBuffer({ rate: 1000, channels: 1, latency: 40 as Milli });
+		write(buffer, 0 as Milli, 40, { channels: 1, value: 1 });
+		buffer.end(Micro(40_000));
+		read(buffer, 30, 1);
+		buffer.next();
+		write(buffer, 70 as Milli, 20, { channels: 1, value: 2 });
+
+		read(buffer, 20, 1);
+		expect(buffer.quiet).toEqual([10, 20]);
+		read(buffer, 20, 1);
+		expect(buffer.quiet).toEqual([0, 20]);
+		read(buffer, 20, 1);
+		expect(buffer.quiet).toBeUndefined();
+	});
+
+	// The next utterance's audio may land a beat after the tail has played, which is still the
+	// silence the publisher declared.
+	it("treats running dry before the next utterance lands as declared silence", () => {
+		const buffer = new AudioRingBuffer({ rate: 1000, channels: 1, latency: 20 as Milli });
+		write(buffer, 0 as Milli, 40, { channels: 1 });
+		buffer.end(Micro(40_000));
+		read(buffer, 20, 1);
+		buffer.next();
+		read(buffer, 20, 1);
+		read(buffer, 20, 1);
+		expect(buffer.underruns).toBe(0);
+		expect(buffer.silent).toBe(true);
+
+		write(buffer, 60 as Milli, 20, { channels: 1, value: 2 });
+		read(buffer, 20, 1);
+		expect(buffer.quiet).toEqual([0, 20]);
+		expect([...read(buffer, 20, 1)[0]]).toEqual(Array(20).fill(2));
+		expect(buffer.quiet).toBeUndefined();
+		expect(buffer.underruns).toBe(0);
+	});
+
+	it("re-anchors the next utterance once the end's audio has played out", () => {
+		const buffer = new AudioRingBuffer({ rate: 1000, channels: 1, latency: 20 as Milli });
+		write(buffer, 0 as Milli, 20, { channels: 1 });
+		buffer.end(Micro(20_000));
+		read(buffer, 20, 1);
+		read(buffer, 20, 1);
+		expect(buffer.silent).toBe(true);
+		buffer.next();
+		expect(buffer.anchored).toBe(false);
+		expect(buffer.silent).toBe(true);
+	});
+
+	it("takes an end that arrives after the playhead ran out there", () => {
+		const buffer = new AudioRingBuffer({ rate: 1000, channels: 1, latency: 20 as Milli });
+		write(buffer, 0 as Milli, 20, { channels: 1 });
+		read(buffer, 20, 1);
+		read(buffer, 20, 1);
+		expect(buffer.underruns).toBe(1);
+		buffer.end(Micro(20_000));
+		expect(buffer.silent).toBe(true);
+	});
+});
+
 describe("buffered mode", () => {
 	function createBuffered(latency: number) {
 		return new AudioRingBuffer({ rate: 1000, channels: 1, latency: latency as Milli, buffered: true });
diff --git a/js/watch/src/audio/ring-buffer.ts b/js/watch/src/audio/ring-buffer.ts
index 8706af69687..3afd723d588 100644
--- a/js/watch/src/audio/ring-buffer.ts
+++ b/js/watch/src/audio/ring-buffer.ts
@@ -13,6 +13,26 @@ export class AudioRingBuffer {
 	#parked = false;
 	#underruns = 0;
 
+	// Where the publisher declared its audio ends, as a sample index, until the next reset.
+	#end?: number;
+	// That end once the next utterance follows it while its audio still plays, until the next
+	// utterance's first write lands: running dry there before it does is still declared silence.
+	#previous?: number;
+	// Set by `next` until that first write, which marks where the previous utterance's audio stops.
+	#next = false;
+	// Where the audio before the latest declared silence stops. The silence is declared, so it must not
+	// count toward the live band and push the unplayed tail out.
+	#tail?: number;
+	// Declared silences still ahead of the playhead, oldest first, as [start, end) sample indices. The
+	// ring holds them as zeros; the reader fills them with comfort noise. Each one follows a distinct
+	// write, and every move of the playhead drops those behind it, so the ring's capacity bounds them.
+	#pauses: Array<{ start: number; end: number }> = [];
+	// The part of the last read inside a declared silence, as output indices.
+	#quiet?: [number, number];
+	// Whether the playhead ran out at a declared end and nothing has played since: intentional
+	// silence, which is no underrun and survives the reset that re-anchors the next utterance.
+	#silent = false;
+
 	// Samples in the most recent write, i.e. one decoded chunk. The overflow band tolerates this
 	// much above the target before dropping, so a ring sitting exactly on the target doesn't drop
 	// audio the moment the next chunk lands. The most recent write rather than a running maximum:
@@ -65,6 +85,19 @@ export class AudioRingBuffer {
 		return this.#underruns;
 	}
 
+	/** Whether playback is at a declared end, reached or announced before any audio, and nothing has played since. */
+	get silent(): boolean {
+		return this.#silent;
+	}
+
+	/**
+	 * The part of the last read that lies in a declared silence between two utterances, as
+	 * `[from, to)` output indices. Those samples are zeros for the reader to fill with comfort noise.
+	 */
+	get quiet(): readonly [number, number] | undefined {
+		return this.#quiet;
+	}
+
 	get timestamp(): Micro {
 		return Micro.fromSecond((this.#readIndex / this.rate) as Second);
 	}
@@ -144,6 +177,15 @@ export class AudioRingBuffer {
 		const end = start + samples;
 		this.#chunk = data[0].length;
 
+		// The next utterance's first audio: whatever lies between it and the previous utterance's audio
+		// is declared silence.
+		if (this.#next) {
+			this.#next = false;
+			this.#previous = undefined;
+			this.#tail = this.#writeIndex;
+			if (start > this.#writeIndex) this.#pauses.push({ start: this.#writeIndex, end: start });
+		}
+
 		// Bound the ring. While playing, drop the oldest once it holds a whole chunk more than the
 		// target and land back on the target: frames arrive one chunk at a time, so a ring sitting
 		// exactly on the target is a chunk above it the moment the next one lands, and dropping on
@@ -151,9 +193,13 @@ export class AudioRingBuffer {
 		// consuming, so only the hard capacity applies; the band would throw away the very audio the
 		// refill is accumulating. Buffered mode plays through everything, so it is capacity-bound too.
 		const playing = !this.#stalled && !this.#buffered;
-		const limit = playing ? Math.min(this.#latencySamples + this.#chunk, this.capacity) : this.capacity;
+		// Until the tail before a declared silence has played, only the capacity bounds the ring; the
+		// band then catches up by skipping the silence.
+		const band = playing && (this.#tail === undefined || this.#readIndex >= this.#tail);
+		const limit = band ? Math.min(this.#latencySamples + this.#chunk, this.capacity) : this.capacity;
 		if (end - this.#readIndex > limit) {
-			this.#readIndex = end - (playing ? Math.min(this.#latencySamples, this.capacity) : this.capacity);
+			this.#readIndex = end - (band ? Math.min(this.#latencySamples, this.capacity) : this.capacity);
+			this.#prune();
 		}
 
 		// Fill gaps with zeros if there's a discontinuity
@@ -210,26 +256,81 @@ export class AudioRingBuffer {
 		if (target >= this.#writeIndex) return;
 		// Never retreat past the playhead: those samples are already due.
 		this.#writeIndex = Math.max(target, this.#readIndex);
+		this.#pauses = this.#pauses.filter((pause) => pause.start < this.#writeIndex);
+		const last = this.#pauses.at(-1);
+		if (last) last.end = Math.min(last.end, this.#writeIndex);
+	}
+
+	/**
+	 * Note that the publisher declared its audio ends at `timestamp`, so running dry there is silence
+	 * rather than an underrun. Pass the end less any codec delay that leaves the decoded audio short
+	 * of it.
+	 */
+	end(timestamp: Micro): void {
+		this.#end = Math.round(Second.fromMicro(timestamp) * this.rate);
+		// The end can arrive after the playhead already ran out at it, or before any audio, as for a
+		// listener that joins during a mute.
+		if (!this.#anchored || (this.#stalled && this.length <= 0 && this.#ended())) this.#silent = true;
+	}
+
+	// Forget the declared silences the playhead has passed.
+	#prune(): void {
+		const pauses = this.#pauses;
+		let passed = 0;
+		while (passed < pauses.length && pauses[passed].end <= this.#readIndex) passed++;
+		if (passed > 0) pauses.splice(0, passed);
+	}
+
+	// Whether the playhead has reached the declared end.
+	#ended(): boolean {
+		const end = this.#previous ?? this.#end;
+		return end !== undefined && this.#readIndex >= end;
+	}
+
+	/**
+	 * The publisher's next utterance follows its declared end. Once nothing is left to play, flush
+	 * and re-anchor on it like {@link reset}; while the end's audio is still buffered, play straight
+	 * into the next utterance on the same timeline, dropping nothing, with the silence between them
+	 * reported through {@link quiet}.
+	 */
+	next(): void {
+		if (!this.#anchored || this.length <= 0) {
+			const silent = this.#silent;
+			this.reset();
+			this.#silent = silent;
+			return;
+		}
+		this.#previous = this.#end ?? this.#previous;
+		this.#end = undefined;
+		this.#next = true;
 	}
 
 	// Flush all buffered samples and re-stall, ready to anchor the next utterance.
 	reset(): void {
+		this.#silent = false;
 		this.#readIndex = 0;
 		this.#writeIndex = 0;
 		this.#stalled = true;
 		this.#parked = false;
 		this.#anchored = false;
+		this.#end = undefined;
+		this.#previous = undefined;
+		this.#next = false;
+		this.#tail = undefined;
+		this.#pauses = [];
 	}
 
 	read(output: Float32Array[]): number {
 		if (output.length !== this.channels) throw new Error("wrong number of channels");
+		this.#quiet = undefined;
 		if (this.#stalled) return 0;
 
 		const samples = Math.min(this.#writeIndex - this.#readIndex, output[0].length);
 		if (samples <= 0) {
 			// Ran dry mid-playback: re-stall so write() refills to the target before resuming.
 			this.#stalled = true;
-			this.#underruns++;
+			if (this.#ended()) this.#silent = true;
+			else this.#underruns++;
 			return 0;
 		}
 
@@ -245,12 +346,33 @@ export class AudioRingBuffer {
 			}
 		}
 
+		// A quantum overlaps at most one declared silence unless an utterance is shorter than it, which
+		// no codec frame is; the span then covers both silences and the sliver between them.
+		this.#prune();
+		const pauses = this.#pauses;
+		const after = this.#readIndex + samples;
+		const first = pauses[0];
+		if (first && first.start < after) {
+			let last = first;
+			for (const pause of pauses) if (pause.start < after) last = pause;
+			this.#quiet = [Math.max(0, first.start - this.#readIndex), Math.min(samples, last.end - this.#readIndex)];
+		}
+
 		this.#readIndex += samples;
+		this.#silent = false;
 
 		// A short quantum ends in silence, so it counts as an underrun even if a chunk lands before
 		// the next read. It does not park playback: the shortfall is under one quantum, and a
-		// refill would spend the whole target as silence to cover it.
-		if (samples < output[0].length) this.#underruns++;
+		// refill would spend the whole target as silence to cover it. At a declared end it is the
+		// silence the publisher announced, and the ring waits for the next utterance.
+		if (samples < output[0].length) {
+			if (this.#ended()) {
+				this.#silent = true;
+				this.#stalled = true;
+			} else {
+				this.#underruns++;
+			}
+		}
 
 		return samples;
 	}
diff --git a/js/watch/src/audio/source.test.ts b/js/watch/src/audio/source.test.ts
index 0f97b2ef69d..57c346c9e4a 100644
--- a/js/watch/src/audio/source.test.ts
+++ b/js/watch/src/audio/source.test.ts
@@ -91,7 +91,7 @@ test("skips a disabled rendition on the initial selection", async () => {
 	}
 });
 
-test("holds the selected rendition while every rendition is disabled", async () => {
+test("deselects a rendition once it is disabled, and selects it again once re-enabled", async () => {
 	const state = broadcast({ mic: config("opus") });
 	const source = new Source({ broadcast: state.broadcast, supported: async () => true });
 	try {
@@ -100,13 +100,12 @@ test("holds the selected rendition while every rendition is disabled", async ()
 
 		state.catalog.set({ audio: { renditions: { mic: config("opus", { enabled: false }) } } });
 		await settled(source);
-		expect(source.out.track.peek()).toBe("mic");
-		expect(source.out.config.peek()?.enabled).toBe(false);
+		expect(source.out.track.peek()).toBeUndefined();
+		expect(source.out.config.peek()).toBeUndefined();
 
 		state.catalog.set({ audio: { renditions: { mic: config("opus") } } });
 		await settled(source);
 		expect(source.out.track.peek()).toBe("mic");
-		expect(source.out.config.peek()?.enabled).toBeUndefined();
 	} finally {
 		source.close();
 	}
@@ -129,80 +128,6 @@ test("an enabled alternative takes over from a disabled rendition", async () =>
 	}
 });
 
-test("drops a held rendition once it is removed", async () => {
-	const state = broadcast({ mic: config("opus") });
-	const source = new Source({ broadcast: state.broadcast, supported: async () => true });
-	try {
-		await settled(source);
-		state.catalog.set({ audio: { renditions: { mic: config("opus", { enabled: false }) } } });
-		await settled(source);
-		expect(source.out.track.peek()).toBe("mic");
-
-		state.catalog.set({ audio: { renditions: { other: config("opus", { enabled: false }) } } });
-		await settled(source);
-		expect(source.out.track.peek()).toBeUndefined();
-		expect(source.out.config.peek()).toBeUndefined();
-	} finally {
-		source.close();
-	}
-});
-
-test("does not carry a hold to another broadcast", async () => {
-	const first = broadcast({ mic: config("opus") });
-	const current = new Signal<Broadcast | undefined>(first.broadcast);
-	const source = new Source({ broadcast: current, supported: async () => true });
-	try {
-		await settled(source);
-		first.catalog.set({ audio: { renditions: { mic: config("opus", { enabled: false }) } } });
-		await settled(source);
-		expect(source.out.track.peek()).toBe("mic");
-
-		// The same catalog on another broadcast probes nothing new, so wait on a timer, not the probe.
-		current.set(broadcast({ mic: config("opus", { enabled: false }) }).broadcast);
-		await yieldNow();
-		expect(source.out.track.peek()).toBeUndefined();
-	} finally {
-		source.close();
-	}
-});
-
-test("does not hold an enabled selection into another broadcast's disabled rendition", async () => {
-	const current = new Signal<Broadcast | undefined>(broadcast({ mic: config("opus") }).broadcast);
-	const source = new Source({ broadcast: current, supported: async () => true });
-	try {
-		await settled(source);
-		expect(source.out.track.peek()).toBe("mic");
-
-		current.set(broadcast({ mic: config("opus", { enabled: false }) }).broadcast);
-		for (let i = 0; i < 5; i++) await yieldNow();
-		expect(source.out.track.peek()).toBeUndefined();
-		expect(source.out.config.peek()).toBeUndefined();
-	} finally {
-		source.close();
-	}
-});
-
-test("holds on a broadcast whose renditions match the previous one", async () => {
-	const current = new Signal<Broadcast | undefined>(broadcast({ mic: config("opus") }).broadcast);
-	const source = new Source({ broadcast: current, supported: async () => true });
-	try {
-		await settled(source);
-
-		// The new probe publishes an equal `available`, so only its broadcast tag changes.
-		const next = broadcast({ mic: config("opus") });
-		current.set(next.broadcast);
-		await settled(source);
-		expect(source.out.track.peek()).toBe("mic");
-
-		next.catalog.set({ audio: { renditions: { mic: config("opus", { enabled: false }) } } });
-		await settled(source);
-		expect(source.out.track.peek()).toBe("mic");
-		expect(source.out.config.peek()?.enabled).toBe(false);
-	} finally {
-		source.close();
-	}
-});
-
 async function quietly(fn: () => Promise<void>): Promise<void> {
 	const warn = console.warn;
 	console.warn = () => {};
@@ -313,7 +238,7 @@ test("serves unchanged configs from the cache when the catalog changes", async (
 	}
 });
 
-test("mute and unmute reuse the decoder support verdict and publish the new metadata", async () => {
+test("a disable and re-enable reuse the decoder support verdict and publish the new metadata", async () => {
 	const initial = config("opus");
 	const state = broadcast({ mic: initial });
 	let probes = 0;
@@ -333,8 +258,7 @@ test("mute and unmute reuse the decoder support verdict and publish the new meta
 			});
 			await settled(source);
 			expect(source.out.available.peek().mic.enabled).toBe(enabled);
-			expect(source.out.track.peek()).toBe("mic");
-			expect(source.out.config.peek()?.enabled).toBe(enabled);
+			expect(source.out.track.peek()).toBe(enabled ? "mic" : undefined);
 			expect(probes).toBe(1);
 		}
 
diff --git a/js/watch/src/audio/source.ts b/js/watch/src/audio/source.ts
index 0641d075d45..34494726533 100644
--- a/js/watch/src/audio/source.ts
+++ b/js/watch/src/audio/source.ts
@@ -68,13 +68,6 @@ export class Source {
 	/** Whether rendition support is still being resolved. @internal */
 	readonly pending: Getter<boolean> = this.#probe.pending;
 
-	// The last selection, which a disable holds while no enabled rendition remains.
-	#held?: { broadcast: Broadcast; track: string };
-
-	// The broadcast `available` was probed for. It lags a broadcast switch until the new probe lands.
-	// A signal, since the new broadcast's renditions can equal the old ones and leave `available` unchanged.
-	#probed = new Signal<Broadcast | undefined>(undefined);
-
 	#signals = new Effect();
 
 	constructor(props?: Inputs<SourceInput>) {
@@ -104,44 +97,26 @@ export class Source {
 		// Read the catalog from the broadcast itself, so the probe result is tagged with the right one.
 		const broadcast = effect.get(this.in.broadcast);
 		const renditions = (broadcast && effect.get(broadcast.out.catalog)?.audio?.renditions) ?? {};
-		this.#probe.run(effect, supported, renditions, (available) => {
-			this.#probed.set(broadcast);
-			this.#out.available.set(available);
-		});
+		this.#probe.run(effect, supported, renditions, (available) => this.#out.available.set(available));
 	}
 
 	#runSelected(effect: Effect): void {
-		const broadcast = effect.get(this.in.broadcast);
-		const all = effect.get(this.#out.available);
-		const probed = effect.get(this.#probed);
 		const target = effect.get(this.in.target);
 
-		// A disabled rendition has no frames coming, so it is never newly selected, even by name.
-		const available = Object.fromEntries(Object.entries(all).filter(([, config]) => config.enabled !== false));
+		// A disabled rendition has no frames coming, so it is never selected, even by name.
+		const available = Object.fromEntries(
+			Object.entries(effect.get(this.#out.available)).filter(([, config]) => config.enabled !== false),
+		);
 
-		const track =
-			target?.name && target.name in available
-				? target.name
-				: (this.#select(available) ?? this.#hold(broadcast, all));
-		// A pick from the previous broadcast's renditions is not this broadcast's selection to hold.
-		this.#held = track && broadcast && probed === broadcast ? { broadcast, track } : undefined;
+		const track = target?.name && target.name in available ? target.name : this.#select(available);
 		if (!track) return;
 
-		const config = all[track];
+		const config = available[track];
 		effect.set(this.#out.track, track);
 		effect.set(this.#out.config, config);
 		effect.set(this.#out.jitter, config.jitter !== undefined ? Milli(config.jitter) : undefined);
 	}
 
-	// Every rendition is disabled: keep the selected one, and its subscription, so the re-enable
-	// plays without a resubscribe. A removed rendition, or another broadcast, starts over.
-	#hold(broadcast: Broadcast | undefined, all: Record<string, Catalog.AudioConfig>): string | undefined {
-		if (Object.values(all).some((config) => config.enabled !== false)) return undefined;
-		const held = this.#held;
-		if (!held || held.broadcast !== broadcast || !(held.track in all)) return undefined;
-		return held.track;
-	}
-
 	/**
 	 * Select rendition based on the configured strategy.
 	 */
diff --git a/js/watch/src/audio/terminal.ts b/js/watch/src/audio/terminal.ts
index 00462d10471..a447a1bc04c 100644
--- a/js/watch/src/audio/terminal.ts
+++ b/js/watch/src/audio/terminal.ts
@@ -36,6 +36,11 @@ export class Terminal {
 	#prime = true;
 	#before?: Micro;
 
+	/** How far decoded output lands before its frame timestamp: the Opus pre-skip, or zero. */
+	get delay(): Micro {
+		return Math.round((this.#preSkip * 1_000_000) / 48_000) as Micro;
+	}
+
 	/** The exclusive source endpoint most recently received. */
 	get end(): Micro | undefined {
 		return this.#end;
diff --git a/js/watch/src/ui/components/buffering-indicator.ts b/js/watch/src/ui/components/buffering-indicator.ts
index 49ea11a739c..2b96028ebdb 100644
--- a/js/watch/src/ui/components/buffering-indicator.ts
+++ b/js/watch/src/ui/components/buffering-indicator.ts
@@ -13,21 +13,19 @@ export function bufferingIndicator(parent: Effect, watch: MoqWatch): HTMLElement
 		// video one. Gate it on audio actually being downloaded: the ring reports stalled from
 		// construction and drains once the download stops, so a video-only broadcast or a muted
 		// player would otherwise show the spinner forever. "instant" never downloads audio at all.
-		// A held rendition the publisher disabled has no frames coming, which is not a stall either.
-		const audioConfig = effect.get(watch.audio.source.out.config);
 		const audio =
 			effect.get(watch.audio.in.enabled) &&
-			audioConfig !== undefined &&
-			audioConfig.enabled !== false &&
+			effect.get(watch.audio.source.out.config) !== undefined &&
 			effect.get(watch.controls.delay) !== "instant";
-		const video = effect.get(watch.video.source.out.config)?.enabled !== false;
+		const video = effect.get(watch.video.source.out.config) !== undefined;
 		const buffering =
 			(video && effect.get(watch.video.out.stalled)) || (audio && effect.get(watch.audio.out.stalled));
 		const status = effect.get(watch.broadcast.out.status);
 		const online = status === "loading" || status === "live";
 		const unsupported = effect.get(watch.video.source.out.error)?.name === "NotSupportedError";
 		const paused = effect.get(watch.controls.paused);
-		container.style.display = buffering && online && !unsupported && !paused ? "" : "none";
+		container.style.display =
+			(status === "loading" || buffering) && online && !unsupported && !paused ? "" : "none";
 	});
 
 	return container;
diff --git a/js/watch/src/video/decoder.test.ts b/js/watch/src/video/decoder.test.ts
index 6f643ff4aa0..618536e4ee1 100644
--- a/js/watch/src/video/decoder.test.ts
+++ b/js/watch/src/video/decoder.test.ts
@@ -585,28 +585,6 @@ it("keeps the clock when only the catalog's broadcast is republished", async ()
 	}
 });
 
-it("holds the picture and decoder while the only rendition is disabled", async () => {
-	const playback = await guardedPlayback("legacy", [sample(10n, 1000)]);
-	try {
-		const held = playback.decoder.out.frame.peek();
-		expect(held).toBeDefined();
-		const codecs = playback.codecs;
-
-		const video = playback.catalog.peek().video?.renditions.video;
-		if (!video) throw new Error("missing rendition");
-		playback.catalog.set({ video: { renditions: { video: { ...video, enabled: false } } } });
-		await microtasks();
-		// The last picture before the disable stays up; the stock publisher makes it black.
-		expect(playback.decoder.out.frame.peek()).toBe(held);
-
-		playback.catalog.set({ video: { renditions: { video } } });
-		await microtasks();
-		expect(playback.codecs).toBe(codecs);
-	} finally {
-		playback.close();
-	}
-});
-
 it("clears the picture once no rendition is selectable", async () => {
 	const playback = await guardedPlayback("legacy", [sample(10n, 1000)]);
 	try {
diff --git a/js/watch/src/video/decoder.ts b/js/watch/src/video/decoder.ts
index d26a1dbfc63..3dbc465e68b 100644
--- a/js/watch/src/video/decoder.ts
+++ b/js/watch/src/video/decoder.ts
@@ -180,9 +180,7 @@ export class Decoder {
 		const startup = this.#signals.computed((effect) => {
 			if (!effect.get(this.in.enabled)) return undefined;
 			if (effect.get(this.source.pending)) return null;
-			// A held disabled rendition has no frames coming, so startup does not wait on it.
-			const config = effect.get(this.source.out.config);
-			if (!config || config.enabled === false) return undefined;
+			if (!effect.get(this.source.out.config)) return undefined;
 			const active = effect.get(this.#active);
 			if (!active) return null;
 			const timestamp = effect.get(active.first);
diff --git a/js/watch/src/video/source.test.ts b/js/watch/src/video/source.test.ts
index c40569d1465..23e6972be44 100644
--- a/js/watch/src/video/source.test.ts
+++ b/js/watch/src/video/source.test.ts
@@ -243,55 +243,15 @@ describe("Source disabled rendition selection", () => {
 		source.close();
 	});
 
-	it("holds the selected rendition while every rendition is disabled", async () => {
-		const state = mutableBroadcast({
-			low: config("avc1.64001e", { bitrate: 1_000_000 }),
-			high: config("avc1.640028", { bitrate: 2_000_000 }),
-		});
-		const source = new Source({ broadcast: state.broadcast, supported: async () => true });
-
-		await settle();
-		expect(source.out.track.peek()).toBe("high");
-
-		state.catalog.set({
-			video: {
-				renditions: {
-					low: config("avc1.64001e", { bitrate: 1_000_000, enabled: false }),
-					high: config("avc1.640028", { bitrate: 2_000_000, enabled: false }),
-				},
-			},
-		});
-		await settle();
-		expect(source.out.track.peek()).toBe("high");
-		expect(source.out.config.peek()?.enabled).toBe(false);
-
-		// An enabled alternative takes over from the held rendition.
-		state.catalog.set({
-			video: {
-				renditions: {
-					low: config("avc1.64001e", { bitrate: 1_000_000 }),
-					high: config("avc1.640028", { bitrate: 2_000_000, enabled: false }),
-				},
-			},
-		});
-		await settle();
-		expect(source.out.track.peek()).toBe("low");
-		source.close();
-	});
-
-	it("drops a held rendition once it is removed", async () => {
+	it("deselects the selected rendition once every rendition is disabled", async () => {
 		const state = mutableBroadcast({ high: config("avc1.640028", { bitrate: 2_000_000 }) });
 		const source = new Source({ broadcast: state.broadcast, supported: async () => true });
 
-		await settle();
-		state.catalog.set({
-			video: { renditions: { high: config("avc1.640028", { bitrate: 2_000_000, enabled: false }) } },
-		});
 		await settle();
 		expect(source.out.track.peek()).toBe("high");
 
 		state.catalog.set({
-			video: { renditions: { low: config("avc1.64001e", { bitrate: 1_000_000, enabled: false }) } },
+			video: { renditions: { high: config("avc1.640028", { bitrate: 2_000_000, enabled: false }) } },
 		});
 		await settle();
 		expect(source.out.track.peek()).toBeUndefined();
@@ -299,46 +259,6 @@ describe("Source disabled rendition selection", () => {
 		source.close();
 	});
 
-	it("does not hold an enabled selection into another broadcast's disabled rendition", async () => {
-		const current = new Signal<Broadcast | undefined>(
-			mutableBroadcast({ high: config("avc1.640028", { bitrate: 2_000_000 }) }).broadcast,
-		);
-		const source = new Source({ broadcast: current, supported: async () => true });
-
-		await settle();
-		expect(source.out.track.peek()).toBe("high");
-
-		current.set(
-			mutableBroadcast({ high: config("avc1.640028", { bitrate: 2_000_000, enabled: false }) }).broadcast,
-		);
-		await settle();
-		expect(source.out.track.peek()).toBeUndefined();
-		expect(source.out.config.peek()).toBeUndefined();
-		source.close();
-	});
-
-	it("holds on a broadcast whose renditions match the previous one", async () => {
-		const current = new Signal<Broadcast | undefined>(
-			mutableBroadcast({ high: config("avc1.640028", { bitrate: 2_000_000 }) }).broadcast,
-		);
-		const source = new Source({ broadcast: current, supported: async () => true });
-		await settle();
-
-		// The new probe publishes an equal `available`, so only its broadcast tag changes.
-		const next = mutableBroadcast({ high: config("avc1.640028", { bitrate: 2_000_000 }) });
-		current.set(next.broadcast);
-		await settle();
-		expect(source.out.track.peek()).toBe("high");
-
-		next.catalog.set({
-			video: { renditions: { high: config("avc1.640028", { bitrate: 2_000_000, enabled: false }) } },
-		});
-		await settle();
-		expect(source.out.track.peek()).toBe("high");
-		expect(source.out.config.peek()?.enabled).toBe(false);
-		source.close();
-	});
-
 	it("ignores a legacy stalled flag", async () => {
 		const source = new Source({
 			broadcast: mockBroadcast({
diff --git a/js/watch/src/video/source.ts b/js/watch/src/video/source.ts
index 31162082e73..02724775dae 100644
--- a/js/watch/src/video/source.ts
+++ b/js/watch/src/video/source.ts
@@ -182,7 +182,7 @@ function byBitrate(target: number): RenditionFilter {
 	};
 }
 
-/** Return the renditions that may be newly selected: a disabled one has no frames coming. */
+/** Return the renditions that may be selected: a disabled one has no frames coming. */
 function enabledRenditions(renditions: Record<string, Catalog.VideoConfig>): Record<string, Catalog.VideoConfig> {
 	return Object.fromEntries(Object.entries(renditions).filter(([, config]) => config.enabled !== false));
 }
@@ -217,13 +217,6 @@ export class Source {
 	/** Whether rendition support is still being resolved. @internal */
 	readonly pending: Getter<boolean> = this.#probe.pending;
 
-	// The last selection, which a disable holds while no enabled rendition remains.
-	#held?: { broadcast: Broadcast; track: string };
-
-	// The broadcast `available` was probed for. It lags a broadcast switch until the new probe lands.
-	// A signal, since the new broadcast's renditions can equal the old ones and leave `available` unchanged.
-	#probed = new Signal<Broadcast | undefined>(undefined);
-
 	#signals = new Effect();
 
 	constructor(props?: Inputs<SourceInput>) {
@@ -254,26 +247,16 @@ export class Source {
 		// Read the catalog from the broadcast itself, so the probe result is tagged with the right one.
 		const broadcast = effect.get(this.in.broadcast);
 		const renditions = (broadcast && effect.get(broadcast.out.catalog)?.video?.renditions) ?? {};
-		this.#probe.run(effect, supported, renditions, (available) => {
-			this.#probed.set(broadcast);
-			this.#out.available.set(available);
-		});
+		this.#probe.run(effect, supported, renditions, (available) => this.#out.available.set(available));
 	}
 
 	#runSelected(effect: Effect): void {
-		const broadcast = effect.get(this.in.broadcast);
-		const all = effect.get(this.#out.available);
-		const probed = effect.get(this.#probed);
-		const available = enabledRenditions(all);
-		const target = effect.get(this.in.target);
-
-		const selected = this.#choose(effect, available, target) ?? this.#hold(broadcast, all);
-		// A pick from the previous broadcast's renditions is not this broadcast's selection to hold.
-		this.#held = selected && broadcast && probed === broadcast ? { broadcast, track: selected } : undefined;
+		const available = enabledRenditions(effect.get(this.#out.available));
+		const selected = this.#choose(effect, available, effect.get(this.in.target));
 		if (!selected) return;
 
 		effect.set(this.#out.track, selected);
-		effect.set(this.#out.config, all[selected]);
+		effect.set(this.#out.config, available[selected]);
 	}
 
 	// Pick among the enabled renditions.
@@ -295,15 +278,6 @@ export class Source {
 		return this.#select(preferredRenditions(available), effectiveTarget);
 	}
 
-	// Every rendition is disabled: keep the selected one, and its subscription, so the re-enable
-	// plays without a resubscribe. A removed rendition, or another broadcast, starts over.
-	#hold(broadcast: Broadcast | undefined, all: Record<string, Catalog.VideoConfig>): string | undefined {
-		if (Object.values(all).some((config) => config.enabled !== false)) return undefined;
-		const held = this.#held;
-		if (!held || held.broadcast !== broadcast || !(held.track in all)) return undefined;
-		return held.track;
-	}
-
 	/**
 	 * Select the best rendition using a generic filter system.
 	 *
diff --git a/quest/m1/audio-jitter-target/README.md b/quest/m1/audio-jitter-target/README.md
index 05bc0f3b2dc..fa2f3fae71b 100644
--- a/quest/m1/audio-jitter-target/README.md
+++ b/quest/m1/audio-jitter-target/README.md
@@ -33,6 +33,12 @@ target, and `moq play` copies NetEq's stretch in m1 as
 [Native stretch](/quest/m1/audio-jitter-target/native-stretch.md), sharing
 one algorithm and its vectors with the browser's.
 
+Decided 2026-11-04 (maintainer), for push-to-talk's silence suppression
+([moq-dev/moq#7942](https://github.com/moq-dev/moq/pull/7942)): a silence the publisher declares
+with an end marker is not idle, so the estimator folds no idle intervals for
+it and keeps its estimate, where an undeclared gap still relaxes toward the
+prior. The document's `silence` corpus case holds both implementations to it.
+
 What the line still owes once Watch lands: its recorded trace replayed through
 the native decode path too, asserting the same target series the browser's
 `playout.test.ts` does. The audio quality harness's `pulse` rows already grade
diff --git a/quest/m1/push-to-talk-latency.md b/quest/m1/push-to-talk-latency.md
index 519d30f72f0..1a7b2f50cb7 100644
--- a/quest/m1/push-to-talk-latency.md
+++ b/quest/m1/push-to-talk-latency.md
@@ -71,8 +71,8 @@ per-press arrival-lateness spread, from capture bursts rather than the
 network, would make the measured term nonzero; that is the estimator working
 as specified in [Audio jitter
 target](/quest/m1/audio-jitter-target/README.md). With capture fixed, the
-spread left on Chromium 155+ is its 10 ms capture chunks, plus the release
-flush's lookahead chunk, which goes out up to a frame ahead of its media.
+spread left on Chromium 155+ is its 10 ms capture chunks; a release no longer
+flushes the codec's lookahead chunk out ahead of its media.
 Older Chromium still paces capture at the device's callback size.
 
 Decided 2026-11-04 (maintainer, planning in
@@ -85,12 +85,9 @@ Decided 2026-11-04 (maintainer, planning in
   first; set the budget from those numbers, and keep output-side knobs until
   then.
 - ✅ Browser only.
-- The catalog toggle forces at least a round trip of jitter buffer, so the
-  budget is measured once push-to-talk runs on DTX (Required below).
-
-## Required
-
-- [Push-to-talk suppresses silence instead of toggling the catalog](/quest/m1/push-to-talk/dtx.md) - removes the catalog round trip the budget would otherwise carry
+- The catalog toggle forced at least a round trip of jitter buffer, so the
+  budget is measured on silence suppression, which
+  [moq-dev/moq#7942](https://github.com/moq-dev/moq/pull/7942) landed.
 
 ## Related
 
diff --git a/quest/m1/push-to-talk/README.md b/quest/m1/push-to-talk/README.md
index e92815b1bd2..d43d1d0088d 100644
--- a/quest/m1/push-to-talk/README.md
+++ b/quest/m1/push-to-talk/README.md
@@ -24,14 +24,15 @@ Decided 2026-10-28 (maintainer):
   encoder CPU. DTX is off on main anyway ([#4919](https://github.com/moq-dev/moq/pull/4919)).
   **Reversed 2026-11-04 (maintainer):** a catalog toggle makes every listener
   wait out the `enabled` flip, so the jitter buffer must hold at least a round
-  trip. Push-to-talk moves to DTX ([Push-to-talk suppresses
-  silence](/quest/m1/push-to-talk/dtx.md)), and hold retires when that lands;
-  until then hold stays on main.
-- **Players hold a disabled rendition**, audio and video, by default, in
-  every first-party player. Exports keep dropping it, since a held track
-  sends nothing and an interleaving muxer or HLS player may wait on it. The
-  hang spec weakens from "must not select" to "should not select" a disabled
-  rendition.
+  trip. Done by [moq-dev/moq#7942](https://github.com/moq-dev/moq/pull/7942):
+  the mute sends nothing and keeps the rendition enabled, the publisher gates
+  capture before the encoder and stamps chunks from the inputs it fed, and
+  each muted span ends with a discontinuity marker that listeners play as
+  comfort noise, with no underrun or stall, which the jitter estimator ignores.
+- **Players hold a disabled rendition**, retired by
+  [moq-dev/moq#7942](https://github.com/moq-dev/moq/pull/7942) with the mute
+  that needed it. Every first-party player deselects a disabled rendition
+  again, and the hang spec is back to "must not select".
 - **The publisher keeps its probe result across a disable**, and the
   element's `muted` and `invisible` leave capture open.
 - **Encoding no longer waits for demand**, in every first-party publisher
@@ -42,9 +43,10 @@ Decided 2026-10-28 (maintainer):
   same idea special-cased.
 
 The epic's own work: the acceptance proof `just test push-to-talk` (22
-presses, 60 ms Opus, 300 ms delay). A held listener's unmute pays no catalog
+presses, 60 ms Opus, 300 ms delay). A listener's unmute pays no catalog
 round trip and no resubscribe, and every frame of each utterance is encoded,
-sent, received, and decoded from its first frame.
+sent, received, and decoded from its first frame, with no catalog flip and no
+underrun or stall across the presses.
 
 Decided with the maintainer on
 [moq-dev/moq#7760](https://github.com/moq-dev/moq/pull/7760):
@@ -69,10 +71,9 @@ Decided with the maintainer on
   hardware codecs; Opus is software. A failure stays latched until a device,
   settings or `source` change.
 
-The publisher's tail drop is fixed:
-[moq-dev/moq#7725](https://github.com/moq-dev/moq/pull/7725) flushes the codec
-before a disable's discontinuity. A frame submitted under 1 ms before release
-used to be lost in 3 of 7 runs; it was lost in none of 12 since.
+The publisher's tail drop is fixed: a release's discontinuity marker waits
+until the codec has emitted every chunk submitted before it. A frame submitted
+under 1 ms before release used to be lost in 3 of 7 runs.
 
 What remains is a lost head at the listener. In one of 110 presses over the
 2026-11-04 relay runs (run 3, press 20, after a 60 s mute), the
@@ -94,7 +95,6 @@ catches this. A complete set of runs finishes this epic.
 
 ## Required
 
-- [Push-to-talk suppresses silence instead of toggling the catalog](/quest/m1/push-to-talk/dtx.md) - replaces hold with DTX
 - [Native playback fills declared silence with comfort noise](/quest/m1/push-to-talk/native-comfort-noise.md) - `moq play` plays comfort noise over declared silence and counts no underrun, matching the browser
 
 ## Closes
diff --git a/quest/m1/push-to-talk/dtx.md b/quest/m1/push-to-talk/dtx.md
deleted file mode 100644
index 2b7318fc73f..00000000000
--- a/quest/m1/push-to-talk/dtx.md
+++ /dev/null
@@ -1,66 +0,0 @@
-# [M] Push-to-talk suppresses silence instead of toggling the catalog
-
-## Goal
-
-Muting a push-to-talk publisher keeps its audio rendition enabled and its
-subscription live, and sends no media while silent. The next utterance reaches
-a listener with no catalog flip and no round trip, and listeners play comfort
-noise across the silence without counting it as an underrun. The hold design,
-listeners staying subscribed to a disabled rendition, is retired in the same
-change. `just test push-to-talk` proves it.
-
-## Plan
-
-Planned 2026-11-04 with the maintainer, from the
-[moq-dev/moq#7760](https://github.com/moq-dev/moq/pull/7760) latency
-breakdown.
-
-Decided 2026-11-04 (maintainer), reversing the epic's 2026-10-28 "Hold, not
-DTX": a catalog toggle makes every listener wait out the `enabled` flip, so
-the jitter buffer must hold at least a round trip for push-to-talk to work,
-and the maintainer would rather fix DTX and avoid the catalog entirely.
-
-- **Route: gate before the encoder, stamp from our own inputs ✅**, decided
-  2026-11-04 (maintainer) from the measurements on Chrome, Firefox and Safari
-  in [moq-dev/moq#7880](https://github.com/moq-dev/moq/pull/7880). Not chosen:
-  WASM libopus 1.6.1 with DTX; the gate plus native `usedtx` on Firefox only.
-  While muted, the publisher feeds the `AudioEncoder` nothing, and stamps
-  each chunk from a queue of the input timestamps it fed, never
-  `chunk.timestamp`: Chrome and Firefox stamp gated input as if it were
-  contiguous (19 s ended at 10.6 s), and every browser emits exactly one chunk
-  per input, in order, within 28 ms, so nothing waits in the codec across a
-  gap. That also retires the encoder restart on an input gap in
-  `js/publish/src/audio/encoder.ts`. `flush()` emits one extra chunk past the
-  queue in every browser (the codec's lookahead tail); the queue must account
-  for it.
-- **Mute is the gate ✅**, decided 2026-11-04 (maintainer): the publisher's
-  mute only. Not chosen: mute plus an energy VAD for open mic. No energy VAD
-  until open-mic suppression has a consumer. One was measured in #7880
-  (-45 dBFS, 200 ms hangover, one frame of pre-roll): no speech frame lost
-  and the head within 5 ms of unsuppressed.
-- Silence then sends nothing, where libopus DTX still sends comfort-noise
-  updates (2.9 packets/s, 1.3 kbps); the listener makes its own comfort noise
-  (below). Rejected: WASM libopus (the encoder is 117 KB gzip at `-Oz`; the
-  151 KB `-O2` build took 1.5 to 2.2x the native encode time) and native
-  `usedtx` (Chrome drifts 7.3 s over 19 s,
-  Safari ignores it; see [Chromium's Opus encoder stamps chunks from their
-  input](/quest/m2/chromium-opus-timestamps.md)).
-- **Hold retires when this lands ✅**, not before, so push-to-talk keeps
-  working on main meanwhile. Remove the players' default hold of a disabled
-  rendition and restore the hang spec's "must not select" if nothing else
-  relies on "should not select"; check video and exports before restoring.
-- **Gaps play comfort noise ✅**, not plain silence. A suppressed span is
-  intentional silence: it counts as no underrun, does not grow the buffer, and
-  the jitter estimator ignores it
-  ([Audio jitter target](/quest/m1/audio-jitter-target/README.md) specifies
-  the estimator; record the exception there too).
-- The publisher's mute becomes "suppress", not `enabled: false`. Keep
-  `enabled` for a real stop (leaving the call), where a catalog change is
-  correct.
-- Mind the release flush's lookahead chunk. The disable path's `flush()`
-  sends it at once, up to a frame ahead of its media
-  ([moq-dev/moq#7881](https://github.com/moq-dev/moq/pull/7881) measured it adding
-  10-22 ms to the median per-press spread). `"auto"` then measures an utterance that starts
-  within its 2 s window against it, so suppression should not reintroduce it.
-
-Update the epic's acceptance and `doc/` pages that describe hold.
diff --git a/quest/m1/push-to-talk/native-comfort-noise.md b/quest/m1/push-to-talk/native-comfort-noise.md
index 31d72a23a36..81fed0f73d2 100644
--- a/quest/m1/push-to-talk/native-comfort-noise.md
+++ b/quest/m1/push-to-talk/native-comfort-noise.md
@@ -8,13 +8,6 @@ plays level-matched comfort noise instead of plain silence, counts no underrun
 or stall, and keeps that silence through the next utterance's refill. A
 push-to-talk listener on `moq play` then matches the browser.
 
-## Waiting
-
-- moq-dev/moq: [moq-dev/moq#7942](https://github.com/moq-dev/moq/pull/7942)
-  merges. It defines how a suppressed span is declared and already gives
-  `moq-audio`'s jitter estimator the declared-silence exception. Check that
-  it is merged and `quest/m1/push-to-talk/dtx.md` is gone from `main`.
-
 ## Plan
 
 Planned 2026-11-05 (maintainer, /quest-plan of the follow-ups from the
diff --git a/quest/m2/chromium-opus-timestamps.md b/quest/m2/chromium-opus-timestamps.md
index 6a0964c4772..653f724faa7 100644
--- a/quest/m2/chromium-opus-timestamps.md
+++ b/quest/m2/chromium-opus-timestamps.md
@@ -9,10 +9,9 @@ in input timestamps. Check by running the repro attached to
 Chrome: scenario A ends near 13.98 s with steps across
 suppressed spans, and scenario C follows the +1 s jump. Delete this quest once a stable Chrome
 passes. Nothing in moq depends on it, so this quest only tracks the upstream
-report: the publisher never sets `usedtx`, and the planned push-to-talk route
-([Push-to-talk suppresses silence](/quest/m1/push-to-talk/dtx.md)), not yet
-implemented, gates silence before the encoder and stamps chunks from its own
-inputs. Safari ignores `usedtx`.
+report: the publisher never sets `usedtx`, and its push-to-talk mute gates
+silence before the encoder and stamps chunks from its own inputs
+(`js/publish/src/audio/encoder.ts`). Safari ignores `usedtx`.
 
 ## Plan
 
diff --git a/quest/m3/ladder/README.md b/quest/m3/ladder/README.md
index 157e7ecaa47..024bdbec998 100644
--- a/quest/m3/ladder/README.md
+++ b/quest/m3/ladder/README.md
@@ -20,7 +20,7 @@ publisher-side ladder.
 
 The catalog and player half is the rendition `enabled` flag, which replaced the `stalled`
 state shipped in [moq#2865](https://github.com/moq-dev/moq/pull/2865):
-`enabled: false` means no frames are coming and a viewer should not select the
+`enabled: false` means no frames are coming and a viewer must not select the
 rendition. Routing, decoder, and presentation identities are split so a
 metadata-only change cannot rebuild WebCodecs.
 
diff --git a/rs/hang/src/catalog/audio/mod.rs b/rs/hang/src/catalog/audio/mod.rs
index 177afe90eea..0df4866edfd 100644
--- a/rs/hang/src/catalog/audio/mod.rs
+++ b/rs/hang/src/catalog/audio/mod.rs
@@ -156,8 +156,7 @@ pub struct AudioConfig {
 	pub bitrate: Option<u64>,
 
 	/// Whether this rendition may be selected. When false, no frames are coming and a consumer
-	/// should not select it, though one may keep it selected while no enabled alternative exists.
-	/// Only written when false.
+	/// must not select it. Only written when false.
 	#[serde(
 		default = "crate::catalog::enabled_default",
 		skip_serializing_if = "crate::catalog::enabled_skip"
diff --git a/rs/hang/src/catalog/video/mod.rs b/rs/hang/src/catalog/video/mod.rs
index db21279c4d2..e2faf3e660a 100644
--- a/rs/hang/src/catalog/video/mod.rs
+++ b/rs/hang/src/catalog/video/mod.rs
@@ -279,8 +279,7 @@ pub struct VideoConfig {
 	pub bitrate: Option<u64>,
 
 	/// Whether this rendition may be selected. When false, no frames are coming and a consumer
-	/// should not select it, though one may keep it selected while no enabled alternative exists.
-	/// Only written when false.
+	/// must not select it. Only written when false.
 	#[serde(
 		default = "crate::catalog::enabled_default",
 		skip_serializing_if = "crate::catalog::enabled_skip"
diff --git a/rs/moq-audio/src/decode/consumer.rs b/rs/moq-audio/src/decode/consumer.rs
index af8671cf438..724bc9aed6b 100644
--- a/rs/moq-audio/src/decode/consumer.rs
+++ b/rs/moq-audio/src/decode/consumer.rs
@@ -335,7 +335,10 @@ impl Consumer {
 					let first = !std::mem::replace(&mut self.started, true);
 					// A later group after a declared end comes from a fresh encoder; the end's
 					// own group carries the stopped encoder's final packets, trimmed below.
+					// Those packets end the speech before the silence, so only this frame
+					// tells the estimator the silence it measures across was declared.
 					if self.end.is_some() && group != self.end_group {
+						self.target.end();
 						self.restart()?;
 					}
 					// Nothing precedes group 0, and a group delivers from its frame 0 or not at
@@ -346,6 +349,10 @@ impl Consumer {
 				// Behind whatever the resampler held from before the loss.
 				Some(Encoded::Gap { timestamp, duration }) => {
 					self.started = true;
+					// The restart forgets the end, but the silence across it stays declared.
+					if self.end.is_some() {
+						self.target.end();
+					}
 					self.restart()?;
 					self.warmup_pending = !self.warmup.is_zero();
 					self.ready.push_back(Read::Gap { timestamp, duration });
@@ -2198,7 +2205,9 @@ mod tests {
 	/// sample count either way, and an unoptimized Opus codec takes minutes over
 	/// the whole corpus. [`opus_states_its_own_frame_duration`] covers Opus. The
 	/// lowest common rate keeps each packet small, since only its duration counts.
-	async fn replay(case: &crate::jitter::tests::Case) -> Vec<f64> {
+	/// With `hole`, the group after each end marker never arrives, so the consumer reads a
+	/// gap between the marker and what resumes.
+	async fn replay(case: &crate::jitter::tests::Case, hole: bool) -> Vec<f64> {
 		use crate::jitter::tests::duration;
 
 		let rate = 8_000;
@@ -2236,7 +2245,24 @@ mod tests {
 
 		let payload: Bytes = vec![0u8; samples * size_of::<f32>()].into();
 		let mut series = Vec::with_capacity(case.arrival.len());
-		for (&arrival, &media) in case.arrival.iter().zip(&case.media) {
+		// The sequence of the next group, one per packet and one per marker.
+		let mut sequence = 0;
+		for (index, (&arrival, &media)) in case.arrival.iter().zip(&case.media).enumerate() {
+			// The marker goes out as the utterance stops, so it is read during the silence
+			// rather than alongside what resumes it.
+			if case.ends.contains(&index) {
+				producer.discontinuity().unwrap();
+				sequence += 1;
+				match consumer.read().await.unwrap() {
+					Some(Read::End { .. }) => {}
+					other => panic!("packet {index} is preceded by {other:?}, not its end"),
+				}
+				if hole {
+					sequence += 1;
+					producer.seek(sequence).unwrap();
+				}
+			}
+			sequence += 1;
 			CLOCK.set(Some(origin + duration(arrival)));
 			producer
 				.write(moq_mux::container::Frame {
@@ -2262,7 +2288,8 @@ mod tests {
 	/// container hands a packet over, media from its timestamp, and the frame term
 	/// from what the codec decoded. `reorder` and `backlog` are left to the
 	/// estimator's own test, since the container refuses a timestamp that runs
-	/// backwards.
+	/// backwards. `silence` publishes a discontinuity marker ahead of each frame its
+	/// `ends` lists, so the consumer has to find the declared end on its own.
 	#[tokio::test]
 	async fn the_decode_path_conforms_to_the_corpus() {
 		for name in [
@@ -2272,12 +2299,13 @@ mod tests {
 			"flush",
 			"idle",
 			"paced",
+			"silence",
 			"spike",
 			"tunein",
 		] {
 			let case = crate::jitter::tests::case(name);
 			let expected = case.series();
-			for (index, actual) in replay(&case).await.into_iter().enumerate() {
+			for (index, actual) in replay(&case, false).await.into_iter().enumerate() {
 				// A Duration is whole nanoseconds, so the round trip through one costs up
 				// to a nanosecond on top of the corpus tolerance.
 				assert!(
@@ -2289,6 +2317,15 @@ mod tests {
 		}
 	}
 
+	/// A group lost between a declared end and what resumes leaves the end declared, as the
+	/// browser's consumer does: the estimator measures the same as when nothing was lost.
+	#[tokio::test]
+	async fn a_declared_end_survives_a_lost_group() {
+		let case = crate::jitter::tests::case("silence");
+		assert!(!case.ends.is_empty());
+		assert_eq!(replay(&case, true).await, replay(&case, false).await);
+	}
+
 	/// The frame term is the packet's full duration, pre-skip included: Opus trims
 	/// codec delay off the first packet, and reading the frame off what came out
 	/// would shrink the term by exactly that much.
diff --git a/rs/moq-audio/src/jitter.rs b/rs/moq-audio/src/jitter.rs
index 62f295b8a81..0aa2fda433b 100644
--- a/rs/moq-audio/src/jitter.rs
+++ b/rs/moq-audio/src/jitter.rs
@@ -70,6 +70,13 @@ impl Target {
 		}
 	}
 
+	/// Mark a declared end between the previous observation and the next. A fixed target ignores it.
+	pub(crate) fn end(&mut self) {
+		if let Self::Auto(estimator) = self {
+			estimator.end();
+		}
+	}
+
 	/// Set the codec's frame duration, the term added on top of the measurement.
 	pub(crate) fn set_frame(&mut self, frame: f64) {
 		if let Self::Auto(estimator) = self {
@@ -260,6 +267,8 @@ pub(crate) struct Estimator {
 	interval: f64,
 	/// The largest delay seen in that interval.
 	peak: f64,
+	/// A declared end precedes the next measured observation, so the silence before it is not idle.
+	ended: bool,
 
 	histogram: [f64; BUCKETS],
 	/// How much of the histogram is still the prior's rather than evidence.
@@ -276,6 +285,7 @@ impl Estimator {
 			origin: None,
 			interval: 0.0,
 			peak: 0.0,
+			ended: false,
 			histogram: std::array::from_fn(prior),
 			prior: 1.0,
 		}
@@ -309,6 +319,7 @@ impl Estimator {
 		};
 
 		let interval = ((arrival - origin) / RESAMPLE).floor();
+		let resumed = std::mem::take(&mut self.ended);
 		if interval <= self.interval {
 			self.peak = self.peak.max(delay);
 			return;
@@ -316,15 +327,33 @@ impl Estimator {
 
 		self.fold(Some(((self.peak / BUCKET).floor() as usize).min(BUCKETS - 1)));
 
-		let idle = f64::min(interval - self.interval - 1.0, IDLE_MAX);
-		for _ in 0..idle as u32 {
-			self.fold(None);
+		if resumed {
+			// A silence the publisher declared says nothing about the path, so the
+			// estimate keeps what it had and a fresh interval starts here.
+			self.origin = Some(arrival);
+			self.interval = 0.0;
+		} else {
+			// An interval with no arrival relaxes the estimate toward the prior.
+			let idle = f64::min(interval - self.interval - 1.0, IDLE_MAX);
+			for _ in 0..idle as u32 {
+				self.fold(None);
+			}
+			self.interval = interval;
 		}
-
-		self.interval = interval;
 		self.peak = delay;
 	}
 
+	/// A declared end lies between the previous observation and the next, so the
+	/// silence it declares does not relax the estimate the way an unexplained gap
+	/// does. Called before observing the first frame after the end, not at the
+	/// marker, since the stopped encoder's final packets may still follow it.
+	fn end(&mut self) {
+		// Before any observation there is no interval for the silence to stretch.
+		if self.origin.is_some() {
+			self.ended = true;
+		}
+	}
+
 	fn target(&self) -> f64 {
 		let mut cumulative = 0.0;
 		let mut measured = BUCKETS as f64 * BUCKET;
@@ -376,6 +405,9 @@ pub(crate) mod tests {
 		pub delay: Option<f64>,
 		pub arrival: Vec<f64>,
 		pub media: Vec<f64>,
+		/// Indices of the frames observed right after a declared end.
+		#[serde(default)]
+		pub ends: Vec<usize>,
 		pub target: Vec<(usize, f64)>,
 	}
 
@@ -414,7 +446,7 @@ pub(crate) mod tests {
 
 	/// Every case the document lists. Named rather than globbed, so a case that
 	/// goes missing fails here instead of silently shrinking the suite.
-	const CORPUS: [&str; 11] = [
+	const CORPUS: [&str; 12] = [
 		"advertised",
 		"backlog",
 		"buildup",
@@ -423,6 +455,7 @@ pub(crate) mod tests {
 		"idle",
 		"paced",
 		"reorder",
+		"silence",
 		"spike",
 		"straggler",
 		"tunein",
@@ -441,6 +474,9 @@ pub(crate) mod tests {
 
 			let series = case.series();
 			for (index, (&arrival, &media)) in case.arrival.iter().zip(&case.media).enumerate() {
+				if case.ends.contains(&index) {
+					target.end();
+				}
 				target.observe(arrival, media);
 				let actual = target.millis();
 				assert!(
@@ -465,6 +501,21 @@ pub(crate) mod tests {
 		assert_eq!(target.millis(), 40.0);
 	}
 
+	/// A cold estimator has no interval for a silence to stretch, so an end before
+	/// the first observation must not linger and excuse the first unexplained gap.
+	#[test]
+	fn an_end_before_any_observation_is_ignored() {
+		let mut target = Target::new(Duration::ZERO, true, None);
+		target.set_frame(20.0);
+		target.end();
+		for i in 0..500 {
+			target.observe(50.0 + i as f64 * 20.0, i as f64 * 20.0);
+		}
+		let settled = target.millis();
+		target.observe(50.0 + 500.0 * 20.0 + 30_000.0, 500.0 * 20.0 + 30_000.0);
+		assert!(target.millis() > settled);
+	}
+
 	#[test]
 	fn an_advertised_span_floors_rather_than_adds() {
 		let target = Target::new(Duration::ZERO, true, Some(Duration::from_millis(200)));
diff --git a/rs/moq-c/MIGRATE.md b/rs/moq-c/MIGRATE.md
index c9acce77e19..38a3689fb19 100644
--- a/rs/moq-c/MIGRATE.md
+++ b/rs/moq-c/MIGRATE.md
@@ -4,6 +4,10 @@ How to update your code for each breaking change, newest first.
 
 ## Unreleased
 
+### Consumers and decoders refuse a disabled rendition ([#7942](https://github.com/moq-dev/moq/pull/7942))
+
+`moq_consume_audio`, `moq_consume_video`, `moq_decode_audio`, and `moq_decode_video` return `MOQ_ERROR_NOT_FOUND` when the catalog snapshot marks the rendition disabled, instead of subscribing and waiting for a re-enable. Check `moq_consume_audio_enabled` or `moq_consume_video_enabled` on the latest snapshot first, and cancel a consumer whose rendition a newer snapshot disables.
+
 ### Pre-encoded simulcast
 
 `moq_video_init` gains `lower`, changing its C ABI layout. Rebuild against the
diff --git a/rs/moq-c/src/api.rs b/rs/moq-c/src/api.rs
index 788405c5024..60abbd171ca 100644
--- a/rs/moq-c/src/api.rs
+++ b/rs/moq-c/src/api.rs
@@ -3916,11 +3916,11 @@ pub unsafe extern "C" fn moq_consume_video_config(catalog: u32, index: u32, dst:
 	})
 }
 
-/// Query whether the publisher is serving a video rendition.
+/// Query whether a video rendition may be selected.
 ///
-/// False means no frames are coming until it re-enables. Pick an enabled rendition, but keep one
-/// already playing while every video rendition is disabled, so a re-enable plays without a
-/// resubscribe. A catalog that omits the optional field reads as true.
+/// False means no frames are coming and the rendition must not be selected: [moq_consume_video]
+/// and `moq_decode_video` refuse it with `MOQ_ERROR_NOT_FOUND`. A catalog that omits the optional
+/// field reads as true.
 ///
 /// Returns zero on success, or a negative code on failure.
 ///
@@ -3979,11 +3979,11 @@ pub unsafe extern "C" fn moq_consume_audio_config(catalog: u32, index: u32, dst:
 	})
 }
 
-/// Query whether the publisher is serving an audio rendition.
+/// Query whether an audio rendition may be selected.
 ///
-/// False means no frames are coming until it re-enables. Pick an enabled rendition, but keep one
-/// already playing while every audio rendition is disabled, so a re-enable plays without a
-/// resubscribe. A catalog that omits the optional field reads as true.
+/// False means no frames are coming and the rendition must not be selected: [moq_consume_audio]
+/// and `moq_decode_audio` refuse it with `MOQ_ERROR_NOT_FOUND`. A catalog that omits the optional
+/// field reads as true.
 ///
 /// Returns zero on success, or a negative code on failure.
 ///
diff --git a/rs/moq-c/src/consume.rs b/rs/moq-c/src/consume.rs
index e43df123482..48b320473cc 100644
--- a/rs/moq-c/src/consume.rs
+++ b/rs/moq-c/src/consume.rs
@@ -67,6 +67,9 @@ pub(crate) trait Media: hang::catalog::Reference + Clone {
 
 	/// Its renditions, keyed by ID.
 	fn renditions(catalog: &moq_mux::catalog::hang::Catalog<moq_mux::catalog::hang::Extra>) -> &BTreeMap<String, Self>;
+
+	/// Whether the publisher is serving this rendition.
+	fn enabled(&self) -> bool;
 }
 
 impl Media for hang::catalog::VideoConfig {
@@ -79,6 +82,10 @@ impl Media for hang::catalog::VideoConfig {
 	fn renditions(catalog: &moq_mux::catalog::hang::Catalog<moq_mux::catalog::hang::Extra>) -> &BTreeMap<String, Self> {
 		&catalog.video.renditions
 	}
+
+	fn enabled(&self) -> bool {
+		self.enabled
+	}
 }
 
 impl Media for hang::catalog::AudioConfig {
@@ -91,6 +98,10 @@ impl Media for hang::catalog::AudioConfig {
 	fn renditions(catalog: &moq_mux::catalog::hang::Catalog<moq_mux::catalog::hang::Extra>) -> &BTreeMap<String, Self> {
 		&catalog.audio.renditions
 	}
+
+	fn enabled(&self) -> bool {
+		self.enabled
+	}
 }
 
 /// A catalog rendition to decode: the broadcast and track serving it, and the owner whose panic
@@ -524,7 +535,7 @@ impl Consume {
 	where
 		for<'a> moq_mux::catalog::hang::Container: TryFrom<&'a C, Error = moq_mux::Error>,
 	{
-		let (consume, name, config) = self.select::<C>(catalog, index)?;
+		let (consume, name, config) = self.select_enabled::<C>(catalog, index)?;
 		let name = hang::catalog::Reference::track(config, name).to_string();
 		// Consume with the container the catalog actually advertises (Legacy / Cmaf / Loc)
 		// instead of assuming Legacy, otherwise CMAF/fMP4 sources (e.g. ffmpeg moqenc,
@@ -1172,10 +1183,19 @@ impl Consume {
 
 	/// Look up a video or audio rendition by catalog index, mirroring the selection in [`Self::media`].
 	pub fn rendition<C: Media>(&self, catalog: Id, index: usize) -> Result<Rendition<C>, Error> {
-		let (consume, name, config) = self.select(catalog, index)?;
+		let (consume, name, config) = self.select_enabled(catalog, index)?;
 		Ok(consume.rendition(name, config))
 	}
 
+	/// [`Self::select`], refusing a disabled rendition with [`Error::NotFound`]: no frames are coming.
+	fn select_enabled<C: Media>(&self, catalog: Id, index: usize) -> Result<(&ConsumeCatalog, &String, &C), Error> {
+		let selected = self.select::<C>(catalog, index)?;
+		if !selected.2.enabled() {
+			return Err(Error::NotFound);
+		}
+		Ok(selected)
+	}
+
 	/// A catalog and its rendition at `index`, in catalog order.
 	fn select<C: Media>(&self, catalog: Id, index: usize) -> Result<(&ConsumeCatalog, &String, &C), Error> {
 		let consume = self.catalog.get(catalog).ok_or(Error::CatalogNotFound)?;
@@ -1225,6 +1245,35 @@ mod supervision_tests {
 	}
 }
 
+#[cfg(test)]
+mod rendition_tests {
+	use super::*;
+
+	/// A decoder refuses a disabled rendition, as a track consumer does: no frames are coming.
+	#[test]
+	fn a_disabled_rendition_is_not_decoded() {
+		let broadcast = moq_net::broadcast::Info::new().produce();
+		let mut catalog = moq_mux::catalog::hang::Catalog::<moq_mux::catalog::hang::Extra>::default();
+		let mut audio = hang::catalog::AudioConfig::new(hang::catalog::AudioCodec::Opus, 48_000, 2);
+		audio.enabled = false;
+		catalog.audio.renditions.insert("audio".into(), audio);
+		let mut consume = Consume::default();
+		let id = consume
+			.catalog
+			.insert(ConsumeCatalog {
+				broadcast: broadcast.consume(),
+				origin: None,
+				catalog,
+				audio_codec: Vec::new(),
+				video_codec: Vec::new(),
+				sections: Vec::new(),
+			})
+			.unwrap();
+		let result = consume.rendition::<hang::catalog::AudioConfig>(id, 0);
+		assert!(matches!(result, Err(Error::NotFound)));
+	}
+}
+
 #[cfg(test)]
 mod read_tests {
 	use super::*;
diff --git a/rs/moq-c/src/test.rs b/rs/moq-c/src/test.rs
index 427c06f00fd..f999572ba69 100644
--- a/rs/moq-c/src/test.rs
+++ b/rs/moq-c/src/test.rs
@@ -970,9 +970,10 @@ fn publish_catalog_config_null_pointer() {
 	assert_eq!(moq_publish_close(broadcast), 0);
 }
 
-/// Enablement belongs to each catalog snapshot; holding a disabled rendition keeps its subscription usable.
+/// Enablement belongs to each catalog snapshot, and a snapshot that disables a rendition refuses to
+/// consume it.
 #[test]
-fn audio_enabled_snapshots_preserve_a_held_consumer() {
+fn audio_enabled_follows_each_snapshot() {
 	let origin = id(moq_origin_create());
 	let path = b"audio-enabled";
 	let broadcast = publish_broadcast(origin, path);
@@ -1030,9 +1031,11 @@ fn audio_enabled_snapshots_preserve_a_held_consumer() {
 		MOQ_ERROR_INVALID_POINTER
 	);
 
-	// A held rendition may be opened from a disabled snapshot, then re-enabled without resubscribing.
 	let frames = Callback::new();
-	let track = id(unsafe { moq_consume_audio(disabled, 0, &TEN_SECONDS, Some(channel_callback), frames.ptr) });
+	assert_eq!(
+		unsafe { moq_consume_audio(disabled, 0, &TEN_SECONDS, Some(channel_callback), frames.ptr) },
+		MOQ_ERROR_NOT_FOUND
+	);
 	set_enabled(true);
 	let resumed = id(catalogs.recv());
 	assert_eq!(
@@ -1045,6 +1048,7 @@ fn audio_enabled_snapshots_preserve_a_held_consumer() {
 		0
 	);
 	assert!(!unsafe { enabled.assume_init() });
+	let track = id(unsafe { moq_consume_audio(resumed, 0, &TEN_SECONDS, Some(channel_callback), frames.ptr) });
 	let payload = b"resumed-audio";
 	assert_eq!(
 		unsafe { moq_publish_media_frame(media, payload.as_ptr(), payload.len(), micros(0)) },
diff --git a/rs/moq-cli/src/play/media.rs b/rs/moq-cli/src/play/media.rs
index dfe7b92491f..0f4f8665ce9 100644
--- a/rs/moq-cli/src/play/media.rs
+++ b/rs/moq-cli/src/play/media.rs
@@ -1,7 +1,7 @@
 //! The media task: subscribe, pick renditions, and decode into the window and
 //! the speaker.
 
-use std::collections::{BTreeMap, VecDeque};
+use std::collections::VecDeque;
 use std::sync::{Arc, Mutex};
 use std::time::Duration;
 
@@ -128,9 +128,8 @@ impl<O: Output> Media<O> {
 		let mut catalogs = catalog::Consumer::<()>::new(&broadcast, self.args.catalog_format(&self.broadcast))
 			.await
 			.context("failed to subscribe to the catalog")?;
-		// Applied by hand rather than with `select`, so each snapshot holds the renditions that are
-		// actually playing, and so the player can tell a disabled rendition it lets go, which stops
-		// now, from one that leaves the catalog, which plays out its tail.
+		// Applied by hand rather than with `select`, which drops disabled renditions: a disabled
+		// rendition stops now, while one that leaves the catalog plays out its tail.
 		let selection = self.args.select.selection(None);
 		let mut tasks = tokio::task::JoinSet::new();
 		let mut playback = Playback::default();
@@ -188,17 +187,9 @@ impl<O: Output> Media<O> {
 					snapshot = catalogs.next(), if playback.following() => {
 						match snapshot.context("failed to read the catalog")? {
 							Some(mut snapshot) => {
-								// A playing rendition its publisher disabled is held while nothing else
-								// of its kind is enabled, so an unmute plays without a resubscribe.
-								let video_disabled = disabled(&video_demand, &snapshot.video.renditions, |config| config.enabled);
-								let audio_disabled = disabled(&audio_demand, &snapshot.audio.renditions, |config| config.enabled);
-								let playing = moq_mux::select::Selected {
-									video: video_demand.iter().map(|demand| demand.name.clone()).collect(),
-									audio: audio_demand.iter().map(|demand| demand.name.clone()).collect(),
-								};
-								selection.retain(&mut snapshot, &playing);
-								stop_released(&mut video_demand, video_disabled, &snapshot.video.renditions);
-								stop_released(&mut audio_demand, audio_disabled, &snapshot.audio.renditions);
+								stop_disabled(&mut video_demand, snapshot.video.renditions.iter().filter(|(_, config)| !config.enabled).map(|(name, _)| name));
+								stop_disabled(&mut audio_demand, snapshot.audio.renditions.iter().filter(|(_, config)| !config.enabled).map(|(name, _)| name));
+								selection.retain(&mut snapshot);
 								if let Some(demand) = &mut video_demand
 									&& demand.retire_moved(&source, snapshot.video.renditions.get(&demand.name))
 								{
@@ -499,20 +490,13 @@ impl Demand {
 	}
 }
 
-/// Whether the catalog still lists the rendition `playing` names, disabled.
-fn disabled<C>(playing: &Option<Demand>, renditions: &BTreeMap<String, C>, enabled: impl Fn(&C) -> bool) -> bool {
-	playing
+// Cancel through the task's own result so it still reports which half ended.
+fn stop_disabled<'a>(playing: &mut Option<Demand>, mut disabled: impl Iterator<Item = &'a String>) {
+	if playing
 		.as_ref()
-		.and_then(|playing| renditions.get(&playing.name))
-		.is_some_and(|config| !enabled(config))
-}
-
-/// Stop the rendition `playing` if it was `disabled` and the selection let it go, because
-/// another of its kind is enabled. Cancelled through the task's own result so it still reports
-/// which half ended.
-fn stop_released<C>(playing: &mut Option<Demand>, disabled: bool, selected: &BTreeMap<String, C>) {
-	if disabled && let Some(demand) = playing.take_if(|playing| !selected.contains_key(&playing.name)) {
-		let _ = demand.stop.send(());
+		.is_some_and(|playing| disabled.any(|disabled| *disabled == playing.name))
+	{
+		let _ = playing.take().unwrap().stop.send(());
 	}
 }
 
@@ -1536,43 +1520,6 @@ mod tests {
 		);
 	}
 
-	/// Muting the only audio rendition holds it, so the unmute plays on the subscription it
-	/// already had rather than a new one.
-	#[tokio::test]
-	async fn a_muted_rendition_is_held_through_the_unmute() {
-		tokio::time::pause();
-		let origin = moq_tokio::origin::spawn();
-		let broadcast = origin.create_broadcast("room").unwrap();
-		broadcast.announce(Default::default()).unwrap();
-		let mut catalog = catalog::Producer::new(&mut broadcast.broadcast().clone(), Default::default()).unwrap();
-		let mut audio = rendition(&broadcast, &catalog, "audio");
-		let recorder = Recorder::default();
-		let player = tokio::spawn(media(&origin, Duration::from_millis(50), recorder.clone()).run());
-		let mut enable = |enabled: bool| {
-			catalog
-				.mutate(|catalog| catalog.audio.renditions.get_mut("audio").unwrap().enabled = enabled)
-				.unwrap()
-		};
-
-		write(&mut audio, 10, 0.25).await;
-		enable(false);
-		// Half a second muted, with the timeline running on through it.
-		let demand = audio.demand();
-		for _ in 0..25 {
-			kio::clock::sleep(PACKET_DURATION).await;
-			assert!(demand.wanted().is_some(), "the mute unsubscribed");
-		}
-		enable(true);
-		for index in 35..60 {
-			audio.write(packet(index, 0.5)).unwrap();
-			kio::clock::sleep(PACKET_DURATION).await;
-		}
-
-		settle(player, &recorder).await;
-		assert!(played(&recorder, 0.25).0 > Duration::ZERO);
-		assert!(played(&recorder, 0.5).0 > Duration::ZERO, "the unmute did not play");
-	}
-
 	/// A publisher retires an audio rendition by naming its replacement and then
 	/// finishing the old track. The retired sink still holds a delay of audio, and
 	/// the replacement's sink holds its own before its first sample sounds, so
diff --git a/rs/moq-ffi/MIGRATE.md b/rs/moq-ffi/MIGRATE.md
index ef5640f5164..83ef63003a4 100644
--- a/rs/moq-ffi/MIGRATE.md
+++ b/rs/moq-ffi/MIGRATE.md
@@ -5,6 +5,10 @@ These are the UniFFI names; each language wrapper has its own `MIGRATE.md` in it
 
 ## Unreleased
 
+### Decoders refuse a disabled rendition ([#7942](https://github.com/moq-dev/moq/pull/7942))
+
+`MoqAudioConsumer::subscribe` and `MoqVideoConsumer::subscribe` fail with `MoqError::NotFound` when the rendition's `enabled` is false, instead of subscribing and waiting for a re-enable. Pick an enabled rendition from the latest catalog, and close a decoder whose rendition a newer catalog disables.
+
 ### Announcements are a listing ([#7678](https://github.com/moq-dev/moq/pull/7678))
 
 `MoqAnnounceEvent` is `Present { announce }` or `Absent { announce }`. `Start`, `Update`, `End`, `Restart` and `Takeover` (with its `predecessor`) are gone: another instance taking a path over keeps it present, and a route's cost changing is not reported.
diff --git a/rs/moq-ffi/src/audio.rs b/rs/moq-ffi/src/audio.rs
index 47da8b173a3..95343feca25 100644
--- a/rs/moq-ffi/src/audio.rs
+++ b/rs/moq-ffi/src/audio.rs
@@ -605,6 +605,9 @@ impl MoqAudioConsumer {
 }
 
 fn audio_config(catalog_audio: crate::media::MoqAudio) -> Result<hang::catalog::AudioConfig, MoqError> {
+	if !catalog_audio.enabled {
+		return Err(MoqError::NotFound);
+	}
 	let codec = catalog_audio
 		.codec
 		.parse::<hang::catalog::AudioCodec>()
@@ -637,10 +640,8 @@ impl MoqAudioConsumer {
 	/// the codec is inferred from it. A codec, layout, or description the decoder cannot open
 	/// returns [`MoqError::UnsupportedConfig`], so a player can try another rendition.
 	///
-	/// A [disabled](crate::media::MoqAudio::enabled) rendition subscribes too, and decodes once its
-	/// publisher re-enables it: a muted speaker's listener stays subscribed, so the unmute plays
-	/// from its first frame. Don't pick one, but keep one already playing while no enabled
-	/// rendition is on offer.
+	/// A [disabled](crate::media::MoqAudio::enabled) rendition returns [`MoqError::NotFound`]: no
+	/// frames are coming.
 	///
 	/// `id` is the rendition's catalog key. Its [`track`](crate::media::MoqAudio::track), or `id`
 	/// when unset, is subscribed in the broadcast its
@@ -728,11 +729,12 @@ mod tests {
 		assert_eq!(config.warmup, Some(Duration::from_millis(80)));
 	}
 
-	/// A consumer holds a disabled rendition it already plays, so one converts like any other.
 	#[test]
-	fn audio_config_accepts_disabled_renditions() {
+	fn audio_config_refuses_disabled_renditions() {
 		let mut config = catalog_audio("opus");
 		config.enabled = false;
+		assert!(matches!(audio_config(config.clone()), Err(MoqError::NotFound)));
+		config.enabled = true;
 		assert!(audio_config(config).is_ok());
 	}
 
diff --git a/rs/moq-ffi/src/media.rs b/rs/moq-ffi/src/media.rs
index 242e2e776b0..a32399c58c7 100644
--- a/rs/moq-ffi/src/media.rs
+++ b/rs/moq-ffi/src/media.rs
@@ -144,9 +144,7 @@ pub struct MoqVideo {
 	pub display_aspect: Option<MoqDimensions>,
 	/// The maximum encoded bitrate in bits per second.
 	pub bitrate: Option<u64>,
-	/// Whether the publisher is serving this rendition; when false, no frames are coming until it
-	/// re-enables. Pick an enabled rendition, but keep one already playing while every rendition
-	/// of its kind is disabled, so a re-enable plays without a resubscribe.
+	/// Whether this rendition may be selected; when false, no frames are coming.
 	#[uniffi(default = true)]
 	pub enabled: bool,
 	/// Higher values are preferred; compatibility transcodes use -1 and the default is 0.
@@ -192,9 +190,7 @@ pub struct MoqAudio {
 	pub channel_count: u32,
 	/// The maximum encoded bitrate in bits per second.
 	pub bitrate: Option<u64>,
-	/// Whether the publisher is serving this rendition; when false, no frames are coming until it
-	/// re-enables. Pick an enabled rendition, but keep one already playing while every rendition
-	/// of its kind is disabled, so a re-enable plays without a resubscribe.
+	/// Whether this rendition may be selected; when false, no frames are coming.
 	#[uniffi(default = true)]
 	pub enabled: bool,
 	/// The framing used to carry this rendition.
diff --git a/rs/moq-ffi/src/test.rs b/rs/moq-ffi/src/test.rs
index 68ca499d3e0..d79d21ca7c6 100644
--- a/rs/moq-ffi/src/test.rs
+++ b/rs/moq-ffi/src/test.rs
@@ -713,73 +713,6 @@ fn tone_power(samples: &[f32], frequency: f64) -> f64 {
 	previous * previous + older * older - coefficient * previous * older
 }
 
-/// A listener holding a muted rendition passes its disabled config, which subscribes and plays
-/// whatever the publisher sends once it unmutes.
-#[cfg(feature = "audio")]
-#[tokio::test]
-async fn audio_subscribes_a_held_disabled_rendition() {
-	use crate::audio::*;
-	let broadcast = MoqBroadcastProducer::new().unwrap();
-	let consumer = broadcast.consume().unwrap();
-	let catalogs = MoqMediaCatalogConsumer::subscribe(&consumer).await.unwrap();
-	let catalog = MoqMediaCatalogProducer::new(broadcast.clone()).unwrap();
-	let audio = MoqAudioProducer::new(
-		&catalog,
-		MoqAudioProducerOptions {
-			input: MoqAudioEncoderInput {
-				format: MoqAudioSampleFormat::F32,
-				sample_rate: 48_000,
-				channels: 2,
-			},
-			output: MoqAudioEncoderOutput {
-				codec: MoqAudioCodec::opus(),
-				sample_rate: None,
-				channels: None,
-				bitrate: None,
-				frame_duration: Some(Duration::from_millis(20)),
-			},
-			track: Some("voice".into()),
-			bandwidth: None,
-		},
-	)
-	.unwrap();
-	let snapshot = catalogs.next().await.unwrap().unwrap();
-	let mut muted = snapshot.audio["voice"].clone();
-	muted.enabled = false;
-	let decoder = MoqAudioConsumer::subscribe(
-		&consumer,
-		"voice".into(),
-		muted,
-		MoqAudioDecoderOutput {
-			delay: Some(MoqDelay {
-				min: Some(Duration::ZERO),
-				max: Some(Duration::from_secs(30)),
-			}),
-			..audio_output()
-		},
-	)
-	.await
-	.unwrap();
-
-	for index in 0..4 {
-		audio
-			.write(MoqAudioFrame {
-				timestamp: us(index * 20_000),
-				data: audio_tone(index as usize * 960, 960, 2),
-			})
-			.unwrap();
-	}
-	audio.finish().unwrap();
-	let mut frames = 0;
-	while let Some(read) = kio::clock::timeout(TIMEOUT, decoder.next()).await.unwrap().unwrap() {
-		if matches!(read, MoqAudioRead::Frame { .. }) {
-			frames += 1;
-		}
-	}
-	assert!(frames > 0, "the held rendition played nothing");
-	broadcast.close().unwrap();
-}
-
 /// PCM written and finished from separate host threads survives the binding's locking and drain.
 #[cfg(feature = "audio")]
 #[tokio::test]
diff --git a/rs/moq-ffi/src/video.rs b/rs/moq-ffi/src/video.rs
index 911418f6b01..4381221c68e 100644
--- a/rs/moq-ffi/src/video.rs
+++ b/rs/moq-ffi/src/video.rs
@@ -1231,6 +1231,9 @@ impl MoqVideoConsumer {
 /// is rejected here; a recognized one the native backends can't open is rejected when the decoder
 /// opens, which is still before the first frame.
 fn video_config(catalog_video: crate::media::MoqVideo) -> Result<hang::catalog::VideoConfig, MoqError> {
+	if !catalog_video.enabled {
+		return Err(MoqError::NotFound);
+	}
 	let codec = catalog_video
 		.codec
 		.parse::<hang::catalog::VideoCodec>()
@@ -1289,9 +1292,8 @@ impl MoqVideoConsumer {
 	/// refuses, returns [`MoqError::UnsupportedConfig`] before decoding starts. Also fails with [`MoqError::Unsupported`] when
 	/// [`surface`](MoqVideoDecoderOutput::surface) is set on a platform with no surface to expose.
 	///
-	/// A [disabled](crate::media::MoqVideo::enabled) rendition subscribes too, and decodes once its
-	/// publisher re-enables it. Don't pick one, but keep one already playing while no enabled
-	/// rendition is on offer.
+	/// A [disabled](crate::media::MoqVideo::enabled) rendition returns [`MoqError::NotFound`]: no
+	/// frames are coming.
 	///
 	/// `id` is the rendition's catalog key. Its [`track`](crate::media::MoqVideo::track), or `id`
 	/// when unset, is subscribed in the broadcast its
@@ -1371,12 +1373,13 @@ mod decode_tests {
 		);
 	}
 
-	/// A consumer holds a disabled rendition it already plays, so one converts like any other.
 	#[test]
-	fn video_config_accepts_disabled_renditions() {
+	fn video_config_refuses_disabled_renditions() {
 		let mut config = catalog_video("avc1.64001f");
 		config.enabled = false;
 		config.preference = -1;
+		assert!(matches!(video_config(config.clone()), Err(MoqError::NotFound)));
+		config.enabled = true;
 		assert_eq!(video_config(config).unwrap().preference, -1);
 	}
 
diff --git a/rs/moq-gst/MIGRATE.md b/rs/moq-gst/MIGRATE.md
index 8da134ac585..5eda4093e01 100644
--- a/rs/moq-gst/MIGRATE.md
+++ b/rs/moq-gst/MIGRATE.md
@@ -4,6 +4,12 @@ How to update your pipelines for each breaking change, newest first.
 
 ## Unreleased
 
+### A disabled `moqsrc` rendition ends its pad
+
+Disabling a rendition in the catalog now ends its pad with EOS instead of holding it idle, and a re-enable adds a new pad (`video_1` after `video_0`) whose stream starts at the live edge, like any rendition the catalog adds.
+A pipeline linked by pad name, such as `s.video_0 ! ...`, must link the new pad from `pad-added` to keep playing across a disable.
+Push-to-talk publishers no longer disable a rendition to mute it, so a mute keeps the pad.
+
 ### `moqsrc` audio caps are the standard ones
 
 `moqsrc` audio pads now carry `rate` and `channels` as `int`, and Opus pads the mapping fields (`channel-mapping-family`, `stream-count`, `coupled-count`, plus `channel-mapping` beyond stereo) with the OpusHead and an empty OpusTags as `streamheader`, so `decodebin` and `opusdec` accept them and `opusdec` applies the output gain.
diff --git a/rs/moq-gst/src/source/imp.rs b/rs/moq-gst/src/source/imp.rs
index a6259e50605..e90ff295ab8 100644
--- a/rs/moq-gst/src/source/imp.rs
+++ b/rs/moq-gst/src/source/imp.rs
@@ -469,6 +469,8 @@ struct PadHandle {
 	task: tokio::task::JoinHandle<()>,
 	/// A [`Command::Retire`] is queued, so a further delisting needs none.
 	retiring: bool,
+	/// Ends the pad at once, cutting short the play on it: the rendition was disabled.
+	disable: watch::Sender<bool>,
 }
 
 /// A [`PadActor`]'s queue of commands. Unlike a channel, a reader's cancelled turn leaves it as
@@ -535,7 +537,8 @@ enum Command {
 
 impl Pads {
 	/// Play `play` on the rendition's pad, created if the session has none, once the plays sent
-	/// before it are done. [`Exit::Unlisted`] if the latest catalog does not list the rendition.
+	/// before it are done. [`Exit::Unlisted`] if the latest catalog does not list the rendition, or
+	/// the pad ends before or while it plays.
 	async fn play(&self, element: &glib::WeakRef<super::MoqSrc>, rendition: &Rendition, play: Play) -> Exit {
 		let turn = match self.queue(element, rendition, &play.cancel) {
 			Ok(turn) => turn,
@@ -548,7 +551,7 @@ impl Pads {
 			handoff = turn => match handoff {
 				Ok(handoff) => handoff,
 				// The actor ended the pad first.
-				Err(_) => return Exit::Done,
+				Err(_) => return Exit::Unlisted,
 			},
 		};
 		let (done, exit) = oneshot::channel();
@@ -598,13 +601,15 @@ impl Pads {
 			pad,
 			added: false,
 		};
-		let task = RUNTIME.spawn(STREAMING.scope(element.clone(), actor.run(commands.clone())));
+		let (disable, disabled) = watch::channel(false);
+		let task = RUNTIME.spawn(STREAMING.scope(element.clone(), actor.run(commands.clone(), disabled)));
 		table.pads.insert(
 			rendition.clone(),
 			PadHandle {
 				commands,
 				task,
 				retiring: false,
+				disable,
 			},
 		);
 		Ok(called)
@@ -617,13 +622,21 @@ impl Pads {
 
 	/// List what the latest catalog names, retiring each pad it no longer lists. Its actor ends it
 	/// with EOS once the plays before are done, unless the rendition is listed again by then, so a
-	/// delisted rendition still playing out its track keeps its tail.
+	/// delisted rendition still playing out its track keeps its tail. A `disabled` rendition's pad
+	/// leaves the session now and its actor ends it as soon as a push on it returns, even when its
+	/// reader missed the disable or a re-enable follows, so a re-enable always takes a new pad.
 	/// Nothing once `cancel` fired, since a later run lists the pads then.
-	fn list(&self, listed: HashSet<Rendition>, cancel: &watch::Receiver<bool>) {
+	fn list(&self, listed: HashSet<Rendition>, disabled: &HashSet<Rendition>, cancel: &watch::Receiver<bool>) {
 		let mut table = self.0.lock().unwrap();
 		if *cancel.borrow() {
 			return;
 		}
+		for rendition in disabled {
+			if let Some(handle) = table.pads.remove(rendition) {
+				handle.disable.send_replace(true);
+				table.ending.push(handle.task);
+			}
+		}
 		// A pad is made listed, and an actor finding it listed again keeps it, so only a delisting
 		// retires one. A retirement already queued judges the listing when its turn comes.
 		let delisted = std::mem::replace(&mut table.listed, listed);
@@ -674,8 +687,20 @@ struct PadActor {
 }
 
 impl PadActor {
-	async fn run(mut self, commands: Arc<Inbox>) {
-		while let Some(command) = commands.recv().await {
+	/// Take `commands` until the pad ends, or at once once `disabled`. A disable cuts short the
+	/// play on the pad, which reports [`Exit::Unlisted`] so its follower starts it again on a new
+	/// pad if the rendition is enabled again, and drops the turns queued behind it.
+	async fn run(mut self, commands: Arc<Inbox>, mut disabled: watch::Receiver<bool>) {
+		loop {
+			// A closed sender is a released or dropped pad, which the commands end.
+			let command = tokio::select! {
+				biased;
+				Ok(_) = disabled.wait_for(|disabled| *disabled) => return self.ended(),
+				command = commands.recv() => command,
+			};
+			let Some(command) = command else {
+				return;
+			};
 			match command {
 				Command::Play(turn) => {
 					let (handoff, handed) = oneshot::channel();
@@ -686,21 +711,16 @@ impl PadActor {
 					let Ok((play, done)) = handed.await else {
 						continue;
 					};
-					let exit = self.play(*play).await;
+					let exit = tokio::select! {
+						biased;
+						Ok(_) = disabled.wait_for(|disabled| *disabled) => Exit::Unlisted,
+						exit = self.play(*play) => exit,
+					};
 					let _ = done.send(exit);
 				}
-				Command::Retire => {
-					if self.retired() {
-						// A turn queued behind the retirement drops here, which its reader takes as
-						// done.
-						self.end(true);
-						if let Some(pads) = self.pads.upgrade() {
-							let id = tokio::task::id();
-							pads.lock().unwrap().ending.retain(|task| task.id() != id);
-						}
-						return;
-					}
-				}
+				// A turn queued behind the retirement drops here, which its reader takes as unlisted.
+				Command::Retire if self.retired() => return self.ended(),
+				Command::Retire => {}
 				Command::Release { eos } => return self.end(eos),
 				#[cfg(test)]
 				Command::Settled(settled) => {
@@ -771,6 +791,15 @@ impl PadActor {
 		true
 	}
 
+	/// End a pad the session already let go, and leave [`PadTable::ending`].
+	fn ended(&self) {
+		self.end(true);
+		if let Some(pads) = self.pads.upgrade() {
+			let id = tokio::task::id();
+			pads.lock().unwrap().ending.retain(|task| task.id() != id);
+		}
+	}
+
 	fn end(&self, eos: bool) {
 		if eos {
 			let _ = tokio::task::block_in_place(|| self.pad.push_event(gst::event::Eos::new()));
@@ -1033,23 +1062,12 @@ fn reconcile(
 	emptied: &Arc<tokio::sync::Notify>,
 	cancel: &watch::Receiver<bool>,
 ) {
-	// Share the players' selection rule: keep an already selected disabled rendition only
-	// while no enabled alternative of its kind exists. Pads alone also include idle renditions
-	// displaced by an alternative, so derive selection from the plans the readers follow.
-	let mut selected = moq_mux::select::Selected::default();
-	for follower in followers.values() {
-		for (kind, name) in follower.plan.borrow().renditions.keys() {
-			match kind {
-				TrackKind::Video => selected.video.insert(name.clone()),
-				TrackKind::Audio => selected.audio.insert(name.clone()),
-			};
-		}
-	}
+	// Read what the players select: every enabled rendition in a container this build knows.
 	let mut playable = catalog.clone();
 	moq_mux::select::Broadcast::default()
 		.video(Default::default())
 		.audio(Default::default())
-		.retain(&mut playable, &selected);
+		.retain(&mut playable);
 
 	// Build the desired shape for each rendition. This is deliberately cheap: caps come from the
 	// catalog config and the container is just the hang descriptor. The reader parses the wire
@@ -1097,40 +1115,29 @@ fn reconcile(
 		);
 	}
 
-	// A disabled rendition keeps its pad even when an enabled alternative displaced its reader,
-	// since a pipeline links pads by name (`s.video_0 ! ...`).
-	let disabled: Vec<(Rendition, &dyn hang::catalog::Reference)> = catalog
-		.video
-		.renditions
-		.iter()
-		.filter(|(_, config)| !config.enabled)
-		.map(|(name, config)| {
-			(
-				(TrackKind::Video, name.clone()),
-				config as &dyn hang::catalog::Reference,
+	// Only an enabled rendition keeps a pad: a disabled one's pad ends, and a re-enable takes a new
+	// one like any rendition the catalog adds. Listed before any follower hears of the update, so a
+	// reader it stops can't claim a pad.
+	let listed = desired.keys().cloned().collect();
+	// A disabled reader stops now, where one the catalog dropped plays out its tail.
+	let disabled: Arc<HashSet<Rendition>> = Arc::new(
+		catalog
+			.video
+			.renditions
+			.iter()
+			.filter(|(_, config)| !config.enabled)
+			.map(|(name, _)| (TrackKind::Video, name.clone()))
+			.chain(
+				catalog
+					.audio
+					.renditions
+					.iter()
+					.filter(|(_, config)| !config.enabled)
+					.map(|(name, _)| (TrackKind::Audio, name.clone())),
 			)
-		})
-		.chain(
-			catalog
-				.audio
-				.renditions
-				.iter()
-				.filter(|(_, config)| !config.enabled)
-				.map(|(name, config)| {
-					(
-						(TrackKind::Audio, name.clone()),
-						config as &dyn hang::catalog::Reference,
-					)
-				}),
-		)
-		.collect();
-	// Listed before any follower hears of the update, so a reader it stops can't claim a pad.
-	let listed = desired
-		.keys()
-		.cloned()
-		.chain(disabled.iter().map(|(rendition, _)| rendition.clone()))
-		.collect();
-	playback.session.pads.list(listed, cancel);
+			.collect(),
+	);
+	playback.session.pads.list(listed, &disabled, cancel);
 
 	let mut plans: HashMap<moq_net::Path, Plan> = HashMap::new();
 	for (rendition, shape) in desired {
@@ -1144,22 +1151,24 @@ fn reconcile(
 		};
 		plans.entry(path).or_default().renditions.insert(rendition, shape);
 	}
+	for plan in plans.values_mut() {
+		plan.disabled = disabled.clone();
+	}
 
-	// A broadcast no selected rendition reads any more stops its readers, apart from a delisted
+	// A broadcast no enabled rendition reads any more stops its readers, apart from a delisted
 	// one playing out its tail. Its follower stays reachable, with its finished records, while a
-	// disabled rendition still names it or a delisted one drains, so a re-enable or relist reaches
-	// it rather than a new follower. Once it plays nothing, the run lets it go.
-	let held: HashSet<moq_net::Path> = disabled
-		.iter()
-		.filter_map(|(_, reference)| source.resolve_reference(reference.broadcast()))
-		.collect();
+	// delisted one drains, so a relist reaches it rather than a new follower. Once it plays nothing,
+	// the run lets it go.
 	followers.retain(|path, follower| {
 		// A follower whose broadcast failed exited, and this update follows it again.
 		if follower.plan.is_closed() {
 			return false;
 		}
-		follower.held = held.contains(path);
-		follower.plan.send_replace(plans.remove(path).unwrap_or_default());
+		let plan = plans.remove(path).unwrap_or_else(|| Plan {
+			disabled: disabled.clone(),
+			..Default::default()
+		});
+		follower.plan.send_replace(plan);
 		!follower.idle()
 	});
 	for (path, plan) in plans {
@@ -1176,7 +1185,6 @@ fn reconcile(
 		};
 		let (plan_tx, plan) = watch::channel(plan);
 		let (empty_tx, empty) = watch::channel(false);
-		let held = held.contains(&path);
 		let follower_task = Follower {
 			playback: playback.clone(),
 			path: path.clone(),
@@ -1195,14 +1203,7 @@ fn reconcile(
 			STREAMING.scope(playback.session.element.clone(), follower_task),
 			RUNTIME.handle(),
 		);
-		followers.insert(
-			path,
-			Followed {
-				plan: plan_tx,
-				empty,
-				held,
-			},
-		);
+		followers.insert(path, Followed { plan: plan_tx, empty });
 	}
 }
 
@@ -1211,16 +1212,13 @@ struct Followed {
 	plan: watch::Sender<Plan>,
 	/// Set while it plays no rendition.
 	empty: watch::Receiver<bool>,
-	/// A disabled rendition names its path, so a re-enable needs its finished records.
-	held: bool,
 }
 
 impl Followed {
-	/// Whether nothing reaches it again: it plays nothing, was asked for nothing, and keeps no
-	/// record a re-enable needs. Judged against the plan sent last, so a plan it has yet to take
-	/// keeps it.
+	/// Whether nothing reaches it again: it plays nothing and was asked for nothing. Judged against
+	/// the plan sent last, so a plan it has yet to take keeps it.
 	fn idle(&self) -> bool {
-		!self.held && *self.empty.borrow() && self.plan.borrow().renditions.is_empty()
+		*self.empty.borrow() && self.plan.borrow().renditions.is_empty()
 	}
 }
 
@@ -1245,6 +1243,9 @@ struct Plan {
 	/// its readers drain, and a sibling's keeps following its instances until the catalog's
 	/// broadcast ends.
 	closed: bool,
+	/// Every rendition the catalog names but disables, whose reader stops at once rather than
+	/// playing out its tail as a removed one does.
+	disabled: Arc<HashSet<Rendition>>,
 }
 
 /// Follows the instances at one path and plays the renditions that read it on each in turn: a
@@ -1333,7 +1334,7 @@ impl Follower {
 		let mut listening = !first.closed;
 		// Following instances, which a sibling does past its catalog's close.
 		let mut following = listening || sibling;
-		self.apply(first.renditions);
+		self.apply(first);
 		self.play();
 
 		loop {
@@ -1359,7 +1360,7 @@ impl Follower {
 						let next = plan.borrow_and_update().clone();
 						listening = !next.closed;
 						following = listening || sibling;
-						let fresh = self.apply(next.renditions);
+						let fresh = self.apply(next);
 						// The final plan starts what it adds or reshapes, but restarts no reader
 						// that already ended.
 						match listening {
@@ -1370,7 +1371,7 @@ impl Follower {
 					// No rendition reads this path any more.
 					Err(_) => {
 						(listening, following) = (false, false);
-						self.apply(HashMap::new());
+						self.apply(Plan::default());
 					}
 				},
 				Some(joined) = self.readers.join_next() => {
@@ -1405,9 +1406,14 @@ impl Follower {
 		while self.readers.join_next().await.is_some() {}
 	}
 
-	/// Bring the renditions in line with `wanted`, stopping each one reshaped or gone, and return
+	/// Bring the renditions in line with `plan`, stopping each one reshaped or gone, and return
 	/// those added or reshaped. [`Self::play`] starts the rest.
-	fn apply(&mut self, mut wanted: HashMap<Rendition, Shape>) -> HashSet<Rendition> {
+	fn apply(&mut self, plan: Plan) -> HashSet<Rendition> {
+		let Plan {
+			renditions: mut wanted,
+			disabled,
+			..
+		} = plan;
 		let pads = &self.playback.session.pads;
 		let mut fresh = HashSet::new();
 		self.renditions
@@ -1425,10 +1431,10 @@ impl Follower {
 					true
 				}
 				// A delisted rendition plays out the instance it reads, then leaves. One that never
-				// took its pad, was displaced by an enabled alternative, or now reads another
-				// broadcast stops now.
+				// took its pad, or that is disabled or now reads another broadcast, stops now.
 				None => {
 					entry.draining = !pads.is_listed(rendition)
+						&& !disabled.contains(rendition)
 						&& entry
 							.reader
 							.as_ref()
@@ -1494,7 +1500,7 @@ impl Follower {
 	}
 
 	/// Drop the state no return can resume: an instance neither current nor pinned by a rendition,
-	/// and the records of a retired pad. A disabled rendition keeps its pad, and its records.
+	/// and the records of a retired pad.
 	fn forget(&mut self) {
 		let pinned: HashSet<&moq_net::Instance> = self
 			.renditions
@@ -1586,7 +1592,8 @@ impl Follower {
 		} else if let Exit::Unlisted = exit
 			&& self.playback.session.pads.is_listed(&rendition)
 		{
-			// Delisted and listed again while it went to claim its pad, which the plan coalesced.
+			// Its pad went while the rendition was delisted or disabled and listed again, which the
+			// plan coalesced.
 			self.play();
 		}
 	}
@@ -1606,7 +1613,8 @@ fn serves(instance: &moq_net::broadcast::Consumer, id: Option<&moq_net::Instance
 enum Exit {
 	/// It is done with the instance.
 	Done,
-	/// The catalog did not list the rendition when it went to claim its pad.
+	/// It lost its pad: the catalog did not list the rendition when it went to claim one, or the
+	/// pad ended first or under it. Its follower starts it again if the rendition is listed.
 	Unlisted,
 }
 
@@ -2540,10 +2548,10 @@ mod session_tests {
 		}
 	}
 
-	/// Selection follows the reader plans, independently by kind; idle pads do not keep a
-	/// displaced rendition selected. Reconcile against a plan receiver without starting readers.
+	/// A disabled rendition drops out of its reader's plan, each kind on its own, and an enable
+	/// brings it back. Reconcile against a plan receiver without starting readers.
 	#[test]
-	fn disabled_renditions_follow_the_player_selection_rule() {
+	fn disabled_renditions_leave_the_plan() {
 		let element = element();
 		let (origin, _driver) = moq_net::origin::Producer::new(Default::default());
 		let broadcast = moq_net::broadcast::Info::new().produce();
@@ -2559,11 +2567,7 @@ mod session_tests {
 		let (_empty, empty) = watch::channel(false);
 		let mut followers = std::collections::HashMap::from([(
 			source.resolve_reference(None).unwrap(),
-			super::Followed {
-				plan,
-				empty,
-				held: false,
-			},
+			super::Followed { plan, empty },
 		)]);
 		let mut tasks = tokio::task::JoinSet::new();
 		let emptied = Arc::default();
@@ -2592,23 +2596,15 @@ mod session_tests {
 		catalog.audio.renditions.insert("main".into(), audio);
 		check(&catalog, &[]);
 
-		let both = [(TrackKind::Video, "main"), (TrackKind::Audio, "main")];
 		catalog.video.renditions.get_mut("main").unwrap().enabled = true;
 		catalog.audio.renditions.get_mut("main").unwrap().enabled = true;
-		check(&catalog, &both);
-		catalog.video.renditions.get_mut("main").unwrap().enabled = false;
+		check(&catalog, &[(TrackKind::Video, "main"), (TrackKind::Audio, "main")]);
 		catalog.audio.renditions.get_mut("main").unwrap().enabled = false;
-		check(&catalog, &both);
-
-		catalog.video.renditions.insert("alternative".into(), video_rendition());
-		let alternative = [(TrackKind::Video, "alternative"), (TrackKind::Audio, "main")];
-		check(&catalog, &alternative);
-		catalog.video.renditions.get_mut("alternative").unwrap().enabled = false;
-		check(&catalog, &alternative);
-
-		catalog.video.renditions.remove("alternative");
-		catalog.audio.renditions.remove("main");
-		check(&catalog, &[]);
+		check(&catalog, &[(TrackKind::Video, "main")]);
+		// Its pad ends rather than waiting for a re-enable, and its reader stops without a drain.
+		let audio = (TrackKind::Audio, "main".to_string());
+		assert!(!playback.session.pads.is_listed(&audio));
+		assert!(received.borrow().disabled.contains(&audio));
 	}
 
 	fn video_rendition() -> VideoConfig {
@@ -3872,7 +3868,7 @@ mod session_tests {
 		let (_shutdown, shutdown) = watch::channel(true);
 		let (_stop, stop) = watch::channel(false);
 		let pads = Pads::default();
-		pads.list(HashSet::from([rendition.clone()]), &cancel);
+		pads.list(HashSet::from([rendition.clone()]), &HashSet::new(), &cancel);
 		let instance = publisher.broadcast.consume();
 		let reader = super::Reader {
 			playback: super::Playback {
@@ -3908,6 +3904,77 @@ mod session_tests {
 			.unwrap();
 	}
 
+	/// A disable ends the pad even when its reader never hears of it, as when the follower takes
+	/// the disable and a re-enable as one plan. The reader reports its pad lost, so its follower
+	/// starts it again on a new pad.
+	#[test]
+	fn a_disable_its_reader_missed_cuts_its_play() {
+		let _pad_ids = pad_ids();
+		let element = element();
+		let recorder = Recorder::attach(&element);
+		let mut publisher = Publisher::new(&origin(), Default::default(), video_rendition());
+
+		let rendition = (TrackKind::Video, "video".to_string());
+		let (cancelling, cancel) = watch::channel(false);
+		let (_shutdown, shutdown) = watch::channel(false);
+		let (_stop, stop) = watch::channel(false);
+		let pads = Pads::default();
+		pads.list(HashSet::from([rendition.clone()]), &HashSet::new(), &cancel);
+		let instance = publisher.broadcast.consume();
+		let reader = super::Reader {
+			playback: super::Playback {
+				session: Session {
+					max_delay: DEFAULT_MAX_DELAY,
+					element: element.downgrade(),
+					pads: pads.clone(),
+					shutdown,
+				},
+				broadcast: instance.clone(),
+				timeline: Arc::default(),
+				stop,
+			},
+			rendition: rendition.clone(),
+			shape: super::Shape {
+				caps: gst::Caps::new_empty_simple("video/x-h264"),
+				container: Container::Legacy,
+				track: "video".into(),
+				broadcast: None,
+				instance: None,
+				warmup: Duration::ZERO,
+			},
+			instance,
+			serial: 1,
+			timeline: Arc::default(),
+			finished: super::Finished::default(),
+			live: Arc::default(),
+			cancel,
+		};
+		let run = super::RUNTIME.spawn(reader.run());
+		let pad = recorder.written(&mut publisher, 1);
+
+		pads.list(
+			HashSet::new(),
+			&HashSet::from([rendition.clone()]),
+			&cancelling.subscribe(),
+		);
+		pads.list(
+			HashSet::from([rendition.clone()]),
+			&HashSet::new(),
+			&cancelling.subscribe(),
+		);
+		let exit = super::RUNTIME
+			.block_on(async { kio::clock::timeout(Duration::from_secs(10), run).await })
+			.expect("the disable never cut the play")
+			.unwrap();
+		assert!(
+			matches!(exit, super::Exit::Unlisted),
+			"the reader took its pad's end as done"
+		);
+		recorder.wait("the disabled pad never ended", |seen| {
+			seen.contains(&Seen::Eos(pad.clone())).then_some(())
+		});
+	}
+
 	/// A bus sync or pad handler can stop the element from inside a reader's push. Waiting for the
 	/// session there would wait on that reader, so stop settles for the connection closing.
 	#[test]
@@ -4554,74 +4621,6 @@ mod session_tests {
 		});
 	}
 
-	/// A sibling track that finished stays finished for its instance only: a disable and an enable
-	/// replays nothing on that instance, and the next instance plays even before the enable.
-	#[test]
-	fn a_reenabled_sibling_rendition_plays_the_next_instance_after_a_finish() {
-		let _pad_ids = pad_ids();
-		let element = element();
-		let recorder = Recorder::attach(&element);
-		let origin = origin();
-		let mut room = referencing(&origin, None);
-		let _audio = ["audio", "again"].map(|name| {
-			room.broadcast
-				.create_track(name, hang::container::track_info(hang::catalog::PRIORITY.audio))
-				.unwrap()
-		});
-		let session = follow(&element, &origin);
-
-		let mut first = Publisher::sibling(&origin, Default::default());
-		let pad = recorder.written(&mut first, 1);
-		first.video.finish().unwrap();
-		await_finished(&first);
-
-		// The catalog consumer only yields the newest snapshot, so each update lists another audio
-		// rendition: its pad appearing proves the run acted on it.
-		{
-			let mut guard = room.catalog.modify().unwrap();
-			guard.video.renditions.get_mut("video").unwrap().enabled = false;
-			guard.audio.renditions = BTreeMap::from([("audio".to_string(), audio_rendition())]);
-		}
-		await_pad(&element, "audio_");
-		let mut second = Publisher::sibling(&origin, Default::default());
-		assert_eq!(
-			recorder.written(&mut second, 2),
-			pad,
-			"the next instance moved to another pad"
-		);
-
-		{
-			let mut guard = room.catalog.modify().unwrap();
-			guard.video.renditions.get_mut("video").unwrap().enabled = true;
-			let mut again = audio_rendition();
-			again.track = Some("again".into());
-			guard.audio.renditions.insert("again".to_string(), again);
-		}
-		for _ in 0..200 {
-			if pads(&element, "audio_").len() == 2 {
-				break;
-			}
-			block(Duration::from_millis(50));
-		}
-		assert_eq!(pads(&element, "audio_").len(), 2, "the re-enable never landed");
-		let replayed = recorder.count(|seen| *seen == Seen::Buffer(pad.clone(), 1));
-
-		assert_eq!(recorder.written(&mut second, 3), pad);
-
-		stop(session);
-
-		// Only the next instance starts a stream: the finished one stays finished on its pad.
-		let seen = recorder.seen();
-		assert_eq!(recorder.count(|seen| *seen == Seen::Start(pad.clone())), 1, "{seen:?}");
-		assert_eq!(
-			recorder.count(|seen| *seen == Seen::Buffer(pad.clone(), 1)),
-			replayed,
-			"{seen:?}"
-		);
-		recorder.assert_one_pad_held();
-		drop(first);
-	}
-
 	/// A sibling rendition delisted while it plays and listed again before its track finishes stays
 	/// with the reader that drained it: the finished track does not replay on its pad, and the
 	/// next instance plays there.
@@ -5100,37 +5099,38 @@ mod session_tests {
 		recorder.assert_one_pad_held();
 	}
 
-	/// With no enabled alternative, disabling holds the reader as well as its pad, so media that
-	/// beats the re-enable catalog update plays without a new subscription or stream.
+	/// Disabling a rendition ends its reader and its pad with an EOS, holding nothing for a
+	/// re-enable, which takes a new pad from a fresh subscription like any added rendition.
 	#[test]
-	fn a_disabled_rendition_keeps_reading_on_the_same_pad() {
+	fn a_disabled_rendition_ends_its_pad() {
 		let _pad_ids = pad_ids();
 		let element = element();
 		let recorder = Recorder::attach(&element);
 		let origin = origin();
 
 		let mut publisher = Publisher::new(&origin, Default::default(), video_rendition());
-		let _audio = publisher
-			.broadcast
-			.create_track("audio", hang::container::track_info(hang::catalog::PRIORITY.audio))
-			.unwrap();
 		let session = follow(&element, &origin);
 		let pad = recorder.written(&mut publisher, 1);
 
-		// The catalog consumer only yields the newest snapshot, so the same update lists an audio
-		// rendition: its pad appearing proves the run acted on the disable.
-		{
-			let mut guard = publisher.catalog.modify().unwrap();
-			guard.video.renditions.get_mut("video").unwrap().enabled = false;
-			guard.audio.renditions = BTreeMap::from([("audio".to_string(), audio_rendition())]);
+		publisher
+			.catalog
+			.modify()
+			.unwrap()
+			.video
+			.renditions
+			.get_mut("video")
+			.unwrap()
+			.enabled = false;
+		recorder.wait("the disabled pad never ended", |seen| {
+			seen.contains(&Seen::Eos(pad.clone())).then_some(())
+		});
+		for _ in 0..100 {
+			if pads(&element, "video_").is_empty() {
+				break;
+			}
+			block(Duration::from_millis(50));
 		}
-		await_pad(&element, "audio_");
-
-		assert_eq!(
-			recorder.written(&mut publisher, 2),
-			pad,
-			"media before the re-enable did not reach the held reader"
-		);
+		assert!(pads(&element, "video_").is_empty(), "the disabled pad stayed");
 
 		publisher
 			.catalog
@@ -5141,19 +5141,88 @@ mod session_tests {
 			.get_mut("video")
 			.unwrap()
 			.enabled = true;
-		assert_eq!(
-			recorder.written(&mut publisher, 3),
+		assert_ne!(
+			recorder.written(&mut publisher, 2),
 			pad,
-			"the re-enabled rendition moved to another pad"
+			"the re-enable reused the ended pad"
 		);
 		stop(session);
 
 		let seen = recorder.seen();
+		assert_eq!(recorder.count(|seen| matches!(seen, Seen::Pad(_))), 2, "{seen:?}");
 		assert!(
 			!seen.contains(&Seen::Start(pad)),
-			"the disable restarted the stream: {seen:?}"
+			"the ended pad started again: {seen:?}"
+		);
+	}
+
+	/// A disable ends the pad even when the rendition is re-enabled while a push on it is still
+	/// blocked downstream, so its actor takes both catalog updates only once the push returns.
+	#[test]
+	fn a_disable_ends_the_pad_while_its_push_is_blocked() {
+		let _pad_ids = pad_ids();
+		let element = element();
+		let recorder = Recorder::attach(&element);
+		let origin = origin();
+
+		let mut publisher = Publisher::new(&origin, Default::default(), video_rendition());
+		let (shutdown, stopping) = watch::channel(false);
+		let session = Session::new(element.downgrade(), stopping, DEFAULT_MAX_DELAY);
+		let pads = session.pads.clone();
+		let consumer = origin.consume();
+		let task =
+			super::RUNTIME.spawn(async move { session.follow_path(&consumer, "room", std::future::pending()).await });
+		let pad = recorder.written(&mut publisher, 1);
+
+		let blocking = element.static_pad(&pad).unwrap();
+		let (blocked, reached) = std::sync::mpsc::channel();
+		let probe = blocking
+			.add_probe(gst::PadProbeType::BLOCK | gst::PadProbeType::BUFFER, move |_, _| {
+				let _ = blocked.send(());
+				gst::PadProbeReturn::Ok
+			})
+			.unwrap();
+		publisher.write(2);
+		reached
+			.recv_timeout(Duration::from_secs(10))
+			.expect("the frame never reached the pad");
+
+		let rendition = (TrackKind::Video, "video".to_string());
+		for enabled in [false, true] {
+			publisher
+				.catalog
+				.modify()
+				.unwrap()
+				.video
+				.renditions
+				.get_mut("video")
+				.unwrap()
+				.enabled = enabled;
+			for _ in 0..200 {
+				if pads.is_listed(&rendition) == enabled {
+					break;
+				}
+				block(Duration::from_millis(50));
+			}
+			assert_eq!(pads.is_listed(&rendition), enabled, "the catalog update never applied");
+		}
+		blocking.remove_probe(probe);
+
+		recorder.wait("the disabled pad never ended", |seen| {
+			seen.contains(&Seen::Eos(pad.clone())).then_some(())
+		});
+		assert_ne!(
+			recorder.written(&mut publisher, 3),
+			pad,
+			"the re-enable reused the disabled pad"
+		);
+		stop((shutdown, task));
+
+		let seen = recorder.seen();
+		assert!(
+			!seen.contains(&Seen::Start(pad)),
+			"the disabled pad started again: {seen:?}"
 		);
-		recorder.assert_one_pad_held();
 	}
 
 	/// A publisher that stops ends its media, a beat later its catalog, then its announcement.
diff --git a/rs/moq-mux/MIGRATE.md b/rs/moq-mux/MIGRATE.md
index 466c3fcae12..3efaa0be233 100644
--- a/rs/moq-mux/MIGRATE.md
+++ b/rs/moq-mux/MIGRATE.md
@@ -4,6 +4,17 @@ How to adopt new APIs and update for breaking changes, newest first.
 
 ## Unreleased
 
+### Selection never holds a disabled rendition ([#7942](https://github.com/moq-dev/moq/pull/7942))
+
+`select::Broadcast::retain` takes only the catalog, and `select::Selected` is gone: a rendition the catalog marks `enabled: false` is never selected, even one selected before, so `catalog::Select` drops it on the snapshot that disables it. Drop the second argument and any `Selected` you tracked.
+
+```rust
+// Before
+selection.retain(&mut catalog, &Selected::of(&previous));
+// After
+selection.retain(&mut catalog);
+```
+
 ### Shared H.265 SPS parsing
 
 Use `codec::h265::Sps::parse` to read an SPS NAL unit through the same bounded
diff --git a/rs/moq-mux/src/catalog/select.rs b/rs/moq-mux/src/catalog/select.rs
index 5193d0b9b1a..4105e9f2446 100644
--- a/rs/moq-mux/src/catalog/select.rs
+++ b/rs/moq-mux/src/catalog/select.rs
@@ -2,8 +2,7 @@
 //!
 //! [`Select`] wraps any [`Stream`] and applies a [`select::Broadcast`](crate::select::Broadcast)
 //! to each snapshot, dropping renditions that aren't selected before handing the
-//! catalog on. Each snapshot holds what the previous one selected, so a rendition its
-//! publisher disables stays while nothing else of its role is enabled.
+//! catalog to an exporter.
 
 use std::task::{Poll, ready};
 
@@ -14,24 +13,17 @@ use crate::select;
 /// A [`Stream`] that keeps only the renditions a [`select::Broadcast`] selects.
 ///
 /// The selection is fixed at construction; every snapshot from the inner stream is
-/// narrowed by it, holding the renditions the previous snapshot selected (see
-/// [`select::Broadcast::retain`]). Build one with [`Stream::select`](super::Stream::select) or
+/// narrowed by it. Build one with [`Stream::select`](super::Stream::select) or
 /// [`Select::new`].
 pub struct Select<S: Stream> {
 	inner: S,
 	selection: select::Broadcast,
-	/// What the last snapshot selected.
-	selected: select::Selected,
 }
 
 impl<S: Stream> Select<S> {
 	/// Wrap `inner`, narrowing every snapshot by `selection`.
 	pub fn new(inner: S, selection: select::Broadcast) -> Self {
-		Self {
-			inner,
-			selection,
-			selected: select::Selected::default(),
-		}
+		Self { inner, selection }
 	}
 }
 
@@ -41,8 +33,7 @@ impl<S: Stream> Stream for Select<S> {
 	fn poll_next(&mut self, waiter: &kio::Waiter) -> Poll<crate::Result<Option<Catalog<S::Ext>>>> {
 		let next = ready!(self.inner.poll_next(waiter))?;
 		Poll::Ready(Ok(next.map(|mut catalog| {
-			self.selection.retain(&mut catalog, &self.selected);
-			self.selected = select::Selected::of(&catalog);
+			self.selection.retain(&mut catalog);
 			catalog
 		})))
 	}
@@ -57,27 +48,14 @@ mod tests {
 	use super::super::hang::Catalog;
 	use super::*;
 
-	/// A finite stream: yields its snapshots in order, then ends.
-	struct Snapshots(std::collections::VecDeque<Catalog>);
+	/// A one-shot stream: yields its snapshot once, then ends.
+	struct Once(Option<Catalog>);
 
-	impl Snapshots {
-		fn new(snapshots: impl IntoIterator<Item = Catalog>) -> Self {
-			Self(snapshots.into_iter().collect())
-		}
-	}
-
-	impl Stream for Snapshots {
+	impl Stream for Once {
 		type Ext = ();
 
 		fn poll_next(&mut self, _: &kio::Waiter) -> Poll<crate::Result<Option<Catalog>>> {
-			Poll::Ready(Ok(self.0.pop_front()))
-		}
-	}
-
-	fn next(stream: &mut impl Stream<Ext = ()>) -> Catalog {
-		match stream.poll_next(&kio::Waiter::noop()) {
-			Poll::Ready(Ok(Some(c))) => c,
-			other => panic!("expected snapshot, got {other:?}"),
+			Poll::Ready(Ok(self.0.take()))
 		}
 	}
 
@@ -98,9 +76,12 @@ mod tests {
 		catalog.video.renditions = BTreeMap::from_iter(vec![h264("lo"), h264("hi")]);
 
 		let selection = select::Broadcast::default().video(select::Video::default().name("hi"));
-		let mut stream = Snapshots::new([catalog]).select(selection);
+		let mut stream = Once(Some(catalog)).select(selection);
 
-		let out = next(&mut stream);
+		let out = match stream.poll_next(&kio::Waiter::noop()) {
+			Poll::Ready(Ok(Some(c))) => c,
+			other => panic!("expected snapshot, got {other:?}"),
+		};
 		assert_eq!(out.video.renditions.keys().collect::<Vec<_>>(), vec!["hi"]);
 		assert!(matches!(stream.poll_next(&kio::Waiter::noop()), Poll::Ready(Ok(None))));
 	}
@@ -110,36 +91,15 @@ mod tests {
 		let mut catalog = Catalog::default();
 		catalog.video.renditions = BTreeMap::from_iter(vec![h264("lo"), h264("hi")]);
 
-		let boxed: Box<dyn Stream<Ext = ()>> = Box::new(Snapshots::new([catalog]));
+		let boxed: Box<dyn Stream<Ext = ()>> = Box::new(Once(Some(catalog)));
 		let selection = select::Broadcast::default().video(select::Video::default().name("lo"));
 		let mut stream = boxed.select(selection);
 
-		let out = next(&mut stream);
+		let out = match stream.poll_next(&kio::Waiter::noop()) {
+			Poll::Ready(Ok(Some(c))) => c,
+			other => panic!("expected snapshot, got {other:?}"),
+		};
 		assert_eq!(out.video.renditions.keys().collect::<Vec<_>>(), vec!["lo"]);
 		assert!(matches!(stream.poll_next(&kio::Waiter::noop()), Poll::Ready(Ok(None))));
 	}
-
-	/// A selected rendition its publisher disables stays selected until it re-enables, while one
-	/// disabled before it was ever selected is skipped.
-	#[test]
-	fn holds_what_the_previous_snapshot_selected() {
-		let snapshot = |enabled: bool| {
-			let mut catalog = Catalog::default();
-			let (name, mut config) = h264("v");
-			config.enabled = enabled;
-			catalog.video.renditions.insert(name, config);
-			catalog
-		};
-		let selection = select::Broadcast::default().video(select::Video::default());
-
-		let mut stream =
-			Snapshots::new([snapshot(false), snapshot(true), snapshot(false), snapshot(true)]).select(selection);
-		assert!(
-			next(&mut stream).video.renditions.is_empty(),
-			"disabled before it was selected"
-		);
-		assert!(next(&mut stream).video.renditions["v"].enabled);
-		assert!(!next(&mut stream).video.renditions["v"].enabled, "held while disabled");
-		assert!(next(&mut stream).video.renditions["v"].enabled);
-	}
 }
diff --git a/rs/moq-mux/src/select.rs b/rs/moq-mux/src/select.rs
index e4bcadfbbe8..c8421052eef 100644
--- a/rs/moq-mux/src/select.rs
+++ b/rs/moq-mux/src/select.rs
@@ -4,22 +4,15 @@
 //! additive: a default [`Broadcast`] selects *nothing*, and you opt a role in with
 //! [`video`](Broadcast::video) / [`audio`](Broadcast::audio). Within an opted-in
 //! role, an empty field matches everything; listing values keeps renditions matching
-//! any one of them (a union within a field, intersected across fields). A rendition whose
-//! container `kind` this build does not recognize is never selected.
-//!
-//! A disabled rendition (catalog `enabled: false`) is not selected, with one exception: one
-//! already [`Selected`] is held, still selected, while it stays in the catalog and no other
-//! rendition of its role that this selection matches is enabled. So a muted speaker keeps its
-//! listeners subscribed and its unmute plays at once, while a simulcast ladder, whose lowest rung
-//! never disables, moves to an enabled rung. Selection runs on every snapshot, so a rendition
-//! that re-enables is selected again.
+//! any one of them (a union within a field, intersected across fields). Per the hang spec, a
+//! disabled rendition (catalog `enabled: false`) and one whose container `kind` this build does
+//! not recognize are never selected. Selection runs on every snapshot, so a rendition that
+//! re-enables is selected again.
 //!
 //! The same [`Broadcast`] drives selection at either end of the pipeline: narrowing
 //! a published catalog on the consume side (see [`catalog::Select`](crate::catalog::Select)),
 //! or choosing which tracks to publish on the import side.
 
-use std::collections::{BTreeMap, BTreeSet};
-
 use hang::catalog::{AudioCodecKind, AudioConfig, VideoCodecKind, VideoConfig};
 
 use crate::catalog::hang::{Catalog, CatalogExt, supported};
@@ -57,66 +50,25 @@ impl Broadcast {
 		self.audio.is_some()
 	}
 
-	/// Drop every rendition from `catalog` that isn't selected, holding a disabled one in
-	/// `selected` (see the [module docs](self)).
-	///
-	/// Pass [`Selected::default`] to select from scratch, or the renditions already in use,
-	/// such as [`Selected::of`] the previous snapshot this returned.
-	pub fn retain<E: CatalogExt>(&self, catalog: &mut Catalog<E>, selected: &Selected) {
+	/// Drop every rendition from `catalog` that isn't selected.
+	pub fn retain<E: CatalogExt>(&self, catalog: &mut Catalog<E>) {
 		match &self.video {
-			Some(video) => hold(
-				&mut catalog.video.renditions,
-				|name, config| video.matches(name, config),
-				|config| config.enabled,
-				&selected.video,
-			),
+			Some(video) => catalog
+				.video
+				.renditions
+				.retain(|name, config| video.matches(name, config)),
 			None => catalog.video.renditions.clear(),
 		}
 		match &self.audio {
-			Some(audio) => hold(
-				&mut catalog.audio.renditions,
-				|name, config| audio.matches(name, config),
-				|config| config.enabled,
-				&selected.audio,
-			),
+			Some(audio) => catalog
+				.audio
+				.renditions
+				.retain(|name, config| audio.matches(name, config)),
 			None => catalog.audio.renditions.clear(),
 		}
 	}
 }
 
-/// The renditions a consumer already selected, by role and catalog name, which
-/// [`Broadcast::retain`] holds while their publisher has them disabled.
-#[derive(Clone, Debug, Default, PartialEq, Eq)]
-pub struct Selected {
-	/// Selected video renditions.
-	pub video: BTreeSet<String>,
-	/// Selected audio renditions.
-	pub audio: BTreeSet<String>,
-}
-
-impl Selected {
-	/// Every rendition `catalog` lists, such as the snapshot [`Broadcast::retain`] last returned.
-	pub fn of<E: CatalogExt>(catalog: &Catalog<E>) -> Self {
-		Self {
-			video: catalog.video.renditions.keys().cloned().collect(),
-			audio: catalog.audio.renditions.keys().cloned().collect(),
-		}
-	}
-}
-
-/// Keep the renditions of one role that match, dropping the disabled ones unless none that
-/// match is enabled, in which case those in `selected` stay.
-fn hold<C>(
-	renditions: &mut BTreeMap<String, C>,
-	matches: impl Fn(&str, &C) -> bool,
-	enabled: impl Fn(&C) -> bool,
-	selected: &BTreeSet<String>,
-) {
-	renditions.retain(|name, config| matches(name, config));
-	let alternative = renditions.values().any(&enabled);
-	renditions.retain(|name, config| enabled(config) || (!alternative && selected.contains(name)));
-}
-
 /// Video rendition criteria. An empty field matches every rendition.
 #[derive(Clone, Debug, Default)]
 pub struct Video {
@@ -138,7 +90,8 @@ impl Video {
 	}
 
 	fn matches(&self, name: &str, config: &VideoConfig) -> bool {
-		supported(name, &config.container)
+		config.enabled
+			&& supported(name, &config.container)
 			&& (self.name.is_empty() || self.name.iter().any(|n| n == name))
 			&& (self.codec.is_empty() || self.codec.contains(&config.codec.kind()))
 	}
@@ -165,7 +118,8 @@ impl Audio {
 	}
 
 	fn matches(&self, name: &str, config: &AudioConfig) -> bool {
-		supported(name, &config.container)
+		config.enabled
+			&& supported(name, &config.container)
 			&& (self.name.is_empty() || self.name.iter().any(|n| n == name))
 			&& (self.codec.is_empty() || self.codec.contains(&config.codec.kind()))
 	}
@@ -229,7 +183,7 @@ mod tests {
 	#[test]
 	fn default_selects_nothing() {
 		let mut catalog = catalog(vec![h264("v")], vec![opus("a")]);
-		Broadcast::default().retain(&mut catalog, &Selected::default());
+		Broadcast::default().retain(&mut catalog);
 		assert!(catalog.video.renditions.is_empty());
 		assert!(catalog.audio.renditions.is_empty());
 	}
@@ -237,9 +191,7 @@ mod tests {
 	#[test]
 	fn empty_axis_keeps_everything() {
 		let mut catalog = catalog(vec![h264("lo"), h264("hi")], vec![opus("a")]);
-		Broadcast::default()
-			.video(Video::default())
-			.retain(&mut catalog, &Selected::default());
+		Broadcast::default().video(Video::default()).retain(&mut catalog);
 		assert_eq!(video_names(&catalog), vec!["hi", "lo"]);
 		// Audio was never selected, so it's dropped.
 		assert!(catalog.audio.renditions.is_empty());
@@ -250,7 +202,7 @@ mod tests {
 		let mut catalog = catalog(vec![h264("lo"), h264("hi")], vec![]);
 		Broadcast::default()
 			.video(Video::default().name("hi"))
-			.retain(&mut catalog, &Selected::default());
+			.retain(&mut catalog);
 		assert_eq!(video_names(&catalog), vec!["hi"]);
 	}
 
@@ -259,7 +211,7 @@ mod tests {
 		let mut catalog = catalog(vec![], vec![opus("en"), opus("es"), opus("fr")]);
 		Broadcast::default()
 			.audio(Audio::default().name("en").name("es"))
-			.retain(&mut catalog, &Selected::default());
+			.retain(&mut catalog);
 		assert_eq!(audio_names(&catalog), vec!["en", "es"]);
 	}
 
@@ -268,7 +220,7 @@ mod tests {
 		let mut catalog = catalog(vec![h264("a"), vp9("b"), h264("c")], vec![]);
 		Broadcast::default()
 			.video(Video::default().codec(VideoCodecKind::H264))
-			.retain(&mut catalog, &Selected::default());
+			.retain(&mut catalog);
 		assert_eq!(video_names(&catalog), vec!["a", "c"]);
 	}
 
@@ -277,7 +229,7 @@ mod tests {
 		let mut catalog = catalog(vec![h264("a"), vp9("b")], vec![]);
 		Broadcast::default()
 			.video(Video::default().codec(VideoCodecKind::H264).codec(VideoCodecKind::VP9))
-			.retain(&mut catalog, &Selected::default());
+			.retain(&mut catalog);
 		assert_eq!(video_names(&catalog), vec!["a", "b"]);
 	}
 
@@ -287,102 +239,31 @@ mod tests {
 		future.container = serde_json::from_str(r#"{"kind":"future"}"#).unwrap();
 
 		let mut catalog = catalog(vec![h264("known"), (name, future)], vec![]);
-		Broadcast::default()
-			.video(Video::default())
-			.retain(&mut catalog, &Selected::default());
+		Broadcast::default().video(Video::default()).retain(&mut catalog);
 		assert_eq!(video_names(&catalog), vec!["known"]);
 	}
 
-	fn off_video((name, mut config): (String, VideoConfig)) -> (String, VideoConfig) {
-		config.enabled = false;
-		(name, config)
-	}
-
-	fn off_audio((name, mut config): (String, AudioConfig)) -> (String, AudioConfig) {
-		config.enabled = false;
-		(name, config)
-	}
-
-	fn selected(video: &[&str], audio: &[&str]) -> Selected {
-		Selected {
-			video: video.iter().map(|name| name.to_string()).collect(),
-			audio: audio.iter().map(|name| name.to_string()).collect(),
-		}
-	}
-
-	fn everything() -> Broadcast {
-		Broadcast::default().video(Video::default()).audio(Audio::default())
-	}
-
-	/// Selecting from scratch skips a disabled rendition, so a listener who joins during a
-	/// pause subscribes on the unmute.
-	#[test]
-	fn disabled_not_selected_initially() {
-		let mut catalog = catalog(vec![h264("lo"), off_video(h264("hi"))], vec![off_audio(opus("a"))]);
-		everything().retain(&mut catalog, &Selected::default());
-		assert_eq!(video_names(&catalog), vec!["lo"]);
-		assert!(catalog.audio.renditions.is_empty());
-	}
-
-	/// A selected rendition stays selected while disabled, if nothing else of its role is enabled.
 	#[test]
-	fn disabled_selection_is_held() {
-		let mut catalog = catalog(vec![off_video(h264("v"))], vec![off_audio(opus("a"))]);
-		everything().retain(&mut catalog, &selected(&["v"], &["a"]));
-		assert_eq!(video_names(&catalog), vec!["v"]);
-		assert_eq!(audio_names(&catalog), vec!["a"]);
-	}
-
-	/// Only what was selected is held: a rendition that was disabled all along is not picked up.
-	#[test]
-	fn only_the_selection_is_held() {
-		let mut catalog = catalog(vec![], vec![off_audio(opus("a")), off_audio(opus("b"))]);
-		everything().retain(&mut catalog, &selected(&[], &["a"]));
-		assert_eq!(audio_names(&catalog), vec!["a"]);
-	}
-
-	/// An enabled alternative wins, as a simulcast ladder's lowest rung does.
-	#[test]
-	fn enabled_alternative_wins() {
-		let mut catalog = catalog(vec![h264("lo"), off_video(h264("hi"))], vec![]);
-		everything().retain(&mut catalog, &selected(&["hi"], &[]));
+	fn disabled_never_selected() {
+		let (name, mut disabled) = h264("hi");
+		disabled.enabled = false;
+		let (audio, mut muted) = opus("a");
+		muted.enabled = false;
+
+		let mut catalog = catalog(vec![h264("lo"), (name, disabled)], vec![(audio, muted)]);
+		let selection = Broadcast::default().video(Video::default()).audio(Audio::default());
+		selection.retain(&mut catalog);
 		assert_eq!(video_names(&catalog), vec!["lo"]);
-	}
-
-	/// A rendition the selection doesn't match is no alternative.
-	#[test]
-	fn unmatched_rendition_is_no_alternative() {
-		let mut catalog = catalog(vec![h264("lo"), off_video(h264("hi"))], vec![]);
-		Broadcast::default()
-			.video(Video::default().name("hi"))
-			.retain(&mut catalog, &selected(&["hi"], &[]));
-		assert_eq!(video_names(&catalog), vec!["hi"]);
-	}
-
-	/// A held rendition removed from the catalog is dropped.
-	#[test]
-	fn removed_selection_is_dropped() {
-		let mut catalog = catalog(vec![], vec![off_audio(opus("b"))]);
-		everything().retain(&mut catalog, &selected(&[], &["a"]));
 		assert!(catalog.audio.renditions.is_empty());
 	}
 
-	/// Each role holds on its own: enabled video does not release held audio.
-	#[test]
-	fn roles_hold_independently() {
-		let mut catalog = catalog(vec![h264("v")], vec![off_audio(opus("a"))]);
-		everything().retain(&mut catalog, &selected(&["v"], &["a"]));
-		assert_eq!(video_names(&catalog), vec!["v"]);
-		assert_eq!(audio_names(&catalog), vec!["a"]);
-	}
-
 	#[test]
 	fn name_and_codec_intersect() {
 		let mut catalog = catalog(vec![h264("hi"), vp9("hi2"), h264("lo")], vec![]);
 		// name in {hi, hi2} AND codec H264 -> only "hi".
 		Broadcast::default()
 			.video(Video::default().name("hi").name("hi2").codec(VideoCodecKind::H264))
-			.retain(&mut catalog, &Selected::default());
+			.retain(&mut catalog);
 		assert_eq!(video_names(&catalog), vec!["hi"]);
 	}
 }
diff --git a/rs/moq-rtmp/src/server.rs b/rs/moq-rtmp/src/server.rs
index 9c1ed34d792..333a1c963c1 100644
--- a/rs/moq-rtmp/src/server.rs
+++ b/rs/moq-rtmp/src/server.rs
@@ -2467,7 +2467,7 @@ mod tests {
 		fn best(catalog: &moq_mux::catalog::hang::Catalog, capabilities: &ClientCapabilities) -> Option<String> {
 			let select = play_selection(catalog, capabilities).unwrap();
 			let mut catalog = catalog.clone();
-			select.retain(&mut catalog, &Default::default());
+			select.retain(&mut catalog);
 			catalog.video.ranked().next().map(|(name, _)| name.clone())
 		}
 
@@ -2527,7 +2527,7 @@ mod tests {
 		let legacy = ClientCapabilities::default();
 		let select = play_selection(&catalog, &legacy).expect("aac is playable");
 		let mut kept = catalog.clone();
-		select.retain(&mut kept, &Default::default());
+		select.retain(&mut kept);
 		assert_eq!(
 			kept.audio.renditions.keys().map(String::as_str).collect::<Vec<_>>(),
 			["b"]
@@ -2561,7 +2561,7 @@ mod tests {
 		};
 		let select = play_selection(&ac3, &ClientCapabilities::new(0, FourCcSupport::default(), support)).unwrap();
 		let mut kept = ac3.clone();
-		select.retain(&mut kept, &Default::default());
+		select.retain(&mut kept);
 		assert_eq!(
 			kept.audio.renditions.keys().map(String::as_str).collect::<Vec<_>>(),
 			["a"]
diff --git a/test/audio-quality/README.md b/test/audio-quality/README.md
index de33803e74a..5a8cc36489e 100644
--- a/test/audio-quality/README.md
+++ b/test/audio-quality/README.md
@@ -130,7 +130,9 @@ just test push-to-talk
 
 This separate, roughly nine-minute run drives the shipped publish and watch elements in one Chromium
 page. A constant tone loops through the fake microphone, encoded as 128 kbit/s Opus with 60 ms
-frames. The listener holds a fixed 300 ms delay. After warmup and a mute, it measures 22 presses,
+frames. A release mutes the publisher, which sends nothing until the next press while its rendition
+stays enabled, so the listener keeps its subscription and plays comfort noise in between. The
+listener holds a fixed 300 ms delay. After warmup and a mute, it measures 22 presses,
 alternating two and three seconds: the first after the warmup's five-second mute, seven with no
 intervening wait, seven after five seconds, and seven after sixty seconds. Both elements reach a
 local relay directly over WebTransport, with no shaping, loss, or queueing, so every millisecond
@@ -139,7 +141,7 @@ measured belongs to the media pipeline rather than the path.
 `presses.json` records captured chunks at each press, WebCodecs encoder and decoder inputs and
 outputs, container writes, frame arrivals before reordering, and audible output onsets. Publisher,
 receiver, and worklet observations share the page's monotonic clock. A listening worklet detects
-each nonzero output onset. Its render time is mapped through the context's render clock, read with
+each output onset above -40 dBFS, which clears the comfort noise (at most -60 dBFS RMS). Its render time is mapped through the context's render clock, read with
 the page clock when the port message lands, so a late message moves neither boundary; its projected
 output comes from `getOutputTimestamp`. This measures the browser's projected device output, not
 acoustic output from a physical speaker. Zero-gap presses can remain continuously audible, and a
@@ -150,8 +152,9 @@ separated presses have an identifiable onset.
 is still attributed to its utterance. The command checks pipeline completeness, not the epic's
 latency verdict. It refuses missing encoder inputs, a head that never reaches the listener or never
 decodes, submitted frames that never encode or reach the container, written frames that never reach
-the listener, reopened capture, a new encoder (a probe or a rebuilt codec) or subscription, and
-separated utterances with no audible output. It also fails on a broken driver or invalid capture.
+the listener, reopened capture, a new encoder (a probe or a rebuilt codec) or subscription, a mute
+that disables or drops the rendition, any underrun or stall across the presses, and separated
+utterances with no audible output. It also fails on a broken driver or invalid capture.
 
 The latency goal is at most 300 ms of playout added on top of one-way delivery. For each separated
 press, `delivery` is the slowest of the utterance's frames that arrived before its onset, measured
@@ -166,11 +169,10 @@ playout delay), `render` (that PCM to the render onset: the worklet hand-off and
 render callback), and `device`, as the stages below name them. `spread` is how far an utterance's frames
 stray from a steady arrival: the latest arrival relative to its media timestamp minus the earliest,
 which on this ideal path is the capture graph's cadence and what `"auto"`'s jitter estimate measures.
-The release's flushed lookahead chunk is not one of the utterance's frames and is left out. `latency`
-and `path` give each one's min, median and max.
+`latency` and `path` give each one's min, median and max.
 
-The command prints `latency`, `path`, and the completeness counts, and keeps its run directory
-even when it passes (set `HARNESS_KEEP=0` to drop it). Nightly runs it and keeps the raw evidence
+The command prints `latency`, `path`, the completeness counts, and `playback`'s underruns and
+stalls, and keeps its run directory even when it passes (set `HARNESS_KEEP=0` to drop it). Nightly runs it and keeps the raw evidence
 alongside the audio quality rows.
 
 ## Traces
diff --git a/test/audio-quality/clients/js/ptt-analyze.test.ts b/test/audio-quality/clients/js/ptt-analyze.test.ts
index 0d0e0d7a100..6e8fa9bf4ef 100644
--- a/test/audio-quality/clients/js/ptt-analyze.test.ts
+++ b/test/audio-quality/clients/js/ptt-analyze.test.ts
@@ -21,6 +21,8 @@ function trace() {
 		presses: [] as { at: number; on: boolean; capture?: { at: number; end: number } }[],
 		captures: [] as unknown[],
 		encoders: [] as number[],
+		catalog: [] as { at: number; selectable: boolean }[],
+		playback: { underruns: 0, stalls: 0 },
 		errors: [] as string[],
 		arrivals: [] as [number, number, number, number][],
 		state: { delay: 300 },
@@ -130,11 +132,32 @@ test("a head that arrives but never reaches the decoder fails the run", async ()
 	expect(stderr).toContain("utterance head was not decoded");
 });
 
-test("a new encoder fails as a probe, but the live encoder's release flush does not", async () => {
-	// A flush leaves no trace in the page's records, so the passing run above is the release flush.
+test("a new encoder fails the run", async () => {
 	const result = trace();
 	result.encoders.push(result.presses[2].at + 1);
 	const { exitCode, stderr } = await analyze(result);
 	expect(exitCode).toBe(1);
 	expect(stderr).toContain("an encoder was created again");
 });
+
+test("a mute that disables the rendition fails the run", async () => {
+	const result = trace();
+	result.catalog.push({ at: result.presses[3].at, selectable: false });
+	const { exitCode, stderr } = await analyze(result);
+	expect(exitCode).toBe(1);
+	expect(stderr).toContain("a mute disabled or dropped the rendition");
+});
+
+// The silence between presses is declared, so playback must cross it without counting it.
+test("an underrun or stall across the presses fails the run", async () => {
+	for (const playback of [
+		{ underruns: 1, stalls: 0 },
+		{ underruns: 0, stalls: 1 },
+	]) {
+		const result = trace();
+		result.playback = playback;
+		const { exitCode, stderr } = await analyze(result);
+		expect(exitCode).toBe(1);
+		expect(stderr).toContain("playback underran or stalled");
+	}
+});
diff --git a/test/audio-quality/clients/js/ptt-analyze.ts b/test/audio-quality/clients/js/ptt-analyze.ts
index d027d000fc6..967254b1fe2 100644
--- a/test/audio-quality/clients/js/ptt-analyze.ts
+++ b/test/audio-quality/clients/js/ptt-analyze.ts
@@ -129,6 +129,8 @@ const summary = {
 	captures: result.captures,
 	encoders: result.encoders,
 	subscriptions: result.subscriptions,
+	catalog: result.catalog,
+	playback: result.playback,
 	unencoded: result.submitted.filter((frame) => !encoded.has(frame.timestamp)).length,
 	unsent: result.encoded.filter((frame) => !sent.has(frame.timestamp)).length,
 	// An ideal path loses nothing, so every written frame must reach the listener.
@@ -137,8 +139,8 @@ const summary = {
 await Bun.write(join(directory, "summary.json"), JSON.stringify(summary, null, 2));
 // The report: the latency and its parts, and the completeness the run gates on. Per-press detail
 // stays in summary.json.
-const { latency, path, delay, unencoded, unsent, unreceived } = summary;
-console.log(JSON.stringify({ latency, path, delay, unencoded, unsent, unreceived }, null, 2));
+const { latency, path, delay, unencoded, unsent, unreceived, playback } = summary;
+console.log(JSON.stringify({ latency, path, delay, unencoded, unsent, unreceived, playback }, null, 2));
 
 const failures: string[] = [];
 if (presses.some((press, i) => (i === 0 || i >= 8) && press.audible === null)) {
@@ -147,6 +149,9 @@ if (presses.some((press, i) => (i === 0 || i >= 8) && press.audible === null)) {
 if (result.captures.length) failures.push("capture reopened");
 if (result.encoders.length) failures.push("an encoder was created again");
 if (result.subscriptions.length) failures.push("subscription reopened");
+if (result.catalog.length) failures.push("a mute disabled or dropped the rendition");
+// The silence between presses is declared, so it is neither an underrun nor a stall.
+if (result.playback.underruns || result.playback.stalls) failures.push("playback underran or stalled");
 if (presses.some((press) => !press.submitted || !press.firstEncoded)) failures.push("utterance head was not encoded");
 if (summary.unencoded || summary.unsent) failures.push("submitted audio was not encoded and sent completely");
 if (presses.some((press) => !press.firstReceived)) failures.push("utterance head was not received");
diff --git a/test/audio-quality/clients/js/ptt.ts b/test/audio-quality/clients/js/ptt.ts
index a4b4946bee8..ca5afed0f10 100644
--- a/test/audio-quality/clients/js/ptt.ts
+++ b/test/audio-quality/clients/js/ptt.ts
@@ -63,11 +63,11 @@ try {
 	await page.evaluate(() => globalThis.ptt.press(false));
 	await page.waitForTimeout(5000);
 	const held = await page.evaluate(() => globalThis.ptt.state());
-	if (held.active || held.config?.enabled !== false || held.selected !== initial.selected) {
-		throw new Error("the muted listener did not hold its rendition");
+	if (held.active || !held.config || held.config.enabled === false || held.selected !== initial.selected) {
+		throw new Error("muting changed the rendition or the listener's selection");
 	}
 	// Tune-in can consume retained audio. Validate the tap on a fresh press only after the muted
-	// listener holds its subscription.
+	// listener keeps its subscription.
 	await page.evaluate(() => globalThis.ptt.press(true));
 	await page.waitForTimeout(3000);
 	await page.evaluate(() => globalThis.ptt.press(false));
diff --git a/test/audio-quality/clients/js/src/ptt.ts b/test/audio-quality/clients/js/src/ptt.ts
index 90c645aae7c..3741759998f 100644
--- a/test/audio-quality/clients/js/src/ptt.ts
+++ b/test/audio-quality/clients/js/src/ptt.ts
@@ -25,25 +25,33 @@ const records = {
 	presses: [] as { at: number; on: boolean; capture?: { at: number; end: number } }[],
 	captures: [] as { at: number; audio: boolean }[],
 	encoders: [] as number[],
+	// Each time the published rendition became unselectable (disabled or dropped) or selectable again.
+	catalog: [] as { at: number; selectable: boolean }[],
 	errors: [] as string[],
 };
 
 // Observe WebCodecs without changing its input, output, or scheduling. A probe or a rebuilt codec
-// constructs a new encoder; the live one flushes at each release, so a flush alone is no probe.
+// constructs a new encoder. Chrome and Firefox stamp output after an input gap as if it were
+// contiguous, so each chunk answers the oldest input still owed, as the publisher stamps it. Only a
+// flush, which the probe uses, emits a chunk past the inputs: the codec's lookahead tail.
 const NativeEncoder = globalThis.AudioEncoder;
 globalThis.AudioEncoder = class extends NativeEncoder {
+	#owed: number[] = [];
 	constructor(init: AudioEncoderInit) {
 		records.encoders.push(performance.now());
 		super({
 			...init,
 			output: (chunk, metadata) => {
-				records.encoded.push({ at: performance.now(), timestamp: chunk.timestamp, bytes: chunk.byteLength });
+				const timestamp = this.#owed.shift();
+				if (timestamp !== undefined)
+					records.encoded.push({ at: performance.now(), timestamp, bytes: chunk.byteLength });
 				init.output(chunk, metadata);
 			},
 		});
 	}
 	override encode(data: AudioData): void {
 		records.submitted.push({ at: performance.now(), timestamp: data.timestamp, duration: data.duration });
+		this.#owed.push(data.timestamp);
 		super.encode(data);
 	}
 };
@@ -145,12 +153,14 @@ async function attach() {
 	if (!root || root === attached) return;
 	attached = root;
 	const context = root.context as AudioContext;
-	// A constant microphone tone makes a nonzero output quantum the utterance's audible onset.
-	// Map its render timestamp through getOutputTimestamp, rather than timing the port message.
+	// A constant microphone tone makes a loud output quantum the utterance's audible onset. The
+	// threshold clears the comfort noise the player fills a declared silence with (at most -60 dBFS
+	// RMS) and sits far below the -12 dBFS tone. Map its render timestamp through
+	// getOutputTimestamp, rather than timing the port message.
 	const source = `class Tap extends AudioWorkletProcessor {
 		loud = false;
 		process(inputs) {
-			const loud = !!inputs[0]?.[0]?.some(s => Math.abs(s) > 0.001);
+			const loud = !!inputs[0]?.[0]?.some(s => Math.abs(s) > 0.01);
 			if (loud && !this.loud) this.port.postMessage(currentTime);
 			this.loud = loud;
 			return true;
@@ -191,6 +201,20 @@ async function attach() {
 }
 audio.out.root.subscribe(() => void attach().catch((error) => records.errors.push(String(error))));
 
+// A mute must not touch the catalog: a disabled or dropped rendition makes every listener wait for it.
+let selectable = true;
+publish.audio.out.catalog.subscribe((config) => {
+	const now = config !== undefined && config.enabled !== false;
+	if (now !== selectable) records.catalog.push({ at: performance.now(), selectable: now });
+	selectable = now;
+});
+// Playback counts from the measurement's start, so the warmup's tune-in is not charged to it.
+let baseline = { underruns: 0, stalls: 0 };
+const playback = () => {
+	const stats = audio.out.stats.peek();
+	return { underruns: (stats?.underruns ?? 0) - baseline.underruns, stalls: (stats?.stalls ?? 0) - baseline.stalls };
+};
+
 /** The finite measurement surface driven by ptt.ts. */
 export const measurement = {
 	press(on: boolean) {
@@ -219,10 +243,12 @@ export const measurement = {
 		for (const list of Object.values(records)) list.length = 0;
 		capture.drain();
 		arrivals.length = 0;
+		const stats = audio.out.stats.peek();
+		baseline = { underruns: stats?.underruns ?? 0, stalls: stats?.stalls ?? 0 };
 	},
 	result() {
 		arrivals.push(...capture.drain());
-		return { ...records, arrivals, captureError: capture.error() };
+		return { ...records, arrivals, playback: playback(), captureError: capture.error() };
 	},
 };
 

From bec817fdf3ccca06935e85647ca610d0faeda1e7 Mon Sep 17 00:00:00 2001
From: Luke Curley <kixelated@gmail.com>
Date: Thu, 5 Nov 2026 22:19:43 +0000
Subject: [PATCH 26/36] fix(ci): report independent Nightly failures together
 (#7667)

Co-authored-by: GPT-6.1 Sol <noreply@openai.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: quest fixer <quest-fixer@localhost>
---
 .github/workflows/nightly.yml  |  13 ++-
 .github/workflows/platform.yml |  19 +++--
 quest/m0/nightly/README.md     |   6 +-
 rs/justfile                    | 146 +++++++++++++++++++--------------
 sh/checks.sh                   |  15 ++++
 sh/gh/nightly.sh               |  12 +--
 sh/gh/nightly.test.py          | 117 ++++++++++++++++++++++++++
 sh/rs/media-features.sh        |  15 ++--
 sh/rs/net-features.sh          |  10 ++-
 sh/rs/tokio-features.sh        |  28 ++++---
 10 files changed, 276 insertions(+), 105 deletions(-)
 create mode 100644 sh/checks.sh

diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
index 1e9495f7044..e66080f43de 100644
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -466,30 +466,35 @@ jobs:
           persist-credentials: false
       - uses: ./.github/actions/nix
       - name: Rust cache
+        id: setup
         uses: ./.github/actions/rust-cache
         with:
           access-key-id: ${{ secrets.MBX_R2_ACCESS_KEY_ID }}
           secret-access-key: ${{ secrets.MBX_R2_SECRET_ACCESS_KEY }}
+      # Independent checks keep running after a failure; the job still finishes red.
       - name: WebSocket fallback startup benchmark
         run: nix develop --command just js qmux-bench
 
       - name: Browser publisher fairness benchmark
+        if: ${{ !cancelled() && steps.setup.outcome == 'success' }}
         run: nix develop --command just js serve-bench
         shell: bash -leo pipefail {0}
       - name: Raw audio encoding benchmark
+        if: ${{ !cancelled() && steps.setup.outcome == 'success' }}
         run: nix develop --command just js raw-audio-bench
         shell: bash -leo pipefail {0}
       - name: Audio ring benchmark
+        if: ${{ !cancelled() && steps.setup.outcome == 'success' }}
         run: nix develop --command just js ring-bench
         shell: bash -leo pipefail {0}
       - name: Native headless playback
-        if: ${{ !cancelled() }}
+        if: ${{ !cancelled() && steps.setup.outcome == 'success' }}
         run: nix develop --command just test native-play
         shell: bash -leo pipefail {0}
         env:
           HARNESS_RUNS: ${{ runner.temp }}/moq-test-runs
       - name: Audio quality
-        if: ${{ !cancelled() }}
+        if: ${{ !cancelled() && steps.setup.outcome == 'success' }}
         run: nix develop --command just test audio-quality --runtimes chromium --enforce --capture
         shell: bash -leo pipefail {0}
         env:
@@ -508,7 +513,7 @@ jobs:
       # stall voids about one AAC row in seven, which would fail most nights until
       # it is fixed. Kept beside the browser run so its ceilings can be re-measured.
       - name: Native audio quality
-        if: ${{ !cancelled() }}
+        if: ${{ !cancelled() && steps.setup.outcome == 'success' }}
         run: nix develop --command just test audio-quality --runtimes native
         shell: bash -leo pipefail {0}
         env:
@@ -517,7 +522,7 @@ jobs:
       # The run directory is the diagnosis: each process's log, the shaper's
       # counters, the raw samples, and every row's summary.
       - name: Keep the run
-        if: ${{ !cancelled() }}
+        if: ${{ !cancelled() && steps.setup.outcome == 'success' }}
         uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: audio-quality-run
diff --git a/.github/workflows/platform.yml b/.github/workflows/platform.yml
index a178c017e75..f72fcb6dd0a 100644
--- a/.github/workflows/platform.yml
+++ b/.github/workflows/platform.yml
@@ -106,14 +106,16 @@ jobs:
       - name: Setup complete
         id: setup
         run: echo "Platform tools ready"
-      - name: Rust compile and tests
+      - name: Rust compile
         if: ${{ !cancelled() && steps.setup.outcome == 'success' && (needs.scope.outputs.rs == 'true') }}
         shell: bash
         env:
           CI_BASE: ${{ github.event_name != 'pull_request' && '--all' || '' }}
-        run: |
-          just rs windows "$CI_BASE"
-          just rs windows-test
+        run: just rs windows "$CI_BASE"
+      - name: Rust tests
+        if: ${{ !cancelled() && steps.setup.outcome == 'success' && (needs.scope.outputs.rs == 'true') }}
+        shell: bash
+        run: just rs windows-test
       - name: C
         if: ${{ !cancelled() && steps.setup.outcome == 'success' && (needs.scope.outputs.c == 'true') }}
         shell: bash
@@ -159,13 +161,14 @@ jobs:
       - name: Setup complete
         id: setup
         run: echo "Platform tools ready"
-      - name: Rust compile and tests
+      - name: Rust compile
         if: ${{ !cancelled() && steps.setup.outcome == 'success' && (needs.scope.outputs.rs == 'true') }}
         env:
           CI_BASE: ${{ github.event_name != 'pull_request' && '--all' || '' }}
-        run: |
-          just rs macos "$CI_BASE"
-          just rs macos-test
+        run: just rs macos "$CI_BASE"
+      - name: Rust tests
+        if: ${{ !cancelled() && steps.setup.outcome == 'success' && (needs.scope.outputs.rs == 'true') }}
+        run: just rs macos-test
       - name: Swift simulator check
         if: ${{ !cancelled() && steps.setup.outcome == 'success' && (needs.scope.outputs.swift == 'true') }}
         run: just swift simulator
diff --git a/quest/m0/nightly/README.md b/quest/m0/nightly/README.md
index b896ebeb1de..fb51ffd967b 100644
--- a/quest/m0/nightly/README.md
+++ b/quest/m0/nightly/README.md
@@ -22,10 +22,8 @@ children for the causes nothing owned.
 
 This README's own work, after the children:
 
-- Nightly's multi-step jobs (Features first) keep going past a failed step
-  and fail at the end, so one break never hides the steps after it.
-- Confirm a scheduled run passes. Failures already owned elsewhere stay
-  there: the audio near-zero p95 row belongs to
+- Confirm a scheduled run on `main` passes; never dispatch Nightly. Failures
+  already owned elsewhere stay there: the audio near-zero p95 row belongs to
   [audio jitter target](/quest/m1/audio-jitter-target/README.md), the
   macOS `receive_credit` timeout has no owner since its quest was deleted in
   [moq-dev/moq#6732](https://github.com/moq-dev/moq/pull/6732), so plan one under
diff --git a/rs/justfile b/rs/justfile
index 57ee63a5771..6b3f5b8e152 100644
--- a/rs/justfile
+++ b/rs/justfile
@@ -101,9 +101,13 @@ windows $BASE="":
 
 # Test the platform-sensitive crates on Windows, independent of the diff.
 windows-test:
-    just rs test --manifest-path rs/moq-auth/Cargo.toml
-    just rs test -p kio -p hang -p moq-tokio -p moq-sock -p moq-relay
-    just rs test -p moq-video --no-default-features --features render -E 'test(/^render::export::/)'
+    #!/usr/bin/env bash
+    set -euo pipefail
+    source sh/checks.sh
+    run just rs test --manifest-path rs/moq-auth/Cargo.toml
+    run just rs test -p kio -p hang -p moq-tokio -p moq-sock -p moq-relay
+    run just rs test -p moq-video --no-default-features --features render -E 'test(/^render::export::/)'
+    finish
 
 # Run io_uring tests when the branch affects the relay or its dependencies.
 [positional-arguments]
@@ -144,14 +148,18 @@ macos $BASE="":
 
 # Test the platform-sensitive crates on macOS, independent of the diff.
 macos-test:
-    just rs test --manifest-path rs/moq-auth/Cargo.toml
-    just rs test -p kio -p hang -p moq-tokio -p moq-sock
-    just rs test -p moq-sock --features fast-apple-datapath
-    just rs test -p moq-video --no-default-features -E 'test(encode::backend::videotoolbox::tests)'
-    just rs test -p moq-video --no-default-features --features render -E 'test(/^render::export::/)'
+    #!/usr/bin/env bash
+    set -euo pipefail
+    source sh/checks.sh
+    run just rs test --manifest-path rs/moq-auth/Cargo.toml
+    run just rs test -p kio -p hang -p moq-tokio -p moq-sock
+    run just rs test -p moq-sock --features fast-apple-datapath
+    run just rs test -p moq-video --no-default-features -E 'test(encode::backend::videotoolbox::tests)'
+    run just rs test -p moq-video --no-default-features --features render -E 'test(/^render::export::/)'
     # The runner's paravirtual Metal device proves the IOSurface import, ignored elsewhere.
-    just rs test -p moq-video --no-default-features --features render --lib --run-ignored only \
+    run just rs test -p moq-video --no-default-features --features render --lib --run-ignored only \
         -E 'test(/^render::renderer::tests::(the_metal_import_matches_the_cpu_path|imports_survive_decoder_pool_recycling)$/)'
+    finish
 
 # Compile and lint the capture and playback features, which the default check skips.
 [positional-arguments]
@@ -237,26 +245,30 @@ c-tests:
 
 # Compile the full feature matrix, including isolated combinations and their tests.
 features:
-    just rs net-features --all
-    just rs coroutines
-    just rs quic-features --all
-    just rs crypto-key
-    just rs tokio-features --all
-    just rs media-features --all
-    bash sh/local.sh cargo check --locked --workspace {{ no_fuzz }} --all-targets --no-default-features
-    bash sh/local.sh cargo check --locked -p moq-relay --no-default-features
-    just rs relay-minimal
-    bash sh/local.sh cargo check --locked -p moq-cli --no-default-features
-    just rs test -p moq-cli --no-default-features --features capture,websocket -E 'test(capture_window)'
-    just rs test -p moq-cli --no-default-features --features capture,pipewire,websocket -E 'test(capture_window)'
-    bash sh/local.sh cargo check --locked -p moq-bench --no-default-features
-    bash sh/local.sh cargo check --locked -p moq-boy --no-default-features
+    #!/usr/bin/env bash
+    set -euo pipefail
+    source sh/checks.sh
+    run just rs net-features --all
+    run just rs coroutines
+    run just rs quic-features --all
+    run just rs crypto-key
+    run just rs tokio-features --all
+    run just rs media-features --all
+    run bash sh/local.sh cargo check --locked --workspace {{ no_fuzz }} --all-targets --no-default-features
+    run bash sh/local.sh cargo check --locked -p moq-relay --no-default-features
+    run just rs relay-minimal
+    run bash sh/local.sh cargo check --locked -p moq-cli --no-default-features
+    run just rs test -p moq-cli --no-default-features --features capture,websocket -E 'test(capture_window)'
+    run just rs test -p moq-cli --no-default-features --features capture,pipewire,websocket -E 'test(capture_window)'
+    run bash sh/local.sh cargo check --locked -p moq-bench --no-default-features
+    run bash sh/local.sh cargo check --locked -p moq-boy --no-default-features
     # Alone, since the workspace's `kio/sim` dev-dependencies would unify `kio/async` back in.
-    bash sh/local.sh cargo check --locked --manifest-path rs/moq-auth/Cargo.toml --lib --all-features
-    bash sh/local.sh cargo check --locked -p moq-hls -p moq-rtmp -p moq-rtc --no-default-features --all-targets
-    bash sh/local.sh cargo clippy --locked --workspace {{ no_fuzz }} --all-targets --all-features -- -D warnings
-    RUSTDOCFLAGS="-D warnings" bash sh/local.sh cargo doc --locked --workspace {{ no_fuzz }} --all-features --no-deps
-    bash sh/rs/nextest.sh cargo nextest run --locked --workspace {{ no_fuzz }} --all-targets --all-features
+    run bash sh/local.sh cargo check --locked --manifest-path rs/moq-auth/Cargo.toml --lib --all-features
+    run bash sh/local.sh cargo check --locked -p moq-hls -p moq-rtmp -p moq-rtc --no-default-features --all-targets
+    run bash sh/local.sh cargo clippy --locked --workspace {{ no_fuzz }} --all-targets --all-features -- -D warnings
+    run env RUSTDOCFLAGS="-D warnings" bash sh/local.sh cargo doc --locked --workspace {{ no_fuzz }} --all-features --no-deps
+    run bash sh/rs/nextest.sh cargo nextest run --locked --workspace {{ no_fuzz }} --all-targets --all-features
+    finish
 
 # Compile and test the explicit-time model without async helpers or sessions.
 [positional-arguments]
@@ -265,37 +277,46 @@ net-features *args:
 
 # Prove the poll-only library builds compile no coroutines and document cleanly.
 coroutines:
-    bash sh/rs/coroutines.sh kio -- --no-default-features --features macros,runtime,manual,serde
-    RUSTDOCFLAGS="-D warnings" bash sh/local.sh cargo doc --locked -p kio --no-deps --no-default-features --features macros,runtime,manual,serde
-    bash sh/rs/coroutines.sh moq-net -- --no-default-features
-    bash sh/rs/coroutines.sh moq-json -- --no-default-features
-    RUSTDOCFLAGS="-D warnings" bash sh/local.sh cargo doc --locked -p moq-json --no-deps --no-default-features
-    bash sh/rs/coroutines.sh hang -- --no-default-features
-    RUSTDOCFLAGS="-D warnings" bash sh/local.sh cargo doc --locked -p hang --no-deps --no-default-features
-    bash sh/rs/coroutines.sh moq-mux -- --no-default-features
-    RUSTDOCFLAGS="-D warnings" bash sh/local.sh cargo doc --locked -p moq-mux --no-deps --no-default-features
-    bash sh/rs/coroutines.sh moq-hls -- --no-default-features
-    RUSTDOCFLAGS="-D warnings" bash sh/local.sh cargo doc --locked -p moq-hls --no-deps --no-default-features
-    bash sh/rs/coroutines.sh moq-room -- --no-default-features
-    RUSTDOCFLAGS="-D warnings" bash sh/local.sh cargo doc --locked -p moq-room --no-deps --no-default-features
-    bash sh/rs/coroutines.sh moq-stats -- --no-default-features
-    RUSTDOCFLAGS="-D warnings" bash sh/local.sh cargo doc --locked -p moq-stats --no-deps --no-default-features
-    bash sh/rs/coroutines.sh moq-crypto -- --no-default-features --features sign,e2ee,provider,serde
-    RUSTDOCFLAGS="-D warnings" bash sh/local.sh cargo doc --locked -p moq-crypto --no-deps --no-default-features --features sign,e2ee,provider,serde
-    bash sh/rs/coroutines.sh rs/moq-auth/Cargo.toml -- --no-default-features
+    #!/usr/bin/env bash
+    set -euo pipefail
+    source sh/checks.sh
+    run bash sh/rs/coroutines.sh kio -- --no-default-features --features macros,runtime,manual,serde
+    run env RUSTDOCFLAGS="-D warnings" bash sh/local.sh cargo doc --locked -p kio --no-deps --no-default-features --features macros,runtime,manual,serde
+    run bash sh/rs/coroutines.sh moq-net -- --no-default-features
+    run bash sh/rs/coroutines.sh moq-json -- --no-default-features
+    run env RUSTDOCFLAGS="-D warnings" bash sh/local.sh cargo doc --locked -p moq-json --no-deps --no-default-features
+    run bash sh/rs/coroutines.sh hang -- --no-default-features
+    run env RUSTDOCFLAGS="-D warnings" bash sh/local.sh cargo doc --locked -p hang --no-deps --no-default-features
+    run bash sh/rs/coroutines.sh moq-mux -- --no-default-features
+    run env RUSTDOCFLAGS="-D warnings" bash sh/local.sh cargo doc --locked -p moq-mux --no-deps --no-default-features
+    run bash sh/rs/coroutines.sh moq-hls -- --no-default-features
+    run env RUSTDOCFLAGS="-D warnings" bash sh/local.sh cargo doc --locked -p moq-hls --no-deps --no-default-features
+    run bash sh/rs/coroutines.sh moq-room -- --no-default-features
+    run env RUSTDOCFLAGS="-D warnings" bash sh/local.sh cargo doc --locked -p moq-room --no-deps --no-default-features
+    run bash sh/rs/coroutines.sh moq-stats -- --no-default-features
+    run env RUSTDOCFLAGS="-D warnings" bash sh/local.sh cargo doc --locked -p moq-stats --no-deps --no-default-features
+    run bash sh/rs/coroutines.sh moq-crypto -- --no-default-features --features sign,e2ee,provider,serde
+    run env RUSTDOCFLAGS="-D warnings" bash sh/local.sh cargo doc --locked -p moq-crypto --no-deps --no-default-features --features sign,e2ee,provider,serde
+    run bash sh/rs/coroutines.sh rs/moq-auth/Cargo.toml -- --no-default-features
+    finish
 
 # Prove moq-crypto's key-only build, which moq-auth depends on, leaves out the transport and aws-lc-rs, then lint and test it alone; a workspace build unifies the default features back in.
 crypto-key:
     #!/usr/bin/env bash
     set -euo pipefail
-    graph=$(cargo tree --locked -p moq-crypto --no-default-features --features serde -e normal --prefix none)
-    if grep -E '^(aws-lc-rs|moq-net) ' <<<"$graph"; then
-        echo "moq-crypto without sign or e2ee must not depend on moq-net or aws-lc-rs" >&2
-        exit 1
-    fi
-    bash sh/local.sh cargo clippy --locked -p moq-crypto --no-default-features --all-targets -- -D warnings
-    bash sh/local.sh cargo clippy --locked -p moq-crypto --no-default-features --features serde --all-targets -- -D warnings
-    bash sh/rs/nextest.sh cargo nextest run --locked -p moq-crypto --no-default-features --features serde
+    source sh/checks.sh
+    key_only_dependencies() {
+        graph=$(cargo tree --locked -p moq-crypto --no-default-features --features serde -e normal --prefix none) || return
+        if grep -E '^(aws-lc-rs|moq-net) ' <<<"$graph"; then
+            echo "moq-crypto without sign or e2ee must not depend on moq-net or aws-lc-rs" >&2
+            return 1
+        fi
+    }
+    run key_only_dependencies
+    run bash sh/local.sh cargo clippy --locked -p moq-crypto --no-default-features --all-targets -- -D warnings
+    run bash sh/local.sh cargo clippy --locked -p moq-crypto --no-default-features --features serde --all-targets -- -D warnings
+    run bash sh/rs/nextest.sh cargo nextest run --locked -p moq-crypto --no-default-features --features serde
+    finish
 
 # Prove moq-quic leaves kio's dev-only clock runtime to its consumers, and lints without its default features; a workspace build unifies both back in.
 [positional-arguments]
@@ -309,12 +330,17 @@ quic-features *args:
         echo 'usage: just rs quic-features [--all]' >&2
         exit 2
     fi
-    graph=$(cargo tree --locked -p moq-quic -e normal --prefix none)
-    if grep -E '^tokio ' <<<"$graph"; then
-        echo "moq-quic must not depend on a native runtime" >&2
-        exit 1
-    fi
-    bash sh/local.sh cargo clippy --locked -p moq-quic "${targets[@]}" --no-default-features -- -D warnings
+    source sh/checks.sh
+    dependencies() {
+        graph=$(cargo tree --locked -p moq-quic -e normal --prefix none) || return
+        if grep -E '^tokio ' <<<"$graph"; then
+            echo "moq-quic must not depend on a native runtime" >&2
+            return 1
+        fi
+    }
+    run dependencies
+    run bash sh/local.sh cargo clippy --locked -p moq-quic "${targets[@]}" --no-default-features -- -D warnings
+    finish
 
 # Compile media boundaries (--all isolates every mode) and prove expensive
 # native/render dependencies are absent when their features are excluded.
diff --git a/sh/checks.sh b/sh/checks.sh
new file mode 100644
index 00000000000..265e3605404
--- /dev/null
+++ b/sh/checks.sh
@@ -0,0 +1,15 @@
+# shellcheck shell=bash
+# Source this in a suite, run independent commands with run, then call finish.
+# Functions passed to run must return errors explicitly: Bash suppresses their
+# errexit inside an if condition. External commands keep their own error handling.
+failed=()
+run() {
+    echo "checks: $*"
+    if ! "$@"; then failed+=("$*"); fi
+}
+finish() {
+    if ((${#failed[@]})); then
+        printf 'checks: failed: %s\n' "${failed[@]}" >&2
+        return 1
+    fi
+}
diff --git a/sh/gh/nightly.sh b/sh/gh/nightly.sh
index 2017e3f034e..5a4fe03313c 100755
--- a/sh/gh/nightly.sh
+++ b/sh/gh/nightly.sh
@@ -54,11 +54,8 @@ if [[ -n $report ]]; then
     mkdir -p "$out/raw"
 fi
 
-failed=()
-run() {
-    echo "nightly: $*"
-    if ! "$@"; then failed+=("$*"); fi
-}
+# shellcheck source=sh/checks.sh
+source "$(dirname "${BASH_SOURCE[0]}")/../checks.sh"
 
 criterion() {
     local label=$1
@@ -202,10 +199,7 @@ case "$1" in
         ;;
 esac
 
-if ((${#failed[@]})); then
-    printf 'nightly: failed: %s\n' "${failed[@]}" >&2
-    exit 1
-fi
+finish
 
 if [[ -n $report ]]; then
     just gh benchmark-report "$report" "$out" "$out/report.json"
diff --git a/sh/gh/nightly.test.py b/sh/gh/nightly.test.py
index 09d596baf3e..8ea23e81a51 100644
--- a/sh/gh/nightly.test.py
+++ b/sh/gh/nightly.test.py
@@ -7,6 +7,7 @@
 import shutil
 import subprocess
 import tempfile
+import textwrap
 import unittest
 from pathlib import Path
 
@@ -15,6 +16,122 @@
 ROOT = Path(__file__).resolve().parents[2]
 
 
+class FeaturesTest(unittest.TestCase):
+    def run_features(self, failures=(), nested=False, leaks=(), recipe="features"):
+        runner = shutil.which("just")
+        (ROOT / ".tmp").mkdir(exist_ok=True)
+        with tempfile.TemporaryDirectory(dir=ROOT / ".tmp") as directory:
+            scratch = Path(directory)
+            calls = scratch / "calls"
+            for command in ("just", "cargo"):
+                stub = scratch / command
+                stub.write_text(
+                    textwrap.dedent("""\
+                    #!/usr/bin/env python3
+                    import json, os, subprocess, sys
+                    from pathlib import Path
+                    args = sys.argv[1:]
+                    call = [os.path.basename(sys.argv[0]), *[
+                        'mir=<output>' if arg.startswith('mir=') else arg for arg in args
+                    ]]
+                    with open(os.environ['FEATURE_CALLS'], 'a') as output:
+                        output.write(json.dumps(call) + '\\n')
+                    if call in json.loads(os.environ['FEATURE_FAILURES']):
+                        sys.exit(1)
+                    if call[0] == 'just':
+                        if os.environ['FEATURE_NESTED'] == '1' and args[1] in (
+                            'net-features', 'quic-features', 'crypto-key', 'tokio-features', 'media-features',
+                            'coroutines',
+                        ):
+                            sys.exit(subprocess.call([os.environ['FEATURE_REAL_JUST'], *args]))
+                        sys.exit(0)
+                    if args[0] == 'tree':
+                        for crate in json.loads(os.environ['FEATURE_LEAKS']):
+                            print(crate + ' v1.0.0')
+                        features = args[args.index('--features') + 1].split(',') if '--features' in args else []
+                        for feature, crates in {
+                            'openh264': ['openh264', 'openh264-sys2'], 'nvidia': ['moq-nvenc'],
+                            'render': ['wgpu'], 'vpx': ['libvpx-native-sys'], 'capture': ['cpal'],
+                        }.items():
+                            if feature in features:
+                                for crate in crates:
+                                    print(crate + ' v1.0.0')
+                    elif args[0] == 'rustc':
+                        for arg in args:
+                            if arg.startswith('mir='):
+                                Path(arg[4:]).write_text('')
+                    """)
+                )
+                stub.chmod(0o755)
+            result = subprocess.run(
+                [runner, "rs", recipe],
+                cwd=ROOT,
+                env=dict(
+                    os.environ,
+                    PATH=f"{scratch}:{os.environ['PATH']}",
+                    FEATURE_CALLS=str(calls),
+                    FEATURE_FAILURES=json.dumps(failures),
+                    FEATURE_REAL_JUST=runner,
+                    FEATURE_NESTED=str(int(nested)),
+                    FEATURE_LEAKS=json.dumps(leaks),
+                    LOCAL_SUPERVISED="1",
+                    GITHUB_ACTIONS="false",
+                    BASH_ENV="/dev/null",
+                ),
+                capture_output=True,
+                text=True,
+            )
+            return result, [json.loads(line) for line in calls.read_text().splitlines()]
+
+    def test_independent_checks_run_after_multiple_failures(self):
+        passed, expected = self.run_features()
+        self.assertEqual(passed.returncode, 0, passed.stderr)
+        # Early, middle, and final failures must all survive subsequent successes.
+        for failures in ([expected[0], expected[len(expected) // 2]], [expected[-1]]):
+            with self.subTest(failures=failures):
+                failed, calls = self.run_features(failures)
+                self.assertNotEqual(failed.returncode, 0)
+                self.assertEqual(calls, expected)
+                summary = [line for line in failed.stderr.splitlines() if line.startswith("checks: failed: ")]
+                self.assertEqual(len(summary), len(failures))
+                for failure in failures:
+                    self.assertTrue(any(" ".join(failure) in line for line in summary))
+
+    def test_platform_tests_run_after_a_failure(self):
+        for recipe in ("macos-test", "windows-test"):
+            with self.subTest(recipe=recipe):
+                passed, expected = self.run_features(recipe=recipe)
+                self.assertEqual(passed.returncode, 0, passed.stderr)
+                failed, calls = self.run_features([expected[0]], recipe=recipe)
+                self.assertNotEqual(failed.returncode, 0)
+                self.assertEqual(calls, expected)
+                self.assertIn("checks: failed: " + " ".join(expected[0]), failed.stderr)
+
+    def test_nested_feature_checks_continue_after_compile_failures(self):
+        passed, expected = self.run_features(nested=True)
+        self.assertEqual(passed.returncode, 0, passed.stderr)
+        failures = []
+        for package in ("kio", "moq-net", "moq-quic", "moq-crypto", "moq-tokio", "moq-video"):
+            failures.append(
+                next(call for call in expected if call[0] == "cargo" and call[1] != "tree" and package in call)
+            )
+        failed, calls = self.run_features(failures, nested=True)
+        self.assertNotEqual(failed.returncode, 0)
+        self.assertEqual(calls, expected)
+        summary = "\n".join(line for line in failed.stderr.splitlines() if line.startswith("checks: failed: "))
+        for package in ("kio", "moq-net", "moq-quic", "moq-crypto", "moq-tokio", "moq-video"):
+            self.assertIn(package, summary)
+        self.assertIn("checks: just rs coroutines", failed.stdout)
+
+    def test_dependency_contract_failures_do_not_hide_checks(self):
+        passed, expected = self.run_features(nested=True)
+        self.assertEqual(passed.returncode, 0, passed.stderr)
+        failed, calls = self.run_features(nested=True, leaks=("cpal",))
+        self.assertNotEqual(failed.returncode, 0)
+        self.assertEqual(calls, expected)
+        self.assertIn("moq-video minimal unexpectedly contains cpal", failed.stderr)
+
+
 class NightlyTest(unittest.TestCase):
     def run_group(self, group, fail="", cwd=ROOT, **environment):
         with tempfile.TemporaryDirectory() as directory:
diff --git a/sh/rs/media-features.sh b/sh/rs/media-features.sh
index 6f27ab49c6c..7877588e999 100755
--- a/sh/rs/media-features.sh
+++ b/sh/rs/media-features.sh
@@ -13,12 +13,14 @@ elif [[ $# != 0 ]]; then
     exit 2
 fi
 
+# shellcheck source=sh/checks.sh
+source "$(dirname "${BASH_SOURCE[0]}")/../checks.sh"
+
 targets=(--tests)
 if ((all)); then targets=(--all-targets); fi
 
 check() {
-    echo "media features: cargo check $*"
-    cargo check --locked "${targets[@]}" "$@"
+    run cargo check --locked "${targets[@]}" "$@"
 }
 
 # Resolved for Linux, the platform every asserted dependency targets: moq-nvenc
@@ -32,7 +34,7 @@ require_crate() {
     local graph=$1 crate=$2 label=$3
     if ! grep -Eq "^${crate} v" <<<"$graph"; then
         echo "media features: $label must contain $crate" >&2
-        exit 1
+        failed+=("$label must contain $crate")
     fi
 }
 
@@ -40,7 +42,7 @@ forbid_crate() {
     local graph=$1 crate=$2 label=$3
     if grep -Eq "^${crate} v" <<<"$graph"; then
         echo "media features: $label unexpectedly contains $crate" >&2
-        exit 1
+        failed+=("$label unexpectedly contains $crate")
     fi
 }
 
@@ -52,7 +54,7 @@ minimal=$(tree -p moq-video --no-default-features)
 for crate in openh264 openh264-sys2 wgpu cpal; do
     forbid_crate "$minimal" "$crate" "moq-video minimal"
 done
-cargo nextest run --locked -p moq-video --no-default-features
+run cargo nextest run --locked -p moq-video --no-default-features
 
 if ((all)); then check -p moq-video --no-default-features --features openh264; fi
 software=$(tree -p moq-video --no-default-features --features openh264)
@@ -76,7 +78,7 @@ require_crate "$vpx" libvpx-native-sys "moq-video VP8/VP9"
 for crate in openh264 openh264-sys2 wgpu; do
     forbid_crate "$vpx" "$crate" "moq-video VP8/VP9"
 done
-cargo nextest run --locked -p moq-video --no-default-features --features vpx -E 'test(/::vpx::/)'
+run cargo nextest run --locked -p moq-video --no-default-features --features vpx -E 'test(/::vpx::/)'
 
 if ((all)); then check -p moq-video --no-default-features --features render; fi
 render=$(tree -p moq-video --no-default-features --features render)
@@ -111,4 +113,5 @@ if ((all)); then check -p moq-audio --no-default-features --features capture,pip
 audio_capture=$(tree -p moq-audio --no-default-features --features capture,pipewire)
 require_crate "$audio_capture" cpal "moq-audio PipeWire capture"
 
+finish
 echo "media features: dependency contracts ok"
diff --git a/sh/rs/net-features.sh b/sh/rs/net-features.sh
index a7aca80cead..cf0f7bc5737 100644
--- a/sh/rs/net-features.sh
+++ b/sh/rs/net-features.sh
@@ -28,6 +28,10 @@ if grep -qE 'moq-net feature "(async|default|fuzz)"' <<<"$features"; then
     exit 1
 fi
 
-cargo clippy --locked -p moq-net --no-default-features --lib -- -D warnings
-RUSTDOCFLAGS="-D warnings" cargo doc --locked -p moq-net --no-default-features --no-deps
-bash sh/rs/nextest.sh cargo nextest run --locked -p moq-net --no-default-features --tests
+# shellcheck source=sh/checks.sh
+source "$(dirname "${BASH_SOURCE[0]}")/../checks.sh"
+
+run cargo clippy --locked -p moq-net --no-default-features --lib -- -D warnings
+run env RUSTDOCFLAGS="-D warnings" cargo doc --locked -p moq-net --no-default-features --no-deps
+run bash sh/rs/nextest.sh cargo nextest run --locked -p moq-net --no-default-features --tests
+finish
diff --git a/sh/rs/tokio-features.sh b/sh/rs/tokio-features.sh
index 871779252fa..c4328fb151a 100755
--- a/sh/rs/tokio-features.sh
+++ b/sh/rs/tokio-features.sh
@@ -18,30 +18,36 @@ elif [[ $# != 0 ]]; then
 fi
 
 cd "$(git rev-parse --show-toplevel)"
+# shellcheck source=sh/checks.sh
+source "$(dirname "${BASH_SOURCE[0]}")/../checks.sh"
 
-cargo clippy --locked -p moq-tokio --no-default-features -- -D warnings
-cargo clippy --locked -p moq-tokio --all-features -- -D warnings
+run cargo clippy --locked -p moq-tokio --no-default-features -- -D warnings
+run cargo clippy --locked -p moq-tokio --all-features -- -D warnings
 
 # The QUIC driver is public API for applications without a MoQ session, so its
 # build must not reach moq-net, the MoQ backend's dependencies, or another QUIC stack.
 driver=(--no-default-features --features "driver")
 targets=(--tests)
 if ((all)); then targets=(--all-targets); fi
-cargo clippy --locked -p moq-tokio "${targets[@]}" "${driver[@]}" -- -D warnings
-graph=$(cargo tree --locked -p moq-tokio -e normal --prefix none "${driver[@]}")
-if leaked=$(grep -E '^(moq-net|reqwest|notify|quinn[a-z-]*|noq[a-z-]*|web-transport[a-z-]*) ' <<<"$graph"); then
-    echo "rs: moq-tokio's driver build must not depend on:" >&2
-    sort -u <<<"$leaked" >&2
-    exit 1
-fi
+run cargo clippy --locked -p moq-tokio "${targets[@]}" "${driver[@]}" -- -D warnings
+driver_dependencies() {
+    graph=$(cargo tree --locked -p moq-tokio -e normal --prefix none "${driver[@]}") || return
+    if leaked=$(grep -E '^(moq-net|reqwest|notify|quinn[a-z-]*|noq[a-z-]*|web-transport[a-z-]*) ' <<<"$graph"); then
+        echo "rs: moq-tokio's driver build must not depend on:" >&2
+        sort -u <<<"$leaked" >&2
+        return 1
+    fi
+}
+run driver_dependencies
 # Every isolated permutation, which `just rs features` asks for.
 if ((all)); then
     for feature in net quic tcp uds websocket webrtc; do
-        cargo clippy --locked -p moq-tokio --no-default-features --features "$feature" -- -D warnings
+        run cargo clippy --locked -p moq-tokio --no-default-features --features "$feature" -- -D warnings
     done
 fi
 
 # Crypto support alone must not make a transport-less server load a QUIC identity.
-bash sh/rs/nextest.sh cargo nextest run --locked -p moq-tokio --lib \
+run bash sh/rs/nextest.sh cargo nextest run --locked -p moq-tokio --lib \
     --no-default-features --features tcp \
     -E 'test(no_quic_backend_needs_no_served_identity)'
+finish

From 6883a898b3570a651daa443c602a39f4dea798ac Mon Sep 17 00:00:00 2001
From: Luke Curley <kixelated@gmail.com>
Date: Thu, 5 Nov 2026 22:38:11 +0000
Subject: [PATCH 27/36] quest: audit m0 and m1 (2026-11-05) (#7975)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: moq-bot <moq-bot@users.noreply.github.com>
---
 quest/m0/README.md                            | 18 +++--
 quest/m0/backport-fill-head-race.md           |  5 +-
 quest/m0/backport-release-hardening.md        |  4 -
 quest/m0/backport-security-fixes.md           | 24 ------
 quest/m0/ci/README.md                         |  1 -
 quest/m0/ci/five-minutes.md                   | 21 +++--
 quest/m0/ci/hakari-followups.md               | 45 +++++++----
 quest/m0/ci/hakari.md                         | 18 +++--
 quest/m0/ci/mbx-r2-verify.md                  | 42 +++++-----
 quest/m0/ci/publish-release-only.md           | 27 ++++---
 quest/m0/ffi-shutdown-backport.md             | 42 +++-------
 quest/m0/interop-green/README.md              | 13 ++-
 quest/m0/nightly/README.md                    |  3 +-
 quest/m0/nightly/miri.md                      | 28 ++++---
 quest/m0/nightly/obs-stop-drain.md            | 33 ++++++++
 quest/m0/nightly/resume-model.md              | 33 ++++++++
 quest/m0/nightly/shipping-size.md             | 79 -------------------
 quest/m0/test-flakes-2/README.md              | 10 ++-
 quest/m0/test-flakes-2/open-gop-fixture.md    | 20 -----
 quest/m0/test-flakes-2/p2p-data-channel.md    | 27 +++++++
 quest/m1/README.md                            | 24 +++---
 quest/m1/announce-takeover.md                 | 14 ++--
 quest/m1/api-audit/README.md                  |  5 +-
 .../m1/audio-jitter-target/native-stretch.md  | 16 ++--
 quest/m1/audio-jitter-target/watch.md         | 11 ++-
 quest/m1/bench-publish.md                     |  6 +-
 quest/m1/c/README.md                          | 16 ++--
 quest/m1/ci-housekeeping.md                   | 20 -----
 quest/m1/cluster-routing/federation.md        | 34 ++++----
 quest/m1/cluster-routing/routes/README.md     |  7 +-
 quest/m1/copy-recover.md                      | 15 ++--
 quest/m1/crates-trusted-publisher.md          |  5 ++
 quest/m1/group-drops.md                       | 13 ++-
 quest/m1/moq-e2ee-remove.md                   | 22 ++++++
 quest/m1/push-to-talk/README.md               |  4 -
 quest/m1/push-to-talk/native-comfort-noise.md |  7 +-
 quest/m1/read-backfill.md                     | 11 ++-
 quest/m1/release-rs-oidc.md                   |  1 +
 quest/m1/session-policy/README.md             |  6 +-
 quest/m1/session-policy/tokio-handoff.md      |  7 +-
 quest/m1/session-policy/uring.md              |  3 +-
 quest/m1/stream-credit/takeover.md            | 13 +--
 quest/m1/subscribe-ranges/README.md           | 14 ++--
 quest/m1/subscribe-ranges/js-fills.md         |  6 ++
 quest/m1/subscribe-ranges/lite07-fetch.md     |  9 +++
 .../m1/subscribe-ranges/start-bookkeeping.md  | 43 +++++-----
 quest/m1/time-addressing/consumers.md         |  6 +-
 quest/m1/time-addressing/js.md                | 12 ++-
 quest/m1/time-addressing/lite07.md            | 15 +++-
 quest/m1/time-addressing/model.md             |  3 +-
 quest/m1/unbounded-groups/README.md           | 44 ++++++-----
 quest/m1/unbounded-groups/byte-holes.md       | 19 ++++-
 quest/m1/unbounded-groups/js-byte-holes.md    | 19 +++--
 quest/m1/webrtc-rename.md                     |  2 +-
 quest/m2/README.md                            |  4 +-
 quest/m2/c/README.md                          |  4 +-
 quest/m2/c/consumers.md                       |  4 +-
 quest/m2/mbx-r2-release-cache.md              | 27 +++++++
 quest/m2/relay-io-uring-package.md            |  5 ++
 quest/{m0/ci => m2}/release-tag-publishers.md |  9 +++
 60 files changed, 565 insertions(+), 433 deletions(-)
 delete mode 100644 quest/m0/backport-security-fixes.md
 create mode 100644 quest/m0/nightly/obs-stop-drain.md
 create mode 100644 quest/m0/nightly/resume-model.md
 delete mode 100644 quest/m0/nightly/shipping-size.md
 delete mode 100644 quest/m0/test-flakes-2/open-gop-fixture.md
 create mode 100644 quest/m0/test-flakes-2/p2p-data-channel.md
 delete mode 100644 quest/m1/ci-housekeeping.md
 create mode 100644 quest/m1/moq-e2ee-remove.md
 create mode 100644 quest/m2/mbx-r2-release-cache.md
 rename quest/{m0/ci => m2}/release-tag-publishers.md (54%)

diff --git a/quest/m0/README.md b/quest/m0/README.md
index c5bdcb1feb9..ece91eafa74 100644
--- a/quest/m0/README.md
+++ b/quest/m0/README.md
@@ -2,11 +2,14 @@
 
 ## Goal
 
-The work in flight now: a passing Nightly, fixes for the `release` line, the
-quest merge driver, local reviews, CI cost and latency, test flakes, and
-replacing the catalog's HLS records with a declared segment grid. That last
-one is a breaking catalog and API change, pulled ahead of m1's other planned
-format changes; it lands on `main` and ships with the next cut.
+The work in flight now: passing Nightly, Interop, and Video runs, backports
+and patch releases for the `release` line, CI cost and latency, test flakes,
+and a few small fixes for hostile input, WebSocket throughput, agent disk use,
+and CRLF checkouts. The quest merge driver
+([moq-dev/moq#6728](https://github.com/moq-dev/moq/pull/6728)), local reviews
+([moq-dev/moq#7175](https://github.com/moq-dev/moq/pull/7175)), and the
+declared HLS segment grid
+([moq-dev/moq#7652](https://github.com/moq-dev/moq/pull/7652)) landed.
 
 ## Plan
 
@@ -25,11 +28,10 @@ edge, which embeds moq-relay; it moved there on 2026-09-28.
 
 - [Nightly passes on main](/quest/m0/nightly/README.md) - the scheduled Nightly passes end to end, so red means a new break
 - [Interop and Video pass on main](/quest/m0/interop-green/README.md) - the scheduled Interop and Video workflows pass, so red means a new break
-- [Publish the release line's drain() wrappers](/quest/m0/ffi-shutdown-backport.md) - Python `moq-rs` 0.5.2 and Dart `moq` 0.1.1 reach PyPI and pub.dev from `release`
+- [Publish the release line's drain() wrappers](/quest/m0/ffi-shutdown-backport.md) - Dart `moq` 0.1.1 reaches pub.dev from `release`
 - [Backport audio groupDuration](/quest/m0/backport-audio-group-duration.md) - `@moq/publish` 0.5.4 on `release` can pack several Opus frames per group, making Cloudflare's relay drop audio less often
-- [Backport the SETUP-path and iroh-key fixes](/quest/m0/backport-security-fixes.md) - `release` refuses a conflicting SETUP Path and keeps persisted iroh keys private, in one patch release
 - [Backport the joined-head FETCH race fix](/quest/m0/backport-fill-head-race.md) - a `release` relay stops FETCHing a group head its own SUBSCRIBE is bringing, which left live readers hanging
 - [CI cost and latency](/quest/m0/ci/README.md) - cloud CI runs only in GitHub's merge queue, one tested entry at a time, expensive checks run nightly and gate `release`, caches move to R2, and runners are chosen last
-- [More tests under load](/quest/m0/test-flakes-2/README.md) - load-only and queue failures, one quest per flake, fixed at the cause, since each one fails a whole batch
+- [More tests under load](/quest/m0/test-flakes-2/README.md) - load-only and queue failures, one quest per flake, fixed at the cause, since each one drops a queued PR
 - [Backport the relay and auth hardening to release](/quest/m0/backport-release-hardening.md) - `release`'s relay refuses dot-segment paths, serves its HTTP routes with main's response hardening, and withdraws advertisements a peer starves of send credit; its auth client refuses redirects
 - [Agent build output can't fill the desktop's disk](/quest/m0/agent-disk-budget.md) - finished agent checkouts reclaim their mbx targets automatically, so parallel agent builds stop filling the root disk
diff --git a/quest/m0/backport-fill-head-race.md b/quest/m0/backport-fill-head-race.md
index 09cd8bc0f09..3105257ede8 100644
--- a/quest/m0/backport-fill-head-race.md
+++ b/quest/m0/backport-fill-head-race.md
@@ -27,8 +27,9 @@ that arrives, and a remaining miss still FETCHes. Older history does not wait.
 
 Local review also exposed a pending miss no longer being polled during the
 PUBLISH_DONE grace. The backport adds that poll and a paused-time reproduction.
-[moq-dev/moq#7903](https://github.com/moq-dev/moq/pull/7903) lands the same
-correction on main first, following the main-first backport rule. Its other
+[moq-dev/moq#7903](https://github.com/moq-dev/moq/pull/7903) landed the same
+correction on main first (merged 2026-11-05), following the main-first
+backport rule. Its other
 change, driving a lingering copy's fetches while a resumed SUBSCRIBE is set up,
 has no `release` counterpart: release creates its fetch set after SUBSCRIBE_OK
 and never lingers.
diff --git a/quest/m0/backport-release-hardening.md b/quest/m0/backport-release-hardening.md
index 4e4bf984035..d3943f0277d 100644
--- a/quest/m0/backport-release-hardening.md
+++ b/quest/m0/backport-release-hardening.md
@@ -20,7 +20,3 @@ Added 2026-10-31 (user, /quest-plan of the follow-ups from the 2026-10-31 /quest
 - **Landed:** the dot-segment and auth-redirect items above merged into `release` on 2026-11-02 in [moq-dev/moq#7599](https://github.com/moq-dev/moq/pull/7599), which also settles the redirect follow-up that [moq-dev/moq#7298](https://github.com/moq-dev/moq/pull/7298) and [moq-dev/moq#7278](https://github.com/moq-dev/moq/pull/7278) suggested. What remains is the two ports above, then the patch release. [moq-dev/moq#7596](https://github.com/moq-dev/moq/pull/7596) (open) holds this quest's main-side checkpoint.
 
 Public API: none. Wire: none; as on main, a withdrawal resets a partially written request without waiting for peer credit.
-
-## Related
-
-- [Backport the SETUP-path and iroh-key fixes](/quest/m0/backport-security-fixes.md) - the earlier backport in the same patch release
diff --git a/quest/m0/backport-security-fixes.md b/quest/m0/backport-security-fixes.md
deleted file mode 100644
index c1503d18701..00000000000
--- a/quest/m0/backport-security-fixes.md
+++ /dev/null
@@ -1,24 +0,0 @@
-# [S] Backport the SETUP-path and iroh-key fixes to release
-
-## Goal
-
-`release` refuses a moq-transport SETUP Path on WebTransport and WebSocket
-bindings, as [moq-dev/moq#7206](https://github.com/moq-dev/moq/pull/7206)
-fixed on main, and writes persisted iroh endpoint keys with private file
-permissions, as [moq-dev/moq#7213](https://github.com/moq-dev/moq/pull/7213)
-did. Both ship in one patch release with the published API unchanged.
-
-## Plan
-
-Decided 2026-10-30 (maintainer, `/quest-plan`): one quest and one PR against
-`release` for both. They are small security fixes that ship in the same patch
-release, so pairing them is simpler than the usual one PR per backport.
-
-- SETUP path: `release`'s handshake also accepts a SETUP Path that names a
-  different path or query than the request URI, so Tokio could authorize the
-  wrong path. Port #7206's refusal onto `release`'s handshake, with its test.
-- iroh key: port #7213's private permissions for the persisted key file, with
-  its test.
-- Version bumps are hand-picked, per `CONTRIBUTING.md`.
-
-Public API: none. Wire: a conflicting SETUP Path is refused, as on main.
diff --git a/quest/m0/ci/README.md b/quest/m0/ci/README.md
index 6ae82407f3e..48da9fd104c 100644
--- a/quest/m0/ci/README.md
+++ b/quest/m0/ci/README.md
@@ -180,7 +180,6 @@ The historical samples locate candidates; they are not controlled benchmarks.
 - [Verify the Nix runtime cache](/quest/m0/ci/nix-cache-verify.md) - hosted Cache uploads `main`'s relay and CLI, and Smoke's nix channel substitutes them
 - [Record hosted cargo-hakari evidence](/quest/m0/ci/hakari.md) - compare scheduled macOS and Windows cache hits and estimated compiler work saved before and after the workspace-hack
 - [Drop main from the publish Environment](/quest/m0/ci/publish-release-only.md) - the maintainer narrows `publish` to `release` and release tags once no job naming it runs as `main`
-- [Binary release publishers run on their tag](/quest/m0/ci/release-tag-publishers.md) - brew, Go and Swift releases stop running through `workflow_run` on main
 - [Measure the Linux cache effect of native media exclusions](/quest/m0/ci/hakari-followups.md) - scheduled Linux jobs measure cache reuse after unrelated tests stop compiling PipeWire and libclang
 - [A release merge opens no stale release PR](/quest/m0/ci/release-pr-after-release.md) - `just rs release` publishes before it proposes, so a merged release isn't re-proposed
 - [Build two queue entries at once if it helps](/quest/m0/ci/queue-concurrency.md) - a measured trial of `maximumEntriesToBuild: 2` against the serial lane's burst latency
diff --git a/quest/m0/ci/five-minutes.md b/quest/m0/ci/five-minutes.md
index 721d52bedb1..ff4b3b9ca70 100644
--- a/quest/m0/ci/five-minutes.md
+++ b/quest/m0/ci/five-minutes.md
@@ -30,6 +30,16 @@ Decided 2026-10-29 (user): time queued in `quest gate` admission counts.
 kixelated/quest redesigns the gate so admission no longer outlasts a worker's
 cache; this quest owns the gated commands' own run time.
 
+Decided 2026-11-05 (maintainer, /quest-audit): ✅ drop the wait on
+moq-dev/quest's admission work. Its admission changes landed
+([moq-dev/quest#324](https://github.com/moq-dev/quest/pull/324),
+[moq-dev/quest#342](https://github.com/moq-dev/quest/pull/342)), and the
+5-minute-cache premise PR
+([moq-dev/quest#276](https://github.com/moq-dev/quest/pull/276)) closed
+unmerged. Re-measure the net route with landed admission, then finish or
+narrow this quest. Not chosen: wait on moq-dev/quest's m1 worker cache and
+move this to m1; delete this quest.
+
 Baseline, 2026-10-22 to 10-29: successful agent-run gates on the desktop, from
 Claude Code transcripts. Times include admission wait and load from concurrent
 agents, so this is an observation, not a controlled benchmark.
@@ -131,9 +141,9 @@ require a capable builder.
 
 What remains:
 
-- Admission still makes the measured net route exceed 5 minutes despite its
-  command taking 227 s. The 2026-10-29 admission decision above remains with
-  moq-dev/quest.
+- Re-measure the net route with landed admission: on 2026-11-02, admission
+  made it exceed 5 minutes despite its command taking 227 s. Then finish or
+  narrow this quest.
 - Repeat the default FFI route without the override; the Gradle fix
   ([moq-dev/moq#7632](https://github.com/moq-dev/moq/pull/7632)) merged
   2026-11-04.
@@ -146,11 +156,6 @@ What remains:
   Moving a check to the queue or nightly still needs evidence and an explicit
   coverage tradeoff. Split a large independent lever into its own quest.
 
-## Waiting
-
-- moq-dev/quest: admission must keep the whole gate inside the worker's cache
-  window; repeat the net measurement after its admission work lands.
-
 ## Related
 
 - [Unify dependency features](/quest/m0/ci/hakari.md) - cache hits across feature shapes
diff --git a/quest/m0/ci/hakari-followups.md b/quest/m0/ci/hakari-followups.md
index 8bfecc2801e..2cfaf7e58c7 100644
--- a/quest/m0/ci/hakari-followups.md
+++ b/quest/m0/ci/hakari-followups.md
@@ -9,13 +9,15 @@ settled.
 
 ## Plan
 
-The implementation in [moq-dev/moq#7713](https://github.com/moq-dev/moq/pull/7713)
-adds the derived trybuild-edge guard and excludes `pipewire`, `libspa`, and
-`clang-sys` from the workspace-hack's final output. Other transitive features
-remain unified. Linux x86_64 and ARM test graphs of `moq-json` no longer reach
-PipeWire or libclang. An x86_64 nextest run with shared compiler caching
-bypassed passes with native media pkg-config probes refused and an invalid
-libclang path. The original manifests fail under the same restriction.
+The implementation in
+[moq-dev/moq#7713](https://github.com/moq-dev/moq/pull/7713) (merged
+2026-11-05) adds the derived trybuild-edge guard and excludes `pipewire`,
+`libspa`, and `clang-sys` from the workspace-hack's final output. Other
+transitive features remain unified. Linux x86_64 and ARM test graphs of
+`moq-json` no longer reach PipeWire or libclang. An x86_64 nextest run with
+shared compiler caching bypassed passes with native media pkg-config probes
+refused and an invalid libclang path. The original manifests fail under the
+same restriction.
 
 Local Cargo 1.98.1 unit graphs for `moq-json`, `moq-video --features pipewire`,
 and `moq-audio --features pipewire`, each built with `--tests`, have 531 distinct
@@ -43,7 +45,7 @@ the merge with the first two after it. Failed or cancelled builds and missing su
 are incomplete evidence, not zero cache hits. Record source/build differences
 that prevent attributing a change to these exclusions.
 
-The 2026-11-02 scheduled run is a pre-merge candidate:
+The 2026-11-02 scheduled run was the first pre-merge candidate:
 [run 41483654426](https://github.com/moq-dev/moq/actions/runs/41483654426),
 [Rust benchmark tests](https://github.com/moq-dev/moq/actions/runs/41483654426/job/125408205554).
 Its 12 mbx object-cache summaries total 986 hits, 721 misses, 323 not
@@ -51,23 +53,32 @@ looked up, 8 bypassed, and 11 remote failures. The conditional hit rate is
 57.76% (`986 / (986 + 721)`); this excludes not-looked-up and bypassed units.
 The summaries report estimated compiler time avoided, not measured CPU totals.
 The 5 GiB download budget was exhausted during the first build; remote
-failures and mixed build phases limit attribution. Replace this
-candidate if a later scheduled run precedes this PR's merge.
+failures and mixed build phases limit attribution.
+
+Checked 2026-11-05 (/quest-audit): the last scheduled run before the merge,
+[run 41852517544](https://github.com/moq-dev/moq/actions/runs/41852517544)
+(2026-11-04), replaces that candidate as the baseline. Its
+[Rust benchmark tests](https://github.com/moq-dev/moq/actions/runs/41852517544/job/126652296572)
+job failed (test failures and a denied `moq-ffi` test warning) but printed
+its mbx summaries. The first post-merge run,
+[42050683248](https://github.com/moq-dev/moq/actions/runs/42050683248/job/127325640293),
+cancelled that job at the 60-minute timeout, so it is incomplete evidence.
 
 Public API: none. Wire: none.
 
 ## Waiting
 
-- moq-dev/moq: after the native-media exclusions merge, collect the last
-  scheduled Linux baseline and first two post-merge Nightlies' mbx hit rates
-  and available compiler-time fields. No post-merge evidence for these
-  exclusions exists yet. If the cache cost is material, present the measured tradeoff to the
-  maintainer; recommend keeping the narrow final exclusions unless the
-  measurements justify another design.
+- moq-dev/moq: collect the baseline run 41852517544's and the first two
+  complete post-merge Nightlies' mbx hit rates and available compiler-time
+  fields for `Nightly (Rust benchmark tests)`. No complete post-merge evidence
+  exists yet: the 2026-11-05 run cancelled the job at 60 minutes. If the cache
+  cost is material, present the measured tradeoff to the maintainer; recommend
+  keeping the narrow final exclusions unless the measurements justify another
+  design.
 
 ## Related
 
 - [Unify dependency features with cargo-hakari](/quest/m0/ci/hakari.md) - owns
   the separate macOS/Windows evidence and FFI invocation alignment in
   [moq-dev/moq#7666](https://github.com/moq-dev/moq/pull/7666); do not duplicate
-  those measurements or depend on its unmerged implementation
+  those measurements
diff --git a/quest/m0/ci/hakari.md b/quest/m0/ci/hakari.md
index 9ac40761ed3..8b9841a4873 100644
--- a/quest/m0/ci/hakari.md
+++ b/quest/m0/ci/hakari.md
@@ -18,8 +18,9 @@ trimming CI's feature permutations.
 dev-dependency layout, unifying test, lint, and bench builds. Keep that layout;
 library-only builds do not need the hack.
 
-The remaining FFI invocation alignment is implemented in
-[moq-dev/moq#7666](https://github.com/moq-dev/moq/pull/7666): default builds use
+The remaining FFI invocation alignment landed in
+[moq-dev/moq#7666](https://github.com/moq-dev/moq/pull/7666) (merged
+2026-11-05): default builds use
 `cargo build-ffi` with `openh264`, native builds omit `--target`, and only cross
 builds name a target. Python and Dart host tests retain `testing` for the manual
 clock and leak allocator, with separate target directories so they cannot
@@ -40,7 +41,7 @@ completed Windows, but cancelled macOS before any step ran. Windows therefore
 has two complete after-runs; macOS has only one. Logs expose object-cache counts
 and estimated compiler work saved, but no measured user/system CPU totals.
 Do not call elapsed time CPU time, or attribute these earlier runs to the FFI
-alignment that has not landed yet.
+alignment, which landed only on 2026-11-05.
 
 The 2026-11-04 maintainer decision accepts hosted CI as the strict Nix gate;
 a local namespace-probe skip is expected. The pkg-config and Gradle repairs
@@ -51,10 +52,13 @@ Public API and wire: none.
 ## Waiting
 
 - moq-dev/moq: inspect the next scheduled Nightly for a second complete macOS
-  after-run. As of 2026-11-04, the latest scheduled run is
-  [Nov 4](https://github.com/moq-dev/moq/actions/runs/41852517544); its
-  [macOS job](https://github.com/moq-dev/moq/actions/runs/41852517544/job/126656206251)
-  was cancelled with no steps. Run
+  after-run. The macOS job cannot give one until
+  [Nightly's macOS platform job passes](/quest/m0/nightly/macos.md) fixes
+  `moq-audio`'s macOS test build: the
+  [2026-11-05 macOS job](https://github.com/moq-dev/moq/actions/runs/42050683248/job/127326015410)
+  failed compiling it (E0277, `rs/moq-audio/src/capture.rs:859`), and the
+  [Nov 4](https://github.com/moq-dev/moq/actions/runs/41852517544/job/126656206251)
+  one was cancelled with no steps. Run
   `gh run list --repo moq-dev/moq --workflow nightly.yml --event schedule`,
   inspect the next macOS job and record its mbx summaries alongside Nov 3.
   This measurement wait outlives the implementation PR; never dispatch Nightly.
diff --git a/quest/m0/ci/mbx-r2-verify.md b/quest/m0/ci/mbx-r2-verify.md
index 1d5945d59fa..e81792c20a2 100644
--- a/quest/m0/ci/mbx-r2-verify.md
+++ b/quest/m0/ci/mbx-r2-verify.md
@@ -2,14 +2,10 @@
 
 ## Goal
 
-Confirm the cache earns its keep for the hosted jobs that still use R2
-(Nightly on `main`, release pull requests, and the macOS and Windows jobs),
-and record the numbers in the PR that closes this:
-
-- A release pull request's `Check the cache` step reports `effective
-  read-only`. Condition: `release` carries the Rust cache, which its
-  `platform.yml` still lacks on 2026-10-28; check with
-  `git show origin/release:.github/workflows/platform.yml | grep rust-cache`.
+Confirm the cache earns its keep for the hosted Nightly jobs on `main` that
+still use R2 (Linux, macOS and Windows), and record the numbers in the PR
+that closes this:
+
 - Nightly's Linux, macOS and Windows jobs hit what the previous Nightly
   wrote.
 - Restore plus build time against the 150-210s Actions restore of the ~6 GB
@@ -28,6 +24,12 @@ nightly.yml --branch main --event schedule`), never a dispatch on a branch.
 
 ## Plan
 
+Decided 2026-11-05 (maintainer, /quest-audit): ✅ the release pull request
+check moved to [m2](/quest/m2/mbx-r2-release-cache.md) behind the cut, since
+`release` gets the platform Rust cache only when the cut merges `main` into
+it; the Nightly checks stay here. Not chosen: moving this whole quest; merging
+`main` into `release` now, which reverses the 2026-11-04 decision.
+
 Decided 2026-10-22 (maintainer): narrowed to hosted jobs. Since
 [#6040](https://github.com/moq-dev/moq/pull/6040) the merge queue runs on the
 self-hosted `moq-queue` runner with mbx's local store, so it neither reads nor
@@ -70,9 +72,13 @@ compilation is "not looked up".
   where `main` has it. mbx v1.29.1 (2026-11-01) includes
   [#870](https://github.com/jdx/mr-boxington/pull/870), and
   `.github/actions/rust-cache/action.yml` pins 1.29.2 (2026-11-03) since
-  [#7653](https://github.com/moq-dev/moq/pull/7653). Verify it against the
-  Windows criterion in Waiting below. The fix also offers legacy CRLF
-  identities, so an in-window manifest from 1.28.0 remains usable.
+  [#7653](https://github.com/moq-dev/moq/pull/7653). The fix also offers
+  legacy CRLF identities, so an in-window manifest from 1.28.0 remains usable.
+  Verified 2026-11-05: the scheduled
+  [Windows job](https://github.com/moq-dev/moq/actions/runs/42050683248/job/127326015447)
+  of run 42050683248 set up mbx 1.29.2, and its workspace build, against a
+  manifest of 2,604 predictions, reported 846 hits, 224 misses, 168 not looked
+  up and 1,019 prefetched. Windows inheritance pays.
 - macOS: on 2026-10-28 the build did inherit, prefetching 732 predictions,
   yet hit only 13, with 1565 compilations not looked up. The install order is
   not the cause. Find out why the inherited predictions mostly miss, for
@@ -82,7 +88,8 @@ compilation is "not looked up".
   The doctest job hit 0 on 2026-10-24 and 2026-10-27, 115 on 2026-10-25, and
   46 on 2026-10-26. Decided 2026-10-29 (maintainer): give those jobs full
   history (`fetch-depth: 0` with `filter: blob:none`) only once Windows hits
-  after the mbx bump, which shows inheritance pays.
+  after the mbx bump, which shows inheritance pays. Windows hit on
+  2026-11-05 (above), so that condition is met.
 - `Cargo.lock` changed 7, 2, 6, 10, 8 and 8 times between consecutive
   scheduled Nightlies from 2026-10-21 to 2026-10-27. Nightly is the only
   hosted writer for Windows and macOS, so after more than 8 changes the
@@ -118,17 +125,6 @@ feature unification, so changed compiler inputs remain a separate cause.
 
 ## Waiting
 
-- GitHub Actions: a scheduled Windows job on mbx 1.29.1 or later must load
-  a workspace manifest of more than 124 predictions and hit, as its
-  workspace build's mbx summary reports. Check the first run with an
-  available manifest from an earlier scheduled Windows workspace build at the
-  same lockfile state or within 8 earlier states. A setup failure or no
-  in-window predecessor is inconclusive; inspect the next eligible scheduled
-  run. Until this proves inheritance pays, keep Linux's shallow checkout as
-  decided above. Do not dispatch Nightly.
-- moq-dev/moq: `release` still lacks the platform Rust cache as checked on
-  2026-11-04 with the command in the Goal. Once it carries the cache, inspect
-  a release pull request's `Check the cache` step for effective read-only.
 - GitHub Actions: scheduled runs must supply the remaining cross-platform
   reuse, restore-plus-build comparison and rebuild-frequency evidence in the
   Goal. Current timings are not a matched-commit comparison, and macOS's
diff --git a/quest/m0/ci/publish-release-only.md b/quest/m0/ci/publish-release-only.md
index ed1dabc46f8..250364fd4e2 100644
--- a/quest/m0/ci/publish-release-only.md
+++ b/quest/m0/ci/publish-release-only.md
@@ -28,15 +28,24 @@ merges `main` into it, and
 [Release tags substitute from nix.moq.dev](/quest/m2/release-nix-cache.md) deletes the Cachix
 cache and token once a release tag substitutes from `nix.moq.dev`.
 
-What remains is the maintainer's, in order:
-
-1. Merge `main` into `release` (a release cut or a backport). Tags run
-   `release`'s copies of the workflows, so until then a tag still chains its
-   winget and Kotlin wrapper publishers through `main`'s `workflow_run`, which
-   that PR removed: those two skip, and `release`'s apt and rpm dispatches
-   still run on `main`.
-2. Then drop `main` from `publish`'s deployment policy, and remove
-   `DISCORD_WEBHOOK` and `CACHIX_AUTH_TOKEN` from `publish`.
+Decided 2026-11-05 (maintainer, /quest-audit): `publish` still admits
+`main`, so this does not wait for the next cut.
+
+- ✅ Backport only #7431's workflow change to `release` now, as
+  [moq-dev/moq#7202](https://github.com/moq-dev/moq/pull/7202) and
+  [moq-dev/moq#7421](https://github.com/moq-dev/moq/pull/7421) backported
+  workflow changes, so a tag's run dispatches winget and calls the Kotlin
+  wrapper itself, and `release`'s apt and rpm dispatches name `--ref release`.
+- Not chosen: moving this quest to m2 behind the cut with the other
+  release-gated CI quests; merging `main` into `release` now, which reverses
+  the 2026-11-04 decision below.
+
+What remains, in order:
+
+1. Open the backport PR against `release` (agent work).
+2. Once it merges, the maintainer drops `main` from `publish`'s deployment
+   policy and removes `DISCORD_WEBHOOK` and `CACHIX_AUTH_TOKEN` from
+   `publish`. Environment settings need the maintainer's admin access.
 
 Decided 2026-11-04 (maintainer, /quest-unblock): ✅ cut the combined patch
 release on `release` soon, once [moq-dev/moq#7596](https://github.com/moq-dev/moq/pull/7596)'s
diff --git a/quest/m0/ffi-shutdown-backport.md b/quest/m0/ffi-shutdown-backport.md
index 100d5c10820..7acdbbeddb6 100644
--- a/quest/m0/ffi-shutdown-backport.md
+++ b/quest/m0/ffi-shutdown-backport.md
@@ -2,17 +2,14 @@
 
 ## Goal
 
-The `release` line's hand-written wrappers that gained `drain()` in
-[moq-dev/moq#6642](https://github.com/moq-dev/moq/pull/6642) are on their
-registries:
+The `release` line's hand-written Dart wrapper that gained `drain()` in
+[moq-dev/moq#6642](https://github.com/moq-dev/moq/pull/6642), Dart
+[`moq`](https://pub.dev/packages/moq) 0.1.1, is on pub.dev.
 
-- Python [`moq-rs`](https://pypi.org/project/moq-rs/) 0.5.2 on PyPI.
-- Dart [`moq`](https://pub.dev/packages/moq) 0.1.1 on pub.dev.
-
-Check: each registry lists the version. Both versions are already set on
-`release` (`py/moq-rs/pyproject.toml`, `dart/moq/pubspec.yaml`), so this needs
-a publish, not code. Each publish is outward-facing, so the maintainer runs it;
-agents do not push tags, dispatch workflows, or bump versions.
+Check: pub.dev lists the version. It is already set on `release`
+(`dart/moq/pubspec.yaml`), so this needs a tag push, not code. The publish
+is outward-facing, so the maintainer runs it; agents do not push tags,
+dispatch workflows, or bump versions.
 
 ## Plan
 
@@ -23,28 +20,11 @@ from `gh workflow run release-kt-lib.yml --ref release`
 ([run](https://github.com/moq-dev/moq/actions/runs/40904381781), after
 [moq-dev/moq#7026](https://github.com/moq-dev/moq/pull/7026)'s fix).
 
-Decided 2026-10-30 (maintainer): `moq-rs` 0.5.2 and Dart `moq` 0.1.1 ship in
-the next combined patch cut on `release`, which the maintainer cuts.
-
-Python: `workflow_run` runs `main`'s `release-py.yml` against the `release`
-checkout, which lacked `.github/actions/nix`. The maintainer picked the
-backport of that action to `release`, which landed in
-[moq-dev/moq#7421](https://github.com/moq-dev/moq/pull/7421). The
-`moq-ffi-v0.4.20` tag's chained run
-([failed](https://github.com/moq-dev/moq/actions/runs/41038297141)) came before
-that merge, and a re-run checks out the same tag commit, so it fails again.
-`release`'s `release-py.yml` has no `workflow_dispatch` until the maintainer's
-cut carries the manual retry trigger from `main`. What publishes 0.5.2 now:
-
-- The next `moq-ffi-v*` tag at a `release` commit with the nix action, which
-  chains Release Py FFI into Release Py.
-- A `release` push touching `py/moq-rs/**`, `.github/workflows/release-py.yml`,
-  or `sh/gh/release.sh`: the push gate publishes, since `release`'s moq-ffi
-  0.4.20 is tagged and on PyPI.
+Python [`moq-rs`](https://pypi.org/project/moq-rs/) 0.5.2 reached PyPI on
+2026-10-31.
 
-After that cut adopts the trigger, the maintainer can retry with
-`gh workflow run release-py.yml --ref release`; the same published-wrapper
-and published-FFI gates apply.
+Decided 2026-10-30 (maintainer): Dart `moq` 0.1.1 ships in the next combined
+patch cut on `release`, which the maintainer cuts.
 
 Dart: pub.dev publishes `moq` only from a `moq-dart-v*` tag, and only
 `moq-dart-v0.1.0` exists. Pushing `moq-dart-v0.1.1` at `release`'s head
diff --git a/quest/m0/interop-green/README.md b/quest/m0/interop-green/README.md
index 32a34d7b31b..f55a5bf7f22 100644
--- a/quest/m0/interop-green/README.md
+++ b/quest/m0/interop-green/README.md
@@ -4,7 +4,9 @@
 
 The scheduled Interop and Video workflows pass on `main`, so a red run
 means a new break. Interop has failed every scheduled run since
-2026-10-22, and Video fails on a stale expectation.
+2026-10-22. Video has passed every scheduled run since 2026-11-02 (for
+example [42063654592](https://github.com/moq-dev/moq/actions/runs/42063654592)),
+so it only needs to stay green.
 
 ## Waiting
 
@@ -58,14 +60,17 @@ showed more causes, fixed in this quest's own PR:
   0.14.11 has been released. Remeasured against moq-cli 0.14.12 and
   moq-relay 0.17.12 with `just test wire-compat --remeasure`.
 
-The P2P data-channel test timed out once, in 41668668824, and passes
-locally; triage it if it recurs.
+The P2P data-channel test timed out in 41668668824 and again in
+[42062226837](https://github.com/moq-dev/moq/actions/runs/42062226837)
+(2026-11-05); [its quest](/quest/m0/test-flakes-2/p2p-data-channel.md) under
+test flakes owns it.
 
 Scheduled run
 [41863118968](https://github.com/moq-dev/moq/actions/runs/41863118968)
 (2026-11-04, after every fix above landed) passed the open-GOP recovery
 case, P2P, and wire-compat. Its only failure was the fallback audio stall
 above, on `moq-lite-07-wip` in Chromium, which the IETF22 fallback quest
-owns.
+owns. Scheduled run 42062226837 (2026-11-05) failed only P2P and the same
+fallback audio stall in Chromium (`audioStalled:true`).
 
 Public API: none. Wire: none.
diff --git a/quest/m0/nightly/README.md b/quest/m0/nightly/README.md
index fb51ffd967b..2fd31b9f0dd 100644
--- a/quest/m0/nightly/README.md
+++ b/quest/m0/nightly/README.md
@@ -42,6 +42,7 @@ Public API: none. Wire: none.
 
 ## Required
 
-- [Nightly's shipping-size check passes](/quest/m0/nightly/shipping-size.md) - js/net, js/watch, and moq-relay growth over 5% is traced to its commits, then shrunk or accepted
 - [Nightly's Miri job stays inside its time budget](/quest/m0/nightly/miri.md) - both Miri passes go green, with ARM timings inside the 60-minute job and 15-minute-per-test budgets
 - [Nightly's macOS platform job passes](/quest/m0/nightly/macos.md) - `moq-audio`'s tests compile on macOS again and the websocket version test's timeout is fixed if it recurs
+- [The OBS stop-drain test reads no gap](/quest/m0/nightly/obs-stop-drain.md) - OBS and OBS TSan read every delivered frame and the track's end after `Stop()`, with no gap
+- [The JS resume model finds no missing groups](/quest/m0/nightly/resume-model.md) - the JS resume model property test hands every reader each group it is owed
diff --git a/quest/m0/nightly/miri.md b/quest/m0/nightly/miri.md
index b634711efee..8c727194114 100644
--- a/quest/m0/nightly/miri.md
+++ b/quest/m0/nightly/miri.md
@@ -40,18 +40,22 @@ for 97 tests, with `model::group::test::a_group_has_no_frame_cap` (10,000
 writes at about 30 ms each under Miri) past SLOW; #7895 ignores that test under
 Miri, since it still runs natively in the merge gate.
 
-Remaining: read the next scheduled run's log and record the job duration, both
-pass durations, the slowest test, and headroom against both budgets. If the job
-nears 60 minutes, split the strict and epoch passes into separate matrix
-entries rather than raising the timeout, and keep nextest's 15-minute per-test
-cap. A test past SLOW gets a smaller Miri workload.
+The first scheduled run after #7895 merged,
+[run 42050683248](https://github.com/moq-dev/moq/actions/runs/42050683248)
+on 2026-11-05, passed `Tests (rs miri)` with both passes:
 
-Public API: none. Wire: none.
+- Job 31 min 26 s, inside the 60-minute timeout.
+- Strict pass: 228 tests in 688 s. Slowest
+  `model::frame::tests::a_delivery_attaching_mid_write_publishes_one_payload`
+  192 s, then kio's `task::tests::concurrent_wakes_are_never_lost` 183 s.
+- Epoch pass: 97 tests in 832 s, one SLOW:
+  `model::group::test::debt_sheds_the_front_but_not_the_newest_frame` 335.8 s,
+  past the 300 s SLOW mark and inside the 900 s cap.
 
-## Waiting
+Remaining: shrink `debt_sheds_the_front_but_not_the_newest_frame`'s Miri
+workload so it finishes under SLOW, as #7895 did for the strict pass's
+slowest tests. If the job nears 60 minutes, split the strict and epoch passes
+into separate matrix entries rather than raising the timeout, and keep
+nextest's 15-minute per-test cap.
 
-- moq-dev/moq: After [moq-dev/moq#7895](https://github.com/moq-dev/moq/pull/7895)
-  lands, the next scheduled Nightly on `main` must pass `Tests (rs miri)` on
-  `ubuntu-24.04-arm` with both passes. Read its log
-  (`gh run view <run> --repo moq-dev/moq --log`) and record the timings above;
-  local runs do not clear this wait.
+Public API: none. Wire: none.
diff --git a/quest/m0/nightly/obs-stop-drain.md b/quest/m0/nightly/obs-stop-drain.md
new file mode 100644
index 00000000000..aa46b2af6c6
--- /dev/null
+++ b/quest/m0/nightly/obs-stop-drain.md
@@ -0,0 +1,33 @@
+# [S] The OBS stop-drain test reads no gap
+
+## Goal
+
+Nightly's `Nightly (OBS)` and `Nightly (OBS TSan)` jobs pass the
+`stop drains the session` case of `cpp/obs/test/moq-output-test.cpp`: after
+`Stop()`, a subscriber reads every frame the session delivered and then the
+track's end, with no gap. Find the root cause and fix it there, not by
+loosening the assertion.
+
+## Plan
+
+Added 2026-11-05 (maintainer, /quest-audit), from scheduled Nightly
+[run 42050683248](https://github.com/moq-dev/moq/actions/runs/42050683248).
+Both [OBS](https://github.com/moq-dev/moq/actions/runs/42050683248/job/127325639496)
+and [OBS TSan](https://github.com/moq-dev/moq/actions/runs/42050683248/job/127325639711)
+failed the same check:
+
+```text
+FAIL test/moq-output-test.cpp:909: !std::holds_alternative<moq::MediaRead::kGap>((*result)->get_variant())
+```
+
+The 2026-11-04 scheduled run
+([41852517544](https://github.com/moq-dev/moq/actions/runs/41852517544/job/126652295686))
+failed the same line; the 2026-11-03 run
+([41656613559](https://github.com/moq-dev/moq/actions/runs/41656613559))
+passed both jobs, so start with what landed on `main` between them. The test
+writes a 2 MiB keyframe just before `Stop()` and reads after the relay sees
+the session close, so a gap means the relay or the container consumer reports
+a group the session did not finish delivering, or the drain cut the large
+frame off.
+
+Public API: none expected. Wire: none expected.
diff --git a/quest/m0/nightly/resume-model.md b/quest/m0/nightly/resume-model.md
new file mode 100644
index 00000000000..ec1febe1986
--- /dev/null
+++ b/quest/m0/nightly/resume-model.md
@@ -0,0 +1,33 @@
+# [S] The JS resume model finds no missing groups
+
+## Goal
+
+Nightly's `Tests (test resume-model)` passes: the JS resume model property
+test (`js/net/src/resume.model.test.ts`) hands every reader each group its
+spec owes on every generated case. Find the root cause and fix it in
+`@moq/net`, or in the model if the model is wrong.
+
+## Plan
+
+Added 2026-11-05 (maintainer, /quest-audit), from scheduled Nightly
+[run 42050683248](https://github.com/moq-dev/moq/actions/runs/42050683248/job/127325640208).
+The Rust half (`model::resume_model::readers_match_the_logical_track`)
+passed; the JS half failed:
+
+```text
+error: Property failed after 2700 tests
+error: reader 0: missing groups 2,3,4,5,6,7,8,9,10; handed out 1,11,0, dropped , floor undefined, spec {"ordered":false,"budget":"hour","drops":false}
+```
+
+Replay it with `MOQ_RESUME_SEED=764723972 just test resume-model`. The shrunk
+counterexample: instance 1 brings up slots 1 and 2, reader 0 joins unordered
+with an hour budget, slot 1 writes group 11 and slot 2 group 1, slot 2 goes
+down, slot 1 ends, and reader 0 joins again.
+
+The two earlier scheduled runs failed this job with a different symptom,
+`the track ended cleanly though no route declared an end`
+([41852517544](https://github.com/moq-dev/moq/actions/runs/41852517544/job/126652296304),
+[41656613559](https://github.com/moq-dev/moq/actions/runs/41656613559/job/125988510774)).
+Check whether one cause explains both before closing this.
+
+Public API: none expected. Wire: none.
diff --git a/quest/m0/nightly/shipping-size.md b/quest/m0/nightly/shipping-size.md
deleted file mode 100644
index f828ce9d01c..00000000000
--- a/quest/m0/nightly/shipping-size.md
+++ /dev/null
@@ -1,79 +0,0 @@
-# [S] Nightly's shipping-size check passes
-
-## Goal
-
-Nightly's shipping-size check passes on `main`. Every growth over its 5%
-threshold is traced to the commits that caused it. Each is then shrunk back,
-or accepted as a new baseline with the reason recorded.
-
-## Plan
-
-Decided 2026-11-03 (maintainer, /quest-plan of the follow-ups from
-[moq-dev/moq#7667](https://github.com/moq-dev/moq/pull/7667)): milestone m0,
-a child of the Nightly epic.
-
-The [2026-11-03 shipping-size job](https://github.com/moq-dev/moq/actions/runs/41656613559/job/126039954216)
-failed nine daily comparisons between
-[dde50c699f](https://github.com/moq-dev/moq/commit/dde50c699f69507ced243754c2f700a6184d1576)
-and [801fd9a2f2](https://github.com/moq-dev/moq/commit/801fd9a2f2f5c88371fa833d805620d97d372465).
-[Investigation PR](https://github.com/moq-dev/moq/pull/7813) records every failing
-measurement and its attribution evidence:
-
-- Rebuilt both JS endpoints and all 18 intervening JS/lockfile commits. All 21
-  retained endpoint measurements reproduce exactly. Net raw grows 22,656 bytes;
-  watch raw grows 30,479. Subscription ranges contribute 17,090 and 17,111
-  respectively, and stats/feedback adds 6,787 watch bytes. The remaining deltas,
-  including every failing compression format, are attributed in the PR.
-- Bigint group IDs are excluded as a cause: their merge happened after the
-  failed Nightly commit.
-- All four downloaded relay archives and executable code sections grew. Native
-  x86_64 Linux symbol attribution identifies new rind and rind-rustls alongside
-  transport's retained AWS-LC. The PR separates local diagnostic builds from
-  the actual shipping archive sizes. Native per-commit attribution on macOS,
-  aarch64 Linux, and Windows MSVC remains unfinished; do not label the Linux
-  measurements as those targets' results.
-- The daily baseline already advances after a threshold failure. The failed
-  run retained its current point, and there was no thirty-day anchor yet.
-  `sh/size/README.md` documents acceptance using retained history, and tests
-  cover both daily advancement and the surviving thirty-day guard. A step over
-  10% can still fail until a post-jump point becomes the thirty-day anchor;
-  recording acceptance alone does not waive that check. Summaries now identify
-  the current and failing baseline commits.
-
-Decided 2026-11-04 (maintainer, on the investigation PR):
-
-- ✅ Accept the exactly attributed JS growth (`js/net` and `js/watch`,
-  +5.02–5.28%) as the cost of the retained features and correctness fixes.
-  The PR's per-commit table is the acceptance record; the retained November 3
-  point is the new daily baseline.
-- Require further JS reduction while retaining those behaviors.
-
-- ✅ Keep the 5% daily and 10% thirty-day guards unchanged.
-- Raise or exempt the guards for this step.
-
-Relay archive acceptance stays open until native per-commit attribution for
-macOS, aarch64 Linux, and Windows MSVC is supplied, or the maintainer
-explicitly accepts the evidence limit. Keep the retained history intact.
-[Size audit](/quest/m2/audit-size.md) owns the release-time view.
-
-Public API: none. Wire: none.
-
-## Waiting
-
-- moq-dev/moq: native per-commit relay archive attribution for macOS, aarch64
-  Linux, and Windows MSVC. Windows needs a matching build host; none of the
-  listed SSH hosts runs Windows. macOS needs the pinned Nix toolchain rather
-  than kixtop's ambient Rust. Supply before/after archive measurements for the
-  responsible commits rather than substituting Linux `cargo bloat` estimates,
-  then put relay acceptance to the maintainer.
-- moq-dev/moq: inspect the next scheduled Nightly shipping-size job on main,
-  its measured revision and retained baseline, for passing JS daily
-  comparisons and, when an anchor exists, thirty-day comparisons. If a
-  thirty-day comparison still fails, reduction or further acceptance work
-  remains, potentially until the post-jump point is thirty days old. No manual
-  Nightly dispatch; retain this quest until that evidence and the relay
-  attribution are settled.
-
-## Related
-
-- [Size audit](/quest/m2/audit-size.md) - pre-cut size investigation and the post-release refresh
diff --git a/quest/m0/test-flakes-2/README.md b/quest/m0/test-flakes-2/README.md
index 17ff84fa08a..9b68a967706 100644
--- a/quest/m0/test-flakes-2/README.md
+++ b/quest/m0/test-flakes-2/README.md
@@ -37,8 +37,9 @@ Added 2026-10-21 and 2026-10-22 (maintainer): failures from the m0/m1
 merge runs, one child each.
 
 Decided 2026-10-26 (maintainer): the epic moved from m1 to m0, since every
-flake now fails a whole batch of the [batched merge gate](https://github.com/moq-dev/moq/blob/17a81d6c64/quest/m0/ci/land.md)
-rather than one PR. The queue's recurring flakes from 2026-10-23 to 10-26
+flake drops a queued PR from the merge queue (it then failed a whole batch of
+the [batched merge gate](https://github.com/moq-dev/moq/blob/17a81d6c64/quest/m0/ci/land.md),
+dropped 2026-11-01). The queue's recurring flakes from 2026-10-23 to 10-26
 were already fixed (the moq-rtsp stall tests, the moq-gst pinned-instance and
 sibling-restart tests, the moq-mux missing-sequence test,
 `js/common/worklet.test.ts`, and the IETF datagram range test in
@@ -91,6 +92,9 @@ from 2026-11-03 and early 2026-11-04 UTC, one child each.
 Added 2026-11-04 (maintainer, `/quest-plan`): moq-gst's interleaved restart
 test, which failed two merge-queue batches and two loaded local runs.
 
+Added 2026-11-05 (maintainer, `/quest-audit`): Interop's P2P data-channel
+timeout, one child.
+
 Public API: none. Wire: none.
 
 ## Required
@@ -101,4 +105,4 @@ Public API: none. Wire: none.
 - [dispatch-query's terminate test survives load](/quest/m0/test-flakes-2/dispatch-query-terminate.md) - `test_terminating_the_run_stops_the_running_phase` passes reliably under host load, re-enabled once fixed
 - [Diagnose and re-enable the FFI datagram connection test](/quest/m0/test-flakes-2/ffi-datagram-roundtrip.md) - diagnose the default-connection timeout and re-enable the quarantined test
 - [Test PulseAudio servers stay off the desktop's D-Bus](/quest/m0/test-flakes-2/pulse-dbus.md) - concurrent media runs on one desktop never collide on `org.PulseAudio1`
-- [The open-GOP browser fixture fails loudly](/quest/m0/test-flakes-2/open-gop-fixture.md) - its broadcast stub matches current stats dependencies and an effect exception fails the test
+- [The P2P data-channel test transfers its frame](/quest/m0/test-flakes-2/p2p-data-channel.md) - Interop's two-peer data-channel test stops stalling after a failed send
diff --git a/quest/m0/test-flakes-2/open-gop-fixture.md b/quest/m0/test-flakes-2/open-gop-fixture.md
deleted file mode 100644
index 216b79ee669..00000000000
--- a/quest/m0/test-flakes-2/open-gop-fixture.md
+++ /dev/null
@@ -1,20 +0,0 @@
-# [XS] The open-GOP browser fixture fails loudly
-
-## Goal
-
-The open-GOP browser test (`test/interop/clients/js/open-gop.browser.ts`)
-exercises current `@moq/watch` code: its broadcast stub satisfies the stats
-dependencies the player now reads, and an exception inside the fixture's
-effect fails the test directly instead of being swallowed.
-
-## Plan
-
-Planned 2026-11-05 (maintainer, /quest-plan of the follow-ups from the
-2026-11-05 /quest-complete run), from
-[moq-dev/moq#7716](https://github.com/moq-dev/moq/pull/7716). Milestone: ✅ m0.
-
-The stub lives in `test/interop/clients/js/open-gop/main.ts`. Prefer building
-the stub from the real types so the next dependency change fails to compile
-rather than at runtime.
-
-Public API: none. Wire: none.
diff --git a/quest/m0/test-flakes-2/p2p-data-channel.md b/quest/m0/test-flakes-2/p2p-data-channel.md
new file mode 100644
index 00000000000..7993d1d4c1d
--- /dev/null
+++ b/quest/m0/test-flakes-2/p2p-data-channel.md
@@ -0,0 +1,27 @@
+# [S] The P2P data-channel test transfers its frame
+
+## Goal
+
+Interop's P2P test (`test/p2p/transport.browser.ts`, two browser peer
+connections completing MoQ SETUP and transferring a frame without a relay)
+passes in scheduled Interop runs. Find the root cause and fix it, never by
+raising the test's timeout or adding a retry.
+
+## Plan
+
+Added 2026-11-05 (maintainer, /quest-audit), from scheduled Interop
+[run 42062226837](https://github.com/moq-dev/moq/actions/runs/42062226837/job/127366882573).
+`window.checkTransport()` never returned, so the test timed out after
+60000 ms at `test/p2p/transport.browser.ts:46`. Chromium logged one data
+channel error just before:
+
+```text
+ERROR:third_party/blink/renderer/modules/peerconnection/rtc_data_channel.cc:867] Send failedINVALID_STATE
+```
+
+A send on a data channel that was not open (or already closing) failed, and
+the transfer then stalled instead of failing. It timed out once before, in
+[41668668824](https://github.com/moq-dev/moq/actions/runs/41668668824), and
+passed locally then.
+
+Public API: none expected. Wire: none.
diff --git a/quest/m1/README.md b/quest/m1/README.md
index 382b920ece0..b2a24e9ed28 100644
--- a/quest/m1/README.md
+++ b/quest/m1/README.md
@@ -101,8 +101,9 @@ crashes and amplification in media and RTMP parsing, lite announce bounds,
 JS track terminal causes, browser element teardown, and smaller Rust/JS
 divergences, under one epic; its redesign proposals went to m2.
 
-Changed 2026-10-26 (maintainer): pure-Rust crypto moved to m3 until upstream
-graviola and ACME releases make it cheap, so the cut ships on aws-lc-rs.
+Decided 2026-10-26 (maintainer): every MoQ crate takes its crypto from
+[rind](/quest/m1/rind/README.md), a pure-Rust graviola fork, so the cut ships
+no C crypto. This supersedes the same day's move of pure-Rust crypto to m3.
 Dropping the `rsa` crate from moq-auth's production graph stays in m1.
 
 Added 2026-10-25 (maintainer): the studio's
@@ -137,18 +138,26 @@ Added 2026-11-04 (maintainer): the relay reports the native sessions its
 drain deadline force-closes while still open, apart from those only finishing
 their end report, so an embedder's drain alert pages on real cuts.
 
+Decided 2026-11-05 (maintainer, /quest-audit): blockers rank above the
+quests that require them.
+
+- ✅ Move the blockers up: Drop set and Subscribe ranges rank just above
+  Address groups by timestamp, and the API audit just above Cluster routing.
+- Not chosen: moving the dependents down; leaving the order as it was.
+
 ## Required
 
+- [Drop set](/quest/m1/drop-set.md) - each cursor judges missing groups against its own budget, so a narrow reader drops promptly and a widening re-offers groups already reported dropped on lite-07
+- [Subscribe ranges](/quest/m1/subscribe-ranges/README.md) - a lite-07 SUBSCRIBE asks for past and live ranges with absolute or relative ends, in either order, and replaces FETCH for multi-group reads (single-group FETCH stays); merged ranges never starve a subscriber; relays fill misses by range, including over moq-transport
 - [Address groups by timestamp](/quest/m1/time-addressing/README.md) - group start timestamps replace sequence numbers in the moq-net API and lite-07 wire, while old subscribers, old publishers, and published JS clients keep working
 - [Pre-cut audit findings](/quest/m1/cut-audit/README.md) - fix the crashes, hostile-input costs, and correctness bugs the 2026-10-24 audit of main found
 - [Vendored code has every upstream fix it needs](/quest/m1/vendor-sync/README.md) - quinn, libv4l-rs, nvidia-video-codec-sdk, rust-media-libs, cros-codecs, and UniFFI generator fixes are ported or planned, once per release cycle
 - [Media fuzz findings](/quest/m1/fuzz-findings/README.md) - the nightly media fuzz targets run clean: mp4-atom, MKV block, TS step, SPS overflow, and catalog encoder bugs they found are fixed
+- [A smaller, safer API than release](/quest/m1/api-audit/README.md) - every surface added since release has a consumer or is gone, overlapping operations are collapsed, names mirror across Rust, JS, and the bindings, and every break says how to migrate
 - [Cluster routing](/quest/m1/cluster-routing/README.md) - prove shared routing contracts, implement per-origin routes, and connect outbound local clusters
 - [Routing guide](/quest/m1/routing-guide.md) - concepts and practical outbound federation setup
 - [moq-c at parity](/quest/m1/c/README.md) - the hand-written `moq-c` ships at the cut with every m1 binding feature moq-ffi gains
 - [A job's exact route continues its claim's readers](/quest/m1/announce-takeover.md) - a job's route inherits its claim's instance, replacing the ANNOUNCE_TAKEOVER predecessor design
-- [Subscribe ranges](/quest/m1/subscribe-ranges/README.md) - a lite-07 SUBSCRIBE asks for past and live ranges with absolute or relative ends, in either order, and replaces FETCH; merged ranges never starve a subscriber; relays fill misses by range, including over moq-transport
-- [Drop set](/quest/m1/drop-set.md) - each cursor judges missing groups against its own budget, so a narrow reader drops promptly and a widening re-offers groups already reported dropped on lite-07
 - [A reader on a failed copy continues on the held re-offer](/quest/m1/copy-recover.md) - a live reader keeps a group whose copy fails by continuing on the same track's re-offer at the same frame
 - [Group errors are cached by kind](/quest/m1/group-error-cache.md) - permanent group errors bind every reader, retryable ones are kept only for a bounded time, and a live SUBSCRIBE_DROP or FETCH answered `Old` no longer caches it for good
 - [A group a subscriber gives up on is always reported](/quest/m1/group-drops.md) - the wire names every abandoned group and the drop signal is public, so readers count losses instead of stalling
@@ -157,7 +166,6 @@ their end report, so an embedder's drain alert pages on real cuts.
 - [Stream credit by priority](/quest/m1/stream-credit/README.md) - every stream opens through one priority entry point, and a higher-priority group takes over or resets a lower one when credit runs out
 - [Finalize moq-lite-07](/quest/m1/lite07-finalize.md) - when the maintainer cuts it, lite-07 negotiates as `moq-lite-07` and the next release ships it
 - [Sockets](/quest/m1/socket/README.md) - a generic dial/accept `Socket` in moq-net, Rust, JS, and Python, with tracks as streams; moq-boy and CARLA move onto it
-- [A smaller, safer API than release](/quest/m1/api-audit/README.md) - every surface added since release has a consumer or is gone, overlapping operations are collapsed, names mirror across Rust, JS, and the bindings, and every break says how to migrate
 - [Audio jitter target](/quest/m1/audio-jitter-target/README.md) - the playout target is default in both languages; time-stretched browser playback without steady-state underruns and a native trace replay remain
 - [Container reads drop backfill](/quest/m1/read-backfill.md) - the JS container consumer drops groups below its read cursor like Rust
 - [Buffered playback subscribes in ascending order](/quest/m1/buffered-ascending.md) - a buffered `<moq-watch>` asks for the oldest group first, so a voice reply's opening arrives first, and audio's head hold shrinks to the floor
@@ -165,7 +173,7 @@ their end report, so an embedder's drain alert pages on real cuts.
 - [Push-to-talk's press-to-audible latency fits a budget on the defaults](/quest/m1/push-to-talk-latency.md) - press to audible on the browser defaults, excluding device output, stays under a kixtop-measured budget that `just test push-to-talk` enforces
 - [TS fidelity and recovery](/quest/m1/ts-reliability/README.md) - both modes have explicit profiles, automated validation, loss tests, and a dedicated guide
 - [WebGPU on Safari](/quest/m1/webgpu-safari.md) - the WebGPU renderer is verified on Safari 26 for macOS and iOS
-- [CI housekeeping](/quest/m1/ci-housekeeping.md) - remove the actionlint queue ignore once a release after 1.7.12 reaches the dev shell
+- [Remove the moq-e2ee stub](/quest/m1/moq-e2ee-remove.md) - `rs/moq-e2ee` leaves the workspace and release config now that its final release points to moq-crypto
 - [crates.io trusts the workflow](/quest/m1/crates-trusted-publisher.md) - maintainer action: every published crate gets a trusted publisher for `release-rs.yml`
 - [Rust releases publish through OIDC](/quest/m1/release-rs-oidc.md) - release-plz publishes with trusted publishing and `CARGO_REGISTRY_TOKEN` is revoked
 - [Main is no slower than release](/quest/m1/release-perf/README.md) - every benchmark where main is slower than release is fixed or accepted with a reason, checked by a final paired run before the cut
@@ -178,7 +186,3 @@ their end report, so an embedder's drain alert pages on real cuts.
 - [Rename moq-rtc to moq-webrtc](/quest/m1/webrtc-rename.md) - one published `moq-webrtc` crate holds the gateway, the ICE driver, and the data-channel transport
 - [Vendor and trim the WebRTC stack](/quest/m1/webrtc-vendor.md) - str0m, dimpl, `is`, and sctp-proto live in moq-webrtc with unused code removed, so moq-rtc can take rind
 - [MoQ on rind](/quest/m1/rind/README.md) - every MoQ crate takes its crypto from rind, a pure-Rust graviola fork, so no build compiles C crypto
-
-## Related
-
-- [A busy js/net serve yields](https://github.com/moq-dev/moq/pull/5289) - js/net's serve loop leaves the browser its event loop under a fast publisher, if it does not already
diff --git a/quest/m1/announce-takeover.md b/quest/m1/announce-takeover.md
index c97f34a3699..a99f7cbc114 100644
--- a/quest/m1/announce-takeover.md
+++ b/quest/m1/announce-takeover.md
@@ -121,25 +121,29 @@ Remove the cold-start warm-up reads (`claimed` in
 assert that the first subscription succeeds. Keep them for moq-transport.
 Run `just check`, `just test interop --all` and `just drafts check`.
 
-### Once identity replaces ANNOUNCE_TAKEOVER
+### Once the instance replaces ANNOUNCE_TAKEOVER
 
 Decided 2026-10-31 (maintainer, the /quest-complete requeue session). Kept
 separate from the identity rewrite of this Plan, which landed with
 [moq-dev/moq#7420](https://github.com/moq-dev/moq/pull/7420).
-"We're replacing EPOCH with IDENTITY soon" (maintainer, 2026-10-31).
+"We're replacing EPOCH with IDENTITY soon" (maintainer, 2026-10-31). The
+broadcast "identity" was renamed `instance` on 2026-11-01 (maintainer, in
+[the route API audit](/quest/m1/api-audit/route/README.md), landed in
+[moq-dev/moq#7489](https://github.com/moq-dev/moq/pull/7489)), so that
+IDENTITY is now the instance.
 
-- Reword "takeover" as an event or operation, in terms of identity
+- Reword "takeover" as an event or operation, in terms of instance
   continuity, in [moq-bench pins the instances it measures](/quest/m2/bench-epoch-pin.md)
   (Goal and Plan) and [the HLS server follows each path once](/quest/m2/hls-follow-once.md)
   (Goal and Tests).
 - Rewrite the EPOCH references in `drafts/draft-lcurley-moq-cluster.md` and
-  `drafts/draft-lcurley-moq-epoch.md` in terms of IDENTITY.
+  `drafts/draft-lcurley-moq-epoch.md` in terms of the instance.
 - Add a regression test where a publisher restart's new announcement
   arrives before the old one's reset, on `solicit = false` moq-transport
   sessions. [moq-dev/moq#7239](https://github.com/moq-dev/moq/pull/7239)
   found that the subscriber (`rs/moq-net/src/ietf/subscriber.rs`, `attach`)
   folds such a PUBLISH_NAMESPACE into the same epochless route as an update
-  instead of End then Start; per-announcement identities resolve it, and
+  instead of End then Start; per-announcement instances resolve it, and
   the test proves they do.
 
 Public API: breaking; removes `Takeover` and the predecessor fields in every
diff --git a/quest/m1/api-audit/README.md b/quest/m1/api-audit/README.md
index 4656fc70329..5bc24033622 100644
--- a/quest/m1/api-audit/README.md
+++ b/quest/m1/api-audit/README.md
@@ -53,9 +53,10 @@ audit skips them:
   InvalidRange, Remote, UnsupportedExtension}`, the `DecodeError` auth-token
   variants) and the session error codes the lite draft registers with
   moq-transport's meaning. Errors are fine; only dead ones go.
-- `setup::Extensions::{auth, solicit, epoch}` and the relay's
+- `setup::Extensions::{auth, solicit}` and the relay's
   `[listen|connect.extensions]` TOML, as interop knobs documented as
-  affecting moq-transport only.
+  affecting moq-transport only. `epoch` went with moq-transport's epochs in
+  [moq-dev/moq#7239](https://github.com/moq-dev/moq/pull/7239).
 
 Rejected in planning:
 
diff --git a/quest/m1/audio-jitter-target/native-stretch.md b/quest/m1/audio-jitter-target/native-stretch.md
index f14c509dc67..fc024d27efa 100644
--- a/quest/m1/audio-jitter-target/native-stretch.md
+++ b/quest/m1/audio-jitter-target/native-stretch.md
@@ -16,10 +16,12 @@ specifies it.
 ## Plan
 
 Decided 2026-11-03 (maintainer, on
-[moq-dev/moq#7679](https://github.com/moq-dev/moq/pull/7679)): copy NetEq in m1.
-The implementation now ports its received-audio accelerate and preemptive
-expand into the native playback callback. The estimator is unchanged.
-`doc/concept/audio-jitter.md` specifies the shared floating-point algorithm;
+[moq-dev/moq#7679](https://github.com/moq-dev/moq/pull/7679)): copy NetEq in
+m1. The implementation, merged 2026-11-04 in
+[moq-dev/moq#7856](https://github.com/moq-dev/moq/pull/7856), ports its
+received-audio accelerate and preemptive expand into the native playback
+callback. The estimator is unchanged. `doc/concept/audio-jitter.md` specifies
+the shared floating-point algorithm;
 `doc/concept/audio-jitter/stretch/corpus.json` supplies literal PCM vectors
 for both languages. The browser half remains
 [Watch](/quest/m1/audio-jitter-target/watch.md); neither implementation waits
@@ -92,9 +94,9 @@ until the seven-nightly calibration below.
   audible. Recommend this check before claiming the perceptual goal;
   automated amplitude tests cannot decide it.
   Run it in `~/work/moq` on `kixtop`, with its speakers or headphones as
-  the default output, at
-  [moq-dev/moq#7856](https://github.com/moq-dev/moq/pull/7856)'s head
-  (`gh pr checkout 7856 --detach`), or `main` once it lands. The source is
+  the default output, on `main`, where
+  [moq-dev/moq#7856](https://github.com/moq-dev/moq/pull/7856) landed. The
+  source is
   macOS's `say` voice reading `LICENSE-APACHE`, about ten minutes of
   continuous speech, so nothing is downloaded (an archive's speech file
   returned 403):
diff --git a/quest/m1/audio-jitter-target/watch.md b/quest/m1/audio-jitter-target/watch.md
index 939cde0ba6c..729e0e0a2e9 100644
--- a/quest/m1/audio-jitter-target/watch.md
+++ b/quest/m1/audio-jitter-target/watch.md
@@ -121,11 +121,16 @@ are expanding sooner or more often as the ring nears empty, or accepting the
 remaining re-stalls. Each departure from NetEq's constants is recorded with
 the replay numbers that justify it.
 
+- Port the shared specification rather than NetEq independently:
+  [moq-dev/moq#7856](https://github.com/moq-dev/moq/pull/7856) landed the
+  native stretch with `doc/concept/audio-jitter.md` specifying the shared
+  floating-point adaptation and `doc/concept/audio-jitter/stretch/corpus.json`
+  holding literal PCM vectors for both languages. Implement that spec and
+  pass those vectors, so both players stretch alike; record any departure
+  from it in the spec, not only here.
 - Put the stretch where `js/watch/src/audio/replay.ts` exercises it, such as
   `AudioRingBuffer`'s read path or a module the render worklet and the replay
-  share, so the replay rows measure the stretch and not a model of it. Port
-  the search with unit tests against NetEq's behaviour on synthetic periodic
-  and noise signals.
+  share, so the replay rows measure the stretch and not a model of it.
 - Accelerate replaces the skip-ahead when the ring sits above the high
   limit. A re-stall remains for a ring that empties despite the stretch, and a
   skip-ahead remains only above what fast accelerate can close.
diff --git a/quest/m1/bench-publish.md b/quest/m1/bench-publish.md
index abe57c3f32e..97026b1709d 100644
--- a/quest/m1/bench-publish.md
+++ b/quest/m1/bench-publish.md
@@ -32,8 +32,10 @@ Decided 2026-11-05 (maintainer, /quest-plan):
 Today the crate has three `[[bin]]`s (`rs/moq-bench/Cargo.toml`):
 `moq-bench` (`src/main.rs`), `moq-bench-host` (`src/host.rs`, Linux-only),
 and `moq-bench-uring-check` (`src/uring.rs`, 15 lines, behind the `uring`
-feature). Only `bench/run.sh` runs the probe, and nothing else uses the
-`uring` feature, so the feature goes with it. Put the probe wherever
+feature). `bench/run.sh` runs the probe, `bench/profile.test.py` stubs its
+binary, and `bench/metadata.py` names the `moq-bench/uring` feature in its
+runtime and profile descriptions; nothing else uses the feature, so it goes
+with the probe and those three callers follow. Put the probe wherever
 `bench/run.sh` can still build it with the least new surface; a
 `moq-uring` example is the likely fit. On a non-Linux host,
 `moq-bench host` errors the way the bin does today.
diff --git a/quest/m1/c/README.md b/quest/m1/c/README.md
index 1b6313edb19..bc87069b587 100644
--- a/quest/m1/c/README.md
+++ b/quest/m1/c/README.md
@@ -2,11 +2,11 @@
 
 ## Goal
 
-The hand-written `moq-c` crate (`rs/moq-c`, `moq.h`) ships at this cut as
-`moq-c` 0.7 with every binding feature moq-ffi gains in m1, so a C user can do
-whatever a Python, Swift, Kotlin, Go, Dart, or C++ user can. The C interop
-client and every `doc/lib/c` sample build and run against the built release
-archive before the cut.
+The hand-written `moq-c` crate (`rs/moq-c`, `moq.h`) ships at this cut at the
+shared 0.22 minor with every binding feature moq-ffi gains in m1, so a C user
+can do whatever a Python, Swift, Kotlin, Go, Dart, or C++ user can. The C
+interop client and every `doc/lib/c` sample build and run against the built
+release archive before the cut.
 
 ## Plan
 
@@ -14,7 +14,11 @@ Decided 2026-10-25 (maintainer): the hand-written crate ships at this cut and
 the [generated C line](/quest/m2/c/README.md) moves after it, waiting on the
 switch to rust2's UniFFI fork. The generated package (`c/moq`) builds in CI,
 but it publishes only after the cut. C users break
-twice (0.6 to 0.7, then to the generated 0.8); that is the accepted cost.
+twice (to 0.22 at this cut, then to the generated package at a later cut);
+that is the accepted cost. moq-c follows the shared minor like every
+published package (CONTRIBUTING.md's [Versions](/CONTRIBUTING.md#versions),
+[moq-dev/moq#7610](https://github.com/moq-dev/moq/pull/7610)), not a 0.7
+then 0.8 line of its own.
 
 - moq-c is not frozen: it takes the same breaks as moq-ffi and the other
   bindings. Every m1 quest or PR that changes the binding API changes
diff --git a/quest/m1/ci-housekeeping.md b/quest/m1/ci-housekeeping.md
deleted file mode 100644
index 28edcf9ab71..00000000000
--- a/quest/m1/ci-housekeeping.md
+++ /dev/null
@@ -1,20 +0,0 @@
-# [XS] Remove the actionlint queue-key workaround
-
-## Goal
-
-`.github/actionlint.yaml` drops its ignore for the `queue` key once an
-actionlint release after 1.7.12 is in the dev shell.
-
-## Plan
-
-[rhysd/actionlint#661](https://github.com/rhysd/actionlint/pull/661) is merged
-but unreleased. The dev shell still has actionlint 1.7.12.
-[moq-dev/moq#6180](https://github.com/moq-dev/moq/pull/6180) added the ignore
-for the three Pages publishing workflows; remove it when the release reaches
-nixpkgs and `just gh check` accepts `queue: max`.
-
-Public API: none. Wire: none.
-
-## Related
-
-- [CI workflow audit](/quest/m2/audit-ci.md) - the broader per-job review
diff --git a/quest/m1/cluster-routing/federation.md b/quest/m1/cluster-routing/federation.md
index 00742dcfb68..03ff65e0b22 100644
--- a/quest/m1/cluster-routing/federation.md
+++ b/quest/m1/cluster-routing/federation.md
@@ -17,22 +17,23 @@ connection protocol. Do not require an inbound connection to the local relay.
 Use authenticated, namespace-scoped admission: the CDN scopes the local
 relay's connection to a path prefix, and identities it sends, its own and its
 local publishers', are qualified, so a forger or a misconfigured uplink only
-affects its own scope (decided 2026-10-14; see
-[Routes and announces](/quest/m1/cluster-routing/routes/README.md)). Open: how
-those identities are keyed, owned by
-[Route session integration](/quest/m1/cluster-routing/routes/session.md). Without a key, a scoped forger
-declaring a victim's id captures claims outside its scope
-(`forged_identity_hijacks_claims_outside_the_forgers_scope`). The scope
-itself (`hash(scope, id)`) was rejected 2026-10-15, and the grant's
-issuer-qualified subject (`hash(subject, id)`) was dropped 2026-11-02
-(maintainer). The key must survive token refresh and be shared by the local
-relay's two uplinks. A scoped
-connection cannot forward an already qualified identity, so nested scoped
-federation is out: a relay behind the local relay connects unscoped. The local relay
-marks its CDN links `upstream`, so CDN relays never shortcut through the
-local network, and keeps its local `proxy` preference on toward the CDN. One
-route selection per identity; a cheaper exportable alternative hidden behind
-a preferred down-only route is accepted (decided 2026-10-14).
+affects its own scope (decided 2026-10-14; see [Routes and
+announces](/quest/m1/cluster-routing/routes/README.md)). Decided 2026-11-04
+(maintainer): those identities are keyed by the route key the peer proves,
+read from a key file the local relay's uplinks share ([Route session
+integration](/quest/m1/cluster-routing/routes/session.md), [Scoped peers prove
+a route key](/quest/m1/cluster-routing/routes/proof.md)). Without a key, a
+scoped forger declaring a victim's id captures claims outside its scope
+(`forged_identity_hijacks_claims_outside_the_forgers_scope`). The scope itself
+(`hash(scope, id)`) was rejected 2026-10-15, and the grant's issuer-qualified
+subject (`hash(subject, id)`) was dropped 2026-11-02 (maintainer). The key
+must survive token refresh and be shared by the local relay's two uplinks. A
+scoped connection cannot forward an already qualified identity, so nested
+scoped federation is out: a relay behind the local relay connects unscoped.
+The local relay marks its CDN links `upstream`, so CDN relays never shortcut
+through the local network, and keeps its local `proxy` preference on toward
+the CDN. One route selection per identity; a cheaper exportable alternative
+hidden behind a preferred down-only route is accepted (decided 2026-10-14).
 
 CDN content still flows into the local network and local content out: a local
 relay whose own uplink died reaches the CDN, in both directions, through a
@@ -67,5 +68,6 @@ Rust/JS parity. Run `just check`, `just test interop --all`, and `just drafts ch
 
 ## Related
 
+- [Scoped peers prove a route key](/quest/m1/cluster-routing/routes/proof.md) - the key this connection's identities are qualified under
 - [Route health](/quest/m2/route-health/README.md) - epoch-only detection of stalled delivery on still-open links
 - [Routing guide](/quest/m1/routing-guide.md) - runnable operator setup after integration
diff --git a/quest/m1/cluster-routing/routes/README.md b/quest/m1/cluster-routing/routes/README.md
index 57623772c93..72a12885f5e 100644
--- a/quest/m1/cluster-routing/routes/README.md
+++ b/quest/m1/cluster-routing/routes/README.md
@@ -157,8 +157,11 @@ the bullets below are the contract it carries.
   claim no longer decides transit trust. Legitimate scoped delivery survives
   losing one of two uplinks under one key
   (`scoped_delivery_through_two_uplinks_reaches_one_key`).
-- Open: how a scoped peer's routing identities are keyed, owned by
-  [session integration](/quest/m1/cluster-routing/routes/session.md). The router takes the key from the caller (`Scope::qualify`).
+- Decided 2026-11-04 (maintainer): a scoped peer's routing identities are
+  keyed by the route key the peer proves, from a shared key file
+  ([session integration](/quest/m1/cluster-routing/routes/session.md),
+  [Scoped peers prove a route key](/quest/m1/cluster-routing/routes/proof.md)).
+  The router takes the key from the caller (`Scope::qualify`).
 - Decided 2026-10-14: qualified keys carry a marker every relay recognizes,
   and a scoped connection forwarding an already qualified identity has that
   route refused, with no wire change. Otherwise a key sent down through a
diff --git a/quest/m1/copy-recover.md b/quest/m1/copy-recover.md
index 8d37bc202d8..a67c5c1079e 100644
--- a/quest/m1/copy-recover.md
+++ b/quest/m1/copy-recover.md
@@ -7,12 +7,6 @@ group: its `group::Consumer` continues on the successor copy the held
 re-offer carries in the same track, at the same frame, instead of surfacing
 the failure. Rust and `js/net` behave the same.
 
-## Waiting
-
-- moq-dev/moq: [moq-dev/moq#7670](https://github.com/moq-dev/moq/pull/7670)
-  merges. It adds the held re-offer (its decision 24) this builds on. Check
-  that it is merged into `main`.
-
 ## Plan
 
 Planned 2026-11-05 (maintainer, /quest-plan of the follow-ups from the
@@ -24,8 +18,13 @@ path. A successor that diverges from what the reader already consumed fails
 the reader, as a route switch does. Test on mock time: a reader mid-group on a
 copy that fails continues on the re-offer with no duplicate or missing frame.
 
+Decided 2026-11-05 (maintainer, /quest-audit): ✅ the wait on
+[moq-dev/moq#7670](https://github.com/moq-dev/moq/pull/7670), Drop set's own
+PR, becomes a `Required` link to [Drop set](/quest/m1/drop-set.md), since
+#7670 adds the held re-offer (its decision 24) this builds on.
+
 Public API: none expected. Wire: none.
 
-## Related
+## Required
 
-- [Drop set](/quest/m1/drop-set.md) - reworks the re-offer path this reads from
+- [Drop set](/quest/m1/drop-set.md) - adds the held re-offer this builds on
diff --git a/quest/m1/crates-trusted-publisher.md b/quest/m1/crates-trusted-publisher.md
index daea9e07345..7c5828c6168 100644
--- a/quest/m1/crates-trusted-publisher.md
+++ b/quest/m1/crates-trusted-publisher.md
@@ -43,3 +43,8 @@ publishing through OIDC.
 
 Done 2026-11-04 (maintainer, /quest-unblock): all 31 published crates have
 the trusted publisher. Only the 7 unpublished crates remain.
+
+Decided 2026-11-05 (maintainer, /quest-audit): moq-e2ee, published but
+retired in favor of moq-crypto, gets no trusted publisher;
+[Remove the moq-e2ee stub](/quest/m1/moq-e2ee-remove.md) takes it out of the
+workspace instead.
diff --git a/quest/m1/group-drops.md b/quest/m1/group-drops.md
index 3ae504de173..17e6c1fa04f 100644
--- a/quest/m1/group-drops.md
+++ b/quest/m1/group-drops.md
@@ -57,19 +57,24 @@ every run; the 256-stream cell sometimes does.
   surface needs one; name it in the PR or leave the mirror out.
 - **Order with the [drop set](/quest/m1/drop-set.md).** The drop set
   replaces `poll_drop`'s `Delivered` argument and the skipped record, and
-  edits the lite-07 SUBSCRIBE_DROP wording. Land the wire half whenever it's
-  ready, but publish the API after the drop set, against its final
-  disposition record, so the public shape doesn't change twice.
+  edits the lite-07 SUBSCRIBE_DROP wording. Publish the API against its
+  final disposition record, so the public shape doesn't change twice.
 - The drop set owns the per-cursor drop runs and their reasons. This quest
   reports what a cursor gives up; it doesn't change how a cursor judges a
   missing group.
 
+Decided 2026-11-05 (maintainer, /quest-audit): ✅ this waits for
+[Drop set](/quest/m1/drop-set.md), since both rewrite the lite-07
+SUBSCRIBE_DROP draft wording and the drop signal's `Delivered` argument.
+
 Public API: additive for a separate read; breaking if folded into `recv_group`
 (its `Result<Option<group::Consumer>>` return changes for every caller), with
 MIGRATE notes. `@moq/net` and the bindings mirror it only with a named consumer.
 Wire: possibly lite-07 (SUBSCRIBE_DROP for a stopped group), decided here.
 
-## Related
+## Required
 
 - [Drop set](/quest/m1/drop-set.md) - owns the per-cursor drop runs this reports
+
+## Related
 - [The receive-windows benchmark](/quest/m1/receive-windows-evicted.md) - its overcommitted cells wait on this (skipped by [moq-dev/moq#7838](https://github.com/moq-dev/moq/pull/7838) until it lands)
diff --git a/quest/m1/moq-e2ee-remove.md b/quest/m1/moq-e2ee-remove.md
new file mode 100644
index 00000000000..e56d075fdff
--- /dev/null
+++ b/quest/m1/moq-e2ee-remove.md
@@ -0,0 +1,22 @@
+# [XS] Remove the moq-e2ee stub
+
+## Goal
+
+`rs/moq-e2ee` leaves the workspace, along with any release or version config
+that names it, so release-plz stops tracking a crate whose final release is
+out. moq-e2ee 0.0.21, the final no-code release pointing users to moq-crypto,
+is on crates.io (published 2026-11-03).
+
+## Plan
+
+Decided 2026-11-05 (maintainer, /quest-audit): ✅ retire the stub before
+[Rust releases publish through OIDC](/quest/m1/release-rs-oidc.md), so the
+crate never needs a trusted publisher.
+
+- Delete `rs/moq-e2ee` (the workspace's `rs/*` glob picks it up) and its
+  `Cargo.lock` entry.
+- Search release-plz, `version.json`, workflows, and docs for `moq-e2ee` and
+  drop what names the crate. The `moq-e2ee-*` draft profiles and the
+  `draft-lcurley-moq-e2ee` drafts are the protocol, not the crate, and stay.
+
+Public API: none; the crate has no code. Wire: none.
diff --git a/quest/m1/push-to-talk/README.md b/quest/m1/push-to-talk/README.md
index d43d1d0088d..848f10e8500 100644
--- a/quest/m1/push-to-talk/README.md
+++ b/quest/m1/push-to-talk/README.md
@@ -97,10 +97,6 @@ catches this. A complete set of runs finishes this epic.
 
 - [Native playback fills declared silence with comfort noise](/quest/m1/push-to-talk/native-comfort-noise.md) - `moq play` plays comfort noise over declared silence and counts no underrun, matching the browser
 
-## Closes
-
-- [#7101](https://github.com/moq-dev/moq/issues/7101) - a disabled audio rendition is deselected, so the start of the next utterance is lost
-
 ## Related
 
 - [Container reads drop backfill](/quest/m1/read-backfill.md) - changes how the ordered read treats a group below its cursor, where this head was lost
diff --git a/quest/m1/push-to-talk/native-comfort-noise.md b/quest/m1/push-to-talk/native-comfort-noise.md
index 81fed0f73d2..24243bff0b8 100644
--- a/quest/m1/push-to-talk/native-comfort-noise.md
+++ b/quest/m1/push-to-talk/native-comfort-noise.md
@@ -23,8 +23,9 @@ browser through `doc/concept/audio-jitter.md` and a corpus case rather than
 two descriptions. Cover it in `test/audio-quality`'s native rows or
 `just test push-to-talk` if that can drive `moq play`.
 
-Coordinate with [moq play reaches zero steady-state underruns by
-time-stretching](/quest/m1/audio-jitter-target/native-stretch.md), which edits
-the same playback ring: whichever lands second rebases onto the other.
+Build on [moq play reaches zero steady-state underruns by
+time-stretching](/quest/m1/audio-jitter-target/native-stretch.md), whose
+stretch in the same playback ring is on `main` since
+[moq-dev/moq#7856](https://github.com/moq-dev/moq/pull/7856).
 
 Public API: none expected. Wire: none.
diff --git a/quest/m1/read-backfill.md b/quest/m1/read-backfill.md
index 34489990830..7a090cd1472 100644
--- a/quest/m1/read-backfill.md
+++ b/quest/m1/read-backfill.md
@@ -43,7 +43,7 @@ delivers a group that arrives below the cursor as a late backfill; Rust
 - The cursor is range-aware, not just floored: with disjoint ranges it skips
   straight across an unrequested gap (group 1, then 10 onward) instead of
   waiting for the latency budget, since no SUBSCRIBE_DROP is owed there.
-- Once both land: set the ordered read's floor from those bounds in Rust and
+- With both landed: set the ordered read's floor from those bounds in Rust and
   JS, then make JS discard groups below the cursor. Add a test mirroring
   Rust's: a reordered group below the floor is never yielded and no extra
   `Gap` appears, and the out-of-order head case keeps passing. Add a
@@ -54,8 +54,13 @@ delivers a group that arrives below the cursor as a late backfill; Rust
   API instead.
 
 Decided 2026-10-27 (maintainer): this waits only on the resolved start in
-SUBSCRIBE_OK, now landed, and JS ranges, not the whole
-[Subscribe ranges](/quest/m1/subscribe-ranges/README.md) epic.
+SUBSCRIBE_OK and JS ranges, not the whole
+[Subscribe ranges](/quest/m1/subscribe-ranges/README.md) epic. Both have
+landed: the resolved start, and JS ranges in
+[moq-dev/moq#7696](https://github.com/moq-dev/moq/pull/7696). A range that a
+SUBSCRIBE_UPDATE adds gets its start from SUBSCRIBE_STARTED
+([moq-dev/moq#7872](https://github.com/moq-dev/moq/pull/7872)), not
+SUBSCRIBE_OK, so carry those starts to the reader too.
 
 Public API: no type change; the ordered read changes in Rust and JS (the
 floor comes from reported bounds, and JS drops backfill). Wire: none.
diff --git a/quest/m1/release-rs-oidc.md b/quest/m1/release-rs-oidc.md
index 6bd7c82a94a..8992e5456a2 100644
--- a/quest/m1/release-rs-oidc.md
+++ b/quest/m1/release-rs-oidc.md
@@ -29,4 +29,5 @@ authentication Action is needed.
 
 ## Required
 
+- [Remove the moq-e2ee stub](/quest/m1/moq-e2ee-remove.md) - release-plz stops tracking a retired crate that has no trusted publisher
 - [crates.io trusts the workflow](/quest/m1/crates-trusted-publisher.md) - every published crate has the trusted publisher configured
diff --git a/quest/m1/session-policy/README.md b/quest/m1/session-policy/README.md
index 62ba3e31c82..3a8b93ac898 100644
--- a/quest/m1/session-policy/README.md
+++ b/quest/m1/session-policy/README.md
@@ -19,8 +19,10 @@ where moq-webrtc should plug its externally established transport in. The
 maintainer asked what that means for io_uring and how much of moq-tokio belongs
 in moq-net, and decided:
 
-- ✅ **Move the policy first**, then give moq-tokio thin handoffs; #7804 waits
-  on [moq-tokio becomes a thin shell](/quest/m1/session-policy/tokio-handoff.md).
+- ✅ **Move the policy first**, then give moq-tokio thin handoffs; the
+  [WebRTC rename](/quest/m1/webrtc-rename.md) waits on
+  [moq-tokio becomes a thin shell](/quest/m1/session-policy/tokio-handoff.md)
+  (#7804 closed unmerged).
   Not chosen: a moq-tokio handoff now with the move later; moq-webrtc calling
   moq-net directly with its own policy.
 - ✅ **Reconnect is in scope**: the reconnect, backoff and GOAWAY candidate
diff --git a/quest/m1/session-policy/tokio-handoff.md b/quest/m1/session-policy/tokio-handoff.md
index efcdec89f3d..493082e47c8 100644
--- a/quest/m1/session-policy/tokio-handoff.md
+++ b/quest/m1/session-policy/tokio-handoff.md
@@ -14,9 +14,10 @@ moq-webrtc without reaching into moq-tokio's internals.
 ## Plan
 
 Part of [Session policy lives in moq-net](/quest/m1/session-policy/README.md);
-see it for the decisions and research. This is what
-[moq-dev/moq#7804](https://github.com/moq-dev/moq/pull/7804) and the
-[WebRTC rename](/quest/m1/webrtc-rename.md) wait on: the maintainer decided on
+see it for the decisions and research. This is what the
+[WebRTC rename](/quest/m1/webrtc-rename.md) waits on
+([moq-dev/moq#7804](https://github.com/moq-dev/moq/pull/7804), which first
+asked, closed unmerged): the maintainer decided on
 2026-11-04 to move the policy first, so the handoff is a few lines over
 moq-net rather than a copy of the policy.
 
diff --git a/quest/m1/session-policy/uring.md b/quest/m1/session-policy/uring.md
index 352223d1e00..2963e8b48cc 100644
--- a/quest/m1/session-policy/uring.md
+++ b/quest/m1/session-policy/uring.md
@@ -25,7 +25,8 @@ see it for the decisions and research.
   runs on the worker handle, with admission hopping to the shared runtime
   through `Lifecycle::shared`, so one `Connection::run` serves every runtime.
   Use one listen-config mapping at all three sites.
-- Do this before the io_uring packaging work publishes the duplicated path.
+- Do this before [the io_uring packaging work](/quest/m2/relay-io-uring-package.md)
+  publishes the duplicated path.
 - The relay's existing drain, admission and handshake-deadline tests must
   pass on both runtimes.
 
diff --git a/quest/m1/stream-credit/takeover.md b/quest/m1/stream-credit/takeover.md
index df2d6be2e45..73a7014f20b 100644
--- a/quest/m1/stream-credit/takeover.md
+++ b/quest/m1/stream-credit/takeover.md
@@ -11,12 +11,6 @@ stopped when it is next served, under the duplicate rule of
 [moq-dev/moq#7670](https://github.com/moq-dev/moq/pull/7670). moq-transport
 and older lite versions keep reset only.
 
-## Waiting
-
-- moq-dev/moq: [moq-dev/moq#7670](https://github.com/moq-dev/moq/pull/7670)
-  merges. Resuming a reset group sends a second stream for the same group,
-  which #7670's hold-the-duplicate rule rewrites. Check that it is merged.
-
 ## Plan
 
 Decided 2026-11-05 (maintainer, /quest-plan): split from "A higher-priority group makes room". Takeover first,
@@ -30,9 +24,16 @@ Tests: a browser over WebTransport and a Rust relay, more live groups than
 the cap, the higher-priority group starting without waiting a round trip;
 a group that lost its stream resumes without loss.
 
+Decided 2026-11-05 (maintainer, /quest-audit): ✅ the wait on
+[moq-dev/moq#7670](https://github.com/moq-dev/moq/pull/7670), Drop set's own
+PR, becomes a `Required` link to [Drop set](/quest/m1/drop-set.md), since
+resuming a reset group sends a second stream for the same group, which #7670's
+hold-the-duplicate rule rewrites.
+
 Public API: none. Wire: lite-07 group stream takeover.
 
 ## Required
 
+- [Drop set](/quest/m1/drop-set.md) - its hold-the-duplicate rule governs a resumed group's second stream
 - [Open streams](/quest/m1/stream-credit/open-streams.md) - which open streams are fully acknowledged
 - [Reset fallback](/quest/m1/stream-credit/reset-fallback.md) - the fallback a takeover is tried before
diff --git a/quest/m1/subscribe-ranges/README.md b/quest/m1/subscribe-ranges/README.md
index b287c92ceeb..d2229b41ee0 100644
--- a/quest/m1/subscribe-ranges/README.md
+++ b/quest/m1/subscribe-ranges/README.md
@@ -36,8 +36,9 @@ relay bounds a sparse FETCH only if the model can request ranges:
   publisher delivers what it has and fills the rest as upstream answers.
 - **Model.** `Subscription` gains `ranges` beside its `order`, mirroring the wire;
   `request_groups` as a separate API was rejected. A publisher's
-  `track::Requests` receives a `track::Fill` per run of misses (landed), and
-  `fetch_group` becomes a one-range subscription or is removed. This breaks published moq-net APIs.
+  `track::Requests` receives a `track::Fill` per run of misses (landed).
+  Single-group FETCH stays (2026-11-03), so `fetch_group` stays too. This
+  breaks published moq-net APIs.
 - **moq-transport.** Some deployments use non-contiguous group numbers, so a
   relay never probes upstream one group at a time. Upstream, each run of
   locally missing groups becomes one standalone range FETCH, capped below the
@@ -48,9 +49,12 @@ relay bounds a sparse FETCH only if the model can request ranges:
   (maintainer, 2026-10-28,
   [moq-dev/moq#7204](https://github.com/moq-dev/moq/pull/7204)), until
   [hole markers](/quest/m2/ietf-hole-marker.md) let a cache that knows every
-  group answer a range. A FETCH of the open largest group reads it whole
-  (maintainer, 2026-10-25): the cache cannot know an open group's real
-  Largest Object.
+  group answer a range. A FETCH of the track's newest live group is refused
+  unless its range ends below that group's live edge
+  ([moq-dev/moq#7944](https://github.com/moq-dev/moq/pull/7944),
+  `poll_settle` in `rs/moq-net/src/ietf/publisher.rs`), replacing the
+  2026-10-25 rule that it reads the open group whole; an older group still
+  arriving is waited on until it finishes or its edge passes the range.
 - **Relative ends** (maintainer, 2026-10-11, superseding the 10-07 `Live`
   flag and closing #5085). Each range end is `Absolute(group)` or
   `Relative(n)`, naming the group n before the latest; either end may be
diff --git a/quest/m1/subscribe-ranges/js-fills.md b/quest/m1/subscribe-ranges/js-fills.md
index 13df15ec38d..130693fe2a4 100644
--- a/quest/m1/subscribe-ranges/js-fills.md
+++ b/quest/m1/subscribe-ranges/js-fills.md
@@ -67,6 +67,12 @@ half rewrites the same JS fill and miss code as
 which also redefine the stale-drop judgment it relies on. Not chosen:
 splitting the `Fill.time` lookup off to start now.
 
+Decided 2026-11-05 (maintainer, /quest-audit): ✅ this also waits for
+[Lite-07 FETCH is single-group only](/quest/m1/subscribe-ranges/lite07-fetch.md),
+which moves JS multi-group fills in the same `#runFills` onto the
+subscription.
+
 ## Required
 
 - [Drop set](/quest/m1/drop-set.md) - redefines the JS stale-drop judgment and fill code this rewrites
+- [Lite-07 FETCH is single-group only](/quest/m1/subscribe-ranges/lite07-fetch.md) - moves JS multi-group fills onto the subscription in the same `#runFills`
diff --git a/quest/m1/subscribe-ranges/lite07-fetch.md b/quest/m1/subscribe-ranges/lite07-fetch.md
index 75738354eb1..dda0805168b 100644
--- a/quest/m1/subscribe-ranges/lite07-fetch.md
+++ b/quest/m1/subscribe-ranges/lite07-fetch.md
@@ -50,5 +50,14 @@ on lite-07 (`track.Consumer.fetchGroup` in JS).
   Subscribe sections. Run `just drafts check`.
 - Run `just test interop --all`.
 
+Decided 2026-11-05 (maintainer, /quest-audit): ✅ this waits for
+[Drop set](/quest/m1/drop-set.md), since both rewrite the JS fill code
+(`js/net/src/lite/subscriber.ts` `#runFills`) and the same lite-07 draft
+sections.
+
 Public API: none expected. Wire: lite-07 (unpublished) SUBSCRIBE anchors lose
 their frame.
+
+## Required
+
+- [Drop set](/quest/m1/drop-set.md) - rewrites the JS fill code and lite-07 draft sections this changes
diff --git a/quest/m1/subscribe-ranges/start-bookkeeping.md b/quest/m1/subscribe-ranges/start-bookkeeping.md
index 6d154e6d3d8..65a8275c00e 100644
--- a/quest/m1/subscribe-ranges/start-bookkeeping.md
+++ b/quest/m1/subscribe-ranges/start-bookkeeping.md
@@ -3,19 +3,13 @@
 ## Goal
 
 Where a lite subscription starts lives in one place per version: lite
-`TrackRun`'s `start`, `first`, `start_frame`, the pre-06 re-pin branch, and
+`TrackRun`'s `start` and `first`, the pre-06 re-pin branch, and
 the per-version start branches collapse into one start state that only
 translates into SUBSCRIBE_START per version, and on lite-07 the
 `requested == start` gate is gone, since a fresh START per update makes it
 unnecessary. What a cursor is owed or was served is out of scope: it stays
 with [Drop set](/quest/m1/drop-set.md).
 
-## Waiting
-
-- moq-dev/moq: [moq-dev/moq#7670](https://github.com/moq-dev/moq/pull/7670)
-  merges. It rewrites the same lite publisher state (about 1,250 lines of
-  `lite/publisher.rs`). Check that it is merged into `main`.
-
 ## Plan
 
 Decided 2026-11-05 (maintainer, /quest-plan): narrow this quest to the start state and wait for #7670, as the
@@ -24,8 +18,13 @@ publisher state, Drop set already promises to delete the served-groups
 record (`skipped`, `served`, `Delivered`), and
 [moq-dev/moq#7872](https://github.com/moq-dev/moq/pull/7872)'s
 SUBSCRIBE_STARTED makes the lite-07 start gate removable. Not chosen:
-folding it into Drop set, or doing it now on main. The bullets below
-predate the narrowing; the owed-range ones are Drop set's.
+folding it into Drop set, or doing it now on main.
+
+Decided 2026-11-05 (maintainer, /quest-audit): ✅ the wait on
+[moq-dev/moq#7670](https://github.com/moq-dev/moq/pull/7670), Drop set's own
+PR, becomes a `Required` link to [Drop set](/quest/m1/drop-set.md), since
+#7670 rewrites the same lite publisher state (about 1,250 lines of
+`lite/publisher.rs`).
 
 
 Moved out of the [Subscribe ranges](/quest/m1/subscribe-ranges/README.md)
@@ -38,21 +37,19 @@ every child.
 Lite `TrackRun`'s fixes cluster on where a subscription starts and what it
 is owed or dropped (e713c30991, 36f82ac450, 35fa44f6bf, e1b5d2741f,
 f235fcfcbd, df0bd5c36f, 342445f251, 06765f4c1a, 4927167904, f52848d634,
-0513c07369, 5ad3652871). That state spans about eight fields (`floor`,
-`cap`, `start`, `first`, `skipped`, `served`, `start_frame`, `end_frame`),
-plus `cursor_floor` and a pre-06 re-pin branch, encoding three wire
-generations of "start".
-
-- On lite-07 every owed range is covered by delivered stream groups or a
-  DROP, since
-  [Datagram tracks](/quest/m1/datagram-tracks/README.md) takes datagrams out
-  of stream tracks (maintainer, 2026-11-01). The subscriber's end is "owed
-  range covered and no stream active", with no datagram grace. A stream
-  track's lite-05/06 subscription drops group datagrams, so a group an old
-  publisher sent only as one is a hole there. Keep `Settle`'s full grace for
-  lite-05/06 and moq-transport behind one version predicate.
+0513c07369, 5ad3652871). That state spans `TrackRun`'s `floor`, `cap`,
+`start`, `first`, `skipped`, and `served` (frame bounds moved to `Frames`;
+`start_frame` remains only on lite FETCH, `lite/fetch.rs`), plus
+`cursor_floor` and the pre-06 re-pin branch in `TrackRun::update`, encoding
+three wire generations of "start".
+
 - Lite-07 is unpublished, so sending a fresh START per update can remove the
-  `requested == start` gate (`lite/subscriber.rs`, about line 4898).
+  `active.start == active.requested` gate (`lite/subscriber.rs`,
+  `apply_response`).
 
 Public API: none expected. Wire: lite-07 (unpublished) may send a START per
 update; published versions are unchanged.
+
+## Required
+
+- [Drop set](/quest/m1/drop-set.md) - rewrites the same lite publisher state
diff --git a/quest/m1/time-addressing/consumers.md b/quest/m1/time-addressing/consumers.md
index 50ff812b750..71de05c780e 100644
--- a/quest/m1/time-addressing/consumers.md
+++ b/quest/m1/time-addressing/consumers.md
@@ -13,9 +13,9 @@ frame's pts.
 Decided 2026-10-25 (maintainer), from the spike:
 
 - GROUP_END replaces hang's empty-frame duration marker
-  (`rs/moq-mux/src/container/producer.rs:523`), so moq-mux stops writing
-  empty frames.
-- Discontinuity marker groups go away (`producer.rs:650`): a gap is a
+  (`rs/moq-mux/src/container/producer.rs`, `cut` and `close`), so moq-mux
+  stops writing empty frames.
+- Discontinuity marker groups go away (`producer.rs`, `discontinuity`): a gap is a
   previous end below the next start, and a missing group is a
   previous-start link that doesn't match.
 - Legacy egress synthesizes neither: old players lose end durations and
diff --git a/quest/m1/time-addressing/js.md b/quest/m1/time-addressing/js.md
index 645cf6f6b14..acc66b04a4e 100644
--- a/quest/m1/time-addressing/js.md
+++ b/quest/m1/time-addressing/js.md
@@ -17,12 +17,18 @@ so they are carried past 2^53 (decided 2026-11-03, maintainer).
 
 The spike found no sparse-ID breakage in direct `@moq/net` sessions over
 lite-06 and lite-07; its relay fills follow Rust's once JavaScript received
-copies fill, which JS ranges ([moq-dev/moq#7696](https://github.com/moq-dev/moq/pull/7696))
-left as a follow-up. Decided 2026-10-27
-(maintainer): this requires JS ranges, so the ranges it rekeys exist first.
+copies fill. JS ranges
+([moq-dev/moq#7696](https://github.com/moq-dev/moq/pull/7696)), which the
+2026-10-27 decision required first, merged.
+
+Decided 2026-11-05 (maintainer, /quest-audit): ✅ this waits for
+[Lite-07 FETCH is single-group only](/quest/m1/subscribe-ranges/lite07-fetch.md),
+which moves JS multi-group fills (`js/net/src/lite/subscriber.ts`
+`#runFills`) onto the subscription this rekeys.
 
 Public API: breaking, mirroring Rust's. Wire: as the lite-07 quest.
 
 ## Required
 
 - [Lite-07 by start](/quest/m1/time-addressing/lite07.md) - the wire this speaks
+- [Lite-07 FETCH is single-group only](/quest/m1/subscribe-ranges/lite07-fetch.md) - moves the JS fills this rekeys onto the subscription
diff --git a/quest/m1/time-addressing/lite07.md b/quest/m1/time-addressing/lite07.md
index f09800e6a4c..2451a045541 100644
--- a/quest/m1/time-addressing/lite07.md
+++ b/quest/m1/time-addressing/lite07.md
@@ -19,9 +19,10 @@ Decided 2026-10-25 (maintainer), from the spike:
   arrived, and a reset aborts. A relay closes an expired or partial group
   instead of resetting it, which changes the draft's reset rule for those
   groups (around line 760).
-- SUBSCRIBE and SUBSCRIBE_UPDATE bounds, SUBSCRIBE_OK and its largest,
-  SUBSCRIBE_END, and SUBSCRIBE_DROP address by start. Datagrams keep their own sequence (maintainer, 2026-11-01). Drops name
-  time spans with no group to deliver, not sequence ranges. `Relative(n)`
+- SUBSCRIBE and SUBSCRIBE_UPDATE bounds, SUBSCRIBE_OK's largest and its Range
+  Starts, SUBSCRIBE_STARTED, SUBSCRIBE_FINISH, and SUBSCRIBE_DROP address by
+  start. Datagrams keep their own sequence (maintainer, 2026-11-01). Drops
+  name time spans with no group to deliver, not sequence ranges. `Relative(n)`
   stays a group count.
 - Positions stay (start, frame index), preserving transport frame offsets.
 - SUBSCRIBE_UPDATE's `Wanted Group` (a sequence plus one) and SUBSCRIBE_OK's
@@ -47,10 +48,16 @@ Update `drafts/draft-lcurley-moq-lite.md` (fields, the group-end rules, and the
 lite-07 changelog) and `doc/concept/moq-lite.md`, and run `just drafts check`
 and `just test interop --all`.
 
+Decided 2026-11-05 (maintainer, /quest-audit): ✅ this waits for
+[Lite-07 FETCH is single-group only](/quest/m1/subscribe-ranges/lite07-fetch.md),
+which rewrites the same lite-07 draft sections (`Range`, Positions,
+SUBSCRIBE anchors).
+
 Public API: none beyond [the model](/quest/m1/time-addressing/model.md).
 Wire: lite-07-wip GROUP, GROUP_END, SUBSCRIBE, SUBSCRIBE_UPDATE,
-SUBSCRIBE_OK, SUBSCRIBE_END, and SUBSCRIBE_DROP change.
+SUBSCRIBE_OK, SUBSCRIBE_STARTED, SUBSCRIBE_FINISH, and SUBSCRIBE_DROP change.
 
 ## Required
 
 - [Rust groups by start](/quest/m1/time-addressing/model.md) - the model this wire carries
+- [Lite-07 FETCH is single-group only](/quest/m1/subscribe-ranges/lite07-fetch.md) - rewrites the same lite-07 draft sections first
diff --git a/quest/m1/time-addressing/model.md b/quest/m1/time-addressing/model.md
index 0987f1e420c..8db9afdfccc 100644
--- a/quest/m1/time-addressing/model.md
+++ b/quest/m1/time-addressing/model.md
@@ -54,7 +54,8 @@ a producer would need per-track memory of its last number.
 - **What it waits on** (decided 2026-10-27, maintainer; Fetch as a range
   finished in [moq-dev/moq#7625](https://github.com/moq-dev/moq/pull/7625)): only the
   subscribe-ranges children that put sequence ranges into the model and the
-  wire, Lite-07 ranges ([moq-dev/moq#7872](https://github.com/moq-dev/moq/pull/7872)) and
+  wire, Lite-07 ranges ([moq-dev/moq#7872](https://github.com/moq-dev/moq/pull/7872),
+  merged 2026-11-05) and
   [Delete the old start bookkeeping](/quest/m1/subscribe-ranges/start-bookkeeping.md),
   not the whole epic. [Drop set](/quest/m1/drop-set.md) lands first too: its
   runs keyed by group sequence convert mechanically to starts.
diff --git a/quest/m1/unbounded-groups/README.md b/quest/m1/unbounded-groups/README.md
index f8bef59a954..20cc1c0d66f 100644
--- a/quest/m1/unbounded-groups/README.md
+++ b/quest/m1/unbounded-groups/README.md
@@ -2,18 +2,19 @@
 
 ## Goal
 
-Groups and frames have no fixed size cap. `MAX_GROUP_FRAMES` (8192) goes
-away, and `MAX_CACHE_BYTES` (32 MB) stops capping groups and frames and
-instead bounds how much of a group's live tail is held. A group sheds whole
-frames from its front once its tail passes 32 MB, or sooner when the shared
-cache pool is over budget, so one long group never grows without bound even
-on a relay with no cache capacity set. A reader or FETCH that reaches a shed
-front is served by a flight, a separate paced copy filled from upstream or
-the publisher's own refill handler; failing that, it asks for a new group
-(refresh), and otherwise it gets `Evicted`. Readers never fail just because a group got big. The motivating
-workloads are long-lived single groups (data/log tracks, audio, window
-timelines), video with very long GOPs, and file transfers where a frame is a
-whole file.
+Groups and frames have no fixed size cap. `MAX_GROUP_FRAMES` is already gone
+([moq-dev/moq#6993](https://github.com/moq-dev/moq/pull/6993)), and
+`MAX_CACHE_BYTES` (32 MB) stops capping groups and frames and instead bounds
+how much of a group's live tail is held. A group sheds whole frames from its
+front once its tail passes 32 MB, or sooner when the shared cache pool is over
+budget, so one long group never grows without bound even on a relay with no
+cache capacity set. A reader or FETCH that reaches a shed front is served by a
+flight, a separate paced copy filled from upstream or the publisher's own
+refill handler; failing that, it asks for a new group (refresh), and otherwise
+it gets `Evicted`. Readers never fail just because a group got big. The
+motivating workloads are long-lived single groups (data/log tracks, audio,
+window timelines), video with very long GOPs, and file transfers where a frame
+is a whole file.
 
 The hot write and read path for ordinary groups does not regress.
 
@@ -164,15 +165,16 @@ A flight's fill is the `track::Requests` fill (`track::Fill`). A handler serves
 group producer bounded to that range, the same API as a live write, so an
 origin can regenerate data from disk or an archive.
 
-This epic owns the end-to-end test: a relay chain carries one live group well
-past the old caps. A late joiner gets its head through a flight and hands
-over to the live copy, and a live reader keeps the tail, over lite, with
-memory held near 32 MB per copy; over moq-transport, the live group's replay
-is refused and a finished group's replays
-([moq-dev/moq#7944](https://github.com/moq-dev/moq/pull/7944)). It also carries a long
-compressed group through a small cache pool with a plain reader on a legacy
-wire, which [moq-dev/moq#6993](https://github.com/moq-dev/moq/pull/6993)
-covered only at the model layer (maintainer, 2026-10-30).
+Most of the end-to-end test landed in
+[moq-dev/moq#7944](https://github.com/moq-dev/moq/pull/7944)
+(`rs/moq-net/tests/integration/flights.rs`): a relay chain carries one live
+group past its 32 MiB tail, a late joiner replays it through a flight and
+hands over to the live copy over lite, and over moq-transport the live
+group's replay is refused and a finished group's replays. This epic still
+owns the rest: a long compressed group through a small cache pool with a
+plain reader on a legacy wire, which
+[moq-dev/moq#6993](https://github.com/moq-dev/moq/pull/6993) covered only at
+the model layer (maintainer, 2026-10-30).
 
 ## Required
 
diff --git a/quest/m1/unbounded-groups/byte-holes.md b/quest/m1/unbounded-groups/byte-holes.md
index 9a1c2e888e2..a428aaff5ba 100644
--- a/quest/m1/unbounded-groups/byte-holes.md
+++ b/quest/m1/unbounded-groups/byte-holes.md
@@ -20,6 +20,14 @@ and lite-07 peers start flights only at frame boundaries, like older lite
 versions. Decided 2026-10-28 (maintainer): shed frames are served again only
 by flights, so this waits on Flights and stays in m1.
 
+Decided 2026-11-05 (maintainer, /quest-audit): ✅ the byte offset rides
+FETCH's frame start plus the group header, not a SUBSCRIBE range end.
+SUBSCRIBE ranges are whole groups since 2026-11-03
+([Lite-07 FETCH is single-group only](/quest/m1/subscribe-ranges/lite07-fetch.md),
+[moq-dev/moq#7675](https://github.com/moq-dev/moq/pull/7675)), and flights
+ride lite FETCH since [moq-dev/moq#7944](https://github.com/moq-dev/moq/pull/7944).
+This waits for that quest.
+
 - Segments are `frame::SEGMENT` (1 MiB) long, so segment `i` always holds
   bytes from `i * SEGMENT`, and a completed chain is `frame::Payload::Chain`.
   Only a frame past one segment written in pieces chains. One written whole
@@ -28,8 +36,8 @@ by flights, so this waits on Flights and stays in m1.
   segment slices, whose memory frees only once every slice drops, or copied
   into segments.
 
-- `Position` gains a byte offset within the frame. A lite range end can
-  carry it, and so can a group stream header, beside `frame_start`. A
+- `Position` gains a byte offset within the frame. A lite FETCH carries it
+  beside its `frame_start`, and so does a group stream header. A
   stream that starts mid-frame still states the frame's full size. Older
   lite versions and moq-transport start flights only at frame or object
   boundaries. A reader inside a shed object refreshes or is `Evicted` there.
@@ -58,4 +66,9 @@ by flights, so this waits on Flights and stays in m1.
 
 Public API: `Position` gains a byte field, frames gain a chunked read, and
 `MAX_CACHE_BYTES` stops capping a frame.
-Wire: a byte offset on the current lite wip's range ends and group header.
+Wire: a byte offset on the current lite wip's FETCH frame start and group
+header.
+
+## Required
+
+- [Lite-07 FETCH is single-group only](/quest/m1/subscribe-ranges/lite07-fetch.md) - SUBSCRIBE ranges become whole groups, so the offset goes on FETCH
diff --git a/quest/m1/unbounded-groups/js-byte-holes.md b/quest/m1/unbounded-groups/js-byte-holes.md
index a51cbaca1d4..3c7742d899f 100644
--- a/quest/m1/unbounded-groups/js-byte-holes.md
+++ b/quest/m1/unbounded-groups/js-byte-holes.md
@@ -2,9 +2,9 @@
 
 ## Goal
 
-`@moq/net` speaks the lite wip byte offset on range ends and group headers
-as Rust does, so a JS reader cut off inside a large frame continues it from
-the byte it reached instead of failing.
+`@moq/net` speaks the lite wip byte offset on FETCH's frame start and group
+headers as Rust does, so a JS reader cut off inside a large frame continues it
+from the byte it reached instead of failing.
 
 ## Plan
 
@@ -20,8 +20,8 @@ has `Group.Producer.createFrame` and `Group.Consumer.nextFrame` with
 32 MiB tail, and streams payloads past one segment on lite and
 moq-transport. What is left here is the wire:
 
-- Mirror the byte offset on the same lite wip version as Rust, on range
-  ends and the group stream header, and refill a hole inside a frame the way
+- Mirror the byte offset on the same lite wip version as Rust, on FETCH's
+  frame start and the group stream header, and refill a hole inside a frame the way
   Rust does.
 - A consumer that took a frame to stream and loses its copy partway
   through fails today, since resuming at the next frame would drop the rest
@@ -34,9 +34,18 @@ moq-transport. What is left here is the wire:
 - If [JS-only @moq/net from Rust](/quest/m2/rs2ts-js.md) is adopted first,
   this shrinks to exposing its byte-offset recovery.
 
+Decided 2026-11-05 (maintainer, /quest-audit): ✅ the byte offset rides
+FETCH's frame start plus the group header, not a SUBSCRIBE range end.
+SUBSCRIBE ranges are whole groups since 2026-11-03
+([Lite-07 FETCH is single-group only](/quest/m1/subscribe-ranges/lite07-fetch.md),
+[moq-dev/moq#7675](https://github.com/moq-dev/moq/pull/7675)), and flights
+ride lite FETCH since [moq-dev/moq#7944](https://github.com/moq-dev/moq/pull/7944).
+This waits for that quest.
+
 Public API: none beyond the recovery. Wire: the lite wip byte offset, as
 Byte holes defines it.
 
 ## Required
 
 - [Byte holes](/quest/m1/unbounded-groups/byte-holes.md) - the Rust contract and the lite wire this mirrors
+- [Lite-07 FETCH is single-group only](/quest/m1/subscribe-ranges/lite07-fetch.md) - SUBSCRIBE ranges become whole groups, so the offset goes on FETCH
diff --git a/quest/m1/webrtc-rename.md b/quest/m1/webrtc-rename.md
index 88adb4b524f..a129f356c80 100644
--- a/quest/m1/webrtc-rename.md
+++ b/quest/m1/webrtc-rename.md
@@ -24,4 +24,4 @@ Public API: breaking (crate rename; `moq_tokio::webrtc` moves). Wire: none.
 
 ## Related
 
-- [moq-rtc REMB and TIAS](/rs/moq-rtc/src/server/whip.rs) - #7373 adds the capped answer in moq-rtc; carry it through the move
+- [moq-rtc REMB and TIAS](/rs/moq-rtc/src/server/whip.rs) - #7373 added the capped answer in moq-rtc; carry it through the move
diff --git a/quest/m2/README.md b/quest/m2/README.md
index 2881ca995a9..a66a330cb67 100644
--- a/quest/m2/README.md
+++ b/quest/m2/README.md
@@ -36,6 +36,8 @@ lite-07; bitrate enforcement is not part of this release.
 - [An audio track's final flush joins its open group](/quest/m2/audio-flush-group.md) - a zero-`delay.max` subscriber gets the tail, not `Old`
 - [Release execution](/quest/m2/release/README.md) - publication, installed-artifact proof, cleanup, and downstream adoption after m1
 - [Release tags substitute from nix.moq.dev](/quest/m2/release-nix-cache.md) - the first tag after the cut substitutes on a clean machine, bucket sizes hold, and Cachix is retired
+- [Release pull requests read the R2 Rust cache](/quest/m2/mbx-r2-release-cache.md) - a release PR's `Check the cache` step reports effective read-only once the cut brings the cache to `release`
+- [Binary release publishers run on their tag](/quest/m2/release-tag-publishers.md) - brew, Go and Swift releases stop running through `workflow_run` on main, once the cut brings the workflows to `release`
 - [One policy for oversized container metadata](/quest/m2/import-metadata-policy.md) - fMP4 and MKV refuse or stream huge metadata by one documented rule
 - [Wire fuzz coverage](/quest/m2/wire-fuzz-coverage.md) - the cmsg walks in moq-sock and moq-uring have invariant fuzz targets, and the unsafe peer input reaches runs under Miri
 - [VA-API renderer tests](/quest/m2/vaapi-render-tests.md) - the VA-API renderer, decode, and transcode tests run in `just rs gpu` on AMD and Intel and fail instead of skipping, and hosted CI reports them ignored
@@ -46,7 +48,7 @@ lite-07; bitrate enforcement is not part of this release.
 - [moq-auth drops the unused peer grant API](/quest/m2/auth-drop-peer-grant.md) - P2P trusts its peers, so `PeerGrant` and its `KeySet` methods go
 - [rust2's exporter is ready for moq](/quest/m2/rust2-exporter.md) - waiting on moq-dev/rust2's exporter to generate every language moq ships
 - [Switch to rust2's exporter](/quest/m2/ffi-exporter.md) - moq's bindings come from rust2-ffi, moq-ffi shrinks to its remainder, and moq's UniFFI generator code is deleted
-- [Generated C bindings](/quest/m2/c/README.md) - C generated from moq-ffi ships as `moq-c` 0.8.0 and replaces the hand-written crate
+- [Generated C bindings](/quest/m2/c/README.md) - C generated from moq-ffi ships as `moq-c` at a later cut's shared minor and replaces the hand-written crate
 - [A C origin can discover eagerly, like a relay](/quest/m2/c-origin-relay.md) - the C API puts an origin in relay mode, so forwarding a client session's routes needs no local announce watcher
 - [A runtime-free QUIC driver](/quest/m2/quic-sansio-driver.md) - a caller's own loop moves UDP datagrams and polls moq sessions over moq-quic, for rust2's bindings
 - [Benchmark sources](/quest/m2/bench-sources.md) - every measuring nightly benchmark feeds the regression table, and none is a smoke run
diff --git a/quest/m2/c/README.md b/quest/m2/c/README.md
index 2979fde4076..963e4372658 100644
--- a/quest/m2/c/README.md
+++ b/quest/m2/c/README.md
@@ -32,7 +32,9 @@ Decided earlier, still standing:
   scalars are `{has_value, value}`, each async function has its own callback
   typedef, and unnamed variant fields are `v1`, as in C++.
 - The generated package takes over the `moq-c` name and `moq::c` target at
-  0.8.0, a minor bump over the hand-written 0.7.x.
+  the shared minor of the cut that ships it, after the hand-written crate's
+  0.22 (CONTRIBUTING.md's [Versions](/CONTRIBUTING.md#versions),
+  [moq-dev/moq#7610](https://github.com/moq-dev/moq/pull/7610)).
 - Docs change inline: the consumer quest rewrites `doc/lib/c`, and its Impact
   bullet carries the move for the package's `MIGRATE.md`.
 
diff --git a/quest/m2/c/consumers.md b/quest/m2/c/consumers.md
index 781c3f25577..2ade0c5d38b 100644
--- a/quest/m2/c/consumers.md
+++ b/quest/m2/c/consumers.md
@@ -22,7 +22,7 @@ the smoke client (`test/smoke/clients/c`), which
 
 Waits for the cut and the generator switch (found when first started,
 2026-10-28; decided 2026-10-31). Until the cut, [moq-c parity](/quest/m1/c/README.md) ships the
-hand-written 0.7 and proves it with this interop client and the current
+hand-written crate at 0.22 and proves it with this interop client and the current
 `doc/lib/c`, and `doc/` describes only what ships, so either half landing first
 drops the shipping crate's proof and documents an unpublished API. The switch
 re-cases every generated C type (`moq_session` becomes `MoqSession`), so a port
@@ -39,5 +39,5 @@ so it can move only once the generated archive publishes, after this quest;
 
 ## Required
 
-- [Breaking release cut](/quest/m2/release/cut.md) - the hand-written 0.7 ships with this client and these docs as its proof
+- [Breaking release cut](/quest/m2/release/cut.md) - the hand-written crate ships at 0.22 with this client and these docs as its proof
 - [Switch to rust2's exporter](/quest/m2/ffi-exporter.md) - the generated C type names settle before consumers are written against them
diff --git a/quest/m2/mbx-r2-release-cache.md b/quest/m2/mbx-r2-release-cache.md
new file mode 100644
index 00000000000..557988a0185
--- /dev/null
+++ b/quest/m2/mbx-r2-release-cache.md
@@ -0,0 +1,27 @@
+# [XS] Release pull requests read the R2 Rust cache
+
+## Goal
+
+A release pull request's `Check the cache` step reports `effective
+read-only`, and the PR that closes this records it. Condition: `release`
+carries the platform Rust cache, which its `platform.yml` still lacks on
+2026-11-05; check with
+`git show origin/release:.github/workflows/platform.yml | grep rust-cache`.
+
+## Plan
+
+Decided 2026-11-05 (maintainer, /quest-audit): ✅ split from
+[Verify the R2 Rust cache](/quest/m0/ci/mbx-r2-verify.md) and moved to m2
+behind [the cut](/quest/m2/release/cut.md), which brings `main`'s platform
+Rust cache to `release` when it merges `main` into it. Not chosen: moving
+the whole R2 verification quest; merging `main` into `release` now, which
+reverses the 2026-11-04 decision.
+
+Once the cut lands, inspect the first release pull request's `Check the
+cache` step.
+
+Public API: none. Wire: none.
+
+## Required
+
+- [Cut and publish the prepared breaking release](/quest/m2/release/cut.md) - brings the platform Rust cache to `release`
diff --git a/quest/m2/relay-io-uring-package.md b/quest/m2/relay-io-uring-package.md
index 7fe15fa06c0..533e4520ee8 100644
--- a/quest/m2/relay-io-uring-package.md
+++ b/quest/m2/relay-io-uring-package.md
@@ -38,8 +38,13 @@ ships, not the default.
   (`listen.lb_id` QUIC-LB server ids). That refusal is a recorded exception
   to parity, not a prerequisite, until a consumer asks.
 
+Decided 2026-11-05 (maintainer, /quest-audit): ✅ this waits for
+[the io_uring relay path using moq-net's policy](/quest/m1/session-policy/uring.md),
+so packaging never publishes the hand-copied lifecycle path.
+
 Public API: none. Wire: none.
 
 ## Required
 
+- [The io_uring relay path uses moq-net's policy](/quest/m1/session-policy/uring.md) - the ring serves through the shared accept policy before it ships
 - [One port on the io_uring workers](/quest/m2/uring-demux.md) - a one-port config is served on the ring too
diff --git a/quest/m0/ci/release-tag-publishers.md b/quest/m2/release-tag-publishers.md
similarity index 54%
rename from quest/m0/ci/release-tag-publishers.md
rename to quest/m2/release-tag-publishers.md
index 625626776b3..db56ae8a3f1 100644
--- a/quest/m0/ci/release-tag-publishers.md
+++ b/quest/m2/release-tag-publishers.md
@@ -12,6 +12,15 @@ Planned 2026-11-02 (maintainer, follow-up planning after the 2026-11-02 /quest-c
 the `bot` Environment today, which admits `main`; moving them needs `bot` to
 admit the binary release tags, a maintainer action to list in the PR.
 
+Decided 2026-11-05 (maintainer, /quest-audit): ✅ moved from m0 to m2 behind
+[the cut](/quest/m2/release/cut.md), since tags run `release`'s copies of the
+workflows and `release` gets `main`'s only when the cut merges it. Not
+chosen: moving all four release-gated m0 CI quests, including
+[Drop main from the publish Environment](/quest/m0/ci/publish-release-only.md),
+which backports its own change instead; merging `main` into `release` now,
+which reverses the 2026-11-04 decision.
+
 ## Required
 
+- [Cut and publish the prepared breaking release](/quest/m2/release/cut.md) - brings `main`'s workflows to `release`, where tags run them
 - [Release credentials off main](/quest/m0/ci/publish-release-only.md) - the same move for the `publish` jobs lands first

From d6fcf6d60012d11ace99385a780de3cfc75dc9b3 Mon Sep 17 00:00:00 2001
From: Luke Curley <kixelated@gmail.com>
Date: Thu, 5 Nov 2026 22:59:51 +0000
Subject: [PATCH 28/36] feat!: one Route handle owns its broadcast (#7806)

Co-authored-by: pullfrog[bot] <226033991+pullfrog[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 bench/browser/page/stats.ts                   |    6 +-
 bench/browser/page/transport.ts               |    2 +-
 bench/fanout/session/Cargo.lock               |  840 ++++++
 bench/fanout/session/src/main.rs              |    6 +-
 c/moq/MIGRATE.md                              |   12 +
 c/moq/test/probe.c                            |   30 +-
 cpp/moq/MIGRATE.md                            |   12 +
 cpp/moq/bench/main.cpp                        |    5 +-
 cpp/moq/test/probe.cpp                        |   33 +-
 cpp/obs/src/moq-dock.cpp                      |    5 +
 cpp/obs/src/moq-output.cpp                    |   31 +-
 cpp/obs/src/moq-output.h                      |    6 +
 cpp/obs/test/moq-audio-encoder-test.cpp       |    5 +-
 cpp/obs/test/moq-source-test.cpp              |   22 +-
 dart/moq/MIGRATE.md                           |   11 +
 dart/moq/README.md                            |    4 +-
 dart/moq/bench/ffi.dart                       |    9 +-
 dart/moq/lib/src/aliases.dart                 |   21 +-
 dart/moq/lib/src/client.dart                  |   13 +-
 dart/moq/lib/src/server.dart                  |   15 +-
 dart/moq/test/moq_test.dart                   |  140 +-
 dart/moq_ffi/lib/src/moq.dart                 |  738 +++--
 dart/moq_ffi/test/future_test.dart            |    9 +-
 demo/carla/sim/moq_carla_sim/main.py          |    6 +-
 demo/carla/sim/moq_carla_sim/runtime.py       |   18 +-
 demo/carla/sim/tests/test_runtime.py          |    8 +-
 demo/carla/web/src/truck.ts                   |   12 +-
 doc/bin/obs.md                                |    2 +-
 doc/concept/identity.md                       |   26 +-
 doc/lib/c/index.md                            |   30 +-
 doc/lib/cpp/index.md                          |   10 +-
 doc/lib/dart/index.md                         |   18 +-
 doc/lib/go/index.md                           |    9 +-
 doc/lib/js/net.md                             |   16 +-
 doc/lib/kt/index.md                           |    9 +-
 doc/lib/py/index.md                           |    7 +-
 doc/lib/rs/index.md                           |   16 +-
 doc/lib/rs/moq-net.md                         |    6 +-
 doc/lib/swift/index.md                        |    9 +-
 go/wrapper/MIGRATE.md                         |   16 +
 go/wrapper/README.md                          |    6 +-
 go/wrapper/client.go                          |    8 +-
 go/wrapper/example_test.go                    |   13 +-
 go/wrapper/moq_test.go                        |  252 +-
 go/wrapper/origin.go                          |  176 +-
 go/wrapper/origin_internal_test.go            |   49 +-
 go/wrapper/publish.go                         |    6 +-
 go/wrapper/reconnect_test.go                  |   10 +-
 go/wrapper/runtime_bench_test.go              |    8 +-
 go/wrapper/server.go                          |    8 +-
 go/wrapper/types.go                           |   20 +-
 js/crypto/README.md                           |   23 +-
 js/crypto/src/e2ee/index.ts                   |   13 +-
 js/crypto/src/e2ee/transport.test.ts          |   12 +-
 js/crypto/src/sign/broadcast.ts               |   21 +-
 js/crypto/src/sign/index.ts                   |    6 +-
 js/crypto/src/sign/sign.test.ts               |    7 +-
 js/hang/src/catalog/consumer.test.ts          |    6 +-
 js/moq-boy/src/game.test.ts                   |    3 +-
 js/moq-boy/src/game.ts                        |    9 +-
 js/net/MIGRATE.md                             |   42 +
 js/net/api/index.api.md                       |   59 +-
 js/net/bench/broadcasts.ts                    |   45 +-
 js/net/bench/fetch.ts                         |    5 +-
 js/net/bench/fills.ts                         |    3 +-
 js/net/bench/forward.ts                       |    4 +-
 js/net/bench/refresh.ts                       |    5 +-
 js/net/bench/requests.ts                      |   29 +-
 js/net/bench/resume-history.ts                |    3 +-
 js/net/bench/serve-browser-entry.ts           |    5 +-
 js/net/bench/subscribe-drop.ts                |    5 +-
 js/net/examples/publish.ts                    |    7 +-
 js/net/src/announced.test-util.ts             |    4 +-
 js/net/src/announced.test.ts                  |   19 +-
 js/net/src/announced.ts                       |    4 +-
 js/net/src/auth.test.ts                       |   62 +-
 js/net/src/broadcast.ts                       |   22 +-
 js/net/src/connection/close.test.ts           |    5 +-
 js/net/src/connection/forward.test.ts         |    8 +-
 js/net/src/connection/forward.ts              |   21 +-
 js/net/src/connection/migrate.test.ts         |    5 +-
 js/net/src/connection/pool.test.ts            |    9 +-
 js/net/src/connection/reload.test.ts          |   31 +-
 js/net/src/connection/scope.test.ts           |    5 +-
 js/net/src/consume.test.ts                    |   30 +-
 js/net/src/consume.ts                         |    8 +-
 js/net/src/fill.test.ts                       |    3 +-
 js/net/src/goaway-requests.test.ts            |   10 +-
 js/net/src/group-id.test.ts                   |    5 +-
 js/net/src/hop.ts                             |   59 +-
 js/net/src/ietf/connection.test.ts            |   12 +-
 js/net/src/ietf/fetch.test.ts                 |    8 +-
 js/net/src/ietf/goaway.test.ts                |    4 +-
 js/net/src/ietf/join.test.ts                  |    3 +-
 js/net/src/ietf/malformed.test.ts             |    5 +-
 js/net/src/ietf/publisher.test.ts             |  131 +-
 js/net/src/ietf/publisher.ts                  |    8 +-
 js/net/src/ietf/subscriber.ts                 |   12 +-
 js/net/src/integration.test.ts                |   36 +-
 js/net/src/internal.ts                        |   26 +-
 js/net/src/lite/compression.test.ts           |    6 +-
 js/net/src/lite/connection.test.ts            |   35 +-
 js/net/src/lite/copy_fill.test.ts             |    9 +-
 js/net/src/lite/datagram-tracks.test.ts       |   10 +-
 js/net/src/lite/publisher.test.ts             |   25 +-
 js/net/src/lite/publisher.ts                  |   14 +-
 js/net/src/lite/refresh.test.ts               |    5 +-
 js/net/src/lite/subscriber.test.ts            |    6 +-
 js/net/src/lite/subscriber.ts                 |    6 +-
 js/net/src/lite/track_stream.test.ts          |   45 +-
 js/net/src/lite/tracks.test.ts                |   40 +-
 js/net/src/lite/widened_max_age.test.ts       |    3 +-
 js/net/src/order.test.ts                      |   20 +-
 js/net/src/origin-demand.test.ts              |   60 +-
 js/net/src/origin-request.test.ts             |  320 ++-
 js/net/src/origin.test.ts                     |  517 ++--
 js/net/src/origin.ts                          |  854 +++---
 js/net/src/parked-expiry.test.ts              |   10 +-
 js/net/src/resume.model.test.ts               |    4 +-
 js/net/src/resume.test.ts                     |   15 +-
 js/net/src/retention.test.ts                  |    5 +-
 js/net/src/subscribe_priority.test.ts         |   20 +-
 js/net/src/tail.test.ts                       |    5 +-
 js/net/src/terminal.test.ts                   |    3 +-
 js/net/src/untimed.test.ts                    |   12 +-
 js/net/src/wire.ts                            |   45 +-
 js/publish/src/broadcast.test.ts              |    8 +-
 js/publish/src/broadcast.ts                   |   20 +-
 js/watch/src/audio/decoder.test.ts            |    2 +-
 js/watch/src/broadcast.test.ts                |   83 +-
 js/watch/src/echo.ts                          |    8 +-
 js/watch/src/include.test.ts                  |    5 +-
 js/watch/src/player.test.ts                   |    3 +-
 js/watch/src/video/decoder.test.ts            |    2 +-
 kt/moq/MIGRATE.md                             |   16 +
 .../kotlin/dev/moq/Aliases.kt                 |   32 +-
 .../jvmAndAndroidMain/kotlin/dev/moq/Flows.kt |    8 +-
 .../jvmAndAndroidMain/kotlin/dev/moq/Moq.kt   |   15 +-
 .../kotlin/dev/moq/Server.kt                  |   16 +-
 .../kotlin/dev/moq/SmokeTest.kt               |  128 +-
 kt/moq/src/jvmTest/kotlin/dev/moq/FfiBench.kt |    6 +-
 py/moq-ffi/tests/exit_inside_callback.py      |    5 +-
 py/moq-rs/MIGRATE.md                          |   14 +
 py/moq-rs/README.md                           |   34 +-
 py/moq-rs/benches/ffi.py                      |    3 +-
 py/moq-rs/docs/index.md                       |    6 +-
 py/moq-rs/examples/clock.py                   |    6 +-
 py/moq-rs/examples/serve_clock.py             |    6 +-
 py/moq-rs/moq/__init__.py                     |   12 +-
 py/moq-rs/moq/client.py                       |   12 +-
 py/moq-rs/moq/origin.py                       |  167 +-
 py/moq-rs/moq/publish.py                      |    6 +-
 py/moq-rs/moq/server.py                       |   16 +-
 py/moq-rs/moq/types.py                        |    8 +-
 py/moq-rs/tests/test_local.py                 |  189 +-
 py/moq-rs/tests/test_server.py                |   26 +-
 py/moq-rs/tests/test_testing_clock.py         |    3 +-
 quest/m1/announce-takeover.md                 |    8 +-
 quest/m1/api-audit/route/README.md            |    2 +-
 quest/m1/api-audit/route/facts.md             |   42 +
 quest/m1/api-audit/route/handle.md            |  126 -
 quest/m1/cluster-routing/routes/session.md    |    4 -
 rs/hang/examples/video.rs                     |    7 +-
 rs/moq-archive/README.md                      |    2 +-
 rs/moq-audio/src/decode/consumer.rs           |   14 +-
 rs/moq-audio/src/encode/capture.rs            |    4 +-
 rs/moq-bench/src/connection.rs                |   47 +-
 rs/moq-boy/src/input.rs                       |   15 +-
 rs/moq-boy/src/main.rs                        |   23 +-
 rs/moq-c/MIGRATE.md                           |   16 +
 rs/moq-c/README.md                            |   21 +-
 rs/moq-c/c-tests/audio-decode-output.c        |   11 +-
 rs/moq-c/c-tests/decode-output.c              |   14 +-
 rs/moq-c/c-tests/timestamps.c                 |   11 +-
 rs/moq-c/src/api.rs                           |  351 ++-
 rs/moq-c/src/origin.rs                        |  257 +-
 rs/moq-c/src/publish.rs                       |  138 +-
 rs/moq-c/src/test.rs                          |  323 ++-
 rs/moq-cli/src/announced.rs                   |    7 +-
 rs/moq-cli/src/archive.rs                     |   49 +-
 rs/moq-cli/src/complete.rs                    |    3 +-
 rs/moq-cli/src/fetch.rs                       |   23 +-
 rs/moq-cli/src/hls.rs                         |   37 +-
 rs/moq-cli/src/hls/record.rs                  |    8 +-
 rs/moq-cli/src/main.rs                        |   32 +-
 rs/moq-cli/src/play/media.rs                  |  105 +-
 rs/moq-cli/src/publish.rs                     |  159 +-
 rs/moq-cli/src/report.rs                      |   41 +-
 rs/moq-cli/src/report/echo_test.rs            |    4 +-
 rs/moq-cli/src/rtc.rs                         |   16 +-
 rs/moq-cli/src/rtsp.rs                        |   18 +-
 rs/moq-cli/src/transcode.rs                   |   43 +-
 rs/moq-cli/tests/integration/export.rs        |   13 +-
 rs/moq-cli/tests/integration/instances.rs     |   12 +-
 rs/moq-cli/tests/integration/listen.rs        |    8 +-
 rs/moq-crypto/MIGRATE.md                      |    2 +-
 rs/moq-crypto/README.md                       |   20 +-
 rs/moq-crypto/benches/sign.rs                 |   14 +-
 rs/moq-crypto/src/sign/broadcast.rs           |   19 +-
 rs/moq-crypto/src/sign/mod.rs                 |    4 +-
 rs/moq-crypto/src/sign/tests.rs               |   16 +-
 rs/moq-crypto/tests/transport.rs              |    9 +-
 rs/moq-ffi/MIGRATE.md                         |   16 +
 rs/moq-ffi/src/bench.rs                       |   14 +-
 rs/moq-ffi/src/ffi.rs                         |    7 +-
 rs/moq-ffi/src/origin.rs                      |  405 +--
 rs/moq-ffi/src/producer.rs                    |    2 +-
 rs/moq-ffi/src/test.rs                        |  434 +--
 rs/moq-ffi/uniffi.toml                        |    2 +
 rs/moq-gst/src/sink/imp.rs                    |   38 +-
 rs/moq-gst/src/sink/session.rs                |   34 +-
 rs/moq-gst/src/source/imp.rs                  |  151 +-
 rs/moq-hls/benches/include.rs                 |   30 +-
 rs/moq-hls/src/export/archive_tests.rs        |    4 +-
 rs/moq-hls/src/export/include.rs              |    9 +-
 rs/moq-hls/src/export/mod.rs                  |  323 ++-
 rs/moq-hls/src/export/rendition.rs            |   22 +-
 rs/moq-hls/src/server/include_tests.rs        |   54 +-
 rs/moq-hls/src/server/mod.rs                  |   36 +-
 rs/moq-hls/src/server/routes.rs               |   71 +-
 rs/moq-hls/tests/integration/conformance.rs   |    6 +-
 rs/moq-hls/tests/integration/finish.rs        |    4 +-
 rs/moq-hls/tests/integration/restart.rs       |    3 +-
 rs/moq-hls/tests/integration/server.rs        |   36 +-
 rs/moq-hls/tests/integration/support.rs       |   21 +-
 rs/moq-mux/benches/containers.rs              |    5 +-
 rs/moq-mux/benches/export.rs                  |   10 +-
 rs/moq-mux/src/catalog/hang/consumer.rs       |   25 +-
 rs/moq-mux/src/catalog/producer.rs            |   15 +-
 rs/moq-mux/src/container/consumer.rs          |   16 +-
 rs/moq-mux/src/container/source.rs            |   35 +-
 rs/moq-mux/src/container/test_util.rs         |    6 +-
 rs/moq-mux/src/container/ts/export_test.rs    |  185 +-
 rs/moq-mux/src/container/ts/programs.rs       |   76 +-
 rs/moq-mux/src/follow.rs                      |   24 +-
 rs/moq-mux/src/linger.rs                      |   35 +-
 rs/moq-mux/src/source.rs                      |  129 +-
 rs/moq-net-tests/tests/announce_allocs.rs     |   22 +-
 .../tests/integration/hop_limit.rs            |  154 +
 .../tests/integration/ietf_conformance.rs     |    2 +-
 rs/moq-net-tests/tests/integration/main.rs    |    1 +
 rs/moq-net-tests/tests/integration/refresh.rs |   10 +-
 rs/moq-net-tests/tests/integration/restart.rs |  107 +-
 rs/moq-net-tests/tests/integration/serve.rs   |   16 +-
 rs/moq-net/MIGRATE.md                         |   38 +
 rs/moq-net/benches/announce.rs                |    2 +-
 rs/moq-net/benches/auth.rs                    |   45 +-
 rs/moq-net/benches/memory.rs                  |   15 +-
 rs/moq-net/benches/origin.rs                  |  208 +-
 rs/moq-net/benches/path.rs                    |   16 +-
 rs/moq-net/benches/retirement.rs              |   14 +-
 rs/moq-net/benches/session/mod.rs             |   20 +-
 rs/moq-net/benches/stats.rs                   |    8 +-
 rs/moq-net/benches/viewers.rs                 |   13 +-
 rs/moq-net/src/auth.rs                        |    4 +-
 rs/moq-net/src/fuzz.rs                        |   32 +-
 rs/moq-net/src/ietf/cluster.rs                |    6 +-
 rs/moq-net/src/ietf/publisher.rs              |  305 +-
 rs/moq-net/src/ietf/session.rs                |   12 +-
 rs/moq-net/src/ietf/subscriber.rs             |   44 +-
 rs/moq-net/src/lite/fetch.rs                  |    2 +-
 rs/moq-net/src/lite/ietf.rs                   |   19 +-
 rs/moq-net/src/lite/publisher.rs              |  184 +-
 rs/moq-net/src/lite/subscribe.rs              |    2 +-
 rs/moq-net/src/lite/subscriber.rs             |   41 +-
 rs/moq-net/src/lite/track.rs                  |    2 +-
 rs/moq-net/src/lite/tracks.rs                 |    2 +-
 rs/moq-net/src/model/announced.rs             |   16 +-
 rs/moq-net/src/model/broadcast.rs             |  124 +-
 rs/moq-net/src/model/follow.rs                |  108 +-
 rs/moq-net/src/model/mod.rs                   |    6 +-
 rs/moq-net/src/model/origin.rs                | 2472 ++++++++++-------
 rs/moq-net/src/model/resume_model.rs          |    8 +-
 rs/moq-net/src/model/socket.rs                |   27 +-
 rs/moq-net/src/server.rs                      |    4 +-
 rs/moq-net/src/stats.rs                       |    2 +-
 rs/moq-net/src/util.rs                        |    2 +-
 .../integration/announce_covering_route.rs    |   24 +-
 .../tests/integration/announce_takeover.rs    |   22 +-
 .../tests/integration/announce_to_serve.rs    |   12 +-
 rs/moq-net/tests/integration/auth.rs          |  219 +-
 .../tests/integration/broadcast_close.rs      |   12 +-
 .../tests/integration/catalog_acquisition.rs  |   14 +-
 rs/moq-net/tests/integration/catalog_churn.rs |   10 +-
 .../tests/integration/catalog_handover.rs     |   10 +-
 rs/moq-net/tests/integration/compress.rs      |   20 +-
 rs/moq-net/tests/integration/control_stats.rs |    7 +-
 rs/moq-net/tests/integration/datagram.rs      |   43 +-
 .../tests/integration/dial_split_horizon.rs   |    8 +-
 rs/moq-net/tests/integration/drained_claim.rs |   24 +-
 rs/moq-net/tests/integration/empty_group.rs   |    8 +-
 rs/moq-net/tests/integration/errored_end.rs   |    8 +-
 rs/moq-net/tests/integration/extensions.rs    |    6 +-
 .../tests/integration/fastest_reader.rs       |   16 +-
 rs/moq-net/tests/integration/fetch_cancel.rs  |   14 +-
 rs/moq-net/tests/integration/fetch_fanout.rs  |    3 +-
 .../tests/integration/fetch_from_feed.rs      |    9 +-
 rs/moq-net/tests/integration/fetch_only.rs    |   24 +-
 .../tests/integration/fetch_pipeline.rs       |   18 +-
 .../integration/finished_broadcast_mock.rs    |   10 +-
 rs/moq-net/tests/integration/finite_relay.rs  |    8 +-
 rs/moq-net/tests/integration/flights.rs       |   12 +-
 rs/moq-net/tests/integration/goaway.rs        |   26 +-
 rs/moq-net/tests/integration/group_order.rs   |   14 +-
 .../tests/integration/history_groups.rs       |   14 +-
 .../tests/integration/idle_cancel_refetch.rs  |    7 +-
 rs/moq-net/tests/integration/idle_session.rs  |    4 +-
 rs/moq-net/tests/integration/instance.rs      |   11 +-
 .../tests/integration/late_lower_group.rs     |   19 +-
 .../tests/integration/lazy_discovery.rs       |   14 +-
 rs/moq-net/tests/integration/mesh_withdraw.rs |  206 +-
 rs/moq-net/tests/integration/model.rs         |   18 +-
 rs/moq-net/tests/integration/multi_cdn.rs     |   12 +-
 rs/moq-net/tests/integration/partial_group.rs |    7 +-
 rs/moq-net/tests/integration/quiet_catalog.rs |    8 +-
 rs/moq-net/tests/integration/range_anchors.rs |    7 +-
 rs/moq-net/tests/integration/range_fill.rs    |    9 +-
 rs/moq-net/tests/integration/range_read.rs    |    7 +-
 .../tests/integration/received_rewind.rs      |   14 +-
 rs/moq-net/tests/integration/rejoin.rs        |   80 +-
 .../tests/integration/relay_upstream_close.rs |    7 +-
 rs/moq-net/tests/integration/replacement.rs   |   32 +-
 rs/moq-net/tests/integration/request_caps.rs  |   22 +-
 rs/moq-net/tests/integration/route_change.rs  |   87 +-
 rs/moq-net/tests/integration/route_health.rs  |   16 +-
 .../tests/integration/segmented_frame.rs      |    8 +-
 rs/moq-net/tests/integration/session_close.rs |   30 +-
 rs/moq-net/tests/integration/session_idle.rs  |   10 +-
 rs/moq-net/tests/integration/session_panic.rs |   13 +-
 .../integration/settled_end_survives_abort.rs |    4 +-
 .../tests/integration/setup_negotiation.rs    |    4 +-
 rs/moq-net/tests/integration/slow_joiner.rs   |    7 +-
 rs/moq-net/tests/integration/socket.rs        |   18 +-
 rs/moq-net/tests/integration/source_errors.rs |   20 +-
 rs/moq-net/tests/integration/stream_credit.rs |   23 +-
 .../tests/integration/subscribe_priority.rs   |    7 +-
 .../tests/integration/subscribe_ranges.rs     |   36 +-
 .../tests/integration/subscribe_tracks.rs     |   10 +-
 .../tests/integration/subscribe_with_track.rs |    5 +-
 .../tests/integration/subscriber_max_age.rs   |   14 +-
 .../integration/subscription_end_integrity.rs |   24 +-
 rs/moq-net/tests/integration/support/mod.rs   |   48 +-
 rs/moq-net/tests/integration/synced.rs        |   18 +-
 .../integration/track_abort_over_session.rs   |   18 +-
 .../tests/integration/track_info_cancel.rs    |   18 +-
 .../tests/integration/track_stream_demand.rs  |   12 +-
 rs/moq-net/tests/integration/track_tail.rs    |   10 +-
 rs/moq-net/tests/integration/tracks.rs        |   54 +-
 rs/moq-net/tests/integration/tracks_ietf.rs   |    8 +-
 .../tests/integration/unannounce_release.rs   |    8 +-
 rs/moq-net/tests/integration/untimed.rs       |   35 +-
 rs/moq-net/tests/integration/warm_backfill.rs |   14 +-
 rs/moq-net/tests/integration/wide_hop.rs      |    6 +-
 rs/moq-net/tests/integration/wide_sequence.rs |   28 +-
 .../tests/integration/widened_max_age.rs      |   24 +-
 rs/moq-net/tests/integration/zero_copy.rs     |    8 +-
 rs/moq-relay/src/cluster.rs                   |   53 +-
 rs/moq-relay/src/internal.rs                  |   30 +-
 rs/moq-relay/src/web.rs                       |   21 +-
 rs/moq-relay/tests/drills.rs                  |   58 +-
 .../tests/integration/auth_lifetime.rs        |   76 +-
 .../tests/integration/bitrate_caps.rs         |    6 +-
 .../tests/integration/cluster_drain.rs        |   17 +-
 .../tests/integration/cluster_fresh_port.rs   |    5 +-
 .../tests/integration/cluster_idle.rs         |    5 +-
 .../tests/integration/cluster_unknown.rs      |   15 +-
 rs/moq-relay/tests/integration/connection.rs  |   17 +-
 rs/moq-relay/tests/integration/embed.rs       |   10 +-
 .../tests/integration/goaway_cluster.rs       |   32 +-
 .../tests/integration/hidden_cluster.rs       |    6 +-
 .../tests/integration/public_rules.rs         |   10 +-
 .../tests/integration/runtime_uring.rs        |   40 +-
 .../tests/integration/runtime_workers.rs      |   10 +-
 .../tests/integration/shutdown_signal.rs      |    5 +-
 rs/moq-relay/tests/integration/smoke.rs       |   59 +-
 .../tests/integration/tenant_matrix.rs        |   11 +-
 .../tests/integration/upstream_links.rs       |   13 +-
 rs/moq-room/src/chat.rs                       |    8 +-
 rs/moq-room/src/room.rs                       |   16 +-
 rs/moq-rtc/src/client/mod.rs                  |    4 +-
 rs/moq-rtc/src/egress.rs                      |   44 +-
 rs/moq-rtc/src/ingest.rs                      |   13 +
 rs/moq-rtc/src/lib.rs                         |   65 +-
 rs/moq-rtc/src/server/whep.rs                 |   14 +-
 rs/moq-rtc/src/server/whip.rs                 |   14 +-
 rs/moq-rtmp/src/dial.rs                       |   70 +-
 rs/moq-rtmp/src/server.rs                     |   72 +-
 rs/moq-rtsp/README.md                         |   10 +-
 rs/moq-rtsp/src/client.rs                     |   16 +-
 rs/moq-srt/src/server.rs                      |   20 +-
 rs/moq-srt/src/ts.rs                          |   26 +-
 rs/moq-stats/benches/aggregate.rs             |   19 +-
 rs/moq-stats/benches/producer_tick.rs         |    4 +-
 rs/moq-stats/src/aggregate.rs                 |   91 +-
 rs/moq-stats/src/consume.rs                   |    9 +-
 rs/moq-stats/src/produce.rs                   |   51 +-
 rs/moq-tokio/examples/chat.rs                 |   16 +-
 rs/moq-tokio/examples/clock.rs                |   16 +-
 rs/moq-tokio/src/client.rs                    |    6 +-
 rs/moq-tokio/src/connection.rs                |   11 +-
 rs/moq-tokio/src/origin.rs                    |    7 +-
 rs/moq-tokio/src/server.rs                    |   10 +-
 rs/moq-tokio/src/webrtc/tests.rs              |    4 +-
 rs/moq-tokio/tests/integration/backend.rs     |   24 +-
 rs/moq-tokio/tests/integration/broadcast.rs   |  273 +-
 .../tests/integration/datagram_delivery.rs    |    8 +-
 rs/moq-tokio/tests/integration/max_age.rs     |   10 +-
 rs/moq-tokio/tests/integration/migrate.rs     |   22 +-
 .../tests/integration/receive_credit.rs       |   21 +-
 rs/moq-tokio/tests/integration/relay_fill.rs  |    6 +-
 rs/moq-tokio/tests/integration/runtime.rs     |    6 +-
 rs/moq-tokio/tests/integration/sim.rs         |    7 +-
 .../integration/subscription_end_integrity.rs |   10 +-
 rs/moq-tokio/tests/integration/unannounce.rs  |    6 +-
 rs/moq-transcode/README.md                    |    6 +-
 rs/moq-transcode/examples/transcode.rs        |    6 +-
 rs/moq-transcode/src/lib.rs                   |    6 +-
 rs/moq-uring/benches/session_lite.rs          |   10 +-
 .../tests/integration/receive_credit.rs       |    9 +-
 rs/moq-uring/tests/integration/session.rs     |   20 +-
 rs/moq-uring/tests/integration/web.rs         |   10 +-
 rs/moq-video/src/decode/decoder.rs            |    3 +-
 swift/MIGRATE.md                              |   16 +
 swift/README.md                               |    6 +-
 swift/Sources/Moq/Aliases.swift               |   10 +-
 swift/Sources/Moq/Broadcast.swift             |    6 +-
 swift/Sources/Moq/Origin.swift                |  148 +-
 swift/Tests/MoqTests/FfiBench.swift           |    4 +-
 swift/Tests/MoqTests/SmokeTests.swift         |  124 +-
 .../clients/js/src/capture.test.ts            |   18 +-
 test/drain/drain.ts                           |    6 +-
 .../relay-withdraws-lost-publisher.patch      |   16 +-
 test/interop/clients/cpp/main.cpp             |   17 +-
 test/interop/clients/go/main.go               |   23 +-
 test/interop/clients/js-native/claims.ts      |    2 +-
 test/interop/clients/js-native/hls.ts         |    2 +-
 test/interop/clients/js-native/replace.ts     |    2 +-
 test/interop/clients/js-native/server.ts      |   12 +-
 test/interop/clients/js-native/tail.ts        |    6 +-
 test/interop/clients/js/open-gop/main.ts      |    6 +-
 test/interop/clients/js/src/finish.ts         |   12 +-
 test/interop/clients/python/interop.py        |   10 +-
 test/interop/clients/rust/catalog.rs          |   10 +-
 test/interop/clients/rust/control.rs          |    8 +-
 test/interop/clients/rust/finish.rs           |   24 +-
 test/interop/clients/rust/goaway.rs           |    7 +-
 test/interop/clients/rust/hls.rs              |    6 +-
 test/interop/clients/rust/tail.rs             |    8 +-
 test/interop/compat/client.ts                 |   10 +-
 test/interop/ietf-range-updates.ts            |    2 +-
 test/interop/sign.ts                          |    2 +-
 test/interop/track-status.ts                  |    5 +-
 test/interop/tracks.ts                        |    5 +-
 test/max-age/client.ts                        |    6 +-
 test/p2p/src/main.ts                          |    5 +-
 test/receive-credit/sender.ts                 |    6 +-
 test/relay-fill/relay.ts                      |    2 +-
 test/stream-limits/client.ts                  |    2 +-
 test/video/src/captions.ts                    |    6 +-
 test/video/src/poster.ts                      |    6 +-
 460 files changed, 10786 insertions(+), 8193 deletions(-)
 create mode 100644 bench/fanout/session/Cargo.lock
 create mode 100644 quest/m1/api-audit/route/facts.md
 delete mode 100644 quest/m1/api-audit/route/handle.md
 create mode 100644 rs/moq-net-tests/tests/integration/hop_limit.rs

diff --git a/bench/browser/page/stats.ts b/bench/browser/page/stats.ts
index 1af8a34d759..cee88d035c7 100644
--- a/bench/browser/page/stats.ts
+++ b/bench/browser/page/stats.ts
@@ -91,7 +91,7 @@ async function allocator(connection: Moq.Connection): Promise<Moq.Bandwidth.Hand
 
 /** A reservation on `handle` for a fresh, unannounced track: the allocator sees only its demand. */
 function reserve(handle: Moq.Bandwidth.Handle, origin: Moq.Origin.Producer, name: string) {
-	const publication = origin.createBroadcast(Moq.Path.from(name));
+	const publication = origin.route(Moq.Path.from(name), { hidden: true });
 	const track = publication.broadcast.createTrack("video", { priority: 1 });
 	const reservation = handle.reserve(track.demand(), 2_500_000);
 	cleanup.push(() => {
@@ -149,7 +149,7 @@ async function setup(config: Sampling): Promise<void> {
 /** Publishes one small-frame track and plays it on every connection. */
 async function receive(config: Sampling): Promise<void> {
 	const publishing = new Moq.Origin.Producer();
-	const publication = publishing.createBroadcast(Moq.Path.from(`${config.path}/live`));
+	const publication = publishing.route(Moq.Path.from(`${config.path}/live`), { hidden: true });
 	const track = publication.broadcast.createTrack("data", { timescale: Moq.Time.Timescale.MILLI });
 	publication.announce();
 	const publisher = await Moq.Connection.connect({
@@ -249,7 +249,7 @@ async function resume(config: Sampling & { cycles: number; idle_ms: number; limi
 	const waits: number[] = [];
 	for (let cycle = 0; cycle < config.cycles; cycle++) {
 		await new Promise((resolve) => setTimeout(resolve, config.idle_ms));
-		const publication = origin.createBroadcast(Moq.Path.from(`${config.path}/resume/${cycle}`));
+		const publication = origin.route(Moq.Path.from(`${config.path}/resume/${cycle}`), { hidden: true });
 		const track = publication.broadcast.createTrack("video", { priority: 1 });
 		const start = performance.now();
 		const reservation = handle.reserve(track.demand(), 2_500_000);
diff --git a/bench/browser/page/transport.ts b/bench/browser/page/transport.ts
index bbfce615db6..d188ee28dc2 100644
--- a/bench/browser/page/transport.ts
+++ b/bench/browser/page/transport.ts
@@ -32,7 +32,7 @@ async function publish(config: Transport): Promise<void> {
 	// Fixture generation stays outside every timed interval.
 	const fixtures = Array.from({ length: config.frames }, (_, frame) => payload(config.size, frame));
 	const origin = new Moq.Origin.Producer();
-	const publication = origin.createBroadcast(Moq.Path.from(config.path));
+	const publication = origin.route(Moq.Path.from(config.path), { hidden: true });
 	const producer = publication.broadcast;
 	// Retention covers the whole run, so a slow consumer cannot lose a group to eviction.
 	const track = producer.createTrack("data", { timescale: Moq.Time.Timescale.MILLI, maxAge: Milli(600_000) });
diff --git a/bench/fanout/session/Cargo.lock b/bench/fanout/session/Cargo.lock
new file mode 100644
index 00000000000..2d9f2ec521d
--- /dev/null
+++ b/bench/fanout/session/Cargo.lock
@@ -0,0 +1,840 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 4
+
+[[package]]
+name = "arrayvec"
+version = "0.7.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3fb67a6e08acf24fdeccbac2cb6ac4305825bd1f117462e0e6f2f193345ad56"
+
+[[package]]
+name = "bytes"
+version = "1.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fc652a48c352aef3ea3aed32080501cf3ef6ed5da78602a020c991775b0aff04"
+
+[[package]]
+name = "cfg-if"
+version = "1.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4e7648175b45a9a48536d676f68d918270699102aa8dab5496df06904c914600"
+
+[[package]]
+name = "chacha20"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "65c35e4b699c7e15ccbe7ee35c005e4fc0a278d22238a2857e6ce2dadeda1b06"
+dependencies = [
+ "cfg-if",
+ "cpufeatures",
+ "rand_core",
+]
+
+[[package]]
+name = "cpufeatures"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5ca28b0ae3115b884660db4118d803791fd6756b6e88f39c0f3f7859060d7566"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "crc32fast"
+version = "1.5.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5f97d3416d5337d15c4b0d78c8c91df922ca143f57ec20e2d1c188333047ef04"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "crossbeam-epoch"
+version = "0.9.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dc74980687109a3b14c72fd458107bf0baa1da1a1a805e178d15501ba9b86d9d"
+dependencies = [
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "crossbeam-utils"
+version = "0.8.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a31eee39dddec8330830986fcd7625edb5a24ec90ea038215273bbc3adb08ac6"
+
+[[package]]
+name = "displaydoc"
+version = "0.2.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c6232dd377dcc64799954cbd3a9bb882e9cdc1308ccd87b1c098f1fb2eaf82a8"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.9",
+]
+
+[[package]]
+name = "equivalent"
+version = "1.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "00d174d5400e5e8fd687ad1049e2f578285fa914201b1af7e8b112a4546bd826"
+
+[[package]]
+name = "fanout-session"
+version = "0.0.0"
+dependencies = [
+ "bytes",
+ "futures",
+ "kio",
+ "moq-net",
+ "tokio",
+]
+
+[[package]]
+name = "flate2"
+version = "1.1.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6e634e2e0ebac1ee034020da1ca582e17ffe4e0f5e985823721e168928136dcb"
+dependencies = [
+ "crc32fast",
+ "zlib-rs",
+]
+
+[[package]]
+name = "foldhash"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77ce24cb58228fbb8aa041425bb1050850ac19177686ea6e0f41a70416f56fdb"
+
+[[package]]
+name = "form_urlencoded"
+version = "1.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb4cb245038516f5f85277875cdaa4f7d2c9a0fa0468de06ed190163b1581fcf"
+dependencies = [
+ "percent-encoding",
+]
+
+[[package]]
+name = "futures"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9a31d2a3fbaaeb2af2368bbdd904aa8e812d3c04a1ee10d3171f52d556e5d0a3"
+dependencies = [
+ "futures-channel",
+ "futures-core",
+ "futures-executor",
+ "futures-io",
+ "futures-sink",
+ "futures-task",
+ "futures-util",
+]
+
+[[package]]
+name = "futures-channel"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b1f9e3d69d39e4862ffed03ed071a76f9a13ba1d9109d355b0f0aa6b15e393c4"
+dependencies = [
+ "futures-core",
+ "futures-sink",
+]
+
+[[package]]
+name = "futures-core"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92d699e522242e69e3003b94ecc1f960f3a5e015aa7c5d7486e65ad01dd94f5e"
+
+[[package]]
+name = "futures-executor"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "031b47cf1a3c6cc8bc2fc76cd437f521619387907d469316e7c0bc278f1f5432"
+dependencies = [
+ "futures-core",
+ "futures-task",
+ "futures-util",
+]
+
+[[package]]
+name = "futures-io"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "53c0fa8157de1303bfffdaa1cc2a673bfffb60102f76b0ef4441659124373fed"
+
+[[package]]
+name = "futures-macro"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9fb9654ba8355388abeb8dcb4fc62f511300867002afc858860463bdd9fe0c44"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.9",
+]
+
+[[package]]
+name = "futures-sink"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1944426bf7d03f1d14f708785e4b33efd750b36d48a157b836b3efc15ede8e1d"
+
+[[package]]
+name = "futures-task"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cd417de3d1d015fc3bfd2b1ea46dfc7bab72ef86f1cc7cc9c78e728b34a6d1fd"
+
+[[package]]
+name = "futures-util"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0d50a92467f8ba5dd6e3ee5d4bd04d73ab2e4e1c44474a0674821dfce14b79bc"
+dependencies = [
+ "futures-channel",
+ "futures-core",
+ "futures-io",
+ "futures-macro",
+ "futures-sink",
+ "futures-task",
+ "memchr",
+ "pin-project-lite",
+ "slab",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "300e883d756b2e4ec94e02791f39b04b522276138852cfc41d9fb7e904106099"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "r-efi",
+ "rand_core",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.17.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed5909b6e89a2db4456e54cd5f673791d7eca6732202bbf2a9cc504fe2f9b84a"
+dependencies = [
+ "foldhash",
+]
+
+[[package]]
+name = "hashlink"
+version = "0.12.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a596f1b20ed2cc5ecac41a164aaebc7258057060f06c0cf7a2ba3991ee7990fb"
+dependencies = [
+ "hashbrown",
+]
+
+[[package]]
+name = "icu_collections"
+version = "2.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fe090a42a0d3140fed8c63263ed1fecc02422cb2f4bfe55cd8de2de1b8e105dd"
+dependencies = [
+ "displaydoc",
+ "potential_utf",
+ "utf8_iter",
+ "yoke",
+ "zerofrom",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_locale_core"
+version = "2.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "25d29b57c17c6528d0dc4c2141cfa2d08200465acb537a3909c8b9b8a4a984c0"
+dependencies = [
+ "displaydoc",
+ "litemap",
+ "tinystr",
+ "writeable",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_normalizer"
+version = "2.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "404a3b8c486f205c87fe7f23ab6894d84a4ad76d6e4671ae1981ba7def87c599"
+dependencies = [
+ "icu_collections",
+ "icu_normalizer_data",
+ "icu_properties",
+ "icu_provider",
+ "smallvec",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_normalizer_data"
+version = "2.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "20f0088bfb7441f7a37fa0c9e20cb1e9cba1cac6b9ce8cd2a6dc44294f8e8cbc"
+
+[[package]]
+name = "icu_properties"
+version = "2.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2ea83d991c56158f7cf898bf86436c1dfe7c07ee82fe88951f2695c9f37a379f"
+dependencies = [
+ "displaydoc",
+ "icu_collections",
+ "icu_locale_core",
+ "icu_properties_data",
+ "icu_provider",
+ "zerotrie",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_properties_data"
+version = "2.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b98f29af82d02b163fe50161388350e743bb3107cc8e8c2f7314cb505faddfcf"
+
+[[package]]
+name = "icu_provider"
+version = "2.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "413099315636c588ee8f011190b329b971a09a8fae9d157e01dcae8379468514"
+dependencies = [
+ "displaydoc",
+ "icu_locale_core",
+ "writeable",
+ "yoke",
+ "zerofrom",
+ "zerotrie",
+ "zerovec",
+]
+
+[[package]]
+name = "idna"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3b0875f23caa03898994f6ddc501886a45c7d3d62d04d2d90788d47be1b1e4de"
+dependencies = [
+ "idna_adapter",
+ "smallvec",
+ "utf8_iter",
+]
+
+[[package]]
+name = "idna_adapter"
+version = "1.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb68373c0d6620ef8105e855e7745e18b0d00d3bdb07fb532e434244cdb9a714"
+dependencies = [
+ "icu_normalizer",
+ "icu_properties",
+]
+
+[[package]]
+name = "indexmap"
+version = "2.14.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cc4e190f5d26ca7051642629da2c52fc03bde85a03197c99408dcd291734c855"
+dependencies = [
+ "equivalent",
+ "hashbrown",
+]
+
+[[package]]
+name = "kio"
+version = "0.6.2"
+dependencies = [
+ "crossbeam-epoch",
+ "kio-macros",
+ "rand",
+ "smallvec",
+ "tokio",
+]
+
+[[package]]
+name = "kio-macros"
+version = "0.1.0"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "libc"
+version = "0.2.191"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "65cd87c9a6d60536580b316ad985726104730a5151c99845f2490428ef91240a"
+
+[[package]]
+name = "litemap"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "47d9d19d1d6efa0109d2f65ff4c85cddd50bd572e5a00127ab10987290bcefae"
+
+[[package]]
+name = "memchr"
+version = "2.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf8baf1c55e62ffcace7a9f06f4bd9cd3f0c4beb022d3b367256b91b87513d98"
+
+[[package]]
+name = "moq-net"
+version = "0.3.10"
+dependencies = [
+ "arrayvec",
+ "bytes",
+ "flate2",
+ "futures",
+ "hashbrown",
+ "hashlink",
+ "kio",
+ "moq-pattern",
+ "num_enum",
+ "rand",
+ "rangemap",
+ "serde",
+ "slab",
+ "thiserror",
+ "tracing",
+ "url",
+]
+
+[[package]]
+name = "moq-pattern"
+version = "0.1.2"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "num_enum"
+version = "0.7.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5d0bca838442ec211fa11de3a8b0e0e8f3a4522575b5c4c06ed722e005036f26"
+dependencies = [
+ "num_enum_derive",
+ "rustversion",
+]
+
+[[package]]
+name = "num_enum_derive"
+version = "0.7.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "680998035259dcfcafe653688bf2aa6d3e2dc05e98be6ab46afb089dc84f1df8"
+dependencies = [
+ "proc-macro-crate",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "once_cell"
+version = "1.21.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50"
+
+[[package]]
+name = "percent-encoding"
+version = "2.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b4f627cb1b25917193a259e49bdad08f671f8d9708acfd5fe0a8c1455d87220"
+
+[[package]]
+name = "pin-project-lite"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a89322df9ebe1c1578d689c92318e070967d1042b512afbe49518723f4e6d5cd"
+
+[[package]]
+name = "potential_utf"
+version = "0.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d83eb9bc6d8e5cf568e7a1101d60ee05e81ed50ea106026f3d18deeb046d7661"
+dependencies = [
+ "zerovec",
+]
+
+[[package]]
+name = "proc-macro-crate"
+version = "3.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e67ba7e9b2b56446f1d419b1d807906278ffa1a658a8a5d8a39dcb1f5a78614f"
+dependencies = [
+ "toml_edit",
+]
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.107"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "985e7ec9bb745e6ce6535b544d84d6cd6f7ad8bd711c398938ae983b91a766d9"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.47"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fbf4db142a473a8d80c26bbf18454ed458bf8d26c8219c331daecfdbd079001"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "r-efi"
+version = "6.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf"
+
+[[package]]
+name = "rand"
+version = "0.10.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "65c9fb96cbc91e3478eaae79a69fcd3f1ae4ad052e471fe6732fff548984b4af"
+dependencies = [
+ "chacha20",
+ "getrandom",
+ "rand_core",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "63b8176103e19a2643978565ca18b50549f6101881c443590420e4dc998a3c69"
+
+[[package]]
+name = "rangemap"
+version = "1.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a611d15b50743feb4c76b7d03edcb0e64f399c26961e4efe6975bc398be6aa3d"
+
+[[package]]
+name = "rustversion"
+version = "1.0.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf54715a573b99ac80df0bc206da022bcd442c974952c7b9720069370852e21f"
+
+[[package]]
+name = "serde"
+version = "1.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4148590afebada386688f18773da617792bf2ef03ffc1e4cbd2b1d45b023e0ba"
+dependencies = [
+ "serde_core",
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_core"
+version = "1.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "67dca2c9c51e58a4791a4b1ed58308b39c64224d349a935ab5039aa360942a48"
+dependencies = [
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_derive"
+version = "1.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e7a5d71263a5a7d47b41f6b3f06ba276f10cc18b0931f1799f710578e2309348"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.9",
+]
+
+[[package]]
+name = "slab"
+version = "0.4.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c790de23124f9ab44544d7ac05d60440adc586479ce501c1d6d7da3cd8c9cf5"
+
+[[package]]
+name = "smallvec"
+version = "1.16.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d0d5d4b1981b8bbbb7aed204cae5726d683d5d6ac7e74ec54122ea28f315e7c8"
+
+[[package]]
+name = "stable_deref_trait"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ce2be8dc25455e1f91df71bfa12ad37d7af1092ae736f3a6cd0e37bc7810596"
+
+[[package]]
+name = "syn"
+version = "2.0.119"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "872831b642d1a07999a962a351ed35b955ea2cfc8f3862091e2a240a84f17297"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "syn"
+version = "3.0.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d78c8dee4c7bf0e14673097256fed6142ce9d3b85a408189d07482442145823b"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "synstructure"
+version = "0.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "901704edd0dfe137f1987838ee4f259e4e063c31371bdb423f7ae38ec6f77f02"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.9",
+]
+
+[[package]]
+name = "thiserror"
+version = "2.0.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09e52cb86a36cede5cb101bf8908837b3e4c6e5e59fe7fd85c23fb56200d189e"
+dependencies = [
+ "thiserror-impl",
+]
+
+[[package]]
+name = "thiserror-impl"
+version = "2.0.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fe5197923287db20a58125f0bc85c062f7f2c892de97b18c356f9efb14b28524"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.9",
+]
+
+[[package]]
+name = "tinystr"
+version = "0.8.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "abc840c238154d58f9e86b2792261edfde565a17696e1cda1a449de27979801a"
+dependencies = [
+ "displaydoc",
+ "zerovec",
+]
+
+[[package]]
+name = "tokio"
+version = "1.54.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b52fd3255258d26fac7264ab5a76b53c13367136dc011d3d6ad4f8ed070396a3"
+dependencies = [
+ "pin-project-lite",
+]
+
+[[package]]
+name = "toml_datetime"
+version = "1.1.2+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2b86d767906c6c42421dcba507eb9d203e779497710a47782a224bb871653053"
+dependencies = [
+ "serde_core",
+]
+
+[[package]]
+name = "toml_edit"
+version = "0.25.18+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ec6e78bd70db9420d8d212fa9dc97f116448a1ceff5d00eabb991d407e21396"
+dependencies = [
+ "indexmap",
+ "toml_datetime",
+ "toml_parser",
+ "winnow",
+]
+
+[[package]]
+name = "toml_parser"
+version = "1.1.5+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "baa693a8032d7e1cada7d0041e96126df243179ff061456783ac7f12bda4744c"
+dependencies = [
+ "winnow",
+]
+
+[[package]]
+name = "tracing"
+version = "0.1.44"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "63e71662fa4b2a2c3a26f570f037eb95bb1f85397f3cd8076caed2f026a6d100"
+dependencies = [
+ "pin-project-lite",
+ "tracing-attributes",
+ "tracing-core",
+]
+
+[[package]]
+name = "tracing-attributes"
+version = "0.1.31"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7490cfa5ec963746568740651ac6781f701c9c5ea257c58e057f3ba8cf69e8da"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "tracing-core"
+version = "0.1.36"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "db97caf9d906fbde555dd62fa95ddba9eecfd14cb388e4f491a66d74cd5fb79a"
+dependencies = [
+ "once_cell",
+]
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.27"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a2c754d6c33795a1c324727428e5a7dedb5b06195f9890bdbcba760d3e246563"
+
+[[package]]
+name = "url"
+version = "2.5.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ff67a8a4397373c3ef660812acab3268222035010ab8680ec4215f38ba3d0eed"
+dependencies = [
+ "form_urlencoded",
+ "idna",
+ "percent-encoding",
+ "serde",
+]
+
+[[package]]
+name = "utf8_iter"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "af3bd9d3e571c26fcce9d033b87ea5ab061b8d2ffe9b7a5675d810d68f03edf0"
+dependencies = [
+ "utf_types",
+]
+
+[[package]]
+name = "utf_types"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3a3b425286980a367278453f3b6d28cdcb134b574e5a35824a6ff5eebad50bb6"
+
+[[package]]
+name = "winnow"
+version = "1.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8c3b93199df0ab874cdf0c6a94f0a0dc3423fe41f1cafb62b8bd7b1deb277aef"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "writeable"
+version = "0.6.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3ad82d2a33cdc9674dc7465672f271e096168fcdbe0f799d9e6db8c5892679dc"
+
+[[package]]
+name = "yoke"
+version = "0.8.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "417ef3fcf6c300b7dbd25c85531a746931c02ad536f3cf4786ed1e88223340b3"
+dependencies = [
+ "stable_deref_trait",
+ "yoke-derive",
+ "zerofrom",
+]
+
+[[package]]
+name = "yoke-derive"
+version = "0.8.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ec8ebde2db3681e8c9980cc27822030e68752690ddfa9473e739aeb4dbde6d71"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.9",
+ "synstructure",
+]
+
+[[package]]
+name = "zerofrom"
+version = "0.1.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0ec05a11813ea801ff6d75110ad09cd0824ddba17dfe17128ea0d5f68e6c5272"
+dependencies = [
+ "zerofrom-derive",
+]
+
+[[package]]
+name = "zerofrom-derive"
+version = "0.1.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f75b4683f6c7f45248d4d64056a24298c6281e0993356d7d1b4a1a962ef10d4a"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.9",
+ "synstructure",
+]
+
+[[package]]
+name = "zerotrie"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4ea269c3bd32f0a32c321907a2ae912ba6f4649bb0fc764a15627e99a7095a3f"
+dependencies = [
+ "displaydoc",
+ "yoke",
+ "zerofrom",
+]
+
+[[package]]
+name = "zerovec"
+version = "0.11.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f58a2799cfe9a1670c7ea8edbd52ef8edb93cb37a7f83bf31ba9e35d9dae6a40"
+dependencies = [
+ "yoke",
+ "zerofrom",
+ "zerovec-derive",
+]
+
+[[package]]
+name = "zerovec-derive"
+version = "0.11.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c3743ddbf47738d929cd1ae2e199d40d0162979dfe31aef8ae646d2bf00bf97a"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.9",
+]
+
+[[package]]
+name = "zlib-rs"
+version = "0.6.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b268e58e7c693d7c271f93ffc4ba3b380412554231c85bf61ca7af91042a4112"
diff --git a/bench/fanout/session/src/main.rs b/bench/fanout/session/src/main.rs
index 6c841192bd7..03e7f3d27fb 100644
--- a/bench/fanout/session/src/main.rs
+++ b/bench/fanout/session/src/main.rs
@@ -63,10 +63,10 @@ fn main() {
 				.with_subscriber(relay.clone()),
 		)
 		.await;
-		let broadcast = publisher.create_broadcast("room").unwrap();
+		let broadcast = publisher.route("room", moq_net::origin::RouteOptions::hidden()).unwrap();
 		let info = moq_net::track::Info::default().with_timescale(moq_net::Timescale::MILLI);
-		let mut track = broadcast.create_track("chat", info).unwrap();
-		broadcast.announce(Default::default()).unwrap();
+		let mut track = broadcast.broadcast().create_track("chat", info).unwrap();
+		broadcast.announce().unwrap();
 
 		let mut audience = Vec::new();
 		for viewer in 0..viewers {
diff --git a/c/moq/MIGRATE.md b/c/moq/MIGRATE.md
index 8c738b9bda8..e12e9ed5a8d 100644
--- a/c/moq/MIGRATE.md
+++ b/c/moq/MIGRATE.md
@@ -4,6 +4,18 @@ How to update your code for each breaking change, newest first.
 
 ## Unreleased
 
+### Publishing goes through one `moq_route` handle
+
+`moq_origin_producer_create_broadcast(origin, path, &publication)` is `moq_origin_producer_route(origin, path, &options, &route)`, and `moq_origin_producer_requests(origin, prefix, &requests)` is `moq_origin_producer_route_prefix(origin, prefix, &options, &route)`; start `options` from `moq_route_options_default()`. A `moq_route` replaces `moq_publication`, `moq_origin_requests`, and `moq_broadcast_prepared`:
+
+- `moq_publication_broadcast(publication)` is `moq_route_broadcast(route, &broadcast)`, which fails on a prefix route.
+- `moq_publication_announce(publication, &route)` is `moq_route_announce(route)`, and re-pricing is `moq_route_set_cost(route, cost)`; `moq_publication_unannounce` is `moq_route_withdraw`.
+- `moq_origin_requests_requested_broadcast` is `moq_route_requested`, whose value is NULL once the origin closes.
+- `moq_broadcast_request_prepare` then `moq_broadcast_prepared_publish` is `moq_broadcast_request_route(request, &options, &route)`: create it hidden to fill it first, then announce it.
+- `moq_route_instance_id(route)` returns the stream's instance, kept across withdraw and announce.
+
+`moq_announce_route` is `moq_route_options`, given at creation, with a leading `hidden`. The default route is visible at once, so set `hidden` and call `moq_route_announce` after filling the catalog to keep the old order. Hold the route while the broadcast should stay announced: `moq_route_cancel` or freeing its last handle retracts it, and `moq_broadcast_producer_close` ends both. The `moq_route` record on `moq_announce.route` is `moq_route_info`.
+
 ### Separate datagram tracks
 
 Create a separate producer with `moq_publish_datagrams` and `moq_datagram_info`; replace `moq_publish_track_datagram` with `moq_publish_datagrams_append` on that handle, or `moq_publish_datagrams_insert` for an explicit sequence. `moq_consume_datagrams` now takes a subscriber priority before its callback and never subscribes to a stream track. Use `moq_publish_datagrams_demand` and `moq_datagram_demand_priority` for aggregate priority, and `moq_publish_datagrams_requests` / `moq_datagram_request_accept` for on-demand publishing. Finish or abort datagram producers separately. A zeroed datagram info is untimed, unlike the microsecond default of stream-track info.
diff --git a/c/moq/test/probe.c b/c/moq/test/probe.c
index 5ab02854386..6ca21f6ee1f 100644
--- a/c/moq/test/probe.c
+++ b/c/moq/test/probe.c
@@ -288,18 +288,22 @@ int main(void)
 	/* Publisher: a server whose origin serves one broadcast with one track. */
 	moq_origin_config origin_config = moq_origin_config_default();
 	moq_origin_producer *origin = moq_origin_producer_new(&origin_config);
-	moq_publication *publication = NULL;
-	ok(moq_origin_producer_create_broadcast(origin, "probe", &publication), "create_broadcast");
-	moq_broadcast_producer *broadcast = moq_publication_broadcast(publication);
+	/* Hidden until its track exists; the route keeps it announced while it is held. */
+	moq_route_options route_options = moq_route_options_default();
+	route_options.hidden = true;
+	moq_route *route = NULL;
+	ok(moq_origin_producer_route(origin, "probe", &route_options, &route), "route");
+	moq_broadcast_producer *broadcast = NULL;
+	ok(moq_route_broadcast(route, &broadcast), "route broadcast");
+	char *instance = moq_route_instance_id(route);
+	CHECK(instance && instance[0] != '\0');
+	moq_string_free(instance);
 	moq_track_info info = moq_track_info_default();
 	info.timescale.has_value = true;
 	info.timescale.value = 1000000;
 	moq_track_producer *track = NULL;
 	ok(moq_broadcast_producer_publish_track(broadcast, "data", &info, &track), "publish_track");
-	moq_announce_route route = moq_announce_route_default();
-	ok(moq_publication_announce(publication, &route), "announce");
-	/* Releasing the publication keeps the route: the subscriber below still reaches it. */
-	moq_publication_free(publication);
+	ok(moq_route_announce(route), "announce");
 
 	const char *generate[] = {"localhost"};
 	const char *versions[] = {"moq-lite-07-wip"};
@@ -419,6 +423,7 @@ int main(void)
 	moq_server_free(server);
 	moq_track_producer_free(track);
 	moq_broadcast_producer_free(broadcast);
+	moq_route_free(route);
 	moq_origin_producer_free(origin);
 
 	/* A first dial that keeps failing still returns the session, whose state names each failed
@@ -455,10 +460,13 @@ int main(void)
      * while moq_shutdown drains the dispatcher; none may run once it returns, even as the
      * handles are freed afterward. */
 	moq_origin_producer *late_origin = moq_origin_producer_new(&origin_config);
-	moq_publication *late_publication = NULL;
-	ok(moq_origin_producer_create_broadcast(late_origin, "late", &late_publication), "late broadcast");
-	moq_broadcast_producer *late_broadcast = moq_publication_broadcast(late_publication);
-	moq_publication_free(late_publication);
+	moq_route_options late_options = moq_route_options_default();
+	late_options.hidden = true;
+	moq_route *late_route = NULL;
+	ok(moq_origin_producer_route(late_origin, "late", &late_options, &late_route), "late route");
+	moq_broadcast_producer *late_broadcast = NULL;
+	ok(moq_route_broadcast(late_route, &late_broadcast), "late broadcast");
+	moq_route_free(late_route);
 	moq_track_producer *late_track = NULL;
 	ok(moq_broadcast_producer_publish_track(late_broadcast, "data", &info, &late_track), "late track");
 	moq_track_consumer *late = NULL;
diff --git a/cpp/moq/MIGRATE.md b/cpp/moq/MIGRATE.md
index b3a688e0dca..b915c08031a 100644
--- a/cpp/moq/MIGRATE.md
+++ b/cpp/moq/MIGRATE.md
@@ -6,6 +6,18 @@
 
 `moq::Following::available()` resolves to a null `std::shared_ptr<moq::BroadcastConsumer>` once the path goes offline (or, for a follow pinned to an instance, once another instance takes it over), then the next broadcast when something serves the path again. The first call is never null. Check for null before using a later result, and treat it like the previous instance ending.
 
+### Publishing goes through one `moq::Route` handle
+
+`OriginProducer::create_broadcast(path)` is `route(path, options)`, and `requests(prefix)` is `route_prefix(prefix, options)`; `{}` options are the default. Each returns a `std::shared_ptr<moq::Route>`, which replaces `moq::Publication`, `moq::OriginRequests`, and `moq::BroadcastPrepared`:
+
+- `Publication::broadcast()` is `Route::broadcast()`, which returns an error on a prefix route.
+- `Publication::announce(route)` is `announce()`, and re-pricing is `set_cost(cost)`; `unannounce()` is `withdraw()`.
+- `OriginRequests::requested_broadcast()` is `requested()`, which resolves to `nullptr` once the origin closes.
+- `BroadcastRequest::prepare()` then `BroadcastPrepared::publish()` is `BroadcastRequest::route(options)`: create it hidden to fill it first, then `announce()`.
+- `instance_id()` is the stream's instance, kept across `withdraw()` and `announce()`.
+
+`moq::AnnounceRoute` is `moq::RouteOptions{hidden, cost, instance, epoch}`, given at creation. A route is visible at once unless `hidden`; set it and call `announce()` after filling the catalog to keep the old order. Hold the route while the broadcast should stay announced: `cancel()` or releasing its last handle retracts it, and closing its broadcast ends both. `moq::Route`, the record on `moq::Announce::route`, is `moq::RouteInfo`.
+
 ### Separate datagram tracks
 
 Replace stream-track datagram methods with `BroadcastProducer::create_datagrams(name, info)` and `BroadcastConsumer::datagrams(name)`. The generated `DatagramProducer` exposes `append(timestamp, payload)` and `insert(Datagram)`; `DatagramConsumer::recv()` returns an optional datagram through a future. `DatagramInfo` has only priority and optional timescale. Demand is aggregate subscriber `priority()` / `priority_changed(last)`; on-demand datagram requests come from `BroadcastRequests::datagrams()` / `DatagramRequests::requested()`. Stream tracks of the same name are independent.
diff --git a/cpp/moq/bench/main.cpp b/cpp/moq/bench/main.cpp
index 91653e4326c..dde2857309f 100644
--- a/cpp/moq/bench/main.cpp
+++ b/cpp/moq/bench/main.cpp
@@ -98,7 +98,10 @@ Reader read(Case c, std::shared_ptr<moq::TrackConsumer> consumer, const std::vec
 void throughput(Case c, double budget, std::vector<Result> &results)
 {
 	auto origin = moq::OriginProducer::init({uint64_t(64 << 20)});
-	auto broadcast = ok(origin->create_broadcast("bench"))->broadcast();
+	moq::RouteOptions hidden;
+	hidden.hidden = true;
+	auto route = ok(origin->route("bench", hidden));
+	auto broadcast = ok(route->broadcast());
 	std::vector<std::shared_ptr<moq::TrackProducer>> tracks;
 	std::vector<std::shared_ptr<moq::TrackConsumer>> consumers;
 	moq::TrackInfo info;
diff --git a/cpp/moq/test/probe.cpp b/cpp/moq/test/probe.cpp
index ffea5252058..e4f325ebade 100644
--- a/cpp/moq/test/probe.cpp
+++ b/cpp/moq/test/probe.cpp
@@ -293,24 +293,23 @@ int main()
 	// It prints the message Rust's Display gives.
 	CHECK(fingerprints.error().to_string() == "bind: not listening; call listen() first");
 
-	// Publisher: a server whose origin serves one broadcast with one track. Dropping the
-	// publication keeps the route, which lasts until the broadcast closes.
+	// Publisher: a server whose origin serves one broadcast with one track. The route, created
+	// hidden until its track exists, keeps the broadcast announced while it is held.
 	auto origin = moq::OriginProducer::init({});
-	std::shared_ptr<moq::BroadcastProducer> broadcast;
-	std::shared_ptr<moq::TrackProducer> track;
-	{
-		auto publication = ok(origin->create_broadcast("probe"), "create_broadcast");
-		broadcast = publication->broadcast();
-		moq::TrackInfo info;
-		info.timescale = 1000000;
-		track = ok(broadcast->publish_track("data", info), "publish_track");
-		ok(publication->announce({}), "announce");
-	}
-
-	// A closed broadcast's publication can no longer announce.
-	auto stale = ok(origin->create_broadcast("stale"), "create_broadcast");
-	ok(stale->broadcast()->close(), "close stale broadcast");
-	auto reannounced = stale->announce({});
+	moq::RouteOptions hidden;
+	hidden.hidden = true;
+	auto route = ok(origin->route("probe", hidden), "route");
+	CHECK(!route->instance_id().empty());
+	auto broadcast = ok(route->broadcast(), "route broadcast");
+	moq::TrackInfo info;
+	info.timescale = 1000000;
+	auto track = ok(broadcast->publish_track("data", info), "publish_track");
+	ok(route->announce(), "announce");
+
+	// A route whose broadcast closed can no longer announce.
+	auto stale = ok(origin->route("stale", {}), "route");
+	ok(ok(stale->broadcast(), "stale broadcast")->close(), "close stale broadcast");
+	auto reannounced = stale->announce();
 	CHECK(!reannounced);
 	CHECK(std::holds_alternative<moq::Error::kClosed>(reannounced.error().get_variant()));
 
diff --git a/cpp/obs/src/moq-dock.cpp b/cpp/obs/src/moq-dock.cpp
index 21699589dd2..02eb02b029f 100644
--- a/cpp/obs/src/moq-dock.cpp
+++ b/cpp/obs/src/moq-dock.cpp
@@ -1124,6 +1124,11 @@ void MoQDock::StartStream()
 		return;
 	}
 
+	if (auto *moq = static_cast<MoQOutput *>(obs_obj_get_data(output))) {
+		const auto instance = moq->GetInstance();
+		if (!instance.empty())
+			publishSummary += QStringLiteral("\nInstance ") + QString::fromStdString(instance);
+	}
 	pollTimer->start();
 
 	SetRunning(true);
diff --git a/cpp/obs/src/moq-output.cpp b/cpp/obs/src/moq-output.cpp
index 95bfb576647..df628cfda75 100644
--- a/cpp/obs/src/moq-output.cpp
+++ b/cpp/obs/src/moq-output.cpp
@@ -166,19 +166,20 @@ bool MoQOutput::Start()
 		return false;
 	}
 
-	// Create the broadcast on an origin of our own, then announce it so subscribers
-	// can discover it. Stop() finishes it, so each Start creates a fresh one, under a
-	// fresh instance the broadcast mints and keeps across reconnects. Only the
-	// broadcast is kept: the route outlives the publication until the broadcast closes.
+	// Route the broadcast on an origin of our own, visible at once so subscribers can
+	// discover it. Stop() closes it, so each Start creates a fresh route, under a fresh
+	// instance it mints and keeps across reconnects. The route is held until Reset():
+	// releasing it would retract the broadcast.
 	LOG_INFO("Publishing broadcast: %s", path.c_str());
 	auto next_origin = moq::OriginProducer::init(moq::OriginConfig{});
-	auto publication = next_origin->create_broadcast(path);
-	if (!publication) {
-		LOG_ERROR("Failed to create broadcast: %s", publication.error().to_string().c_str());
+	auto next_route = next_origin->route(path, {});
+	if (!next_route) {
+		LOG_ERROR("Failed to create broadcast: %s", next_route.error().to_string().c_str());
 		return false;
 	}
-	if (auto announced = (*publication)->announce({}); !announced) {
-		LOG_ERROR("Failed to announce broadcast: %s", announced.error().to_string().c_str());
+	auto next_broadcast = (*next_route)->broadcast();
+	if (!next_broadcast) {
+		LOG_ERROR("Failed to create broadcast: %s", next_broadcast.error().to_string().c_str());
 		return false;
 	}
 
@@ -228,11 +229,13 @@ bool MoQOutput::Start()
 	{
 		std::lock_guard<std::mutex> lock(mutex);
 		url = server;
+		instance = (*next_route)->instance_id();
 	}
 	{
 		std::lock_guard<std::mutex> lock(media_mutex);
 		origin = next_origin;
-		broadcast = (*publication)->broadcast();
+		route = *next_route;
+		broadcast = *next_broadcast;
 	}
 
 	// NOTE: You could publish the same broadcasts to multiple sessions if you want (redundant ingest).
@@ -369,6 +372,7 @@ void MoQOutput::Reset()
 		connected = false;
 		live = false;
 		url.clear();
+		instance.clear();
 		last_failure_code = MoQError::None;
 		last_failure_reason.clear();
 		token_refusal.clear();
@@ -403,6 +407,7 @@ void MoQOutput::Reset()
 	if (broadcast)
 		broadcast->close();
 	broadcast.reset();
+	route.reset();
 	origin.reset();
 
 	// The session owns the drain after this request, even if the output dies now.
@@ -425,6 +430,12 @@ void MoQOutput::Reset()
 		SetBitrate(encoder, bitrate);
 }
 
+std::string MoQOutput::GetInstance()
+{
+	std::lock_guard<std::mutex> lock(mutex);
+	return instance;
+}
+
 bool MoQOutput::TryGetConnectionStats(ConnectionStats *out)
 {
 	if (!out)
diff --git a/cpp/obs/src/moq-output.h b/cpp/obs/src/moq-output.h
index 796c5e516e1..333528baf39 100644
--- a/cpp/obs/src/moq-output.h
+++ b/cpp/obs/src/moq-output.h
@@ -59,6 +59,9 @@ class MoQOutput {
 	// Prefer this over obs_output_get_connect_time_ms, which stays 0 for sub-ms connects.
 	bool IsLiveSession();
 
+	// The route's instance for this Start(), kept through session reconnects; empty when stopped.
+	std::string GetInstance();
+
 	// Most recent connect/reconnect failure for this Start(), or empty when none.
 	// Thread-safe; the dock polls this while connecting, while reconnecting, and on stop.
 	void CopyLastFailure(int *code, std::string *reason);
@@ -184,6 +187,7 @@ class MoQOutput {
 	bool connected = false;
 	bool live = false;
 	std::string url;
+	std::string instance;
 	int last_failure_code = 0;
 	std::string last_failure_reason;
 	std::string token_refusal;
@@ -195,6 +199,8 @@ class MoQOutput {
 	// Never held across an OBS call that can wait on an encoder thread.
 	std::mutex media_mutex;
 	std::shared_ptr<moq::OriginProducer> origin;
+	// Keeps the broadcast announced; the broadcast closing retracts it.
+	std::shared_ptr<moq::Route> route;
 	std::shared_ptr<moq::BroadcastProducer> broadcast;
 	std::map<obs_encoder_t *, Track> video_tracks;
 	std::map<obs_encoder_t *, Track> audio_tracks;
diff --git a/cpp/obs/test/moq-audio-encoder-test.cpp b/cpp/obs/test/moq-audio-encoder-test.cpp
index f7f19fd9b15..682658d1ebb 100644
--- a/cpp/obs/test/moq-audio-encoder-test.cpp
+++ b/cpp/obs/test/moq-audio-encoder-test.cpp
@@ -203,9 +203,8 @@ void CheckSubscriberDecodes(const char *preset, size_t channels)
 		return;
 
 	auto origin = moq::OriginProducer::init(moq::OriginConfig{});
-	auto publication = TestOk(origin->create_broadcast("room"), "create_broadcast");
-	auto broadcast = publication->broadcast();
-	TestOk(publication->announce({}), "announce");
+	auto route = TestOk(origin->route("room", {}), "route");
+	auto broadcast = TestOk(route->broadcast(), "route broadcast");
 
 	moq::AudioInit init{};
 	init.format = moq::AudioFormat::kOpus;
diff --git a/cpp/obs/test/moq-source-test.cpp b/cpp/obs/test/moq-source-test.cpp
index 91a11c9690d..740e0bb3e77 100644
--- a/cpp/obs/test/moq-source-test.cpp
+++ b/cpp/obs/test/moq-source-test.cpp
@@ -585,8 +585,10 @@ class Publisher {
 		  uint64_t start_us = 1'000'000)
 		: timestamp_us(start_us)
 	{
-		auto publication = TestOk(relay.origin->create_broadcast(path), "create_broadcast");
-		broadcast = publication->broadcast();
+		moq::RouteOptions hidden;
+		hidden.hidden = true;
+		route = TestOk(relay.origin->route(path, hidden), "route");
+		broadcast = TestOk(route->broadcast(), "route broadcast");
 		if (video) {
 			moq::VideoInit init{};
 			init.format = moq::VideoFormat::kAvc3;
@@ -603,7 +605,7 @@ class Publisher {
 				TestOk(moq::MediaTrackProducer::audio(broadcast, moq::MediaTarget::kNamed{}, init),
 				       "audio producer");
 		}
-		TestOk(publication->announce(moq::AnnounceRoute{}), "announce");
+		TestOk(route->announce(), "announce");
 	}
 
 	~Publisher() { (void)broadcast->close(); }
@@ -632,6 +634,8 @@ class Publisher {
 			timeout);
 	}
 
+	// Keeps the broadcast announced for the publisher's lifetime.
+	std::shared_ptr<moq::Route> route;
 	std::shared_ptr<moq::BroadcastProducer> broadcast;
 	std::shared_ptr<moq::MediaTrackProducer> video;
 	std::shared_ptr<moq::MediaTrackProducer> audio;
@@ -1576,9 +1580,13 @@ int main()
 		auto snapshot = TestOk(catalogs->next().get(), "catalog snapshot");
 		CHECK(snapshot.has_value());
 		auto config = snapshot->video.begin()->second;
-		std::shared_ptr<moq::Publication> hidden;
+		std::shared_ptr<moq::Route> hidden;
 		if (sibling) {
-			hidden = TestOk(relay.origin->create_broadcast("obs/hidden"), "unannounced sibling");
+			// A different stream than the one the rendition pins, hidden until announced.
+			moq::RouteOptions options;
+			options.hidden = true;
+			options.instance = "obs-test-other";
+			hidden = TestOk(relay.origin->route("obs/hidden", options), "unannounced sibling");
 			config.broadcast = "./hidden";
 			config.instance = "obs-test-pinned";
 		}
@@ -1601,9 +1609,7 @@ int main()
 			const int frames = g_output_frames;
 			CHECK(publisher.WriteUntil([&] { return g_output_frames >= frames + 3; }));
 			// A different stream is a real resolution failure.
-			moq::AnnounceRoute route;
-			route.instance = "obs-test-other";
-			TestOk(hidden->announce(route), "announce mismatched sibling");
+			TestOk(hidden->announce(), "announce mismatched sibling");
 		}
 		CHECK(WaitFor([] {
 			std::lock_guard<std::mutex> lock(g_candidate_mutex);
diff --git a/dart/moq/MIGRATE.md b/dart/moq/MIGRATE.md
index f2edcc86509..ea8860a333e 100644
--- a/dart/moq/MIGRATE.md
+++ b/dart/moq/MIGRATE.md
@@ -26,6 +26,17 @@ while (true) {
 }
 ```
 
+### Publishing goes through one `MoqRoute` handle
+
+`Moq.createBroadcast(path)`, `Server.createBroadcast(path)`, and `OriginProducer.createBroadcast(path: ...)` are `route(path, options: ...)` (`route(path: ..., options: RouteOptions())` on the generated `OriginProducer`), and `OriginProducer.requests(prefix: ...)` is `routePrefix(prefix: ..., options: RouteOptions())`. Each returns a `MoqRoute`, which replaces `Publication`, `OriginRequests`, and `BroadcastPrepared`:
+
+- `Publication.announce(route: AnnounceRoute(...))` is `announce()`, and re-pricing is `setCost(cost: ...)`; `unannounce()` is `withdraw()`.
+- `OriginRequests.requestedBroadcast()` is `requested()`, which returns `null` once the origin closes.
+- `BroadcastRequest.prepare()` then `publish()` is `BroadcastRequest.route(options: ...)`: create it hidden to fill it first, then `announce()`.
+- `instance()` is the stream's instance, kept across `withdraw()` and `announce()`.
+
+`AnnounceRoute` is `RouteOptions(hidden:, cost:, instance:, epoch:)`, given at creation. A route is visible at once unless `hidden: true`; pass it and call `announce()` after filling the catalog to keep the old order. Hold the route while the broadcast should stay announced: cancelling or disposing it retracts it, and closing its broadcast ends both. `MoqRoute`, the facts on `Announce.route`, is `RouteInfo` (`MoqRouteInfo`), and the route handle keeps the `Moq` prefix because Flutter owns `Route`.
+
 ### Catalog renditions carry their warmup ([#7864](https://github.com/moq-dev/moq/pull/7864))
 
 `Video` and `Audio` gain `warmup`, the catalog's decoder warmup; it defaults to `null`, so existing constructors still compile. `TrackConsumer` and the audio and video consumers read it from the rendition and start that much earlier.
diff --git a/dart/moq/README.md b/dart/moq/README.md
index c6ccb9272be..d33323de046 100644
--- a/dart/moq/README.md
+++ b/dart/moq/README.md
@@ -33,12 +33,12 @@ final server = await Server.listen(
     tlsGenerate: ['localhost'],
   ),
 );
-final publication = server.createBroadcast('live');
-publication.announce(route: AnnounceRoute()); // unannounced broadcasts are invisible
+final route = server.route('live'); // hold it: disposing the route retracts it
 await for (final request in server.requests()) {
   final session = await request.accept();
   print(session.state().connects);
 }
+route.dispose(); // retracts the route
 ```
 
 The package uses `Future` for asynchronous operations and `Stream` for
diff --git a/dart/moq/bench/ffi.dart b/dart/moq/bench/ffi.dart
index a4defdca85c..e1626e44531 100644
--- a/dart/moq/bench/ffi.dart
+++ b/dart/moq/bench/ffi.dart
@@ -41,8 +41,11 @@ Future<void> throughput(
   final origin = OriginProducer(
     config: OriginConfig(cacheCapacityBytes: 64 << 20),
   );
-  final publication = origin.createBroadcast(path: 'bench');
-  final broadcast = publication.broadcast();
+  final route = origin.route(
+    path: 'bench',
+    options: RouteOptions(hidden: true),
+  );
+  final broadcast = route.broadcast();
   final tracks = List.generate(
     c.publishers,
     (p) =>
@@ -124,7 +127,7 @@ Future<void> throughput(
       track.dispose();
     }
     broadcast.dispose();
-    publication.dispose();
+    route.dispose();
     origin.dispose();
   }
 }
diff --git a/dart/moq/lib/src/aliases.dart b/dart/moq/lib/src/aliases.dart
index 478853db830..e456a825512 100644
--- a/dart/moq/lib/src/aliases.dart
+++ b/dart/moq/lib/src/aliases.dart
@@ -13,7 +13,8 @@ import 'package:moq_ffi/moq_ffi.dart';
 //
 //   * `MoqServer` - `Server` is the listen facade in server.dart.
 //   * `MoqContainer` / `MoqRoute` - `Container` and `Route` are Flutter's, and
-//     an ambiguous import would break every Flutter app that uses them.
+//     an ambiguous import would break every Flutter app that uses them. Its
+//     options and facts are still [RouteOptions] and [RouteInfo].
 //   * `MoqException` - `Exception` is in `dart:core`.
 
 /// A MoQ client: configure the TLS/bind knobs, then connect to a relay.
@@ -37,7 +38,7 @@ typedef CongestionControl = MoqCongestionControl;
 /// Certificate trust and the mTLS identity for `ConnectOptions.tls`.
 typedef ClientTls = MoqClientTls;
 
-/// The publish side of an origin: create broadcasts so subscribers can discover them.
+/// The publish side of an origin: create routes so subscribers can discover their broadcasts.
 typedef OriginProducer = MoqOriginProducer;
 
 /// Config for creating an origin, such as its total cache budget.
@@ -46,17 +47,11 @@ typedef OriginConfig = MoqOriginConfig;
 /// The subscribe side of an origin: discover and request published broadcasts.
 typedef OriginConsumer = MoqOriginConsumer;
 
-/// A served route: advertises a path prefix and yields broadcast requests beneath it.
-typedef OriginRequests = MoqOriginRequests;
-
-/// A requested broadcast not yet accepted: fulfill it with a producer or reject it.
+/// A requested broadcast not yet answered: serve a held broadcast, route a new one, or reject it.
 typedef BroadcastRequest = MoqBroadcastRequest;
 
-/// A claim answer being filled before its exact route is announced.
-typedef BroadcastPrepared = MoqBroadcastPrepared;
-
-/// A broadcast published on an origin: the broadcast to fill and its announcement.
-typedef Publication = MoqPublication;
+/// How a route advertises itself: hidden until announced, its static cost, and a stable instance.
+typedef RouteOptions = MoqRouteOptions;
 
 /// A stream of announce events under a prefix.
 typedef AnnounceConsumer = MoqAnnounceConsumer;
@@ -67,8 +62,8 @@ typedef AnnounceConfig = MoqAnnounceConfig;
 /// Follows a specific broadcast path across the publisher instances that serve it.
 typedef Following = MoqFollowing;
 
-/// How a broadcast advertises its exact path: its static production cost and stream instance.
-typedef AnnounceRoute = MoqAnnounceRoute;
+/// The read-only facts on a received route: hops, a static cost, and the stream's instance.
+typedef RouteInfo = MoqRouteInfo;
 
 /// A route over a prefix: its origin-relative path, required wildcard captures (empty without wildcards), and route metadata.
 typedef Announce = MoqAnnounce;
diff --git a/dart/moq/lib/src/client.dart b/dart/moq/lib/src/client.dart
index 18e7964173a..4bcaebbca9f 100644
--- a/dart/moq/lib/src/client.dart
+++ b/dart/moq/lib/src/client.dart
@@ -213,13 +213,14 @@ final class Moq {
     }
   }
 
-  /// Create an unannounced broadcast at [path], invisible to everyone until announced.
+  /// Create a route at exactly [path], owning a new broadcast to fill.
   ///
-  /// Populate its `broadcast`, calling `requests` first if tracks are served
-  /// on demand, then advertise it with `announce`. Disposing the publication
-  /// keeps the route; closing the broadcast ends it.
-  Publication createBroadcast(String path) =>
-      session.publish().createBroadcast(path: path);
+  /// Visible at once unless [options] is hidden: create it hidden to populate
+  /// its `broadcast()` first (calling `requests` if tracks are served on
+  /// demand), then `announce()` it. Hold the route: cancelling or disposing it
+  /// retracts it, and closing the broadcast ends both.
+  MoqRoute route(String path, {RouteOptions? options}) =>
+      session.publish().route(path: path, options: options ?? RouteOptions());
 
   /// List the paths matching [options] as each becomes present or absent;
   /// prefixes stay relative to the origin.
diff --git a/dart/moq/lib/src/server.dart b/dart/moq/lib/src/server.dart
index 1a127b4e4aa..81acee86a89 100644
--- a/dart/moq/lib/src/server.dart
+++ b/dart/moq/lib/src/server.dart
@@ -53,7 +53,7 @@ final class ListenOptions {
 
 /// A listening MoQ server with publishing and subscription conveniences.
 ///
-/// Build one with [Server.listen]. Broadcasts created via [createBroadcast] are
+/// Build one with [Server.listen]. Broadcasts of routes created via [route] are
 /// served to incoming sessions, and [requests] streams each incoming [Request]
 /// for the caller to accept or reject. [close] stops accepting new sessions and
 /// releases the listening socket before it returns; in-flight sessions stay
@@ -111,15 +111,16 @@ final class Server {
     }
   }
 
-  /// Create a broadcast at [path], served to incoming sessions.
+  /// Create a route at exactly [path], owning a broadcast served to incoming sessions.
   ///
-  /// Advertise it with `announce` after populating its `broadcast`. Throws
-  /// when [listen] was given a [ListenOptions.consume] origin but no
-  /// [ListenOptions.publish] one, since there is then nothing to serve from.
-  Publication createBroadcast(String path) {
+  /// Visible at once unless [options] is hidden; hold the route, since
+  /// cancelling or disposing it retracts it. Throws when [listen] was given a
+  /// [ListenOptions.consume] origin but no [ListenOptions.publish] one, since
+  /// there is then nothing to serve from.
+  MoqRoute route(String path, {RouteOptions? options}) {
     final origin = _publishOrigin;
     if (origin == null) throw StateError('no publish origin configured');
-    return origin.createBroadcast(path: path);
+    return origin.route(path: path, options: options ?? RouteOptions());
   }
 
   /// SHA-256 fingerprints of the configured TLS certificates, hex-encoded.
diff --git a/dart/moq/test/moq_test.dart b/dart/moq/test/moq_test.dart
index ffcc9daf1c8..0e6d525cf5b 100644
--- a/dart/moq/test/moq_test.dart
+++ b/dart/moq/test/moq_test.dart
@@ -281,12 +281,15 @@ void main() {
     final announcement = client.announced().updates().firstWhere(
       (event) => event is AnnounceEventPresent,
     );
-    final publication = relay.createBroadcast(path: 'live');
-    final track = publication.broadcast().publishTrack(
+    final route = relay.route(
+      path: 'live',
+      options: RouteOptions(hidden: true),
+    );
+    final track = route.broadcast().publishTrack(
       name: 'events',
       info: TrackInfo(timescale: 1000000),
     );
-    publication.announce(route: AnnounceRoute());
+    route.announce();
     final announced =
         (await announcement.timeout(timeout) as AnnounceEventPresent).announce;
     expect(announced.prefix, 'live');
@@ -370,10 +373,10 @@ void main() {
     final announcement = client.announced().updates().firstWhere(
       (event) => event is AnnounceEventPresent,
     );
-    final publication = server.createBroadcast('live');
-    final broadcast = publication.broadcast();
+    final route = server.route('live', options: RouteOptions(hidden: true));
+    final broadcast = route.broadcast();
     final track = broadcast.publishTrack(name: 'events', info: null);
-    publication.announce(route: AnnounceRoute());
+    route.announce();
     final announced =
         (await announcement.timeout(timeout) as AnnounceEventPresent).announce;
     expect(announced.prefix, 'live');
@@ -383,6 +386,7 @@ void main() {
     track.finish();
     broadcast.close();
     broadcast.close(); // a second close is a no-op
+    route.dispose();
     server.close();
   });
 
@@ -526,8 +530,11 @@ void main() {
 
   test('a broadcast is reachable only while announced', () async {
     final origin = MoqOriginProducer(config: MoqOriginConfig());
-    final publication = origin.createBroadcast(path: 'live');
-    final broadcast = publication.broadcast();
+    final route = origin.route(
+      path: 'live',
+      options: RouteOptions(hidden: true),
+    );
+    final broadcast = route.broadcast();
     broadcast.publishTrack(name: 'events', info: null);
     final consumer = origin.consume();
     await expectLater(
@@ -535,13 +542,14 @@ void main() {
       throwsA(anything),
     );
 
-    publication.announce(route: AnnounceRoute());
+    route.announce();
     final announced = consumer.announced(config: MoqAnnounceConfig());
     final first = await nextRoute(announced);
     expect(first, isA<AnnounceEventPresent>());
     expect((first as AnnounceEventPresent).announce.prefix, 'live');
+    expect(first.announce.route.instance, route.instanceId());
 
-    publication.unannounce();
+    route.withdraw();
     final retracted = await nextRoute(announced);
     expect(retracted, isA<AnnounceEventAbsent>());
     expect((retracted as AnnounceEventAbsent).announce.prefix, 'live');
@@ -550,60 +558,90 @@ void main() {
       throwsA(anything),
     );
 
-    publication.announce(route: AnnounceRoute());
-    expect(await nextRoute(announced), isA<AnnounceEventPresent>());
+    // Announcing again continues the same stream.
+    route.announce();
+    final again = await nextRoute(announced) as AnnounceEventPresent;
+    expect(again.announce.route.instance, route.instanceId());
     await consumer.request(path: 'live').timeout(timeout);
 
-    // Disposing the publication keeps the route; closing the broadcast ends it.
-    publication.dispose();
+    // Disposing the broadcast handle keeps the route; cancelling the route retracts it,
+    // and its broadcast lives on.
+    broadcast.dispose();
     await consumer.request(path: 'live').timeout(timeout);
-    broadcast.close();
+    final kept = route.broadcast();
+    route.cancel();
+    expect(await nextRoute(announced), isA<AnnounceEventAbsent>());
+    expect(() => route.announce(), throwsA(isA<CancelledMoqException>()));
+    kept.publishTrack(name: 'after', info: null);
+    kept.close();
+    route.dispose();
+    announced.cancel();
+    announced.dispose();
+  });
+
+  test('closing the broadcast retracts its route', () async {
+    final origin = MoqOriginProducer(config: MoqOriginConfig());
+    final announced = origin.consume().announced(config: MoqAnnounceConfig());
+    final route = origin.route(path: 'live', options: RouteOptions());
+    expect(await nextRoute(announced), isA<AnnounceEventPresent>());
+    route.broadcast().close();
     expect(await nextRoute(announced), isA<AnnounceEventAbsent>());
+    expect(() => route.announce(), throwsA(isA<ClosedMoqException>()));
+    route.dispose();
     announced.cancel();
     announced.dispose();
   });
 
-  test('a stale publication leaves its replacement alone', () async {
+  test('a closed route leaves its replacement alone', () async {
     final origin = MoqOriginProducer(config: MoqOriginConfig());
-    final stale = origin.createBroadcast(path: 'live');
-    stale.announce(route: AnnounceRoute());
+    final stale = origin.route(path: 'live', options: RouteOptions());
     stale.broadcast().close();
 
-    final replacement = origin.createBroadcast(path: 'live');
-    replacement.announce(route: AnnounceRoute());
-    expect(
-      () => stale.announce(route: AnnounceRoute()),
-      throwsA(isA<ClosedMoqException>()),
-    );
-    expect(() => stale.unannounce(), throwsA(isA<ClosedMoqException>()));
+    final replacement = origin.route(path: 'live', options: RouteOptions());
+    expect(() => stale.announce(), throwsA(isA<ClosedMoqException>()));
+    expect(() => stale.setCost(cost: 1), throwsA(isA<ClosedMoqException>()));
+    stale.withdraw();
     await origin.consume().request(path: 'live').timeout(timeout);
     replacement.broadcast().close();
+    stale.dispose();
+    replacement.dispose();
   });
 
-  test('a new instance restarts followers but stays listed', () async {
+  test('a new route restarts followers but stays listed', () async {
     final origin = MoqOriginProducer(config: MoqOriginConfig());
     final consumer = origin.consume();
     final announced = consumer.announced(config: MoqAnnounceConfig());
     final following = consumer.follow(path: 'instance');
-    final publication = origin.createBroadcast(path: 'instance');
+    final first = origin.route(path: 'instance', options: RouteOptions());
 
-    publication.announce(route: AnnounceRoute());
     final present = await nextRoute(announced) as AnnounceEventPresent;
-    expect(present.announce.route.instance, isNotEmpty);
+    expect(present.announce.route.instance, first.instanceId());
     (await following.available().timeout(timeout))!.dispose();
 
-    publication.announce(route: AnnounceRoute(instance: 'camera', epoch: 1));
+    final second = origin.route(
+      path: 'instance',
+      options: RouteOptions(instance: 'camera', epoch: 1),
+    );
+    expect(second.instanceId(), 'camera');
     (await following.available().timeout(timeout))!.dispose();
 
     // The takeover was not listed, so the next event is the path going absent.
-    publication.unannounce();
+    first.withdraw();
+    second.withdraw();
     final absent = await nextRoute(announced) as AnnounceEventAbsent;
     expect(absent.announce.route.instance, 'camera');
 
     expect(
-      () => publication.announce(route: AnnounceRoute(instance: '')),
+      () => origin.route(
+        path: 'refused',
+        options: RouteOptions(instance: ''),
+      ),
       throwsA(isA<InvalidInstanceMoqException>()),
     );
+    first.cancel();
+    second.cancel();
+    first.dispose();
+    second.dispose();
     following.cancel();
     following.dispose();
     announced.cancel();
@@ -615,17 +653,17 @@ void main() {
     () async {
       final origin = MoqOriginProducer(config: MoqOriginConfig());
       final following = origin.consume().follow(path: 'offline');
-      final publication = origin.createBroadcast(path: 'offline');
-
-      publication.announce(route: AnnounceRoute());
+      final route = origin.route(path: 'offline', options: RouteOptions());
       (await following.available().timeout(timeout))!.dispose();
 
-      publication.unannounce();
+      route.withdraw();
       expect(await following.available().timeout(timeout), isNull);
 
-      publication.announce(route: AnnounceRoute());
+      route.announce();
       (await following.available().timeout(timeout))!.dispose();
 
+      route.cancel();
+      route.dispose();
       following.cancel();
       following.dispose();
     },
@@ -636,27 +674,37 @@ void main() {
     final announced = origin.consume().announced(
       config: MoqAnnounceConfig(prefix: 'room', filter: '*/chat'),
     );
-    final publication = origin.createBroadcast(path: 'room/alice/chat');
-    publication.announce(route: AnnounceRoute());
+    final route = origin.route(
+      path: 'room/alice/chat',
+      options: RouteOptions(),
+    );
 
     final update = await nextRoute(announced) as AnnounceEventPresent;
     expect(update.announce.prefix, 'room/alice/chat');
     expect(update.announce.captures, ['alice']);
+    route.dispose();
   });
 
   test('dynamic serves a request under a prefix', () async {
     final origin = MoqOriginProducer(config: MoqOriginConfig());
-    final dynamic = origin.requests(prefix: 'live');
+    final dynamic = origin.routePrefix(prefix: 'live', options: RouteOptions());
     final pending = origin.consume().request(path: 'live/cam');
-    final request = await dynamic.requestedBroadcast().timeout(timeout);
+    final request = (await dynamic.requested().timeout(timeout))!;
     expect(request.path(), 'live/cam');
-    final prepared = request.prepare();
-    final served = prepared.publish();
+    // A hidden job route answers nobody until it announces.
+    final served = request.route(options: RouteOptions(hidden: true));
+    expect(served.instanceId(), isNot(dynamic.instanceId()));
+    served.announce();
     await pending.timeout(timeout);
-    // The publication controls the prepared fill: closing that ends its announcement.
-    prepared.broadcast().close();
-    expect(() => served.unannounce(), throwsA(isA<ClosedMoqException>()));
+    // Closing the job's broadcast ends its route.
+    served.broadcast().close();
+    expect(() => served.announce(), throwsA(isA<ClosedMoqException>()));
+    expect(() => dynamic.broadcast(), throwsA(isA<InternalMoqException>()));
     dynamic.cancel();
+    await expectLater(
+      dynamic.requested(),
+      throwsA(isA<CancelledMoqException>()),
+    );
     dynamic.dispose();
     served.dispose();
   });
diff --git a/dart/moq_ffi/lib/src/moq.dart b/dart/moq_ffi/lib/src/moq.dart
index 65f0f46f21a..8dd3c33eb30 100644
--- a/dart/moq_ffi/lib/src/moq.dart
+++ b/dart/moq_ffi/lib/src/moq.dart
@@ -2813,7 +2813,7 @@ class FfiConverterMoqVideoProperties {
 class MoqAnnounce {
   final String prefix;
   final List<String> captures;
-  final MoqRoute route;
+  final MoqRouteInfo route;
   MoqAnnounce({
     required this.prefix,
     required this.captures,
@@ -2838,7 +2838,7 @@ class FfiConverterMoqAnnounce {
     );
     final captures = captures_lifted.value;
     new_offset += captures_lifted.bytesRead;
-    final route_lifted = FfiConverterMoqRoute.read(
+    final route_lifted = FfiConverterMoqRouteInfo.read(
       Uint8List.view(buf.buffer, new_offset),
     );
     final route = route_lifted.value;
@@ -2853,7 +2853,7 @@ class FfiConverterMoqAnnounce {
     final total_length =
         FfiConverterString.allocationSize(value.prefix) +
         FfiConverterSequenceString.allocationSize(value.captures) +
-        FfiConverterMoqRoute.allocationSize(value.route) +
+        FfiConverterMoqRouteInfo.allocationSize(value.route) +
         0;
     final buf = Uint8List(total_length);
     write(value, buf);
@@ -2870,7 +2870,7 @@ class FfiConverterMoqAnnounce {
       value.captures,
       Uint8List.view(buf.buffer, new_offset),
     );
-    new_offset += FfiConverterMoqRoute.write(
+    new_offset += FfiConverterMoqRouteInfo.write(
       value.route,
       Uint8List.view(buf.buffer, new_offset),
     );
@@ -2880,7 +2880,7 @@ class FfiConverterMoqAnnounce {
   static int allocationSize(MoqAnnounce value) {
     return FfiConverterString.allocationSize(value.prefix) +
         FfiConverterSequenceString.allocationSize(value.captures) +
-        FfiConverterMoqRoute.allocationSize(value.route) +
+        FfiConverterMoqRouteInfo.allocationSize(value.route) +
         0;
   }
 }
@@ -2960,77 +2960,6 @@ class FfiConverterMoqAnnounceConfig {
   }
 }
 
-class MoqAnnounceRoute {
-  final int cost;
-  final String? instance;
-  final int epoch;
-  MoqAnnounceRoute({this.cost = 0, this.instance = null, this.epoch = 0});
-}
-
-class FfiConverterMoqAnnounceRoute {
-  static MoqAnnounceRoute lift(RustBuffer buf) {
-    return FfiConverterMoqAnnounceRoute.read(buf.asUint8List()).value;
-  }
-
-  static LiftRetVal<MoqAnnounceRoute> read(Uint8List buf) {
-    int new_offset = buf.offsetInBytes;
-    final cost_lifted = FfiConverterUInt64.read(
-      Uint8List.view(buf.buffer, new_offset),
-    );
-    final cost = cost_lifted.value;
-    new_offset += cost_lifted.bytesRead;
-    final instance_lifted = FfiConverterOptionalString.read(
-      Uint8List.view(buf.buffer, new_offset),
-    );
-    final instance = instance_lifted.value;
-    new_offset += instance_lifted.bytesRead;
-    final epoch_lifted = FfiConverterUInt64.read(
-      Uint8List.view(buf.buffer, new_offset),
-    );
-    final epoch = epoch_lifted.value;
-    new_offset += epoch_lifted.bytesRead;
-    return LiftRetVal(
-      MoqAnnounceRoute(cost: cost, instance: instance, epoch: epoch),
-      new_offset - buf.offsetInBytes,
-    );
-  }
-
-  static RustBuffer lower(MoqAnnounceRoute value) {
-    final total_length =
-        FfiConverterUInt64.allocationSize(value.cost) +
-        FfiConverterOptionalString.allocationSize(value.instance) +
-        FfiConverterUInt64.allocationSize(value.epoch) +
-        0;
-    final buf = Uint8List(total_length);
-    write(value, buf);
-    return toRustBuffer(buf);
-  }
-
-  static int write(MoqAnnounceRoute value, Uint8List buf) {
-    int new_offset = buf.offsetInBytes;
-    new_offset += FfiConverterUInt64.write(
-      value.cost,
-      Uint8List.view(buf.buffer, new_offset),
-    );
-    new_offset += FfiConverterOptionalString.write(
-      value.instance,
-      Uint8List.view(buf.buffer, new_offset),
-    );
-    new_offset += FfiConverterUInt64.write(
-      value.epoch,
-      Uint8List.view(buf.buffer, new_offset),
-    );
-    return new_offset - buf.offsetInBytes;
-  }
-
-  static int allocationSize(MoqAnnounceRoute value) {
-    return FfiConverterUInt64.allocationSize(value.cost) +
-        FfiConverterOptionalString.allocationSize(value.instance) +
-        FfiConverterUInt64.allocationSize(value.epoch) +
-        0;
-  }
-}
-
 class MoqOriginConfig {
   final int? cacheCapacityBytes;
   MoqOriginConfig({this.cacheCapacityBytes = null});
@@ -3077,12 +3006,12 @@ class FfiConverterMoqOriginConfig {
   }
 }
 
-class MoqRoute {
+class MoqRouteInfo {
   final List<int> hops;
   final int cost;
   final bool anonymous;
   final String instance;
-  MoqRoute({
+  MoqRouteInfo({
     required this.hops,
     required this.cost,
     required this.anonymous,
@@ -3090,12 +3019,12 @@ class MoqRoute {
   });
 }
 
-class FfiConverterMoqRoute {
-  static MoqRoute lift(RustBuffer buf) {
-    return FfiConverterMoqRoute.read(buf.asUint8List()).value;
+class FfiConverterMoqRouteInfo {
+  static MoqRouteInfo lift(RustBuffer buf) {
+    return FfiConverterMoqRouteInfo.read(buf.asUint8List()).value;
   }
 
-  static LiftRetVal<MoqRoute> read(Uint8List buf) {
+  static LiftRetVal<MoqRouteInfo> read(Uint8List buf) {
     int new_offset = buf.offsetInBytes;
     final hops_lifted = FfiConverterSequenceUInt64.read(
       Uint8List.view(buf.buffer, new_offset),
@@ -3118,7 +3047,7 @@ class FfiConverterMoqRoute {
     final instance = instance_lifted.value;
     new_offset += instance_lifted.bytesRead;
     return LiftRetVal(
-      MoqRoute(
+      MoqRouteInfo(
         hops: hops,
         cost: cost,
         anonymous: anonymous,
@@ -3128,7 +3057,7 @@ class FfiConverterMoqRoute {
     );
   }
 
-  static RustBuffer lower(MoqRoute value) {
+  static RustBuffer lower(MoqRouteInfo value) {
     final total_length =
         FfiConverterSequenceUInt64.allocationSize(value.hops) +
         FfiConverterUInt64.allocationSize(value.cost) +
@@ -3140,7 +3069,7 @@ class FfiConverterMoqRoute {
     return toRustBuffer(buf);
   }
 
-  static int write(MoqRoute value, Uint8List buf) {
+  static int write(MoqRouteInfo value, Uint8List buf) {
     int new_offset = buf.offsetInBytes;
     new_offset += FfiConverterSequenceUInt64.write(
       value.hops,
@@ -3161,7 +3090,7 @@ class FfiConverterMoqRoute {
     return new_offset - buf.offsetInBytes;
   }
 
-  static int allocationSize(MoqRoute value) {
+  static int allocationSize(MoqRouteInfo value) {
     return FfiConverterSequenceUInt64.allocationSize(value.hops) +
         FfiConverterUInt64.allocationSize(value.cost) +
         FfiConverterBool.allocationSize(value.anonymous) +
@@ -3170,6 +3099,99 @@ class FfiConverterMoqRoute {
   }
 }
 
+class MoqRouteOptions {
+  final bool hidden;
+  final int cost;
+  final String? instance;
+  final int epoch;
+  MoqRouteOptions({
+    this.hidden = false,
+    this.cost = 0,
+    this.instance = null,
+    this.epoch = 0,
+  });
+}
+
+class FfiConverterMoqRouteOptions {
+  static MoqRouteOptions lift(RustBuffer buf) {
+    return FfiConverterMoqRouteOptions.read(buf.asUint8List()).value;
+  }
+
+  static LiftRetVal<MoqRouteOptions> read(Uint8List buf) {
+    int new_offset = buf.offsetInBytes;
+    final hidden_lifted = FfiConverterBool.read(
+      Uint8List.view(buf.buffer, new_offset),
+    );
+    final hidden = hidden_lifted.value;
+    new_offset += hidden_lifted.bytesRead;
+    final cost_lifted = FfiConverterUInt64.read(
+      Uint8List.view(buf.buffer, new_offset),
+    );
+    final cost = cost_lifted.value;
+    new_offset += cost_lifted.bytesRead;
+    final instance_lifted = FfiConverterOptionalString.read(
+      Uint8List.view(buf.buffer, new_offset),
+    );
+    final instance = instance_lifted.value;
+    new_offset += instance_lifted.bytesRead;
+    final epoch_lifted = FfiConverterUInt64.read(
+      Uint8List.view(buf.buffer, new_offset),
+    );
+    final epoch = epoch_lifted.value;
+    new_offset += epoch_lifted.bytesRead;
+    return LiftRetVal(
+      MoqRouteOptions(
+        hidden: hidden,
+        cost: cost,
+        instance: instance,
+        epoch: epoch,
+      ),
+      new_offset - buf.offsetInBytes,
+    );
+  }
+
+  static RustBuffer lower(MoqRouteOptions value) {
+    final total_length =
+        FfiConverterBool.allocationSize(value.hidden) +
+        FfiConverterUInt64.allocationSize(value.cost) +
+        FfiConverterOptionalString.allocationSize(value.instance) +
+        FfiConverterUInt64.allocationSize(value.epoch) +
+        0;
+    final buf = Uint8List(total_length);
+    write(value, buf);
+    return toRustBuffer(buf);
+  }
+
+  static int write(MoqRouteOptions value, Uint8List buf) {
+    int new_offset = buf.offsetInBytes;
+    new_offset += FfiConverterBool.write(
+      value.hidden,
+      Uint8List.view(buf.buffer, new_offset),
+    );
+    new_offset += FfiConverterUInt64.write(
+      value.cost,
+      Uint8List.view(buf.buffer, new_offset),
+    );
+    new_offset += FfiConverterOptionalString.write(
+      value.instance,
+      Uint8List.view(buf.buffer, new_offset),
+    );
+    new_offset += FfiConverterUInt64.write(
+      value.epoch,
+      Uint8List.view(buf.buffer, new_offset),
+    );
+    return new_offset - buf.offsetInBytes;
+  }
+
+  static int allocationSize(MoqRouteOptions value) {
+    return FfiConverterBool.allocationSize(value.hidden) +
+        FfiConverterUInt64.allocationSize(value.cost) +
+        FfiConverterOptionalString.allocationSize(value.instance) +
+        FfiConverterUInt64.allocationSize(value.epoch) +
+        0;
+  }
+}
+
 class MoqPosition {
   final int group;
   final int frame;
@@ -13225,103 +13247,10 @@ class FfiConverterMoqAnnounceConsumer {
   }
 }
 
-abstract class MoqBroadcastPreparedInterface {
-  MoqBroadcastProducer broadcast();
-  MoqPublication publish();
-}
-
-final _MoqBroadcastPreparedFinalizer = Finalizer<Pointer<Void>>((ptr) {
-  rustCall(
-    (status) => uniffi_moq_ffi_fn_free_moqbroadcastprepared(ptr, status),
-  );
-});
-
-class MoqBroadcastPrepared implements MoqBroadcastPreparedInterface {
-  late final Pointer<Void> _ptr;
-  bool _isDisposed = false;
-  MoqBroadcastPrepared._(this._ptr) {
-    _MoqBroadcastPreparedFinalizer.attach(this, _ptr, detach: this);
-  }
-  factory MoqBroadcastPrepared.lift(Pointer<Void> ptr) {
-    return MoqBroadcastPrepared._(ptr);
-  }
-  Pointer<Void> uniffiClonePointer() {
-    if (_isDisposed) {
-      throw StateError("Object has already been disposed");
-    }
-    return rustCall(
-      (status) => uniffi_moq_ffi_fn_clone_moqbroadcastprepared(_ptr, status),
-    );
-  }
-
-  void dispose() {
-    if (_isDisposed) {
-      return;
-    }
-    final status = calloc<RustCallStatus>();
-    _isDisposed = true;
-    _MoqBroadcastPreparedFinalizer.detach(this);
-    try {
-      uniffi_moq_ffi_fn_free_moqbroadcastprepared(_ptr, status);
-      checkCallStatus(NullRustCallStatusErrorHandler(), status);
-    } finally {
-      calloc.free(status);
-    }
-  }
-
-  MoqBroadcastProducer broadcast() {
-    return rustCallWithLifter(
-      (status) => uniffi_moq_ffi_fn_method_moqbroadcastprepared_broadcast(
-        uniffiClonePointer(),
-        status,
-      ),
-      FfiConverterMoqBroadcastProducer.lift,
-      null,
-    );
-  }
-
-  MoqPublication publish() {
-    return rustCallWithLifter(
-      (status) => uniffi_moq_ffi_fn_method_moqbroadcastprepared_publish(
-        uniffiClonePointer(),
-        status,
-      ),
-      FfiConverterMoqPublication.lift,
-      moqExceptionErrorHandler,
-    );
-  }
-}
-
-class FfiConverterMoqBroadcastPrepared {
-  static MoqBroadcastPrepared lift(Pointer<Void> ptr) {
-    return MoqBroadcastPrepared.lift(ptr);
-  }
-
-  static Pointer<Void> lower(MoqBroadcastPrepared value) {
-    return value.uniffiClonePointer();
-  }
-
-  static int allocationSize(MoqBroadcastPrepared value) {
-    return 8;
-  }
-
-  static LiftRetVal<MoqBroadcastPrepared> read(Uint8List buf) {
-    final handle = buf.buffer.asByteData(buf.offsetInBytes).getInt64(0);
-    final pointer = Pointer<Void>.fromAddress(handle);
-    return LiftRetVal(MoqBroadcastPrepared.lift(pointer), 8);
-  }
-
-  static int write(MoqBroadcastPrepared value, Uint8List buf) {
-    final handle = lower(value);
-    buf.buffer.asByteData(buf.offsetInBytes).setInt64(0, handle.address);
-    return 8;
-  }
-}
-
 abstract class MoqBroadcastRequestInterface {
   String path();
-  MoqBroadcastPrepared prepare();
   void reject({required int errorCode});
+  MoqRoute route({required MoqRouteOptions options});
   void serve({required MoqBroadcastConsumer broadcast});
 }
 
@@ -13373,17 +13302,6 @@ class MoqBroadcastRequest implements MoqBroadcastRequestInterface {
     );
   }
 
-  MoqBroadcastPrepared prepare() {
-    return rustCallWithLifter(
-      (status) => uniffi_moq_ffi_fn_method_moqbroadcastrequest_prepare(
-        uniffiClonePointer(),
-        status,
-      ),
-      FfiConverterMoqBroadcastPrepared.lift,
-      moqExceptionErrorHandler,
-    );
-  }
-
   void reject({required int errorCode}) {
     return rustCall((status) {
       uniffi_moq_ffi_fn_method_moqbroadcastrequest_reject(
@@ -13394,6 +13312,18 @@ class MoqBroadcastRequest implements MoqBroadcastRequestInterface {
     }, moqExceptionErrorHandler);
   }
 
+  MoqRoute route({required MoqRouteOptions options}) {
+    return rustCallWithLifter(
+      (status) => uniffi_moq_ffi_fn_method_moqbroadcastrequest_route(
+        uniffiClonePointer(),
+        FfiConverterMoqRouteOptions.lower(options),
+        status,
+      ),
+      FfiConverterMoqRoute.lift,
+      moqExceptionErrorHandler,
+    );
+  }
+
   void serve({required MoqBroadcastConsumer broadcast}) {
     return rustCall((status) {
       uniffi_moq_ffi_fn_method_moqbroadcastrequest_serve(
@@ -13642,8 +13572,11 @@ class FfiConverterMoqOriginConsumer {
 
 abstract class MoqOriginProducerInterface {
   MoqOriginConsumer consume();
-  MoqPublication createBroadcast({required String path});
-  MoqOriginRequests requests({required String prefix});
+  MoqRoute route({required String path, required MoqRouteOptions options});
+  MoqRoute routePrefix({
+    required String prefix,
+    required MoqRouteOptions options,
+  });
 }
 
 final _MoqOriginProducerFinalizer = Finalizer<Pointer<Void>>((ptr) {
@@ -13704,26 +13637,31 @@ class MoqOriginProducer implements MoqOriginProducerInterface {
     );
   }
 
-  MoqPublication createBroadcast({required String path}) {
+  MoqRoute route({required String path, required MoqRouteOptions options}) {
     return rustCallWithLifter(
-      (status) => uniffi_moq_ffi_fn_method_moqoriginproducer_create_broadcast(
+      (status) => uniffi_moq_ffi_fn_method_moqoriginproducer_route(
         uniffiClonePointer(),
         FfiConverterString.lower(path),
+        FfiConverterMoqRouteOptions.lower(options),
         status,
       ),
-      FfiConverterMoqPublication.lift,
+      FfiConverterMoqRoute.lift,
       moqExceptionErrorHandler,
     );
   }
 
-  MoqOriginRequests requests({required String prefix}) {
+  MoqRoute routePrefix({
+    required String prefix,
+    required MoqRouteOptions options,
+  }) {
     return rustCallWithLifter(
-      (status) => uniffi_moq_ffi_fn_method_moqoriginproducer_requests(
+      (status) => uniffi_moq_ffi_fn_method_moqoriginproducer_route_prefix(
         uniffiClonePointer(),
         FfiConverterString.lower(prefix),
+        FfiConverterMoqRouteOptions.lower(options),
         status,
       ),
-      FfiConverterMoqOriginRequests.lift,
+      FfiConverterMoqRoute.lift,
       moqExceptionErrorHandler,
     );
   }
@@ -13755,31 +13693,34 @@ class FfiConverterMoqOriginProducer {
   }
 }
 
-abstract class MoqOriginRequestsInterface {
+abstract class MoqRouteInterface {
+  void announce();
+  MoqBroadcastProducer broadcast();
   void cancel();
-  UniffiRustFuture<MoqBroadcastRequest> requestedBroadcast();
+  String instanceId();
+  UniffiRustFuture<MoqBroadcastRequest?> requested();
+  void setCost({required int cost});
+  void withdraw();
 }
 
-final _MoqOriginRequestsFinalizer = Finalizer<Pointer<Void>>((ptr) {
-  rustCall((status) => uniffi_moq_ffi_fn_free_moqoriginrequests(ptr, status));
+final _MoqRouteFinalizer = Finalizer<Pointer<Void>>((ptr) {
+  rustCall((status) => uniffi_moq_ffi_fn_free_moqroute(ptr, status));
 });
 
-class MoqOriginRequests implements MoqOriginRequestsInterface {
+class MoqRoute implements MoqRouteInterface {
   late final Pointer<Void> _ptr;
   bool _isDisposed = false;
-  MoqOriginRequests._(this._ptr) {
-    _MoqOriginRequestsFinalizer.attach(this, _ptr, detach: this);
+  MoqRoute._(this._ptr) {
+    _MoqRouteFinalizer.attach(this, _ptr, detach: this);
   }
-  factory MoqOriginRequests.lift(Pointer<Void> ptr) {
-    return MoqOriginRequests._(ptr);
+  factory MoqRoute.lift(Pointer<Void> ptr) {
+    return MoqRoute._(ptr);
   }
   Pointer<Void> uniffiClonePointer() {
     if (_isDisposed) {
       throw StateError("Object has already been disposed");
     }
-    return rustCall(
-      (status) => uniffi_moq_ffi_fn_clone_moqoriginrequests(_ptr, status),
-    );
+    return rustCall((status) => uniffi_moq_ffi_fn_clone_moqroute(_ptr, status));
   }
 
   void dispose() {
@@ -13788,160 +13729,98 @@ class MoqOriginRequests implements MoqOriginRequestsInterface {
     }
     final status = calloc<RustCallStatus>();
     _isDisposed = true;
-    _MoqOriginRequestsFinalizer.detach(this);
+    _MoqRouteFinalizer.detach(this);
     try {
-      uniffi_moq_ffi_fn_free_moqoriginrequests(_ptr, status);
+      uniffi_moq_ffi_fn_free_moqroute(_ptr, status);
       checkCallStatus(NullRustCallStatusErrorHandler(), status);
     } finally {
       calloc.free(status);
     }
   }
 
-  void cancel() {
+  void announce() {
     return rustCall((status) {
-      uniffi_moq_ffi_fn_method_moqoriginrequests_cancel(
-        uniffiClonePointer(),
-        status,
-      );
-    }, null);
+      uniffi_moq_ffi_fn_method_moqroute_announce(uniffiClonePointer(), status);
+    }, moqExceptionErrorHandler);
   }
 
-  UniffiRustFuture<MoqBroadcastRequest> requestedBroadcast() {
-    return uniffiRustCallAsync(
-      () => uniffi_moq_ffi_fn_method_moqoriginrequests_requested_broadcast(
+  MoqBroadcastProducer broadcast() {
+    return rustCallWithLifter(
+      (status) => uniffi_moq_ffi_fn_method_moqroute_broadcast(
         uniffiClonePointer(),
+        status,
       ),
-      ffi_moq_ffi_rust_future_poll_u64,
-      ffi_moq_ffi_rust_future_complete_u64,
-      ffi_moq_ffi_rust_future_cancel_u64,
-      ffi_moq_ffi_rust_future_free_u64,
-      (ptr) =>
-          FfiConverterMoqBroadcastRequest.lift(Pointer<Void>.fromAddress(ptr)),
+      FfiConverterMoqBroadcastProducer.lift,
       moqExceptionErrorHandler,
     );
   }
-}
-
-class FfiConverterMoqOriginRequests {
-  static MoqOriginRequests lift(Pointer<Void> ptr) {
-    return MoqOriginRequests.lift(ptr);
-  }
-
-  static Pointer<Void> lower(MoqOriginRequests value) {
-    return value.uniffiClonePointer();
-  }
-
-  static int allocationSize(MoqOriginRequests value) {
-    return 8;
-  }
-
-  static LiftRetVal<MoqOriginRequests> read(Uint8List buf) {
-    final handle = buf.buffer.asByteData(buf.offsetInBytes).getInt64(0);
-    final pointer = Pointer<Void>.fromAddress(handle);
-    return LiftRetVal(MoqOriginRequests.lift(pointer), 8);
-  }
-
-  static int write(MoqOriginRequests value, Uint8List buf) {
-    final handle = lower(value);
-    buf.buffer.asByteData(buf.offsetInBytes).setInt64(0, handle.address);
-    return 8;
-  }
-}
-
-abstract class MoqPublicationInterface {
-  void announce({required MoqAnnounceRoute route});
-  MoqBroadcastProducer broadcast();
-  void unannounce();
-}
-
-final _MoqPublicationFinalizer = Finalizer<Pointer<Void>>((ptr) {
-  rustCall((status) => uniffi_moq_ffi_fn_free_moqpublication(ptr, status));
-});
-
-class MoqPublication implements MoqPublicationInterface {
-  late final Pointer<Void> _ptr;
-  bool _isDisposed = false;
-  MoqPublication._(this._ptr) {
-    _MoqPublicationFinalizer.attach(this, _ptr, detach: this);
-  }
-  factory MoqPublication.lift(Pointer<Void> ptr) {
-    return MoqPublication._(ptr);
-  }
-  Pointer<Void> uniffiClonePointer() {
-    if (_isDisposed) {
-      throw StateError("Object has already been disposed");
-    }
-    return rustCall(
-      (status) => uniffi_moq_ffi_fn_clone_moqpublication(_ptr, status),
-    );
-  }
-
-  void dispose() {
-    if (_isDisposed) {
-      return;
-    }
-    final status = calloc<RustCallStatus>();
-    _isDisposed = true;
-    _MoqPublicationFinalizer.detach(this);
-    try {
-      uniffi_moq_ffi_fn_free_moqpublication(_ptr, status);
-      checkCallStatus(NullRustCallStatusErrorHandler(), status);
-    } finally {
-      calloc.free(status);
-    }
-  }
 
-  void announce({required MoqAnnounceRoute route}) {
+  void cancel() {
     return rustCall((status) {
-      uniffi_moq_ffi_fn_method_moqpublication_announce(
-        uniffiClonePointer(),
-        FfiConverterMoqAnnounceRoute.lower(route),
-        status,
-      );
-    }, moqExceptionErrorHandler);
+      uniffi_moq_ffi_fn_method_moqroute_cancel(uniffiClonePointer(), status);
+    }, null);
   }
 
-  MoqBroadcastProducer broadcast() {
+  String instanceId() {
     return rustCallWithLifter(
-      (status) => uniffi_moq_ffi_fn_method_moqpublication_broadcast(
+      (status) => uniffi_moq_ffi_fn_method_moqroute_instance_id(
         uniffiClonePointer(),
         status,
       ),
-      FfiConverterMoqBroadcastProducer.lift,
+      FfiConverterString.lift,
       null,
     );
   }
 
-  void unannounce() {
+  UniffiRustFuture<MoqBroadcastRequest?> requested() {
+    return uniffiRustCallAsync(
+      () => uniffi_moq_ffi_fn_method_moqroute_requested(uniffiClonePointer()),
+      ffi_moq_ffi_rust_future_poll_rust_buffer,
+      ffi_moq_ffi_rust_future_complete_rust_buffer,
+      ffi_moq_ffi_rust_future_cancel_rust_buffer,
+      ffi_moq_ffi_rust_future_free_rust_buffer,
+      FfiConverterOptionalMoqBroadcastRequest.lift,
+      moqExceptionErrorHandler,
+    );
+  }
+
+  void setCost({required int cost}) {
     return rustCall((status) {
-      uniffi_moq_ffi_fn_method_moqpublication_unannounce(
+      uniffi_moq_ffi_fn_method_moqroute_set_cost(
         uniffiClonePointer(),
+        FfiConverterUInt64.lower(cost),
         status,
       );
     }, moqExceptionErrorHandler);
   }
+
+  void withdraw() {
+    return rustCall((status) {
+      uniffi_moq_ffi_fn_method_moqroute_withdraw(uniffiClonePointer(), status);
+    }, moqExceptionErrorHandler);
+  }
 }
 
-class FfiConverterMoqPublication {
-  static MoqPublication lift(Pointer<Void> ptr) {
-    return MoqPublication.lift(ptr);
+class FfiConverterMoqRoute {
+  static MoqRoute lift(Pointer<Void> ptr) {
+    return MoqRoute.lift(ptr);
   }
 
-  static Pointer<Void> lower(MoqPublication value) {
+  static Pointer<Void> lower(MoqRoute value) {
     return value.uniffiClonePointer();
   }
 
-  static int allocationSize(MoqPublication value) {
+  static int allocationSize(MoqRoute value) {
     return 8;
   }
 
-  static LiftRetVal<MoqPublication> read(Uint8List buf) {
+  static LiftRetVal<MoqRoute> read(Uint8List buf) {
     final handle = buf.buffer.asByteData(buf.offsetInBytes).getInt64(0);
     final pointer = Pointer<Void>.fromAddress(handle);
-    return LiftRetVal(MoqPublication.lift(pointer), 8);
+    return LiftRetVal(MoqRoute.lift(pointer), 8);
   }
 
-  static int write(MoqPublication value, Uint8List buf) {
+  static int write(MoqRoute value, Uint8List buf) {
     final handle = lower(value);
     buf.buffer.asByteData(buf.offsetInBytes).setInt64(0, handle.address);
     return 8;
@@ -16958,6 +16837,55 @@ class FfiConverterOptionalMoqBroadcastConsumer {
   }
 }
 
+class FfiConverterOptionalMoqBroadcastRequest {
+  static MoqBroadcastRequest? lift(RustBuffer buf) {
+    return FfiConverterOptionalMoqBroadcastRequest.read(
+      buf.asUint8List(),
+    ).value;
+  }
+
+  static LiftRetVal<MoqBroadcastRequest?> read(Uint8List buf) {
+    if (ByteData.view(buf.buffer, buf.offsetInBytes).getInt8(0) == 0) {
+      return LiftRetVal(null, 1);
+    }
+    final result = FfiConverterMoqBroadcastRequest.read(
+      Uint8List.view(buf.buffer, buf.offsetInBytes + 1),
+    );
+    return LiftRetVal<MoqBroadcastRequest?>(result.value, result.bytesRead + 1);
+  }
+
+  static int allocationSize([MoqBroadcastRequest? value]) {
+    if (value == null) {
+      return 1;
+    }
+    return FfiConverterMoqBroadcastRequest.allocationSize(value) + 1;
+  }
+
+  static RustBuffer lower(MoqBroadcastRequest? value) {
+    if (value == null) {
+      return toRustBuffer(Uint8List.fromList([0]));
+    }
+    final buf = Uint8List(
+      FfiConverterOptionalMoqBroadcastRequest.allocationSize(value),
+    );
+    FfiConverterOptionalMoqBroadcastRequest.write(value, buf);
+    return toRustBuffer(buf);
+  }
+
+  static int write(MoqBroadcastRequest? value, Uint8List buf) {
+    if (value == null) {
+      buf[0] = 0;
+      return 1;
+    }
+    buf[0] = 1;
+    return FfiConverterMoqBroadcastRequest.write(
+          value,
+          Uint8List.view(buf.buffer, buf.offsetInBytes + 1),
+        ) +
+        1;
+  }
+}
+
 class FfiConverterOptionalMoqCatalog {
   static MoqCatalog? lift(RustBuffer buf) {
     return FfiConverterOptionalMoqCatalog.read(buf.asUint8List()).value;
@@ -20803,38 +20731,6 @@ external Pointer<Void> uniffi_moq_ffi_fn_method_moqannounceconsumer_next(
   Pointer<Void> ptr,
 );
 
-@Native<Pointer<Void> Function(Pointer<Void>, Pointer<RustCallStatus>)>(
-  assetId: _uniffiAssetId,
-)
-external Pointer<Void> uniffi_moq_ffi_fn_clone_moqbroadcastprepared(
-  Pointer<Void> handle,
-  Pointer<RustCallStatus> uniffiStatus,
-);
-
-@Native<Void Function(Pointer<Void>, Pointer<RustCallStatus>)>(
-  assetId: _uniffiAssetId,
-)
-external void uniffi_moq_ffi_fn_free_moqbroadcastprepared(
-  Pointer<Void> handle,
-  Pointer<RustCallStatus> uniffiStatus,
-);
-
-@Native<Pointer<Void> Function(Pointer<Void>, Pointer<RustCallStatus>)>(
-  assetId: _uniffiAssetId,
-)
-external Pointer<Void> uniffi_moq_ffi_fn_method_moqbroadcastprepared_broadcast(
-  Pointer<Void> ptr,
-  Pointer<RustCallStatus> uniffiStatus,
-);
-
-@Native<Pointer<Void> Function(Pointer<Void>, Pointer<RustCallStatus>)>(
-  assetId: _uniffiAssetId,
-)
-external Pointer<Void> uniffi_moq_ffi_fn_method_moqbroadcastprepared_publish(
-  Pointer<Void> ptr,
-  Pointer<RustCallStatus> uniffiStatus,
-);
-
 @Native<Pointer<Void> Function(Pointer<Void>, Pointer<RustCallStatus>)>(
   assetId: _uniffiAssetId,
 )
@@ -20859,20 +20755,21 @@ external RustBuffer uniffi_moq_ffi_fn_method_moqbroadcastrequest_path(
   Pointer<RustCallStatus> uniffiStatus,
 );
 
-@Native<Pointer<Void> Function(Pointer<Void>, Pointer<RustCallStatus>)>(
+@Native<Void Function(Pointer<Void>, Uint16, Pointer<RustCallStatus>)>(
   assetId: _uniffiAssetId,
 )
-external Pointer<Void> uniffi_moq_ffi_fn_method_moqbroadcastrequest_prepare(
+external void uniffi_moq_ffi_fn_method_moqbroadcastrequest_reject(
   Pointer<Void> ptr,
+  int error_code,
   Pointer<RustCallStatus> uniffiStatus,
 );
 
-@Native<Void Function(Pointer<Void>, Uint16, Pointer<RustCallStatus>)>(
-  assetId: _uniffiAssetId,
-)
-external void uniffi_moq_ffi_fn_method_moqbroadcastrequest_reject(
+@Native<
+  Pointer<Void> Function(Pointer<Void>, RustBuffer, Pointer<RustCallStatus>)
+>(assetId: _uniffiAssetId)
+external Pointer<Void> uniffi_moq_ffi_fn_method_moqbroadcastrequest_route(
   Pointer<Void> ptr,
-  int error_code,
+  RustBuffer options,
   Pointer<RustCallStatus> uniffiStatus,
 );
 
@@ -20996,28 +20893,39 @@ external Pointer<Void> uniffi_moq_ffi_fn_method_moqoriginproducer_consume(
 );
 
 @Native<
-  Pointer<Void> Function(Pointer<Void>, RustBuffer, Pointer<RustCallStatus>)
+  Pointer<Void> Function(
+    Pointer<Void>,
+    RustBuffer,
+    RustBuffer,
+    Pointer<RustCallStatus>,
+  )
 >(assetId: _uniffiAssetId)
-external Pointer<Void>
-uniffi_moq_ffi_fn_method_moqoriginproducer_create_broadcast(
+external Pointer<Void> uniffi_moq_ffi_fn_method_moqoriginproducer_route(
   Pointer<Void> ptr,
   RustBuffer path,
+  RustBuffer options,
   Pointer<RustCallStatus> uniffiStatus,
 );
 
 @Native<
-  Pointer<Void> Function(Pointer<Void>, RustBuffer, Pointer<RustCallStatus>)
+  Pointer<Void> Function(
+    Pointer<Void>,
+    RustBuffer,
+    RustBuffer,
+    Pointer<RustCallStatus>,
+  )
 >(assetId: _uniffiAssetId)
-external Pointer<Void> uniffi_moq_ffi_fn_method_moqoriginproducer_requests(
+external Pointer<Void> uniffi_moq_ffi_fn_method_moqoriginproducer_route_prefix(
   Pointer<Void> ptr,
   RustBuffer prefix,
+  RustBuffer options,
   Pointer<RustCallStatus> uniffiStatus,
 );
 
 @Native<Pointer<Void> Function(Pointer<Void>, Pointer<RustCallStatus>)>(
   assetId: _uniffiAssetId,
 )
-external Pointer<Void> uniffi_moq_ffi_fn_clone_moqoriginrequests(
+external Pointer<Void> uniffi_moq_ffi_fn_clone_moqroute(
   Pointer<Void> handle,
   Pointer<RustCallStatus> uniffiStatus,
 );
@@ -21025,7 +20933,7 @@ external Pointer<Void> uniffi_moq_ffi_fn_clone_moqoriginrequests(
 @Native<Void Function(Pointer<Void>, Pointer<RustCallStatus>)>(
   assetId: _uniffiAssetId,
 )
-external void uniffi_moq_ffi_fn_free_moqoriginrequests(
+external void uniffi_moq_ffi_fn_free_moqroute(
   Pointer<Void> handle,
   Pointer<RustCallStatus> uniffiStatus,
 );
@@ -21033,54 +20941,53 @@ external void uniffi_moq_ffi_fn_free_moqoriginrequests(
 @Native<Void Function(Pointer<Void>, Pointer<RustCallStatus>)>(
   assetId: _uniffiAssetId,
 )
-external void uniffi_moq_ffi_fn_method_moqoriginrequests_cancel(
+external void uniffi_moq_ffi_fn_method_moqroute_announce(
   Pointer<Void> ptr,
   Pointer<RustCallStatus> uniffiStatus,
 );
 
-@Native<Pointer<Void> Function(Pointer<Void>)>(assetId: _uniffiAssetId)
-external Pointer<Void>
-uniffi_moq_ffi_fn_method_moqoriginrequests_requested_broadcast(
-  Pointer<Void> ptr,
-);
-
 @Native<Pointer<Void> Function(Pointer<Void>, Pointer<RustCallStatus>)>(
   assetId: _uniffiAssetId,
 )
-external Pointer<Void> uniffi_moq_ffi_fn_clone_moqpublication(
-  Pointer<Void> handle,
+external Pointer<Void> uniffi_moq_ffi_fn_method_moqroute_broadcast(
+  Pointer<Void> ptr,
   Pointer<RustCallStatus> uniffiStatus,
 );
 
 @Native<Void Function(Pointer<Void>, Pointer<RustCallStatus>)>(
   assetId: _uniffiAssetId,
 )
-external void uniffi_moq_ffi_fn_free_moqpublication(
-  Pointer<Void> handle,
+external void uniffi_moq_ffi_fn_method_moqroute_cancel(
+  Pointer<Void> ptr,
   Pointer<RustCallStatus> uniffiStatus,
 );
 
-@Native<Void Function(Pointer<Void>, RustBuffer, Pointer<RustCallStatus>)>(
+@Native<RustBuffer Function(Pointer<Void>, Pointer<RustCallStatus>)>(
   assetId: _uniffiAssetId,
 )
-external void uniffi_moq_ffi_fn_method_moqpublication_announce(
+external RustBuffer uniffi_moq_ffi_fn_method_moqroute_instance_id(
   Pointer<Void> ptr,
-  RustBuffer route,
   Pointer<RustCallStatus> uniffiStatus,
 );
 
-@Native<Pointer<Void> Function(Pointer<Void>, Pointer<RustCallStatus>)>(
+@Native<Pointer<Void> Function(Pointer<Void>)>(assetId: _uniffiAssetId)
+external Pointer<Void> uniffi_moq_ffi_fn_method_moqroute_requested(
+  Pointer<Void> ptr,
+);
+
+@Native<Void Function(Pointer<Void>, Uint64, Pointer<RustCallStatus>)>(
   assetId: _uniffiAssetId,
 )
-external Pointer<Void> uniffi_moq_ffi_fn_method_moqpublication_broadcast(
+external void uniffi_moq_ffi_fn_method_moqroute_set_cost(
   Pointer<Void> ptr,
+  int cost,
   Pointer<RustCallStatus> uniffiStatus,
 );
 
 @Native<Void Function(Pointer<Void>, Pointer<RustCallStatus>)>(
   assetId: _uniffiAssetId,
 )
-external void uniffi_moq_ffi_fn_method_moqpublication_unannounce(
+external void uniffi_moq_ffi_fn_method_moqroute_withdraw(
   Pointer<Void> ptr,
   Pointer<RustCallStatus> uniffiStatus,
 );
@@ -22835,20 +22742,14 @@ external int uniffi_moq_ffi_checksum_method_moqannounceconsumer_cancel();
 @Native<Uint16 Function()>(assetId: _uniffiAssetId)
 external int uniffi_moq_ffi_checksum_method_moqannounceconsumer_next();
 
-@Native<Uint16 Function()>(assetId: _uniffiAssetId)
-external int uniffi_moq_ffi_checksum_method_moqbroadcastprepared_broadcast();
-
-@Native<Uint16 Function()>(assetId: _uniffiAssetId)
-external int uniffi_moq_ffi_checksum_method_moqbroadcastprepared_publish();
-
 @Native<Uint16 Function()>(assetId: _uniffiAssetId)
 external int uniffi_moq_ffi_checksum_method_moqbroadcastrequest_path();
 
 @Native<Uint16 Function()>(assetId: _uniffiAssetId)
-external int uniffi_moq_ffi_checksum_method_moqbroadcastrequest_prepare();
+external int uniffi_moq_ffi_checksum_method_moqbroadcastrequest_reject();
 
 @Native<Uint16 Function()>(assetId: _uniffiAssetId)
-external int uniffi_moq_ffi_checksum_method_moqbroadcastrequest_reject();
+external int uniffi_moq_ffi_checksum_method_moqbroadcastrequest_route();
 
 @Native<Uint16 Function()>(assetId: _uniffiAssetId)
 external int uniffi_moq_ffi_checksum_method_moqbroadcastrequest_serve();
@@ -22872,27 +22773,31 @@ external int uniffi_moq_ffi_checksum_method_moqoriginconsumer_request();
 external int uniffi_moq_ffi_checksum_method_moqoriginproducer_consume();
 
 @Native<Uint16 Function()>(assetId: _uniffiAssetId)
-external int
-uniffi_moq_ffi_checksum_method_moqoriginproducer_create_broadcast();
+external int uniffi_moq_ffi_checksum_method_moqoriginproducer_route();
 
 @Native<Uint16 Function()>(assetId: _uniffiAssetId)
-external int uniffi_moq_ffi_checksum_method_moqoriginproducer_requests();
+external int uniffi_moq_ffi_checksum_method_moqoriginproducer_route_prefix();
 
 @Native<Uint16 Function()>(assetId: _uniffiAssetId)
-external int uniffi_moq_ffi_checksum_method_moqoriginrequests_cancel();
+external int uniffi_moq_ffi_checksum_method_moqroute_announce();
 
 @Native<Uint16 Function()>(assetId: _uniffiAssetId)
-external int
-uniffi_moq_ffi_checksum_method_moqoriginrequests_requested_broadcast();
+external int uniffi_moq_ffi_checksum_method_moqroute_broadcast();
 
 @Native<Uint16 Function()>(assetId: _uniffiAssetId)
-external int uniffi_moq_ffi_checksum_method_moqpublication_announce();
+external int uniffi_moq_ffi_checksum_method_moqroute_cancel();
 
 @Native<Uint16 Function()>(assetId: _uniffiAssetId)
-external int uniffi_moq_ffi_checksum_method_moqpublication_broadcast();
+external int uniffi_moq_ffi_checksum_method_moqroute_instance_id();
 
 @Native<Uint16 Function()>(assetId: _uniffiAssetId)
-external int uniffi_moq_ffi_checksum_method_moqpublication_unannounce();
+external int uniffi_moq_ffi_checksum_method_moqroute_requested();
+
+@Native<Uint16 Function()>(assetId: _uniffiAssetId)
+external int uniffi_moq_ffi_checksum_method_moqroute_set_cost();
+
+@Native<Uint16 Function()>(assetId: _uniffiAssetId)
+external int uniffi_moq_ffi_checksum_method_moqroute_withdraw();
 
 @Native<Uint16 Function()>(assetId: _uniffiAssetId)
 external int
@@ -23648,23 +23553,16 @@ void _checkApiChecksums() {
   if (uniffi_moq_ffi_checksum_method_moqannounceconsumer_next() != 38311) {
     throw UniffiInternalError.panicked("UniFFI API checksum mismatch");
   }
-  if (uniffi_moq_ffi_checksum_method_moqbroadcastprepared_broadcast() !=
-      42363) {
-    throw UniffiInternalError.panicked("UniFFI API checksum mismatch");
-  }
-  if (uniffi_moq_ffi_checksum_method_moqbroadcastprepared_publish() != 60136) {
-    throw UniffiInternalError.panicked("UniFFI API checksum mismatch");
-  }
   if (uniffi_moq_ffi_checksum_method_moqbroadcastrequest_path() != 6534) {
     throw UniffiInternalError.panicked("UniFFI API checksum mismatch");
   }
-  if (uniffi_moq_ffi_checksum_method_moqbroadcastrequest_prepare() != 45877) {
+  if (uniffi_moq_ffi_checksum_method_moqbroadcastrequest_reject() != 9727) {
     throw UniffiInternalError.panicked("UniFFI API checksum mismatch");
   }
-  if (uniffi_moq_ffi_checksum_method_moqbroadcastrequest_reject() != 9727) {
+  if (uniffi_moq_ffi_checksum_method_moqbroadcastrequest_route() != 16046) {
     throw UniffiInternalError.panicked("UniFFI API checksum mismatch");
   }
-  if (uniffi_moq_ffi_checksum_method_moqbroadcastrequest_serve() != 16802) {
+  if (uniffi_moq_ffi_checksum_method_moqbroadcastrequest_serve() != 2580) {
     throw UniffiInternalError.panicked("UniFFI API checksum mismatch");
   }
   if (uniffi_moq_ffi_checksum_method_moqfollowing_available() != 26337) {
@@ -23685,27 +23583,31 @@ void _checkApiChecksums() {
   if (uniffi_moq_ffi_checksum_method_moqoriginproducer_consume() != 52357) {
     throw UniffiInternalError.panicked("UniFFI API checksum mismatch");
   }
-  if (uniffi_moq_ffi_checksum_method_moqoriginproducer_create_broadcast() !=
-      43708) {
+  if (uniffi_moq_ffi_checksum_method_moqoriginproducer_route() != 27041) {
+    throw UniffiInternalError.panicked("UniFFI API checksum mismatch");
+  }
+  if (uniffi_moq_ffi_checksum_method_moqoriginproducer_route_prefix() != 3472) {
+    throw UniffiInternalError.panicked("UniFFI API checksum mismatch");
+  }
+  if (uniffi_moq_ffi_checksum_method_moqroute_announce() != 46977) {
     throw UniffiInternalError.panicked("UniFFI API checksum mismatch");
   }
-  if (uniffi_moq_ffi_checksum_method_moqoriginproducer_requests() != 8499) {
+  if (uniffi_moq_ffi_checksum_method_moqroute_broadcast() != 31588) {
     throw UniffiInternalError.panicked("UniFFI API checksum mismatch");
   }
-  if (uniffi_moq_ffi_checksum_method_moqoriginrequests_cancel() != 18954) {
+  if (uniffi_moq_ffi_checksum_method_moqroute_cancel() != 41411) {
     throw UniffiInternalError.panicked("UniFFI API checksum mismatch");
   }
-  if (uniffi_moq_ffi_checksum_method_moqoriginrequests_requested_broadcast() !=
-      47029) {
+  if (uniffi_moq_ffi_checksum_method_moqroute_instance_id() != 18728) {
     throw UniffiInternalError.panicked("UniFFI API checksum mismatch");
   }
-  if (uniffi_moq_ffi_checksum_method_moqpublication_announce() != 60624) {
+  if (uniffi_moq_ffi_checksum_method_moqroute_requested() != 49558) {
     throw UniffiInternalError.panicked("UniFFI API checksum mismatch");
   }
-  if (uniffi_moq_ffi_checksum_method_moqpublication_broadcast() != 38236) {
+  if (uniffi_moq_ffi_checksum_method_moqroute_set_cost() != 30911) {
     throw UniffiInternalError.panicked("UniFFI API checksum mismatch");
   }
-  if (uniffi_moq_ffi_checksum_method_moqpublication_unannounce() != 21154) {
+  if (uniffi_moq_ffi_checksum_method_moqroute_withdraw() != 4611) {
     throw UniffiInternalError.panicked("UniFFI API checksum mismatch");
   }
   if (uniffi_moq_ffi_checksum_method_moqbroadcastproducer_create_datagrams() !=
@@ -24065,7 +23967,7 @@ void _checkApiChecksums() {
   if (uniffi_moq_ffi_checksum_constructor_moqoriginproducer_new() != 48126) {
     throw UniffiInternalError.panicked("UniFFI API checksum mismatch");
   }
-  if (uniffi_moq_ffi_checksum_constructor_moqbroadcastproducer_new() != 12099) {
+  if (uniffi_moq_ffi_checksum_constructor_moqbroadcastproducer_new() != 2448) {
     throw UniffiInternalError.panicked("UniFFI API checksum mismatch");
   }
   if (uniffi_moq_ffi_checksum_constructor_moqserver_new() != 49910) {
diff --git a/dart/moq_ffi/test/future_test.dart b/dart/moq_ffi/test/future_test.dart
index 92d8d311bdb..62e154c4ff9 100644
--- a/dart/moq_ffi/test/future_test.dart
+++ b/dart/moq_ffi/test/future_test.dart
@@ -137,12 +137,15 @@ void main() {
       await pending.cancel();
       await error;
       final next = cursor.next();
-      final publication = origin.createBroadcast(path: 'still-listening');
+      final route = origin.route(
+        path: 'still-listening',
+        options: MoqRouteOptions(),
+      );
       try {
-        publication.announce(route: MoqAnnounceRoute());
         expect(await next, isA<PresentMoqAnnounceEvent>());
       } finally {
-        publication.broadcast().close();
+        route.broadcast().close();
+        route.dispose();
       }
     } finally {
       cursor.cancel();
diff --git a/demo/carla/sim/moq_carla_sim/main.py b/demo/carla/sim/moq_carla_sim/main.py
index 91e2ce38fa1..88585fb09d0 100644
--- a/demo/carla/sim/moq_carla_sim/main.py
+++ b/demo/carla/sim/moq_carla_sim/main.py
@@ -241,11 +241,11 @@ async def run(args: argparse.Namespace) -> None:
             async with moq.connect(args.url) as client:
                 try:
                     for truck in world.trucks:
-                        publication = client.create_broadcast(broadcast_path(truck.name, args.camera))
+                        route = client.route(broadcast_path(truck.name, args.camera), hidden=True)
                         video = await bridge.open(
-                            bridge_stream(truck.name, args.camera), renditions(camera), publication.broadcast
+                            bridge_stream(truck.name, args.camera), renditions(camera), route.broadcast
                         )
-                        session = TruckSession(truck, publication, video, args.location, map_name, world.clock)
+                        session = TruckSession(truck, route, video, args.location, map_name, world.clock)
                         sessions.append(session)
                         log.info(
                             "publishing %s, consuming %s/*",
diff --git a/demo/carla/sim/moq_carla_sim/runtime.py b/demo/carla/sim/moq_carla_sim/runtime.py
index 48c519fa27d..51aceae2e6b 100644
--- a/demo/carla/sim/moq_carla_sim/runtime.py
+++ b/demo/carla/sim/moq_carla_sim/runtime.py
@@ -93,19 +93,21 @@ class TruckSession:
     def __init__(
         self,
         truck: Truck,
-        publication: moq.Publication,
+        route: moq.Route,
         video: BridgeStream,
         location: str | None,
         map_name: str | None,
         clock: Clock,
     ) -> None:
         self._truck = truck
+        # Held for the session's lifetime: dropping the route retracts the broadcast.
+        self._route = route
         self._video = video
         self._clock = clock
         self._location = location
         self._map_name = map_name
         self._drive = Drive()
-        self._status = StatusPublisher(publication.broadcast)
+        self._status = StatusPublisher(route.broadcast)
         # Bounded: drivers are untrusted publishers, so an unbounded queue is a
         # memory-growth path under one that floods; a full queue instead blocks
         # that driver's own task.
@@ -113,12 +115,12 @@ def __init__(
         self._media_pipeline: dict[str, list[dict[str, Any]]] = {}
         self._deadline: float | None = None
         self._stuck = StuckDetector()
-        # A broadcast starts unadvertised; the player discovers trucks by
-        # announcement, so advertise once the status and video tracks exist.
-        # The stream's are there already: opening it advertised them. The
-        # broadcast mints a fresh instance, so viewers see a restarted worker
-        # as a restart rather than a stalled broadcast.
-        publication.announce()
+        # The route starts hidden; the player discovers trucks by announcement,
+        # so advertise once the status and video tracks exist. The stream's are
+        # there already: opening it advertised them. The route mints a fresh
+        # instance, so viewers see a restarted worker as a restart rather than
+        # a stalled broadcast.
+        route.announce()
 
     def stop_video(self) -> None:
         """End the video tracks cleanly and stop the bridge encoding them."""
diff --git a/demo/carla/sim/tests/test_runtime.py b/demo/carla/sim/tests/test_runtime.py
index 61a73a1e333..cfa4b76d015 100644
--- a/demo/carla/sim/tests/test_runtime.py
+++ b/demo/carla/sim/tests/test_runtime.py
@@ -534,10 +534,10 @@ def respawn() -> None:
 
 
 def test_session_announces_after_populating_tracks() -> None:
-    """The player lists trucks from announcements, and a broadcast starts
-    unadvertised, so a session that never announces is invisible."""
+    """The player lists trucks from announcements, and the route starts hidden,
+    so a session that never announces is invisible."""
     calls: list[object] = []
-    publication = SimpleNamespace(
+    route = SimpleNamespace(
         broadcast=SimpleNamespace(
             publish_track=lambda name, info=None: calls.append(name) or SimpleNamespace(demand=SimpleNamespace)
         ),
@@ -545,7 +545,7 @@ def test_session_announces_after_populating_tracks() -> None:
     )
 
     # The video tracks were advertised when the bridge stream opened.
-    runtime.TruckSession(SimpleNamespace(name="truck1"), publication, SimpleNamespace(), None, None, FakeClock())
+    runtime.TruckSession(SimpleNamespace(name="truck1"), route, SimpleNamespace(), None, None, FakeClock())
 
     assert calls == ["status", "announce"]
 
diff --git a/demo/carla/web/src/truck.ts b/demo/carla/web/src/truck.ts
index e16c27b7eeb..cbba17bf2ce 100644
--- a/demo/carla/web/src/truck.ts
+++ b/demo/carla/web/src/truck.ts
@@ -414,8 +414,8 @@ export class Truck {
 		const driverId = crypto.randomUUID().replaceAll("-", "").slice(0, 12);
 		this.driverId.set(driverId);
 
-		const driverBroadcastPublication = conn.createBroadcast(driverPath(this.name, driverId));
-		const driverBroadcast = driverBroadcastPublication.broadcast;
+		const driverBroadcastRoute = conn.route(driverPath(this.name, driverId), { hidden: true });
+		const driverBroadcast = driverBroadcastRoute.broadcast;
 		effect.cleanup(() => {
 			driverBroadcast.close();
 			this.driverId.set(undefined);
@@ -429,7 +429,7 @@ export class Truck {
 		effect.run(this.#runControlTrack.bind(this, track, producer));
 		// A fresh instance per lease, which each publication mints: the truck binds its single
 		// driver to this path and instance.
-		driverBroadcastPublication.announce();
+		driverBroadcastRoute.announce();
 	}
 
 	#runSafetyControl(connection: Moq.Connection, effect: Moq.Signals.Effect) {
@@ -438,10 +438,10 @@ export class Truck {
 		if (!conn || !command) return;
 
 		const driverId = `safety-${crypto.randomUUID().replaceAll("-", "").slice(0, 12)}`;
-		const broadcastPublication = conn.createBroadcast(driverPath(this.name, driverId));
-		const broadcast = broadcastPublication.broadcast;
+		const broadcastRoute = conn.route(driverPath(this.name, driverId), { hidden: true });
+		const broadcast = broadcastRoute.broadcast;
 		const safety = new SafetyCommandBroadcast(command, broadcast);
-		broadcastPublication.announce();
+		broadcastRoute.announce();
 		effect.cleanup(() => safety.close());
 	}
 
diff --git a/doc/bin/obs.md b/doc/bin/obs.md
index d16f18be7cb..72fbabe86da 100644
--- a/doc/bin/obs.md
+++ b/doc/bin/obs.md
@@ -12,7 +12,7 @@ OBS Studio install.
 - **Subscribe**: add a "MoQ Source", enter the relay URL and broadcast path, and the stream appears in the scene.
 - **Dock**: a **MoQ** dock with Go Live, encoding that uses the OBS Output settings or custom settings for this stream only, and live stats (protocol, RTT, bandwidth, loss), and the reason while a stream connects or reconnects.
 
-Each Start Streaming publishes under a fresh instance. The client's automatic
+Each Start Streaming publishes under a fresh instance, which the dock shows. The client's automatic
 reconnects keep the same instance. A
 stop/start, or an OBS auto-reconnect after the client gives up, republishes
 the broadcast under a new instance, which viewers see as a new stream.
diff --git a/doc/concept/identity.md b/doc/concept/identity.md
index 681c50d54c4..5b2ac5021cb 100644
--- a/doc/concept/identity.md
+++ b/doc/concept/identity.md
@@ -173,26 +173,28 @@ already served, start a new prefix route. Its first subscription stays on
 the prefix route without a restart.
 
 A job that may restart independently, such as a transcoder claiming
-`transcode`, instead prepares and publishes each requested path. A claim
+`transcode`, instead creates each requested path's own exact route. A claim
 promises capability, not content. Each requested path is a separate job,
 announced at its exact path under a fresh instance of its own.
 
 ```rust
-let claim = origin.requests("transcode")?;
-while let Ok(request) = claim.requested_broadcast().await {
+let claim = origin.route_prefix("transcode", RouteOptions::default())?;
+while let Some(request) = claim.requested().await {
     // A fresh instance for this job, never one shared with another path or run.
-    let prepared = request.prepare()?;
-    let video = prepared.broadcast().create_track("video", info.clone())?;
+    // Hidden until its tracks exist.
+    let job = request.route(RouteOptions::hidden())?;
+    let video = job.broadcast().create_track("video", info.clone())?;
     // Announces the exact path under that instance and answers the waiting request.
-    let output = prepared.publish()?;
-    spawn(run_job(video, output));
+    job.announce()?;
+    spawn(run_job(video, job));
 }
 ```
 
-JavaScript mirrors this with `request.prepare()` and `prepared.publish()`;
-see [`@moq/net`](/lib/js/net) and [`moq-net`](/lib/rs/moq-net).
-A prepared answer is unannounced until published, and dropping it unpublished
-refuses the request.
+JavaScript mirrors this with `request.route({ hidden: true })` and
+`job.announce()`; see [`@moq/net`](/lib/js/net) and [`moq-net`](/lib/rs/moq-net).
+A hidden job route is unannounced until it announces, and dropping it before
+then refuses the request. Ending a job's route withdraws only its path: the
+prefix route keeps answering later requests.
 
 A lazy job's lifecycle, as a viewer of `transcode/alice` sees it through a relay:
 
@@ -212,7 +214,7 @@ A lazy job's lifecycle, as a viewer of `transcode/alice` sees it through a relay
    second request reaches job A.
 3. **Steady state.** Requests resolve instance A by its exact route. Routes
    carrying instance A through other relays fail over without a seam.
-4. **Job restart.** The worker closes job A's publication. The path falls back
+4. **Job restart.** The worker drops job A's route. The path falls back
    to the claim, the next request asks the worker again, and job B publishes
    under a fresh instance. Followers are handed each new broadcast; relays drop
    job A's cached groups, so a viewer returning within the cache window never
diff --git a/doc/lib/c/index.md b/doc/lib/c/index.md
index 10ee8b867f6..9bd3e9c4f3f 100644
--- a/doc/lib/c/index.md
+++ b/doc/lib/c/index.md
@@ -68,27 +68,31 @@ if (session < 0)
 
 ```c
 const char *path = "my-stream.hang";
-uint32_t broadcast;
-int publication = moq_origin_create_broadcast(origin, path, strlen(path), &broadcast);
-if (publication < 0)
+moq_route_options options;
+memset(&options, 0, sizeof(options)); // zeroed means visible, cost 0, a fresh instance
+options.hidden = true;                // fill the catalog before anyone finds it
+int route = moq_origin_route(origin, path, strlen(path), &options);
+if (route < 0)
     return fail(moq_error());
-// Fill tracks on broadcast here; announce on the publication.
-
-moq_announce_route route;
-memset(&route, 0, sizeof(route));     // zeroed means cost 0 and the minted instance
-if (moq_publication_announce((uint32_t)publication, &route) < 0)
+int broadcast = moq_route_broadcast((uint32_t)route);
+// Fill tracks on broadcast here, then make the route visible.
+if (moq_route_announce((uint32_t)route) < 0)
     return fail(moq_error());
 ```
 
-A route carries only a cost and the stream's instance; relays add the hops. Each
-publication mints a fresh instance and keeps it across re-announcing, so a restarted
-publisher is a new stream that `moq_origin_follow` hands viewers instead of a stalled
+The route keeps the broadcast announced: `moq_route_free()` retracts it, and
+`moq_publish_close()` ends both. A route carries only a cost and the stream's instance;
+relays add the hops. Each route mints a fresh instance (`moq_route_instance()`) and keeps it
+across `moq_route_withdraw()` and `moq_route_announce()`, so a restarted publisher, being a
+new route, is a new stream that `moq_origin_follow` hands viewers instead of a stalled
 broadcast; the path stays `MOQ_ANNOUNCE_KIND_PRESENT` throughout. The follow callback
 reports each instance as `MOQ_FOLLOW_EVENT_ONLINE` with its handle,
 `MOQ_FOLLOW_EVENT_OFFLINE` when the path goes offline, and one `MOQ_FOLLOW_EVENT_END`. Set `instance` only for a publisher that continues its group sequences
 across restarts, and raise `epoch` on each: readers stitch every route of one instance
 together, so restarting the sequences under an old instance splices unrelated groups into
-their tracks.
+their tracks. To serve paths on demand, `moq_origin_route_prefix()` delivers each request to
+answer with `moq_broadcast_request_serve()`, `moq_broadcast_request_route()`, or
+`moq_broadcast_request_reject()`.
 
 Raw video encoders take an exact numerator/denominator frame rate, such as 30000/1001. Publication track names stay separate from codec settings. For simulcast, give each rendition the next one down as the `lower` handle in its `moq_video_encode_options`: it stops encoding, advertised as disabled, while its bandwidth grant cannot fund it, and resumes once the grant recovers. A rung only disables while the session probes for bandwidth, which on native transports takes moq-quic with BBR3. For pre-encoded video, publish from the lowest rendition up and set `moq_video_init.lower` to the next lower media handle. Reserve each track with `moq_allocator_reserve_media`, then bind its reservation with `moq_rate_control_create` and call `moq_rate_control_update` on every frame. Apply changed targets to your encoder and `moq_publish_media_set_enabled`, resuming video on a keyframe; close the control and reservation separately when done.
 
@@ -110,7 +114,7 @@ inside. The header is the reference: each function carries a doc comment.
 - **Audio needs cuts.** Video groups at its keyframes, but audio forms a group only where you call `moq_publish_media_cut`: after every frame, or less often to batch frames into fewer groups. Pass that cadence as `moq_audio_init.hint.group_duration_us`.
 - **Catalog hints.** Give the catalog what the encoder knows instead of having it estimated: `moq_video_init.hint` (coded size, bitrate, frame rate, group duration) and `moq_audio_init.hint` (bitrate, group duration). A supplied bitrate is never re-estimated. `group_duration_us` is the longest span between two group starts: the GOP, or your cut cadence. Leave a field's `has_*` flag false to have it measured. A bitrate or `group_duration_us` flag set with a 0 value returns `MOQ_ERROR_INVALID_CONFIG`.
 - **Discovery.** Announcement captures are always a list of wildcard matches, empty when the filter has no wildcards.
-- **Ending cleanly.** When the input ends, finish every track, then call `moq_publish_catalog_finish()` to finish the catalog, which ends the content. The broadcast stays announced and keeps serving the finished tracks, so a subscriber still catching up can drain them, until `moq_publish_close()` takes it offline. How long to keep it up is yours to decide. A track still open at the close ends with `UNROUTABLE` (an internal error over moq-transport, which has no such code), and its handle is released. Readers follow a publisher's runs by announcement, not by that error: see [identity and recovery](/concept/identity).
+- **Ending cleanly.** When the input ends, finish every track, then call `moq_publish_catalog_finish()` to finish the catalog, which ends the content. The broadcast stays announced and keeps serving the finished tracks, so a subscriber still catching up can drain them, until `moq_publish_close()` or `moq_route_free()` takes it offline. How long to keep it up is yours to decide. A track still open at the close ends with `UNROUTABLE` (an internal error over moq-transport, which has no such code), and its handle is released. Readers follow a publisher's runs by announcement, not by that error: see [identity and recovery](/concept/identity).
 - **Timeline breaks.** On a seek or pause, call `moq_publish_media_discontinuity`, then keep timestamps moving forward and resume video on a keyframe.
 - **Timestamps.** A `moq_timestamp` is exact: `value` units at `scale` units per second, so a 90 kHz tick survives a read and republish. Frames, datagrams, and JSON values point `timestamp` at theirs, NULL on an untimed track and valid as long as the payload. Stream tracks moq-c creates are timed, so their raw writes need one. Datagram tracks are separate and default to untimed; set their timescale when creating them to require timestamps. Stamp media frames and JSON writes from `moq_publish_catalog_now()`, the broadcast clock every track in the broadcast shares; media on a timeline of its own advertises the gap to the JSON tracks as catalog `delay`. JSON writes are converted to their track's milliseconds. A NULL timestamp on any JSON write (snapshot update, stream append, window push or pop) fails with `MOQ_ERROR_INVALID_POINTER` and publishes nothing. A zero scale or an out-of-range value fails with `MOQ_ERROR_TIMESTAMP_OVERFLOW`.
 - **JSON values.** `moq_consume_json_value` fills `moq_json_value` with the document and its frame's timestamp. A snapshot consumer's callback fires for each state in order, but a group superseded before it is read is skipped.
diff --git a/doc/lib/cpp/index.md b/doc/lib/cpp/index.md
index 62b42ad3d5e..f8fad94854b 100644
--- a/doc/lib/cpp/index.md
+++ b/doc/lib/cpp/index.md
@@ -137,8 +137,10 @@ A raw `moq::Frame` with `std::nullopt` is untimed.
 // Publish encoded frames, or raw pixels with the codec inside the binding.
 // session is connected as above; opus_init, packet, and rgba come from your
 // encoder or capture source.
-auto publication = ok(session->publish()->create_broadcast("my-stream.hang"));
-auto broadcast = publication->broadcast(); // fill tracks here; announce on the publication
+moq::RouteOptions options;
+options.hidden = true; // fill tracks before anyone finds it; hold the route to stay announced
+auto route = ok(session->publish()->route("my-stream.hang", options));
+auto broadcast = ok(route->broadcast());
 auto audio = ok(moq::MediaTrackProducer::audio(broadcast, moq::MediaTarget::kNamed{}, {moq::AudioFormat::kOpus, opus_init}));
 ok(audio->write_frame({packet, moq::Timestamp{960, 48'000}}));   // 20 ms
 
@@ -146,8 +148,8 @@ moq::VideoEncoderOutput output{moq::VideoCodec::kH264, std::nullopt, std::nullop
 auto catalog = ok(moq::MediaCatalogProducer::init(broadcast));
 auto video = ok(moq::VideoProducer::init(catalog, {{moq::VideoPixelFormat::kRgba, 1280, 720, {30000, 1001}}, output, "camera", nullptr}));
 ok(video->write({{0, 30'000}, rgba}));
-ok(publication->announce({})); // each broadcast mints a fresh instance
-ok(broadcast->close());    // keep the producer alive while publishing, then close explicitly
+ok(route->announce()); // each route mints a fresh instance, route->instance_id()
+ok(broadcast->close()); // keep the producer alive while publishing, then close explicitly
 ```
 
 Raw video encoders take an exact numerator/denominator frame rate, such as 30000/1001. Producer options hold input, codec settings, track naming, and optional session bandwidth ownership; standalone encoders take only codec settings. For simulcast, give each rendition the next one down as `lower`: it stops encoding, advertised as disabled, while its bandwidth grant cannot fund it, and resumes once the grant recovers. A rung only disables while the session probes for bandwidth, which on native transports takes moq-quic with BBR3. A pre-encoded video track takes `lower` in its `VideoInit` too, as a `moq::MediaProducer::kTrack` or `kStream`, which only places it one priority below; follow its reservation with `RateControl`, and while it reports disabled, drop the frames, call `set_enabled(false)` after a `discontinuity()`, and `set_enabled(true)` on the keyframe that resumes it. A `MediaTrackStreamProducer` finds its own frames: `set_enabled(false)` drops what is written to it, and after `set_enabled(true)` it resumes at the stream's next keyframe.
diff --git a/doc/lib/dart/index.md b/doc/lib/dart/index.md
index c5df8857bf0..dff6b40a757 100644
--- a/doc/lib/dart/index.md
+++ b/doc/lib/dart/index.md
@@ -81,7 +81,8 @@ print(await catalog.next());
 // Publish raw pixels; the binding encodes them. rgba and pts come from your capture source.
 import 'package:moq/video.dart' as video;
 
-final camera = moq.createBroadcast('live/camera');
+// Hidden until announced, so the catalog is filled before anyone finds it.
+final camera = moq.route('live/camera', options: RouteOptions(hidden: true));
 final encoder = video.Producer(
   catalog: media.CatalogProducer(broadcast: camera.broadcast()),
   options: video.ProducerOptions(
@@ -99,7 +100,7 @@ final encoder = video.Producer(
   ),
 );
 encoder.write(frame: video.Frame(timestamp: pts, data: rgba));
-camera.announce(route: AnnounceRoute());
+camera.announce();
 encoder.finish();
 ```
 
@@ -126,15 +127,15 @@ if (read is video.ReadFrame) {
 
 ```dart
 // Publish already-encoded frames. bytes comes from your encoder or application source.
-final publication = moq.createBroadcast('live/camera');
-final mine = publication.broadcast();
+final route = moq.route('live/camera'); // visible at once, under a fresh instance
+print(route.instanceId());
+final mine = route.broadcast();
 final track = mine.publishTrack(name: 'video', info: null);
 final group = track.appendGroup();
 group.writeFrame(frame: Frame(payload: bytes, timestamp: null));
 group.finish();
-publication.announce(route: AnnounceRoute()); // the broadcast mints its own instance
 track.finish();
-mine.close();
+mine.close(); // ends the route too
 
 await moq.close();
 ```
@@ -147,13 +148,14 @@ The rest of the [shared feature list](/lib/#what-every-binding-can-do) maps
 one to one; the API reference has the names, and [Layers](/lib/layers)
 shows which module holds each.
 
-- **Names.** Types drop the `Moq` prefix (`Session`, `BroadcastProducer`) as aliases, so the generated names still work. `Container`, `Route`, and the exceptions keep it, since Flutter owns those names.
+- **Names.** Types drop the `Moq` prefix (`Session`, `BroadcastProducer`, `RouteOptions`) as aliases, so the generated names still work. `MoqContainer`, `MoqRoute`, and the exceptions keep it, since Flutter owns those names.
+- **Routes.** `route(path)` publishes a broadcast and `routePrefix(prefix)` answers requests beneath a prefix, each returning a `MoqRoute`. Hold it: cancelling or disposing it retracts the route, while a broadcast handle alone does not keep it announced. It keeps its instance across `withdraw()` and `announce()`, so a new run is a new route.
 - **Audio needs cuts.** Video groups at its keyframes, but audio forms a group only where you call `cut()`: after every frame, or less often to batch frames into fewer groups.
 - **Timeline breaks.** On a seek or pause, call `discontinuity()`, then keep timestamps moving forward and resume video on a keyframe.
 - **Media reads.** `media.TrackConsumer`, `audio.Consumer`, and `video.Consumer` return a `Read` in order: a `ReadFrame`, a `ReadGap` where media was lost, or a `ReadEnd` where the publisher stopped its encoder. A gap breaks continuity. An encoder end is not stream EOF: following frames before its endpoint are the old encoder's drain; the first at or past it starts fresh. A decoder reads everything the track still holds unless a live player sets `start: media.DecodeStart.latest` in its decoder output, which joins at the newest group and skips the cached backlog.
 - **Decoded frames hold decoder buffers.** `dispose()` each frame from a `video.Consumer` promptly rather than waiting for the garbage collector, or the decoder stalls. `resize` is best effort, so read each frame's `width()` and `height()`.
 - **Closing.** `await moq.close()` drains for up to one second and reports its result. `session.shutdown()` requests the drain synchronously; `await session.closed()` waits for its result. `session.cancel(code: 0)` closes at once. Finish or abort live tracks first. Awaiting cancellation of an announcement, grant, or request subscription releases its pending native read. Announcements and grants also release their consumer; server listeners leave their shared server usable. moq-lite-05 and newer wait for the peer to receive finished tails; older Lite versions and IETF wait only for transport ACKs.
-- **Ending cleanly.** When the input ends, finish every track, then call `finish()` on its `CatalogProducer` to finish the catalog, which ends the content. The broadcast stays announced and keeps serving the finished tracks, so a subscriber still catching up can drain them, until `broadcast.close()` takes it offline; disposing its `Publication` does not. How long to keep it up is yours to decide. A track still open at the close, or released without a finish, ends with `Unroutable` (`Internal` over moq-transport, which has no such code). Readers follow a publisher's runs by announcement, not by that error: see [identity and recovery](/concept/identity).
+- **Ending cleanly.** When the input ends, finish every track, then call `finish()` on its `CatalogProducer` to finish the catalog, which ends the content. The broadcast stays announced and keeps serving the finished tracks, so a subscriber still catching up can drain them, until `broadcast.close()` or disposing its `MoqRoute` takes it offline. How long to keep it up is yours to decide. A track still open at the close, or released without a finish, ends with `Unroutable` (`Internal` over moq-transport, which has no such code). Readers follow a publisher's runs by announcement, not by that error: see [identity and recovery](/concept/identity).
 - **Stats.** `session.stats()` reports `rtt`, `estimatedSendRateBps`, and the byte and packet counters (`bytesSent`, `bytesReceived`, `bytesLost`, `packetsSent`, `packetsReceived`, `packetsLost`). A field is `null` when the transport does not report it, which is not the same as zero. `version` names the negotiated protocol. Connect returns a connecting session; read its coherent `state()` snapshot and wait with that snapshot's revision to observe first-dial failures and reconnects. Each watcher keeps its own revision. Hold the owned `BandwidthConsumer` returned by `session.recvBandwidth()` to receive bandwidth estimates. `rate()` reads the current estimate in bits per second and `rateChanged()` waits for a new one. Release the consumer or call `cancel()` when finished; releasing the last consumer stops PROBE; the session and stats snapshots do not request it. Client consumers survive reconnects and report no estimate while disconnected.
 - **Viewers.** `client.viewers()` divides the connection's receive estimate among the broadcasts you watch, max-min fair by each one's ceiling. `watch(maxBps: ...)` returns a `Viewer` claiming up to what the largest rendition the player would switch to needs; `rate()` reads its slice in bits per second, `null` while there is no estimate, so hold the current selection. `update(maxBps: ...)` changes the ceiling, such as when the catalog enables or disables a rendition. Holding a viewer requests PROBE, and the session sends the viewers' summed ceilings as the PROBE target; `dispose()` it once the broadcast stops being watched. `setTarget(targetBps: ...)` sends another target, `0` sends none, and `null` follows the viewers again. Ceilings or a target past 2^53 - 1 bps, the most a PROBE target carries, throw `OutOfRangeMoqException`. Client viewers survive reconnects and read `null` while disconnected.
 - **Authorization.** On `moq-lite-07-wip` (opt in with `ConnectOptions(versions: ...)`) and on moq-transport draft-18+ with the [MoQ Auth extension](/draft/moq-auth), listen to `moq.grants().updates()` for the `Grant` the relay sent back and each change, `null` until it answers and while a client session reconnects.
diff --git a/doc/lib/go/index.md b/doc/lib/go/index.md
index f364497668d..219ac0e1a66 100644
--- a/doc/lib/go/index.md
+++ b/doc/lib/go/index.md
@@ -94,8 +94,9 @@ import (
 
 // Publish encoded frames, or raw pixels with the codec inside the binding.
 // opusInit, packet, pts (90 kHz ticks), and rgba come from your encoder or capture source.
-publication, _ := client.CreateBroadcast("my-stream.hang")
-broadcast := publication.Broadcast()
+// Hidden until the catalog is filled; keep the route reachable while publishing.
+route, _ := client.Route("my-stream.hang", moq.RouteOptions{Hidden: true})
+broadcast, _ := route.Broadcast()
 audio, _ := moqmedia.NewAudioTrackProducer(broadcast, moqmedia.Named{}, moqmedia.AudioInit{Format: moqmedia.AudioFormatOpus, Data: opusInit})
 timestamp := moq.Timestamp{Value: 960, Scale: 48_000} // 20 ms on the Opus sample clock
 _ = audio.WriteFrame(moq.Frame{Payload: packet, Timestamp: &timestamp})
@@ -109,7 +110,7 @@ video, _ := moqvideo.NewProducer(catalogProducer, moqvideo.ProducerOptions{
     Track: &track,
 })
 _ = video.Write(moqvideo.Frame{Timestamp: moq.Timestamp{Value: pts, Scale: 90_000}, Data: rgba})
-_ = publication.Announce(moq.AnnounceRoute{}) // each broadcast mints a fresh instance
+_ = route.Announce() // each route mints a fresh instance (route.Instance())
 _ = audio.Finish()
 _ = video.Finish()
 broadcast.Close()    // keep the producer reachable while publishing, then close explicitly
@@ -124,7 +125,7 @@ one to one; the API reference has the names, and [Layers](/lib/layers)
 shows which module holds each.
 
 - **Context cancellation.** Every call that can block takes a `context.Context` first, and cancelling it tears down the native work, not just your wait. A one-shot call (`Request`, `FetchGroup`, `Server.Accept`) aborts alone; a stream read (`Next`, `ReadFrame`, and the iterators over them) cancels the stream it reads.
-- **Keep owners reachable.** An origin from `moq.NewOriginProducer` has no `Close`. It ends when the garbage collector reaches its last owner (each producer, published broadcast, and `OriginRequests`), and its consumers then fail with `moq.ErrClosed`.
+- **Keep owners reachable.** An origin from `moq.NewOriginProducer` has no `Close`. It ends when the garbage collector reaches its last owner (each producer and `Route`), and its consumers then fail with `moq.ErrClosed`. A `Route` the collector reclaims is retracted, so keep it reachable while it should stay announced, or end it with `Cancel()`.
 - **Bandwidth ownership.** An encoder you manage can reserve a share of the session's bandwidth. Reuse its reservation when the ceiling changes; before abandoning or replacing it, call `Update(0)` to return its share and automatic probe ceiling without waiting for garbage collection. The track can stay subscribed and the reservation can be reused.
 - **Audio needs cuts.** Video groups at its keyframes, but audio forms a group only where you call `Cut()`: after every frame, or less often to batch frames into fewer groups.
 - **Timeline breaks.** On a seek or pause, call `Discontinuity()`, then keep timestamps moving forward and resume video on a keyframe.
diff --git a/doc/lib/js/net.md b/doc/lib/js/net.md
index 69f64df188b..41521578862 100644
--- a/doc/lib/js/net.md
+++ b/doc/lib/js/net.md
@@ -29,19 +29,19 @@ const connection = await Moq.Connection.connect({
     consume: origin,
 });
 
-const publication = origin.createBroadcast(Moq.Path.from("chat.room"));
-const broadcast = publication.broadcast;
-const track = broadcast.createTrack("messages", { timescale: Moq.Time.Timescale.MILLI });
+// Hidden until its first track exists, then announced.
+const route = origin.route(Moq.Path.from("chat.room"), { hidden: true });
+const track = route.broadcast.createTrack("messages", { timescale: Moq.Time.Timescale.MILLI });
 const group = track.appendGroup();
 group.writeFrame({ payload: new TextEncoder().encode("hello"), timestamp: Moq.Time.Timestamp.now() });
 group.finish();
-publication.announce();
+route.announce();
 ```
 
-- **The origin holds the broadcasts, not the connection.** Closing a session unannounces them and leaves them created for the next one. A publication controls announcements; its `broadcast` fills tracks. The broadcast is invisible, locally and remotely, until the publication calls `announce()`.
-- **Answer claimed paths with `using`.** `requests(prefix)` claims a prefix and yields each requested path. Use `using prepared = request.prepare()`, fill its broadcast, then `prepared.publish()` to answer with a new stream under a fresh instance and keep the `Publication` it returns. Leaving the scope without publishing, including on a throw, refuses the request as unroutable. Explicit `prepared.close()` or closing its unpublished broadcast does the same; disposal after publishing leaves the returned publication and its fill broadcast live. Reject before preparing with `request.reject(err)`. A retained, unclosed prepared answer keeps the request pending; JavaScript garbage collection provides no prompt cleanup guarantee.
+- **The origin holds the routes, not the connection.** `origin.route(path)` creates a route that owns a new broadcast; fill its tracks through `route.broadcast`. Closing a session withdraws its announcements and leaves the routes for the next one. A route is visible at once unless created `{ hidden: true }`, which keeps it invisible, locally and remotely, until `announce()`. `withdraw()` hides it again and `announce()` brings the same stream back. `close()` retracts it and closes its broadcast, as closing the broadcast does.
+- **Answer claimed paths with a route.** `origin.routePrefix(prefix)` claims a prefix, and `route.requested()` yields each requested path. Answer with `request.route()`, a new exact route under a fresh instance, or `request.route({ hidden: true })` to fill its broadcast before `announce()` answers the requesters; closing it or its broadcast before then refuses them as unroutable, so `using job = request.route({ hidden: true })` refuses on a throw. Serve a broadcast you already hold with `request.serve(broadcast)`, or refuse with `request.reject(err)`.
 - **End content by finishing tracks.** A broadcast has no finished state. When the input ends, `finish()` each track, then `close()` it; closing a track without finishing aborts it. The broadcast stays announced and keeps serving them until you `close()` it. How long to keep it up for late readers is yours to decide.
-- **Requests can pin an instance.** `consumer.request(path, { instance })` resolves only through a route announcing that [publisher instance](/concept/moq-lite#publisher-instances). The resolved broadcast's `instance` names the stream it came through, pinned or not. A publication mints a random instance and keeps it across `announce()`; pass `announce({ instance, epoch })` only for a publisher that continues its group sequences across restarts and raises the epoch each time.
+- **Requests can pin an instance.** `consumer.request(path, { instance })` resolves only through a route announcing that [publisher instance](/concept/moq-lite#publisher-instances). The resolved broadcast's `instance` names the stream it came through, pinned or not. A route mints a random instance when it is created and keeps it across `withdraw()` and `announce()`; pass `origin.route(path, { instance, epoch })` only for a publisher that continues its group sequences across restarts and raises the epoch each time.
 - **Follow restarts.** `origin.follow(path)` follows whichever publisher instance serves the path: its `active` changes to a fresh broadcast on a restart, clears on an end, and resolves again on the next start, so read it reactively and close it when done. Instances are never stitched, so subscribe again to each new broadcast. Another route of the same instance taking over (instances travel only on `moq-lite-07-wip`; older wires mint one per announcement) keeps `active` as is, and each track subscription resumes there from the first group it lacks. A refusal ends it. Pass `{ instance }` to pin one stream, which it waits for again after an end. `request(path)` instead keeps its accepted instance and ends once that instance stops serving; while pending, it fails `Unroutable` once discovery of its path has synced without a route for it. To list what is live, iterate `announced(scope)`. See [identity and recovery](/concept/identity) to choose between following and holding one instance.
 - **Discovery follows what you watch.** A `consume` origin asks the relay for announcements only under the prefixes its readers watch with `announced(scope)`, `request(path)`, or `follow(path)`, stops asking about a prefix 2s after nothing at or beneath it is watched, and asks again on reconnect. Every request and follower watches its path from creation until closed, so it outlives the listing that found it. A relay that refuses an announce request downgrades that session: requests subscribe blind through it, and followers keep waiting for a session that can discover.
 - **Connections share by URL and versions.** `new Connection({ url })` pools and reconnects with backoff, which the elements use. An ordered `versions` list, spelled like `moq-lite-06` as in Rust, applies to both WebTransport and WebSocket; equivalent lists share, while a different order or an omitted list gets its own pool entry. Supplying your own transport options or origin selects a private loop. Receive estimates are on demand: observe `connection.probe` reactively or subscribe while you need them; `peek()` alone opens no PROBE stream.
@@ -58,7 +58,7 @@ publication.announce();
 - **Subscription defaults.** `Track.Subscription.default()` returns the default subscription, whose zero `delay.max` skips a superseded group at once; calling `subscribe()` with no options means the same. An omitted `delay` field means the same zero; `max: null` sets no subscriber limit.
 - **A subscription asks for `ranges`.** Each [range](/concept/moq-lite#subscriptions) starts and ends at an `absolute` group, one `relative` to the latest, or the group containing a `time` (a `Timestamp`), and a reader reads only its own ranges. A read whose ranges all end finishes once every group in them is handed out, dropped, or skipped, as in Rust. A time anchor needs a timed track and `moq-lite-07-wip` over a session. Passing the old `groups` key throws a `TypeError` naming `ranges`; `withRange` only narrows reads locally.
 - **Hidden paths** stay out of discovery unless the announce request opts in. See [hidden broadcasts](/concept/moq-lite#hidden-broadcasts).
-- **Authorization is in band.** On moq-lite 07 (opt in with `versions: ["moq-lite-07-wip", "moq-lite-06"]`, listing every fallback you still want) and on moq-transport draft-18+ with the [MoQ Auth extension](/draft/moq-auth), `auth.grant` watches what the relay lets this side publish and subscribe to, and `auth.add(token)` presents another token without reconnecting. Publishing outside the grant closes the connection with `SessionCode.Unauthorized`, naming the path. On moq-lite, a subscription or track listing the grant stops covering resets with `StreamCode.Unauthorized` and the session stays up. On moq-transport, `auth.add(token)` keeps the token even without the extension, and a broadcast announced with the `Auth.Credential` it returns (`publication.announce({ auth })`) carries it on that announcement's `PUBLISH_NAMESPACE`; announcing again with another renews the request. A `Connection`'s `auth` handle (a getter on a pooled connection, following its URL) outlives its sessions: a token added there is presented on every reconnect and keeps riding the announcements that name it, with no re-add or re-announce. A one-shot session's `auth` ends with it, unless `Connection.connect` was given a `new Auth.Handle()` as `auth`.
+- **Authorization is in band.** On moq-lite 07 (opt in with `versions: ["moq-lite-07-wip", "moq-lite-06"]`, listing every fallback you still want) and on moq-transport draft-18+ with the [MoQ Auth extension](/draft/moq-auth), `auth.grant` watches what the relay lets this side publish and subscribe to, and `auth.add(token)` presents another token without reconnecting. Publishing outside the grant closes the connection with `SessionCode.Unauthorized`, naming the path. On moq-lite, a subscription or track listing the grant stops covering resets with `StreamCode.Unauthorized` and the session stays up. On moq-transport, `auth.add(token)` keeps the token even without the extension, and a route created with the `Auth.Credential` it returns (`origin.route(path, { auth })`) carries it on that announcement's `PUBLISH_NAMESPACE`; `route.setAuth(other)` renews the request. A `Connection`'s `auth` handle (a getter on a pooled connection, following its URL) outlives its sessions: a token added there is presented on every reconnect and keeps riding the announcements that name it, with no re-add or re-announce. A one-shot session's `auth` ends with it, unless `Connection.connect` was given a `new Auth.Handle()` as `auth`.
 - **A graceful close waits.** `await connection.close()` withdraws announcements and drains for up to one second. `moq-lite-05` and newer wait for the subscriber to receive finished tails; older Lite versions wait only for transport ACKs. IETF media streams are not drained. `abort()` ends immediately.
 
 Examples:
diff --git a/doc/lib/kt/index.md b/doc/lib/kt/index.md
index 11786fe0fef..fb5954f5116 100644
--- a/doc/lib/kt/index.md
+++ b/doc/lib/kt/index.md
@@ -72,8 +72,9 @@ Moq.connect("https://relay.example.com", ClientConfig(tls = ClientTls(roots = li
 // Publish encoded frames, or raw pixels with the codec inside the binding.
 // opusInit, packet, pts, and rgba come from your encoder or capture source.
 Moq.connect("https://relay.example.com").use { moq ->
-    val publication = moq.createBroadcast("my-stream.hang")
-    val broadcast = publication.broadcast()
+    // Hidden until the catalog is filled; hold the route while it should stay announced.
+    val route = moq.route("my-stream.hang", RouteOptions(hidden = true))
+    val broadcast = route.broadcast()
     val audio = dev.moq.media.TrackProducer.audio(broadcast, Named(null), AudioInit(format = AudioFormat.OPUS, data = opusInit))
     audio.writeFrame(Frame(payload = packet, timestamp = Timestamp(960u, 48_000u)))
     audio.cut() // audio has no keyframes, so this is what gives it groups
@@ -84,7 +85,7 @@ Moq.connect("https://relay.example.com").use { moq ->
         output = VideoEncoderOutput(codec = VideoCodec.H264, bitrate = null, gop = null, kind = autoEncoder), track = "camera"),
     )
     video.write(VideoFrame(timestamp = pts, data = rgba))
-    publication.announce(AnnounceRoute()) // the broadcast mints its own instance
+    route.announce() // the route mints its own instance: route.instance()
     audio.finish()
     video.finish()
     broadcast.end()
@@ -101,7 +102,7 @@ The rest of the [shared feature list](/lib/#what-every-binding-can-do) maps
 one to one; the API reference has the names, and [Layers](/lib/layers)
 shows which module holds each.
 
-- **`end`, not `close`.** `broadcast.end()` ends a broadcast for good. `close()`, or leaving `use { }`, releases the handle, which ends the broadcast only once no other handle to it remains, such as its publication or a `requests()` handle.
+- **`end`, not `close`.** `broadcast.end()` ends a broadcast for good, retracting its route. `close()`, or leaving `use { }`, releases the handle, which ends the broadcast only once no other handle to it remains, such as its route or a `requests()` handle. A route is the opposite: closing it retracts it at once, so hold it while the broadcast should stay announced.
 - **Audio needs cuts.** Video groups at its keyframes, but audio forms a group only where you call `cut()`: after every frame, or less often to batch frames into fewer groups.
 - **Timeline breaks.** On a seek or pause, call `discontinuity()`, then keep timestamps moving forward and resume video on a keyframe.
 - **Media reads.** `dev.moq.media.TrackConsumer`, `dev.moq.audio.Consumer`, and `dev.moq.video.Consumer` return a `Read` in order: `ReadFrame`, a `ReadGap` where media was lost, or a `ReadEnd` where the publisher stopped its encoder. A gap breaks continuity. An encoder end is not stream EOF: following frames before its endpoint are the old encoder's drain; the first at or past it starts fresh. A decoder reads everything the track still holds unless a live player sets `start = DecodeStart.LATEST` in its decoder output, which joins at the newest group and skips the cached backlog.
diff --git a/doc/lib/py/index.md b/doc/lib/py/index.md
index a9578d94f9b..dcb3a3cc170 100644
--- a/doc/lib/py/index.md
+++ b/doc/lib/py/index.md
@@ -71,8 +71,9 @@ import asyncio, moq
 async def main():
     # opus_init_bytes, payload, pts, and rgba come from your encoder or capture source.
     async with moq.Client("https://cdn.moq.dev/anon") as client:
-        publication = client.create_broadcast("my-stream.hang")
-        broadcast = publication.broadcast
+        # Hidden until announced, so viewers find a filled catalog. Hold the route: dropping it retracts it.
+        route = client.route("my-stream.hang", hidden=True)
+        broadcast = route.broadcast
 
         # Already-encoded frames: the catalog is filled from the bitstream
         audio = moq.media.TrackProducer.audio(broadcast, moq.media.AudioInit(format=moq.media.AudioFormat.OPUS, data=opus_init_bytes))
@@ -99,7 +100,7 @@ async def main():
         status = moq.json.SnapshotProducer(broadcast, status_track)
         status.update({"state": "live", "viewers": 42}, catalog_producer.now())
 
-        publication.announce()  # each broadcast mints a fresh instance
+        route.announce()  # each route mints a fresh instance, route.instance
         audio.finish()
         video.finish()
         events.finish()
diff --git a/doc/lib/rs/index.md b/doc/lib/rs/index.md
index f373a8243cf..0e46fa6ac74 100644
--- a/doc/lib/rs/index.md
+++ b/doc/lib/rs/index.md
@@ -70,7 +70,7 @@ while let Some(event) = announced.next().await {
     // Skip retractions. A path stays present across publisher restarts: hold
     // `consumer.follow(path, None)` to be handed each new run.
     let moq_net::announce::Event::Present(update) = event else { continue };
-    let broadcast = consumer.request(&update.prefix, update.route.instance).await?;
+    let broadcast = consumer.request(&update.prefix, Some(update.route.instance().clone())).await?;
     let catalog = broadcast
         .track(hang::Catalog::DEFAULT_NAME)?
         .subscribe(hang::Catalog::default_subscription())
@@ -80,12 +80,14 @@ while let Some(event) = announced.next().await {
 ```
 
 ```rust
-// Publish: create and announce a broadcast on the origin, then fill it.
-let mut broadcast = origin.publish("my-stream.hang", Default::default())?;
-// moq-mux (from a container) or moq-video / moq-audio (from a device) fill it.
-// The route retracts on `unannounce()` or when the broadcast ends. To serve a whole
-// subtree on demand instead, `origin.requests("room")?` yields each requested path:
-// `prepare()`, fill its broadcast, then `publish()`, or reject it.
+// Publish: create a route on the origin; it owns the broadcast to fill.
+let route = origin.route("my-stream.hang", RouteOptions::default())?;
+// moq-mux (from a container) or moq-video / moq-audio (from a device) fill
+// `route.broadcast()`. Keep the route: dropping it, or closing its broadcast,
+// retracts it, and `withdraw()`/`announce()` hide and show the same stream. To
+// serve a whole subtree on demand instead, `origin.route_prefix("room", ..)?`
+// yields each requested path: answer with `request.route(..)`, `serve` a held
+// broadcast, or `reject`.
 ```
 
 The connection and origin helpers spawn their drivers. Watch
diff --git a/doc/lib/rs/moq-net.md b/doc/lib/rs/moq-net.md
index 634ebe17553..90c8bc15e34 100644
--- a/doc/lib/rs/moq-net.md
+++ b/doc/lib/rs/moq-net.md
@@ -15,15 +15,15 @@ moq-transport at setup and presents one API either way. Media is a layer above
 
 What you use it for, beyond what the concept page already describes:
 
-- **An origin outlives the session.** Creating a broadcast returns an origin publication that controls its announcement and exposes the broadcast to fill. Standalone and Prepared fill producers cannot announce; only publishing the Prepared answer admits its publication. A reconnect announces existing publications again, and closing the session does not delete them.
-- **Requests can pin an instance.** `consumer.request(path, Some(instance))` resolves only through a route announcing that [publisher instance](/concept/moq-lite#publisher-instances); `None` takes whichever route wins. The resolved consumer names its instance in `info().instance`, pinned or not. A broadcast announced with `Route::default()` serves a random instance it keeps across re-announcing; set one with `Route::with_instance(instance, epoch)` only for a publisher that continues its group sequences across restarts and raises the epoch each time.
+- **An origin outlives the session.** `origin.route(path, options)` returns a `Route` that owns the broadcast to fill (`route.broadcast()`) and controls its announcement: `announce()`, `withdraw()`, `set_cost()`, and dropping the last clone retracts it. `origin.route_prefix(prefix, options)` serves requests beneath a prefix instead, each answered with `request.serve(held)`, `request.route(options)` (the path's own exact route) or `reject`. A standalone broadcast cannot announce; publish one only through a prefix route's `serve`. A reconnect announces existing routes again, and closing the session does not delete them.
+- **Requests can pin an instance.** `consumer.request(path, Some(instance))` resolves only through a route announcing that [publisher instance](/concept/moq-lite#publisher-instances); `None` takes whichever route wins. The resolved consumer names its instance in `info().instance`, pinned or not. A route serves a random instance minted when it is created and kept across `withdraw()` and `announce()`; set one with `RouteOptions::with_instance(instance, epoch)` only for a publisher that continues its group sequences across restarts and raises the epoch each time. `route.instance()` names it.
 - **Rank several CDNs.** Dial each with its own subscribe handle, `origin.clone().with_preference(origin::Preference::new(rank))` (higher wins; 0 is neutral and a negative rank demotes), all on one origin. Requests use the preferred link that has a route and fail over to the next; see [multiple CDNs](/concept/moq-lite#multiple-cdns).
 - **Request one instance, or follow them all.** `consumer.request(path, None)` resolves the instance serving a path now, and fails `Unroutable` only once discovery has synced with no route for it. `consumer.follow(path, None)` hands out each publisher instance serving a path from `available()`: the first once announced, then each one that takes over, `None` once the path goes offline, and whatever serves it next, like JS `follow(path)`. `consumer.announced()` lists paths only as present or absent. A broadcast already resolved stays on the old instance until dropped or its route goes. See [identity and recovery](/concept/identity) to choose between following and holding one instance.
 - **Discovery follows what you watch.** A client session asks the relay for announcements only under the prefixes its subscribe origin's readers watch, with `announced()`, `request`, or `follow`, stops asking about a prefix 2s after nothing at or beneath it is watched, and asks again on reconnect. A broadcast resolved through a discovered route keeps its path watched until dropped. `request` owns discovery of its path, so no separate watch is needed. A server session, or a client fed into an origin handle marked `with_link(origin::Link::Peer)` or `Link::Upstream`, asks for everything it may, so a relay discovers everything. An HTTP gateway (the moq-hls `Server`, the moq-rtc WHEP router) watches its whole scope while it lives, so the paths its callers name never open a request each. moq-lite-03/04 sessions, whose announcements mark no initial set, still ask for everything.
 - **Dial and accept sockets.** `socket::Endpoint::new(&origin, prefix, id)` announces a hidden endpoint at `<prefix>/.socket/<id>`, used only to route dials. A session speaks one of two protocols, each with its own dial and accept. `accept_tcp()` and `accept_track()` yield an `Incoming` dial to `accept` or `reject` (dropping it rejects). `dial_tcp(peer)` and an accepted `tcp` dial yield a `socket::TcpStream`, a `group::Producer` and `group::Consumer` pair carrying one reliable, ordered byte pipe each way (finish is FIN, abort is RST, and `ready` paces the writer to the reader); `dial_track(peer, info)` and an accepted `track` dial yield a `socket::TrackStream`, this side's `track::Producer` and a `track::Subscriber` of the peer's half, subscribed reliably and in order until the application updates it, one message per group. A dial resolves once the peer accepts, and an accept checks that the claimed dialer really dialed this endpoint, waiting for its endpoint while the dial stays open. Every hop needs moq-lite-07 or moq-transport: while the origin has an older moq-lite client session whose publish half doesn't opt into hidden broadcasts (`with_hidden(true)`), dials and accepts fail with `Unsupported`. A dial to a peer behind such a hop waits, as for a peer not online yet. Session tracks are never announced or listed. See [Sockets](/concept/socket).
 - **One track per name.** Concurrent subscriptions share one request and producer. The application owns sequence numbers: the broadcast keeps nothing of an ended track, so a producer that replaces it starts at 0. A name always means the same content, so the replacement continues past its predecessor's groups with `create_group` at an explicit sequence. Readers of an aborted track resume onto the replacement when they read through an origin request, whose route always names an instance; otherwise their subscription ends with the error.
 - **Authored tracks default to a zero `max_age`.** `track::Info::default()` sets `max_age` to `Some(Duration::ZERO)`, the live edge only; a publisher that wants readers to reach history sets a longer bound, or `with_max_age(None)` for no publisher limit. Media tracks from `hang::container::track_info` declare `hang::container::MAX_AGE` (30 seconds). `max_age` is how long a superseded group stays fresh, never the newest group; it frees no bytes, which the cache pool's expiry reclaims. Received metadata keeps absence as no limit, and an origin's `cache_duration` can only cap it lower.
-- **End content by finishing tracks.** A broadcast has no finished state. When the input ends, finish each track; the broadcast stays announced and keeps serving them until you close it or drop its last producer. How long to keep it up for late readers is yours to decide: `moq_mux::Linger` holds a hang broadcast for a fixed window.
+- **End content by finishing tracks.** A broadcast has no finished state. When the input ends, finish each track; the broadcast stays announced and keeps serving them until you close it or drop its route. How long to keep it up for late readers is yours to decide: `moq_mux::Linger` holds a hang broadcast for a fixed window.
 - **Demand says whether anyone is watching.** `demand()` on a track, group, or broadcast says whether a subscriber is attached. First-party capture does not wait for it: video encodes while enabled and audio keeps raw PCM to encode when someone listens, so a late subscription's `delay.max` or a FETCH finds the recent past. Demand gates bandwidth reservations, transcode rungs, and on-demand video where a publisher opts in, which saves the encode but leaves nothing from before the first subscriber. Holding a broadcast or track consumer is not demand: a track consumer requests nothing until it queries, subscribes, or fetches, and those count until dropped. A shared fetch stays up until its last reader leaves. Demand rolls up: a frame being read keeps its group wanted, a group a subscription or fetch handed out keeps its track wanted until read to its end, and any wanted track keeps its broadcast wanted.
 - **Use the model without a runtime.** By default `moq-net` is its `poll_*` APIs and origin driver with caller-supplied time. The `async` feature adds their async wrappers, `time::run`, and both wire sessions.
 - **You drive the session, or `moq-tokio` does.** `connect` and `accept` return a session plus a driver that never reads the clock itself. `moq_net::time::run` polls it on tokio. `moq-tokio` hides that. A custom transport implements `moq_net::transport::poll`, and `moq_net::transport::memory::pair` links two sessions in one process with no sockets, for tests or in-process links.
diff --git a/doc/lib/swift/index.md b/doc/lib/swift/index.md
index 726940de7e6..cd8fc07854c 100644
--- a/doc/lib/swift/index.md
+++ b/doc/lib/swift/index.md
@@ -70,8 +70,9 @@ for try await event in try session.consume.announced(prefix: "live/", filter: "*
 ```swift
 // Publish encoded frames, or raw pixels with the codec inside the binding (VideoToolbox).
 // opusInit, packet, pts, and rgba come from your encoder or capture source.
-let publication = try session.publish.createBroadcast(path: "my-stream.hang")
-let broadcast = publication.broadcast
+// Hidden until the catalog is filled; hold the route while it should stay announced.
+let route = try session.publish.route(path: "my-stream.hang", hidden: true)
+let broadcast = try route.broadcast
 let audio = try Media.TrackProducer.audio(broadcast: broadcast, initData: Media.AudioInit(format: .opus, data: opusInit))
 try audio.writeFrame(packet, timestamp: Timestamp(value: 20, scale: 1_000))
 try audio.cut() // audio has no keyframes, so this is what gives it groups
@@ -83,7 +84,7 @@ let video = try Video.Producer(
     track: "camera"
 )
 try video.write(VideoFrame(timestamp: pts, data: rgba))
-try publication.announce(route: AnnounceRoute()) // the broadcast mints its own instance
+try route.announce() // the route mints its own instance: route.instance
 try audio.finish()
 try video.finish()
 try broadcast.close()
@@ -105,7 +106,7 @@ shows which module holds each.
 - **Media reads.** `Media.TrackConsumer`, `Audio.Consumer`, and `Video.Consumer` yield `Read` cases in order: `.frame`, a `.gap` where media was lost, or an `.end` where the publisher stopped its encoder. A gap breaks continuity. An encoder end is not stream EOF: following frames before its endpoint are the old encoder's drain; the first at or past it starts fresh. A decoder reads everything the track still holds unless a live player sets `start: .latest` in its decoder output, which joins at the newest group and skips the cached backlog.
 - **Decoded frames hold decoder buffers.** Release each frame from a `Video.Consumer` promptly, or the decoder stalls. `resize` is best effort, so read each frame's `width()` and `height()`.
 - **Closing.** `session.shutdown()` requests a drain immediately; `try await session.closed()` waits up to one second and reports its result. `session.cancel(code:)` closes at once. Finish or abort live tracks first. moq-lite-05 and newer wait for the peer to receive finished tails; older Lite versions and IETF wait only for transport ACKs.
-- **Ending cleanly.** When the input ends, finish every track, then call `try finish()` on its `Media.CatalogProducer` to finish the catalog, which ends the content. The broadcast stays announced and keeps serving the finished tracks, so a subscriber still catching up can drain them, until `broadcast.close()` takes it offline. How long to keep it up is yours to decide. A track still open at the close, or released without a finish, ends with `Unroutable` (`Internal` over moq-transport, which has no such code). Readers follow a publisher's runs by announcement, not by that error: see [identity and recovery](/concept/identity).
+- **Ending cleanly.** When the input ends, finish every track, then call `try finish()` on its `Media.CatalogProducer` to finish the catalog, which ends the content. The broadcast stays announced and keeps serving the finished tracks, so a subscriber still catching up can drain them, until `broadcast.close()`, or releasing its route, takes it offline. How long to keep it up is yours to decide. A track still open at the close, or released without a finish, ends with `Unroutable` (`Internal` over moq-transport, which has no such code). Readers follow a publisher's runs by announcement, not by that error: see [identity and recovery](/concept/identity).
 - **Stats.** `session.stats()` reports `rtt`, `estimatedSendRateBps`, and the byte and packet counters (`bytesSent`, `bytesReceived`, `bytesLost`, `packetsSent`, `packetsReceived`, `packetsLost`). A field is `nil` when the transport does not report it, which is not the same as zero. `version` names the negotiated protocol. Connect returns a connecting session; read its coherent `state()` snapshot and wait with that snapshot's revision to observe first-dial failures and reconnects. Each watcher keeps its own revision. Hold the owned `BandwidthConsumer` returned by `session.recvBandwidth()` to receive bandwidth estimates. `rate()` reads the current estimate in bits per second and `rateChanged()` waits for a new one. Release the consumer or call `cancel()` when finished; releasing the last consumer stops PROBE; the session and stats snapshots do not request it. Client consumers survive reconnects and report no estimate while disconnected.
 - **Viewers.** `session.viewers()` divides the receive estimate among the broadcasts you watch. `watch(maxBps:)` returns a `Viewer` claiming up to a ceiling, the bitrate of the largest rendition you would switch to; its `rate()` reads that viewer's fair share in bits per second, `nil` while there is no estimate (keep the current rendition), and `update(maxBps:)` changes the ceiling. Holding a viewer requests the estimate like `recvBandwidth()`, and releasing it releases the claim. The session sends the summed ceilings as its PROBE target; `setTarget(targetBps:)` overrides that, `0` sends none, and `nil` follows the viewers again. `watch`, `update`, and `setTarget` throw `MoqError.OutOfRange` when the ceilings or the target would pass 2^53 - 1 bps, the most a PROBE target carries.
 - **Authorization.** On `moq-lite-07-wip` (opt in with `Client(versions:)`) and on moq-transport draft-18+ with the [MoQ Auth extension](/draft/moq-auth), `for try await grant in session.grants()` yields the `Grant` the relay sent back and each change, `nil` until it answers and while a client session reconnects. Cancelling the iterating task cancels the native wait.
diff --git a/go/wrapper/MIGRATE.md b/go/wrapper/MIGRATE.md
index d11bc22dc22..1c2553c6d9c 100644
--- a/go/wrapper/MIGRATE.md
+++ b/go/wrapper/MIGRATE.md
@@ -35,6 +35,22 @@ for {
 }
 ```
 
+### Publishing goes through one `Route`
+
+`OriginProducer.CreateBroadcast(path)`, `Client.CreateBroadcast`, and `Server.CreateBroadcast` are `Route(path, moq.RouteOptions{})`, and `OriginProducer.Requests(prefix)` is `RoutePrefix(prefix, moq.RouteOptions{})`. Both return a `*Route`, which replaces `*Publication`, `*OriginRequests`, and `*BroadcastPrepared`:
+
+- `Publication.Broadcast()` is `Route.Broadcast()`, which now also returns an error, on a prefix route.
+- `Publication.Announce(moq.AnnounceRoute{...})` is `Announce()`, and re-pricing is `SetCost(cost)`. `Unannounce()` is `Withdraw()`.
+- `OriginRequests.RequestedBroadcast(ctx)` is `Route.Requested(ctx)`, which returns `(nil, nil)` once the origin closes; `All(ctx)` and `Cancel()` keep their names. Cancelling ctx no longer retracts the route, only the wait.
+- `BroadcastRequest.Prepare()` then `BroadcastPrepared.Publish()` is `BroadcastRequest.Route(options)`: create it hidden to fill it first, then `Announce()`. `BroadcastPrepared.Close()` is `Route.Cancel()`.
+- `Route.Instance()` is the stream's instance, minted at creation and kept across `Withdraw` and `Announce`.
+
+`moq.AnnounceRoute` is `moq.RouteOptions{Hidden, Cost, Instance, Epoch}`, given once at creation. A route is visible at once unless `Hidden`; set it and call `Announce()` after filling the catalog to keep the old create-then-announce order. A stable `Instance` is fixed for the route's lifetime: announcing another one is a new route.
+
+Keep the `*Route` reachable for as long as the broadcast should stay announced: the collector reclaiming it, or `Cancel()`, retracts it, while `BroadcastProducer.Close()` still ends both. A `*BroadcastProducer` alone no longer keeps it announced.
+
+`moq.Route`, the received facts in `Announce.Route`, is renamed `moq.RouteInfo`; its fields are unchanged.
+
 ### Catalog renditions carry their warmup ([#7864](https://github.com/moq-dev/moq/pull/7864))
 
 `ffi.MoqVideo` and `ffi.MoqAudio` (`media.Video` and `media.Audio`) gain `Warmup`, the catalog's decoder warmup, nil when absent. `media.NewTrackConsumer` and the audio and video `Subscribe` read it from the rendition and start that much earlier; a negative one is refused with an error. Only unkeyed struct literals change.
diff --git a/go/wrapper/README.md b/go/wrapper/README.md
index 1550a52120f..16f98f5e61b 100644
--- a/go/wrapper/README.md
+++ b/go/wrapper/README.md
@@ -138,8 +138,8 @@ import (
 	moqmedia "moq.dev/moq/media"
 )
 
-publication, _ := client.CreateBroadcast("room")
-broadcast := publication.Broadcast()
+route, _ := client.Route("room", moq.RouteOptions{Hidden: true})
+broadcast, _ := route.Broadcast()
 // Every JSON write is stamped, so the track is timed. JSON is small and repetitive, so
 // compress it on the wire.
 scale := uint64(1_000)
@@ -148,7 +148,7 @@ status, _ := moqjson.NewSnapshotProducer(broadcast, track, moqjson.SnapshotOptio
 catalog, _ := moqmedia.NewCatalogProducer(broadcast)
 now, _ := catalog.Now()
 _ = status.Update(map[string]any{"viewers": 42}, now)
-_ = publication.Announce(moq.AnnounceRoute{})
+_ = route.Announce()
 ```
 
 Snapshot and window producers take `SnapshotOptions` or `WindowOptions`; the stream producer and
diff --git a/go/wrapper/client.go b/go/wrapper/client.go
index 3982bca6ad4..b94a224904a 100644
--- a/go/wrapper/client.go
+++ b/go/wrapper/client.go
@@ -300,11 +300,11 @@ func Dial(ctx context.Context, url string, config ClientConfig) (*Client, error)
 	return c, nil
 }
 
-// CreateBroadcast creates an unannounced broadcast at path, invisible to everyone until announced. Announce it after populating tracks.
+// Route creates a route at exactly path on the publish origin, owning a new broadcast to fill.
 //
-// See [OriginProducer.CreateBroadcast].
-func (c *Client) CreateBroadcast(path string) (*Publication, error) {
-	return c.publisher.CreateBroadcast(path)
+// See [OriginProducer.Route].
+func (c *Client) Route(path string, options RouteOptions) (*Route, error) {
+	return c.publisher.Route(path, options)
 }
 
 // Announced lists the paths the remote announces under a pattern scope, as each becomes present or absent.
diff --git a/go/wrapper/example_test.go b/go/wrapper/example_test.go
index aaba35f5a70..dbc2243939e 100644
--- a/go/wrapper/example_test.go
+++ b/go/wrapper/example_test.go
@@ -76,7 +76,7 @@ func ExampleClient_Follow() {
 }
 
 // Publish a media track to a relay.
-func ExampleClient_CreateBroadcast() {
+func ExampleClient_Route() {
 	ctx := context.Background()
 
 	client, err := moq.Dial(ctx, "https://relay.example.com", moq.ClientConfig{})
@@ -85,17 +85,22 @@ func ExampleClient_CreateBroadcast() {
 	}
 	defer client.Close()
 
-	publication, err := client.CreateBroadcast("me/mic")
+	// Hidden until the catalog is filled; hold the route while it should stay announced.
+	route, err := client.Route("me/mic", moq.RouteOptions{Hidden: true})
+	if err != nil {
+		log.Fatal(err)
+	}
+	defer route.Cancel()
+	broadcast, err := route.Broadcast()
 	if err != nil {
 		log.Fatal(err)
 	}
-	broadcast := publication.Broadcast()
 
 	media, err := moqmedia.NewAudioTrackProducer(broadcast, moqmedia.Named{}, moqmedia.AudioInit{Format: moqmedia.AudioFormatOpus, Data: opusHead()})
 	if err != nil {
 		log.Fatal(err)
 	}
-	_ = publication.Announce(moq.AnnounceRoute{})
+	_ = route.Announce()
 
 	// 20 ms in, counted on the Opus 48 kHz sample clock.
 	pts := moq.Timestamp{Value: 960, Scale: 48_000}
diff --git a/go/wrapper/moq_test.go b/go/wrapper/moq_test.go
index 3f64bdcdc39..268a5cf20e1 100644
--- a/go/wrapper/moq_test.go
+++ b/go/wrapper/moq_test.go
@@ -30,6 +30,22 @@ func newOrigin(t *testing.T) *moq.OriginProducer {
 	return origin
 }
 
+// newRoute creates an exact route on origin with its broadcast, kept reachable
+// until the test ends: the collector reclaiming it would retract the route.
+func newRoute(t *testing.T, origin *moq.OriginProducer, path string, options moq.RouteOptions) (*moq.Route, *moq.BroadcastProducer) {
+	t.Helper()
+	route, err := origin.Route(path, options)
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { runtime.KeepAlive(route) })
+	broadcast, err := route.Broadcast()
+	if err != nil {
+		t.Fatal(err)
+	}
+	return route, broadcast
+}
+
 // opusHead builds a valid OpusHead init buffer (RFC 7845): 48 kHz, 2 channels.
 func opusHead() []byte {
 	buf := []byte("OpusHead")
@@ -46,11 +62,14 @@ func TestDynamicBroadcastRequest(t *testing.T) {
 	defer cancel()
 
 	origin := newOrigin(t)
-	dynamic, err := origin.Requests("")
+	dynamic, err := origin.RoutePrefix("", moq.RouteOptions{})
 	if err != nil {
 		t.Fatal(err)
 	}
 	defer dynamic.Cancel()
+	if _, err := dynamic.Broadcast(); err == nil {
+		t.Fatal("a prefix route owns no broadcast")
+	}
 
 	type result struct {
 		broadcast *moq.BroadcastConsumer
@@ -62,7 +81,7 @@ func TestDynamicBroadcastRequest(t *testing.T) {
 		requested <- result{broadcast: broadcast, err: err}
 	}()
 
-	request, err := dynamic.RequestedBroadcast(ctx)
+	request, err := dynamic.Requested(ctx)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -74,18 +93,26 @@ func TestDynamicBroadcastRequest(t *testing.T) {
 		t.Fatalf("path = %q, want %q", path, "dynamic/broadcast")
 	}
 
-	prepared, err := request.Prepare()
+	served, err := request.Route(moq.RouteOptions{Hidden: true})
 	if err != nil {
 		t.Fatal(err)
 	}
-	track, err := prepared.Broadcast().PublishTrack("status", timedInfo())
+	defer runtime.KeepAlive(served)
+	if served.Instance() == dynamic.Instance() {
+		t.Fatal("a job's route serves a fresh instance")
+	}
+	broadcast, err := served.Broadcast()
 	if err != nil {
 		t.Fatal(err)
 	}
-	served, err := prepared.Publish()
+	track, err := broadcast.PublishTrack("status", timedInfo())
 	if err != nil {
 		t.Fatal(err)
 	}
+	// Only announcing answers the requester.
+	if err := served.Announce(); err != nil {
+		t.Fatal(err)
+	}
 
 	var res result
 	select {
@@ -118,13 +145,20 @@ func TestDynamicBroadcastRequest(t *testing.T) {
 	if err := track.Finish(); err != nil {
 		t.Fatal(err)
 	}
-	if err := served.Broadcast().Close(); err != nil {
+	if err := broadcast.Close(); err != nil {
 		t.Fatal(err)
 	}
-	// The publication fills the prepared broadcast, so closing one closes the other.
-	if _, err := prepared.Broadcast().PublishTrack("late", nil); !errors.Is(err, moq.ErrClosed) {
+	// The route hands out one broadcast, so closing it ends the route too.
+	again, err := served.Broadcast()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := again.PublishTrack("late", nil); !errors.Is(err, moq.ErrClosed) {
 		t.Fatalf("PublishTrack after close = %v, want ErrClosed", err)
 	}
+	if err := served.Announce(); !errors.Is(err, moq.ErrClosed) {
+		t.Fatalf("Announce after close = %v, want ErrClosed", err)
+	}
 }
 
 func TestPublishAudioLifecycle(t *testing.T) {
@@ -251,11 +285,7 @@ func TestAudioConsumerDelay(t *testing.T) {
 	defer cancel()
 
 	origin := newOrigin(t)
-	publication, err := origin.CreateBroadcast("audio-delay")
-	if err != nil {
-		t.Fatal(err)
-	}
-	broadcast := publication.Broadcast()
+	route, broadcast := newRoute(t, origin, "audio-delay", moq.RouteOptions{Hidden: true})
 	track := "mic"
 	catalogProducer, err := moqmedia.NewCatalogProducer(broadcast)
 	if err != nil {
@@ -270,7 +300,7 @@ func TestAudioConsumerDelay(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	if err := publication.Announce(moq.AnnounceRoute{}); err != nil {
+	if err := route.Announce(); err != nil {
 		t.Fatal(err)
 	}
 
@@ -417,11 +447,7 @@ func testDecodeVideoFrame(t *testing.T, surface bool) {
 	defer cancel()
 
 	origin := newOrigin(t)
-	publication, err := origin.CreateBroadcast("video-decode-frame")
-	if err != nil {
-		t.Fatal(err)
-	}
-	broadcast := publication.Broadcast()
+	route, broadcast := newRoute(t, origin, "video-decode-frame", moq.RouteOptions{Hidden: true})
 	track := "camera"
 	catalogProducer, err := moqmedia.NewCatalogProducer(broadcast)
 	if err != nil {
@@ -436,7 +462,7 @@ func testDecodeVideoFrame(t *testing.T, surface bool) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	if err := publication.Announce(moq.AnnounceRoute{}); err != nil {
+	if err := route.Announce(); err != nil {
 		t.Fatal(err)
 	}
 
@@ -758,16 +784,12 @@ func TestLocalPublishConsumeAudio(t *testing.T) {
 	defer cancel()
 
 	origin := newOrigin(t)
-	publication, err := origin.CreateBroadcast("live")
-	if err != nil {
-		t.Fatal(err)
-	}
-	broadcast := publication.Broadcast()
+	route, broadcast := newRoute(t, origin, "live", moq.RouteOptions{Hidden: true})
 	media, err := moqmedia.NewAudioTrackProducer(broadcast, moqmedia.Named{}, moqmedia.AudioInit{Format: moqmedia.AudioFormatOpus, Data: opusHead()})
 	if err != nil {
 		t.Fatal(err)
 	}
-	if err := publication.Announce(moq.AnnounceRoute{}); err != nil {
+	if err := route.Announce(); err != nil {
 		t.Fatal(err)
 	}
 
@@ -1302,7 +1324,7 @@ func TestConsumerCancelConcurrent(t *testing.T) {
 // that one request rather than the consumer it was made on.
 func TestRequestCancelKeepsTheOrigin(t *testing.T) {
 	origin := newOrigin(t)
-	dynamic, err := origin.Requests("")
+	dynamic, err := origin.RoutePrefix("", moq.RouteOptions{})
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -1321,7 +1343,7 @@ func TestRequestCancelKeepsTheOrigin(t *testing.T) {
 
 	// Take the request but never answer it, so the cancel lands on a call that is
 	// genuinely parked rather than one that has not started.
-	pending, err := dynamic.RequestedBroadcast(waitCtx)
+	pending, err := dynamic.Requested(waitCtx)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -1345,19 +1367,15 @@ func TestRequestCancelKeepsTheOrigin(t *testing.T) {
 		resolved <- err
 	}()
 
-	next, err := dynamic.RequestedBroadcast(waitCtx)
+	next, err := dynamic.Requested(waitCtx)
 	if err != nil {
 		t.Fatal(err)
 	}
-	prepared, err := next.Prepare()
+	served, err := next.Route(moq.RouteOptions{})
 	if err != nil {
 		t.Fatal(err)
 	}
-	served, err := prepared.Publish()
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer served.Broadcast().Close()
+	defer runtime.KeepAlive(served)
 	select {
 	case err := <-resolved:
 		if err != nil {
@@ -1563,11 +1581,7 @@ func TestBroadcastIsReachableOnlyWhileAnnounced(t *testing.T) {
 	defer cancel()
 
 	origin := newOrigin(t)
-	publication, err := origin.CreateBroadcast("live")
-	if err != nil {
-		t.Fatal(err)
-	}
-	broadcast := publication.Broadcast()
+	route, broadcast := newRoute(t, origin, "live", moq.RouteOptions{Hidden: true})
 	if _, err := broadcast.PublishTrack("events", nil); err != nil {
 		t.Fatal(err)
 	}
@@ -1576,7 +1590,10 @@ func TestBroadcastIsReachableOnlyWhileAnnounced(t *testing.T) {
 		t.Fatal("an unannounced broadcast must be unroutable")
 	}
 
-	if err := publication.Announce(moq.AnnounceRoute{Cost: 3}); err != nil {
+	if err := route.SetCost(3); err != nil {
+		t.Fatal(err)
+	}
+	if err := route.Announce(); err != nil {
 		t.Fatal(err)
 	}
 	announced, err := consumer.Announced(moq.AnnounceOptions{})
@@ -1589,21 +1606,23 @@ func TestBroadcastIsReachableOnlyWhileAnnounced(t *testing.T) {
 		t.Fatalf("announce: ann=%+v", ann)
 	}
 
-	if err := publication.Unannounce(); err != nil {
+	if err := route.Withdraw(); err != nil {
 		t.Fatal(err)
 	}
 	event := nextRoute(t, ctx, announced)
 	if retracted, ok := event.(moq.AnnounceEventAbsent); !ok || retracted.Announce.Prefix != "live" {
-		t.Fatalf("unannounce: event=%+v", event)
+		t.Fatalf("withdraw: event=%+v", event)
 	}
 	if _, err := consumer.Request(ctx, "live", nil); err == nil {
 		t.Fatal("an unannounced broadcast must be unroutable")
 	}
 
-	if err := publication.Announce(moq.AnnounceRoute{}); err != nil {
+	if err := route.Announce(); err != nil {
 		t.Fatal(err)
 	}
-	nextAnnounced(t, ctx, announced)
+	if ann := nextAnnounced(t, ctx, announced); ann.Route.Instance != route.Instance() {
+		t.Fatalf("reannounce: ann=%+v, want instance %s", ann, route.Instance())
+	}
 	if _, err := consumer.Request(ctx, "live", nil); err != nil {
 		t.Fatal(err)
 	}
@@ -1612,37 +1631,28 @@ func TestBroadcastIsReachableOnlyWhileAnnounced(t *testing.T) {
 	}
 }
 
-// A publication outliving its closed broadcast cannot announce or withdraw the
-// broadcast that replaced it at the same path.
-func TestStalePublicationLeavesItsReplacementAlone(t *testing.T) {
+// A route outliving its closed broadcast cannot announce, re-price, or withdraw
+// the route that replaced it at the same path.
+func TestStaleRouteLeavesItsReplacementAlone(t *testing.T) {
 	ctx, cancel := context.WithTimeout(context.Background(), testTimeout)
 	defer cancel()
 
 	origin := newOrigin(t)
-	stale, err := origin.CreateBroadcast("live")
-	if err != nil {
-		t.Fatal(err)
-	}
-	if err := stale.Announce(moq.AnnounceRoute{}); err != nil {
-		t.Fatal(err)
-	}
-	if err := stale.Broadcast().Close(); err != nil {
+	stale, broadcast := newRoute(t, origin, "live", moq.RouteOptions{})
+	if err := broadcast.Close(); err != nil {
 		t.Fatal(err)
 	}
 
-	replacement, err := origin.CreateBroadcast("live")
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer replacement.Broadcast().Close()
-	if err := replacement.Announce(moq.AnnounceRoute{}); err != nil {
-		t.Fatal(err)
-	}
-	if err := stale.Announce(moq.AnnounceRoute{}); !errors.Is(err, moq.ErrClosed) {
+	_, replacement := newRoute(t, origin, "live", moq.RouteOptions{})
+	defer replacement.Close()
+	if err := stale.Announce(); !errors.Is(err, moq.ErrClosed) {
 		t.Fatalf("stale Announce = %v, want ErrClosed", err)
 	}
-	if err := stale.Unannounce(); !errors.Is(err, moq.ErrClosed) {
-		t.Fatalf("stale Unannounce = %v, want ErrClosed", err)
+	if err := stale.SetCost(1); !errors.Is(err, moq.ErrClosed) {
+		t.Fatalf("stale SetCost = %v, want ErrClosed", err)
+	}
+	if err := stale.Withdraw(); err != nil {
+		t.Fatalf("stale Withdraw = %v, want a no-op", err)
 	}
 	if _, err := origin.Consume().Request(ctx, "live", nil); err != nil {
 		t.Fatalf("Request = %v, want the replacement", err)
@@ -1661,20 +1671,8 @@ func TestAnnouncedPatternCaptures(t *testing.T) {
 	}
 	defer announced.Cancel()
 
-	audio, err := origin.CreateBroadcast("room/alice/audio")
-	if err != nil {
-		t.Fatal(err)
-	}
-	if err := audio.Announce(moq.AnnounceRoute{}); err != nil {
-		t.Fatal(err)
-	}
-	chat, err := origin.CreateBroadcast("room/alice/chat")
-	if err != nil {
-		t.Fatal(err)
-	}
-	if err := chat.Announce(moq.AnnounceRoute{}); err != nil {
-		t.Fatal(err)
-	}
+	newRoute(t, origin, "room/alice/audio", moq.RouteOptions{})
+	newRoute(t, origin, "room/alice/chat", moq.RouteOptions{})
 
 	update := nextAnnounced(t, ctx, announced)
 	if update.Prefix != "room/alice/chat" {
@@ -1699,13 +1697,7 @@ func TestAnnouncedExactFilterCapturesEmpty(t *testing.T) {
 	}
 	defer announced.Cancel()
 
-	chat, err := origin.CreateBroadcast("room/alice/chat")
-	if err != nil {
-		t.Fatal(err)
-	}
-	if err := chat.Announce(moq.AnnounceRoute{}); err != nil {
-		t.Fatal(err)
-	}
+	newRoute(t, origin, "room/alice/chat", moq.RouteOptions{})
 
 	update := nextAnnounced(t, ctx, announced)
 	if update.Prefix != "room/alice/chat" {
@@ -1716,9 +1708,9 @@ func TestAnnouncedExactFilterCapturesEmpty(t *testing.T) {
 	}
 }
 
-// A broadcast mints its own instance and keeps it across re-announcing. Another
-// instance keeps the path present in the listing and reaches only followers.
-func TestInstanceChangeReachesFollowers(t *testing.T) {
+// A route mints its own instance and keeps it across re-pricing. Another route
+// keeps the path present in the listing and reaches only followers.
+func TestNewRouteReachesFollowers(t *testing.T) {
 	ctx, cancel := context.WithTimeout(context.Background(), testTimeout)
 	defer cancel()
 
@@ -1735,34 +1727,30 @@ func TestInstanceChangeReachesFollowers(t *testing.T) {
 	}
 	defer following.Cancel()
 
-	publication, err := origin.CreateBroadcast("instance")
-	if err != nil {
-		t.Fatal(err)
-	}
-	if err := publication.Announce(moq.AnnounceRoute{}); err != nil {
-		t.Fatal(err)
-	}
+	route, _ := newRoute(t, origin, "instance", moq.RouteOptions{})
 	minted := nextAnnounced(t, ctx, announced).Route.Instance
-	if minted == "" {
-		t.Fatal("present instance is empty, want a minted one")
+	if minted == "" || minted != route.Instance() {
+		t.Fatalf("present instance = %q, want the minted %q", minted, route.Instance())
 	}
 	if _, err := following.Available(ctx); err != nil {
 		t.Fatal(err)
 	}
 
-	if err := publication.Announce(moq.AnnounceRoute{Cost: 1}); err != nil {
+	if err := route.SetCost(1); err != nil {
 		t.Fatal(err)
 	}
 	stable := "cam"
-	if err := publication.Announce(moq.AnnounceRoute{Instance: &stable, Epoch: 1}); err != nil {
-		t.Fatal(err)
-	}
+	second, _ := newRoute(t, origin, "instance", moq.RouteOptions{Instance: &stable, Epoch: 1})
 	if _, err := following.Available(ctx); err != nil {
 		t.Fatalf("follow after the instance change: %v", err)
 	}
 
-	// The listing's next event is the absence, so neither re-announce reached it.
-	if err := publication.Unannounce(); err != nil {
+	// The listing's next event is the absence, so neither the re-price nor the new
+	// route reached it.
+	if err := route.Withdraw(); err != nil {
+		t.Fatal(err)
+	}
+	if err := second.Withdraw(); err != nil {
 		t.Fatal(err)
 	}
 	event := nextRoute(t, ctx, announced)
@@ -1771,8 +1759,8 @@ func TestInstanceChangeReachesFollowers(t *testing.T) {
 	}
 
 	empty := ""
-	if err := publication.Announce(moq.AnnounceRoute{Instance: &empty}); !errors.Is(err, moq.ErrInvalidInstance) {
-		t.Fatalf("Announce(empty instance) = %v, want ErrInvalidInstance", err)
+	if _, err := origin.Route("refused", moq.RouteOptions{Instance: &empty}); !errors.Is(err, moq.ErrInvalidInstance) {
+		t.Fatalf("Route(empty instance) = %v, want ErrInvalidInstance", err)
 	}
 }
 
@@ -1788,25 +1776,19 @@ func TestFollowReportsOffline(t *testing.T) {
 	}
 	defer following.Cancel()
 
-	publication, err := origin.CreateBroadcast("offline")
-	if err != nil {
-		t.Fatal(err)
-	}
-	if err := publication.Announce(moq.AnnounceRoute{}); err != nil {
-		t.Fatal(err)
-	}
+	route, _ := newRoute(t, origin, "offline", moq.RouteOptions{})
 	if broadcast, err := following.Available(ctx); err != nil || broadcast == nil {
 		t.Fatalf("first Available = %v, %v; want a broadcast", broadcast, err)
 	}
 
-	if err := publication.Unannounce(); err != nil {
+	if err := route.Withdraw(); err != nil {
 		t.Fatal(err)
 	}
 	if broadcast, err := following.Available(ctx); err != nil || broadcast != nil {
-		t.Fatalf("Available after unannounce = %v, %v; want nil", broadcast, err)
+		t.Fatalf("Available after withdraw = %v, %v; want nil", broadcast, err)
 	}
 
-	if err := publication.Announce(moq.AnnounceRoute{}); err != nil {
+	if err := route.Announce(); err != nil {
 		t.Fatal(err)
 	}
 	if broadcast, err := following.Available(ctx); err != nil || broadcast == nil {
@@ -1827,21 +1809,13 @@ func TestPinnedFollowReportsTakeoverOffline(t *testing.T) {
 	}
 	defer following.Cancel()
 
-	publication, err := origin.CreateBroadcast("pinned")
-	if err != nil {
-		t.Fatal(err)
-	}
-	if err := publication.Announce(moq.AnnounceRoute{Instance: &pinned}); err != nil {
-		t.Fatal(err)
-	}
+	newRoute(t, origin, "pinned", moq.RouteOptions{Instance: &pinned})
 	if broadcast, err := following.Available(ctx); err != nil || broadcast == nil {
 		t.Fatalf("first Available = %v, %v; want a broadcast", broadcast, err)
 	}
 
 	other := "other"
-	if err := publication.Announce(moq.AnnounceRoute{Instance: &other, Epoch: 1}); err != nil {
-		t.Fatal(err)
-	}
+	newRoute(t, origin, "pinned", moq.RouteOptions{Instance: &other, Epoch: 1})
 	if broadcast, err := following.Available(ctx); err != nil || broadcast != nil {
 		t.Fatalf("Available after takeover = %v, %v; want nil", broadcast, err)
 	}
@@ -1878,7 +1852,7 @@ func TestDynamicServesARequestUnderAPrefix(t *testing.T) {
 	defer cancel()
 
 	origin := newOrigin(t)
-	dynamic, err := origin.Requests("live")
+	dynamic, err := origin.RoutePrefix("live", moq.RouteOptions{})
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -1891,7 +1865,7 @@ func TestDynamicServesARequestUnderAPrefix(t *testing.T) {
 		done <- err
 	}()
 
-	request, err := dynamic.RequestedBroadcast(ctx)
+	request, err := dynamic.Requested(ctx)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -1899,26 +1873,22 @@ func TestDynamicServesARequestUnderAPrefix(t *testing.T) {
 	if err != nil || path != "live/cam" {
 		t.Fatalf("path = %q err=%v", path, err)
 	}
-	prepared, err := request.Prepare()
-	if err != nil {
-		t.Fatal(err)
-	}
-	served, err := prepared.Publish()
+	served, err := request.Route(moq.RouteOptions{})
 	if err != nil {
 		t.Fatal(err)
 	}
-	defer served.Broadcast().Close()
+	defer runtime.KeepAlive(served)
 	if err := <-done; err != nil {
 		t.Fatal(err)
 	}
 }
 
-func TestClosingAPreparedAnswerRefusesTheRequest(t *testing.T) {
+func TestCancellingAHiddenAnswerRefusesTheRequest(t *testing.T) {
 	ctx, cancel := context.WithTimeout(context.Background(), testTimeout)
 	defer cancel()
 
 	origin := newOrigin(t)
-	dynamic, err := origin.Requests("live")
+	dynamic, err := origin.RoutePrefix("live", moq.RouteOptions{})
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -1931,15 +1901,15 @@ func TestClosingAPreparedAnswerRefusesTheRequest(t *testing.T) {
 		done <- err
 	}()
 
-	request, err := dynamic.RequestedBroadcast(ctx)
+	request, err := dynamic.Requested(ctx)
 	if err != nil {
 		t.Fatal(err)
 	}
-	prepared, err := request.Prepare()
+	hidden, err := request.Route(moq.RouteOptions{Hidden: true})
 	if err != nil {
 		t.Fatal(err)
 	}
-	prepared.Close()
+	hidden.Cancel()
 
 	select {
 	case err := <-done:
diff --git a/go/wrapper/origin.go b/go/wrapper/origin.go
index 0abeae0c06f..c3d65e0954b 100644
--- a/go/wrapper/origin.go
+++ b/go/wrapper/origin.go
@@ -13,7 +13,7 @@ import (
 // consume sink for a full-duplex peer.
 //
 // There is no Close: the origin ends once the collector reaches every owner
-// (each producer, published broadcast, and [OriginRequests]), and its consumers
+// (each producer and [Route]), and its consumers
 // then fail with [ErrClosed]. Keep an owner reachable for as long as the origin
 // should live.
 type OriginProducer struct {
@@ -35,95 +35,122 @@ func (o *OriginProducer) Consume() *OriginConsumer {
 	return &OriginConsumer{inner: o.inner.Consume()}
 }
 
-// Requests advertises prefix and serves the requests beneath it.
+// Route creates a route at exactly path, owning a new broadcast to fill.
 //
-// A route claims prefix and every path beneath it ("" claims every path). A
-// service that only serves some of them rejects the rest as they are requested.
-// Create, Requests if tracks are served on demand, populate, then
-// [Publication.Announce].
-func (o *OriginProducer) Requests(prefix string) (*OriginRequests, error) {
-	inner, err := o.inner.Requests(prefix)
+// The route is visible at once unless options.Hidden: a hidden route is
+// invisible and unroutable, for this origin's consumers and peers alike, until
+// [Route.Announce], so create it hidden to fill the catalog first. It serves a
+// fresh instance, kept across [Route.Withdraw] and [Route.Announce], unless
+// options names one. Keep the route reachable: [Route.Cancel], or the collector
+// reclaiming it, retracts it, and [BroadcastProducer.Close] ends both.
+func (o *OriginProducer) Route(path string, options RouteOptions) (*Route, error) {
+	inner, err := o.inner.Route(path, options)
 	if err != nil {
 		return nil, err
 	}
-	return &OriginRequests{inner: inner}, nil
+	return newRoute(inner), nil
 }
 
-// CreateBroadcast creates a broadcast at the given path, returning its publication.
+// RoutePrefix creates a route over prefix that serves the requests beneath it.
 //
-// The broadcast is invisible and unroutable, for this origin's consumers and
-// peers alike, until [Publication.Announce]. Announce it after populating
-// tracks. [BroadcastProducer.Close] ends it for good; dropping the last handle,
-// the publication included, does the same.
-func (o *OriginProducer) CreateBroadcast(path string) (*Publication, error) {
-	inner, err := o.inner.CreateBroadcast(path)
+// A route claims prefix and every path beneath it ("" claims every path). A
+// service that only serves some of them rejects the rest as they are requested.
+// Answer each [Route.Requested] request, and keep the route reachable while it
+// should stay advertised.
+func (o *OriginProducer) RoutePrefix(prefix string, options RouteOptions) (*Route, error) {
+	inner, err := o.inner.RoutePrefix(prefix, options)
 	if err != nil {
 		return nil, err
 	}
-	return newPublication(inner), nil
+	return newRoute(inner), nil
 }
 
-// Publication is a broadcast published on an origin: the broadcast to fill and
-// its announcement.
+// Route is a route on an origin: an exact route owning one broadcast, or a
+// prefix route yielding the requests beneath it.
 //
-// The collector reclaiming it does not retract the route; [BroadcastProducer.Close] does.
-type Publication struct {
-	inner     *ffi.MoqPublication
+// [Route.Cancel], or the collector reclaiming it, retracts the route, as does
+// closing an exact route's broadcast; a [BroadcastProducer] alone does not keep
+// it announced.
+type Route struct {
+	inner     *ffi.MoqRoute
 	broadcast *BroadcastProducer
 }
 
-func newPublication(inner *ffi.MoqPublication) *Publication {
-	return &Publication{inner: inner, broadcast: &BroadcastProducer{inner: inner.Broadcast()}}
+func newRoute(inner *ffi.MoqRoute) *Route {
+	route := &Route{inner: inner}
+	// A prefix route owns no broadcast.
+	if broadcast, err := inner.Broadcast(); err == nil {
+		route.broadcast = &BroadcastProducer{inner: broadcast}
+	}
+	return route
+}
+
+// Broadcast returns the broadcast an exact route owns, the same one on every
+// call, or an error on a prefix route, which owns none.
+func (r *Route) Broadcast() (*BroadcastProducer, error) {
+	if r.broadcast == nil {
+		_, err := r.inner.Broadcast()
+		return nil, err
+	}
+	return r.broadcast, nil
 }
 
-// Broadcast returns the broadcast to fill, the same one on every call.
-func (p *Publication) Broadcast() *BroadcastProducer {
-	return p.broadcast
+// Instance returns the stream this route serves, minted at creation unless
+// [RouteOptions] named one.
+func (r *Route) Instance() string {
+	return r.inner.InstanceId()
 }
 
-// Announce advertises the broadcast's exact path as a route.
-//
-// Announcing again re-prices the route in place. Until announced, the
-// broadcast is invisible and unroutable for local consumers and peers alike.
-// Errors with ErrClosed once the broadcast is closed.
-func (p *Publication) Announce(route AnnounceRoute) error {
-	return p.inner.Announce(route)
+// Announce makes the route visible, or keeps it so. A route from
+// [BroadcastRequest.Route] also answers the requesters waiting on its path.
+// Errors with ErrClosed once its broadcast is closed.
+func (r *Route) Announce() error {
+	return r.inner.Announce()
 }
 
-// Unannounce retracts the broadcast's exact-path advertisement, if any, from
-// local consumers and peers alike. Tracks already in flight carry on, and
-// Announce brings it back. Errors with ErrClosed once the broadcast is closed.
-func (p *Publication) Unannounce() error {
-	return p.inner.Unannounce()
+// Withdraw hides the route from local consumers and peers alike, keeping its
+// broadcast and instance. Tracks already in flight carry on, and Announce
+// brings the same stream back.
+func (r *Route) Withdraw() error {
+	return r.inner.Withdraw()
 }
 
-// OriginRequests streams requests for paths with no existing exact-path broadcast.
-type OriginRequests struct {
-	inner *ffi.MoqOriginRequests
+// SetCost re-prices the route in place: lower wins among routes covering the
+// same prefix. A hidden route keeps the price for when it next announces.
+func (r *Route) SetCost(cost uint64) error {
+	return r.inner.SetCost(cost)
 }
 
-// RequestedBroadcast blocks until a consumer requests a path with no existing
-// exact-path broadcast.
-func (d *OriginRequests) RequestedBroadcast(ctx context.Context) (*BroadcastRequest, error) {
-	inner, err := bridge.CallHandle(ctx, d.inner.Cancel, d.inner.RequestedBroadcast)
-	if err != nil {
+// Requested blocks until a consumer requests a path beneath this prefix route,
+// returning (nil, nil) once the origin closes, and at once on an exact route.
+//
+// Cancelling ctx abandons only this wait: the route stays advertised.
+func (r *Route) Requested(ctx context.Context) (*BroadcastRequest, error) {
+	inner, err := bridge.CallRelease(ctx, nil, r.inner.Requested, func(request **ffi.MoqBroadcastRequest) {
+		if request != nil {
+			(*request).Destroy()
+		}
+	})
+	if err != nil || inner == nil {
 		return nil, err
 	}
-	return &BroadcastRequest{inner: inner}, nil
+	return &BroadcastRequest{inner: *inner}, nil
 }
 
-// All ranges over requested broadcasts until the stream errors or the loop
-// breaks.
-func (d *OriginRequests) All(ctx context.Context) iter.Seq2[*BroadcastRequest, error] {
-	return bridge.Seq(ctx, d.RequestedBroadcast)
+// All ranges over requested broadcasts until the route ends, a call errors, or
+// the loop breaks.
+func (r *Route) All(ctx context.Context) iter.Seq2[*BroadcastRequest, error] {
+	return bridge.Seq(ctx, r.Requested)
 }
 
-// Cancel stops serving requested broadcasts and retracts the route.
-func (d *OriginRequests) Cancel() {
-	d.inner.Cancel()
+// Cancel retracts the route now, rather than when the collector reclaims it.
+// Pending requests are rejected and later calls fail with ErrCancelled. An exact
+// route's broadcast lives on until [BroadcastProducer.Close].
+func (r *Route) Cancel() {
+	r.inner.Cancel()
 }
 
-// BroadcastRequest is a requested broadcast that has not been accepted yet.
+// BroadcastRequest is a requested broadcast that has not been answered yet.
 type BroadcastRequest struct {
 	inner *ffi.MoqBroadcastRequest
 }
@@ -133,13 +160,17 @@ func (r *BroadcastRequest) Path() (string, error) {
 	return r.inner.Path()
 }
 
-// Prepare starts answering as a new stream under a fresh instance, hidden until published.
-func (r *BroadcastRequest) Prepare() (*BroadcastPrepared, error) {
-	inner, err := r.inner.Prepare()
+// Route answers with the path's own exact route, owning a new broadcast.
+//
+// It serves a fresh instance unless options names one. Created visible, it
+// announces now and answers the waiting requesters; created hidden, they wait
+// until [Route.Announce], so the job can fill its catalog first.
+func (r *BroadcastRequest) Route(options RouteOptions) (*Route, error) {
+	inner, err := r.inner.Route(options)
 	if err != nil {
 		return nil, err
 	}
-	return &BroadcastPrepared{inner: inner}, nil
+	return newRoute(inner), nil
 }
 
 // Serve answers with held content under the prefix route's continuous sequence space,
@@ -153,31 +184,6 @@ func (r *BroadcastRequest) Reject(errorCode uint16) error {
 	return r.inner.Reject(errorCode)
 }
 
-// BroadcastPrepared is a claim answer being filled before announcement.
-type BroadcastPrepared struct {
-	inner *ffi.MoqBroadcastPrepared
-}
-
-// Broadcast returns the unannounced broadcast to fill before publishing; only Publish announces it.
-func (p *BroadcastPrepared) Broadcast() *BroadcastProducer {
-	return &BroadcastProducer{inner: p.inner.Broadcast()}
-}
-
-// Publish announces the answer and resolves every waiting requester, returning
-// its publication.
-func (p *BroadcastPrepared) Publish() (*Publication, error) {
-	inner, err := p.inner.Publish()
-	if err != nil {
-		return nil, err
-	}
-	return newPublication(inner), nil
-}
-
-// Close abandons the answer if it was not published, refusing every waiting requester.
-func (p *BroadcastPrepared) Close() {
-	p.inner.Destroy()
-}
-
 // OriginConsumer discovers and requests broadcasts published to an origin.
 type OriginConsumer struct {
 	inner *ffi.MoqOriginConsumer
diff --git a/go/wrapper/origin_internal_test.go b/go/wrapper/origin_internal_test.go
index d0c9fd04b4e..e3f2de5544b 100644
--- a/go/wrapper/origin_internal_test.go
+++ b/go/wrapper/origin_internal_test.go
@@ -35,15 +35,15 @@ func TestOriginEndsWithItsProducer(t *testing.T) {
 	}
 }
 
-// An OriginRequests owns its origin: once the collector finalizes the last
+// A prefix Route owns its origin: once the collector finalizes the last
 // OriginProducer, the route still serves and a consumer made earlier still
 // resolves through it.
-func TestRequestsKeepTheOrigin(t *testing.T) {
+func TestRouteKeepsTheOrigin(t *testing.T) {
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 	defer cancel()
 
 	origin := NewOriginProducer()
-	dynamic, err := origin.Requests("")
+	dynamic, err := origin.RoutePrefix("", RouteOptions{})
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -62,19 +62,15 @@ func TestRequestsKeepTheOrigin(t *testing.T) {
 		requested <- result{broadcast: broadcast, err: err}
 	}()
 
-	request, err := dynamic.RequestedBroadcast(ctx)
-	if err != nil {
-		t.Fatalf("RequestedBroadcast err = %v, want a request", err)
-	}
-	prepared, err := request.Prepare()
-	if err != nil {
-		t.Fatal(err)
+	request, err := dynamic.Requested(ctx)
+	if err != nil || request == nil {
+		t.Fatalf("Requested = (%v, %v), want a request", request, err)
 	}
-	served, err := prepared.Publish()
+	served, err := request.Route(RouteOptions{})
 	if err != nil {
 		t.Fatal(err)
 	}
-	defer func() { _ = served.Broadcast().Close() }()
+	defer func() { _ = served.broadcast.Close() }()
 
 	var res result
 	select {
@@ -87,34 +83,37 @@ func TestRequestsKeepTheOrigin(t *testing.T) {
 	}
 }
 
-// Releasing a publication, which is what its finalizer does, keeps the route:
-// only closing the broadcast retracts it.
-func TestReleasingAPublicationKeepsItsRoute(t *testing.T) {
+// Releasing a route, which is what its finalizer does, retracts it: the
+// broadcast alone keeps nothing announced, though it lives on until closed.
+func TestReleasingARouteRetractsIt(t *testing.T) {
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 	defer cancel()
 
 	origin := NewOriginProducer()
 	consumer := origin.Consume()
-	publication, err := origin.CreateBroadcast("live")
+	route, err := origin.Route("live", RouteOptions{})
 	if err != nil {
 		t.Fatal(err)
 	}
-	if err := publication.Announce(AnnounceRoute{}); err != nil {
+	broadcast, err := route.Broadcast()
+	if err != nil {
 		t.Fatal(err)
 	}
-	broadcast := publication.Broadcast()
-	if broadcast != publication.Broadcast() {
+	if again, _ := route.Broadcast(); again != broadcast {
 		t.Fatal("Broadcast must return the same producer on every call")
 	}
-	publication.inner.Destroy()
-
 	if _, err := consumer.Request(ctx, "live", nil); err != nil {
-		t.Fatalf("Request = %v, want the released publication's broadcast", err)
+		t.Fatalf("Request = %v, want the route's broadcast", err)
+	}
+	route.inner.Destroy()
+
+	if _, err := consumer.Request(ctx, "live", nil); err == nil {
+		t.Fatal("a released route must be unroutable")
+	}
+	if _, err := broadcast.PublishTrack("data", nil); err != nil {
+		t.Fatalf("PublishTrack = %v, want the broadcast still open", err)
 	}
 	if err := broadcast.Close(); err != nil {
 		t.Fatal(err)
 	}
-	if _, err := consumer.Request(ctx, "live", nil); err == nil {
-		t.Fatal("a closed broadcast must be unroutable")
-	}
 }
diff --git a/go/wrapper/publish.go b/go/wrapper/publish.go
index 7abebe48368..02c28eb680d 100644
--- a/go/wrapper/publish.go
+++ b/go/wrapper/publish.go
@@ -10,8 +10,8 @@ import (
 )
 
 // BroadcastProducer publishes a collection of tracks. Create one at a path with
-// [OriginProducer.CreateBroadcast] (or [Client.CreateBroadcast]) and take it
-// from the [Publication], then publish tracks onto it.
+// [OriginProducer.Route] (or [Client.Route]) and take it from the [Route], then
+// publish tracks onto it.
 type BroadcastProducer struct {
 	inner *ffi.MoqBroadcastProducer
 }
@@ -19,7 +19,7 @@ type BroadcastProducer struct {
 // NewBroadcastProducer creates a standalone broadcast, not attached to any
 // origin: pass its [BroadcastProducer.Consume] result to [BroadcastRequest.Serve]
 // for a dynamic request, or use it for local pub/sub. To publish at a path, use
-// [OriginProducer.CreateBroadcast].
+// [OriginProducer.Route].
 func NewBroadcastProducer() (*BroadcastProducer, error) {
 	inner, err := ffi.NewMoqBroadcastProducer()
 	if err != nil {
diff --git a/go/wrapper/reconnect_test.go b/go/wrapper/reconnect_test.go
index 398fe4f8a66..0926f488c1e 100644
--- a/go/wrapper/reconnect_test.go
+++ b/go/wrapper/reconnect_test.go
@@ -184,11 +184,15 @@ func TestReconnectAcrossRelayRestart(t *testing.T) {
 	publisher := dialWorker(t, ctx, url)
 	defer publisher.Close()
 
-	publication, err := publisher.CreateBroadcast("live")
+	route, err := publisher.Route("live", moq.RouteOptions{Hidden: true})
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer route.Cancel()
+	broadcast, err := route.Broadcast()
 	if err != nil {
 		t.Fatal(err)
 	}
-	broadcast := publication.Broadcast()
 	defer broadcast.Close()
 
 	track, err := broadcast.PublishTrack("data", timedInfo())
@@ -196,7 +200,7 @@ func TestReconnectAcrossRelayRestart(t *testing.T) {
 		t.Fatal(err)
 	}
 	defer track.Finish()
-	if err := publication.Announce(moq.AnnounceRoute{}); err != nil {
+	if err := route.Announce(); err != nil {
 		t.Fatal(err)
 	}
 
diff --git a/go/wrapper/runtime_bench_test.go b/go/wrapper/runtime_bench_test.go
index 5507f55d70c..0d01fb69477 100644
--- a/go/wrapper/runtime_bench_test.go
+++ b/go/wrapper/runtime_bench_test.go
@@ -150,11 +150,15 @@ func benchThroughput(b *testing.B, c benchCase) {
 	origin := moq.NewOriginProducerWithConfig(moq.OriginConfig{CacheCapacityBytes: &cacheBytes})
 	// The origin owns the cache policy; keep it until the case ends.
 	b.Cleanup(func() { runtime.KeepAlive(origin) })
-	publication, err := origin.CreateBroadcast("bench")
+	route, err := origin.Route("bench", moq.RouteOptions{Hidden: true})
+	if err != nil {
+		b.Fatal(err)
+	}
+	b.Cleanup(func() { runtime.KeepAlive(route) })
+	broadcast, err := route.Broadcast()
 	if err != nil {
 		b.Fatal(err)
 	}
-	broadcast := publication.Broadcast()
 	b.Cleanup(func() { _ = broadcast.Close() })
 	tracks := make([]*moq.TrackProducer, c.publishers)
 	consumers := make([]*moq.TrackConsumer, 0, c.publishers*c.subscribers)
diff --git a/go/wrapper/server.go b/go/wrapper/server.go
index 2247aa52cd0..c81e5e30029 100644
--- a/go/wrapper/server.go
+++ b/go/wrapper/server.go
@@ -215,14 +215,14 @@ func (s *Server) CertFingerprints() ([]string, error) {
 	return s.inner.CertFingerprints()
 }
 
-// CreateBroadcast creates an unannounced broadcast at path, invisible to everyone until announced. Announce it after populating tracks.
+// Route creates a route at exactly path on the publish origin, owning a new broadcast to fill.
 //
-// See [OriginProducer.CreateBroadcast].
-func (s *Server) CreateBroadcast(path string) (*Publication, error) {
+// See [OriginProducer.Route].
+func (s *Server) Route(path string, options RouteOptions) (*Route, error) {
 	if s.publishOrigin == nil {
 		return nil, ErrNoPublishOrigin
 	}
-	return s.publishOrigin.CreateBroadcast(path)
+	return s.publishOrigin.Route(path, options)
 }
 
 // Accept returns the next incoming request, or (nil, nil) when the server stops.
diff --git a/go/wrapper/types.go b/go/wrapper/types.go
index 5f1b7e08c5f..787a68d6edb 100644
--- a/go/wrapper/types.go
+++ b/go/wrapper/types.go
@@ -33,16 +33,18 @@ type (
 	ProtocolKind = ffi.MoqProtocolKind
 	// OriginConfig configures a new origin, such as its maximum cache size in bytes.
 	OriginConfig = ffi.MoqOriginConfig
-	// AnnounceRoute is how a broadcast advertises its exact path: its static production Cost (lower wins) and, optionally, a stable Instance.
-	// A nil Instance keeps the one the broadcast minted, which it keeps across re-announcing, so a restarted
-	// publisher is a new stream viewers restart onto. Set one only for a publisher that continues its group
-	// sequences across restarts and raises Epoch on each: readers stitch every route of one instance together,
-	// so restarting the sequences under an old instance splices unrelated groups into their tracks.
-	AnnounceRoute = ffi.MoqAnnounceRoute
-	// Route is an observed route: the Instance of the stream it serves (routes with one instance are one continuous stream), the hop chain it took to reach an origin, and its static production and link cost (lower wins).
-	Route = ffi.MoqRoute
+	// RouteOptions is how a [Route] advertises itself: Hidden until [Route.Announce], its static
+	// production Cost (lower wins) and, optionally, a stable Instance. The zero value is visible at
+	// once, at cost 0, under a fresh instance the route keeps for its lifetime, so a restarted
+	// publisher is a new stream viewers restart onto. Set Instance only for a publisher that
+	// continues its group sequences across restarts and raises Epoch on each: readers stitch every
+	// route of one instance together, so restarting the sequences under an old instance splices
+	// unrelated groups into their tracks.
+	RouteOptions = ffi.MoqRouteOptions
+	// RouteInfo is the read-only facts on a received route: the Instance of the stream it serves (routes with one instance are one continuous stream), the hop chain it took to reach an origin, and its static production and link cost (lower wins).
+	RouteInfo = ffi.MoqRouteInfo
 	// Announce is a route over a prefix: the origin-relative Prefix, what each filter
-	// wildcard matched (Captures), and the Route serving it. It carries no broadcast;
+	// wildcard matched (Captures), and the RouteInfo serving it. It carries no broadcast;
 	// resolve a path with [OriginConsumer.Request]. Captures is a required slice,
 	// empty when the filter has no wildcards.
 	Announce = ffi.MoqAnnounce
diff --git a/js/crypto/README.md b/js/crypto/README.md
index 29316633daf..09b85db380c 100644
--- a/js/crypto/README.md
+++ b/js/crypto/README.md
@@ -36,10 +36,11 @@ const { Broadcast, SecretKey } = Sign;
 
 const key = await SecretKey.generate();
 const path = Path.from(`mesh/${key.public}/agent`);
-const publication = origin.createBroadcast(path);
-const signed = new Broadcast.Producer(publication.broadcast, key, path);
+const route = origin.route(path, { hidden: true });
+// Signs under the route's instance, which readers verify against.
+const signed = new Broadcast.Producer(route.broadcast, key, { path, instance: route.instance });
 const messages = signed.createTrack("messages");
-publication.announce({ instance: signed.instance });
+route.announce();
 
 const group = messages.appendGroup();
 await group.writeFrame(undefined, payload);
@@ -87,15 +88,19 @@ every write is checked against it. `close()` ends the wrapped broadcast.
 import { E2ee } from "@moq/crypto";
 import { Time } from "@moq/net";
 
-const { Broadcast, Credential } = E2ee;
+const { Broadcast, Credential, Epoch } = E2ee;
 
 const credential = new Credential({ context, kid, secret });
 const generation = credential.produce();
-const publication = origin.createBroadcast(await credential.path("meeting.hang"));
-const video = await new Broadcast.Producer(publication.broadcast, generation).createTrack("video", {
+// The route's instance names the generation's epoch, so subscribers find the key.
+const route = origin.route(await credential.path("meeting.hang"), {
+	hidden: true,
+	instance: Epoch.instance(generation.epoch),
+});
+const video = await new Broadcast.Producer(route.broadcast, generation).createTrack("video", {
 	timescale: Time.Timescale.MILLI,
 });
-publication.announce({ epoch: generation.epoch });
+route.announce();
 
 const group = video.appendGroup();
 await group.writeFrame(Time.Timestamp.now(), frame);
@@ -105,8 +110,8 @@ video.close();
 ```
 
 A subscriber follows `credential.path(semantic)` with `origin.follow(path)`. It takes each
-instance's epoch from the broadcast it resolved, `broadcast.epoch` (or from the application's
-channel on a wire without route epochs), so the key always matches the instance it reads. It
+instance's epoch from the broadcast it resolved, `Epoch.of(broadcast)` (or from the application's
+channel on a wire without route instances), so the key always matches the instance it reads. It
 binds the epoch with `credential.consume(epoch)` and wraps the broadcast in a
 `Broadcast.Consumer`. Its
 `subscribe(semantic)` opens the track a decrypted catalog names, and `close()` releases the
diff --git a/js/crypto/src/e2ee/index.ts b/js/crypto/src/e2ee/index.ts
index 949c58e758e..c7db9f1270a 100644
--- a/js/crypto/src/e2ee/index.ts
+++ b/js/crypto/src/e2ee/index.ts
@@ -7,8 +7,8 @@
  *
  * A {@link Credential} is what the application distributes out of band. Each publisher instance
  * calls {@link Credential.produce} to mint a {@link Generation.Producer} and wraps its `@moq/net`
- * broadcast in a {@link Broadcast.Producer}, announcing the generation's epoch as its route's
- * instance. Subscribers follow the path, read each instance's epoch with {@link Epoch.of} from
+ * broadcast in a {@link Broadcast.Producer}, creating its route under the generation's epoch as
+ * its instance. Subscribers follow the path, read each instance's epoch with {@link Epoch.of} from
  * the broadcast it resolved, bind a {@link Generation.Consumer} with
  * {@link Credential.consume}, and wrap the broadcast in a {@link Broadcast.Consumer}. Both sides name tracks by their semantic names; only the
  * derived physical names reach `@moq/net`.
@@ -16,9 +16,12 @@
  * ```ts
  * const credential = new Credential({ context, kid, secret });
  * const generation = credential.produce();
- * const publication = origin.createBroadcast(await credential.path("meeting.hang"));
- * const video = await new Broadcast.Producer(publication.broadcast, generation).createTrack("video", { timescale });
- * publication.announce({ instance: Epoch.instance(generation.epoch) });
+ * const route = origin.route(await credential.path("meeting.hang"), {
+ *   hidden: true,
+ *   instance: Epoch.instance(generation.epoch),
+ * });
+ * const video = await new Broadcast.Producer(route.broadcast, generation).createTrack("video", { timescale });
+ * route.announce();
  *
  * const group = video.appendGroup();
  * await group.writeFrame(timestamp, frame);
diff --git a/js/crypto/src/e2ee/transport.test.ts b/js/crypto/src/e2ee/transport.test.ts
index 176690027de..712f105a042 100644
--- a/js/crypto/src/e2ee/transport.test.ts
+++ b/js/crypto/src/e2ee/transport.test.ts
@@ -62,12 +62,12 @@ for (const [name, protocol, routed, timed] of transports) {
 		const cred = credential();
 		const generation = cred.produce();
 		const path = await cred.path("meeting.hang");
-		const broadcastPublication = publisher.createBroadcast(path);
-		const broadcast = broadcastPublication.broadcast;
+		const broadcastRoute = publisher.route(path, { hidden: true, instance: Epoch.instance(generation.epoch) });
+		const broadcast = broadcastRoute.broadcast;
 		const video = await new Protected.Producer(broadcast, generation).createTrack("video", {
 			timescale: Time.Timescale.MILLI,
 		});
-		broadcastPublication.announce({ instance: Epoch.instance(generation.epoch) });
+		broadcastRoute.announce();
 
 		const group = video.appendGroup();
 		await group.writeFrame(ms(1), encoder.encode("keyframe"));
@@ -119,12 +119,12 @@ for (const [name, protocol] of [
 		const cred = credential();
 		const generation = cred.produce();
 		const path = await cred.path("meeting.hang");
-		const broadcastPublication = publisher.createBroadcast(path);
-		const broadcast = broadcastPublication.broadcast;
+		const broadcastRoute = publisher.route(path, { hidden: true, instance: Epoch.instance(generation.epoch) });
+		const broadcast = broadcastRoute.broadcast;
 		const audio = await new Protected.Producer(broadcast, generation).createDatagrams("audio", {
 			timescale: Time.Timescale.MILLI,
 		});
-		broadcastPublication.announce({ instance: Epoch.instance(generation.epoch) });
+		broadcastRoute.announce();
 
 		const remote = await active(subscriber, path);
 		const consumer = await new Protected.Consumer(
diff --git a/js/crypto/src/sign/broadcast.ts b/js/crypto/src/sign/broadcast.ts
index fecfde5f21d..5d7ffebb90a 100644
--- a/js/crypto/src/sign/broadcast.ts
+++ b/js/crypto/src/sign/broadcast.ts
@@ -15,23 +15,32 @@ import * as Track from "./track.ts";
 /**
  * The publishing side of a signed broadcast.
  *
- * Mints a fresh instance, so a restart never signs a sequence an earlier instance already signed.
- * Announce the wrapped broadcast with {@link instance} on its route.
+ * Signs under the instance of the route that serves it, which a route mints fresh, so a restart
+ * never signs a sequence an earlier instance already signed.
  */
 export class Producer {
-	/** The instance this producer signs under, to announce on the broadcast's route. */
-	readonly instance: Instance.Valid = Instance.random();
+	/** The instance this producer signs under: the route's that serves the broadcast. */
+	readonly instance: Instance.Valid;
 	#inner: NetBroadcast.Producer;
 	#key: SecretKey;
 	#path: Path.Valid;
 	// Each track's lowest unsigned sequence, kept across the track's replacements.
 	#sequences = new Map<string, Track.Sequences>();
 
-	/** Sign `inner` with `key`, as the broadcast at application path `path`, taking ownership of it: {@link close} ends it. */
-	constructor(inner: NetBroadcast.Producer, key: SecretKey, path: Path.Valid) {
+	/**
+	 * Sign `inner` with `key`, as the broadcast at application path `path` served under `instance`,
+	 * taking ownership of it: {@link close} ends it. Pass the instance of the route that serves it,
+	 * such as `route.instance` for the route that owns `inner`.
+	 */
+	constructor(
+		inner: NetBroadcast.Producer,
+		key: SecretKey,
+		{ path, instance }: { path: Path.Valid; instance: Instance.Valid },
+	) {
 		this.#inner = inner;
 		this.#key = key;
 		this.#path = path;
+		this.instance = instance;
 	}
 
 	/** Settles with `null` once the wrapped broadcast closes, as `@moq/net`'s `closed` does. */
diff --git a/js/crypto/src/sign/index.ts b/js/crypto/src/sign/index.ts
index b840f107158..8b9e5b4704d 100644
--- a/js/crypto/src/sign/index.ts
+++ b/js/crypto/src/sign/index.ts
@@ -13,10 +13,10 @@
  * ```ts
  * const key = await SecretKey.generate();
  * const path = Path.from(`mesh/${key.public}/agent`);
- * const publication = origin.createBroadcast(path);
- * const signed = new Broadcast.Producer(publication.broadcast, key, path);
+ * const route = origin.route(path, { hidden: true });
+ * const signed = new Broadcast.Producer(route.broadcast, key, { path, instance: route.instance });
  * const messages = signed.createTrack("messages");
- * publication.announce({ instance: signed.instance });
+ * route.announce();
  *
  * const group = messages.appendGroup();
  * await group.writeFrame(undefined, payload);
diff --git a/js/crypto/src/sign/sign.test.ts b/js/crypto/src/sign/sign.test.ts
index d2f1d01da46..342bb759c24 100644
--- a/js/crypto/src/sign/sign.test.ts
+++ b/js/crypto/src/sign/sign.test.ts
@@ -46,15 +46,14 @@ async function active(origin: Origin.Producer, path: Path.Valid): Promise<Broadc
 /** A signed broadcast at `path` on a fresh session, and the raw net broadcast under it. */
 async function publish(key: SecretKey, path: Path.Valid) {
 	const net = await session();
-	const publication = net.publisher.createBroadcast(path);
-	const signed = new Signed.Producer(publication.broadcast, key, path);
-	publication.announce({ instance: signed.instance });
+	const route = net.publisher.route(path);
+	const signed = new Signed.Producer(route.broadcast, key, { path, instance: route.instance });
 	return {
 		...net,
 		signed,
 		/** A signed track over a net track the test can also write forged frames to. */
 		track(name: string) {
-			const raw = publication.broadcast.createTrack(name);
+			const raw = route.broadcast.createTrack(name);
 			const scope = new Scope(path, signed.instance, name);
 			return { signed: Track.Producer.make(raw, key, scope, { next: 0n }, {}), raw };
 		},
diff --git a/js/hang/src/catalog/consumer.test.ts b/js/hang/src/catalog/consumer.test.ts
index 905f9c0ae94..e1e7b89e4f1 100644
--- a/js/hang/src/catalog/consumer.test.ts
+++ b/js/hang/src/catalog/consumer.test.ts
@@ -87,11 +87,11 @@ function referencing(broadcast: string): Root {
 // Watch the catalog of `room/alice`, published through an origin and requested from it.
 async function watchRequested(root: Root) {
 	const origin = new Moq.Origin.Producer();
-	const broadcastPublication = origin.createBroadcast(Moq.Path.from("room/alice"));
-	const broadcast = broadcastPublication.broadcast;
+	const broadcastRoute = origin.route(Moq.Path.from("room/alice"), { hidden: true });
+	const broadcast = broadcastRoute.broadcast;
 	const track = broadcast.createTrack(TRACK, { timescale: Moq.Time.Timescale.MILLI });
 	const producer = new Json.Snapshot.Producer<Root>({ track, deltas: false });
-	broadcastPublication.announce();
+	broadcastRoute.announce();
 	const request = origin.request(Moq.Path.from("room/alice"));
 	const active = request.active.peek();
 	if (!active) throw new Error("request did not resolve");
diff --git a/js/moq-boy/src/game.test.ts b/js/moq-boy/src/game.test.ts
index 4070d14ef80..57f48e84873 100644
--- a/js/moq-boy/src/game.test.ts
+++ b/js/moq-boy/src/game.test.ts
@@ -58,8 +58,7 @@ test("status skips values that fail the schema and ends when the track errors",
 
 	const connection = new Moq.Connection({ enabled: false });
 	const origin = new Moq.Origin.Producer();
-	const publication = origin.createBroadcast(Moq.Path.from("game", "test"));
-	publication.announce();
+	const publication = origin.route(Moq.Path.from("game", "test"));
 	const track = publication.broadcast.createTrack("status");
 
 	// One finished group per status, so between statuses the loop waits on the next group.
diff --git a/js/moq-boy/src/game.ts b/js/moq-boy/src/game.ts
index bbfff3d1d06..7c8fa6a6fb3 100644
--- a/js/moq-boy/src/game.ts
+++ b/js/moq-boy/src/game.ts
@@ -323,13 +323,10 @@ export class Game {
 		const viewerId = Math.random().toString(36).slice(2, 8);
 		this.viewerId.set(viewerId);
 
-		const viewerBroadcastPublication = origin.createBroadcast(
-			Moq.Path.from(this.#viewerPrefix, this.sessionId, viewerId),
-		);
-		const viewerBroadcast = viewerBroadcastPublication.broadcast;
-		viewerBroadcastPublication.announce();
+		const viewerRoute = origin.route(Moq.Path.from(this.#viewerPrefix, this.sessionId, viewerId));
+		const viewerBroadcast = viewerRoute.broadcast;
 		effect.cleanup(() => {
-			viewerBroadcast.close();
+			viewerRoute.close();
 			this.viewerId.set(undefined);
 		});
 
diff --git a/js/net/MIGRATE.md b/js/net/MIGRATE.md
index 2804c5431d1..598de2f1853 100644
--- a/js/net/MIGRATE.md
+++ b/js/net/MIGRATE.md
@@ -40,6 +40,48 @@ currently refuses them while its separate datagram-track adapter is implemented.
 `Announce.Event` is `{ kind: "present" | "absent" } & Announce`. Another instance taking a path over keeps it present, and a route's cost or hops changing is not reported, so `start`, `update`, `restart` and `end` are gone.
 Map `"start"` to `"present"` and `"end"` to `"absent"`, and drop `"update"` branches. Where you requested the path again on `"restart"`, hold `origin.follow(path)`: its `active` moves to each new instance's broadcast.
 
+### One `Origin.Route` handle replaces publications, claims, and prepared answers
+
+`Origin.Producer.createBroadcast`, `requests`, and `requestsRoute`, and the `Origin.Publication`, `Origin.Prepared`, and `Origin.Requests` classes are gone.
+An `Origin.Route` owns what you publish: `origin.route(path, options?)` creates an exact route that owns a new broadcast, and `origin.routePrefix(prefix, options?)` creates a prefix route that yields requests.
+A route is visible at once unless created with `{ hidden: true }`; `announce()` and `withdraw()` toggle it, `announced` says which, and `close()` retracts it and closes its broadcast, as closing the broadcast does.
+Its `instance` is minted when the route is created and kept across `withdraw()` and `announce()`, so a reader continues rather than restarts. A new route is a new stream.
+`RouteOptions` sets what `announce(route)` took: `cost`, `auth`, and a stable `instance` with its `epoch`. Re-price with `setCost(cost)` and swap the credential with `setAuth(auth)`.
+
+```ts
+// Before
+const publication = origin.createBroadcast(path);
+publication.broadcast.createTrack("catalog.json");
+publication.announce({ cost: 5n });
+publication.unannounce();
+
+// After
+const route = origin.route(path, { hidden: true, cost: 5n });
+route.broadcast.createTrack("catalog.json");
+route.announce();
+route.withdraw(); // announce() again continues the same instance
+```
+
+Drop the separate `announce()` call when nothing needs filling first: `origin.route(path)` is already visible.
+A prefix route replaces `requests(prefix)`: iterate `route.requested()` as before, and answer each request with `serve(broadcast)`, `reject(err)`, or `request.route(options?)`, which replaces `prepare()` and `Prepared.publish()`.
+A job's route is visible at once and answers the waiting requesters unless created hidden; a hidden one answers them on `announce()`, and closing it or its broadcast before then refuses them as `Unroutable`.
+
+```ts
+// Before
+using prepared = request.prepare();
+prepared.broadcast.createTrack("video");
+const publication = prepared.publish();
+
+// After
+const job = request.route({ hidden: true });
+job.broadcast.createTrack("video");
+job.announce();
+```
+
+`route.broadcast` throws on a prefix route, and `requested()` ends at once on an exact one.
+The route metadata interface `Origin.Route` is now the read-only `Origin.RouteInfo`, carried on announce events; applications never build one.
+`Origin.Table` exposes `route` and `routePrefix` in place of `createBroadcast`, `requests`, and `requestsRoute`, and `Origin.RequestSlot` and `Origin.RouteEntry` are no longer exported.
+
 ### Opens wait their turn for stream credit ([#7894](https://github.com/moq-dev/moq/pull/7894))
 
 `NoStreamCredit` is removed: a request no longer fails when the peer grants no more streams. Every open waits for credit, and returning credit goes to the open with the highest `sendOrder`. A request's 10s deadline runs only while none of its streams waits to open.
diff --git a/js/net/api/index.api.md b/js/net/api/index.api.md
index 3d7994b6aa3..d121e0b669d 100644
--- a/js/net/api/index.api.md
+++ b/js/net/api/index.api.md
@@ -11,7 +11,7 @@ export namespace Announce {
 	export interface Announce {
 		captures: Path.Pattern[] | undefined;
 		prefix: Path.Valid;
-		route: Origin.Route;
+		route: Origin.RouteInfo;
 	}
 	export class Consumer {
 		[Symbol.asyncIterator](): AsyncGenerator<Announce.Event, void, undefined>;
@@ -466,37 +466,19 @@ export namespace Origin {
 	}
 	export type Hop = infer<typeof Origin.HopSchema>;
 	export const HopSchema: $ZodBranded<ZodMiniBigInt<bigint>, "Hop", "out">;
-	export class Prepared {
-		[Symbol.dispose](): void;
-		readonly broadcast: Broadcast.Producer;
-		close(): void;
-		publish(): Origin.Publication;
-	}
 	export class Producer implements Origin.Table {
 		constructor();
 		announced(scope?: Path.Pattern, options?: Announce.Options): Announce.Consumer;
 		close(abort?: Error): void;
 		get closed(): Signals.GetPromise<Error | null>;
 		consume(): Origin.Consumer;
-		createBroadcast(path: Path.Valid): Origin.Publication;
 		get discovery(): Signals.Getter<boolean | undefined>;
 		follow(path: Path.Valid, options?: Origin.FollowOptions): Origin.Following;
 		request(path: Path.Valid, options?: Origin.RequestOptions): Origin.Requesting;
-		requests(prefix: Path.Valid): Origin.Requests;
+		route(path: Path.Valid, options?: Origin.RouteOptions): Origin.Route;
+		routePrefix(prefix: Path.Valid, options?: Origin.RouteOptions): Origin.Route;
 		scope(root: Path.Valid, patterns: Path.Patterns): Origin.Producer;
 	}
-	export class Publication {
-		announce(route?: Origin.Route | {
-			auth?: Origin.Route["auth"];
-			cost?: Origin.Route["cost"];
-			epoch?: Origin.Route["epoch"];
-			hops?: Origin.Route["hops"];
-			instance?: Origin.Route["instance"];
-		}): void;
-		readonly broadcast: Broadcast.Producer;
-		get route(): Origin.Route | undefined;
-		unannounce(): void;
-	}
 	export interface Reader {
 		announced(scope?: Path.Pattern, options?: Announce.Options): Announce.Consumer;
 		readonly closed: Signals.GetPromise<Error | null>;
@@ -506,8 +488,8 @@ export namespace Origin {
 	}
 	export class Request {
 		readonly path: Path.Valid;
-		prepare(): Origin.Prepared;
 		reject(err: Error): void;
+		route(options?: Origin.RouteOptions): Origin.Route;
 		serve(source: Broadcast.Producer | Broadcast.Consumer): void;
 	}
 	export interface RequestOptions {
@@ -519,24 +501,37 @@ export namespace Origin {
 		readonly closed: Signals.GetPromise<Error | null>;
 		readonly path: Path.Valid;
 	}
-	export class Requests {
+	export class Route {
+		[Symbol.dispose](): void;
+		announce(): void;
+		get announced(): boolean;
+		get broadcast(): Broadcast.Producer;
 		close(): void;
-		readonly prefix: Path.Valid;
+		get instance(): Instance.Valid;
 		requested(): AsyncIterableIterator<Origin.Request>;
-		get route(): Origin.Route;
-	}
-	export interface Route {
+		setAuth(auth?: Auth.Credential): void;
+		setCost(cost: Origin.Cost): void;
+		withdraw(): void;
+	}
+	export interface RouteInfo {
+		readonly auth?: Auth.Credential;
+		readonly cost: Origin.Cost;
+		readonly epoch?: bigint;
+		readonly hops: readonly Origin.Hop[];
+		readonly instance?: Instance.Valid;
+	}
+	export interface RouteOptions {
 		auth?: Auth.Credential;
-		cost: Origin.Cost;
+		cost?: Origin.Cost;
 		epoch?: bigint;
-		hops: Origin.Hop[];
+		hidden?: boolean;
 		instance?: Instance.Valid;
 	}
 	export interface Table extends Origin.Reader {
-		createBroadcast(path: Path.Valid): Origin.Publication;
-		requests(prefix: Path.Valid): Origin.Requests;
+		route(path: Path.Valid, options?: Origin.RouteOptions): Origin.Route;
+		routePrefix(prefix: Path.Valid, options?: Origin.RouteOptions): Origin.Route;
 	}
-	export function isAnonymous(route: Origin.Route): boolean;
+	export function isAnonymous(route: Origin.RouteInfo): boolean;
 }
 
 export namespace Path {
diff --git a/js/net/bench/broadcasts.ts b/js/net/bench/broadcasts.ts
index eb38662b229..6349cdc34e5 100644
--- a/js/net/bench/broadcasts.ts
+++ b/js/net/bench/broadcasts.ts
@@ -4,7 +4,7 @@ import { Signal } from "@moq/signals";
 import type { Grant } from "../src/auth.ts";
 import { Producer as BroadcastProducer } from "../src/broadcast.ts";
 import { BroadcastCache } from "../src/consume.ts";
-import { HopSchema, Route } from "../src/hop.ts";
+import { HopSchema, RouteInfo } from "../src/hop.ts";
 import * as Instance from "../src/instance.ts";
 import { AnnounceRequest } from "../src/lite/announce.ts";
 import { Publisher } from "../src/lite/publisher.ts";
@@ -15,6 +15,7 @@ import { createMockTransportPair } from "../src/mock.ts";
 import { Producer } from "../src/origin.ts";
 import * as Path from "../src/path.ts";
 import { Stream, Writer } from "../src/stream.ts";
+import { wireOf } from "../src/wire.ts";
 
 // Keep protocol diagnostics out of the measured CSV on stdout.
 console.debug = console.error;
@@ -37,7 +38,7 @@ for (const scope of [
 		for (const observerCount of observerCounts) {
 			const origin = new Producer();
 			const handles = Array.from({ length: routeCount }, (_, index) =>
-				origin.requests(Path.from(`room/${index}${scope === "full-name" ? ".chat" : ""}`)),
+				origin.routePrefix(Path.from(`room/${index}${scope === "full-name" ? ".chat" : ""}`)),
 			);
 			const touched = Path.from(
 				scope === "rooted-producers" ? "0" : scope === "full-name" ? "room/0.chat" : "room/0",
@@ -75,7 +76,7 @@ for (const scope of [
 
 			const start = performance.now();
 			for (let index = 0; index < updates; index++) {
-				handles[0].updateRoute({ cost: BigInt(index + 1) });
+				handles[0].setCost(BigInt(index + 1));
 				await new Promise<void>((resolve) => setImmediate(resolve));
 			}
 			const elapsed = performance.now() - start;
@@ -132,16 +133,14 @@ for (const pinned of [false, true]) {
 			const origin = new Producer();
 			const reader = origin.consume();
 			const options = pinned ? { instance } : {};
-			const publishers = Array.from({ length: routeCount }, (_, index) => {
-				const sourcePublication = origin.createBroadcast(Path.from(`room/${index}`));
-				sourcePublication.announce({ instance });
-				return sourcePublication;
-			});
+			const publishers = Array.from({ length: routeCount }, (_, index) =>
+				origin.route(Path.from(`room/${index}`), { instance }),
+			);
 			const background = publishers.map((_, index) => reader.request(Path.from(`room/${index}`), options));
 			const requests = Array.from({ length: readerCount }, () => reader.request(Path.from("room/0"), options));
 			const start = performance.now();
 			for (let index = 0; index < updates; index++) {
-				publishers[0].announce({ instance, cost: BigInt(index + 1) });
+				publishers[0].setCost(BigInt(index + 1));
 				await Promise.resolve();
 				for (const request of requests) {
 					if (!request.active.peek()) throw new Error("same-instance request lost its front");
@@ -234,7 +233,7 @@ const nextInstance = Instance.parse("01900000-0000-7000-8000-000000000002");
 for (const pathCount of routeCounts) {
 	for (const readerCount of observerCounts) {
 		const origin = new Producer();
-		const dynamic = origin.requestsRoute(Path.from("room"), { instance });
+		const dynamic = origin.routePrefix(Path.from("room"), { instance });
 		const pending = dynamic.requested();
 		const requests = Array.from({ length: pathCount }, (_, index) =>
 			Array.from({ length: readerCount }, () => origin.consume().request(Path.from(`room/${index}`))),
@@ -247,7 +246,7 @@ for (const pathCount of routeCounts) {
 		await Promise.resolve();
 		const before = requests.map((request) => request.active.peek());
 		const start = performance.now();
-		dynamic.updateRoute({ instance: nextInstance });
+		wireOf(dynamic).update({ instance: nextInstance });
 		await Promise.resolve();
 		const elapsed = performance.now() - start;
 		for (const [index, request] of requests.entries()) {
@@ -269,7 +268,7 @@ for (const routeCount of routeCounts) {
 	for (const consumerCount of [8, 32, 128]) {
 		const cache = new BroadcastCache();
 		const owners = Array.from({ length: routeCount }, () => ({}));
-		for (let i = 0; i < routeCount; i++) cache.announce(Path.from(`pool/${i}`), owners[i], Route.default);
+		for (let i = 0; i < routeCount; i++) cache.announce(Path.from(`pool/${i}`), owners[i], RouteInfo.default);
 		const sources = Array.from({ length: consumerCount }, () => new BroadcastProducer());
 		const held = sources.map((source, i) => {
 			const path = Path.from(`pool/${i % routeCount}/job/${i}`);
@@ -278,7 +277,7 @@ for (const routeCount of routeCounts) {
 		const touched = Path.from("pool/0/job/0");
 		const start = performance.now();
 		for (let i = 0; i < 4096; i++) {
-			cache.announce(Path.from("pool/0"), owners[0], { ...Route.default, cost: BigInt(i) });
+			cache.announce(Path.from("pool/0"), owners[0], { ...RouteInfo.default, cost: BigInt(i) });
 			const shared = cache.get(touched, cache.instance(touched));
 			if (!shared || shared.closed !== held[0].closed) throw new Error("update replaced the source");
 			shared.close();
@@ -295,7 +294,7 @@ for (const routeCount of routeCounts) {
 	for (const consumerCount of [1, 8, 32]) {
 		const cache = new BroadcastCache();
 		const owners = Array.from({ length: routeCount }, () => ({}));
-		for (let i = 0; i < routeCount; i++) cache.announce(Path.from(`pool/${i}`), owners[i], Route.default);
+		for (let i = 0; i < routeCount; i++) cache.announce(Path.from(`pool/${i}`), owners[i], RouteInfo.default);
 		const sources = Array.from({ length: consumerCount }, () => new BroadcastProducer());
 		const paths = sources.map((_, i) => Path.from(`pool/0/job/${i}`));
 		const held = sources.map((source, i) => cache.insert(paths[i], cache.instance(paths[i]), source.consume()));
@@ -305,7 +304,7 @@ for (const routeCount of routeCounts) {
 		let duplicates = 0;
 		const start = performance.now();
 		for (let round = 0; round < 256; round++) {
-			if (round % 2 === 0) cache.announce(prefix, specific, { ...Route.default, instance });
+			if (round % 2 === 0) cache.announce(prefix, specific, { ...RouteInfo.default, instance });
 			else cache.withdraw(prefix, specific);
 			for (let i = 0; i < consumerCount; i++) {
 				const instance = cache.instance(paths[i]);
@@ -330,7 +329,7 @@ console.log("blind,announcements,consumers,invalidate_us,stale");
 for (const routeCount of routeCounts) {
 	for (const consumerCount of [1, 8, 32]) {
 		const cache = new BroadcastCache();
-		for (let i = 0; i < routeCount; i++) cache.announce(Path.from(`other/${i}`), {}, Route.default);
+		for (let i = 0; i < routeCount; i++) cache.announce(Path.from(`other/${i}`), {}, RouteInfo.default);
 		const source = new BroadcastProducer();
 		const keeper = source.consume();
 		const paths = Array.from({ length: consumerCount }, (_, i) => Path.from(`pool/job/${i}`));
@@ -341,7 +340,7 @@ for (const routeCount of routeCounts) {
 		for (let round = 0; round < 256; round++) {
 			const held = paths.map((path) => cache.insert(path, cache.instance(path), source.consume()));
 			const start = performance.now();
-			cache.announce(prefix, owner, Route.default);
+			cache.announce(prefix, owner, RouteInfo.default);
 			cache.withdraw(prefix, owner);
 			elapsed += performance.now() - start;
 			for (const path of paths) {
@@ -372,7 +371,7 @@ for (const routeCount of routeCounts) {
 			const held = [];
 			for (let route = 0; route < routeCount; route++) {
 				const prefix = Path.from(`route/${route}`);
-				cache.announce(prefix, owners[route], Route.default);
+				cache.announce(prefix, owners[route], RouteInfo.default);
 				for (let consumer = 0; consumer < (route === 0 ? consumerCount : 1); consumer++) {
 					const path = Path.from(`${prefix}/job/${consumer}`);
 					const instance = cache.instance(path);
@@ -403,9 +402,8 @@ for (const routeCount of routeCounts) {
 	for (const observerCount of observerCounts) {
 		const origin = new Producer();
 		const routes = Array.from({ length: routeCount }, (_, index) => {
-			const broadcastPublication = origin.createBroadcast(Path.from(`z/${index}`));
-			const broadcast = broadcastPublication.broadcast;
-			broadcastPublication.announce();
+			const broadcastRoute = origin.route(Path.from(`z/${index}`));
+			const broadcast = broadcastRoute.broadcast;
 			return broadcast;
 		});
 		const senders = Array.from({ length: observerCount }, () => {
@@ -429,9 +427,8 @@ for (const routeCount of routeCounts) {
 		await Promise.all(senders.map((sender) => sender.entered.promise));
 		const start = performance.now();
 		for (let index = 0; index < updates; index++) {
-			const broadcastPublication = origin.createBroadcast(Path.from(`a/${index}`));
-			const broadcast = broadcastPublication.broadcast;
-			broadcastPublication.announce();
+			const broadcastRoute = origin.route(Path.from(`a/${index}`));
+			const broadcast = broadcastRoute.broadcast;
 			await new Promise<void>((resolve) => setImmediate(resolve));
 			broadcast.close();
 			await new Promise<void>((resolve) => setImmediate(resolve));
diff --git a/js/net/bench/fetch.ts b/js/net/bench/fetch.ts
index b16a9c50d66..0728d2c2350 100644
--- a/js/net/bench/fetch.ts
+++ b/js/net/bench/fetch.ts
@@ -19,9 +19,8 @@ for (const groups of [2, 128]) {
 	for (const subscribers of [1, 8]) {
 		for (const size of [16, 1000, SEGMENT_BYTES * 2]) {
 			const origin = new Producer();
-			const publication = origin.createBroadcast(Path.from("fetch"));
-			publication.announce();
-			const track = publication.broadcast.createTrack("video", { maxAge: Milli(60_000) });
+			const route = origin.route(Path.from("fetch"));
+			const track = route.broadcast.createTrack("video", { maxAge: Milli(60_000) });
 			for (let sequence = 0; sequence < groups; sequence++) {
 				const group = track.appendGroup();
 				// Only the selected group needs payloads; the rest expose cache-table scans.
diff --git a/js/net/bench/fills.ts b/js/net/bench/fills.ts
index df3a607ab86..498fdcb86a7 100644
--- a/js/net/bench/fills.ts
+++ b/js/net/bench/fills.ts
@@ -19,8 +19,7 @@ console.log("groups,subscribers,fill_us");
 for (const groups of [2, 16, 128]) {
 	for (const subscribers of [1, 8]) {
 		const origin = new Producer();
-		const publication = origin.createBroadcast(Path.from("fills"));
-		publication.announce();
+		const publication = origin.route(Path.from("fills"));
 		const track = publication.broadcast.createTrack("video", { maxAge: Milli(60_000) });
 		for (let i = 0; i < groups; i++) {
 			const group = track.appendGroup();
diff --git a/js/net/bench/forward.ts b/js/net/bench/forward.ts
index 42edb11c682..9fb7807daf5 100644
--- a/js/net/bench/forward.ts
+++ b/js/net/bench/forward.ts
@@ -10,7 +10,7 @@ import { AuthSession } from "../src/auth_session.ts";
 import { Producer as BroadcastProducer } from "../src/broadcast.ts";
 import type { Established } from "../src/connection/established.ts";
 import { forwardAnnounced } from "../src/connection/forward.ts";
-import { Route } from "../src/hop.ts";
+import { RouteInfo } from "../src/hop.ts";
 import { Producer } from "../src/origin.ts";
 import * as Path from "../src/path.ts";
 import { registerWire } from "../src/wire.ts";
@@ -52,7 +52,7 @@ class FakeSession {
 }
 
 const announce = (stream: Announce.Producer, prefix: Path.Valid, cost: bigint, kind: "start" | "update") =>
-	stream.append({ prefix, captures: undefined, kind, route: Route.normalize({ cost }) });
+	stream.append({ prefix, captures: undefined, kind, route: RouteInfo.normalize({ cost }) });
 
 console.log("touched,heads,routes,update_us");
 for (const touched of ["covering", "single"] as const) {
diff --git a/js/net/bench/refresh.ts b/js/net/bench/refresh.ts
index a4ecbbad214..916d57df29e 100644
--- a/js/net/bench/refresh.ts
+++ b/js/net/bench/refresh.ts
@@ -16,9 +16,8 @@ for (const retained of [1, 64, 1024])
 			const installed = clock.install();
 			const source = new Producer();
 			const destination = new Producer();
-			const broadcastPublication = source.createBroadcast(Path.from("room"));
-			const broadcast = broadcastPublication.broadcast;
-			broadcastPublication.announce();
+			const broadcastRoute = source.route(Path.from("room"));
+			const broadcast = broadcastRoute.broadcast;
 			const producers = Array.from({ length: tracks }, (_, i) =>
 				broadcast.createTrack(`data${i}`, { refresh: 1 }),
 			);
diff --git a/js/net/bench/requests.ts b/js/net/bench/requests.ts
index 5bd6a4fa82e..44e1da5645d 100644
--- a/js/net/bench/requests.ts
+++ b/js/net/bench/requests.ts
@@ -28,9 +28,8 @@ for (const touched of ["watched", "unrelated"])
 			const origin = new Producer();
 			const path = Path.from("room/0");
 			const broadcasts = Array.from({ length: routes }, (_, i) => {
-				const broadcastPublication = origin.createBroadcast(Path.from(`room/${i}`));
-				const broadcast = broadcastPublication.broadcast;
-				broadcastPublication.announce();
+				const broadcastRoute = origin.route(Path.from(`room/${i}`));
+				const broadcast = broadcastRoute.broadcast;
 				return broadcast;
 			});
 			const requests = Array.from({ length: followers }, () => origin.follow(path));
@@ -41,9 +40,8 @@ for (const touched of ["watched", "unrelated"])
 			for (let round = 0; round < 6; round++) {
 				const start = performance.now();
 				for (let i = 0; i < 128; i++) {
-					const nextPublication = origin.createBroadcast(touched === "watched" ? path : Path.from("other"));
-					const next = nextPublication.broadcast;
-					nextPublication.announce();
+					const nextRoute = origin.route(touched === "watched" ? path : Path.from("other"));
+					const next = nextRoute.broadcast;
 					if (touched === "watched") {
 						current.close();
 						current = next;
@@ -73,7 +71,7 @@ console.log("unrelated,waiters,cancel_us");
 for (const unrelated of [8, 128, 2048])
 	for (const waiters of [1, 8, 32]) {
 		const origin = new Producer();
-		origin.requestsRoute(Path.from("pending"));
+		origin.routePrefix(Path.from("pending"));
 		const held = Array.from({ length: unrelated }, (_, i) => origin.request(Path.from(`pending/${i}`)));
 		const wire = wireOf(origin.consume());
 		const samples: number[] = [];
@@ -141,9 +139,9 @@ for (const failovers of [0, 1, 16, 128])
 			const sources: Broadcast[] = [];
 			for (let i = 0; i < failovers; i++) {
 				const instance = Instance.random();
-				const primary = origin.requestsRoute(prefix, { instance, cost: 0n });
+				const primary = origin.routePrefix(prefix, { instance, cost: 0n });
 				const ar = primary.requested();
-				const br = origin.requestsRoute(prefix, { instance, cost: 1n }).requested();
+				const br = origin.routePrefix(prefix, { instance, cost: 1n }).requested();
 				const held = origin.request(path);
 				const source = new Broadcast();
 				sources.push(source);
@@ -153,8 +151,8 @@ for (const failovers of [0, 1, 16, 128])
 				entries.push({ primary, ar, br, held });
 			}
 			const instance = Instance.random();
-			origin.requestsRoute(prefix, { instance });
-			for (let i = 0; i < extraRoutes; i++) origin.requestsRoute(prefix, { instance, cost: BigInt(i + 1) });
+			origin.routePrefix(prefix, { instance });
+			for (let i = 0; i < extraRoutes; i++) origin.routePrefix(prefix, { instance, cost: BigInt(i + 1) });
 			const pending = [];
 			for (const entry of entries) {
 				entry.primary.close();
@@ -216,7 +214,7 @@ for (const operation of ["cancel-forward", "cancel-reverse", "drain-local"])
 			const settled: number[] = [];
 			for (let round = 0; round < 4; round++) {
 				const origin = new Producer();
-				const dynamic = origin.requestsRoute(Path.from("pending"));
+				const dynamic = origin.routePrefix(Path.from("pending"));
 				const requests = dynamic.requested();
 				const wire = wireOf(origin.consume());
 				const names = Array.from({ length: paths }, (_, i) => Path.from(`pending/${i}`));
@@ -274,7 +272,7 @@ for (const survivor of [false, true])
 				const origin = new Producer();
 				const prefix = Path.from("competing");
 				const path = Path.from("competing/touched");
-				for (let i = 0; i < routes; i++) origin.requestsRoute(prefix, { cost: BigInt(i) });
+				for (let i = 0; i < routes; i++) origin.routePrefix(prefix, { cost: BigInt(i) });
 				const wire = wireOf(origin.consume());
 				const kept = survivor ? new AbortController() : undefined;
 				const remaining = kept ? wire.demand(path, undefined, kept.signal).catch(() => {}) : undefined;
@@ -314,9 +312,8 @@ for (const [version, alpn] of [
 			const sources = [];
 			for (const prefix of ["a", "b"])
 				for (let i = 0; i < namespaces; i++) {
-					const sourcePublication = origin.createBroadcast(Path.from(`${prefix}/${i}`));
-					const source = sourcePublication.broadcast;
-					sourcePublication.announce();
+					const sourceRoute = origin.route(Path.from(`${prefix}/${i}`));
+					const source = sourceRoute.broadcast;
 					sources.push(source);
 				}
 			const peers = await Promise.all(
diff --git a/js/net/bench/resume-history.ts b/js/net/bench/resume-history.ts
index a5e2d63bd63..fd417fbf752 100644
--- a/js/net/bench/resume-history.ts
+++ b/js/net/bench/resume-history.ts
@@ -216,8 +216,7 @@ async function measureOn(clock: Manual, { fronts, names: perRoute, routes, histo
 	const publisher = new OriginProducer();
 	const paths = Array.from({ length: fronts }, (_, index) => Path.from(`room/${index}`));
 	const broadcasts: BroadcastProducer[] = paths.map((path) => {
-		const publication = publisher.createBroadcast(path);
-		publication.announce();
+		const publication = publisher.route(path);
 		return publication.broadcast;
 	});
 	const payload = new Uint8Array(PAYLOAD).fill(7);
diff --git a/js/net/bench/serve-browser-entry.ts b/js/net/bench/serve-browser-entry.ts
index f70d07346b9..bde56cddf01 100644
--- a/js/net/bench/serve-browser-entry.ts
+++ b/js/net/bench/serve-browser-entry.ts
@@ -17,9 +17,8 @@ import { Timescale, Timestamp } from "../src/time.ts";
 
 async function measure(protocol: string, groups: number, viewers: number) {
 	const origin = new Origin();
-	const broadcastPublication = origin.createBroadcast(Path.from("bench"));
-	const broadcast = broadcastPublication.broadcast;
-	broadcastPublication.announce();
+	const broadcastRoute = origin.route(Path.from("bench"));
+	const broadcast = broadcastRoute.broadcast;
 	const track = broadcast.createTrack("data", { maxAge: Milli(60_000), timescale: Timescale.MICRO });
 	const pair = createMockTransportPair(protocol === "lite" ? ALPN_05 : ALPN.DRAFT_22);
 	const version = protocol === "lite" ? LiteVersion.DRAFT_05 : IetfVersion.DRAFT_22;
diff --git a/js/net/bench/subscribe-drop.ts b/js/net/bench/subscribe-drop.ts
index 892a8d9a7c0..bf4d9af8f59 100644
--- a/js/net/bench/subscribe-drop.ts
+++ b/js/net/bench/subscribe-drop.ts
@@ -23,9 +23,8 @@ try {
 			for (let rep = 0; rep < reps; rep++) {
 				const origins = Array.from({ length: publishers }, () => {
 					const origin = new OriginProducer();
-					const broadcastPublication = origin.createBroadcast(Path.from("bench"));
-					const broadcast = broadcastPublication.broadcast;
-					broadcastPublication.announce();
+					const broadcastRoute = origin.route(Path.from("bench"));
+					const broadcast = broadcastRoute.broadcast;
 					const track = broadcast.createTrack("video", { timescale: Timescale.MILLI });
 					for (let sequence = 0n; sequence < BigInt(groups); sequence++) {
 						const group = track.createGroup(sequence);
diff --git a/js/net/examples/publish.ts b/js/net/examples/publish.ts
index 90d90d6be64..7b1b7b27d09 100644
--- a/js/net/examples/publish.ts
+++ b/js/net/examples/publish.ts
@@ -7,10 +7,9 @@ async function main() {
 	const origin = new Moq.Origin.Producer();
 	const connection = await Moq.Connection.connect({ url, publish: origin.consume() });
 
-	// Create a broadcast (a collection of tracks) at a path on the origin
-	const broadcastPublication = origin.createBroadcast(Moq.Path.from("my-broadcast"));
-	const broadcast = broadcastPublication.broadcast;
-	broadcastPublication.announce();
+	// Route a path on the origin. The route owns a broadcast (a collection of tracks) and announces it.
+	const route = origin.route(Moq.Path.from("my-broadcast"));
+	const broadcast = route.broadcast;
 
 	// Create the "chat" track up front. A subscriber is served directly from this
 	// track, no requested() round-trip needed. Mirrors Rust's create_track.
diff --git a/js/net/src/announced.test-util.ts b/js/net/src/announced.test-util.ts
index 6f2b2732d87..5b36855a195 100644
--- a/js/net/src/announced.test-util.ts
+++ b/js/net/src/announced.test-util.ts
@@ -1,6 +1,6 @@
 import { Signal } from "@moq/signals";
 import type { Options, Routes } from "./announced";
-import type { Route } from "./hop";
+import type { RouteInfo } from "./hop";
 import type * as Path from "./path";
 
 /** A closeable announcement snapshot for tests and benchmarks. @internal */
@@ -10,7 +10,7 @@ export async function announcedView(
 	options?: Options,
 ) {
 	const stream = origin.routes(scope, options);
-	const value = new Signal<ReadonlyMap<Path.Valid, Route>>(new Map());
+	const value = new Signal<ReadonlyMap<Path.Valid, RouteInfo>>(new Map());
 	const done = (async () => {
 		for await (const event of stream)
 			value.update((previous) => {
diff --git a/js/net/src/announced.test.ts b/js/net/src/announced.test.ts
index eb2ce44fe0e..87cd1fc24e2 100644
--- a/js/net/src/announced.test.ts
+++ b/js/net/src/announced.test.ts
@@ -2,15 +2,14 @@ import { expect, test } from "bun:test";
 import { yieldNow } from "@moq/clock";
 import * as Announce from "./announced.ts";
 import type { Producer as BroadcastProducer } from "./broadcast.ts";
-import { Route } from "./hop.ts";
+import { RouteInfo } from "./hop.ts";
 import { Producer as OriginProducer } from "./origin.ts";
 import * as Path from "./path.ts";
 import { wireOf } from "./wire.ts";
 
 function publish(origin: OriginProducer, path: Path.Valid): BroadcastProducer {
-	const broadcastPublication = origin.createBroadcast(path);
-	const broadcast = broadcastPublication.broadcast;
-	broadcastPublication.announce();
+	const broadcastRoute = origin.route(path);
+	const broadcast = broadcastRoute.broadcast;
 	return broadcast;
 }
 
@@ -20,7 +19,7 @@ test("next streams every appended event in order", async () => {
 	const producer = new Announce.Producer();
 	const consumer = producer.consume();
 
-	const route = Route.default;
+	const route = RouteInfo.default;
 	producer.append({ prefix: p("a"), captures: undefined, kind: "start", route });
 	producer.append({ prefix: p("a"), captures: undefined, kind: "end", route });
 
@@ -32,7 +31,7 @@ test("a listing reports only a path becoming present or absent", async () => {
 	const producer = new Announce.Producer();
 	const listing = Announce.list(producer.consume());
 
-	const route = Route.default;
+	const route = RouteInfo.default;
 	producer.append({ prefix: p("a"), captures: undefined, kind: "start", route });
 	producer.append({ prefix: p("a"), captures: undefined, kind: "update", route });
 	producer.append({ prefix: p("a"), captures: undefined, kind: "restart", route });
@@ -46,7 +45,7 @@ test("the consumer is an async iterable of the same events", async () => {
 	const producer = new Announce.Producer();
 	const consumer = producer.consume();
 
-	const route = Route.default;
+	const route = RouteInfo.default;
 	producer.append({ prefix: p("a"), captures: undefined, kind: "start", route });
 	producer.append({ prefix: p("a"), captures: undefined, kind: "end", route });
 
@@ -65,7 +64,7 @@ test("a same-name re-announce is a distinct update", async () => {
 	// The stream is a log, not a set: it carries a redundant announce as its own update rather
 	// than collapsing it. Deciding what a repeat means belongs to the session layer, which resolves
 	// a restart into either nothing (an identical route) or an in-place update.
-	const route = Route.default;
+	const route = RouteInfo.default;
 	producer.append({ prefix: p("a"), captures: undefined, kind: "start", route });
 	producer.append({ prefix: p("a"), captures: undefined, kind: "start", route });
 
@@ -98,7 +97,7 @@ test("closing a consumer releases only that handle", async () => {
 	expect(producer.closed.peek()).toBeUndefined();
 
 	// The other reader keeps the stream: an event still reaches it.
-	const route = Route.default;
+	const route = RouteInfo.default;
 	producer.append({ prefix: p("a"), captures: undefined, kind: "start", route });
 	expect((await second.next())?.prefix).toBe(p("a"));
 
@@ -179,7 +178,7 @@ const start = (prefix: string): Announce.RouteEvent => ({
 	prefix: p(prefix),
 	captures: undefined,
 	kind: "start",
-	route: Route.default,
+	route: RouteInfo.default,
 });
 
 test("a stream syncs once the reader is past what was queued at the boundary", async () => {
diff --git a/js/net/src/announced.ts b/js/net/src/announced.ts
index 20db6927bfc..f779130dd94 100644
--- a/js/net/src/announced.ts
+++ b/js/net/src/announced.ts
@@ -4,7 +4,7 @@
  * @module
  */
 import { type GetPromise, type Getter, Once, Signal } from "@moq/signals";
-import type { Route } from "./hop.js";
+import type { RouteInfo } from "./hop.js";
 import type * as Path from "./path.js";
 
 /**
@@ -26,7 +26,7 @@ export interface Announce {
 	/** What the filter's wildcards stood for, when this prefix pins all of them. */
 	captures: Path.Pattern[] | undefined;
 	/** Hops and cost of the route; on a retraction, its last advertised values. */
-	route: Route;
+	route: RouteInfo;
 }
 
 /**
diff --git a/js/net/src/auth.test.ts b/js/net/src/auth.test.ts
index 0ca98b10dc6..5e1708feca9 100644
--- a/js/net/src/auth.test.ts
+++ b/js/net/src/auth.test.ts
@@ -311,8 +311,8 @@ describe.each([Lite.ALPN_07_WIP, Ietf.ALPN.DRAFT_22])("%s", (protocol) => {
 		})();
 
 		await waitFor(client.auth.grant, (g) => g !== undefined);
-		origin.createBroadcast(Path.from("baz/ok")).announce();
-		origin.createBroadcast(Path.from("foo/bar")).announce();
+		origin.route(Path.from("baz/ok"), { hidden: true }).announce();
+		origin.route(Path.from("foo/bar"), { hidden: true }).announce();
 
 		const info = await transport.closed;
 		expect(info.closeCode).toBe(SessionCode.Unauthorized);
@@ -332,15 +332,14 @@ describe.each([Lite.ALPN_07_WIP, Ietf.ALPN.DRAFT_22])("%s", (protocol) => {
 		try {
 			const unanswered = await requests.next();
 			if (!unanswered) throw new Error("missing token");
-			const withdrawn = origin.createBroadcast(Path.from("foo/bar"));
-			withdrawn.announce();
+			const withdrawn = origin.route(Path.from("foo/bar"));
 			await yieldNow();
-			withdrawn.unannounce();
+			withdrawn.withdraw();
 			await yieldNow();
 			const issued = unanswered.accept(grant(["other"], []));
 			await adding;
 			// Still enforcing: the next uncovered broadcast is the one named.
-			origin.createBroadcast(Path.from("still-bad")).announce();
+			origin.route(Path.from("still-bad"), { hidden: true }).announce();
 			const info = await transport.closed;
 			expect(info.closeCode).toBe(SessionCode.Unauthorized);
 			expect(info.reason).toBe("unauthorized: still-bad");
@@ -367,7 +366,7 @@ describe.each([Lite.ALPN_07_WIP, Ietf.ALPN.DRAFT_22])("%s", (protocol) => {
 		})();
 
 		await waitFor(client.auth.grant, (g) => g !== undefined);
-		origin.createBroadcast(Path.from("a/x")).announce();
+		origin.route(Path.from("a/x"), { hidden: true }).announce();
 
 		const announced = server.routes();
 		const first = await nextRoute(announced);
@@ -459,9 +458,8 @@ describe.each([Lite.ALPN_07_WIP, Ietf.ALPN.DRAFT_22])("%s", (protocol) => {
 		const installed = clock.install();
 		const logged = spyOn(console, "debug");
 		const origin = new OriginProducer();
-		const broadcastPublication = origin.createBroadcast(Path.from("room/x"));
-		const broadcast = broadcastPublication.broadcast;
-		broadcastPublication.announce();
+		const broadcastRoute = origin.route(Path.from("room/x"));
+		const broadcast = broadcastRoute.broadcast;
 		const published = broadcast.createTrack("video");
 		published.appendGroup().writeFrame({ payload: new Uint8Array([1]) });
 		const { client, server } = await connect({ serverPublish: origin, protocol });
@@ -527,7 +525,9 @@ describe.each([Lite.ALPN_07_WIP, Ietf.ALPN.DRAFT_22])("%s", (protocol) => {
 		try {
 			const unanswered = await requests.next();
 			if (!unanswered) throw new Error("missing token");
-			const track = new OriginProducer().createBroadcast(Path.from("room/x")).broadcast.createTrack("video");
+			const track = new OriginProducer()
+				.route(Path.from("room/x"), { hidden: true })
+				.broadcast.createTrack("video");
 			const reader = track.subscribe();
 			const ready = wireOf(client).auth.ready(Path.from("room/x"), "subscribe", {
 				until: () => abandoned(track.demand()),
@@ -552,9 +552,8 @@ describe.each([Lite.ALPN_07_WIP, Ietf.ALPN.DRAFT_22])("%s", (protocol) => {
 	test("a subscribe abandoned while its token waits never reaches the wire", async () => {
 		const logged = spyOn(console, "debug");
 		const origin = new OriginProducer();
-		const broadcastPublication = origin.createBroadcast(Path.from("room/x"));
-		const broadcast = broadcastPublication.broadcast;
-		broadcastPublication.announce();
+		const broadcastRoute = origin.route(Path.from("room/x"));
+		const broadcast = broadcastRoute.broadcast;
 		broadcast.createTrack("video");
 		const { client, server, transport } = await connect({ serverPublish: origin, protocol });
 		const requests = server.auth.requests();
@@ -591,9 +590,8 @@ describe.each([Lite.ALPN_07_WIP, Ietf.ALPN.DRAFT_22])("%s", (protocol) => {
 		"a subscribe that regains a reader while its token waits keeps waiting (%d)",
 		async (gap) => {
 			const origin = new OriginProducer();
-			const broadcastPublication = origin.createBroadcast(Path.from("room/x"));
-			const broadcast = broadcastPublication.broadcast;
-			broadcastPublication.announce();
+			const broadcastRoute = origin.route(Path.from("room/x"));
+			const broadcast = broadcastRoute.broadcast;
 			const published = broadcast.createTrack("video");
 			published.appendGroup().writeFrame({ payload: new Uint8Array([7]) });
 			const { client, server } = await connect({ serverPublish: origin, protocol });
@@ -628,9 +626,8 @@ describe.each([Lite.ALPN_07_WIP, Ietf.ALPN.DRAFT_22])("%s", (protocol) => {
 
 	test("a session's close is not a revocation of its subscriptions", async () => {
 		const origin = new OriginProducer();
-		const broadcastPublication = origin.createBroadcast(Path.from("room/x"));
-		const broadcast = broadcastPublication.broadcast;
-		broadcastPublication.announce();
+		const broadcastRoute = origin.route(Path.from("room/x"));
+		const broadcast = broadcastRoute.broadcast;
 		broadcast
 			.createTrack("video")
 			.appendGroup()
@@ -1020,9 +1017,8 @@ test("lite-07 ignores a draining session's late refusal while its successor retr
 test("a fetch abandoned while its token waits never reaches the wire", async () => {
 	const logged = spyOn(console, "debug");
 	const origin = new OriginProducer();
-	const broadcastPublication = origin.createBroadcast(Path.from("room/x"));
-	const broadcast = broadcastPublication.broadcast;
-	broadcastPublication.announce();
+	const broadcastRoute = origin.route(Path.from("room/x"));
+	const broadcast = broadcastRoute.broadcast;
 	broadcast
 		.createTrack("video")
 		.appendGroup()
@@ -1064,9 +1060,8 @@ test("a fetch abandoned while its token waits never reaches the wire", async ()
 // The peer refuses a listing its token has not yet authorized, so the request waits for it.
 test("a listing waits for its token before reaching the wire", async () => {
 	const origin = new OriginProducer();
-	const broadcastPublication = origin.createBroadcast(Path.from("room/x"));
-	const broadcast = broadcastPublication.broadcast;
-	broadcastPublication.announce();
+	const broadcastRoute = origin.route(Path.from("room/x"));
+	const broadcast = broadcastRoute.broadcast;
 	broadcast.createTrack("video");
 	const { client, server, transport } = await connect({ serverPublish: origin, protocol: Lite.ALPN_07_WIP });
 	const requests = server.auth.requests();
@@ -1102,9 +1097,8 @@ test.each(Array.from({ length: 17 }, (_, gap) => gap))(
 	"a fetch that regains a caller while its token waits keeps waiting (%d)",
 	async (gap) => {
 		const origin = new OriginProducer();
-		const broadcastPublication = origin.createBroadcast(Path.from("room/x"));
-		const broadcast = broadcastPublication.broadcast;
-		broadcastPublication.announce();
+		const broadcastRoute = origin.route(Path.from("room/x"));
+		const broadcast = broadcastRoute.broadcast;
 		broadcast
 			.createTrack("video")
 			.appendGroup()
@@ -1274,15 +1268,13 @@ test.each([
 // moq-transport has no stream code for it, so only moq-lite resets with UNAUTHORIZED.
 test("a revoked grant resets its subscriptions with UNAUTHORIZED", async () => {
 	const clientOrigin = new OriginProducer();
-	const upPublication = clientOrigin.createBroadcast(Path.from("up/y"));
-	const up = upPublication.broadcast;
-	upPublication.announce();
+	const upRoute = clientOrigin.route(Path.from("up/y"));
+	const up = upRoute.broadcast;
 	const upTrack = up.createTrack("video");
 
 	const serverOrigin = new OriginProducer();
-	const downPublication = serverOrigin.createBroadcast(Path.from("room/x"));
-	const down = downPublication.broadcast;
-	downPublication.announce();
+	const downRoute = serverOrigin.route(Path.from("room/x"));
+	const down = downRoute.broadcast;
 	const downTrack = down.createTrack("video");
 
 	const { client, server } = await connect({
diff --git a/js/net/src/broadcast.ts b/js/net/src/broadcast.ts
index e07d002d8ca..bb2eb8337d9 100644
--- a/js/net/src/broadcast.ts
+++ b/js/net/src/broadcast.ts
@@ -7,7 +7,6 @@ import { type GetPromise, Once, Signal } from "@moq/signals";
 import * as datagram from "./datagram.ts";
 import { NotFound, StreamCode, StreamError, toStreamCode } from "./error.ts";
 import type { Consumer as GroupConsumer } from "./group.ts";
-import type { Route } from "./hop.ts";
 import type * as Instance from "./instance.ts";
 import { hooks } from "./internal.ts";
 import { Listing, listTracks, makeLister, type Tracks } from "./listing.ts";
@@ -18,17 +17,6 @@ import { registerWire, trackOf, wireOf } from "./wire.ts";
 
 export { Tracks, type TracksEvent } from "./listing.ts";
 
-/** The origin callback a created broadcast uses to advertise its exact path. @internal */
-export interface Announcer {
-	/** Advertise or re-price this broadcast's path. */
-	announce(route: Route): void;
-	/** Retract the advertisement from local consumers and peers alike. */
-	unannounce(): void;
-	/** The route this broadcast's path is advertised with, if it is. */
-	route(): Route | undefined;
-}
-
-let attachAnnouncer: (producer: Producer, announcer: Announcer) => void;
 let stampProducer: (producer: Producer, path: Path.Valid) => void;
 
 // Info lookups pending or held on a track.
@@ -386,7 +374,6 @@ function adopt(state: BroadcastState, producer: track.Producer, info: track.Info
  */
 export class Producer {
 	#state = new BroadcastState();
-	#announcer?: Announcer;
 	#path = Path.empty();
 
 	constructor() {
@@ -406,11 +393,6 @@ export class Producer {
 	}
 
 	static {
-		attachAnnouncer = (producer, announcer) => {
-			producer.#announcer = announcer;
-		};
-		hooks.attachAnnouncer = attachAnnouncer;
-
 		hooks.onClosed = (producer, fn) => {
 			const closers = producer.#state.closers;
 			closers.add(fn);
@@ -493,10 +475,8 @@ export class Producer {
 		return trackOf(name, this);
 	}
 
-	/** End the broadcast for good: retract its route and serve no new tracks. Idempotent. */
+	/** End the broadcast for good: serve no new tracks. Idempotent. */
 	close(): void {
-		this.#announcer?.unannounce();
-		this.#announcer = undefined;
 		closeState(this.#state);
 	}
 }
diff --git a/js/net/src/connection/close.test.ts b/js/net/src/connection/close.test.ts
index 2111a17e097..d15c7c770bf 100644
--- a/js/net/src/connection/close.test.ts
+++ b/js/net/src/connection/close.test.ts
@@ -57,9 +57,8 @@ for (const protocol of [Lite.ALPN_07_WIP, Ietf.ALPN.DRAFT_18]) {
 			const fin = holdFin(pair.server);
 			const source = new Producer();
 			const destination = new Producer();
-			const broadcastPublication = source.createBroadcast(Path.from("room"));
-			const broadcast = broadcastPublication.broadcast;
-			broadcastPublication.announce();
+			const broadcastRoute = source.route(Path.from("room"));
+			const broadcast = broadcastRoute.broadcast;
 			const url = new URL("https://localhost/test");
 			const [client, server] = await Promise.all([
 				connect({ url, transport: pair.client, consume: destination }),
diff --git a/js/net/src/connection/forward.test.ts b/js/net/src/connection/forward.test.ts
index 79a9df2030a..396e9c3b40a 100644
--- a/js/net/src/connection/forward.test.ts
+++ b/js/net/src/connection/forward.test.ts
@@ -3,7 +3,7 @@ import { type Installed, Manual, Milli, Nano } from "@moq/clock";
 import * as Announce from "../announced.ts";
 import { AuthSession } from "../auth_session.ts";
 import { type Consumer as BroadcastConsumer, Producer as BroadcastProducer } from "../broadcast.ts";
-import { Route } from "../hop.ts";
+import { RouteInfo } from "../hop.ts";
 import * as Instance from "../instance.ts";
 import { Producer as OriginProducer } from "../origin.ts";
 import * as Path from "../path.ts";
@@ -132,7 +132,7 @@ class FakeSession {
 	}
 }
 
-function start(stream: Announce.Producer, prefix: string, route: Route = Route.default) {
+function start(stream: Announce.Producer, prefix: string, route: RouteInfo = RouteInfo.default) {
 	stream.append({ prefix: Path.from(prefix), captures: undefined, kind: "start", route });
 }
 
@@ -411,12 +411,12 @@ for (const [name, instances] of [
 
 		const narrow = origin.routes(Path.Pattern.subtree(Path.from("a/b")));
 		await settle();
-		start(session.stream("a/b/**"), "a/b/x", { ...Route.default, instance: instances[0] });
+		start(session.stream("a/b/**"), "a/b/x", { ...RouteInfo.default, instance: instances[0] });
 		await settle();
 		const broad = origin.routes(Path.Pattern.subtree(Path.from("a")));
 		const events = record(broad);
 		await settle();
-		start(session.stream("a/**"), "a/b/x", { ...Route.default, instance: instances[1] });
+		start(session.stream("a/**"), "a/b/x", { ...RouteInfo.default, instance: instances[1] });
 		await settle();
 		expect(events).toEqual(["start a/b/x"]);
 
diff --git a/js/net/src/connection/forward.ts b/js/net/src/connection/forward.ts
index 99ea9c338f7..bb2cfb6ba6d 100644
--- a/js/net/src/connection/forward.ts
+++ b/js/net/src/connection/forward.ts
@@ -7,12 +7,12 @@
 import { Milli, Nano } from "@moq/clock";
 import { type Dispose, race } from "@moq/signals";
 import type * as Announce from "../announced.ts";
-import { type Route, routesEqual } from "../hop.ts";
+import { type RouteInfo, routesEqual } from "../hop.ts";
 import { coveringPrefixes } from "../internal.ts";
-import type { Producer as OriginProducer, RequestSlot, Requests } from "../origin.ts";
+import type { Producer as OriginProducer, Route } from "../origin.ts";
 import * as Path from "../path.ts";
 import { after } from "../util/timer.ts";
-import { wireOf } from "../wire.ts";
+import { type RequestSlot, wireOf } from "../wire.ts";
 import type { Established } from "./established.ts";
 
 /** Why a connection refuses the removed `discovery` option rather than ignoring it. */
@@ -39,9 +39,9 @@ interface Interest {
  * request handing over to another never retracts it. The first reporter drives it.
  */
 interface Reported {
-	handle: Requests;
+	handle: Route;
 	/** Each request's latest route for the prefix. */
-	readonly reporters: Map<Interest, Route>;
+	readonly reporters: Map<Interest, RouteInfo>;
 }
 
 /**
@@ -118,16 +118,17 @@ export function forwardAnnounced(conn: Established, origin: OriginProducer): voi
 	 * instance, so nothing resolved through the old one is joined again, and an in-place
 	 * update otherwise.
 	 */
-	const updateReported = (existing: Reported, prefix: Path.Valid, route: Route, restart: boolean) => {
-		if (restart || route.epoch !== existing.handle.route.epoch) {
+	const updateReported = (existing: Reported, prefix: Path.Valid, route: RouteInfo, restart: boolean) => {
+		const current = wireOf(existing.handle).info;
+		if (restart || route.epoch !== current?.epoch) {
 			// Inserted before the old one leaves, so local readers see one restart rather than
 			// an end and a start.
 			const handle = originWire.receive(prefix, route);
 			existing.handle.close();
 			existing.handle = handle;
 			void drive(handle, conn);
-		} else if (!routesEqual(existing.handle.route, route)) {
-			existing.handle.updateRoute(route);
+		} else if (!routesEqual(current, route)) {
+			wireOf(existing.handle).update(route);
 		}
 	};
 
@@ -289,7 +290,7 @@ export function forwardAnnounced(conn: Established, origin: OriginProducer): voi
 }
 
 /** Answer the requests under a received route by consuming them from the session. */
-async function drive(handle: Requests, conn: Established): Promise<void> {
+async function drive(handle: Route, conn: Established): Promise<void> {
 	const session = wireOf(conn);
 	try {
 		for await (const request of handle.requested()) {
diff --git a/js/net/src/connection/migrate.test.ts b/js/net/src/connection/migrate.test.ts
index 0eaef291ca2..eede71cf3e2 100644
--- a/js/net/src/connection/migrate.test.ts
+++ b/js/net/src/connection/migrate.test.ts
@@ -79,9 +79,8 @@ test("an empty GOAWAY migrates the follower to the replacement session", async (
 	const clock = new Manual();
 	const installed = clock.install();
 	const { dials, origin } = fleet();
-	const broadcastPublication = origin.createBroadcast(Path.from("cam"));
-	const broadcast = broadcastPublication.broadcast;
-	broadcastPublication.announce();
+	const broadcastRoute = origin.route(Path.from("cam"));
+	const broadcast = broadcastRoute.broadcast;
 
 	const consume = new OriginProducer();
 	const reload = new Reload({
diff --git a/js/net/src/connection/pool.test.ts b/js/net/src/connection/pool.test.ts
index d62e72772e2..e9dc3a9d313 100644
--- a/js/net/src/connection/pool.test.ts
+++ b/js/net/src/connection/pool.test.ts
@@ -13,11 +13,8 @@ import { type AcceptProps, accept as acceptSession } from "./index.ts";
 import { Connection, resetShared } from "./pool.ts";
 import { Reload } from "./reload.ts";
 
-function publish(origin: Pick<Table, "createBroadcast">, path: Path.Valid) {
-	const broadcastPublication = origin.createBroadcast(path);
-	const broadcast = broadcastPublication.broadcast;
-	broadcastPublication.announce();
-	return broadcast;
+function publish(origin: Pick<Table, "route">, path: Path.Valid) {
+	return origin.route(path).broadcast;
 }
 
 const url = new URL("https://example.com/pool");
@@ -262,7 +259,7 @@ test("a borrowed connection origin exposes live routes and dynamic serving", asy
 			announcement = event;
 		});
 		const prefix = Path.from("on-demand");
-		const route = table.requestsRoute(prefix);
+		const route = table.routePrefix(prefix);
 		await advance();
 		expect(announcement).toMatchObject({ kind: "present", prefix });
 		let withdrawal: unknown;
diff --git a/js/net/src/connection/reload.test.ts b/js/net/src/connection/reload.test.ts
index 80e37e1e321..066835bc2f6 100644
--- a/js/net/src/connection/reload.test.ts
+++ b/js/net/src/connection/reload.test.ts
@@ -5,7 +5,7 @@ import * as Announce from "../announced.ts";
 import { Viewers } from "../bandwidth.ts";
 import type { Producer as BroadcastProducer } from "../broadcast.ts";
 import { ConnectTimeout, SessionCode, SessionError, StreamCode, toTransport } from "../error.ts";
-import { Route } from "../hop.ts";
+import { RouteInfo } from "../hop.ts";
 import { ALPN as IetfALPN } from "../ietf/version.ts";
 import * as Lite from "../lite/index.ts";
 import { createMockTransportPair, type MockTransport, textFrame } from "../mock.ts";
@@ -25,9 +25,8 @@ function accept(transport: WebTransport, url: URL, props: Omit<AcceptProps, "tra
 }
 
 function publish(origin: OriginProducer, path: Path.Valid) {
-	const broadcastPublication = origin.createBroadcast(path);
-	const broadcast = broadcastPublication.broadcast;
-	broadcastPublication.announce();
+	const broadcastRoute = origin.route(path);
+	const broadcast = broadcastRoute.broadcast;
 	return broadcast;
 }
 
@@ -747,9 +746,8 @@ for (const [name, teardown] of Object.entries(teardowns)) {
 		await waitUntil(() => handle.origin.peek() !== undefined);
 		const origin = handle.origin.peek();
 		if (!origin) throw new Error("no origin");
-		const broadcastPublication = origin.createBroadcast(Path.from("room"));
-		const broadcast = broadcastPublication.broadcast;
-		broadcastPublication.announce();
+		const broadcastRoute = origin.route(Path.from("room"));
+		const broadcast = broadcastRoute.broadcast;
 		const producer = broadcast.createTrack("video", { timescale: Timescale.MILLI });
 		await waitUntil(() => dials.length > 0);
 		const first = dials[0];
@@ -835,9 +833,8 @@ for (const [name, drainEnd] of Object.entries(drainEnds)) {
 		globalThis.WebTransport = stub as unknown as typeof WebTransport;
 
 		const origin = new OriginProducer();
-		const broadcastPublication = origin.createBroadcast(Path.from("room"));
-		const broadcast = broadcastPublication.broadcast;
-		broadcastPublication.announce();
+		const broadcastRoute = origin.route(Path.from("room"));
+		const broadcast = broadcastRoute.broadcast;
 		const producer = broadcast.createTrack("video", { timescale: Timescale.MILLI });
 		const reload = new Reload({
 			url: new URL("https://example.com/a"),
@@ -896,9 +893,8 @@ test("a retired GOAWAY predecessor still closes by its handover cap", async () =
 	globalThis.WebTransport = stub as unknown as typeof WebTransport;
 
 	const origin = new OriginProducer();
-	const broadcastPublication = origin.createBroadcast(Path.from("room"));
-	const broadcast = broadcastPublication.broadcast;
-	broadcastPublication.announce();
+	const broadcastRoute = origin.route(Path.from("room"));
+	const broadcast = broadcastRoute.broadcast;
 	const producer = broadcast.createTrack("video", { timescale: Timescale.MILLI });
 	const reload = new Reload({
 		url: new URL("https://example.com/"),
@@ -980,9 +976,8 @@ test("closing the loop keeps the tokens until the session drains", async () => {
 	const origin = new OriginProducer();
 	const reload = new Reload({ url, websocket: { enabled: false }, publish: origin.consume() });
 	await reload.auth.add("token");
-	const broadcastPublication = origin.createBroadcast(Path.from("room"));
-	const broadcast = broadcastPublication.broadcast;
-	broadcastPublication.announce();
+	const broadcastRoute = origin.route(Path.from("room"));
+	const broadcast = broadcastRoute.broadcast;
 	const producer = broadcast.createTrack("video", { timescale: Timescale.MILLI });
 	const first = dials[0];
 	if (!first) throw new Error("no first dial");
@@ -1034,7 +1029,7 @@ test("closing an announce consumer during upstream teardown does not append retr
 			prefix: Path.from("alice/camera.hang"),
 			captures: undefined,
 			kind: "start",
-			route: Route.default,
+			route: RouteInfo.default,
 		});
 		await consumer.next();
 		upstream.close();
@@ -1140,7 +1135,7 @@ test("a pump owes the retractions of the upstream it replaces", async () => {
 	const consumer = producer.consume();
 
 	const first = new Announce.Producer();
-	first.append({ prefix: Path.from("a"), captures: undefined, kind: "start", route: Route.default });
+	first.append({ prefix: Path.from("a"), captures: undefined, kind: "start", route: RouteInfo.default });
 	first.synced();
 	const upstream = new Signal(first);
 	const pump = new Effect((effect) => pumpAnnounced(effect, effect.get(upstream).consume(), producer));
diff --git a/js/net/src/connection/scope.test.ts b/js/net/src/connection/scope.test.ts
index c59a729acf1..8c6e0b204c3 100644
--- a/js/net/src/connection/scope.test.ts
+++ b/js/net/src/connection/scope.test.ts
@@ -22,9 +22,8 @@ for (const protocol of [Lite.ALPN_07_WIP, Ietf.ALPN.DRAFT_18]) {
 			new Path.Patterns(["room/**", "other/**"].map(Path.Pattern.parse)),
 		);
 		const broadcasts = ["room/live", "room/.hidden", "other/live", "outside"].map((path) => {
-			const broadcastPublication = publish.createBroadcast(Path.from(path));
-			const broadcast = broadcastPublication.broadcast;
-			broadcastPublication.announce();
+			const broadcastRoute = publish.route(Path.from(path));
+			const broadcast = broadcastRoute.broadcast;
 			return broadcast;
 		});
 		const [client, server] = await Promise.all([
diff --git a/js/net/src/consume.test.ts b/js/net/src/consume.test.ts
index 562ff925d99..04a42fa4f34 100644
--- a/js/net/src/consume.test.ts
+++ b/js/net/src/consume.test.ts
@@ -2,7 +2,7 @@ import { expect, test } from "bun:test";
 import { Producer } from "./broadcast.ts";
 import { BroadcastCache } from "./consume.ts";
 import { StreamCode, StreamError } from "./error.ts";
-import { Route } from "./hop.ts";
+import { RouteInfo } from "./hop.ts";
 import * as Instance from "./instance.ts";
 import * as Path from "./path.ts";
 
@@ -13,16 +13,16 @@ test("cache identity follows the serving announcement, preserving held tracks",
 	const broad = {};
 	const specific = {};
 	const instance = Instance.random();
-	cache.announce(pool, broad, { ...Route.default, instance });
+	cache.announce(pool, broad, { ...RouteInfo.default, instance });
 	const source = new Producer();
 	const track = source.createTrack("video");
 	const held = cache.insert(job, cache.instance(job), source.consume());
 	const ordered = held.track("video").subscribe().ordered();
-	cache.announce(job, specific, { ...Route.default, instance });
+	cache.announce(job, specific, { ...RouteInfo.default, instance });
 	const same = cache.get(job, cache.instance(job));
 	expect(same?.closed).toBe(held.closed);
 
-	cache.announce(job, specific, Route.default, true);
+	cache.announce(job, specific, RouteInfo.default, true);
 	expect(cache.instance(job).route.instance).toBeUndefined();
 	expect(cache.get(job, cache.instance(job))).toBeUndefined();
 	const replacement = new Producer();
@@ -46,7 +46,7 @@ test("withdrawing one interest keeps another interest's explicit identity", () =
 	const path = Path.from("room");
 	const first = {};
 	const second = {};
-	const route = { ...Route.default, instance: Instance.random() };
+	const route = { ...RouteInfo.default, instance: Instance.random() };
 	cache.announce(path, first, route);
 	cache.announce(path, second, route);
 	const source = new Producer();
@@ -70,7 +70,7 @@ test("an announcement lifecycle retires a blind cache without disturbing unrelat
 	const held = cache.insert(path, cache.instance(path), source.consume());
 	const otherHeld = cache.insert(other, cache.instance(other), unrelated.consume());
 	const owner = {};
-	cache.announce(Path.from("pool"), owner, Route.default);
+	cache.announce(Path.from("pool"), owner, RouteInfo.default);
 	cache.withdraw(Path.from("pool"), owner);
 	expect(cache.get(path, cache.instance(path))).toBeUndefined();
 	const same = cache.get(other, cache.instance(other));
@@ -87,10 +87,10 @@ test.each([false, true])("route alternation reuses every held instance (instance
 	const broad = Path.from("pool");
 	const ownerA = {};
 	const ownerB = {};
-	cache.announce(broad, ownerA, { ...Route.default, instance: explicit ? Instance.random() : undefined });
+	cache.announce(broad, ownerA, { ...RouteInfo.default, instance: explicit ? Instance.random() : undefined });
 	const a = new Producer();
 	const heldA = cache.insert(path, cache.instance(path), a.consume());
-	cache.announce(path, ownerB, { ...Route.default, instance: explicit ? Instance.random() : undefined });
+	cache.announce(path, ownerB, { ...RouteInfo.default, instance: explicit ? Instance.random() : undefined });
 	const b = new Producer();
 	const heldB = cache.insert(path, cache.instance(path), b.consume());
 	cache.withdraw(path, ownerB);
@@ -107,13 +107,13 @@ test("request validity cancels one selection period and permits the held fallbac
 	const broad = Path.from("pool");
 	const a = {};
 	const b = {};
-	cache.announce(broad, a, Route.default);
+	cache.announce(broad, a, RouteInfo.default);
 	const sourceA = new Producer();
 	const instanceA = cache.instance(path);
 	const heldA = cache.insert(path, instanceA, sourceA.consume());
 	const first = instanceA.validity?.signal;
 	expect(first?.aborted).toBe(false);
-	cache.announce(path, b, Route.default);
+	cache.announce(path, b, RouteInfo.default);
 	expect(first?.aborted).toBe(true);
 	// A more specific route taking over ends the old instance's requests the way Rust does, so
 	// players treat it as the instance going offline rather than an unexpected failure.
@@ -142,16 +142,16 @@ test("request validity follows the selected interest and ignores unrelated withd
 	const broad = {};
 	const first = {};
 	const second = {};
-	cache.announce(Path.from("pool"), broad, Route.default);
-	cache.announce(path, first, Route.default);
-	cache.announce(path, second, Route.default);
+	cache.announce(Path.from("pool"), broad, RouteInfo.default);
+	cache.announce(path, first, RouteInfo.default);
+	cache.announce(path, second, RouteInfo.default);
 	const source = new Producer();
 	const instance = cache.instance(path);
 	const held = cache.insert(path, instance, source.consume());
 	const signal = instance.validity?.signal;
 	cache.withdraw(Path.from("pool"), broad);
 	cache.withdraw(path, second);
-	cache.announce(path, first, { ...Route.default, cost: 1n });
+	cache.announce(path, first, { ...RouteInfo.default, cost: 1n });
 	expect(instance.validity?.signal).toBe(signal);
 	expect(signal?.aborted).toBe(false);
 	cache.withdraw(path, first);
@@ -167,7 +167,7 @@ test("a blind selection retires on discovery while explicit instances need no pa
 	const source = new Producer();
 	const held = cache.insert(path, blind, source.consume());
 	const owner = {};
-	cache.announce(Path.from("pool"), owner, { ...Route.default, instance: Instance.random() });
+	cache.announce(Path.from("pool"), owner, { ...RouteInfo.default, instance: Instance.random() });
 	expect(blind.validity?.signal.aborted).toBe(true);
 	expect(cache.instance(path).validity).toBeUndefined();
 	cache.withdraw(Path.from("pool"), owner);
diff --git a/js/net/src/consume.ts b/js/net/src/consume.ts
index 3e19f1159dd..86b89c379c3 100644
--- a/js/net/src/consume.ts
+++ b/js/net/src/consume.ts
@@ -1,6 +1,6 @@
 import type * as broadcast from "./broadcast.ts";
 import { StreamCode, StreamError } from "./error.ts";
-import type { Route } from "./hop.ts";
+import type { RouteInfo } from "./hop.ts";
 import * as Instance from "./instance.ts";
 import { compareRouteCandidates, coveringPrefixes, Epochs } from "./internal.ts";
 import type * as Path from "./path.ts";
@@ -52,13 +52,13 @@ export class BroadcastCache {
 		Path.Valid,
 		Map<Instance.Valid | object, { consumer: broadcast.Consumer; selection: Selection }>
 	>();
-	#announced = new Map<Path.Valid, Map<object, { identity: object; route: Route }>>();
+	#announced = new Map<Path.Valid, Map<object, { identity: object; route: RouteInfo }>>();
 	#blind = new Map<Path.Valid, Blind>();
 	#blindPrefixes = new Map<Path.Valid, Set<Path.Valid>>();
 	#paths = new Map<Path.Valid, Set<Path.Valid>>();
 
 	/** Record this interest's live advertisement, preserving identity across route updates. */
-	announce(path: Path.Valid, owner: object, route: Route, restart = false): void {
+	announce(path: Path.Valid, owner: object, route: RouteInfo, restart = false): void {
 		// Only unannounced consumers covered by this advertisement lose their blind identity.
 		for (const covered of this.#blindPrefixes.get(path) ?? []) this.#forgetBlind(covered);
 		let entries = this.#announced.get(path);
@@ -84,7 +84,7 @@ export class BroadcastCache {
 		for (const prefix of coveringPrefixes(path)) {
 			const entries = this.#announced.get(prefix);
 			if (!entries) continue;
-			let best: { identity: object; route: Route } | undefined;
+			let best: { identity: object; route: RouteInfo } | undefined;
 			const epochs = new Epochs([...entries.values()].map((entry) => entry.route));
 			for (const entry of entries.values()) {
 				if (epochs.supersedes(entry.route)) continue;
diff --git a/js/net/src/fill.test.ts b/js/net/src/fill.test.ts
index bae555bf01f..ae66a7ea732 100644
--- a/js/net/src/fill.test.ts
+++ b/js/net/src/fill.test.ts
@@ -769,8 +769,7 @@ async function session(alpn: string) {
 		connectSession({ url, transport: pair.client }),
 		acceptSession({ transport: pair.server, url, publish: origin.consume() }),
 	]);
-	const publication = origin.createBroadcast(Path.from("archive"));
-	publication.announce();
+	const publication = origin.route(Path.from("archive"));
 	const broadcast = publication.broadcast;
 	const track = broadcast.createTrack("video", { timescale: Timescale.MILLI, maxAge: null });
 	// Groups 0 to 2 were published before this producer existed.
diff --git a/js/net/src/goaway-requests.test.ts b/js/net/src/goaway-requests.test.ts
index bc2df5b5235..fb869add6ca 100644
--- a/js/net/src/goaway-requests.test.ts
+++ b/js/net/src/goaway-requests.test.ts
@@ -107,9 +107,8 @@ async function handover(kind: "lite" | "ietf"): Promise<void> {
 
 	const consume = new OriginProducer();
 	const publish = new OriginProducer();
-	const broadcastPublication = publish.createBroadcast(Path.from("room"));
-	const broadcast = broadcastPublication.broadcast;
-	broadcastPublication.announce();
+	const broadcastRoute = publish.route(Path.from("room"));
+	const broadcast = broadcastRoute.broadcast;
 
 	const served: TrackProducer[] = [];
 	let armVideo = true;
@@ -299,9 +298,8 @@ async function routeDeath(kind: "lite" | "ietf", after: boolean): Promise<void>
 
 	const consume = new OriginProducer();
 	const publish = new OriginProducer();
-	const broadcastPublication = publish.createBroadcast(Path.from("room"));
-	const broadcast = broadcastPublication.broadcast;
-	broadcastPublication.announce();
+	const broadcastRoute = publish.route(Path.from("room"));
+	const broadcast = broadcastRoute.broadcast;
 
 	const served: TrackProducer[] = [];
 	const serving = (async () => {
diff --git a/js/net/src/group-id.test.ts b/js/net/src/group-id.test.ts
index d025cecad53..e17c1de620d 100644
--- a/js/net/src/group-id.test.ts
+++ b/js/net/src/group-id.test.ts
@@ -86,12 +86,11 @@ for (const wire of WIRES) {
 		]);
 
 		const path = Path.from("big");
-		const publication = source.createBroadcast(path);
-		publication.announce();
+		const publication = source.route(path);
 		const datagrams = wire.datagrams ? publication.broadcast.createDatagrams("video") : undefined;
 		const track = publication.broadcast.createTrack("video");
 
-		const dynamic = relay.requestsRoute(path);
+		const dynamic = relay.routePrefix(path);
 		const inputs: BroadcastConsumer[] = [];
 		const forwarding = (async () => {
 			for await (const request of dynamic.requested()) {
diff --git a/js/net/src/hop.ts b/js/net/src/hop.ts
index 2319ebcbfb8..d01492d599b 100644
--- a/js/net/src/hop.ts
+++ b/js/net/src/hop.ts
@@ -89,59 +89,48 @@ export const Cost = {
 };
 
 /**
- * The path a route took through the mesh and what using it costs.
+ * The stream a received route serves, the path it took through the mesh, and what using it
+ * costs: read-only facts on an announcement. Mirrors `RouteInfo` in rs/moq-net.
  *
- * The metadata half of an advertisement: an origin `requests()` pairs it with the
- * pattern it covers, a broadcast `announce()` with the broadcast's exact path, and
- * an announce event carries it so consumers can read it back.
+ * Carried by an announce event. Applications never build one: an origin `Route` takes
+ * `RouteOptions`, and the origin and the relays fill in the rest.
  */
-export interface Route {
+export interface RouteInfo {
 	/**
 	 * The stream the route serves: routes with one instance serve one continuous sequence
-	 * space, so a subscription resumes from one to another. Changing it on a standing
-	 * advertisement is a restart. Always set on a route the origin delivers; given to an
-	 * announcing handle, unset keeps the instance its route already has, a fresh random one
-	 * minted when the handle was made. Mirrors `Route::instance` in rs/moq-net.
-	 *
-	 * Set one only for a publisher that continues its group sequences across restarts and
-	 * raises {@link epoch} on each: readers stitch every route of one instance together, so
-	 * restarting the sequences under an old instance splices unrelated groups into their tracks.
-	 * Do not start a named instance with `~`: that marks one a relay minted (see
-	 * {@link Instance.isMinted}), which signing refuses to bind and a catalog's instance check
-	 * skips. The mark is not refused, since a relay forwarding a route keeps the one it received.
+	 * space, so a subscription resumes from one to another. Always set on a route the origin
+	 * delivers; pass it to an origin `request` to pin this stream.
 	 */
-	instance?: Instance.Valid;
+	readonly instance?: Instance.Valid;
 	/**
 	 * Which incarnation of {@link instance} this is: among its routes at one prefix only the
-	 * highest epoch is eligible, cheaper or not. Never compared across instances. Ignored
-	 * without an instance.
+	 * highest epoch is eligible, cheaper or not. Never compared across instances.
 	 */
-	epoch?: bigint;
-	/** The chain of hops the route has traversed, oldest first. */
-	hops: Hop[];
+	readonly epoch?: bigint;
+	/**
+	 * The chain of hops the route has traversed, oldest first. A 0 entry is the anonymous mark;
+	 * see {@link isAnonymous}. A route announced on this origin has none.
+	 */
+	readonly hops: readonly Hop[];
 	/** What pulling content via this route costs; lower wins. */
-	cost: Cost;
+	readonly cost: Cost;
 	/**
 	 * The token the request advertising this route carries, from `auth.add()`, or undefined
 	 * for the session's own credential. Only the session that issued it carries it, as the
 	 * token on its moq-transport PUBLISH_NAMESPACE: any other session, the inline NAMESPACE
 	 * answering a solicited SUBSCRIBE_NAMESPACE, and moq-lite advertise the route unnamed.
-	 * Swapping it renews the request with REQUEST_UPDATE. Local: a relay never forwards it. Mirrors `Route::auth` in rs/moq-net.
+	 * Swapping it renews the request with REQUEST_UPDATE. Local: a relay never forwards it.
 	 */
-	auth?: Credential;
+	readonly auth?: Credential;
 }
 
-/** Constructors and helpers for {@link Route}. */
-export const Route = {
+/** Constructors and helpers for {@link RouteInfo}. @internal */
+export const RouteInfo = {
 	/** An empty hop chain at zero cost: what a publisher seeds for a live broadcast. */
-	default: { hops: [], cost: Cost.zero } as Route,
+	default: { hops: [], cost: Cost.zero } as RouteInfo,
 
 	/** Fill route defaults and saturate the static price at the wire ceiling. */
-	normalize(
-		route:
-			| Route
-			| { instance?: Instance.Valid; epoch?: bigint; hops?: readonly Hop[]; cost?: Cost; auth?: Credential } = {},
-	): Route {
+	normalize(route: Partial<RouteInfo> = {}): RouteInfo {
 		const cost = route.cost ?? Cost.zero;
 		if (typeof cost !== "bigint" || cost < 0n) throw new RangeError("route cost must be a non-negative bigint");
 		const max = 2n ** 62n - 1n;
@@ -162,12 +151,12 @@ export const Route = {
  * An empty chain is a local announcement, not the anonymous mark. Ingress fills a
  * received empty list with the anonymous hop before yielding it.
  */
-export function isAnonymous(route: Route): boolean {
+export function isAnonymous(route: RouteInfo): boolean {
 	return route.hops.includes(UNKNOWN_HOP);
 }
 
 /** Whether two routes name the same instance, epoch, hop chain, cost, and auth. */
-export function routesEqual(a: Route | undefined, b: Route | undefined): boolean {
+export function routesEqual(a: RouteInfo | undefined, b: RouteInfo | undefined): boolean {
 	if (a === b) return true;
 	if (!a || !b) return false;
 	return (
diff --git a/js/net/src/ietf/connection.test.ts b/js/net/src/ietf/connection.test.ts
index 3060dcb9fbd..d920b04d8e8 100644
--- a/js/net/src/ietf/connection.test.ts
+++ b/js/net/src/ietf/connection.test.ts
@@ -162,7 +162,7 @@ test("SUBSCRIBE_NAMESPACE gets the published namespaces", async () => {
 	const pair = createMockTransportPair(ALPN.DRAFT_18);
 	const control = await Stream.open(pair.server, { version });
 	const origin = new OriginProducer();
-	origin.createBroadcast(Path.from("room")).announce();
+	origin.route(Path.from("room"), { hidden: true }).announce();
 	const connection = new Connection({
 		url: new URL("https://example.com"),
 		quic: pair.server,
@@ -397,9 +397,8 @@ for (const [version, alpn] of [[Version.DRAFT_22, ALPN.DRAFT_22]] as const) {
 			const pair = createMockTransportPair(alpn);
 			const control = await Stream.open(pair.server, { version });
 			const origin = new OriginProducer();
-			const broadcastPublication = origin.createBroadcast(Path.from("room"));
-			const broadcast = broadcastPublication.broadcast;
-			broadcastPublication.announce();
+			const broadcastRoute = origin.route(Path.from("room"));
+			const broadcast = broadcastRoute.broadcast;
 			broadcast.createTrack("video", { timescale: Timescale.MILLI });
 			const connection = new Connection({
 				url: new URL("https://example.com"),
@@ -433,9 +432,8 @@ async function serving(version: IetfVersion, alpn: string) {
 	const pair = createMockTransportPair(alpn);
 	const control = await Stream.open(pair.server, { version });
 	const origin = new OriginProducer();
-	const broadcastPublication = origin.createBroadcast(Path.from("room"));
-	const broadcast = broadcastPublication.broadcast;
-	broadcastPublication.announce();
+	const broadcastRoute = origin.route(Path.from("room"));
+	const broadcast = broadcastRoute.broadcast;
 	broadcast.createTrack("video", { timescale: Timescale.MILLI });
 	const connection = new Connection({
 		url: new URL("https://example.com"),
diff --git a/js/net/src/ietf/fetch.test.ts b/js/net/src/ietf/fetch.test.ts
index d74b8f768c7..a34db56c948 100644
--- a/js/net/src/ietf/fetch.test.ts
+++ b/js/net/src/ietf/fetch.test.ts
@@ -53,8 +53,7 @@ function serve(version: IetfVersion, grant?: Signal<Grant | undefined>, priority
 		requiresSolicitation: false,
 		grant,
 	});
-	const publication = origin.createBroadcast(Path.from("room"));
-	publication.announce();
+	const publication = origin.route(Path.from("room"));
 	const track = publication.broadcast.createTrack("video", { timescale: Timescale.MILLI, priority, maxAge });
 	const uni = pair.client.incomingUnidirectionalStreams.getReader() as ReadableStreamDefaultReader<
 		ReadableStream<Uint8Array>
@@ -487,8 +486,7 @@ test("a FETCH preserves relayed metadata and cached groups without upstream FETC
 		for (const warm of [false, true]) {
 			using fx = serve(version);
 			const upstream = new OriginProducer();
-			const publication = upstream.createBroadcast(Path.from("archive"));
-			publication.announce();
+			const publication = upstream.route(Path.from("archive"));
 			const track = publication.broadcast.createTrack("video", { timescale: Timescale.MILLI });
 			writeGroup(track, 3n, ["3-0", "3-1"]);
 			// lite-04 has no FETCH; lite-05 can fetch, but refuses empty subscription ranges.
@@ -507,7 +505,7 @@ test("a FETCH preserves relayed metadata and cached groups without upstream FETC
 					while (await group?.readFrame()) {}
 					group?.close();
 				}
-				const requests = fx.origin.requestsRoute(Path.from("relayed"));
+				const requests = fx.origin.routePrefix(Path.from("relayed"));
 				const cursor = requests.requested();
 				const requested = cursor.next();
 				const type = { ...range(version, at(3, 0), at(3, 0)), trackNamespace: Path.from("relayed") };
diff --git a/js/net/src/ietf/goaway.test.ts b/js/net/src/ietf/goaway.test.ts
index 7ceb767ae72..480dddd5a32 100644
--- a/js/net/src/ietf/goaway.test.ts
+++ b/js/net/src/ietf/goaway.test.ts
@@ -235,7 +235,7 @@ for (const [version, alpn] of [
 		const control = await Stream.open(pair.server, { version });
 		await Stream.accept(pair.client, version);
 		const origin = new OriginProducer();
-		origin.createBroadcast(Path.from("room")).announce();
+		origin.route(Path.from("room"), { hidden: true }).announce();
 		const connection = new Connection({
 			url: new URL("https://relay.example/"),
 			quic: pair.server,
@@ -265,7 +265,7 @@ for (const [version, alpn] of [
 			const control = await Stream.open(pair.server, { version });
 			await Stream.accept(pair.client, version);
 			const origin = new OriginProducer();
-			origin.createBroadcast(Path.from("room")).announce();
+			origin.route(Path.from("room"), { hidden: true }).announce();
 			const connection = new Connection({
 				url: new URL("https://relay.example/"),
 				quic: pair.server,
diff --git a/js/net/src/ietf/join.test.ts b/js/net/src/ietf/join.test.ts
index 38872a9ce63..d33b3c2df0e 100644
--- a/js/net/src/ietf/join.test.ts
+++ b/js/net/src/ietf/join.test.ts
@@ -589,8 +589,7 @@ async function publishing(version: IetfVersion) {
 		server.abort();
 	});
 
-	const publication = origin.createBroadcast(Path.from("room"));
-	publication.announce();
+	const publication = origin.route(Path.from("room"));
 	const broadcast = publication.broadcast;
 	// Written once, before anyone subscribed, and left open: only the head can deliver it.
 	const catalog = broadcast.createTrack("catalog.json", { timescale: Timescale.MILLI });
diff --git a/js/net/src/ietf/malformed.test.ts b/js/net/src/ietf/malformed.test.ts
index 0382758948f..19bf77af8d2 100644
--- a/js/net/src/ietf/malformed.test.ts
+++ b/js/net/src/ietf/malformed.test.ts
@@ -57,9 +57,8 @@ async function serving(version: IetfVersion, alpn: string) {
 	const pair = createMockTransportPair(alpn);
 	const control = await Stream.open(pair.server, { version });
 	const origin = new OriginProducer();
-	const broadcastPublication = origin.createBroadcast(Path.from("room"));
-	const broadcast = broadcastPublication.broadcast;
-	broadcastPublication.announce();
+	const broadcastRoute = origin.route(Path.from("room"));
+	const broadcast = broadcastRoute.broadcast;
 	broadcast.createTrack("video", { timescale: Timescale.MILLI });
 	const connection = new Connection({
 		url: new URL("https://example.com"),
diff --git a/js/net/src/ietf/publisher.test.ts b/js/net/src/ietf/publisher.test.ts
index 5acaa91461a..a8520047281 100644
--- a/js/net/src/ietf/publisher.test.ts
+++ b/js/net/src/ietf/publisher.test.ts
@@ -42,9 +42,8 @@ import { TrackStatusOk, TrackStatusRequest } from "./track.ts";
 import { ALPN, type IetfVersion, Version } from "./version.ts";
 
 function publish(origin: OriginProducer, path: Path.Valid) {
-	const broadcastPublication = origin.createBroadcast(path);
-	const broadcast = broadcastPublication.broadcast;
-	broadcastPublication.announce();
+	const broadcastRoute = origin.route(path);
+	const broadcast = broadcastRoute.broadcast;
 	return broadcast;
 }
 
@@ -295,7 +294,7 @@ test("TRACK_STATUS finished at once is answered on every draft", async () => {
 		const pair = createMockTransportPair(ALPNS[version]);
 		const session = new NativeSession(pair.server, version, true);
 		const { pub, origin } = publisher(pair.server, { session });
-		const requests = origin.requestsRoute(Path.from("room")).requested();
+		const requests = origin.routePrefix(Path.from("room")).requested();
 
 		// The FIN arrives while the broadcast still resolves.
 		const { stream, wire, finish } = requestStream(version);
@@ -341,7 +340,7 @@ test("TRACK_STATUS outside the grant is refused on every draft", async () => {
 		const session = new NativeSession(pair.server, version, true);
 		const grant = new Signal<Grant | undefined>(nothing());
 		const { pub, origin } = publisher(pair.server, { session, grant });
-		const requests = origin.requestsRoute(Path.from("room")).requested();
+		const requests = origin.routePrefix(Path.from("room")).requested();
 
 		const outside = requestStream(version);
 		await pub.runTrackStatusRequest(trackStatus("room"), outside.stream);
@@ -368,7 +367,7 @@ test("a second GOAWAY on an unanswered SUBSCRIBE closes the session", async () =
 		const pair = createMockTransportPair(ALPNS[version]);
 		const session = new NativeSession(pair.server, version, true);
 		const { pub, origin } = publisher(pair.server, { session });
-		const requests = origin.requests(Path.from("room")).requested();
+		const requests = origin.routePrefix(Path.from("room")).requested();
 
 		const held = requestStream(version);
 		const task = pub.runSubscribe(
@@ -426,7 +425,7 @@ test("a cancelled TRACK_STATUS releases its demand on every draft", async () =>
 		const pair = createMockTransportPair(ALPNS[version]);
 		const session = new NativeSession(pair.server, version, true);
 		const { pub, origin } = publisher(pair.server, { session });
-		const requests = origin.requestsRoute(Path.from("room")).requested();
+		const requests = origin.routePrefix(Path.from("room")).requested();
 
 		// The broadcast is still resolving: its handler never answers.
 		const early = requestStream(version);
@@ -478,7 +477,7 @@ test("a SUBSCRIBE withdrawn during setup releases its demand on every draft", as
 		const pair = createMockTransportPair(ALPNS[version]);
 		const session = new NativeSession(pair.server, version, true);
 		const { pub, origin } = publisher(pair.server, { session });
-		const requests = origin.requestsRoute(Path.from("room")).requested();
+		const requests = origin.routePrefix(Path.from("room")).requested();
 
 		// The broadcast is still resolving: its handler never answers.
 		const early = requestStream(version);
@@ -645,7 +644,7 @@ test("reserved namespace requests get DOES_NOT_EXIST while other dot namespaces
 			// Navigation segments cannot be published. A covering application
 			// route still proves these reserved requests are refused before lookup.
 			const navigation = path.split("/")[0] === ".";
-			const claim = navigation ? origin.requests(Path.empty()) : undefined;
+			const claim = navigation ? origin.routePrefix(Path.empty()) : undefined;
 			const requested = claim?.requested().next();
 			const broadcast = navigation ? undefined : publish(origin, Path.from(path));
 			const track = broadcast?.createTrack("video", { timescale: Timescale.MILLI });
@@ -1156,7 +1155,7 @@ test("a subscription outside a covering route's claim does not hear it", async (
 	const pair = createMockTransportPair(ALPN.DRAFT_18);
 	const { pub, origin } = publisher(pair.server, { requiresSolicitation: true });
 	const chat = origin.scope(Path.empty(), new Path.Patterns([Path.Pattern.subtree(Path.from("room/chat"))]));
-	const dynamic = chat.requestsRoute(Path.from("room"));
+	const dynamic = chat.routePrefix(Path.from("room"));
 
 	const subscription = await Stream.open(pair.client, { version: VERSION });
 	const accepted = await Stream.accept(pair.server, VERSION);
@@ -1188,8 +1187,8 @@ test("a subscription hears the best covering route its claim allows", async () =
 	const { pub, origin } = publisher(pair.server, { requiresSolicitation: true });
 	const scoped = (path: string) =>
 		origin.scope(Path.empty(), new Path.Patterns([Path.Pattern.subtree(Path.from(path))]));
-	const chat = scoped("room/chat").requestsRoute(Path.from("room"), { cost: 1n });
-	const video = scoped("room/video").requestsRoute(Path.from("room"), { cost: 5n });
+	const chat = scoped("room/chat").routePrefix(Path.from("room"), { cost: 1n });
+	const video = scoped("room/video").routePrefix(Path.from("room"), { cost: 5n });
 
 	const subscription = await Stream.open(pair.client, { version: VERSION });
 	const accepted = await Stream.accept(pair.server, VERSION);
@@ -1229,8 +1228,8 @@ test("a subscription hears a broader covering route when the narrowest cannot se
 	});
 	const chat = origin
 		.scope(Path.empty(), new Path.Patterns([Path.Pattern.subtree(Path.from("tenant/chat"))]))
-		.requestsRoute(Path.from("tenant"));
-	const broad = origin.requestsRoute(Path.empty(), { cost: 5n });
+		.routePrefix(Path.from("tenant"));
+	const broad = origin.routePrefix(Path.empty(), { cost: 5n });
 
 	const subscription = await Stream.open(pair.client, { version: VERSION });
 	const accepted = await Stream.accept(pair.server, VERSION);
@@ -1267,7 +1266,7 @@ test("a covering route's claim is compared relative to the served root", async (
 		requiresSolicitation: true,
 	});
 	const chat = origin.scope(Path.empty(), new Path.Patterns([Path.Pattern.subtree(Path.from("tenant/room/chat"))]));
-	const dynamic = chat.requestsRoute(Path.from("tenant/room"));
+	const dynamic = chat.routePrefix(Path.from("tenant/room"));
 
 	const subscription = await Stream.open(pair.client, { version: VERSION });
 	const accepted = await Stream.accept(pair.server, VERSION);
@@ -1351,8 +1350,7 @@ test("a new instance at the same path clears a refusal", async () => {
 	const pair = createMockTransportPair(ALPN.DRAFT_18);
 	const { pub, origin } = publisher(pair.server);
 
-	const broadcast = origin.createBroadcast(Path.from("restarted"));
-	broadcast.announce({ instance: Instance.random() });
+	const broadcast = origin.route(Path.from("restarted"), { instance: Instance.random() });
 
 	void pub.runPublishNamespaces();
 
@@ -1362,7 +1360,7 @@ test("a new instance at the same path clears a refusal", async () => {
 	await declinePublishNamespace(declined, 0n);
 	await sleep(Nano.fromMilli(Milli(SETTLE)));
 
-	broadcast.announce({ ...broadcast.route, instance: Instance.random() });
+	wireOf(broadcast).update({ ...wireOf(broadcast).info, instance: Instance.random() });
 
 	const retried = await nextStream(pair.client);
 	if (!retried) throw new Error("the new instance was never offered");
@@ -1563,18 +1561,18 @@ const OTHER: Hop = HopSchema.parse(5n);
 test("a price change on a held namespace is one REQUEST_UPDATE, not a withdrawal", async () => {
 	const { clock, self, pub, origin, streams, close } = clustered();
 	try {
-		const broadcast = origin.createBroadcast(Path.from("mine"));
-		broadcast.announce({ hops: [VIA], cost: 4n });
+		const broadcast = origin.route(Path.from("mine"), { hidden: true });
+		wireOf(broadcast).update({ hops: [VIA], cost: 4n });
 		void pub.runPublishNamespaces();
 
 		const stream = await take(clock, streams);
 		expect(await acceptClustered(stream)).toEqual({ hops: [VIA, self], cost: 4n });
 
-		broadcast.announce({ hops: [VIA], cost: 8n });
+		wireOf(broadcast).update({ hops: [VIA], cost: 8n });
 		expect(await readUpdate(stream)).toEqual({ hops: undefined, cost: 8n });
 		await acceptPublishNamespace(stream);
 
-		broadcast.announce({ hops: [VIA], cost: 0n });
+		wireOf(broadcast).update({ hops: [VIA], cost: 0n });
 		expect(await readUpdate(stream)).toEqual({ hops: undefined, cost: 0n });
 		await acceptPublishNamespace(stream);
 
@@ -1591,14 +1589,14 @@ test("a price change on a held namespace is one REQUEST_UPDATE, not a withdrawal
 test("a hop path change behind the same publisher is one REQUEST_UPDATE carrying HOP_PATH", async () => {
 	const { clock, self, pub, origin, streams, close } = clustered();
 	try {
-		const broadcast = origin.createBroadcast(Path.from("mine"));
-		broadcast.announce({ hops: [VIA], cost: 4n });
+		const broadcast = origin.route(Path.from("mine"), { hidden: true });
+		wireOf(broadcast).update({ hops: [VIA], cost: 4n });
 		void pub.runPublishNamespaces();
 
 		const stream = await take(clock, streams);
 		await acceptClustered(stream);
 
-		broadcast.announce({ hops: [VIA, MID], cost: 4n });
+		wireOf(broadcast).update({ hops: [VIA, MID], cost: 4n });
 		expect(await readUpdate(stream)).toEqual({ hops: [VIA, MID, self], cost: undefined });
 		await acceptPublishNamespace(stream);
 
@@ -1621,8 +1619,8 @@ test.each([
 ] as const)("a solicited namespace takes %s as one NAMESPACE and no NAMESPACE_DONE", async (_, hops, cost) => {
 	const { clock, self, pair, pub, origin, close } = clustered(true);
 	try {
-		const broadcast = origin.createBroadcast(Path.from("mine"));
-		broadcast.announce({ hops: [VIA], cost: 4n });
+		const broadcast = origin.route(Path.from("mine"), { hidden: true });
+		wireOf(broadcast).update({ hops: [VIA], cost: 4n });
 
 		const subscription = await Stream.open(pair.client, { version: VERSION });
 		const stream = await Stream.accept(pair.server, VERSION);
@@ -1641,7 +1639,7 @@ test.each([
 			params: { cluster: { hops: [VIA, self], cost: 4n } },
 		});
 
-		broadcast.announce({ hops: [...hops], cost });
+		wireOf(broadcast).update({ hops: [...hops], cost });
 		expect(await entry()).toMatchObject({
 			suffix: Path.from("mine"),
 			params: { cluster: { hops: [...hops, self], cost } },
@@ -1663,14 +1661,14 @@ test.each([
 test("a first-hop change is one REQUEST_UPDATE carrying HOP_PATH, not a withdrawal", async () => {
 	const { clock, self, pub, origin, streams, close } = clustered();
 	try {
-		const broadcast = origin.createBroadcast(Path.from("mine"));
-		broadcast.announce({ hops: [VIA], cost: 4n });
+		const broadcast = origin.route(Path.from("mine"), { hidden: true });
+		wireOf(broadcast).update({ hops: [VIA], cost: 4n });
 		void pub.runPublishNamespaces();
 
 		const stream = await take(clock, streams);
 		await acceptClustered(stream);
 
-		broadcast.announce({ hops: [OTHER], cost: 4n });
+		wireOf(broadcast).update({ hops: [OTHER], cost: 4n });
 		expect(await readUpdate(stream)).toEqual({ hops: [OTHER, self], cost: undefined });
 		await acceptPublishNamespace(stream);
 
@@ -1685,8 +1683,8 @@ test("a first-hop change is one REQUEST_UPDATE carrying HOP_PATH, not a withdraw
 
 /** A different broadcast is not an update: it withdraws the old one and advertises again. */
 function republish(origin: OriginProducer, old: BroadcastProducer) {
-	const next = origin.createBroadcast(Path.from("mine"));
-	next.announce({ hops: [VIA], cost: 4n });
+	const next = origin.route(Path.from("mine"), { hidden: true });
+	wireOf(next).update({ hops: [VIA], cost: 4n });
 	old.close();
 }
 
@@ -1750,15 +1748,15 @@ test("swapping a route's token is one REQUEST_UPDATE carrying it", async () => {
 	const { clock, pub, origin, streams, close } = clustered(false, tokens);
 	const { sent, restore } = carriedTokens();
 	try {
-		const broadcast = origin.createBroadcast(Path.from("mine"));
-		broadcast.announce({ hops: [VIA], cost: 4n, auth: tokens.issue("first") });
+		const broadcast = origin.route(Path.from("mine"), { hidden: true });
+		wireOf(broadcast).update({ hops: [VIA], cost: 4n, auth: tokens.issue("first") });
 		void pub.runPublishNamespaces();
 
 		const stream = await take(clock, streams);
 		await acceptClustered(stream);
 		expect(sent).toEqual(["first"]);
 
-		broadcast.announce({ hops: [VIA], cost: 4n, auth: tokens.issue("second") });
+		wireOf(broadcast).update({ hops: [VIA], cost: 4n, auth: tokens.issue("second") });
 		expect(await readUpdate(stream)).toEqual({ hops: undefined, cost: undefined });
 		await acceptPublishNamespace(stream);
 		expect(sent).toEqual(["first", "second"]);
@@ -1775,13 +1773,13 @@ test("a foreign route token is not carried", async () => {
 	const { clock, pub, origin, streams, close } = clustered(false, new Tokens());
 	const { sent, restore } = carriedTokens();
 	try {
-		const broadcast = origin.createBroadcast(Path.from("mine"));
-		broadcast.announce({ hops: [VIA], cost: 4n, auth: foreign.issue("first") });
+		const broadcast = origin.route(Path.from("mine"), { hidden: true });
+		wireOf(broadcast).update({ hops: [VIA], cost: 4n, auth: foreign.issue("first") });
 		void pub.runPublishNamespaces();
 
 		const stream = await take(clock, streams);
 		await acceptClustered(stream);
-		broadcast.announce({ hops: [VIA], cost: 4n, auth: foreign.issue("second") });
+		wireOf(broadcast).update({ hops: [VIA], cost: 4n, auth: foreign.issue("second") });
 		const more = watch(stream.reader.u53());
 		await clock.advance(Nano.zero);
 		expect(more.state).toBe("pending");
@@ -1798,13 +1796,13 @@ test("naming a token on an unnamed request makes it again", async () => {
 	const { clock, pub, origin, streams, close } = clustered(false, tokens);
 	const { sent, restore } = carriedTokens();
 	try {
-		const broadcast = origin.createBroadcast(Path.from("mine"));
-		broadcast.announce({ hops: [VIA], cost: 4n });
+		const broadcast = origin.route(Path.from("mine"), { hidden: true });
+		wireOf(broadcast).update({ hops: [VIA], cost: 4n });
 		void pub.runPublishNamespaces();
 
 		const old = await take(clock, streams);
 		await acceptClustered(old);
-		broadcast.announce({ hops: [VIA], cost: 4n, auth: tokens.issue("first") });
+		wireOf(broadcast).update({ hops: [VIA], cost: 4n, auth: tokens.issue("first") });
 
 		expect(await old.reader.done().catch(error)).toMatchObject({ code: StreamCode.Cancel });
 		await acceptClustered(await take(clock, streams));
@@ -1821,9 +1819,9 @@ test("closing a route's token makes its request again without it", async () => {
 	const { clock, pub, origin, streams, close } = clustered(false, tokens);
 	const { sent, restore } = carriedTokens();
 	try {
-		const broadcast = origin.createBroadcast(Path.from("mine"));
+		const broadcast = origin.route(Path.from("mine"), { hidden: true });
 		const token = tokens.issue("first");
-		broadcast.announce({ hops: [VIA], cost: 4n, auth: token });
+		wireOf(broadcast).update({ hops: [VIA], cost: 4n, auth: token });
 		void pub.runPublishNamespaces();
 
 		const old = await take(clock, streams);
@@ -1842,9 +1840,9 @@ test("closing a route's token makes its request again without it", async () => {
 test("a republish withdraws the PUBLISH_NAMESPACE and advertises again", async () => {
 	const { clock, pub, origin, streams, close } = clustered();
 	try {
-		const broadcastPublication = origin.createBroadcast(Path.from("mine"));
-		const broadcast = broadcastPublication.broadcast;
-		broadcastPublication.announce({ hops: [VIA], cost: 4n });
+		const broadcastRoute = origin.route(Path.from("mine"), { hidden: true });
+		const broadcast = broadcastRoute.broadcast;
+		wireOf(broadcastRoute).update({ hops: [VIA], cost: 4n });
 		void pub.runPublishNamespaces();
 
 		const old = await take(clock, streams);
@@ -1864,9 +1862,9 @@ test("a republish withdraws the PUBLISH_NAMESPACE and advertises again", async (
 test("a republish withdraws the solicited NAMESPACE and sends it again", async () => {
 	const { pair, pub, origin, close } = clustered(true);
 	try {
-		const broadcastPublication = origin.createBroadcast(Path.from("mine"));
-		const broadcast = broadcastPublication.broadcast;
-		broadcastPublication.announce({ hops: [VIA], cost: 4n });
+		const broadcastRoute = origin.route(Path.from("mine"), { hidden: true });
+		const broadcast = broadcastRoute.broadcast;
+		wireOf(broadcastRoute).update({ hops: [VIA], cost: 4n });
 
 		const subscription = await Stream.open(pair.client, { version: VERSION });
 		const stream = await Stream.accept(pair.server, VERSION);
@@ -1903,14 +1901,14 @@ test.each([
 ])("a refused update %s", async (_, retryInterval) => {
 	const { clock, pub, origin, streams, close } = clustered();
 	try {
-		const broadcast = origin.createBroadcast(Path.from("mine"));
-		broadcast.announce({ hops: [VIA], cost: 4n });
+		const broadcast = origin.route(Path.from("mine"), { hidden: true });
+		wireOf(broadcast).update({ hops: [VIA], cost: 4n });
 		void pub.runPublishNamespaces();
 
 		const stream = await take(clock, streams);
 		await acceptClustered(stream);
 
-		broadcast.announce({ hops: [VIA], cost: 8n });
+		wireOf(broadcast).update({ hops: [VIA], cost: 8n });
 		await readUpdate(stream);
 		await declinePublishNamespace(stream, retryInterval);
 
@@ -1944,8 +1942,8 @@ test.each([
 test("a refused update whose peer closes the request keeps the loop running", async () => {
 	const { clock, pub, origin, streams, close } = clustered();
 	try {
-		const broadcast = origin.createBroadcast(Path.from("mine"));
-		broadcast.announce({ hops: [VIA], cost: 4n });
+		const broadcast = origin.route(Path.from("mine"), { hidden: true });
+		wireOf(broadcast).update({ hops: [VIA], cost: 4n });
 		let failed: unknown;
 		void pub.runPublishNamespaces().catch((err: unknown) => {
 			failed = err;
@@ -1954,7 +1952,7 @@ test("a refused update whose peer closes the request keeps the loop running", as
 		const stream = await take(clock, streams);
 		await acceptClustered(stream);
 
-		broadcast.announce({ hops: [VIA], cost: 8n });
+		wireOf(broadcast).update({ hops: [VIA], cost: 8n });
 		await readUpdate(stream);
 		await declinePublishNamespace(stream, 1n);
 		stream.close();
@@ -1975,17 +1973,17 @@ test("a refused update whose peer closes the request keeps the loop running", as
 test("a change while an update is unanswered waits for its answer", async () => {
 	const { clock, pub, origin, streams, close } = clustered();
 	try {
-		const broadcast = origin.createBroadcast(Path.from("mine"));
-		broadcast.announce({ hops: [VIA], cost: 4n });
+		const broadcast = origin.route(Path.from("mine"), { hidden: true });
+		wireOf(broadcast).update({ hops: [VIA], cost: 4n });
 		void pub.runPublishNamespaces();
 
 		const stream = await take(clock, streams);
 		await acceptClustered(stream);
 
-		broadcast.announce({ hops: [VIA], cost: 8n });
+		wireOf(broadcast).update({ hops: [VIA], cost: 8n });
 		expect(await readUpdate(stream)).toEqual({ hops: undefined, cost: 8n });
 
-		broadcast.announce({ hops: [VIA], cost: 12n });
+		wireOf(broadcast).update({ hops: [VIA], cost: 12n });
 		const second = watch(stream.reader.u53());
 		await clock.advance(Nano.fromMilli(Milli(1_000)));
 		expect(second.state).toBe("pending");
@@ -2013,7 +2011,7 @@ test("a change while an update is unanswered waits for its answer", async () =>
 test("an advertisement the peer keeps ending comes back on a growing backoff", async () => {
 	const { clock, pub, origin, streams, close } = clustered();
 	try {
-		origin.createBroadcast(Path.from("mine")).announce({ hops: [VIA], cost: 4n });
+		wireOf(origin.route(Path.from("mine"), { hidden: true })).update({ hops: [VIA], cost: 4n });
 		void pub.runPublishNamespaces();
 
 		let stream = await take(clock, streams);
@@ -2041,14 +2039,14 @@ test("an advertisement the peer keeps ending comes back on a growing backoff", a
 test("an unanswered update drops the request and re-offers the namespace fresh", async () => {
 	const { clock, pub, origin, streams, close } = clustered();
 	try {
-		const broadcast = origin.createBroadcast(Path.from("mine"));
-		broadcast.announce({ hops: [VIA], cost: 4n });
+		const broadcast = origin.route(Path.from("mine"), { hidden: true });
+		wireOf(broadcast).update({ hops: [VIA], cost: 4n });
 		void pub.runPublishNamespaces();
 
 		const stream = await take(clock, streams);
 		await acceptClustered(stream);
 
-		broadcast.announce({ hops: [VIA], cost: 8n });
+		wireOf(broadcast).update({ hops: [VIA], cost: 8n });
 		await readUpdate(stream);
 		const reset = watch(stream.reader.u53());
 
@@ -2079,8 +2077,7 @@ test.each([
 	const self: Hop = HopSchema.parse(7n);
 	const pair = createMockTransportPair(ALPN.DRAFT_18);
 	const { pub, origin } = publisher(pair.server, { cluster: { self, peer } });
-	const broadcast = origin.createBroadcast(Path.from("mine"));
-	broadcast.announce({ cost: 4n });
+	const broadcast = origin.route(Path.from("mine"), { cost: 4n });
 	void pub.runPublishNamespaces();
 
 	const stream = await nextStream(pair.client);
@@ -2090,7 +2087,7 @@ test.each([
 	expect(msg.trackNamespace).toBe(Path.from("mine"));
 	await acceptPublishNamespace(stream);
 
-	broadcast.announce({ cost: peer === undefined ? 8n : 4n });
+	broadcast.setCost(peer === undefined ? 8n : 4n);
 	await noStream(pair.client, clock);
 
 	origin.close();
diff --git a/js/net/src/ietf/publisher.ts b/js/net/src/ietf/publisher.ts
index 55034c0c5c3..7e7d2c25fbc 100644
--- a/js/net/src/ietf/publisher.ts
+++ b/js/net/src/ietf/publisher.ts
@@ -19,7 +19,7 @@ import {
 	unauthorized,
 } from "../error.ts";
 import type * as group from "../group.ts";
-import type { Hop, Route } from "../hop.ts";
+import type { Hop, RouteInfo } from "../hop.ts";
 import { finalSequence, firstEligible, hiddenBelow, hooks, presented, type ReadGroupFrame } from "../internal.ts";
 import type { Consumer as OriginConsumer } from "../origin.ts";
 import * as Path from "../path.ts";
@@ -79,7 +79,7 @@ const RETRY_BASE = 100;
 const RETRY_MAX = 5000;
 
 /** Cluster parameters for one snapshot: the advertised hops, then our own id last. */
-function clusterFor(base: Cluster.Advert | undefined, route: Route): Cluster.Advert | undefined {
+function clusterFor(base: Cluster.Advert | undefined, route: RouteInfo): Cluster.Advert | undefined {
 	if (!base) return undefined;
 	const self = base.hops.at(-1);
 	if (self === undefined) return undefined;
@@ -1819,7 +1819,7 @@ export class Publisher {
 	/**
 	 * The extension parameters an advertisement of `route` carries.
 	 */
-	#params(route: Route): AdvertParams {
+	#params(route: RouteInfo): AdvertParams {
 		return { cluster: clusterFor(this.#advert, route) };
 	}
 
@@ -1828,7 +1828,7 @@ export class Publisher {
 	 * is logged and skipped: a peer that wants none of this rejects each one and stays
 	 * connected.
 	 */
-	async #advertise(path: Path.Valid, requests: Requests, route: Route): Promise<Answer> {
+	async #advertise(path: Path.Valid, requests: Requests, route: RouteInfo): Promise<Answer> {
 		const params = this.#params(route);
 		const auth = this.#carry(route.auth);
 		const requestId = await this.#session.nextRequestId();
diff --git a/js/net/src/ietf/subscriber.ts b/js/net/src/ietf/subscriber.ts
index 7333b0b493f..1a5dc4918f3 100644
--- a/js/net/src/ietf/subscriber.ts
+++ b/js/net/src/ietf/subscriber.ts
@@ -21,7 +21,7 @@ import {
 } from "../error.ts";
 import { type Fill, fillChanged, type Requests, wantedRuns } from "../fill.ts";
 import type * as netGroup from "../group.ts";
-import { Cost, type Route, routesEqual, UNKNOWN_HOP } from "../hop.ts";
+import { Cost, type RouteInfo, routesEqual, UNKNOWN_HOP } from "../hop.ts";
 import * as Instance from "../instance.ts";
 import { finalSequence, hiddenBelow, hooks, maxDelayOf, scopeCaptures, scopeHead, scopeOverlaps } from "../internal.ts";
 import type { Lister } from "../listing.ts";
@@ -119,7 +119,7 @@ type SubscribeSetupState = {
 };
 
 /** An announced path: each live advertisement referencing it, oldest first, and the route it holds. */
-type Announced = { adverts: { id: number; route: Route }[]; route: Route };
+type Announced = { adverts: { id: number; route: RouteInfo }[]; route: RouteInfo };
 
 /** A local announce reader's filter: its scope, the prefix it asked for, and its hidden opt-in. */
 type Filter = { scope: Path.Pattern; prefix: Path.Valid; hidden: boolean; covering: boolean };
@@ -266,7 +266,7 @@ export class Subscriber {
 	}
 
 	// What a route costs once the peer has asked us to leave.
-	#priced(route: Route): Route {
+	#priced(route: RouteInfo): RouteInfo {
 		if (!this.#goingAway()) return route;
 		if (route.cost === DRAIN_COST) return route;
 		return { ...route, cost: DRAIN_COST };
@@ -300,7 +300,7 @@ export class Subscriber {
 	/**
 	 * The route an advertisement carries, before it is minted an instance; one without a path is anonymous and free.
 	 */
-	#route({ cluster }: AdvertParams): Route {
+	#route({ cluster }: AdvertParams): RouteInfo {
 		return cluster === undefined ? { hops: [UNKNOWN_HOP], cost: Cost.zero } : { ...cluster };
 	}
 
@@ -370,7 +370,7 @@ export class Subscriber {
 	 * Record one more advertisement for a path, returning the id that names it. Consumers
 	 * hear `start` for the first; a later one stands as the newest (see `#settleAnnounce`).
 	 */
-	#attachAnnounce(path: Path.Valid, route: Route): number {
+	#attachAnnounce(path: Path.Valid, route: RouteInfo): number {
 		const id = this.#nextAdvert++;
 		const existing = this.#announced.get(path);
 		if (existing) {
@@ -396,7 +396,7 @@ export class Subscriber {
 	}
 
 	/** Replace the route of advertisement `id`, which moves the path only while it is the newest. */
-	#updateAnnounce(path: Path.Valid, id: number, route: Route) {
+	#updateAnnounce(path: Path.Valid, id: number, route: RouteInfo) {
 		const existing = this.#announced.get(path);
 		const advert = existing?.adverts.find((advert) => advert.id === id);
 		if (existing === undefined || advert === undefined) return;
diff --git a/js/net/src/integration.test.ts b/js/net/src/integration.test.ts
index 68469b293d7..3808ed63d56 100644
--- a/js/net/src/integration.test.ts
+++ b/js/net/src/integration.test.ts
@@ -33,9 +33,8 @@ import { withTimeout } from "./util/timeout.ts";
 import { wireOf } from "./wire.ts";
 
 function publish(origin: OriginProducer, path: Path.Valid) {
-	const broadcastPublication = origin.createBroadcast(path);
-	const broadcast = broadcastPublication.broadcast;
-	broadcastPublication.announce();
+	const broadcastRoute = origin.route(path);
+	const broadcast = broadcastRoute.broadcast;
 	return broadcast;
 }
 
@@ -891,10 +890,9 @@ test("integration: a peer is served the cheaper route it was offered, not the lo
 	const path = Path.from("test");
 	// One publisher instance, so the two compete on cost alone.
 	const instance = Instance.random();
-	const localPublication = origin.createBroadcast(path);
-	const local = localPublication.broadcast;
-	localPublication.announce({ instance, cost: 5n });
-	const dynamic = origin.requestsRoute(path, { instance, cost: 1n });
+	const localRoute = origin.route(path, { instance, cost: 5n });
+	const local = localRoute.broadcast;
+	const dynamic = origin.routePrefix(path, { instance, cost: 1n });
 
 	const [client, server] = await Promise.all([
 		connect(url, { transport: pair.client }),
@@ -1264,8 +1262,7 @@ test("integration: ietf fetches a past group of a finished track", async () => {
 	for (const protocol of [Ietf.ALPN.DRAFT_18, Ietf.ALPN.DRAFT_20, Ietf.ALPN.DRAFT_22]) {
 		const pair = createMockTransportPair(protocol);
 		const origin = new OriginProducer();
-		const publication = origin.createBroadcast(Path.from("test"));
-		publication.announce();
+		const publication = origin.route(Path.from("test"));
 		// No publisher limit, so the superseded group stays fresh to fetch, and no MAX_CACHE_DURATION.
 		const published = publication.broadcast.createTrack("video", { timescale: Timescale.MILLI, maxAge: null });
 		for (let sequence = 0; sequence < 3; sequence++) {
@@ -2617,12 +2614,12 @@ test("create then announce is discoverable on the wire", async () => {
 	]);
 
 	const announced = client.routes();
-	const broadcastPublication = origin.createBroadcast(Path.from("later"));
-	const broadcast = broadcastPublication.broadcast;
+	const broadcastRoute = origin.route(Path.from("later"), { hidden: true });
+	const broadcast = broadcastRoute.broadcast;
 	broadcast.createTrack("chat", { timescale: Timescale.MILLI });
 
 	const pending = announced.next();
-	broadcastPublication.announce();
+	broadcastRoute.announce();
 	const entry = await pending;
 	expect(entry?.prefix).toBe("later" as Path.Valid);
 	expect(entry?.kind).toBe("start");
@@ -2640,7 +2637,7 @@ test.each([Lite.ALPN_06, Lite.ALPN_07_WIP, Ietf.ALPN.DRAFT_18, Ietf.ALPN.DRAFT_2
 		const pair = createMockTransportPair(protocol);
 		const origin = new OriginProducer();
 		const consumer = new OriginProducer();
-		const handle = origin.requests(Path.empty());
+		const handle = origin.routePrefix(Path.empty());
 		const held = new BroadcastProducer();
 		held.createTrack("chat", { timescale: Timescale.MILLI }).writeFrame(textFrame("hello"));
 		const serving = (async () => {
@@ -2674,14 +2671,15 @@ test.each([Lite.ALPN_06, Lite.ALPN_07_WIP, Ietf.ALPN.DRAFT_18, Ietf.ALPN.DRAFT_2
 		const pair = createMockTransportPair(protocol);
 		const origin = new OriginProducer();
 		const consumer = new OriginProducer();
-		const handle = origin.requests(Path.empty());
+		const handle = origin.routePrefix(Path.empty());
 		const serving = (async () => {
 			const requests = handle.requested();
 			const request = (await requests.next()).value;
 			if (!request) throw new Error("missing job request");
-			const prepared = request.prepare();
-			prepared.broadcast.createTrack("chat", { timescale: Timescale.MILLI }).writeFrame(textFrame("job"));
-			return prepared.publish();
+			const job = request.route({ hidden: true });
+			job.broadcast.createTrack("chat", { timescale: Timescale.MILLI }).writeFrame(textFrame("job"));
+			job.announce();
+			return job;
 		})();
 		const [client, server] = await Promise.all([
 			connect(url, { transport: pair.client, consume: consumer }),
@@ -2692,11 +2690,11 @@ test.each([Lite.ALPN_06, Lite.ALPN_07_WIP, Ietf.ALPN.DRAFT_18, Ietf.ALPN.DRAFT_2
 		if (!remote) throw new Error("request did not resolve");
 		const track = remote.track("chat").subscribe().ordered();
 		await expect(track.readString()).rejects.toBeInstanceOf(Error);
-		const publication = await serving;
+		const job = await serving;
 		track.close();
 		requested.close();
 		handle.close();
-		publication.broadcast.close();
+		job.close();
 		client.abort();
 		server.abort();
 		origin.close();
diff --git a/js/net/src/internal.ts b/js/net/src/internal.ts
index 6b1c48be47f..4d1c81d4587 100644
--- a/js/net/src/internal.ts
+++ b/js/net/src/internal.ts
@@ -12,7 +12,7 @@ import type * as datagram from "./datagram.ts";
 import type { Delivered } from "./delivered.ts";
 import { toStreamCode } from "./error.ts";
 import type { Frame, FrameConsumer, Consumer as GroupConsumer, Producer as GroupProducer } from "./group.ts";
-import { isAnonymous, type Route } from "./hop.ts";
+import { isAnonymous, type RouteInfo } from "./hop.ts";
 import type * as Instance from "./instance.ts";
 import * as Path from "./path.ts";
 import type { Timestamp } from "./time.ts";
@@ -132,12 +132,12 @@ export function presented(
  * candidate supersedes. Supersession is decided among what the reader may see, so a higher epoch
  * it cannot see never hides a route it can.
  */
-export function firstEligible<T extends { readonly route: Route; readonly prefix?: Path.Valid }>(
+export function firstEligible<T extends { readonly route: RouteInfo; readonly prefix?: Path.Valid }>(
 	candidates: readonly T[],
 	admits: (candidate: T) => boolean = () => true,
 ): T | undefined {
 	const admitted = candidates.filter(admits);
-	const byPrefix = new Map<Path.Valid | undefined, Route[]>();
+	const byPrefix = new Map<Path.Valid | undefined, RouteInfo[]>();
 	for (const candidate of admitted) {
 		const routes = byPrefix.get(candidate.prefix);
 		if (routes) routes.push(candidate.route);
@@ -728,12 +728,6 @@ export const hooks: {
 	 * mirror is released too: not when its group reads on, or may yet, from another copy.
 	 */
 	evictGroup: (group: GroupConsumer) => boolean;
-	/** Attach the origin advertisement of a created broadcast. */
-	attachAnnouncer: (
-		producer: BroadcastProducer,
-		announcer: { announce(route: Route): void; unannounce(): void; route(): Route | undefined },
-	) => void;
-
 	/** Call `fn` synchronously when an open broadcast closes, from any handle. */
 	onClosed: (producer: BroadcastProducer, fn: () => void) => Dispose;
 	/** Name a broadcast handle by the path an origin created or resolved it at. */
@@ -1012,10 +1006,6 @@ export const hooks: {
 	evictGroup: () => {
 		throw new Error("group.ts not loaded");
 	},
-	attachAnnouncer: () => {
-		throw new Error("broadcast.ts not loaded");
-	},
-
 	onClosed: () => {
 		throw new Error("broadcast.ts not loaded");
 	},
@@ -1083,7 +1073,7 @@ export function* coveringPrefixes(path: Path.Valid): Generator<Path.Valid> {
  * a higher epoch at the same prefix. An older incarnation of an instance is never eligible,
  * however cheap, since its publisher was replaced.
  */
-export function superseded(route: Route, others: Iterable<Route>): boolean {
+export function superseded(route: RouteInfo, others: Iterable<RouteInfo>): boolean {
 	return new Epochs(others).supersedes(route);
 }
 
@@ -1095,7 +1085,7 @@ export function superseded(route: Route, others: Iterable<Route>): boolean {
 export class Epochs {
 	readonly #highest = new Map<Instance.Valid | undefined, bigint>();
 
-	constructor(routes: Iterable<Route>) {
+	constructor(routes: Iterable<RouteInfo>) {
 		for (const route of routes) {
 			const epoch = route.epoch ?? 0n;
 			if (epoch === 0n) continue;
@@ -1105,14 +1095,14 @@ export class Epochs {
 	}
 
 	/** Whether a route carries `route`'s instance at a higher epoch. */
-	supersedes(route: Route): boolean {
+	supersedes(route: RouteInfo): boolean {
 		const highest = this.#highest.get(route.instance);
 		return highest !== undefined && highest > (route.epoch ?? 0n);
 	}
 }
 
 /** Prefer identified publishers, then lower static cost. */
-export function compareRoutes(a: Route, b: Route): number {
+export function compareRoutes(a: RouteInfo, b: RouteInfo): number {
 	return Number(isAnonymous(a)) - Number(isAnonymous(b)) || (a.cost < b.cost ? -1 : a.cost > b.cost ? 1 : 0);
 }
 
@@ -1124,7 +1114,7 @@ export function compareRoutes(a: Route, b: Route): number {
  * matching `route_order` in rs/moq-net for routes a node did not get from a cluster peer, which
  * is every route here.
  */
-export function compareRouteCandidates(path: Path.Valid, prefix: Path.Valid, a: Route, b: Route): number {
+export function compareRouteCandidates(path: Path.Valid, prefix: Path.Valid, a: RouteInfo, b: RouteInfo): number {
 	const order = compareRoutes(a, b) || a.hops.length - b.hops.length;
 	if (order !== 0 || path === prefix) return order;
 	const ha = spreadHash(path, a.instance ?? "");
diff --git a/js/net/src/lite/compression.test.ts b/js/net/src/lite/compression.test.ts
index 43d7d1c9a41..d6d32fb03f8 100644
--- a/js/net/src/lite/compression.test.ts
+++ b/js/net/src/lite/compression.test.ts
@@ -13,11 +13,11 @@ for (const downstream of [ALPN_06, ALPN_07_WIP]) {
 		const installed = clock.install();
 		const source = new Producer();
 		const destination = new Producer();
-		const broadcastPublication = source.createBroadcast(Path.from("compressed"));
-		const broadcast = broadcastPublication.broadcast;
+		const broadcastRoute = source.route(Path.from("compressed"), { hidden: true });
+		const broadcast = broadcastRoute.broadcast;
 		const datagrams = broadcast.createDatagrams("data");
 		const track = broadcast.createTrack("data", { compress: true });
-		broadcastPublication.announce();
+		broadcastRoute.announce();
 		const peers: { abort(): void }[] = [];
 		async function link(publish: Producer, consume: Producer, alpn: string) {
 			const pair = createMockTransportPair(alpn);
diff --git a/js/net/src/lite/connection.test.ts b/js/net/src/lite/connection.test.ts
index 48690d2f88c..a59006e6042 100644
--- a/js/net/src/lite/connection.test.ts
+++ b/js/net/src/lite/connection.test.ts
@@ -309,9 +309,8 @@ for (const [alpn, version] of [
 		const pair = createMockTransportPair(alpn);
 		const fin = holdFins(pair.server, "uni");
 		const origin = new Producer();
-		const broadcastPublication = origin.createBroadcast(Path.from("room"));
-		const broadcast = broadcastPublication.broadcast;
-		broadcastPublication.announce();
+		const broadcastRoute = origin.route(Path.from("room"));
+		const broadcast = broadcastRoute.broadcast;
 		const producer = broadcast.createTrack("video", { timescale: Timescale.MILLI });
 		const url = new URL("https://localhost/test");
 		const client = new Connection({ url, quic: pair.client, version });
@@ -371,9 +370,8 @@ for (const [alpn, version] of [
 			deliverWhole(pair.client);
 			if (overtaken === "fin") finAfterClose(pair.client);
 			const origin = new Producer();
-			const broadcastPublication = origin.createBroadcast(Path.from("room"));
-			const broadcast = broadcastPublication.broadcast;
-			broadcastPublication.announce();
+			const broadcastRoute = origin.route(Path.from("room"));
+			const broadcast = broadcastRoute.broadcast;
 			const producer = broadcast.createTrack("video", { timescale: Timescale.MILLI });
 			const url = new URL("https://localhost/test");
 			const client = new Connection({ url, quic: pair.client, version });
@@ -423,9 +421,8 @@ for (const [alpn, version] of [
 			const pair = createMockTransportPair(alpn);
 			finAfterClose(pair.client);
 			const origin = new Producer();
-			const broadcastPublication = origin.createBroadcast(Path.from("room"));
-			const broadcast = broadcastPublication.broadcast;
-			broadcastPublication.announce();
+			const broadcastRoute = origin.route(Path.from("room"));
+			const broadcast = broadcastRoute.broadcast;
 			const producer = broadcast.createTrack("video", { timescale: Timescale.MILLI });
 			const url = new URL("https://localhost/test");
 			const client = new Connection({ url, quic: pair.client, version });
@@ -468,9 +465,8 @@ for (const [alpn, version] of [
 		test(`a peer close finishes a FIN'd track over qmux ${versionName(version)}`, async () => {
 			const pair = qmuxPair();
 			const origin = new Producer();
-			const broadcastPublication = origin.createBroadcast(Path.from("room"));
-			const broadcast = broadcastPublication.broadcast;
-			broadcastPublication.announce();
+			const broadcastRoute = origin.route(Path.from("room"));
+			const broadcast = broadcastRoute.broadcast;
 			const producer = broadcast.createTrack("video", { timescale: Timescale.MILLI });
 			const url = new URL("https://localhost/test");
 			const client = new Connection({ url, quic: pair.client, version });
@@ -509,9 +505,8 @@ for (const [alpn, version] of [
 async function servedRawSubscription(alpn: string = ALPN_07_WIP, version: Version = Version.DRAFT_07) {
 	const pair = createMockTransportPair(alpn);
 	const origin = new Producer();
-	const broadcastPublication = origin.createBroadcast(Path.from("room"));
-	const broadcast = broadcastPublication.broadcast;
-	broadcastPublication.announce();
+	const broadcastRoute = origin.route(Path.from("room"));
+	const broadcast = broadcastRoute.broadcast;
 	const producer = broadcast.createTrack("video", { timescale: Timescale.MILLI });
 	const server = new Connection({
 		url: new URL("https://relay.example/"),
@@ -628,9 +623,8 @@ test("close waits for a served FETCH to be acknowledged", async () => {
 	const pair = createMockTransportPair(ALPN_05);
 	const fin = holdFins(pair.server, "incoming-bidi");
 	const origin = new Producer();
-	const broadcastPublication = origin.createBroadcast(Path.from("room"));
-	const broadcast = broadcastPublication.broadcast;
-	broadcastPublication.announce();
+	const broadcastRoute = origin.route(Path.from("room"));
+	const broadcast = broadcastRoute.broadcast;
 	const producer = broadcast.createTrack("video", { timescale: Timescale.MILLI });
 	const group = producer.appendGroup();
 	group.writeFrame(textFrame("last"));
@@ -681,9 +675,8 @@ test("close waits for a request served while withdrawals are in flight", async (
 	const fin = holdFins(pair.server, "incoming-bidi");
 	const source = new Producer();
 	const destination = new Producer();
-	const broadcastPublication = source.createBroadcast(Path.from("room"));
-	const broadcast = broadcastPublication.broadcast;
-	broadcastPublication.announce();
+	const broadcastRoute = source.route(Path.from("room"));
+	const broadcast = broadcastRoute.broadcast;
 	const producer = broadcast.createTrack("video", { timescale: Timescale.MILLI });
 	const group = producer.appendGroup();
 	group.writeFrame(textFrame("last"));
diff --git a/js/net/src/lite/copy_fill.test.ts b/js/net/src/lite/copy_fill.test.ts
index 68bf496cd99..48f282ee605 100644
--- a/js/net/src/lite/copy_fill.test.ts
+++ b/js/net/src/lite/copy_fill.test.ts
@@ -28,8 +28,7 @@ async function peers(alpn: string) {
 		connectSession({ url, transport: pair.client }),
 		acceptSession({ transport: pair.server, url, publish: origin.consume() }),
 	]);
-	const publication = origin.createBroadcast(Path.from("room"));
-	publication.announce();
+	const publication = origin.route(Path.from("room"));
 	const broadcast = publication.broadcast;
 	const track = broadcast.createTrack("video", { timescale: Timescale.MILLI, maxAge: null });
 	const requests = track.requests();
@@ -238,8 +237,7 @@ test("copy fill: a filled group stops downloading once every reader left or pass
 		connectSession({ url, transport: pair.client }),
 		acceptSession({ transport: pair.server, url, publish: origin.consume() }),
 	]);
-	const publication = origin.createBroadcast(Path.from("room"));
-	publication.announce();
+	const publication = origin.route(Path.from("room"));
 	const track = publication.broadcast.createTrack("video", { timescale: Timescale.MILLI, maxAge: null });
 	write(track.createGroup(1n), 1n, "live");
 	// The archive answers group 0 with one frame and keeps it open.
@@ -304,8 +302,7 @@ test("copy fill: a filled group nobody holds any more stops downloading", async
 		connectSession({ url, transport: pair.client }),
 		acceptSession({ transport: pair.server, url, publish: origin.consume() }),
 	]);
-	const publication = origin.createBroadcast(Path.from("room"));
-	publication.announce();
+	const publication = origin.route(Path.from("room"));
 	const track = publication.broadcast.createTrack("video", { timescale: Timescale.MILLI, maxAge: null });
 	write(track.createGroup(1n), 1n, "live");
 	// The archive answers group 0 with one frame and never finishes it.
diff --git a/js/net/src/lite/datagram-tracks.test.ts b/js/net/src/lite/datagram-tracks.test.ts
index c5138d7c0f3..88d167a49fa 100644
--- a/js/net/src/lite/datagram-tracks.test.ts
+++ b/js/net/src/lite/datagram-tracks.test.ts
@@ -15,7 +15,7 @@ for (const alpn of [ALPN_05, ALPN_06, ALPN_07_WIP]) {
 	for (const streams of [false, true]) {
 		test(`${alpn}: ${streams ? "same-name kinds" : "datagram-only track"} delivery`, async () => {
 			const source = new Origin();
-			const publication = source.createBroadcast(path);
+			const publication = source.route(path, { hidden: true });
 			const datagrams = publication.broadcast.createDatagrams("audio", {
 				timescale: Timescale.MICRO,
 				priority: -7,
@@ -104,7 +104,7 @@ test("lite-04 refuses datagram tracks at setup", async () => {
 
 test("lite-07 bounds and prioritizes independent createWritable datagram queues", async () => {
 	const source = new Origin();
-	const publication = source.createBroadcast(path);
+	const publication = source.route(path, { hidden: true });
 	const datagrams = publication.broadcast.createDatagrams("audio");
 	publication.broadcast.createTrack("audio", { compress: true });
 	publication.announce();
@@ -155,7 +155,7 @@ for (const alpn of [ALPN_05, ALPN_06])
 	for (const first of ["stream", "datagram"]) {
 		test(`${alpn}: datagram readers rejoin and outlive streams (${first} first)`, async () => {
 			const source = new Origin();
-			const publication = source.createBroadcast(path);
+			const publication = source.route(path, { hidden: true });
 			const datagrams = publication.broadcast.createDatagrams("audio");
 			const track = publication.broadcast.createTrack("audio");
 			publication.announce();
@@ -200,7 +200,7 @@ for (const alpn of [ALPN_05, ALPN_06])
 
 test("lite-07 forwards a priority change made while the previous DATAGRAMS_UPDATE writes", async () => {
 	const source = new Origin();
-	const publication = source.createBroadcast(path);
+	const publication = source.route(path, { hidden: true });
 	const datagrams = publication.broadcast.createDatagrams("audio");
 	publication.announce();
 	const pair = createMockTransportPair(ALPN_07_WIP);
@@ -231,7 +231,7 @@ test("lite-07 forwards a priority change made while the previous DATAGRAMS_UPDAT
 
 test("lite-06: a request cancelled behind the shared datagram writer sends nothing", async () => {
 	const source = new Origin();
-	const publication = source.createBroadcast(path);
+	const publication = source.route(path, { hidden: true });
 	const first = publication.broadcast.createDatagrams("a");
 	const second = publication.broadcast.createDatagrams("b");
 	publication.announce();
diff --git a/js/net/src/lite/publisher.test.ts b/js/net/src/lite/publisher.test.ts
index f2aa0d241e9..eae0748cf2f 100644
--- a/js/net/src/lite/publisher.test.ts
+++ b/js/net/src/lite/publisher.test.ts
@@ -32,9 +32,8 @@ import { Track as TrackMessage } from "./track.ts";
 import { ALPN_05, ALPN_06, ALPN_07_WIP, hasRanges, keepsSubscribeOpen, Version } from "./version.ts";
 
 function publish(origin: OriginProducer, path: Path.Valid) {
-	const broadcastPublication = origin.createBroadcast(path);
-	const broadcast = broadcastPublication.broadcast;
-	broadcastPublication.announce();
+	const broadcastRoute = origin.route(path);
+	const broadcast = broadcastRoute.broadcast;
 	return broadcast;
 }
 
@@ -116,9 +115,8 @@ test.each([
 	const pair = createMockTransportPair(ALPN_05);
 	const origin = new OriginProducer();
 	const publisher = new Publisher(pair.server, version, randomHop(), origin.consume());
-	const broadcastPublication = origin.createBroadcast(Path.from("cam"));
-	const broadcast = broadcastPublication.broadcast;
-	broadcastPublication.announce({ cost: 7n });
+	const broadcastRoute = origin.route(Path.from("cam"), { cost: 7n });
+	const broadcast = broadcastRoute.broadcast;
 
 	const written: Uint8Array[] = [];
 	const stream = new Stream({
@@ -136,7 +134,7 @@ test.each([
 	const initial = written.length;
 	expect(initial).toBeGreaterThan(0);
 
-	broadcastPublication.announce({ cost: 9n });
+	broadcastRoute.setCost(9n);
 	await settle();
 	expect(written.length > initial).toBe(sent);
 
@@ -734,7 +732,7 @@ async function servedSubscription(
 		broadcast = new BroadcastProducer();
 		const front = new Front();
 		front.serve(broadcast.consume());
-		const dynamic = origin.requestsRoute(Path.from("test"));
+		const dynamic = origin.routePrefix(Path.from("test"));
 		void (async () => {
 			for await (const request of dynamic.requested()) request.serve(front.consumer);
 		})();
@@ -2831,9 +2829,8 @@ test("lite draft-06: announces wait for the setup grant", async () => {
 		answered = resolve;
 	});
 	const publisher = new Publisher(pair.server, Version.DRAFT_06, randomHop(), origin.consume(), { grant, ready });
-	const broadcastPublication = origin.createBroadcast(Path.from("foo/bar"));
-	const broadcast = broadcastPublication.broadcast;
-	broadcastPublication.announce();
+	const broadcastRoute = origin.route(Path.from("foo/bar"));
+	const broadcast = broadcastRoute.broadcast;
 
 	const written: Uint8Array[] = [];
 	const stream = new Stream({
@@ -2909,7 +2906,7 @@ test("lite draft-06: closing while announces wait for the setup grant does not h
 test("lite draft-06: a grant that shrinks while a TRACK resolves refuses it", async () => {
 	const pair = createMockTransportPair(ALPN_06);
 	const origin = new OriginProducer();
-	const handle = origin.requestsRoute(Path.from("live"));
+	const handle = origin.routePrefix(Path.from("live"));
 	const requests = handle.requested();
 	const grant = new Signal<Grant | undefined>(grantOf("live"));
 	const publisher = new Publisher(pair.server, Version.DRAFT_06, randomHop(), origin.consume(), {
@@ -2950,7 +2947,7 @@ test("lite draft-06: a grant that shrinks while a TRACK resolves refuses it", as
 test("lite draft-06: a grant that shrinks while TRACK_INFO is blocked resets it", async () => {
 	const pair = createMockTransportPair(ALPN_06);
 	const origin = new OriginProducer();
-	const handle = origin.requestsRoute(Path.from("live"));
+	const handle = origin.routePrefix(Path.from("live"));
 	const requests = handle.requested();
 	const grant = new Signal<Grant | undefined>(grantOf("live"));
 	const publisher = new Publisher(pair.server, Version.DRAFT_06, randomHop(), origin.consume(), {
@@ -3013,7 +3010,7 @@ test("lite draft-06: a grant that shrinks while TRACK_INFO is blocked resets it"
 test("lite draft-06: a grant that shrinks while the broadcast resolves resets the subscription", async () => {
 	const pair = createMockTransportPair(ALPN_06);
 	const origin = new OriginProducer();
-	const handle = origin.requestsRoute(Path.from("live"));
+	const handle = origin.routePrefix(Path.from("live"));
 	const requests = handle.requested();
 	const grant = new Signal<Grant | undefined>(grantOf("live"));
 	const publisher = new Publisher(pair.server, Version.DRAFT_06, randomHop(), origin.consume(), {
diff --git a/js/net/src/lite/publisher.ts b/js/net/src/lite/publisher.ts
index 8210e0b0115..4e75c4430c3 100644
--- a/js/net/src/lite/publisher.ts
+++ b/js/net/src/lite/publisher.ts
@@ -19,7 +19,7 @@ import {
 	unauthorized,
 } from "../error.ts";
 import type * as group from "../group.ts";
-import { Cost, type Hop, type Route, routesEqual } from "../hop.ts";
+import { Cost, type Hop, type RouteInfo, routesEqual } from "../hop.ts";
 import { finalSequence, hiddenBelow, hooks, insertRun, presented, type Run, runGaps } from "../internal.ts";
 import type { Consumer as OriginConsumer } from "../origin.ts";
 import * as Path from "../path.ts";
@@ -601,15 +601,15 @@ export class Publisher {
 		let nextAnnounceId = 0n;
 		const announceIds = new Map<Path.Valid, bigint>();
 
-		const wireHops = (route: Route): Hop[] => {
-			if (hasAnnounceOk(this.version)) return route.hops;
+		const wireHops = (route: RouteInfo): Hop[] => {
+			if (hasAnnounceOk(this.version)) return [...route.hops];
 			return [...route.hops, this.hop];
 		};
 
 		// What the peer decodes for a route: pre-lite-06 wires carry no cost, so a re-price
 		// there must not restart.
 		// moq-lite carries no per-request auth, so a swap alone sends nothing.
-		const onWire = (route: Route): Route => ({
+		const onWire = (route: RouteInfo): RouteInfo => ({
 			...route,
 			cost: hasRouteCost(this.version) ? route.cost : Cost.zero,
 			auth: undefined,
@@ -621,7 +621,7 @@ export class Publisher {
 			!sameInstance(prev, next) ||
 			(hasInstance(this.version) && (prev.route.epoch ?? 0n) !== (next.route.epoch ?? 0n));
 
-		const announce = async (suffix: Path.Valid, route: Route) => {
+		const announce = async (suffix: Path.Valid, route: RouteInfo) => {
 			console.debug(`announce: broadcast=${suffix} active=true instance=${route.instance}`);
 			if (hasAnnounceId(this.version)) announceIds.set(suffix, nextAnnounceId++);
 			await encodeAnnounceBroadcast(
@@ -638,7 +638,7 @@ export class Publisher {
 			);
 		};
 
-		const update = async (suffix: Path.Valid, route: Route) => {
+		const update = async (suffix: Path.Valid, route: RouteInfo) => {
 			if (!hasAnnounceId(this.version)) {
 				await retract(suffix);
 				await announce(suffix, route);
@@ -658,7 +658,7 @@ export class Publisher {
 		};
 
 		// Another instance or epoch: ANNOUNCE_RESTART on lite-07, an end and a start before it.
-		const restart = async (suffix: Path.Valid, route: Route) => {
+		const restart = async (suffix: Path.Valid, route: RouteInfo) => {
 			const id = announceIds.get(suffix);
 			if (id === undefined || !hasAnnounceRestart(this.version)) {
 				await retract(suffix);
diff --git a/js/net/src/lite/refresh.test.ts b/js/net/src/lite/refresh.test.ts
index 90e2ad341a0..15378a82123 100644
--- a/js/net/src/lite/refresh.test.ts
+++ b/js/net/src/lite/refresh.test.ts
@@ -13,9 +13,8 @@ test.each([ALPN_06, ALPN_07_WIP])("refresh joins reach a browser publisher on %s
 	const installed = clock.install();
 	const source = new Producer();
 	const b = new Producer();
-	const broadcastPublication = source.createBroadcast(Path.from("room"));
-	const broadcast = broadcastPublication.broadcast;
-	broadcastPublication.announce();
+	const broadcastRoute = source.route(Path.from("room"));
+	const broadcast = broadcastRoute.broadcast;
 	const producer = broadcast.createTrack("data", { refresh: 1 });
 	const pair = createMockTransportPair(alpn);
 	const url = new URL("https://localhost/refresh");
diff --git a/js/net/src/lite/subscriber.test.ts b/js/net/src/lite/subscriber.test.ts
index a9004ee48f2..b31106e1ae7 100644
--- a/js/net/src/lite/subscriber.test.ts
+++ b/js/net/src/lite/subscriber.test.ts
@@ -17,7 +17,7 @@ import {
 	TimestampMismatch,
 } from "../error.ts";
 import type { Consumer as GroupConsumer } from "../group.ts";
-import { HopSchema, isAnonymous, MAX_HOPS, Route, UNKNOWN_HOP } from "../hop.ts";
+import { HopSchema, isAnonymous, MAX_HOPS, RouteInfo, UNKNOWN_HOP } from "../hop.ts";
 import * as Instance from "../instance.ts";
 import { hooks } from "../internal.ts";
 import { GRACE } from "../ledger.ts";
@@ -201,8 +201,8 @@ test("an announce consumer closed while its stream opens sends nothing on it", a
 });
 
 test("a local empty hop chain is not anonymous", () => {
-	expect(isAnonymous(Route.default)).toBe(false);
-	expect(isAnonymous({ hops: [UNKNOWN_HOP], cost: Route.default.cost })).toBe(true);
+	expect(isAnonymous(RouteInfo.default)).toBe(false);
+	expect(isAnonymous({ hops: [UNKNOWN_HOP], cost: RouteInfo.default.cost })).toBe(true);
 });
 
 test("a max-length chain plus withheld responder is dropped", async () => {
diff --git a/js/net/src/lite/subscriber.ts b/js/net/src/lite/subscriber.ts
index 7c6fb03d36c..afdd4067d43 100644
--- a/js/net/src/lite/subscriber.ts
+++ b/js/net/src/lite/subscriber.ts
@@ -21,7 +21,7 @@ import {
 	unauthorized,
 } from "../error.ts";
 import * as netGroup from "../group.ts";
-import { Cost, type Hop, MAX_HOPS, type Route, routesEqual, UNKNOWN_HOP } from "../hop.ts";
+import { Cost, type Hop, MAX_HOPS, type RouteInfo, routesEqual, UNKNOWN_HOP } from "../hop.ts";
 import * as Instance from "../instance.ts";
 import { hiddenBelow, hooks, maxDelayOf, minDelayOf, scopeCaptures, scopeHead, scopeOverlaps } from "../internal.ts";
 import type { Lister } from "../listing.ts";
@@ -409,7 +409,7 @@ export class Subscriber {
 		// retract that one's state.
 		type Advertisement = {
 			live: boolean;
-			route: Route;
+			route: RouteInfo;
 			captures: Path.Pattern[] | undefined;
 		};
 		// Each holds one of the session's announce slots, reflected and hidden ones included.
@@ -721,7 +721,7 @@ export class Subscriber {
 					});
 					continue;
 				}
-				const route: Route = { instance, epoch, hops: fullHops, cost: this.#cost(cost) };
+				const route: RouteInfo = { instance, epoch, hops: fullHops, cost: this.#cost(cost) };
 				const captures = scopeCaptures(scope, path);
 				if (!visible(path)) {
 					advertised.set(path, { live: false, route, captures });
diff --git a/js/net/src/lite/track_stream.test.ts b/js/net/src/lite/track_stream.test.ts
index cb396508eb3..3ef3a0341f4 100644
--- a/js/net/src/lite/track_stream.test.ts
+++ b/js/net/src/lite/track_stream.test.ts
@@ -117,9 +117,8 @@ describe.each([Version.DRAFT_05, Version.DRAFT_06, Version.DRAFT_07])("%s", (ver
 			const pair = createMockTransportPair(ALPN_05);
 			const origin = new OriginProducer();
 			const publisher = new Publisher(pair.server, version, randomHop(), origin.consume());
-			const broadcastPublication = origin.createBroadcast(Path.from("room"));
-			const broadcast = broadcastPublication.broadcast;
-			broadcastPublication.announce();
+			const broadcastRoute = origin.route(Path.from("room"));
+			const broadcast = broadcastRoute.broadcast;
 			let producer: TrackProducer | undefined;
 			const serving = (async () => {
 				for (;;) {
@@ -155,9 +154,8 @@ describe.each([Version.DRAFT_05, Version.DRAFT_06, Version.DRAFT_07])("%s", (ver
 		const closing = spyOn(pair.server, "close");
 		const origin = new OriginProducer();
 		const publisher = new Publisher(pair.server, version, randomHop(), origin.consume());
-		const broadcastPublication = origin.createBroadcast(Path.from("room"));
-		const broadcast = broadcastPublication.broadcast;
-		broadcastPublication.announce();
+		const broadcastRoute = origin.route(Path.from("room"));
+		const broadcast = broadcastRoute.broadcast;
 
 		const client = await Stream.open(pair.client, { version });
 		const server = await Stream.accept(pair.server, version);
@@ -179,9 +177,8 @@ describe.each([Version.DRAFT_05, Version.DRAFT_06, Version.DRAFT_07])("%s", (ver
 			const pair = createMockTransportPair(ALPN_05);
 			const origin = new OriginProducer();
 			const publisher = new Publisher(pair.server, version, randomHop(), origin.consume());
-			const broadcastPublication = origin.createBroadcast(Path.from("room"));
-			const broadcast = broadcastPublication.broadcast;
-			broadcastPublication.announce();
+			const broadcastRoute = origin.route(Path.from("room"));
+			const broadcast = broadcastRoute.broadcast;
 			let producer: TrackProducer | undefined;
 			const serving = (async () => {
 				for (;;) {
@@ -227,9 +224,8 @@ describe.each([Version.DRAFT_05, Version.DRAFT_06, Version.DRAFT_07])("%s", (ver
 		const pair = createMockTransportPair(ALPN_05);
 		const origin = new OriginProducer();
 		const publisher = new Publisher(pair.server, version, randomHop(), origin.consume());
-		const broadcastPublication = origin.createBroadcast(Path.from("room"));
-		const broadcast = broadcastPublication.broadcast;
-		broadcastPublication.announce();
+		const broadcastRoute = origin.route(Path.from("room"));
+		const broadcast = broadcastRoute.broadcast;
 		const producers: TrackProducer[] = [];
 		const serving = (async () => {
 			for (;;) {
@@ -269,9 +265,8 @@ describe.each([Version.DRAFT_05, Version.DRAFT_06, Version.DRAFT_07])("%s", (ver
 		const pair = createMockTransportPair(ALPN_05);
 		const origin = new OriginProducer();
 		const publisher = new Publisher(pair.server, version, randomHop(), origin.consume());
-		const broadcastPublication = origin.createBroadcast(Path.from("room"));
-		const broadcast = broadcastPublication.broadcast;
-		broadcastPublication.announce();
+		const broadcastRoute = origin.route(Path.from("room"));
+		const broadcast = broadcastRoute.broadcast;
 		const producers: TrackProducer[] = [];
 		const serving = (async () => {
 			for (;;) {
@@ -328,9 +323,8 @@ describe.each([Version.DRAFT_05, Version.DRAFT_06, Version.DRAFT_07])("%s", (ver
 			const pair = createMockTransportPair(ALPN_05);
 			const origin = new OriginProducer();
 			const publisher = new Publisher(pair.server, version, randomHop(), origin.consume());
-			const broadcastPublication = origin.createBroadcast(Path.from("room"));
-			const broadcast = broadcastPublication.broadcast;
-			broadcastPublication.announce();
+			const broadcastRoute = origin.route(Path.from("room"));
+			const broadcast = broadcastRoute.broadcast;
 			// Answered by hand, once every requester has left.
 			const requested = wireOf(broadcast).requested();
 
@@ -356,9 +350,8 @@ describe.each([Version.DRAFT_05, Version.DRAFT_06, Version.DRAFT_07])("%s", (ver
 		const pair = createMockTransportPair(ALPN_05);
 		const origin = new OriginProducer();
 		const publisher = new Publisher(pair.server, version, randomHop(), origin.consume());
-		const broadcastPublication = origin.createBroadcast(Path.from("room"));
-		const broadcast = broadcastPublication.broadcast;
-		broadcastPublication.announce();
+		const broadcastRoute = origin.route(Path.from("room"));
+		const broadcast = broadcastRoute.broadcast;
 		const requested = wireOf(broadcast).requested();
 
 		await requester(pair, publisher, kind);
@@ -379,9 +372,8 @@ describe.each([Version.DRAFT_05, Version.DRAFT_06, Version.DRAFT_07])("%s", (ver
 		const pair = createMockTransportPair(ALPN_05);
 		const origin = new OriginProducer();
 		const publisher = new Publisher(pair.server, version, randomHop(), origin.consume());
-		const broadcastPublication = origin.createBroadcast(Path.from("room"));
-		const broadcast = broadcastPublication.broadcast;
-		broadcastPublication.announce();
+		const broadcastRoute = origin.route(Path.from("room"));
+		const broadcast = broadcastRoute.broadcast;
 		// Answered by hand, after the first TRACK stream has left.
 		const requested = wireOf(broadcast).requested();
 
@@ -410,9 +402,8 @@ describe.each([Version.DRAFT_05, Version.DRAFT_06, Version.DRAFT_07])("%s", (ver
 		const pair = createMockTransportPair(ALPN_05);
 		const origin = new OriginProducer();
 		const publisher = new Publisher(pair.server, version, randomHop(), origin.consume());
-		const broadcastPublication = origin.createBroadcast(Path.from("room"));
-		const broadcast = broadcastPublication.broadcast;
-		broadcastPublication.announce();
+		const broadcastRoute = origin.route(Path.from("room"));
+		const broadcast = broadcastRoute.broadcast;
 		const serving = (async () => {
 			for (;;) {
 				const request = await wireOf(broadcast).requested();
diff --git a/js/net/src/lite/tracks.test.ts b/js/net/src/lite/tracks.test.ts
index 346abbbe2f7..cd3beebc5ab 100644
--- a/js/net/src/lite/tracks.test.ts
+++ b/js/net/src/lite/tracks.test.ts
@@ -350,9 +350,8 @@ function publisher(origin: OriginProducer) {
 
 test("data after a TRACKS request closes the session", async () => {
 	const origin = new OriginProducer();
-	const broadcastPublication = origin.createBroadcast(Path.from("room"));
-	const broadcast = broadcastPublication.broadcast;
-	broadcastPublication.announce();
+	const broadcastRoute = origin.route(Path.from("room"));
+	const broadcast = broadcastRoute.broadcast;
 	broadcast.createTrack("a");
 	const { list, closing } = publisher(origin);
 	const listing = await list("room");
@@ -366,9 +365,8 @@ test("data after a TRACKS request closes the session", async () => {
 
 test("a publisher lists its broadcast's own tracks, never one served on request", async () => {
 	const origin = new OriginProducer();
-	const broadcastPublication = origin.createBroadcast(Path.from("room"));
-	const broadcast = broadcastPublication.broadcast;
-	broadcastPublication.announce();
+	const broadcastRoute = origin.route(Path.from("room"));
+	const broadcast = broadcastRoute.broadcast;
 	broadcast.createTrack("a", { priority: 5 });
 	// Served on request: answered when asked, never listed.
 	void wireOf(broadcast)
@@ -389,9 +387,8 @@ test("a publisher lists its broadcast's own tracks, never one served on request"
 
 test("a newer listing of a broadcast on one session replaces the older", async () => {
 	const origin = new OriginProducer();
-	const broadcastPublication = origin.createBroadcast(Path.from("room"));
-	const broadcast = broadcastPublication.broadcast;
-	broadcastPublication.announce();
+	const broadcastRoute = origin.route(Path.from("room"));
+	const broadcast = broadcastRoute.broadcast;
 	broadcast.createTrack("a");
 	const { list } = publisher(origin);
 	const older = await list("room");
@@ -408,7 +405,7 @@ test("a newer listing of a broadcast on one session replaces the older", async (
 
 test("a path served through a covering prefix route is NOT_FOUND", async () => {
 	const origin = new OriginProducer();
-	const dynamic = origin.requestsRoute(Path.from("room"));
+	const dynamic = origin.routePrefix(Path.from("room"));
 	void (async () => {
 		for await (const request of dynamic.requested()) {
 			const served = new BroadcastProducer();
@@ -425,7 +422,7 @@ test("a path served through a covering prefix route is NOT_FOUND", async () => {
 test("a local read through a covering prefix route is NOT_FOUND, and through its exact route lists", async () => {
 	const origin = new OriginProducer();
 	for (const prefix of ["room", "room/bob"]) {
-		const dynamic = origin.requestsRoute(Path.from(prefix));
+		const dynamic = origin.routePrefix(Path.from(prefix));
 		void (async () => {
 			for await (const request of dynamic.requested()) {
 				const served = new BroadcastProducer();
@@ -461,9 +458,8 @@ test("a listing over a session carries each track's info, end to end", async ()
 		connect({ url, transport: pair.client }),
 		accept({ transport: pair.server, url, publish: origin.consume() }),
 	]);
-	const broadcastPublication = origin.createBroadcast(Path.from("room"));
-	const broadcast = broadcastPublication.broadcast;
-	broadcastPublication.announce();
+	const broadcastRoute = origin.route(Path.from("room"));
+	const broadcast = broadcastRoute.broadcast;
 	broadcast.createTrack("a", {
 		timescale: Timescale.MILLI,
 		maxAge: Milli(3000),
@@ -497,10 +493,13 @@ test("an instance-pinned front lists its serving route's tracks", async () => {
 		connect({ url, transport: pair.client, consume: clientOrigin }),
 		accept({ transport: pair.server, url, publish: serverOrigin.consume() }),
 	]);
-	const broadcastPublication = serverOrigin.createBroadcast(Path.from("room"));
-	const broadcast = broadcastPublication.broadcast;
+	const broadcastRoute = serverOrigin.route(Path.from("room"), {
+		hidden: true,
+		instance: Instance.parse("01900000-0000-7000-8000-000000000001"),
+	});
+	const broadcast = broadcastRoute.broadcast;
 	broadcast.createTrack("a");
-	broadcastPublication.announce({ instance: Instance.parse("01900000-0000-7000-8000-000000000001") });
+	broadcastRoute.announce();
 
 	const reader = clientOrigin.consume();
 	const announced = reader.routes();
@@ -525,7 +524,7 @@ test("an instance-pinned front lists its serving route's tracks", async () => {
 
 test("a front pinned to a named instance served through a covering prefix route is NOT_FOUND", async () => {
 	const origin = new OriginProducer();
-	const dynamic = origin.requestsRoute(Path.from("room"), { instance: Instance.parse("named") });
+	const dynamic = origin.routePrefix(Path.from("room"), { instance: Instance.parse("named") });
 	void (async () => {
 		for await (const request of dynamic.requested()) {
 			const served = new BroadcastProducer();
@@ -551,9 +550,8 @@ test("lite-06 cannot list over a session", async () => {
 		connect({ url, transport: pair.client }),
 		accept({ transport: pair.server, url, publish: origin.consume() }),
 	]);
-	const broadcastPublication = origin.createBroadcast(Path.from("room"));
-	const broadcast = broadcastPublication.broadcast;
-	broadcastPublication.announce();
+	const broadcastRoute = origin.route(Path.from("room"));
+	const broadcast = broadcastRoute.broadcast;
 	const tracks = wireOf(client).consume(Path.from("room")).tracks();
 	expect(await next(tracks)).toMatch(/requires moq-lite-07/);
 	broadcast.close();
diff --git a/js/net/src/lite/widened_max_age.test.ts b/js/net/src/lite/widened_max_age.test.ts
index 6bc779b4cb9..9ef760cfb96 100644
--- a/js/net/src/lite/widened_max_age.test.ts
+++ b/js/net/src/lite/widened_max_age.test.ts
@@ -28,8 +28,7 @@ async function received(reader: TrackSubscriber, count: number): Promise<bigint[
 test("a widened maxDelay re-offers what the publisher skipped below the start", async () => {
 	const pair = createMockTransportPair(ALPN_07_WIP);
 	const origin = new OriginProducer();
-	const publication = origin.createBroadcast(Path.from("room"));
-	publication.announce();
+	const publication = origin.route(Path.from("room"));
 	const broadcast = publication.broadcast;
 	const producer = broadcast.createTrack("video", { timescale: Timescale.MILLI, maxAge: null });
 	// One group per second, so a budget picks how far back a reader reaches.
diff --git a/js/net/src/order.test.ts b/js/net/src/order.test.ts
index f78d2df0efa..4ddba1863dc 100644
--- a/js/net/src/order.test.ts
+++ b/js/net/src/order.test.ts
@@ -139,9 +139,8 @@ async function backlog(protocol: string, order: Order, update?: Order) {
 	const origin = new OriginProducer();
 	const { client, server, transport } = await session(protocol, origin);
 
-	const broadcastPublication = origin.createBroadcast(Path.from("test"));
-	const broadcast = broadcastPublication.broadcast;
-	broadcastPublication.announce();
+	const broadcastRoute = origin.route(Path.from("test"));
+	const broadcast = broadcastRoute.broadcast;
 	const video = broadcast.createTrack("video", { timescale: Timescale.MILLI, maxAge: null });
 	const groups = [0, 1, 2].map(() => writeGroup(video));
 
@@ -193,9 +192,8 @@ test.each(["ascending", "descending"] as const)("ietf serves GROUP_ORDER %s", as
 	const origin = new OriginProducer();
 	const { client, server, transport } = await session(Ietf.ALPN.DRAFT_18, origin);
 
-	const broadcastPublication = origin.createBroadcast(Path.from("test"));
-	const broadcast = broadcastPublication.broadcast;
-	broadcastPublication.announce();
+	const broadcastRoute = origin.route(Path.from("test"));
+	const broadcast = broadcastRoute.broadcast;
 	const video = broadcast.createTrack("video", { timescale: Timescale.MILLI, maxAge: null });
 
 	const remote = wireOf(client).consume(Path.from("test"));
@@ -261,9 +259,8 @@ test("ietf keeps a closing group stream ranked until it settles", async () => {
 	const { client, server, transport } = await session(Ietf.ALPN.DRAFT_18, origin);
 	const fins = holdFins(transport);
 
-	const broadcastPublication = origin.createBroadcast(Path.from("test"));
-	const broadcast = broadcastPublication.broadcast;
-	broadcastPublication.announce();
+	const broadcastRoute = origin.route(Path.from("test"));
+	const broadcast = broadcastRoute.broadcast;
 	const video = broadcast.createTrack("video", { timescale: Timescale.MILLI, maxAge: null });
 
 	const remote = wireOf(client).consume(Path.from("test"));
@@ -302,9 +299,8 @@ test("a shared track aggregates descending and serves each subscriber in its own
 		session(Lite.ALPN_07_WIP, origin),
 	]);
 
-	const broadcastPublication = origin.createBroadcast(Path.from("test"));
-	const broadcast = broadcastPublication.broadcast;
-	broadcastPublication.announce();
+	const broadcastRoute = origin.route(Path.from("test"));
+	const broadcast = broadcastRoute.broadcast;
 	const video = broadcast.createTrack("video", { timescale: Timescale.MILLI, maxAge: null });
 
 	const ascendingRemote = wireOf(ascending.client).consume(Path.from("test"));
diff --git a/js/net/src/origin-demand.test.ts b/js/net/src/origin-demand.test.ts
index 018a10d7679..a3511747e5d 100644
--- a/js/net/src/origin-demand.test.ts
+++ b/js/net/src/origin-demand.test.ts
@@ -27,7 +27,7 @@ test.each(["lite", "ietf", "fetch", "track"] as const)(
 	async (kind) => {
 		const pair = createMockTransportPair();
 		const origin = new Producer();
-		const dynamic = origin.requestsRoute(Path.from("room"));
+		const dynamic = origin.routePrefix(Path.from("room"));
 		const publisher =
 			kind === "ietf"
 				? new IetfPublisher({
@@ -106,7 +106,7 @@ test.each(["lite", "ietf", "fetch", "track"] as const)(
 
 test("last cancellation finishes the internal wait and discards a late consumer", async () => {
 	const origin = new Producer();
-	const dynamic = origin.requestsRoute(Path.from("room"));
+	const dynamic = origin.routePrefix(Path.from("room"));
 	const requests = dynamic.requested();
 	const hold = new AbortController();
 	const wait = wireOf(origin.consume()).demand(path, undefined, hold.signal);
@@ -134,7 +134,7 @@ test("last cancellation finishes the internal wait and discards a late consumer"
 		expect(source.closed.peek()).toBeUndefined();
 		fresh.serve(source);
 		await settle();
-		expect(next.active.peek()?.instance).toBe(dynamic.route.instance);
+		expect(next.active.peek()?.instance).toBe(dynamic.instance);
 		next.close();
 		keeper.close();
 		source.close();
@@ -149,7 +149,7 @@ test.each([true, false])(
 	"shared local/remote demand is withdrawn whichever leaves last (local first: %s)",
 	async (localFirst) => {
 		const origin = new Producer();
-		const dynamic = origin.requestsRoute(Path.from("room"));
+		const dynamic = origin.routePrefix(Path.from("room"));
 		const requests = dynamic.requested();
 		const hold = new AbortController();
 		const wait = wireOf(origin.consume())
@@ -193,13 +193,13 @@ test.each([
 ] as const)("cancelling one waiter preserves a second %s requester across %i routes", async (other, routes) => {
 	const origin = new Producer();
 	const prefix = Path.from("room");
-	const dynamics = Array.from({ length: routes }, (_, i) => origin.requestsRoute(prefix, { cost: BigInt(i) }));
+	const dynamics = Array.from({ length: routes }, (_, i) => origin.routePrefix(prefix, { cost: BigInt(i) }));
 	const hold = new AbortController();
 	const wire = wireOf(origin.consume());
 	const first = wire.demand(path, undefined, hold.signal).catch(() => undefined);
 	// With competing routes, re-price the cancelled waiter's route so the survivor pends on another.
 	const cancelled = dynamics[0];
-	if (routes > 1) cancelled.updateRoute({ ...cancelled.route, cost: BigInt(routes) });
+	if (routes > 1) cancelled.setCost(BigInt(routes));
 	const requests = dynamics[routes > 1 ? 1 : 0].requested();
 	const second = other === "peer" ? wire.demand(path) : undefined;
 	const local = other === "local" ? origin.request(path) : undefined;
@@ -212,7 +212,7 @@ test.each([
 		request.serve(source);
 		await settle();
 		if (other === "peer") expect((await second)?.closed).toBe(source.closed);
-		else expect(local?.active.peek()?.instance).toBe(dynamics[routes > 1 ? 1 : 0].route.instance);
+		else expect(local?.active.peek()?.instance).toBe(dynamics[routes > 1 ? 1 : 0].instance);
 	} finally {
 		local?.close();
 		origin.close();
@@ -223,7 +223,7 @@ test.each([
 
 test("an already cancelled signal never enqueues or subscribes to abort", async () => {
 	const origin = new Producer();
-	const dynamic = origin.requestsRoute(Path.from("room"));
+	const dynamic = origin.routePrefix(Path.from("room"));
 	const requests = dynamic.requested();
 	const hold = new AbortController();
 	hold.abort();
@@ -245,7 +245,7 @@ test.each(["accept", "reject", "cancel"] as const)(
 	"%s releases the abort listener without closing a shared producer",
 	async (action) => {
 		const origin = new Producer();
-		const dynamic = origin.requestsRoute(Path.from("room"));
+		const dynamic = origin.routePrefix(Path.from("room"));
 		const requests = dynamic.requested();
 		const source = new Broadcast();
 		const keeper = source.consume();
@@ -281,12 +281,12 @@ test.each(["accept", "reject", "cancel"] as const)(
 
 test("a pending local request changing routes withdraws the old route's work", async () => {
 	const origin = new Producer();
-	const first = origin.requestsRoute(Path.from("room"), { cost: 5n });
+	const first = origin.routePrefix(Path.from("room"), { cost: 5n });
 	const a = first.requested();
 	const local = origin.request(path);
 	const old = (await a.next()).value;
 	if (!old) throw new Error("expected a pending request");
-	const second = origin.requestsRoute(Path.from("room"), { cost: 1n });
+	const second = origin.routePrefix(Path.from("room"), { cost: 1n });
 	const b = second.requested();
 	const fresh = (await b.next()).value;
 	if (!fresh) throw new Error("expected a pending request");
@@ -299,7 +299,7 @@ test("a pending local request changing routes withdraws the old route's work", a
 		expect(close).toHaveBeenCalledTimes(1);
 		fresh.serve(source);
 		await settle();
-		expect(local.active.peek()?.instance).toBe(second.route.instance);
+		expect(local.active.peek()?.instance).toBe(second.instance);
 	} finally {
 		close.mockRestore();
 		local.close();
@@ -314,7 +314,7 @@ test("a pending local request changing routes withdraws the old route's work", a
 test("cancelling an old instance waiter does not decrement a new instance's demand", async () => {
 	const origin = new Producer();
 	const instance = Instance.random();
-	const dynamic = origin.requestsRoute(Path.from("room"), { instance });
+	const dynamic = origin.routePrefix(Path.from("room"), { instance });
 	const requests = dynamic.requested();
 	const wire = wireOf(origin.consume());
 	const hold = new AbortController();
@@ -322,7 +322,7 @@ test("cancelling an old instance waiter does not decrement a new instance's dema
 	const old = (await requests.next()).value;
 	if (!old) throw new Error("expected old request");
 	const next = Instance.random();
-	dynamic.updateRoute({ instance: next });
+	wireOf(dynamic).update({ instance: next });
 	const after = wire.demand(path, next);
 	hold.abort();
 	await before;
@@ -346,8 +346,8 @@ test.each(["answer", "release"] as const)(
 		const origin = new Producer();
 		const instance = Instance.random();
 		const prefix = Path.from("room");
-		const a = origin.requestsRoute(prefix, { instance, cost: 1n });
-		const b = origin.requestsRoute(prefix, { instance, cost: 5n });
+		const a = origin.routePrefix(prefix, { instance, cost: 1n });
+		const b = origin.routePrefix(prefix, { instance, cost: 5n });
 		const ar = a.requested();
 		const br = b.requested();
 		const held = origin.request(path);
@@ -355,7 +355,7 @@ test.each(["answer", "release"] as const)(
 		(await ar.next()).value.serve(source);
 		await settle();
 		// Another instance wins new requests. The old handle stays on its own instance.
-		const c = origin.requestsRoute(prefix, { instance: Instance.random(), cost: 0n });
+		const c = origin.routePrefix(prefix, { instance: Instance.random(), cost: 0n });
 		a.close();
 		await settle();
 		const pending = (await br.next()).value;
@@ -407,8 +407,8 @@ test.each([0, 1])(
 			// Each instance undercuts the last, so it wins the path for the request made now.
 			const instance = Instance.parse(`instance-${i + 1}`);
 			const cost = BigInt(4 - 2 * i);
-			const primary = origin.requestsRoute(prefix, { instance, cost });
-			const standby = origin.requestsRoute(prefix, { instance, cost: cost + 1n });
+			const primary = origin.routePrefix(prefix, { instance, cost });
+			const standby = origin.routePrefix(prefix, { instance, cost: cost + 1n });
 			const ar = primary.requested();
 			const br = standby.requested();
 			const held = origin.request(path);
@@ -418,7 +418,7 @@ test.each([0, 1])(
 			await settle();
 			entries.push({ primary, ar, br, held });
 		}
-		origin.requestsRoute(prefix, { instance: Instance.parse("instance-3"), cost: 0n });
+		origin.routePrefix(prefix, { instance: Instance.parse("instance-3"), cost: 0n });
 		const pending = [];
 		for (const entry of entries) {
 			entry.primary.close();
@@ -459,7 +459,7 @@ test.each([0, 1])(
 test("a normal FETCH request FIN keeps unanswered origin demand alive", async () => {
 	const pair = createMockTransportPair();
 	const origin = new Producer();
-	const dynamic = origin.requestsRoute(Path.from("room"));
+	const dynamic = origin.routePrefix(Path.from("room"));
 	const requests = dynamic.requested();
 	const publisher = new LitePublisher(pair.server, LiteVersion.DRAFT_06, randomHop(), origin.consume());
 	let input!: ReadableStreamDefaultController<Uint8Array>;
@@ -500,7 +500,7 @@ test.each(["accept", "reject"] as const)(
 	"cancellation racing %s releases only the cancelled waiter",
 	async (answer) => {
 		const origin = new Producer();
-		const dynamic = origin.requestsRoute(Path.from("room"));
+		const dynamic = origin.routePrefix(Path.from("room"));
 		const requests = dynamic.requested();
 		const wire = wireOf(origin.consume());
 		const hold = new AbortController();
@@ -529,7 +529,7 @@ test.each(["accept", "reject"] as const)(
 
 test.each([true, false])("last waiter cancellation and accept in one turn (cancel first: %s)", async (cancelFirst) => {
 	const origin = new Producer();
-	const dynamic = origin.requestsRoute(Path.from("room"));
+	const dynamic = origin.routePrefix(Path.from("room"));
 	const requests = dynamic.requested();
 	const wire = wireOf(origin.consume());
 	const hold = new AbortController();
@@ -570,7 +570,7 @@ test.each([true, false])("last waiter cancellation and accept in one turn (cance
 
 test.each([true, false])("local demand survives same-turn cancellation only when rejoined: %s", async (rejoin) => {
 	const origin = new Producer();
-	const dynamic = origin.requestsRoute(Path.from("room"));
+	const dynamic = origin.routePrefix(Path.from("room"));
 	const requests = dynamic.requested();
 	const local = origin.request(path);
 	const hold = new AbortController();
@@ -592,7 +592,7 @@ test.each([true, false])("local demand survives same-turn cancellation only when
 		expect(close).toHaveBeenCalledTimes(rejoin ? 0 : 1);
 		if (replacement) {
 			await settle();
-			expect(replacement.active.peek()?.instance).toBe(dynamic.route.instance);
+			expect(replacement.active.peek()?.instance).toBe(dynamic.instance);
 		} else {
 			const fresh = origin.request(path);
 			const next = (await requests.next()).value;
@@ -600,7 +600,7 @@ test.each([true, false])("local demand survives same-turn cancellation only when
 			if (!next) throw new Error("expected fresh request");
 			next.serve(source);
 			await settle();
-			expect(fresh.active.peek()?.instance).toBe(dynamic.route.instance);
+			expect(fresh.active.peek()?.instance).toBe(dynamic.instance);
 			fresh.close();
 		}
 	} finally {
@@ -616,7 +616,7 @@ test.each([true, false])("local demand survives same-turn cancellation only when
 
 test("queued cancellation preserves order, replacement identity, and empty-queue wakeup", async () => {
 	const origin = new Producer();
-	const dynamic = origin.requestsRoute(Path.from("room"));
+	const dynamic = origin.routePrefix(Path.from("room"));
 	const requests = dynamic.requested();
 	const wire = wireOf(origin.consume());
 	const holds = Array.from({ length: 4 }, () => new AbortController());
@@ -642,7 +642,7 @@ test("queued cancellation preserves order, replacement identity, and empty-queue
 test("reset clears queued work while a handler is suspended and admits the new instance", async () => {
 	const origin = new Producer();
 	const instance = Instance.random();
-	const dynamic = origin.requestsRoute(Path.from("room"), { instance });
+	const dynamic = origin.routePrefix(Path.from("room"), { instance });
 	const requests = dynamic.requested();
 	const wire = wireOf(origin.consume());
 	const waits = [path, Path.from("room/obsolete")].map((name) => wire.demand(name, instance).catch(() => {}));
@@ -650,7 +650,7 @@ test("reset clears queued work while a handler is suspended and admits the new i
 		const old = (await requests.next()).value;
 		expect(old?.path).toBe(path);
 		const next = Instance.random();
-		dynamic.updateRoute({ instance: next });
+		wireOf(dynamic).update({ instance: next });
 		waits.push(wire.demand(path, next).catch(() => {}));
 		const fresh = (await requests.next()).value;
 		expect(fresh?.path).toBe(path);
@@ -666,7 +666,7 @@ test("reset clears queued work while a handler is suspended and admits the new i
 
 test("concurrent handlers consume queued requests once across empty batches", async () => {
 	const origin = new Producer();
-	const dynamic = origin.requestsRoute(Path.from("room"));
+	const dynamic = origin.routePrefix(Path.from("room"));
 	const handlers = [dynamic.requested(), dynamic.requested()];
 	const wire = wireOf(origin.consume());
 	const waits: Promise<unknown>[] = [];
diff --git a/js/net/src/origin-request.test.ts b/js/net/src/origin-request.test.ts
index 38074e798ee..aabf3d94108 100644
--- a/js/net/src/origin-request.test.ts
+++ b/js/net/src/origin-request.test.ts
@@ -1,9 +1,9 @@
 import { expect, test } from "bun:test";
 import { Producer as BroadcastProducer } from "./broadcast";
 import { StreamCode, StreamError } from "./error";
-import { Route } from "./hop";
+import { RouteInfo } from "./hop";
 import * as Instance from "./instance.ts";
-import { type Following, Producer, type Publication, type Requesting } from "./origin";
+import { type Following, Producer, type Requesting } from "./origin";
 import * as Path from "./path";
 import { wireOf } from "./wire";
 
@@ -12,25 +12,22 @@ const settle = () => new Promise<void>((resolve) => setImmediate(resolve));
 test("a follower moves through restart, end and a later start", async () => {
 	const origin = new Producer();
 	const path = Path.from("room/audio");
-	const firstPublication = origin.createBroadcast(path);
-	const first = firstPublication.broadcast;
-	firstPublication.announce();
+	const firstRoute = origin.route(path);
+	const first = firstRoute.broadcast;
 	const request: Following = origin.follow(path);
-	expect(request.active.peek()?.instance).toBe(firstPublication.route?.instance);
-	const secondPublication = origin.createBroadcast(path);
-	const second = secondPublication.broadcast;
-	secondPublication.announce();
+	expect(request.active.peek()?.instance).toBe(firstRoute.instance);
+	const secondRoute = origin.route(path);
+	const second = secondRoute.broadcast;
 	await settle();
-	expect(request.active.peek()?.instance).toBe(secondPublication.route?.instance);
+	expect(request.active.peek()?.instance).toBe(secondRoute.instance);
 	second.close();
 	await settle();
 	expect(request.active.peek()).toBeUndefined();
 	expect(request.closed.peek()).toBeUndefined();
-	const thirdPublication = origin.createBroadcast(path);
-	const third = thirdPublication.broadcast;
-	thirdPublication.announce();
+	const thirdRoute = origin.route(path);
+	const third = thirdRoute.broadcast;
 	await settle();
-	expect(request.active.peek()?.instance).toBe(thirdPublication.route?.instance);
+	expect(request.active.peek()?.instance).toBe(thirdRoute.instance);
 	request.close();
 	third.close();
 	first.close();
@@ -41,15 +38,13 @@ test("an instance-pinned follower refuses another instance", async () => {
 	const origin = new Producer();
 	const path = Path.from("room/audio");
 	const instance = Instance.random();
-	const firstPublication = origin.createBroadcast(path);
-	const first = firstPublication.broadcast;
-	firstPublication.announce({ instance });
+	const firstRoute = origin.route(path, { instance });
+	const first = firstRoute.broadcast;
 	const request = origin.follow(path, { instance });
-	const secondPublication = origin.createBroadcast(path);
-	const second = secondPublication.broadcast;
-	secondPublication.announce({ instance: Instance.random() });
+	const secondRoute = origin.route(path, { instance: Instance.random() });
+	const second = secondRoute.broadcast;
 	await settle();
-	expect(request.active.peek()?.instance).not.toBe(secondPublication.route?.instance);
+	expect(request.active.peek()?.instance).not.toBe(secondRoute.instance);
 	request.close();
 	first.close();
 	second.close();
@@ -59,14 +54,14 @@ test("an instance-pinned follower refuses another instance", async () => {
 test("a follower changes its handle on an in-place instance restart", async () => {
 	const origin = new Producer();
 	const path = Path.from("room/audio");
-	const broadcastPublication = origin.createBroadcast(path);
-	const broadcast = broadcastPublication.broadcast;
 	const before = Instance.random();
-	broadcastPublication.announce({ instance: before });
+	const broadcastRoute = origin.route(path, { instance: before });
+	const broadcast = broadcastRoute.broadcast;
 	const request = origin.follow(path);
 	const old = request.active.peek();
 	const after = Instance.random();
-	broadcastPublication.announce({ instance: after });
+	// A session's in-place restart: the route's instance changes under it.
+	wireOf(broadcastRoute).update({ instance: after });
 	await settle();
 	expect(request.active.peek()?.instance).toBe(after);
 	expect(request.active.peek()).not.toBe(old);
@@ -80,9 +75,8 @@ test("a closed follower never acquires another publisher", async () => {
 	const path = Path.from("room/audio");
 	const request = origin.follow(path);
 	request.close();
-	const broadcastPublication = origin.createBroadcast(path);
-	const broadcast = broadcastPublication.broadcast;
-	broadcastPublication.announce();
+	const broadcastRoute = origin.route(path);
+	const broadcast = broadcastRoute.broadcast;
 	await settle();
 	expect(request.active.peek()).toBeUndefined();
 	expect(request.closed.peek()).toBeNull();
@@ -108,11 +102,10 @@ test("unrelated routes never notify followers", async () => {
 	await settle();
 	let changes = 0;
 	const stops = requests.map((request) => request.active.subscribe(() => changes++));
-	const otherPublication = origin.createBroadcast(Path.from("unrelated"));
-	const other = otherPublication.broadcast;
-	otherPublication.announce();
+	const otherRoute = origin.route(Path.from("unrelated"));
+	const other = otherRoute.broadcast;
 	await settle();
-	otherPublication.announce({ cost: 5n });
+	otherRoute.setCost(5n);
 	await settle();
 	other.close();
 	await settle();
@@ -167,29 +160,27 @@ test("followers track the serving prefix, ignoring descendants and re-prices", a
 	const origin = new Producer();
 	const source = new BroadcastProducer();
 	const keeper = source.consume();
-	const prefix = origin.requestsRoute(Path.from("pool"));
+	const prefix = origin.routePrefix(Path.from("pool"));
 	const serving = (async () => {
 		for await (const request of prefix.requested()) request.serve(source.consume());
 	})();
 	const request = origin.follow(Path.from("pool/job"));
 	await settle();
-	expect(request.active.peek()?.instance).toBe(prefix.route.instance);
-	const belowPublication = origin.createBroadcast(Path.from("pool/job/thumb"));
-	const below = belowPublication.broadcast;
-	belowPublication.announce();
+	expect(request.active.peek()?.instance).toBe(prefix.instance);
+	const belowRoute = origin.route(Path.from("pool/job/thumb"));
+	const below = belowRoute.broadcast;
 	await settle();
-	expect(request.active.peek()?.instance).toBe(prefix.route.instance);
-	const exactPublication = origin.createBroadcast(Path.from("pool/job"));
-	const exact = exactPublication.broadcast;
-	exactPublication.announce();
+	expect(request.active.peek()?.instance).toBe(prefix.instance);
+	const exactRoute = origin.route(Path.from("pool/job"));
+	const exact = exactRoute.broadcast;
 	await settle();
-	expect(request.active.peek()?.instance).toBe(exactPublication.route?.instance);
-	prefix.updateRoute({ cost: 5n });
+	expect(request.active.peek()?.instance).toBe(exactRoute.instance);
+	prefix.setCost(5n);
 	await settle();
-	expect(request.active.peek()?.instance).toBe(exactPublication.route?.instance);
+	expect(request.active.peek()?.instance).toBe(exactRoute.instance);
 	exact.close();
 	await settle();
-	expect(request.active.peek()?.instance).toBe(prefix.route.instance);
+	expect(request.active.peek()?.instance).toBe(prefix.instance);
 	prefix.close();
 	await settle();
 	expect(request.active.peek()).toBeUndefined();
@@ -205,12 +196,11 @@ test("followers track the serving prefix, ignoring descendants and re-prices", a
 test("a follower ignores a covering route whose scope excludes its path", async () => {
 	const origin = new Producer();
 	const scoped = origin.scope(Path.empty(), new Path.Patterns([Path.Pattern.parse("room/*/chat")]));
-	const prefix = scoped.requestsRoute(Path.from("room/alice"));
-	const exactPublication = origin.createBroadcast(Path.from("room/alice"));
-	const exact = exactPublication.broadcast;
-	exactPublication.announce({ cost: 5n });
+	const prefix = scoped.routePrefix(Path.from("room/alice"));
+	const exactRoute = origin.route(Path.from("room/alice"), { cost: 5n });
+	const exact = exactRoute.broadcast;
 	const request = origin.follow(Path.from("room/alice"));
-	expect(request.active.peek()?.instance).toBe(exactPublication.route?.instance);
+	expect(request.active.peek()?.instance).toBe(exactRoute.instance);
 	exact.close();
 	await settle();
 	expect(request.active.peek()).toBeUndefined();
@@ -223,7 +213,7 @@ test("a follower tracks a route replaced by an identical one", async () => {
 	const origin = new Producer();
 	const path = Path.from("room");
 	const serve = (source: BroadcastProducer) => {
-		const route = origin.requestsRoute(path);
+		const route = origin.routePrefix(path);
 		void (async () => {
 			for await (const request of route.requested()) request.serve(source.consume());
 		})();
@@ -233,7 +223,7 @@ test("a follower tracks a route replaced by an identical one", async () => {
 	const first = serve(firstSource);
 	const request = origin.follow(path);
 	await settle();
-	expect(request.active.peek()?.instance).toBe(first.route.instance);
+	expect(request.active.peek()?.instance).toBe(first.instance);
 
 	// Same (default) route metadata: only the instance each claim minted differs.
 	const secondSource = new BroadcastProducer();
@@ -241,7 +231,7 @@ test("a follower tracks a route replaced by an identical one", async () => {
 	await settle();
 	first.close();
 	await settle();
-	expect(request.active.peek()?.instance).toBe(second.route.instance);
+	expect(request.active.peek()?.instance).toBe(second.instance);
 
 	request.close();
 	second.close();
@@ -254,7 +244,7 @@ test("an origin closing settles a follower a served route resolved", async () =>
 	const origin = new Producer();
 	const path = Path.from("room");
 	const source = new BroadcastProducer();
-	const route = origin.requestsRoute(path);
+	const route = origin.routePrefix(path);
 	void (async () => {
 		for await (const request of route.requested()) request.serve(source.consume());
 	})();
@@ -273,14 +263,14 @@ test("an origin closing settles a follower a served route resolved", async () =>
 test("a follower keeps a refusal that lands with a re-price", async () => {
 	const origin = new Producer();
 	const path = Path.from("room");
-	const route = origin.requestsRoute(path);
+	const route = origin.routePrefix(path);
 	const requested = route.requested();
 	const request = origin.follow(path);
 	const pending = (await requested.next()).value;
 	if (!pending) throw new Error("expected a request");
 
 	// Both land in one turn: the watch notification must not retry the refused request.
-	route.updateRoute({ cost: 5n });
+	route.setCost(5n);
 	const denied = new Error("denied");
 	pending.reject(denied);
 	await settle();
@@ -304,7 +294,7 @@ for (const received of [false, true]) {
 		const events: string[] = [];
 		const stop = wireOf(origin).interests((prefix, wanted) => events.push(`${prefix} ${wanted}`));
 		const source = new BroadcastProducer();
-		const route = received ? wireOf(origin).receive(path, Route.default) : origin.requestsRoute(path);
+		const route = received ? wireOf(origin).receive(path, RouteInfo.default) : origin.routePrefix(path);
 		void (async () => {
 			for await (const request of route.requested()) request.serve(source.consume());
 		})();
@@ -325,55 +315,85 @@ for (const received of [false, true]) {
 	});
 }
 
-test("a claim answer is hidden until published under its own instance", async () => {
+test("a hidden job route is hidden until announced under its own instance", async () => {
 	const origin = new Producer();
 	const path = Path.from("room/alice");
-	const claim = origin.requests(Path.from("room"));
+	const claim = origin.routePrefix(Path.from("room"));
 	const requests = claim.requested();
 	const request = origin.request(path);
 	const pending = (await requests.next()).value;
 	if (!pending) throw new Error("expected a request");
-	const prepared = pending.prepare();
-	prepared.broadcast.createTrack("video");
+	const job = pending.route({ hidden: true });
+	job.broadcast.createTrack("video");
 	await settle();
 	expect(request.active.peek()).toBeUndefined();
-	const published = prepared.publish();
+	job.announce();
 	await settle();
-	expect(published.route?.instance).toBeDefined();
-	expect(request.active.peek()?.instance).toBe(published.route?.instance);
+	expect(request.active.peek()?.instance).toBe(job.instance);
 	request.close();
-	published.broadcast.close();
+	job.close();
 	claim.close();
 	origin.close();
 });
 
-test("a prepared answer cannot announce itself before publish", async () => {
+test("a visible job route answers its waiting requesters at once", async () => {
 	const origin = new Producer();
 	const path = Path.from("room/alice");
-	const claim = origin.requests(Path.from("room"));
+	const claim = origin.routePrefix(Path.from("room"));
+	const requests = claim.requested();
+	const first = origin.request(path);
+	const pending = (await requests.next()).value;
+	if (!pending) throw new Error("expected a request");
+	const shared = origin.request(path);
+	const job = pending.route();
+	expect(job.announced).toBe(true);
+	expect(job.instance).not.toBe(claim.instance);
+	await settle();
+	for (const request of [first, shared]) expect(request.active.peek()?.instance).toBe(job.instance);
+	// The request is answered: routing it again is refused.
+	expect(() => pending.route()).toThrow("request is closed");
+
+	// Ending the job withdraws only its path: the claim keeps answering later requests.
+	job.close();
+	await settle();
+	const later = origin.request(path);
+	const next = (await requests.next()).value;
+	if (!next) throw new Error("expected another request");
+	const again = next.route({ instance: Instance.parse("stable"), epoch: 2n });
+	await settle();
+	expect(again.instance).toBe(Instance.parse("stable"));
+	expect(later.active.peek()?.instance).toBe(again.instance);
+	for (const request of [first, shared, later]) request.close();
+	again.close();
+	claim.close();
+	origin.close();
+});
+
+test("a hidden job route's broadcast cannot announce itself", async () => {
+	const origin = new Producer();
+	const path = Path.from("room/alice");
+	const claim = origin.routePrefix(Path.from("room"));
 	const requests = claim.requested();
 	const request = origin.request(path);
 	const pending = (await requests.next()).value;
 	if (!pending) throw new Error("expected a request");
-	const prepared = pending.prepare();
-	expect(prepared.broadcast).not.toHaveProperty("announce");
-	expect(prepared.broadcast).not.toHaveProperty("route");
+	const job = pending.route({ hidden: true });
+	expect(job.broadcast).not.toHaveProperty("announce");
+	expect(job.broadcast).not.toHaveProperty("route");
 	await settle();
 	expect(request.active.peek()).toBeUndefined();
-	const published = prepared.publish();
-	const instance = published.route?.instance;
-	expect(instance).toBeDefined();
+	job.announce();
 	await settle();
-	expect(request.active.peek()?.instance).toBe(instance);
+	expect(request.active.peek()?.instance).toBe(job.instance);
 	request.close();
-	published.broadcast.close();
+	job.close();
 	claim.close();
 	origin.close();
 });
 
 test("an application serves held content without an exact route", async () => {
 	const origin = new Producer();
-	const claim = origin.requests(Path.from("room"));
+	const claim = origin.routePrefix(Path.from("room"));
 	const requests = claim.requested();
 	const request = origin.request(Path.from("room/alice"));
 	const pending = (await requests.next()).value;
@@ -392,20 +412,20 @@ test("an application serves held content without an exact route", async () => {
 	origin.close();
 });
 
-for (const withdraw of ["unannounce", "replace"] as const) {
-	test(`a published answer is not cached after ${withdraw}`, async () => {
+for (const withdraw of ["withdraw", "replace"] as const) {
+	test(`a job's route is not cached after ${withdraw}`, async () => {
 		const origin = new Producer();
-		const claim = origin.requests(Path.from("room"));
+		const claim = origin.routePrefix(Path.from("room"));
 		const requests = claim.requested();
 		const path = Path.from("room/alice");
 		const first = origin.request(path);
 		const pending = (await requests.next()).value;
 		if (!pending) throw new Error("expected a request");
-		const publication = pending.prepare().publish();
+		const job = pending.route();
 		await settle();
 		const held = first.active.peek()?.clone();
-		if (withdraw === "unannounce") publication.unannounce();
-		else origin.createBroadcast(path).broadcast.close();
+		if (withdraw === "withdraw") job.withdraw();
+		else origin.route(path, { hidden: true }).broadcast.close();
 		const next = origin.request(path);
 		await settle();
 		expect(next.active.peek()).toBeUndefined();
@@ -415,41 +435,43 @@ for (const withdraw of ["unannounce", "replace"] as const) {
 		held?.close();
 		next.close();
 		first.close();
-		publication.broadcast.close();
+		job.close();
 		claim.close();
 		origin.close();
 	});
 }
 
-test("closing a prepared answer refuses the request and closes its broadcast", async () => {
+test("closing a hidden job route refuses the request and closes its broadcast", async () => {
 	const origin = new Producer();
-	const claim = origin.requests(Path.from("room"));
+	const claim = origin.routePrefix(Path.from("room"));
 	const requests = claim.requested();
 	const request = origin.request(Path.from("room/alice"));
 	const pending = (await requests.next()).value;
 	if (!pending) throw new Error("expected a request");
-	const prepared = pending.prepare();
-	prepared.close();
-	prepared.close();
-	prepared[Symbol.dispose]();
+	const job = pending.route({ hidden: true });
+	job.close();
+	job.close();
+	job[Symbol.dispose]();
 	await settle();
 	expect(request.closed.peek()).toBeInstanceOf(Error);
-	expect(prepared.broadcast.closed.peek()).toBeDefined();
+	expect(job.broadcast.closed.peek()).toBeDefined();
 	claim.close();
 	origin.close();
 });
 
-test("an answer prepared for an abandoned claim is never announced", async () => {
+test("a job route for an abandoned claim is never announced", async () => {
 	const origin = new Producer();
 	const path = Path.from("room/alice");
-	const claim = origin.requests(Path.from("room"));
+	const claim = origin.routePrefix(Path.from("room"));
 	const requests = claim.requested();
 	const request = origin.request(path);
 	const pending = (await requests.next()).value;
 	if (!pending) throw new Error("expected a request");
-	const prepared = pending.prepare();
+	const job = pending.route({ hidden: true });
 	claim.close();
-	expect(() => prepared.publish()).toThrow("request is closed");
+	expect(() => job.announce()).toThrow("unroutable");
+	expect(job.announced).toBe(false);
+	expect(job.broadcast.closed.peek()).toBeDefined();
 	const announced = origin.follow(path);
 	await settle();
 	expect(announced.active.peek()).toBeUndefined();
@@ -459,31 +481,31 @@ test("an answer prepared for an abandoned claim is never announced", async () =>
 });
 
 for (const cleanup of ["close", "dispose", "broadcast"] as const) {
-	test(`prepared ${cleanup} releases shared requesters and admits a new request`, async () => {
+	test(`a hidden job route's ${cleanup} releases shared requesters and admits a new request`, async () => {
 		const origin = new Producer();
 		const path = Path.from("room/alice");
-		const claim = origin.requests(Path.from("room"));
+		const claim = origin.routePrefix(Path.from("room"));
 		const requests = claim.requested();
 		const first = origin.request(path);
 		const pending = (await requests.next()).value;
 		if (!pending) throw new Error("expected a request");
-		const prepared = pending.prepare();
+		const job = pending.route({ hidden: true });
 		const shared = origin.request(path);
-		if (cleanup === "close") prepared.close();
-		else if (cleanup === "dispose") prepared[Symbol.dispose]();
-		else prepared.broadcast.close();
+		if (cleanup === "close") job.close();
+		else if (cleanup === "dispose") job[Symbol.dispose]();
+		else job.broadcast.close();
 		// Requested in the same turn, so the release cannot wait on a reactive notification.
 		const later = origin.request(path);
 		await settle();
-		prepared.close();
-		prepared[Symbol.dispose]();
+		job.close();
+		job[Symbol.dispose]();
 
 		for (const request of [first, shared]) {
 			expect(request.closed.peek()).toBeInstanceOf(StreamError);
 			expect((request.closed.peek() as StreamError).code).toBe(StreamCode.Unroutable);
 		}
 		expect(later.closed.peek()).toBeUndefined();
-		expect(() => prepared.publish()).toThrow("prepared answer is closed");
+		expect(() => job.announce()).toThrow("broadcast is closed");
 		const next = (await requests.next()).value;
 		if (!next) throw new Error("expected another request");
 		expect(next).not.toBe(pending);
@@ -495,14 +517,14 @@ for (const cleanup of ["close", "dispose", "broadcast"] as const) {
 	});
 }
 
-test("a throwing handler disposes its prepared answer and leaves the claim answerable", async () => {
+test("a throwing handler disposes its job route and leaves the claim answerable", async () => {
 	const origin = new Producer();
 	const path = Path.from("room/alice");
-	const claim = origin.requests(Path.from("room"));
+	const claim = origin.routePrefix(Path.from("room"));
 	const failed = (async () => {
 		for await (const request of claim.requested()) {
-			using prepared = request.prepare();
-			prepared.broadcast.createTrack("video");
+			using job = request.route({ hidden: true });
+			job.broadcast.createTrack("video");
 			throw new Error("handler failed");
 		}
 	})();
@@ -515,8 +537,8 @@ test("a throwing handler disposes its prepared answer and leaves the claim answe
 	const pending = (await requests.next()).value;
 	if (!pending) throw new Error("expected another request");
 	{
-		using prepared = pending.prepare();
-		prepared.close();
+		using job = pending.route({ hidden: true });
+		job.close();
 	}
 	await settle();
 	expect((later.closed.peek() as StreamError).code).toBe(StreamCode.Unroutable);
@@ -524,44 +546,40 @@ test("a throwing handler disposes its prepared answer and leaves the claim answe
 	origin.close();
 });
 
-test("using transfers a published answer without closing it on disposal", async () => {
+test("announcing a job route again keeps it answering under one instance", async () => {
 	const origin = new Producer();
 	const path = Path.from("room/alice");
-	const claim = origin.requests(Path.from("room"));
+	const claim = origin.routePrefix(Path.from("room"));
 	const requests = claim.requested();
 	const request = origin.request(path);
 	const pending = (await requests.next()).value;
 	if (!pending) throw new Error("expected a request");
-	let published: Publication;
-	{
-		using prepared = pending.prepare();
-		prepared.broadcast.createTrack("data").writeFrame({ payload: new TextEncoder().encode("published") });
-		published = prepared.publish();
-		expect(() => prepared.publish()).toThrow("prepared answer is closed");
-		prepared.close();
-	}
+	const job = pending.route({ hidden: true });
+	job.broadcast.createTrack("data").writeFrame({ payload: new TextEncoder().encode("published") });
+	job.announce();
+	job.announce();
 	await settle();
-	expect(published.broadcast.closed.peek()).toBeUndefined();
-	expect(request.active.peek()?.instance).toBe(published.route?.instance);
+	expect(job.broadcast.closed.peek()).toBeUndefined();
+	expect(request.active.peek()?.instance).toBe(job.instance);
 	const reader = request.active.peek()?.track("data").subscribe().ordered();
 	expect(await reader?.readString()).toBe("published");
 	reader?.close();
 	request.close();
-	published.broadcast.close();
+	job.close();
 	claim.close();
 	origin.close();
 });
 
-for (const cleanup of ["close", "dispose", "broadcast", "publish"] as const) {
-	test(`an old prepared ${cleanup} cannot refuse the next request for its path`, async () => {
+for (const cleanup of ["close", "dispose", "broadcast", "announce"] as const) {
+	test(`an old job route's ${cleanup} cannot refuse the next request for its path`, async () => {
 		const origin = new Producer();
 		const path = Path.from("room/alice");
-		const claim = origin.requests(Path.from("room"));
+		const claim = origin.routePrefix(Path.from("room"));
 		const requests = claim.requested();
 		const first = origin.request(path);
 		const pending = (await requests.next()).value;
 		if (!pending) throw new Error("expected a request");
-		const old = pending.prepare();
+		const old = pending.route({ hidden: true });
 		first.close();
 		await settle();
 		const later = origin.request(path);
@@ -570,34 +588,33 @@ for (const cleanup of ["close", "dispose", "broadcast", "publish"] as const) {
 		if (cleanup === "close") old.close();
 		else if (cleanup === "dispose") old[Symbol.dispose]();
 		else if (cleanup === "broadcast") old.broadcast.close();
-		else expect(() => old.publish()).toThrow("request is closed");
+		else expect(() => old.announce()).toThrow("unroutable");
 		await settle();
 		expect(later.closed.peek()).toBeUndefined();
-		using prepared = next.prepare();
-		prepared.broadcast.createTrack("data").writeFrame({ payload: new TextEncoder().encode(cleanup) });
-		const published = prepared.publish();
+		using job = next.route({ hidden: true });
+		job.broadcast.createTrack("data").writeFrame({ payload: new TextEncoder().encode(cleanup) });
+		job.announce();
 		await settle();
-		expect(later.active.peek()?.instance).toBe(published.route?.instance);
+		expect(later.active.peek()?.instance).toBe(job.instance);
 		const reader = later.active.peek()?.track("data").subscribe().ordered();
 		expect(await reader?.readString()).toBe(cleanup);
 		reader?.close();
 		old.close();
 		later.close();
-		published.broadcast.close();
 		claim.close();
 		origin.close();
 	});
 }
 
-test("a forwarded request cannot be prepared by setting a publisher property", async () => {
+test("a forwarded request cannot be routed by setting a publisher property", async () => {
 	const origin = new Producer();
-	const route = origin.requestsRoute(Path.from("room"));
+	const route = wireOf(origin).receive(Path.from("room"));
 	const requests = route.requested();
 	const request = origin.request(Path.from("room/alice"));
 	const pending = (await requests.next()).value;
 	if (!pending) throw new Error("expected a request");
 	Object.assign(pending, { publisher: origin });
-	expect(() => pending.prepare()).toThrow("forwarded requests cannot be prepared");
+	expect(() => pending.route()).toThrow("unroutable");
 	pending.reject(new Error("refused"));
 	request.close();
 	route.close();
@@ -611,7 +628,7 @@ test("an instance-pinned follower resumes when its instance returns after a gap"
 	const source = new BroadcastProducer();
 	const keeper = source.consume();
 	const serve = (instance: Instance.Valid, broadcast: BroadcastProducer) => {
-		const route = origin.requestsRoute(path, { instance: instance });
+		const route = origin.routePrefix(path, { instance: instance });
 		void (async () => {
 			for await (const request of route.requested()) request.serve(broadcast.consume());
 		})();
@@ -681,10 +698,9 @@ test("a follower keeps its scoped discovery across instances until closed", asyn
 	synced?.();
 	await settle();
 	expect(follower.closed.peek()).toBeUndefined();
-	const publication = origin.createBroadcast(path);
-	publication.announce();
+	const publication = origin.route(path);
 	await settle();
-	expect(follower.active.peek()?.instance).toBe(publication.route?.instance);
+	expect(follower.active.peek()?.instance).toBe(publication.instance);
 	publication.broadcast.close();
 	await settle();
 	// The instance ending keeps the follower and its discovery open for the next one.
@@ -763,7 +779,7 @@ test("a pending request waits for a session before concluding absence", async ()
 test("a follower retains a selected handler's explicit unroutable refusal", async () => {
 	const origin = new Producer();
 	const path = Path.from("room/audio");
-	const route = origin.requestsRoute(path);
+	const route = origin.routePrefix(path);
 	const pending = route.requested();
 	const requested = origin.follow(path);
 	const request = (await pending.next()).value;
@@ -780,25 +796,24 @@ test("a follower retains a selected handler's explicit unroutable refusal", asyn
 test("a pending request retries a route gap and never retargets after resolving", async () => {
 	const origin = new Producer();
 	const path = Path.from("room/audio");
-	const first = origin.requestsRoute(path);
+	const first = origin.routePrefix(path);
 	const requested = origin.request(path);
 	const before = await first.requested().next();
 	expect(before.value).toBeDefined();
 	first.close();
 	await settle();
 	expect(requested.closed.peek()).toBeUndefined();
-	const second = origin.requestsRoute(path);
+	const second = origin.routePrefix(path);
 	const pending = (await second.requested().next()).value;
 	if (!pending) throw new Error("replacement route was not requested");
 	const source = new BroadcastProducer();
 	const keeper = source.consume();
 	pending.serve(source.consume());
 	await settle();
-	expect(requested.active.peek()?.instance).toBe(second.route.instance);
-	const replacement = origin.createBroadcast(path);
-	replacement.announce();
+	expect(requested.active.peek()?.instance).toBe(second.instance);
+	const replacement = origin.route(path);
 	await settle();
-	expect(requested.active.peek()?.instance).toBe(second.route.instance);
+	expect(requested.active.peek()?.instance).toBe(second.instance);
 	second.close();
 	await settle();
 	expect(requested.closed.peek()).toBeInstanceOf(StreamError);
@@ -834,8 +849,8 @@ test.each(["request", "follow"] as const)("a %s pinned to a losing instance reso
 	const origin = new Producer();
 	const path = Path.from("room/audio");
 	const pinned = Instance.random();
-	const losing = origin.requestsRoute(path, { instance: pinned, cost: 9n });
-	const winning = origin.requestsRoute(path, { instance: Instance.random(), cost: 1n });
+	const losing = origin.routePrefix(path, { instance: pinned, cost: 9n });
+	const winning = origin.routePrefix(path, { instance: Instance.random(), cost: 1n });
 	const asked = losing.requested();
 	const requested = origin[method](path, { instance: pinned });
 	const pending = (await asked.next()).value;
@@ -855,12 +870,12 @@ test.each(["request", "follow"] as const)("a %s pinned to a losing instance reso
 	const other = new BroadcastProducer();
 	answer.serve(other.consume());
 	await settle();
-	expect(plain.active.peek()?.instance).toBe(winning.route.instance);
+	expect(plain.active.peek()?.instance).toBe(winning.instance);
 
 	requested.close();
 	again.close();
 	await settle();
-	expect(plain.active.peek()?.instance).toBe(winning.route.instance);
+	expect(plain.active.peek()?.instance).toBe(winning.instance);
 	plain.close();
 	source.close();
 	other.close();
@@ -873,10 +888,9 @@ test("a peer's pin is served by a local broadcast that loses the path", async ()
 	const origin = new Producer();
 	const wire = wireOf(origin.consume());
 	const path = Path.from("room/audio");
-	const publication = origin.createBroadcast(path);
 	const pinned = Instance.random();
-	publication.announce({ instance: pinned, cost: 9n });
-	const winning = origin.requestsRoute(path, { instance: Instance.random(), cost: 1n });
+	const publication = origin.route(path, { instance: pinned, cost: 9n });
+	const winning = origin.routePrefix(path, { instance: Instance.random(), cost: 1n });
 	expect(wire.local(path)).toBeUndefined();
 	expect(wire.local(path, pinned)).toBeDefined();
 	expect(await wire.demand(path, pinned)).toBeDefined();
diff --git a/js/net/src/origin.test.ts b/js/net/src/origin.test.ts
index 36ad412a0c5..8c6ad7afda3 100644
--- a/js/net/src/origin.test.ts
+++ b/js/net/src/origin.test.ts
@@ -4,7 +4,7 @@ import { getter, Once, race, Signal } from "@moq/signals";
 import { announcedView } from "./announced.test-util";
 import { type Consumer as BroadcastConsumer, Producer as BroadcastProducer } from "./broadcast.ts";
 import { StreamCode, StreamError } from "./error.ts";
-import { HopSchema, Route } from "./hop.ts";
+import { type Cost, HopSchema, RouteInfo } from "./hop.ts";
 import * as Instance from "./instance.ts";
 import { chainHash, presented, spreadHash } from "./internal.ts";
 import { SessionBroadcast, textFrame } from "./mock.ts";
@@ -16,9 +16,8 @@ import { Timescale } from "./time.ts";
 import { overrideBroadcastWire, wireOf } from "./wire.ts";
 
 function publish(origin: Producer, path: Path.Valid) {
-	const broadcastPublication = origin.createBroadcast(path);
-	const broadcast = broadcastPublication.broadcast;
-	broadcastPublication.announce();
+	const broadcastRoute = origin.route(path);
+	const broadcast = broadcastRoute.broadcast;
 	return broadcast;
 }
 
@@ -28,7 +27,12 @@ const PEER = HopSchema.parse(10n);
 const INSTANCE = Instance.parse("01900000-0000-7000-8000-000000000001");
 
 /** Land a received prefix, served from `consume`, the way a session does. */
-function serve(origin: Producer, prefix: Path.Valid, consume: () => BroadcastConsumer, route: Route = Route.default) {
+function serve(
+	origin: Producer,
+	prefix: Path.Valid,
+	consume: () => BroadcastConsumer,
+	route: RouteInfo = RouteInfo.default,
+) {
 	const handle = wireOf(origin).receive(prefix, route);
 	void (async () => {
 		try {
@@ -120,35 +124,35 @@ test("a borrowed table exposes dynamic serving and a live scoped broadcast map",
 	const table: Table = origin;
 	const scope = Path.Pattern.parse("room/**");
 	const live = await announcedView(origin, scope);
-	const changes: ReadonlyMap<Path.Valid, Route>[] = [];
+	const changes: ReadonlyMap<Path.Valid, RouteInfo>[] = [];
 	const stop = live.subscribe((value) => changes.push(value));
 	await new Promise<void>((resolve) => setImmediate(resolve));
 	expect(live.peek().size).toBe(0);
 
 	const other = publish(origin, Path.from("other"));
 	const localPath = Path.from("room/alice");
-	const localPublication = table.createBroadcast(localPath);
-	const local = localPublication.broadcast;
+	const localRoute = table.route(localPath, { hidden: true, instance: INSTANCE, cost: 4n });
+	const local = localRoute.broadcast;
 	await new Promise<void>((resolve) => setImmediate(resolve));
 	expect(live.peek().has(localPath)).toBe(false);
 	await new Promise<void>((resolve) => setImmediate(resolve));
 	expect(live.peek().has(Path.from("other"))).toBe(false);
 
-	localPublication.announce({ instance: INSTANCE, cost: 4n });
+	localRoute.announce();
 	await settle();
 	await new Promise<void>((resolve) => setImmediate(resolve));
-	expect(live.peek().get(localPath)).toEqual(Route.normalize({ instance: INSTANCE, cost: 4n }));
+	expect(live.peek().get(localPath)).toEqual(RouteInfo.normalize({ instance: INSTANCE, cost: 4n }));
 	await new Promise<void>((resolve) => setImmediate(resolve));
 	expect(changes.some((value) => value.get(localPath)?.cost === 4n)).toBe(true);
 
 	const prefix = Path.from("room");
-	const dynamic = table.requestsRoute(prefix, { cost: 2n });
+	const dynamic = table.routePrefix(prefix, { cost: 2n });
 	await new Promise<void>((resolve) => setImmediate(resolve));
-	expect(live.peek().get(prefix)).toEqual(Route.normalize({ ...dynamic.route, cost: 2n }));
-	dynamic.updateRoute({ cost: 3n });
+	expect(live.peek().get(prefix)).toEqual(RouteInfo.normalize({ ...wireOf(dynamic).info, cost: 2n }));
+	dynamic.setCost(3n);
 	await settle();
 	await new Promise<void>((resolve) => setImmediate(resolve));
-	expect(live.peek().get(prefix)).toEqual(Route.normalize({ ...dynamic.route, cost: 3n }));
+	expect(live.peek().get(prefix)).toEqual(RouteInfo.normalize({ ...wireOf(dynamic).info, cost: 3n }));
 
 	dynamic.close();
 	local.close();
@@ -167,26 +171,26 @@ test("an announced local path competes with a received route on cost", async ()
 	const remote = wireOf(origin).receive(path, { instance: INSTANCE, hops: [PEER], cost: 5n });
 	const live = await announcedView(consumer);
 	await new Promise<void>((resolve) => setImmediate(resolve));
-	expect(live.peek().get(path)).toEqual(Route.normalize({ instance: INSTANCE, hops: [PEER], cost: 5n }));
+	expect(live.peek().get(path)).toEqual(RouteInfo.normalize({ instance: INSTANCE, hops: [PEER], cost: 5n }));
 
 	// Unannounced, it competes for nothing.
-	const localPublication = origin.createBroadcast(path);
-	const local = localPublication.broadcast;
+	const localRoute = origin.route(path, { hidden: true, instance: INSTANCE, cost: 9n });
+	const local = localRoute.broadcast;
 	await new Promise<void>((resolve) => setImmediate(resolve));
-	expect(live.peek().get(path)).toEqual(Route.normalize({ instance: INSTANCE, hops: [PEER], cost: 5n }));
+	expect(live.peek().get(path)).toEqual(RouteInfo.normalize({ instance: INSTANCE, hops: [PEER], cost: 5n }));
 
 	// Cheaper wins; a tie falls to the local broadcast.
-	localPublication.announce({ instance: INSTANCE, cost: 9n });
+	localRoute.announce();
 	await new Promise<void>((resolve) => setImmediate(resolve));
-	expect(live.peek().get(path)).toEqual(Route.normalize({ instance: INSTANCE, hops: [PEER], cost: 5n }));
-	localPublication.announce({ instance: INSTANCE, cost: 5n });
+	expect(live.peek().get(path)).toEqual(RouteInfo.normalize({ instance: INSTANCE, hops: [PEER], cost: 5n }));
+	localRoute.setCost(5n);
 	await new Promise<void>((resolve) => setImmediate(resolve));
-	expect(live.peek().get(path)).toEqual(Route.normalize({ instance: INSTANCE, cost: 5n }));
+	expect(live.peek().get(path)).toEqual(RouteInfo.normalize({ instance: INSTANCE, cost: 5n }));
 
 	local.close();
 	await settle();
 	await new Promise<void>((resolve) => setImmediate(resolve));
-	expect(live.peek().get(path)).toEqual(Route.normalize({ instance: INSTANCE, hops: [PEER], cost: 5n }));
+	expect(live.peek().get(path)).toEqual(RouteInfo.normalize({ instance: INSTANCE, hops: [PEER], cost: 5n }));
 
 	remote.close();
 	await settle();
@@ -207,7 +211,7 @@ test("a scoped route remains visible when an exact local path is outside the sco
 
 	await new Promise<void>((resolve) => setImmediate(resolve));
 
-	expect((await announcedView(origin)).peek().get(path)).toMatchObject(Route.default);
+	expect((await announcedView(origin)).peek().get(path)).toMatchObject(RouteInfo.default);
 	await new Promise<void>((resolve) => setImmediate(resolve));
 	expect(live.peek().get(path)).toMatchObject({ cost: 5n });
 
@@ -309,7 +313,7 @@ test("a superseded broadcast closes, and its subscribers keep reading", async ()
 	const consumer = origin.consume();
 	const path = Path.from("room");
 
-	const publication = origin.createBroadcast(path);
+	const publication = origin.route(path, { hidden: true });
 	const first = publication.broadcast;
 	const track = first.createTrack("video", { timescale: Timescale.MILLI });
 	publication.announce();
@@ -317,13 +321,12 @@ test("a superseded broadcast closes, and its subscribers keep reading", async ()
 	const subscriber = mine?.track("video").subscribe();
 	if (!subscriber) throw new Error("expected a subscriber");
 
-	const replacement = origin.createBroadcast(path);
-	replacement.announce();
+	const replacement = origin.route(path);
 	// The origin closes the old producer itself, whoever still holds a handle on it.
 	expect(first.closed.peek()).toBeNull();
 	// Its stale publication never displaces or retracts the replacement.
-	expect(() => publication.announce({ instance: INSTANCE })).toThrow("broadcast is closed");
-	publication.unannounce();
+	expect(() => publication.announce()).toThrow("broadcast is closed");
+	publication.withdraw();
 	const current = await routed(consumer, path);
 	expect(readsFrom(current, replacement.broadcast)).toBe(true);
 	current?.close();
@@ -438,7 +441,7 @@ test("a remote entry resolves by path and retracts on dispose", async () => {
 
 	// Announced streams include remote entries.
 	const announced = consumer.routes();
-	expect(await announced.next()).toMatchObject({ prefix: path, kind: "start", route: Route.default });
+	expect(await announced.next()).toMatchObject({ prefix: path, kind: "start", route: RouteInfo.default });
 
 	dispose();
 	expect(await announced.next()).toMatchObject({ prefix: path, kind: "end" });
@@ -490,7 +493,7 @@ test("a local publish shadows a remote entry", async () => {
 
 	// One path, one announcement, even though both tables route it.
 	const announced = consumer.routes();
-	expect(await announced.next()).toMatchObject({ prefix: path, kind: "start", route: Route.default });
+	expect(await announced.next()).toMatchObject({ prefix: path, kind: "start", route: RouteInfo.default });
 
 	// Dropping the local publish falls back to the remote entry without a retraction.
 	local.close();
@@ -719,7 +722,7 @@ test("an identical reconnect restarts without an instance and is quiet with one"
 		const consumer = origin.consume();
 		const path = Path.from("room");
 		const announced = consumer.routes();
-		const route = Route.normalize({ instance, hops: [PEER] });
+		const route = RouteInfo.normalize({ instance, hops: [PEER] });
 
 		const old = wireOf(origin).receive(path, route);
 		expect(await announced.next()).toMatchObject({ prefix: path, kind: "start" });
@@ -730,7 +733,7 @@ test("an identical reconnect restarts without an instance and is quiet with one"
 
 		// Retracting the stale twin is quiet, and a re-price of the winner is an update.
 		old.close();
-		fresh.updateRoute({ ...route, cost: 5n });
+		wireOf(fresh).update({ ...route, cost: 5n });
 		expect(await announced.next()).toMatchObject({ prefix: path, kind: "update", route: { cost: 5n } });
 
 		fresh.close();
@@ -1024,47 +1027,56 @@ test("a seeded route still notifies when it retracts", async () => {
 	origin.close();
 });
 
-test("createBroadcast is invisible to everyone until announce", async () => {
+test("a hidden route is invisible to everyone until announce", async () => {
 	const origin = new Producer();
 	const consumer = origin.consume();
 	const path = Path.from("room");
 
-	const broadcastPublication = origin.createBroadcast(path);
-	const broadcast = broadcastPublication.broadcast;
+	const broadcastRoute = origin.route(path, { hidden: true, cost: 4n });
+	const broadcast = broadcastRoute.broadcast;
 	expect(wireOf(consumer).routes(path)).toBe(false);
 	expect(wireOf(consumer).advertised.peek()?.has(path)).toBe(false);
 	const request = consumer.request(path);
 	expect(request.active.peek()).toBeUndefined();
 
 	const announced = consumer.routes();
-	broadcastPublication.announce({ cost: 4n });
+	expect(broadcastRoute.announced).toBe(false);
+	broadcastRoute.announce();
+	expect(broadcastRoute.announced).toBe(true);
 	expect(wireOf(consumer).routes(path)).toBe(true);
 	expect(wireOf(consumer).advertised.peek()?.has(path)).toBe(true);
 	expect(await announced.next()).toMatchObject({
 		prefix: path,
 		kind: "start",
-		route: { hops: [], cost: 4n },
+		route: { instance: broadcastRoute.instance, hops: [], cost: 4n },
 	});
 	const first = request.active.peek();
-	expect(first).toBeDefined();
+	expect(first?.instance).toBe(broadcastRoute.instance);
 
 	// Off the air for local consumers and peers alike, which ends the request on it.
-	broadcastPublication.unannounce();
+	broadcastRoute.withdraw();
 	expect(wireOf(consumer).routes(path)).toBe(false);
 	expect(wireOf(consumer).advertised.peek()?.has(path)).toBe(false);
 	expect(await announced.next()).toMatchObject({ prefix: path, kind: "end" });
 	expect(request.active.peek()).toBeUndefined();
 	expect(request.closed.peek()).toBeInstanceOf(Error);
 
-	// Back on the air for a fresh request, through a fresh handle.
-	broadcastPublication.announce();
-	expect(await announced.next()).toMatchObject({ prefix: path, kind: "start" });
+	// Back on the air for a fresh request, through a fresh handle, continuing the same instance.
+	const instance = broadcastRoute.instance;
+	broadcastRoute.announce();
+	expect(await announced.next()).toMatchObject({ prefix: path, kind: "start", route: { instance } });
 	const fresh = consumer.request(path);
 	const again = fresh.active.peek();
 	expect(again).toBeDefined();
 	expect(again).not.toBe(first);
+	expect(again?.instance).toBe(instance);
 
+	// Closing the broadcast retracts the route at once, for good.
 	broadcast.close();
+	expect(broadcastRoute.announced).toBe(false);
+	expect(wireOf(consumer).routes(path)).toBe(false);
+	expect(() => broadcastRoute.announce()).toThrow("broadcast is closed");
+	expect(() => broadcastRoute.setCost(1n)).toThrow("broadcast is closed");
 	expect(await announced.next()).toMatchObject({ prefix: path, kind: "end" });
 	fresh.close();
 	request.close();
@@ -1072,6 +1084,90 @@ test("createBroadcast is invisible to everyone until announce", async () => {
 	origin.close();
 });
 
+test("closing the origin ends a hidden or withdrawn prefix route's requests", async () => {
+	const origin = new Producer();
+	const hidden = origin.routePrefix(Path.from("hidden"), { hidden: true });
+	const withdrawn = origin.routePrefix(Path.from("withdrawn"));
+	withdrawn.withdraw();
+	const pending = [hidden.requested().next(), withdrawn.requested().next()];
+
+	origin.close();
+	for (const next of await Promise.all(pending)) expect(next.done).toBe(true);
+});
+
+test("a prefix route refuses to announce or re-price once its origin closed, like an exact one", () => {
+	const origin = new Producer();
+	const prefix = origin.routePrefix(Path.from("live"));
+	const exact = origin.route(Path.from("room"));
+	origin.close();
+	expect(prefix.announced).toBe(false);
+	expect(() => prefix.announce()).toThrow("origin is closed");
+	expect(() => prefix.setCost(1n)).toThrow("origin is closed");
+	expect(() => exact.announce()).toThrow();
+	expect(() => exact.setCost(1n)).toThrow();
+});
+
+test("a prefix route can start hidden, withdraw and come back while it keeps yielding requests", async () => {
+	const origin = new Producer();
+	const consumer = origin.consume();
+	const prefix = Path.from("jobs");
+	const path = Path.from("jobs/a");
+	const route = origin.routePrefix(prefix, { hidden: true, cost: 3n });
+	expect(() => route.broadcast).toThrow("a prefix route owns no broadcast");
+	expect(route.announced).toBe(false);
+	expect(wireOf(consumer).routes(path)).toBe(false);
+	const requests = route.requested();
+
+	route.announce();
+	expect(route.announced).toBe(true);
+	expect(wireOf(consumer).advertised.peek()?.get(prefix)?.[0]?.route).toEqual(
+		RouteInfo.normalize({ instance: route.instance, cost: 3n }),
+	);
+	const first = consumer.request(path);
+	const asked = (await requests.next()).value;
+	if (!asked) throw new Error("expected a request");
+
+	// Withdrawn, the route answers nothing: the handler's late answer is dropped, and the request
+	// waits for a route, as it would between reconnects.
+	route.withdraw();
+	expect(route.announced).toBe(false);
+	expect(wireOf(consumer).routes(path)).toBe(false);
+	const dropped = new BroadcastProducer();
+	asked.serve(dropped);
+	await settle();
+	expect(first.active.peek()).toBeUndefined();
+
+	// Back under the same instance, the same iterator yields the request again.
+	const instance = route.instance;
+	route.announce();
+	expect(route.instance).toBe(instance);
+	const second = consumer.request(path);
+	const next = (await requests.next()).value;
+	if (!next) throw new Error("expected another request");
+	const source = new BroadcastProducer();
+	next.serve(source);
+	await settle();
+	for (const request of [first, second]) expect(request.active.peek()?.instance).toBe(instance);
+
+	first.close();
+	second.close();
+	dropped.close();
+	route.close();
+	expect((await requests.next()).done).toBe(true);
+	expect(() => route.announce()).toThrow("route is closed");
+	source.close();
+	origin.close();
+});
+
+test("an exact route yields no requests", async () => {
+	const origin = new Producer();
+	const route = origin.route(Path.from("room"));
+	expect((await route.requested().next()).done).toBe(true);
+	route.close();
+	expect(route.broadcast.closed.peek()).toBeNull();
+	origin.close();
+});
+
 test("a request prefers a cheaper received route over an announced local broadcast", async () => {
 	const origin = new Producer();
 	const consumer = origin.consume();
@@ -1081,11 +1177,10 @@ test("a request prefers a cheaper received route over an announced local broadca
 		origin,
 		path,
 		provider(upstream),
-		Route.normalize({ instance: INSTANCE, hops: [PEER], cost: 1n }),
+		RouteInfo.normalize({ instance: INSTANCE, hops: [PEER], cost: 1n }),
 	);
-	const localPublication = origin.createBroadcast(path);
-	const local = localPublication.broadcast;
-	localPublication.announce({ instance: INSTANCE, cost: 3n });
+	const localRoute = origin.route(path, { instance: INSTANCE, cost: 3n });
+	const local = localRoute.broadcast;
 
 	// The cheaper route is served on demand, so it resolves only once its handler answers.
 	const request = consumer.request(path);
@@ -1098,7 +1193,7 @@ test("a request prefers a cheaper received route over an announced local broadca
 
 	// Re-priced below it, the local broadcast of the same instance wins at once: the request's
 	// broadcast stays, and its tracks read the local one.
-	localPublication.announce({ instance: INSTANCE, cost: 0n });
+	localRoute.setCost(0n);
 	expect(await announced.next()).toMatchObject({
 		prefix: path,
 		kind: "update",
@@ -1125,16 +1220,25 @@ test("the cheapest received route competes with the local broadcast, not the new
 		served.push(name);
 		return upstream.consume();
 	};
-	const cheap = serve(origin, path, via("cheap"), Route.normalize({ instance: INSTANCE, hops: [PEER], cost: 1n }));
-	const pricey = serve(origin, path, via("pricey"), Route.normalize({ instance: INSTANCE, hops: [PEER], cost: 10n }));
-	const localPublication = origin.createBroadcast(path);
-	const local = localPublication.broadcast;
-	localPublication.announce({ instance: INSTANCE, cost: 5n });
+	const cheap = serve(
+		origin,
+		path,
+		via("cheap"),
+		RouteInfo.normalize({ instance: INSTANCE, hops: [PEER], cost: 1n }),
+	);
+	const pricey = serve(
+		origin,
+		path,
+		via("pricey"),
+		RouteInfo.normalize({ instance: INSTANCE, hops: [PEER], cost: 10n }),
+	);
+	const localRoute = origin.route(path, { instance: INSTANCE, cost: 5n });
+	const local = localRoute.broadcast;
 
 	await new Promise<void>((resolve) => setImmediate(resolve));
 
 	expect((await announcedView(consumer)).peek().get(path)).toEqual(
-		Route.normalize({ instance: INSTANCE, hops: [PEER], cost: 1n }),
+		RouteInfo.normalize({ instance: INSTANCE, hops: [PEER], cost: 1n }),
 	);
 	const request = consumer.request(path);
 	await settle();
@@ -1154,7 +1258,7 @@ test("the cheapest received route competes with the local broadcast, not the new
 test("a handle serves a request under live", async () => {
 	const origin = new Producer();
 	const consumer = origin.consume();
-	const handle = origin.requestsRoute(Path.from("live"));
+	const handle = origin.routePrefix(Path.from("live"));
 
 	expect(await consumer.routes().next()).toMatchObject({ prefix: Path.from("live"), kind: "start" });
 
@@ -1181,7 +1285,7 @@ test("a handle serves a request under live", async () => {
 
 test("an originated route serves held content a session delivered", async () => {
 	const origin = new Producer();
-	const handle = origin.requestsRoute(Path.from("live"));
+	const handle = origin.routePrefix(Path.from("live"));
 	const it = handle.requested();
 	const pending = wireOf(origin.consume()).demand(Path.from("live/cam"));
 	const { value: req } = await it.next();
@@ -1219,10 +1323,10 @@ test("a received route still serves a broadcast a session delivered", async () =
 
 test("a re-priced route is delivered as an update", async () => {
 	const origin = new Producer();
-	const handle = origin.requestsRoute(Path.from("live"));
+	const handle = origin.routePrefix(Path.from("live"));
 	const announced = origin.consume().routes();
 	expect(await announced.next()).toMatchObject({ prefix: Path.from("live"), kind: "start" });
-	handle.updateRoute({ cost: 5n });
+	handle.setCost(5n);
 	expect(await announced.next()).toMatchObject({ prefix: Path.from("live"), kind: "update" });
 	handle.close();
 	expect(await announced.next()).toMatchObject({ prefix: Path.from("live"), kind: "end" });
@@ -1232,7 +1336,7 @@ test("a re-priced route is delivered as an update", async () => {
 
 test("an accepted dynamic broadcast is retired when it closes, and its handle resumes", async () => {
 	const origin = new Producer();
-	const handle = origin.requestsRoute(Path.from("live"));
+	const handle = origin.routePrefix(Path.from("live"));
 	const path = Path.from("live/cam");
 	const request = origin.request(path);
 	const it = handle.requested();
@@ -1266,7 +1370,7 @@ test("an accepted dynamic broadcast is retired when it closes, and its handle re
 
 test("reject surfaces the error from demand", async () => {
 	const origin = new Producer();
-	const handle = origin.requestsRoute(Path.from("live"));
+	const handle = origin.routePrefix(Path.from("live"));
 	const consumer = origin.consume();
 	const it = handle.requested();
 	const pending = wireOf(consumer).demand(Path.from("live/cam"));
@@ -1283,11 +1387,11 @@ test("a peer is offered and served the cheapest originated route", async () => {
 	const origin = new Producer();
 	const consumer = origin.consume();
 	const prefix = Path.from("live");
-	const cheap = origin.requestsRoute(prefix, { instance: INSTANCE, cost: 1n });
-	const pricey = origin.requestsRoute(prefix, { instance: INSTANCE, cost: 10n });
+	const cheap = origin.routePrefix(prefix, { instance: INSTANCE, cost: 1n });
+	const pricey = origin.routePrefix(prefix, { instance: INSTANCE, cost: 10n });
 
 	expect(wireOf(consumer).advertised.peek()?.get(prefix)?.[0]?.route).toEqual(
-		Route.normalize({ instance: INSTANCE, cost: 1n }),
+		RouteInfo.normalize({ instance: INSTANCE, cost: 1n }),
 	);
 	const pending = wireOf(consumer).demand(Path.from("live/cam"));
 	const { value: req } = await cheap.requested().next();
@@ -1296,15 +1400,14 @@ test("a peer is offered and served the cheapest originated route", async () => {
 	expect(await pending).toBeDefined();
 
 	// An exact-path local broadcast competes with them on cost too.
-	const localPublication = origin.createBroadcast(prefix);
-	const local = localPublication.broadcast;
-	localPublication.announce({ instance: INSTANCE, cost: 5n });
+	const localRoute = origin.route(prefix, { instance: INSTANCE, cost: 5n });
+	const local = localRoute.broadcast;
 	expect(wireOf(consumer).advertised.peek()?.get(prefix)?.[0]?.route).toEqual(
-		Route.normalize({ instance: INSTANCE, cost: 1n }),
+		RouteInfo.normalize({ instance: INSTANCE, cost: 1n }),
 	);
-	localPublication.announce({ instance: INSTANCE, cost: 0n });
+	localRoute.setCost(0n);
 	expect(wireOf(consumer).advertised.peek()?.get(prefix)?.[0]?.route).toEqual(
-		Route.normalize({ instance: INSTANCE, cost: 0n }),
+		RouteInfo.normalize({ instance: INSTANCE, cost: 0n }),
 	);
 
 	local.close();
@@ -1316,7 +1419,7 @@ test("a peer is offered and served the cheapest originated route", async () => {
 
 test("a shared reject still surfaces from demand", async () => {
 	const origin = new Producer();
-	const handle = origin.requestsRoute(Path.from("live"));
+	const handle = origin.routePrefix(Path.from("live"));
 	const consumer = origin.consume();
 	const it = handle.requested();
 
@@ -1338,7 +1441,7 @@ test("a shared reject still surfaces from demand", async () => {
 
 test("a request refusal does not keep demand from asking again", async () => {
 	const origin = new Producer();
-	const handle = origin.requestsRoute(Path.from("live"));
+	const handle = origin.routePrefix(Path.from("live"));
 	const consumer = origin.consume();
 	const it = handle.requested();
 
@@ -1362,7 +1465,7 @@ test("a request refusal does not keep demand from asking again", async () => {
 
 test("advancing requested without settling rejects the previous request", async () => {
 	const origin = new Producer();
-	const handle = origin.requestsRoute(Path.from("live"));
+	const handle = origin.routePrefix(Path.from("live"));
 	const consumer = origin.consume();
 	const it = handle.requested();
 
@@ -1386,7 +1489,7 @@ test("advancing requested without settling rejects the previous request", async
 
 test("a rejected request is not asked of the same route again", async () => {
 	const origin = new Producer();
-	const handle = origin.requestsRoute(Path.from("live"));
+	const handle = origin.routePrefix(Path.from("live"));
 	const it = handle.requested();
 
 	const request = origin.request(Path.from("live/cam"));
@@ -1421,7 +1524,7 @@ test("an outranked route keeps serving until its replacement answers", async ()
 
 	const older = new BroadcastProducer();
 	const keepOlder = older.consume();
-	const disposeOlder = serve(origin, path, () => keepOlder.clone(), Route.normalize({ instance: INSTANCE }));
+	const disposeOlder = serve(origin, path, () => keepOlder.clone(), RouteInfo.normalize({ instance: INSTANCE }));
 
 	const request = consumer.request(path);
 	await settle();
@@ -1541,16 +1644,21 @@ test("a request on a replaced instance fails over to another route of it", async
 
 	const primary = new BroadcastProducer();
 	const keepPrimary = primary.consume();
-	const disposePrimary = serve(origin, path, () => keepPrimary.clone(), Route.normalize({ instance: INSTANCE }));
+	const disposePrimary = serve(origin, path, () => keepPrimary.clone(), RouteInfo.normalize({ instance: INSTANCE }));
 	const replica = new BroadcastProducer();
-	const disposeReplica = serve(origin, path, provider(replica), Route.normalize({ instance: INSTANCE, cost: 5n }));
+	const disposeReplica = serve(
+		origin,
+		path,
+		provider(replica),
+		RouteInfo.normalize({ instance: INSTANCE, cost: 5n }),
+	);
 	const request = consumer.request(path);
 	await settle();
 	const first = request.active.peek();
 	expect(first).toBeDefined();
 
 	const restarted = new BroadcastProducer();
-	const disposeRestarted = serve(origin, path, provider(restarted), Route.normalize({ instance: newer }));
+	const disposeRestarted = serve(origin, path, provider(restarted), RouteInfo.normalize({ instance: newer }));
 	await settle();
 	expect(request.active.peek()).toBe(first);
 
@@ -1589,17 +1697,16 @@ test("a request on a replaced instance fails over to a local replica of it", asy
 
 	const primary = new BroadcastProducer();
 	const keepPrimary = primary.consume();
-	const disposePrimary = serve(origin, path, () => keepPrimary.clone(), Route.normalize({ instance: INSTANCE }));
-	const localPublication = origin.createBroadcast(path);
-	const local = localPublication.broadcast;
-	localPublication.announce({ instance: INSTANCE, cost: 5n });
+	const disposePrimary = serve(origin, path, () => keepPrimary.clone(), RouteInfo.normalize({ instance: INSTANCE }));
+	const localRoute = origin.route(path, { instance: INSTANCE, cost: 5n });
+	const local = localRoute.broadcast;
 	const request = consumer.request(path);
 	await settle();
 	const first = request.active.peek();
 	expect(first).toBeDefined();
 
 	const restarted = new BroadcastProducer();
-	const disposeRestarted = serve(origin, path, provider(restarted), Route.normalize({ instance: newer }));
+	const disposeRestarted = serve(origin, path, provider(restarted), RouteInfo.normalize({ instance: newer }));
 	await settle();
 	expect(request.active.peek()).toBe(first);
 
@@ -1632,10 +1739,9 @@ test("a stale takeover's refusal leaves a request whose source came back", async
 	const path = Path.from("resumed");
 	const newer = Instance.parse("01900000-0000-7000-8000-000000000002");
 
-	const localPublication = origin.createBroadcast(path);
-	const local = localPublication.broadcast;
-	localPublication.announce({ instance: INSTANCE, cost: 2n });
-	const standby = wireOf(origin).receive(path, Route.normalize({ instance: INSTANCE, cost: 5n }));
+	const localRoute = origin.route(path, { instance: INSTANCE, cost: 2n });
+	const local = localRoute.broadcast;
+	const standby = wireOf(origin).receive(path, RouteInfo.normalize({ instance: INSTANCE, cost: 5n }));
 	const asked = standby.requested();
 	const request = consumer.request(path);
 	await settle();
@@ -1644,14 +1750,19 @@ test("a stale takeover's refusal leaves a request whose source came back", async
 
 	const restarted = new BroadcastProducer();
 	// Another instance, cheaper, wins new requests.
-	const disposeRestarted = serve(origin, path, provider(restarted), Route.normalize({ instance: newer, cost: 1n }));
+	const disposeRestarted = serve(
+		origin,
+		path,
+		provider(restarted),
+		RouteInfo.normalize({ instance: newer, cost: 1n }),
+	);
 	await settle();
 	expect(request.active.peek()).toBe(first);
 
 	// The local broadcast steps away, so the standby is asked to take over; it comes back first.
-	localPublication.unannounce();
+	localRoute.withdraw();
 	const takeover = await asked.next();
-	localPublication.announce({ instance: INSTANCE, cost: 2n });
+	localRoute.announce();
 	await settle();
 	takeover.value?.reject(new Error("too late"));
 	await settle();
@@ -1672,7 +1783,7 @@ test("a request ends when its winning source goes, even with a standby", async (
 	const path = Path.from("standby");
 
 	const standby = new BroadcastProducer();
-	const disposeStandby = serve(origin, path, provider(standby), Route.normalize({ cost: 5n }));
+	const disposeStandby = serve(origin, path, provider(standby), RouteInfo.normalize({ cost: 5n }));
 	const winner = new BroadcastProducer();
 	const keepWinner = winner.consume();
 	const disposeWinner = serve(origin, path, () => keepWinner.clone());
@@ -1702,8 +1813,8 @@ test("a request ends when its winning source goes, even with a standby", async (
 test("a refusal is terminal, never falling through to a broader route", async () => {
 	const origin = new Producer();
 	const consumer = origin.consume();
-	const narrow = origin.requestsRoute(Path.from("live"));
-	const wide = origin.requestsRoute(Path.from(""));
+	const narrow = origin.routePrefix(Path.from("live"));
+	const wide = origin.routePrefix(Path.from(""));
 	const wideRequests = wide.requested();
 	const wideAsked = wideRequests.next();
 
@@ -1730,7 +1841,7 @@ test("a better route's refusal ends a served request", async () => {
 	const consumer = origin.consume();
 	const served = new BroadcastProducer();
 	// One instance, so the narrower route serves the same instance and the request follows it.
-	const disposeWide = serve(origin, Path.from(""), provider(served), Route.normalize({ instance: INSTANCE }));
+	const disposeWide = serve(origin, Path.from(""), provider(served), RouteInfo.normalize({ instance: INSTANCE }));
 
 	const request = consumer.request(Path.from("live/cam"));
 	await settle();
@@ -1739,8 +1850,8 @@ test("a better route's refusal ends a served request", async () => {
 
 	// The narrower route is asked while the broad one keeps serving, then says no. A
 	// costlier sibling at the same prefix could serve, but is never asked.
-	const narrow = origin.requestsRoute(Path.from("live"), { instance: INSTANCE, cost: 1n });
-	const sibling = origin.requestsRoute(Path.from("live"), { instance: INSTANCE, cost: 2n });
+	const narrow = origin.routePrefix(Path.from("live"), { instance: INSTANCE, cost: 1n });
+	const sibling = origin.routePrefix(Path.from("live"), { instance: INSTANCE, cost: 2n });
 	const siblingRequests = sibling.requested();
 	const siblingAsked = siblingRequests.next();
 	const { value: req } = await narrow.requested().next();
@@ -1765,14 +1876,14 @@ test("a better route's refusal ends a served request", async () => {
 test("a refusal from a superseded route does not end the request", async () => {
 	const origin = new Producer();
 	const consumer = origin.consume();
-	const wide = origin.requestsRoute(Path.from(""));
+	const wide = origin.routePrefix(Path.from(""));
 	const wideRequests = wide.requested();
 
 	const request = consumer.request(Path.from("live/cam"));
 	const { value: stale } = await wideRequests.next();
 
 	// A narrower route takes over the pending request before the broad one answers.
-	const narrow = origin.requestsRoute(Path.from("live"));
+	const narrow = origin.routePrefix(Path.from("live"));
 	const { value: req } = await narrow.requested().next();
 	stale?.reject(new Error("unserved"));
 	await settle();
@@ -1794,7 +1905,7 @@ test("a refusal from a superseded route does not end the request", async () => {
 test("a refusal from a route a local broadcast superseded does not end the request", async () => {
 	const origin = new Producer();
 	const consumer = origin.consume();
-	const wide = origin.requestsRoute(Path.from("live"));
+	const wide = origin.routePrefix(Path.from("live"));
 	const wideRequests = wide.requested();
 
 	const request = consumer.request(Path.from("live/cam"));
@@ -1820,7 +1931,7 @@ test("a refusal from a route a local broadcast superseded does not end the reque
 
 test("close rejects queued requests as unroutable", async () => {
 	const origin = new Producer();
-	const handle = origin.requestsRoute(Path.from("live"));
+	const handle = origin.routePrefix(Path.from("live"));
 	const waiting = handle.requested().next();
 	const request = origin.request(Path.from("live/cam"));
 	const { value: req } = await waiting;
@@ -1858,9 +1969,9 @@ test("announced lists full names while covering views and session advertisements
 	const origin = new Producer();
 	const patterns = new Path.Patterns([Path.Pattern.parse("*.hang"), Path.Pattern.parse("**/*.chat")]);
 	const reader = origin.scope(Path.from("project"), patterns).consume();
-	const cam = origin.requestsRoute(Path.from("project/cam.hang"));
-	const overlap = origin.requestsRoute(Path.from("project/room/mic.hang"));
-	const chat = origin.requestsRoute(Path.from("project/lobby.chat"));
+	const cam = origin.routePrefix(Path.from("project/cam.hang"));
+	const overlap = origin.routePrefix(Path.from("project/room/mic.hang"));
+	const chat = origin.routePrefix(Path.from("project/lobby.chat"));
 	const selected = await announcedView(reader);
 	const covering = await announcedView(reader, undefined, { covering: true });
 	const all = [Path.from("cam.hang"), Path.from("lobby.chat"), Path.from("room/mic.hang")];
@@ -1868,10 +1979,10 @@ test("announced lists full names while covering views and session advertisements
 	expect([...covering.peek().keys()].sort()).toEqual(all);
 	expect(Array.from(wireOf(reader).advertised.peek()?.keys() ?? []).sort()).toEqual(all);
 
-	const nested = origin.requestsRoute(Path.from("project/room/lobby.chat"));
+	const nested = origin.routePrefix(Path.from("project/room/lobby.chat"));
 	await new Promise<void>((resolve) => setImmediate(resolve));
 	expect(selected.peek().has(Path.from("room/lobby.chat"))).toBe(true);
-	overlap.updateRoute({ cost: 2n });
+	overlap.setCost(2n);
 	overlap.close();
 	nested.close();
 	await new Promise<void>((resolve) => setImmediate(resolve));
@@ -1891,7 +2002,7 @@ test("announced filters before rooting and retains lifecycle, routing and watch
 	const interests: string[] = [];
 	const unlisten = wireOf(origin).interests((prefix, wanted) => interests.push(`${wanted ? "+" : "-"}${prefix}`));
 	const source = new BroadcastProducer();
-	const broad = origin.requestsRoute(Path.from("room"));
+	const broad = origin.routePrefix(Path.from("room"));
 	const stream = reader.routes();
 	const events = stream[Symbol.asyncIterator]();
 	const covering = await announcedView(reader, undefined, { covering: true });
@@ -1906,13 +2017,13 @@ test("announced filters before rooting and retains lifecycle, routing and watch
 	expect(request.active.peek()).toBeDefined();
 	request.close();
 
-	const exact = origin.requestsRoute(root, { instance: INSTANCE });
+	const exact = origin.routePrefix(root, { instance: INSTANCE });
 	expect(await events.next()).toMatchObject({
 		value: { kind: "start", prefix: Path.empty(), captures: expect.any(Array) },
 	});
-	exact.updateRoute({ instance: INSTANCE, cost: 2n });
+	wireOf(exact).update({ instance: INSTANCE, cost: 2n });
 	expect(await events.next()).toMatchObject({ value: { kind: "update", route: { cost: 2n } } });
-	exact.updateRoute({ instance: Instance.random() });
+	wireOf(exact).update({ instance: Instance.random() });
 	expect(await events.next()).toMatchObject({ value: { kind: "restart" } });
 	exact.close();
 	expect(await events.next()).toMatchObject({ value: { kind: "end" } });
@@ -2054,11 +2165,11 @@ test("a rooted producer shares the table and enforces its pattern union", async
 	await new Promise<void>((resolve) => setImmediate(resolve));
 	expect(request.active.peek()).toBeDefined();
 	await new Promise<void>((resolve) => setImmediate(resolve));
-	expect(() => scoped.createBroadcast(Path.from("other")).broadcast).toThrow("outside the origin scope");
+	expect(() => scoped.route(Path.from("other"), { hidden: true }).broadcast).toThrow("outside the origin scope");
 	await new Promise<void>((resolve) => setImmediate(resolve));
 	expect(() => scoped.request(Path.from("room/alice/deep"))).toThrow("outside the origin scope");
 	await new Promise<void>((resolve) => setImmediate(resolve));
-	expect(() => scoped.requestsRoute(Path.from("other"))).toThrow("outside the origin scope");
+	expect(() => scoped.routePrefix(Path.from("other"))).toThrow("outside the origin scope");
 	await new Promise<void>((resolve) => setImmediate(resolve));
 	expect(() => scoped.scope(Path.empty(), new Path.Patterns([Path.Pattern.parse("other/**")]))).toThrow(
 		"do not overlap",
@@ -2070,7 +2181,7 @@ test("a rooted producer shares the table and enforces its pattern union", async
 	await new Promise<void>((resolve) => setImmediate(resolve));
 	expect([...(await announcedView(nested)).peek().keys()]).toEqual([Path.from("alice")]);
 	await new Promise<void>((resolve) => setImmediate(resolve));
-	expect(() => nested.createBroadcast(Path.from("alice/deep")).broadcast).toThrow("outside the origin scope");
+	expect(() => nested.route(Path.from("alice/deep"), { hidden: true }).broadcast).toThrow("outside the origin scope");
 	const announced = nested.routes();
 	await new Promise<void>((resolve) => setImmediate(resolve));
 	expect(await announced.next()).toMatchObject({ kind: "start", prefix: Path.from("alice") });
@@ -2086,8 +2197,8 @@ test("closing a derived handle releases only what it registered", async () => {
 	const scoped = origin.scope(Path.empty(), new Path.Patterns([Path.Pattern.subtree(Path.from("room"))]));
 	const wide = origin.scope(Path.empty(), new Path.Patterns([Path.Pattern.all()]));
 	const inside = publish(scoped, Path.from("room/alice"));
-	const claim = scoped.requests(Path.from("room/claim"));
-	const ranked = wide.requests(Path.from("ranked"));
+	const claim = scoped.routePrefix(Path.from("room/claim"));
+	const ranked = wide.routePrefix(Path.from("ranked"));
 	const peer = serve(scoped, Path.from("room/peer"), provider(new BroadcastProducer()));
 
 	scoped.close();
@@ -2100,8 +2211,8 @@ test("closing a derived handle releases only what it registered", async () => {
 	expect([...routes.keys()]).toEqual([Path.from("lobby")]);
 
 	// A released handle refuses new work, so a borrower notices instead of publishing into nothing.
-	expect(() => scoped.createBroadcast(Path.from("room/late")).broadcast).toThrow("origin handle is closed");
-	scoped.requests(Path.from("room/late")).close();
+	expect(() => scoped.route(Path.from("room/late"), { hidden: true }).broadcast).toThrow("origin handle is closed");
+	scoped.routePrefix(Path.from("room/late")).close();
 	expect((await announcedView(origin)).peek().has(Path.from("room/late"))).toBe(false);
 
 	// The owner and fresh handles keep working.
@@ -2123,9 +2234,8 @@ test("a broadcast a derived handle released cannot announce again", async () =>
 	const consumer = origin.consume();
 	const scoped = origin.scope(Path.empty(), new Path.Patterns([Path.Pattern.all()]));
 	const path = Path.from("room");
-	const publication = scoped.createBroadcast(path);
+	const publication = scoped.route(path);
 	const broadcast = publication.broadcast;
-	publication.announce();
 	const held = await routed(consumer, path);
 
 	scoped.close();
@@ -2200,9 +2310,8 @@ test("closing a derived handle withdraws the sessions and answers attached throu
 test("a scoped dynamic only serves allowed paths and presents relative requests", async () => {
 	const origin = new Producer();
 	const scoped = origin.scope(Path.from("tenant"), new Path.Patterns([Path.Pattern.parse("room/*/chat")]));
-	const dynamic = scoped.requestsRoute(Path.from("room"));
+	const dynamic = scoped.routePrefix(Path.from("room"));
 	await new Promise<void>((resolve) => setImmediate(resolve));
-	expect(dynamic.prefix).toBe(Path.from("room"));
 	const denied = origin.request(Path.from("tenant/room/alice/video"));
 	await new Promise<void>((resolve) => setImmediate(resolve));
 	expect(denied.active.peek()).toBeUndefined();
@@ -2215,7 +2324,7 @@ test("a scoped dynamic only serves allowed paths and presents relative requests"
 	pending.value.serve(broadcast);
 	await new Promise<void>((resolve) => setImmediate(resolve));
 	expect(request.active.peek()).toBeDefined();
-	dynamic.updateRoute({ cost: 2n });
+	dynamic.setCost(2n);
 	await new Promise<void>((resolve) => setImmediate(resolve));
 	expect((await announcedView(origin)).peek().get(Path.from("tenant/room"))?.cost).toBe(2n);
 	await requests.return?.();
@@ -2248,7 +2357,7 @@ test("a scoped dynamic is announced only to readers its scope can serve", async
 	const origin = new Producer();
 	const dynamic = origin
 		.scope(Path.empty(), new Path.Patterns([Path.Pattern.parse("*/chat")]))
-		.requestsRoute(Path.empty());
+		.routePrefix(Path.empty());
 	const chat = origin.scope(Path.empty(), new Path.Patterns([Path.Pattern.parse("room/chat")]));
 	const video = origin.scope(Path.empty(), new Path.Patterns([Path.Pattern.parse("room/video")]));
 	await new Promise<void>((resolve) => setImmediate(resolve));
@@ -2265,8 +2374,8 @@ test("a scoped dynamic is announced only to readers its scope can serve", async
 
 test("a rooted reader presents the most specific covering route", async () => {
 	const origin = new Producer();
-	const narrow = origin.requestsRoute(Path.from("room/alice"), { cost: 9n });
-	const broad = origin.requestsRoute(Path.from("room"), { cost: 1n });
+	const narrow = origin.routePrefix(Path.from("room/alice"), { cost: 9n });
+	const broad = origin.routePrefix(Path.from("room"), { cost: 1n });
 	const rooted = origin.scope(Path.from("room/alice"), new Path.Patterns([Path.Pattern.all()]));
 	await new Promise<void>((resolve) => setImmediate(resolve));
 	expect((await announcedView(rooted)).peek().get(Path.empty())?.cost).toBe(9n);
@@ -2280,8 +2389,8 @@ test("a rooted reader presents the most specific covering route", async () => {
 test("a scoped reader picks the best route its scope can see at a prefix", async () => {
 	const origin = new Producer();
 	const scoped = (pattern: string) => origin.scope(Path.empty(), new Path.Patterns([Path.Pattern.parse(pattern)]));
-	const chat = scoped("*/chat").requestsRoute(Path.empty(), { cost: 1n });
-	const video = scoped("*/video").requestsRoute(Path.empty(), { cost: 5n });
+	const chat = scoped("*/chat").routePrefix(Path.empty(), { cost: 1n });
+	const video = scoped("*/video").routePrefix(Path.empty(), { cost: 5n });
 	const reader = scoped("room/video");
 
 	await new Promise<void>((resolve) => setImmediate(resolve));
@@ -2311,10 +2420,9 @@ test("a scoped reader sees a local broadcast that only loses to a route outside
 	const origin = new Producer();
 	const chat = origin
 		.scope(Path.empty(), new Path.Patterns([Path.Pattern.parse("room/*/chat")]))
-		.requestsRoute(Path.from("room/alice"), { instance: INSTANCE, cost: 0n });
-	const localPublication = origin.createBroadcast(Path.from("room/alice"));
-	const local = localPublication.broadcast;
-	localPublication.announce({ instance: INSTANCE, cost: 5n });
+		.routePrefix(Path.from("room/alice"), { instance: INSTANCE, cost: 0n });
+	const localRoute = origin.route(Path.from("room/alice"), { instance: INSTANCE, cost: 5n });
+	const local = localRoute.broadcast;
 	const reader = origin.scope(Path.empty(), new Path.Patterns([Path.Pattern.parse("room/*")]));
 
 	await new Promise<void>((resolve) => setImmediate(resolve));
@@ -2346,7 +2454,7 @@ test("broadcast handles carry the path they were created or requested at", async
 	expect(clone?.path).toBe(Path.from("room/alice"));
 
 	// A dynamic handler's standalone broadcast is named by the request, too.
-	const dynamic = origin.requestsRoute(Path.from("live"));
+	const dynamic = origin.routePrefix(Path.from("live"));
 	const request = origin.request(Path.from("live/bob"));
 	const pending = await dynamic.requested().next();
 	const served = new BroadcastProducer();
@@ -2367,9 +2475,8 @@ test("a higher epoch of a dynamic route supersedes a cheaper local broadcast of
 	const origin = new Producer();
 	const path = Path.from("camera");
 	const instance = Instance.random();
-	const localPublication = origin.createBroadcast(path);
-	localPublication.announce({ instance, epoch: 1n, cost: 0n });
-	const dynamic = origin.requestsRoute(path, { instance, epoch: 2n, cost: 10n });
+	const localRoute = origin.route(path, { instance, epoch: 1n, cost: 0n });
+	const dynamic = origin.routePrefix(path, { instance, epoch: 2n, cost: 10n });
 	const served = new BroadcastProducer();
 	const requests = dynamic.requested();
 	const request = origin.consume().request(path);
@@ -2381,7 +2488,7 @@ test("a higher epoch of a dynamic route supersedes a cheaper local broadcast of
 	request.close();
 	await requests.return?.();
 	dynamic.close();
-	localPublication.broadcast.close();
+	localRoute.broadcast.close();
 	served.close();
 	origin.close();
 });
@@ -2390,10 +2497,9 @@ test("a higher epoch that is not the best route still supersedes a local broadca
 	const origin = new Producer();
 	const path = Path.from("camera");
 	const stale = Instance.random();
-	const localPublication = origin.createBroadcast(path);
-	localPublication.announce({ instance: stale, epoch: 1n, cost: 0n });
-	const newer = origin.requestsRoute(path, { instance: stale, epoch: 2n, cost: 10n });
-	const other = origin.requestsRoute(path, { instance: Instance.random(), cost: 5n });
+	const localRoute = origin.route(path, { instance: stale, epoch: 1n, cost: 0n });
+	const newer = origin.routePrefix(path, { instance: stale, epoch: 2n, cost: 10n });
+	const other = origin.routePrefix(path, { instance: Instance.random(), cost: 5n });
 	const served = new BroadcastProducer();
 	const requests = other.requested();
 	const request = origin.consume().request(path);
@@ -2406,7 +2512,7 @@ test("a higher epoch that is not the best route still supersedes a local broadca
 	await requests.return?.();
 	other.close();
 	newer.close();
-	localPublication.broadcast.close();
+	localRoute.broadcast.close();
 	served.close();
 	origin.close();
 });
@@ -2415,23 +2521,22 @@ test("a publisher weighs a local broadcast against the routes it may forward onl
 	const origin = new Producer();
 	const path = Path.from("camera");
 	const instance = Instance.random();
-	const localPublication = origin.createBroadcast(path);
-	localPublication.announce({ instance, epoch: 1n, cost: 0n });
-	const originated = origin.requestsRoute(path, { cost: 5n });
+	const localRoute = origin.route(path, { instance, epoch: 1n, cost: 0n });
+	const originated = origin.routePrefix(path, { cost: 5n });
 	// A session delivered the higher epoch, which a publisher never forwards back out.
 	const received = wireOf(origin).receive(path, { instance, epoch: 2n, cost: 10n, hops: [PEER] });
 	expect(wireOf(origin.consume()).local(path, instance)).toBeDefined();
 	received.close();
 	originated.close();
-	localPublication.broadcast.close();
+	localRoute.broadcast.close();
 	origin.close();
 });
 
 test("a scope's merged covering prefixes never supersede across prefixes", async () => {
 	const origin = new Producer();
 	const instance = Instance.random();
-	const room = origin.requestsRoute(Path.from("room"), { instance, epoch: 2n });
-	const video = origin.requestsRoute(Path.from("room/video"), { instance, epoch: 1n });
+	const room = origin.routePrefix(Path.from("room"), { instance, epoch: 2n });
+	const video = origin.routePrefix(Path.from("room/video"), { instance, epoch: 1n });
 	const reader = origin.scope(Path.from("room/video"), new Path.Patterns([Path.Pattern.all()])).consume();
 	await settle();
 	const table = wireOf(reader).advertised.peek();
@@ -2448,14 +2553,14 @@ test("supersession only counts routes the reader can see", async () => {
 	const instance = Instance.random();
 	const video = origin
 		.scope(Path.empty(), new Path.Patterns([Path.Pattern.parse("*/video")]))
-		.requestsRoute(Path.empty(), { instance, epoch: 1n });
+		.routePrefix(Path.empty(), { instance, epoch: 1n });
 	const live = await announcedView(origin, Path.Pattern.parse("room/video"), { covering: true });
 	await settle();
 	expect(live.peek().size).toBe(1);
 	// A higher epoch the reader cannot see never hides the route it can.
 	const chat = origin
 		.scope(Path.empty(), new Path.Patterns([Path.Pattern.parse("*/chat")]))
-		.requestsRoute(Path.empty(), { instance, epoch: 2n });
+		.routePrefix(Path.empty(), { instance, epoch: 2n });
 	await settle();
 	expect([...live.peek().values()].map((route) => route.epoch)).toEqual([1n]);
 	chat.close();
@@ -2470,9 +2575,8 @@ test("the newest epoch of an instance is announced in place over a cheaper one",
 	const announced = consumer.routes();
 	const instance = Instance.random();
 
-	const oldPublication = origin.createBroadcast(path);
-	const old = oldPublication.broadcast;
-	oldPublication.announce({ instance, epoch: 1n, cost: 1n });
+	const oldRoute = origin.route(path, { instance, epoch: 1n, cost: 1n });
+	const old = oldRoute.broadcast;
 	expect(await announced.next()).toMatchObject({ prefix: path, kind: "start" });
 
 	// A higher epoch of the same instance supersedes it despite the cost: the same stream.
@@ -2498,14 +2602,14 @@ test("demand held across an instance change asks again, unless it named the old
 	const origin = new Producer();
 	const consumer = origin.consume();
 	const path = Path.from("live/cam");
-	const handle = origin.requestsRoute(Path.from("live"), { instance: INSTANCE });
+	const handle = origin.routePrefix(Path.from("live"), { instance: INSTANCE });
 	const it = handle.requested();
 	const pinned = wireOf(consumer).demand(path, INSTANCE);
 	const unpinned = wireOf(consumer).demand(path);
 	const { value: req } = await it.next();
 
 	// Another instance now serves the route: the old handler's answer is for the old one.
-	handle.updateRoute({ ...handle.route, instance: NEWER });
+	wireOf(handle).update({ ...wireOf(handle).info, instance: NEWER });
 	req.serve(new BroadcastProducer().consume());
 	await expect(pinned).rejects.toThrow("unroutable");
 
@@ -2527,13 +2631,13 @@ test("a demand refused across an instance change does not lose the carried deman
 	const origin = new Producer();
 	const consumer = origin.consume();
 	const path = Path.from("live/cam");
-	const handle = origin.requestsRoute(Path.from("live"), { instance: INSTANCE });
+	const handle = origin.routePrefix(Path.from("live"), { instance: INSTANCE });
 	const it = handle.requested();
 	const unpinned = wireOf(consumer).demand(path);
 	const pinned = wireOf(consumer).demand(path, INSTANCE);
 	await it.next();
 
-	handle.updateRoute({ ...handle.route, instance: NEWER });
+	wireOf(handle).update({ ...wireOf(handle).info, instance: NEWER });
 	await expect(pinned).rejects.toThrow("unroutable");
 	// The replacement's refusal reaches the demand that carried over.
 	(await it.next()).value?.reject(new Error("gone"));
@@ -2547,14 +2651,14 @@ test("a demand refused across an instance change does not lose the carried deman
 test("demand held across an instance round trip still asks again", async () => {
 	const origin = new Producer();
 	const path = Path.from("live/cam");
-	const handle = origin.requestsRoute(Path.from("live"), { instance: INSTANCE });
+	const handle = origin.routePrefix(Path.from("live"), { instance: INSTANCE });
 	const it = handle.requested();
 	const demanded = wireOf(origin.consume()).demand(path);
 	const { value: req } = await it.next();
 
 	// Released by the first change; the instance coming back does not undo that.
-	handle.updateRoute({ ...handle.route, instance: NEWER });
-	handle.updateRoute({ ...handle.route, instance: INSTANCE });
+	wireOf(handle).update({ ...wireOf(handle).info, instance: NEWER });
+	wireOf(handle).update({ ...wireOf(handle).info, instance: INSTANCE });
 	req.serve(new BroadcastProducer().consume());
 
 	const next = new BroadcastProducer();
@@ -2573,18 +2677,18 @@ test("demand held across an instance round trip still asks again", async () => {
 
 test("re-pricing from the current route keeps the instance", () => {
 	const origin = new Producer();
-	const handle = origin.requestsRoute(Path.from("live"), { instance: INSTANCE, cost: 5n });
-	handle.updateRoute({ ...handle.route, cost: 1n });
-	expect(handle.route).toEqual(Route.normalize({ instance: INSTANCE, cost: 1n }));
+	const handle = origin.routePrefix(Path.from("live"), { instance: INSTANCE, cost: 5n });
+	handle.setCost(1n);
+	expect(wireOf(handle).info).toEqual(RouteInfo.normalize({ instance: INSTANCE, cost: 1n }));
 
-	const broadcastPublication = origin.createBroadcast(Path.from("room"));
-	const broadcast = broadcastPublication.broadcast;
-	expect(broadcastPublication.route).toBeUndefined();
-	broadcastPublication.announce({ instance: INSTANCE, cost: 5n });
-	broadcastPublication.announce({ ...broadcastPublication.route, cost: 1n });
-	expect(broadcastPublication.route).toEqual(Route.normalize({ instance: INSTANCE, cost: 1n }));
-	broadcastPublication.unannounce();
-	expect(broadcastPublication.route).toBeUndefined();
+	const broadcastRoute = origin.route(Path.from("room"), { hidden: true, instance: INSTANCE, cost: 5n });
+	const broadcast = broadcastRoute.broadcast;
+	expect(wireOf(broadcastRoute).info).toBeUndefined();
+	broadcastRoute.announce();
+	broadcastRoute.setCost(1n);
+	expect(wireOf(broadcastRoute).info).toEqual(RouteInfo.normalize({ instance: INSTANCE, cost: 1n }));
+	broadcastRoute.withdraw();
+	expect(wireOf(broadcastRoute).info).toBeUndefined();
 
 	broadcast.close();
 	handle.close();
@@ -2595,9 +2699,8 @@ test("a peer naming another instance is refused rather than served a different i
 	const origin = new Producer();
 	const consumer = origin.consume();
 	const path = Path.from("room");
-	const localPublication = origin.createBroadcast(path);
-	const local = localPublication.broadcast;
-	localPublication.announce({ instance: INSTANCE });
+	const localRoute = origin.route(path, { instance: INSTANCE });
+	const local = localRoute.broadcast;
 
 	expect(wireOf(consumer).local(path, INSTANCE)).toBeDefined();
 	const other = Instance.parse("01900000-0000-7000-8000-000000000002");
@@ -2611,18 +2714,16 @@ test("a peer naming another instance is refused rather than served a different i
 test("a newer instance ends pinned and unpinned requests on the replaced publisher alike", () => {
 	const origin = new Producer();
 	const path = Path.from("room");
-	const first = origin.createBroadcast(path);
-	first.announce({ instance: INSTANCE });
+	const first = origin.route(path, { instance: INSTANCE });
 	const reader = origin.consume();
 	const pinned = reader.request(path, { instance: INSTANCE });
 	const unpinned = reader.request(path);
 	expect(pinned.active.peek()?.instance).toBe(INSTANCE);
 	expect(unpinned.active.peek()?.instance).toBe(INSTANCE);
 	const replacement = Instance.parse("01900000-0000-7000-8000-000000000002");
-	const second = origin.createBroadcast(path);
-	second.announce({ instance: replacement });
-	expect(() => first.announce({ instance: INSTANCE })).toThrow("broadcast is closed");
-	first.unannounce();
+	origin.route(path, { instance: replacement });
+	expect(() => first.announce()).toThrow("broadcast is closed");
+	first.withdraw();
 	expect(pinned.active.peek()).toBeUndefined();
 	// The replaced publisher closed: the unpinned request ends rather than move to the newer one.
 	expect(unpinned.active.peek()).toBeUndefined();
@@ -2642,12 +2743,12 @@ test("a request held across an instance change asks again and never takes the ol
 	const origin = new Producer();
 	const prefix = Path.from("room");
 	const path = Path.from("room/cam");
-	const dynamic = origin.requestsRoute(prefix, { instance: INSTANCE });
+	const dynamic = origin.routePrefix(prefix, { instance: INSTANCE });
 	const unpinned = origin.consume().request(path);
 	const pinned = origin.consume().request(path, { instance: INSTANCE });
 	const requests = dynamic.requested();
 	const old = (await requests.next()).value;
-	dynamic.updateRoute({ ...dynamic.route, instance: NEWER });
+	wireOf(dynamic).update({ ...wireOf(dynamic).info, instance: NEWER });
 	const current = origin.consume().request(path, { instance: NEWER });
 	old.serve(new BroadcastProducer().consume());
 	await settle();
@@ -2675,9 +2776,9 @@ test.each([
 	const origin = new Producer();
 	const prefix = Path.from("live");
 	const path = Path.from("live/cam");
-	const dynamic = origin.requestsRoute(prefix, { instance: named });
+	const dynamic = origin.routePrefix(prefix, { instance: named });
 	// A claim naming no instance serves one of its own.
-	const from = dynamic.route.instance;
+	const from = dynamic.instance;
 	expect(from).toBeDefined();
 	if (named !== undefined) expect(from).toBe(named);
 	const to = NEWER;
@@ -2698,7 +2799,7 @@ test.each([
 	expect((await sticky?.recvGroup())?.sequence).toBe(0n);
 
 	// A re-price at the same instance keeps every handle, and the handler is not asked again.
-	dynamic.updateRoute({ ...dynamic.route, cost: 5n });
+	dynamic.setCost(5n);
 	expect(await announced.next()).toMatchObject({ prefix, kind: "update" });
 	expect(held.active.peek()).toBe(resolved);
 	const same = origin.consume().request(path);
@@ -2707,7 +2808,7 @@ test.each([
 	const pinned = origin.consume().request(path, { instance: from });
 
 	// Another instance is another stream: resolved requests keep the old one.
-	dynamic.updateRoute({ ...dynamic.route, instance: to });
+	wireOf(dynamic).update({ ...wireOf(dynamic).info, instance: to });
 	expect(await announced.next()).toMatchObject({ prefix, kind: "restart" });
 	await settle();
 	expect(held.active.peek()).toBe(resolved);
@@ -2762,14 +2863,14 @@ test.each([
 test("an instance update does not retain an answer that already closed", async () => {
 	const origin = new Producer();
 	const path = Path.from("live/cam");
-	const dynamic = origin.requestsRoute(Path.from("live"), { instance: INSTANCE });
+	const dynamic = origin.routePrefix(Path.from("live"), { instance: INSTANCE });
 	const requests = dynamic.requested();
 	const held = origin.consume().request(path);
 	const old = new BroadcastProducer();
 	(await requests.next()).value.serve(old);
 	old.close();
 	// The server's closure callback has not removed the answer yet.
-	dynamic.updateRoute({ instance: NEWER });
+	wireOf(dynamic).update({ instance: NEWER });
 	try {
 		expect(held.closed.peek()).toBeInstanceOf(Error);
 		expect(held.active.peek()).toBeUndefined();
@@ -2790,13 +2891,13 @@ test("an instance update does not retain an answer that already closed", async (
 test("an unread resolved request retains its broadcast until its last handle closes", async () => {
 	const origin = new Producer();
 	const path = Path.from("live/cam");
-	const dynamic = origin.requestsRoute(Path.from("live"), { instance: INSTANCE });
+	const dynamic = origin.routePrefix(Path.from("live"), { instance: INSTANCE });
 	const requests = dynamic.requested();
 	const held = origin.consume().request(path);
 	const old = new SessionBroadcast();
 	(await requests.next()).value.serve(old);
 	// Change instances before the active getter or its subscription can clone the answer.
-	dynamic.updateRoute({ instance: NEWER });
+	wireOf(dynamic).update({ instance: NEWER });
 	expect(old.closed.peek()).toBeUndefined();
 	expect(held.active.peek()?.instance).toBe(INSTANCE);
 	held.close();
@@ -2810,7 +2911,7 @@ test("an unread resolved request retains its broadcast until its last handle clo
 test("a session's re-request after an instance update asks the handler again", async () => {
 	const origin = new Producer();
 	const path = Path.from("live/cam");
-	const dynamic = origin.requestsRoute(Path.from("live"), { instance: INSTANCE });
+	const dynamic = origin.routePrefix(Path.from("live"), { instance: INSTANCE });
 	const requests = dynamic.requested();
 	const wire = wireOf(origin.consume());
 
@@ -2819,7 +2920,7 @@ test("a session's re-request after an instance update asks the handler again", a
 	(await requests.next()).value.serve(old);
 	expect(await before).toBeDefined();
 
-	dynamic.updateRoute({ ...dynamic.route, instance: NEWER });
+	wireOf(dynamic).update({ ...wireOf(dynamic).info, instance: NEWER });
 	const after = wire.demand(path);
 	const next = new BroadcastProducer();
 	const track = next.createTrack("video");
@@ -2840,8 +2941,8 @@ test("an update does not override route selection: another claim at the instance
 	const origin = new Producer();
 	const prefix = Path.from("live");
 	const path = Path.from("live/cam");
-	const first = origin.requestsRoute(prefix, { instance: INSTANCE, cost: 1n });
-	const second = origin.requestsRoute(prefix, { instance: INSTANCE, cost: 5n });
+	const first = origin.routePrefix(prefix, { instance: INSTANCE, cost: 1n });
+	const second = origin.routePrefix(prefix, { instance: INSTANCE, cost: 5n });
 	const firstRequests = first.requested();
 	const secondRequests = second.requested();
 
@@ -2854,7 +2955,7 @@ test("an update does not override route selection: another claim at the instance
 	// The first claim moves to another instance priced above the second, which still serves
 	// the old one: the resolved request keeps its answer, and new requests go through the
 	// second claim.
-	first.updateRoute({ ...first.route, instance: NEWER, cost: 9n });
+	wireOf(first).update({ ...wireOf(first).info, instance: NEWER, cost: 9n });
 	const fresh = origin.consume().request(path);
 	const replacement = new BroadcastProducer();
 	const track = replacement.createTrack("video");
@@ -2878,14 +2979,13 @@ test("an update does not override route selection: another claim at the instance
 	origin.close();
 });
 
-test("a route naming no instance resolves a handle under the one its publication minted", () => {
+test("a route naming no instance resolves a handle under the one it minted", () => {
 	const origin = new Producer();
 	const path = Path.from("room");
-	const broadcast = origin.createBroadcast(path);
-	broadcast.announce();
+	const broadcast = origin.route(path);
 	const request = origin.consume().request(path);
-	expect(broadcast.route?.instance).toBeDefined();
-	expect(request.active.peek()?.instance).toBe(broadcast.route?.instance);
+	expect(broadcast.instance).toBeDefined();
+	expect(request.active.peek()?.instance).toBe(broadcast.instance);
 	request.close();
 	origin.close();
 });
@@ -2893,19 +2993,18 @@ test("a route naming no instance resolves a handle under the one its publication
 test("public announcements saturate static costs and refuse invalid cost shapes", async () => {
 	const origin = new Producer();
 	const path = Path.from("priced");
-	const broadcastPublication = origin.createBroadcast(path);
-	const broadcast = broadcastPublication.broadcast;
+	const broadcastRoute = origin.route(path, { hidden: true });
+	const broadcast = broadcastRoute.broadcast;
 	const view = await announcedView(origin);
-	broadcastPublication.announce({ cost: 2n ** 64n - 1n });
+	broadcastRoute.setCost(2n ** 64n - 1n);
+	broadcastRoute.announce();
 	await settle();
 	await new Promise<void>((resolve) => setImmediate(resolve));
 	expect(view.peek().get(path)?.cost).toBe(2n ** 62n - 1n);
 	await new Promise<void>((resolve) => setImmediate(resolve));
-	expect(() => broadcastPublication.announce({ cost: -1n })).toThrow(RangeError);
+	expect(() => broadcastRoute.setCost(-1n)).toThrow(RangeError);
 	await new Promise<void>((resolve) => setImmediate(resolve));
-	expect(() => broadcastPublication.announce({ cost: { warm: 1n, cold: 2n } } as unknown as Route)).toThrow(
-		RangeError,
-	);
+	expect(() => broadcastRoute.setCost({ warm: 1n, cold: 2n } as unknown as Cost)).toThrow(RangeError);
 	broadcast.close();
 	origin.close();
 });
@@ -2915,14 +3014,14 @@ test("published names refuse navigation segments", () => {
 	try {
 		for (const name of ["room/./cam", "room/../cam", ".", ".."]) {
 			const path = Path.from(name);
-			expect(() => origin.createBroadcast(path).broadcast).toThrow();
-			expect(() => origin.requests(path)).toThrow();
-			expect(() => wireOf(origin).receive(path, Route.default)).toThrow();
+			expect(() => origin.route(path, { hidden: true }).broadcast).toThrow();
+			expect(() => origin.routePrefix(path)).toThrow();
+			expect(() => wireOf(origin).receive(path, RouteInfo.default)).toThrow();
 		}
 		const scoped = origin.scope(Path.from("room/.."), new Path.Patterns([Path.Pattern.all()]));
-		expect(() => scoped.createBroadcast(Path.from("cam")).broadcast).toThrow();
+		expect(() => scoped.route(Path.from("cam"), { hidden: true }).broadcast).toThrow();
 		for (const path of ["room/.pro/cam", "room/a..b", "room/cam"]) {
-			origin.createBroadcast(Path.from(path)).broadcast.close();
+			origin.route(Path.from(path), { hidden: true }).broadcast.close();
 		}
 	} finally {
 		origin.close();
diff --git a/js/net/src/origin.ts b/js/net/src/origin.ts
index ca062735965..963a6e40ff4 100644
--- a/js/net/src/origin.ts
+++ b/js/net/src/origin.ts
@@ -13,9 +13,10 @@
 import { Derived, type Dispose, type GetPromise, type Getter, Once, race, Signal } from "@moq/signals";
 import type * as Announce from "./announce.ts";
 import * as announce from "./announced.ts";
+import type { Credential } from "./auth.ts";
 import * as broadcast from "./broadcast.ts";
 import { StreamCode, StreamError } from "./error.ts";
-import { Route, routesEqual } from "./hop.ts";
+import { type Cost, RouteInfo, routesEqual } from "./hop.ts";
 import * as Instance from "./instance.ts";
 import {
 	compareRouteCandidates,
@@ -43,7 +44,7 @@ import {
 	wireOf,
 } from "./wire.ts";
 
-export type { Cost, Hop, Route } from "./hop.ts";
+export type { Cost, Hop, RouteInfo } from "./hop.ts";
 export { HopSchema, isAnonymous } from "./hop.ts";
 
 /** The rooted permissions shared by a handle and every route it inserts. */
@@ -243,10 +244,8 @@ class CoveringRoot {
  * A refusal is terminal, even while another source still serves: the slot ends, every handle
  * closes with the handler's error, and the slot leaves the table, so the next request asks
  * afresh. A refusal never falls through to a broader prefix or another advertiser.
- *
- * @internal
  */
-export interface RequestSlot {
+interface RequestSlot {
 	/** Open plain handles that can use a peer without discovery. */
 	blind: number;
 	answer?: broadcast.Consumer;
@@ -281,15 +280,13 @@ interface Resolution {
  * The preferred entry per prefix is the one requests resolve through. An originated
  * entry is forwarded by sessions; a received one is not, so a shared origin
  * cannot echo a peer's announcements back to it.
- *
- * @internal
  */
-export interface RouteEntry {
+interface RouteEntry {
 	readonly identity: object;
 	readonly scope: Scope;
 	/** The paths the entry may serve beneath its prefix, when its producer is scoped. */
 	readonly claim?: Path.Patterns;
-	readonly route: Signal<Route>;
+	readonly route: Signal<RouteInfo>;
 	readonly originated: boolean;
 	readonly server?: ServeState;
 }
@@ -321,7 +318,7 @@ function preferredEntry(
 	prefix: Path.Valid,
 	entries: readonly RouteEntry[],
 	skip?: (entry: RouteEntry) => boolean,
-	others: readonly Route[] = [],
+	others: readonly RouteInfo[] = [],
 ): RouteEntry | undefined {
 	const eligible = entries.filter((entry) => !skip?.(entry));
 	// `others` compete at the prefix too, such as a broadcast announced here at the path.
@@ -359,7 +356,7 @@ function unroutable(): StreamError {
 // A selected handler refused these requests; a coalesced route gap can have the same error.
 const refusedRequests = new WeakSet<GetPromise<Error | null>>();
 
-/** A served route from {@link Producer.requests}: the queue a handler drains. */
+/** A prefix route's queue of requests, from {@link Producer.routePrefix}: what a handler drains. */
 class ServeState {
 	readonly root: Path.Valid;
 	/** The prefix the route claims; every served path is at or beneath it. */
@@ -531,7 +528,7 @@ class OriginState {
 	// directions echo-free.
 	created: Map<Path.Valid, Created> | undefined = new Map();
 	local = new VersionedSignal<Map<Path.Valid, broadcast.Consumer> | undefined>(new Map());
-	advertisedLocal = new VersionedSignal<Map<Path.Valid, Route> | undefined>(new Map());
+	advertisedLocal = new VersionedSignal<Map<Path.Valid, RouteInfo> | undefined>(new Map());
 	routes = new VersionedSignal<Map<Path.Valid, RouteEntry[]> | undefined>(new Map());
 
 	#snapshotVersion = "";
@@ -572,7 +569,7 @@ class OriginState {
 		for (const [path, front] of this.local.peek() ?? []) {
 			const local = {
 				identity: front,
-				route: advertised?.get(path) ?? Route.default,
+				route: advertised?.get(path) ?? RouteInfo.default,
 				exact: true,
 			};
 			const list = out.get(path);
@@ -591,6 +588,10 @@ class OriginState {
 	// republish diffs as retract-then-announce and a re-price as another active.
 	originated = new Signal<Advertisements | undefined>(new Map());
 
+	// Every open prefix route's server, advertised or not, so the origin's close ends each
+	// handler loop even for a route that is hidden or withdrawn.
+	servers = new Set<ServeState>();
+
 	// Broadcasts materialized from a served route, keyed by exact path. Shared by every
 	// request for the path so repeats reuse one accept; dropped (and closed) when the
 	// providing route goes away or the last request releases it.
@@ -1234,25 +1235,54 @@ export interface Reader {
  * @public
  */
 export interface Table extends Reader {
-	/** Create an unannounced broadcast at `path`; see {@link Producer.createBroadcast}. */
-	createBroadcast(path: Path.Valid): Publication;
-
-	/** Advertise a prefix and serve requests under it; see {@link Producer.requests}. */
-	requests(prefix: Path.Valid): Requests;
-
-	/** Insert a route with protocol metadata. @internal */
-	requestsRoute(
-		prefix: Path.Valid,
-		route?:
-			| Route
-			| {
-					instance?: Route["instance"];
-					epoch?: Route["epoch"];
-					hops?: Route["hops"];
-					cost?: Route["cost"];
-					auth?: Route["auth"];
-			  },
-	): Requests;
+	/** Create a route at exactly `path`, owning a new broadcast; see {@link Producer.route}. */
+	route(path: Path.Valid, options?: RouteOptions): Route;
+
+	/** Create a route over `prefix` that yields requests; see {@link Producer.routePrefix}. */
+	routePrefix(prefix: Path.Valid, options?: RouteOptions): Route;
+}
+
+/**
+ * How an application advertises a {@link Route}: its visibility at creation, its price, its
+ * credential, and, rarely, a stable instance.
+ *
+ * The default announces at once, at cost 0, under the session's scope, serving a fresh random
+ * instance minted when the route is created.
+ */
+export interface RouteOptions {
+	/**
+	 * Create the route hidden: it exists for nobody until {@link Route.announce}. For a
+	 * publisher that fills its catalog first, or answers a negotiation, before readers may find it.
+	 */
+	hidden?: boolean;
+	/**
+	 * What pulling content via this route costs: lower wins among routes covering the same
+	 * prefix and anonymity. A publisher prices content it already produces at zero, and content
+	 * it would have to start producing on demand higher.
+	 */
+	cost?: Cost;
+	/**
+	 * The credential the advertising request carries, from `auth.add()`. Only a session built
+	 * on the handle that issued it presents it, as the token on its moq-transport
+	 * PUBLISH_NAMESPACE; every other session advertises the route under its own scope.
+	 */
+	auth?: Credential;
+	/**
+	 * Serve this stable instance in place of a freshly minted one.
+	 *
+	 * Only for a publisher that continues the instance's sequence space across restarts,
+	 * announcing a higher {@link epoch} each time, such as a counter persisted on disk. Readers
+	 * stitch every route of one instance together, so a publisher that restarts its group
+	 * sequences under an old instance splices unrelated groups into their tracks. The highest
+	 * epoch wins over every older one of the instance, cheaper or not. Naming an instance grants
+	 * nothing: publishing still needs the path's grant.
+	 *
+	 * Do not start a named instance with `~`: that marks one a relay minted (see
+	 * {@link Instance.isMinted}), which signing refuses to bind and a catalog's instance check skips.
+	 */
+	instance?: Instance.Valid;
+	/** Which incarnation of {@link instance} this is; raise it on each restart. Ignored without an instance. */
+	epoch?: bigint;
 }
 
 /** Options for resolving one publisher instance with {@link Consumer.request}. */
@@ -1267,8 +1297,12 @@ export interface FollowOptions {
 	instance?: Instance.Valid;
 }
 
+// Route constructors, assigned in the classes' static blocks so neither class exposes one.
+let makeRoute: (control: RouteControl) => Route;
+let exactRoute: (producer: Producer, path: Path.Valid, options: RouteOptions, request: Request) => Route;
+
 /**
- * The write side of an origin: create broadcasts by path and advertise them.
+ * The write side of an origin: route broadcasts into it by path and advertise them.
  *
  * Independent of any connection. A connection given this origin (via its `publish` option)
  * announces and serves the table's originated advertisements for as long as the session
@@ -1276,10 +1310,10 @@ export interface FollowOptions {
  * the origin down. A reconnecting session re-announces the table on each attach, so
  * advertisements made while offline surface on the next connection.
  *
- * Create a broadcast, populate its tracks, then {@link Publication.announce}: an
- * exact-path subscribe before the tracks exist is refused, and nobody can see or reach a
- * broadcast until it announces. To publish broadcasts on demand instead, claim a prefix with
- * {@link requests} and answer the requests beneath it.
+ * Create a {@link route} at a path and fill its broadcast; create it hidden and
+ * {@link Route.announce} it once its first tracks exist, since nobody can see or reach a hidden
+ * route. To publish broadcasts on demand instead, claim a prefix with {@link routePrefix} and
+ * answer the requests beneath it.
  *
  * @public
  */
@@ -1297,6 +1331,10 @@ export class Producer implements Table {
 	// identity across reads.
 	#reader = makeConsumer(this.#state, this.#scope);
 
+	static {
+		exactRoute = (producer, path, options, request) => producer.#exact(path, options, request);
+	}
+
 	constructor() {
 		const thisProducer = this;
 		registerWire(this, {
@@ -1331,7 +1369,7 @@ export class Producer implements Table {
 				return thisProducer.#requests;
 			},
 			changed: () => this.#changed(),
-			blind: (slot) => this.#state.blind(slot),
+			blind: (slot) => this.#state.blind(slot as RequestSlot),
 			answer: (path, front) => this.#answer(this.#scope.path(path), front),
 			routes: (path) => wireOf(this.#reader).routes(path),
 		});
@@ -1361,52 +1399,48 @@ export class Producer implements Table {
 	}
 
 	/**
-	 * Create a broadcast at `path`, returning its publication handle.
+	 * Create a route at exactly `path`, owning a new broadcast to fill.
 	 *
-	 * The broadcast exists for nobody until {@link Publication.announce}: announce
-	 * streams skip it and requests for its path find nothing, on this origin exactly as at
-	 * a peer. Announce once its tracks exist; {@link Publication.unannounce}
-	 * withdraws it from everyone again.
+	 * This is how local content enters an origin. Fill the broadcast through
+	 * {@link Route.broadcast}. The route serves a fresh random instance, minted here and kept
+	 * for its lifetime, across {@link Route.withdraw} and {@link Route.announce}, since its
+	 * sequences continue: a new route is a new stream that never splices into an old one. A
+	 * publisher that continues one sequence space across restarts may name a stable instance
+	 * instead ({@link RouteOptions.instance}).
 	 *
-	 * Close the producer to drop it. Creating a path again supersedes the previous
-	 * broadcast: the origin retracts and closes the old one, and tracks already subscribed
-	 * keep serving until they end. The broadcast serves a fresh random {@link Route.instance},
-	 * kept across announce, unannounce and re-announce, so a restart is a new stream rather
-	 * than a splice into the old one; at the same instance, a local broadcast competes on cost
-	 * and wins ties. A publisher that continues one sequence space across restarts may name a
-	 * stable instance instead.
+	 * Announced at once unless created {@link RouteOptions.hidden | hidden}. A hidden route
+	 * exists for nobody until {@link Route.announce}: announce streams skip it and a request
+	 * for its path finds nothing, on this origin exactly as at a peer. Create it hidden when
+	 * the tracks a subscriber needs first, such as a catalog, are not there yet. To serve paths
+	 * on demand without publishing each one, use {@link routePrefix}.
+	 *
+	 * Closing the route retracts it and closes its broadcast, and so does closing the
+	 * broadcast. Creating a path again supersedes the previous route: the origin retracts it
+	 * and closes its broadcast, and tracks already subscribed keep serving until they end. At
+	 * the same instance, a local broadcast competes on cost and wins ties.
 	 */
-	createBroadcast(path: Path.Valid): Publication {
+	route(path: Path.Valid, options: RouteOptions = {}): Route {
+		return this.#exact(path, options);
+	}
+
+	/** An exact route at `path`, answering `request` on its first announce when it is a job's. */
+	#exact(path: Path.Valid, options: RouteOptions, request?: Request): Route {
 		path = this.#scope.path(path);
 		if (this.#borrowed?.closed) throw new Error("origin handle is closed");
 		publishPath(path);
 		const created = this.#state.created;
 		if (!created) throw new Error("origin is closed");
+		// Normalized first, so a bad cost throws before anything is created.
+		let info = RouteInfo.normalize({
+			instance: options.instance ?? Instance.random(),
+			epoch: options.instance === undefined ? 0n : options.epoch,
+			cost: options.cost,
+			auth: options.auth,
+		});
 
 		const producer = new broadcast.Producer();
 		hooks.stampPath(producer, path);
 		const front = producer.consume();
-		// The publication's own stream, kept across announce, unannounce and re-announce since
-		// its sequences continue. A route naming another instance replaces it.
-		let instance = Instance.random();
-		let epoch = 0n;
-
-		const announcer: broadcast.Announcer = {
-			announce: (route) => {
-				if (route.instance !== undefined) {
-					instance = route.instance;
-					epoch = route.epoch ?? 0n;
-				}
-				this.#advertiseExact(path, front, { ...route, instance, epoch });
-			},
-			unannounce: () => this.#retractExact(path, front),
-			route: () =>
-				this.#state.local.peek()?.get(path) === front
-					? this.#state.advertisedLocal.peek()?.get(path)
-					: undefined,
-		};
-		hooks.attachAnnouncer(producer, announcer);
-
 		const entry = { producer, front };
 		const previous = created.get(path);
 		created.set(path, entry);
@@ -1415,20 +1449,71 @@ export class Producer implements Table {
 			retire(previous);
 		}
 
-		// Drop it when the broadcast closes, unless a recreate already replaced it: a stale
-		// broadcast closing must not unpublish the live one. Clearing `created` also stops a
-		// later announce.
+		// The request a job's route answers when it first announces.
+		let pending = request;
+		// Drop the route when its broadcast closes, unless a recreate already replaced it: a
+		// stale broadcast closing must not unpublish the live one. Clearing `created` also stops
+		// a later announce. A job's unanswered request can never be answered now.
 		const release = this.#hold(() => {
+			stop();
 			this.#retractExact(path, front);
-			if (this.#state.created?.get(path) === entry) this.#state.created.delete(path);
+			if (created.get(path) === entry) created.delete(path);
 			retire(entry);
+			const job = pending;
+			pending = undefined;
+			if (job) rejectJob(job, unroutable());
 		});
-		void front.closed.then(release);
+		// Synchronous, so a request made right after the broadcast closes finds it gone.
+		const stop = hooks.onClosed(producer, release);
+
+		const announced = () => this.#state.local.peek()?.get(path) === front;
+		const announce = () => {
+			if (producer.closed.peek() !== undefined) throw new Error("broadcast is closed");
+			const job = pending;
+			if (!job) {
+				this.#advertiseExact(path, front, info);
+				return;
+			}
+			pending = undefined;
+			try {
+				// A request released meanwhile can never be answered, so this route never announces.
+				if (!jobPending(job)) throw unroutable();
+				this.#advertiseExact(path, front, info);
+			} catch (err) {
+				release();
+				rejectJob(job, err instanceof Error ? err : new Error(String(err)));
+				throw err;
+			}
+			answerJob(job);
+		};
+		const change = (next: RouteInfo) => {
+			if (producer.closed.peek() !== undefined) throw new Error("broadcast is closed");
+			if (!this.#state.created) throw new Error("origin is closed");
+			info = next;
+			if (announced()) this.#advertiseExact(path, front, info);
+		};
 
-		return makePublication(producer, announcer);
+		const route = makeRoute({
+			broadcast: producer,
+			instance: () => info.instance as Instance.Valid,
+			announce,
+			withdraw: () => this.#retractExact(path, front),
+			announced,
+			change: (update) => change(RouteInfo.normalize({ ...info, ...update })),
+			requested: async function* () {},
+			close: release,
+			info: () => (announced() ? this.#state.advertisedLocal.peek()?.get(path) : undefined),
+			update: (next) => {
+				const named = RouteInfo.normalize(next);
+				info = named.instance === undefined ? { ...named, instance: info.instance, epoch: info.epoch } : named;
+				announce();
+			},
+		});
+		if (!options.hidden) announce();
+		return route;
 	}
 
-	#advertiseExact(path: Path.Valid, front: broadcast.Consumer, route: Route): void {
+	#advertiseExact(path: Path.Valid, front: broadcast.Consumer, route: RouteInfo): void {
 		if (!this.#state.local.peek()) throw new Error("origin is closed");
 		if (this.#state.created?.get(path)?.front !== front) throw new Error("broadcast is closed");
 		// Both maps move together, so every reader sees the broadcast and its route at once.
@@ -1455,60 +1540,39 @@ export class Producer implements Table {
 	}
 
 	/**
-	 * Advertise `prefix` and serve the requests beneath it.
+	 * Create a route over `prefix` that yields the requests beneath it.
 	 *
-	 * A route is always a prefix: it claims `prefix` and every path beneath it (the
-	 * empty prefix claims every path). A service that only serves some of them
-	 * advertises the covering prefix and rejects the rest as they are requested;
-	 * consumers narrow with a {@link Path.Pattern} locally. The advertisement is
-	 * visible to {@link Consumer.announced} and forwarded by sessions for as long as
-	 * the returned {@link Requests} lives. A consumer resolving a path under it that
-	 * no announced local broadcast wins is handed to the handle as a {@link Request}.
+	 * A route is always a prefix: it claims `prefix` and every path beneath it (the empty
+	 * prefix claims every path). A service that only serves some of them advertises the
+	 * covering prefix and rejects the rest as they are requested; consumers narrow with a
+	 * {@link Path.Pattern} locally. The route is priced, credentialed and shown like an exact
+	 * one, and forwarded by sessions while it is visible.
+	 *
+	 * A consumer resolving a path under it that no announced local broadcast wins is handed to
+	 * {@link Route.requested} as a {@link Request}: answer it by serving a broadcast already held
+	 * ({@link Request.serve}), under this route's instance, or by creating the path's own exact
+	 * route ({@link Request.route}), under a fresh instance, so restarting one job never splices
+	 * into a copy of the last. A publisher that knows its broadcasts creates each one's exact
+	 * {@link route} instead, so subscribers can enumerate them.
 	 */
-	requests(prefix: Path.Valid): Requests {
-		return this.#insertRoute(prefix, Route.default, true, true);
-	}
-
-	/** Insert an originated claim with route metadata that answers through `Request.serve`, for tests and benches. @internal */
-	requestsRoute(
-		prefix: Path.Valid,
-		route:
-			| Route
-			| {
-					instance?: Route["instance"];
-					epoch?: Route["epoch"];
-					hops?: Route["hops"];
-					cost?: Route["cost"];
-					auth?: Route["auth"];
-			  } = Route.default,
-	): Requests {
-		return this.#insertRoute(prefix, Route.normalize(route), true, false);
+	routePrefix(prefix: Path.Valid, options: RouteOptions = {}): Route {
+		const info = RouteInfo.normalize({
+			instance: options.instance,
+			epoch: options.epoch,
+			cost: options.cost,
+			auth: options.auth,
+		});
+		return this.#serving(prefix, info, true, true, !options.hidden);
 	}
 
-	/**
-	 * Land a route a peer announced, served through the returned handle. Same as
-	 * {@link requests} but not originated, so a session never announces it back.
-	 *
-	 * @internal
-	 */
-	#receive(
-		prefix: Path.Valid,
-		route:
-			| Route
-			| {
-					instance?: Route["instance"];
-					epoch?: Route["epoch"];
-					hops?: Route["hops"];
-					cost?: Route["cost"];
-					auth?: Route["auth"];
-			  } = Route.default,
-	): Requests {
-		return this.#insertRoute(prefix, Route.normalize(route), false, false);
-	}
-
-	#insertRoute(prefix: Path.Valid, route: Route, originated: boolean, publishes: boolean): Requests {
+	/** Land a route a peer announced, taken as given. Not originated, so a session never announces it back. */
+	#receive(prefix: Path.Valid, route?: Partial<RouteInfo>): Route {
+		return this.#serving(prefix, RouteInfo.normalize(route), false, false, true);
+	}
+
+	#serving(prefix: Path.Valid, route: RouteInfo, originated: boolean, publishes: boolean, visible: boolean): Route {
 		prefix = this.#scope.prefix(prefix);
-		// A handle that names no instance serves one of its own.
+		// A route that names no instance serves one of its own.
 		if (route.instance === undefined) route = { ...route, instance: Instance.random(), epoch: 0n };
 		publishPath(prefix);
 		const server = new ServeState(this.#scope.root, prefix);
@@ -1523,40 +1587,98 @@ export class Producer implements Table {
 		};
 		server.onReject = (path, err) => this.#state.refuse(path, entry, err);
 
-		let closed = this.#borrowed?.closed ?? false;
-		if (!closed) {
+		let inserted = false;
+		let ended = false;
+		// Closing the origin drops the whole table without visiting each route, so a route
+		// still marked inserted learns of it here, matching an exact route's "origin is closed".
+		const open = () => {
+			if (ended) throw new Error("route is closed");
+			if (this.#state.routes.peek()) return;
+			inserted = false;
+			throw new Error("origin is closed");
+		};
+		const insert = () => {
+			open();
+			if (inserted) return;
 			this.#state.routes.mutate((routes) => {
-				if (!routes) {
-					closed = true;
-					return;
-				}
-				const entries = routes.get(prefix);
+				const entries = routes?.get(prefix);
 				if (entries) entries.unshift(entry);
-				else routes.set(prefix, [entry]);
+				else routes?.set(prefix, [entry]);
 			});
-		}
-		if (closed) {
+			inserted = true;
+			this.#state.rebuildOriginated();
+			this.#state.refreshPrefix(prefix);
+		};
+		// Take the entry out of the table, then end (or renew) the server before the requests
+		// beneath it reroute, so none of them resolves through an answer it already gave.
+		const remove = (server: () => void) => {
+			if (inserted) {
+				inserted = false;
+				this.#state.routes.mutate((routes) => {
+					const entries = routes?.get(prefix);
+					if (!entries) return;
+					const index = entries.indexOf(entry);
+					if (index < 0) return;
+					entries.splice(index, 1);
+					if (entries.length === 0) routes?.delete(prefix);
+				});
+			}
+			server();
+			this.#state.rebuildOriginated();
+			this.#state.refreshPrefix(prefix);
+		};
+		const release = this.#hold(() => {
+			ended = true;
+			this.#state.servers.delete(server);
+			remove(() => server.close());
+		});
+		// A route made after its origin (or this handle) closed is born retracted.
+		if (this.#borrowed?.closed || !this.#state.routes.peek()) {
+			ended = true;
 			server.close();
-			return makeDynamic(prefix, entry, this.#state, () => {}, publishes ? this : undefined);
+		} else {
+			this.#state.servers.add(server);
+			if (visible) insert();
 		}
-		this.#state.rebuildOriginated();
-		this.#state.refreshPrefix(prefix);
 
-		const retract = this.#hold(() => {
-			this.#state.routes.mutate((routes) => {
-				const entries = routes?.get(prefix);
-				if (!entries) return;
-				const index = entries.indexOf(entry);
-				if (index < 0) return;
-				entries.splice(index, 1);
-				if (entries.length === 0) routes?.delete(prefix);
-			});
-			server.close();
+		const update = (next: RouteInfo) => {
+			open();
+			const previous = entry.route.peek().instance;
+			const restart = inserted && previous !== next.instance;
+			if (restart) this.#state.restart(entry);
+			entry.route.set(next);
+			if (previous !== next.instance) server.reset();
+			if (!inserted) return;
 			this.#state.rebuildOriginated();
 			this.#state.refreshPrefix(prefix);
-		});
+			this.#state.routes.mutate(() => {});
+		};
 
-		return makeDynamic(prefix, entry, this.#state, retract, publishes ? this : undefined);
+		const publisher = publishes ? this : undefined;
+		return makeRoute({
+			instance: () => entry.route.peek().instance as Instance.Valid,
+			announce: insert,
+			withdraw: () => {
+				if (ended || !inserted) return;
+				remove(() => server.reset());
+			},
+			announced: () => inserted && this.#state.routes.peek() !== undefined,
+			change: (changed) => update(RouteInfo.normalize({ ...entry.route.peek(), ...changed })),
+			requested: () => serveRequests(server, publisher),
+			close: release,
+			info: () => (inserted && this.#state.routes.peek() ? entry.route.peek() : undefined),
+			update: (next) => {
+				// A route naming no instance keeps the one it serves.
+				const named = RouteInfo.normalize(next);
+				const current = entry.route.peek();
+				update(
+					named.instance === undefined
+						? { ...named, instance: current.instance, epoch: current.epoch }
+						: named,
+				);
+				insert();
+			},
+		});
 	}
 
 	/**
@@ -1698,16 +1820,22 @@ export class Producer implements Table {
 		if (this.#state.closed.peek() !== undefined) return;
 		this.#state.closed.set(abort ?? null);
 		for (const watch of this.#state.watchers.values()) watch.version.update((n) => n + 1);
-		for (const created of this.#state.created?.values() ?? []) retire(created);
+		// Cleared before the broadcasts close, so each route's synchronous retraction finds
+		// nothing left to rebuild rather than rebuilding the table once per route.
+		const created = this.#state.created;
 		this.#state.created = undefined;
 		this.#state.local.update(() => undefined);
 		this.#state.advertisedLocal.update(() => undefined);
+		for (const entry of created?.values() ?? []) retire(entry);
 		this.#state.routes.update((routes) => {
 			for (const entries of routes?.values() ?? []) {
 				for (const entry of entries) entry.server?.close(abort);
 			}
 			return undefined;
 		});
+		// A hidden or withdrawn prefix route is out of the table but its handler still waits.
+		for (const server of this.#state.servers) server.close(abort);
+		this.#state.servers.clear();
 		this.#state.originated.update(() => undefined);
 		// Materialized broadcasts are handles we opened; release them.
 		for (const cached of this.#state.materialized.values()) {
@@ -1752,20 +1880,12 @@ let makeFollowing: (
 	dispose: Dispose,
 ) => Following;
 
-let makeDynamic: (
-	prefix: Path.Valid,
-	entry: RouteEntry,
-	state: OriginState,
-	retract: Dispose,
-	publisher?: Producer,
-) => Requests;
-
 let makeRequest: (path: Path.Valid, server: ServeState) => Request;
 let finishRequest: (request: Request, err: Error) => void;
 let setRequestPublisher: (request: Request, publisher: Producer | undefined) => void;
-let makePrepared: (request: Request, publication: Publication) => Prepared;
-let publishPrepared: (request: Request, publication: Publication) => Publication;
-let rejectPrepared: (request: Request, err: Error) => void;
+let jobPending: (request: Request) => boolean;
+let answerJob: (request: Request) => void;
+let rejectJob: (request: Request, err: Error) => void;
 
 /**
  * An owned request for one publisher instance at a broadcast path; see {@link Consumer.request}.
@@ -2393,21 +2513,6 @@ export class Consumer implements Reader {
 		producer.close();
 	}
 
-	/**
-	 * The local table, borrowed by the wire publishers to answer subscribes.
-	 *
-	 * Deliberately excludes received routes: a session never re-announces what a peer
-	 * told it, so an origin wired to both directions of a connection cannot echo.
-	 * Borrowed, not owned: do not close the fronts. Undefined once the origin closes.
-	 *
-	 * @internal
-	 */
-	/**
-	 * Originated advertisements a session should forward: exact-path announces plus
-	 * originated dynamics. Undefined once the origin closes.
-	 *
-	 * @internal
-	 */
 	/**
 	 * The announced local broadcast at `path`, when it beats the originated routes there.
 	 * Resolves through what rebuildOriginated advertised: a peer never sees received routes.
@@ -2510,140 +2615,172 @@ export class Consumer implements Reader {
 	}
 }
 
+/** What one {@link Route} does, exact or prefix. */
+interface RouteControl {
+	readonly broadcast?: broadcast.Producer;
+	instance(): Instance.Valid;
+	announce(): void;
+	withdraw(): void;
+	announced(): boolean;
+	change(update: Partial<Pick<RouteInfo, "cost" | "auth">>): void;
+	requested(): AsyncIterableIterator<Request>;
+	close(): void;
+	info(): RouteInfo | undefined;
+	update(info: Partial<RouteInfo>): void;
+}
+
+/** The requests arriving on a prefix route's `server`, each answerable with a route of `publisher`'s when it has one. */
+async function* serveRequests(server: ServeState, publisher: Producer | undefined): AsyncIterableIterator<Request> {
+	let current: Request | undefined;
+	const drop = () => {
+		current?.reject(unroutable());
+		current = undefined;
+	};
+	// Keep the cursor while draining: restarting it would rescan deleted entries.
+	let queued = server.queue.peek().values();
+	try {
+		for (;;) {
+			const next = queued.next();
+			if (!next.done) {
+				drop();
+				server.queue.mutate((queue) => {
+					queue.delete(next.value);
+				});
+				current = next.value;
+				setRequestPublisher(current, publisher);
+				yield next.value;
+				continue;
+			}
+			if (server.closed.peek() !== undefined) return;
+			await Signal.race(server.queue, server.closed);
+			queued = server.queue.peek().values();
+		}
+	} finally {
+		drop();
+	}
+}
+
 /**
- * A served route from {@link Producer.requests}: advertises a prefix and answers the
+ * A route in an origin: an exact one owning its broadcast, or a prefix one answering the
  * requests beneath it.
  *
- * Drop it (or {@link close}) to retract the route and reject anything still waiting
- * with {@link StreamCode | StreamCode.Unroutable}. Close it and claim again to change it.
+ * Create an exact route with {@link Producer.route}, a prefix route with
+ * {@link Producer.routePrefix}, or a job's exact route with {@link Request.route}.
+ *
+ * ```ts
+ * // Fill the catalog before readers can find it.
+ * const route = origin.route(Path.from("live/alice"), { hidden: true });
+ * route.broadcast.createTrack("catalog.json");
+ * route.announce(); // visible now, same instance
+ * route.setCost(5n); // re-prices in place
+ * route.withdraw(); // hidden; announce() again continues the same stream
+ * ```
+ *
+ * {@link close} retracts it and closes its broadcast, and so does closing the broadcast.
  *
  * @public
  */
-export class Requests {
-	/** The prefix this handle advertises. */
-	readonly prefix: Path.Valid;
-
-	#entry: RouteEntry;
-	#state: OriginState;
-	#retract: Dispose;
-	#publisher?: Producer;
-	#closed = false;
+export class Route {
+	readonly #control: RouteControl;
 
-	private constructor(
-		prefix: Path.Valid,
-		entry: RouteEntry,
-		state: OriginState,
-		retract: Dispose,
-		publisher?: Producer,
-	) {
-		this.prefix = Path.stripPrefix(entry.scope.root, prefix) ?? Path.empty();
-		this.#entry = entry;
-		this.#state = state;
-		this.#retract = retract;
-		this.#publisher = publisher;
+	private constructor(control: RouteControl) {
+		this.#control = control;
+		registerWire(this, {
+			get info() {
+				return control.info();
+			},
+			update: (info) => control.update(info),
+		});
 	}
 
 	static {
-		makeDynamic = (prefix, entry, state, retract, publisher) =>
-			new Requests(prefix, entry, state, retract, publisher);
+		makeRoute = (control) => new Route(control);
+	}
+
+	/** The broadcast this exact route owns, to fill with tracks. Throws on a prefix route, which owns none. */
+	get broadcast(): broadcast.Producer {
+		const producer = this.#control.broadcast;
+		if (!producer) throw new Error("a prefix route owns no broadcast; answer its requests");
+		return producer;
 	}
 
-	/** The route this handle advertises. */
-	get route(): Route {
-		return this.#entry.route.peek();
+	/** The stream this route serves, minted when it was created unless {@link RouteOptions.instance} named one. */
+	get instance(): Instance.Valid {
+		return this.#control.instance();
 	}
 
 	/**
-	 * Replace the route in place. The prefix is fixed at announce time.
-	 *
-	 * A route naming no instance keeps the one this handle serves. At the same instance this
-	 * re-prices (or, at a higher epoch, continues the stream): consumers see an update and every
-	 * handle survives. Another instance names another stream:
-	 * consumers see a restart, resolved requests keep their old broadcast until closed, and a
-	 * re-request never joins it. Requests still waiting on this handle carry over: the handler
-	 * is asked again under the new instance, and its answer to a request asked before the change
-	 * is dropped, never served under the new instance. A new or unresolved request pinned to the
-	 * old instance is refused as unroutable. The answers already served are forgotten, so the next
-	 * request for one of those paths asks the handler again too. The broadcasts it served keep
-	 * running for the subscriptions already on them; close them to end those too.
-	 * Route selection still applies across instances. To re-price, start from the current route, `updateRoute({ ...dynamic.route, cost })`.
+	 * Make the route visible, or keep it so. Idempotent.
 	 *
-	 * @internal
+	 * Visible to local consumers before it returns. A job's route ({@link Request.route}) also
+	 * answers the requesters waiting on its path. Throws once the route or its broadcast closed,
+	 * and, announcing nothing, with {@link StreamCode | StreamCode.Unroutable} when a job's request
+	 * was released or its prefix route retracted meanwhile: that route can never announce.
 	 */
-	updateRoute(
-		route:
-			| Route
-			| {
-					instance?: Route["instance"];
-					epoch?: Route["epoch"];
-					hops?: Route["hops"];
-					cost?: Route["cost"];
-					auth?: Route["auth"];
-			  },
-	): void {
-		if (this.#closed) throw new Error("dynamic is closed");
-		const current = this.#entry.route.peek();
-		const named = Route.normalize(route);
-		// A route naming no instance keeps the one this handle serves.
-		const next =
-			named.instance === undefined ? { ...named, instance: current.instance, epoch: current.epoch } : named;
-		const previous = current.instance;
-		if (previous !== next.instance) this.#state.restart(this.#entry);
-		this.#entry.route.set(next);
-		if (previous !== next.instance) this.#entry.server?.reset();
-		this.#state.rebuildOriginated();
-		this.#state.refreshPrefix(Path.join(this.#entry.scope.root, this.prefix));
-		this.#state.routes.mutate(() => {});
+	announce(): void {
+		this.#control.announce();
+	}
+
+	/**
+	 * Hide the route from everyone, local and remote alike, keeping its broadcast and instance:
+	 * {@link announce} brings the same stream back. Requests for the path fail with
+	 * {@link StreamCode | StreamCode.Unroutable} meanwhile, while tracks already in flight carry
+	 * on to their own end. Idempotent.
+	 */
+	withdraw(): void {
+		this.#control.withdraw();
 	}
 
-	/** Retract the route and reject anything still waiting. Idempotent. */
+	/** Whether the route is visible. */
+	get announced(): boolean {
+		return this.#control.announced();
+	}
+
+	/**
+	 * Re-price the route: lower wins among routes covering the same prefix and anonymity. A
+	 * visible route changes in place, as an update to its readers; a hidden one announces at
+	 * this price. Throws once the route or its broadcast closed.
+	 */
+	setCost(cost: Cost): void {
+		this.#control.change({ cost });
+	}
+
+	/**
+	 * Swap the credential the advertising request carries; see {@link RouteOptions.auth}.
+	 * Undefined advertises under the session's scope. Throws once the route or its broadcast closed.
+	 */
+	setAuth(auth?: Credential): void {
+		this.#control.change({ auth });
+	}
+
+	/**
+	 * The requests beneath this prefix route, as they arrive, each to answer with
+	 * {@link Request.serve}, {@link Request.route} or {@link Request.reject}. Advancing the
+	 * iterator or closing it without answering rejects the request. Ends once the route is
+	 * closed or the origin closes, and at once on an exact route, which yields no requests.
+	 */
+	requested(): AsyncIterableIterator<Request> {
+		return this.#control.requested();
+	}
+
+	/** Retract the route for good, closing its broadcast and rejecting anything still waiting. Idempotent. */
 	close(): void {
-		if (this.#closed) return;
-		this.#closed = true;
-		this.#retract();
-	}
-
-	/** Requests under this prefix, as they arrive, each to {@link Request.prepare} or reject. */
-	async *requested(): AsyncIterableIterator<Request> {
-		const server = this.#entry.server;
-		if (!server) return;
-		let current: Request | undefined;
-		const drop = () => {
-			current?.reject(unroutable());
-			current = undefined;
-		};
-		// Keep the cursor while draining: restarting it would rescan deleted entries.
-		let queued = server.queue.peek().values();
-		try {
-			for (;;) {
-				const next = queued.next();
-				if (!next.done) {
-					drop();
-					server.queue.mutate((queue) => {
-						queue.delete(next.value);
-					});
-					current = next.value;
-					setRequestPublisher(current, this.#publisher);
-					yield next.value;
-					continue;
-				}
-				if (server.closed.peek() !== undefined) return;
-				await Signal.race(server.queue, server.closed);
-				queued = server.queue.peek().values();
-			}
-		} finally {
-			drop();
-		}
+		this.#control.close();
+	}
+
+	/** Calls {@link close}, so `using` retracts the route. */
+	[Symbol.dispose](): void {
+		this.close();
 	}
 }
 
 /**
  * A pending request for a broadcast to be served on demand.
  *
- * Yielded by {@link Requests.requested}. {@link prepare} then {@link Prepared.publish}
- * resolves it with a new exact-path broadcast; {@link serve} answers with a held broadcast;
- * {@link reject} resolves it with an error.
- * Advancing the iterator or closing it without answering rejects the request.
+ * Yielded by {@link Route.requested}. Answer it one of three ways: {@link serve} a broadcast
+ * already held, under the prefix route's instance; create the path's own exact route with
+ * {@link route}, under a fresh instance; or {@link reject} it with an error. Advancing the
+ * iterator or closing it without answering rejects the request.
  *
  * @public
  */
@@ -2666,16 +2803,14 @@ export class Request {
 		setRequestPublisher = (request, publisher) => {
 			request.#publisher = publisher;
 		};
-		publishPrepared = (request, publication) => {
-			if (!request.#server.has(request)) throw new Error("request is closed");
-			publication.announce();
+		jobPending = (request) => request.#server.has(request);
+		answerJob = (request) => {
 			// Its exact route owns availability: never cache a published job under the
 			// prefix, which would keep serving it after that exact route is withdrawn.
 			request.#server.forget(Path.join(request.#server.root, request.path), request);
 			request.#server.settled.update((n) => n + 1);
-			return publication;
 		};
-		rejectPrepared = (request, err) => request.#server.reject(request, err);
+		rejectJob = (request, err) => request.#server.reject(request, err);
 		finishRequest = (request, err) => {
 			request.#done = true;
 			request.#withdrawn = true;
@@ -2683,15 +2818,26 @@ export class Request {
 		};
 	}
 
-	/** Start answering as a new stream under a fresh instance, hidden until published. */
-	prepare(): Prepared {
+	/**
+	 * Answer with the path's own exact route, owning a new broadcast.
+	 *
+	 * The route serves a fresh instance unless `options` names one, so a job that ends and
+	 * restarts beneath the same prefix is a new stream for its restarted sequences. Closing the
+	 * route withdraws only this path: the prefix route keeps answering later requests. Created
+	 * visible, the route announces now and answers the requesters waiting on its path. Created
+	 * {@link RouteOptions.hidden | hidden}, they wait until {@link Route.announce}, so the job can
+	 * fill its catalog first; closing the route or its broadcast before then refuses them.
+	 *
+	 * Throws {@link StreamCode | StreamCode.Unroutable} on a request a session forwarded, which can
+	 * only {@link serve} its peer's broadcast, and, announcing nothing, once the request was
+	 * released or its prefix route retracted. Otherwise it throws as {@link Producer.route} does.
+	 */
+	route(options: RouteOptions = {}): Route {
 		if (this.#done) throw new Error("request is closed");
-		if (!this.#publisher) throw new Error("forwarded requests cannot be prepared");
-		const publication = this.#publisher.createBroadcast(this.path);
-		// Only the fill handle escapes until publish, so the answer cannot announce itself
-		// under another instance or skip the request's admission.
+		if (!this.#publisher) throw unroutable();
+		const route = exactRoute(this.#publisher, this.path, options, this);
 		this.#done = true;
-		return makePrepared(this, publication);
+		return route;
 	}
 
 	/**
@@ -2699,8 +2845,8 @@ export class Request {
 	 *
 	 * Takes ownership of a consumer; a producer stays the caller's. Every answer at this
 	 * path belongs to the prefix route's instance and must continue the same sequences and
-	 * bytes. Start a new prefix route for different content, or use {@link prepare} and
-	 * {@link Prepared.publish} for a job that can restart independently.
+	 * bytes. Start a new prefix route for different content, or use {@link route} for a job
+	 * that can restart independently.
 	 */
 	serve(source: broadcast.Producer | broadcast.Consumer): void {
 		if (this.#done) {
@@ -2721,107 +2867,3 @@ export class Request {
 		this.#server.reject(this, err);
 	}
 }
-
-let makePublication: (producer: broadcast.Producer, announcer: broadcast.Announcer) => Publication;
-
-/** An origin-owned broadcast and the capability to announce its route. */
-export class Publication {
-	/** The broadcast to fill with tracks before announcing it. */
-	readonly broadcast: broadcast.Producer;
-	readonly #announcer: broadcast.Announcer;
-
-	private constructor(producer: broadcast.Producer, announcer: broadcast.Announcer) {
-		this.broadcast = producer;
-		this.#announcer = announcer;
-	}
-
-	static {
-		makePublication = (producer, announcer) => new Publication(producer, announcer);
-	}
-
-	/** The route this broadcast is announced with, if any. */
-	get route(): Route | undefined {
-		return this.#announcer.route();
-	}
-
-	/**
-	 * Announce this broadcast, or replace its route; retain its instance when changing only cost.
-	 * Announce once its initial tracks exist. Throws after the broadcast closes or is replaced.
-	 */
-	announce(
-		route:
-			| Route
-			| {
-					instance?: Route["instance"];
-					epoch?: Route["epoch"];
-					hops?: Route["hops"];
-					cost?: Route["cost"];
-					auth?: Route["auth"];
-			  } = Route.default,
-	): void {
-		if (this.broadcast.closed.peek() !== undefined) throw new Error("broadcast is closed");
-		this.#announcer.announce(Route.normalize(route));
-	}
-
-	/** Retract this broadcast's route until announced again, without closing its fill handle. */
-	unannounce(): void {
-		this.#announcer.unannounce();
-	}
-}
-
-/**
- * A claim answer being filled before its exact route is announced.
- *
- * Use `using` or {@link close} to refuse it unless {@link publish} transfers its broadcast.
- * Closing the unpublished broadcast also refuses the request. A retained, unclosed answer
- * keeps the request pending; garbage collection provides no prompt cleanup guarantee.
- */
-export class Prepared {
-	/** The unannounced broadcast to fill before publishing; only {@link publish} announces it. */
-	readonly broadcast: broadcast.Producer;
-	readonly #request: Request;
-	readonly #publication: Publication;
-	readonly #stop: Dispose;
-	#done = false;
-
-	private constructor(request: Request, publication: Publication) {
-		this.#request = request;
-		this.broadcast = publication.broadcast;
-		this.#publication = publication;
-		// Synchronous, so a request made right after the broadcast closes reaches the claim again.
-		this.#stop = hooks.onClosed(this.broadcast, () => this.close());
-	}
-
-	static {
-		makePrepared = (request, publication) => new Prepared(request, publication);
-	}
-
-	/** Announce the filled broadcast and resolve every waiting requester, refusing them if it cannot be announced. */
-	publish(): Publication {
-		// Closing the broadcast closes this answer at once, so `#done` covers it too.
-		if (this.#done) throw new Error("prepared answer is closed");
-		this.#done = true;
-		this.#stop();
-		try {
-			return publishPrepared(this.#request, this.#publication);
-		} catch (err) {
-			this.broadcast.close();
-			rejectPrepared(this.#request, err instanceof Error ? err : new Error(String(err)));
-			throw err;
-		}
-	}
-
-	/** Refuse an unpublished answer as unroutable and close its broadcast. Idempotent. */
-	close(): void {
-		if (this.#done) return;
-		this.#done = true;
-		this.#stop();
-		this.broadcast.close();
-		rejectPrepared(this.#request, unroutable());
-	}
-
-	/** Calls {@link close}, so `using` refuses an unpublished answer. */
-	[Symbol.dispose](): void {
-		this.close();
-	}
-}
diff --git a/js/net/src/parked-expiry.test.ts b/js/net/src/parked-expiry.test.ts
index 4b302a86f30..624901a6005 100644
--- a/js/net/src/parked-expiry.test.ts
+++ b/js/net/src/parked-expiry.test.ts
@@ -30,9 +30,8 @@ for (const protocol of protocols) {
 			const installed = clock.install();
 			const pair = createMockTransportPair(protocol.alpn);
 			const origin = new Origin();
-			const broadcastPublication = origin.createBroadcast(Path.from("parked"));
-			const broadcast = broadcastPublication.broadcast;
-			broadcastPublication.announce();
+			const broadcastRoute = origin.route(Path.from("parked"));
+			const broadcast = broadcastRoute.broadcast;
 			// No publisher limit, so the cache eviction rather than a stale verdict ends a long budget.
 			const track = broadcast.createTrack("video", { timescale: Timescale.MILLI, maxAge: null });
 			const write = (sequence: bigint) => {
@@ -152,9 +151,8 @@ for (const protocol of protocols) {
 		const installed = clock.install();
 		const pair = createMockTransportPair(protocol.alpn);
 		const origin = new Origin();
-		const broadcastPublication = origin.createBroadcast(Path.from("parked"));
-		const broadcast = broadcastPublication.broadcast;
-		broadcastPublication.announce();
+		const broadcastRoute = origin.route(Path.from("parked"));
+		const broadcast = broadcastRoute.broadcast;
 		const track = broadcast.createTrack("video", { timescale: Timescale.MILLI });
 		const write = (sequence: bigint, frames: number) => {
 			const group = track.createGroup(sequence);
diff --git a/js/net/src/resume.model.test.ts b/js/net/src/resume.model.test.ts
index 919dee85a19..cf06c9f77fc 100644
--- a/js/net/src/resume.model.test.ts
+++ b/js/net/src/resume.model.test.ts
@@ -17,7 +17,7 @@ import fc from "fast-check";
 import { Consumer as BroadcastConsumer, Producer as BroadcastProducer } from "./broadcast.ts";
 import { NotFound, StreamCode, StreamError, TooFarBehind } from "./error.ts";
 import type { Frame, Consumer as GroupConsumer, Producer as GroupProducer } from "./group.ts";
-import { HopSchema, Route } from "./hop.ts";
+import { HopSchema, RouteInfo } from "./hop.ts";
 import * as Instance from "./instance.ts";
 import { hooks } from "./internal.ts";
 import { type Consumer as OriginConsumer, Producer as OriginProducer, type Requesting } from "./origin.ts";
@@ -447,7 +447,7 @@ class Model {
 	up(instance: number, slot: number): void {
 		const publisher = this.instances[instance];
 		if (publisher.routes[slot]) return;
-		const route = Route.normalize({
+		const route = RouteInfo.normalize({
 			instance: INSTANCES[instance],
 			hops: [HopSchema.parse(BigInt(10 * (instance + 1) + slot))],
 			// The second instance's routes all undercut the first's.
diff --git a/js/net/src/resume.test.ts b/js/net/src/resume.test.ts
index 34dbb1c308a..69b340e5aad 100644
--- a/js/net/src/resume.test.ts
+++ b/js/net/src/resume.test.ts
@@ -3,7 +3,7 @@ import { Manual, Milli, Nano, yieldNow } from "@moq/clock";
 import { Consumer as BroadcastConsumer, Producer as BroadcastProducer } from "./broadcast.ts";
 import { NotFound, SessionCode, SessionError, StreamCode, StreamError } from "./error.ts";
 import { type Consumer as GroupConsumer, Producer as GroupProducer } from "./group.ts";
-import { Route } from "./hop.ts";
+import { RouteInfo } from "./hop.ts";
 import type { Session as IetfSession } from "./ietf/session.ts";
 import { Subscriber as IetfSubscriber } from "./ietf/subscriber.ts";
 import { Version as IetfVersion } from "./ietf/version.ts";
@@ -39,7 +39,7 @@ async function isPending(promise: Promise<unknown>): Promise<boolean> {
 
 /** A stand-in session announcing `path` under the shared instance at `cost`, serving `source`. */
 function serve(origin: Producer, source: BroadcastProducer, cost: bigint) {
-	const handle = wireOf(origin).receive(path, Route.normalize({ instance: INSTANCE, cost }));
+	const handle = wireOf(origin).receive(path, RouteInfo.normalize({ instance: INSTANCE, cost }));
 	void (async () => {
 		for await (const request of handle.requested()) request.serve(source.consume());
 	})();
@@ -485,9 +485,8 @@ test("a resumed fork shares an on-demand track request", async () => {
 test("a lagging same-instance replica resumes from one publisher's bytes exactly once", async () => {
 	const { clock, installed } = manual();
 	const publisher = new Producer();
-	const originalPublication = publisher.createBroadcast(path);
-	const original = originalPublication.broadcast;
-	originalPublication.announce({ instance: INSTANCE });
+	const originalRoute = publisher.route(path, { instance: INSTANCE });
+	const original = originalRoute.broadcast;
 	const source = original.createTrack("seq", { maxAge: null });
 	const origin = new Producer();
 
@@ -943,7 +942,7 @@ test("between routes a reader keeps reading the copy it has", async () => {
 	expect(drain(sub)).toEqual([0n]);
 
 	// The next route has not answered when the old one is retracted.
-	const next = wireOf(origin).receive(path, Route.normalize({ instance: INSTANCE, cost: 1n }));
+	const next = wireOf(origin).receive(path, RouteInfo.normalize({ instance: INSTANCE, cost: 1n }));
 	const asked = next.requested();
 	disposeA();
 	await settle();
@@ -1832,7 +1831,7 @@ test("a fetched group that fails on the route still serving waits for the next r
 	const b = new BroadcastProducer();
 	const ta = copy(a);
 	const tb = copy(b);
-	// Route a's request handler holds the refetch of its failed group open, as Rust's tests do
+	// RouteInfo a's request handler holds the refetch of its failed group open, as Rust's tests do
 	// with `requests()`: without one, a miss there is NotFound at once.
 	const pending = ta.producer.requests();
 	const failing = ta.write(5n, 1, false);
@@ -1864,7 +1863,7 @@ test("a group handed out already failed with its route still continues on the ne
 	const b = new BroadcastProducer();
 	const ta = copy(a);
 	const tb = copy(b);
-	// Route a's request handler holds the refetch of its failed group open until the next route.
+	// RouteInfo a's request handler holds the refetch of its failed group open until the next route.
 	const pending = ta.producer.requests();
 	front.serve(a.consume());
 	const sub = front.consumer.track("seq").subscribe();
diff --git a/js/net/src/retention.test.ts b/js/net/src/retention.test.ts
index 029176110d3..81d5d6d4f4b 100644
--- a/js/net/src/retention.test.ts
+++ b/js/net/src/retention.test.ts
@@ -81,9 +81,8 @@ async function session(alpn: string) {
 		accept({ transport: pair.server, url, publish: origin.consume() }),
 	]);
 
-	const broadcastPublication = origin.createBroadcast(Path.from("test"));
-	const broadcast = broadcastPublication.broadcast;
-	broadcastPublication.announce();
+	const broadcastRoute = origin.route(Path.from("test"));
+	const broadcast = broadcastRoute.broadcast;
 	const producer = broadcast.createTrack("video", { timescale: Timescale.MILLI });
 
 	const remote = wireOf(client).consume(Path.from("test"));
diff --git a/js/net/src/subscribe_priority.test.ts b/js/net/src/subscribe_priority.test.ts
index 1ccae6bdb62..caa93dff11f 100644
--- a/js/net/src/subscribe_priority.test.ts
+++ b/js/net/src/subscribe_priority.test.ts
@@ -60,9 +60,8 @@ test.each([Lite.ALPN_07_WIP, ...Object.values(Ietf.ALPN)])(
 	"%s follows the aggregate priority upstream",
 	async (protocol) => {
 		const origin = new OriginProducer();
-		const broadcastPublication = origin.createBroadcast(path);
-		const broadcast = broadcastPublication.broadcast;
-		broadcastPublication.announce();
+		const broadcastRoute = origin.route(path);
+		const broadcast = broadcastRoute.broadcast;
 		const video = broadcast.createTrack("video", { timescale: Timescale.MILLI });
 		const [client, server] = await session(protocol, origin);
 
@@ -100,9 +99,8 @@ test.each(Object.values(Ietf.ALPN))("%s ends a subscription mid-update without a
 		await yieldNow();
 	});
 	const origin = new OriginProducer();
-	const broadcastPublication = origin.createBroadcast(path);
-	const broadcast = broadcastPublication.broadcast;
-	broadcastPublication.announce();
+	const broadcastRoute = origin.route(path);
+	const broadcast = broadcastRoute.broadcast;
 	const video = broadcast.createTrack("video", { timescale: Timescale.MILLI });
 	const [client, server] = await session(protocol, origin);
 	let closed: Error | null | undefined;
@@ -137,9 +135,8 @@ test.each(Object.values(Ietf.ALPN))("%s ends a subscription mid-update without a
 // update of defaults first, as on lite and in Rust.
 test.each(Object.values(Ietf.ALPN))("%s sends no update when the last subscriber leaves", async (protocol) => {
 	const origin = new OriginProducer();
-	const broadcastPublication = origin.createBroadcast(path);
-	const broadcast = broadcastPublication.broadcast;
-	broadcastPublication.announce();
+	const broadcastRoute = origin.route(path);
+	const broadcast = broadcastRoute.broadcast;
 	const video = broadcast.createTrack("video", { timescale: Timescale.MILLI });
 	const [client, server] = await session(protocol, origin);
 	try {
@@ -164,9 +161,8 @@ test.each(Object.values(Ietf.ALPN))("%s sends no update when the last subscriber
 // track with the error rather than leaving it at a stale priority. Nothing reaches the wire.
 test.each(Object.values(Ietf.ALPN))("%s ends the track when an update fails to encode", async (protocol) => {
 	const origin = new OriginProducer();
-	const broadcastPublication = origin.createBroadcast(path);
-	const broadcast = broadcastPublication.broadcast;
-	broadcastPublication.announce();
+	const broadcastRoute = origin.route(path);
+	const broadcast = broadcastRoute.broadcast;
 	const video = broadcast.createTrack("video", { timescale: Timescale.MILLI });
 	const [client, server] = await session(protocol, origin);
 	let closed: Error | null | undefined;
diff --git a/js/net/src/tail.test.ts b/js/net/src/tail.test.ts
index 40a81d606c1..b354df703ae 100644
--- a/js/net/src/tail.test.ts
+++ b/js/net/src/tail.test.ts
@@ -26,9 +26,8 @@ async function session(protocol: string) {
 		connect({ url, transport: pair.client }),
 		accept({ transport: pair.server, url, publish: origin.consume() }),
 	]);
-	const broadcastPublication = origin.createBroadcast(Path.from("test"));
-	const broadcast = broadcastPublication.broadcast;
-	broadcastPublication.announce();
+	const broadcastRoute = origin.route(Path.from("test"));
+	const broadcast = broadcastRoute.broadcast;
 	const video = broadcast.createTrack("video", { timescale: Timescale.MILLI, maxAge: null });
 	const remote = wireOf(client).consume(Path.from("test"));
 	const reader = remote
diff --git a/js/net/src/terminal.test.ts b/js/net/src/terminal.test.ts
index 796ae45243d..009cfc2a9b6 100644
--- a/js/net/src/terminal.test.ts
+++ b/js/net/src/terminal.test.ts
@@ -57,8 +57,7 @@ test("an unanswered track request is refused with the dropped producer's error",
 test("a lite protocol violation reaches the subscribed track and its open group", async () => {
 	const pair = createMockTransportPair(ALPN_06);
 	const origin = new OriginProducer();
-	const publication = origin.createBroadcast(Path.from("room"));
-	publication.announce();
+	const publication = origin.route(Path.from("room"));
 	const producer = publication.broadcast.createTrack("video", { timescale: Timescale.MILLI });
 	producer.appendGroup().writeFrame(textFrame("prefix"));
 	const url = new URL("https://example.com");
diff --git a/js/net/src/untimed.test.ts b/js/net/src/untimed.test.ts
index 2ce19df361d..eae4fe355e2 100644
--- a/js/net/src/untimed.test.ts
+++ b/js/net/src/untimed.test.ts
@@ -44,9 +44,8 @@ async function roundTrip(wire: Wire, timescale: Timescale | undefined, timestamp
 		accept({ transport: pair.server, url, version: wire.version, publish: origin.consume() }),
 	]);
 
-	const broadcastPublication = origin.createBroadcast(Path.from("test"));
-	const broadcast = broadcastPublication.broadcast;
-	broadcastPublication.announce();
+	const broadcastRoute = origin.route(Path.from("test"));
+	const broadcast = broadcastRoute.broadcast;
 	// Every request is answered, including the TRACK lookup lite-05+ makes before subscribing.
 	const serving = (async () => {
 		for (;;) {
@@ -115,9 +114,8 @@ test("a forwarded untimed track stays untimed", async () => {
 		connect({ url, transport: downstream.client }),
 	]);
 
-	const broadcastPublication = source.createBroadcast(Path.from("test"));
-	const broadcast = broadcastPublication.broadcast;
-	broadcastPublication.announce();
+	const broadcastRoute = source.route(Path.from("test"));
+	const broadcast = broadcastRoute.broadcast;
 	const serving = (async () => {
 		for (;;) {
 			const request = await wireOf(broadcast).requested();
@@ -130,7 +128,7 @@ test("a forwarded untimed track stays untimed", async () => {
 
 	// Serve the downstream session from the upstream one through a copy the forwarding
 	// node produces.
-	const dynamic = relay.requestsRoute(Path.from("test"));
+	const dynamic = relay.routePrefix(Path.from("test"));
 	const inputs: BroadcastConsumer[] = [];
 	const forwarding = (async () => {
 		for await (const request of dynamic.requested()) {
diff --git a/js/net/src/wire.ts b/js/net/src/wire.ts
index d8a7e59e99c..c39b99474b1 100644
--- a/js/net/src/wire.ts
+++ b/js/net/src/wire.ts
@@ -11,7 +11,7 @@ import type { Dispose, GetPromise, Getter } from "@moq/signals";
 import type * as broadcast from "./broadcast.ts";
 import type * as datagram from "./datagram.ts";
 import type { Consumer as GroupConsumer } from "./group.ts";
-import type { Route } from "./hop.ts";
+import type { RouteInfo } from "./hop.ts";
 import type * as Instance from "./instance.ts";
 import type { Lister, Tracks } from "./listing.ts";
 import type * as origin from "./origin.ts";
@@ -42,6 +42,12 @@ export interface Broadcast {
 /** Receives one change to the watched prefixes: `prefix` is now (or no longer) wanted. */
 export type InterestListener = (prefix: Path.Valid, wanted: boolean) => void;
 
+/** An origin's open request for a path, as a serving session sees it. */
+export interface RequestSlot {
+	/** The blind answer a session already gave it, if any. */
+	readonly answer?: broadcast.Consumer;
+}
+
 /** The protocol-facing operations behind an origin producer. */
 export interface OriginProducer {
 	/**
@@ -53,32 +59,34 @@ export interface OriginProducer {
 	interests(listener: InterestListener): Dispose;
 	/** Whether an advertised prefix overlaps the handle's allowed paths. */
 	accepts(prefix: Path.Valid): boolean;
-	receive(
-		prefix: Path.Valid,
-		route?:
-			| Route
-			| {
-					instance?: Route["instance"];
-					epoch?: Route["epoch"];
-					hops?: Route["hops"];
-					cost?: Route["cost"];
-					auth?: Route["auth"];
-			  },
-	): origin.Requests;
+	/** Land a route a peer announced, taken as given and never forwarded back to a peer. */
+	receive(prefix: Path.Valid, route?: Partial<RouteInfo>): origin.Route;
 	attach(discovery: boolean): Dispose;
 	/**
 	 * Hold the origin's announcement streams overlapping `prefix` unsynced until
 	 * the returned dispose: a session holds one while its peer's initial set is in flight.
 	 */
 	snapshot(prefix: Path.Valid): Dispose;
-	readonly requests: Getter<ReadonlyMap<Path.Valid, origin.RequestSlot> | undefined>;
+	readonly requests: Getter<ReadonlyMap<Path.Valid, RequestSlot> | undefined>;
 	changed(): GetPromise<unknown>;
 	/** Whether sessions should answer the request with a blind subscription right now. */
-	blind(slot: origin.RequestSlot): boolean;
+	blind(slot: RequestSlot): boolean;
 	answer(path: Path.Valid, front: broadcast.Consumer): Dispose | undefined;
 	routes(path: Path.Valid): boolean;
 }
 
+/** The protocol-facing operations behind an origin route. */
+export interface Route {
+	/** The metadata the route is advertised with, or undefined while hidden. */
+	readonly info: RouteInfo | undefined;
+	/**
+	 * Advertise the route with `info` as given, as a session's update does: a named instance
+	 * replaces the route's, which restarts its readers; otherwise it keeps the route's own.
+	 * Announces a hidden route.
+	 */
+	update(info: Partial<RouteInfo>): void;
+}
+
 /** The protocol-facing operations behind an origin consumer. */
 export interface OriginConsumer {
 	routes(path: Path.Valid): boolean;
@@ -93,7 +101,7 @@ export interface OriginConsumer {
 /** One originated advertisement exposed to the publishing wire. */
 export interface Advertised {
 	readonly identity: object;
-	readonly route: Route;
+	readonly route: RouteInfo;
 	/** The paths a scoped route may serve beneath its prefix, relative like its key; unset for the whole subtree. */
 	readonly claim?: Path.Patterns;
 	/**
@@ -107,7 +115,7 @@ export interface Advertised {
 /** What names a stream: an advertisement, and the instance its route serves. */
 export interface Served {
 	readonly identity: object;
-	readonly route: Pick<Route, "instance">;
+	readonly route: Pick<RouteInfo, "instance">;
 }
 
 /**
@@ -145,7 +153,7 @@ export interface Established {
 /** A produced broadcast's view, which always fetches from its own cache. */
 export type Produced = Broadcast & Required<Pick<Broadcast, "fetchGroup">>;
 
-type View = Broadcast | OriginProducer | OriginConsumer | Established;
+type View = Broadcast | OriginProducer | OriginConsumer | Route | Established;
 const views = new WeakMap<object, View>();
 
 /** Register the package-private view for a handle. */
@@ -167,6 +175,7 @@ export function wireOf(handle: broadcast.Producer): Produced;
 export function wireOf(handle: broadcast.Producer | broadcast.Consumer): Broadcast;
 export function wireOf(handle: origin.Producer): OriginProducer;
 export function wireOf(handle: origin.Consumer): OriginConsumer;
+export function wireOf(handle: origin.Route): Route;
 export function wireOf(handle: import("./connection/established.ts").Established): Established;
 /** Return the package-private view for a handle. */
 export function wireOf(handle: object): View {
diff --git a/js/publish/src/broadcast.test.ts b/js/publish/src/broadcast.test.ts
index a6a949f1a3e..4f9e0eb351b 100644
--- a/js/publish/src/broadcast.test.ts
+++ b/js/publish/src/broadcast.test.ts
@@ -390,7 +390,7 @@ test("serves no catalog until announced, so the first snapshot is the one at ann
 
 // Regression: a re-announce re-created the catalog track, restarting its group sequence under the
 // same instance, so a resumed viewer mistook the new catalog for the old one. Turning the announce off
-// unannounces at once and keeps the broadcast for the next announce.
+// withdraws the route at once and keeps it, broadcast and instance, for the next announce.
 test("a re-announce continues the catalog's group sequence", async () => {
 	const announce = new Signal(true);
 	const broadcast = new Broadcast({
@@ -407,6 +407,8 @@ test("a re-announce continues the catalog's group sequence", async () => {
 	const announced = broadcast.in.origin.peek()?.follow(broadcast.in.name.peek());
 	const first = net.track(Broadcast.CATALOG_TRACK).subscribe().ordered();
 	expect((await first.nextGroup())?.sequence).toBe(0n);
+	const instance = announced?.active.peek()?.instance;
+	expect(instance).toBeDefined();
 
 	announce.set(false);
 	await settle();
@@ -416,7 +418,9 @@ test("a re-announce continues the catalog's group sequence", async () => {
 	announce.set(true);
 	await settle();
 
-	// The same track keeps serving, and its newest group is past the first.
+	// The follower continues the same instance, the same track keeps serving, and its newest group
+	// is past the first.
+	expect(announced?.active.peek()?.instance).toBe(instance);
 	expect(broadcast.net.peek()).toBe(net);
 	const group = await first.nextGroup();
 	expect(group?.sequence).toBeGreaterThan(0);
diff --git a/js/publish/src/broadcast.ts b/js/publish/src/broadcast.ts
index 0344e5004cf..da6d46ea14a 100644
--- a/js/publish/src/broadcast.ts
+++ b/js/publish/src/broadcast.ts
@@ -31,7 +31,7 @@ export type BroadcastInput = {
 	// see or subscribe to it. The flip rather than a gate on creating it: tracks can be
 	// populated while this is false, then announced once ready. The catalog is served from the
 	// first announce, so its first snapshot is the one current at announce time.
-	// Turning it off unannounces the broadcast.
+	// Turning it off withdraws the route, and turning it back on continues the same stream.
 	announce: Getter<boolean>;
 
 	// The broadcast name.
@@ -445,13 +445,13 @@ export class Broadcast {
 			);
 		}
 
-		// Creating into the origin outlives any single session: a reconnect re-announces the
-		// broadcast and new subscriptions land on the same producer.
-		const broadcastPublication = origin.createBroadcast(name);
-		const broadcast = broadcastPublication.broadcast;
-		// The publication mints one instance, kept across unannounce and announce, so a restart
-		// is a new stream rather than a resume into the old one.
-		effect.cleanup(() => broadcast.close());
+		// Routing into the origin outlives any single session: a reconnect re-announces the
+		// broadcast and new subscriptions land on the same producer. Hidden until the catalog is
+		// served. The route mints one instance, kept across withdraw and announce, so toggling
+		// `announce` continues the same stream for viewers; a new route is a new stream.
+		const route = origin.route(name, { hidden: true });
+		const broadcast = route.broadcast;
+		effect.cleanup(() => route.close());
 
 		// Expose it before serving so an application reacting to `net` can insert its own tracks.
 		this.#net.set(broadcast);
@@ -483,7 +483,7 @@ export class Broadcast {
 		let serving = false;
 		effect.run((inner) => {
 			if (!inner.get(this.in.announce)) {
-				broadcastPublication.unannounce();
+				route.withdraw();
 				return;
 			}
 
@@ -510,7 +510,7 @@ export class Broadcast {
 				this.catalog.serve(track, effect);
 			}
 
-			broadcastPublication.announce();
+			route.announce();
 		});
 
 		// Static tracks fan out to every subscriber. The encoder-facing handle stays set while the
diff --git a/js/watch/src/audio/decoder.test.ts b/js/watch/src/audio/decoder.test.ts
index d87a7b73617..3a15d872cae 100644
--- a/js/watch/src/audio/decoder.test.ts
+++ b/js/watch/src/audio/decoder.test.ts
@@ -1180,7 +1180,7 @@ async function livePlayback(burst: number) {
 		// Serve the same rendition from another path, as a `broadcast` override does.
 		move(path: string) {
 			media.peek().close();
-			producer = new Moq.Origin.Producer().createBroadcast(Moq.Path.from(path)).broadcast;
+			producer = new Moq.Origin.Producer().route(Moq.Path.from(path), { hidden: true }).broadcast;
 			track = producer.createTrack("audio", { timescale: Moq.Time.Timescale.MILLI, maxAge: Container.MAX_AGE });
 			sequence = 0n;
 			media.set(producer.consume());
diff --git a/js/watch/src/broadcast.test.ts b/js/watch/src/broadcast.test.ts
index 5f98ceeaa61..32e8ea4676a 100644
--- a/js/watch/src/broadcast.test.ts
+++ b/js/watch/src/broadcast.test.ts
@@ -9,10 +9,7 @@ import { Effect, Signal } from "@moq/signals";
 import { Broadcast } from "./broadcast";
 
 function publish(origin: Origin.Producer, path: Path.Valid) {
-	const broadcastPublication = origin.createBroadcast(path);
-	const broadcast = broadcastPublication.broadcast;
-	broadcastPublication.announce();
-	return broadcast;
+	return origin.route(path).broadcast;
 }
 
 // A real origin with local broadcasts at the given paths. Resolution is proven by
@@ -37,10 +34,10 @@ function broadcast(name: string, paths: string[] = [name]): { source: Broadcast;
 }
 
 // Answer every request `claim` receives with a new exact broadcast, returning the answers.
-function serve(claim: Origin.Requests): Moq.Broadcast.Producer[] {
+function serve(claim: Origin.Route): Moq.Broadcast.Producer[] {
 	const answers: Moq.Broadcast.Producer[] = [];
 	void (async () => {
-		for await (const request of claim.requested()) answers.push(request.prepare().publish().broadcast);
+		for await (const request of claim.requested()) answers.push(request.route().broadcast);
 	})();
 	return answers;
 }
@@ -340,16 +337,13 @@ describe("relativeBroadcast", () => {
 			Moq.Instance.random(),
 			Moq.Instance.random(),
 		];
-		const catalogPublication = owner.createBroadcast(Path.from("a/b"));
-		const catalog = catalogPublication.broadcast;
-		catalogPublication.announce({ instance: catalogInstance });
-		const siblingPublication = owner.createBroadcast(Path.from("a/source"));
-		const sibling = siblingPublication.broadcast;
-		siblingPublication.announce({ instance: siblingInstance });
+		const catalogRoute = owner.route(Path.from("a/b"), { instance: catalogInstance });
+		const catalog = catalogRoute.broadcast;
+		const siblingRoute = owner.route(Path.from("a/source"), { instance: siblingInstance });
+		const sibling = siblingRoute.broadcast;
 		// A route over a wire that carries no instance has one its session minted.
-		const plainPublication = owner.createBroadcast(Path.from("a/plain"));
-		const plain = plainPublication.broadcast;
-		plainPublication.announce({ instance: Moq.Instance.minted() });
+		const plainRoute = owner.route(Path.from("a/plain"), { instance: Moq.Instance.minted() });
+		const plain = plainRoute.broadcast;
 		const source = new Broadcast({
 			origin: owner,
 			name: Path.from("a/b"),
@@ -387,9 +381,8 @@ describe("relativeBroadcast", () => {
 		const owner = new Origin.Producer();
 		const main = publish(owner, Path.from("a/b"));
 		const [oldInstance, newInstance] = [Moq.Instance.random(), Moq.Instance.random()];
-		const oldPublication = owner.createBroadcast(Path.from("a/source"));
-		const old = oldPublication.broadcast;
-		oldPublication.announce({ instance: oldInstance });
+		const oldRoute = owner.route(Path.from("a/source"), { instance: oldInstance });
+		const old = oldRoute.broadcast;
 		const source = new Broadcast({
 			origin: owner,
 			name: Path.from("a/b"),
@@ -413,9 +406,8 @@ describe("relativeBroadcast", () => {
 
 			// The announcement is the online signal: the plain reference follows the restart,
 			// while one naming the old instance never reads the new one.
-			const replacementPublication = owner.createBroadcast(Path.from("a/source"));
-			const replacement = replacementPublication.broadcast;
-			replacementPublication.announce({ instance: newInstance });
+			const replacementRoute = owner.route(Path.from("a/source"), { instance: newInstance });
+			const replacement = replacementRoute.broadcast;
 			await settle();
 			expect(following?.instance).toBe(newInstance);
 			expect(pinned).toBeUndefined();
@@ -433,9 +425,8 @@ describe("relativeBroadcast", () => {
 		const owner = new Origin.Producer();
 		const main = publish(owner, Path.from("a/b"));
 		const [oldInstance, newInstance] = [Moq.Instance.random(), Moq.Instance.random()];
-		const oldPublication = owner.createBroadcast(Path.from("a/source"));
-		const old = oldPublication.broadcast;
-		oldPublication.announce({ instance: oldInstance });
+		const oldRoute = owner.route(Path.from("a/source"), { instance: oldInstance });
+		const old = oldRoute.broadcast;
 		const named = { ...video("avc1.64001f", "./source"), instance: oldInstance } as Catalog.VideoConfig;
 		const source = new Broadcast({
 			origin: owner,
@@ -448,9 +439,8 @@ describe("relativeBroadcast", () => {
 			await settle();
 			expect(videoRenditions(source)).toEqual(["named", "plain"]);
 
-			const replacementPublication = owner.createBroadcast(Path.from("a/source"));
-			const replacement = replacementPublication.broadcast;
-			replacementPublication.announce({ instance: newInstance });
+			const replacementRoute = owner.route(Path.from("a/source"), { instance: newInstance });
+			const replacement = replacementRoute.broadcast;
 			await withoutWarnings(settle);
 			expect(videoRenditions(source)).toEqual(["plain"]);
 			replacement.close();
@@ -498,11 +488,11 @@ describe("blind resolution", () => {
 		await settle();
 
 		// Stand in for a claim answering the request.
-		const route = owner.requests(Path.from("blind.hang"));
+		const route = owner.routePrefix(Path.from("blind.hang"));
 		const requests = route.requested();
 		const next = await requests.next();
 		if (!next.value) throw new Error("expected a request");
-		const upstream = next.value.prepare(Moq.Instance.random()).publish().broadcast;
+		const upstream = next.value.route().broadcast;
 
 		await settle();
 		const active = source.out.active.peek();
@@ -610,7 +600,7 @@ describe("restart", () => {
 	it("moves to a more specific announcement of another instance", async () => {
 		const owner = new Origin.Producer();
 		const name = Path.from("pool/job.hang");
-		const pool = owner.requests(Path.from("pool"));
+		const pool = owner.routePrefix(Path.from("pool"));
 		const answers = serve(pool);
 		const source = new Broadcast({ origin: owner, name, enabled: true, follow: true, catalogFormat: "manual" });
 		await settle();
@@ -618,9 +608,8 @@ describe("restart", () => {
 		expect(old).toBeDefined();
 
 		// A newer publisher announces the path, which now serves the name: a restart.
-		const exactPublication = owner.createBroadcast(name);
-		const exact = exactPublication.broadcast;
-		exactPublication.announce();
+		const exactRoute = owner.route(name);
+		const exact = exactRoute.broadcast;
 		await settle();
 		const moved = source.out.active.peek();
 		expect(moved).toBeDefined();
@@ -642,9 +631,8 @@ describe("restart", () => {
 	it("resumes on a covering prefix after a gap", async () => {
 		const owner = new Origin.Producer();
 		const name = Path.from("pool/job.hang");
-		const exactPublication = owner.createBroadcast(name);
-		const exact = exactPublication.broadcast;
-		exactPublication.announce();
+		const exactRoute = owner.route(name);
+		const exact = exactRoute.broadcast;
 		const source = new Broadcast({ origin: owner, name, enabled: true, follow: true, catalogFormat: "manual" });
 		await settle();
 		const old = source.out.active.peek();
@@ -653,7 +641,7 @@ describe("restart", () => {
 		// The exact route goes, which ends the request on it, and a prefix answers before the table
 		// is read again. The player still has to ask again.
 		exact.close();
-		const pool = owner.requests(Path.from("pool"));
+		const pool = owner.routePrefix(Path.from("pool"));
 		const answers = serve(pool);
 		await settle();
 		const resumed = source.out.active.peek();
@@ -671,7 +659,7 @@ describe("restart", () => {
 	it("falls back to a covering prefix when the exact route ends", async () => {
 		const owner = new Origin.Producer();
 		const name = Path.from("pool/job.hang");
-		const pool = owner.requests(Path.from("pool"));
+		const pool = owner.routePrefix(Path.from("pool"));
 		const answers = serve(pool);
 		const exact = publish(owner, name);
 		const source = new Broadcast({ origin: owner, name, enabled: true, follow: true, catalogFormat: "manual" });
@@ -704,7 +692,7 @@ describe("refusal", () => {
 	it("reports an unroutable refusal of a restarted publisher", async () => {
 		const owner = new Origin.Producer();
 		const name = Path.from("room/live.hang");
-		const first = owner.requests(Path.from("room"));
+		const first = owner.routePrefix(Path.from("room"));
 		const answers = serve(first);
 		const source = new Broadcast({ origin: owner, name, enabled: true, follow: true, catalogFormat: "manual" });
 		await settle();
@@ -713,7 +701,7 @@ describe("refusal", () => {
 		// The publisher restarts, and refuses with the same code an ended instance reports.
 		first.close();
 		for (const answer of answers) answer.close();
-		const second = owner.requests(Path.from("room"));
+		const second = owner.routePrefix(Path.from("room"));
 		const refused = await second.requested().next();
 		refused.value?.reject(new Moq.Error.Stream(Moq.StreamCode.Unroutable, { message: "refused" }));
 		await settle();
@@ -749,7 +737,7 @@ describe("refusal", () => {
 	for (const follow of [true, false]) {
 		it(`reports a refusal until a fresh request (follow: ${follow})`, async () => {
 			const owner = new Origin.Producer();
-			const route = owner.requests(Path.from("room"));
+			const route = owner.routePrefix(Path.from("room"));
 			const requests = route.requested();
 			const name = new Signal(Path.from("room/refused.hang"));
 			const enabled = new Signal(true);
@@ -1031,7 +1019,7 @@ describe("wildcard renditions", () => {
 			await settle();
 			expect(videoRenditions(source)).toEqual(["source"]);
 
-			const worker = owner.requests(Path.from(".pro/transcode"));
+			const worker = owner.routePrefix(Path.from(".pro/transcode"));
 			const requests = worker.requested();
 			await settle();
 			expect(videoRenditions(source)).toEqual(["source", "transcode"]);
@@ -1046,11 +1034,12 @@ describe("wildcard renditions", () => {
 			expect(active).toBeUndefined();
 
 			if (!request) throw new Error("expected a request");
-			const prepared = request.prepare(Moq.Instance.random());
-			prepared.broadcast
+			const job = request.route({ hidden: true });
+			job.broadcast
 				.createTrack("video", { timescale: Moq.Time.Timescale.MILLI })
 				.writeFrame({ payload: new TextEncoder().encode("frame"), timestamp: Moq.Time.Timestamp.now() });
-			const produced = prepared.publish().broadcast;
+			job.announce();
+			const produced = job.broadcast;
 			await settle();
 			expect(active).toBeDefined();
 			const track = active?.track("video").subscribe().ordered();
@@ -1077,8 +1066,8 @@ describe("wildcard renditions", () => {
 
 		try {
 			// A catch-all (an archive) and a narrower pool both cover the derived path.
-			const archive = owner.requests(Path.empty());
-			const worker = owner.requests(Path.from(".pro/transcode"));
+			const archive = owner.routePrefix(Path.empty());
+			const worker = owner.routePrefix(Path.from(".pro/transcode"));
 			await settle();
 			expect(videoRenditions(source)).toEqual(["source", "transcode"]);
 
diff --git a/js/watch/src/echo.ts b/js/watch/src/echo.ts
index 32f2deaf016..e8104791003 100644
--- a/js/watch/src/echo.ts
+++ b/js/watch/src/echo.ts
@@ -125,11 +125,11 @@ export class Echo {
 			let broadcast: Moq.Broadcast.Producer | undefined;
 			let writer: Report.Writer<Schema.Snapshot>;
 			try {
-				const publication = origin.createBroadcast(path);
-				broadcast = publication.broadcast;
-				writer = new Report.Writer(broadcast, Schema.TRACK, Schema.SnapshotSchema);
 				// A fresh instance, so a reader sees a replaced feedback broadcast as a restart.
-				publication.announce();
+				const route = origin.route(path, { hidden: true });
+				broadcast = route.broadcast;
+				writer = new Report.Writer(broadcast, Schema.TRACK, Schema.SnapshotSchema);
+				route.announce();
 			} catch (err) {
 				broadcast?.close();
 				console.warn("failed to publish feedback", path, err);
diff --git a/js/watch/src/include.test.ts b/js/watch/src/include.test.ts
index a8e1eab8973..67f4f2fb416 100644
--- a/js/watch/src/include.test.ts
+++ b/js/watch/src/include.test.ts
@@ -8,8 +8,7 @@ import { Broadcast } from "./broadcast";
 import { Source } from "./video/source";
 
 function publish(origin: Origin.Producer, path: string, instance?: Instance.Valid) {
-	const publication = origin.createBroadcast(Path.from(path));
-	publication.announce({ instance });
+	const publication = origin.route(Path.from(path), { instance });
 	return publication.broadcast;
 }
 
@@ -104,7 +103,7 @@ it("opens a listed include only on selection, keeping its rendition IDs its own"
 it("reads an unavailable include as offline without touching the parent", async () => {
 	const origin = new Origin.Producer();
 	publish(origin, "room/main.hang");
-	const claim = origin.requests(Path.from("room/absent.hang"));
+	const claim = origin.routePrefix(Path.from("room/absent.hang"));
 	const requests = claim.requested();
 	const source = new Broadcast({
 		origin,
diff --git a/js/watch/src/player.test.ts b/js/watch/src/player.test.ts
index d4f131d6a78..4921d4b81e6 100644
--- a/js/watch/src/player.test.ts
+++ b/js/watch/src/player.test.ts
@@ -35,8 +35,7 @@ test.each(["table", "consumer", "structural"] as const)("Player borrows a %s ori
 	const player = new Player({ origin: origins[role], name, catalogFormat: "manual", catalog: {} });
 	try {
 		const active = player.broadcast.out.active.changed();
-		const publication = producer.createBroadcast(name);
-		publication.announce();
+		const publication = producer.route(name);
 		expect((await active)?.path).toBe(name);
 		expect(player.in.origin.peek()).toBe(origins[role]);
 		expect(player.broadcast.in.origin.peek()).toBe(origins[role]);
diff --git a/js/watch/src/video/decoder.test.ts b/js/watch/src/video/decoder.test.ts
index 618536e4ee1..05133fb10c7 100644
--- a/js/watch/src/video/decoder.test.ts
+++ b/js/watch/src/video/decoder.test.ts
@@ -437,7 +437,7 @@ async function guardedPlayback(
 		republishMedia(path?: string): Moq.Track.Producer | undefined {
 			media.peek().close();
 			mediaProducer = path
-				? new Moq.Origin.Producer().createBroadcast(Moq.Path.from(path)).broadcast
+				? new Moq.Origin.Producer().route(Moq.Path.from(path), { hidden: true }).broadcast
 				: new Moq.Broadcast.Producer();
 			const track = live
 				? mediaProducer.createTrack("video", { timescale: Moq.Time.Timescale.MILLI, maxAge: Container.MAX_AGE })
diff --git a/kt/moq/MIGRATE.md b/kt/moq/MIGRATE.md
index 77428b07a6b..73bb90e54be 100644
--- a/kt/moq/MIGRATE.md
+++ b/kt/moq/MIGRATE.md
@@ -25,6 +25,22 @@ while (true) {
 }
 ```
 
+### Publishing goes through one `Route`
+
+`OriginProducer.createBroadcast(path)`, `Moq.createBroadcast`, and `Server.createBroadcast` are `route(path, RouteOptions())`, and `OriginProducer.requests(prefix)` is `routePrefix(prefix, RouteOptions())`. Both return a `Route`, which replaces `Publication`, `OriginRequests`, and `BroadcastPrepared`:
+
+- `Publication.broadcast()` is `Route.broadcast()`, which throws `MoqException.Internal` on a prefix route.
+- `Publication.announce(AnnounceRoute(...))` is `announce()`, and re-pricing is `setCost(cost)`. `unannounce()` is `withdraw()`.
+- `OriginRequests.requestedBroadcast()` is `Route.requested()`, which returns null once the origin closes; `requestedBroadcasts()` is now an extension on `Route`, and ending its collection no longer retracts the route.
+- `BroadcastRequest.prepare()` then `BroadcastPrepared.publish()` is `BroadcastRequest.route(options)`: create it hidden to fill it first, then `announce()`.
+- `Route.instance()` is the stream's instance, minted at creation and kept across `withdraw` and `announce`.
+
+`AnnounceRoute` is `RouteOptions(hidden, cost, instance, epoch)`, given once at creation. A route is visible at once unless `hidden = true`; set it and call `announce()` after filling the catalog to keep the old create-then-announce order. A stable `instance` is fixed for the route's lifetime: announcing another one is a new route.
+
+Hold the `Route` for as long as the broadcast should stay announced: closing or cancelling it retracts it, while `BroadcastProducer.end()` still ends both. A `BroadcastProducer` alone no longer keeps it announced.
+
+`Route`, the received facts in `Announce.route`, is renamed `RouteInfo`; its fields are unchanged.
+
 ### Catalog renditions carry their warmup ([#7864](https://github.com/moq-dev/moq/pull/7864))
 
 `Video` and `Audio` gain `warmup`, the catalog's decoder warmup; it defaults to `null` as the last field, so existing code keeps working. `TrackConsumer` and the audio and video consumers read it from the rendition and start that much earlier.
diff --git a/kt/moq/src/jvmAndAndroidMain/kotlin/dev/moq/Aliases.kt b/kt/moq/src/jvmAndAndroidMain/kotlin/dev/moq/Aliases.kt
index e60a13736c6..356134c8b47 100644
--- a/kt/moq/src/jvmAndAndroidMain/kotlin/dev/moq/Aliases.kt
+++ b/kt/moq/src/jvmAndAndroidMain/kotlin/dev/moq/Aliases.kt
@@ -49,14 +49,16 @@ typealias Request = uniffi.moq.MoqRequest
 typealias Transport = uniffi.moq.MoqTransport
 
 // Origin (broadcast discovery / announcement).
-/** The publish side of an origin: create broadcasts so subscribers can discover them. */
+/** The publish side of an origin: create routes so subscribers can discover them. */
 typealias OriginProducer = uniffi.moq.MoqOriginProducer
 
 /**
- * An origin's handle on one broadcast: `broadcast()` to fill it, `announce` and `unannounce` to
- * advertise it.
+ * A route on an origin: an exact route owning one broadcast (`broadcast()` to fill it), or a prefix
+ * route yielding the requests beneath it (`requested()`). `announce`, `withdraw`, and `setCost`
+ * advertise it. Closing or cancelling it retracts it, as does ending its broadcast; a broadcast
+ * handle alone does not keep it announced.
  */
-typealias Publication = uniffi.moq.MoqPublication
+typealias Route = uniffi.moq.MoqRoute
 
 /** Config for creating an origin, such as its total cache budget. */
 typealias OriginConfig = uniffi.moq.MoqOriginConfig
@@ -64,15 +66,9 @@ typealias OriginConfig = uniffi.moq.MoqOriginConfig
 /** The subscribe side of an origin: discover and request published broadcasts. */
 typealias OriginConsumer = uniffi.moq.MoqOriginConsumer
 
-/** A served route: advertises a path prefix and yields broadcast requests beneath it. */
-typealias OriginRequests = uniffi.moq.MoqOriginRequests
-
-/** A requested broadcast not yet accepted: fulfill it with a producer or reject it. */
+/** A requested broadcast not yet answered: serve it, route it, or reject it. */
 typealias BroadcastRequest = uniffi.moq.MoqBroadcastRequest
 
-/** A claim answer being filled before its exact route is announced. */
-typealias BroadcastPrepared = uniffi.moq.MoqBroadcastPrepared
-
 /** A stream of announce events under a prefix. */
 typealias AnnounceConsumer = uniffi.moq.MoqAnnounceConsumer
 
@@ -156,17 +152,17 @@ typealias Frame = uniffi.moq.MoqFrame
 typealias Timestamp = uniffi.moq.MoqTimestamp
 
 /**
- * How a broadcast advertises its exact path: its static production cost (lower wins), an optional
- * stable instance (null keeps the one the broadcast minted), and the epoch, which only matters with
- * a stable instance.
+ * How a [Route] advertises itself: `hidden` until `announce`, its static production cost (lower
+ * wins), an optional stable instance (null mints a fresh one the route keeps for its lifetime), and
+ * the epoch, which only matters with a stable instance.
  */
-typealias AnnounceRoute = uniffi.moq.MoqAnnounceRoute
+typealias RouteOptions = uniffi.moq.MoqRouteOptions
 
 /**
- * An observed path-prefix route: the instance of the stream it serves, relay hop ids (oldest
- * first), and static production and link cost (lower wins).
+ * The read-only facts on a received route: the instance of the stream it serves, relay hop ids
+ * (oldest first), and static production and link cost (lower wins).
  */
-typealias Route = uniffi.moq.MoqRoute
+typealias RouteInfo = uniffi.moq.MoqRouteInfo
 
 /** Tunes how a track subscription is delivered: priority, delay, ranges, and group ordering. */
 typealias Subscription = uniffi.moq.MoqSubscription
diff --git a/kt/moq/src/jvmAndAndroidMain/kotlin/dev/moq/Flows.kt b/kt/moq/src/jvmAndAndroidMain/kotlin/dev/moq/Flows.kt
index 1cb73bbe325..bf2fc6a62bc 100644
--- a/kt/moq/src/jvmAndAndroidMain/kotlin/dev/moq/Flows.kt
+++ b/kt/moq/src/jvmAndAndroidMain/kotlin/dev/moq/Flows.kt
@@ -47,9 +47,11 @@ fun BroadcastRequests.requestedTracks(): Flow<TrackRequest> =
 /** Stream of the fills readers of one track need. */
 fun TrackRequests.requestedFills(): Flow<Fill> = pull({ cancel() }) { requestedFill() }
 
-/** Stream of broadcasts requested by consumers. */
-fun OriginRequests.requestedBroadcasts(): Flow<BroadcastRequest> =
-    pull({ cancel() }) { requestedBroadcast() }
+/**
+ * Stream of broadcasts requested beneath a prefix route, ending once the origin closes. Ending the
+ * collection leaves the route advertised; close or cancel the route to retract it.
+ */
+fun Route.requestedBroadcasts(): Flow<BroadcastRequest> = pull { requested() }
 
 /** Stream of timestamped raw frames within a group. */
 fun GroupConsumer.frames(): Flow<Frame> = pull({ cancel() }) { readFrame() }
diff --git a/kt/moq/src/jvmAndAndroidMain/kotlin/dev/moq/Moq.kt b/kt/moq/src/jvmAndAndroidMain/kotlin/dev/moq/Moq.kt
index 89b15bc41a6..c7d738c2eb4 100644
--- a/kt/moq/src/jvmAndAndroidMain/kotlin/dev/moq/Moq.kt
+++ b/kt/moq/src/jvmAndAndroidMain/kotlin/dev/moq/Moq.kt
@@ -4,8 +4,8 @@ package dev.moq
  * A MoQ session with publish/subscribe conveniences.
  *
  * Build one with [Moq.connect]. The underlying [session] always exposes a publisher and a
- * subscriber (wired from the origins in its [ClientConfig], or auto-created), so you can
- * [createBroadcast] and collect [announced] updates without touching the raw [Client] handle.
+ * subscriber (wired from the origins in its [ClientConfig], or auto-created), so you can [route]
+ * and collect [announced] updates without touching the raw [Client] handle.
  *
  * Call [shutdown], then await [Session.closed] to drain finished tracks before disconnecting.
  * [AutoCloseable] disposal through `use { ... }` or [close] cancels immediately.
@@ -17,13 +17,14 @@ internal constructor(
     private val client: Client,
 ) : AutoCloseable {
     /**
-     * Create an unannounced broadcast at [path], invisible to everyone until announced.
+     * Create a route at exactly [path], owning a new broadcast to fill.
      *
-     * Fill `broadcast()`, then advertise it with `announce`. The broadcast's `end()` ends it for
-     * good, as does releasing its last handle: the publication, each `broadcast()`, and
-     * `requests()`.
+     * Visible at once unless [options] is `hidden`: then fill `broadcast()` and advertise it with
+     * `announce()`. Hold the route while it should stay announced: closing it retracts it, and the
+     * broadcast's `end()` ends both.
      */
-    fun createBroadcast(path: String): Publication = session.publish().createBroadcast(path)
+    fun route(path: String, options: RouteOptions = RouteOptions()): Route =
+        session.publish().route(path, options)
 
     /**
      * List the paths matching [config] as each becomes present or absent; prefixes stay relative to
diff --git a/kt/moq/src/jvmAndAndroidMain/kotlin/dev/moq/Server.kt b/kt/moq/src/jvmAndAndroidMain/kotlin/dev/moq/Server.kt
index 25a4547156c..033e46d1f88 100644
--- a/kt/moq/src/jvmAndAndroidMain/kotlin/dev/moq/Server.kt
+++ b/kt/moq/src/jvmAndAndroidMain/kotlin/dev/moq/Server.kt
@@ -9,8 +9,8 @@ import uniffi.moq.MoqServer
 /**
  * A listening MoQ server with publish/subscribe conveniences.
  *
- * Build one with [Server.listen]. Broadcasts created via [createBroadcast] are served to incoming
- * sessions, and [requests] streams each incoming [Request] for the caller to accept or reject.
+ * Build one with [Server.listen]. Broadcasts created via [route] are served to incoming sessions,
+ * and [requests] streams each incoming [Request] for the caller to accept or reject.
  *
  * [Server] is [AutoCloseable]; `use { ... }` (or [close]) stops accepting new sessions. In-flight
  * sessions stay alive until their handles are dropped or cancelled.
@@ -24,15 +24,15 @@ internal constructor(
     private val publishOrigin: OriginProducer?,
 ) : AutoCloseable {
     /**
-     * Create an unannounced broadcast at [path], served to incoming sessions once announced.
+     * Create a route at exactly [path], served to incoming sessions while announced.
      *
-     * Fill `broadcast()`, then advertise it with `announce`. The broadcast's `end()` ends it for
-     * good, as does releasing its last handle: the publication, each `broadcast()`, and
-     * `requests()`.
+     * Visible at once unless [options] is `hidden`: then fill `broadcast()` and advertise it with
+     * `announce()`. Hold the route while it should stay announced: closing it retracts it, and the
+     * broadcast's `end()` ends both.
      */
-    fun createBroadcast(path: String): Publication {
+    fun route(path: String, options: RouteOptions = RouteOptions()): Route {
         val origin = publishOrigin ?: throw IllegalStateException("no publish origin configured")
-        return origin.createBroadcast(path)
+        return origin.route(path, options)
     }
 
     /**
diff --git a/kt/moq/src/jvmAndAndroidTest/kotlin/dev/moq/SmokeTest.kt b/kt/moq/src/jvmAndAndroidTest/kotlin/dev/moq/SmokeTest.kt
index 9c40670f10d..bdb48cef8c3 100644
--- a/kt/moq/src/jvmAndAndroidTest/kotlin/dev/moq/SmokeTest.kt
+++ b/kt/moq/src/jvmAndAndroidTest/kotlin/dev/moq/SmokeTest.kt
@@ -30,6 +30,7 @@ import kotlin.test.Test
 import kotlin.test.assertEquals
 import kotlin.test.assertFailsWith
 import kotlin.test.assertIs
+import kotlin.test.assertNotEquals
 import kotlin.test.assertNotNull
 import kotlin.test.assertNull
 import kotlin.test.assertTrue
@@ -210,7 +211,7 @@ class SmokeTest {
     fun `origin alias constructs and consumes`() = runTest {
         OriginProducer(OriginConfig()).use { origin ->
             origin.consume().use { /* lifecycle smoke */ }
-            origin.requests("").use { /* dynamic origin smoke */ }
+            origin.routePrefix("", RouteOptions()).use { /* prefix route smoke */ }
         }
     }
 
@@ -690,9 +691,9 @@ class SmokeTest {
                 assertEquals(1, fingerprints.size)
                 assertEquals(64, fingerprints[0].length)
 
-                server.createBroadcast("live").use { publication ->
-                    publication.announce(AnnounceRoute())
-                    publication.unannounce()
+                server.route("live", RouteOptions(hidden = true)).use { route ->
+                    route.announce()
+                    route.withdraw()
                 }
             }
     }
@@ -772,57 +773,75 @@ class SmokeTest {
     @Test
     fun `a broadcast is reachable only while announced`() = runTest {
         OriginProducer(OriginConfig()).use { origin ->
-            origin.createBroadcast("live").use { publication ->
-                publication.broadcast().use { it.publishTrack("events", null) }
+            origin.route("live", RouteOptions(hidden = true)).use { route ->
+                route.broadcast().use { it.publishTrack("events", null) }
                 val consumer = origin.consume()
                 assertFailsWith<MoqException> { consumer.request("live") }
 
-                publication.announce(AnnounceRoute())
+                route.announce()
                 val announced = consumer.announced(AnnounceConfig())
                 val first = assertIs<AnnounceEventPresent>(announced.nextRoute())
                 assertEquals("live", first.announce.prefix)
+                assertEquals(route.instance(), first.announce.route.instance)
 
-                publication.unannounce()
+                route.withdraw()
                 val retracted = assertIs<AnnounceEventAbsent>(announced.nextRoute())
                 assertEquals("live", retracted.announce.prefix)
                 assertFailsWith<MoqException> { consumer.request("live") }
 
-                publication.announce(AnnounceRoute())
-                assertIs<AnnounceEventPresent>(announced.nextRoute())
+                // Announcing again continues the same stream.
+                route.announce()
+                val again = assertIs<AnnounceEventPresent>(announced.nextRoute())
+                assertEquals(route.instance(), again.announce.route.instance)
                 consumer.request("live")
             }
         }
     }
 
     @Test
-    fun `closing a publication keeps its route until the broadcast ends`() = runTest {
+    fun `closing a route retracts it while its broadcast lives on`() = runTest {
         OriginProducer(OriginConfig()).use { origin ->
             val consumer = origin.consume()
             val announced = consumer.announced(AnnounceConfig())
-            val publication = origin.createBroadcast("live")
-            publication.broadcast().use { broadcast ->
-                publication.use { it.announce(AnnounceRoute()) }
+            val route = origin.route("live", RouteOptions())
+            route.broadcast().use { broadcast ->
                 assertIs<AnnounceEventPresent>(announced.nextRoute())
                 consumer.request("live")
 
+                route.close()
+                assertIs<AnnounceEventAbsent>(announced.nextRoute())
+                assertFailsWith<MoqException> { consumer.request("live") }
+                broadcast.publishTrack("events", null)
                 broadcast.end()
+            }
+        }
+    }
+
+    @Test
+    fun `ending the broadcast retracts its route`() = runTest {
+        OriginProducer(OriginConfig()).use { origin ->
+            val consumer = origin.consume()
+            val announced = consumer.announced(AnnounceConfig())
+            origin.route("live", RouteOptions()).use { route ->
+                assertIs<AnnounceEventPresent>(announced.nextRoute())
+                route.broadcast().use { it.end() }
                 assertIs<AnnounceEventAbsent>(announced.nextRoute())
                 assertFailsWith<MoqException> { consumer.request("live") }
+                assertFailsWith<MoqException.Closed> { route.announce() }
             }
         }
     }
 
     @Test
-    fun `a stale publication leaves its replacement alone`() = runTest {
+    fun `a stale route leaves its replacement alone`() = runTest {
         OriginProducer(OriginConfig()).use { origin ->
-            origin.createBroadcast("live").use { stale ->
-                stale.announce(AnnounceRoute())
+            origin.route("live", RouteOptions()).use { stale ->
                 stale.broadcast().use { it.end() }
 
-                origin.createBroadcast("live").use { replacement ->
-                    replacement.announce(AnnounceRoute())
-                    assertFailsWith<MoqException.Closed> { stale.announce(AnnounceRoute()) }
-                    assertFailsWith<MoqException.Closed> { stale.unannounce() }
+                origin.route("live", RouteOptions()).use { replacement ->
+                    assertFailsWith<MoqException.Closed> { stale.announce() }
+                    assertFailsWith<MoqException.Closed> { stale.setCost(1uL) }
+                    stale.withdraw()
                     origin.consume().request("live")
                     replacement.broadcast().use { it.end() }
                 }
@@ -836,22 +855,25 @@ class SmokeTest {
             val consumer = origin.consume()
             val announced = consumer.announced(AnnounceConfig())
             val following = consumer.follow("instance", null)
-            origin.createBroadcast("instance").use { publication ->
-                publication.announce(AnnounceRoute())
+            origin.route("instance", RouteOptions()).use { first ->
                 val present = assertIs<AnnounceEventPresent>(announced.nextRoute())
                 assertTrue(present.announce.route.instance.isNotEmpty())
+                assertEquals(first.instance(), present.announce.route.instance)
                 assertNotNull(following.available()).close()
 
-                publication.announce(AnnounceRoute(instance = "camera", epoch = 1uL))
-                assertNotNull(following.available()).close()
+                origin.route("instance", RouteOptions(instance = "camera", epoch = 1uL)).use {
+                    second ->
+                    assertNotNull(following.available()).close()
 
-                // The takeover was not listed, so the next event is the path going absent.
-                publication.unannounce()
-                val absent = assertIs<AnnounceEventAbsent>(announced.nextRoute())
-                assertEquals("camera", absent.announce.route.instance)
+                    // The takeover was not listed, so the next event is the path going absent.
+                    first.withdraw()
+                    second.withdraw()
+                    val absent = assertIs<AnnounceEventAbsent>(announced.nextRoute())
+                    assertEquals("camera", absent.announce.route.instance)
+                }
 
                 assertFailsWith<MoqException.InvalidInstance> {
-                    publication.announce(AnnounceRoute(instance = ""))
+                    origin.route("refused", RouteOptions(instance = ""))
                 }
             }
             following.cancel()
@@ -862,14 +884,13 @@ class SmokeTest {
     fun `a follower reports the path going offline and the next broadcast`() = runTest {
         OriginProducer(OriginConfig()).use { origin ->
             val following = origin.consume().follow("offline", null)
-            origin.createBroadcast("offline").use { publication ->
-                publication.announce(AnnounceRoute())
+            origin.route("offline", RouteOptions()).use { route ->
                 assertNotNull(following.available()).close()
 
-                publication.unannounce()
+                route.withdraw()
                 assertNull(following.available())
 
-                publication.announce(AnnounceRoute())
+                route.announce()
                 assertNotNull(following.available()).close()
             }
             following.cancel()
@@ -881,8 +902,7 @@ class SmokeTest {
         OriginProducer(OriginConfig()).use { origin ->
             val announced =
                 origin.consume().announced(AnnounceConfig(prefix = "room", filter = "*/chat"))
-            origin.createBroadcast("room/alice/chat").use { publication ->
-                publication.announce(AnnounceRoute())
+            origin.route("room/alice/chat", RouteOptions()).use {
                 val update = assertIs<AnnounceEventPresent>(announced.nextRoute())
                 assertEquals("room/alice/chat", update.announce.prefix)
                 assertEquals(listOf("alice"), update.announce.captures)
@@ -893,21 +913,23 @@ class SmokeTest {
     @Test
     fun `dynamic serves a request under a prefix`() = runTest {
         OriginProducer(OriginConfig()).use { origin ->
-            origin.requests("live").use { dynamic ->
+            origin.routePrefix("live", RouteOptions()).use { dynamic ->
+                assertFailsWith<MoqException.Internal> { dynamic.broadcast() }
                 val pending = async {
                     origin.consume().request("live/cam")
                 }
-                val request = dynamic.requestedBroadcast()
+                val request = assertNotNull(dynamic.requested())
                 assertEquals("live/cam", request.path())
-                request.prepare().use { prepared ->
-                    prepared.broadcast().use { fill ->
-                        prepared.publish().use { publication ->
-                            pending.await()
-                            // The publication fills the broadcast it prepared: ending one ends the
-                            // other.
-                            publication.broadcast().use { it.end() }
-                            assertFailsWith<MoqException.Closed> { fill.publishTrack("late", null) }
-                        }
+                request.route(RouteOptions(hidden = true)).use { job ->
+                    assertNotEquals(dynamic.instance(), job.instance())
+                    job.broadcast().use { fill ->
+                        // Only announcing answers the requester.
+                        job.announce()
+                        pending.await()
+                        // The route hands out one broadcast: ending it ends the route too.
+                        job.broadcast().use { it.end() }
+                        assertFailsWith<MoqException.Closed> { fill.publishTrack("late", null) }
+                        assertFailsWith<MoqException.Closed> { job.announce() }
                     }
                 }
             }
@@ -1044,8 +1066,8 @@ class SmokeTest {
     @Test
     fun `audio consumer reports its playout delay`() = runTest {
         OriginProducer(OriginConfig()).use { origin ->
-            origin.createBroadcast("audio-delay").use { publication ->
-                publication.broadcast().use { broadcast ->
+            origin.route("audio-delay", RouteOptions(hidden = true)).use { route ->
+                route.broadcast().use { broadcast ->
                     val audio =
                         AudioProducer(
                             CatalogProducer(broadcast),
@@ -1060,7 +1082,7 @@ class SmokeTest {
                                 track = "mic",
                             ),
                         )
-                    publication.announce(AnnounceRoute())
+                    route.announce()
 
                     val consumer = origin.consume().request("audio-delay")
                     val catalog = CatalogConsumer.subscribe(consumer).next()!!
@@ -1116,8 +1138,8 @@ class SmokeTest {
     @Test
     fun `decoded video frame owns its picture`() = runTest {
         OriginProducer(OriginConfig()).use { origin ->
-            origin.createBroadcast("video-decode-frame").use { publication ->
-                publication.broadcast().use { broadcast ->
+            origin.route("video-decode-frame", RouteOptions(hidden = true)).use { route ->
+                route.broadcast().use { broadcast ->
                     val video =
                         VideoProducer(
                             CatalogProducer(broadcast),
@@ -1138,7 +1160,7 @@ class SmokeTest {
                                 bandwidth = null,
                             ),
                         )
-                    publication.announce(AnnounceRoute())
+                    route.announce()
 
                     // Seed the track so a subscriber joining below lands on encoded media.
                     val rgba = ByteArray(320 * 240 * 4) { 0x80.toByte() }
diff --git a/kt/moq/src/jvmTest/kotlin/dev/moq/FfiBench.kt b/kt/moq/src/jvmTest/kotlin/dev/moq/FfiBench.kt
index 1fa325f5e59..d66b8fa64aa 100644
--- a/kt/moq/src/jvmTest/kotlin/dev/moq/FfiBench.kt
+++ b/kt/moq/src/jvmTest/kotlin/dev/moq/FfiBench.kt
@@ -83,8 +83,8 @@ class FfiBench {
         kotlinx.coroutines.coroutineScope {
             // Close every handle inside the case, so native teardown never lands in a later one.
             val origin = OriginProducer(OriginConfig(cacheCapacityBytes = CACHE_BYTES))
-            val publication = origin.createBroadcast("bench")
-            val broadcast = publication.broadcast()
+            val route = origin.route("bench", RouteOptions(hidden = true))
+            val broadcast = route.broadcast()
             val tracks =
                 (0 until case.publishers).map {
                     broadcast.publishTrack("$it", TrackInfo(timescale = 1_000_000uL))
@@ -142,7 +142,7 @@ class FfiBench {
             val mb = (n - WARMUP) * case.delivered / 1e6
             results += Result("throughput/${case.name}", "MB/s", mb / (wallNs / 1e9))
             results += Result("cpu/${case.name}", "ms/MB", cpuUsedNs / 1e6 / mb)
-            (consumers + tracks + listOf(broadcast, publication, origin)).forEach { it.close() }
+            (consumers + tracks + listOf(broadcast, route, origin)).forEach { it.close() }
         }
 
     private inline fun call(name: String, results: MutableList<Result>, fn: () -> Unit) {
diff --git a/py/moq-ffi/tests/exit_inside_callback.py b/py/moq-ffi/tests/exit_inside_callback.py
index 9e2ec2038de..6520a4cd2a9 100644
--- a/py/moq-ffi/tests/exit_inside_callback.py
+++ b/py/moq-ffi/tests/exit_inside_callback.py
@@ -54,9 +54,8 @@ def _preempted_continuation(future_ptr, poll_code):
 
 async def main() -> None:
     origin = moq_ffi.MoqOriginProducer(moq_ffi.MoqOriginConfig())
-    publication = origin.create_broadcast("exit")
-    publication.announce(moq_ffi.MoqAnnounceRoute())
-    broadcast = publication.broadcast()
+    route = origin.route("exit", moq_ffi.MoqRouteOptions())
+    broadcast = route.broadcast()
     track = broadcast.publish_track("data", moq_ffi.MoqTrackInfo(timescale=1_000_000))
 
     consumer = await origin.consume().request("exit")
diff --git a/py/moq-rs/MIGRATE.md b/py/moq-rs/MIGRATE.md
index eba8ff96742..e4974c0906f 100644
--- a/py/moq-rs/MIGRATE.md
+++ b/py/moq-rs/MIGRATE.md
@@ -16,6 +16,20 @@ Another publisher instance taking a path over keeps it present and is not listed
 Later calls return `None` when the path goes offline, or, when following an `instance`, when another instance takes it over, then the next broadcast once something serves the path again; the first call never returns `None`.
 Stop reading the previous broadcast on `None` and call `available()` again. A caller that only awaits the first broadcast can assert it is not `None`.
 
+### Publishing goes through one `Route` handle
+
+`OriginProducer.create_broadcast(path)` (and `Client.create_broadcast` / `Server.create_broadcast`) is `route(path, *, hidden=False, cost=0, instance=None, epoch=0)`, and `OriginProducer.requests(prefix)` is `route_prefix(prefix, ...)`. Both return a `moq.Route`, which replaces `Publication`, `OriginRequests`, and `BroadcastPrepared`:
+
+- `Publication.broadcast` is `Route.broadcast`, which raises `Error.Internal` on a prefix route.
+- `Publication.announce(AnnounceRoute(...))` is `Route.announce()`; pass the cost and instance to `route()` instead, and re-price with `set_cost(cost)`. `unannounce()` is `withdraw()`.
+- `OriginRequests.requested_broadcast()` is `Route.requested()`, which returns `None` once the origin closes; `async for` still iterates the requests.
+- `BroadcastRequest.prepare()` then `.publish()` is `BroadcastRequest.route(hidden=True)`, then fill `.broadcast` and call `announce()`.
+- `Route.instance` is the stream's instance, minted at creation and kept across `withdraw()` and `announce()`.
+
+A route is visible at once unless `hidden=True`, so pass it and call `announce()` after filling the catalog to keep the old create-then-announce order. Hold the `Route` while the broadcast should stay announced: dropping or cancelling it retracts it, while `broadcast.close()` still ends both.
+
+`AnnounceRoute` is gone, and `moq.Route` now names the handle: the read-only facts on `Announce.route` are `moq.RouteInfo`.
+
 ### Catalog renditions carry their warmup ([#7864](https://github.com/moq-dev/moq/pull/7864))
 
 `Video` and `Audio` gain `warmup`, the catalog's decoder warmup; it defaults to `None` as the last field, so existing code keeps working. `TrackConsumer` and the audio and video consumers read it from the rendition and start that much earlier.
diff --git a/py/moq-rs/README.md b/py/moq-rs/README.md
index bbaa3f5ae16..b09a547121e 100644
--- a/py/moq-rs/README.md
+++ b/py/moq-rs/README.md
@@ -57,8 +57,9 @@ import moq
 
 async def main():
     async with moq.Client("https://cdn.moq.dev/anon") as client:
-        publication = client.create_broadcast("my-stream")
-        broadcast = publication.broadcast
+        # Hidden until announced; hold the route, since dropping it retracts the broadcast.
+        route = client.route("my-stream", hidden=True)
+        broadcast = route.broadcast
 
         # Publish an Opus audio track (init bytes from your encoder)
         audio = moq.media.TrackProducer.audio(
@@ -72,8 +73,8 @@ async def main():
         audio.write_frame(payload, timestamp=moq.Timestamp(20, 1_000))
         audio.cut()
 
-        # Each broadcast mints a fresh instance, so viewers see a restart as a new stream.
-        publication.announce()
+        # Each route mints a fresh instance, so viewers see a restart as a new stream.
+        route.announce()
 
         # Clean up
         audio.finish()
@@ -92,9 +93,9 @@ import moq
 
 async def main():
     async with moq.Server("127.0.0.1:4443", tls_generate=["localhost"]) as server:
-        publication = server.create_broadcast("hello")
-        track = publication.broadcast.publish_track("events")
-        publication.announce()
+        route = server.route("hello", hidden=True)
+        track = route.broadcast.publish_track("events")
+        route.announce()
         print(f"listening on https://{server.local_addr}")
 
         sessions = []
@@ -148,7 +149,7 @@ client = moq.Client(
   - `keylog`. Write TLS session secrets to the file `SSLKEYLOGFILE` names, for decrypting a capture; without `SSLKEYLOGFILE` entering the server fails.
   - `.local_addr`. The bound address (useful when binding to port `0`).
   - `.cert_fingerprints()`. SHA-256 fingerprints of the configured TLS certificates, for `serverCertificateHashes` browser cert pinning.
-  - `.create_broadcast(path) → Publication`. Create an unannounced broadcast, invisible to everyone; fill `.broadcast`, then `announce()` makes it discoverable and reachable; `.broadcast.close()` ends it.
+  - `.route(path, *, hidden=False, cost=0, instance=None, epoch=0) → Route`. Create a route owning a broadcast to fill at `.broadcast`. Create it `hidden` to fill it before `announce()` makes it discoverable and reachable; dropping or cancelling the route retracts it, and `.broadcast.close()` ends both.
 - **`Request`**. An incoming session, yielded by `async for request in server`.
   - `.url`, `.path`, `.query`, `.transport`. The query-free path is uniform across transports; the root or missing path is `""`. The encoded query may contain credentials.
   - `await .accept(*, publish=None, consume=None) → Session`. Origins are captured when accept starts; None inherits the server default and a supplied origin replaces it. Pass fresh origins for isolation, or the same origin on both sides to share it. A second response raises `AlreadyResponded`; calls after cancel raise `Cancelled`. Complete the handshake (hold the result to keep the connection alive).
@@ -245,20 +246,19 @@ same either way. Opaque bytes go on a plain `TrackProducer`.
 - **`GroupConsumer`**. Async iterator of raw `Frame`s.
   - `.read_frame() -> Frame | None` returns a raw frame with optional capture time.
 
-Every handle whose cleanup is `cancel()` is an async context manager, so exiting `async with` releases it: the consumers (`media.CatalogConsumer`, `media.TrackConsumer`, `media.GroupConsumer`, `TrackConsumer`, `audio.Consumer`, `video.Consumer`, `GroupConsumer`, `json.SnapshotConsumer`, `json.StreamConsumer`, `json.WindowConsumer`, `AnnounceConsumer`, `Following`) and the dynamic sources (`OriginRequests`, `BroadcastRequests`, `TrackRequests`).
+Every handle whose cleanup is `cancel()` is an async context manager, so exiting `async with` releases it: the consumers (`media.CatalogConsumer`, `media.TrackConsumer`, `media.GroupConsumer`, `TrackConsumer`, `audio.Consumer`, `video.Consumer`, `GroupConsumer`, `json.SnapshotConsumer`, `json.StreamConsumer`, `json.WindowConsumer`, `AnnounceConsumer`, `Following`) and the dynamic sources (`Route`, `BroadcastRequests`, `TrackRequests`).
 
 ### Origin (advanced)
 
 - **`OriginProducer(*, cache_capacity_bytes=None)`**. Manage broadcast announcements. Set `cache_capacity_bytes` to bound cached groups under this origin.
   - `.consume() → OriginConsumer`
-  - `.requests(prefix) → OriginRequests`
-  - `.create_broadcast(path) → Publication`
-- **`Publication`**. A broadcast published on an origin. Dropping it keeps the route; closing the broadcast ends it.
-  - `.broadcast → BroadcastProducer`. The broadcast to fill.
-  - `.announce(route=None)`, `.unannounce()`. Advertise or retract its exact path; both raise `Closed` once the broadcast closed.
-- **`OriginRequests`**. Async source of broadcasts requested by consumers.
-  - `await .requested_broadcast() → BroadcastRequest`. Call `.serve(consumer)` to answer with held content under the prefix route's continuous sequence space, `.prepare()` then fill its `.broadcast` and `.publish() → Publication` for an independently restarting job under a fresh instance, or `.reject(code)` to fail the requester.
-  - Async iterator yielding `BroadcastRequest`
+  - `.route(path, *, hidden=False, cost=0, instance=None, epoch=0) → Route`. An exact route owning a new broadcast, visible at once unless `hidden`, under a fresh instance unless `instance` names one.
+  - `.route_prefix(prefix, *, hidden=False, cost=0, instance=None, epoch=0) → Route`. A prefix route that yields the requests beneath it.
+- **`Route`**. A route on an origin. Hold it: dropping or cancelling it retracts it, and so does closing its broadcast.
+  - `.broadcast → BroadcastProducer`. The broadcast an exact route owns; raises `Internal` on a prefix route.
+  - `.instance`. The stream it serves, kept across `withdraw()` and `announce()`.
+  - `.announce()`, `.withdraw()`, `.set_cost(cost)`. Show, hide, or re-price it in place; `announce` and `set_cost` raise `Closed` once the broadcast closed.
+  - `await .requested() → BroadcastRequest | None`, or async iteration over a prefix route. Call `.serve(consumer)` to answer with held content under the prefix route's continuous sequence space, `.route(hidden=..., ...)` for the path's own route under a fresh instance, as an independently restarting job, or `.reject(code)` to fail the requester.
 - **`OriginConsumer`**. Discover broadcasts.
   - `.announced(prefix, filter=None) → AnnounceConsumer` (async iterator of `AnnounceEvent`: `AnnounceEventPresent` or `AnnounceEventAbsent`, each carrying an `Announce` whose `.route.instance` names the stream; another instance taking a path over keeps it present, so `follow` the path to see that); `filter` is a pattern relative to the literal prefix, while each `Announce.prefix` stays origin-relative and `.captures` is a required list of wildcard matches, empty without wildcards
   - `.follow(path, instance=None) → Following` (awaitable, waits until something serves the path, then returns each stream that takes over, or `None` once the path goes offline; an `instance` follows only that stream)
diff --git a/py/moq-rs/benches/ffi.py b/py/moq-rs/benches/ffi.py
index f5049c4cad2..120441b4228 100644
--- a/py/moq-rs/benches/ffi.py
+++ b/py/moq-rs/benches/ffi.py
@@ -70,7 +70,8 @@ async def read(case: Case, consumer: moq.TrackConsumer, payload: bytes, n: int)
 
 async def throughput(case: Case, results: list[dict]) -> None:
     origin = moq.OriginProducer(cache_capacity_bytes=CACHE_BYTES)
-    broadcast = origin.create_broadcast("bench").broadcast
+    route = origin.route("bench", hidden=True)
+    broadcast = route.broadcast
     tracks = [broadcast.publish_track(str(p), moq.TrackInfo(timescale=1_000_000)) for p in range(case.publishers)]
     consumers = [track.consume() for track in tracks for _ in range(case.subscribers)]
     # A non-uniform payload, so a zero-filled or truncated copy fails the check.
diff --git a/py/moq-rs/docs/index.md b/py/moq-rs/docs/index.md
index fcb8b948027..af3f45afdfd 100644
--- a/py/moq-rs/docs/index.md
+++ b/py/moq-rs/docs/index.md
@@ -170,8 +170,7 @@ broadcast, and producers advertise it in the catalog.
 
    OriginProducer
    OriginConsumer
-   OriginRequests
-   Publication
+   Route
    AnnounceConsumer
    Following
    Announce
@@ -216,8 +215,7 @@ Rust side ([`moq-ffi`](https://crates.io/crates/moq-ffi)).
    Subscription
    TrackInfo
    FetchGroupOptions
-   AnnounceRoute
-   Route
+   RouteInfo
    ConnectionStats
 ```
 
diff --git a/py/moq-rs/examples/clock.py b/py/moq-rs/examples/clock.py
index 4df4e102f8b..d251cecf3ce 100644
--- a/py/moq-rs/examples/clock.py
+++ b/py/moq-rs/examples/clock.py
@@ -17,9 +17,9 @@
 
 async def publish(url: str, broadcast_name: str, track_name: str, insecure: bool) -> None:
     async with moq.Client(url, tls=moq.ClientTls(insecure=insecure)) as client:
-        publication = client.create_broadcast(broadcast_name)
-        track = publication.broadcast.publish_track(track_name, moq.TrackInfo(timescale=1_000_000))
-        publication.announce()
+        route = client.route(broadcast_name, hidden=True)
+        track = route.broadcast.publish_track(track_name, moq.TrackInfo(timescale=1_000_000))
+        route.announce()
         print(f"publishing {broadcast_name!r} track={track_name!r} at {url}")
 
         while True:
diff --git a/py/moq-rs/examples/serve_clock.py b/py/moq-rs/examples/serve_clock.py
index 5df6325cb1a..01e4871700a 100644
--- a/py/moq-rs/examples/serve_clock.py
+++ b/py/moq-rs/examples/serve_clock.py
@@ -20,9 +20,9 @@
 
 async def run(bind: str, broadcast_name: str, track_name: str, host: str) -> None:
     async with moq.Server(bind, tls_generate=[host]) as server:
-        publication = server.create_broadcast(broadcast_name)
-        track = publication.broadcast.publish_track(track_name, moq.TrackInfo(timescale=1_000_000))
-        publication.announce()
+        route = server.route(broadcast_name, hidden=True)
+        track = route.broadcast.publish_track(track_name, moq.TrackInfo(timescale=1_000_000))
+        route.announce()
         print(f"serving {broadcast_name!r} track={track_name!r} on https://{server.local_addr}")
         for fp in server.cert_fingerprints():
             print(f"  cert fingerprint sha256: {fp}")
diff --git a/py/moq-rs/moq/__init__.py b/py/moq-rs/moq/__init__.py
index b5b74fc4c2b..713abae9278 100644
--- a/py/moq-rs/moq/__init__.py
+++ b/py/moq-rs/moq/__init__.py
@@ -20,13 +20,11 @@
     AnnounceEvent,
     AnnounceEventAbsent,
     AnnounceEventPresent,
-    BroadcastPrepared,
     BroadcastRequest,
     Following,
     OriginConsumer,
     OriginProducer,
-    OriginRequests,
-    Publication,
+    Route,
 )
 from .publish import (
     BroadcastProducer,
@@ -57,7 +55,6 @@
 )
 from .types import (
     Anchor,
-    AnnounceRoute,
     AudioCodec,
     AudioEncoderInput,
     AudioSampleFormat,
@@ -80,7 +77,7 @@
     QuicConfig,
     Range,
     RateTarget,
-    Route,
+    RouteInfo,
     Subscription,
     Timestamp,
     TrackInfo,
@@ -101,7 +98,6 @@
     "AnnounceEvent",
     "AnnounceEventAbsent",
     "AnnounceEventPresent",
-    "AnnounceRoute",
     "AudioCodec",
     "AudioEncoderInput",
     "AudioSampleFormat",
@@ -109,7 +105,6 @@
     "BandwidthConsumer",
     "BroadcastConsumer",
     "BroadcastRequests",
-    "BroadcastPrepared",
     "BroadcastProducer",
     "BroadcastRequest",
     "Client",
@@ -139,17 +134,16 @@
     "GroupConsumer",
     "GroupProducer",
     "OriginConsumer",
-    "OriginRequests",
     "OriginProducer",
     "Order",
     "Position",
-    "Publication",
     "Range",
     "RateControl",
     "RateTarget",
     "Request",
     "Reservation",
     "Route",
+    "RouteInfo",
     "Server",
     "Session",
     "Subscription",
diff --git a/py/moq-rs/moq/client.py b/py/moq-rs/moq/client.py
index 2394adea5df..c65e489bb0a 100644
--- a/py/moq-rs/moq/client.py
+++ b/py/moq-rs/moq/client.py
@@ -14,7 +14,7 @@
 )
 
 from ._records import Backoff, ClientTls, QuicConfig, WebSocketConfig, _implementation, _strs
-from .origin import AnnounceConsumer, Following, OriginConsumer, OriginProducer, Publication
+from .origin import AnnounceConsumer, Following, OriginConsumer, OriginProducer, Route
 from .session import Session
 from .subscribe import BroadcastConsumer
 
@@ -155,12 +155,14 @@ async def __aexit__(self, *exc) -> None:
                 self._inner.cancel()
                 self._inner = None
 
-    def create_broadcast(self, path: str) -> Publication:
-        """Create an unannounced broadcast at ``path``, invisible until announced. Announce it after populating tracks.
+    def route(
+        self, path: str, *, hidden: bool = False, cost: int = 0, instance: str | None = None, epoch: int = 0
+    ) -> Route:
+        """Create a route at ``path`` owning a broadcast to fill; hold it to keep it announced.
 
-        See :meth:`OriginProducer.create_broadcast`.
+        See :meth:`OriginProducer.route`.
         """
-        return self._require_publisher().create_broadcast(path)
+        return self._require_publisher().route(path, hidden=hidden, cost=cost, instance=instance, epoch=epoch)
 
     def announced(self, prefix: str = "", *, filter: str | None = None, hidden: bool = False) -> AnnounceConsumer:
         """Async-iterate broadcasts under ``prefix`` matching an optional pattern.
diff --git a/py/moq-rs/moq/origin.py b/py/moq-rs/moq/origin.py
index 090aabc1c53..fac2485f231 100644
--- a/py/moq-rs/moq/origin.py
+++ b/py/moq-rs/moq/origin.py
@@ -7,20 +7,18 @@
     MoqAnnounceConfig,
     MoqAnnounceConsumer,
     MoqAnnounceEvent,
-    MoqBroadcastPrepared,
     MoqBroadcastRequest,
     MoqFollowing,
     MoqOriginConfig,
     MoqOriginConsumer,
     MoqOriginProducer,
-    MoqOriginRequests,
-    MoqPublication,
+    MoqRoute,
+    MoqRouteOptions,
 )
 
 from ._stream import _Stream
 from .publish import BroadcastProducer
 from .subscribe import BroadcastConsumer
-from .types import AnnounceRoute
 
 Announce = MoqAnnounce
 """A route over a prefix: the origin-relative ``prefix``, what each filter wildcard
@@ -103,8 +101,12 @@ def cancel(self) -> None:
         self._inner.cancel()
 
 
+def _options(*, hidden: bool, cost: int, instance: str | None, epoch: int) -> MoqRouteOptions:
+    return MoqRouteOptions(hidden=hidden, cost=cost, instance=instance, epoch=epoch)
+
+
 class BroadcastRequest:
-    """A requested broadcast that has not been accepted yet."""
+    """A requested broadcast that has not been answered yet."""
 
     def __init__(self, inner: MoqBroadcastRequest) -> None:
         self._inner = inner
@@ -114,9 +116,16 @@ def path(self) -> str:
         """The requested broadcast path."""
         return self._inner.path()
 
-    def prepare(self) -> BroadcastPrepared:
-        """Start answering as a new stream under a fresh instance, hidden until published."""
-        return BroadcastPrepared(self._inner.prepare())
+    def route(self, *, hidden: bool = False, cost: int = 0, instance: str | None = None, epoch: int = 0) -> Route:
+        """Answer with the path's own exact :class:`Route`, owning a new broadcast.
+
+        The route serves a fresh instance unless ``instance`` names one, so a job that
+        restarts is a new stream. Created visible, it announces now and answers the waiting
+        requesters; created ``hidden``, they wait until :meth:`Route.announce`, so the job can
+        fill its catalog first, and cancelling the route before then refuses them. Ending the
+        route withdraws only this path.
+        """
+        return Route(self._inner.route(_options(hidden=hidden, cost=cost, instance=instance, epoch=epoch)))
 
     def serve(self, broadcast: BroadcastConsumer) -> None:
         """Serve held content under the prefix route's continuous sequence space, without an exact route."""
@@ -127,72 +136,75 @@ def reject(self, error_code: int) -> None:
         self._inner.reject(error_code)
 
 
-class BroadcastPrepared:
-    """A claim answer being filled before its exact route is announced."""
-
-    def __init__(self, inner: MoqBroadcastPrepared) -> None:
-        self._inner = inner
-        self._broadcast = BroadcastProducer._from_inner(inner.broadcast())
-
-    @property
-    def broadcast(self) -> BroadcastProducer:
-        """The unannounced broadcast to fill before publishing; only `publish` announces it."""
-        return self._broadcast
-
-    def publish(self) -> Publication:
-        """Announce the filled broadcast and resolve waiting requesters."""
-        return Publication(self._inner.publish(), self._broadcast)
+class Route(_Stream[BroadcastRequest]):
+    """A route on an origin: an exact route owning one broadcast, or a prefix route
+    yielding the requests beneath it.
 
-
-class Publication:
-    """A broadcast published on an origin: the broadcast to fill and its announcement.
-
-    Dropping it does not retract the route; :meth:`BroadcastProducer.close` does.
+    Hold it for as long as the route should stay advertised: dropping or cancelling it
+    retracts it, as does closing an exact route's broadcast. A broadcast handle alone does
+    not keep it announced. Iterate a prefix route with ``async for`` for its
+    :class:`BroadcastRequest` values; usable as an async context manager that cancels the
+    route on exit.
     """
 
-    def __init__(self, inner: MoqPublication, broadcast: BroadcastProducer) -> None:
+    def __init__(self, inner: MoqRoute) -> None:
         self._inner = inner
-        self._broadcast = broadcast
+        self._broadcast: BroadcastProducer | None = None
 
     @property
     def broadcast(self) -> BroadcastProducer:
-        """The broadcast to fill, without announcement control."""
+        """The broadcast this exact route owns, to fill with tracks.
+
+        Raises ``moq.Error.Internal`` on a prefix route, which owns none: answer its requests instead.
+        """
+        if self._broadcast is None:
+            self._broadcast = BroadcastProducer._from_inner(self._inner.broadcast())
         return self._broadcast
 
-    def announce(self, route: AnnounceRoute | None = None) -> None:
-        """Advertise the broadcast's exact path as a route, or re-price it in place.
+    @property
+    def instance(self) -> str:
+        """The stream this route serves, minted at creation unless one was named, and kept
+        across :meth:`withdraw` and :meth:`announce`."""
+        return self._inner.instance_id()
+
+    def announce(self) -> None:
+        """Make the route visible, or keep it so.
 
-        Until announced, the broadcast is invisible and unroutable for local
-        consumers and peers alike. Raises ``moq.Error.Closed`` once the broadcast closed.
+        A route from :meth:`BroadcastRequest.route` also answers the requesters waiting on
+        its path. Raises ``moq.Error.Closed`` once its broadcast closed.
         """
-        self._inner.announce(route if route is not None else AnnounceRoute())
+        self._inner.announce()
 
-    def unannounce(self) -> None:
-        """Retract the advertisement, if any, keeping the filled tracks alive.
+    def withdraw(self) -> None:
+        """Hide the route from everyone, keeping its broadcast and instance.
 
-        Announcing again brings it back. Raises ``moq.Error.Closed`` once the broadcast closed.
+        :meth:`announce` brings the same stream back; tracks already in flight carry on.
         """
-        self._inner.unannounce()
-
+        self._inner.withdraw()
 
-class OriginRequests(_Stream[BroadcastRequest]):
-    """A served route: advertises a prefix and yields requests beneath it.
+    def set_cost(self, cost: int) -> None:
+        """Re-price the route in place: lower wins among routes covering the same prefix.
 
-    Usable as an async context manager that cancels the route on exit.
-    """
+        A hidden route keeps the price for when it next announces. Raises
+        ``moq.Error.Closed`` once its broadcast closed.
+        """
+        self._inner.set_cost(cost)
 
-    def __init__(self, inner: MoqOriginRequests) -> None:
-        self._inner = inner
+    async def _next(self) -> BroadcastRequest | None:
+        return await self.requested()
 
-    async def _next(self) -> BroadcastRequest:
-        return await self.requested_broadcast()
+    async def requested(self) -> BroadcastRequest | None:
+        """Await the next broadcast a consumer requests beneath this prefix route.
 
-    async def requested_broadcast(self) -> BroadcastRequest:
-        """Await the next broadcast a consumer requested but that isn't published yet."""
-        return BroadcastRequest(await self._inner.requested_broadcast())
+        Serve, route, or reject it; the requester stays pending until then. Returns
+        ``None`` once the origin closes, and at once on an exact route.
+        """
+        request = await self._inner.requested()
+        return None if request is None else BroadcastRequest(request)
 
     def cancel(self) -> None:
-        """Stop serving and retract the route."""
+        """Retract the route and release it now. An exact route's broadcast lives on until
+        :meth:`BroadcastProducer.close`."""
         self._inner.cancel()
 
 
@@ -238,12 +250,11 @@ async def request(self, path: str, *, instance: str | None = None) -> BroadcastC
 
 
 class OriginProducer:
-    """The publishing side of an origin: announce broadcasts for consumers to discover.
+    """The publishing side of an origin: route broadcasts for consumers to discover.
 
-    Call :meth:`create_broadcast` to publish at a path, :meth:`consume` for a
-    matching :class:`OriginConsumer`, or :meth:`requests` to advertise a prefix
-    and serve on-demand requests. Create, :meth:`requests` if tracks are served
-    on demand, populate, then :meth:`Publication.announce`.
+    Call :meth:`route` to publish a broadcast at a path, :meth:`route_prefix` to
+    serve on-demand requests beneath a prefix, or :meth:`consume` for a matching
+    :class:`OriginConsumer`.
     """
 
     def __init__(self, *, cache_capacity_bytes: int | None = None) -> None:
@@ -260,25 +271,29 @@ def consume(self) -> OriginConsumer:
         """Create a consumer that discovers the broadcasts this origin publishes."""
         return OriginConsumer(self._inner.consume())
 
-    def requests(self, prefix: str) -> OriginRequests:
-        """Advertise ``prefix`` and serve the requests beneath it.
-
-        A route claims ``prefix`` and every path beneath it (``""`` claims every
-        path). A service that only serves some of them rejects the rest as they
-        are requested. Hold the returned handle while the route should stay
-        advertised.
+    def route(
+        self, path: str, *, hidden: bool = False, cost: int = 0, instance: str | None = None, epoch: int = 0
+    ) -> Route:
+        """Create a :class:`Route` at exactly ``path``, owning a new broadcast to fill.
+
+        Visible at once unless ``hidden``: a hidden route is invisible and unroutable, for
+        this origin's consumers and peers alike, until :meth:`Route.announce`, so create it
+        hidden to fill the catalog first. ``cost`` prices it: lower wins. The route serves a
+        fresh instance unless ``instance`` names a stable one, whose runs raise ``epoch``.
+        Hold the route: dropping or cancelling it retracts it, and
+        :meth:`BroadcastProducer.close` ends both.
         """
-        return OriginRequests(self._inner.requests(prefix))
+        return Route(self._inner.route(path, _options(hidden=hidden, cost=cost, instance=instance, epoch=epoch)))
 
-    def create_broadcast(self, path: str) -> Publication:
-        """Create a broadcast at ``path``, returning its :class:`Publication`.
+    def route_prefix(
+        self, prefix: str, *, hidden: bool = False, cost: int = 0, instance: str | None = None, epoch: int = 0
+    ) -> Route:
+        """Create a :class:`Route` over ``prefix`` that yields the requests beneath it.
 
-        Fill :attr:`Publication.broadcast`. The broadcast is invisible and
-        unroutable, for this origin's consumers and peers alike, until
-        :meth:`Publication.announce`. Announce it after populating tracks. Create,
-        :meth:`requests` if tracks are served on demand, populate, then announce.
-        :meth:`BroadcastProducer.close` ends it for good; dropping its last
-        handle, the publication included, does the same.
+        A route claims ``prefix`` and every path beneath it (``""`` claims every
+        path). A service that only serves some of them rejects the rest as they
+        are requested. Hold the route while it should stay advertised.
         """
-        inner = self._inner.create_broadcast(path)
-        return Publication(inner, BroadcastProducer._from_inner(inner.broadcast()))
+        return Route(
+            self._inner.route_prefix(prefix, _options(hidden=hidden, cost=cost, instance=instance, epoch=epoch))
+        )
diff --git a/py/moq-rs/moq/publish.py b/py/moq-rs/moq/publish.py
index ed555cfe651..96cc160a038 100644
--- a/py/moq-rs/moq/publish.py
+++ b/py/moq-rs/moq/publish.py
@@ -318,9 +318,9 @@ def cancel(self) -> None:
 class BroadcastProducer:
     """Wraps MoqBroadcastProducer with a cleaner interface.
 
-    It fills tracks; announcing belongs to the :class:`moq.Publication` that
-    :meth:`moq.OriginProducer.create_broadcast` returns, the way to publish at a
-    path. Constructing one directly creates a standalone broadcast for local pub/sub.
+    It fills tracks; announcing belongs to the :class:`moq.Route` that
+    :meth:`moq.OriginProducer.route` returns, the way to publish at a path.
+    Constructing one directly creates a standalone broadcast for local pub/sub.
     """
 
     def __init__(self) -> None:
diff --git a/py/moq-rs/moq/server.py b/py/moq-rs/moq/server.py
index 5a81fa4571d..ffde0e4740f 100644
--- a/py/moq-rs/moq/server.py
+++ b/py/moq-rs/moq/server.py
@@ -8,7 +8,7 @@
 from moq_ffi import MoqQuicConfig, MoqRequest, MoqServer, MoqServerConfig, MoqServerTls, MoqTransport
 
 from ._records import _implementation, _strs
-from .origin import OriginProducer, Publication
+from .origin import OriginProducer, Route
 from .session import Session
 
 # The network transport carrying an incoming session.
@@ -94,8 +94,7 @@ class Server:
     In simple mode (no origin provided), creates an internal origin automatically::
 
         async with Server("127.0.0.1:4443", tls_generate=["localhost"]) as server:
-            publication = server.create_broadcast("live")
-            publication.announce()  # unannounced broadcasts are invisible
+            route = server.route("live")  # announced while held
             await server.serve()
 
     Or hand-roll the accept loop if you need per-request control::
@@ -205,15 +204,18 @@ async def __anext__(self) -> Request:
             raise StopAsyncIteration
         return Request(request)
 
-    def create_broadcast(self, path: str) -> Publication:
-        """Create a live broadcast at ``path``, served to incoming sessions.
+    def route(
+        self, path: str, *, hidden: bool = False, cost: int = 0, instance: str | None = None, epoch: int = 0
+    ) -> Route:
+        """Create a route at ``path`` owning a broadcast served to incoming sessions; hold it
+        to keep it announced.
 
-        See :meth:`OriginProducer.create_broadcast`.
+        See :meth:`OriginProducer.route`.
         """
         origin = self._publish_origin
         if origin is None:
             raise RuntimeError("no publish origin configured")
-        return origin.create_broadcast(path)
+        return origin.route(path, hidden=hidden, cost=cost, instance=instance, epoch=epoch)
 
     async def serve(self) -> None:
         """Accept every session in a loop, holding each one alive until it closes.
diff --git a/py/moq-rs/moq/types.py b/py/moq-rs/moq/types.py
index 26300416244..c38e9670646 100644
--- a/py/moq-rs/moq/types.py
+++ b/py/moq-rs/moq/types.py
@@ -4,9 +4,6 @@
 timestamp, are owned in `_records` instead.
 """
 
-from moq_ffi import (
-    MoqAnnounceRoute as AnnounceRoute,
-)
 from moq_ffi import (
     MoqAudioCodec as AudioCodec,
 )
@@ -45,7 +42,7 @@
     MoqRateTarget as RateTarget,
 )
 from moq_ffi import (
-    MoqRoute as Route,
+    MoqRouteInfo as RouteInfo,
 )
 from moq_ffi import (
     MoqVideoCodec as VideoCodec,
@@ -85,7 +82,6 @@
 )
 
 __all__ = [
-    "AnnounceRoute",
     "Anchor",
     "AudioCodec",
     "AudioEncoderInput",
@@ -109,7 +105,7 @@
     "QuicConfig",
     "Range",
     "RateTarget",
-    "Route",
+    "RouteInfo",
     "Subscription",
     "Timestamp",
     "TrackInfo",
diff --git a/py/moq-rs/tests/test_local.py b/py/moq-rs/tests/test_local.py
index b84605c5297..6d0c672b8b5 100644
--- a/py/moq-rs/tests/test_local.py
+++ b/py/moq-rs/tests/test_local.py
@@ -21,12 +21,6 @@ async def until_wanted(demand: moq.TrackDemand, wanted: bool = True) -> None:
         pass
 
 
-def create_announced(origin: moq.OriginProducer, path: str) -> moq.BroadcastProducer:
-    publication = origin.create_broadcast(path)
-    publication.announce()
-    return publication.broadcast
-
-
 async def routes(announced: moq.AnnounceConsumer):
     """Yield each route that makes its path present, skipping absences."""
     async for event in announced:
@@ -231,7 +225,8 @@ def test_audio_rejects_bad_init_bytes():
 
 async def test_local_publish_consume_audio():
     origin = moq.OriginProducer()
-    broadcast = create_announced(origin, "live")
+    route = origin.route("live")
+    broadcast = route.broadcast
     media = moq.media.TrackProducer.audio(
         broadcast, moq.media.AudioInit(format=moq.media.AudioFormat.OPUS, data=opus_head())
     )
@@ -269,7 +264,8 @@ async def test_local_publish_consume_audio():
 
 async def test_video_publish_consume():
     origin = moq.OriginProducer()
-    broadcast = create_announced(origin, "video-test")
+    route = origin.route("video-test")
+    broadcast = route.broadcast
     media = moq.media.TrackProducer.video(
         broadcast, moq.media.VideoInit(format=moq.media.VideoFormat.AVC3, data=h264_init())
     )
@@ -306,7 +302,8 @@ async def test_video_publish_consume():
 
 async def test_video_publish_named_track():
     origin = moq.OriginProducer()
-    broadcast = create_announced(origin, "video-named-test")
+    route = origin.route("video-named-test")
+    broadcast = route.broadcast
     media = moq.media.TrackProducer.video(
         broadcast,
         moq.media.VideoInit(format=moq.media.VideoFormat.AVC3, data=h264_init()),
@@ -325,7 +322,8 @@ async def test_video_publish_named_track():
 
 async def test_multiple_frames_ordering():
     origin = moq.OriginProducer()
-    broadcast = create_announced(origin, "ordering-test")
+    route = origin.route("ordering-test")
+    broadcast = route.broadcast
     media = moq.media.TrackProducer.audio(
         broadcast, moq.media.AudioInit(format=moq.media.AudioFormat.OPUS, data=opus_head())
     )
@@ -355,7 +353,8 @@ async def test_multiple_frames_ordering():
 
 async def test_catalog_update_on_new_track():
     origin = moq.OriginProducer()
-    broadcast = create_announced(origin, "catalog-update")
+    route = origin.route("catalog-update")
+    broadcast = route.broadcast
     _media1 = moq.media.TrackProducer.audio(
         broadcast, moq.media.AudioInit(format=moq.media.AudioFormat.OPUS, data=opus_head())
     )
@@ -397,7 +396,7 @@ def test_close_twice_is_a_noop():
 
 async def test_announced_broadcast():
     origin = moq.OriginProducer()
-    _broadcast = create_announced(origin, "test/broadcast")
+    _route = origin.route("test/broadcast")
 
     consumer = origin.consume()
 
@@ -413,51 +412,53 @@ async def test_following_restarts_on_a_new_instance():
     consumer = origin.consume()
     announced = consumer.announced()
     following = consumer.follow("instance")
-    publication = origin.create_broadcast("instance")
 
-    # The broadcast mints its own instance and keeps it across re-announcing.
-    publication.announce()
+    # The route mints its own instance and keeps it across re-pricing.
+    first = origin.route("instance")
     present = await next_route(announced)
     assert isinstance(present, moq.AnnounceEventPresent)
     minted = present.announce.route.instance
-    assert minted
+    assert minted == first.instance
     assert await asyncio.wait_for(following.available(), timeout=5.0) is not None
 
-    # Another instance is another stream: followers restart onto it, while the path
-    # stays present, so neither the re-price nor the restart is listed.
-    publication.announce(moq.AnnounceRoute(cost=1))
-    publication.announce(moq.AnnounceRoute(instance="cam", epoch=1))
+    # Another route is another stream: followers restart onto it, while the path stays
+    # present, so neither the re-price nor the restart is listed.
+    first.set_cost(1)
+    second = origin.route("instance", instance="cam", epoch=1)
+    assert second.instance == "cam"
     assert await asyncio.wait_for(following.available(), timeout=5.0) is not None
-    publication.unannounce()
+    first.withdraw()
+    second.withdraw()
     absent = await next_route(announced)
     assert isinstance(absent, moq.AnnounceEventAbsent)
     assert absent.announce.route.instance == "cam"
 
     with pytest.raises(moq.Error.InvalidInstance):
-        publication.announce(moq.AnnounceRoute(instance=""))
+        origin.route("refused", instance="")
     following.cancel()
-    publication.broadcast.close()
+    first.broadcast.close()
+    second.broadcast.close()
 
 
 async def test_following_reports_the_path_offline_until_it_returns():
     origin = moq.OriginProducer()
     consumer = origin.consume()
-    publication = origin.create_broadcast("live")
-    publication.announce()
+    route = origin.route("live")
     async with consumer.follow("live") as following:
         assert await asyncio.wait_for(following.available(), timeout=5.0) is not None
-        publication.unannounce()
+        route.withdraw()
         assert await asyncio.wait_for(following.available(), timeout=5.0) is None
-        publication.announce()
+        route.announce()
         assert await asyncio.wait_for(following.available(), timeout=5.0) is not None
-    publication.broadcast.close()
+    route.broadcast.close()
 
 
 async def test_finish_serves_until_closed():
     origin = moq.OriginProducer()
     consumer = origin.consume()
     announced = consumer.announced()
-    broadcast = create_announced(origin, "finish")
+    route = origin.route("finish")
+    broadcast = route.broadcast
     assert isinstance(await next_route(announced), moq.AnnounceEventPresent)
 
     track = broadcast.publish_track("status")
@@ -814,18 +815,20 @@ async def test_dynamic_track_request_can_publish_media():
 
 async def test_dynamic_broadcast_request():
     origin = moq.OriginProducer(cache_capacity_bytes=4096)
-    dynamic = origin.requests("")
+    dynamic = origin.route_prefix("")
     consumer = origin.consume()
 
     requesting = asyncio.create_task(consumer.request("dynamic/broadcast"))
 
-    request = await asyncio.wait_for(dynamic.requested_broadcast(), timeout=5.0)
+    request = await asyncio.wait_for(dynamic.requested(), timeout=5.0)
+    assert request is not None
     assert request.path == "dynamic/broadcast"
 
-    prepared = request.prepare()
-    track = prepared.broadcast.publish_track("status", moq.TrackInfo(timescale=1_000_000))
-    served = prepared.publish()
-    assert served.broadcast is prepared.broadcast
+    # A hidden job route answers once it announces, under its own instance.
+    served = request.route(hidden=True)
+    assert served.instance != dynamic.instance
+    track = served.broadcast.publish_track("status", moq.TrackInfo(timescale=1_000_000))
+    served.announce()
     with pytest.raises(Exception):
         _ = request.path
 
@@ -844,12 +847,13 @@ async def test_dynamic_broadcast_request():
 
 async def test_dynamic_serves_held_content_without_an_exact_route():
     origin = moq.OriginProducer()
-    dynamic = origin.requests("live")
+    dynamic = origin.route_prefix("live")
     held = moq.BroadcastProducer()
     track = held.publish_track("status", moq.TrackInfo(timescale=1_000_000))
     source = held.consume()
     requesting = asyncio.create_task(origin.consume().request("live/cam"))
-    request = await dynamic.requested_broadcast()
+    request = await dynamic.requested()
+    assert request is not None
     request.serve(source)
     with pytest.raises(Exception):
         request.serve(source)
@@ -865,11 +869,12 @@ async def test_dynamic_serves_held_content_without_an_exact_route():
 
 async def test_dynamic_broadcast_request_can_reject():
     origin = moq.OriginProducer()
-    dynamic = origin.requests("")
+    dynamic = origin.route_prefix("")
     consumer = origin.consume()
 
     requesting = asyncio.create_task(consumer.request("missing"))
-    request = await asyncio.wait_for(dynamic.requested_broadcast(), timeout=5.0)
+    request = await asyncio.wait_for(dynamic.requested(), timeout=5.0)
+    assert request is not None
     assert request.path == "missing"
 
     request.reject(404)
@@ -1013,7 +1018,8 @@ async def test_container_consumer_default_latency_and_context_manager():
     """TrackConsumer.subscribe defaults the
     latency; the returned consumer is also an async context manager."""
     origin = moq.OriginProducer()
-    broadcast = create_announced(origin, "live")
+    route = origin.route("live")
+    broadcast = route.broadcast
     media = moq.media.TrackProducer.audio(
         broadcast, moq.media.AudioInit(format=moq.media.AudioFormat.OPUS, data=opus_head())
     )
@@ -1040,7 +1046,8 @@ async def test_container_consumer_default_latency_and_context_manager():
 
 async def test_raw_publish_consume():
     origin = moq.OriginProducer()
-    broadcast = create_announced(origin, "robot/arm")
+    route = origin.route("robot/arm")
+    broadcast = route.broadcast
     raw = broadcast.publish_track("events")
 
     consumer = origin.consume()
@@ -1065,7 +1072,8 @@ async def test_raw_publish_consume():
 
 async def test_raw_multiple_frames():
     origin = moq.OriginProducer()
-    broadcast = create_announced(origin, "robot/io")
+    route = origin.route("robot/io")
+    broadcast = route.broadcast
     raw = broadcast.publish_track("commands", moq.TrackInfo(max_age=None))
 
     consumer = origin.consume()
@@ -1194,7 +1202,8 @@ async def test_broadcast_producer_consume_direct():
 async def test_raw_group_sequence():
     """Consumer sees the same sequence numbers the producer assigned."""
     origin = moq.OriginProducer()
-    broadcast = create_announced(origin, "track/seq")
+    route = origin.route("track/seq")
+    broadcast = route.broadcast
     raw = broadcast.publish_track("seq", moq.TrackInfo(max_age=None, timescale=1_000_000))
 
     consumer = origin.consume()
@@ -1231,7 +1240,8 @@ async def test_default_iteration_is_sequence_order():
     this fails if the default iteration ever reverts to recv_group.
     """
     origin = moq.OriginProducer()
-    broadcast = create_announced(origin, "track/ordering")
+    route = origin.route("track/ordering")
+    broadcast = route.broadcast
     raw = broadcast.publish_track("ordering", moq.TrackInfo(max_age=None))
 
     subscription = moq.Subscription(delay=moq.Delay(max=timedelta(seconds=1)), ranges=FROM_GROUP_0)
@@ -1356,7 +1366,8 @@ async def test_container_group_fails_loudly():
 async def test_raw_multi_frame_group():
     """A single group can carry multiple frames, not just one per group."""
     origin = moq.OriginProducer()
-    broadcast = create_announced(origin, "stream/chunks")
+    route = origin.route("stream/chunks")
+    broadcast = route.broadcast
     raw = broadcast.publish_track("chunks")
 
     consumer = origin.consume()
@@ -1586,7 +1597,8 @@ def test_encode_audio_with_opus_object():
 async def test_audio_consumer_reports_its_playout_delay():
     """A fixed playout delay is reported back as is; an estimated one moves as frames are read."""
     origin = moq.OriginProducer()
-    broadcast = create_announced(origin, "audio-delay")
+    route = origin.route("audio-delay")
+    broadcast = route.broadcast
     audio = moq.audio.Producer(
         moq.media.CatalogProducer(broadcast),
         moq.AudioEncoderInput(format=moq.AudioSampleFormat.F32, sample_rate=48_000, channels=1),
@@ -1630,7 +1642,8 @@ def output(delay: timedelta | None) -> moq.audio.DecoderOutput:
 async def test_decode_video_frame():
     """A decoded frame owns its picture and converts to either layout, even after its consumer is cancelled."""
     origin = moq.OriginProducer()
-    broadcast = create_announced(origin, "video-decode-frame")
+    route = origin.route("video-decode-frame")
+    broadcast = route.broadcast
     video = moq.video.Producer(
         moq.media.CatalogProducer(broadcast),
         moq.VideoEncoderInput(
@@ -1686,39 +1699,39 @@ async def test_decode_video_frame():
 
 async def test_broadcast_is_reachable_only_while_announced():
     origin = moq.OriginProducer()
-    publication = origin.create_broadcast("live")
-    track = publication.broadcast.publish_track("events")
+    route = origin.route("live", hidden=True)
+    track = route.broadcast.publish_track("events")
     consumer = origin.consume()
     with pytest.raises(Exception):
         await asyncio.wait_for(consumer.request("live"), timeout=5.0)
 
-    publication.announce()
+    route.announce()
     announced = consumer.announced()
     first = await next_route(announced)
     assert isinstance(first, moq.AnnounceEventPresent)
     assert first.announce.prefix == "live"
 
-    publication.unannounce()
+    route.withdraw()
     retracted = await next_route(announced)
     assert isinstance(retracted, moq.AnnounceEventAbsent)
     assert retracted.announce.prefix == "live"
     with pytest.raises(Exception):
         await asyncio.wait_for(consumer.request("live"), timeout=5.0)
 
-    publication.announce()
+    route.announce()
     back = await next_route(announced)
     assert isinstance(back, moq.AnnounceEventPresent)
+    assert back.announce.route.instance == route.instance
     await asyncio.wait_for(consumer.request("live"), timeout=5.0)
     announced.cancel()
     track.finish()
-    publication.broadcast.close()
+    route.broadcast.close()
 
 
 async def test_an_instance_pins_request_and_follow():
     origin = moq.OriginProducer()
     consumer = origin.consume()
-    publication = origin.create_broadcast("live")
-    publication.announce(moq.AnnounceRoute(instance="cam"))
+    route = origin.route("live", instance="cam")
 
     await asyncio.wait_for(consumer.request("live", instance="cam"), timeout=5.0)
     with pytest.raises(moq.Error.Protocol):
@@ -1728,39 +1741,53 @@ async def test_an_instance_pins_request_and_follow():
     async with consumer.follow("live", instance="cam") as following:
         assert await asyncio.wait_for(following.available(), timeout=5.0) is not None
         # Another instance taking the path over ends the pinned stream.
-        publication.announce(moq.AnnounceRoute(instance="other"))
+        other = origin.route("live", instance="other")
         assert await asyncio.wait_for(following.available(), timeout=5.0) is None
-    publication.broadcast.close()
+    other.broadcast.close()
+    route.broadcast.close()
 
 
-async def test_dropping_a_publication_keeps_its_route():
+async def test_the_route_keeps_its_broadcast_announced():
     origin = moq.OriginProducer()
     consumer = origin.consume()
-    publication = origin.create_broadcast("live")
-    broadcast = publication.broadcast
-    assert publication.broadcast is broadcast
-    publication.announce()
-    del publication
+    route = origin.route("live")
+    broadcast = route.broadcast
+    assert route.broadcast is broadcast
+    # The broadcast handle alone retracts nothing.
+    del broadcast
     await asyncio.wait_for(consumer.request("live"), timeout=5.0)
 
-    broadcast.close()
+    # Dropping the route retracts it; its broadcast lives on for its other handles.
+    broadcast = route.broadcast
+    del route
     with pytest.raises(moq.Error.Protocol):
         await asyncio.wait_for(consumer.request("live"), timeout=5.0)
+    broadcast.publish_track("data")
+    broadcast.close()
+
+    # Cancelling retracts it too, and later calls fail.
+    cancelled = origin.route("cancelled")
+    await asyncio.wait_for(consumer.request("cancelled"), timeout=5.0)
+    cancelled.cancel()
+    with pytest.raises(moq.Error.Protocol):
+        await asyncio.wait_for(consumer.request("cancelled"), timeout=5.0)
+    with pytest.raises(moq.Error.Cancelled):
+        cancelled.announce()
+    cancelled.broadcast.close()
 
 
-async def test_a_stale_publication_leaves_its_replacement_alone():
+async def test_a_closed_route_leaves_its_replacement_alone():
     origin = moq.OriginProducer()
     consumer = origin.consume()
-    stale = origin.create_broadcast("live")
-    stale.announce()
+    stale = origin.route("live")
     stale.broadcast.close()
 
-    replacement = origin.create_broadcast("live")
-    replacement.announce()
+    replacement = origin.route("live")
     with pytest.raises(moq.Error.Closed):
         stale.announce()
     with pytest.raises(moq.Error.Closed):
-        stale.unannounce()
+        stale.set_cost(1)
+    stale.withdraw()
     await asyncio.wait_for(consumer.request("live"), timeout=5.0)
     replacement.broadcast.close()
 
@@ -1771,10 +1798,10 @@ async def test_announced_pattern_captures():
     announced = consumer.announced("room", filter="*/chat")
 
     # A claim at "room" could serve a match, but its own name is none, so it is not listed.
-    dynamic = origin.requests("room")
+    dynamic = origin.route_prefix("room")
 
-    audio = create_announced(origin, "room/alice/audio")
-    chat = create_announced(origin, "room/alice/chat")
+    audio = origin.route("room/alice/audio")
+    chat = origin.route("room/alice/chat")
     match = await next_route(announced)
     assert isinstance(match, moq.AnnounceEventPresent)
     assert match.announce.prefix == "room/alice/chat"
@@ -1782,19 +1809,21 @@ async def test_announced_pattern_captures():
 
     announced.cancel()
     dynamic.cancel()
-    audio.close()
-    chat.close()
+    audio.broadcast.close()
+    chat.broadcast.close()
 
 
 async def test_dynamic_serves_a_request_under_a_prefix():
     origin = moq.OriginProducer()
-    dynamic = origin.requests("live")
+    dynamic = origin.route_prefix("live")
     consumer = origin.consume()
+    with pytest.raises(moq.Error.Internal):
+        _ = dynamic.broadcast
 
     pending = asyncio.create_task(consumer.request("live/cam"))
-    request = await asyncio.wait_for(dynamic.requested_broadcast(), timeout=5.0)
+    request = await asyncio.wait_for(anext(dynamic), timeout=5.0)
     assert request.path == "live/cam"
-    served = request.prepare().publish()
+    served = request.route()
     await asyncio.wait_for(pending, timeout=5.0)
     dynamic.cancel()
     served.broadcast.close()
@@ -1809,9 +1838,9 @@ async def assert_cancelled(awaitable) -> None:
         assert moq.is_shutdown(excinfo.value)
 
     origin = moq.OriginProducer()
-    async with origin.requests("live") as origin_dynamic:
+    async with origin.route_prefix("live") as origin_dynamic:
         pass
-    await assert_cancelled(origin_dynamic.requested_broadcast())
+    await assert_cancelled(origin_dynamic.requested())
 
     broadcast = moq.BroadcastProducer()
     async with broadcast.requests() as broadcast_dynamic:
diff --git a/py/moq-rs/tests/test_server.py b/py/moq-rs/tests/test_server.py
index 076906ff84b..6b9376e30ae 100644
--- a/py/moq-rs/tests/test_server.py
+++ b/py/moq-rs/tests/test_server.py
@@ -38,12 +38,12 @@ async def test_server_client_roundtrip():
     """Server publishes a broadcast; a client connects and receives a frame."""
     async with moq.Server("127.0.0.1:0", versions=["moq-lite-07-wip"], tls_generate=["localhost"]) as server:
         # Publish a broadcast on the server side.
-        publication = server.create_broadcast("hello")
-        broadcast = publication.broadcast
+        published = server.route("hello", hidden=True)
+        broadcast = published.broadcast
         media = moq.media.TrackProducer.audio(
             broadcast, moq.media.AudioInit(format=moq.media.AudioFormat.OPUS, data=opus_head())
         )
-        publication.announce()
+        published.announce()
 
         # Auto-accept incoming sessions in the background so the handshake
         # completes from the server side. Hold references so the sessions
@@ -158,9 +158,8 @@ async def accept_loop() -> None:
                 assert session.state().failure is None
 
                 # A broadcast published only after the reconnect still arrives.
-                publication = server.create_broadcast("after-reconnect")
-                broadcast = publication.broadcast
-                publication.announce()
+                published = server.route("after-reconnect")
+                broadcast = published.broadcast
                 async for announcement in routes(client.announced()):
                     assert announcement.prefix == "after-reconnect"
                     break
@@ -422,9 +421,8 @@ async def accept_once() -> None:
 async def test_serve_helper_accepts_clients():
     """Server.serve() accepts incoming sessions and holds them automatically."""
     async with moq.Server("127.0.0.1:0", tls_generate=["localhost"]) as server:
-        publication = server.create_broadcast("via-serve")
-        broadcast = publication.broadcast
-        publication.announce()
+        published = server.route("via-serve")
+        broadcast = published.broadcast
 
         serve_task = asyncio.create_task(server.serve())
         try:
@@ -448,9 +446,8 @@ async def test_serve_helper_accepts_clients():
 async def test_broadcast_route_over_wire():
     """A route received over the wire exposes its hop chain and cost."""
     async with moq.Server("127.0.0.1:0", tls_generate=["localhost"]) as server:
-        publication = server.create_broadcast("with-route")
-        broadcast = publication.broadcast
-        publication.announce()
+        published = server.route("with-route")
+        broadcast = published.broadcast
 
         serve_task = asyncio.create_task(server.serve())
         try:
@@ -507,9 +504,8 @@ async def drain(reader: moq.TrackConsumer) -> None:
                     # rather than lean on the last session reference dropping.
                     session = client.session
                     assert session is not None
-                    publication = client.create_broadcast("live")
-                    broadcast = publication.broadcast
-                    publication.announce()
+                    published = client.route("live")
+                    broadcast = published.broadcast
                     track = broadcast.publish_track("data")
                     await asyncio.wait_for(accepted.wait(), timeout=5.0)
                     consume = sessions[0].consume()
diff --git a/py/moq-rs/tests/test_testing_clock.py b/py/moq-rs/tests/test_testing_clock.py
index a0b3e23f5a4..e5ee9450619 100644
--- a/py/moq-rs/tests/test_testing_clock.py
+++ b/py/moq-rs/tests/test_testing_clock.py
@@ -25,7 +25,8 @@ def test_a_pending_timer_waits_for_advance() -> None:
         async def main():
             # The origin's driver runs the timers that judge a group stale.
             origin = moq.OriginProducer()
-            track = origin.create_broadcast("clock").broadcast.publish_track("track", moq.TrackInfo(max_age=None))
+            route = origin.route("clock", hidden=True)
+            track = route.broadcast.publish_track("track", moq.TrackInfo(max_age=None))
             from_group_0 = [moq.Range(start=moq.Anchor.ABSOLUTE(group=0))]
             consumer = track.consume(moq.Subscription(delay=moq.Delay(max=timedelta(seconds=1)), ranges=from_group_0))
 
diff --git a/quest/m1/announce-takeover.md b/quest/m1/announce-takeover.md
index a99f7cbc114..21374432811 100644
--- a/quest/m1/announce-takeover.md
+++ b/quest/m1/announce-takeover.md
@@ -59,8 +59,8 @@ this quest removes the predecessor machinery and grows to [XL].
   `doc/concept/moq-lite.md`.
 - **Inheriting the instance.** Decided 2026-11-03 (maintainer, on
   [moq-dev/moq#7770](https://github.com/moq-dev/moq/pull/7770)):
-  `request.route(options)` from
-  [One Route handle](/quest/m1/api-audit/route/handle.md) mints a fresh
+  `request.route(options)`, from
+  [One Route handle](https://github.com/moq-dev/moq/pull/7806), mints a fresh
   instance by default, and ending a job leaves its prefix route open, with
   no history of ended paths. Carrying the prefix route's instance onto the
   path's exact route, so that the answer the waiting request gets is that
@@ -150,10 +150,6 @@ Public API: breaking; removes `Takeover` and the predecessor fields in every
 language. Wire: removes lite-07's ANNOUNCE_TAKEOVER (0x5), adding nothing
 beyond [Instance and epoch](https://github.com/moq-dev/moq/pull/7489)'s fields.
 
-## Required
-
-- [One Route handle](/quest/m1/api-audit/route/handle.md) - `request.route` creates the path's exact route, minting a fresh instance by default
-
 ## Related
 
 - [Claim answer epochs](https://github.com/moq-dev/moq/pull/5678) - why a restarted job must never be stitched to its predecessor
diff --git a/quest/m1/api-audit/route/README.md b/quest/m1/api-audit/route/README.md
index 8a0b7c9c14c..d070f5b8149 100644
--- a/quest/m1/api-audit/route/README.md
+++ b/quest/m1/api-audit/route/README.md
@@ -167,7 +167,7 @@ stale, including `doc/concept/identity.md`.
 
 ## Required
 
-- [One Route handle](/quest/m1/api-audit/route/handle.md) - `Publication`, `Prepared`, `Announcer` and `Requests` become one `Route` that owns its broadcast, with app options separate from transit facts
+- [Transit facts stay read-only](/quest/m1/api-audit/route/facts.md) - `Hop`, `Hops` and `HopLimit` leave the public API, and JS `RouteInfo` hides epoch and auth
 
 ## Related
 
diff --git a/quest/m1/api-audit/route/facts.md b/quest/m1/api-audit/route/facts.md
new file mode 100644
index 00000000000..6d7e201d9ef
--- /dev/null
+++ b/quest/m1/api-audit/route/facts.md
@@ -0,0 +1,42 @@
+# [L] Transit facts stay read-only
+
+## Goal
+
+Hops, via, source, the epoch and the anonymous mark are facts the origin and
+the relays fill in, never something an application sets. `Hop`, `Hops` and
+`HopLimit` leave the public API in Rust, JS and the bindings, and a received
+announcement exposes its hop chain as plain ids. JS `RouteInfo` stops exposing
+`epoch` and `auth`, as Rust's already does not.
+
+Non-goals: the route handle and its options, which
+[One Route handle](https://github.com/moq-dev/moq/pull/7806) landed, and the
+wire.
+
+## Plan
+
+Split from [One Route handle](https://github.com/moq-dev/moq/pull/7806), which
+made `origin::RouteInfo` read-only (getters, no public builders) and moved app
+settings to `RouteOptions`, but kept these types public because removing them
+reaches every origin construction:
+
+- **Rust.** `origin::Config::new(Hop)` and `Config::hop` take a plain non-zero
+  id, `Config::max_hops` a plain count, and `Producer::hop()`/`Consumer::hop()`
+  return ids or go crate-private. `RouteInfo::hops()` returns ids rather than
+  `&Hops`. `moq_net::fuzz` keeps whatever benches and tests need to build relay
+  chains (`fuzz::route_info`, `fuzz::excluding`). About 100 test and bench
+  sites build a config with `Hop::new(..)`; moq-relay's cluster id and
+  moq-ffi/moq-c already pass plain ids.
+- **JS.** Stop exporting `Hop`, `HopSchema` and `isAnonymous` from `@moq/net`'s
+  entry, keep `RouteInfo` to instance, cost, hops (as bigints) and anonymity,
+  and move `epoch` and `auth` to the internal wire view (`wireOf`) that
+  sessions already use.
+- **Docs and MIGRATE.** `rs/moq-net/MIGRATE.md`, `js/net/MIGRATE.md` and
+  `doc/lib/rs/moq-net.md`.
+
+Run `just check`.
+
+Public API: breaking in moq-net and @moq/net. Wire: none.
+
+## Related
+
+- [Routes are the origin API](/quest/m1/api-audit/route/README.md) - the epic this finishes
diff --git a/quest/m1/api-audit/route/handle.md b/quest/m1/api-audit/route/handle.md
deleted file mode 100644
index d3ba60ceb48..00000000000
--- a/quest/m1/api-audit/route/handle.md
+++ /dev/null
@@ -1,126 +0,0 @@
-# [XL] One Route handle
-
-## Goal
-
-On the publishing side, ownership runs origin → route → broadcast → track →
-group → frame. An application creates a `Route` on the origin, and the
-route creates and owns its broadcast. `Publication`, `Prepared`,
-`Announcer`, `Requests` and `Producer::publish` are gone, in Rust, JS,
-moq-ffi, moq-c and the wrappers:
-
-```rust
-// An exact route owns one broadcast; dropping the route withdraws it.
-let route = origin.route("live/alice", Options::hidden())?;
-route.broadcast().create_track("catalog", info)?;
-route.announce();  // visible now, same instance
-route.set_cost(5); // re-prices in place
-route.withdraw();  // hidden; announce() again continues the same stream
-
-// A prefix route serves requests.
-let claim = origin.route_prefix("transcode", Options::default())?;
-while let Some(request) = claim.requested().await {
-    // Either serve a broadcast already held, under the claim's instance...
-    // request.serve(held);
-    // ...or create the path's own exact route.
-    let job = request.route(Options::default())?;
-    spawn(run(job));
-}
-```
-
-A `Route` mints its instance when it is created and keeps it for its
-lifetime, across withdraw, re-announce and reconnects, because it owns the
-same broadcast and its sequences continue. A new run is a new `Route`. Apps
-pass only options: visibility at creation, `cost`, `auth`, and a stable
-`instance` for a publisher that keeps its sequence space across restarts
-(see [Instance and epoch](https://github.com/moq-dev/moq/pull/7489)). Setting
-an instance grants no more than a minted one does: publishing still
-requires the path's grant. A route exposes its own instance (`route.instance()`), so the OBS dock can
-show it again. Hops, via, source and the anonymous mark become
-read-only facts on a received announcement, and `Hop`, `Hops` and
-`HopLimit` leave the public API.
-
-Non-goals: the instance model ([Instance and epoch](https://github.com/moq-dev/moq/pull/7489)),
-announce events (a path listing plus `follow` since
-[moq-dev/moq#7678](https://github.com/moq-dev/moq/pull/7678)),
-the read side, which instance owns, and the route layer's wire metric
-(`drafts/draft-lcurley-moq-lite.md`).
-
-## Plan
-
-Decided 2026-10-30 (maintainer); see the [epic](/quest/m1/api-audit/route/README.md).
-The names above are a sketch. Settle the final ones in the PR, keeping Rust,
-JS and the bindings identical.
-
-- **The route owns the broadcast.** `route.broadcast()` returns the
-  `broadcast::Producer` that the 18 library entry points already take
-  (`moq-mux` catalog and importers, `moq-hls` import, the `moq-rtc` codecs,
-  `moq-room` chat, `moq-boy` status). Today the broadcast holds its own
-  announcer (`rs/moq-net/src/model/broadcast.rs:252-292`, and
-  `js/net/src/broadcast.ts:391`). That inversion goes: the broadcast knows
-  nothing of routes, and `broadcast::Producer::announce`/`unannounce`/
-  `route` are removed. A standalone `broadcast::Producer` stays for
-  in-process pipelines and tests. It can only be published through a
-  prefix route's `serve`, as today, where a standalone broadcast cannot be
-  announced.
-- **Prefix routes.** A prefix route yields requests, and each one is
-  answered by `serve(consumer)`,
-  by `route(options)`, or by `reject`. `route(options)` creates the path's
-  exact `Route`. A prefix route takes cost and auth as an exact one does,
-  so claims can be priced. Today `Requests::route()` is always the default
-  and `update_route` is crate-private.
-- **A job's instance.** ✅ Decided 2026-11-03 (maintainer, on
-  [moq-dev/moq#7770](https://github.com/moq-dev/moq/pull/7770)):
-  `request.route(options)` mints a fresh instance by default, as
-  `Request::prepare` does today, so a job that ends and restarts beneath
-  the same prefix gets a new instance for its restarted sequences. An
-  explicit stable instance in the options is only for a caller that
-  continues its sequences. Ending a job's route withdraws only that path:
-  the prefix route stays open and keeps answering later requests, each
-  with its own job lifetime, and the origin keeps no history of ended
-  paths. The existing predecessor handling stays until
-  [announce takeover](/quest/m1/announce-takeover.md) replaces it, and
-  that quest owns continuing the claim's readers on the job's route.
-  Rejected: inheriting the prefix route's instance by default and making
-  the prefix terminal once a materialized job ends, which would change
-  long-lived services; and inheriting it with automatic restarts, which
-  needs ended-path history or a retirement design this quest does not own.
-- **Visibility, not unannounced broadcasts.** Callers that fill the catalog
-  first (`moq-cli` hls, rtsp and publish; moq-mux
-  `ts/programs.rs`) or announce after SDP (`moq-rtc/server/whip.rs`) create
-  the route hidden and announce it when ready. js/publish's on/off toggle
-  becomes withdraw and announce on one route, so viewers continue rather
-  than restart.
-- **Sessions.** Relay forwarding keeps a crate-private construction with
-  forwarded instance, epoch, hops and cost, which the deleted
-  `requests_route` and `dynamic_route` did. `moq_net::fuzz`'s hatches
-  shrink to what tests still need.
-- **JS leaks.** Removing `Requests`/`requestsRoute`/`updateRoute` also
-  removes their `@internal`-but-public exposure on `Table`. Stop exporting
-  `Epoch.toBytes`/`fromBytes`, `RequestSlot` and `RouteEntry`, and delete
-  the orphaned `@internal` doc blocks (`js/net/src/origin.ts:2160-2176`).
-- **Bindings.** These all move to the route handle:
-  - moq-ffi's `MoqRoute`, `MoqPublication`, `MoqBroadcastRequest` and
-    `MoqBroadcastPrepared`.
-  - moq-c's `moq_origin_requests`, `moq_broadcast_request_*`,
-    `moq_broadcast_prepared_*`, `moq_publication_*` and `moq_mint_epoch`.
-  - The py, kt, swift, dart and go wrappers.
-
-  moq-c's API gaps error-code fix applies to
-  whichever functions remain.
-- **Callers.** Migrate every caller: about 25 crates use `create_broadcast`
-  or `publish`, about 19 set an epoch, plus `@moq/publish`, moq-boy, carla
-  and the e2ee generations. The rs/moq-net and js/net `MIGRATE.md` entries
-  and the PR's Impact section give the mapping, including moq.pro's
-  `.dash` claim and sync-ingest mirror.
-- **Docs.** Update `doc/concept/identity.md`'s publishing and lazy-job
-  examples, `doc/lib/rs`, `doc/lib/js`, `doc/lib/c`, and each binding's
-  README.
-
-Run `just check` and `just test interop --all`.
-
-Public API: breaking across moq-net, @moq/net, moq-ffi, moq-c and the
-wrappers. Wire: none.
-
-## Related
-
-- No constructible internal handles - the same JS hygiene rule
diff --git a/quest/m1/cluster-routing/routes/session.md b/quest/m1/cluster-routing/routes/session.md
index 34f60fc1e9e..fcbae7fba94 100644
--- a/quest/m1/cluster-routing/routes/session.md
+++ b/quest/m1/cluster-routing/routes/session.md
@@ -146,10 +146,6 @@ by a proven key, every remaining attack stays inside the forger's grant, with
 no grant field, no issuer-coordinated labels, and support for token-less
 admission.
 
-## Required
-
-- [One Route handle](/quest/m1/api-audit/route/handle.md) - the origin's route surface this rewrites
-
 ## Related
 
 - [Routes and announces](/quest/m1/cluster-routing/routes/README.md) - the contract
diff --git a/rs/hang/examples/video.rs b/rs/hang/examples/video.rs
index 899b59c8807..7910196fd66 100644
--- a/rs/hang/examples/video.rs
+++ b/rs/hang/examples/video.rs
@@ -82,11 +82,10 @@ fn create_track(broadcast: &mut moq_net::broadcast::Producer) -> anyhow::Result<
 async fn run_broadcast(origin: moq_net::origin::Producer) -> anyhow::Result<()> {
 	// Create a broadcast on the origin and announce its path.
 	// NOTE: The path is empty because we're using the URL to scope the broadcast.
-	let broadcast = origin.create_broadcast("").context("failed to create broadcast")?;
-	broadcast
-		.announce(Default::default())
+	let route = origin
+		.route("", moq_net::origin::RouteOptions::default())
 		.context("failed to announce broadcast")?;
-	let track = create_track(&mut broadcast.broadcast().clone())?;
+	let track = create_track(&mut route.broadcast().clone())?;
 
 	// Wrap in a Producer for keyframe-based group management.
 	let mut producer = moq_mux::container::Producer::new(
diff --git a/rs/moq-archive/README.md b/rs/moq-archive/README.md
index b96bee472f7..da623fa263d 100644
--- a/rs/moq-archive/README.md
+++ b/rs/moq-archive/README.md
@@ -31,7 +31,7 @@ use moq_archive::object_store::memory::InMemory;
 let store = moq_archive::Store::new(InMemory::new(), "recordings/demo");
 moq_archive::Producer::new(store.clone(), broadcast, Default::default()).run().await?;
 
-// `served` is an `origin::Publication`'s fill, announced once `open` returns.
+// `served` is an `origin::Route`'s broadcast, created hidden and announced once `open` returns.
 let consumer = moq_archive::Consumer::open(store, served, Default::default()).await?;
 consumer.run().await?;
 ```
diff --git a/rs/moq-audio/src/decode/consumer.rs b/rs/moq-audio/src/decode/consumer.rs
index 724bc9aed6b..f42deec3cbb 100644
--- a/rs/moq-audio/src/decode/consumer.rs
+++ b/rs/moq-audio/src/decode/consumer.rs
@@ -975,11 +975,14 @@ mod tests {
 	#[tokio::test(start_paused = true)]
 	async fn latest_skips_a_warm_copys_backlog() {
 		let publisher = origin(1);
-		let broadcast = publisher.create_broadcast("bcast").unwrap();
+		let broadcast = publisher
+			.route("bcast", moq_net::origin::RouteOptions::hidden())
+			.unwrap();
 		let track = broadcast
+			.broadcast()
 			.create_track("audio", hang::container::track_info(hang::catalog::PRIORITY.audio))
 			.unwrap();
-		broadcast.announce(Default::default()).unwrap();
+		broadcast.announce().unwrap();
 		let mut demand = track.demand();
 		let mut producer = moq_mux::container::Producer::new(
 			track,
@@ -1053,11 +1056,14 @@ mod tests {
 	#[tokio::test(start_paused = true)]
 	async fn latest_loses_no_group_the_publisher_bursts_before_its_first_frame() {
 		let publisher = origin(1);
-		let broadcast = publisher.create_broadcast("bcast").unwrap();
+		let broadcast = publisher
+			.route("bcast", moq_net::origin::RouteOptions::hidden())
+			.unwrap();
 		let track = broadcast
+			.broadcast()
 			.create_track("audio", hang::container::track_info(hang::catalog::PRIORITY.audio))
 			.unwrap();
-		broadcast.announce(Default::default()).unwrap();
+		broadcast.announce().unwrap();
 		let mut producer = moq_mux::container::Producer::new(
 			track,
 			moq_mux::catalog::hang::Container::Legacy(moq_mux::container::Kind::Audio),
diff --git a/rs/moq-audio/src/encode/capture.rs b/rs/moq-audio/src/encode/capture.rs
index 23727f18165..847f7708a8d 100644
--- a/rs/moq-audio/src/encode/capture.rs
+++ b/rs/moq-audio/src/encode/capture.rs
@@ -874,8 +874,8 @@ mod tests {
 				let (capture, samples) = capture::test_source();
 				let (origin, origin_driver) = moq_net::origin::Producer::new(Default::default());
 				tokio::spawn(moq_net::time::run(origin_driver));
-				let publication = origin.create_broadcast("live").unwrap();
-				publication.announce(Default::default()).unwrap();
+				let publication = origin.route("live", moq_net::origin::RouteOptions::hidden()).unwrap();
+				publication.announce().unwrap();
 				let mut broadcast = publication.broadcast().clone();
 				let catalog =
 					moq_mux::catalog::Producer::new(&mut broadcast, moq_mux::catalog::Config::default()).unwrap();
diff --git a/rs/moq-bench/src/connection.rs b/rs/moq-bench/src/connection.rs
index 0707226ff22..a612ea23d8a 100644
--- a/rs/moq-bench/src/connection.rs
+++ b/rs/moq-bench/src/connection.rs
@@ -108,7 +108,7 @@ pub async fn run(ctx: Connection) {
 		config.name()
 	};
 
-	let mut broadcasts = Vec::new();
+	let mut routes = Vec::new();
 	let mut publishing = Vec::new();
 	let mut own = HashSet::new();
 	let mut tasks = JoinSet::new();
@@ -126,14 +126,14 @@ pub async fn run(ctx: Connection) {
 	};
 
 	for (relative, path) in paths {
-		let broadcast = match publish.create_broadcast(&path) {
-			Ok(broadcast) => broadcast,
+		let route = match publish.route(&path, moq_net::origin::RouteOptions::hidden()) {
+			Ok(route) => route,
 			Err(err) => {
 				tracing::error!(connection, %err, "failed to create broadcast");
 				continue;
 			}
 		};
-		let track = match broadcast.create_track(
+		let track = match route.broadcast().create_track(
 			TRACK,
 			moq_net::track::Info::default()
 				.with_timescale(moq_net::Timescale::MILLI)
@@ -145,14 +145,14 @@ pub async fn run(ctx: Connection) {
 				continue;
 			}
 		};
-		if let Err(err) = broadcast.announce(Default::default()) {
+		if let Err(err) = route.announce() {
 			tracing::error!(connection, %err, "failed to announce broadcast");
 			continue;
 		}
 		own.insert(relative);
-		// Hold the broadcast producer for the connection's lifetime so it stays
-		// published and advertised.
-		broadcasts.push(broadcast);
+		// Hold the route for the connection's lifetime so it stays published and
+		// advertised.
+		routes.push(route);
 
 		let published = Published::new(stats.clone());
 		publishing.push(Arc::downgrade(&published));
@@ -991,22 +991,26 @@ mod tests {
 		let origin = moq_tokio::origin::spawn();
 
 		// The relay-internal broadcast: announced, but with no bench data track.
-		let _internal = origin.create_broadcast(".stats/node/host").unwrap();
-		_internal.announce(Default::default()).unwrap();
+		let _internal = origin
+			.route(".stats/node/host", moq_net::origin::RouteOptions::default())
+			.unwrap();
 
 		// Our own broadcast: in the namespace, but excluded via the `own` set
 		// (paths relative to the namespace, matching the scoped announce consumer).
-		let _previous = origin.create_broadcast("bench/previous/0/0").unwrap();
-		_previous.announce(Default::default()).unwrap();
+		let _previous = origin
+			.route("bench/previous/0/0", moq_net::origin::RouteOptions::default())
+			.unwrap();
 
-		let _own = origin.create_broadcast("bench/current/9/9").unwrap();
-		_own.announce(Default::default()).unwrap();
+		let _own = origin
+			.route("bench/current/9/9", moq_net::origin::RouteOptions::default())
+			.unwrap();
 		let own = HashSet::from(["9/9".to_string()]);
 
 		// One legitimate peer under the bench namespace with a single finished group.
-		let peer = origin.create_broadcast("bench/current/0/0").unwrap();
-		peer.announce(Default::default()).unwrap();
-		let track = peer.create_track(TRACK, timed()).unwrap();
+		let peer = origin
+			.route("bench/current/0/0", moq_net::origin::RouteOptions::default())
+			.unwrap();
+		let track = peer.broadcast().create_track(TRACK, timed()).unwrap();
 		let mut group = track.append_group().unwrap();
 		group
 			.write_frame(moq_net::Timestamp::now(), Bytes::from_static(b"{}"))
@@ -1036,9 +1040,10 @@ mod tests {
 			stats.clone(),
 		));
 
-		let broadcast = origin.create_broadcast("bench/run/chat").unwrap();
-		broadcast.announce(Default::default()).unwrap();
-		let track = broadcast.create_track(TRACK, timed()).unwrap();
+		let broadcast = origin
+			.route("bench/run/chat", moq_net::origin::RouteOptions::default())
+			.unwrap();
+		let track = broadcast.broadcast().create_track(TRACK, timed()).unwrap();
 		tokio::task::yield_now().await;
 		let mut group = track.append_group().unwrap();
 		let header = serde_json::json!({
@@ -1055,7 +1060,7 @@ mod tests {
 
 		task.await.unwrap().unwrap();
 		assert_eq!(stats.groups_recv.load(Ordering::Relaxed), 1);
-		broadcast.close();
+		broadcast.broadcast().close();
 	}
 
 	/// The relay fails a group it gave up on (`Error::Lagged` once a subscriber
diff --git a/rs/moq-boy/src/input.rs b/rs/moq-boy/src/input.rs
index e50d8612d8f..3b4696b4b8d 100644
--- a/rs/moq-boy/src/input.rs
+++ b/rs/moq-boy/src/input.rs
@@ -190,15 +190,16 @@ mod tests {
 	}
 
 	/// Publish a viewer with a live command track.
-	fn viewer(origin: &moq_net::origin::Producer) -> (moq_net::origin::Publication, moq_net::track::Producer) {
-		let broadcast = origin.create_broadcast("alice").unwrap();
+	fn viewer(origin: &moq_net::origin::Producer) -> (moq_net::origin::Route, moq_net::track::Producer) {
+		let broadcast = origin.route("alice", moq_net::origin::RouteOptions::hidden()).unwrap();
 		let track = broadcast
+			.broadcast()
 			.create_track(
 				"command",
 				moq_net::track::Info::default().with_timescale(moq_net::Timescale::MILLI),
 			)
 			.unwrap();
-		broadcast.announce(moq_net::origin::Route::default()).unwrap();
+		broadcast.announce().unwrap();
 		(broadcast, track)
 	}
 
@@ -253,7 +254,7 @@ mod tests {
 		send(&old_track, r#"{"type":"reset"}"#);
 		assert!(matches!(rx.recv().await, Some(Command::Reset)));
 
-		old.unannounce();
+		old.withdraw();
 		assert!(matches!(rx.recv().await, Some(Command::ViewerLeft { .. })));
 		let (_new, new_track) = viewer(&origin);
 		kio::clock::sleep(Duration::from_secs(1)).await;
@@ -281,8 +282,10 @@ mod tests {
 		let consumer = origin.consume();
 		tokio::spawn(async move { handle_viewers(&consumer, &tx).await });
 
-		let claim = origin.requests("alice").unwrap();
-		kio::clock::timeout(Duration::from_secs(1), claim.requested_broadcast())
+		let claim = origin
+			.route_prefix("alice", moq_net::origin::RouteOptions::default())
+			.unwrap();
+		kio::clock::timeout(Duration::from_secs(1), claim.requested())
 			.await
 			.expect("never asked")
 			.expect("the claim closed")
diff --git a/rs/moq-boy/src/main.rs b/rs/moq-boy/src/main.rs
index e56168d146e..227101ac80a 100644
--- a/rs/moq-boy/src/main.rs
+++ b/rs/moq-boy/src/main.rs
@@ -256,15 +256,11 @@ async fn run(config: &Config) -> Result<()> {
 	let publish_origin = moq_tokio::origin::spawn();
 	let (broadcast_path, viewer_path) = config.paths(&name)?;
 
-	// Create the broadcast on the publish origin and announce its path.
-	let broadcast = publish_origin
-		.create_broadcast(&broadcast_path)
-		.context("failed to create broadcast")?;
-	let instance = moq_net::Instance::random();
-	broadcast
-		.announce(moq_net::origin::Route::default().with_instance(instance.clone(), 0))
+	// Announce the game session's route on the publish origin; it owns the broadcast.
+	let route = publish_origin
+		.route(&broadcast_path, moq_net::origin::RouteOptions::default())
 		.context("failed to announce broadcast")?;
-	tracing::info!(broadcast = %broadcast_path, %instance, "announced");
+	tracing::info!(broadcast = %broadcast_path, instance = %route.instance(), "announced");
 
 	// Consume origin: viewer broadcasts under the viewer prefix.
 	// JS publishes viewer feedback at "{viewer_prefix}/{name}/{viewerId}"
@@ -282,16 +278,15 @@ async fn run(config: &Config) -> Result<()> {
 		.connect(url);
 
 	// Set up catalog and encoders.
-	let catalog =
-		moq_mux::catalog::Producer::new(&mut broadcast.broadcast().clone(), moq_mux::catalog::Config::default())?;
-	let video_encoder = video::VideoEncoder::spawn(broadcast.broadcast().clone(), catalog.clone()).await;
+	let catalog = moq_mux::catalog::Producer::new(&mut route.broadcast().clone(), moq_mux::catalog::Config::default())?;
+	let video_encoder = video::VideoEncoder::spawn(route.broadcast().clone(), catalog.clone()).await;
 
-	let audio_encoder = audio::AudioEncoder::new(broadcast.broadcast().clone(), catalog.clone(), 44100)?;
+	let audio_encoder = audio::AudioEncoder::new(route.broadcast().clone(), catalog.clone(), 44100)?;
 
 	let video_track = video_encoder.demand.clone();
 	let audio_track = audio_encoder.demand();
 
-	let status_publisher = status::StatusPublisher::new(&mut broadcast.broadcast().clone())?;
+	let status_publisher = status::StatusPublisher::new(&mut route.broadcast().clone())?;
 
 	let session = Arc::new(Session {
 		video_encoder,
@@ -332,7 +327,7 @@ async fn run(config: &Config) -> Result<()> {
 	};
 
 	// Close the broadcast now, even if the emulator thread still holds a clone.
-	broadcast.close();
+	route.broadcast().close();
 	result
 }
 
diff --git a/rs/moq-c/MIGRATE.md b/rs/moq-c/MIGRATE.md
index 38a3689fb19..4ea469fb3eb 100644
--- a/rs/moq-c/MIGRATE.md
+++ b/rs/moq-c/MIGRATE.md
@@ -26,6 +26,22 @@ Map `_START` to `_PRESENT` and `_END` to `_ABSENT`, and drop `_UPDATE` handling.
 
 `moq_origin_follow` takes a `moq_follow_callback`, `(void *user_data, moq_follow_event event, int32_t code)`, instead of a `moq_status_callback`. `MOQ_FOLLOW_EVENT_ONLINE` carries each broadcast handle (where a positive code did), `MOQ_FOLLOW_EVENT_OFFLINE` reports the path going offline (or, for a follow pinned to an instance, another instance taking it over) with code `0`, and `MOQ_FOLLOW_EVENT_END` is the terminal callback, with `0` or a negative error that `moq_error()` explains (where a code `<= 0` was). Release `user_data` on `MOQ_FOLLOW_EVENT_END`.
 
+### Publishing goes through one route handle
+
+A route handle replaces the publication, the prepared answer, and the request handler:
+
+- `moq_origin_create_broadcast(origin, path, len, &broadcast)` is `moq_origin_route(origin, path, len, options)`, which returns a route; `moq_route_broadcast(route)` gives the broadcast handle to fill.
+- `moq_publication_announce(publication, route)` is `moq_route_announce(route)`, and re-pricing is `moq_route_set_cost(route, cost)`. `moq_publication_unannounce` is `moq_route_withdraw`, and `moq_publication_free` is `moq_route_free`.
+- `moq_origin_requests(origin, prefix, len, on_request, user_data)` is `moq_origin_route_prefix(origin, prefix, len, options, on_request, user_data)`, and `moq_origin_requests_cancel` is `moq_route_free`.
+- `moq_broadcast_request_prepare(request, &broadcast)` then `moq_broadcast_prepared_publish` is `moq_broadcast_request_route(request, options)`: create it hidden to fill it first, then `moq_route_announce`. `moq_broadcast_prepared_free` is `moq_route_free`.
+- `moq_route_instance(route, &dst)` reads the stream's instance, minted at creation and kept across withdraw and announce.
+
+`moq_announce_route` is `moq_route_options`, given once at creation, and gains a trailing `hidden`. A zeroed or NULL `moq_route_options` is visible at once, so set `hidden` and call `moq_route_announce` after filling the catalog to keep the old create-then-announce order. A stable `instance` is fixed for the route's lifetime: announcing another one is a new route.
+
+Hold the route for as long as the broadcast should stay announced. `moq_route_free` now retracts it, while `moq_publish_close` still ends both; the broadcast handle alone no longer keeps it announced.
+
+`moq_route`, the struct carried by `moq_announce_event.route`, is renamed `moq_route_info`; its fields are unchanged. Recompile against the regenerated `moq.h`.
+
 ### Separate datagram tracks
 
 Create a separate producer with `moq_publish_datagrams` and `moq_datagram_info`; replace `moq_publish_track_datagram` with `moq_publish_datagrams_append` on that handle, or `moq_publish_datagrams_insert` for an explicit sequence. `moq_consume_datagrams` now takes a subscriber priority before its callback and never subscribes to a stream track. Use `moq_publish_datagrams_demand` and `moq_datagram_demand_priority` for aggregate priority, and `moq_publish_datagrams_requests` / `moq_datagram_request_accept` for on-demand publishing. Finish or abort datagram producers separately. A zeroed datagram info is untimed, unlike the microsecond default of stream-track info. `moq_consume_datagrams` returns a negative code at once when the broadcast has neither the datagram track nor a datagram request handler, and a remote name without one ends its callback with a not-found error.
diff --git a/rs/moq-c/README.md b/rs/moq-c/README.md
index 898d7ea1002..16a4dfbc4b6 100644
--- a/rs/moq-c/README.md
+++ b/rs/moq-c/README.md
@@ -61,7 +61,6 @@ int32_t moq_session_request_free(uint32_t request);
 // Origin
 int32_t moq_origin_create(void);
 int32_t moq_origin_close(uint32_t origin);
-int32_t moq_origin_create_broadcast(uint32_t origin, const char *path, uintptr_t path_len, uint32_t *broadcast);
 int32_t moq_origin_request(uint32_t origin, const char *path, uintptr_t path_len, const char *instance, uintptr_t instance_len, moq_status_callback on_broadcast, void *user_data);
 int32_t moq_origin_request_cancel(uint32_t task);
 int32_t moq_origin_follow(uint32_t origin, const char *path, uintptr_t path_len, const char *instance, uintptr_t instance_len, moq_follow_callback on_follow, void *user_data);
@@ -72,11 +71,21 @@ int32_t moq_origin_announced_free(uint32_t announced);
 int32_t moq_origin_announced_cancel(uint32_t announced);
 // config (NULL for everything): filter is relative to the literal prefix, or NULL for **. hidden also lists `.`-named paths. Updates stay relative to the origin.
 
-// Publishing: Announcement (a publication from moq_origin_create_broadcast or moq_broadcast_prepared_publish)
-int32_t moq_publication_announce(uint32_t publication, const moq_announce_route *route);
-// route (NULL for the default): a cost, and an optional stable instance with its epoch. Hops are the origin's to add.
-int32_t moq_publication_unannounce(uint32_t publication);
-int32_t moq_publication_free(uint32_t publication);
+// Publishing: Routes (freeing one retracts it; moq_publish_close on its broadcast ends both)
+int32_t moq_origin_route(uint32_t origin, const char *path, uintptr_t path_len, const moq_route_options *options);
+int32_t moq_origin_route_prefix(uint32_t origin, const char *prefix, uintptr_t prefix_len, const moq_route_options *options, moq_status_callback on_request, void *user_data);
+// options (NULL for the default): hidden until moq_route_announce, a cost, and an optional stable instance with its epoch. Hops are the origin's to add.
+int32_t moq_route_broadcast(uint32_t route);
+int32_t moq_route_instance(uint32_t route, moq_string *dst);
+int32_t moq_route_announce(uint32_t route);
+int32_t moq_route_withdraw(uint32_t route);
+int32_t moq_route_set_cost(uint32_t route, uint64_t cost);
+int32_t moq_route_free(uint32_t route);
+int32_t moq_broadcast_request_path(uint32_t request, moq_string *dst);
+int32_t moq_broadcast_request_serve(uint32_t request, uint32_t broadcast);
+int32_t moq_broadcast_request_route(uint32_t request, const moq_route_options *options);
+int32_t moq_broadcast_request_reject(uint32_t request, uint16_t error_code);
+int32_t moq_broadcast_request_free(uint32_t request);
 
 // Publishing
 int32_t moq_publish_close(uint32_t broadcast);
diff --git a/rs/moq-c/c-tests/audio-decode-output.c b/rs/moq-c/c-tests/audio-decode-output.c
index 73e0364d40a..59e6092f93f 100644
--- a/rs/moq-c/c-tests/audio-decode-output.c
+++ b/rs/moq-c/c-tests/audio-decode-output.c
@@ -104,11 +104,11 @@ int main(void) {
     int32_t origin = moq_origin_create();
     CHECK(origin > 0);
     const char *path = "audio-decode-output";
-    uint32_t broadcast = 0;
-    int32_t publication = moq_origin_create_broadcast((uint32_t)origin, path, strlen(path), &broadcast);
-    CHECK(publication > 0);
-    CHECK(moq_publication_announce((uint32_t)publication, NULL) == 0);
-    CHECK(moq_publication_free((uint32_t)publication) == 0);
+    int32_t route = moq_origin_route((uint32_t)origin, path, strlen(path), NULL);
+    CHECK(route > 0);
+    int32_t created = moq_route_broadcast((uint32_t)route);
+    CHECK(created > 0);
+    uint32_t broadcast = (uint32_t)created;
     moq_audio_encoder_input input = {MOQ_AUDIO_SAMPLE_FORMAT_F32, 48000, 2};
     moq_audio_encoder_output output = {"pcm", 3, 0, 0, 0, 0};
     int32_t producer = moq_encode_audio((uint32_t)broadcast, "audio", 5, &input, &output, 0);
@@ -155,6 +155,7 @@ int main(void) {
     CHECK(moq_consume_catalog_free((uint32_t)c.catalog) == 0);
     CHECK(moq_consume_catalog_cancel((uint32_t)catalogs) == 0);
     CHECK(moq_consume_close((uint32_t)c.broadcast) == 0);
+    CHECK(moq_route_free((uint32_t)route) == 0);
     CHECK(moq_publish_close((uint32_t)broadcast) == 0);
     CHECK(moq_origin_close((uint32_t)origin) == 0);
     pthread_mutex_lock(&c.mutex);
diff --git a/rs/moq-c/c-tests/decode-output.c b/rs/moq-c/c-tests/decode-output.c
index c8dbaf59741..f2c431a2a3e 100644
--- a/rs/moq-c/c-tests/decode-output.c
+++ b/rs/moq-c/c-tests/decode-output.c
@@ -243,13 +243,11 @@ int main(void) {
     if (origin <= 0) fail("error: moq_origin_create failed: %d\n", origin);
 
     const char *path = "c-decoder-output-test";
-    uint32_t broadcast = 0;
-    int32_t publication = moq_origin_create_broadcast((uint32_t)origin, path, strlen(path), &broadcast);
-    if (publication <= 0) fail("error: moq_origin_create_broadcast failed: %d\n", publication);
-    if (moq_publication_announce((uint32_t)publication, NULL) < 0)
-        fail("error: moq_publication_announce failed (%s)\n", moq_error());
-    if (moq_publication_free((uint32_t)publication) < 0)
-        fail("error: moq_publication_free failed (%s)\n", moq_error());
+    int32_t route = moq_origin_route((uint32_t)origin, path, strlen(path), NULL);
+    if (route <= 0) fail("error: moq_origin_route failed: %d\n", route);
+    int32_t created = moq_route_broadcast((uint32_t)route);
+    if (created <= 0) fail("error: moq_route_broadcast failed: %d\n", created);
+    uint32_t broadcast = (uint32_t)created;
 
     moq_video_encoder_input input = {MOQ_VIDEO_PIXEL_FORMAT_RGBA, WIDTH, HEIGHT, {30000, 1001}};
     moq_video_encoder_output output = {MOQ_VIDEO_CODEC_H264, 0, 0, MOQ_VIDEO_ENCODER_KIND_SOFTWARE, NULL, 0};
@@ -300,6 +298,8 @@ int main(void) {
         fail("error: moq_consume_close failed (%s)\n", moq_error());
     if (moq_encode_video_finish((uint32_t)producer) < 0)
         fail("error: moq_encode_video_finish failed (%s)\n", moq_error());
+    if (moq_route_free((uint32_t)route) < 0)
+        fail("error: moq_route_free failed (%s)\n", moq_error());
     if (moq_publish_close((uint32_t)broadcast) < 0)
         fail("error: moq_publish_close failed (%s)\n", moq_error());
     if (moq_origin_close((uint32_t)origin) < 0)
diff --git a/rs/moq-c/c-tests/timestamps.c b/rs/moq-c/c-tests/timestamps.c
index 8045f115f75..508262e62ea 100644
--- a/rs/moq-c/c-tests/timestamps.c
+++ b/rs/moq-c/c-tests/timestamps.c
@@ -78,11 +78,11 @@ int main(void) {
     int32_t origin = moq_origin_create();
     CHECK(origin > 0);
     const char *path = "timestamps";
-    uint32_t broadcast = 0;
-    int32_t publication = moq_origin_create_broadcast((uint32_t)origin, path, strlen(path), &broadcast);
-    CHECK(publication > 0);
-    CHECK(moq_publication_announce((uint32_t)publication, NULL) == 0);
-    CHECK(moq_publication_free((uint32_t)publication) == 0);
+    int32_t route = moq_origin_route((uint32_t)origin, path, strlen(path), NULL);
+    CHECK(route > 0);
+    int32_t created = moq_route_broadcast((uint32_t)route);
+    CHECK(created > 0);
+    uint32_t broadcast = (uint32_t)created;
     moq_track_info info = {0};
     info.timescale = 90000;
     info.timescale_present = true;
@@ -158,6 +158,7 @@ int main(void) {
     CHECK(moq_publish_json_stream_finish((uint32_t)json) == 0);
     CHECK(moq_publish_track_finish((uint32_t)track) == 0);
     CHECK(moq_publish_datagrams_finish((uint32_t)datagram_track) == 0);
+    CHECK(moq_route_free((uint32_t)route) == 0);
     CHECK(moq_publish_close((uint32_t)broadcast) == 0);
     CHECK(moq_origin_close((uint32_t)origin) == 0);
     WAIT_FOR(&c, c.request_done);
diff --git a/rs/moq-c/src/api.rs b/rs/moq-c/src/api.rs
index 60abbd171ca..adb4ae1186a 100644
--- a/rs/moq-c/src/api.rs
+++ b/rs/moq-c/src/api.rs
@@ -918,42 +918,45 @@ pub struct moq_section {
 	pub json_len: usize,
 }
 
-/// How a publication advertises its exact path: a static cost and, optionally, a stable
-/// instance.
+/// How a route advertises itself: its visibility at creation, a static cost and, optionally,
+/// a stable instance.
 ///
-/// Pass one to [moq_publication_announce]. The hop chain is the origin's to build,
-/// so a local publisher cannot claim relay hops it never took. Zeroed (cost 0, NULL
-/// instance) is the default route. `instance` is borrowed for the duration of the call.
+/// Pass one to [moq_origin_route], [moq_origin_route_prefix], or [moq_broadcast_request_route].
+/// The hop chain is the origin's to build, so a local publisher cannot claim relay hops it
+/// never took. Zeroed (or NULL) is the default: visible at once, cost 0, under a fresh
+/// instance. `instance` is borrowed for the duration of the call.
 #[repr(C)]
 #[derive(Clone, Copy)]
-pub struct moq_announce_route {
+pub struct moq_route_options {
 	/// Preference among routes covering the same prefix: lower wins. A publisher
 	/// sets its production cost here: zero for content it is already producing,
 	/// larger for content it would have to start producing on demand.
 	pub cost: u64,
-	/// A stable instance for the stream, NOT NULL terminated, or NULL (or empty) to keep the
-	/// one the publication minted.
+	/// A stable instance for the stream, NOT NULL terminated, or NULL (or empty) to mint a
+	/// fresh one when the route is created.
 	///
-	/// Every publication mints a fresh instance, kept across re-announcing, so a restarted
-	/// publisher is a new stream viewers restart onto. Set one only for a publisher that
-	/// continues its group sequences across restarts and raises `epoch` on each: readers
-	/// stitch every route of one instance together, so restarting the sequences under an
-	/// old instance splices unrelated groups into their tracks. Changing it hands followers
-	/// ([moq_origin_follow]) a new broadcast.
+	/// A route keeps its instance for its lifetime, across [moq_route_withdraw] and
+	/// [moq_route_announce], so a new route is a new stream viewers restart onto. Set one only
+	/// for a publisher that continues its group sequences across restarts and raises `epoch`
+	/// on each: readers stitch every route of one instance together, so restarting the
+	/// sequences under an old instance splices unrelated groups into their tracks.
 	pub instance: *const c_char,
 	/// The length in bytes of `instance`.
 	pub instance_len: usize,
 	/// Which run of a stable `instance` this is: only its highest epoch is eligible, cheaper
 	/// or not. Ignored without one.
 	pub epoch: u64,
+	/// Create the route hidden: it exists for nobody until [moq_route_announce]. For a
+	/// publisher that fills its catalog first.
+	pub hidden: bool,
 }
 
-/// An observed route: hops, a static cost, and the stream's instance.
+/// The read-only facts on a received route: hops, a static cost, and the stream's instance.
 ///
 /// Carried by [moq_announce_event]. Its pointers borrow the announcement's storage.
 #[repr(C)]
 #[derive(Clone, Copy)]
-pub struct moq_route {
+pub struct moq_route_info {
 	/// Hop ids of the relay hops the route traversed, oldest first. 0 is the
 	/// anonymous mark, which ranks the route below every fully identified one.
 	/// A route announced on this origin has none.
@@ -966,18 +969,46 @@ pub struct moq_route {
 	pub instance: moq_string,
 }
 
-/// Parse a [moq_announce_route], treating NULL as the default.
+/// Parse [moq_route_options], treating NULL as the default.
+///
+/// The instance parses as at every API that takes one: NULL or empty names none.
 ///
 /// # Safety
-/// `route` may be NULL, or must point at a readable [moq_announce_route] whose `instance`
+/// `options` may be NULL, or must point at a readable [moq_route_options] whose `instance`
 /// pointer is valid for `instance_len` bytes.
-unsafe fn parse_announce_route(route: *const moq_announce_route) -> Result<moq_net::origin::Route, Error> {
-	let Some(route) = (unsafe { route.as_ref() }) else {
-		return Ok(moq_net::origin::Route::default());
+unsafe fn parse_route_options(options: *const moq_route_options) -> Result<moq_net::origin::RouteOptions, Error> {
+	let hidden = unsafe { options.as_ref() }.is_some_and(|options| options.hidden);
+	unsafe { route_options(options, hidden) }
+}
+
+/// [parse_route_options] for an exact route: created hidden so [State::exact_route] attaches
+/// the catalog track before anyone can find it, with whether the caller asked it visible.
+///
+/// # Safety
+/// As [parse_route_options].
+unsafe fn parse_exact_route_options(
+	options: *const moq_route_options,
+) -> Result<(moq_net::origin::RouteOptions, bool), Error> {
+	let visible = unsafe { options.as_ref() }.is_none_or(|options| !options.hidden);
+	Ok((unsafe { route_options(options, true)? }, visible))
+}
+
+/// # Safety
+/// As [parse_route_options].
+unsafe fn route_options(
+	options: *const moq_route_options,
+	hidden: bool,
+) -> Result<moq_net::origin::RouteOptions, Error> {
+	let mut out = match hidden {
+		true => moq_net::origin::RouteOptions::hidden(),
+		false => moq_net::origin::RouteOptions::default(),
+	};
+	let Some(options) = (unsafe { options.as_ref() }) else {
+		return Ok(out);
 	};
-	let mut out = moq_net::origin::Route::default().with_cost(moq_net::origin::Cost::new(route.cost));
-	if let Some(instance) = unsafe { parse_instance(route.instance, route.instance_len)? } {
-		out = out.with_instance(instance, route.epoch);
+	out = out.with_cost(options.cost);
+	if let Some(instance) = unsafe { parse_instance(options.instance, options.instance_len)? } {
+		out = out.with_instance(instance, options.epoch);
 	}
 	Ok(out)
 }
@@ -1035,7 +1066,7 @@ pub struct moq_announce_event {
 
 	/// The route serving the prefix. On `MOQ_ANNOUNCE_KIND_ABSENT` it carries the last
 	/// advertised route.
-	pub route: moq_route,
+	pub route: moq_route_info,
 }
 
 /// Where a session is in its lifecycle, reported by [moq_connection_state].
@@ -1994,89 +2025,178 @@ pub extern "C" fn moq_origin_create() -> i32 {
 	ffi::enter(move || State::lock().origin.create())
 }
 
-/// Create a broadcast at `path` on an origin, for publishing media tracks.
+/// Create a route at exactly `path` on an origin, owning a new broadcast to fill.
 ///
-/// Writes the broadcast handle to fill with the `moq_publish_*` functions to
-/// `broadcast`, and returns a positive publication handle that announces it, or a
-/// negative code on failure. The broadcast is invisible and unroutable, on this
-/// origin and its peers alike, until [moq_publication_announce]. Fill it, then
-/// announce it. [moq_publish_close] ends it for good;
-/// [moq_publication_free] releases the publication handle without retracting.
+/// Returns a positive route handle, or a negative code on failure. [moq_route_broadcast]
+/// gives the broadcast handle to fill with the `moq_publish_*` functions. The route is
+/// visible at once unless `options` sets `hidden`: a hidden route is invisible and
+/// unroutable, on this origin and its peers alike, until [moq_route_announce], so create
+/// it hidden to fill the catalog first. NULL `options` is the default.
+///
+/// Hold the route while the broadcast should stay announced: [moq_route_free] retracts it,
+/// and [moq_publish_close] ends both.
 ///
 /// # Safety
 /// - The caller must ensure that path is a valid pointer to path_len bytes of data.
-/// - `broadcast` must point at writable storage for one handle.
+/// - `options` may be NULL, or must point at a readable [moq_route_options].
 #[unsafe(no_mangle)]
-pub unsafe extern "C" fn moq_origin_create_broadcast(
+pub unsafe extern "C" fn moq_origin_route(
 	origin: u32,
 	path: *const c_char,
 	path_len: usize,
-	broadcast: *mut u32,
+	options: *const moq_route_options,
 ) -> i32 {
 	ffi::enter(move || {
 		let origin = ffi::parse_id(origin)?;
 		let path = unsafe { ffi::parse_str(path, path_len)? };
-		let broadcast_out = unsafe { broadcast.as_mut() }.ok_or(Error::InvalidPointer)?;
-
+		let (options, visible) = unsafe { parse_exact_route_options(options)? };
 		let mut state = State::lock();
-		let publication = state.origin.create_broadcast(origin, path)?;
-		let (publication, broadcast) = state.publish.create_publication(publication)?;
-		*broadcast_out = broadcast.into();
-		Ok(publication)
+		let route = state.origin.route(origin, path, options)?;
+		state.exact_route(route, visible)
 	})
 }
 
-/// Advertise `prefix` and serve the requests beneath it.
+/// Create a route over `prefix` that serves the requests beneath it.
 ///
 /// A route claims `prefix` and every path beneath it (the empty prefix claims
 /// every path). A service that only serves some of them advertises the
-/// covering prefix and rejects the rest as they are requested. `on_request` is
-/// required: a NULL callback is refused before the route is advertised. It is
-/// invoked with a positive request handle for each
-/// pending broadcast, then exactly once more with a terminal code: `0` (stopped
-/// cleanly, including after [moq_origin_requests_cancel]) or a negative error.
+/// covering prefix and rejects the rest as they are requested. NULL `options` is the
+/// default.
+///
+/// `on_request` is required: a NULL callback is refused before the route is advertised.
+/// It is invoked with a positive request handle for each pending broadcast (answer it with
+/// [moq_broadcast_request_serve], [moq_broadcast_request_route], or
+/// [moq_broadcast_request_reject]), then exactly once more with a terminal code: `0`
+/// (stopped cleanly, after [moq_route_free] or the origin closing) or a negative error.
 /// After the terminal (`<= 0`) callback, `user_data` is never touched again.
 ///
-/// Returns a non-zero handle on success, or a negative code on failure.
+/// Returns a positive route handle on success, or a negative code on failure.
 ///
 /// # Safety
 /// - The caller must ensure that prefix is a valid pointer to prefix_len bytes of data.
+/// - `options` may be NULL, or must point at a readable [moq_route_options].
 /// - `on_request` must be non-NULL; a missing callback is refused before the route is advertised.
 /// - The caller must keep `user_data` valid until the terminal (`<= 0`) `on_request` callback.
 #[unsafe(no_mangle)]
-pub unsafe extern "C" fn moq_origin_requests(
+pub unsafe extern "C" fn moq_origin_route_prefix(
 	origin: u32,
 	prefix: *const c_char,
 	prefix_len: usize,
+	options: *const moq_route_options,
 	on_request: ffi::moq_status_callback,
 	user_data: *mut c_void,
 ) -> i32 {
 	ffi::enter(move || {
 		let origin = ffi::parse_id(origin)?;
 		let prefix = unsafe { ffi::parse_str(prefix, prefix_len)? };
+		let options = unsafe { parse_route_options(options)? };
 		let on_request = unsafe { ffi::OnStatus::new(user_data, on_request)? };
-		State::lock().origin.dynamic(origin, prefix, on_request)
+		State::lock().origin.route_prefix(origin, prefix, options, on_request)
 	})
 }
 
-/// Stop serving and retract the route.
+/// The broadcast an exact route owns, to fill with the `moq_publish_*` functions.
 ///
-/// Returns immediately: zero on success, or a negative code if already closed.
-/// The [moq_origin_requests] `on_request` callback still fires once more with a
-/// terminal `0` (or a negative error), and that final callback is where
-/// `user_data` should be released.
+/// Returns the same positive broadcast handle on every call, or a negative code: a prefix
+/// route owns none (`MOQ_ERROR_BROADCAST_NOT_FOUND`), and neither does a route whose
+/// broadcast [moq_publish_close] ended.
 #[unsafe(no_mangle)]
-pub extern "C" fn moq_origin_requests_cancel(dynamic: u32) -> i32 {
+pub extern "C" fn moq_route_broadcast(route: u32) -> i32 {
 	ffi::enter(move || {
-		let dynamic = ffi::parse_id(dynamic)?;
-		State::lock().origin.dynamic_close(dynamic)
+		let route = ffi::parse_id(route)?;
+		let state = State::lock();
+		let broadcast = state.origin.route_broadcast(route)?;
+		match state.publish.contains(broadcast) {
+			true => Ok(broadcast),
+			false => Err(Error::BroadcastNotFound),
+		}
+	})
+}
+
+/// The stream a route serves, minted at creation unless its options named one.
+///
+/// Kept across [moq_route_withdraw] and [moq_route_announce]. The destination borrows the
+/// route's storage until [moq_route_free].
+///
+/// Returns zero on success, or a negative code on failure.
+///
+/// # Safety
+/// - `dst` must point at a writable [moq_string].
+#[unsafe(no_mangle)]
+pub unsafe extern "C" fn moq_route_instance(route: u32, dst: *mut moq_string) -> i32 {
+	ffi::enter(move || {
+		let route = ffi::parse_id(route)?;
+		let dst = unsafe { dst.as_mut() }.ok_or(Error::InvalidPointer)?;
+		State::lock().origin.route_instance(route, dst)
 	})
 }
 
-/// The path of a broadcast request delivered to a [moq_origin_requests] callback.
+/// Make a route visible, or keep it so.
+///
+/// A route from [moq_broadcast_request_route] also answers the requesters waiting on its
+/// path. Fails once its broadcast closed, and when a request's route can never announce
+/// because the request was released or its prefix route retracted meanwhile.
+///
+/// Returns zero on success, or a negative code on failure.
+#[unsafe(no_mangle)]
+pub extern "C" fn moq_route_announce(route: u32) -> i32 {
+	ffi::enter(move || {
+		let route = ffi::parse_id(route)?;
+		State::lock().origin.route_with(route, |route| route.announce())
+	})
+}
+
+/// Hide a route from everyone, keeping its broadcast and instance.
+///
+/// Local consumers and peers alike stop discovering and requesting it; tracks already in
+/// flight carry on, and [moq_route_announce] brings the same stream back.
+/// Returns zero on success, or a negative code on failure.
+#[unsafe(no_mangle)]
+pub extern "C" fn moq_route_withdraw(route: u32) -> i32 {
+	ffi::enter(move || {
+		let route = ffi::parse_id(route)?;
+		State::lock().origin.route_with(route, |route| {
+			route.withdraw();
+			Ok(())
+		})
+	})
+}
+
+/// Re-price a route in place: lower wins among routes covering the same prefix.
+///
+/// A hidden route keeps the price for when it next announces. Fails once its broadcast
+/// closed. Returns zero on success, or a negative code on failure.
+#[unsafe(no_mangle)]
+pub extern "C" fn moq_route_set_cost(route: u32, cost: u64) -> i32 {
+	ffi::enter(move || {
+		let route = ffi::parse_id(route)?;
+		State::lock().origin.route_with(route, |route| route.set_cost(cost))
+	})
+}
+
+/// Release a route handle, retracting the route.
+///
+/// An exact route's broadcast handle stays the caller's until [moq_publish_close]. A prefix
+/// route stops serving: requests not yet delivered are rejected, and its `on_request`
+/// callback fires once more with a terminal `0`, which is where `user_data` should be
+/// released.
+///
+/// Returns zero on success, or a negative code if the handle is unknown.
+#[unsafe(no_mangle)]
+pub extern "C" fn moq_route_free(route: u32) -> i32 {
+	ffi::enter(move || {
+		let route = ffi::parse_id(route)?;
+		// Dropped outside the lock: retracting refuses a job's waiting requesters.
+		let route = State::lock().origin.route_take(route)?;
+		drop(route);
+		Ok(())
+	})
+}
+
+/// The path of a broadcast request delivered to a [moq_origin_route_prefix] callback.
 ///
 /// The destination borrows the request's storage: copy it out before
-/// [moq_broadcast_request_serve], [moq_broadcast_request_prepare],
+/// [moq_broadcast_request_serve], [moq_broadcast_request_route],
 /// [moq_broadcast_request_reject], or [moq_broadcast_request_free].
 ///
 /// Returns a zero on success, or a negative code on failure.
@@ -2095,7 +2215,7 @@ pub unsafe extern "C" fn moq_broadcast_request_path(request: u32, dst: *mut moq_
 /// Serve a held consumer under the prefix route's instance without announcing an exact route.
 ///
 /// Every answer at this path must continue the same sequences and bytes. Start a new
-/// prefix route for different content, or prepare and publish a job with its own instance.
+/// prefix route for different content, or route a job with its own instance.
 /// Consumes the request handle; the consumer remains owned by the caller.
 /// Returns zero on success, or a negative error.
 #[unsafe(no_mangle)]
@@ -2113,55 +2233,28 @@ pub extern "C" fn moq_broadcast_request_serve(request: u32, broadcast: u32) -> i
 	})
 }
 
-/// Start a broadcast request answer as a new stream under a fresh instance, hidden until
-/// published.
+/// Answer a broadcast request with the path's own exact route, owning a new broadcast.
 ///
-/// Consumes the request handle, writes the new broadcast handle to `broadcast`
-/// (which cannot announce itself; only [moq_broadcast_prepared_publish] does),
-/// and returns a positive prepared-answer handle or a negative error.
+/// Consumes the request handle and returns a positive route handle, or a negative error.
+/// The route serves a fresh instance unless `options` names one, so a job that restarts is
+/// a new stream. Created visible, it announces now and answers the waiting requesters;
+/// created hidden, they wait until [moq_route_announce], so the job can fill its catalog
+/// first, and freeing the route before then refuses them. Ending the route withdraws only
+/// this path. Unreadable `options` fail without consuming the request.
 ///
 /// # Safety
-/// - `broadcast` must point at writable storage for one handle.
+/// - `options` may be NULL, or must point at a readable [moq_route_options].
 #[unsafe(no_mangle)]
-pub unsafe extern "C" fn moq_broadcast_request_prepare(request: u32, broadcast: *mut u32) -> i32 {
+pub unsafe extern "C" fn moq_broadcast_request_route(request: u32, options: *const moq_route_options) -> i32 {
 	ffi::enter(move || {
 		let request = ffi::parse_id(request)?;
-		let broadcast_out = unsafe { broadcast.as_mut() }.ok_or(Error::InvalidPointer)?;
+		let (options, visible) = unsafe { parse_exact_route_options(options)? };
 		let mut state = State::lock();
 		let (pending, driver) = state.origin.broadcast_request_take(request)?;
-		let prepared = pending.prepare()?;
-		let broadcast = state.publish.create((prepared.broadcast().clone(), driver.clone()))?;
-		let id = state.origin.prepared_insert(prepared, driver, broadcast)?;
-		*broadcast_out = broadcast.into();
-		Ok(id)
-	})
-}
-
-/// Publish a prepared claim answer and resolve every waiting requester.
-///
-/// Consumes the prepared handle and returns a positive publication handle, or a
-/// negative code on failure. The broadcast handle returned by
-/// [moq_broadcast_request_prepare] remains owned by the caller.
-#[unsafe(no_mangle)]
-pub extern "C" fn moq_broadcast_prepared_publish(prepared: u32) -> i32 {
-	ffi::enter(move || {
-		let prepared = ffi::parse_id(prepared)?;
-		let mut state = State::lock();
-		let (prepared, driver, broadcast) = state.origin.prepared_take(prepared)?;
 		driver.check()?;
-		let result = state.publish.admit(broadcast, prepared, driver.clone());
+		let result = pending.route(options);
 		driver.check()?;
-		result
-	})
-}
-
-/// Free a prepared claim answer without publishing it.
-#[unsafe(no_mangle)]
-pub extern "C" fn moq_broadcast_prepared_free(prepared: u32) -> i32 {
-	ffi::enter(move || {
-		let prepared = ffi::parse_id(prepared)?;
-		State::lock().origin.prepared_take(prepared)?;
-		Ok(())
+		state.exact_route((result?, driver), visible)
 	})
 }
 
@@ -2181,7 +2274,7 @@ pub extern "C" fn moq_broadcast_request_reject(request: u32, error_code: u16) ->
 	})
 }
 
-/// Free a broadcast request without accepting or rejecting it.
+/// Free a broadcast request without answering it.
 ///
 /// Dropping the request rejects it. Returns a zero on success, or a negative
 /// code if the handle is unknown.
@@ -2374,8 +2467,8 @@ pub extern "C" fn moq_origin_follow_cancel(task: u32) -> i32 {
 ///
 /// Owns discovery of the path and retries route churn while resolving one publisher instance.
 /// It fails as unroutable once discovery has synced without a covering route, including a
-/// broadcast created but not announced. No separate announcement stream is needed.
-/// Serve on-demand paths with [moq_origin_requests].
+/// hidden route not announced yet. No separate announcement stream is needed.
+/// Serve on-demand paths with [moq_origin_route_prefix].
 ///
 /// `instance` is the only stream to accept, or NULL (or empty) for any. A request pinned to an
 /// instance that does not serve the path is unroutable.
@@ -2441,8 +2534,7 @@ unsafe fn parse_instance(instance: *const c_char, instance_len: usize) -> Result
 
 /// Close an origin and clean up its resources.
 ///
-/// The origin keeps running while a broadcast published on it or a
-/// [moq_origin_requests] handler lives; close or cancel those to end it.
+/// The origin keeps running while a route created on it lives; free those to end it.
 ///
 /// Returns a zero on success, or a negative code on failure.
 #[unsafe(no_mangle)]
@@ -2453,51 +2545,6 @@ pub extern "C" fn moq_origin_close(origin: u32) -> i32 {
 	})
 }
 
-/// Advertise a publication's exact path as a route.
-///
-/// Announcing again re-prices the route in place, or restarts it under another instance. A
-/// NULL `route` uses the default: cost 0, under the instance the publication minted. Until
-/// announced, the broadcast is invisible and unroutable for local consumers and peers alike.
-/// Fails once the broadcast closed.
-///
-/// Returns a zero on success, or a negative code on failure.
-///
-/// # Safety
-/// - `route` may be NULL, or must point at a readable [moq_announce_route].
-#[unsafe(no_mangle)]
-pub unsafe extern "C" fn moq_publication_announce(publication: u32, route: *const moq_announce_route) -> i32 {
-	ffi::enter(move || {
-		let publication = ffi::parse_id(publication)?;
-		let route = unsafe { parse_announce_route(route)? };
-		State::lock().publish.announce(publication, route)
-	})
-}
-
-/// Retract a publication's exact-path advertisement, if any.
-///
-/// Local consumers and peers alike stop discovering and requesting it; tracks already in
-/// flight carry on, and announcing again brings it back. Fails once the broadcast closed.
-/// Returns a zero on success, or a negative code on failure.
-#[unsafe(no_mangle)]
-pub extern "C" fn moq_publication_unannounce(publication: u32) -> i32 {
-	ffi::enter(move || {
-		let publication = ffi::parse_id(publication)?;
-		State::lock().publish.unannounce(publication)
-	})
-}
-
-/// Release a publication handle.
-///
-/// The broadcast and its route stay as they are; [moq_publish_close] ends them.
-/// Returns a zero on success, or a negative code on failure.
-#[unsafe(no_mangle)]
-pub extern "C" fn moq_publication_free(publication: u32) -> i32 {
-	ffi::enter(move || {
-		let publication = ffi::parse_id(publication)?;
-		State::lock().publish.publication_free(publication)
-	})
-}
-
 /// End a broadcast for good and release its handle.
 ///
 /// The origin retracts the path immediately and serves no new tracks. Every media, raw track,
@@ -2911,7 +2958,7 @@ pub unsafe extern "C" fn moq_publish_video_properties(broadcast: u32, properties
 ///
 /// This is the producer counterpart to [moq_consume_video_config]: instead of
 /// reading a rendition out of a catalog, it writes one into the catalog of a
-/// broadcast created with [moq_origin_create_broadcast]. The rendition is keyed by
+/// broadcast from [moq_route_broadcast]. The rendition is keyed by
 /// `config.name`; calling this again with the same name replaces the rendition
 /// you declared, so a config can be refined in place. It fails when a
 /// [moq_publish_video] track owns the name, since that track publishes and
@@ -3048,7 +3095,7 @@ pub unsafe extern "C" fn moq_publish_audio_remove(broadcast: u32, name: *const c
 ///
 /// This is the producer counterpart to [moq_consume_catalog_section] /
 /// [moq_consume_catalog_section_at]: it writes an arbitrary top-level JSON key into the
-/// catalog of a broadcast created with [moq_origin_create_broadcast], beyond the
+/// catalog of a broadcast from [moq_route_broadcast], beyond the
 /// `video`/`audio` keys owned by the media pipeline. Calling it again with the
 /// same name replaces the section. The updated catalog is published to
 /// subscribers automatically.
diff --git a/rs/moq-c/src/origin.rs b/rs/moq-c/src/origin.rs
index b1eb57a1e4e..ead137e4192 100644
--- a/rs/moq-c/src/origin.rs
+++ b/rs/moq-c/src/origin.rs
@@ -3,7 +3,7 @@ use tokio::sync::oneshot;
 
 use crate::ffi::{OnFollow, OnStatus};
 use crate::task::Task;
-use crate::{Error, Id, NonZeroSlab, State, moq_announce_event, moq_announce_kind, moq_route, moq_string};
+use crate::{Error, Id, NonZeroSlab, State, moq_announce_event, moq_announce_kind, moq_route_info, moq_string};
 
 /// Global state managing all active resources.
 ///
@@ -25,17 +25,18 @@ pub struct Origin {
 	/// Pending requests. Close signals shutdown; the task delivers a final callback, then removes itself.
 	consume_task: NonZeroSlab<Task>,
 
+	/// Routes created on an origin, retracted when freed.
+	routes: NonZeroSlab<RouteEntry>,
+
 	/// Follows. Close signals shutdown; the task delivers its end event, then removes itself.
 	follow_task: NonZeroSlab<Task<OnFollow>>,
 
-	/// Served routes from [Self::dynamic], retracted when the handle is closed.
-	dynamic: NonZeroSlab<DynamicEntry>,
+	/// Request deliveries of prefix routes. Freeing the route signals shutdown; the task
+	/// delivers a final callback, then removes itself.
+	route_requests: NonZeroSlab<Task>,
 
-	/// Broadcast requests delivered to a dynamic handler, freed after accept/reject.
+	/// Broadcast requests delivered to a prefix route's callback, freed after serve/route/reject.
 	broadcast_request: NonZeroSlab<(moq_net::origin::Request, crate::ffi::Background)>,
-
-	/// Claim answers being filled before their exact route is announced.
-	prepared: NonZeroSlab<(moq_net::origin::Prepared, crate::ffi::Background, Id)>,
 }
 
 #[derive(Clone)]
@@ -116,20 +117,48 @@ impl AnnouncedRecord {
 			_captures: captures,
 			capture_views,
 			kind,
-			hops: update.route.hops.iter().map(|hop| hop.id()).collect(),
-			cost: update.route.cost.value(),
-			instance: update
-				.route
-				.instance
-				.map(|instance| instance.to_string())
-				.unwrap_or_default(),
+			hops: update.route.hops().iter().map(|hop| hop.id()).collect(),
+			cost: update.route.cost().value(),
+			instance: update.route.instance().to_string(),
 		}
 	}
 }
 
-struct DynamicEntry {
-	task: Task,
-	inner: Option<moq_net::origin::Requests>,
+impl State {
+	/// Store an exact route and the fill handle of the broadcast it owns, returning the route.
+	///
+	/// The route is created hidden, so its catalog track is attached before `visible` announces
+	/// it and a reader that finds it finds the catalog.
+	pub fn exact_route(
+		&mut self,
+		(route, driver): (moq_net::origin::Route, crate::ffi::Background),
+		visible: bool,
+	) -> Result<Id, Error> {
+		let broadcast = self.publish.create((route.broadcast().clone(), driver.clone()))?;
+		let announced = match visible {
+			true => route.announce().map_err(Error::from),
+			false => Ok(()),
+		};
+		announced
+			.and_then(|()| self.origin.route_insert(route, driver, broadcast))
+			.inspect_err(|_| {
+				self.publish.discard(broadcast);
+			})
+	}
+}
+
+struct RouteEntry {
+	inner: moq_net::origin::Route,
+	driver: crate::ffi::Background,
+	/// Minted at creation and kept for the route's lifetime, borrowed by [Origin::route_instance].
+	instance: String,
+	/// An exact route's broadcast fill handle, or a prefix route's request delivery task.
+	kind: RouteKind,
+}
+
+enum RouteKind {
+	Exact { broadcast: Id },
+	Prefix { requests: Id },
 }
 
 impl Origin {
@@ -202,7 +231,7 @@ impl Origin {
 			captures: announced.capture_views.as_ptr(),
 			captures_len: announced.capture_views.len(),
 			kind: announced.kind,
-			route: moq_route {
+			route: moq_route_info {
 				hops: announced.hops.as_ptr(),
 				hops_len: announced.hops.len(),
 				cost: announced.cost,
@@ -358,49 +387,83 @@ impl Origin {
 		self.consume_task.close(task, Error::NotFound)
 	}
 
-	/// Create an unannounced broadcast at `path` on an origin.
+	/// Create an exact route at `path`, returning the route and the broadcast it owns.
 	///
 	/// Errors with [`Error::Moq`] if the path is outside the origin's scope.
-	pub fn create_broadcast<P: TryInto<moq_net::Path, Error: Into<moq_net::Error>>>(
+	pub fn route(
 		&self,
 		origin: Id,
-		path: P,
-	) -> Result<(moq_net::origin::Publication, crate::ffi::Background), Error> {
+		path: &str,
+		options: moq_net::origin::RouteOptions,
+	) -> Result<(moq_net::origin::Route, crate::ffi::Background), Error> {
 		let origin = self.get(origin)?;
-		let result = origin.producer.create_broadcast(path);
+		let result = origin.producer.route(path, options);
 		origin.driver.check()?;
 		Ok((result?, origin.driver.clone()))
 	}
 
-	/// Advertise `prefix` and serve requests beneath it, delivering each as a
-	/// broadcast-request handle via `on_request`.
-	pub fn dynamic(&mut self, origin: Id, prefix: &str, on_request: OnStatus) -> Result<Id, Error> {
-		let origin = self.active.get(origin).ok_or(Error::OriginNotFound)?;
-		origin.driver.check()?;
+	/// Store an exact route whose broadcast fill handle is `broadcast`.
+	pub fn route_insert(
+		&mut self,
+		route: moq_net::origin::Route,
+		driver: crate::ffi::Background,
+		broadcast: Id,
+	) -> Result<Id, Error> {
+		self.routes.insert(RouteEntry {
+			instance: route.instance().to_string(),
+			inner: route,
+			driver,
+			kind: RouteKind::Exact { broadcast },
+		})
+	}
+
+	/// Create a prefix route, delivering each request beneath it as a broadcast-request handle
+	/// via `on_request`.
+	pub fn route_prefix(
+		&mut self,
+		origin: Id,
+		prefix: &str,
+		options: moq_net::origin::RouteOptions,
+		on_request: OnStatus,
+	) -> Result<Id, Error> {
+		let origin = self.get(origin)?;
 		let driver = origin.driver.clone();
-		let result = origin.producer.requests(prefix);
-		origin.driver.check()?;
-		let inner = result?;
+		let result = origin.producer.route_prefix(prefix, options);
+		driver.check()?;
+		let route = result?;
+		let instance = route.instance().to_string();
+
+		// The route first, so the delivery task finds it once it runs; it cannot lock the
+		// state before this call returns.
 		let (task, close) = Task::new(on_request);
-		let id = self.dynamic.insert(DynamicEntry {
-			task,
-			inner: Some(inner),
-		})?;
+		let requests = self.route_requests.insert(task)?;
+		let id = match self.routes.insert(RouteEntry {
+			inner: route,
+			driver: driver.clone(),
+			instance,
+			kind: RouteKind::Prefix { requests },
+		}) {
+			Ok(id) => id,
+			Err(err) => {
+				self.route_requests.remove(requests);
+				return Err(err);
+			}
+		};
 
-		let request_driver = driver.clone();
 		tokio::spawn(async move {
-			let res = crate::ffi::run(driver.watch(Self::run_dynamic(id, close, request_driver))).await;
-			let entry = State::lock().origin.dynamic.remove(id);
+			let res = crate::ffi::run(driver.watch(Self::run_requests(id, on_request, close, driver.clone()))).await;
+			let entry = State::lock().origin.route_requests.remove(requests);
 			if let Some(entry) = entry {
-				entry.task.callback.call(res);
+				entry.callback.call(res);
 			}
 		});
 
 		Ok(id)
 	}
 
-	async fn run_dynamic(
-		id: Id,
+	async fn run_requests(
+		route: Id,
+		callback: OnStatus,
 		mut close: oneshot::Receiver<()>,
 		driver: crate::ffi::Background,
 	) -> Result<(), Error> {
@@ -408,39 +471,74 @@ impl Origin {
 			let request = tokio::select! {
 				biased;
 				_ = &mut close => return Ok(()),
-				res = kio::wait(|waiter| {
+				request = kio::wait(|waiter| {
 					let state = State::lock();
-					match state.origin.dynamic.get(id).and_then(|entry| entry.inner.as_ref()) {
-						Some(dynamic) => dynamic.poll_requested_broadcast(waiter),
-						None => std::task::Poll::Ready(Err(moq_net::Error::Closed)),
+					match state.origin.routes.get(route) {
+						Some(entry) => entry.inner.poll_requested(waiter),
+						None => std::task::Poll::Ready(None),
 					}
-				}) => match res {
-					Ok(request) => request,
-					Err(moq_net::Error::Closed) => return Ok(()),
-					Err(err) => return Err(err.into()),
+				}) => match request {
+					Some(request) => request,
+					// Retracted, or the origin closed.
+					None => return Ok(()),
 				},
 			};
 
+			// Hold the lock only to buffer the request; release it before the callback.
 			let request_id = State::lock()
 				.origin
 				.broadcast_request
 				.insert((request, driver.clone()))?;
-			let callback = State::lock().origin.dynamic.get(id).map(|entry| entry.task.callback);
-			let Some(callback) = callback else {
-				return Ok(());
-			};
 			callback.call(request_id);
 		}
 	}
 
-	pub fn dynamic_close(&mut self, dynamic: Id) -> Result<(), Error> {
-		let entry = self.dynamic.get_mut(dynamic).ok_or(Error::NotFound)?;
-		let inner = entry.inner.take().ok_or(Error::NotFound)?;
-		entry.task.close(Error::NotFound)?;
-		drop(inner);
+	fn route_entry(&self, route: Id) -> Result<&RouteEntry, Error> {
+		let entry = self.routes.get(route).ok_or(Error::NotFound)?;
+		entry.driver.check()?;
+		Ok(entry)
+	}
+
+	/// Run `f` against the route, then check its origin is still healthy.
+	pub fn route_with<R>(
+		&self,
+		route: Id,
+		f: impl FnOnce(&moq_net::origin::Route) -> Result<R, moq_net::Error>,
+	) -> Result<R, Error> {
+		let entry = self.route_entry(route)?;
+		let result = f(&entry.inner);
+		entry.driver.check()?;
+		Ok(result?)
+	}
+
+	/// An exact route's broadcast fill handle, or [`Error::BroadcastNotFound`] on a prefix route.
+	pub fn route_broadcast(&self, route: Id) -> Result<Id, Error> {
+		match self.route_entry(route)?.kind {
+			RouteKind::Exact { broadcast } => Ok(broadcast),
+			RouteKind::Prefix { .. } => Err(Error::BroadcastNotFound),
+		}
+	}
+
+	pub fn route_instance(&self, route: Id, dst: &mut moq_string) -> Result<(), Error> {
+		let entry = self.route_entry(route)?;
+		*dst = moq_string {
+			data: entry.instance.as_ptr().cast::<c_char>(),
+			len: entry.instance.len(),
+		};
 		Ok(())
 	}
 
+	/// Release a route handle and stop a prefix route's request delivery, returning the route
+	/// for the caller to retract by dropping it.
+	pub fn route_take(&mut self, route: Id) -> Result<moq_net::origin::Route, Error> {
+		let entry = self.routes.remove(route).ok_or(Error::NotFound)?;
+		if let RouteKind::Prefix { requests } = entry.kind {
+			// Already gone once the origin closed and the task delivered its terminal callback.
+			let _ = self.route_requests.close(requests, Error::NotFound);
+		}
+		Ok(entry.inner)
+	}
+
 	pub fn broadcast_request_path(&self, request: Id, dst: &mut crate::moq_string) -> Result<(), Error> {
 		let request = self.broadcast_request.get(request).ok_or(Error::NotFound)?;
 		let path = request.0.path();
@@ -458,22 +556,6 @@ impl Origin {
 		self.broadcast_request.remove(request).ok_or(Error::NotFound)
 	}
 
-	pub fn prepared_insert(
-		&mut self,
-		prepared: moq_net::origin::Prepared,
-		driver: crate::ffi::Background,
-		broadcast: Id,
-	) -> Result<Id, Error> {
-		self.prepared.insert((prepared, driver, broadcast))
-	}
-
-	pub fn prepared_take(
-		&mut self,
-		prepared: Id,
-	) -> Result<(moq_net::origin::Prepared, crate::ffi::Background, Id), Error> {
-		self.prepared.remove(prepared).ok_or(Error::NotFound)
-	}
-
 	pub fn close(&mut self, origin: Id) -> Result<(), Error> {
 		self.active.remove(origin).ok_or(Error::OriginNotFound)?;
 		Ok(())
@@ -483,36 +565,35 @@ impl Origin {
 #[cfg(test)]
 mod supervision_tests {
 	use super::*;
+	use moq_net::origin::RouteOptions;
 
 	#[tokio::test]
-	async fn a_broadcast_keeps_the_origin_failure_after_its_origin_handle_is_released() {
+	async fn a_route_keeps_the_origin_failure_after_its_origin_handle_is_released() {
 		let (producer, completion, trigger) = crate::ffi::panicking_origin();
-		let mut origins = Origin::default();
-		let origin = origins
+		let mut state = State::new();
+		let origin = state
+			.origin
 			.active
 			.insert(Producer {
 				producer,
 				driver: completion.clone(),
 			})
 			.unwrap();
-		let mut publish = crate::publish::Publish::default();
-		let (publication, _broadcast) = publish
-			.create_publication(origins.create_broadcast(origin, "retained").unwrap())
-			.unwrap();
-		origins.close(origin).unwrap();
+		let retained = state.origin.route(origin, "retained", RouteOptions::hidden()).unwrap();
+		let route = state.exact_route(retained, false).unwrap();
+		state.origin.close(origin).unwrap();
 		*trigger
 			.write()
 			.unwrap_or_else(|_| unreachable!("test keeps its panic trigger open")) = true;
 		assert!(matches!(completion.finished().await, Err(Error::Panic)));
 		drop(completion);
 		assert!(matches!(
-			publish.announce(publication, Default::default()),
+			state.origin.route_with(route, |route| route.announce()),
 			Err(Error::Panic)
 		));
-		let healthy = origins.create().unwrap();
-		let (publication, _broadcast) = publish
-			.create_publication(origins.create_broadcast(healthy, "healthy").unwrap())
-			.unwrap();
-		publish.announce(publication, Default::default()).unwrap();
+		let healthy = state.origin.create().unwrap();
+		let healthy = state.origin.route(healthy, "healthy", RouteOptions::hidden()).unwrap();
+		let route = state.exact_route(healthy, false).unwrap();
+		state.origin.route_with(route, |route| route.announce()).unwrap();
 	}
 }
diff --git a/rs/moq-c/src/publish.rs b/rs/moq-c/src/publish.rs
index 9fc5eddc906..b399493045b 100644
--- a/rs/moq-c/src/publish.rs
+++ b/rs/moq-c/src/publish.rs
@@ -342,17 +342,6 @@ pub struct Publish {
 
 	/// Group requests delivered to a handler, freed on accept, abort, or free.
 	group_request: NonZeroSlab<GroupRequest>,
-
-	/// Announcement handles for origin broadcasts, freed by the caller.
-	publications: NonZeroSlab<Publication>,
-}
-
-/// A broadcast's announcement capability, beside the fill handle it was published with.
-struct Publication {
-	driver: crate::ffi::Background,
-	/// The fill handle, which leaves the registry once the broadcast closes.
-	broadcast: Id,
-	inner: moq_net::origin::Publication,
 }
 
 impl Publish {
@@ -390,77 +379,14 @@ impl Publish {
 		Ok(id)
 	}
 
-	/// Store an origin broadcast's fill handle and its publication, returning both handles.
-	pub fn create_publication(
-		&mut self,
-		(publication, driver): (moq_net::origin::Publication, crate::ffi::Background),
-	) -> Result<(Id, Id), Error> {
-		let broadcast = self.create((publication.broadcast().clone(), driver.clone()))?;
-		let id = self.publications.insert(Publication {
-			broadcast,
-			driver,
-			inner: publication,
-		});
-		match id {
-			Ok(id) => Ok((id, broadcast)),
-			Err(err) => {
-				self.broadcasts.remove(broadcast);
-				Err(err)
-			}
-		}
-	}
-
-	/// Publish a prepared answer filled through `id`, returning its publication handle.
-	pub fn admit(
-		&mut self,
-		id: Id,
-		prepared: moq_net::origin::Prepared,
-		driver: crate::ffi::Background,
-	) -> Result<Id, Error> {
-		if let Some(broadcast) = self.broadcasts.get(id) {
-			broadcast.driver.check()?;
-			if !broadcast.producer.is_clone(prepared.broadcast()) {
-				return Err(Error::BroadcastNotFound);
-			}
-		}
-		// A closed fill left this registry, and native admission refuses it.
-		let publication = prepared.publish()?;
-		self.publications.insert(Publication {
-			driver,
-			broadcast: id,
-			inner: publication,
-		})
+	/// Whether `id` names a broadcast fill handle that has not been closed.
+	pub fn contains(&self, id: Id) -> bool {
+		self.broadcasts.get(id).is_some()
 	}
 
-	/// The publication, refused with `Closed` once its broadcast closed.
-	fn publication(&self, id: Id) -> Result<&Publication, Error> {
-		let publication = self.publications.get(id).ok_or(Error::NotFound)?;
-		publication.driver.check()?;
-		if self.broadcasts.get(publication.broadcast).is_none() {
-			return Err(Error::Moq(moq_net::Error::Closed));
-		}
-		Ok(publication)
-	}
-
-	/// Advertise the broadcast's exact path as a route. Announcing again re-prices
-	/// in place. Until announced, the broadcast is invisible and unroutable.
-	pub fn announce(&mut self, publication: Id, route: moq_net::origin::Route) -> Result<(), Error> {
-		let publication = self.publication(publication)?;
-		let result = publication.inner.announce(route);
-		publication.driver.check()?;
-		Ok(result?)
-	}
-
-	/// Retract the broadcast's exact-path advertisement, if any.
-	pub fn unannounce(&mut self, publication: Id) -> Result<(), Error> {
-		self.publication(publication)?.inner.unannounce();
-		Ok(())
-	}
-
-	/// Release a publication handle; the broadcast and its route stay as they are.
-	pub fn publication_free(&mut self, publication: Id) -> Result<(), Error> {
-		self.publications.remove(publication).ok_or(Error::NotFound)?;
-		Ok(())
+	/// Drop a fill handle that never reached the caller.
+	pub fn discard(&mut self, id: Id) {
+		self.broadcasts.remove(id);
 	}
 
 	/// The broadcast's track producer.
@@ -1695,53 +1621,14 @@ mod children_tests {
 mod supervision_tests {
 	use super::*;
 
-	#[tokio::test(start_paused = true)]
-	async fn admission_must_match_the_broadcast_it_filled() {
-		let origin = moq_tokio::origin::spawn();
-		let claim = origin.requests("room").unwrap();
-		let pending = origin.consume().request("room/first", None);
-		let prepared = claim.requested_broadcast().await.unwrap().prepare().unwrap();
-		let mut publish = Publish::default();
-		let first = publish
-			.create((prepared.broadcast().clone(), Default::default()))
-			.unwrap();
-		let alias = {
-			let original = publish.broadcast(first).unwrap();
-			Broadcast {
-				driver: original.driver.clone(),
-				producer: original.producer.clone(),
-				catalog: original.catalog.clone(),
-				video: Default::default(),
-				audio: Default::default(),
-				children: Default::default(),
-				ended: false,
-			}
-		};
-		let clone = publish.broadcasts.insert(alias).unwrap();
-		assert_ne!(first, clone);
-		let publication = publish.admit(clone, prepared, Default::default()).unwrap();
-		pending.await.unwrap();
-		publish.unannounce(publication).unwrap();
-
-		let pending = origin.consume().request("room/second", None);
-		let prepared = claim.requested_broadcast().await.unwrap().prepare().unwrap();
-		publish
-			.create((prepared.broadcast().clone(), Default::default()))
-			.unwrap();
-		assert!(matches!(
-			publish.admit(first, prepared, Default::default()),
-			Err(Error::BroadcastNotFound)
-		));
-		assert!(pending.await.is_err());
-	}
-
 	#[tokio::test]
 	async fn a_container_importer_keeps_the_origin_failure_after_other_owners_are_released() {
 		let (origin, completion, trigger) = crate::ffi::panicking_origin();
 		let mut publish = Publish::default();
-		let (_publication, broadcast) = publish
-			.create_publication((origin.create_broadcast("retained").unwrap(), completion.clone()))
+		let route = origin
+			.route("retained", moq_net::origin::RouteOptions::hidden())
 			.unwrap();
+		let broadcast = publish.create((route.broadcast().clone(), completion.clone())).unwrap();
 		let container = publish
 			.container(
 				broadcast,
@@ -1763,9 +1650,12 @@ mod supervision_tests {
 	async fn a_finish_after_a_driver_panic_reports_it_until_the_close() {
 		let (origin, completion, trigger) = crate::ffi::panicking_origin();
 		let mut state = State::new();
-		let (_publication, broadcast) = state
+		let route = origin
+			.route("retained", moq_net::origin::RouteOptions::hidden())
+			.unwrap();
+		let broadcast = state
 			.publish
-			.create_publication((origin.create_broadcast("retained").unwrap(), completion.clone()))
+			.create((route.broadcast().clone(), completion.clone()))
 			.unwrap();
 		let producer = &state.publish.broadcast(broadcast).unwrap().producer;
 		// A dynamic handle outlives the consumed broadcast, so only an explicit close ends it.
diff --git a/rs/moq-c/src/test.rs b/rs/moq-c/src/test.rs
index f999572ba69..97f72e72e86 100644
--- a/rs/moq-c/src/test.rs
+++ b/rs/moq-c/src/test.rs
@@ -41,21 +41,46 @@ fn id(raw: i32) -> u32 {
 	raw as u32
 }
 
-/// Create a broadcast at `path` on `origin`, returning its publication and fill handles.
-fn create_broadcast(origin: u32, path: &[u8]) -> (u32, u32) {
-	let mut broadcast = 0;
-	let publication =
-		id(unsafe { moq_origin_create_broadcast(origin, path.as_ptr() as *const c_char, path.len(), &mut broadcast) });
-	(publication, broadcast)
+/// Create a route at `path` on `origin`, returning its route and broadcast fill handles.
+fn create_route(origin: u32, path: &[u8], options: Option<&moq_route_options>) -> (u32, u32) {
+	let options = options.map_or(std::ptr::null(), |options| options as *const _);
+	let route = id(unsafe { moq_origin_route(origin, path.as_ptr() as *const c_char, path.len(), options) });
+	(route, id(moq_route_broadcast(route)))
 }
 
-/// Create a broadcast at `path` on `origin` and announce it, keeping only the fill handle:
-/// releasing the publication leaves the route up.
+/// Create a visible route at `path` on `origin`, keeping only the fill handle. The route handle
+/// stays registered for the rest of the test process, so the path stays announced until the
+/// broadcast closes.
 fn publish_broadcast(origin: u32, path: &[u8]) -> u32 {
-	let (publication, broadcast) = create_broadcast(origin, path);
-	assert_eq!(unsafe { moq_publication_announce(publication, std::ptr::null()) }, 0);
-	assert_eq!(moq_publication_free(publication), 0);
-	broadcast
+	create_route(origin, path, None).1
+}
+
+/// Route options at `cost` under the stable `instance`, borrowing it.
+fn route_options(cost: u64, instance: &str, hidden: bool) -> moq_route_options {
+	moq_route_options {
+		cost,
+		instance: instance.as_ptr().cast(),
+		instance_len: instance.len(),
+		epoch: 0,
+		hidden,
+	}
+}
+
+/// Default route options, created hidden.
+fn hidden() -> moq_route_options {
+	route_options(0, "", true)
+}
+
+/// The instance a route serves.
+fn instance_of(route: u32) -> String {
+	let mut dst = moq_string {
+		data: std::ptr::null(),
+		len: 0,
+	};
+	assert_eq!(unsafe { moq_route_instance(route, &mut dst) }, 0);
+	unsafe { std::str::from_utf8(std::slice::from_raw_parts(dst.data.cast::<u8>(), dst.len)) }
+		.unwrap()
+		.to_string()
 }
 
 /// Request a published broadcast via `moq_origin_request` and return its handle.
@@ -166,7 +191,7 @@ fn announce_info(announced: u32) -> moq_announce_event {
 		captures: std::ptr::null(),
 		captures_len: 0,
 		kind: moq_announce_kind::MOQ_ANNOUNCE_KIND_PRESENT,
-		route: moq_route {
+		route: moq_route_info {
 			hops: std::ptr::null(),
 			hops_len: 0,
 			cost: 0,
@@ -185,18 +210,8 @@ fn fresh_instance() -> String {
 	moq_net::Instance::random().to_string()
 }
 
-/// An announce route at `cost` under the stable `instance`, borrowing it.
-fn announce_route(cost: u64, instance: &str) -> moq_announce_route {
-	moq_announce_route {
-		cost,
-		instance: instance.as_ptr().cast(),
-		instance_len: instance.len(),
-		epoch: 0,
-	}
-}
-
 /// The instance a received route carries.
-fn route_instance(route: &moq_route) -> Option<String> {
+fn route_instance(route: &moq_route_info) -> Option<String> {
 	(route.instance.len > 0).then(|| unsafe {
 		std::str::from_utf8(std::slice::from_raw_parts(
 			route.instance.data.cast::<u8>(),
@@ -3842,75 +3857,91 @@ fn announced_deactivation() {
 	let announced_task = id(unsafe { moq_origin_announced(origin, std::ptr::null(), Some(channel_callback), cb.ptr) });
 
 	let path = b"deactivate/test";
-	let (publication, broadcast) = create_broadcast(origin, path);
-	assert_eq!(unsafe { moq_publication_announce(publication, std::ptr::null()) }, 0);
+	let (route, broadcast) = create_route(origin, path, None);
+	let instance = instance_of(route);
 
 	let (announced_id, info) = cb.recv_route();
 	assert_eq!(info.kind, moq_announce_kind::MOQ_ANNOUNCE_KIND_PRESENT);
+	assert_eq!(route_instance(&info.route).as_ref(), Some(&instance));
 	assert_eq!(moq_origin_announced_free(announced_id), 0);
 
-	// Going non-live unannounces the broadcast without tearing it down: local
-	// consumers stop reaching it, exactly as peers do, until it announces again.
-	assert_eq!(moq_publication_unannounce(publication), 0);
+	// Withdrawing hides the route without tearing down its broadcast: local consumers stop
+	// reaching it, exactly as peers do, until it announces again.
+	assert_eq!(moq_route_withdraw(route), 0);
 
 	let (deactivated_id, info) = cb.recv_route();
 	assert_eq!(info.kind, moq_announce_kind::MOQ_ANNOUNCE_KIND_ABSENT);
 	assert_eq!(moq_origin_announced_free(deactivated_id), 0);
-	assert!(request_once(origin, path) < 0, "an unannounced broadcast is unroutable");
+	assert!(request_once(origin, path) < 0, "a withdrawn broadcast is unroutable");
 
-	assert_eq!(unsafe { moq_publication_announce(publication, std::ptr::null()) }, 0);
+	// Announcing again continues the same stream.
+	assert_eq!(moq_route_announce(route), 0);
 	let (reannounced_id, info) = cb.recv_route();
 	assert_eq!(info.kind, moq_announce_kind::MOQ_ANNOUNCE_KIND_PRESENT);
+	assert_eq!(route_instance(&info.route), Some(instance));
 	assert_eq!(moq_origin_announced_free(reannounced_id), 0);
 	let _ = request_broadcast(origin, path);
 
 	assert_eq!(moq_origin_announced_cancel(announced_task), 0);
 	assert_eq!(cb.recv_terminal(), 0, "announced close delivers terminal 0");
 	assert_eq!(moq_publish_close(broadcast), 0);
-	assert!(
-		unsafe { moq_publication_announce(publication, std::ptr::null()) } < 0,
-		"a closed broadcast cannot announce"
-	);
-	assert_eq!(moq_publication_free(publication), 0);
-	assert!(moq_publication_free(publication) < 0, "a freed publication is released");
+	assert!(moq_route_announce(route) < 0, "a closed broadcast cannot announce");
+	assert!(moq_route_broadcast(route) < 0, "a closed broadcast leaves the route");
+	assert_eq!(moq_route_free(route), 0);
+	assert!(moq_route_free(route) < 0, "a freed route is released");
 	assert_eq!(moq_origin_close(origin), 0);
 }
 
-/// A publication outliving its closed broadcast cannot announce or withdraw the broadcast that
+/// Freeing the route retracts it, though its broadcast handle stays the caller's to close.
+#[test]
+fn freeing_a_route_retracts_it() {
+	let origin = id(moq_origin_create());
+	let path = b"freed";
+	let (route, broadcast) = create_route(origin, path, None);
+	let _ = request_broadcast(origin, path);
+
+	assert_eq!(moq_route_free(route), 0);
+	assert!(request_once(origin, path) < 0, "a freed route is unroutable");
+	assert!(moq_route_announce(route) < 0, "a freed route is released");
+	let track = b"data";
+	assert!(unsafe { moq_publish_track(broadcast, track.as_ptr().cast(), track.len(), std::ptr::null()) } > 0);
+	assert_eq!(moq_publish_close(broadcast), 0);
+	assert_eq!(moq_origin_close(origin), 0);
+}
+
+/// A route outliving its closed broadcast cannot announce, re-price, or withdraw the route that
 /// replaced it at the same path.
 #[test]
-fn a_stale_publication_leaves_its_replacement_alone() {
+fn a_closed_route_leaves_its_replacement_alone() {
 	let origin = id(moq_origin_create());
 	let path = b"replaced";
-	let (stale, broadcast) = create_broadcast(origin, path);
-	assert_eq!(unsafe { moq_publication_announce(stale, std::ptr::null()) }, 0);
+	let (stale, broadcast) = create_route(origin, path, None);
 	assert_eq!(moq_publish_close(broadcast), 0);
 
-	let (publication, replacement) = create_broadcast(origin, path);
-	assert_eq!(unsafe { moq_publication_announce(publication, std::ptr::null()) }, 0);
-	assert!(unsafe { moq_publication_announce(stale, std::ptr::null()) } < 0);
-	assert!(moq_publication_unannounce(stale) < 0);
+	let (route, replacement) = create_route(origin, path, None);
+	assert!(moq_route_announce(stale) < 0);
+	assert!(moq_route_set_cost(stale, 1) < 0);
+	assert_eq!(moq_route_withdraw(stale), 0);
 	let _ = request_broadcast(origin, path);
 
-	assert_eq!(moq_publication_free(stale), 0);
-	assert_eq!(moq_publication_free(publication), 0);
+	assert_eq!(moq_route_free(stale), 0);
+	assert_eq!(moq_route_free(route), 0);
 	assert_eq!(moq_publish_close(replacement), 0);
 	assert_eq!(moq_origin_close(origin), 0);
 }
 
 #[test]
-fn create_broadcast_is_unroutable_until_announced() {
+fn a_hidden_route_is_unroutable_until_announced() {
 	let origin = id(moq_origin_create());
 	let cb = Callback::new();
 	let announced_task = id(unsafe { moq_origin_announced(origin, std::ptr::null(), Some(channel_callback), cb.ptr) });
 
 	let path = b"quiet";
-	let (publication, broadcast) = create_broadcast(origin, path);
+	let (route, broadcast) = create_route(origin, path, Some(&hidden()));
 	// Nobody reaches it, locally included, until it announces.
-	assert!(request_once(origin, path) < 0, "an unannounced broadcast is unroutable");
+	assert!(request_once(origin, path) < 0, "a hidden route is unroutable");
 
-	assert_eq!(unsafe { moq_publication_announce(publication, std::ptr::null()) }, 0);
-	assert_eq!(moq_publication_free(publication), 0);
+	assert_eq!(moq_route_announce(route), 0);
 	let _ = request_broadcast(origin, path);
 	let (announced_id, info) = cb.recv_route();
 	assert_eq!(info.kind, moq_announce_kind::MOQ_ANNOUNCE_KIND_PRESENT);
@@ -3918,6 +3949,7 @@ fn create_broadcast_is_unroutable_until_announced() {
 
 	assert_eq!(moq_origin_announced_cancel(announced_task), 0);
 	assert_eq!(cb.recv_terminal(), 0);
+	assert_eq!(moq_route_free(route), 0);
 	assert_eq!(moq_publish_close(broadcast), 0);
 	assert_eq!(moq_origin_close(origin), 0);
 }
@@ -3925,15 +3957,14 @@ fn create_broadcast_is_unroutable_until_announced() {
 /// A locally announced route carries its cost and instance, and no hops: the hop chain is
 /// the origin's to build.
 #[test]
-fn announce_route_carries_cost_and_instance_without_hops() {
+fn route_options_carry_cost_and_instance_without_hops() {
 	let origin = id(moq_origin_create());
 	let cb = Callback::new();
 	let announced_task = id(unsafe { moq_origin_announced(origin, std::ptr::null(), Some(channel_callback), cb.ptr) });
-	let (publication, broadcast) = create_broadcast(origin, b"routed");
 
 	let instance = fresh_instance();
-	let route = announce_route(7, &instance);
-	assert_eq!(unsafe { moq_publication_announce(publication, &route) }, 0);
+	let (route, broadcast) = create_route(origin, b"routed", Some(&route_options(7, &instance, false)));
+	assert_eq!(instance_of(route), instance);
 
 	let (announced, info) = cb.recv_route();
 	assert_eq!(info.kind, moq_announce_kind::MOQ_ANNOUNCE_KIND_PRESENT);
@@ -3942,37 +3973,46 @@ fn announce_route_carries_cost_and_instance_without_hops() {
 	assert_eq!(route_instance(&info.route).as_ref(), Some(&instance));
 	assert_eq!(moq_origin_announced_free(announced), 0);
 
-	// A zeroed route is the default: cost 0 and the instance the publication minted.
-	let zeroed = moq_announce_route {
-		cost: 0,
-		instance: std::ptr::null(),
-		instance_len: 0,
-		epoch: 0,
-	};
-	let (publication2, broadcast2) = create_broadcast(origin, b"plain");
-	assert_eq!(unsafe { moq_publication_announce(publication2, &zeroed) }, 0);
+	// Re-pricing changes the route in place: the listing never reports it, but a fresh
+	// listing reads the new price under the same instance.
+	assert_eq!(moq_route_set_cost(route, 3), 0);
+	let repriced_cb = Callback::new();
+	let repriced_task =
+		id(unsafe { moq_origin_announced(origin, std::ptr::null(), Some(channel_callback), repriced_cb.ptr) });
+	let (announced, info) = repriced_cb.recv_route();
+	assert_eq!(info.kind, moq_announce_kind::MOQ_ANNOUNCE_KIND_PRESENT);
+	assert_eq!(info.route.cost, 3);
+	assert_eq!(route_instance(&info.route).as_ref(), Some(&instance));
+	assert_eq!(moq_origin_announced_free(announced), 0);
+	assert_eq!(moq_origin_announced_cancel(repriced_task), 0);
+	assert_eq!(repriced_cb.recv_announce_terminal(), 0);
+
+	// Zeroed options are the default: visible at once, cost 0, under a freshly minted instance.
+	let zeroed = route_options(0, "", false);
+	let (plain, broadcast2) = create_route(origin, b"plain", Some(&zeroed));
 	let (announced, info) = cb.recv_route();
 	assert_eq!(info.route.cost, 0);
-	assert!(route_instance(&info.route).is_some_and(|minted| minted != instance));
+	let minted = route_instance(&info.route).unwrap();
+	assert_ne!(minted, instance);
+	assert_eq!(minted, instance_of(plain));
 	assert_eq!(moq_origin_announced_free(announced), 0);
 
 	assert_eq!(moq_origin_announced_cancel(announced_task), 0);
 	assert_eq!(cb.recv_announce_terminal(), 0);
-	assert_eq!(moq_publication_free(publication), 0);
-	assert_eq!(moq_publication_free(publication2), 0);
+	assert_eq!(moq_route_free(route), 0);
+	assert_eq!(moq_route_free(plain), 0);
 	assert_eq!(moq_publish_close(broadcast), 0);
 	assert_eq!(moq_publish_close(broadcast2), 0);
 	assert_eq!(moq_origin_close(origin), 0);
 }
 
-/// Announcing under another instance is another stream: the path stays listed, and a follower
-/// is handed the new instance's broadcast.
+/// Another route at a path is another stream: the path stays listed, and a follower is
+/// handed the new route's broadcast.
 #[test]
-fn announce_under_a_new_instance_restarts() {
+fn a_new_route_at_a_path_restarts() {
 	let origin = id(moq_origin_create());
 	let cb = Callback::new();
 	let announced_task = id(unsafe { moq_origin_announced(origin, std::ptr::null(), Some(channel_callback), cb.ptr) });
-	let (publication, broadcast) = create_broadcast(origin, b"restarted");
 	let follow_cb = Callback::new();
 	let path = b"restarted";
 	let follow = id(unsafe {
@@ -3988,10 +4028,7 @@ fn announce_under_a_new_instance_restarts() {
 	});
 
 	let first = fresh_instance();
-	assert_eq!(
-		unsafe { moq_publication_announce(publication, &announce_route(0, &first)) },
-		0
-	);
+	let (first_route, first_broadcast) = create_route(origin, b"restarted", Some(&route_options(0, &first, false)));
 	let (announced, info) = cb.recv_route();
 	assert_eq!(info.kind, moq_announce_kind::MOQ_ANNOUNCE_KIND_PRESENT);
 	assert_eq!(route_instance(&info.route), Some(first));
@@ -3999,10 +4036,7 @@ fn announce_under_a_new_instance_restarts() {
 	let old = id(follow_cb.recv());
 
 	let second = fresh_instance();
-	assert_eq!(
-		unsafe { moq_publication_announce(publication, &announce_route(0, &second)) },
-		0
-	);
+	let (second_route, second_broadcast) = create_route(origin, b"restarted", Some(&route_options(0, &second, false)));
 	let new = id(follow_cb.recv());
 	assert_ne!(old, new);
 
@@ -4013,25 +4047,33 @@ fn announce_under_a_new_instance_restarts() {
 	// The path stayed present throughout: the cancel's terminal is the next callback.
 	assert_eq!(moq_origin_announced_cancel(announced_task), 0);
 	assert_eq!(cb.recv(), 0, "a restart is not listed");
-	assert_eq!(moq_publication_free(publication), 0);
-	assert_eq!(moq_publish_close(broadcast), 0);
+	assert_eq!(moq_route_free(first_route), 0);
+	assert_eq!(moq_route_free(second_route), 0);
+	assert_eq!(moq_publish_close(first_broadcast), 0);
+	assert_eq!(moq_publish_close(second_broadcast), 0);
 	assert_eq!(moq_origin_close(origin), 0);
 }
 
-#[test]
-fn dynamic_serves_a_request_under_a_prefix() {
-	let origin = id(moq_origin_create());
-	let cb = Callback::new();
-	let prefix = b"live";
-	let dynamic = id(unsafe {
-		moq_origin_requests(
+/// Create a prefix route over `prefix` delivering its requests through `cb`.
+fn route_prefix(origin: u32, prefix: &[u8], cb: &Callback) -> u32 {
+	id(unsafe {
+		moq_origin_route_prefix(
 			origin,
 			prefix.as_ptr() as *const c_char,
 			prefix.len(),
+			std::ptr::null(),
 			Some(channel_callback),
 			cb.ptr,
 		)
-	});
+	})
+}
+
+#[test]
+fn dynamic_serves_a_request_under_a_prefix() {
+	let origin = id(moq_origin_create());
+	let cb = Callback::new();
+	let dynamic = route_prefix(origin, b"live", &cb);
+	assert!(moq_route_broadcast(dynamic) < 0, "a prefix route owns no broadcast");
 
 	let path = b"live/cam";
 	let req_cb = Callback::new();
@@ -4056,17 +4098,35 @@ fn dynamic_serves_a_request_under_a_prefix() {
 	let got = unsafe { std::str::from_utf8(std::slice::from_raw_parts(info.data.cast::<u8>(), info.len)).unwrap() };
 	assert_eq!(got, "live/cam");
 
-	let mut served = 0;
-	let prepared = id(unsafe { moq_broadcast_request_prepare(request, &mut served) });
-	let publication = id(moq_broadcast_prepared_publish(prepared));
+	// Unreadable options leave the request to answer.
+	let invalid = [0xff];
+	let unreadable = moq_route_options {
+		instance: invalid.as_ptr().cast(),
+		instance_len: invalid.len(),
+		..hidden()
+	};
+	assert_eq!(
+		unsafe { moq_broadcast_request_route(request, &unreadable) },
+		crate::error::MOQ_ERROR_UTF8
+	);
+
+	// A hidden job route answers nobody until it announces, under its own fresh instance.
+	let job = id(unsafe { moq_broadcast_request_route(request, &hidden()) });
+	assert!(
+		unsafe { moq_broadcast_request_route(request, std::ptr::null()) } < 0,
+		"request is consumed"
+	);
+	assert_ne!(instance_of(job), instance_of(dynamic));
+	let served = id(moq_route_broadcast(job));
+	assert_eq!(moq_route_announce(job), 0);
 	assert!(req_cb.recv() > 0);
 	req_cb.recv_terminal();
-	// The answer's route is the publication's to withdraw.
-	assert_eq!(moq_publication_unannounce(publication), 0);
-	assert_eq!(moq_publication_free(publication), 0);
+	// The answer's route is the job's to withdraw.
+	assert_eq!(moq_route_withdraw(job), 0);
+	assert_eq!(moq_route_free(job), 0);
 
-	assert_eq!(moq_origin_requests_cancel(dynamic), 0);
-	assert!(moq_origin_requests_cancel(dynamic) < 0, "double-cancel should fail");
+	assert_eq!(moq_route_free(dynamic), 0);
+	assert!(moq_route_free(dynamic) < 0, "double-free should fail");
 	assert_eq!(cb.recv_terminal(), 0);
 	assert_eq!(moq_publish_close(served), 0);
 	assert_eq!(moq_origin_close(origin), 0);
@@ -4078,8 +4138,7 @@ fn dynamic_serves_a_held_consumer_without_taking_its_handle() {
 	let broadcast = publish_broadcast(origin, b"source");
 	let held = consume_local(broadcast);
 	let cb = Callback::new();
-	let dynamic =
-		id(unsafe { moq_origin_requests(origin, b"live".as_ptr().cast(), 4, Some(channel_callback), cb.ptr) });
+	let dynamic = route_prefix(origin, b"live", &cb);
 	let result = Callback::new();
 	let _task = id(unsafe {
 		moq_origin_request(
@@ -4099,7 +4158,7 @@ fn dynamic_serves_a_held_consumer_without_taking_its_handle() {
 	assert_eq!(moq_consume_close(held), 0, "source handle remains caller-owned");
 	result.recv_terminal();
 	assert_eq!(moq_consume_close(served), 0);
-	assert_eq!(moq_origin_requests_cancel(dynamic), 0);
+	assert_eq!(moq_route_free(dynamic), 0);
 	cb.recv_terminal();
 	assert_eq!(moq_publish_close(broadcast), 0);
 	assert_eq!(moq_origin_close(origin), 0);
@@ -4110,10 +4169,11 @@ fn dynamic_refuses_a_missing_callback() {
 	let origin = id(moq_origin_create());
 	let prefix = b"live";
 	let code = unsafe {
-		moq_origin_requests(
+		moq_origin_route_prefix(
 			origin,
 			prefix.as_ptr() as *const c_char,
 			prefix.len(),
+			std::ptr::null(),
 			None,
 			std::ptr::null_mut(),
 		)
@@ -5123,16 +5183,16 @@ fn follow_close_cancels() {
 	assert_eq!(moq_origin_close(origin), 0);
 }
 
-/// Publish `path` on `origin` through `route` from Rust, keeping the Rust publication.
-fn publish(origin: u32, path: &str, route: moq_net::origin::Route) -> moq_net::origin::Publication {
+/// Route `path` on `origin` with `options` from Rust, keeping the Rust route.
+fn publish(origin: u32, path: &str, options: moq_net::origin::RouteOptions) -> moq_net::origin::Route {
 	let _runtime = crate::ffi::RUNTIME.enter();
 	let origin = crate::Id::try_from(origin).unwrap();
-	State::lock().origin.get(origin).unwrap().publish(path, route).unwrap()
+	State::lock().origin.get(origin).unwrap().route(path, options).unwrap()
 }
 
-/// Publish `path` on `origin` under a fresh instance, as each run of a publisher does.
-fn publish_run(origin: u32, path: &str) -> moq_net::origin::Publication {
-	publish(origin, path, moq_net::origin::Route::default())
+/// Route `path` on `origin` under a fresh instance, as each run of a publisher does.
+fn publish_run(origin: u32, path: &str) -> moq_net::origin::Route {
+	publish(origin, path, moq_net::origin::RouteOptions::default())
 }
 
 /// Another publisher instance taking the path delivers a fresh handle on the same wait.
@@ -5176,7 +5236,12 @@ fn follow_delivers_a_takeover_once(dynamic_at: &str) {
 	let dynamic = {
 		let _runtime = crate::ffi::RUNTIME.enter();
 		let origin = crate::Id::try_from(origin).unwrap();
-		State::lock().origin.get(origin).unwrap().requests(dynamic_at).unwrap()
+		State::lock()
+			.origin
+			.get(origin)
+			.unwrap()
+			.route_prefix(dynamic_at, moq_net::origin::RouteOptions::default())
+			.unwrap()
 	};
 	let cb = Callback::new();
 	let path = b"live";
@@ -5193,8 +5258,8 @@ fn follow_delivers_a_takeover_once(dynamic_at: &str) {
 	});
 
 	// The wait is on the dynamic route's answer when the exact path takes over under another instance.
-	let _unanswered = crate::ffi::RUNTIME.block_on(dynamic.requested_broadcast()).unwrap();
-	let takeover = publish(origin, "live", moq_net::origin::Route::default());
+	let _unanswered = crate::ffi::RUNTIME.block_on(dynamic.requested()).unwrap();
+	let takeover = publish_run(origin, "live");
 	let delivered = id(cb.recv());
 	assert!(
 		cb.rx
@@ -5256,7 +5321,7 @@ fn an_instance_pins_request_and_follow() {
 	let first = publish(
 		origin,
 		"live",
-		moq_net::origin::Route::default().with_instance(instance.clone(), 0),
+		moq_net::origin::RouteOptions::default().with_instance(instance.clone(), 0),
 	);
 	let instance = instance.to_string();
 
@@ -5304,10 +5369,15 @@ fn an_instance_pins_request_and_follow() {
 }
 
 /// Serve `prefix` on `origin` dynamically.
-fn serve_dynamic(origin: u32, prefix: &str) -> moq_net::origin::Requests {
+fn serve_dynamic(origin: u32, prefix: &str) -> moq_net::origin::Route {
 	let _runtime = crate::ffi::RUNTIME.enter();
 	let origin = crate::Id::try_from(origin).unwrap();
-	State::lock().origin.get(origin).unwrap().requests(prefix).unwrap()
+	State::lock()
+		.origin
+		.get(origin)
+		.unwrap()
+		.route_prefix(prefix, moq_net::origin::RouteOptions::default())
+		.unwrap()
 }
 
 /// Wait for the broadcast at `path` on `origin`, delivering each instance through `cb`.
@@ -5374,16 +5444,16 @@ fn follow_delivers_the_instance_again_after_an_end() {
 	});
 	let recv = || rx.recv_timeout(TIMEOUT).expect("callback timed out");
 
-	let route = moq_net::origin::Route::default().with_instance(moq_net::Instance::random(), 0);
-	let run = publish(origin, "live", route.clone());
+	let options = moq_net::origin::RouteOptions::default().with_instance(moq_net::Instance::random(), 0);
+	let run = publish(origin, "live", options);
 	let first = id(recv());
 
 	// Hold the wait inside that delivery so both changes are on hand when it next looks: the
 	// same stream announcing again after its route left is still a gap.
 	{
 		let _runtime = crate::ffi::RUNTIME.enter();
-		run.unannounce();
-		run.announce(route.clone()).unwrap();
+		run.withdraw();
+		run.announce().unwrap();
 	}
 	release.send(()).unwrap();
 	assert_eq!(recv(), FOLLOW_OFFLINE, "the gap is reported before the return");
@@ -5407,7 +5477,7 @@ fn follow_waits_for_another_instance_after_a_freed_takeover() {
 	let cb = Callback::new();
 	let task = follow(origin, b"live", &cb);
 
-	let _unanswered = crate::ffi::RUNTIME.block_on(dynamic.requested_broadcast()).unwrap();
+	let _unanswered = crate::ffi::RUNTIME.block_on(dynamic.requested()).unwrap();
 	let takeover = publish_run(origin, "live");
 	assert_eq!(moq_consume_close(id(cb.recv())), 0);
 	assert!(
@@ -5435,7 +5505,7 @@ fn follow_delivers_a_gap_while_resolving_once() {
 	let cb = Callback::new();
 	let task = follow(origin, b"live", &cb);
 
-	let _unanswered = crate::ffi::RUNTIME.block_on(dynamic.requested_broadcast()).unwrap();
+	let _unanswered = crate::ffi::RUNTIME.block_on(dynamic.requested()).unwrap();
 	{
 		let _runtime = crate::ffi::RUNTIME.enter();
 		drop(dynamic);
@@ -5445,7 +5515,7 @@ fn follow_delivers_a_gap_while_resolving_once() {
 		reason = "the test thread has no runtime; it waits out the hold on the C API's real runtime"
 	)]
 	std::thread::sleep(moq_net::origin::Config::default().update_hold * 2);
-	let arrival = publish(origin, "live", moq_net::origin::Route::default());
+	let arrival = publish_run(origin, "live");
 	let delivered = id(cb.recv());
 	assert!(
 		cb.rx
@@ -7665,14 +7735,7 @@ fn announce_route_hops_cross_a_relay_session() {
 
 	let announced_cb = Callback::new();
 	let task = id(unsafe { moq_origin_announced(sink, std::ptr::null(), Some(channel_callback), announced_cb.ptr) });
-	let (publication, broadcast) = create_broadcast(source, b"relayed");
-	let route = moq_announce_route {
-		cost: 7,
-		instance: std::ptr::null(),
-		instance_len: 0,
-		epoch: 0,
-	};
-	assert_eq!(unsafe { moq_publication_announce(publication, &route) }, 0);
+	let (route, broadcast) = create_route(source, b"relayed", Some(&route_options(7, "", false)));
 	let (announced, info) = announced_cb.recv_route();
 	assert_eq!(info.kind, moq_announce_kind::MOQ_ANNOUNCE_KIND_PRESENT);
 	assert_eq!(
@@ -7701,7 +7764,7 @@ fn announce_route_hops_cross_a_relay_session() {
 	}
 	assert_eq!(moq_server_close(server), 0);
 	assert_eq!(server_cb.recv_terminal(), 0);
-	assert_eq!(moq_publication_free(publication), 0);
+	assert_eq!(moq_route_free(route), 0);
 	assert_eq!(moq_publish_close(broadcast), 0);
 	for origin in [source, relay, sink] {
 		assert_eq!(moq_origin_close(origin), 0);
diff --git a/rs/moq-cli/src/announced.rs b/rs/moq-cli/src/announced.rs
index c46d412f25f..ac9ed23d9c9 100644
--- a/rs/moq-cli/src/announced.rs
+++ b/rs/moq-cli/src/announced.rs
@@ -181,7 +181,7 @@ mod tests {
 		/// Stops the relay, which ends every session on it.
 		shutdown: moq_relay::shutdown::Trigger,
 		/// The published broadcasts by path; dropping one retracts it.
-		broadcasts: Vec<(&'static str, moq_net::origin::Publication)>,
+		broadcasts: Vec<(&'static str, moq_net::origin::Route)>,
 		_publisher: moq_tokio::Connection,
 	}
 
@@ -206,8 +206,9 @@ mod tests {
 			let broadcasts = ["demo/a", "demo/b", "other/c"]
 				.into_iter()
 				.map(|path| {
-					let broadcast = origin.create_broadcast(path).expect("broadcast");
-					broadcast.announce(Default::default()).expect("announce");
+					let broadcast = origin
+						.route(path, moq_net::origin::RouteOptions::default())
+						.expect("broadcast");
 					(path, broadcast)
 				})
 				.collect::<Vec<_>>();
diff --git a/rs/moq-cli/src/archive.rs b/rs/moq-cli/src/archive.rs
index a0b71ccfa03..e161286e163 100644
--- a/rs/moq-cli/src/archive.rs
+++ b/rs/moq-cli/src/archive.rs
@@ -296,13 +296,17 @@ pub async fn import(
 	if let Some(refresh) = args.refresh {
 		config = config.with_refresh(refresh.into());
 	}
-	let broadcast = origin.create_broadcast(&name).context("failed to create broadcast")?;
-	let consumer = moq_archive::Consumer::open(store, broadcast.broadcast().clone(), config)
+	// Hidden until the recording opens, then held while the replay runs.
+	let route = origin
+		.route(
+			&name,
+			moq_net::origin::RouteOptions::hidden().with_instance(instance, 0),
+		)
+		.context("failed to create broadcast")?;
+	let consumer = moq_archive::Consumer::open(store, route.broadcast().clone(), config)
 		.await
 		.with_context(|| format!("no readable recording at {}", args.store))?;
-	broadcast
-		.announce(moq_net::origin::Route::default().with_instance(instance, 0))
-		.context("failed to announce broadcast")?;
+	route.announce().context("failed to announce broadcast")?;
 
 	tracing::info!(%name, store = %args.store, "replaying");
 	notify_ready();
@@ -400,16 +404,13 @@ mod tests {
 		let mut instances = Vec::new();
 		let mut broadcasts = Vec::new();
 		for path in ["live/a", "live/b", "other"] {
-			let broadcast = origin.create_broadcast(path).unwrap();
-			let track = broadcast.create_track("video", info.clone()).unwrap();
+			let broadcast = origin.route(path, moq_net::origin::RouteOptions::hidden()).unwrap();
+			let track = broadcast.broadcast().create_track("video", info.clone()).unwrap();
 			let mut group = track.create_group(group::Info { sequence: 0 }).unwrap();
 			group.write_frame(Timestamp::from_millis(0).unwrap(), path).unwrap();
 			group.finish().unwrap();
-			let instance = moq_net::Instance::random();
-			broadcast
-				.announce(moq_net::origin::Route::default().with_instance(instance.clone(), 0))
-				.unwrap();
-			instances.push(instance);
+			broadcast.announce().unwrap();
+			instances.push(broadcast.instance());
 			broadcasts.push((broadcast, track));
 		}
 
@@ -420,7 +421,7 @@ mod tests {
 				.expect("the export subscribes")
 				.unwrap();
 			track.finish().unwrap();
-			broadcast.close();
+			broadcast.broadcast().close();
 		}
 		let complete = [
 			format!("live/a/@{}/.end", instances[0]),
@@ -460,10 +461,12 @@ mod tests {
 			retention_grace: None,
 		};
 		let origin = moq_tokio::origin::spawn();
-		let claim = origin.requests("live/a").unwrap();
+		let claim = origin
+			.route_prefix("live/a", moq_net::origin::RouteOptions::default())
+			.unwrap();
 		let recording = tokio::spawn(export(origin.consume(), "live".into(), args));
 
-		let request = kio::clock::timeout(Duration::from_secs(10), claim.requested_broadcast())
+		let request = kio::clock::timeout(Duration::from_secs(10), claim.requested())
 			.await
 			.expect("the export follows the listed path")
 			.unwrap();
@@ -522,7 +525,7 @@ mod tests {
 			loop {
 				if let Some(moq_net::announce::Event::Present(announce)) = announced.next().await {
 					assert_eq!(announce.prefix.as_str(), "replay");
-					assert_eq!(announce.route.instance, Some(instance.clone()));
+					assert_eq!(announce.route.instance(), &instance);
 					break;
 				}
 			}
@@ -555,16 +558,18 @@ mod tests {
 	async fn a_resolved_broadcast_is_recorded_once() {
 		let origin = moq_tokio::origin::spawn();
 		let path = moq_net::Path::from_static("live/a");
-		let newest = origin.create_broadcast(&path).unwrap();
-		let older = origin.create_broadcast(&path).unwrap();
+		let newest = origin.route(&path, moq_net::origin::RouteOptions::hidden()).unwrap();
+		let older = origin.route(&path, moq_net::origin::RouteOptions::hidden()).unwrap();
 
 		let claims = Claims::default();
-		let claim = claims.claim(&path, &newest.consume()).expect("first claim");
-		assert!(claims.claim(&path, &newest.consume()).is_none());
-		let beside = claims.claim(&path, &older.consume()).expect("another instance");
+		let claim = claims.claim(&path, &newest.broadcast().consume()).expect("first claim");
+		assert!(claims.claim(&path, &newest.broadcast().consume()).is_none());
+		let beside = claims
+			.claim(&path, &older.broadcast().consume())
+			.expect("another instance");
 
 		drop(claim);
-		assert!(claims.claim(&path, &newest.consume()).is_some());
+		assert!(claims.claim(&path, &newest.broadcast().consume()).is_some());
 		drop(beside);
 		assert!(claims.0.lock().unwrap().is_empty());
 	}
diff --git a/rs/moq-cli/src/complete.rs b/rs/moq-cli/src/complete.rs
index 02891375b99..f43b36da713 100644
--- a/rs/moq-cli/src/complete.rs
+++ b/rs/moq-cli/src/complete.rs
@@ -428,8 +428,7 @@ mod tests {
 		moq_tokio::crypto::install_default().unwrap();
 
 		let origin = moq_tokio::origin::spawn();
-		let _alpha = origin.create_broadcast("alpha").expect("alpha");
-		_alpha.announce(Default::default()).expect("alpha");
+		let _alpha = origin.route("alpha", Default::default()).expect("alpha");
 
 		let mut config = moq_tokio::listen::Config::default();
 		config.bind = Some("127.0.0.1:0".parse().unwrap());
diff --git a/rs/moq-cli/src/fetch.rs b/rs/moq-cli/src/fetch.rs
index 9f9c16c2412..23420c51dae 100644
--- a/rs/moq-cli/src/fetch.rs
+++ b/rs/moq-cli/src/fetch.rs
@@ -187,7 +187,7 @@ mod tests {
 	struct Fixture {
 		origin: moq_net::origin::Producer,
 		_keep: (
-			moq_net::origin::Publication,
+			moq_net::origin::Route,
 			Vec<moq_net::track::Producer>,
 			moq_net::group::Producer,
 		),
@@ -196,10 +196,11 @@ mod tests {
 	impl Fixture {
 		async fn new() -> Self {
 			let origin = moq_tokio::origin::spawn();
-			let broadcast = origin.create_broadcast("demo").expect("broadcast");
-			broadcast.announce(Default::default()).expect("announce");
+			let broadcast = origin
+				.route("demo", moq_net::origin::RouteOptions::default())
+				.expect("broadcast");
 
-			let data = broadcast.create_track("data", timed()).expect("data track");
+			let data = broadcast.broadcast().create_track("data", timed()).expect("data track");
 			for sequence in 0..3 {
 				let mut group = data.append_group().expect("group");
 				for frame in frames(sequence) {
@@ -207,8 +208,11 @@ mod tests {
 				}
 				group.finish().expect("finish");
 			}
-			let empty = broadcast.create_track("empty", timed()).expect("empty track");
-			let live = broadcast.create_track("live", timed()).expect("live track");
+			let empty = broadcast
+				.broadcast()
+				.create_track("empty", timed())
+				.expect("empty track");
+			let live = broadcast.broadcast().create_track("live", timed()).expect("live track");
 			let mut open = live.append_group().expect("open group");
 			open.write_frame(moq_net::Timestamp::ZERO, b"first".as_ref())
 				.expect("frame");
@@ -245,7 +249,7 @@ mod tests {
 		/// Kept so the published broadcast, its tracks, and the open group stay live.
 		_publisher: (moq_tokio::Connection, Fixture),
 		/// Kept so the relay's hidden broadcast and its track stay live.
-		_hidden: (moq_net::origin::Publication, moq_net::track::Producer),
+		_hidden: (moq_net::origin::Route, moq_net::track::Producer),
 	}
 
 	impl NetworkFixture {
@@ -259,10 +263,9 @@ mod tests {
 				.relay
 				.cluster()
 				.origin
-				.create_broadcast(".hidden")
+				.route(".hidden", moq_net::origin::RouteOptions::default())
 				.expect("hidden broadcast");
-			hidden.announce(Default::default()).expect("announce hidden");
-			let secret = hidden.create_track("data", timed()).expect("hidden track");
+			let secret = hidden.broadcast().create_track("data", timed()).expect("hidden track");
 			let mut group = secret.append_group().expect("group");
 			group
 				.write_frame(moq_net::Timestamp::ZERO, b"secret".as_ref())
diff --git a/rs/moq-cli/src/hls.rs b/rs/moq-cli/src/hls.rs
index e4c1a40b785..5b79d9a61c5 100644
--- a/rs/moq-cli/src/hls.rs
+++ b/rs/moq-cli/src/hls.rs
@@ -170,12 +170,18 @@ pub async fn import(target: ImportTarget, args: ImportArgs, instance: moq_net::I
 		linger,
 		bandwidth,
 	} = target;
-	let producer = origin.create_broadcast(&name).context("failed to create broadcast")?;
+	// Held through the linger, so the finished broadcast stays announced while it serves the tail.
+	let route = origin
+		.route(
+			&name,
+			moq_net::origin::RouteOptions::hidden().with_instance(instance, 0),
+		)
+		.context("failed to create broadcast")?;
 
 	let config = moq_mux::catalog::Config::default()
 		.with_max_age(max_age)
 		.with_bandwidth(bandwidth);
-	let catalog = moq_mux::catalog::Producer::new(&mut producer.broadcast().clone(), config)?;
+	let catalog = moq_mux::catalog::Producer::new(&mut route.broadcast().clone(), config)?;
 	// Announced once the catalog first goes out, which waits for every rendition's init: a
 	// relay queries a broadcast's tracks the moment it is announced, and keeps the refusals of a
 	// publisher that cannot serve its declared tracks yet.
@@ -183,14 +189,14 @@ pub async fn import(target: ImportTarget, args: ImportArgs, instance: moq_net::I
 
 	let mut config = moq_hls::import::Config::new(playlist_url(&args.playlist)?);
 	config.passthrough = args.passthrough;
-	let mut importer = moq_hls::import::Import::new(producer.broadcast().clone(), catalog, config)?;
+	let mut importer = moq_hls::import::Import::new(route.broadcast().clone(), catalog, config)?;
 
 	tracing::info!(%name, "importing HLS");
 
 	let ran = match importer.init().await {
 		Ok(()) => {
 			notify_ready();
-			run_announced(&mut importer, &mut listed, &producer, instance).await
+			run_announced(&mut importer, &mut listed, &route).await
 		}
 		Err(err) => Err(err.into()),
 	};
@@ -204,7 +210,7 @@ pub async fn import(target: ImportTarget, args: ImportArgs, instance: moq_net::I
 	// arrives after the end still gets the tail. An interrupt drops it at once.
 	importer.finish()?;
 	tracing::info!(?linger, "playlist ended; serving the finished broadcast");
-	moq_mux::Linger::new([producer.broadcast().clone()], importer, linger)
+	moq_mux::Linger::new([route.broadcast().clone()], importer, linger)
 		.wait()
 		.await;
 	Ok(())
@@ -216,8 +222,7 @@ pub async fn import(target: ImportTarget, args: ImportArgs, instance: moq_net::I
 async fn run_announced(
 	importer: &mut moq_hls::import::Import,
 	listed: &mut moq_mux::catalog::hang::Consumer,
-	publication: &moq_net::origin::Publication,
-	instance: moq_net::Instance,
+	route: &moq_net::origin::Route,
 ) -> anyhow::Result<()> {
 	let run = importer.run();
 	tokio::pin!(run);
@@ -233,9 +238,7 @@ async fn run_announced(
 		}
 	};
 	anyhow::ensure!(catalog.is_some(), "the playlist ended before it declared a track");
-	publication
-		.announce(moq_net::origin::Route::default().with_instance(instance, 0))
-		.context("failed to announce broadcast")?;
+	route.announce().context("failed to announce broadcast")?;
 	if !ended {
 		run.await?;
 	}
@@ -389,7 +392,7 @@ mod test {
 		tempfile::TempDir,
 		moq_hls::import::Import,
 		moq_mux::catalog::hang::Consumer,
-		moq_net::origin::Publication,
+		moq_net::origin::Route,
 	)> {
 		let dir = tempfile::tempdir()?;
 		write_playlist(dir.path(), segments, false);
@@ -397,7 +400,7 @@ mod test {
 
 		let (origin, driver) = moq_net::origin::Producer::new(moq_net::origin::Config::default());
 		tokio::spawn(moq_net::time::run(driver));
-		let producer = origin.create_broadcast("hls")?;
+		let producer = origin.route("hls", moq_net::origin::RouteOptions::hidden())?;
 		let catalog =
 			moq_mux::catalog::Producer::new(&mut producer.broadcast().clone(), moq_mux::catalog::Config::default())?;
 		let listed = catalog.consume()?;
@@ -419,10 +422,8 @@ mod test {
 	async fn an_ended_playlist_announces_its_catalog() {
 		for _ in 0..32 {
 			let (_dir, mut importer, mut listed, producer) = joined_then_ended(1).await.unwrap();
-			run_announced(&mut importer, &mut listed, &producer, moq_net::Instance::random())
-				.await
-				.unwrap();
-			assert!(producer.route().is_some(), "the finished playlist was not announced");
+			run_announced(&mut importer, &mut listed, &producer).await.unwrap();
+			assert!(producer.is_announced(), "the finished playlist was not announced");
 		}
 	}
 
@@ -440,8 +441,8 @@ mod test {
 	#[tokio::test]
 	async fn an_empty_playlist_fails_unannounced() {
 		let (_dir, mut importer, mut listed, producer) = joined_then_ended(0).await.unwrap();
-		let result = run_announced(&mut importer, &mut listed, &producer, moq_net::Instance::random()).await;
-		assert!(producer.route().is_none(), "an empty playlist was announced");
+		let result = run_announced(&mut importer, &mut listed, &producer).await;
+		assert!(!producer.is_announced(), "an empty playlist was announced");
 		let err = result.expect_err("an empty playlist imports nothing");
 		assert!(format!("{err:#}").contains("before it declared a track"), "{err:#}");
 	}
diff --git a/rs/moq-cli/src/hls/record.rs b/rs/moq-cli/src/hls/record.rs
index 9e8f3b57e89..6b545b2d125 100644
--- a/rs/moq-cli/src/hls/record.rs
+++ b/rs/moq-cli/src/hls/record.rs
@@ -604,7 +604,7 @@ mod tests {
 	/// A broadcast publishing VP8 renditions with aligned two-second GOPs.
 	struct Publisher {
 		origin: moq_net::origin::Producer,
-		broadcast: moq_net::origin::Publication,
+		broadcast: moq_net::origin::Route,
 		catalog: moq_mux::catalog::Producer,
 		video: Vec<Video>,
 	}
@@ -612,7 +612,7 @@ mod tests {
 	impl Publisher {
 		fn new(names: &[&str]) -> Self {
 			let origin = moq_tokio::origin::spawn();
-			let broadcast = origin.create_broadcast("live").unwrap();
+			let broadcast = origin.route("live", moq_net::origin::RouteOptions::hidden()).unwrap();
 			// A join interval declared up front lists every rendition before any media, so each
 			// is recorded from its first segment.
 			let mut seeded = moq_mux::catalog::hang::Catalog::<()>::default();
@@ -627,7 +627,7 @@ mod tests {
 					let info = moq_net::track::Info::default()
 						.with_timescale(moq_net::Timescale::MILLI)
 						.with_max_age(hang::container::MAX_AGE);
-					let track = broadcast.create_track(*name, info).unwrap();
+					let track = broadcast.broadcast().create_track(*name, info).unwrap();
 					let container = moq_mux::catalog::hang::Container::Legacy(moq_mux::container::Kind::Video);
 					reserved.video(track, container, config_of(320)).unwrap()
 				})
@@ -642,7 +642,7 @@ mod tests {
 		}
 
 		fn broadcaster(&self) -> Broadcaster {
-			let source = moq_mux::Source::new(self.origin.consume(), self.broadcast.consume());
+			let source = moq_mux::Source::new(self.origin.consume(), self.broadcast.broadcast().consume());
 			let (broadcaster, driver) = Broadcaster::new(source, moq_hls::export::Config::default()).unwrap();
 			tokio::spawn(driver.run());
 			broadcaster
diff --git a/rs/moq-cli/src/main.rs b/rs/moq-cli/src/main.rs
index 7e9cd308deb..217378e32f9 100644
--- a/rs/moq-cli/src/main.rs
+++ b/rs/moq-cli/src/main.rs
@@ -779,10 +779,10 @@ fn spawn_import(
 			let name = require_broadcast(name, "import ts --program all")?;
 			Publish::ts_programs(origin.clone(), moq_net::Path::new(&name)?, config)
 		} else {
-			Publish::stdin(origin, &name, &format, config)?
+			Publish::stdin(origin, &name, instance, &format, config)?
 		}
 		.with_linger(linger);
-		publish.announce(instance)?;
+		publish.announce()?;
 		local = Some(publish);
 	} else {
 		match import.source {
@@ -838,9 +838,14 @@ fn spawn_import(
 			#[cfg(feature = "capture")]
 			ImportSource::Capture(capture) => {
 				warn_if_missing_format(&name);
-				let broadcast = origin.create_broadcast(&name).context("failed to create broadcast")?;
-				let mut publish = Publish::capture(broadcast, &capture, bandwidth.clone(), max_age)?;
-				publish.announce(instance)?;
+				let route = origin
+					.route(
+						&name,
+						moq_net::origin::RouteOptions::hidden().with_instance(instance, 0),
+					)
+					.context("failed to create broadcast")?;
+				let mut publish = Publish::capture(route, &capture, bandwidth.clone(), max_age)?;
+				publish.announce()?;
 				local = Some(publish);
 			}
 			_ => unreachable!("container formats are handled by stdin_format above"),
@@ -1264,7 +1269,7 @@ mod tests {
 			connection: moq_tokio::Connection,
 			consumer: moq_net::origin::Consumer,
 			_shutdown: Shutdown,
-			_broadcast: moq_net::origin::Publication,
+			_broadcast: moq_net::origin::Route,
 			_track: moq_net::track::Producer,
 		}
 
@@ -1285,10 +1290,12 @@ mod tests {
 				let addr = listener.tcp_local_addr().unwrap();
 				let (cluster, driver) = moq_relay::cluster::Cluster::new(Default::default()).unwrap();
 				tokio::spawn(driver.run());
-				let broadcast = cluster.origin.create_broadcast("probe").unwrap();
-				broadcast.announce(Default::default()).unwrap();
+				let broadcast = cluster
+					.origin
+					.route("probe", moq_net::origin::RouteOptions::default())
+					.unwrap();
 				let info = moq_net::track::Info::default().with_timescale(moq_net::Timescale::MILLI);
-				let track = broadcast.create_track("status", info).unwrap();
+				let track = broadcast.broadcast().create_track("status", info).unwrap();
 				let mut group = track.append_group().unwrap();
 				group
 					.write_frame(moq_net::Timestamp::ZERO, b"admitted".as_ref())
@@ -1485,10 +1492,11 @@ mod tests {
 		tokio::spawn(moq_net::time::run(driver));
 		let _relayed = accepting.await.unwrap();
 
-		let broadcast = publisher.create_broadcast("demo").unwrap();
-		broadcast.announce(Default::default()).unwrap();
+		let broadcast = publisher
+			.route("demo", moq_net::origin::RouteOptions::default())
+			.unwrap();
 		let info = moq_net::track::Info::default().with_timescale(moq_net::Timescale::MILLI);
-		let track = broadcast.create_track("live", info).unwrap();
+		let track = broadcast.broadcast().create_track("live", info).unwrap();
 		let mut group = track.append_group().unwrap();
 		group.write_frame(moq_net::Timestamp::ZERO, b"live".as_ref()).unwrap();
 		group.finish().unwrap();
diff --git a/rs/moq-cli/src/play/media.rs b/rs/moq-cli/src/play/media.rs
index 0f4f8665ce9..461a0381c71 100644
--- a/rs/moq-cli/src/play/media.rs
+++ b/rs/moq-cli/src/play/media.rs
@@ -1487,14 +1487,13 @@ mod tests {
 	async fn disabling_a_live_high_rendition_plays_the_lower_one() {
 		tokio::time::pause();
 		let origin = moq_tokio::origin::spawn();
-		let broadcast = origin.create_broadcast("room").unwrap();
-		broadcast.announce(Default::default()).unwrap();
+		let broadcast = origin.route("room", moq_net::origin::RouteOptions::default()).unwrap();
 		let mut catalog = catalog::Producer::new(&mut broadcast.broadcast().clone(), Default::default()).unwrap();
-		let mut high = rendition(&broadcast, &catalog, "high");
+		let mut high = rendition(broadcast.broadcast(), &catalog, "high");
 		let recorder = Recorder::default();
 		let player = tokio::spawn(media(&origin, Duration::from_millis(50), recorder.clone()).run());
 		write(&mut high, 10, 0.25).await;
-		let mut low = rendition(&broadcast, &catalog, "low");
+		let mut low = rendition(broadcast.broadcast(), &catalog, "low");
 		catalog
 			.mutate(|catalog| {
 				let high = catalog.audio.renditions.get_mut("high").unwrap();
@@ -1533,8 +1532,7 @@ mod tests {
 		let delay = Duration::from_millis(500);
 
 		let origin = moq_tokio::origin::spawn();
-		let broadcast = origin.create_broadcast("room").unwrap();
-		broadcast.announce(Default::default()).unwrap();
+		let broadcast = origin.route("room", moq_net::origin::RouteOptions::default()).unwrap();
 		let mut catalog = catalog::Producer::new(&mut broadcast.broadcast().clone(), Default::default()).unwrap();
 
 		let recorder = Recorder::default();
@@ -1544,7 +1542,7 @@ mod tests {
 		// Paced against absolute deadlines: tokio rounds each sleep up to the next
 		// millisecond, which relative sleeps would accumulate into a publisher
 		// falling behind the speaker.
-		let mut old = rendition(&broadcast, &catalog, "old");
+		let mut old = rendition(broadcast.broadcast(), &catalog, "old");
 		let start = Instant::now();
 		let mut index = 0;
 		while index < 50 {
@@ -1554,7 +1552,7 @@ mod tests {
 		}
 
 		// The replacement joins the catalog, then the old track finishes.
-		let mut new = rendition(&broadcast, &catalog, "new");
+		let mut new = rendition(broadcast.broadcast(), &catalog, "new");
 		new.write(packet(index, NEW)).unwrap();
 		index += 1;
 		old.finish().unwrap();
@@ -1598,11 +1596,11 @@ mod tests {
 		let delay = Duration::from_millis(500);
 
 		let origin = moq_tokio::origin::spawn();
-		let broadcast = origin.create_broadcast("room").unwrap();
-		broadcast.announce(Default::default()).unwrap();
+		let broadcast = origin.route("room", moq_net::origin::RouteOptions::default()).unwrap();
 		let mut catalog = catalog::Producer::new(&mut broadcast.broadcast().clone(), Default::default()).unwrap();
 		let track = |name: &str| {
 			let track = broadcast
+				.broadcast()
 				.create_track(name, hang::container::track_info(hang::catalog::PRIORITY.audio))
 				.unwrap();
 			moq_mux::container::Producer::new(track, Container::Legacy(moq_mux::container::Kind::Audio))
@@ -1680,40 +1678,40 @@ mod tests {
 		}
 	}
 
-	/// Publish an audio-only broadcast at `room` under `route`, returning what keeps
+	/// Publish an audio-only broadcast at `room` under a fresh instance, returning what keeps
 	/// it up and its one rendition.
 	fn publish(
 		origin: &moq_net::origin::Producer,
-		route: moq_net::origin::Route,
 	) -> (
-		moq_net::origin::Publication,
+		moq_net::origin::Route,
 		catalog::Producer,
 		moq_mux::container::Producer<Container, AudioConfig>,
 	) {
-		let broadcast = origin.create_broadcast("room").unwrap();
-		let catalog = catalog::Producer::new(&mut broadcast.broadcast().clone(), Default::default()).unwrap();
-		let audio = rendition(&broadcast, &catalog, "audio");
-		broadcast.announce(route).unwrap();
-		(broadcast, catalog, audio)
+		let route = origin.route("room", moq_net::origin::RouteOptions::hidden()).unwrap();
+		let catalog = catalog::Producer::new(&mut route.broadcast().clone(), Default::default()).unwrap();
+		let audio = rendition(route.broadcast(), &catalog, "audio");
+		route.announce().unwrap();
+		(route, catalog, audio)
 	}
 
 	/// Answer the next request through `claim` with one `audio` rendition, under a fresh instance.
 	async fn answer(
-		claim: &moq_net::origin::Requests,
+		claim: &moq_net::origin::Route,
 	) -> (
-		moq_net::origin::Publication,
+		moq_net::origin::Route,
 		catalog::Producer,
 		moq_mux::container::Producer<Container, AudioConfig>,
 	) {
-		let request = kio::clock::timeout(Duration::from_secs(5), claim.requested_broadcast())
+		let request = kio::clock::timeout(Duration::from_secs(5), claim.requested())
 			.await
 			.expect("the claim is asked")
 			.unwrap();
-		let prepared = request.prepare().unwrap();
-		let mut broadcast = prepared.broadcast().clone();
+		let route = request.route(moq_net::origin::RouteOptions::hidden()).unwrap();
+		let mut broadcast = route.broadcast().clone();
 		let catalog = catalog::Producer::new(&mut broadcast, Default::default()).unwrap();
 		let audio = rendition(&broadcast, &catalog, "audio");
-		(prepared.publish().unwrap(), catalog, audio)
+		route.announce().unwrap();
+		(route, catalog, audio)
 	}
 
 	/// Write `count` packets of `sample` in real time, its timeline starting at 0.
@@ -1758,12 +1756,12 @@ mod tests {
 		const OLD: f32 = 0.25;
 		const NEW: f32 = 0.5;
 		let origin = moq_tokio::origin::spawn();
-		let (_old_broadcast, _old_catalog, mut old) = publish(&origin, Default::default());
+		let (_old_broadcast, _old_catalog, mut old) = publish(&origin);
 		let recorder = Recorder::default();
 		let player = tokio::spawn(media(&origin, Duration::from_millis(50), recorder.clone()).run());
 		write(&mut old, 10, OLD).await;
 
-		let (_new_broadcast, _new_catalog, mut new) = publish(&origin, Default::default());
+		let (_new_broadcast, _new_catalog, mut new) = publish(&origin);
 		write(&mut new, 10, NEW).await;
 
 		settle(player, &recorder).await;
@@ -1784,10 +1782,12 @@ mod tests {
 	#[tokio::test(start_paused = true)]
 	async fn a_refused_broadcast_ends_the_player() {
 		let origin = moq_tokio::origin::spawn();
-		let handler = origin.requests("").unwrap();
+		let handler = origin
+			.route_prefix("", moq_net::origin::RouteOptions::default())
+			.unwrap();
 		let recorder = Recorder::default();
 		let player = tokio::spawn(media(&origin, Duration::from_millis(50), recorder.clone()).run());
-		let request = handler.requested_broadcast().await.unwrap();
+		let request = handler.requested().await.unwrap();
 		request.reject(moq_net::Error::NotFound);
 		kio::clock::timeout(Duration::from_secs(1), player)
 			.await
@@ -1806,12 +1806,12 @@ mod tests {
 		const NEW: f32 = 0.5;
 		let origin = moq_tokio::origin::spawn();
 
-		let (_old_broadcast, _old_catalog, mut old) = publish(&origin, Default::default());
+		let (_old_broadcast, _old_catalog, mut old) = publish(&origin);
 		let recorder = Recorder::default();
 		let player = tokio::spawn(media(&origin, Duration::from_millis(50), recorder.clone()).run());
 		write(&mut old, 10, OLD).await;
 
-		let (_new_broadcast, _new_catalog, mut new) = publish(&origin, Default::default());
+		let (_new_broadcast, _new_catalog, mut new) = publish(&origin);
 		// Give the player the update hold to see the restart, so it joins the new
 		// broadcast at its live edge.
 		kio::clock::sleep(moq_net::origin::Config::default().update_hold).await;
@@ -1840,7 +1840,7 @@ mod tests {
 		const NEW: f32 = 0.5;
 		let origin = moq_tokio::origin::spawn();
 
-		let (old_broadcast, mut old_catalog, mut old) = publish(&origin, Default::default());
+		let (old_broadcast, mut old_catalog, mut old) = publish(&origin);
 		let recorder = Recorder::default();
 		let player = tokio::spawn(media(&origin, Duration::from_millis(50), recorder.clone()).run());
 		write(&mut old, 10, OLD).await;
@@ -1852,7 +1852,7 @@ mod tests {
 		kio::clock::sleep(Duration::from_secs(60)).await;
 		assert!(!player.is_finished(), "the player stopped following the path");
 
-		let (_new_broadcast, _new_catalog, mut new) = publish(&origin, Default::default());
+		let (_new_broadcast, _new_catalog, mut new) = publish(&origin);
 		write(&mut new, 10, NEW).await;
 
 		settle(player, &recorder).await;
@@ -1877,7 +1877,7 @@ mod tests {
 		tokio::time::pause();
 
 		let origin = moq_tokio::origin::spawn();
-		let (_broadcast, mut catalog, mut audio) = publish(&origin, Default::default());
+		let (_broadcast, mut catalog, mut audio) = publish(&origin);
 		let recorder = Recorder::default();
 		let player = tokio::spawn(media(&origin, Duration::from_millis(50), recorder.clone()).run());
 		write(&mut audio, 10, 0.25).await;
@@ -1917,8 +1917,8 @@ mod tests {
 	#[tokio::test]
 	async fn equivalent_references_name_one_track() {
 		let origin = moq_tokio::origin::spawn();
-		let (broadcast, _catalog, _audio) = publish(&origin, Default::default());
-		let source = moq_mux::Source::new(origin.consume(), broadcast.consume());
+		let (broadcast, _catalog, _audio) = publish(&origin);
+		let source = moq_mux::Source::new(origin.consume(), broadcast.broadcast().consume());
 		let mut config = AudioConfig::new(AudioCodec::Pcm, SAMPLE_RATE, 1);
 		let absent = Track::of(&source, &config, "audio");
 		config.broadcast = Some(moq_net::path::Relative::new("").unwrap());
@@ -1935,9 +1935,7 @@ mod tests {
 		const OLD: f32 = 0.25;
 		const NEW: f32 = 0.5;
 		let origin = moq_tokio::origin::spawn();
-		let route = moq_net::origin::Route::default();
-
-		let (exact, mut exact_catalog, mut old) = publish(&origin, route.clone());
+		let (exact, mut exact_catalog, mut old) = publish(&origin);
 		let recorder = Recorder::default();
 		let player = tokio::spawn(media(&origin, Duration::from_millis(50), recorder.clone()).run());
 		write(&mut old, 10, OLD).await;
@@ -1947,7 +1945,9 @@ mod tests {
 		// The broadcast ends while its route stands, so the player goes idle.
 		kio::clock::sleep(Duration::from_secs(60)).await;
 
-		let pool = origin.requests("").unwrap();
+		let pool = origin
+			.route_prefix("", moq_net::origin::RouteOptions::default())
+			.unwrap();
 		drop(exact);
 		let (served, served_catalog, mut new) = answer(&pool).await;
 		write(&mut new, 10, NEW).await;
@@ -1971,10 +1971,8 @@ mod tests {
 		const OLD: f32 = 0.25;
 		const NEW: f32 = 0.5;
 		let origin = moq_tokio::origin::spawn();
-		let route = moq_net::origin::Route::default();
-
 		// One instance, served by the exact route and then answered again behind a covering one.
-		let (exact, exact_catalog, mut old) = publish(&origin, route.clone());
+		let (exact, exact_catalog, mut old) = publish(&origin);
 		let recorder = Recorder::default();
 		let player = tokio::spawn(media(&origin, Duration::from_millis(500), recorder.clone()).run());
 		for index in 0..50 {
@@ -1982,8 +1980,10 @@ mod tests {
 			kio::clock::sleep(PACKET_DURATION).await;
 		}
 
-		exact.unannounce();
-		let pool = origin.requests("").unwrap();
+		exact.withdraw();
+		let pool = origin
+			.route_prefix("", moq_net::origin::RouteOptions::default())
+			.unwrap();
 		let (mirror, mirror_catalog, mut copy) = answer(&pool).await;
 		for index in 50..60 {
 			copy.write(packet(index, NEW)).unwrap();
@@ -2006,14 +2006,12 @@ mod tests {
 
 		const SAMPLE: f32 = 0.25;
 		let origin = moq_tokio::origin::spawn();
-		let route = moq_net::origin::Route::default();
-
-		let (broadcast, _catalog, mut audio) = publish(&origin, route.clone());
+		let (broadcast, _catalog, mut audio) = publish(&origin);
 		let recorder = Recorder::default();
 		let player = tokio::spawn(media(&origin, Duration::from_millis(50), recorder.clone()).run());
 		for index in 0..20 {
 			if index == 10 {
-				broadcast.announce(route.clone().with_cost(5)).unwrap();
+				broadcast.set_cost(5).unwrap();
 			}
 			audio.write(packet(index, SAMPLE)).unwrap();
 			kio::clock::sleep(PACKET_DURATION).await;
@@ -2031,12 +2029,11 @@ mod tests {
 	async fn a_finite_audio_track_plays_its_final_samples() {
 		tokio::time::pause();
 		let origin = moq_tokio::origin::spawn();
-		let broadcast = origin.create_broadcast("room").unwrap();
-		broadcast.announce(Default::default()).unwrap();
+		let broadcast = origin.route("room", moq_net::origin::RouteOptions::default()).unwrap();
 		let mut catalog = catalog::Producer::new(&mut broadcast.broadcast().clone(), Default::default()).unwrap();
 		let recorder = Recorder::default();
 		let player = tokio::spawn(media(&origin, Duration::from_millis(50), recorder.clone()).run());
-		let mut audio = rendition(&broadcast, &catalog, "audio");
+		let mut audio = rendition(broadcast.broadcast(), &catalog, "audio");
 		audio.write(packet(0, 0.25)).unwrap();
 		kio::clock::sleep(PACKET_DURATION).await;
 		audio.finish().unwrap();
@@ -2057,7 +2054,7 @@ mod tests {
 		const BLOCK: u64 = 1024;
 		const COUNT: u64 = 100;
 		let origin = moq_tokio::origin::spawn();
-		let (_broadcast, _catalog, mut audio) = publish(&origin, Default::default());
+		let (_broadcast, _catalog, mut audio) = publish(&origin);
 		let recorder = Recorder::default();
 		let player = tokio::spawn(media(&origin, Duration::from_millis(50), recorder.clone()).run());
 		let start = Instant::now();
@@ -2081,8 +2078,9 @@ mod tests {
 		tokio::time::pause();
 		let delay = Duration::from_secs(2);
 		let origin = moq_tokio::origin::spawn();
-		let broadcast = origin.create_broadcast("room").unwrap();
+		let broadcast = origin.route("room", moq_net::origin::RouteOptions::hidden()).unwrap();
 		let track = broadcast
+			.broadcast()
 			.create_track("video", hang::container::track_info(hang::catalog::PRIORITY.video))
 			.unwrap();
 		let mut producer = moq_mux::container::Producer::new(track, Container::Legacy(moq_mux::container::Kind::Data));
@@ -2116,6 +2114,7 @@ mod tests {
 		options.delay.max = Some(delay);
 		let decoder = moq_video::decode::Sink::open(&catalog, &options.decoder).await.unwrap();
 		let subscriber = broadcast
+			.broadcast()
 			.consume()
 			.track("video")
 			.unwrap()
diff --git a/rs/moq-cli/src/publish.rs b/rs/moq-cli/src/publish.rs
index 5bf7fc1400d..2f829c44f84 100644
--- a/rs/moq-cli/src/publish.rs
+++ b/rs/moq-cli/src/publish.rs
@@ -343,11 +343,12 @@ enum Source {
 pub struct Publish {
 	source: Source,
 	// Keeps the fill surface until finish. `None` for `import ts --program all`,
-	// whose programs each own their fill and publication control.
+	// whose programs each own their fill and route.
 	broadcast: Option<moq_net::broadcast::Producer>,
-	publication: Option<moq_net::origin::Publication>,
-	// A stdin import's route, announced once its catalog lists the tracks; see [`Self::announce`].
+	// The route announcing `broadcast`, held while it is up. Created hidden.
 	route: Option<moq_net::origin::Route>,
+	// Whether a stdin import announces once its catalog lists the tracks; see [`Self::announce`].
+	announce: bool,
 	// The `--report` track, written beside the decode loop; see [`Self::with_report`].
 	report: Option<crate::report::Stats>,
 	// How long a stdin import keeps its broadcast up after EOF; see [`Self::with_linger`].
@@ -363,19 +364,14 @@ pub struct Publish {
 /// announced, so a standby
 /// announced any sooner can receive requests for tracks it cannot serve yet.
 struct Pending {
-	broadcast: moq_net::origin::Publication,
-	catalog: moq_net::track::Consumer,
 	route: moq_net::origin::Route,
+	catalog: moq_net::track::Consumer,
 }
 
 impl Pending {
-	fn new(broadcast: moq_net::origin::Publication, route: moq_net::origin::Route) -> anyhow::Result<Self> {
-		let catalog = broadcast.consume().track(hang::Catalog::DEFAULT_NAME)?;
-		Ok(Self {
-			broadcast,
-			catalog,
-			route,
-		})
+	fn new(route: moq_net::origin::Route) -> anyhow::Result<Self> {
+		let catalog = route.broadcast().consume().track(hang::Catalog::DEFAULT_NAME)?;
+		Ok(Self { route, catalog })
 	}
 
 	/// Announce the broadcast if its catalog has gone out, returning whether it has.
@@ -386,9 +382,7 @@ impl Pending {
 		) {
 			return Ok(false);
 		}
-		self.broadcast
-			.announce(self.route.clone())
-			.context("failed to announce broadcast")?;
+		self.route.announce().context("failed to announce broadcast")?;
 		Ok(true)
 	}
 }
@@ -414,8 +408,8 @@ impl Publish {
 					catalog: PublishCatalog::Ts(catalog),
 				},
 				broadcast: Some(broadcast),
-				publication: None,
 				route: None,
+				announce: false,
 				report: None,
 				linger: moq_mux::Linger::DEFAULT,
 				republish: None,
@@ -464,8 +458,8 @@ impl Publish {
 				catalog: PublishCatalog::Media(catalog),
 			},
 			broadcast: Some(broadcast),
-			publication: None,
 			route: None,
+			announce: false,
 			report: None,
 			linger: moq_mux::Linger::DEFAULT,
 			republish: None,
@@ -473,7 +467,7 @@ impl Publish {
 	}
 
 	/// Build a publisher decoding `format` from stdin into a new broadcast at `name` on
-	/// `origin`, retaining its announcement control alongside the decoder's fill handle.
+	/// `origin` under `instance`, retaining its route alongside the decoder's fill handle.
 	///
 	/// A TS import whose source changes ([`ts::Restart`]), such as a changeover between two
 	/// encoders whose clocks were never locked or whose PATs name another program, finishes the broadcast
@@ -481,10 +475,13 @@ impl Publish {
 	pub(super) fn stdin(
 		origin: &moq_net::origin::Producer,
 		name: &str,
+		instance: moq_net::Instance,
 		format: &PublishFormat,
 		config: moq_mux::catalog::Config,
 	) -> anyhow::Result<Self> {
-		let publication = origin.create_broadcast(name).context("failed to create broadcast")?;
+		let route = origin
+			.route(name, moq_net::origin::RouteOptions::hidden().with_instance(instance, 0))
+			.context("failed to create broadcast")?;
 		let republish = match *format {
 			PublishFormat::Ts { program } => Some(Republish {
 				origin: origin.clone(),
@@ -496,8 +493,8 @@ impl Publish {
 			}),
 			_ => None,
 		};
-		let mut result = Self::new(publication.broadcast().clone(), format, config)?;
-		result.publication = Some(publication);
+		let mut result = Self::new(route.broadcast().clone(), format, config)?;
+		result.route = Some(route);
 		result.republish = republish;
 		Ok(result)
 	}
@@ -519,8 +516,8 @@ impl Publish {
 				catalog: PublishCatalog::TsPrograms,
 			},
 			broadcast: None,
-			publication: None,
 			route: None,
+			announce: false,
 			report: None,
 			linger: moq_mux::Linger::DEFAULT,
 			republish: None,
@@ -538,12 +535,12 @@ impl Publish {
 	/// left after audio's reservation rather than the whole uplink.
 	#[cfg(feature = "capture")]
 	pub fn capture(
-		publication: moq_net::origin::Publication,
+		route: moq_net::origin::Route,
 		args: &CaptureArgs,
 		bandwidth: moq_net::bandwidth::Allocator,
 		max_age: Option<std::time::Duration>,
 	) -> anyhow::Result<Self> {
-		let mut broadcast = publication.broadcast().clone();
+		let mut broadcast = route.broadcast().clone();
 		let config = moq_mux::catalog::Config::default().with_max_age(max_age);
 		let catalog = moq_mux::catalog::Producer::new(&mut broadcast, config)?;
 
@@ -564,8 +561,8 @@ impl Publish {
 				audio,
 			},
 			broadcast: Some(broadcast),
-			publication: Some(publication),
-			route: None,
+			route: Some(route),
+			announce: false,
 			report: None,
 			linger: moq_mux::Linger::DEFAULT,
 			republish: None,
@@ -627,17 +624,16 @@ impl Publish {
 		self
 	}
 
-	/// Advertise the broadcast's path under `instance`.
+	/// Advertise the broadcast's path.
 	///
 	/// A capture announces now. A stdin import announces from [`run`](Self::run), once the input
 	/// has declared its tracks: see [`Pending`].
-	pub fn announce(&mut self, instance: moq_net::Instance) -> anyhow::Result<()> {
-		let route = moq_net::origin::Route::default().with_instance(instance, 0);
-		match (&self.source, &self.publication) {
+	pub fn announce(&mut self) -> anyhow::Result<()> {
+		match (&self.source, &self.route) {
 			(_, None) => {}
-			(Source::Stream { .. }, Some(_)) => self.route = Some(route),
+			(Source::Stream { .. }, Some(_)) => self.announce = true,
 			#[cfg(feature = "capture")]
-			(Source::Capture { .. }, Some(broadcast)) => broadcast.announce(route).context("failed to announce broadcast")?,
+			(Source::Capture { .. }, Some(route)) => route.announce().context("failed to announce broadcast")?,
 		}
 		Ok(())
 	}
@@ -646,12 +642,12 @@ impl Publish {
 	pub async fn run(self) -> anyhow::Result<()> {
 		match self.source {
 			Source::Stream { decoder, catalog } => {
-				let pending = match (&self.publication, self.route) {
-					(Some(broadcast), Some(route)) => Some(Pending::new(broadcast.clone(), route)?),
+				let pending = match (&self.route, self.announce) {
+					(Some(route), true) => Some(Pending::new(route.clone())?),
 					_ => None,
 				};
 				let publication = Publication {
-					control: self.publication,
+					control: self.route,
 					broadcast: self.broadcast,
 					pending,
 					report: self.report,
@@ -735,8 +731,8 @@ impl Publish {
 /// What a stdin import does around its media: announce, report, and retain the end.
 #[derive(Default)]
 struct Publication {
-	/// The announcement control, held while the broadcast is up so its path stays announced.
-	control: Option<moq_net::origin::Publication>,
+	/// The route, held while the broadcast is up so its path stays announced.
+	control: Option<moq_net::origin::Route>,
 	/// The broadcast to keep up after EOF, or `None` when the decoder owns its broadcasts.
 	broadcast: Option<moq_net::broadcast::Producer>,
 	/// The announcement held until the catalog first goes out.
@@ -770,7 +766,7 @@ impl Republish {
 	fn instance(&self, mux_rate: Option<u64>) -> anyhow::Result<Instance> {
 		let control = self
 			.origin
-			.create_broadcast(&self.name)
+			.route(&self.name, moq_net::origin::RouteOptions::hidden())
 			.context("failed to create broadcast")?;
 		let mut broadcast = control.broadcast().clone();
 		let (import, mut catalog) = ts_import(&mut broadcast, self.config.clone(), self.program, mux_rate)?;
@@ -782,12 +778,8 @@ impl Republish {
 		if let Some(echo) = &self.echo {
 			catalog.mutate(|catalog| catalog.echo = Some(echo.clone()))?;
 		}
-		let instance = moq_net::Instance::random();
-		tracing::info!(%instance, "publisher instance");
-		let pending = Pending::new(
-			control.clone(),
-			moq_net::origin::Route::default().with_instance(instance, 0),
-		)?;
+		tracing::info!(instance = %control.instance(), "publisher instance");
+		let pending = Pending::new(control.clone())?;
 		Ok(Instance {
 			decoder: PublishDecoder::Ts(Box::new(import)),
 			catalog: PublishCatalog::Ts(catalog),
@@ -804,7 +796,7 @@ impl Republish {
 struct Instance {
 	decoder: PublishDecoder,
 	catalog: PublishCatalog,
-	control: Option<moq_net::origin::Publication>,
+	control: Option<moq_net::origin::Route>,
 	broadcast: Option<moq_net::broadcast::Producer>,
 	pending: Option<Pending>,
 	report: Option<crate::report::Stats>,
@@ -1368,8 +1360,7 @@ pub(crate) mod tests {
 	async fn manufacture_input() -> Vec<u8> {
 		// Create the broadcast on a throwaway origin so the exporter can resolve it by path.
 		let origin = moq_tokio::origin::spawn();
-		let broadcast = origin.create_broadcast("cli").unwrap();
-		broadcast.announce(Default::default()).unwrap();
+		let broadcast = origin.route("cli", moq_net::origin::RouteOptions::default()).unwrap();
 		settle().await;
 		let config = moq_mux::catalog::Config::default().with_catalog(Catalog::<tscat::Ext>::default());
 		let mut catalog = moq_mux::catalog::Producer::new(&mut broadcast.broadcast().clone(), config).unwrap();
@@ -1379,6 +1370,7 @@ pub(crate) mod tests {
 
 		// Section-framed verbatim stream (SCTE-35, stream_type 0x86).
 		let section = broadcast
+			.broadcast()
 			.unique_track(".scte35", hang::container::track_info(hang::catalog::PRIORITY.text))
 			.unwrap();
 		let mut section_track = tscat::Track::new(SECTION_PID);
@@ -1407,6 +1399,7 @@ pub(crate) mod tests {
 
 		// Whole-PES stream (undecoded private data, stream_type 0x06).
 		let pes = broadcast
+			.broadcast()
 			.unique_track(".data", hang::container::track_info(hang::catalog::PRIORITY.text))
 			.unwrap();
 		let mut pes_track = tscat::Track::new(PES_PID);
@@ -1481,14 +1474,15 @@ pub(crate) mod tests {
 		// streams land in the broadcast instead of being dropped by the media-only path.
 		// The broadcast is created on a throwaway origin so the exporter can resolve it by path.
 		let origin = moq_tokio::origin::spawn();
-		let mut publish =
-			Publish::stdin(&origin, "cli", &PublishFormat::Ts { program: None }, Default::default()).unwrap();
-		publish
-			.publication
-			.as_ref()
-			.unwrap()
-			.announce(Default::default())
-			.unwrap();
+		let mut publish = Publish::stdin(
+			&origin,
+			"cli",
+			moq_net::Instance::random(),
+			&PublishFormat::Ts { program: None },
+			Default::default(),
+		)
+		.unwrap();
+		publish.route.as_ref().unwrap().announce().unwrap();
 		settle().await;
 		#[cfg_attr(
 			not(feature = "capture"),
@@ -1685,16 +1679,12 @@ pub(crate) mod tests {
 			let mut publish = Publish::stdin(
 				&origin,
 				"pt.hang",
+				moq_net::Instance::random(),
 				&PublishFormat::TsPassthrough { pcr_pid: None },
 				Default::default(),
 			)
 			.unwrap();
-			publish
-				.publication
-				.as_ref()
-				.unwrap()
-				.announce(Default::default())
-				.unwrap();
+			publish.route.as_ref().unwrap().announce().unwrap();
 			#[cfg_attr(
 				not(feature = "capture"),
 				expect(
@@ -2142,8 +2132,15 @@ pub(crate) mod tests {
 			let origin = moq_tokio::origin::spawn();
 			let consumer = origin.consume();
 			let mut announced = consumer.announced();
-			let publish = Publish::stdin(&origin, "demo", &format, Default::default()).unwrap();
-			let broadcast = publish.publication.clone().unwrap();
+			let publish = Publish::stdin(
+				&origin,
+				"demo",
+				moq_net::Instance::random(),
+				&format,
+				Default::default(),
+			)
+			.unwrap();
+			let broadcast = publish.route.clone().unwrap();
 			#[cfg_attr(
 				not(feature = "capture"),
 				expect(
@@ -2154,8 +2151,7 @@ pub(crate) mod tests {
 			let Source::Stream { decoder, catalog } = publish.source else {
 				panic!("expected a stream source");
 			};
-			let route = moq_net::origin::Route::default();
-			let pending = Pending::new(broadcast, route).unwrap();
+			let pending = Pending::new(broadcast).unwrap();
 			let (mut stdin, input_end) = tokio::io::duplex(input.len());
 			let publication = Publication {
 				pending: Some(pending),
@@ -2255,9 +2251,11 @@ pub(crate) mod tests {
 
 		let origin = moq_tokio::origin::spawn();
 		let mut announced = origin.consume().announced();
-		let mut publish = Publish::stdin(
+		let first = moq_net::Instance::random();
+		let publish = Publish::stdin(
 			&origin,
 			"demo",
+			first.clone(),
 			&PublishFormat::Ts { program: None },
 			Default::default(),
 		)
@@ -2266,8 +2264,6 @@ pub(crate) mod tests {
 			moq_net::path::Relative::new("viewer").unwrap(),
 		))
 		.unwrap();
-		let first = moq_net::Instance::random();
-		publish.announce(first.clone()).unwrap();
 		#[cfg_attr(
 			not(feature = "capture"),
 			expect(
@@ -2278,9 +2274,9 @@ pub(crate) mod tests {
 		let Source::Stream { decoder, catalog } = publish.source else {
 			panic!("expected a stream source");
 		};
-		let control = publish.publication.unwrap();
+		let control = publish.route.unwrap();
 		let publication = Publication {
-			pending: Some(Pending::new(control.clone(), publish.route.unwrap()).unwrap()),
+			pending: Some(Pending::new(control.clone()).unwrap()),
 			control: Some(control),
 			broadcast: publish.broadcast,
 			republish: publish.republish,
@@ -2298,7 +2294,7 @@ pub(crate) mod tests {
 					loop {
 						use moq_net::announce::Event;
 						if let Event::Present(announce) = announced.next().await.unwrap() {
-							break announce.route.instance.unwrap();
+							break announce.route.instance().clone();
 						}
 					}
 				} => instance,
@@ -2351,14 +2347,14 @@ pub(crate) mod tests {
 
 		const CLIP: &[u8] = include_bytes!("../../moq-mux/src/container/ts/test_data/bbb5s_cbr.ts");
 		let origin = moq_tokio::origin::spawn();
-		let mut publish = Publish::stdin(
+		let publish = Publish::stdin(
 			&origin,
 			"demo",
+			moq_net::Instance::random(),
 			&PublishFormat::Ts { program: None },
 			Default::default(),
 		)
 		.unwrap();
-		publish.announce(moq_net::Instance::random()).unwrap();
 		#[cfg_attr(
 			not(feature = "capture"),
 			expect(irrefutable_let_patterns, reason = "capture is disabled")
@@ -2366,11 +2362,11 @@ pub(crate) mod tests {
 		let Source::Stream { decoder, catalog } = publish.source else {
 			panic!("a stream source");
 		};
-		let control = publish.publication.unwrap();
+		let control = publish.route.unwrap();
 		let mut instance = Instance {
 			decoder,
 			catalog,
-			pending: Some(Pending::new(control.clone(), publish.route.unwrap()).unwrap()),
+			pending: Some(Pending::new(control.clone()).unwrap()),
 			control: Some(control),
 			broadcast: publish.broadcast,
 			report: None,
@@ -2480,8 +2476,15 @@ pub(crate) mod tests {
 		] {
 			let origin = moq_tokio::origin::spawn();
 			let mut announced = origin.consume().announced();
-			let publish = Publish::stdin(&origin, "demo", &format, Default::default()).unwrap();
-			let broadcast = publish.publication.clone().unwrap();
+			let publish = Publish::stdin(
+				&origin,
+				"demo",
+				moq_net::Instance::random(),
+				&format,
+				Default::default(),
+			)
+			.unwrap();
+			let broadcast = publish.route.clone().unwrap();
 			#[cfg_attr(
 				not(feature = "capture"),
 				expect(
@@ -2492,7 +2495,7 @@ pub(crate) mod tests {
 			let Source::Stream { decoder, catalog } = publish.source else {
 				panic!("expected a stream source");
 			};
-			let pending = Pending::new(broadcast, Default::default()).unwrap();
+			let pending = Pending::new(broadcast).unwrap();
 			let publication = Publication {
 				pending: Some(pending),
 				..Default::default()
diff --git a/rs/moq-cli/src/report.rs b/rs/moq-cli/src/report.rs
index 8dab104c54d..4617dc16ebd 100644
--- a/rs/moq-cli/src/report.rs
+++ b/rs/moq-cli/src/report.rs
@@ -254,7 +254,7 @@ pub struct EchoTarget {
 struct Feedback {
 	path: moq_net::Path,
 	// Held for the route: dropping it retracts the announcement.
-	_broadcast: moq_net::origin::Publication,
+	_broadcast: moq_net::origin::Route,
 	tracks: ReportTrack<hang::echo::Snapshot<ts::stats::Report>>,
 }
 
@@ -348,10 +348,13 @@ impl Echo {
 	}
 
 	fn publish(&self, path: &moq_net::Path) -> anyhow::Result<Feedback> {
-		let broadcast = self.target.origin.create_broadcast(path)?;
+		let broadcast = self
+			.target
+			.origin
+			.route(path, moq_net::origin::RouteOptions::hidden())?;
 		let tracks = ReportTrack::create(&mut broadcast.broadcast().clone(), hang::echo::TRACK)?;
 		// A fresh instance, so a reader sees a replaced feedback broadcast as a restart.
-		broadcast.announce(moq_net::origin::Route::default())?;
+		broadcast.announce()?;
 		Ok(Feedback {
 			path: path.clone(),
 			_broadcast: broadcast,
@@ -654,10 +657,12 @@ mod tests {
 	#[tokio::test(start_paused = true)]
 	async fn an_ended_feedback_reader_stops_after_draining() {
 		let origin = moq_tokio::origin::spawn();
-		let broadcast = origin.create_broadcast("viewer.echo").unwrap();
-		let track = broadcast.create_track(hang::echo::TRACK, None).unwrap();
+		let broadcast = origin
+			.route("viewer.echo", moq_net::origin::RouteOptions::hidden())
+			.unwrap();
+		let track = broadcast.broadcast().create_track(hang::echo::TRACK, None).unwrap();
 		let mut feedback = moq_json::snapshot::Producer::<serde_json::Value>::new(track, Default::default());
-		broadcast.announce(Default::default()).unwrap();
+		broadcast.announce().unwrap();
 
 		let (out, read) = tokio::io::duplex(4096);
 		let mut lines = BufReader::new(read).lines();
@@ -667,7 +672,7 @@ mod tests {
 		let line = lines.next_line().await.unwrap().unwrap();
 		assert!(line.contains(r#""n":1"#), "{line}");
 
-		broadcast.unannounce();
+		broadcast.withdraw();
 		kio::clock::sleep(DRAIN * 2).await;
 		feedback.update(&serde_json::json!({ "n": 2 })).unwrap();
 		let late = kio::clock::timeout(Duration::from_secs(1), lines.next_line()).await;
@@ -683,18 +688,22 @@ mod tests {
 		let mut lines = BufReader::new(read).lines();
 		tokio::spawn(write_echo(origin.consume(), String::new(), out));
 
-		let claim = origin.requests("viewer.echo").unwrap();
-		kio::clock::timeout(Duration::from_secs(1), claim.requested_broadcast())
+		let claim = origin
+			.route_prefix("viewer.echo", moq_net::origin::RouteOptions::default())
+			.unwrap();
+		kio::clock::timeout(Duration::from_secs(1), claim.requested())
 			.await
 			.expect("never asked")
 			.expect("the claim closed")
 			.reject(moq_net::Error::NotFound);
 		kio::clock::sleep(Duration::from_secs(1)).await;
 
-		let broadcast = origin.create_broadcast("viewer.echo").unwrap();
-		let track = broadcast.create_track(hang::echo::TRACK, None).unwrap();
+		let route = origin
+			.route("viewer.echo", moq_net::origin::RouteOptions::hidden())
+			.unwrap();
+		let track = route.broadcast().create_track(hang::echo::TRACK, None).unwrap();
 		let mut feedback = moq_json::snapshot::Producer::<serde_json::Value>::new(track, Default::default());
-		broadcast.announce(Default::default()).unwrap();
+		route.announce().unwrap();
 		feedback.update(&serde_json::json!({ "n": 1 })).unwrap();
 		let line = kio::clock::timeout(Duration::from_secs(5), lines.next_line()).await;
 		let line = line.expect("the takeover was never read").unwrap().unwrap();
@@ -725,10 +734,12 @@ mod tests {
 	#[tokio::test(start_paused = true)]
 	async fn a_hidden_prefix_finds_its_feedback() {
 		let origin = moq_tokio::origin::spawn();
-		let broadcast = origin.create_broadcast(".viewers/alice.echo").unwrap();
-		let track = broadcast.create_track(hang::echo::TRACK, None).unwrap();
+		let broadcast = origin
+			.route(".viewers/alice.echo", moq_net::origin::RouteOptions::hidden())
+			.unwrap();
+		let track = broadcast.broadcast().create_track(hang::echo::TRACK, None).unwrap();
 		let mut feedback = moq_json::snapshot::Producer::<serde_json::Value>::new(track, Default::default());
-		broadcast.announce(Default::default()).unwrap();
+		broadcast.announce().unwrap();
 
 		let (out, read) = tokio::io::duplex(4096);
 		let mut lines = BufReader::new(read).lines();
diff --git a/rs/moq-cli/src/report/echo_test.rs b/rs/moq-cli/src/report/echo_test.rs
index 5d803d26135..e17d81c2e72 100644
--- a/rs/moq-cli/src/report/echo_test.rs
+++ b/rs/moq-cli/src/report/echo_test.rs
@@ -16,7 +16,7 @@ struct Feedback {
 async fn export_echo_reports_where_the_import_solicits() {
 	let (expected, _) = written(CLIP);
 	let origin = moq_tokio::origin::spawn();
-	let publication = origin.create_broadcast("demo").unwrap();
+	let publication = origin.route("demo", moq_net::origin::RouteOptions::hidden()).unwrap();
 	let mut broadcast = publication.broadcast().clone();
 	let mut catalog_value = moq_mux::catalog::hang::Catalog::<ts::Ext>::default();
 	catalog_value.echo = Some(hang::catalog::Echo::new(
@@ -28,7 +28,7 @@ async fn export_echo_reports_where_the_import_solicits() {
 	let mut catalog = moq_mux::catalog::Producer::new(&mut broadcast, config).unwrap();
 	let mut import = ts::Import::new(broadcast, catalog.reserve());
 	import.decode(&CLIP[..HALF]).unwrap();
-	publication.announce(Default::default()).unwrap();
+	publication.announce().unwrap();
 	let consumer = origin.consume();
 	let resolved = consumer
 		.follow("demo", None)
diff --git a/rs/moq-cli/src/rtc.rs b/rs/moq-cli/src/rtc.rs
index 27e7055e016..9d5a8a8727b 100644
--- a/rs/moq-cli/src/rtc.rs
+++ b/rs/moq-cli/src/rtc.rs
@@ -92,15 +92,15 @@ fn scope_producer(origin: &moq_net::origin::Producer, name: &str) -> anyhow::Res
 /// announced under `instance`.
 pub async fn connect_import(target: ImportTarget, url: Url, instance: moq_net::Instance) -> anyhow::Result<()> {
 	let name = &target.name;
-	let producer = target
+	// The WHEP pull fills the tracks as they arrive; announce up front so viewers
+	// can discover the broadcast while it connects. Held until the pull ends.
+	let route = target
 		.origin
-		.create_broadcast(name)
+		.route(
+			name,
+			moq_net::origin::RouteOptions::default().with_instance(instance, 0),
+		)
 		.context("failed to create broadcast")?;
-	// The WHEP pull fills the tracks as they arrive; announce up front so viewers
-	// can discover the broadcast while it connects.
-	producer
-		.announce(moq_net::origin::Route::default().with_instance(instance, 0))
-		.context("failed to announce broadcast")?;
 
 	tracing::info!(url = %RedactedUrl::new(&url), %name, "WHEP client pulling");
 	notify_ready();
@@ -109,7 +109,7 @@ pub async fn connect_import(target: ImportTarget, url: Url, instance: moq_net::I
 	config.max_age = target.max_age;
 	config.bandwidth = target.bandwidth;
 	let client = moq_rtc::Client::new(config);
-	client.subscribe(url, producer.broadcast().clone()).await?;
+	client.subscribe(url, route.broadcast().clone()).await?;
 	Ok(())
 }
 
diff --git a/rs/moq-cli/src/rtsp.rs b/rs/moq-cli/src/rtsp.rs
index e738b712d37..5cbbb41d7c8 100644
--- a/rs/moq-cli/src/rtsp.rs
+++ b/rs/moq-cli/src/rtsp.rs
@@ -69,14 +69,15 @@ fn is_fatal(err: &anyhow::Error) -> bool {
 /// Publish one session as one broadcast, announced once its catalog names a track, setting
 /// `published` then.
 async fn run(target: &ImportTarget, client: &moq_rtsp::Client, published: &mut bool) -> anyhow::Result<moq_rtsp::End> {
-	let broadcast = target
+	// Each run is a new route under a fresh instance, so a redial replaces the last run.
+	let route = target
 		.origin
-		.create_broadcast(&target.name)
+		.route(&target.name, moq_net::origin::RouteOptions::hidden())
 		.context("failed to create broadcast")?;
 	let config = moq_mux::catalog::Config::default()
 		.with_max_age(target.max_age)
 		.with_bandwidth(target.bandwidth.clone());
-	let mut catalog = moq_mux::catalog::Producer::new(&mut broadcast.broadcast().clone(), config)?;
+	let mut catalog = moq_mux::catalog::Producer::new(&mut route.broadcast().clone(), config)?;
 
 	// A relay asks for a broadcast's tracks the moment it is announced, so wait for the
 	// first keyframe to put them in the catalog.
@@ -86,17 +87,14 @@ async fn run(target: &ImportTarget, client: &moq_rtsp::Client, published: &mut b
 		if updates.next().await?.is_none() {
 			return std::future::pending().await;
 		}
-		let instance = moq_net::Instance::random();
-		broadcast
-			.announce(moq_net::origin::Route::default().with_instance(instance.clone(), 0))
-			.context("failed to announce broadcast")?;
-		tracing::info!(name = %target.name, %instance, "publishing RTSP broadcast");
+		route.announce().context("failed to announce broadcast")?;
+		tracing::info!(name = %target.name, instance = %route.instance(), "publishing RTSP broadcast");
 		*published = true;
 		std::future::pending::<anyhow::Result<moq_rtsp::End>>().await
 	};
 
 	let end = tokio::select! {
-		end = client.pull(&broadcast, &catalog) => end.map_err(anyhow::Error::from),
+		end = client.pull(route.broadcast(), &catalog) => end.map_err(anyhow::Error::from),
 		err = announce => err,
 	};
 	// Closed at once even after a clean end: the pull redials and publishes the next run under a
@@ -109,7 +107,7 @@ async fn run(target: &ImportTarget, client: &moq_rtsp::Client, published: &mut b
 			Ok(())
 		}
 	};
-	broadcast.close();
+	route.broadcast().close();
 	finished?;
 	end
 }
diff --git a/rs/moq-cli/src/transcode.rs b/rs/moq-cli/src/transcode.rs
index fe499fafb87..acd4adde43b 100644
--- a/rs/moq-cli/src/transcode.rs
+++ b/rs/moq-cli/src/transcode.rs
@@ -176,11 +176,15 @@ impl Following {
 					Some(source) => {
 						// Dropping the old ladder cancels its pending requests and rung tasks.
 						drop(running.take());
-						let output = self.publish.create_broadcast(&self.output_path)?;
+						let output = self.publish.route(&self.output_path, moq_net::origin::RouteOptions::hidden())?;
 						let transcoder = moq_transcode::Transcoder::new(source, output.broadcast().clone(), self.config.clone())?;
-						output.announce(moq_net::origin::Route::default())?;
+						output.announce()?;
 						tracing::info!(source = %self.source_path, output = %self.output_path, "transcoding");
-						running = Some(Box::pin(transcoder.run()));
+						// The ladder holds its route, so the output stays announced while it runs.
+						running = Some(Box::pin(async move {
+							let _output = output;
+							transcoder.run().await
+						}));
 					}
 					None => tracing::info!(source = %self.source_path, "offline, waiting for it to return"),
 				},
@@ -216,21 +220,21 @@ mod tests {
 		restart(false).await;
 	}
 
-	/// `named` announces each source under an instance the route names, rather than the one its
-	/// handle mints.
+	/// `named` announces each source under an instance its options name, rather than the one
+	/// its route mints.
 	async fn restart(named: bool) {
 		let origin = moq_tokio::origin::spawn();
 		let publish = moq_tokio::origin::spawn();
-		let route = || {
-			let route = moq_net::origin::Route::default();
+		let options = || {
+			let options = moq_net::origin::RouteOptions::default();
 			if named {
-				route.with_instance(moq_net::Instance::random(), 0)
+				options.with_instance(moq_net::Instance::random(), 0)
 			} else {
-				route
+				options
 			}
 		};
-		let old = origin.publish("source", route()).unwrap();
-		let _old_dynamic = old.requests();
+		let old = origin.route("source", options()).unwrap();
+		let _old_dynamic = old.broadcast().requests();
 		let mut derivatives = publish.consume().follow("derived", None).unwrap();
 		let following = Following {
 			origin: origin.consume(),
@@ -247,8 +251,8 @@ mod tests {
 			.subscribe(None)
 			.await
 			.unwrap();
-		let new = origin.publish("source", route()).unwrap();
-		let _new_dynamic = new.requests();
+		let new = origin.route("source", options()).unwrap();
+		let _new_dynamic = new.broadcast().requests();
 		let second = next(&mut derivatives).await;
 		assert!(!first.is_clone(&second));
 		assert_ne!(first.info().instance, second.info().instance);
@@ -262,7 +266,7 @@ mod tests {
 		}
 		assert!(!second.is_closed(), "the new ladder serves immediately");
 		assert!(
-			!old.consume().is_closed(),
+			!old.broadcast().consume().is_closed(),
 			"replacement does not close the source publisher"
 		);
 		task.abort();
@@ -275,8 +279,9 @@ mod tests {
 	async fn a_source_ending_before_its_video_waits_for_the_next_instance() {
 		let origin = moq_tokio::origin::spawn();
 		let publish = moq_tokio::origin::spawn();
-		let route = || moq_net::origin::Route::default();
-		let old = origin.publish("source", route()).unwrap();
+		let old = origin
+			.route("source", moq_net::origin::RouteOptions::default())
+			.unwrap();
 		let mut catalog = moq_mux::catalog::Producer::new(&mut old.broadcast().clone(), Default::default()).unwrap();
 		let mut derivatives = publish.consume().follow("derived", None).unwrap();
 		let following = Following {
@@ -295,8 +300,10 @@ mod tests {
 			.expect("the ladder outlived its source's end");
 		assert!(!task.is_finished(), "a clean end stopped following");
 
-		let new = origin.publish("source", route()).unwrap();
-		let _new_dynamic = new.requests();
+		let new = origin
+			.route("source", moq_net::origin::RouteOptions::default())
+			.unwrap();
+		let _new_dynamic = new.broadcast().requests();
 		let second = next(&mut derivatives).await;
 		assert!(!first.is_clone(&second));
 		task.abort();
diff --git a/rs/moq-cli/tests/integration/export.rs b/rs/moq-cli/tests/integration/export.rs
index 11c68fd2e5e..0181e48630c 100644
--- a/rs/moq-cli/tests/integration/export.rs
+++ b/rs/moq-cli/tests/integration/export.rs
@@ -520,18 +520,16 @@ async fn a_restarted_publisher_is_a_program_switch_with_stitch() {
 #[ignore = "real-time process test: just rs cli-export"]
 async fn the_same_instance_within_the_follow_continues() {
 	let relay = relay().await;
-	let instance = moq_net::Instance::random();
 	let lite07 = ["--connect-version", LITE_07];
 	let origin = moq_tokio::origin::spawn();
-	let broadcast = origin.create_broadcast("demo").unwrap();
+	let broadcast = origin.route("demo", moq_net::origin::RouteOptions::hidden()).unwrap();
+	let instance = broadcast.instance();
 	let config = moq_mux::catalog::Config::default()
 		.with_max_age(Some(Duration::from_secs(1)))
 		.with_catalog(moq_mux::catalog::hang::Catalog::<ts::Ext>::default());
 	let mut catalog = moq_mux::catalog::Producer::new(&mut broadcast.broadcast().clone(), config).unwrap();
 	let mut import = ts::Import::new(broadcast.broadcast().clone(), catalog.reserve());
-	broadcast
-		.announce(moq_net::origin::Route::default().with_instance(instance.clone(), 0))
-		.unwrap();
+	broadcast.announce().unwrap();
 	let mut config = moq_tokio::connect::Config::default();
 	config.tls.insecure = Some(true);
 	config.version = vec![LITE_07.parse().unwrap()];
@@ -1069,10 +1067,7 @@ async fn next_instance(announced: &mut moq_net::origin::Routes) -> moq_net::Inst
 				moq_net::origin::RouteEvent::Start(announce)
 				| moq_net::origin::RouteEvent::Restart(announce)
 				| moq_net::origin::RouteEvent::Takeover { announce, .. } => {
-					return announce
-						.route
-						.instance
-						.expect("a lite-07 importer announces its instance");
+					return announce.route.instance().clone();
 				}
 				_ => continue,
 			}
diff --git a/rs/moq-cli/tests/integration/instances.rs b/rs/moq-cli/tests/integration/instances.rs
index 2e38197c738..90c15ddb30e 100644
--- a/rs/moq-cli/tests/integration/instances.rs
+++ b/rs/moq-cli/tests/integration/instances.rs
@@ -65,17 +65,18 @@ async fn read(subscription: &mut track::Subscriber) -> String {
 
 struct Published {
 	catalog: moq_mux::catalog::Producer,
-	_catalog_broadcast: origin::Publication,
-	sibling: origin::Publication,
+	_catalog_broadcast: origin::Route,
+	sibling: origin::Route,
 	media: track::Producer,
 }
 
 fn publish(origin: &origin::Producer, instance: &Instance, tag: &str) -> Published {
-	let route = origin::Route::default().with_instance(instance.clone(), 0);
-	let broadcast = origin.publish("live/catalog.hang", route.clone()).unwrap();
-	let sibling = origin.publish("live/media", route).unwrap();
+	let options = || origin::RouteOptions::default().with_instance(instance.clone(), 0);
+	let broadcast = origin.route("live/catalog.hang", options()).unwrap();
+	let sibling = origin.route("live/media", options()).unwrap();
 	// Media's max age, so its superseded groups stay fetchable.
 	let media = sibling
+		.broadcast()
 		.create_track(
 			"audio",
 			track::Info::default()
@@ -185,6 +186,7 @@ async fn replacement(version: &str) {
 	write(&second.media, "B:2");
 	let _late = second
 		.sibling
+		.broadcast()
 		.create_track("late", track::Info::default().with_priority(17))
 		.unwrap();
 	let catalog_restart = changed(&mut catalog_follow).await;
diff --git a/rs/moq-cli/tests/integration/listen.rs b/rs/moq-cli/tests/integration/listen.rs
index a20343a7a87..a05e0d78ae4 100644
--- a/rs/moq-cli/tests/integration/listen.rs
+++ b/rs/moq-cli/tests/integration/listen.rs
@@ -147,9 +147,11 @@ async fn an_export_stage_ending_during_drain_waits_for_every_session() {
 	let listening = listen("export", &["--drain-timeout", "3s"]).await;
 	moq_tokio::crypto::install_default().unwrap();
 	let origin = moq_tokio::origin::spawn();
-	let source = origin.create_broadcast("demo.hang").unwrap();
-	let catalog = source.create_track("catalog.json", None).unwrap();
-	source.announce(Default::default()).unwrap();
+	let source = origin
+		.route("demo.hang", moq_net::origin::RouteOptions::hidden())
+		.unwrap();
+	let catalog = source.broadcast().create_track("catalog.json", None).unwrap();
+	source.announce().unwrap();
 	let publisher = moq_tokio::connect::Config::default()
 		.init(Default::default())
 		.unwrap()
diff --git a/rs/moq-crypto/MIGRATE.md b/rs/moq-crypto/MIGRATE.md
index d16eb693e71..29cac30e93f 100644
--- a/rs/moq-crypto/MIGRATE.md
+++ b/rs/moq-crypto/MIGRATE.md
@@ -60,7 +60,7 @@ A track served on demand is reserved up front with `broadcast::Producer::reserve
 
 The protected path is the opaque broadcast path; the publisher epoch is read from the route's instance instead of a path suffix.
 On wires that do not carry an instance, the session mints one, so the application supplies the epoch.
-Drop `join_epoch` and `split_epoch`: announce the generation's `moq_crypto::e2ee::Epoch` as the route's instance with `Route::default().with_instance(generation.epoch().instance(), 0)`, and read it back from the resolved broadcast with `moq_crypto::e2ee::Epoch::of(&broadcast)`.
+Drop `join_epoch` and `split_epoch`: create the broadcast's route under the generation's `moq_crypto::e2ee::Epoch` as its instance, with `RouteOptions::hidden().with_instance(generation.epoch().instance(), 0)`, and read it back from the resolved broadcast with `moq_crypto::e2ee::Epoch::of(&broadcast)`.
 
 ### Timestamps are optional
 
diff --git a/rs/moq-crypto/README.md b/rs/moq-crypto/README.md
index 983db7842fb..a62659ee8fd 100644
--- a/rs/moq-crypto/README.md
+++ b/rs/moq-crypto/README.md
@@ -48,17 +48,17 @@ An endpoint's `SecretKey` signs; its `PublicKey` is the endpoint ID, displayed a
 characters (a DNS label). `SecretKey::load_or_generate(path)` keeps one key for the life of a host,
 as 52 z-base-32 characters in a `0600` file it never replaces implicitly.
 
-`broadcast::Producer` wraps the `moq-net` broadcast, mints a fresh instance, and signs each frame
-over the application path, instance, track, group, frame index, and timestamp (at the track's
-timescale). Announce the broadcast with that instance on its route:
+`broadcast::Producer` wraps the `moq-net` broadcast and signs each frame over the application
+path, instance, track, group, frame index, and timestamp (at the track's timescale). It signs under
+the instance of the route that serves the broadcast, which the route mints fresh:
 
 ```rust
 let key = SecretKey::load_or_generate("/var/lib/moq/endpoint.key")?;
 let path = moq_net::Path::new(&format!("mesh/{}/agent", key.public()))?;
-let publication = origin.create_broadcast(&path)?;
-let signed = broadcast::Producer::new(publication.broadcast().clone(), key, path);
+let route = origin.route(&path, RouteOptions::hidden())?;
+let signed = broadcast::Producer::new(route.broadcast().clone(), key, path, route.instance());
 let messages = signed.create_track("messages", None)?;
-publication.announce(Route::default().with_instance(signed.instance().clone(), 0))?;
+route.announce()?;
 ```
 
 A subscriber wraps the broadcast an origin resolved in a `broadcast::Consumer` with the key it
@@ -100,10 +100,12 @@ learns only its length rounded up to 16 bytes. A track served on demand is reser
 ```rust
 let credential = Credential::new(credential::Config { context, kid, secret })?;
 let generation = credential.produce();
-let publication = origin.create_broadcast(&credential.path("meeting.hang")?)?;
-let protected = broadcast::Producer::new(publication.broadcast().clone(), generation.clone());
+// The route serves the generation's epoch as its instance, so subscribers find the key.
+let options = RouteOptions::hidden().with_instance(generation.epoch().instance(), 0);
+let route = origin.route(&credential.path("meeting.hang")?, options)?;
+let protected = broadcast::Producer::new(route.broadcast().clone(), generation.clone());
 let video = protected.create_track("video", None)?;
-publication.announce(Route::default().with_instance(generation.epoch().instance(), 0))?;
+route.announce()?;
 ```
 
 A subscriber follows `credential.path(semantic)` with `origin.follow(path, None)`. It takes
diff --git a/rs/moq-crypto/benches/sign.rs b/rs/moq-crypto/benches/sign.rs
index f05dac9fe24..63c90ad2ecb 100644
--- a/rs/moq-crypto/benches/sign.rs
+++ b/rs/moq-crypto/benches/sign.rs
@@ -14,7 +14,7 @@ fn produce(key: &SecretKey) -> (moq_crypto::sign::track::Producer, moq_net::broa
 	let info = moq_net::track::Info::default().with_max_age(Duration::ZERO);
 	let inner = moq_net::broadcast::Info::new().produce();
 	let path = moq_net::Path::new("bench").unwrap();
-	let track = broadcast::Producer::new(inner.clone(), key.clone(), path)
+	let track = broadcast::Producer::new(inner.clone(), key.clone(), path, moq_net::Instance::random())
 		.create_track("stream", info)
 		.unwrap();
 	(track, inner)
@@ -26,24 +26,22 @@ async fn roundtrip(
 ) -> (
 	moq_crypto::sign::track::Producer,
 	moq_crypto::sign::track::Consumer,
-	moq_net::origin::Publication,
+	moq_net::origin::Route,
 ) {
 	let (origin, driver) = moq_net::origin::Producer::new(moq_net::origin::Config::default());
 	tokio::spawn(moq_net::time::run(driver));
 	let path = moq_net::Path::new("bench").unwrap();
-	let publication = origin.create_broadcast(&path).unwrap();
-	let signed = broadcast::Producer::new(publication.broadcast().clone(), key.clone(), path.clone());
+	let route = origin.route(&path, moq_net::origin::RouteOptions::hidden()).unwrap();
+	let signed = broadcast::Producer::new(route.broadcast().clone(), key.clone(), path.clone(), route.instance());
 	let info = moq_net::track::Info::default().with_max_age(Duration::ZERO);
 	let track = signed.create_track("stream", info).unwrap();
-	publication
-		.announce(moq_net::origin::Route::default().with_instance(signed.instance().clone(), 0))
-		.unwrap();
+	route.announce().unwrap();
 	let inner = origin.consume().request(&path, None).await.unwrap();
 	let consumer = broadcast::Consumer::new(inner, key.public(), path).unwrap();
 	let subscription = moq_net::track::Subscription::default()
 		.with_delay(moq_net::track::Delay::default().with_max(Duration::from_secs(60)));
 	let consumer = consumer.subscribe("stream", subscription).unwrap().await.unwrap();
-	(track, consumer, publication)
+	(track, consumer, route)
 }
 
 fn bench_sign(c: &mut Criterion) {
diff --git a/rs/moq-crypto/src/sign/broadcast.rs b/rs/moq-crypto/src/sign/broadcast.rs
index 716809ba4a9..a8c52bd8458 100644
--- a/rs/moq-crypto/src/sign/broadcast.rs
+++ b/rs/moq-crypto/src/sign/broadcast.rs
@@ -13,8 +13,8 @@ use crate::sign::{PublicKey, SecretKey};
 
 /// The publishing side of a signed broadcast.
 ///
-/// Mints a fresh instance, so a restart never signs a sequence an earlier instance already signed.
-/// Announce the wrapped broadcast with [`Self::instance`] on its route.
+/// Signs under the instance of the route that serves it, which a route mints fresh, so a restart
+/// never signs a sequence an earlier instance already signed.
 #[derive(Clone)]
 pub struct Producer {
 	inner: moq_net::broadcast::Producer,
@@ -26,18 +26,25 @@ pub struct Producer {
 }
 
 impl Producer {
-	/// Sign `inner` with `key`, as the broadcast at application path `path`.
-	pub fn new(inner: moq_net::broadcast::Producer, key: SecretKey, path: moq_net::Path) -> Self {
+	/// Sign `inner` with `key`, as the broadcast at application path `path` served under
+	/// `instance`: the instance of the route that serves it, such as
+	/// [`Route::instance`](moq_net::origin::Route::instance) for the route that owns `inner`.
+	pub fn new(
+		inner: moq_net::broadcast::Producer,
+		key: SecretKey,
+		path: moq_net::Path,
+		instance: moq_net::Instance,
+	) -> Self {
 		Self {
 			inner,
 			key,
 			path,
-			instance: moq_net::Instance::random(),
+			instance,
 			next: Arc::default(),
 		}
 	}
 
-	/// The instance this producer signs under, to announce on the broadcast's route.
+	/// The instance this producer signs under: the route's that serves the broadcast.
 	pub fn instance(&self) -> &moq_net::Instance {
 		&self.instance
 	}
diff --git a/rs/moq-crypto/src/sign/mod.rs b/rs/moq-crypto/src/sign/mod.rs
index 6a641f845b3..71512ad44bb 100644
--- a/rs/moq-crypto/src/sign/mod.rs
+++ b/rs/moq-crypto/src/sign/mod.rs
@@ -10,8 +10,8 @@
 //!
 //! [draft-lcurley-moq-sign]: https://datatracker.ietf.org/doc/draft-lcurley-moq-sign/
 //!
-//! A publisher wraps its `moq-net` broadcast in a [`broadcast::Producer`], which mints a fresh
-//! instance to announce on the broadcast's route. A subscriber wraps the broadcast an origin
+//! A publisher wraps its `moq-net` broadcast in a [`broadcast::Producer`], which signs under the
+//! instance of the route that serves it. A subscriber wraps the broadcast an origin
 //! resolved in a [`broadcast::Consumer`], which takes the instance from that route. Both sides name
 //! the broadcast by the same application path, independent of where a relay mounts it.
 //!
diff --git a/rs/moq-crypto/src/sign/tests.rs b/rs/moq-crypto/src/sign/tests.rs
index aeb0aabbf35..8c67bf4e193 100644
--- a/rs/moq-crypto/src/sign/tests.rs
+++ b/rs/moq-crypto/src/sign/tests.rs
@@ -169,7 +169,7 @@ fn subscribe_all() -> moq_net::track::Subscription {
 /// A signed broadcast published at `path` on its own origin, announced under its instance.
 struct Published {
 	origin: moq_net::origin::Producer,
-	_publication: moq_net::origin::Publication,
+	route: moq_net::origin::Route,
 	signed: broadcast::Producer,
 	path: moq_net::Path,
 }
@@ -178,14 +178,11 @@ fn publish(key: &SecretKey, path: &str) -> Published {
 	let (origin, driver) = moq_net::origin::Producer::new(moq_net::origin::Config::default());
 	tokio::spawn(moq_net::time::run(driver));
 	let path = moq_net::Path::new(path).unwrap();
-	let publication = origin.create_broadcast(&path).unwrap();
-	let signed = broadcast::Producer::new(publication.broadcast().clone(), key.clone(), path.clone());
-	publication
-		.announce(moq_net::origin::Route::default().with_instance(signed.instance().clone(), 0))
-		.unwrap();
+	let route = origin.route(&path, moq_net::origin::RouteOptions::default()).unwrap();
+	let signed = broadcast::Producer::new(route.broadcast().clone(), key.clone(), path.clone(), route.instance());
 	Published {
 		origin,
-		_publication: publication,
+		route,
 		signed,
 		path,
 	}
@@ -201,7 +198,7 @@ impl Published {
 
 	/// A signed track over a net track the test can also write forged frames to.
 	fn track(&self, key: &SecretKey, name: &str) -> (track::Producer, moq_net::track::Producer) {
-		let net = self._publication.broadcast().create_track(name, None).unwrap();
+		let net = self.route.broadcast().create_track(name, None).unwrap();
 		let scope = Scope::new(&self.path, self.signed.instance(), name);
 		(
 			track::Producer::new(net.clone(), key.clone(), scope, Arc::default()),
@@ -389,7 +386,8 @@ async fn frame_from_an_earlier_instance_is_refused() {
 fn group_sequence_is_never_signed_twice() {
 	let key = SecretKey::generate();
 	let net = moq_net::broadcast::Info::new().produce();
-	let signed = broadcast::Producer::new(net, key, moq_net::Path::new("mesh/node/ssh").unwrap());
+	let path = moq_net::Path::new("mesh/node/ssh").unwrap();
+	let signed = broadcast::Producer::new(net, key, path, moq_net::Instance::random());
 	let track = signed.create_track("stream", None).unwrap();
 	let mut group = track.append_group().unwrap();
 	group.write_frame(None, b"first").unwrap();
diff --git a/rs/moq-crypto/tests/transport.rs b/rs/moq-crypto/tests/transport.rs
index 1ac5db1ccc6..489d8fd49d6 100644
--- a/rs/moq-crypto/tests/transport.rs
+++ b/rs/moq-crypto/tests/transport.rs
@@ -31,7 +31,7 @@ fn timed_datagrams() -> moq_net::datagram::Info {
 struct Fixture {
 	producer: moq_crypto::e2ee::broadcast::Producer,
 	consumer: moq_crypto::e2ee::broadcast::Consumer,
-	_broadcast: moq_net::origin::Publication,
+	_broadcast: moq_net::origin::Route,
 	_pair: MockPair,
 }
 
@@ -48,11 +48,10 @@ async fn connect_protected(version: Version, label: &str) -> Fixture {
 	let publisher = produce_origin(1);
 	let consumer_origin = produce_origin(2);
 
-	let broadcast = publisher.create_broadcast(&path).unwrap();
+	let options = moq_net::origin::RouteOptions::hidden().with_instance(generation.epoch().instance(), 0);
+	let broadcast = publisher.route(&path, options).unwrap();
 	let producer = moq_crypto::e2ee::broadcast::Producer::new(broadcast.broadcast().clone(), generation.clone());
-	broadcast
-		.announce(moq_net::origin::Route::default().with_instance(generation.epoch().instance(), 0))
-		.unwrap();
+	broadcast.announce().unwrap();
 
 	let mut options = MockConnectOptions::new(version);
 	options.server_publish = Some(publisher);
diff --git a/rs/moq-ffi/MIGRATE.md b/rs/moq-ffi/MIGRATE.md
index 83ef63003a4..f6addc7a020 100644
--- a/rs/moq-ffi/MIGRATE.md
+++ b/rs/moq-ffi/MIGRATE.md
@@ -16,6 +16,22 @@ Map `Start` to `Present` and `End` to `Absent`, and drop `Update` handling. Wher
 
 `MoqFollowing::available()` returns `Option<Arc<MoqBroadcastConsumer>>`: `None` once the path goes offline (or, for a follow pinned to an `instance`, once another instance takes it over), then the next broadcast when something serves the path again. The first call never returns `None`. Handle `None` as offline: drop what you read from the last broadcast and call `available()` again.
 
+### Publishing goes through one `MoqRoute` handle
+
+`MoqOriginProducer::create_broadcast(path)` is `route(path, MoqRouteOptions)`, and `requests(prefix)` is `route_prefix(prefix, MoqRouteOptions)`. Both return a `MoqRoute`, which replaces `MoqPublication`, `MoqOriginRequests`, and `MoqBroadcastPrepared`:
+
+- `MoqPublication::broadcast()` is `MoqRoute::broadcast()`, which errors with `Internal` on a prefix route.
+- `MoqPublication::announce(MoqAnnounceRoute)` is `announce()`, and re-pricing is `set_cost(cost)`. `unannounce()` is `withdraw()`.
+- `MoqOriginRequests::requested_broadcast()` is `requested()`, which returns `None` once the origin closes instead of `Closed`. A call after `cancel()` fails with `Cancelled`.
+- `MoqBroadcastRequest::prepare()` then `MoqBroadcastPrepared::publish()` is `MoqBroadcastRequest::route(options)`: create it hidden to fill it first, then `announce()`.
+- `MoqRoute::instance_id()` is the stream's instance, minted at creation and kept across `withdraw` and `announce` (Kotlin names it `instance()`; the Python, Go and Swift wrappers expose `instance`). It is not `instance()` because the generated C and C++ objects reserve that name.
+
+`MoqAnnounceRoute` is `MoqRouteOptions { hidden, cost, instance, epoch }`, given once at creation. A route is visible at once unless `hidden`; pass `hidden: true` and call `announce()` after filling the catalog to keep the old create-then-announce order. A stable `instance` is fixed for the route's lifetime: announcing a different one is a new route.
+
+Hold the `MoqRoute` for as long as the broadcast should stay announced. Dropping or cancelling it retracts the route, while `MoqBroadcastProducer::close()` still ends both; a broadcast handle alone no longer keeps it announced.
+
+`MoqRoute`, the record carried by `MoqAnnounce.route`, is renamed `MoqRouteInfo`; its fields are unchanged.
+
 ### Catalog renditions carry their warmup ([#7864](https://github.com/moq-dev/moq/pull/7864))
 
 `MoqVideo` and `MoqAudio` gain `warmup`, the catalog's decoder warmup, null when absent. `MoqMediaTrackConsumer::subscribe` reads it from the rendition: it starts that much further back than the subscription's min delay and asks the publisher for its max delay plus the warmup, while it still skips at the max delay alone. `MoqAudioConsumer::subscribe` and `MoqVideoConsumer::subscribe` now honor it too.
diff --git a/rs/moq-ffi/src/bench.rs b/rs/moq-ffi/src/bench.rs
index 26063e83970..8e7ae89e77d 100644
--- a/rs/moq-ffi/src/bench.rs
+++ b/rs/moq-ffi/src/bench.rs
@@ -244,7 +244,16 @@ async fn rust_ffi() {
 		let origin = MoqOriginProducer::new(MoqOriginConfig {
 			cache_capacity_bytes: Some(CACHE_BYTES),
 		});
-		let broadcast = origin.create_broadcast("bench".into()).unwrap().broadcast();
+		let route = origin
+			.route(
+				"bench".into(),
+				crate::origin::MoqRouteOptions {
+					hidden: true,
+					..Default::default()
+				},
+			)
+			.unwrap();
+		let broadcast = route.broadcast().unwrap();
 		let timed = MoqTrackInfo {
 			priority: 0,
 			max_age: None,
@@ -289,7 +298,8 @@ async fn rust_net() {
 		config.pool = moq_net::cache::Pool::new(cache);
 		let (origin, driver) = moq_net::origin::Producer::new(config);
 		let driver = tokio::spawn(moq_net::time::run(driver));
-		let broadcast = origin.create_broadcast("bench").unwrap();
+		let route = origin.route("bench", moq_net::origin::RouteOptions::hidden()).unwrap();
+		let broadcast = route.broadcast();
 		let info = moq_net::track::Info::default().with_timescale(moq_net::Timescale::MICRO);
 		let tracks: Vec<_> = (0..case.publishers)
 			.map(|p| broadcast.create_track(p.to_string(), Some(info.clone())).unwrap())
diff --git a/rs/moq-ffi/src/ffi.rs b/rs/moq-ffi/src/ffi.rs
index c7f9bc30eb6..f35ccbc804f 100644
--- a/rs/moq-ffi/src/ffi.rs
+++ b/rs/moq-ffi/src/ffi.rs
@@ -733,11 +733,6 @@ impl<T> Polled<T> {
 		self.state.lock().as_mut().map(f)
 	}
 
-	/// Whether [Self::cancel] or [Self::take] has run.
-	pub fn is_cancelled(&self) -> bool {
-		self.state.lock().is_none()
-	}
-
 	/// Move the state to a new owner, ending this handle as [Self::cancel] would.
 	///
 	/// `check` sees the state first, and an error there leaves this handle untouched.
@@ -1496,7 +1491,7 @@ mod tests {
 		polled.cancel();
 		// Dropped before cancel returns, though the parked call still holds a borrow.
 		assert!(matches!(dropped.try_recv(), Ok(())));
-		assert!(polled.is_cancelled());
+		assert!(polled.peek(|_| ()).is_none());
 		assert!(matches!(soon(parked).await, Err(MoqError::Cancelled)));
 		assert!(matches!(
 			polled.wait(|_, _| Poll::Ready(Ok(()))).await,
diff --git a/rs/moq-ffi/src/origin.rs b/rs/moq-ffi/src/origin.rs
index 08779f590d4..8ffe5fc59c8 100644
--- a/rs/moq-ffi/src/origin.rs
+++ b/rs/moq-ffi/src/origin.rs
@@ -30,25 +30,29 @@ pub struct MoqAnnounceConfig {
 	pub hidden: bool,
 }
 
-/// How a broadcast advertises its exact path: a static cost and the stream's instance.
+/// How a route advertises itself: its visibility at creation, its price, and, rarely, a
+/// stable instance.
 ///
-/// Pass one to `MoqPublication::announce`. The hop chain is the origin's to build,
-/// so a local publisher cannot claim relay hops it never took.
+/// The default announces at once, at cost 0, serving a fresh instance minted when the
+/// route is created. The hop chain is the origin's to build, so a local publisher cannot
+/// claim relay hops it never took.
 #[derive(Clone, Debug, Default, PartialEq, Eq, uniffi::Record)]
-pub struct MoqAnnounceRoute {
+pub struct MoqRouteOptions {
+	/// Create the route hidden: it exists for nobody until [`MoqRoute::announce`]. For a
+	/// publisher that fills its catalog first.
+	#[uniffi(default = false)]
+	pub hidden: bool,
 	/// Preference among routes covering the same prefix: lower wins. A publisher
 	/// sets its production cost here: zero for content it is already producing,
 	/// larger for content it would have to start producing on demand.
 	#[uniffi(default = 0)]
 	pub cost: u64,
-	/// A stable instance for the stream, or `None` to keep the one the broadcast minted.
+	/// A stable instance for the stream, or `None` to mint a fresh one.
 	///
-	/// Every broadcast mints a fresh instance, kept across re-announcing, so a restarted
-	/// publisher is a new stream viewers restart onto. Set one only for a publisher that
-	/// continues its group sequences across restarts and raises `epoch` on each: readers
-	/// stitch every route of one instance together, so restarting the sequences under an
-	/// old instance splices unrelated groups into their tracks. Changing it hands
-	/// `MoqFollowing` a new broadcast.
+	/// Set one only for a publisher that continues its group sequences across restarts and
+	/// raises `epoch` on each: readers stitch every route of one instance together, so
+	/// restarting the sequences under an old instance splices unrelated groups into their
+	/// tracks. Naming an instance grants nothing: publishing still needs the path's grant.
 	#[uniffi(default = None)]
 	pub instance: Option<String>,
 	/// Which run of a stable `instance` this is: only its highest epoch is eligible, cheaper
@@ -57,26 +61,30 @@ pub struct MoqAnnounceRoute {
 	pub epoch: u64,
 }
 
-impl TryFrom<MoqAnnounceRoute> for moq_net::origin::Route {
+impl TryFrom<MoqRouteOptions> for moq_net::origin::RouteOptions {
 	type Error = MoqError;
 
-	fn try_from(route: MoqAnnounceRoute) -> Result<Self, MoqError> {
-		let mut out = moq_net::origin::Route::default().with_cost(moq_net::origin::Cost::new(route.cost));
-		if let Some(instance) = route.instance {
-			out = out.with_instance(instance.parse()?, route.epoch);
+	fn try_from(options: MoqRouteOptions) -> Result<Self, MoqError> {
+		let mut out = match options.hidden {
+			true => moq_net::origin::RouteOptions::hidden(),
+			false => moq_net::origin::RouteOptions::default(),
+		}
+		.with_cost(options.cost);
+		if let Some(instance) = options.instance {
+			out = out.with_instance(instance.parse()?, options.epoch);
 		}
 		Ok(out)
 	}
 }
 
-/// An observed path-prefix route: hops, a static cost, and the stream's instance.
+/// The read-only facts on a received route: hops, a static cost, and the stream's instance.
 ///
 /// Carried by `MoqAnnounceConsumer` events. A route claims capability, not
-/// inventory: by convention a publisher announces each broadcast's exact path,
-/// so subscribers can enumerate broadcasts, while a service advertises a prefix
-/// with `MoqOriginProducer::requests` and answers whatever is requested beneath it.
+/// inventory: by convention a publisher creates each broadcast's exact route,
+/// so subscribers can enumerate broadcasts, while a service creates a prefix route
+/// with `MoqOriginProducer::route_prefix` and answers whatever is requested beneath it.
 #[derive(Clone, Debug, PartialEq, Eq, uniffi::Record)]
-pub struct MoqRoute {
+pub struct MoqRouteInfo {
 	/// Hop ids of the relay hops the route traversed, oldest first. 0 is the
 	/// anonymous mark.
 	pub hops: Vec<u64>,
@@ -89,13 +97,13 @@ pub struct MoqRoute {
 	pub instance: String,
 }
 
-impl From<moq_net::origin::Route> for MoqRoute {
-	fn from(route: moq_net::origin::Route) -> Self {
+impl From<moq_net::origin::RouteInfo> for MoqRouteInfo {
+	fn from(route: moq_net::origin::RouteInfo) -> Self {
 		Self {
-			hops: route.hops.iter().map(|origin| origin.id()).collect(),
-			cost: route.cost.value(),
+			hops: route.hops().iter().map(|origin| origin.id()).collect(),
+			cost: route.cost().value(),
 			anonymous: route.is_anonymous(),
-			instance: route.instance.map(|instance| instance.to_string()).unwrap_or_default(),
+			instance: route.instance().to_string(),
 		}
 	}
 }
@@ -132,41 +140,30 @@ pub struct MoqAnnounceConsumer {
 	reads: Polled<moq_net::announce::Consumer>,
 }
 
-#[derive(uniffi::Object)]
-/// A served route: advertises a path prefix and yields the broadcast requests
-/// beneath it for the application to accept or reject.
+/// A route on an origin: an exact route owning one broadcast, or a prefix route yielding
+/// the requests beneath it.
 ///
-/// Keeps its origin running, like a published broadcast, after every
-/// `MoqOriginProducer` is gone.
-pub struct MoqOriginRequests {
-	reads: Polled<moq_net::origin::Requests>,
+/// Dropping or cancelling it retracts the route, as does closing an exact route's
+/// broadcast; a broadcast handle alone does not keep it announced. It keeps its
+/// origin running after every `MoqOriginProducer` is gone.
+#[derive(uniffi::Object)]
+pub struct MoqRoute {
+	/// The route itself, released on cancel.
+	reads: Polled<moq_net::origin::Route>,
+	/// An exact route's broadcast, wrapped once so every caller shares its catalog.
+	broadcast: Option<Arc<MoqBroadcastProducer>>,
+	/// Minted at creation and kept for the route's lifetime.
+	instance: String,
 	driver: Background,
 }
 
 #[derive(uniffi::Object)]
-/// A pending dynamic broadcast request that must be accepted or rejected.
+/// A pending broadcast request on a prefix route, answered by serving, routing, or rejecting it.
 pub struct MoqBroadcastRequest {
 	inner: std::sync::Mutex<Option<moq_net::origin::Request>>,
 	driver: Background,
 }
 
-#[derive(uniffi::Object)]
-/// A broadcast published on an origin: the broadcast to fill and its announcement.
-///
-/// Dropping it does not retract the route; closing the broadcast does.
-pub struct MoqPublication {
-	pub(crate) inner: moq_net::origin::Publication,
-	broadcast: Arc<MoqBroadcastProducer>,
-}
-
-#[derive(uniffi::Object)]
-/// A claim answer being filled before its exact route is announced.
-pub struct MoqBroadcastPrepared {
-	inner: std::sync::Mutex<Option<moq_net::origin::Prepared>>,
-	broadcast: Arc<MoqBroadcastProducer>,
-	driver: Background,
-}
-
 /// A route over a prefix, carried by a [`MoqAnnounceEvent`].
 ///
 /// Carries no broadcast: resolve a specific path with
@@ -179,7 +176,7 @@ pub struct MoqAnnounce {
 	/// What each wildcard matched, empty when the filter has no wildcards.
 	pub captures: Vec<String>,
 	/// The route serving the prefix: its instance, hops, and a static cost.
-	pub route: MoqRoute,
+	pub route: MoqRouteInfo,
 }
 
 impl From<moq_net::announce::Announce> for MoqAnnounce {
@@ -314,50 +311,36 @@ impl MoqOriginProducer {
 		Arc::new(MoqOriginConsumer::from_inner(self.inner.clone()))
 	}
 
-	/// Advertise `prefix` and serve the requests beneath it.
+	/// Create a route at exactly `path`, owning a new broadcast to fill.
 	///
-	/// A route claims `prefix` and every path beneath it (the empty prefix
-	/// claims every path). A service that only serves some of them advertises
-	/// the covering prefix and rejects the rest as they are requested. Hold
-	/// the returned handle while the route should stay advertised and missing
-	/// broadcasts should be served.
-	pub fn requests(&self, prefix: String) -> Result<Arc<MoqOriginRequests>, MoqError> {
+	/// Visible at once unless `options.hidden`: a hidden route exists for nobody, on this
+	/// origin or its peers, until [`MoqRoute::announce`], so create it hidden to fill the
+	/// catalog first. The route serves a fresh instance, kept across withdraw and announce,
+	/// unless `options` names one. Hold the route: dropping or cancelling it retracts it, and
+	/// [`MoqBroadcastProducer::close`] ends both.
+	pub fn route(&self, path: String, options: MoqRouteOptions) -> Result<Arc<MoqRoute>, MoqError> {
 		let _guard = crate::ffi::enter();
+		let (options, visible) = MoqRoute::exact_options(options)?;
 		self.inner.driver.check()?;
-		let result = self.inner.requests(prefix);
+		// Surfaces Error::Unauthorized (out of scope) via the MoqError::Protocol conversion.
+		let result = self.inner.route(path.as_str(), options);
 		self.inner.driver.check()?;
-		let dynamic = result?;
-		Ok(Arc::new(MoqOriginRequests {
-			reads: Polled::new(dynamic).supervised(self.inner.driver.clone()),
-			driver: self.inner.driver.clone(),
-		}))
+		Ok(Arc::new(MoqRoute::exact(result?, self.inner.driver.clone(), visible)?))
 	}
 
-	/// Create a broadcast at `path` on this origin, returning its publication.
-	///
-	/// The broadcast exists for nobody, on this origin or its peers, until
-	/// [`MoqPublication::announce`]: until then announcement streams skip it
-	/// and requests for its path are unroutable. Announce after populating
-	/// tracks; an on-demand handler is [`MoqBroadcastProducer::requests`]. Create,
-	/// `requests()` if tracks are served on demand, populate, then announce.
+	/// Create a route over `prefix` that yields the requests beneath it.
 	///
-	/// [`MoqBroadcastProducer::close`] ends it for good; dropping its last handle,
-	/// the publication and `requests()` included, does the same.
-	pub fn create_broadcast(&self, path: String) -> Result<Arc<MoqPublication>, MoqError> {
+	/// A route claims `prefix` and every path beneath it (the empty prefix
+	/// claims every path). A service that only serves some of them advertises
+	/// the covering prefix and rejects the rest as they are requested. Answer each
+	/// [`MoqRoute::requested`] request; hold the route while it should stay advertised.
+	pub fn route_prefix(&self, prefix: String, options: MoqRouteOptions) -> Result<Arc<MoqRoute>, MoqError> {
 		let _guard = crate::ffi::enter();
+		let options = options.try_into()?;
 		self.inner.driver.check()?;
-		// Surfaces Error::Unauthorized (out of scope) via the MoqError::Protocol conversion.
-		let result = self.inner.create_broadcast(path.as_str());
+		let result = self.inner.route_prefix(prefix, options);
 		self.inner.driver.check()?;
-		let publication = result?;
-		let broadcast = Arc::new(MoqBroadcastProducer::from_inner(
-			publication.broadcast().clone(),
-			self.inner.driver.clone(),
-		)?);
-		Ok(Arc::new(MoqPublication {
-			inner: publication,
-			broadcast,
-		}))
+		Ok(Arc::new(MoqRoute::prefix(result?, self.inner.driver.clone())))
 	}
 }
 
@@ -427,35 +410,118 @@ impl MoqOriginConsumer {
 	}
 }
 
-// ---- MoqOriginRequests ----
+// ---- MoqRoute ----
+
+impl MoqRoute {
+	/// An exact route's native options, always hidden so [`Self::exact`] attaches the catalog
+	/// track before anyone can find the route, and whether the caller asked it visible.
+	fn exact_options(options: MoqRouteOptions) -> Result<(moq_net::origin::RouteOptions, bool), MoqError> {
+		let visible = !options.hidden;
+		let options = MoqRouteOptions {
+			hidden: true,
+			..options
+		}
+		.try_into()?;
+		Ok((options, visible))
+	}
+
+	/// Wrap an exact route created hidden, attaching the catalog track every FFI broadcast
+	/// carries, then announce it when `visible`, so a reader that finds it finds the catalog.
+	fn exact(route: moq_net::origin::Route, driver: Background, visible: bool) -> Result<Self, MoqError> {
+		let broadcast = MoqBroadcastProducer::from_inner(route.broadcast().clone(), driver.clone())?;
+		if visible {
+			route.announce()?;
+		}
+		Ok(Self::new(route, Some(Arc::new(broadcast)), driver))
+	}
+
+	fn prefix(route: moq_net::origin::Route, driver: Background) -> Self {
+		Self::new(route, None, driver)
+	}
+
+	fn new(route: moq_net::origin::Route, broadcast: Option<Arc<MoqBroadcastProducer>>, driver: Background) -> Self {
+		Self {
+			instance: route.instance().to_string(),
+			reads: Polled::new(route).supervised(driver.clone()),
+			broadcast,
+			driver,
+		}
+	}
+
+	/// Run `f` against the route, refused with `Cancelled` once it was cancelled.
+	fn with<R>(&self, f: impl FnOnce(&moq_net::origin::Route) -> Result<R, moq_net::Error>) -> Result<R, MoqError> {
+		let _guard = crate::ffi::enter();
+		self.driver.check()?;
+		let result = self.reads.peek(f).ok_or(MoqError::Cancelled)?;
+		self.driver.check()?;
+		Ok(result?)
+	}
+}
 
 #[uniffi::export]
-impl MoqOriginRequests {
-	/// Wait for the next broadcast requested through this handle's prefix.
+impl MoqRoute {
+	/// The broadcast this exact route owns, to fill with tracks.
 	///
-	/// Returns a [`MoqBroadcastRequest`]: serve a held broadcast, prepare a new one, or reject
-	/// it with an application error code. The requesting consumer stays pending until then.
-	pub async fn requested_broadcast(&self) -> Result<Arc<MoqBroadcastRequest>, MoqError> {
-		// A call after cancel finds the route retracted, rather than racing the cancel.
-		if self.reads.is_cancelled() {
-			return Err(MoqError::Closed);
-		}
+	/// Errors on a prefix route, which owns none: answer its requests instead.
+	pub fn broadcast(&self) -> Result<Arc<MoqBroadcastProducer>, MoqError> {
+		self.broadcast.clone().ok_or_else(|| MoqError::Internal {
+			reason: "a prefix route owns no broadcast; answer its requests".into(),
+		})
+	}
+
+	/// The stream this route serves, minted at creation unless the options named one.
+	///
+	/// Named `instance_id` rather than `instance` because the generated C and C++
+	/// objects keep their handle in a private field named `instance`; the wrappers
+	/// expose it as `instance`.
+	pub fn instance_id(&self) -> String {
+		self.instance.clone()
+	}
+
+	/// Make the route visible, or keep it so.
+	///
+	/// A route created by [`MoqBroadcastRequest::route`] also answers the requesters waiting
+	/// on its path. Errors with `Closed` once its broadcast closed, and with a protocol
+	/// `Unroutable` when a request's route can never announce because the request was
+	/// released or its prefix route retracted meanwhile.
+	pub fn announce(&self) -> Result<(), MoqError> {
+		self.with(|route| route.announce())
+	}
+
+	/// Hide the route from everyone, keeping its broadcast and instance: `announce` brings the
+	/// same stream back. Tracks already in flight carry on.
+	pub fn withdraw(&self) -> Result<(), MoqError> {
+		self.with(|route| {
+			route.withdraw();
+			Ok(())
+		})
+	}
+
+	/// Re-price the route in place: lower wins among routes covering the same prefix. A
+	/// hidden route keeps the price for when it next announces. Errors with `Closed` once its
+	/// broadcast closed.
+	pub fn set_cost(&self, cost: u64) -> Result<(), MoqError> {
+		self.with(|route| route.set_cost(cost))
+	}
+
+	/// Wait for the next broadcast a consumer requests beneath this prefix route.
+	///
+	/// Serve a held broadcast, route a new one, or reject the returned request; the requesting
+	/// consumer stays pending until then. Returns `None` once the origin closes, and at once on
+	/// an exact route, which yields no requests.
+	pub async fn requested(&self) -> Result<Option<Arc<MoqBroadcastRequest>>, MoqError> {
 		let request = self
 			.reads
-			.wait(|dynamic, waiter| {
-				Poll::Ready(match ready!(dynamic.poll_requested_broadcast(waiter)) {
-					Ok(request) => Ok(request),
-					Err(moq_net::Error::Closed) => Err(MoqError::Closed),
-					Err(err) => Err(err.into()),
-				})
-			})
+			.wait(|route, waiter| Poll::Ready(Ok(ready!(route.poll_requested(waiter)))))
 			.await?;
-		Ok(Arc::new(MoqBroadcastRequest::new(request, self.driver.clone())))
+		Ok(request.map(|request| Arc::new(MoqBroadcastRequest::new(request, self.driver.clone()))))
 	}
 
-	/// Stop serving and retract the route. Terminal: this handler is released
-	/// here, not when the handle is, so pending requests are rejected before
-	/// this returns.
+	/// Retract the route and release it here, not when the handle is.
+	///
+	/// Terminal: pending requests are rejected and later calls fail with `Cancelled`. An exact
+	/// route's broadcast lives on for its other handles until
+	/// [`MoqBroadcastProducer::close`].
 	pub fn cancel(&self) {
 		self.reads.cancel();
 	}
@@ -485,29 +551,27 @@ impl MoqBroadcastRequest {
 		Ok(request.path().to_string())
 	}
 
-	/// Start answering as a new stream under a fresh instance, hidden until published.
-	pub fn prepare(&self) -> Result<Arc<MoqBroadcastPrepared>, MoqError> {
+	/// Answer with the path's own exact route, owning a new broadcast.
+	///
+	/// The route serves a fresh instance unless `options` names one, so a job that restarts
+	/// is a new stream. Created visible, it announces now and answers the waiting
+	/// requesters; created hidden, they wait until [`MoqRoute::announce`], so the job can
+	/// fill its catalog first, and cancelling the route before then refuses them. Ending the
+	/// route withdraws only this path.
+	pub fn route(&self, options: MoqRouteOptions) -> Result<Arc<MoqRoute>, MoqError> {
 		let _guard = crate::ffi::enter();
+		let (options, visible) = MoqRoute::exact_options(options)?;
 		self.driver.check()?;
 		let request = self.take()?;
-		let result = request.prepare();
+		let result = request.route(options);
 		self.driver.check()?;
-		let prepared = result?;
-		let broadcast = Arc::new(MoqBroadcastProducer::from_inner(
-			prepared.broadcast().clone(),
-			self.driver.clone(),
-		)?);
-		Ok(Arc::new(MoqBroadcastPrepared {
-			inner: std::sync::Mutex::new(Some(prepared)),
-			broadcast,
-			driver: self.driver.clone(),
-		}))
+		Ok(Arc::new(MoqRoute::exact(result?, self.driver.clone(), visible)?))
 	}
 
 	/// Serve a held broadcast under the prefix route's instance without announcing an exact route.
 	///
 	/// Every answer at this path must continue the same sequences and bytes. Start a new
-	/// prefix route for different content, or prepare and publish a job with its own instance.
+	/// prefix route for different content, or route a job with its own instance.
 	pub fn serve(&self, broadcast: &Arc<MoqBroadcastConsumer>) -> Result<(), MoqError> {
 		let _guard = crate::ffi::enter();
 		self.driver.check()?;
@@ -526,58 +590,6 @@ impl MoqBroadcastRequest {
 	}
 }
 
-#[uniffi::export]
-impl MoqBroadcastPrepared {
-	/// The unannounced broadcast to fill before publishing; only `publish` announces it.
-	pub fn broadcast(&self) -> Arc<MoqBroadcastProducer> {
-		self.broadcast.clone()
-	}
-
-	/// Announce the filled broadcast and resolve every waiting requester.
-	pub fn publish(&self) -> Result<Arc<MoqPublication>, MoqError> {
-		let _guard = crate::ffi::enter();
-		self.driver.check()?;
-		let prepared = self.inner.lock().unwrap().take().ok_or(MoqError::Closed)?;
-		let result = prepared.publish();
-		self.driver.check()?;
-		Ok(Arc::new(MoqPublication {
-			inner: result?,
-			broadcast: self.broadcast.clone(),
-		}))
-	}
-}
-
-#[uniffi::export]
-impl MoqPublication {
-	/// The broadcast to fill, without announcement control.
-	pub fn broadcast(&self) -> Arc<MoqBroadcastProducer> {
-		self.broadcast.clone()
-	}
-
-	/// Advertise the broadcast's exact path as a route, or re-price it in place.
-	///
-	/// Until announced, the broadcast is invisible and unroutable for local
-	/// consumers and peers alike. Errors with `Closed` once the broadcast closed.
-	pub fn announce(&self, route: MoqAnnounceRoute) -> Result<(), MoqError> {
-		let _guard = crate::ffi::enter();
-		let route: moq_net::origin::Route = route.try_into()?;
-		self.broadcast.with_state(|_| Ok(self.inner.announce(route)?))
-	}
-
-	/// Retract the advertisement, if any, keeping the filled tracks alive.
-	///
-	/// Local consumers and peers alike stop discovering and requesting it;
-	/// tracks already in flight carry on. Announcing again brings it back. Errors with
-	/// `Closed` once the broadcast closed.
-	pub fn unannounce(&self) -> Result<(), MoqError> {
-		let _guard = crate::ffi::enter();
-		self.broadcast.with_state(|_| {
-			self.inner.unannounce();
-			Ok(())
-		})
-	}
-}
-
 // ---- MoqAnnounceConsumer ----
 
 #[uniffi::export]
@@ -636,15 +648,22 @@ impl MoqFollowing {
 mod supervision_tests {
 	use super::*;
 
+	fn hidden() -> MoqRouteOptions {
+		MoqRouteOptions {
+			hidden: true,
+			..Default::default()
+		}
+	}
+
 	#[tokio::test]
 	async fn serving_held_content_consumes_only_the_request() {
 		let origin = MoqOriginProducer::new(Default::default());
-		let requests = origin.requests("room".into()).unwrap();
-		let source = origin.create_broadcast("source".into()).unwrap().broadcast();
+		let requests = origin.route_prefix("room".into(), Default::default()).unwrap();
+		let source = origin.route("source".into(), hidden()).unwrap().broadcast().unwrap();
 		let held = source.consume().unwrap();
 		let consumer = origin.consume();
 		let (resolved, ()) = tokio::join!(consumer.request("room/camera".into(), None), async {
-			let request = requests.requested_broadcast().await.unwrap();
+			let request = requests.requested().await.unwrap().unwrap();
 			request.serve(&held).unwrap();
 			assert!(matches!(request.serve(&held), Err(MoqError::Closed)));
 		});
@@ -666,8 +685,7 @@ mod supervision_tests {
 		assert!(matches!(result, Err(MoqError::Task { .. })), "{result:?}");
 
 		let healthy = MoqOriginProducer::new(Default::default());
-		let publication = healthy.create_broadcast("healthy".into()).unwrap();
-		publication.announce(Default::default()).unwrap();
+		let _route = healthy.route("healthy".into(), Default::default()).unwrap();
 		healthy.consume().request("healthy".into(), None).await.unwrap();
 	}
 
@@ -678,25 +696,18 @@ mod supervision_tests {
 			inner,
 			driver: completion.clone(),
 		});
-		let publication = origin.create_broadcast("retained".into()).unwrap();
-		let dynamic = publication.broadcast().requests().unwrap();
+		let route = origin.route("retained".into(), hidden()).unwrap();
+		let dynamic = route.broadcast().unwrap().requests().unwrap();
 		drop(origin);
 		*trigger
 			.write()
 			.unwrap_or_else(|_| unreachable!("test keeps its panic trigger open")) = true;
 		assert!(matches!(completion.finished().await, Err(MoqError::Task { .. })));
 		drop(completion);
-		assert!(matches!(
-			publication.announce(Default::default()),
-			Err(MoqError::Task { .. })
-		));
+		assert!(matches!(route.announce(), Err(MoqError::Task { .. })));
 		assert!(matches!(dynamic.requested_track().await, Err(MoqError::Task { .. })));
 		let healthy = MoqOriginProducer::new(Default::default());
-		healthy
-			.create_broadcast("healthy".into())
-			.unwrap()
-			.announce(Default::default())
-			.unwrap();
+		let _route = healthy.route("healthy".into(), Default::default()).unwrap();
 	}
 
 	#[tokio::test]
@@ -706,7 +717,7 @@ mod supervision_tests {
 			inner,
 			driver: completion.clone(),
 		});
-		let broadcast = origin.create_broadcast("retained".into()).unwrap().broadcast();
+		let broadcast = origin.route("retained".into(), hidden()).unwrap().broadcast().unwrap();
 		// A dynamic handle outlives the consumed producer, so only an explicit close ends it.
 		let _dynamic = broadcast.requests().unwrap();
 		let consumer = broadcast.state.lock().unwrap().as_ref().unwrap().broadcast.consume();
@@ -730,7 +741,10 @@ mod supervision_tests {
 			inner,
 			driver: completion.clone(),
 		});
-		let broadcast = origin.create_broadcast("retained".into()).unwrap().broadcast();
+		// The route owns the broadcast, and it is the only handle that keeps the origin
+		// running once the producer is gone.
+		let route = origin.route("retained".into(), hidden()).unwrap();
+		let broadcast = route.broadcast().unwrap();
 		// One importer shares a timebase and one doesn't, so both reservation paths carry the driver.
 		let timebase = MoqMediaTimebase::new(broadcast.clone()).unwrap();
 		let container = MoqMediaContainerProducer::new(
@@ -759,6 +773,8 @@ mod supervision_tests {
 			.unwrap_or_else(|_| unreachable!("test keeps its panic trigger open")) = true;
 		assert!(matches!(completion.finished().await, Err(MoqError::Task { .. })));
 		drop(completion);
+		// The origin's last owner is gone too, so only the importers still hold the failure.
+		drop(route);
 		assert!(matches!(container.cut(), Err(MoqError::Task { .. })));
 		assert!(matches!(independent.write(Vec::new()), Err(MoqError::Task { .. })));
 		assert!(matches!(container.finish(), Err(MoqError::Task { .. })));
@@ -772,9 +788,8 @@ mod supervision_tests {
 			inner,
 			driver: completion.clone(),
 		});
-		let publication = origin.create_broadcast("routed".into()).unwrap();
-		publication.announce(Default::default()).unwrap();
-		let broadcast = publication.broadcast();
+		let route = origin.route("routed".into(), Default::default()).unwrap();
+		let broadcast = route.broadcast().unwrap();
 		let track = broadcast.publish_track("data".into(), None).unwrap();
 		let open = track.append_group().unwrap();
 		let consumer = origin.consume().request("routed".into(), None).await.unwrap();
@@ -794,7 +809,7 @@ mod supervision_tests {
 		drop(open);
 		drop(track);
 		drop(broadcast);
-		drop(publication);
+		drop(route);
 		let result = subscriber.recv_group().await.map(|group| group.is_some());
 		assert!(matches!(result, Err(MoqError::Task { .. })), "{result:?}");
 		let result = group.read_frame().await.map(|frame| frame.is_some());
diff --git a/rs/moq-ffi/src/producer.rs b/rs/moq-ffi/src/producer.rs
index 66bb0f0ec47..a6a86b2d7c5 100644
--- a/rs/moq-ffi/src/producer.rs
+++ b/rs/moq-ffi/src/producer.rs
@@ -355,7 +355,7 @@ impl MoqBroadcastProducer {
 	/// Create a standalone broadcast, not attached to any origin.
 	///
 	/// Use it for local pub/sub via [`consume`](Self::consume). To publish at a path, use
-	/// [`MoqOriginProducer::create_broadcast`](crate::origin::MoqOriginProducer::create_broadcast) instead.
+	/// [`MoqOriginProducer::route`](crate::origin::MoqOriginProducer::route) instead.
 	#[uniffi::constructor]
 	pub fn new() -> Result<Arc<Self>, MoqError> {
 		let _guard = crate::ffi::enter();
diff --git a/rs/moq-ffi/src/test.rs b/rs/moq-ffi/src/test.rs
index d79d21ca7c6..3c30ea5b164 100644
--- a/rs/moq-ffi/src/test.rs
+++ b/rs/moq-ffi/src/test.rs
@@ -256,12 +256,35 @@ async fn await_announced(consumer: &MoqOriginConsumer, path: &str) -> Arc<MoqBro
 		.expect("the first change is an instance")
 }
 
-/// Create a broadcast and announce its exact path: the create / populate / announce
-/// order with nothing to populate yet.
-fn create_announced(origin: &MoqOriginProducer, path: &str) -> Arc<MoqBroadcastProducer> {
-	let publication = origin.create_broadcast(path.into()).unwrap();
-	publication.announce(MoqAnnounceRoute::default()).unwrap();
-	publication.broadcast()
+/// A broadcast and the route that keeps it announced.
+struct Announced {
+	_route: Arc<MoqRoute>,
+	broadcast: Arc<MoqBroadcastProducer>,
+}
+
+impl std::ops::Deref for Announced {
+	type Target = Arc<MoqBroadcastProducer>;
+
+	fn deref(&self) -> &Self::Target {
+		&self.broadcast
+	}
+}
+
+/// Create a visible route, with nothing to populate yet.
+fn create_announced(origin: &MoqOriginProducer, path: &str) -> Announced {
+	let route = origin.route(path.into(), MoqRouteOptions::default()).unwrap();
+	Announced {
+		broadcast: route.broadcast().unwrap(),
+		_route: route,
+	}
+}
+
+/// Options creating a route hidden until it announces.
+fn hidden() -> MoqRouteOptions {
+	MoqRouteOptions {
+		hidden: true,
+		..Default::default()
+	}
 }
 
 /// The next announce event, failing the test on a timeout or a closed origin.
@@ -390,114 +413,92 @@ fn origin_config_set_cache_capacity() {
 	);
 }
 
-#[test]
-fn route_conversions_keep_cost_and_derive_anonymity() {
-	// An observed route reports its static cost.
-	let route = moq_net::origin::Route::default().with_cost(moq_net::origin::Cost::new(9));
-	assert_eq!(MoqRoute::from(route).cost, 9);
-
-	// A publisher seeds its production cost with one number.
-	let seeded = moq_net::origin::Route::try_from(MoqAnnounceRoute {
-		cost: 5,
-		..Default::default()
-	})
-	.unwrap();
-	assert_eq!(seeded.cost, moq_net::origin::Cost::new(5));
-	assert!(seeded.hops.is_empty());
-
-	let anonymous = MoqRoute::from(
-		moq_net::origin::Route::default().with_hops(moq_net::Hops::try_from(vec![moq_net::Hop::UNKNOWN]).unwrap()),
-	);
-	assert!(anonymous.anonymous);
-	assert_eq!(anonymous.hops, vec![0]);
-}
-
 #[tokio::test]
-async fn announced_route_keeps_static_cost_on_reannounce() {
+async fn route_options_reach_the_announced_route() {
 	let origin = MoqOriginProducer::new(MoqOriginConfig::default());
 	let consumer = origin.consume();
-	let publication = origin.create_broadcast("priced-route".into()).unwrap();
-	publication
-		.announce(MoqAnnounceRoute {
-			cost: 9,
-			..Default::default()
-		})
+	let route = origin
+		.route(
+			"priced-route".into(),
+			MoqRouteOptions {
+				cost: 9,
+				..Default::default()
+			},
+		)
 		.unwrap();
 
-	// Reading an advertisement preserves its static production price.
+	// Reading an advertisement preserves its static production price and the route's
+	// instance; a local route took no hops.
 	let announced = consumer.announced(MoqAnnounceConfig::default()).unwrap();
-	let route = loop {
-		if let MoqAnnounceEvent::Present { announce } = next_event(&announced).await
-			&& announce.prefix == "priced-route"
-		{
-			break announce.route;
-		}
-	};
-	assert_eq!(route.cost, 9);
+	let info = next_announced(&announced).await.route;
+	assert_eq!(info.cost, 9);
+	assert_eq!(info.instance, route.instance_id());
+	assert!(info.hops.is_empty());
+	assert!(!info.anonymous);
 
-	// Re-announcing what was observed keeps the static price.
-	publication
-		.announce(MoqAnnounceRoute {
-			cost: route.cost,
-			instance: Some(route.instance.clone()),
-			..Default::default()
-		})
-		.unwrap();
-	assert_eq!(publication.inner.route().map(MoqRoute::from), Some(route));
+	// Re-pricing changes the route in place: the listing never reports it, but a fresh
+	// listing reads the new price under the same instance.
+	route.set_cost(4).unwrap();
+	let repriced = consumer.announced(MoqAnnounceConfig::default()).unwrap();
+	let info = next_announced(&repriced).await.route;
+	assert_eq!(info.cost, 4);
+	assert_eq!(info.instance, route.instance_id());
 
-	publication.broadcast().close().unwrap();
+	route.broadcast().unwrap().close().unwrap();
 }
 
-#[test]
-fn instance_routes_parse_and_refuse() {
-	// A stable instance round-trips with its epoch, which only orders its runs.
-	let route = MoqAnnounceRoute {
-		instance: Some("cam".into()),
-		epoch: 3,
-		..Default::default()
-	};
-	let back = moq_net::origin::Route::try_from(route).unwrap();
-	assert_eq!(back.instance, Some("cam".parse().unwrap()));
-	assert_eq!(MoqRoute::from(back).instance, "cam");
+#[tokio::test]
+async fn route_options_name_an_instance_or_refuse() {
+	let origin = MoqOriginProducer::new(MoqOriginConfig::default());
+	let consumer = origin.consume();
+	let announced = consumer.announced(MoqAnnounceConfig::default()).unwrap();
 
-	let route = MoqAnnounceRoute {
+	// A stable instance is served as named.
+	let route = origin
+		.route(
+			"instance-route".into(),
+			MoqRouteOptions {
+				instance: Some("cam".into()),
+				epoch: 3,
+				..Default::default()
+			},
+		)
+		.unwrap();
+	assert_eq!(route.instance_id(), "cam");
+	assert_eq!(next_announced(&announced).await.route.instance, "cam");
+
+	// An instance is never empty, and the refusal creates nothing.
+	let empty = MoqRouteOptions {
 		instance: Some(String::new()),
 		..Default::default()
 	};
 	assert!(matches!(
-		moq_net::origin::Route::try_from(route),
+		origin.route("refused".into(), empty.clone()),
 		Err(MoqError::InvalidInstance { .. })
 	));
+	assert!(matches!(
+		origin.route_prefix("refused".into(), empty),
+		Err(MoqError::InvalidInstance { .. })
+	));
+
+	route.cancel();
 }
 
 #[tokio::test]
-async fn following_restarts_on_a_new_instance() {
+async fn a_new_route_at_a_path_restarts_its_followers() {
 	let origin = MoqOriginProducer::new(MoqOriginConfig::default());
 	let consumer = origin.consume();
 	let announced = consumer.announced(MoqAnnounceConfig::default()).unwrap();
 	let following = consumer.follow("instance-route".into(), None).unwrap();
-	let publication = origin.create_broadcast("instance-route".into()).unwrap();
-
-	let first = moq_net::Instance::random().to_string();
-	publication
-		.announce(MoqAnnounceRoute {
-			instance: Some(first.clone()),
-			..Default::default()
-		})
-		.unwrap();
+	let first = origin.route("instance-route".into(), Default::default()).unwrap();
 	let announce = next_announced(&announced).await;
-	assert_eq!(announce.route.instance, first);
+	assert_eq!(announce.route.instance, first.instance_id());
 	following.available().await.unwrap().unwrap();
 
-	// A new run of the same publisher is another instance: followers restart onto it, while
-	// the path stays listed.
-	let second = moq_net::Instance::random().to_string();
-	publication
-		.announce(MoqAnnounceRoute {
-			instance: Some(second.clone()),
-			..Default::default()
-		})
-		.unwrap();
+	// A new run of the same publisher is a new route with its own instance: followers
+	// restart onto it, while the path stays listed.
+	let second = origin.route("instance-route".into(), Default::default()).unwrap();
+	assert_ne!(first.instance_id(), second.instance_id());
 	kio::clock::timeout(TIMEOUT, following.available())
 		.await
 		.expect("the new instance is handed out")
@@ -506,13 +507,26 @@ async fn following_restarts_on_a_new_instance() {
 
 	// The next listed event is the path going absent under the new instance: the restart
 	// itself was never listed.
-	publication.unannounce().unwrap();
+	first.withdraw().unwrap();
+	second.withdraw().unwrap();
 	match next_event(&announced).await {
-		MoqAnnounceEvent::Absent { announce } => assert_eq!(announce.route.instance, second),
+		MoqAnnounceEvent::Absent { announce } => assert_eq!(announce.route.instance, second.instance_id()),
 		other => panic!("expected an absence, got {other:?}"),
 	}
 
-	publication.broadcast().close().unwrap();
+	first.cancel();
+	second.cancel();
+}
+
+#[tokio::test]
+async fn an_exact_route_yields_no_requests_and_a_prefix_route_no_broadcast() {
+	let origin = MoqOriginProducer::new(MoqOriginConfig::default());
+	let exact = origin.route("live".into(), Default::default()).unwrap();
+	assert!(exact.requested().await.unwrap().is_none());
+	let prefix = origin.route_prefix("room".into(), Default::default()).unwrap();
+	assert!(matches!(prefix.broadcast(), Err(MoqError::Internal { .. })));
+	exact.cancel();
+	prefix.cancel();
 }
 
 /// A media track reserves through its demand, so an app that publishes
@@ -3266,14 +3280,14 @@ fn audio_rejects_bad_init_bytes() {
 	);
 }
 
-/// Creating a broadcast does not make it exist for anyone: nothing crosses the
-/// announce cursor and nothing resolves until `announce`, locally exactly as for a
-/// peer. `follow` waits for the announcement.
+/// A hidden route does not exist for anyone: nothing crosses the announce cursor and
+/// nothing resolves until `announce`, locally exactly as for a peer. `follow` waits for
+/// the announcement.
 #[tokio::test]
-async fn create_broadcast_is_invisible_until_announced() {
+async fn a_hidden_route_is_invisible_until_announced() {
 	let origin = MoqOriginProducer::new(MoqOriginConfig::default());
 	let consumer = origin.consume();
-	let publication = origin.create_broadcast("live".into()).unwrap();
+	let route = origin.route("live".into(), hidden()).unwrap();
 
 	let unroutable = kio::clock::timeout(TIMEOUT, consumer.request("live".into(), None))
 		.await
@@ -3285,10 +3299,10 @@ async fn create_broadcast_is_invisible_until_announced() {
 	let waiting = consumer.follow("live".into(), None).unwrap();
 	let waited = tokio::spawn(async move { waiting.available().await });
 	kio::clock::sleep(std::time::Duration::from_millis(50)).await;
-	assert!(!pending.is_finished(), "create_broadcast must not advertise the path");
+	assert!(!pending.is_finished(), "a hidden route must not advertise the path");
 	assert!(!waited.is_finished(), "an unannounced broadcast must not resolve");
 
-	publication.announce(MoqAnnounceRoute::default()).unwrap();
+	route.announce().unwrap();
 	kio::clock::timeout(TIMEOUT, waited)
 		.await
 		.expect("timed out waiting for the announced broadcast")
@@ -3304,7 +3318,7 @@ async fn create_broadcast_is_invisible_until_announced() {
 		matches!(&update, MoqAnnounceEvent::Present { announce } if announce.prefix == "live"),
 		"{update:?}"
 	);
-	publication.broadcast().close().unwrap();
+	route.broadcast().unwrap().close().unwrap();
 }
 
 /// Waiting for an exact path must hand the broadcast back named by that path, the base a
@@ -3540,7 +3554,7 @@ async fn announced_filters_patterns_and_reports_captures() {
 			.unwrap();
 
 		// A claim at `room` could serve a match, but its own name is none, so it is not listed.
-		let broad = origin.requests("room".into()).unwrap();
+		let broad = serve(&origin, "room");
 		let chat = create_announced(&origin, "room/alice/chat");
 		let audio = create_announced(&origin, "room/alice/audio");
 		let update = next_announced(&announced).await;
@@ -3658,17 +3672,15 @@ async fn resolve_honors_the_reference_instance() {
 	let consumer = origin.consume();
 	let served = moq_net::Instance::random().to_string();
 	let other = moq_net::Instance::random().to_string();
-	let route = MoqAnnounceRoute {
+	let options = MoqRouteOptions {
 		instance: Some(served.clone()),
 		..Default::default()
 	};
 
-	let catalog = origin.create_broadcast("a/pub".into()).unwrap();
-	catalog.announce(route.clone()).unwrap();
-	let catalog = catalog.broadcast();
-	let source = origin.create_broadcast("a/source".into()).unwrap();
-	source.announce(route).unwrap();
-	let source = source.broadcast();
+	let catalog_route = origin.route("a/pub".into(), options.clone()).unwrap();
+	let catalog = catalog_route.broadcast().unwrap();
+	let source_route = origin.route("a/source".into(), options).unwrap();
+	let source = source_route.broadcast().unwrap();
 	let _video = source.publish_track("video".into(), None).unwrap();
 	let plain = create_announced(&origin, "a/plain");
 
@@ -3716,97 +3728,104 @@ async fn resolve_honors_the_reference_instance() {
 }
 
 #[tokio::test]
-async fn announce_and_unannounce_toggles_discovery() {
+async fn announce_and_withdraw_toggle_discovery() {
 	let origin = MoqOriginProducer::new(MoqOriginConfig::default());
 	let consumer = origin.consume();
-	let publication = origin.create_broadcast("live".into()).unwrap();
-	publication.announce(MoqAnnounceRoute::default()).unwrap();
+	let route = origin.route("live".into(), MoqRouteOptions::default()).unwrap();
 
 	// The consumer observes the flag through the announce stream: an active
 	// announcement, then its retraction.
 	let announced = consumer.announced(MoqAnnounceConfig::default()).unwrap();
-	async fn wait_live(announced: &MoqAnnounceConsumer, active: bool) {
+	async fn wait_live(announced: &MoqAnnounceConsumer, active: bool) -> MoqAnnounce {
 		loop {
 			match next_event(announced).await {
-				MoqAnnounceEvent::Present { announce } if active && announce.prefix == "live" => return,
-				MoqAnnounceEvent::Absent { announce } if !active && announce.prefix == "live" => return,
+				MoqAnnounceEvent::Present { announce } if active && announce.prefix == "live" => return announce,
+				MoqAnnounceEvent::Absent { announce } if !active && announce.prefix == "live" => return announce,
 				_ => {}
 			}
 		}
 	}
-	wait_live(&announced, true).await;
+	assert_eq!(wait_live(&announced, true).await.route.instance, route.instance_id());
 
-	publication.unannounce().unwrap();
+	route.withdraw().unwrap();
 	wait_live(&announced, false).await;
 
-	// Unannounced for local consumers exactly as for peers.
+	// Withdrawn for local consumers exactly as for peers.
 	let unroutable = kio::clock::timeout(TIMEOUT, consumer.request("live".into(), None))
 		.await
 		.expect("an unroutable request answers at once");
-	assert!(unroutable.is_err(), "an unannounced broadcast is unroutable");
+	assert!(unroutable.is_err(), "a withdrawn broadcast is unroutable");
 
-	// Announcing again brings it back.
-	publication.announce(MoqAnnounceRoute::default()).unwrap();
-	wait_live(&announced, true).await;
+	// Announcing again brings the same stream back.
+	route.announce().unwrap();
+	assert_eq!(wait_live(&announced, true).await.route.instance, route.instance_id());
 	kio::clock::timeout(TIMEOUT, consumer.request("live".into(), None))
 		.await
 		.expect("timed out requesting the reannounced broadcast")
 		.expect("a reannounced broadcast resolves");
 
-	publication.broadcast().close().unwrap();
+	route.broadcast().unwrap().close().unwrap();
 }
 
-/// The publication and the fill handle each keep the broadcast and its route alive: dropping
-/// either alone retracts nothing, and only the close does.
+/// The route alone keeps its broadcast announced: dropping the broadcast handle retracts
+/// nothing, while dropping or cancelling the route retracts it and its broadcast lives on.
 #[tokio::test]
-async fn dropping_a_publication_keeps_its_route() {
+async fn the_route_keeps_its_broadcast_announced() {
 	let origin = MoqOriginProducer::new(MoqOriginConfig::default());
 	let consumer = origin.consume();
-	let publication = origin.create_broadcast("live".into()).unwrap();
-	publication.announce(MoqAnnounceRoute::default()).unwrap();
-	let broadcast = publication.broadcast();
-	assert!(Arc::ptr_eq(&broadcast, &publication.broadcast()));
-	drop(publication);
+	let live = origin.route("live".into(), MoqRouteOptions::default()).unwrap();
+	let broadcast = live.broadcast().unwrap();
+	assert!(Arc::ptr_eq(&broadcast, &live.broadcast().unwrap()));
+	drop(broadcast);
 	await_announced(&consumer, "live").await;
 
-	let publication = origin.create_broadcast("held".into()).unwrap();
-	publication.announce(MoqAnnounceRoute::default()).unwrap();
-	drop(publication.broadcast());
-	await_announced(&consumer, "held").await;
-
-	broadcast.close().unwrap();
-	publication.broadcast().close().unwrap();
-	for path in ["live", "held"] {
+	let dropped = origin.route("dropped".into(), MoqRouteOptions::default()).unwrap();
+	let dropped_broadcast = dropped.broadcast().unwrap();
+	await_announced(&consumer, "dropped").await;
+	drop(dropped);
+	let cancelled = origin.route("cancelled".into(), MoqRouteOptions::default()).unwrap();
+	let cancelled_broadcast = cancelled.broadcast().unwrap();
+	await_announced(&consumer, "cancelled").await;
+	cancelled.cancel();
+	assert!(matches!(cancelled.announce(), Err(MoqError::Cancelled)));
+	assert!(matches!(cancelled.requested().await, Err(MoqError::Cancelled)));
+	for path in ["dropped", "cancelled"] {
 		let unroutable = kio::clock::timeout(TIMEOUT, consumer.request(path.into(), None))
 			.await
 			.expect("an unroutable request answers at once");
-		assert!(unroutable.is_err(), "a closed broadcast is unroutable");
+		assert!(unroutable.is_err(), "a retracted route is unroutable");
 	}
+	for broadcast in [dropped_broadcast, cancelled_broadcast] {
+		broadcast.publish_track("data".into(), None).unwrap();
+		broadcast.close().unwrap();
+	}
+
+	live.broadcast().unwrap().close().unwrap();
+	let unroutable = kio::clock::timeout(TIMEOUT, consumer.request("live".into(), None))
+		.await
+		.expect("an unroutable request answers at once");
+	assert!(unroutable.is_err(), "a closed broadcast is unroutable");
 }
 
-/// A publication outliving its closed broadcast cannot announce or withdraw the broadcast that
-/// replaced it at the same path.
+/// A route outliving its closed broadcast cannot announce, re-price, or withdraw the route
+/// that replaced it at the same path.
 #[tokio::test]
-async fn a_stale_publication_leaves_its_replacement_alone() {
+async fn a_closed_route_leaves_its_replacement_alone() {
 	let origin = MoqOriginProducer::new(MoqOriginConfig::default());
 	let consumer = origin.consume();
-	let stale = origin.create_broadcast("live".into()).unwrap();
-	stale.announce(MoqAnnounceRoute::default()).unwrap();
-	stale.broadcast().close().unwrap();
+	let stale = origin.route("live".into(), MoqRouteOptions::default()).unwrap();
+	stale.broadcast().unwrap().close().unwrap();
 
-	let replacement = origin.create_broadcast("live".into()).unwrap();
-	replacement.announce(MoqAnnounceRoute::default()).unwrap();
-	assert!(matches!(
-		stale.announce(MoqAnnounceRoute::default()),
-		Err(MoqError::Closed)
-	));
-	assert!(matches!(stale.unannounce(), Err(MoqError::Closed)));
+	let replacement = origin.route("live".into(), MoqRouteOptions::default()).unwrap();
+	assert!(matches!(stale.announce(), Err(MoqError::Closed)));
+	assert!(matches!(stale.set_cost(1), Err(MoqError::Closed)));
+	stale.withdraw().unwrap();
 	kio::clock::timeout(TIMEOUT, consumer.request("live".into(), None))
 		.await
 		.expect("timed out requesting the replacement")
 		.expect("the replacement still resolves");
 
-	replacement.broadcast().close().unwrap();
+	replacement.broadcast().unwrap().close().unwrap();
 }
 
 #[tokio::test]
@@ -4956,8 +4975,13 @@ async fn follow() {
 	_broadcast.close().unwrap();
 }
 
-fn serve(origin: &MoqOriginProducer, prefix: &str) -> Arc<MoqOriginRequests> {
-	origin.requests(prefix.into()).unwrap()
+fn serve(origin: &MoqOriginProducer, prefix: &str) -> Arc<MoqRoute> {
+	origin.route_prefix(prefix.into(), MoqRouteOptions::default()).unwrap()
+}
+
+/// The next request beneath a prefix route, failing the test once it yields none.
+async fn requested(route: &MoqRoute) -> Result<Arc<MoqBroadcastRequest>, MoqError> {
+	Ok(route.requested().await?.expect("the prefix route ended"))
 }
 
 #[tokio::test]
@@ -4971,26 +4995,21 @@ async fn dynamic_broadcast_request() {
 		tokio::spawn(async move { consumer.request("dynamic/broadcast".into(), None).await })
 	};
 
-	let request = kio::clock::timeout(TIMEOUT, dynamic.requested_broadcast())
+	let request = kio::clock::timeout(TIMEOUT, requested(&dynamic))
 		.await
 		.expect("timed out waiting for requested broadcast")
 		.unwrap();
 	assert_eq!(request.path().unwrap(), "dynamic/broadcast");
 
-	let prepared = request.prepare().unwrap();
-	let served = prepared.broadcast();
+	let job = request.route(hidden()).unwrap();
+	let served = job.broadcast().unwrap();
 	let track = served.publish_track("status".into(), Some(timed_info())).unwrap();
-	// Only publish announces the answer, under a fresh instance and after admission, and it
-	// hands back the fill handle the answer was prepared with.
-	let publication = prepared.publish().unwrap();
-	assert!(Arc::ptr_eq(&publication.broadcast(), &served));
-	// A re-price that names no instance keeps the one the answer was published under.
-	publication
-		.announce(MoqAnnounceRoute {
-			cost: 7,
-			..Default::default()
-		})
-		.unwrap();
+	// Only announce answers the requester, under a fresh instance and after admission.
+	let instance = job.instance_id();
+	job.announce().unwrap();
+	// A re-price keeps the instance the answer was announced under.
+	job.set_cost(7).unwrap();
+	assert_eq!(job.instance_id(), instance);
 	assert!(matches!(request.path(), Err(MoqError::Closed)));
 
 	let broadcast = kio::clock::timeout(TIMEOUT, requesting)
@@ -5032,14 +5051,13 @@ async fn dynamic_serves_a_request_under_a_prefix() {
 		let consumer = consumer.clone();
 		tokio::spawn(async move { consumer.request("live/cam".into(), None).await })
 	};
-	let request = kio::clock::timeout(TIMEOUT, dynamic.requested_broadcast())
+	let request = kio::clock::timeout(TIMEOUT, requested(&dynamic))
 		.await
 		.expect("timed out waiting for the prefix request")
 		.unwrap();
 	assert_eq!(request.path().unwrap(), "live/cam");
-	let prepared = request.prepare().unwrap();
-	let served = prepared.broadcast();
-	prepared.publish().unwrap();
+	let job = request.route(MoqRouteOptions::default()).unwrap();
+	let served = job.broadcast().unwrap();
 	kio::clock::timeout(TIMEOUT, requesting)
 		.await
 		.expect("timed out waiting for the request to resolve")
@@ -5075,13 +5093,12 @@ async fn dynamic_keeps_the_origin_alive() {
 		let consumer = consumer.clone();
 		tokio::spawn(async move { consumer.request("live".into(), None).await })
 	};
-	let request = kio::clock::timeout(TIMEOUT, dynamic.requested_broadcast())
+	let request = kio::clock::timeout(TIMEOUT, requested(&dynamic))
 		.await
 		.expect("the handler must still receive requests")
 		.unwrap();
-	let prepared = request.prepare().unwrap();
-	let served = prepared.broadcast();
-	prepared.publish().unwrap();
+	let job = request.route(MoqRouteOptions::default()).unwrap();
+	let served = job.broadcast().unwrap();
 	kio::clock::timeout(TIMEOUT, requesting)
 		.await
 		.expect("timed out waiting for the request to resolve")
@@ -5563,7 +5580,7 @@ async fn dynamic_broadcast_request_can_reject() {
 		tokio::spawn(async move { consumer.request("missing".into(), None).await })
 	};
 
-	let request = kio::clock::timeout(TIMEOUT, dynamic.requested_broadcast())
+	let request = kio::clock::timeout(TIMEOUT, requested(&dynamic))
 		.await
 		.expect("timed out waiting for requested broadcast")
 		.unwrap();
@@ -5586,7 +5603,7 @@ async fn cancelling_dynamic_broadcasts_unregisters_the_handler() {
 	let consumer = origin.consume();
 
 	dynamic.cancel();
-	assert!(matches!(dynamic.requested_broadcast().await, Err(MoqError::Closed)));
+	assert!(matches!(dynamic.requested().await, Err(MoqError::Cancelled)));
 
 	let result = kio::clock::timeout(TIMEOUT, consumer.request("missing".into(), None))
 		.await
@@ -5923,12 +5940,7 @@ async fn roundtrip(media: &MoqMediaTrackProducer, track: &MoqMediaTrackConsumer,
 async fn datagram_connection(
 	path: &str,
 	versions: Vec<String>,
-) -> (
-	Arc<MoqBroadcastProducer>,
-	Arc<MoqBroadcastConsumer>,
-	Arc<MoqSession>,
-	impl Sized,
-) {
+) -> (Announced, Arc<MoqBroadcastConsumer>, Arc<MoqSession>, impl Sized) {
 	let server_origin = MoqOriginProducer::new(MoqOriginConfig::default());
 	let server = MoqServer::new(MoqServerConfig {
 		bind: Some("127.0.0.1:0".into()),
@@ -6140,7 +6152,7 @@ async fn follow_retries_a_dropped_wait() {
 
 	let waiting = followed.clone();
 	let dropped = tokio::spawn(async move { waiting.available().await });
-	let request = kio::clock::timeout(TIMEOUT, dynamic.requested_broadcast())
+	let request = kio::clock::timeout(TIMEOUT, requested(&dynamic))
 		.await
 		.expect("the wait never asked for the broadcast")
 		.unwrap();
@@ -6148,13 +6160,13 @@ async fn follow_retries_a_dropped_wait() {
 	assert!(matches!(dropped.await, Err(err) if err.is_cancelled()));
 
 	let retry = tokio::spawn(async move { followed.available().await });
-	let served = request.prepare().unwrap().publish().unwrap();
+	let served = request.route(MoqRouteOptions::default()).unwrap();
 	kio::clock::timeout(TIMEOUT, retry)
 		.await
 		.expect("the retry waited for another instance")
 		.unwrap()
 		.unwrap();
-	served.broadcast().close().unwrap();
+	served.broadcast().unwrap().close().unwrap();
 }
 
 /// Another instance taking over while `available()` resolves is the one it hands out, so the
@@ -6170,7 +6182,7 @@ async fn follow_hands_out_a_takeover_once(dynamic_at: &str) {
 	let waiting = followed.clone();
 	let first = tokio::spawn(async move { waiting.available().await });
 	// The wait is on the dynamic route's answer when the exact path takes over under another instance.
-	let _unanswered = kio::clock::timeout(TIMEOUT, dynamic.requested_broadcast())
+	let _unanswered = kio::clock::timeout(TIMEOUT, requested(&dynamic))
 		.await
 		.expect("the wait never asked for the broadcast")
 		.unwrap();
@@ -6205,12 +6217,11 @@ async fn follow_hands_out_a_held_takeover_once() {
 async fn follow_hands_out_the_instance_again_after_an_end() {
 	let origin = MoqOriginProducer::new(MoqOriginConfig::default());
 	let followed = origin.consume().follow("live".into(), None).unwrap();
-	let route = MoqAnnounceRoute {
+	let options = MoqRouteOptions {
 		instance: Some(moq_net::Instance::random().to_string()),
 		..Default::default()
 	};
-	let publication = origin.create_broadcast("live".into()).unwrap();
-	publication.announce(route.clone()).unwrap();
+	let first_route = origin.route("live".into(), options.clone()).unwrap();
 	let first = kio::clock::timeout(TIMEOUT, followed.available())
 		.await
 		.expect("timed out waiting for the broadcast")
@@ -6218,20 +6229,17 @@ async fn follow_hands_out_the_instance_again_after_an_end() {
 		.unwrap();
 
 	// A covering claim answering under the same instance.
-	let dynamic = origin.inner().inner.requests("").unwrap();
-	publication.unannounce().unwrap();
+	let dynamic = serve(&origin, "");
+	first_route.withdraw().unwrap();
 	let again = tokio::spawn(async move {
 		assert!(followed.available().await?.is_none(), "the end comes first");
 		followed.available().await
 	});
-	let request = kio::clock::timeout(TIMEOUT, dynamic.requested_broadcast())
+	let request = kio::clock::timeout(TIMEOUT, requested(&dynamic))
 		.await
 		.expect("the instance never asked the route above the path")
 		.unwrap();
-	let served = request.prepare().unwrap().publish().unwrap();
-	served
-		.announce(moq_net::origin::Route::try_from(route.clone()).unwrap())
-		.unwrap();
+	let served = request.route(options).unwrap();
 
 	let again = kio::clock::timeout(TIMEOUT, again)
 		.await
@@ -6245,7 +6253,7 @@ async fn follow_hands_out_the_instance_again_after_an_end() {
 		"the claim above did not answer the same instance"
 	);
 	drop((served, dynamic));
-	publication.broadcast().close().unwrap();
+	first_route.broadcast().unwrap().close().unwrap();
 }
 
 /// An instance pins both resolutions to one publisher instance: a request for another one is
@@ -6255,12 +6263,14 @@ async fn an_instance_pins_request_and_follow() {
 	let origin = MoqOriginProducer::new(MoqOriginConfig::default());
 	let consumer = origin.consume();
 	let instance = moq_net::Instance::random().to_string();
-	let first = origin.create_broadcast("live".into()).unwrap();
-	first
-		.announce(MoqAnnounceRoute {
-			instance: Some(instance.clone()),
-			..Default::default()
-		})
+	let first = origin
+		.route(
+			"live".into(),
+			MoqRouteOptions {
+				instance: Some(instance.clone()),
+				..Default::default()
+			},
+		)
 		.unwrap();
 
 	let pinned = kio::clock::timeout(TIMEOUT, consumer.request("live".into(), Some(instance.clone())))
@@ -6295,13 +6305,7 @@ async fn an_instance_pins_request_and_follow() {
 		.expect("timed out following the pinned instance")
 		.unwrap()
 		.unwrap();
-	let second = origin.create_broadcast("live".into()).unwrap();
-	second
-		.announce(MoqAnnounceRoute {
-			instance: Some(moq_net::Instance::random().to_string()),
-			..Default::default()
-		})
-		.unwrap();
+	let second = origin.route("live".into(), MoqRouteOptions::default()).unwrap();
 	// An unpinned request resolves the takeover and holds it, so a follower resolving it joins
 	// that answer at once: one poll, which applies the takeover first, would hand it out.
 	let takeover = kio::clock::timeout(TIMEOUT, consumer.request("live".into(), None))
@@ -6325,8 +6329,8 @@ async fn an_instance_pins_request_and_follow() {
 		"the follower handed out another instance"
 	);
 	drop(takeover);
-	first.broadcast().close().unwrap();
-	second.broadcast().close().unwrap();
+	first.broadcast().unwrap().close().unwrap();
+	second.broadcast().unwrap().close().unwrap();
 }
 
 /// The route a wait resolves through leaving, and another instance arriving before it resolves,
@@ -6340,7 +6344,7 @@ async fn follow_hands_out_a_gap_while_resolving_once() {
 
 	let waiting = followed.clone();
 	let first = tokio::spawn(async move { waiting.available().await });
-	let _unanswered = kio::clock::timeout(TIMEOUT, dynamic.requested_broadcast())
+	let _unanswered = kio::clock::timeout(TIMEOUT, requested(&dynamic))
 		.await
 		.expect("the wait never asked for the broadcast")
 		.unwrap();
@@ -6371,7 +6375,7 @@ async fn follow_waits_for_another_instance_after_a_dropped_takeover() {
 
 	let waiting = followed.clone();
 	let first = tokio::spawn(async move { waiting.available().await });
-	let _unanswered = kio::clock::timeout(TIMEOUT, dynamic.requested_broadcast())
+	let _unanswered = kio::clock::timeout(TIMEOUT, requested(&dynamic))
 		.await
 		.expect("the wait never asked for the broadcast")
 		.unwrap();
diff --git a/rs/moq-ffi/uniffi.toml b/rs/moq-ffi/uniffi.toml
index eba2c541b3d..ddaf3cc8ec6 100644
--- a/rs/moq-ffi/uniffi.toml
+++ b/rs/moq-ffi/uniffi.toml
@@ -3,3 +3,5 @@
 # generated forced end is `end()` so it doesn't collide with it.
 [bindings.kotlin.rename]
 "MoqBroadcastProducer.close" = "end"
+# See MoqRoute::instance_id: the C++ generator reserves `instance`, Kotlin does not.
+"MoqRoute.instance_id" = "instance"
diff --git a/rs/moq-gst/src/sink/imp.rs b/rs/moq-gst/src/sink/imp.rs
index 55191b8e4d9..5b405e54259 100644
--- a/rs/moq-gst/src/sink/imp.rs
+++ b/rs/moq-gst/src/sink/imp.rs
@@ -68,7 +68,7 @@ impl TryFrom<Settings> for ResolvedSettings {
 /// Live state for one READY to PAUSED run.
 struct State {
 	session: Session,
-	broadcast: moq_net::origin::Publication,
+	route: moq_net::origin::Route,
 	catalog: Option<moq_mux::catalog::Producer>,
 	wall: std::sync::Arc<super::wall::Wall>,
 	/// Follows the published catalog, so a pad reports demand once its track is listed.
@@ -573,7 +573,7 @@ impl MoqSink {
 			gst::error!(CAT, obj = self.obj(), "invalid settings: {err:#}");
 			gst::StateChangeError
 		})?;
-		let (session, registration, broadcast, catalog) =
+		let (session, registration, route, catalog) =
 			Session::start(settings, self.obj().downgrade()).map_err(|err| {
 				gst::error!(CAT, obj = self.obj(), "failed to start session: {err:?}");
 				gst::StateChangeError
@@ -594,7 +594,7 @@ impl MoqSink {
 			let mut control = self.control.lock().unwrap();
 			control.live = Some(State {
 				session,
-				broadcast,
+				route,
 				catalog: Some(catalog),
 				wall,
 				watch,
@@ -686,7 +686,7 @@ impl MoqSink {
 		if let Some(lingering) = state.lingering.take() {
 			lingering.abort();
 		}
-		state.broadcast.close();
+		state.route.broadcast().close();
 		drop(closed);
 		state.session.stop();
 		self.notify_updates(updates);
@@ -1083,8 +1083,7 @@ impl MoqSink {
 			None if completion.finish() => {
 				// The closed renditions and the catalog hold the finished tracks, so they go only
 				// once the broadcast closes.
-				let finished =
-					moq_mux::Linger::new([state.broadcast.broadcast().clone()], (closed, catalog), state.linger);
+				let finished = moq_mux::Linger::new([state.route.broadcast().clone()], (closed, catalog), state.linger);
 				self.linger_locked(control, finished)
 			}
 			None => Posted::Nothing,
@@ -1297,7 +1296,7 @@ fn observe_caps(
 	if let Some(track) = requested.as_deref() {
 		options = options.with_track(track);
 	}
-	let outcome = lifecycle.media.observe_caps(&state.broadcast, catalog, options);
+	let outcome = lifecycle.media.observe_caps(state.route.broadcast(), catalog, options);
 	lifecycle.completion = Some(state.session.completion());
 	match outcome {
 		CapsOutcome::Active(track) => {
@@ -1373,7 +1372,8 @@ mod tests {
 				.live
 				.as_ref()
 				.unwrap()
-				.broadcast
+				.route
+				.broadcast()
 				.consume();
 			futures::executor::block_on(moq_mux::catalog::Consumer::new(
 				&broadcast,
@@ -1517,7 +1517,7 @@ mod tests {
 				let control = run.0.imp().control.lock().unwrap();
 				let state = control.live.as_ref().unwrap();
 				(
-					state.broadcast.consume(),
+					state.route.broadcast().consume(),
 					state.catalog.as_ref().unwrap().snapshot().media.clock.unwrap(),
 				)
 			};
@@ -1753,7 +1753,8 @@ mod tests {
 			.live
 			.as_ref()
 			.unwrap()
-			.broadcast
+			.route
+			.broadcast()
 			.consume();
 		let _first_reader = broadcast.track("first").unwrap().subscribe(None);
 		let _second_reader = broadcast.track("second").unwrap().subscribe(None);
@@ -1825,7 +1826,8 @@ mod tests {
 			.live
 			.as_ref()
 			.unwrap()
-			.broadcast
+			.route
+			.broadcast()
 			.consume();
 		let _reader = broadcast.track("camera").unwrap().subscribe(None);
 		assert!(
@@ -1872,7 +1874,8 @@ mod tests {
 			.live
 			.as_ref()
 			.unwrap()
-			.broadcast
+			.route
+			.broadcast()
 			.consume();
 		let _reader = broadcast.track("levels").unwrap().subscribe(None);
 		let wanted = await_demand(&levels, |state| {
@@ -1919,7 +1922,8 @@ mod tests {
 			.live
 			.as_ref()
 			.unwrap()
-			.broadcast
+			.route
+			.broadcast()
 			.consume();
 		let _old_reader = broadcast.track("camera").unwrap().subscribe(None);
 		frame(&video, VP8_KEYFRAME);
@@ -1970,7 +1974,8 @@ mod tests {
 			.live
 			.as_ref()
 			.unwrap()
-			.broadcast
+			.route
+			.broadcast()
 			.consume();
 		let _first_reader = broadcast.track("first").unwrap().subscribe(None);
 		let _second_reader = broadcast.track("second").unwrap().subscribe(None);
@@ -2035,7 +2040,8 @@ mod tests {
 				.live
 				.as_ref()
 				.unwrap()
-				.broadcast
+				.route
+				.broadcast()
 				.consume();
 			let mut track = broadcast
 				.track("video/1")
@@ -2441,7 +2447,7 @@ mod tests {
 		let (broadcast, session) = {
 			let control = sink.imp().control.lock().unwrap();
 			let state = control.live.as_ref().expect("live session");
-			(state.broadcast.broadcast().clone(), state.session.completion())
+			(state.route.broadcast().clone(), state.session.completion())
 		};
 		let consumer = broadcast.consume();
 		let track = broadcast.create_track("video", None).unwrap();
diff --git a/rs/moq-gst/src/sink/session.rs b/rs/moq-gst/src/sink/session.rs
index baa79fb00a0..bd58d2d95c5 100644
--- a/rs/moq-gst/src/sink/session.rs
+++ b/rs/moq-gst/src/sink/session.rs
@@ -262,29 +262,32 @@ pub(crate) struct Session {
 }
 
 impl Session {
-	/// Create the broadcast/catalog producers and spawn the connect task. Returns the producers for the
-	/// element to write into; the session task owns only the origin, the connection, and the status.
+	/// Create the route and catalog producer and spawn the connect task. Returns them for the element
+	/// to hold and write into; the session task owns only the origin, the connection, and the status.
 	pub fn start(
 		settings: ResolvedSettings,
 		element: glib::WeakRef<Element>,
 	) -> Result<(
 		Self,
 		SessionRegistration,
-		moq_net::origin::Publication,
+		moq_net::origin::Route,
 		moq_mux::catalog::Producer,
 	)> {
 		// Producer setup may touch tokio time (group eviction), so run it inside the runtime context.
 		let _rt = RUNTIME.enter();
 
 		let origin = moq_tokio::origin::spawn();
-		// Each run is a new stream under a fresh instance, which the publication mints: a restarted
+		// Each run is a new stream under a fresh instance, which the route mints: a restarted
 		// pipeline never resumes viewers into the old run's group sequence. Reconnects keep it.
-		let broadcast = origin.publish(&settings.broadcast, moq_net::origin::Route::default())?;
-		if let Some(instance) = broadcast.route().and_then(|route| route.instance) {
-			gst::info!(CAT, "publishing {} under instance {instance}", settings.broadcast);
-		}
+		let route = origin.route(&settings.broadcast, moq_net::origin::RouteOptions::default())?;
+		gst::info!(
+			CAT,
+			"publishing {} under instance {}",
+			settings.broadcast,
+			route.instance()
+		);
 		let catalog =
-			moq_mux::catalog::Producer::new(&mut broadcast.broadcast().clone(), moq_mux::catalog::Config::default())?;
+			moq_mux::catalog::Producer::new(&mut route.broadcast().clone(), moq_mux::catalog::Config::default())?;
 
 		let status = Arc::new(Status::default());
 		let completion = CompletionState::new();
@@ -332,7 +335,7 @@ impl Session {
 				completion,
 			},
 			SessionRegistration { gate },
-			broadcast,
+			route,
 			catalog,
 		))
 	}
@@ -550,7 +553,7 @@ mod tests {
 		assert_eq!(structure.get::<u64>("ended"), Ok(2));
 	}
 
-	fn started_with_broadcast() -> (Session, moq_net::origin::Publication) {
+	fn started_with_broadcast() -> (Session, moq_net::origin::Route) {
 		gst::init().unwrap();
 		let settings = ResolvedSettings {
 			url: "https://127.0.0.1:1".parse().unwrap(),
@@ -558,9 +561,9 @@ mod tests {
 			connect: crate::connection::Settings::default().resolve().unwrap().0,
 			quic: Default::default(),
 		};
-		let (session, registration, broadcast, _) = Session::start(settings, glib::WeakRef::new()).unwrap();
+		let (session, registration, route, _) = Session::start(settings, glib::WeakRef::new()).unwrap();
 		registration.mark_registered();
-		(session, broadcast)
+		(session, route)
 	}
 
 	fn started() -> (Session, moq_tokio::Connection) {
@@ -569,8 +572,9 @@ mod tests {
 		(session, connection)
 	}
 
-	fn announced_instance(broadcast: &moq_net::origin::Publication) -> moq_net::Instance {
-		broadcast.route().expect("announced").instance.expect("an instance")
+	fn announced_instance(route: &moq_net::origin::Route) -> moq_net::Instance {
+		assert!(route.is_announced());
+		route.instance()
 	}
 
 	// Under one instance, a restart whose old route lingers would resume viewers into the old run's groups.
diff --git a/rs/moq-gst/src/source/imp.rs b/rs/moq-gst/src/source/imp.rs
index e90ff295ab8..807946c2294 100644
--- a/rs/moq-gst/src/source/imp.rs
+++ b/rs/moq-gst/src/source/imp.rs
@@ -2797,21 +2797,27 @@ mod session_tests {
 		let _pad_ids = pad_ids();
 		let element = element();
 		let origin = origin();
-		let catalog_broadcast = origin.create_broadcast("room/catalog").unwrap();
-		let mut local = catalog_broadcast.requests();
-		let left = origin.create_broadcast("room/left").unwrap();
-		let mut remote = left.requests();
-		let right = origin.create_broadcast("room/right").unwrap();
-		let mut replacement = right.requests();
+		let catalog_broadcast = origin
+			.route("room/catalog", moq_net::origin::RouteOptions::hidden())
+			.unwrap();
+		let mut local = catalog_broadcast.broadcast().requests();
+		let left = origin
+			.route("room/left", moq_net::origin::RouteOptions::hidden())
+			.unwrap();
+		let mut remote = left.broadcast().requests();
+		let right = origin
+			.route("room/right", moq_net::origin::RouteOptions::hidden())
+			.unwrap();
+		let mut replacement = right.broadcast().requests();
 		let mut catalog =
 			moq_mux::catalog::Producer::new(&mut catalog_broadcast.broadcast().clone(), Default::default()).unwrap();
 		let mut config = video_rendition();
 		config.broadcast = Some(moq_net::path::Relative::new("./left").unwrap());
 		config.track = Some("encoded".into());
 		catalog.modify().unwrap().video.renditions.insert("view".into(), config);
-		catalog_broadcast.announce(Default::default()).unwrap();
-		left.announce(Default::default()).unwrap();
-		right.announce(Default::default()).unwrap();
+		catalog_broadcast.announce().unwrap();
+		left.announce().unwrap();
+		right.announce().unwrap();
 		let (stopping, shutdown) = watch::channel(false);
 		let consumer = origin.consume();
 		let weak = element.downgrade();
@@ -3686,7 +3692,7 @@ mod session_tests {
 
 	/// A broadcast with one video rendition, and what feeds it.
 	struct Publisher {
-		publication: Option<moq_net::origin::Publication>,
+		route: Option<moq_net::origin::Route>,
 		broadcast: moq_net::broadcast::Producer,
 		catalog: moq_mux::catalog::Producer,
 		video: moq_mux::container::Producer<moq_mux::catalog::hang::Container>,
@@ -3696,21 +3702,32 @@ mod session_tests {
 	}
 
 	impl Publisher {
-		/// Publish at `room` on `origin` under `route`.
-		fn new(origin: &moq_net::origin::Producer, route: moq_net::origin::Route, config: VideoConfig) -> Self {
-			let publication = origin.create_broadcast("room").unwrap();
-			let mut publisher = Self::build(publication.broadcast().clone(), config);
-			publication.announce(route).unwrap();
-			publisher.publication = Some(publication);
-			publisher
-		}
-
-		/// The `cam` broadcast a rendition of `room` references as `./cam`, under `route`.
-		fn sibling(origin: &moq_net::origin::Producer, route: moq_net::origin::Route) -> Self {
-			let publication = origin.create_broadcast("cam").unwrap();
-			let mut publisher = Self::build(publication.broadcast().clone(), video_rendition());
-			publication.announce(route).unwrap();
-			publisher.publication = Some(publication);
+		/// Publish at `room` on `origin` under `instance`, or a fresh one.
+		fn new(origin: &moq_net::origin::Producer, instance: Option<moq_net::Instance>, config: VideoConfig) -> Self {
+			Self::routed(origin, "room", instance, config)
+		}
+
+		/// The `cam` broadcast a rendition of `room` references as `./cam`, under `instance`, or
+		/// a fresh one.
+		fn sibling(origin: &moq_net::origin::Producer, instance: Option<moq_net::Instance>) -> Self {
+			Self::routed(origin, "cam", instance, video_rendition())
+		}
+
+		/// Announce `path` once its catalog is built.
+		fn routed(
+			origin: &moq_net::origin::Producer,
+			path: &str,
+			instance: Option<moq_net::Instance>,
+			config: VideoConfig,
+		) -> Self {
+			let options = match instance {
+				Some(instance) => moq_net::origin::RouteOptions::hidden().with_instance(instance, 0),
+				None => moq_net::origin::RouteOptions::hidden(),
+			};
+			let route = origin.route(path, options).unwrap();
+			let mut publisher = Self::build(route.broadcast().clone(), config);
+			route.announce().unwrap();
+			publisher.route = Some(route);
 			publisher
 		}
 
@@ -3730,7 +3747,7 @@ mod session_tests {
 				moq_mux::catalog::hang::Container::Legacy(moq_mux::container::Kind::Video),
 			);
 			Self {
-				publication: None,
+				route: None,
 				broadcast,
 				catalog,
 				video,
@@ -4184,17 +4201,17 @@ mod session_tests {
 
 	/// A publisher restarted while the old one stays up switches at once, on the same pad, and
 	/// nothing more from the old broadcast gets through.
-	fn restart(route: impl Fn() -> moq_net::origin::Route) {
+	fn restart() {
 		let _pad_ids = pad_ids();
 		let element = element();
 		let recorder = Recorder::attach(&element);
 		let origin = origin();
 
-		let mut old = Publisher::new(&origin, route(), video_rendition());
+		let mut old = Publisher::new(&origin, None, video_rendition());
 		let session = follow(&element, &origin);
 		let pad = recorder.written(&mut old, 1);
 
-		let mut new = Publisher::new(&origin, route(), video_rendition());
+		let mut new = Publisher::new(&origin, None, video_rendition());
 		assert_eq!(recorder.written(&mut new, 2), pad, "the restart moved to another pad");
 
 		// The old broadcast still writes, but nothing reads it any more.
@@ -4216,7 +4233,7 @@ mod session_tests {
 
 	#[test]
 	fn a_restart_switches_on_the_same_pad() {
-		restart(moq_net::origin::Route::default);
+		restart();
 	}
 
 	/// The route serving the path can be a prefix covering it, here the root, and a restart of
@@ -4228,13 +4245,16 @@ mod session_tests {
 		let recorder = Recorder::attach(&element);
 		let origin = origin();
 
-		let claim = origin.requests("").unwrap();
+		let claim = origin
+			.route_prefix("", moq_net::origin::RouteOptions::default())
+			.unwrap();
 		let (answers, answered) = std::sync::mpsc::channel();
 		let handler = super::RUNTIME.spawn(async move {
-			while let Ok(request) = claim.requested_broadcast().await {
-				let prepared = request.prepare().unwrap();
-				let answer = Publisher::build(prepared.broadcast().clone(), video_rendition());
-				prepared.publish().unwrap();
+			while let Some(request) = claim.requested().await {
+				let route = request.route(moq_net::origin::RouteOptions::hidden()).unwrap();
+				let mut answer = Publisher::build(route.broadcast().clone(), video_rendition());
+				route.announce().unwrap();
+				answer.route = Some(route);
 				answers.send(answer).unwrap();
 			}
 		});
@@ -4261,10 +4281,12 @@ mod session_tests {
 		let element = element();
 		let recorder = Recorder::attach(&element);
 		let origin = origin();
-		let pool = origin.requests("").unwrap();
+		let pool = origin
+			.route_prefix("", moq_net::origin::RouteOptions::default())
+			.unwrap();
 		let session = follow(&element, &origin);
 		let pending = super::RUNTIME.block_on(async {
-			kio::clock::timeout(Duration::from_secs(10), pool.requested_broadcast())
+			kio::clock::timeout(Duration::from_secs(10), pool.requested())
 				.await
 				.unwrap()
 				.unwrap()
@@ -4455,19 +4477,18 @@ mod session_tests {
 		let session = follow(&element, &origin);
 		let mut follow = watch(&origin, "cam");
 
-		let route = moq_net::origin::Route::default();
-		let mut first = Publisher::sibling(&origin, route.clone());
+		let mut first = Publisher::sibling(&origin, None);
 		let pad = recorder.written(&mut first, 1);
 		first.video.finish().unwrap();
 		await_finished(&first);
 		await_event(&mut follow, |event| {
 			matches!(event, moq_net::origin::RouteEvent::Start(_))
 		});
-		first.publication.as_ref().unwrap().unannounce();
+		first.route.as_ref().unwrap().withdraw();
 		await_event(&mut follow, |event| {
 			matches!(event, moq_net::origin::RouteEvent::End(_))
 		});
-		first.publication.as_ref().unwrap().announce(route).unwrap();
+		first.route.as_ref().unwrap().announce().unwrap();
 		await_event(&mut follow, |event| {
 			matches!(event, moq_net::origin::RouteEvent::Start(_))
 		});
@@ -4693,12 +4714,12 @@ mod session_tests {
 		let mut room = referencing(&origin, Some(old.clone()));
 		let session = follow(&element, &origin);
 
-		let mut first = Publisher::sibling(&origin, moq_net::origin::Route::default().with_instance(old, 0));
+		let mut first = Publisher::sibling(&origin, Some(old));
 		let pad = recorder.written(&mut first, 1);
 		first.video.finish().unwrap();
 		await_finished(&first);
 
-		let mut second = Publisher::sibling(&origin, moq_net::origin::Route::default().with_instance(new.clone(), 0));
+		let mut second = Publisher::sibling(&origin, Some(new.clone()));
 		room.catalog
 			.modify()
 			.unwrap()
@@ -4743,7 +4764,7 @@ mod session_tests {
 
 		// Each rendition plays the first instance on a pad of its own. Written once, so a second
 		// copy on either pad can only be a replay.
-		let mut first = Publisher::sibling(&origin, moq_net::origin::Route::default().with_instance(pinned, 0));
+		let mut first = Publisher::sibling(&origin, Some(pinned));
 		first.write(1);
 		let played = recorder.wait("1 never reached both renditions", |seen| {
 			let pads = reached(seen, 1);
@@ -4754,7 +4775,7 @@ mod session_tests {
 
 		// Another instance wins the path, which only the unpinned rendition plays, then leaves it
 		// to the pinned one.
-		let mut second = Publisher::sibling(&origin, moq_net::origin::Route::default().with_instance(other, 0));
+		let mut second = Publisher::sibling(&origin, Some(other));
 		let unpinned = recorder.written(&mut second, 2);
 		let pad = played.into_iter().find(|pad| *pad != unpinned).unwrap();
 		let mut follow = watch(&origin, "cam");
@@ -4771,10 +4792,7 @@ mod session_tests {
 			)
 		});
 
-		let mut third = Publisher::sibling(
-			&origin,
-			moq_net::origin::Route::default().with_instance(next.clone(), 0),
-		);
+		let mut third = Publisher::sibling(&origin, Some(next.clone()));
 		room.catalog
 			.modify()
 			.unwrap()
@@ -4892,17 +4910,17 @@ mod session_tests {
 
 	/// A sibling replaced while the old one stays up restarts a reference that names no instance, on
 	/// the same pad, and nothing more from the old instance gets through.
-	fn sibling_restart(route: impl Fn() -> moq_net::origin::Route) {
+	fn sibling_restart() {
 		let _pad_ids = pad_ids();
 		let element = element();
 		let recorder = Recorder::attach(&element);
 		let origin = origin();
 		let _room = referencing(&origin, None);
-		let mut old = Publisher::sibling(&origin, route());
+		let mut old = Publisher::sibling(&origin, None);
 		let session = follow(&element, &origin);
 		let pad = recorder.written(&mut old, 1);
 
-		let mut new = Publisher::sibling(&origin, route());
+		let mut new = Publisher::sibling(&origin, None);
 		assert_eq!(recorder.written(&mut new, 2), pad, "the restart moved to another pad");
 		old.write(1);
 		recorder.written(&mut new, 3);
@@ -4922,7 +4940,7 @@ mod session_tests {
 
 	#[test]
 	fn a_sibling_restart_switches_on_the_same_pad() {
-		sibling_restart(moq_net::origin::Route::default);
+		sibling_restart();
 	}
 
 	/// A reference naming its sibling's instance never reads the instance replacing it: the pad
@@ -4935,7 +4953,7 @@ mod session_tests {
 		let origin = origin();
 		let named = moq_net::Instance::random();
 		let _room = referencing(&origin, Some(named.clone()));
-		let mut old = Publisher::sibling(&origin, moq_net::origin::Route::default().with_instance(named, 0));
+		let mut old = Publisher::sibling(&origin, Some(named));
 		let session = follow(&element, &origin);
 		await_demand(&old, true);
 		let pad = recorder.written(&mut old, 1);
@@ -5047,19 +5065,12 @@ mod session_tests {
 		let element = element();
 		let recorder = Recorder::attach(&element);
 		let origin = origin();
-		let route = moq_net::origin::Route::default();
-
-		let mut publisher = Publisher::new(&origin, route.clone(), video_rendition());
+		let mut publisher = Publisher::new(&origin, None, video_rendition());
 		let mut announced = announced(&origin);
 		let session = follow(&element, &origin);
 		recorder.written(&mut publisher, 1);
 
-		publisher
-			.publication
-			.as_ref()
-			.unwrap()
-			.announce(route.with_cost(5))
-			.unwrap();
+		publisher.route.as_ref().unwrap().set_cost(5).unwrap();
 		await_event(&mut announced, |event| {
 			matches!(event, moq_net::origin::RouteEvent::Update(_))
 		});
@@ -5274,7 +5285,7 @@ mod session_tests {
 		let session = follow(&element, &origin);
 		let pad = recorder.written(&mut old, 1);
 
-		old.publication.as_ref().unwrap().unannounce();
+		old.route.as_ref().unwrap().withdraw();
 		await_event(&mut announced, |event| {
 			matches!(event, moq_net::origin::RouteEvent::End(_))
 		});
@@ -5307,8 +5318,7 @@ mod session_tests {
 		let pad = recorder.written(&mut current, 1);
 		for round in 0..4u8 {
 			let tag = 2 + round * 3;
-			let route = moq_net::origin::Route::default();
-			let mut next = Publisher::new(&origin, route.clone(), video_rendition());
+			let mut next = Publisher::new(&origin, None, video_rendition());
 			assert_eq!(
 				recorder.written(&mut next, tag),
 				pad,
@@ -5327,12 +5337,12 @@ mod session_tests {
 			);
 
 			let mut announced = announced(&origin);
-			let publication = next.publication.as_ref().unwrap();
-			publication.unannounce();
+			let route = next.route.as_ref().unwrap();
+			route.withdraw();
 			await_event(&mut announced, |event| {
 				matches!(event, moq_net::origin::RouteEvent::End(_))
 			});
-			publication.announce(route).unwrap();
+			route.announce().unwrap();
 			assert_eq!(
 				recorder.written(&mut next, tag + 2),
 				pad,
@@ -5350,8 +5360,7 @@ mod session_tests {
 	fn a_refused_catalog_fails_the_session() {
 		let element = element();
 		let origin = origin();
-		let broadcast = origin.create_broadcast("room").unwrap();
-		broadcast.announce(Default::default()).unwrap();
+		let _route = origin.route("room", moq_net::origin::RouteOptions::default()).unwrap();
 
 		let (_shutdown, session) = follow(&element, &origin);
 		let err = super::RUNTIME
diff --git a/rs/moq-hls/benches/include.rs b/rs/moq-hls/benches/include.rs
index 7ca1990666a..5285afa213f 100644
--- a/rs/moq-hls/benches/include.rs
+++ b/rs/moq-hls/benches/include.rs
@@ -10,7 +10,7 @@ use moq_hls::{Server, export::Route};
 use moq_mux::catalog::hang::Catalog;
 
 fn publish_catalog(
-	broadcast: &moq_net::origin::Publication,
+	broadcast: &moq_net::broadcast::Producer,
 	catalog: &Catalog,
 ) -> moq_json::snapshot::Producer<Catalog> {
 	let track = broadcast
@@ -42,7 +42,12 @@ fn include(c: &mut Criterion) {
 					let id = format!("c{index}");
 					let instance = moq_net::Instance::random();
 					first.get_or_insert(instance.clone());
-					let broadcast = origin.create_broadcast(format!("room/{id}")).unwrap();
+					let route = origin
+						.route(
+							format!("room/{id}"),
+							moq_net::origin::RouteOptions::hidden().with_instance(instance, 0),
+						)
+						.unwrap();
 					let mut catalog = Catalog::default();
 					catalog.media = root.media;
 					for rendition in 0..renditions {
@@ -51,23 +56,24 @@ fn include(c: &mut Criterion) {
 						video.coded_height = Some(240);
 						catalog.video.renditions.insert(format!("v{rendition}"), video);
 					}
-					catalogs.push(publish_catalog(&broadcast, &catalog));
-					broadcast
-						.announce(moq_net::origin::Route::default().with_instance(instance, 0))
-						.unwrap();
-					publications.push(broadcast);
+					catalogs.push(publish_catalog(route.broadcast(), &catalog));
+					route.announce().unwrap();
+					publications.push(route);
 					root.include.insert(
 						id.clone(),
 						Include::new(moq_net::path::Relative::new(&format!("./{id}")).unwrap()),
 					);
 				}
 				let parent = moq_net::Instance::random();
-				let broadcast = origin.create_broadcast("room/live").unwrap();
-				catalogs.push(publish_catalog(&broadcast, &root));
-				broadcast
-					.announce(moq_net::origin::Route::default().with_instance(parent.clone(), 0))
+				let route = origin
+					.route(
+						"room/live",
+						moq_net::origin::RouteOptions::hidden().with_instance(parent.clone(), 0),
+					)
 					.unwrap();
-				publications.push(broadcast);
+				catalogs.push(publish_catalog(route.broadcast(), &root));
+				route.announce().unwrap();
+				publications.push(route);
 				let server = Server::new(origin.consume(), Default::default()).unwrap();
 				let broadcaster = server.broadcaster("room/live").await.unwrap();
 				kio::clock::timeout(Duration::from_secs(5), async {
diff --git a/rs/moq-hls/src/export/archive_tests.rs b/rs/moq-hls/src/export/archive_tests.rs
index fac89851afe..660321f85b7 100644
--- a/rs/moq-hls/src/export/archive_tests.rs
+++ b/rs/moq-hls/src/export/archive_tests.rs
@@ -232,13 +232,13 @@ impl Replay {
 	async fn open(store: &Store<Counting>, cache: u64) -> Self {
 		let (origin, driver) = moq_net::origin::Producer::new(moq_net::origin::Config::default());
 		let driver = tokio::spawn(moq_net::time::run(driver));
-		let broadcast = origin.create_broadcast("rec").unwrap();
+		let broadcast = origin.route("rec", moq_net::origin::RouteOptions::hidden()).unwrap();
 		let serving = moq_archive::consumer::Config::default().with_cache(cache);
 		let consumer = moq_archive::Consumer::open(store.clone(), broadcast.broadcast().clone(), serving)
 			.await
 			.unwrap();
 		let consumer = tokio::spawn(consumer.run());
-		broadcast.announce(Default::default()).unwrap();
+		broadcast.announce().unwrap();
 
 		let broadcaster = Broadcaster::spawned(crate::resolved(&origin, "rec").await, Config::default());
 		kio::clock::timeout(Duration::from_secs(5), broadcaster.ready())
diff --git a/rs/moq-hls/src/export/include.rs b/rs/moq-hls/src/export/include.rs
index 6cdcfae29a1..d961725af61 100644
--- a/rs/moq-hls/src/export/include.rs
+++ b/rs/moq-hls/src/export/include.rs
@@ -304,7 +304,7 @@ mod tests {
 	#[tokio::test(start_paused = true)]
 	async fn a_sync_after_clear_adds_nothing() {
 		let origin = moq_tokio::origin::spawn();
-		let _parent = origin.publish("room/live", Default::default()).unwrap();
+		let _parent = origin.route("room/live", Default::default()).unwrap();
 		let source = crate::resolved(&origin, "room/live").await;
 		let mut catalog = Catalog::default();
 		catalog.include.insert(
@@ -322,12 +322,12 @@ mod tests {
 	#[tokio::test(start_paused = true)]
 	async fn a_cold_lookup_waits_for_the_first_follow_event() {
 		let origin = moq_tokio::origin::spawn();
-		let _parent = origin.publish("room/live", Default::default()).unwrap();
+		let _parent = origin.route("room/live", Default::default()).unwrap();
 		let child_id = moq_net::Instance::random();
 		let child = origin
-			.publish(
+			.route(
 				"room/child",
-				moq_net::origin::Route::default().with_instance(child_id.clone(), 0),
+				moq_net::origin::RouteOptions::default().with_instance(child_id.clone(), 0),
 			)
 			.unwrap();
 		let source = crate::resolved(&origin, "room/live").await;
@@ -338,6 +338,7 @@ mod tests {
 		video.coded_height = Some(240);
 		catalog.video.renditions.insert("v".into(), video);
 		let track = child
+			.broadcast()
 			.create_track(hang::Catalog::DEFAULT_NAME, hang::Catalog::default_track_info())
 			.unwrap();
 		let mut json = moq_json::snapshot::Producer::new(track, Default::default());
diff --git a/rs/moq-hls/src/export/mod.rs b/rs/moq-hls/src/export/mod.rs
index 3cf54874fc5..7328aa51913 100644
--- a/rs/moq-hls/src/export/mod.rs
+++ b/rs/moq-hls/src/export/mod.rs
@@ -885,8 +885,9 @@ mod tests {
 	#[tokio::test]
 	async fn escaping_broadcast_reference_is_not_advertised() {
 		let origin = produce_origin();
-		let _broadcast = origin.create_broadcast("a/pub").expect("publish allowed");
-		_broadcast.announce(Default::default()).expect("publish allowed");
+		let _broadcast = origin
+			.route("a/pub", moq_net::origin::RouteOptions::default())
+			.expect("publish allowed");
 		settle().await;
 		let upstream = crate::resolved(&origin, "a/pub").await;
 		let mut config = hang::catalog::VideoConfig::new(hang::catalog::VideoCodec::VP8);
@@ -942,8 +943,9 @@ mod tests {
 	#[tokio::test]
 	async fn renditions_wait_for_the_join_interval() {
 		let origin = produce_origin();
-		let broadcast = origin.create_broadcast("live").expect("publish allowed");
-		broadcast.announce(Default::default()).expect("publish allowed");
+		let broadcast = origin
+			.route("live", moq_net::origin::RouteOptions::default())
+			.expect("publish allowed");
 		settle().await;
 		let upstream = crate::resolved(&origin, "live").await;
 
@@ -974,10 +976,12 @@ mod tests {
 	#[tokio::test]
 	async fn a_held_track_follows_its_rendition() {
 		let origin = produce_origin();
-		let broadcast = origin.create_broadcast("live").expect("publish allowed");
-		broadcast.announce(Default::default()).expect("publish allowed");
-		let first = broadcast.create_track("first", timed()).unwrap();
-		let second = broadcast.create_track("second", timed()).unwrap();
+		let broadcast = origin
+			.route("live", moq_net::origin::RouteOptions::hidden())
+			.expect("publish allowed");
+		broadcast.announce().expect("publish allowed");
+		let first = broadcast.broadcast().create_track("first", timed()).unwrap();
+		let second = broadcast.broadcast().create_track("second", timed()).unwrap();
 		settle().await;
 		let upstream = crate::resolved(&origin, "live").await;
 
@@ -1023,8 +1027,9 @@ mod tests {
 	#[tokio::test]
 	async fn estimate_only_catalog_update_keeps_the_rendition() {
 		let origin = produce_origin();
-		let _broadcast = origin.create_broadcast("live").expect("publish allowed");
-		_broadcast.announce(Default::default()).expect("publish allowed");
+		let _broadcast = origin
+			.route("live", moq_net::origin::RouteOptions::default())
+			.expect("publish allowed");
 		settle().await;
 		let upstream = empty_upstream(&origin, "live").await;
 
@@ -1092,8 +1097,9 @@ mod tests {
 	#[tokio::test]
 	async fn estimated_framerate_keeps_the_rendition() {
 		let origin = produce_origin();
-		let _broadcast = origin.create_broadcast("live").expect("publish allowed");
-		_broadcast.announce(Default::default()).expect("publish allowed");
+		let _broadcast = origin
+			.route("live", moq_net::origin::RouteOptions::default())
+			.expect("publish allowed");
 		settle().await;
 		let upstream = empty_upstream(&origin, "live").await;
 
@@ -1121,8 +1127,9 @@ mod tests {
 	#[tokio::test]
 	async fn estimate_before_first_init_reaches_aac_descriptor() {
 		let origin = produce_origin();
-		let _broadcast = origin.create_broadcast("live").expect("publish allowed");
-		_broadcast.announce(Default::default()).expect("publish allowed");
+		let _broadcast = origin
+			.route("live", moq_net::origin::RouteOptions::default())
+			.expect("publish allowed");
 		settle().await;
 		let upstream = empty_upstream(&origin, "live").await;
 
@@ -1154,8 +1161,9 @@ mod tests {
 	#[tokio::test]
 	async fn decoder_config_change_rebuilds_the_rendition() {
 		let origin = produce_origin();
-		let _broadcast = origin.create_broadcast("live").expect("publish allowed");
-		_broadcast.announce(Default::default()).expect("publish allowed");
+		let _broadcast = origin
+			.route("live", moq_net::origin::RouteOptions::default())
+			.expect("publish allowed");
 		settle().await;
 		let upstream = empty_upstream(&origin, "live").await;
 
@@ -1196,8 +1204,9 @@ mod tests {
 	#[tokio::test]
 	async fn replaced_renditions_are_not_held() {
 		let origin = produce_origin();
-		let _broadcast = origin.create_broadcast("live").expect("publish allowed");
-		_broadcast.announce(Default::default()).expect("publish allowed");
+		let _broadcast = origin
+			.route("live", moq_net::origin::RouteOptions::default())
+			.expect("publish allowed");
 		settle().await;
 		let upstream = empty_upstream(&origin, "live").await;
 
@@ -1217,11 +1226,12 @@ mod tests {
 	#[tokio::test]
 	async fn master_lists_only_playable_renditions() {
 		let origin = produce_origin();
-		let broadcast = origin.create_broadcast("live").expect("publish allowed");
-		broadcast.announce(Default::default()).expect("publish allowed");
+		let broadcast = origin
+			.route("live", moq_net::origin::RouteOptions::default())
+			.expect("publish allowed");
 		settle().await;
 		let catalog = hls_catalog(&mut broadcast.broadcast().clone());
-		let mut media = video(&catalog, &broadcast, "video0", video_config());
+		let mut media = video(&catalog, broadcast.broadcast(), "video0", video_config());
 
 		let broadcaster = Broadcaster::spawned(crate::resolved(&origin, "live").await, Config::default());
 		let rendition = kio::clock::timeout(Duration::from_secs(5), async {
@@ -1268,8 +1278,7 @@ mod tests {
 		// A video and an audio rendition can't share a name, so the refused names split.
 		let refused = [(Kind::Video, ""), (Kind::Video, "."), (Kind::Audio, "..")];
 		let origin = produce_origin();
-		let broadcast = origin.create_broadcast("live").unwrap();
-		broadcast.announce(Default::default()).unwrap();
+		let broadcast = origin.route("live", moq_net::origin::RouteOptions::default()).unwrap();
 		settle().await;
 		let mut catalog =
 			moq_mux::catalog::Producer::new(&mut broadcast.broadcast().clone(), Default::default()).unwrap();
@@ -1291,7 +1300,7 @@ mod tests {
 			.unwrap();
 		// Only the servable rendition is ever read.
 		let mut video0 = Gops {
-			track: broadcast.create_track("video0", timed()).unwrap(),
+			track: broadcast.broadcast().create_track("video0", timed()).unwrap(),
 		};
 		for sequence in 0..4 {
 			video0.gop(sequence);
@@ -1320,11 +1329,12 @@ mod tests {
 	#[tokio::test(start_paused = true)]
 	async fn a_disabled_rendition_leaves_the_master_and_keeps_its_playlist() {
 		let origin = produce_origin();
-		let broadcast = origin.create_broadcast("live").expect("publish allowed");
-		broadcast.announce(Default::default()).expect("publish allowed");
+		let broadcast = origin
+			.route("live", moq_net::origin::RouteOptions::default())
+			.expect("publish allowed");
 		settle().await;
 		let catalog = hls_catalog(&mut broadcast.broadcast().clone());
-		let mut media = video(&catalog, &broadcast, "video0", video_config());
+		let mut media = video(&catalog, broadcast.broadcast(), "video0", video_config());
 		for i in 0..3 {
 			media.write(vp8_frame(i * 2_000_000, true)).unwrap();
 		}
@@ -1400,9 +1410,11 @@ mod tests {
 	#[tokio::test(start_paused = true)]
 	async fn a_transmuxed_segment_keeps_its_init_with_an_unfinished_tail() {
 		let origin = produce_origin();
-		let broadcast = origin.create_broadcast("live").expect("publish allowed");
+		let broadcast = origin
+			.route("live", moq_net::origin::RouteOptions::hidden())
+			.expect("publish allowed");
 		let (_catalog, _media) = publish_vp8(&mut broadcast.broadcast().clone(), inline_vp8());
-		broadcast.announce(moq_net::origin::Route::default()).unwrap();
+		broadcast.announce().unwrap();
 		settle().await;
 		let broadcaster = Broadcaster::spawned(crate::resolved(&origin, "live").await, Config::default());
 		broadcaster.ready().await;
@@ -1425,7 +1437,7 @@ mod tests {
 	async fn a_blocked_init_bootstrap_does_not_hide_a_cached_init() {
 		let (origin, broadcast, _catalog, _video0) = inline_pair("video1").await;
 		// At first only segment 0 is listed, while its group is still open.
-		let (media, open) = open_tail(&broadcast, "video1", 0);
+		let (media, open) = open_tail(broadcast.broadcast(), "video1", 0);
 
 		let broadcaster = Broadcaster::spawned(crate::resolved(&origin, "live").await, Config::default());
 		broadcaster.ready().await;
@@ -1467,13 +1479,12 @@ mod tests {
 		inline: &str,
 	) -> (
 		moq_net::origin::Producer,
-		moq_net::origin::Publication,
+		moq_net::origin::Route,
 		moq_mux::catalog::Producer,
 		Gops,
 	) {
 		let origin = produce_origin();
-		let broadcast = origin.create_broadcast("live").unwrap();
-		broadcast.announce(Default::default()).unwrap();
+		let broadcast = origin.route("live", moq_net::origin::RouteOptions::default()).unwrap();
 		settle().await;
 		let mut catalog =
 			moq_mux::catalog::Producer::new(&mut broadcast.broadcast().clone(), Default::default()).unwrap();
@@ -1488,7 +1499,7 @@ mod tests {
 			.unwrap();
 		let other = if inline == "video0" { "video1" } else { "video0" };
 		let other = Gops {
-			track: broadcast.create_track(other, timed()).unwrap(),
+			track: broadcast.broadcast().create_track(other, timed()).unwrap(),
 		};
 		(origin, broadcast, catalog, other)
 	}
@@ -1497,7 +1508,7 @@ mod tests {
 	/// segments.
 	async fn inline_sibling() -> (
 		moq_net::origin::Producer,
-		moq_net::origin::Publication,
+		moq_net::origin::Route,
 		moq_mux::catalog::Producer,
 		Gops,
 	) {
@@ -1565,7 +1576,7 @@ mod tests {
 	#[tokio::test(start_paused = true)]
 	async fn an_init_bootstraps_from_a_complete_group() {
 		let (origin, broadcast, _catalog, _video0) = inline_sibling().await;
-		let media = broadcast.create_track("video1", timed()).unwrap();
+		let media = broadcast.broadcast().create_track("video1", timed()).unwrap();
 		for sequence in 0..3 {
 			let mut group = media.create_group(sequence.into()).unwrap();
 			write_keyframe(&mut group, sequence);
@@ -1587,7 +1598,7 @@ mod tests {
 	#[tokio::test(start_paused = true)]
 	async fn a_stuck_init_leaves_the_manifest_to_its_siblings() {
 		let (origin, broadcast, _catalog, _video0) = inline_sibling().await;
-		let (_media, mut open) = open_tail(&broadcast, "video1", 3);
+		let (_media, mut open) = open_tail(broadcast.broadcast(), "video1", 3);
 
 		let broadcaster = Broadcaster::spawned(crate::resolved(&origin, "live").await, Config::default());
 		broadcaster.advertised().await;
@@ -1614,8 +1625,7 @@ mod tests {
 	#[tokio::test(start_paused = true)]
 	async fn a_failed_rendition_waits_for_a_sibling_init() {
 		let origin = produce_origin();
-		let broadcast = origin.create_broadcast("live").unwrap();
-		broadcast.announce(Default::default()).unwrap();
+		let broadcast = origin.route("live", moq_net::origin::RouteOptions::default()).unwrap();
 		settle().await;
 		let mut catalog =
 			moq_mux::catalog::Producer::new(&mut broadcast.broadcast().clone(), Default::default()).unwrap();
@@ -1629,13 +1639,13 @@ mod tests {
 			})
 			.unwrap();
 		let mut video0 = Gops {
-			track: broadcast.create_track("video0", timed()).unwrap(),
+			track: broadcast.broadcast().create_track("video0", timed()).unwrap(),
 		};
 		for sequence in 0..4 {
 			video0.gop(sequence);
 		}
 		// video1's only cached group is still open, so its init build parks on it.
-		let (video1, mut open) = open_tail(&broadcast, "video1", 3);
+		let (video1, mut open) = open_tail(broadcast.broadcast(), "video1", 3);
 
 		let broadcaster = Broadcaster::spawned(crate::resolved(&origin, "live").await, Config::default());
 		broadcaster.advertised().await;
@@ -1666,7 +1676,7 @@ mod tests {
 	#[tokio::test(start_paused = true)]
 	async fn a_stuck_init_build_never_outlives_its_rendition() {
 		let (origin, broadcast, _catalog, _video0) = inline_sibling().await;
-		let (_media, open) = open_tail(&broadcast, "video1", 3);
+		let (_media, open) = open_tail(broadcast.broadcast(), "video1", 3);
 
 		let broadcaster = Broadcaster::spawned(crate::resolved(&origin, "live").await, Config::default());
 		broadcaster.advertised().await;
@@ -1689,7 +1699,7 @@ mod tests {
 	#[tokio::test(start_paused = true)]
 	async fn a_manifest_renders_off_the_runtime() {
 		let (origin, broadcast, _catalog, _video0) = inline_sibling().await;
-		let (_media, open) = open_tail(&broadcast, "video1", 3);
+		let (_media, open) = open_tail(broadcast.broadcast(), "video1", 3);
 
 		let broadcaster = Broadcaster::spawned(crate::resolved(&origin, "live").await, Config::default());
 		broadcaster.advertised().await;
@@ -1709,7 +1719,7 @@ mod tests {
 	#[tokio::test(start_paused = true)]
 	async fn a_new_generation_releases_a_stuck_init_build() {
 		let (origin, broadcast, _catalog, _video0) = inline_sibling().await;
-		let (_media, open) = open_tail(&broadcast, "video1", 3);
+		let (_media, open) = open_tail(broadcast.broadcast(), "video1", 3);
 
 		let broadcaster = Broadcaster::spawned(crate::resolved(&origin, "live").await, Config::default());
 		broadcaster.advertised().await;
@@ -1732,7 +1742,7 @@ mod tests {
 	#[tokio::test(start_paused = true)]
 	async fn an_ended_manifest_stays_dynamic_while_an_init_builds() {
 		let (origin, broadcast, mut catalog, mut video0) = inline_sibling().await;
-		let (media, mut open) = open_tail(&broadcast, "video1", 3);
+		let (media, mut open) = open_tail(broadcast.broadcast(), "video1", 3);
 
 		let broadcaster = Broadcaster::spawned(crate::resolved(&origin, "live").await, Config::default());
 		broadcaster.advertised().await;
@@ -1766,7 +1776,7 @@ mod tests {
 		// it lists nothing.
 		let (origin, broadcast, mut catalog, _video1) = inline_pair("video0").await;
 		// Its earlier groups already left the cache, so the open one is the only candidate.
-		let (_media, mut open) = open_tail(&broadcast, "video0", 1);
+		let (_media, mut open) = open_tail(broadcast.broadcast(), "video0", 1);
 
 		let broadcaster = Broadcaster::spawned(crate::resolved(&origin, "live").await, Config::default());
 		let _ = kio::clock::timeout(Duration::from_secs(5), broadcaster.ready()).await;
@@ -1792,7 +1802,7 @@ mod tests {
 	#[tokio::test(start_paused = true)]
 	async fn the_first_video_wait_builds_an_init_listed_while_waiting() {
 		let (origin, broadcast, _catalog, _video1) = inline_pair("video0").await;
-		let media = broadcast.create_track("video0", timed()).unwrap();
+		let media = broadcast.broadcast().create_track("video0", timed()).unwrap();
 
 		let broadcaster = Broadcaster::spawned(crate::resolved(&origin, "live").await, Config::default());
 		while broadcaster.rendition(Kind::Video, "video0").is_none() {
@@ -1823,7 +1833,7 @@ mod tests {
 		catalog
 			.mutate(|catalog| catalog.video.renditions.get_mut("video1").unwrap().enabled = false)
 			.unwrap();
-		let media = broadcast.create_track("video1", timed()).unwrap();
+		let media = broadcast.broadcast().create_track("video1", timed()).unwrap();
 		for sequence in 0..4 {
 			let mut group = media.create_group(sequence.into()).unwrap();
 			write_keyframe(&mut group, sequence);
@@ -1856,8 +1866,9 @@ mod tests {
 	#[tokio::test]
 	async fn a_reconfigure_versions_the_init_url() {
 		let origin = produce_origin();
-		let broadcast = origin.create_broadcast("live").expect("publish allowed");
-		broadcast.announce(Default::default()).expect("publish allowed");
+		let broadcast = origin
+			.route("live", moq_net::origin::RouteOptions::default())
+			.expect("publish allowed");
 		settle().await;
 		let (_catalog, mut media) = publish_vp8(&mut broadcast.broadcast().clone(), video_config());
 
@@ -1916,8 +1927,9 @@ mod tests {
 	#[tokio::test(start_paused = true)]
 	async fn the_driver_finishes_with_its_owners() {
 		let origin = produce_origin();
-		let broadcast = origin.create_broadcast("live").expect("publish allowed");
-		broadcast.announce(Default::default()).expect("publish allowed");
+		let broadcast = origin
+			.route("live", moq_net::origin::RouteOptions::default())
+			.expect("publish allowed");
 		settle().await;
 		let (_catalog, mut media) = publish_vp8(&mut broadcast.broadcast().clone(), video_config());
 
@@ -1959,8 +1971,9 @@ mod tests {
 	#[tokio::test]
 	async fn a_generation_versions_segment_urls_and_a_new_one_resets_the_window() {
 		let origin = produce_origin();
-		let broadcast = origin.create_broadcast("live").expect("publish allowed");
-		broadcast.announce(Default::default()).expect("publish allowed");
+		let broadcast = origin
+			.route("live", moq_net::origin::RouteOptions::default())
+			.expect("publish allowed");
 		settle().await;
 		let (_catalog, mut media) = publish_vp8(&mut broadcast.broadcast().clone(), video_config());
 
@@ -2017,8 +2030,9 @@ mod tests {
 	#[tokio::test]
 	async fn a_replaced_instance_keeps_its_generation() {
 		let origin = produce_origin();
-		let broadcast = origin.create_broadcast("live").expect("publish allowed");
-		broadcast.announce(Default::default()).expect("publish allowed");
+		let broadcast = origin
+			.route("live", moq_net::origin::RouteOptions::default())
+			.expect("publish allowed");
 		settle().await;
 		let (_catalog, _media) = publish_vp8(&mut broadcast.broadcast().clone(), video_config());
 
@@ -2041,11 +2055,12 @@ mod tests {
 	#[tokio::test]
 	async fn a_new_generation_rebuilds_an_inline_init() {
 		let origin = produce_origin();
-		let broadcast = origin.create_broadcast("live").expect("publish allowed");
-		broadcast.announce(Default::default()).expect("publish allowed");
+		let broadcast = origin
+			.route("live", moq_net::origin::RouteOptions::default())
+			.expect("publish allowed");
 		settle().await;
 		let catalog = hls_catalog(&mut broadcast.broadcast().clone());
-		let mut media = video(&catalog, &broadcast, "video0", inline_vp8());
+		let mut media = video(&catalog, broadcast.broadcast(), "video0", inline_vp8());
 		for micros in [0, 2_000_000, 4_000_000] {
 			media.write(vp8_frame(micros, true)).unwrap();
 		}
@@ -2079,8 +2094,9 @@ mod tests {
 	#[tokio::test]
 	async fn serves_playlist_and_segments_from_the_media() {
 		let origin = produce_origin();
-		let broadcast = origin.create_broadcast("live").expect("publish allowed");
-		broadcast.announce(Default::default()).expect("publish allowed");
+		let broadcast = origin
+			.route("live", moq_net::origin::RouteOptions::default())
+			.expect("publish allowed");
 		settle().await;
 		// Three GOPs, 2s apart: segments 0 and 1 are complete, segment 2 is the live edge.
 		let (catalog, media) = publish_vp8(&mut broadcast.broadcast().clone(), inline_vp8());
@@ -2142,8 +2158,9 @@ mod tests {
 	#[tokio::test]
 	async fn a_segment_ends_where_its_record_says() {
 		let origin = produce_origin();
-		let broadcast = origin.create_broadcast("live").expect("publish allowed");
-		broadcast.announce(Default::default()).expect("publish allowed");
+		let broadcast = origin
+			.route("live", moq_net::origin::RouteOptions::default())
+			.expect("publish allowed");
 		settle().await;
 		let (catalog, media) = publish_vp8(&mut broadcast.broadcast().clone(), video_config());
 
@@ -2168,8 +2185,9 @@ mod tests {
 	#[tokio::test]
 	async fn a_timed_trailing_sample_keeps_its_duration() {
 		let origin = produce_origin();
-		let broadcast = origin.create_broadcast("live").expect("publish allowed");
-		broadcast.announce(Default::default()).expect("publish allowed");
+		let broadcast = origin
+			.route("live", moq_net::origin::RouteOptions::default())
+			.expect("publish allowed");
 		settle().await;
 		let mut producer = broadcast.broadcast().clone();
 		let catalog = hls_catalog(&mut producer);
@@ -2204,12 +2222,13 @@ mod tests {
 	#[tokio::test]
 	async fn serves_dash_manifest_and_time_addressed_segments() {
 		let origin = produce_origin();
-		let broadcast = origin.create_broadcast("live").expect("publish allowed");
-		broadcast.announce(Default::default()).expect("publish allowed");
+		let broadcast = origin
+			.route("live", moq_net::origin::RouteOptions::default())
+			.expect("publish allowed");
 		settle().await;
 		let catalog = hls_catalog(&mut broadcast.broadcast().clone());
-		let mut video = video(&catalog, &broadcast, "video0", video_config());
-		let mut audio = audio(&catalog, &broadcast, "audio0", opus());
+		let mut video = video(&catalog, broadcast.broadcast(), "video0", video_config());
+		let mut audio = audio(&catalog, broadcast.broadcast(), "audio0", opus());
 
 		// Video keyframes every 2s cut the segments; audio contributes one group per cut.
 		let mut audio_write = |micros: u64| {
@@ -2291,8 +2310,9 @@ mod tests {
 	#[tokio::test]
 	async fn root_clock_times_playlists_and_manifest() {
 		let origin = produce_origin();
-		let broadcast = origin.create_broadcast("live").expect("publish allowed");
-		broadcast.announce(Default::default()).expect("publish allowed");
+		let broadcast = origin
+			.route("live", moq_net::origin::RouteOptions::default())
+			.expect("publish allowed");
 		settle().await;
 
 		// PTS zero at exactly the moq epoch, so every timestamp maps to a fixed string.
@@ -2300,7 +2320,7 @@ mod tests {
 		let config = catalog_config()
 			.with_clock(moq_mux::Clock::at(moq_net::time::Instant::now(), wall).expect("a representable wall"));
 		let catalog = moq_mux::catalog::Producer::new(&mut broadcast.broadcast().clone(), config).unwrap();
-		let mut media = video(&catalog, &broadcast, "video0", video_config());
+		let mut media = video(&catalog, broadcast.broadcast(), "video0", video_config());
 		media.write(frame(0, true)).unwrap();
 		media.write(frame(2_000_000, true)).unwrap();
 		media.write(frame(4_000_000, true)).unwrap(); // live edge
@@ -2335,8 +2355,9 @@ mod tests {
 	#[tokio::test]
 	async fn manifest_falls_back_to_arrival_anchor_without_a_clock() {
 		let origin = produce_origin();
-		let broadcast = origin.create_broadcast("live").expect("publish allowed");
-		broadcast.announce(Default::default()).expect("publish allowed");
+		let broadcast = origin
+			.route("live", moq_net::origin::RouteOptions::default())
+			.expect("publish allowed");
 		settle().await;
 
 		// Write the catalog directly: a moq-mux catalog producer always advertises its clock, as a
@@ -2347,6 +2368,7 @@ mod tests {
 		json.deltas = false;
 		let mut catalog = moq_json::snapshot::Producer::new(
 			broadcast
+				.broadcast()
 				.create_track(hang::Catalog::DEFAULT_NAME, hang::Catalog::default_track_info())
 				.unwrap(),
 			json,
@@ -2355,7 +2377,7 @@ mod tests {
 			.update(moq_net::Timed::from(&snapshot).at(moq_net::Timestamp::now()))
 			.unwrap();
 		let mut media = Gops {
-			track: broadcast.create_track("video0", timed()).unwrap(),
+			track: broadcast.broadcast().create_track("video0", timed()).unwrap(),
 		};
 		for sequence in 0..3 {
 			media.gop(sequence);
@@ -2397,8 +2419,9 @@ mod tests {
 		}
 
 		let origin = produce_origin();
-		let broadcast = origin.create_broadcast("live").expect("publish allowed");
-		broadcast.announce(Default::default()).expect("publish allowed");
+		let broadcast = origin
+			.route("live", moq_net::origin::RouteOptions::default())
+			.expect("publish allowed");
 		settle().await;
 		let catalog = hls_catalog(&mut broadcast.broadcast().clone());
 		let mut import = moq_mux::container::fmp4::Import::new(broadcast.broadcast().clone(), catalog.reserve());
@@ -2512,8 +2535,7 @@ mod tests {
 		} else {
 			None
 		};
-		let broadcast = origin.create_broadcast("live").unwrap();
-		broadcast.announce(Default::default()).unwrap();
+		let broadcast = origin.route("live", moq_net::origin::RouteOptions::default()).unwrap();
 		settle().await;
 		let catalog = hls_catalog(&mut broadcast.broadcast().clone());
 		let mut import = moq_mux::container::fmp4::Import::new(broadcast.broadcast().clone(), catalog.reserve());
@@ -2594,11 +2616,12 @@ mod tests {
 	#[tokio::test]
 	async fn dash_manifest_turns_static_when_finished() {
 		let origin = produce_origin();
-		let broadcast = origin.create_broadcast("live").expect("publish allowed");
-		broadcast.announce(Default::default()).expect("publish allowed");
+		let broadcast = origin
+			.route("live", moq_net::origin::RouteOptions::default())
+			.expect("publish allowed");
 		settle().await;
 		let mut catalog = hls_catalog(&mut broadcast.broadcast().clone());
-		let mut media = video(&catalog, &broadcast, "video0", video_config());
+		let mut media = video(&catalog, broadcast.broadcast(), "video0", video_config());
 		media.write(frame(0, true)).unwrap();
 		media.write(frame(2_000_000, true)).unwrap();
 
@@ -2635,11 +2658,12 @@ mod tests {
 	#[tokio::test]
 	async fn an_audio_only_broadcast_segments_on_its_audio() {
 		let origin = produce_origin();
-		let broadcast = origin.create_broadcast("live").expect("publish allowed");
-		broadcast.announce(Default::default()).expect("publish allowed");
+		let broadcast = origin
+			.route("live", moq_net::origin::RouteOptions::default())
+			.expect("publish allowed");
 		settle().await;
 		let catalog = hls_catalog(&mut broadcast.broadcast().clone());
-		let mut audio = audio(&catalog, &broadcast, "audio0", opus());
+		let mut audio = audio(&catalog, broadcast.broadcast(), "audio0", opus());
 		// 500ms groups pack into the 2s grid.
 		for micros in (0..=6_000_000u64).step_by(500_000) {
 			let keyframe = audio.needs_keyframe();
@@ -2667,12 +2691,13 @@ mod tests {
 	#[tokio::test]
 	async fn audio_and_video_on_one_grid_line_up() {
 		let origin = produce_origin();
-		let broadcast = origin.create_broadcast("live").expect("publish allowed");
-		broadcast.announce(Default::default()).expect("publish allowed");
+		let broadcast = origin
+			.route("live", moq_net::origin::RouteOptions::default())
+			.expect("publish allowed");
 		settle().await;
 		let catalog = hls_catalog(&mut broadcast.broadcast().clone());
-		let mut video = video(&catalog, &broadcast, "video0", video_config());
-		let mut audio = audio(&catalog, &broadcast, "audio0", opus());
+		let mut video = video(&catalog, broadcast.broadcast(), "video0", video_config());
+		let mut audio = audio(&catalog, broadcast.broadcast(), "audio0", opus());
 
 		// Interleaved by pts, as a muxer would demux them: video keyframes every 2s open the
 		// segments; audio publishes a 500ms group each cut.
@@ -2731,12 +2756,13 @@ mod tests {
 	#[tokio::test(start_paused = true)]
 	async fn dropping_the_broadcaster_keeps_a_cursor_drainable() {
 		let origin = produce_origin();
-		let broadcast = origin.create_broadcast("live").expect("publish allowed");
-		broadcast.announce(Default::default()).expect("publish allowed");
+		let broadcast = origin
+			.route("live", moq_net::origin::RouteOptions::default())
+			.expect("publish allowed");
 		settle().await;
 		let mut catalog = hls_catalog(&mut broadcast.broadcast().clone());
 		// Segment 0 is complete, while segment 1 stays open until the publisher finishes.
-		let mut media = video(&catalog, &broadcast, "video0", video_config());
+		let mut media = video(&catalog, broadcast.broadcast(), "video0", video_config());
 		media.write(frame(0, true)).unwrap();
 		media.write(frame(2_000_000, true)).unwrap();
 		media.write(frame(3_000_000, false)).unwrap();
@@ -2823,12 +2849,9 @@ mod tests {
 	/// Finish the media before End while retaining its track cache for a late recorder.
 	async fn ended_rendition(sibling: bool) -> Ended {
 		let origin = produce_origin();
-		let broadcast = origin.create_broadcast("live").unwrap();
-		broadcast.announce(Default::default()).unwrap();
+		let broadcast = origin.route("live", moq_net::origin::RouteOptions::default()).unwrap();
 		let target = if sibling {
-			let target = origin.create_broadcast("media").unwrap();
-			target.announce(Default::default()).unwrap();
-			target
+			origin.route("media", moq_net::origin::RouteOptions::default()).unwrap()
 		} else {
 			broadcast.clone()
 		};
@@ -2846,10 +2869,10 @@ mod tests {
 		assert!(!rendition.snapshot().segments.is_empty());
 		let binding = rendition.poll_media(&kio::Waiter::noop());
 		let bound = binding.broadcast().await.unwrap();
-		target.close();
+		target.broadcast().close();
 		bound.closed().await;
 		assert!(
-			target.consume().track("video0").is_err(),
+			target.broadcast().consume().track("video0").is_err(),
 			"new lookups are refused after End"
 		);
 		Ended {
@@ -2901,10 +2924,12 @@ mod tests {
 		for sibling in [false, true] {
 			let ended = ended_rendition(sibling).await;
 			let path = if sibling { "media" } else { "live" };
-			let next = ended.origin.create_broadcast(path).unwrap();
-			next.announce(Default::default()).unwrap();
+			let next = ended
+				.origin
+				.route(path, moq_net::origin::RouteOptions::default())
+				.unwrap();
 			let mut media = moq_mux::container::Producer::new(
-				next.create_track("video0", timed()).unwrap(),
+				next.broadcast().create_track("video0", timed()).unwrap(),
 				moq_mux::catalog::hang::Container::Legacy(moq_mux::container::Kind::Data),
 			);
 			media.write(payload_frame(0, true, NEW)).unwrap();
@@ -2959,10 +2984,11 @@ mod tests {
 		// carry `payload`, so the two publishers' media differs byte for byte. The returned handle
 		// keeps the publisher alive until it is dropped.
 		fn publish(origin: &moq_net::origin::Producer, payload: &'static [u8]) -> Box<dyn std::any::Any> {
-			let broadcast = origin.create_broadcast("live").expect("publish allowed");
-			broadcast.announce(Default::default()).expect("publish allowed");
+			let broadcast = origin
+				.route("live", moq_net::origin::RouteOptions::default())
+				.expect("publish allowed");
 			let catalog = hls_catalog(&mut broadcast.broadcast().clone());
-			let mut media = video(&catalog, &broadcast, "video0", video_config());
+			let mut media = video(&catalog, broadcast.broadcast(), "video0", video_config());
 			media.write(payload_frame(0, true, payload)).unwrap();
 			media.write(payload_frame(2_000_000, true, payload)).unwrap();
 			media.write(payload_frame(4_000_000, true, payload)).unwrap();
@@ -3031,8 +3057,10 @@ mod tests {
 		const NEW: &[u8] = b"NEWNEWNEWNEWNEWN";
 
 		fn publish_media(origin: &moq_net::origin::Producer, payload: &'static [u8]) -> Box<dyn std::any::Any> {
-			let broadcast = origin.create_broadcast("media").expect("publish allowed");
-			broadcast.announce(Default::default()).expect("publish allowed");
+			let broadcast = origin
+				.route("media", moq_net::origin::RouteOptions::hidden())
+				.expect("publish allowed");
+			broadcast.announce().expect("publish allowed");
 			let media = write_routed_media(&mut broadcast.broadcast().clone(), payload, 0);
 			Box::new((broadcast, media))
 		}
@@ -3040,8 +3068,10 @@ mod tests {
 		let origin = produce_origin();
 
 		// The catalog broadcast carries the catalog; the media lives next door.
-		let live = origin.create_broadcast("live").expect("publish allowed");
-		live.announce(Default::default()).expect("publish allowed");
+		let live = origin
+			.route("live", moq_net::origin::RouteOptions::hidden())
+			.expect("publish allowed");
+		live.announce().expect("publish allowed");
 		let old_media = publish_media(&origin, OLD);
 		settle().await;
 
@@ -3096,18 +3126,6 @@ mod tests {
 		drop((new_media, live));
 	}
 
-	fn hops(ids: &[u64]) -> moq_net::Hops {
-		let mut hops = moq_net::Hops::new();
-		for id in ids {
-			hops.push(moq_net::Hop::new(*id).unwrap()).unwrap();
-		}
-		hops
-	}
-
-	fn sibling_route(first: u64) -> moq_net::origin::Route {
-		moq_net::origin::Route::default().with_hops(hops(&[first]))
-	}
-
 	async fn until_finished(rendition: &Rendition) {
 		let deadline = kio::clock::now() + Duration::from_secs(5);
 		loop {
@@ -3123,7 +3141,7 @@ mod tests {
 	/// the sibling broadcast `media`.
 	struct Sibling {
 		origin: moq_net::origin::Producer,
-		_live: moq_net::origin::Publication,
+		_live: moq_net::origin::Route,
 		upstream: moq_mux::Source,
 		config: hang::catalog::VideoConfig,
 	}
@@ -3131,8 +3149,10 @@ mod tests {
 	impl Sibling {
 		async fn new() -> Self {
 			let origin = produce_origin();
-			let live = origin.create_broadcast("live").expect("publish allowed");
-			live.announce(Default::default()).expect("publish allowed");
+			let live = origin
+				.route("live", moq_net::origin::RouteOptions::hidden())
+				.expect("publish allowed");
+			live.announce().expect("publish allowed");
 			settle().await;
 			let upstream = crate::resolved(&origin, "live").await;
 			let mut config = video_config();
@@ -3151,10 +3171,13 @@ mod tests {
 			payload: &'static [u8],
 			start_micros: u64,
 		) -> (
-			moq_net::origin::Publication,
+			moq_net::origin::Route,
 			moq_mux::container::Producer<moq_mux::catalog::hang::Container>,
 		) {
-			let media = self.origin.create_broadcast("media").unwrap();
+			let media = self
+				.origin
+				.route("media", moq_net::origin::RouteOptions::hidden())
+				.unwrap();
 			let track = write_routed_media(&mut media.broadcast().clone(), payload, start_micros);
 			(media, track)
 		}
@@ -3172,7 +3195,7 @@ mod tests {
 		let (old_media, old_track) = test.media(OLD, 0);
 		settle().await;
 		let (_renditions, rendition) = export(&test.upstream, &test.config);
-		old_media.announce(sibling_route(10)).unwrap();
+		old_media.announce().unwrap();
 		kio::clock::timeout(Duration::from_secs(5), rendition.playable())
 			.await
 			.expect("the media reaches the rendition");
@@ -3200,7 +3223,7 @@ mod tests {
 
 		// A publisher serving the path afterwards is never bound.
 		let (new_media, new_track) = test.media(NEW, 6_000_000);
-		new_media.announce(sibling_route(11)).unwrap();
+		new_media.announce().unwrap();
 		kio::clock::sleep(Duration::from_secs(1)).await;
 		let snapshot = rendition.snapshot();
 		assert_eq!(snapshot.segments.len(), before, "nothing of the replacement is listed");
@@ -3216,7 +3239,7 @@ mod tests {
 
 		let mut test = Sibling::new().await;
 		let (media, _track) = test.media(NEW, 0);
-		media.announce(sibling_route(11)).unwrap();
+		media.announce().unwrap();
 		settle().await;
 
 		let (_renditions, rendition) = export(&test.upstream, &test.config);
@@ -3244,7 +3267,7 @@ mod tests {
 		let (old_media, old_track) = test.media(OLD, 0);
 		settle().await;
 		let (_renditions, rendition) = export(&test.upstream, &test.config);
-		old_media.announce(sibling_route(10)).unwrap();
+		old_media.announce().unwrap();
 		kio::clock::timeout(Duration::from_secs(5), rendition.playable())
 			.await
 			.expect("the media reaches the rendition");
@@ -3256,7 +3279,7 @@ mod tests {
 		assert!(before > 0);
 
 		let (new_media, new_track) = test.media(NEW, 6_000_000);
-		new_media.announce(sibling_route(11)).unwrap();
+		new_media.announce().unwrap();
 		kio::clock::sleep(Duration::from_secs(1)).await;
 		let snapshot = rendition.snapshot();
 		assert_eq!(snapshot.segments.len(), before, "only the old rows remain listed");
@@ -3282,7 +3305,7 @@ mod tests {
 		let (media, track) = test.media(OLD, 0);
 		settle().await;
 		let (_renditions, rendition) = export(&test.upstream, &test.config);
-		media.announce(sibling_route(10)).unwrap();
+		media.announce().unwrap();
 		kio::clock::timeout(Duration::from_secs(5), rendition.playable())
 			.await
 			.expect("the media reaches the rendition");
@@ -3327,7 +3350,7 @@ mod tests {
 			"nothing is listed before the sibling resolves"
 		);
 
-		media.announce(sibling_route(10)).unwrap();
+		media.announce().unwrap();
 		kio::clock::timeout(Duration::from_secs(5), rendition.playable())
 			.await
 			.expect("the sibling's media is listed once it resolves");
@@ -3345,8 +3368,9 @@ mod tests {
 	#[tokio::test]
 	async fn removing_a_rendition_ends_its_segment_cursor() {
 		let origin = produce_origin();
-		let broadcast = origin.create_broadcast("live").expect("publish allowed");
-		broadcast.announce(Default::default()).expect("publish allowed");
+		let broadcast = origin
+			.route("live", moq_net::origin::RouteOptions::default())
+			.expect("publish allowed");
 		settle().await;
 		let upstream = crate::resolved(&origin, "live").await;
 
@@ -3370,11 +3394,12 @@ mod tests {
 	#[tokio::test]
 	async fn dropping_the_broadcaster_releases_its_renditions() {
 		let origin = produce_origin();
-		let broadcast = origin.create_broadcast("live").expect("publish allowed");
-		broadcast.announce(Default::default()).expect("publish allowed");
+		let broadcast = origin
+			.route("live", moq_net::origin::RouteOptions::default())
+			.expect("publish allowed");
 		settle().await;
 		let catalog = hls_catalog(&mut broadcast.broadcast().clone());
-		let mut media = video(&catalog, &broadcast, "video0", video_config());
+		let mut media = video(&catalog, broadcast.broadcast(), "video0", video_config());
 		media.write(frame(0, true)).unwrap();
 		media.write(frame(2_000_000, true)).unwrap();
 
@@ -3414,12 +3439,13 @@ mod tests {
 	#[tokio::test]
 	async fn record_cursors_yield_renditions_and_segments() {
 		let origin = produce_origin();
-		let broadcast = origin.create_broadcast("live").expect("publish allowed");
-		broadcast.announce(Default::default()).expect("publish allowed");
+		let broadcast = origin
+			.route("live", moq_net::origin::RouteOptions::default())
+			.expect("publish allowed");
 		settle().await;
 		let catalog = hls_catalog(&mut broadcast.broadcast().clone());
 		// Segments 0 and 1 are complete; segment 2 is the live edge until the publisher drops.
-		let mut media = video(&catalog, &broadcast, "video0", video_config());
+		let mut media = video(&catalog, broadcast.broadcast(), "video0", video_config());
 		media.write(frame(0, true)).unwrap();
 		media.write(frame(2_000_000, true)).unwrap();
 		media.write(frame(4_000_000, true)).unwrap();
@@ -3459,7 +3485,7 @@ mod tests {
 		// Tear down the publisher. The media ends abruptly, so the cursor fails rather than end
 		// as if the recording were complete.
 		drop((catalog, media));
-		broadcast.close();
+		broadcast.broadcast().close();
 
 		let end = kio::clock::timeout(Duration::from_secs(5), segments.next())
 			.await
@@ -3787,8 +3813,7 @@ mod tests {
 	#[tokio::test(start_paused = true)]
 	async fn a_failed_rendition_leaves_the_manifest_and_master() {
 		let origin = produce_origin();
-		let broadcast = origin.create_broadcast("live").unwrap();
-		broadcast.announce(Default::default()).unwrap();
+		let broadcast = origin.route("live", moq_net::origin::RouteOptions::default()).unwrap();
 		settle().await;
 		let mut catalog =
 			moq_mux::catalog::Producer::new(&mut broadcast.broadcast().clone(), Default::default()).unwrap();
@@ -3801,7 +3826,7 @@ mod tests {
 			})
 			.unwrap();
 		let publish = |name: &str| Gops {
-			track: broadcast.create_track(name, timed()).unwrap(),
+			track: broadcast.broadcast().create_track(name, timed()).unwrap(),
 		};
 		let mut video0 = publish("video0");
 		let mut video1 = publish("video1");
@@ -3946,11 +3971,13 @@ mod tests {
 	#[tokio::test(start_paused = true)]
 	async fn a_discontinuity_marker_lists_no_segment() {
 		let origin = produce_origin();
-		let broadcast = origin.create_broadcast("live").expect("publish allowed");
-		broadcast.announce(Default::default()).expect("publish allowed");
+		let broadcast = origin
+			.route("live", moq_net::origin::RouteOptions::hidden())
+			.expect("publish allowed");
+		broadcast.announce().expect("publish allowed");
 		settle().await;
 		let catalog = hls_catalog(&mut broadcast.broadcast().clone());
-		let mut media = video(&catalog, &broadcast, "video0", video_config());
+		let mut media = video(&catalog, broadcast.broadcast(), "video0", video_config());
 		for micros in [0, 1_000_000, 2_000_000, 3_000_000] {
 			media.write(vp8_frame(micros, micros % 2_000_000 == 0)).unwrap();
 		}
diff --git a/rs/moq-hls/src/export/rendition.rs b/rs/moq-hls/src/export/rendition.rs
index 66b60292dea..39d25a80514 100644
--- a/rs/moq-hls/src/export/rendition.rs
+++ b/rs/moq-hls/src/export/rendition.rs
@@ -2792,16 +2792,20 @@ mod tests {
 	#[tokio::test]
 	async fn pending_reads_preserve_a_later_authorization_refusal() {
 		let origin = moq_tokio::origin::spawn();
-		let broadcast = origin.create_broadcast("room/live").unwrap();
-		let dynamic = origin.requests("room/secret").unwrap();
-		let source = moq_mux::Source::new(origin.consume(), broadcast.consume());
+		let broadcast = origin
+			.route("room/live", moq_net::origin::RouteOptions::hidden())
+			.unwrap();
+		let dynamic = origin
+			.route_prefix("room/secret", moq_net::origin::RouteOptions::default())
+			.unwrap();
+		let source = moq_mux::Source::new(origin.consume(), broadcast.broadcast().consume());
 		let mut config = VideoConfig::new(hang::catalog::VideoCodec::VP8);
 		config.broadcast = Some(moq_net::path::Relative::new("./secret").unwrap());
 		let renditions = renditions::Producer::spawned(Duration::from_secs(30));
 		let rendition = Arc::new(
 			Rendition::video("video".into(), &config, &source, interval(), None, renditions.fanout()).unwrap(),
 		);
-		let request = dynamic.requested_broadcast().await.unwrap();
+		let request = dynamic.requested().await.unwrap();
 		let row = segments::Row {
 			index: 0,
 			segment: 0,
@@ -2939,8 +2943,10 @@ mod tests {
 	#[test]
 	fn a_gone_publisher_is_unservable_and_an_ietf_miss_is_not() {
 		let origin = produce_origin();
-		let producer = origin.create_broadcast("live").expect("publish allowed");
-		let live = producer.consume();
+		let producer = origin
+			.route("live", moq_net::origin::RouteOptions::hidden())
+			.expect("publish allowed");
+		let live = producer.broadcast().consume();
 		let ietf_miss = over_ietf_miss();
 		assert!(
 			!is_gone_publisher(&ietf_miss, &live),
@@ -2963,8 +2969,8 @@ mod tests {
 	#[tokio::test(start_paused = true)]
 	async fn a_refusal_wait_wakes_on_a_media_failure() {
 		let origin = moq_tokio::origin::spawn();
-		let broadcast = origin.create_broadcast("live").unwrap();
-		let source = moq_mux::Source::new(origin.consume(), broadcast.consume());
+		let broadcast = origin.route("live", moq_net::origin::RouteOptions::hidden()).unwrap();
+		let source = moq_mux::Source::new(origin.consume(), broadcast.broadcast().consume());
 		let config = VideoConfig::new(hang::catalog::VideoCodec::VP8);
 		let renditions = renditions::Producer::spawned(Duration::from_secs(30));
 		let rendition = Arc::new(
diff --git a/rs/moq-hls/src/server/include_tests.rs b/rs/moq-hls/src/server/include_tests.rs
index 9eb3841ab26..0a96fd3a833 100644
--- a/rs/moq-hls/src/server/include_tests.rs
+++ b/rs/moq-hls/src/server/include_tests.rs
@@ -10,7 +10,7 @@ use tower::ServiceExt;
 use super::Server;
 
 struct Published {
-	publication: moq_net::origin::Publication,
+	route: moq_net::origin::Route,
 	catalog: moq_json::snapshot::Producer<Catalog>,
 	video: track::Producer,
 	audio: track::Producer,
@@ -31,7 +31,13 @@ fn catalog() -> Catalog {
 }
 
 fn publish(origin: &moq_net::origin::Producer, path: &str, instance: &Instance, value: &Catalog) -> Published {
-	let publication = origin.create_broadcast(path).unwrap();
+	let route = origin
+		.route(
+			path,
+			moq_net::origin::RouteOptions::hidden().with_instance(instance.clone(), 0),
+		)
+		.unwrap();
+	let publication = route.broadcast();
 	let track = publication
 		.create_track(hang::Catalog::DEFAULT_NAME, hang::Catalog::default_track_info())
 		.unwrap();
@@ -44,11 +50,9 @@ fn publish(origin: &moq_net::origin::Producer, path: &str, instance: &Instance,
 	let audio = publication
 		.create_track("audio", hang::container::track_info(2))
 		.unwrap();
-	publication
-		.announce(moq_net::origin::Route::default().with_instance(instance.clone(), 0))
-		.unwrap();
+	route.announce().unwrap();
 	Published {
-		publication,
+		route,
 		catalog,
 		video,
 		audio,
@@ -153,7 +157,8 @@ async fn an_idle_predecessor_does_not_strand_a_requested_reconfigure() {
 	let uri = format!("/room/live/@{root}/include/rung%2Fa/video/same/@{child}/media.m3u8");
 	assert_eq!(request(&server, &uri).await.0, StatusCode::OK);
 	let next = include
-		.publication
+		.route
+		.broadcast()
 		.create_track("next", hang::container::track_info(1))
 		.unwrap();
 	let video = value.video.renditions.get_mut("same").unwrap();
@@ -208,7 +213,7 @@ async fn a_failed_parent_catalog_stops_its_includes() {
 	let root = Instance::random();
 	let child = Instance::random();
 	let Published {
-		publication: _parent,
+		route: _parent,
 		catalog: parent_catalog_track,
 		video,
 		audio,
@@ -278,7 +283,8 @@ async fn idle_release_keeps_an_ended_playlists_inherited_segments() {
 	assert_eq!(request(&server, &uri).await.0, StatusCode::OK);
 	// Reconfigure onto another track; the predecessor ends with its own track.
 	let next = include
-		.publication
+		.route
+		.broadcast()
 		.create_track("next", hang::container::track_info(1))
 		.unwrap();
 	let video = value.video.renditions.get_mut("same").unwrap();
@@ -342,7 +348,9 @@ async fn an_include_rendition_whose_broadcast_failed_is_not_listed() {
 	let parent = publish(&origin, "room/live", &root, &parent_catalog());
 	frames(&parent.video, 0);
 	frames(&parent.audio, 0);
-	let other = origin.requests("room/other").unwrap();
+	let other = origin
+		.route_prefix("room/other", moq_net::origin::RouteOptions::default())
+		.unwrap();
 	let child = Instance::random();
 	let mut value = catalog();
 	value.audio.renditions.clear();
@@ -351,7 +359,7 @@ async fn an_include_rendition_whose_broadcast_failed_is_not_listed() {
 	let server = Server::new(origin.consume(), Default::default()).unwrap();
 	master(&server, &format!("@{root}/video/same"), true).await;
 	// Not a denial, but its media still can't be read.
-	kio::clock::timeout(Duration::from_secs(5), other.requested_broadcast())
+	kio::clock::timeout(Duration::from_secs(5), other.requested())
 		.await
 		.expect("the binding never asked")
 		.unwrap()
@@ -403,7 +411,9 @@ async fn an_include_rendition_is_listed_once_its_broadcast_resolves() {
 	frames(&parent.video, 0);
 	frames(&parent.audio, 0);
 	// The include's only rendition reads a sibling whose route has not answered yet.
-	let other = origin.requests("room/other").unwrap();
+	let other = origin
+		.route_prefix("room/other", moq_net::origin::RouteOptions::default())
+		.unwrap();
 	let child = Instance::random();
 	let mut value = catalog();
 	value.audio.renditions.clear();
@@ -415,7 +425,7 @@ async fn an_include_rendition_is_listed_once_its_broadcast_resolves() {
 		!listed.contains("include/"),
 		"a pending binding may yet be denied: {listed}"
 	);
-	let request = kio::clock::timeout(Duration::from_secs(5), other.requested_broadcast())
+	let request = kio::clock::timeout(Duration::from_secs(5), other.requested())
 		.await
 		.expect("the binding never asked")
 		.unwrap();
@@ -525,11 +535,9 @@ async fn late_instances_replace_unpinned_entries_and_do_not_replace_pins() {
 	let listed = master(&server, &old_uri, true).await;
 	assert!(listed.contains(&format!("include/pinned/video/same/@{first}")));
 	assert_eq!(old.video.demand().wanted(), None);
-	old.publication.unannounce();
+	old.route.withdraw();
 	master(&server, "include/", false).await;
-	old.publication
-		.announce(moq_net::origin::Route::default().with_instance(first.clone(), 0))
-		.unwrap();
+	old.route.announce().unwrap();
 	master(&server, &format!("include/pinned/video/same/@{first}"), true).await;
 	let new = publish(&origin, "room/ladder", &second, &catalog());
 	let listed = master(&server, &format!("include/rung%2Fa/video/same/@{second}"), true).await;
@@ -542,7 +550,7 @@ async fn late_instances_replace_unpinned_entries_and_do_not_replace_pins() {
 			.0,
 		StatusCode::NOT_FOUND
 	);
-	new.publication.unannounce();
+	new.route.withdraw();
 	master(&server, &format!("include/pinned/video/same/@{first}"), true).await;
 }
 
@@ -602,21 +610,23 @@ async fn a_refused_include_is_listed_once_announced() {
 	frames(&parent.video, 0);
 	frames(&parent.audio, 0);
 	// An on-demand route that drops its prepared answer refuses the first resolution.
-	let claim = origin.requests("room/ladder").unwrap();
+	let claim = origin
+		.route_prefix("room/ladder", moq_net::origin::RouteOptions::default())
+		.unwrap();
 	let server = Server::new(origin.consume(), Default::default()).unwrap();
 	let refuse = async {
-		let request = kio::clock::timeout(Duration::from_secs(5), claim.requested_broadcast())
+		let request = kio::clock::timeout(Duration::from_secs(5), claim.requested())
 			.await
 			.expect("never asked")
 			.unwrap();
-		drop(request.prepare().unwrap());
+		drop(request.route(moq_net::origin::RouteOptions::hidden()).unwrap());
 	};
 	let own = format!("@{root}/video/same");
 	let (listed, ()) = futures::join!(master(&server, &own, true), refuse);
 	assert!(!listed.contains("include/"), "{listed}");
 	// The refusing route is not asked again on a timer.
 	assert!(
-		kio::clock::timeout(Duration::from_secs(30), claim.requested_broadcast())
+		kio::clock::timeout(Duration::from_secs(30), claim.requested())
 			.await
 			.is_err()
 	);
diff --git a/rs/moq-hls/src/server/mod.rs b/rs/moq-hls/src/server/mod.rs
index 044295ab852..e4596bba323 100644
--- a/rs/moq-hls/src/server/mod.rs
+++ b/rs/moq-hls/src/server/mod.rs
@@ -470,12 +470,13 @@ mod tests {
 
 	async fn closed_broadcaster() -> Broadcaster {
 		let origin = produce_origin();
-		let producer = origin.create_broadcast("gone").expect("publish allowed");
-		producer.announce(Default::default()).expect("publish allowed");
+		let producer = origin
+			.route("gone", moq_net::origin::RouteOptions::default())
+			.expect("publish allowed");
 		settle().await;
 		let broadcaster = Broadcaster::spawned(crate::resolved(&origin, "gone").await, Config::default());
 		// Close the publisher so the resolved broadcast (and the broadcaster) reports closed.
-		producer.close();
+		producer.broadcast().close();
 		settle().await;
 		broadcaster
 	}
@@ -492,8 +493,9 @@ mod tests {
 			.lock()
 			.unwrap()
 			.insert("live".to_string(), Arc::new(Followed::new(stale.clone())));
-		let _producer = origin.create_broadcast("live").expect("publish allowed");
-		_producer.announce(Default::default()).expect("publish allowed");
+		let _producer = origin
+			.route("live", moq_net::origin::RouteOptions::default())
+			.expect("publish allowed");
 		settle().await;
 
 		let fresh = server.broadcaster("live").await.expect("broadcast announced");
@@ -508,8 +510,9 @@ mod tests {
 	#[tokio::test]
 	async fn dropping_the_server_releases_its_broadcasters() {
 		let origin = produce_origin();
-		let producer = origin.create_broadcast("live").expect("publish allowed");
-		producer.announce(Default::default()).expect("publish allowed");
+		let producer = origin
+			.route("live", moq_net::origin::RouteOptions::default())
+			.expect("publish allowed");
 		settle().await;
 
 		for _ in 0..4 {
@@ -528,7 +531,7 @@ mod tests {
 		settle().await;
 		assert_eq!(held.clones(), 1, "only the response holds it now");
 		assert!(!held.is_closed(), "a held broadcaster keeps serving");
-		producer.close();
+		producer.broadcast().close();
 	}
 
 	/// Wait out the origin's update hold until `ready` holds.
@@ -549,15 +552,18 @@ mod tests {
 	async fn a_replaced_instance_serves_until_it_closes() {
 		let origin = produce_origin();
 		let server = Server::new(origin.consume(), Config::default()).unwrap();
-		let (old_instance, new_instance) = (moq_net::Instance::random(), moq_net::Instance::random());
-		let route = |instance: &moq_net::Instance| moq_net::origin::Route::default().with_instance(instance.clone(), 0);
-
-		let old = origin.publish("live", route(&old_instance)).expect("publish allowed");
+		let old = origin
+			.route("live", moq_net::origin::RouteOptions::default())
+			.expect("publish allowed");
+		let old_instance = old.instance();
 		settle().await;
 		let first = server.broadcaster("live").await.expect("broadcast announced");
 		assert_eq!(first.instance().as_ref(), old_instance.as_str());
 
-		let new = origin.publish("live", route(&new_instance)).expect("publish allowed");
+		let new = origin
+			.route("live", moq_net::origin::RouteOptions::default())
+			.expect("publish allowed");
+		let new_instance = new.instance();
 		eventually(async || {
 			let current = server.broadcaster("live").await.expect("broadcast announced");
 			current.instance().as_ref() == new_instance.as_str()
@@ -584,7 +590,7 @@ mod tests {
 		let origin = produce_origin();
 		let server = Server::new(origin.consume(), Config::default()).unwrap();
 		let publication = origin
-			.publish("live", moq_net::origin::Route::default())
+			.route("live", moq_net::origin::RouteOptions::default())
 			.expect("publish allowed");
 		settle().await;
 
@@ -603,7 +609,7 @@ mod tests {
 		let origin = produce_origin();
 		let server = Server::new(origin.consume(), Config::default()).unwrap();
 		let _old = origin
-			.publish("live", moq_net::origin::Route::default())
+			.route("live", moq_net::origin::RouteOptions::default())
 			.expect("publish allowed");
 		settle().await;
 		let open = Broadcaster::spawned(crate::resolved(&origin, "live").await, Config::default());
diff --git a/rs/moq-hls/src/server/routes.rs b/rs/moq-hls/src/server/routes.rs
index d3021e0ef4e..7089bb8d7fd 100644
--- a/rs/moq-hls/src/server/routes.rs
+++ b/rs/moq-hls/src/server/routes.rs
@@ -301,8 +301,8 @@ mod tests {
 	/// The instance each test's catalog broadcast announces, and so the instance its URLs name.
 	const RUN: &str = "01920000-0000-7000-8000-000000000000";
 
-	fn run() -> moq_net::origin::Route {
-		moq_net::origin::Route::default().with_instance(RUN.parse().unwrap(), 0)
+	fn run() -> moq_net::origin::RouteOptions {
+		moq_net::origin::RouteOptions::default().with_instance(RUN.parse().unwrap(), 0)
 	}
 
 	fn vp8_frame(micros: u64, keyframe: bool) -> moq_mux::container::Frame {
@@ -409,8 +409,7 @@ mod tests {
 	#[tokio::test(start_paused = true)]
 	async fn master_answers_404_until_a_rendition_can_start() {
 		let origin = moq_tokio::origin::spawn();
-		let broadcast = origin.create_broadcast("live").expect("publish");
-		broadcast.announce(run()).expect("announce");
+		let broadcast = origin.route("live", run()).expect("publish");
 		let (_catalog, _registration, _track, mut media) =
 			publish_video(&mut broadcast.broadcast().clone(), video_config(), timed());
 
@@ -428,8 +427,7 @@ mod tests {
 	#[tokio::test(start_paused = true)]
 	async fn the_first_manifest_lists_inline_video() {
 		let origin = moq_tokio::origin::spawn();
-		let broadcast = origin.create_broadcast("live").expect("publish");
-		broadcast.announce(run()).expect("announce");
+		let broadcast = origin.route("live", run()).expect("publish");
 		let inline = hang::catalog::VideoConfig::new(hang::catalog::VideoCodec::VP8);
 		let (_catalog, _registration, _track, mut media) =
 			publish_video(&mut broadcast.broadcast().clone(), inline, timed());
@@ -450,24 +448,24 @@ mod tests {
 	#[tokio::test(start_paused = true)]
 	async fn a_denied_video_never_holds_the_manifest() {
 		let origin = moq_tokio::origin::spawn();
-		let broadcast = origin.create_broadcast("room/live").unwrap();
-		broadcast.announce(run()).unwrap();
-		let secret = origin.create_broadcast("room/secret").unwrap();
-		secret.announce(Default::default()).unwrap();
+		let broadcast = origin.route("room/live", run()).unwrap();
+		let secret = origin
+			.route("room/secret", moq_net::origin::RouteOptions::default())
+			.unwrap();
 		let catalog = moq_mux::catalog::Producer::new(&mut broadcast.broadcast().clone(), hls_config()).unwrap();
 		let reserved = catalog.reserve();
 		let mut config = video_config();
 		config.broadcast = Some(moq_net::path::Relative::new("./secret").unwrap());
 		let mut video = reserved
 			.video(
-				secret.create_track("video0", timed()).unwrap(),
+				secret.broadcast().create_track("video0", timed()).unwrap(),
 				moq_mux::catalog::hang::Container::Legacy(moq_mux::container::Kind::Video),
 				config,
 			)
 			.unwrap();
 		let mut audio = reserved
 			.audio(
-				broadcast.create_track("audio0", timed()).unwrap(),
+				broadcast.broadcast().create_track("audio0", timed()).unwrap(),
 				moq_mux::catalog::hang::Container::Legacy(moq_mux::container::Kind::Data),
 				hang::catalog::AudioConfig::new(hang::catalog::AudioCodec::Opus, 48_000, 2),
 			)
@@ -504,8 +502,7 @@ mod tests {
 	#[tokio::test(start_paused = true)]
 	async fn a_restart_lists_the_replacement_under_its_own_urls() {
 		let origin = moq_tokio::origin::spawn();
-		let old = origin.create_broadcast("live").expect("publish");
-		old.announce(run()).expect("announce");
+		let old = origin.route("live", run()).expect("publish");
 		let (old_catalog, _, old_track, mut old_media) =
 			publish_video(&mut old.broadcast().clone(), video_config(), timed());
 		write_three_gops(&mut old_media);
@@ -519,9 +516,12 @@ mod tests {
 		wait_listed(&app, &old_playlist, "seg/8343e7cd.0.m4s").await;
 
 		let next = moq_net::Instance::random();
-		let new = origin.create_broadcast("live").expect("publish");
-		new.announce(moq_net::origin::Route::default().with_instance(next.clone(), 0))
-			.expect("announce");
+		let new = origin
+			.route(
+				"live",
+				moq_net::origin::RouteOptions::default().with_instance(next.clone(), 0),
+			)
+			.expect("publish");
 		let (_new_catalog, _, _new_track, mut new_media) =
 			publish_video(&mut new.broadcast().clone(), video_config(), timed());
 		write_three_gops(&mut new_media);
@@ -552,8 +552,7 @@ mod tests {
 	#[tokio::test(start_paused = true)]
 	async fn a_replaced_recording_ends_at_what_it_listed() {
 		let origin = moq_tokio::origin::spawn();
-		let old = origin.create_broadcast("live").expect("publish");
-		old.announce(run()).expect("announce");
+		let old = origin.route("live", run()).expect("publish");
 		let (_old_catalog, _, _old_track, mut old_media) =
 			publish_video(&mut old.broadcast().clone(), video_config(), timed());
 		// Keyframes at 0, 2, and 4 s list segments 0 and 1; the third waits for its successor.
@@ -570,9 +569,12 @@ mod tests {
 		let mut old_segments = old_rendition.segments();
 
 		let next = moq_net::Instance::random();
-		let new = origin.create_broadcast("live").expect("publish");
-		new.announce(moq_net::origin::Route::default().with_instance(next.clone(), 0))
-			.expect("announce");
+		let new = origin
+			.route(
+				"live",
+				moq_net::origin::RouteOptions::default().with_instance(next.clone(), 0),
+			)
+			.expect("publish");
 		let (_new_catalog, _, _new_track, mut new_media) =
 			publish_video(&mut new.broadcast().clone(), video_config(), timed());
 		write_three_gops(&mut new_media);
@@ -639,8 +641,7 @@ mod tests {
 	#[tokio::test(start_paused = true)]
 	async fn a_failed_media_track_answers_an_uncacheable_error() {
 		let origin = moq_tokio::origin::spawn();
-		let broadcast = origin.create_broadcast("live").expect("publish");
-		broadcast.announce(run()).expect("announce");
+		let broadcast = origin.route("live", run()).expect("publish");
 		let (_catalog, _registration, track, mut media) =
 			publish_video(&mut broadcast.broadcast().clone(), video_config(), timed());
 		write_three_gops(&mut media);
@@ -677,8 +678,7 @@ mod tests {
 	#[tokio::test(start_paused = true)]
 	async fn serves_only_versioned_media_urls() {
 		let origin = moq_tokio::origin::spawn();
-		let broadcast = origin.create_broadcast("live").expect("publish");
-		broadcast.announce(run()).expect("announce");
+		let broadcast = origin.route("live", run()).expect("publish");
 		let (_catalog, _registration, _track, mut media) =
 			publish_video(&mut broadcast.broadcast().clone(), video_config(), timed());
 		write_three_gops(&mut media);
@@ -746,19 +746,20 @@ mod tests {
 	#[tokio::test(start_paused = true)]
 	async fn denied_sibling_media_answers_403_without_poisoning_allowed_siblings() {
 		let origin = moq_tokio::origin::spawn();
-		let broadcast = origin.create_broadcast("room/live").unwrap();
-		broadcast.announce(run()).unwrap();
-		let source = origin.create_broadcast("room/source").unwrap();
-		source.announce(Default::default()).unwrap();
-		let secret = origin.create_broadcast("room/secret").unwrap();
-		secret.announce(Default::default()).unwrap();
+		let broadcast = origin.route("room/live", run()).unwrap();
+		let source = origin
+			.route("room/source", moq_net::origin::RouteOptions::default())
+			.unwrap();
+		let secret = origin
+			.route("room/secret", moq_net::origin::RouteOptions::default())
+			.unwrap();
 		let catalog = moq_mux::catalog::Producer::new(&mut broadcast.broadcast().clone(), hls_config()).unwrap();
 		let reserved = catalog.reserve();
 		let mut config = video_config();
 		config.broadcast = Some(moq_net::path::Relative::new("./source").unwrap());
 		let mut allowed = reserved
 			.video(
-				source.create_track("video0", timed()).unwrap(),
+				source.broadcast().create_track("video0", timed()).unwrap(),
 				moq_mux::catalog::hang::Container::Legacy(moq_mux::container::Kind::Video),
 				config,
 			)
@@ -767,7 +768,7 @@ mod tests {
 		config.broadcast = Some(moq_net::path::Relative::new("./secret").unwrap());
 		let mut denied = reserved
 			.video(
-				secret.create_track("video1", timed()).unwrap(),
+				secret.broadcast().create_track("video1", timed()).unwrap(),
 				moq_mux::catalog::hang::Container::Legacy(moq_mux::container::Kind::Video),
 				config,
 			)
@@ -822,7 +823,7 @@ mod tests {
 		));
 		// Broader authority can consume the referenced bytes, but cannot warm the
 		// restricted server's export into using them.
-		let broad = moq_mux::Source::new(origin.consume(), broadcast.consume());
+		let broad = moq_mux::Source::new(origin.consume(), broadcast.broadcast().consume());
 		let referenced = broad
 			.resolve(Some(&moq_net::path::Relative::new("./secret").unwrap()), None)
 			.await
diff --git a/rs/moq-hls/tests/integration/conformance.rs b/rs/moq-hls/tests/integration/conformance.rs
index 702a2ce7ece..3a3962d05a6 100644
--- a/rs/moq-hls/tests/integration/conformance.rs
+++ b/rs/moq-hls/tests/integration/conformance.rs
@@ -59,8 +59,10 @@ async fn segments_match_their_manifests() {
 	let ts = encode(dir.path()).await;
 
 	let pair = Pair::connect().await;
-	let publication = pair.publisher.create_broadcast("live").expect("publish");
-	publication.announce(Default::default()).expect("announce");
+	let publication = pair
+		.publisher
+		.route("live", moq_net::origin::RouteOptions::default())
+		.expect("publish");
 	let mut broadcast = publication.broadcast().clone();
 	let mut seeded = moq_mux::catalog::hang::Catalog::<()>::default();
 	seeded.media.join = hang::catalog::Join::new(DURATION);
diff --git a/rs/moq-hls/tests/integration/finish.rs b/rs/moq-hls/tests/integration/finish.rs
index 800803103a2..4d9ec919db4 100644
--- a/rs/moq-hls/tests/integration/finish.rs
+++ b/rs/moq-hls/tests/integration/finish.rs
@@ -41,11 +41,11 @@ async fn finish(order: Order) {
 			// The served playlist ends while the broadcast is still announced.
 			let playlist = listed(&app, &media, "#EXT-X-ENDLIST").await;
 			assert_eq!(numbers(&playlist), [0, 1, 2, 3], "{playlist}");
-			publisher.broadcast.close();
+			publisher.route.broadcast().close();
 		}
 		Order::EndBeforeEof => {
 			publisher.media.finish().expect("finish media");
-			publisher.broadcast.close();
+			publisher.route.broadcast().close();
 			// The server stops serving the instance once `End` reaches it.
 			let deadline = kio::clock::now() + TIMEOUT;
 			while get(&app, &media).await.status() != StatusCode::NOT_FOUND {
diff --git a/rs/moq-hls/tests/integration/restart.rs b/rs/moq-hls/tests/integration/restart.rs
index 4ca4643e745..daa5f750793 100644
--- a/rs/moq-hls/tests/integration/restart.rs
+++ b/rs/moq-hls/tests/integration/restart.rs
@@ -66,8 +66,7 @@ async fn takeover(version: &str, case: Case) {
 	}
 
 	// The new instance numbers its groups and segments from zero again.
-	let route = moq_net::origin::Route::default();
-	let mut new = Publisher::new(&pair.publisher, "live", route);
+	let mut new = Publisher::new(&pair.publisher, "live", Default::default());
 	let deadline = kio::clock::now() + TIMEOUT;
 	let current = loop {
 		let current = server.broadcaster("live").await.expect("announced");
diff --git a/rs/moq-hls/tests/integration/server.rs b/rs/moq-hls/tests/integration/server.rs
index 0b679cdabb0..98b9a47ab56 100644
--- a/rs/moq-hls/tests/integration/server.rs
+++ b/rs/moq-hls/tests/integration/server.rs
@@ -118,8 +118,10 @@ async fn a_disconnected_publisher_on_the_catalog_broadcast_answers_404() {
 #[tokio::test(start_paused = true)]
 async fn lookups_ride_the_servers_scope_watch() {
 	let pair = Pair::connect().await;
-	let other = pair.publisher.create_broadcast("room/other").expect("other");
-	other.announce(Default::default()).expect("announce other");
+	let _other = pair
+		.publisher
+		.route("room/other", moq_net::origin::RouteOptions::default())
+		.expect("other");
 
 	let server = pair.server();
 	let missing = kio::clock::timeout(TIMEOUT, server.broadcaster("room/missing"))
@@ -150,10 +152,14 @@ async fn a_sibling_resolves_through_a_client_session() {
 		"moq-lite-07-wip",
 	] {
 		let pair = Pair::new(version.parse().unwrap(), Default::default()).await;
-		let catalog = pair.publisher.create_broadcast("room/live").expect("catalog");
-		catalog.announce(Default::default()).expect("announce catalog");
-		let media = pair.publisher.create_broadcast("room/source").expect("media");
-		media.announce(Default::default()).expect("announce media");
+		let _catalog = pair
+			.publisher
+			.route("room/live", moq_net::origin::RouteOptions::default())
+			.expect("catalog");
+		let _media = pair
+			.publisher
+			.route("room/source", moq_net::origin::RouteOptions::default())
+			.expect("media");
 
 		let origin = pair.subscriber.consume();
 		let broadcast = kio::clock::timeout(TIMEOUT, origin.follow("room/live", None).unwrap().available())
@@ -178,19 +184,21 @@ async fn a_sibling_resolves_through_a_client_session() {
 #[tokio::test(start_paused = true)]
 async fn a_disconnected_sibling_publisher_ends_the_playlist() {
 	let pair = Pair::connect().await;
-	let catalog_broadcast = pair.publisher.create_broadcast("room/live").expect("catalog");
-	catalog_broadcast
-		.announce(Default::default())
-		.expect("announce catalog");
-	let media_broadcast = pair.publisher.create_broadcast("room/source").expect("media");
-	media_broadcast.announce(Default::default()).expect("announce media");
+	let catalog_broadcast = pair
+		.publisher
+		.route("room/live", moq_net::origin::RouteOptions::default())
+		.expect("catalog");
+	let media_broadcast = pair
+		.publisher
+		.route("room/source", moq_net::origin::RouteOptions::default())
+		.expect("media");
 
 	let catalog =
 		moq_mux::catalog::Producer::new(&mut catalog_broadcast.broadcast().clone(), catalog_config()).unwrap();
 	let reserved = catalog.reserve();
 	let mut config = video_config();
 	config.broadcast = Some(moq_net::path::Relative::new("./source").unwrap());
-	let track = media_broadcast.create_track(TRACK, timed()).unwrap();
+	let track = media_broadcast.broadcast().create_track(TRACK, timed()).unwrap();
 	let mut media = reserved
 		.video(
 			track,
@@ -222,7 +230,7 @@ async fn a_disconnected_sibling_publisher_ends_the_playlist() {
 	.unwrap();
 	// Only the sibling goes: the catalog keeps listing the rendition, so the request reaches the
 	// media fetch rather than missing the rendition.
-	media_broadcast.close();
+	media_broadcast.broadcast().close();
 	kio::clock::timeout(TIMEOUT, remote_media.closed())
 		.await
 		.expect("sibling close timed out");
diff --git a/rs/moq-hls/tests/integration/support.rs b/rs/moq-hls/tests/integration/support.rs
index 403ca66aa3e..5e68764ab8c 100644
--- a/rs/moq-hls/tests/integration/support.rs
+++ b/rs/moq-hls/tests/integration/support.rs
@@ -90,8 +90,8 @@ fn origin(config: moq_net::origin::Config) -> moq_net::origin::Producer {
 /// One publisher run of a broadcast: a catalog declaring its join interval and a single VP8
 /// rendition.
 pub struct Publisher {
-	/// The broadcast, which announces its path while it lives.
-	pub broadcast: moq_net::origin::Publication,
+	/// The route, which announces its path while it lives.
+	pub route: moq_net::origin::Route,
 	/// The catalog.
 	pub catalog: moq_mux::catalog::Producer,
 	/// The media track.
@@ -99,14 +99,13 @@ pub struct Publisher {
 }
 
 impl Publisher {
-	/// Announce `path` on `origin` under `route` and publish its catalog.
-	pub fn new(origin: &moq_net::origin::Producer, path: &str, route: moq_net::origin::Route) -> Self {
-		let broadcast = origin.create_broadcast(path).expect("publish");
-		broadcast.announce(route).expect("announce");
+	/// Announce `path` on `origin` with `options` and publish its catalog.
+	pub fn new(origin: &moq_net::origin::Producer, path: &str, options: moq_net::origin::RouteOptions) -> Self {
+		let route = origin.route(path, options).expect("publish");
 		let catalog =
-			moq_mux::catalog::Producer::new(&mut broadcast.broadcast().clone(), catalog_config()).expect("catalog");
+			moq_mux::catalog::Producer::new(&mut route.broadcast().clone(), catalog_config()).expect("catalog");
 		let reserved = catalog.reserve();
-		let track = broadcast.create_track(TRACK, timed()).expect("track");
+		let track = route.broadcast().create_track(TRACK, timed()).expect("track");
 		let media = reserved
 			.video(
 				track,
@@ -115,11 +114,7 @@ impl Publisher {
 			)
 			.expect("rendition");
 		drop(reserved);
-		Self {
-			broadcast,
-			catalog,
-			media,
-		}
+		Self { route, catalog, media }
 	}
 
 	/// Write one-second frames for each second in `start..end`, a keyframe on every even second.
diff --git a/rs/moq-mux/benches/containers.rs b/rs/moq-mux/benches/containers.rs
index 6e15f8ab0b6..867a52b2399 100644
--- a/rs/moq-mux/benches/containers.rs
+++ b/rs/moq-mux/benches/containers.rs
@@ -56,11 +56,12 @@ async fn prepare(video: Video, payload: &Bytes) -> (moq_mux::Source, impl Stream
 	} = video;
 	let (origin, driver) = moq_net::origin::Producer::new(Default::default());
 	let driver = tokio::spawn(moq_net::time::run(driver));
-	let broadcast = origin.create_broadcast("bench").unwrap();
+	let broadcast = origin.route("bench", moq_net::origin::RouteOptions::hidden()).unwrap();
 	let mut catalog = moq_mux::catalog::Producer::new(&mut broadcast.broadcast().clone(), Default::default()).unwrap();
 	let mut publishers = Vec::new();
 	for index in 0..tracks {
 		let track = broadcast
+			.broadcast()
 			.create_track(
 				format!("video{index}"),
 				catalog.track_info(hang::catalog::PRIORITY.video),
@@ -84,7 +85,7 @@ async fn prepare(video: Video, payload: &Bytes) -> (moq_mux::Source, impl Stream
 		publishers.push(publisher);
 	}
 	catalog.finish().unwrap();
-	broadcast.announce(Default::default()).unwrap();
+	broadcast.announce().unwrap();
 	let resolved = origin.consume().request("bench", None).await.unwrap();
 	let source = moq_mux::Source::new(origin.consume(), resolved);
 	let stream = source.catalog::<()>(CatalogFormat::Hang).await.unwrap();
diff --git a/rs/moq-mux/benches/export.rs b/rs/moq-mux/benches/export.rs
index cb2b073bf16..3efe19e8fdf 100644
--- a/rs/moq-mux/benches/export.rs
+++ b/rs/moq-mux/benches/export.rs
@@ -33,12 +33,13 @@ impl Drop for Fixture {
 async fn prepare(tracks: usize, frames: usize, live: bool) -> (moq_mux::Source, moq_mux::catalog::Consumer, Fixture) {
 	let (origin, driver) = moq_net::origin::Producer::new(Default::default());
 	let driver = tokio::spawn(moq_net::time::run(driver));
-	let broadcast = origin.create_broadcast("bench").unwrap();
+	let broadcast = origin.route("bench", moq_net::origin::RouteOptions::hidden()).unwrap();
 	let mut catalog = moq_mux::catalog::Producer::new(&mut broadcast.broadcast().clone(), Default::default()).unwrap();
 	let stream = moq_mux::catalog::Consumer::from(catalog.consume().unwrap());
 	let mut publishers = Vec::new();
 	for index in 0..tracks {
 		let track = broadcast
+			.broadcast()
 			.create_track(
 				format!("audio{index}"),
 				catalog.track_info(hang::catalog::PRIORITY.audio),
@@ -66,7 +67,7 @@ async fn prepare(tracks: usize, frames: usize, live: bool) -> (moq_mux::Source,
 	if !live {
 		catalog.finish().unwrap();
 	}
-	broadcast.announce(Default::default()).unwrap();
+	broadcast.announce().unwrap();
 	let resolved = origin.consume().request("bench", None).await.unwrap();
 	let source = moq_mux::Source::new(origin.consume(), resolved);
 	let fixture = Fixture {
@@ -234,10 +235,11 @@ async fn prepare_video(
 ) -> (moq_mux::Source, moq_mux::catalog::Consumer, Fixture) {
 	let (origin, driver) = moq_net::origin::Producer::new(Default::default());
 	let driver = tokio::spawn(moq_net::time::run(driver));
-	let broadcast = origin.create_broadcast("bench").unwrap();
+	let broadcast = origin.route("bench", moq_net::origin::RouteOptions::hidden()).unwrap();
 	let mut catalog = moq_mux::catalog::Producer::new(&mut broadcast.broadcast().clone(), Default::default()).unwrap();
 	let stream = moq_mux::catalog::Consumer::from(catalog.consume().unwrap());
 	let track = broadcast
+		.broadcast()
 		.create_track("video", catalog.track_info(hang::catalog::PRIORITY.video))
 		.unwrap();
 	let mut config = hang::catalog::VideoConfig::new(hang::catalog::H264 {
@@ -285,7 +287,7 @@ async fn prepare_video(
 	}
 	video.finish().unwrap();
 	catalog.finish().unwrap();
-	broadcast.announce(Default::default()).unwrap();
+	broadcast.announce().unwrap();
 	let resolved = origin.consume().request("bench", None).await.unwrap();
 	let source = moq_mux::Source::new(origin.consume(), resolved);
 	(
diff --git a/rs/moq-mux/src/catalog/hang/consumer.rs b/rs/moq-mux/src/catalog/hang/consumer.rs
index 13efa1bec8e..f6256e59a98 100644
--- a/rs/moq-mux/src/catalog/hang/consumer.rs
+++ b/rs/moq-mux/src/catalog/hang/consumer.rs
@@ -105,8 +105,11 @@ mod test {
 	/// resolves against.
 	fn publish_catalog(published: Catalog<()>) -> Result<Option<Catalog>> {
 		let origin = crate::source::produce_origin();
-		let broadcast = origin.create_broadcast("a/pub").expect("broadcast should create");
+		let broadcast = origin
+			.route("a/pub", moq_net::origin::RouteOptions::hidden())
+			.expect("broadcast should create");
 		let track = broadcast
+			.broadcast()
 			.create_track(hang::Catalog::DEFAULT_NAME, hang::Catalog::default_track_info())
 			.expect("catalog track should create");
 		let mut consumer = Consumer::new(track.consume());
@@ -138,27 +141,29 @@ mod test {
 	/// takes when it answers an origin request.
 	async fn publish_catalog_served(published: Catalog<()>) -> Result<Option<Catalog>> {
 		let origin = crate::source::produce_origin();
-		let dynamic = origin.requests("").unwrap();
+		let dynamic = origin
+			.route_prefix("", moq_net::origin::RouteOptions::default())
+			.unwrap();
 		let requesting = origin.consume().request("a/pub", None);
 		// The handler hands its route back: dropping it would retract the route and end
 		// the broadcast it just served.
 		let handler = tokio::spawn(async move {
-			let prepared = dynamic
-				.requested_broadcast()
+			let route = dynamic
+				.requested()
 				.await
 				.expect("handler should be asked for the path")
-				.prepare()
-				.expect("the answer should prepare");
-			let track = prepared
+				.route(moq_net::origin::RouteOptions::hidden())
+				.expect("the answer should route");
+			let track = route
 				.broadcast()
 				.create_track(hang::Catalog::DEFAULT_NAME, hang::Catalog::default_track_info())
 				.expect("catalog track should create");
-			let broadcast = prepared.publish().expect("the answer should publish");
-			(dynamic, broadcast, track)
+			route.announce().expect("the answer should announce");
+			(dynamic, route, track)
 		});
 
 		let resolved = requesting.await;
-		let (_dynamic, _broadcast, track) = handler.await.expect("handler task");
+		let (_dynamic, _route, track) = handler.await.expect("handler task");
 		let catalog_track = resolved
 			.expect("the handler served it")
 			.track(hang::Catalog::DEFAULT_NAME)
diff --git a/rs/moq-mux/src/catalog/producer.rs b/rs/moq-mux/src/catalog/producer.rs
index 6be0cf0e0a9..fbbe4245c4a 100644
--- a/rs/moq-mux/src/catalog/producer.rs
+++ b/rs/moq-mux/src/catalog/producer.rs
@@ -1459,7 +1459,11 @@ mod test {
 			let (origin, driver) = moq_net::origin::Producer::new(Default::default());
 			let driver = tokio::spawn(moq_net::time::run(driver));
 			let mut broadcast = match path {
-				Some(path) => origin.create_broadcast(path).unwrap().broadcast().clone(),
+				Some(path) => origin
+					.route(path, moq_net::origin::RouteOptions::hidden())
+					.unwrap()
+					.broadcast()
+					.clone(),
 				None => moq_net::broadcast::Info::new().produce(),
 			};
 			let mut producer = Producer::new(&mut broadcast, Config::default()).unwrap();
@@ -2096,8 +2100,12 @@ mod test {
 		let wall = kio::clock::Wall::UNIX_EPOCH + Duration::from_millis(hang::catalog::MOQ_EPOCH_UNIX_MILLIS + 60_000);
 		let clock = crate::Clock::at(captured, wall).unwrap();
 		let (origin, _driver) = moq_net::origin::Producer::new(Default::default());
-		let front = origin.create_broadcast("robot/front.hang").unwrap();
-		let rear = origin.create_broadcast("robot/rear.hang").unwrap();
+		let front = origin
+			.route("robot/front.hang", moq_net::origin::RouteOptions::hidden())
+			.unwrap();
+		let rear = origin
+			.route("robot/rear.hang", moq_net::origin::RouteOptions::hidden())
+			.unwrap();
 		let catalogs = [
 			Producer::new(
 				&mut front.broadcast().clone(),
@@ -2115,6 +2123,7 @@ mod test {
 			assert_eq!(catalog.snapshot().media.clock, clock.wall());
 			let timestamp = catalog.clock().capture(captured).unwrap();
 			let track = broadcast
+				.broadcast()
 				.create_track("video", catalog.track_info(hang::catalog::PRIORITY.video))
 				.unwrap();
 			let mut video = catalog
diff --git a/rs/moq-mux/src/container/consumer.rs b/rs/moq-mux/src/container/consumer.rs
index fba63982554..bd8292ded66 100644
--- a/rs/moq-mux/src/container/consumer.rs
+++ b/rs/moq-mux/src/container/consumer.rs
@@ -3070,17 +3070,15 @@ mod tests {
 		// One publisher instance behind every route, so each may resume the others.
 		let instance = moq_net::Instance::random();
 		let origin = crate::source::produce_origin();
-		let hops = moq_net::Hops::try_from(vec![moq_net::Hop::new(10).unwrap()]).unwrap();
 		let route = |cost: u64| {
-			moq_net::origin::Route::default()
+			moq_net::origin::RouteOptions::hidden()
 				.with_instance(instance.clone(), 0)
-				.with_hops(hops.clone())
 				.with_cost(cost)
 		};
-		let first = origin.create_broadcast("live").unwrap();
+		let first = origin.route("live", route(5)).unwrap();
 		let info = hang::container::track_info(hang::catalog::PRIORITY.video);
-		let first_track = first.create_track("video", info.clone()).unwrap();
-		first.announce(route(5)).unwrap();
+		let first_track = first.broadcast().create_track("video", info.clone()).unwrap();
+		first.announce().unwrap();
 		let broadcast = origin.consume().request("live", None).await.unwrap();
 		let track = broadcast
 			.track("video")
@@ -3112,9 +3110,9 @@ mod tests {
 		// full budget past it.
 		let mut sources = Vec::new();
 		for sequence in 1..=4 {
-			let source = origin.create_broadcast("live").unwrap();
-			let mut track = source.create_track("video", info.clone()).unwrap();
-			source.announce(route(5 - sequence)).unwrap();
+			let source = origin.route("live", route(5 - sequence)).unwrap();
+			let mut track = source.broadcast().create_track("video", info.clone()).unwrap();
+			source.announce().unwrap();
 			let mut demand = track.demand();
 			while demand.wanted_changed().await.unwrap().is_none() {}
 			if sequence == 1 {
diff --git a/rs/moq-mux/src/container/source.rs b/rs/moq-mux/src/container/source.rs
index 80fd521c1aa..6380781b2a8 100644
--- a/rs/moq-mux/src/container/source.rs
+++ b/rs/moq-mux/src/container/source.rs
@@ -919,7 +919,7 @@ mod tests {
 		use crate::container::test_util::raw_frame;
 
 		let origin = crate::source::produce_origin();
-		let _catalog = origin.publish("a/pub", Default::default()).unwrap();
+		let _catalog = origin.route("a/pub", Default::default()).unwrap();
 		tokio::task::yield_now().await;
 		let source = crate::source::resolved(&origin, "a/pub").await;
 		let config = audio(Some("./source"));
@@ -936,13 +936,14 @@ mod tests {
 		let info = || hang::container::track_info(hang::catalog::PRIORITY.audio);
 
 		assert_eq!(read().await, None, "nothing announces the sibling yet");
-		let old = origin.publish("a/source", Default::default()).unwrap();
-		let mut track = crate::container::Producer::new(old.create_track("audio", info()).unwrap(), wire());
+		let old = origin.route("a/source", Default::default()).unwrap();
+		let mut track = crate::container::Producer::new(old.broadcast().create_track("audio", info()).unwrap(), wire());
 		track.write(raw_frame(0, b"old", true)).unwrap();
 		assert_eq!(read().await, Some(Some(0)), "the late announcement starts it");
 
-		let new = origin.publish("a/source", Default::default()).unwrap();
-		let mut replacement = crate::container::Producer::new(new.create_track("audio", info()).unwrap(), wire());
+		let new = origin.route("a/source", Default::default()).unwrap();
+		let mut replacement =
+			crate::container::Producer::new(new.broadcast().create_track("audio", info()).unwrap(), wire());
 		replacement.write(raw_frame(1_000_000, b"new", true)).unwrap();
 		track.write(raw_frame(24_000, b"old", true)).unwrap();
 		assert_eq!(read().await, Some(Some(24_000)), "the replacement is never read");
@@ -972,7 +973,7 @@ mod tests {
 
 		for failure in ["malformed", "violation", "dropped"] {
 			let origin = crate::source::produce_origin();
-			let _catalog = origin.publish("a/pub", Default::default()).unwrap();
+			let _catalog = origin.route("a/pub", Default::default()).unwrap();
 			tokio::task::yield_now().await;
 			let source = crate::source::resolved(&origin, "a/pub").await;
 			let config = audio(Some("./source"));
@@ -980,8 +981,9 @@ mod tests {
 				.unwrap()
 				.unwrap();
 
-			let sibling = origin.publish("a/source", Default::default()).unwrap();
+			let sibling = origin.route("a/source", Default::default()).unwrap();
 			let track = sibling
+				.broadcast()
 				.create_track("audio", hang::container::track_info(hang::catalog::PRIORITY.audio))
 				.unwrap();
 			// Subscribe before anything is written, so the failure and the instance's end arrive
@@ -1032,13 +1034,14 @@ mod tests {
 
 		let remote = crate::source::produce_origin();
 		let origin = crate::source::produce_origin();
-		let _catalog = origin.publish("a/pub", Default::default()).unwrap();
+		let _catalog = origin.route("a/pub", Default::default()).unwrap();
 		tokio::task::yield_now().await;
 		let source = crate::source::resolved(&origin, "a/pub").await;
 		let _link = Link::new(&remote, &origin).await;
-		let sibling = remote.publish("a/source", Default::default()).unwrap();
+		let sibling = remote.route("a/source", Default::default()).unwrap();
 		let mut track = crate::container::Producer::new(
 			sibling
+				.broadcast()
 				.create_track("audio", hang::container::track_info(hang::catalog::PRIORITY.audio))
 				.unwrap(),
 			HangContainer::Legacy(crate::container::Kind::Audio),
@@ -1129,11 +1132,14 @@ mod tests {
 		let (publisher, subscriber) = (origin(1), origin(2));
 		let _link = Link::new(&publisher, &subscriber).await;
 
-		let broadcast = publisher.create_broadcast("room").unwrap();
+		let broadcast = publisher
+			.route("room", moq_net::origin::RouteOptions::hidden())
+			.unwrap();
 		let track = broadcast
+			.broadcast()
 			.create_track("audio", hang::container::track_info(hang::catalog::PRIORITY.audio))
 			.unwrap();
-		broadcast.announce(Default::default()).unwrap();
+		broadcast.announce().unwrap();
 		let consumer = subscriber.consume();
 		let remote = consumer
 			.follow("room", None)
@@ -1212,11 +1218,14 @@ mod tests {
 				false => (Link::held(&publisher, &subscriber, 2).await, None),
 			};
 
-			let broadcast = publisher.create_broadcast("room").unwrap();
+			let broadcast = publisher
+				.route("room", moq_net::origin::RouteOptions::hidden())
+				.unwrap();
 			let track = broadcast
+				.broadcast()
 				.create_track("audio", hang::container::track_info(hang::catalog::PRIORITY.audio))
 				.unwrap();
-			broadcast.announce(Default::default()).unwrap();
+			broadcast.announce().unwrap();
 			let consumer = subscriber.consume();
 			let remote = consumer
 				.follow("room", None)
diff --git a/rs/moq-mux/src/container/test_util.rs b/rs/moq-mux/src/container/test_util.rs
index 701bba5d5db..42d6faca37e 100644
--- a/rs/moq-mux/src/container/test_util.rs
+++ b/rs/moq-mux/src/container/test_util.rs
@@ -109,7 +109,7 @@ pub(crate) struct Moving {
 	/// `other`'s track `a`.
 	pub(crate) other: crate::container::Producer<crate::catalog::hang::Container>,
 	origin: moq_net::origin::Producer,
-	_broadcasts: [moq_net::origin::Publication; 2],
+	_broadcasts: [moq_net::origin::Route; 2],
 }
 
 impl Moving {
@@ -119,8 +119,8 @@ impl Moving {
 
 	pub(crate) fn new() -> Self {
 		let origin = crate::source::produce_origin();
-		let live = origin.publish("live", Default::default()).unwrap();
-		let other = origin.publish("other", Default::default()).unwrap();
+		let live = origin.route("live", Default::default()).unwrap();
+		let other = origin.route("other", Default::default()).unwrap();
 		let catalog =
 			crate::catalog::Producer::new(&mut live.broadcast().clone(), crate::catalog::Config::default()).unwrap();
 		let track = |broadcast: &mut moq_net::broadcast::Producer, name: &str| {
diff --git a/rs/moq-mux/src/container/ts/export_test.rs b/rs/moq-mux/src/container/ts/export_test.rs
index 8e303203206..1be3d98e020 100644
--- a/rs/moq-mux/src/container/ts/export_test.rs
+++ b/rs/moq-mux/src/container/ts/export_test.rs
@@ -159,14 +159,12 @@ async fn custom_selected_catalog_drives_export_and_follow() {
 	let origin = crate::source::produce_origin();
 	let mut export: Option<Export<crate::catalog::Select<Once>>> = None;
 	for payload in [b"first".as_slice(), b"next".as_slice()] {
-		let broadcast = origin.create_broadcast("live").unwrap();
-		broadcast
-			.announce(moq_net::origin::Route::default().with_instance(moq_net::Instance::random(), 0))
-			.unwrap();
+		let broadcast = origin.route("live", moq_net::origin::RouteOptions::default()).unwrap();
 		let mut snapshot = Catalog::default();
 		let mut producers = Vec::new();
 		for (name, payload) in [("keep", payload), ("drop", b"unselected".as_slice())] {
 			let track = broadcast
+				.broadcast()
 				.create_track(name, hang::container::track_info(hang::catalog::PRIORITY.audio))
 				.unwrap();
 			let mut config = AudioConfig::new(AAC { profile: 2 }, 48_000, 2);
@@ -227,17 +225,17 @@ async fn a_follower_keeps_msf_after_catalog_eof() {
 	let origin = crate::source::produce_origin();
 	let instance = moq_net::Instance::random();
 	let publish = || {
-		let broadcast = origin.create_broadcast("live").unwrap();
+		let options = moq_net::origin::RouteOptions::hidden().with_instance(instance.clone(), 0);
+		let broadcast = origin.route("live", options).unwrap();
 		let track = broadcast
+			.broadcast()
 			.create_track(moq_msf::DEFAULT_NAME, hang::Catalog::default_track_info())
 			.unwrap();
 		let msf = moq_msf::Catalog::<()>::new(Vec::new()).to_json().unwrap();
 		let mut group = track.append_group().unwrap();
 		group.write_frame(moq_net::Timestamp::now(), msf).unwrap();
 		group.finish().unwrap();
-		broadcast
-			.announce(moq_net::origin::Route::default().with_instance(instance.clone(), 0))
-			.unwrap();
+		broadcast.announce().unwrap();
 		(broadcast, track)
 	};
 	let (broadcast, mut track) = publish();
@@ -8951,9 +8949,9 @@ async fn a_track_leaving_the_catalog_is_read_to_its_end() {
 /// Publish an empty catalog at `live` under `route`.
 fn publish_live<E: crate::catalog::hang::CatalogExt>(
 	origin: &moq_net::origin::Producer,
-	route: moq_net::origin::Route,
-) -> (moq_net::origin::Publication, crate::catalog::Producer<E>) {
-	let broadcast = origin.publish("live", route).unwrap();
+	route: moq_net::origin::RouteOptions,
+) -> (moq_net::origin::Route, crate::catalog::Producer<E>) {
+	let broadcast = origin.route("live", route).unwrap();
 	let config = crate::catalog::Config::default().with_catalog(crate::catalog::hang::Catalog::<E>::default());
 	let catalog = crate::catalog::Producer::new(&mut broadcast.broadcast().clone(), config).unwrap();
 	(broadcast, catalog)
@@ -9047,7 +9045,7 @@ fn unflagged(frames: &[Frame]) -> Vec<u16> {
 async fn same_instance_returns(finish: bool) {
 	let origin = crate::source::produce_origin();
 	let instance = moq_net::Instance::random();
-	let route = || moq_net::origin::Route::default().with_instance(instance.clone(), 0);
+	let route = || moq_net::origin::RouteOptions::default().with_instance(instance.clone(), 0);
 
 	let (broadcast, mut catalog) = publish_live::<()>(&origin, route());
 	let mut track = aac_rendition(&mut broadcast.broadcast().clone(), &mut catalog, "a.aac");
@@ -9129,7 +9127,7 @@ async fn a_return_keeps_catalog_and_group_history() {
 	let start = kio::clock::now();
 	let origin = crate::source::produce_origin();
 	let instance = moq_net::Instance::random();
-	let route = moq_net::origin::Route::default().with_instance(instance.clone(), 0);
+	let route = moq_net::origin::RouteOptions::default().with_instance(instance.clone(), 0);
 	let (broadcast, mut catalog) = publish_live::<()>(&origin, route.clone());
 	let mut track = aac_rendition(&mut broadcast.broadcast().clone(), &mut catalog, "a.aac");
 	let mut groups = track.consume();
@@ -9148,11 +9146,11 @@ async fn a_return_keeps_catalog_and_group_history() {
 	let mut frames = drain_frames(&mut export).await;
 	assert_eq!(pes_count(&frames), 10);
 
-	broadcast.unannounce();
+	broadcast.withdraw();
 	old.closed().await;
 	tokio::time::advance(Duration::from_secs(1)).await;
 	crate::clock::fake_host_wall(wall + start.elapsed());
-	broadcast.announce(route).unwrap();
+	broadcast.announce().unwrap();
 	assert_eq!(
 		catalog.snapshot().media.clock,
 		clock,
@@ -9196,7 +9194,7 @@ async fn a_return_keeps_catalog_and_group_history() {
 #[tokio::test(start_paused = true)]
 async fn a_switch_carries_through_an_instance_that_never_built_its_tables() {
 	let origin = crate::source::produce_origin();
-	let route = || moq_net::origin::Route::default().with_instance(moq_net::Instance::random(), 0);
+	let route = || moq_net::origin::RouteOptions::default().with_instance(moq_net::Instance::random(), 0);
 
 	let (old, mut old_catalog) = publish_live::<()>(&origin, route());
 	let mut old_audio = aac_rendition(&mut old.broadcast().clone(), &mut old_catalog, "a.aac");
@@ -9254,7 +9252,7 @@ async fn a_switch_carries_through_an_instance_that_never_built_its_tables() {
 #[tokio::test(start_paused = true)]
 async fn another_instance_is_a_full_program_switch() {
 	let origin = crate::source::produce_origin();
-	let route = || moq_net::origin::Route::default().with_instance(moq_net::Instance::random(), 0);
+	let route = || moq_net::origin::RouteOptions::default().with_instance(moq_net::Instance::random(), 0);
 
 	let (old, mut old_catalog) = publish_live::<()>(&origin, route());
 	let mut old_audio = aac_rendition(&mut old.broadcast().clone(), &mut old_catalog, "a.aac");
@@ -9358,7 +9356,7 @@ async fn another_instance_is_a_full_program_switch() {
 #[tokio::test(start_paused = true)]
 async fn a_switch_moving_the_pmt_advances_the_pat() {
 	let origin = crate::source::produce_origin();
-	let route = || moq_net::origin::Route::default().with_instance(moq_net::Instance::random(), 0);
+	let route = || moq_net::origin::RouteOptions::default().with_instance(moq_net::Instance::random(), 0);
 	let publish = |pmt_pid: u16| {
 		let (broadcast, mut catalog) = publish_live::<tscat::Ext>(&origin, route());
 		let track = aac_rendition(&mut broadcast.broadcast().clone(), &mut catalog, "a.aac");
@@ -9413,7 +9411,7 @@ async fn a_switch_moving_the_pmt_advances_the_pat() {
 async fn export_stats_count_only_returned_output() {
 	let origin = crate::source::produce_origin();
 	let instance = moq_net::Instance::random();
-	let route = || moq_net::origin::Route::default().with_instance(instance.clone(), 0);
+	let route = || moq_net::origin::RouteOptions::default().with_instance(instance.clone(), 0);
 	let units = |stats: stats::Export| stats.streams.values().map(|row| row.units).sum::<u64>() as usize;
 
 	let (broadcast, mut catalog) = publish_live::<()>(&origin, route());
@@ -9771,8 +9769,8 @@ async fn large_pmt(streams: u16, mux_rate: Option<u64>) -> usize {
 fn publish_bare(
 	origin: &moq_net::origin::Producer,
 	instance: Option<&moq_net::Instance>,
-) -> (moq_net::origin::Publication, crate::catalog::Producer<()>) {
-	let route = moq_net::origin::Route::default();
+) -> (moq_net::origin::Route, crate::catalog::Producer<()>) {
+	let route = moq_net::origin::RouteOptions::default();
 	publish_live::<()>(
 		origin,
 		instance.map_or(route.clone(), |instance| route.with_instance(instance.clone(), 0)),
@@ -9786,7 +9784,7 @@ async fn follower(origin: &moq_net::origin::Producer) -> super::Follower {
 }
 
 /// End a catalog-only broadcast cleanly.
-fn finish((broadcast, mut catalog): (moq_net::origin::Publication, crate::catalog::Producer<()>)) {
+fn finish((broadcast, mut catalog): (moq_net::origin::Route, crate::catalog::Producer<()>)) {
 	catalog.finish().unwrap();
 	drop((broadcast, catalog));
 }
@@ -9878,12 +9876,12 @@ async fn a_follower_awaits_a_replacement_catalog_past_the_follow() {
 
 	// Replaced, but the replacement's catalog request is never answered.
 	let second = origin
-		.publish(
+		.route(
 			"live",
-			moq_net::origin::Route::default().with_instance(moq_net::Instance::random(), 0),
+			moq_net::origin::RouteOptions::default().with_instance(moq_net::Instance::random(), 0),
 		)
 		.unwrap();
-	let unanswered = second.requests();
+	let unanswered = second.broadcast().requests();
 	assert!(
 		kio::clock::timeout(follow * 3, follower.next()).await.is_err(),
 		"awaiting the replacement's catalog past the follow"
@@ -9915,9 +9913,15 @@ async fn a_follower_awaits_a_return_catalog_until_it_fails() {
 	);
 
 	let second = origin
-		.publish("live", moq_net::origin::Route::default().with_instance(instance, 0))
+		.route(
+			"live",
+			moq_net::origin::RouteOptions::default().with_instance(instance, 0),
+		)
+		.unwrap();
+	let silent = second
+		.broadcast()
+		.create_track(hang::Catalog::DEFAULT_NAME, None)
 		.unwrap();
-	let silent = second.create_track(hang::Catalog::DEFAULT_NAME, None).unwrap();
 	assert!(
 		kio::clock::timeout(follow * 3, follower.next()).await.is_err(),
 		"awaiting the return's catalog past the follow"
@@ -9951,9 +9955,12 @@ async fn a_follower_keeps_following_when_a_return_goes_before_it_resolves() {
 
 	// Back, but its catalog request is never answered before it goes again.
 	let second = origin
-		.publish("live", moq_net::origin::Route::default().with_instance(instance, 0))
+		.route(
+			"live",
+			moq_net::origin::RouteOptions::default().with_instance(instance, 0),
+		)
 		.unwrap();
-	let unanswered = second.requests();
+	let unanswered = second.broadcast().requests();
 	assert!(
 		kio::clock::timeout(Duration::from_secs(1), follower.next())
 			.await
@@ -9973,12 +9980,12 @@ async fn a_follower_keeps_following_when_a_return_goes_before_it_resolves() {
 /// returned task is aborted, which ends the broadcast.
 fn publish_refusing(origin: &moq_net::origin::Producer, instance: &moq_net::Instance) -> tokio::task::JoinHandle<()> {
 	let broadcast = origin
-		.publish(
+		.route(
 			"live",
-			moq_net::origin::Route::default().with_instance(instance.clone(), 0),
+			moq_net::origin::RouteOptions::default().with_instance(instance.clone(), 0),
 		)
 		.unwrap();
-	let mut dynamic = broadcast.requests();
+	let mut dynamic = broadcast.broadcast().requests();
 	tokio::spawn(async move {
 		let _broadcast = broadcast;
 		while let Ok(request) = dynamic.requested_track().await {
@@ -10063,7 +10070,7 @@ async fn a_follower_reports_a_refused_return_at_the_follow() {
 #[tokio::test(start_paused = true)]
 async fn a_follower_stitches_onto_the_next_replacement_when_one_goes_before_it_resolves() {
 	let origin = crate::source::produce_origin();
-	let route = || moq_net::origin::Route::default().with_instance(moq_net::Instance::random(), 0);
+	let route = || moq_net::origin::RouteOptions::default().with_instance(moq_net::Instance::random(), 0);
 	let first = publish_bare(&origin, Some(&moq_net::Instance::random()));
 	let mut follower = follower(&origin)
 		.await
@@ -10071,8 +10078,8 @@ async fn a_follower_stitches_onto_the_next_replacement_when_one_goes_before_it_r
 		.with_follow(Duration::from_secs(10));
 
 	// Replaced, but the replacement's catalog request is never answered before it goes.
-	let second = origin.publish("live", route()).unwrap();
-	let unanswered = second.requests();
+	let second = origin.route("live", route()).unwrap();
+	let unanswered = second.broadcast().requests();
 	assert!(
 		kio::clock::timeout(Duration::from_secs(1), follower.next())
 			.await
@@ -10129,12 +10136,12 @@ async fn a_follower_keeps_a_return_awaiting_its_catalog_when_a_stitch_goes() {
 
 	// Replaced, but the replacement's catalog request is never answered before it goes.
 	let third = origin
-		.publish(
+		.route(
 			"live",
-			moq_net::origin::Route::default().with_instance(moq_net::Instance::random(), 0),
+			moq_net::origin::RouteOptions::default().with_instance(moq_net::Instance::random(), 0),
 		)
 		.unwrap();
-	let unanswered = third.requests();
+	let unanswered = third.broadcast().requests();
 	assert!(
 		kio::clock::timeout(Duration::from_secs(1), follower.next())
 			.await
@@ -10175,12 +10182,12 @@ async fn a_return_after_an_abandoned_switch_restores_priority() {
 
 	// Replaced, but the replacement's catalog request is never answered.
 	let replacement = origin
-		.publish(
+		.route(
 			"live",
-			moq_net::origin::Route::default().with_instance(moq_net::Instance::random(), 0),
+			moq_net::origin::RouteOptions::default().with_instance(moq_net::Instance::random(), 0),
 		)
 		.unwrap();
-	let unanswered = replacement.requests();
+	let unanswered = replacement.broadcast().requests();
 	pump(&mut follower).await;
 	assert_eq!(
 		old_audio.track().subscription().unwrap().priority,
@@ -10257,9 +10264,9 @@ async fn a_follower_fails_a_stitch_onto_a_replacement_that_refuses_its_catalog()
 	let mut follower = follower(&origin).await.with_stitch(true);
 
 	let _second = origin
-		.publish(
+		.route(
 			"live",
-			moq_net::origin::Route::default().with_instance(moq_net::Instance::random(), 0),
+			moq_net::origin::RouteOptions::default().with_instance(moq_net::Instance::random(), 0),
 		)
 		.unwrap();
 	let end = kio::clock::timeout(Duration::from_secs(10), follower.next())
@@ -10312,21 +10319,19 @@ async fn a_follower_built_after_its_route_went_follows_the_return() {
 #[tokio::test(start_paused = true)]
 async fn a_follower_takes_its_own_instance_winning_back_for_no_replacement() {
 	let origin = crate::source::produce_origin();
-	let route = |cost: u64| {
-		moq_net::origin::Route::default()
-			.with_instance(moq_net::Instance::random(), 0)
-			.with_cost(cost)
-	};
+	let route = |cost: u64| moq_net::origin::RouteOptions::default().with_cost(cost);
 
 	// The export resolves its own instance.
-	let served = origin.create_broadcast("pool/job").unwrap();
+	let served = origin
+		.route("pool/job", moq_net::origin::RouteOptions::hidden().with_cost(5))
+		.unwrap();
 	let mut catalog = crate::catalog::Producer::<()>::new(&mut served.broadcast().clone(), Default::default()).unwrap();
-	served.announce(route(5)).unwrap();
+	served.announce().unwrap();
 	let source = crate::source::resolved(&origin, "pool/job").await;
 	let mut follower = super::Follower::new(open_export(source).await.unwrap()).unwrap();
 
 	// A cheaper route takes the path for a while, then goes.
-	let cheaper = origin.publish("pool/job", route(1)).unwrap();
+	let cheaper = origin.route("pool/job", route(1)).unwrap();
 	assert!(
 		kio::clock::timeout(Duration::from_secs(1), follower.next())
 			.await
@@ -10431,8 +10436,8 @@ async fn drain_follower(follower: &mut super::Follower) -> (Vec<Frame>, Option<c
 async fn a_follower_continues_through_a_same_instance_handoff_after_a_gap() {
 	let origin = crate::source::produce_origin();
 	let instance = moq_net::Instance::random();
-	let route = moq_net::origin::Route::default().with_instance(instance.clone(), 0);
-	let exact = origin.publish("pool/job", route.clone()).unwrap();
+	let route = moq_net::origin::RouteOptions::default().with_instance(instance.clone(), 0);
+	let exact = origin.route("pool/job", route.clone()).unwrap();
 	let mut catalog = crate::catalog::Producer::<()>::new(&mut exact.broadcast().clone(), Default::default()).unwrap();
 	let mut track = aac_rendition(&mut exact.broadcast().clone(), &mut catalog, "a.aac");
 	let source = crate::source::resolved(&origin, "pool/job").await;
@@ -10457,10 +10462,11 @@ async fn a_follower_continues_through_a_same_instance_handoff_after_a_gap() {
 	catalog.abort(moq_net::Error::Unroutable);
 	drop(exact);
 	kio::clock::sleep(Duration::from_secs(1)).await;
-	let served = origin.create_broadcast("pool/job").unwrap();
+	let hidden = moq_net::origin::RouteOptions::hidden().with_instance(instance.clone(), 0);
+	let served = origin.route("pool/job", hidden).unwrap();
 	let mut catalog = crate::catalog::Producer::<()>::new(&mut served.broadcast().clone(), Default::default()).unwrap();
 	let mut track = aac_rendition(&mut served.broadcast().clone(), &mut catalog, "a.aac");
-	served.announce(route).unwrap();
+	served.announce().unwrap();
 	let resumed = start.elapsed().as_millis() as u64;
 	for ms in (resumed..resumed + 200).step_by(20) {
 		write_aac(&mut track, ms);
@@ -10493,17 +10499,21 @@ async fn a_follower_continues_through_a_same_instance_handoff_after_a_gap() {
 #[tokio::test(start_paused = true)]
 async fn a_follower_ignores_a_covering_prefix_while_the_exact_route_serves() {
 	let origin = crate::source::produce_origin();
-	let route = |instance| moq_net::origin::Route::default().with_instance(instance, 0);
-	let exact = origin.publish("pool/job", route(moq_net::Instance::random())).unwrap();
+	let route = |instance| moq_net::origin::RouteOptions::default().with_instance(instance, 0);
+	let exact = origin.route("pool/job", route(moq_net::Instance::random())).unwrap();
 	let catalog = crate::catalog::Producer::<()>::new(&mut exact.broadcast().clone(), Default::default()).unwrap();
 	let source = crate::source::resolved(&origin, "pool/job").await;
 	let mut follower = super::Follower::new(open_export(source).await.unwrap()).unwrap();
 	let quiet = Duration::from_secs(1);
 
-	let pool = origin.requests("pool").unwrap();
+	let pool = origin
+		.route_prefix("pool", moq_net::origin::RouteOptions::default())
+		.unwrap();
 	assert!(kio::clock::timeout(quiet, follower.next()).await.is_err(), "a start");
 	drop(pool);
-	let pool = origin.requests("pool").unwrap();
+	let pool = origin
+		.route_prefix("pool", moq_net::origin::RouteOptions::default())
+		.unwrap();
 	assert!(kio::clock::timeout(quiet, follower.next()).await.is_err(), "a restart");
 	drop(pool);
 	assert!(kio::clock::timeout(quiet, follower.next()).await.is_err(), "an end");
@@ -10554,8 +10564,8 @@ async fn a_cancelled_replacement_after_the_follow_can_follow_again() {
 
 	for format in [CatalogFormat::Hang, CatalogFormat::Msf] {
 		let origin = crate::source::produce_origin();
-		let route = || moq_net::origin::Route::default().with_instance(moq_net::Instance::random(), 0);
-		let first = origin.publish("live", route()).unwrap();
+		let route = || moq_net::origin::RouteOptions::default().with_instance(moq_net::Instance::random(), 0);
+		let first = origin.route("live", route()).unwrap();
 		let (name, snapshot) = match format {
 			CatalogFormat::Hang => (
 				hang::Catalog::DEFAULT_NAME,
@@ -10566,7 +10576,10 @@ async fn a_cancelled_replacement_after_the_follow_can_follow_again() {
 				moq_msf::Catalog::<()>::new(Vec::new()).to_json().unwrap().into_bytes(),
 			),
 		};
-		let mut old_catalog = first.create_track(name, hang::Catalog::default_track_info()).unwrap();
+		let mut old_catalog = first
+			.broadcast()
+			.create_track(name, hang::Catalog::default_track_info())
+			.unwrap();
 		let mut group = old_catalog.append_group().unwrap();
 		group.write_frame(Timestamp::now(), snapshot).unwrap();
 		group.finish().unwrap();
@@ -10652,12 +10665,12 @@ async fn a_midstream_stitch_keeps_the_old_instance_playing_until_it_switches() {
 	let mut follower = super::Follower::new(export).unwrap().with_stitch(true);
 
 	let second = origin
-		.publish(
+		.route(
 			"live",
-			moq_net::origin::Route::default().with_instance(moq_net::Instance::random(), 0),
+			moq_net::origin::RouteOptions::default().with_instance(moq_net::Instance::random(), 0),
 		)
 		.unwrap();
-	let _unanswered = second.requests();
+	let _unanswered = second.broadcast().requests();
 	for ms in (0..200).step_by(20) {
 		write_aac(&mut track, ms);
 	}
@@ -10689,12 +10702,12 @@ async fn a_nested_stitch_keeps_awaiting_the_pending_replacement() {
 
 	// Replaced again, but that one's catalog request is never answered before it goes.
 	let third = origin
-		.publish(
+		.route(
 			"live",
-			moq_net::origin::Route::default().with_instance(moq_net::Instance::random(), 0),
+			moq_net::origin::RouteOptions::default().with_instance(moq_net::Instance::random(), 0),
 		)
 		.unwrap();
-	let unanswered = third.requests();
+	let unanswered = third.broadcast().requests();
 	assert!(
 		kio::clock::timeout(Duration::from_secs(1), follower.next())
 			.await
@@ -10839,7 +10852,7 @@ async fn a_repointed_si_entry_never_reads_a_replacement() {
 		.collect();
 
 	// Another instance takes the path with its own `b.si`, and only then is the entry repointed.
-	let new = origin.publish("live", Default::default()).unwrap();
+	let new = origin.route("live", Default::default()).unwrap();
 	let _new_b = si_track(&mut new.broadcast().clone(), "b.si", &sdt_new);
 	catalog
 		.modify()
@@ -11551,7 +11564,7 @@ async fn placed_sections_keep_their_source_positions() {
 async fn a_track_renamed_on_its_pid_across_returns_retires_the_one_before() {
 	let origin = crate::source::produce_origin();
 	let instance = moq_net::Instance::random();
-	let route = || moq_net::origin::Route::default().with_instance(instance.clone(), 0);
+	let route = || moq_net::origin::RouteOptions::default().with_instance(instance.clone(), 0);
 	let rendition = |broadcast: &mut moq_net::broadcast::Producer,
 	                 catalog: &mut crate::catalog::Producer<tscat::Ext>,
 	                 name: &str| {
@@ -11618,7 +11631,7 @@ async fn a_track_renamed_on_its_pid_across_returns_retires_the_one_before() {
 async fn a_track_renamed_on_its_pid_across_a_return_is_quiet_from_its_listing() {
 	let origin = crate::source::produce_origin();
 	let instance = moq_net::Instance::random();
-	let route = || moq_net::origin::Route::default().with_instance(instance.clone(), 0);
+	let route = || moq_net::origin::RouteOptions::default().with_instance(instance.clone(), 0);
 	let rendition = |broadcast: &mut moq_net::broadcast::Producer,
 	                 catalog: &mut crate::catalog::Producer<tscat::Ext>,
 	                 name: &str| {
@@ -11690,7 +11703,7 @@ async fn a_track_renamed_on_its_pid_across_a_return_is_quiet_from_its_listing()
 #[tokio::test(start_paused = true)]
 async fn a_switch_follows_the_last_pmt_out() {
 	let origin = crate::source::produce_origin();
-	let route = || moq_net::origin::Route::default().with_instance(moq_net::Instance::random(), 0);
+	let route = || moq_net::origin::RouteOptions::default().with_instance(moq_net::Instance::random(), 0);
 
 	let (old, mut old_catalog) = publish_live::<tscat::Ext>(&origin, route());
 	let mut audio = aac_rendition(&mut old.broadcast().clone(), &mut old_catalog, "a.aac");
@@ -11738,7 +11751,7 @@ async fn a_switch_follows_the_last_pmt_out() {
 #[tokio::test(start_paused = true)]
 async fn a_switch_follows_the_last_pat_out() {
 	let origin = crate::source::produce_origin();
-	let route = || moq_net::origin::Route::default().with_instance(moq_net::Instance::random(), 0);
+	let route = || moq_net::origin::RouteOptions::default().with_instance(moq_net::Instance::random(), 0);
 
 	let (old, mut old_catalog) = publish_live::<tscat::Ext>(&origin, route());
 	let mut audio = aac_rendition(&mut old.broadcast().clone(), &mut old_catalog, "a.aac");
@@ -11787,7 +11800,7 @@ async fn a_switch_follows_the_last_pat_out() {
 #[tokio::test(start_paused = true)]
 async fn a_switch_past_an_instance_that_laid_no_tables_follows_the_last_pmt_out() {
 	let origin = crate::source::produce_origin();
-	let route = || moq_net::origin::Route::default().with_instance(moq_net::Instance::random(), 0);
+	let route = || moq_net::origin::RouteOptions::default().with_instance(moq_net::Instance::random(), 0);
 	let follow = async |export: Export<_>| {
 		let replacement = origin.consume().request("live", None).await.unwrap();
 		let stream = crate::catalog::Consumer::new(&replacement, Default::default())
@@ -11842,7 +11855,7 @@ async fn a_switch_past_an_instance_that_laid_no_tables_follows_the_last_pmt_out(
 #[tokio::test(start_paused = true)]
 async fn a_stitched_switch_keeps_the_healthy_legs_held_frames() {
 	let origin = crate::source::produce_origin();
-	let route = || moq_net::origin::Route::default().with_instance(moq_net::Instance::random(), 0);
+	let route = || moq_net::origin::RouteOptions::default().with_instance(moq_net::Instance::random(), 0);
 	let (old, mut old_catalog) = publish_live::<()>(&origin, route());
 	let mut old_audio = aac_rendition(&mut old.broadcast().clone(), &mut old_catalog, "a.aac");
 	let mut export = open_export(crate::source::resolved(&origin, "live").await)
@@ -11880,7 +11893,7 @@ async fn a_stitched_switch_keeps_the_healthy_legs_held_frames() {
 async fn a_healthy_stitch_feeds_the_old_generation_until_the_new_clock_acquires() {
 	use std::task::Poll;
 	let origin = crate::source::produce_origin();
-	let route = || moq_net::origin::Route::default().with_instance(moq_net::Instance::random(), 0);
+	let route = || moq_net::origin::RouteOptions::default().with_instance(moq_net::Instance::random(), 0);
 	let (old, mut old_catalog) = publish_live::<()>(&origin, route());
 	let mut old_audio = aac_rendition(&mut old.broadcast().clone(), &mut old_catalog, "a.aac");
 	let export = open_export(crate::source::resolved(&origin, "live").await)
@@ -11955,7 +11968,7 @@ async fn a_healthy_stitch_feeds_the_old_generation_until_the_new_clock_acquires(
 async fn repeated_stitches_keep_the_delay() {
 	use std::task::Poll;
 	let origin = crate::source::produce_origin();
-	let route = || moq_net::origin::Route::default().with_instance(moq_net::Instance::random(), 0);
+	let route = || moq_net::origin::RouteOptions::default().with_instance(moq_net::Instance::random(), 0);
 	// Publisher `k` stamps its media `k * 100 s` on, so each one has its own timeline.
 	const SPACING: u64 = 100_000;
 	const SWITCH: u64 = 4_000;
@@ -12037,7 +12050,7 @@ async fn repeated_stitches_keep_the_delay() {
 #[tokio::test(start_paused = true)]
 async fn an_expired_follow_stops_healthy_input_but_drains_its_buffered_tail() {
 	let origin = crate::source::produce_origin();
-	let route = || moq_net::origin::Route::default().with_instance(moq_net::Instance::random(), 0);
+	let route = || moq_net::origin::RouteOptions::default().with_instance(moq_net::Instance::random(), 0);
 	let (old, mut old_catalog) = publish_live::<()>(&origin, route());
 	let mut old_audio = aac_rendition(&mut old.broadcast().clone(), &mut old_catalog, "a.aac");
 	let delay = Duration::from_millis(500);
@@ -12203,7 +12216,7 @@ async fn a_publisher_that_leaves_drains_its_buffered_tail_before_the_end() {
 #[tokio::test(start_paused = true)]
 async fn a_replacement_leaving_before_it_commits_keeps_the_old_program() {
 	let origin = crate::source::produce_origin();
-	let route = || moq_net::origin::Route::default().with_instance(moq_net::Instance::random(), 0);
+	let route = || moq_net::origin::RouteOptions::default().with_instance(moq_net::Instance::random(), 0);
 	let (old, mut old_catalog) = publish_live::<()>(&origin, route());
 	let mut old_audio = aac_rendition(&mut old.broadcast().clone(), &mut old_catalog, "a.aac");
 	let mut export = open_export(crate::source::resolved(&origin, "live").await)
@@ -12266,7 +12279,7 @@ async fn a_replacement_leaving_before_it_commits_keeps_the_old_program() {
 #[tokio::test(start_paused = true)]
 async fn a_newer_pending_instance_discards_the_unemitted_held_replacement() {
 	let origin = crate::source::produce_origin();
-	let route = || moq_net::origin::Route::default().with_instance(moq_net::Instance::random(), 0);
+	let route = || moq_net::origin::RouteOptions::default().with_instance(moq_net::Instance::random(), 0);
 	let (a, mut a_catalog) = publish_live::<()>(&origin, route());
 	let mut a_audio = aac_rendition(&mut a.broadcast().clone(), &mut a_catalog, "a.aac");
 	let mut export = open_export(crate::source::resolved(&origin, "live").await)
@@ -12328,7 +12341,7 @@ async fn a_newer_pending_instance_discards_the_unemitted_held_replacement() {
 #[tokio::test(start_paused = true)]
 async fn an_empty_finished_replacement_drains_the_old_program() {
 	let origin = crate::source::produce_origin();
-	let route = || moq_net::origin::Route::default().with_instance(moq_net::Instance::random(), 0);
+	let route = || moq_net::origin::RouteOptions::default().with_instance(moq_net::Instance::random(), 0);
 	let (old, mut catalog) = publish_live::<()>(&origin, route());
 	let mut audio = aac_rendition(&mut old.broadcast().clone(), &mut catalog, "a.aac");
 	let mut export = open_export(crate::source::resolved(&origin, "live").await)
@@ -12379,7 +12392,7 @@ async fn an_empty_finished_replacement_drains_the_old_program() {
 async fn cold_same_instance_return(pending: bool) {
 	let origin = crate::source::produce_origin();
 	let instance = moq_net::Instance::random();
-	let route = || moq_net::origin::Route::default().with_instance(instance.clone(), 0);
+	let route = || moq_net::origin::RouteOptions::default().with_instance(instance.clone(), 0);
 	let (old, mut old_catalog) = publish_live::<()>(&origin, route());
 	let mut old_video = h264_rendition(&mut old.broadcast().clone(), &mut old_catalog, "v.avc1");
 	let mut old_audio = aac_rendition(&mut old.broadcast().clone(), &mut old_catalog, "a.aac");
@@ -12400,7 +12413,7 @@ async fn cold_same_instance_return(pending: bool) {
 		let next_instance = moq_net::Instance::random();
 		let (cold, mut catalog) = publish_live::<()>(
 			&origin,
-			moq_net::origin::Route::default().with_instance(next_instance.clone(), 0),
+			moq_net::origin::RouteOptions::default().with_instance(next_instance.clone(), 0),
 		);
 		let mut video = h264_rendition(&mut cold.broadcast().clone(), &mut catalog, "v.avc1");
 		let mut audio = aac_rendition(&mut cold.broadcast().clone(), &mut catalog, "a.aac");
@@ -12422,19 +12435,19 @@ async fn cold_same_instance_return(pending: bool) {
 		if let std::task::Poll::Ready(Ok(Some(frame))) = export.poll_next(&kio::Waiter::noop()) {
 			prefix.push(frame);
 		}
-		cold.unannounce();
+		cold.withdraw();
 		next_instance
 	} else {
 		old_video.finish().unwrap();
 		old_audio.finish().unwrap();
 		old_catalog.finish().unwrap();
 		assert!(export.next().await.unwrap().is_none());
-		old.unannounce();
+		old.withdraw();
 		instance
 	};
 	let (back, mut catalog) = publish_live::<()>(
 		&origin,
-		moq_net::origin::Route::default().with_instance(returned_instance, 0),
+		moq_net::origin::RouteOptions::default().with_instance(returned_instance, 0),
 	);
 	let mut video = h264_rendition(&mut back.broadcast().clone(), &mut catalog, "v.avc1");
 	let mut audio = aac_rendition(&mut back.broadcast().clone(), &mut catalog, "a.aac");
diff --git a/rs/moq-mux/src/container/ts/programs.rs b/rs/moq-mux/src/container/ts/programs.rs
index 03a52c4999d..7111834f2ce 100644
--- a/rs/moq-mux/src/container/ts/programs.rs
+++ b/rs/moq-mux/src/container/ts/programs.rs
@@ -127,13 +127,14 @@ impl Clock {
 struct Program {
 	/// The PAT's program number.
 	number: u16,
-	/// Owns announcement control while the importer holds a fill clone.
-	broadcast: moq_net::origin::Publication,
+	/// The program's route, created hidden: dropping it retracts the broadcast the importer
+	/// fills.
+	route: moq_net::origin::Route,
 	import: Import<Ext>,
 	catalog: catalog::Producer<Ext>,
-	/// The route and catalog track until the catalog first names a servable track: announced any
-	/// sooner, a relay would ask for tracks it cannot serve yet.
-	pending: Option<(moq_net::origin::Route, moq_net::track::Consumer)>,
+	/// The catalog track until the catalog first names a servable track: announced any sooner,
+	/// a relay would ask for tracks it cannot serve yet.
+	pending: Option<moq_net::track::Consumer>,
 	/// The PIDs this program is listed under in [`Programs::readers`], sorted.
 	claims: Vec<u16>,
 	/// The ways it reads each PID, sorted, but for the PAT and the SI PIDs every program reads.
@@ -145,7 +146,7 @@ struct Program {
 impl Program {
 	/// Announce the broadcast once its catalog has gone out.
 	fn announce_if_listed(&mut self) -> anyhow::Result<bool> {
-		let Some((route, listed)) = &mut self.pending else {
+		let Some(listed) = &mut self.pending else {
 			return Ok(true);
 		};
 		if !matches!(
@@ -154,8 +155,8 @@ impl Program {
 		) {
 			return Ok(false);
 		}
-		self.broadcast
-			.announce(route.clone())
+		self.route
+			.announce()
 			.with_context(|| format!("failed to announce program {}", self.number))?;
 		self.pending = None;
 		Ok(true)
@@ -635,7 +636,7 @@ impl Programs {
 			}
 		}
 		for (program, _) in gone.values() {
-			program.broadcast.close();
+			program.route.broadcast().close();
 		}
 		Ok(())
 	}
@@ -725,9 +726,11 @@ impl Programs {
 	fn start(&mut self, number: u16, pmt_pid: u16, sections: SectionReassembler) -> anyhow::Result<()> {
 		let pat = self.pat.as_ref().expect("a program waits on its PAT");
 		let name = program_broadcast(self.name.as_str(), number);
-		let broadcast = self
+		// Each program is its own publisher instance for this run, minted by its route, so a
+		// restart replaces it rather than resuming into it.
+		let route = self
 			.origin
-			.create_broadcast(&name)
+			.route(&name, moq_net::origin::RouteOptions::hidden())
 			.with_context(|| format!("failed to create broadcast {name}"))?;
 		// TS carries undecoded elementary streams verbatim, so each catalog carries the
 		// `mpegts` extension, and owns its broadcast's catalog tracks.
@@ -735,22 +738,19 @@ impl Programs {
 			.config
 			.clone()
 			.with_catalog(catalog::hang::Catalog::<Ext>::default());
-		let catalog = catalog::Producer::new(&mut broadcast.broadcast().clone(), config)?;
+		let catalog = catalog::Producer::new(&mut route.broadcast().clone(), config)?;
 		let pmt_pid = Pid::new(pmt_pid).expect("a packet's PID fits 13 bits");
-		let mut import = Import::new(broadcast.broadcast().clone(), catalog.reserve())
+		let mut import = Import::new(route.broadcast().clone(), catalog.reserve())
 			.with_program(number)
 			.with_pmt(pmt_pid, sections);
 		import.handle_pat(pat)?;
-		// Each program is its own publisher instance for this run, so a restart
-		// replaces it rather than resuming into it.
-		let route = moq_net::origin::Route::default().with_instance(moq_net::Instance::random(), 0);
-		let listed = broadcast.consume().track(hang::Catalog::DEFAULT_NAME)?;
+		let listed = route.broadcast().consume().track(hang::Catalog::DEFAULT_NAME)?;
 		self.programs.push(Program {
 			number,
-			broadcast,
+			route,
 			import,
 			catalog,
-			pending: Some((route, listed)),
+			pending: Some(listed),
 			claims: Vec::new(),
 			reads: Vec::new(),
 			touched: false,
@@ -892,7 +892,7 @@ impl Programs {
 		Ok(self
 			.programs
 			.iter()
-			.map(|program| program.broadcast.broadcast().clone())
+			.map(|program| program.route.broadcast().clone())
 			.collect())
 	}
 
@@ -936,14 +936,7 @@ mod test {
 		programs
 			.programs
 			.iter()
-			.map(|program| {
-				let route = program.broadcast.route();
-				let route = route.as_ref().or(program.pending.as_ref().map(|(route, _)| route));
-				(
-					program.number,
-					route.and_then(|route| route.instance.clone()).expect("an instance"),
-				)
-			})
+			.map(|program| (program.number, program.route.instance()))
 			.collect()
 	}
 
@@ -1001,7 +994,7 @@ mod test {
 		let both = instances(&programs);
 		assert_eq!(both[0], one[0], "program 1 carries on");
 		assert_eq!(both[1].0, 2, "the added program publishes");
-		let two = programs.programs[1].broadcast.consume();
+		let two = programs.programs[1].route.broadcast().consume();
 		let mut catalog = hang::catalog::Catalog::<()>::subscribe(&two).await.unwrap();
 
 		steps.step(&mut programs, &[(1, 0x100)]);
@@ -2020,16 +2013,16 @@ mod test {
 		);
 		programs.decode(&two_section_pat()).unwrap();
 		programs.finish().unwrap();
+		assert!(
+			programs.programs.iter().all(|program| program.route.is_announced()),
+			"every program announces"
+		);
 		let instances: Vec<_> = programs
 			.programs
 			.iter()
-			.map(|program| program.broadcast.route().and_then(|route| route.instance))
+			.map(|program| program.route.instance())
 			.collect();
 		assert_eq!(instances.len(), 2);
-		assert!(
-			instances.iter().all(Option::is_some),
-			"every program names its instance"
-		);
 		assert_ne!(instances[0], instances[1]);
 	}
 
@@ -2051,10 +2044,7 @@ mod test {
 				.unwrap();
 		}
 		assert!(
-			programs
-				.programs
-				.iter()
-				.all(|program| program.broadcast.route().is_none()),
+			programs.programs.iter().all(|program| !program.route.is_announced()),
 			"announced on the PSI alone"
 		);
 		for packet in packets {
@@ -2062,10 +2052,7 @@ mod test {
 		}
 		programs.finish().unwrap();
 		assert!(
-			programs
-				.programs
-				.iter()
-				.all(|program| program.broadcast.route().is_some()),
+			programs.programs.iter().all(|program| program.route.is_announced()),
 			"every program is announced once it has declared its tracks"
 		);
 	}
@@ -2104,10 +2091,7 @@ mod test {
 		};
 		assert!(err.to_string().contains("declared a track"), "{err:#}");
 		assert!(
-			programs
-				.programs
-				.iter()
-				.all(|program| program.broadcast.route().is_none()),
+			programs.programs.iter().all(|program| !program.route.is_announced()),
 			"no empty program is announced"
 		);
 	}
diff --git a/rs/moq-mux/src/follow.rs b/rs/moq-mux/src/follow.rs
index 76294b1183f..e10d2c0b68d 100644
--- a/rs/moq-mux/src/follow.rs
+++ b/rs/moq-mux/src/follow.rs
@@ -100,8 +100,8 @@ mod tests {
 		}
 	}
 
-	fn route(instance: &moq_net::Instance) -> moq_net::origin::Route {
-		moq_net::origin::Route::default().with_instance(instance.clone(), 0)
+	fn route(instance: &moq_net::Instance) -> moq_net::origin::RouteOptions {
+		moq_net::origin::RouteOptions::default().with_instance(instance.clone(), 0)
 	}
 
 	/// The next change a follower reports, which must arrive within the origin's update hold.
@@ -127,13 +127,13 @@ mod tests {
 	#[tokio::test(start_paused = true)]
 	async fn a_follow_starts_late_and_survives_an_end() {
 		let origin = produce_origin();
-		let _catalog = origin.publish("a/pub", Default::default()).unwrap();
+		let _catalog = origin.route("a/pub", Default::default()).unwrap();
 		settle().await;
 		let source = resolved(&origin, "a/pub").await;
 		let mut follow = source.follow(Some(&Relative::new("./source").unwrap()), None).unwrap();
 		quiet(&mut follow).await;
 
-		let first = origin.publish("a/source", Default::default()).unwrap();
+		let first = origin.route("a/source", Default::default()).unwrap();
 		let started = followed(&mut follow).await.expect("a start");
 		assert_eq!(started.info().path.as_str(), "a/source");
 
@@ -141,7 +141,7 @@ mod tests {
 		assert!(followed(&mut follow).await.is_none(), "an end");
 		quiet(&mut follow).await;
 
-		let _second = origin.publish("a/source", Default::default()).unwrap();
+		let _second = origin.route("a/source", Default::default()).unwrap();
 		let restarted = followed(&mut follow).await.expect("a start");
 		assert!(!restarted.is_clone(&started));
 	}
@@ -152,8 +152,8 @@ mod tests {
 	async fn a_follow_restarts_only_without_an_instance() {
 		let origin = produce_origin();
 		let (old_instance, new_instance) = (moq_net::Instance::random(), moq_net::Instance::random());
-		let _catalog = origin.publish("a/pub", Default::default()).unwrap();
-		let _old = origin.publish("a/source", route(&old_instance)).unwrap();
+		let _catalog = origin.route("a/pub", Default::default()).unwrap();
+		let _old = origin.route("a/source", route(&old_instance)).unwrap();
 		settle().await;
 		let source = resolved(&origin, "a/pub").await;
 		let rel = Relative::new("./source").unwrap();
@@ -162,7 +162,7 @@ mod tests {
 		let old = followed(&mut any).await.unwrap();
 		assert!(followed(&mut named).await.unwrap().is_clone(&old));
 
-		let new = origin.publish("a/source", route(&new_instance)).unwrap();
+		let new = origin.route("a/source", route(&new_instance)).unwrap();
 		let replaced = followed(&mut any).await.unwrap();
 		assert_eq!(replaced.info().instance.as_ref(), Some(&new_instance));
 		assert!(followed(&mut named).await.is_none(), "another instance ends it");
@@ -183,10 +183,10 @@ mod tests {
 	#[tokio::test(start_paused = true)]
 	async fn a_named_instance_follows_a_minted_one() {
 		let origin = produce_origin();
-		let _catalog = origin.publish("a/pub", Default::default()).unwrap();
+		let _catalog = origin.route("a/pub", Default::default()).unwrap();
 		let minted: moq_net::Instance = "~minted".parse().unwrap();
 		assert!(minted.is_minted());
-		let _sibling = origin.publish("a/source", route(&minted)).unwrap();
+		let _sibling = origin.route("a/source", route(&minted)).unwrap();
 		settle().await;
 		let source = resolved(&origin, "a/pub").await;
 		let named = moq_net::Instance::random();
@@ -201,13 +201,13 @@ mod tests {
 	#[tokio::test(start_paused = true)]
 	async fn a_follow_of_the_catalog_keeps_its_instance() {
 		let origin = produce_origin();
-		let old = origin.publish("a/pub", Default::default()).unwrap();
+		let old = origin.route("a/pub", Default::default()).unwrap();
 		settle().await;
 		let source = resolved(&origin, "a/pub").await;
 		let mut follow = source.follow(Some(&Relative::new("./pub").unwrap()), None).unwrap();
 		assert!(followed(&mut follow).await.unwrap().is_clone(&source.broadcast()));
 
-		let _new = origin.publish("a/pub", Default::default()).unwrap();
+		let _new = origin.route("a/pub", Default::default()).unwrap();
 		quiet(&mut follow).await;
 		// Its end is the catalog's, which the catalog's reader sees.
 		drop(old);
diff --git a/rs/moq-mux/src/linger.rs b/rs/moq-mux/src/linger.rs
index b13cba9821d..6242c5d20d3 100644
--- a/rs/moq-mux/src/linger.rs
+++ b/rs/moq-mux/src/linger.rs
@@ -8,8 +8,9 @@ use std::{pin::Pin, task::Poll, time::Duration};
 /// Subscribers already reading a track get its tail when the broadcast closes; this serves
 /// the ones that arrive after the end, such as a relay or player that read the final catalog
 /// late. Finish the catalog and media tracks first, then hand over the broadcasts and
-/// `owner`, whatever holds their track producers: a finished track stops being served once
-/// its producers drop, so the owner drops only after the broadcasts close.
+/// `owner`, whatever holds their routes and track producers: a broadcast stays announced only
+/// while its [`Route`](moq_net::origin::Route) lives, and a finished track stops being served
+/// once its producers drop, so the owner drops only after the broadcasts close.
 ///
 /// The deadline is fixed at [`new`](Self::new), however late [`poll_wait`](Self::poll_wait) is
 /// first polled. Dropping the handle closes the broadcasts at once, which is how an interrupt
@@ -84,19 +85,25 @@ mod tests {
 
 	const PATH: &str = "live";
 
-	/// A broadcast at [`PATH`] whose one track, `video`, has three finished groups. It declares
-	/// media's max age, so its superseded groups stay fetchable as long as the default linger.
-	fn finished(origin: &moq_net::origin::Producer) -> (moq_net::broadcast::Producer, moq_net::track::Producer) {
-		let broadcast = origin.publish(PATH, moq_net::origin::Route::default()).unwrap();
+	/// A broadcast at [`PATH`] whose one track, `video`, has three finished groups, and the
+	/// owner holding its route and track. It declares media's max age, so its superseded groups
+	/// stay fetchable as long as the default linger.
+	fn finished(
+		origin: &moq_net::origin::Producer,
+	) -> (
+		moq_net::broadcast::Producer,
+		(moq_net::origin::Route, moq_net::track::Producer),
+	) {
+		let route = origin.route(PATH, moq_net::origin::RouteOptions::default()).unwrap();
 		let info = moq_net::track::Info::default().with_max_age(hang::container::MAX_AGE);
-		let track = broadcast.create_track("video", info).unwrap();
+		let track = route.broadcast().create_track("video", info).unwrap();
 		for _ in 0..3 {
 			let mut group = track.append_group().unwrap();
 			group.write_frame(None, bytes::Bytes::from_static(b"frame")).unwrap();
 			group.finish().unwrap();
 		}
 		track.finish().unwrap();
-		(broadcast.broadcast().clone(), track)
+		(route.broadcast().clone(), (route, track))
 	}
 
 	/// Whether the origin has stopped routing [`PATH`].
@@ -112,9 +119,9 @@ mod tests {
 	#[tokio::test(start_paused = true)]
 	async fn a_late_subscriber_drains_the_tail_until_the_deadline() {
 		let origin = crate::source::produce_origin();
-		let (broadcast, track) = finished(&origin);
+		let (broadcast, owner) = finished(&origin);
 		let start = kio::clock::now();
-		let linger = tokio::spawn(Linger::new([broadcast], track, Duration::from_secs(30)).wait());
+		let linger = tokio::spawn(Linger::new([broadcast], owner, Duration::from_secs(30)).wait());
 
 		kio::clock::sleep(Duration::from_secs(29)).await;
 		let late = origin.consume().request(PATH, None).await.unwrap();
@@ -140,9 +147,9 @@ mod tests {
 	#[tokio::test(start_paused = true)]
 	async fn the_deadline_is_fixed_at_the_end() {
 		let origin = crate::source::produce_origin();
-		let (broadcast, track) = finished(&origin);
+		let (broadcast, owner) = finished(&origin);
 		let start = kio::clock::now();
-		let linger = Linger::new([broadcast], track, Duration::from_secs(30));
+		let linger = Linger::new([broadcast], owner, Duration::from_secs(30));
 
 		kio::clock::sleep(Duration::from_secs(20)).await;
 		linger.wait().await;
@@ -153,8 +160,8 @@ mod tests {
 	#[tokio::test(start_paused = true)]
 	async fn dropping_closes_at_once() {
 		let origin = crate::source::produce_origin();
-		let (broadcast, track) = finished(&origin);
-		let linger = Linger::new([broadcast], track, Duration::from_secs(30));
+		let (broadcast, owner) = finished(&origin);
+		let linger = Linger::new([broadcast], owner, Duration::from_secs(30));
 		assert!(!unroutable(&origin).await);
 
 		drop(linger);
diff --git a/rs/moq-mux/src/source.rs b/rs/moq-mux/src/source.rs
index 2eaf862d879..3c6e2758c39 100644
--- a/rs/moq-mux/src/source.rs
+++ b/rs/moq-mux/src/source.rs
@@ -671,12 +671,14 @@ mod tests {
 	#[tokio::test]
 	async fn binding_retains_a_pending_request_across_cancelled_and_repeated_reads() {
 		let origin = produce_origin();
-		let _catalog = origin.publish("pub", Default::default()).unwrap();
+		let _catalog = origin.route("pub", Default::default()).unwrap();
 		settle().await;
 		let source = resolved(&origin, "pub").await;
-		let dynamic = origin.requests("media").unwrap();
+		let dynamic = origin
+			.route_prefix("media", moq_net::origin::RouteOptions::default())
+			.unwrap();
 		let binding = source.bind(Some(&Relative::new("media").unwrap()), None).unwrap();
-		let request = dynamic.requested_broadcast().await.unwrap();
+		let request = dynamic.requested().await.unwrap();
 
 		assert!(
 			binding.poll_broadcast(&kio::Waiter::noop()).is_pending(),
@@ -689,14 +691,14 @@ mod tests {
 			_ = std::future::ready(()) => {}
 		}
 
-		let prepared = request.prepare().unwrap();
-		let (first, second, producer) = tokio::join!(binding.broadcast(), binding.broadcast(), async {
-			prepared.publish().unwrap()
+		let route = request.route(moq_net::origin::RouteOptions::hidden()).unwrap();
+		let (first, second, ()) = tokio::join!(binding.broadcast(), binding.broadcast(), async {
+			route.announce().unwrap()
 		});
 		let first = first.unwrap();
 		assert!(!first.is_closed());
 		assert!(first.is_clone(&second.unwrap()));
-		drop((producer, dynamic));
+		drop((route, dynamic));
 		first.closed().await;
 		assert!(first.is_clone(&binding.broadcast().await.unwrap()));
 	}
@@ -707,7 +709,7 @@ mod tests {
 	#[tokio::test(start_paused = true)]
 	async fn a_binding_waits_for_the_first_announcement_and_keeps_it() {
 		let origin = produce_origin();
-		let _catalog = origin.publish("pub", Default::default()).unwrap();
+		let _catalog = origin.route("pub", Default::default()).unwrap();
 		settle().await;
 		let source = resolved(&origin, "pub").await;
 		let media = Relative::new("media").unwrap();
@@ -715,11 +717,11 @@ mod tests {
 		settle().await;
 		assert!(binding.poll_broadcast(&kio::Waiter::noop()).is_pending());
 
-		let first_publisher = origin.publish("media", Default::default()).unwrap();
+		let first_publisher = origin.route("media", Default::default()).unwrap();
 		let first = binding.broadcast().await.unwrap();
 		assert!(!first.is_closed());
 
-		let _second = origin.publish("media", Default::default()).unwrap();
+		let _second = origin.route("media", Default::default()).unwrap();
 		settle().await;
 		assert!(binding.broadcast().await.unwrap().is_clone(&first));
 		assert!(source.resolve(Some(&media), None).await.unwrap().is_clone(&first));
@@ -743,13 +745,13 @@ mod tests {
 	#[tokio::test(start_paused = true)]
 	async fn a_source_keeps_the_broadcast_it_was_built_from() {
 		let origin = produce_origin();
-		let _old = origin.publish("live", Default::default()).unwrap();
+		let _old = origin.route("live", Default::default()).unwrap();
 		settle().await;
 		let consumer = origin.consume();
 		let first = consumer.request("live", None).await.unwrap();
 
-		let new = origin.publish("live", Default::default()).unwrap();
-		let _late = new.create_track("late", None).unwrap();
+		let new = origin.route("live", Default::default()).unwrap();
+		let _late = new.broadcast().create_track("late", None).unwrap();
 		settle().await;
 		let source = Source::new(consumer, first.clone());
 		assert!(source.broadcast().is_clone(&first));
@@ -767,8 +769,8 @@ mod tests {
 		use crate::container::test_util::Link;
 
 		let healthy = produce_origin();
-		let _catalog = healthy.publish("a/pub", Default::default()).unwrap();
-		let _sibling = healthy.publish("a/source", Default::default()).unwrap();
+		let _catalog = healthy.route("a/pub", Default::default()).unwrap();
+		let _sibling = healthy.route("a/source", Default::default()).unwrap();
 		let stalled = produce_origin();
 		let subscriber = produce_origin();
 		let _healthy = Link::lazy(&healthy, &subscriber, true).await;
@@ -793,7 +795,7 @@ mod tests {
 		let binding = source.bind(Some(&Relative::new("./late").unwrap()), None).unwrap();
 		settle().await;
 		assert!(binding.poll_broadcast(&kio::Waiter::noop()).is_pending());
-		let _late = healthy.publish("a/late", Default::default()).unwrap();
+		let _late = healthy.route("a/late", Default::default()).unwrap();
 		let late = kio::clock::timeout(timeout, binding.broadcast())
 			.await
 			.expect("the later sibling resolves")
@@ -805,8 +807,8 @@ mod tests {
 	#[tokio::test(start_paused = true)]
 	async fn a_source_keeps_the_sibling_it_resolved() {
 		let origin = produce_origin();
-		let _catalog = origin.publish("a/pub", Default::default()).unwrap();
-		let _old = origin.publish("a/source", Default::default()).unwrap();
+		let _catalog = origin.route("a/pub", Default::default()).unwrap();
+		let _old = origin.route("a/source", Default::default()).unwrap();
 		settle().await;
 		let source = resolved(&origin, "a/pub").await;
 		let sibling = Relative::new("./source").unwrap();
@@ -815,8 +817,8 @@ mod tests {
 			.await
 			.expect("the sibling resolves");
 
-		let new = origin.publish("a/source", Default::default()).unwrap();
-		let _late = new.create_track("late", None).unwrap();
+		let new = origin.route("a/source", Default::default()).unwrap();
+		let _late = new.broadcast().create_track("late", None).unwrap();
 		settle().await;
 		assert!(source.resolve(Some(&sibling), None).await.unwrap().is_clone(&first));
 		assert!(
@@ -827,8 +829,8 @@ mod tests {
 		assert!(bound.is_clone(&first), "a binding honors the pin too");
 	}
 
-	fn route(instance: &moq_net::Instance) -> moq_net::origin::Route {
-		moq_net::origin::Route::default().with_instance(instance.clone(), 0)
+	fn route(instance: &moq_net::Instance) -> moq_net::origin::RouteOptions {
+		moq_net::origin::RouteOptions::default().with_instance(instance.clone(), 0)
 	}
 
 	fn is_mismatch(result: crate::Result<moq_net::broadcast::Consumer>, expected: &moq_net::Instance) -> bool {
@@ -844,8 +846,8 @@ mod tests {
 			moq_net::Instance::random(),
 			moq_net::Instance::random(),
 		);
-		let _catalog = origin.publish("a/pub", route(&catalog)).unwrap();
-		let _sibling = origin.publish("a/source", route(&sibling)).unwrap();
+		let _catalog = origin.route("a/pub", route(&catalog)).unwrap();
+		let _sibling = origin.route("a/source", route(&sibling)).unwrap();
 		settle().await;
 		let source = resolved(&origin, "a/pub").await;
 		let rel = Relative::new("./source").unwrap();
@@ -867,9 +869,9 @@ mod tests {
 	async fn a_replaced_sibling_fails_a_reference_to_the_old_instance() {
 		let origin = produce_origin();
 		let (old_instance, new_instance) = (moq_net::Instance::random(), moq_net::Instance::random());
-		let _catalog = origin.publish("a/pub", Default::default()).unwrap();
-		let _old = origin.publish("a/source", route(&old_instance)).unwrap();
-		let _new = origin.publish("a/source", route(&new_instance)).unwrap();
+		let _catalog = origin.route("a/pub", Default::default()).unwrap();
+		let _old = origin.route("a/source", route(&old_instance)).unwrap();
+		let _new = origin.route("a/source", route(&new_instance)).unwrap();
 		settle().await;
 		let source = resolved(&origin, "a/pub").await;
 		let rel = Relative::new("./source").unwrap();
@@ -889,14 +891,14 @@ mod tests {
 	async fn a_conflicting_instance_cannot_replace_a_pin() {
 		let origin = produce_origin();
 		let (old_instance, new_instance) = (moq_net::Instance::random(), moq_net::Instance::random());
-		let _catalog = origin.publish("a/pub", Default::default()).unwrap();
-		let _old = origin.publish("a/source", route(&old_instance)).unwrap();
+		let _catalog = origin.route("a/pub", Default::default()).unwrap();
+		let _old = origin.route("a/source", route(&old_instance)).unwrap();
 		settle().await;
 		let source = resolved(&origin, "a/pub").await;
 		let rel = Relative::new("./source").unwrap();
 		let first = source.resolve(Some(&rel), Some(&old_instance)).await.unwrap();
 
-		let _new = origin.publish("a/source", route(&new_instance)).unwrap();
+		let _new = origin.route("a/source", route(&new_instance)).unwrap();
 		settle().await;
 		// A rendition added later names the replacement: it fails, and the pin stays.
 		let binding = source.bind(Some(&rel), Some(&new_instance)).unwrap();
@@ -923,7 +925,7 @@ mod tests {
 	async fn a_self_reference_instance_checks_the_catalog_broadcast() {
 		let origin = produce_origin();
 		let (catalog, other) = (moq_net::Instance::random(), moq_net::Instance::random());
-		let _catalog = origin.publish("a/pub", route(&catalog)).unwrap();
+		let _catalog = origin.route("a/pub", route(&catalog)).unwrap();
 		settle().await;
 		let source = resolved(&origin, "a/pub").await;
 
@@ -945,11 +947,11 @@ mod tests {
 	#[tokio::test(start_paused = true)]
 	async fn self_references_keep_the_catalog_broadcast_after_replacement() {
 		let origin = produce_origin();
-		let old = origin.publish("a/live", Default::default()).unwrap();
+		let old = origin.route("a/live", Default::default()).unwrap();
 		settle().await;
 		let source = resolved(&origin, "a/live").await;
 		drop(old);
-		let _replacement = origin.publish("a/live", Default::default()).unwrap();
+		let _replacement = origin.route("a/live", Default::default()).unwrap();
 		settle().await;
 
 		for reference in [None, Some(""), Some("live"), Some("./live"), Some("../a/live")] {
@@ -965,8 +967,7 @@ mod tests {
 	#[tokio::test]
 	async fn no_override_targets_catalog_broadcast() {
 		let origin = produce_origin();
-		let _producer = origin.create_broadcast("a/pub").unwrap();
-		_producer.announce(Default::default()).unwrap();
+		let _producer = origin.route("a/pub", moq_net::origin::RouteOptions::default()).unwrap();
 		settle().await;
 
 		let source = resolved(&origin, "a/pub").await;
@@ -990,10 +991,9 @@ mod tests {
 	#[tokio::test]
 	async fn subscribe_track_resolves_catalog_broadcast() {
 		let origin = produce_origin();
-		let producer = origin.create_broadcast("a/pub").unwrap();
-		producer.announce(Default::default()).unwrap();
+		let producer = origin.route("a/pub", moq_net::origin::RouteOptions::default()).unwrap();
 		// The track must exist for the subscription to resolve (SUBSCRIBE_OK).
-		let _video = producer.create_track("video", None).unwrap();
+		let _video = producer.broadcast().create_track("video", None).unwrap();
 		settle().await;
 
 		let source = resolved(&origin, "a/pub").await;
@@ -1006,9 +1006,8 @@ mod tests {
 	#[tokio::test]
 	async fn self_reference_targets_catalog_broadcast() {
 		let origin = produce_origin();
-		let producer = origin.create_broadcast("a/pub").unwrap();
-		producer.announce(Default::default()).unwrap();
-		let _video = producer.create_track("video", None).unwrap();
+		let producer = origin.route("a/pub", moq_net::origin::RouteOptions::default()).unwrap();
+		let _video = producer.broadcast().create_track("video", None).unwrap();
 		settle().await;
 
 		let source = resolved(&origin, "a/pub").await;
@@ -1025,14 +1024,14 @@ mod tests {
 	async fn escaping_reference_is_rejected() {
 		let origin = produce_origin();
 
-		let catalog = origin.create_broadcast("a/pub").unwrap();
-		catalog.announce(Default::default()).unwrap();
-		let _catalog_video = catalog.create_track("video", None).unwrap();
+		let catalog = origin.route("a/pub", moq_net::origin::RouteOptions::default()).unwrap();
+		let _catalog_video = catalog.broadcast().create_track("video", None).unwrap();
 
 		// The broadcast an escaping reference would land on if it clamped at the root.
-		let clamped = origin.create_broadcast("elsewhere").unwrap();
-		clamped.announce(Default::default()).unwrap();
-		let _clamped_video = clamped.create_track("video", None).unwrap();
+		let clamped = origin
+			.route("elsewhere", moq_net::origin::RouteOptions::default())
+			.unwrap();
+		let _clamped_video = clamped.broadcast().create_track("video", None).unwrap();
 		settle().await;
 
 		let source = resolved(&origin, "a/pub").await;
@@ -1065,7 +1064,11 @@ mod tests {
 
 	/// A source over a broadcast created at `a/pub`, built without awaiting the origin.
 	fn created(origin: &moq_net::origin::Producer) -> Source {
-		let broadcast = origin.create_broadcast("a/pub").unwrap().consume();
+		let broadcast = origin
+			.route("a/pub", moq_net::origin::RouteOptions::hidden())
+			.unwrap()
+			.broadcast()
+			.consume();
 		Source::new(origin.consume(), broadcast)
 	}
 
@@ -1144,12 +1147,12 @@ mod tests {
 	async fn subscribe_track_resolves_referenced_broadcast() {
 		let origin = produce_origin();
 
-		let _catalog = origin.create_broadcast("a/pub").unwrap();
-		_catalog.announce(Default::default()).unwrap();
+		let _catalog = origin.route("a/pub", moq_net::origin::RouteOptions::default()).unwrap();
 
-		let referenced = origin.create_broadcast("a/source").unwrap();
-		referenced.announce(Default::default()).unwrap();
-		let _video = referenced.create_track("video", None).unwrap();
+		let referenced = origin
+			.route("a/source", moq_net::origin::RouteOptions::default())
+			.unwrap();
+		let _video = referenced.broadcast().create_track("video", None).unwrap();
 		settle().await;
 
 		let source = resolved(&origin, "a/pub").await;
@@ -1166,12 +1169,14 @@ mod tests {
 	async fn dot_resolves_output_parent() {
 		let origin = produce_origin();
 
-		let _catalog = origin.create_broadcast("a/source/transcode").unwrap();
-		_catalog.announce(Default::default()).unwrap();
+		let _catalog = origin
+			.route("a/source/transcode", moq_net::origin::RouteOptions::default())
+			.unwrap();
 
-		let referenced = origin.create_broadcast("a/source").unwrap();
-		referenced.announce(Default::default()).unwrap();
-		let _video = referenced.create_track("video", None).unwrap();
+		let referenced = origin
+			.route("a/source", moq_net::origin::RouteOptions::default())
+			.unwrap();
+		let _video = referenced.broadcast().create_track("video", None).unwrap();
 		settle().await;
 
 		let source = resolved(&origin, "a/source/transcode").await;
@@ -1186,12 +1191,10 @@ mod tests {
 	async fn dot_resolves_one_segment_catalog_to_root() {
 		let origin = produce_origin();
 
-		let _catalog = origin.create_broadcast("top").unwrap();
-		_catalog.announce(Default::default()).unwrap();
+		let _catalog = origin.route("top", moq_net::origin::RouteOptions::default()).unwrap();
 
-		let root = origin.create_broadcast("").unwrap();
-		root.announce(Default::default()).unwrap();
-		let _video = root.create_track("video", None).unwrap();
+		let root = origin.route("", moq_net::origin::RouteOptions::default()).unwrap();
+		let _video = root.broadcast().create_track("video", None).unwrap();
 		settle().await;
 
 		let source = resolved(&origin, "top").await;
diff --git a/rs/moq-net-tests/tests/announce_allocs.rs b/rs/moq-net-tests/tests/announce_allocs.rs
index 643ff25699b..90fe6b3905c 100644
--- a/rs/moq-net-tests/tests/announce_allocs.rs
+++ b/rs/moq-net-tests/tests/announce_allocs.rs
@@ -76,18 +76,23 @@ unsafe impl GlobalAlloc for Counting {
 #[global_allocator]
 static ALLOCATOR: Counting = Counting;
 
-/// A route as `peer` would have announced it: one hop, at `cost`.
-fn peer_route(peer: u64, cost: u64) -> origin::Route {
+/// Land `peer`'s route at `path`, as a session does: one hop, at `cost`.
+fn peer_route(producer: &origin::Producer, path: &'static str, peer: u64, cost: u64) -> origin::Route {
 	let mut hops = Hops::new();
 	hops.push(Hop::new(peer).unwrap()).unwrap();
-	origin::Route::default().with_hops(hops).with_cost(cost)
+	moq_net::fuzz::requests_route(
+		producer,
+		Path::from_static(path),
+		moq_net::fuzz::route_info(hops, cost, None),
+	)
+	.unwrap()
 }
 
 /// Allocations made by a worse route arriving at a watched prefix and leaving
 /// again, with `cursors` cursors rooted at `root` watching it.
 fn churn_allocs(root: &str, cursors: usize) -> usize {
 	let (producer, _driver) = origin::Producer::new(origin::Config::default());
-	let _winner = producer.publish("room/a", peer_route(1, 1)).unwrap();
+	let _winner = peer_route(&producer, "room/a", 1, 1);
 	let all = Patterns::from(Pattern::all());
 	let mut cursors: Vec<_> = (0..cursors)
 		.map(|_| producer.consume().scope(root, &all).unwrap().routes())
@@ -96,7 +101,7 @@ fn churn_allocs(root: &str, cursors: usize) -> usize {
 		while cursor.try_next().is_some() {}
 	}
 
-	let cycle = || drop(producer.publish("room/a", peer_route(2, 5)).unwrap());
+	let cycle = || drop(peer_route(&producer, "room/a", 2, 5));
 	// Reach the steady state first, with every table grown to what it settles at.
 	for _ in 0..4 {
 		cycle();
@@ -247,8 +252,11 @@ async fn a_lite_request_keeps_one_copy_of_its_track_name() {
 		let version: Version = version.parse().unwrap();
 		let (publisher, driver) = origin::Producer::new(origin::Config::new(Hop::new(1).unwrap()));
 		spawn(driver);
-		let broadcast = publisher.publish("room", Default::default()).unwrap();
-		let track = broadcast.create_track(TRACK, track::Info::default()).unwrap();
+		let broadcast = publisher.route("room", origin::RouteOptions::default()).unwrap();
+		let track = broadcast
+			.broadcast()
+			.create_track(TRACK, track::Info::default())
+			.unwrap();
 		let (viewer, driver) = origin::Producer::new(origin::Config::new(Hop::new(2).unwrap()));
 		spawn(driver);
 
diff --git a/rs/moq-net-tests/tests/integration/hop_limit.rs b/rs/moq-net-tests/tests/integration/hop_limit.rs
new file mode 100644
index 00000000000..c9b7ef88210
--- /dev/null
+++ b/rs/moq-net-tests/tests/integration/hop_limit.rs
@@ -0,0 +1,154 @@
+//! The relay's hop limit refuses a route whose chain is already too long and never
+//! forwards one it has no room to stamp.
+//!
+//! Only a peer's route arrives with hops, so the routes under test land through the
+//! hidden `fuzz` module as a session lands them.
+
+use crate::support::{
+	Kind, drain,
+	harness::{peer, spawn},
+	watch,
+};
+
+use moq_net::{Hop, cache, origin};
+
+fn produce_origin(hop: u64) -> origin::Producer {
+	let mut config = origin::Config::new(Hop::new(hop).unwrap());
+	config.pool = cache::Pool::unbounded();
+	let (producer, driver) = origin::Producer::new(config);
+	spawn(driver);
+	producer
+}
+
+/// Land a peer's route at `path` on `origin`, as its session does.
+fn forward(origin: &origin::Producer, path: &str, route: origin::RouteInfo) -> origin::Route {
+	moq_net::fuzz::requests_route(origin, moq_net::Path::new(path).unwrap(), route).unwrap()
+}
+
+/// A permissive source sends an over-limit path to prove ingress refusal; an
+/// accepted boundary path then proves egress counts the relay's own stamp.
+#[kio::test]
+async fn hop_limit_bounds_receive_and_send() {
+	for name in [
+		"moq-lite-03",
+		"moq-lite-04",
+		"moq-lite-05",
+		"moq-lite-06",
+		"moq-lite-07-wip",
+		"moq-transport-18",
+		"moq-transport-22",
+	] {
+		let version = name.parse().unwrap();
+		let source = produce_origin(1);
+		let mut config = origin::Config::new(Hop::new(2).unwrap());
+		config.max_hops = origin::HopLimit::new(2).unwrap();
+		config.pool = cache::Pool::unbounded();
+		let (relay, driver) = origin::Producer::new(config);
+		spawn(driver);
+		let sink = produce_origin(3);
+		let _upstream = peer(version, &source, &relay).await;
+		let _downstream = peer(version, &relay, &sink).await;
+		let mut received = watch(relay.consume().routes());
+		let mut sent = watch(sink.consume().routes());
+		kio::clock::sim::idle().await;
+		let route = |count: u64| {
+			moq_net::fuzz::route_info(
+				moq_net::Hops::try_from((100..100 + count).map(|id| Hop::new(id).unwrap()).collect::<Vec<_>>())
+					.unwrap(),
+				0,
+				None,
+			)
+		};
+		let _long = forward(&source, "long", route(2));
+		let _boundary = forward(&source, "boundary", route(1));
+		let short = forward(&source, "short", route(0));
+		kio::clock::sim::idle().await;
+		let received = drain(&mut received);
+		assert!(!received.contains_key("long"), "{name}: accepted over-limit path");
+		assert!(received.contains_key("boundary"), "{name}: refused boundary path");
+		assert!(received.contains_key("short"), "{name}: refused short path");
+		let sent_initial = drain(&mut sent);
+		assert_eq!(sent_initial.len(), 1, "{name}: {sent_initial:?}");
+		assert!(sent_initial.contains_key("short"), "{name}: forwarded over-limit path");
+
+		if matches!(name, "moq-lite-03" | "moq-lite-04") {
+			// These wires have no route metadata update: withdraw, then replace it.
+			drop(short);
+			kio::clock::sim::idle().await;
+			assert_eq!(
+				drain(&mut sent).get("short").and_then(|kinds| kinds.last()),
+				Some(&Kind::End),
+				"{name}"
+			);
+			let _replacement = forward(&source, "short", route(1));
+			kio::clock::sim::idle().await;
+			assert!(drain(&mut sent).is_empty(), "{name}: forwarded over-limit replacement");
+			continue;
+		}
+		moq_net::fuzz::update_route(&short, route(1)).unwrap();
+		kio::clock::sim::idle().await;
+		let ended = drain(&mut sent);
+		assert_eq!(
+			ended.get("short").and_then(|kinds| kinds.last()),
+			Some(&Kind::End),
+			"{name}: {ended:?}"
+		);
+	}
+}
+
+/// A cheaper route at the cap wins locally but cannot be forwarded, so the relay
+/// advertises the pricier in-cap route instead of withdrawing the prefix, and
+/// withdraws only once no in-cap route is left.
+#[kio::test]
+async fn hop_limit_falls_back_to_a_forwardable_route() {
+	// Only wires carrying a route cost can rank a longer route first.
+	for name in ["moq-lite-06", "moq-lite-07-wip", "moq-transport-18", "moq-transport-22"] {
+		let version = name.parse().unwrap();
+		let near = produce_origin(1);
+		let far = produce_origin(4);
+		let mut config = origin::Config::new(Hop::new(2).unwrap());
+		config.max_hops = origin::HopLimit::new(3).unwrap();
+		config.pool = cache::Pool::unbounded();
+		let (relay, driver) = origin::Producer::new(config);
+		spawn(driver);
+		let sink = produce_origin(3);
+		let _near = peer(version, &near, &relay).await;
+		let _far = peer(version, &far, &relay).await;
+		let _downstream = peer(version, &relay, &sink).await;
+		let mut sent = watch(sink.consume().routes());
+		kio::clock::sim::idle().await;
+
+		let route = |first: u64, count: u64, cost: u64| {
+			moq_net::fuzz::route_info(
+				moq_net::Hops::try_from(
+					(first..first + count)
+						.map(|id| Hop::new(id).unwrap())
+						.collect::<Vec<_>>(),
+				)
+				.unwrap(),
+				cost,
+				None,
+			)
+		};
+		// Three hops at the relay once the sender is appended: in the cap, but full.
+		let _cheap = forward(&far, "room", route(100, 2, 1));
+		// Two hops at the relay, so it has room for the relay's own.
+		let pricey = forward(&near, "room", route(200, 1, 50));
+		kio::clock::sim::idle().await;
+		let started = drain(&mut sent);
+		assert_eq!(
+			started.get("room").and_then(|kinds| kinds.last()),
+			Some(&Kind::Start),
+			"{name}: withdrew a prefix an in-cap route reaches: {started:?}"
+		);
+
+		drop(pricey);
+		kio::clock::sim::idle().await;
+		let ended = drain(&mut sent);
+		assert_eq!(
+			ended.get("room").and_then(|kinds| kinds.last()),
+			Some(&Kind::End),
+			"{name}: forwarded a route at the cap: {ended:?}"
+		);
+	}
+}
diff --git a/rs/moq-net-tests/tests/integration/ietf_conformance.rs b/rs/moq-net-tests/tests/integration/ietf_conformance.rs
index 43360dc6ebc..46e5bdf1982 100644
--- a/rs/moq-net-tests/tests/integration/ietf_conformance.rs
+++ b/rs/moq-net-tests/tests/integration/ietf_conformance.rs
@@ -30,7 +30,7 @@ async fn routing(version: &str, cluster: bool) {
 	let serving = prefix.clone();
 	let answer = broadcast.consume();
 	kio::clock::sim::spawn(async move {
-		let request = serving.requested_broadcast().await.unwrap();
+		let request = serving.requested().await.unwrap();
 		assert_eq!(request.path().as_str(), NAMESPACE);
 		request.serve(answer);
 	});
diff --git a/rs/moq-net-tests/tests/integration/main.rs b/rs/moq-net-tests/tests/integration/main.rs
index 55e1a59234b..5425e8df214 100644
--- a/rs/moq-net-tests/tests/integration/main.rs
+++ b/rs/moq-net-tests/tests/integration/main.rs
@@ -1,5 +1,6 @@
 //! Tests that need JSON consumers or moq-net's hidden fuzz hooks.
 
+mod hop_limit;
 mod ietf_conformance;
 mod refresh;
 mod restart;
diff --git a/rs/moq-net-tests/tests/integration/refresh.rs b/rs/moq-net-tests/tests/integration/refresh.rs
index d33f8ce6d32..215523d8d42 100644
--- a/rs/moq-net-tests/tests/integration/refresh.rs
+++ b/rs/moq-net-tests/tests/integration/refresh.rs
@@ -24,8 +24,9 @@ async fn json_snapshot_refresh_crosses_a_two_relay_cluster() {
 		let a = origin(2);
 		let b = origin(3);
 		let reader = origin(4);
-		let broadcast = source.create_broadcast("room").unwrap();
+		let broadcast = source.route("room", origin::RouteOptions::hidden()).unwrap();
 		let track = broadcast
+			.broadcast()
 			.create_track(
 				"state",
 				track::Info::default()
@@ -34,7 +35,7 @@ async fn json_snapshot_refresh_crosses_a_two_relay_cluster() {
 			)
 			.unwrap();
 		let mut producer = snapshot::Producer::<Value>::new(track.clone(), Default::default());
-		broadcast.announce(Default::default()).unwrap();
+		broadcast.announce().unwrap();
 		let mut links = vec![peer(version, &a, &b).await];
 		for (upstream, downstream) in [(&source, &a), (&b, &reader)] {
 			let mut options = MockConnectOptions::new(version);
@@ -154,11 +155,12 @@ async fn ratio_joins_cross_two_relays() {
 		let source = origin(1);
 		let a = origin(2);
 		let b = origin(3);
-		let broadcast = source.create_broadcast("room").unwrap();
+		let broadcast = source.route("room", origin::RouteOptions::hidden()).unwrap();
 		let producer = broadcast
+			.broadcast()
 			.create_track("data", track::Info::default().with_refresh(1))
 			.unwrap();
-		broadcast.announce(Default::default()).unwrap();
+		broadcast.announce().unwrap();
 		let mut links = Vec::new();
 		for (upstream, downstream) in [(&source, &a), (&a, &b)] {
 			let mut options = MockConnectOptions::new(version);
diff --git a/rs/moq-net-tests/tests/integration/restart.rs b/rs/moq-net-tests/tests/integration/restart.rs
index d201d7558e9..3e254c7f1f8 100644
--- a/rs/moq-net-tests/tests/integration/restart.rs
+++ b/rs/moq-net-tests/tests/integration/restart.rs
@@ -121,8 +121,8 @@ async fn relay_chain(version: &str) {
 	let _upstream = link(version, &publisher, &relay).await;
 	let _downstream = link(version, &relay, &viewer).await;
 
-	let old = publisher.publish("live", origin::Route::default()).unwrap();
-	let old_track = old.create_track("video", timed()).unwrap();
+	let old = publisher.route("live", origin::RouteOptions::default()).unwrap();
+	let old_track = old.broadcast().create_track("video", timed()).unwrap();
 	let mut announced = viewer.consume().routes();
 	match next_event(&mut announced).await {
 		origin::RouteEvent::Start(announce) => assert_eq!(announce.prefix.as_str(), "live"),
@@ -136,8 +136,8 @@ async fn relay_chain(version: &str) {
 	}
 
 	// The publisher restarts under another instance, its old session still open.
-	let new = publisher.publish("live", origin::Route::default()).unwrap();
-	let new_track = new.create_track("video", timed()).unwrap();
+	let new = publisher.route("live", origin::RouteOptions::default()).unwrap();
+	let new_track = new.broadcast().create_track("video", timed()).unwrap();
 	expect_restart(version, &mut announced, "live").await;
 
 	// The old subscription stays on the old instance.
@@ -176,7 +176,7 @@ relay_chain_tests! {
 /// the hidden `fuzz` module as a session lands it, so its answers carry no exact route.
 struct Worker {
 	origin: origin::Producer,
-	_claim: Rc<origin::Requests>,
+	_claim: Rc<origin::Route>,
 	_outputs: Rc<RefCell<Vec<(broadcast::Producer, track::Producer)>>>,
 }
 
@@ -187,14 +187,18 @@ impl Worker {
 			moq_net::fuzz::requests_route(
 				&origin,
 				moq_net::Path::from_static("pool"),
-				origin::Route::default().with_instance(format!("worker-{hop}").parse().unwrap(), 0),
+				moq_net::fuzz::route_info(
+					moq_net::Hops::new(),
+					0,
+					Some((format!("worker-{hop}").parse().unwrap(), 0)),
+				),
 			)
 			.unwrap(),
 		);
 		let outputs = Rc::new(RefCell::new(Vec::new()));
 		let (handler, served) = (claim.clone(), outputs.clone());
 		drop(kio::clock::sim::spawn(async move {
-			while let Ok(request) = handler.requested_broadcast().await {
+			while let Some(request) = handler.requested().await {
 				let output = broadcast::Info::new().produce();
 				let track = output.create_track("video", timed()).unwrap();
 				write(&track, &format!("{hop}"));
@@ -244,7 +248,7 @@ async fn prefix_pool(version: &str) {
 	// The worker whose instance `D`'s route for `pool` names.
 	let advertised = |announce: announce::Announce| {
 		assert_eq!(announce.prefix.as_str(), "pool");
-		let instance = announce.route.instance.expect("a delivered route has an instance");
+		let instance = announce.route.instance().clone();
 		instance.as_str().strip_prefix("worker-").expect("a worker").to_string()
 	};
 	let mut announced = downstream.consume().routes();
@@ -304,27 +308,32 @@ async fn prefix_pool_lite07() {
 /// claim moves to another instance or re-prices in place, so it lands through the hidden
 /// `fuzz` module as a session lands it.
 struct Claim {
-	dynamic: Rc<origin::Requests>,
+	dynamic: Rc<origin::Route>,
 	outputs: Rc<RefCell<Vec<(broadcast::Producer, track::Producer)>>>,
+	/// The price the claim advertises, kept across an instance move.
+	cost: std::cell::Cell<u64>,
 }
 
 impl Claim {
 	fn new(origin: &origin::Producer, instance: Option<Instance>) -> Self {
-		let mut route = origin::Route::default();
-		route.instance = instance;
+		let route = moq_net::fuzz::route_info(moq_net::Hops::new(), 0, instance.map(|instance| (instance, 0)));
 		let dynamic =
 			Rc::new(moq_net::fuzz::requests_route(origin, moq_net::Path::from_static("live"), route).unwrap());
 		let outputs = Rc::new(RefCell::new(Vec::new()));
 		let (handler, served) = (dynamic.clone(), outputs.clone());
 		drop(kio::clock::sim::spawn(async move {
-			while let Ok(request) = handler.requested_broadcast().await {
+			while let Some(request) = handler.requested().await {
 				let output = broadcast::Info::new().produce();
 				let track = output.create_track("video", timed()).unwrap();
 				request.serve(&output);
 				served.borrow_mut().push((output, track));
 			}
 		}));
-		Self { dynamic, outputs }
+		Self {
+			dynamic,
+			outputs,
+			cost: Default::default(),
+		}
 	}
 
 	/// Write `tag` into the output that answered the `n`th request.
@@ -338,11 +347,14 @@ impl Claim {
 
 	/// Move the claim to `instance` in place, keeping the rest of its route.
 	fn update_instance(&self, instance: Instance) {
-		let route = self.dynamic.route().with_instance(instance, 0);
-		self.update_route(route);
+		let route = moq_net::fuzz::route_info(moq_net::Hops::new(), self.cost.get(), Some((instance, 0)));
+		moq_net::fuzz::update_route(&self.dynamic, route).unwrap();
 	}
 
-	fn update_route(&self, route: origin::Route) {
+	/// Re-price the claim in place, keeping its instance.
+	fn update_cost(&self, cost: u64) {
+		self.cost.set(cost);
+		let route = moq_net::fuzz::route_info(moq_net::Hops::new(), cost, None);
 		moq_net::fuzz::update_route(&self.dynamic, route).unwrap();
 	}
 }
@@ -371,7 +383,7 @@ async fn dynamic_instance(version: &str, from: Option<Instance>, to: Instance) {
 	assert_eq!(read(&mut sticky).await, "old:0", "{version}");
 
 	// A re-price is an update at most: every handle survives.
-	claim.update_route(claim.dynamic.route().with_cost(5));
+	claim.update_cost(5);
 	while let Ok(event) = kio::clock::timeout(Duration::from_secs(1), announced.next()).await {
 		assert!(
 			matches!(event, Some(origin::RouteEvent::Update(_))),
@@ -453,17 +465,17 @@ async fn retired_fetch(version: &str, explicit: bool) {
 	let _session = link(version, &publisher, &viewer).await;
 	let (a, b) = instances();
 	let old_route = if explicit {
-		origin::Route::default().with_instance(a, 0)
+		origin::RouteOptions::default().with_instance(a, 0)
 	} else {
-		origin::Route::default()
+		origin::RouteOptions::default()
 	};
 	let new_route = if explicit {
-		origin::Route::default().with_instance(b, 0)
+		origin::RouteOptions::default().with_instance(b, 0)
 	} else {
-		origin::Route::default()
+		origin::RouteOptions::default()
 	};
-	let old = publisher.publish("live", old_route).unwrap();
-	let old_track = old.create_track("video", timed()).unwrap();
+	let old = publisher.route("live", old_route).unwrap();
+	let old_track = old.broadcast().create_track("video", timed()).unwrap();
 	let mut announced = viewer.consume().routes();
 	assert!(matches!(next_event(&mut announced).await, origin::RouteEvent::Start(_)));
 	let (held, mut subscription) = subscribe(&viewer, "live").await;
@@ -471,9 +483,10 @@ async fn retired_fetch(version: &str, explicit: bool) {
 	write(&old_track, "old:0");
 	assert_eq!(read(&mut subscription).await, "old:0");
 
-	let replacement = publisher.publish("live", new_route).unwrap();
-	let replacement_track = replacement.create_track("video", timed()).unwrap();
+	let replacement = publisher.route("live", new_route).unwrap();
+	let replacement_track = replacement.broadcast().create_track("video", timed()).unwrap();
 	let _late = replacement
+		.broadcast()
 		.create_track("late", Some(track::Info::default().with_priority(17)))
 		.unwrap();
 	write(&replacement_track, "new:0");
@@ -539,9 +552,9 @@ async fn unanswered_takeover(version: &str) {
 	let publisher = produce_origin(1);
 	let viewer = produce_origin(2);
 	let _session = link(version, &publisher, &viewer).await;
-	let old = publisher.publish("live", origin::Route::default()).unwrap();
+	let old = publisher.route("live", origin::RouteOptions::default()).unwrap();
 	// Quiet, so the publisher has nothing to answer the SUBSCRIBE with yet.
-	let old_track = old.create_track("video", timed()).unwrap();
+	let old_track = old.broadcast().create_track("video", timed()).unwrap();
 	let mut announced = viewer.consume().routes();
 	assert!(matches!(next_event(&mut announced).await, origin::RouteEvent::Start(_)));
 	let (_held, mut subscription) = subscribe(&viewer, "live").await;
@@ -551,8 +564,8 @@ async fn unanswered_takeover(version: &str) {
 		"{version}: the SUBSCRIBE reached the old instance"
 	);
 
-	let replacement = publisher.publish("live", origin::Route::default()).unwrap();
-	let replacement_track = replacement.create_track("video", timed()).unwrap();
+	let replacement = publisher.route("live", origin::RouteOptions::default()).unwrap();
+	let replacement_track = replacement.broadcast().create_track("video", timed()).unwrap();
 	write(&replacement_track, "new:0");
 	expect_restart(version, &mut announced, "live").await;
 	write(&old_track, "old:0");
@@ -599,15 +612,15 @@ async fn withdrawal_refuses_new_fetches_but_keeps_open_reads() {
 		let publisher = produce_origin(1);
 		let viewer = produce_origin(2);
 		let _session = link(version, &publisher, &viewer).await;
-		let source = publisher.publish("live", origin::Route::default()).unwrap();
-		let produced = source.create_track("video", timed()).unwrap();
+		let source = publisher.route("live", origin::RouteOptions::default()).unwrap();
+		let produced = source.broadcast().create_track("video", timed()).unwrap();
 		let mut announced = viewer.consume().routes();
 		assert!(matches!(next_event(&mut announced).await, origin::RouteEvent::Start(_)));
 		let (held, mut subscription) = subscribe(&viewer, "live").await;
 		let track = held.track("video").unwrap();
 		write(&produced, "old:0");
 		assert_eq!(read(&mut subscription).await, "old:0");
-		source.unannounce();
+		source.withdraw();
 		assert!(matches!(next_event(&mut announced).await, origin::RouteEvent::End(_)));
 		assert!(track.fetch_group(1, None).await.is_err(), "{version}");
 		write(&produced, "old:1");
@@ -629,8 +642,8 @@ async fn a_more_specific_source_cannot_fill_a_held_covering_track() {
 		let track = held.track("video").unwrap();
 		old.write(0, "old:0");
 		assert_eq!(read(&mut subscription).await, "old:0");
-		let replacement = publisher.publish("live/job", origin::Route::default()).unwrap();
-		let replacement_track = replacement.create_track("video", timed()).unwrap();
+		let replacement = publisher.route("live/job", origin::RouteOptions::default()).unwrap();
+		let replacement_track = replacement.broadcast().create_track("video", timed()).unwrap();
 		write(&replacement_track, "new:0");
 		write(&replacement_track, "new:1");
 		assert!(matches!(next_event(&mut announced).await, origin::RouteEvent::Start(_)));
@@ -643,26 +656,26 @@ async fn a_more_specific_source_cannot_fill_a_held_covering_track() {
 	}
 }
 
-/// A worker claiming `pool` through the public API: each request is prepared under a
-/// fresh instance and published at its exact path, and `outputs[path]` holds the latest.
+/// A worker claiming `pool` through the public API: each request is answered with its own
+/// exact route under a fresh instance, and `outputs[path]` holds the latest.
 struct Pool {
-	_claim: Rc<origin::Requests>,
-	outputs: Rc<RefCell<std::collections::HashMap<String, (origin::Publication, track::Producer)>>>,
+	_claim: Rc<origin::Route>,
+	outputs: Rc<RefCell<std::collections::HashMap<String, (origin::Route, track::Producer)>>>,
 	answered: Rc<RefCell<usize>>,
 }
 
 impl Pool {
 	fn new(origin: &origin::Producer) -> Self {
-		let claim = Rc::new(origin.requests("pool").unwrap());
+		let claim = Rc::new(origin.route_prefix("pool", origin::RouteOptions::default()).unwrap());
 		let outputs = Rc::new(RefCell::new(std::collections::HashMap::new()));
 		let answered = Rc::new(RefCell::new(0));
 		let (handler, served, count) = (claim.clone(), outputs.clone(), answered.clone());
 		drop(kio::clock::sim::spawn(async move {
-			while let Ok(request) = handler.requested_broadcast().await {
+			while let Some(request) = handler.requested().await {
 				let path = request.path().to_string();
-				let prepared = request.prepare().unwrap();
-				let track = prepared.broadcast().create_track("video", timed()).unwrap();
-				let output = prepared.publish().unwrap();
+				let output = request.route(origin::RouteOptions::hidden()).unwrap();
+				let track = output.broadcast().create_track("video", timed()).unwrap();
+				output.announce().unwrap();
 				served.borrow_mut().insert(path, (output, track));
 				*count.borrow_mut() += 1;
 			}
@@ -680,7 +693,7 @@ impl Pool {
 
 	/// End the output at `path`, as a worker does when it restarts that job.
 	fn close(&self, path: &str) {
-		self.outputs.borrow()[path].0.close();
+		self.outputs.borrow()[path].0.broadcast().close();
 	}
 }
 
@@ -777,9 +790,9 @@ async fn priority_update(version: &str, relayed: bool, switch: bool) {
 
 	let (a, b) = instances();
 	let old = publisher
-		.publish("live", origin::Route::default().with_instance(a, 0))
+		.route("live", origin::RouteOptions::default().with_instance(a, 0))
 		.unwrap();
-	let old_track = old.create_track("video", timed()).unwrap();
+	let old_track = old.broadcast().create_track("video", timed()).unwrap();
 	let mut announced = viewer.consume().routes();
 	assert!(
 		matches!(next_event(&mut announced).await, origin::RouteEvent::Start(_)),
@@ -792,7 +805,7 @@ async fn priority_update(version: &str, relayed: bool, switch: bool) {
 
 	let _new = switch.then(|| {
 		publisher
-			.publish("live", origin::Route::default().with_instance(b, 0))
+			.route("live", origin::RouteOptions::default().with_instance(b, 0))
 			.unwrap()
 	});
 	if switch {
diff --git a/rs/moq-net-tests/tests/integration/serve.rs b/rs/moq-net-tests/tests/integration/serve.rs
index 3783678f6ff..6e8c32996f5 100644
--- a/rs/moq-net-tests/tests/integration/serve.rs
+++ b/rs/moq-net-tests/tests/integration/serve.rs
@@ -16,7 +16,7 @@ async fn first_subscribe(version: &str, publish: bool) {
 	let version: Version = version.parse().unwrap();
 	let server = origin(1);
 	let client = origin(2);
-	let requests = server.requests("").unwrap();
+	let requests = server.route_prefix("", origin::RouteOptions::default()).unwrap();
 	let mut options = MockConnectOptions::new(version);
 	options.server_publish = Some(server.consume());
 	options.client_subscribe = Some(client.clone());
@@ -42,7 +42,12 @@ async fn first_subscribe(version: &str, publish: bool) {
 	group.finish().unwrap();
 	let handler = async {
 		if publish {
-			let prepared = requests.requested_broadcast().await.unwrap().prepare().unwrap();
+			let prepared = requests
+				.requested()
+				.await
+				.unwrap()
+				.route(origin::RouteOptions::hidden())
+				.unwrap();
 			let track = prepared
 				.broadcast()
 				.create_track(
@@ -53,13 +58,14 @@ async fn first_subscribe(version: &str, publish: bool) {
 			let mut group = track.append_group().unwrap();
 			group.write_frame(Timestamp::ZERO, b"held".as_slice()).unwrap();
 			group.finish().unwrap();
-			Some((prepared.publish().unwrap(), track))
+			prepared.announce().unwrap();
+			Some((prepared, track))
 		} else {
-			requests.requested_broadcast().await.unwrap().serve(&held);
+			requests.requested().await.unwrap().serve(&held);
 			None
 		}
 	};
-	let (result, _publication) = futures::join!(read, handler);
+	let (result, _route) = futures::join!(read, handler);
 	if publish && version != "moq-lite-07-wip".parse().unwrap() {
 		assert!(
 			result.is_err(),
diff --git a/rs/moq-net/MIGRATE.md b/rs/moq-net/MIGRATE.md
index 2b4b39be9b8..45e1fc292b1 100644
--- a/rs/moq-net/MIGRATE.md
+++ b/rs/moq-net/MIGRATE.md
@@ -67,6 +67,44 @@ let broadcast = consumer.follow(path, None)?.available().await?.expect("the firs
 
 Relays and stats that forward every route change call `consumer.routes()`, a hidden `origin::Routes` stream of `origin::RouteEvent`, which keeps the old five variants.
 
+### One `origin::Route` handle replaces publications and claims
+
+On the publishing side ownership runs origin → route → broadcast. `origin::Publication`, `origin::Prepared` and `origin::Requests` are gone, as are `origin::Producer::{create_broadcast, publish, requests}` and the broadcast's own announcement.
+An `origin::Route` is created with `RouteOptions` and owns its broadcast. Dropping its last clone retracts it, and so does closing its broadcast; a broadcast producer clone alone no longer keeps it announced, so hold the route for as long as the content should stay up.
+
+| Before | After |
+| --- | --- |
+| `origin.publish(path, Route::default())` | `origin.route(path, RouteOptions::default())` |
+| `origin.create_broadcast(path)` then `publication.announce(route)` | `origin.route(path, RouteOptions::hidden())` then `route.announce()` |
+| `publication.broadcast()` / `Deref` | `route.broadcast()` |
+| `publication.unannounce()` | `route.withdraw()` |
+| `publication.announce(Route::default().with_cost(c))` | `route.set_cost(c)` |
+| `Route::default().with_auth(cred)` | `RouteOptions::default().with_auth(cred)`, or `route.set_auth(Some(cred))` |
+| `Route::default().with_instance(instance, epoch)` | `RouteOptions::default().with_instance(instance, epoch)`, at creation only |
+| `publication.route().and_then(\|r\| r.instance)` | `route.instance()` |
+| `origin.requests(prefix)` | `origin.route_prefix(prefix, RouteOptions::default())` |
+| `requests.requested_broadcast().await` (`Result`) | `route.requested().await` (`Option`, `None` once retracted or the origin closes) |
+| `request.prepare()?` … `prepared.publish()?` | `request.route(RouteOptions::hidden())?` … `job.announce()?` |
+
+A route mints its instance when it is created and keeps it for its lifetime, across `withdraw()` and `announce()`: re-announcing continues the same stream, and a new run is a new route.
+A job's route from `request.route(options)` serves a fresh instance unless `options` names one; created visible, it announces and answers the waiting requesters at once.
+`requested()` on an exact route returns `None` at once, and `broadcast()` on a prefix route panics.
+A prefix route takes a cost, a credential and hidden visibility like an exact one.
+
+The route metadata a reader receives is `origin::RouteInfo` (was `origin::Route`), with read-only getters: `announce.route.instance()` (an `&Instance`, no longer an `Option`), `cost()`, `hops()`, `is_anonymous()` and `source()`.
+Applications cannot build or edit one.
+
+```rust
+// Before
+let publication = origin.create_broadcast("live/alice")?;
+publication.create_track("catalog.json", info)?;
+publication.announce(Route::default().with_cost(5))?;
+// After
+let route = origin.route("live/alice", RouteOptions::hidden().with_cost(5))?;
+route.broadcast().create_track("catalog.json", info)?;
+route.announce()?;
+```
+
 ### Opens wait their turn for stream credit ([#7894](https://github.com/moq-dev/moq/pull/7894))
 
 A request no longer fails with `Error::NoStreamCredit` when the peer grants no more streams: every stream a session opens waits for credit, and returning credit goes to the open whose stream the transport would send first. The variant is removed; drop any arm matching it.
diff --git a/rs/moq-net/benches/announce.rs b/rs/moq-net/benches/announce.rs
index ca59f4e4080..c30a7bbe082 100644
--- a/rs/moq-net/benches/announce.rs
+++ b/rs/moq-net/benches/announce.rs
@@ -56,7 +56,7 @@ fn initial(c: &mut Criterion) {
 						origin::RouteEvent::Update(announce::Announce {
 							prefix: moq_net::Path::new(&format!("route/{route}")).unwrap(),
 							captures: None,
-							route: moq_net::origin::Route::default().with_cost(cost),
+							route: moq_net::fuzz::route_info(moq_net::Hops::new(), cost, None),
 						})
 					})
 				})
diff --git a/rs/moq-net/benches/auth.rs b/rs/moq-net/benches/auth.rs
index 38edfbb2af7..62ae2cdcd9d 100644
--- a/rs/moq-net/benches/auth.rs
+++ b/rs/moq-net/benches/auth.rs
@@ -193,29 +193,34 @@ fn renewal(c: &mut Criterion) {
 							}
 							auths
 						});
-						let broadcasts: Vec<_> = (0..routes)
-							.map(|route| origin.create_broadcast(format!("room/{route}").as_str()).unwrap())
-							.collect();
-						let mut swap = |next: usize, touched: usize| {
-							for (index, broadcast) in broadcasts.iter().take(touched).enumerate() {
-								broadcast
-									.announce(origin::Route::default().with_auth(auths[index][next].clone()))
-									.unwrap();
-							}
+						let mut accept = |count: usize| {
 							runtime.block_on(async {
-								let mut issued = Vec::with_capacity(touched);
-								for _ in 0..touched {
+								let mut issued = Vec::with_capacity(count);
+								for _ in 0..count {
 									issued.push(requests.next().await.unwrap().accept(auth::Grant::all()));
 								}
 								issued
 							})
 						};
+						let broadcasts: Vec<_> = (0..routes)
+							.map(|route| {
+								origin
+									.route(
+										format!("room/{route}").as_str(),
+										origin::RouteOptions::default().with_auth(auths[route][0].clone()),
+									)
+									.unwrap()
+							})
+							.collect();
 						// Each round's grants replace the last round's, which drop once their
 						// renewals are accepted.
-						let mut held = swap(0, routes);
+						let mut held = accept(routes);
 						let mut next = 1;
 						b.iter(|| {
-							let replacements = swap(next, touched);
+							for (index, broadcast) in broadcasts.iter().take(touched).enumerate() {
+								broadcast.set_auth(Some(auths[index][next].clone())).unwrap();
+							}
+							let replacements = accept(touched);
 							drop(held.splice(..touched, replacements));
 							next ^= 1;
 						});
@@ -274,9 +279,13 @@ fn waiting(c: &mut Criterion) {
 								generation += 1;
 								let broadcasts: Vec<_> = (0..paths)
 									.map(|path| {
-										let broadcast =
-											publish.create_broadcast(format!("{prefix}{path}").as_str()).unwrap();
-										broadcast.announce(Default::default()).unwrap();
+										let broadcast = publish
+											.route(
+												format!("{prefix}{path}").as_str(),
+												moq_net::origin::RouteOptions::hidden(),
+											)
+											.unwrap();
+										broadcast.announce().unwrap();
 										broadcast
 									})
 									.collect();
@@ -360,9 +369,9 @@ fn shared_requests(c: &mut Criterion) {
 								for request in 0..requests {
 									broadcasts.push(
 										origin
-											.publish(
+											.route(
 												format!("{prefix}/{token}/{request}").as_str(),
-												origin::Route::default().with_auth(auth.clone()),
+												moq_net::origin::RouteOptions::default().with_auth(auth.clone()),
 											)
 											.unwrap(),
 									);
diff --git a/rs/moq-net/benches/memory.rs b/rs/moq-net/benches/memory.rs
index fd5361c1022..1786a4028fb 100644
--- a/rs/moq-net/benches/memory.rs
+++ b/rs/moq-net/benches/memory.rs
@@ -105,7 +105,7 @@ struct Link {
 	tracks: Vec<track::Producer>,
 	subscribers: Vec<track::Subscriber>,
 	payload: Bytes,
-	_broadcast: origin::Publication,
+	_broadcast: origin::Route,
 	_sessions: (moq_net::Session, moq_net::Session),
 	_origins: (origin::Producer, origin::Producer),
 }
@@ -149,14 +149,21 @@ impl Link {
 			}
 		);
 
-		let broadcast = publisher.create_broadcast("bench").unwrap();
+		let broadcast = publisher
+			.route("bench", moq_net::origin::RouteOptions::hidden())
+			.unwrap();
 		let info = track::Info::default()
 			.with_max_age(None)
 			.with_timescale(moq_net::Timescale::MILLI);
 		let tracks: Vec<_> = (0..streams)
-			.map(|index| broadcast.create_track(format!("{index}"), info.clone()).unwrap())
+			.map(|index| {
+				broadcast
+					.broadcast()
+					.create_track(format!("{index}"), info.clone())
+					.unwrap()
+			})
 			.collect();
-		broadcast.announce(Default::default()).unwrap();
+		broadcast.announce().unwrap();
 
 		let consumer = subscriber.consume();
 		let remote = consumer
diff --git a/rs/moq-net/benches/origin.rs b/rs/moq-net/benches/origin.rs
index 4fa1bbef981..73bca373821 100644
--- a/rs/moq-net/benches/origin.rs
+++ b/rs/moq-net/benches/origin.rs
@@ -76,7 +76,7 @@ struct Fanout {
 	producer: origin::Producer,
 	consumer: origin::Consumer,
 	driver: origin::Driver,
-	_publishers: Vec<origin::Publication>,
+	_publishers: Vec<origin::Route>,
 	subscribers: Vec<origin::Routes>,
 }
 
@@ -84,7 +84,11 @@ fn fanout(publishers: usize, subscribers: usize) -> Fanout {
 	let (producer, driver) = origin::Producer::new(origin::Config::default());
 	let consumer = producer.consume();
 	let publishers = (0..publishers)
-		.map(|i| producer.publish(format!("room/{i}"), origin::Route::default()).unwrap())
+		.map(|i| {
+			producer
+				.route(format!("room/{i}"), moq_net::origin::RouteOptions::default())
+				.unwrap()
+		})
 		.collect();
 	let mut subscribers: Vec<origin::Routes> = (0..subscribers).map(|_| consumer.routes()).collect();
 	// Drain the replay so each iteration measures only what it adds.
@@ -111,7 +115,7 @@ fn bench_announce(c: &mut Criterion) {
 			b.iter(|| {
 				let handle = fleet
 					.producer
-					.publish("room/incoming", origin::Route::default())
+					.route("room/incoming", moq_net::origin::RouteOptions::default())
 					.unwrap();
 				for cursor in &mut fleet.subscribers {
 					cursor.next().now_or_never().flatten().expect("announce delivered");
@@ -136,7 +140,11 @@ fn bench_announce_covering(c: &mut Criterion) {
 				group.bench_function(format!("{routes}routes_{readers}readers_covering{covering}"), |b| {
 					let (producer, _driver) = origin::Producer::new(origin::Config::default());
 					let _routes: Vec<_> = (0..routes)
-						.map(|i| producer.requests(format!("room/{i}/mic.hang")).unwrap())
+						.map(|i| {
+							producer
+								.route_prefix(format!("room/{i}/mic.hang"), moq_net::origin::RouteOptions::default())
+								.unwrap()
+						})
 						.collect();
 					let consumer = producer
 						.consume()
@@ -149,7 +157,9 @@ fn bench_announce_covering(c: &mut Criterion) {
 					}
 					b.iter(|| {
 						for (name, delivered) in [("room/live.chat", true), ("room/mic.hang", covering)] {
-							let route = producer.requests(name).unwrap();
+							let route = producer
+								.route_prefix(name, moq_net::origin::RouteOptions::default())
+								.unwrap();
 							for cursor in &mut cursors {
 								assert_eq!(cursor.next().now_or_never().flatten().is_some(), delivered);
 							}
@@ -174,7 +184,11 @@ fn bench_pending_churn(c: &mut Criterion) {
 			group.bench_function(format!("{routes}routes_{readers}readers"), |b| {
 				let (producer, _driver) = origin::Producer::new(origin::Config::default());
 				let _routes: Vec<_> = (0..routes)
-					.map(|i| producer.publish(format!("z/{i}"), origin::Route::default()).unwrap())
+					.map(|i| {
+						producer
+							.route(format!("z/{i}"), moq_net::origin::RouteOptions::default())
+							.unwrap()
+					})
 					.collect();
 				let mut cursors: Vec<_> = (0..readers).map(|_| producer.consume().routes()).collect();
 				let mut sequence = 0u64;
@@ -182,7 +196,7 @@ fn bench_pending_churn(c: &mut Criterion) {
 					sequence += 1;
 					drop(
 						producer
-							.publish(format!("a/{sequence}"), origin::Route::default())
+							.route(format!("a/{sequence}"), moq_net::origin::RouteOptions::default())
 							.unwrap(),
 					);
 				});
@@ -258,9 +272,7 @@ fn bench_withdraw_wave(c: &mut Criterion) {
 		for &hop in chain {
 			hops.push(Hop::new(hop).unwrap()).unwrap();
 		}
-		origin::Route::default()
-			.with_instance(instance.clone(), 0)
-			.with_hops(hops)
+		moq_net::fuzz::route_info(hops, 0, Some((instance.clone(), 0)))
 	};
 	for broadcasts in [1_000, 10_000] {
 		for subscribers in [1, 20, 100] {
@@ -382,7 +394,7 @@ fn bench_announce_mounted(c: &mut Criterion) {
 			let _publishers: Vec<_> = (0..publishers)
 				.map(|i| {
 					producer
-						.publish(format!(".svc/p0/{i}"), origin::Route::default())
+						.route(format!(".svc/p0/{i}"), moq_net::origin::RouteOptions::default())
 						.unwrap()
 				})
 				.collect();
@@ -403,7 +415,9 @@ fn bench_announce_mounted(c: &mut Criterion) {
 			}
 
 			b.iter(|| {
-				let handle = producer.publish(".svc/p0/incoming", origin::Route::default()).unwrap();
+				let handle = producer
+					.route(".svc/p0/incoming", moq_net::origin::RouteOptions::default())
+					.unwrap();
 				for cursor in &mut cursors {
 					cursor.next().now_or_never().flatten().expect("announce delivered");
 				}
@@ -433,7 +447,10 @@ fn bench_announce_fleet(c: &mut Criterion) {
 				.flat_map(|project| (0..nodes).map(move |node| (project, node)))
 				.map(|(project, node)| {
 					producer
-						.publish(format!(".stats/p{project}/node/edge{node}"), origin::Route::default())
+						.route(
+							format!(".stats/p{project}/node/edge{node}"),
+							moq_net::origin::RouteOptions::default(),
+						)
 						.unwrap()
 				})
 				.collect();
@@ -447,7 +464,7 @@ fn bench_announce_fleet(c: &mut Criterion) {
 				.collect();
 			b.iter(|| {
 				let handle = producer
-					.publish(".stats/p0/node/incoming", origin::Route::default())
+					.route(".stats/p0/node/incoming", moq_net::origin::RouteOptions::default())
 					.unwrap();
 				drop(handle);
 			});
@@ -580,7 +597,10 @@ fn bench_reprice_duplicate(c: &mut Criterion) {
 							let moq_net::origin::RouteEvent::Restart(update) = event else {
 								panic!("expected a restart: got {event:?}");
 							};
-							assert_eq!(update.route.cost, moq_net::origin::Cost::new(cost.min(incumbent_cost)));
+							assert_eq!(
+								update.route.cost(),
+								moq_net::origin::Cost::new(cost.min(incumbent_cost))
+							);
 						}
 					}
 				});
@@ -598,10 +618,15 @@ const PATH: &str = ".stats/p0/node/edge0";
 const INCUMBENT_COST: u64 = 2;
 
 /// A route as `peer` would have announced it: one hop, at `cost`.
-fn peer_route(peer: u64, cost: u64) -> origin::Route {
+fn peer_route(peer: u64, cost: u64) -> origin::RouteInfo {
+	peer_instance(peer, cost, None)
+}
+
+/// [`peer_route`], serving `instance` when it names one.
+fn peer_instance(peer: u64, cost: u64, instance: Option<Instance>) -> origin::RouteInfo {
 	let mut hops = Hops::new();
 	hops.push(Hop::new(peer).expect("peer id")).expect("hop chain");
-	origin::Route::default().with_hops(hops).with_cost(cost)
+	moq_net::fuzz::route_info(hops, cost, instance.map(|instance| (instance, 0)))
 }
 
 /// An announcement of an unrelated prefix with `fronts` remote fronts parked on
@@ -615,7 +640,9 @@ fn bench_announce_fronts(c: &mut Criterion) {
 			let (producer, mut driver) = origin::Producer::new(origin::Config::default());
 			let consumer = producer.consume();
 			// Served but never answered: every request under it parks a front.
-			let _served = producer.requests("room").unwrap();
+			let _served = producer
+				.route_prefix("room", moq_net::origin::RouteOptions::default())
+				.unwrap();
 			let _requests: Vec<_> = (0..fronts)
 				.map(|i| consumer.request(format!("room/{i}"), None))
 				.collect();
@@ -623,7 +650,9 @@ fn bench_announce_fronts(c: &mut Criterion) {
 			// Run each front once so it parks on its upstream request.
 			driver.poll(moq_net::time::Instant::now(), &waiter).unwrap();
 			b.iter(|| {
-				let handle = producer.publish("other/incoming", origin::Route::default()).unwrap();
+				let handle = producer
+					.route("other/incoming", moq_net::origin::RouteOptions::default())
+					.unwrap();
 				driver.poll(moq_net::time::Instant::now(), &waiter).unwrap();
 				drop(handle);
 				driver.poll(moq_net::time::Instant::now(), &waiter).unwrap();
@@ -634,15 +663,15 @@ fn bench_announce_fronts(c: &mut Criterion) {
 }
 
 /// Answer the claim's request for `path`, dropping any other it queued.
-fn answer(claim: &origin::Requests, path: &str) -> origin::Publication {
+fn answer(claim: &origin::Route, path: &str) -> origin::Route {
 	loop {
 		let request = claim
-			.requested_broadcast()
+			.requested()
 			.now_or_never()
 			.expect("the request reached the claim")
 			.unwrap();
 		if request.path().as_str() == path {
-			return request.prepare().unwrap().publish().unwrap();
+			return request.route(moq_net::origin::RouteOptions::default()).unwrap();
 		}
 	}
 }
@@ -659,7 +688,9 @@ fn bench_takeover(c: &mut Criterion) {
 			|b| {
 				let (producer, mut driver) = origin::Producer::new(origin::Config::default());
 				let consumer = producer.consume();
-				let claim = producer.requests("room").unwrap();
+				let claim = producer
+					.route_prefix("room", moq_net::origin::RouteOptions::default())
+					.unwrap();
 				let waiter = kio::Waiter::noop();
 				let mut ask = |path: &str| {
 					let request = consumer.request(path, None);
@@ -713,7 +744,14 @@ fn bench_serve_idle(c: &mut Criterion) {
 			let (producer, _driver) = origin::Producer::new(origin::Config::default());
 			// One route per announced path, exactly as a session lands a peer's.
 			let dynamics: Vec<_> = (0..routes)
-				.map(|i| producer.requests(format!(".stats/p{}/node/edge{i}", i % 8)).unwrap())
+				.map(|i| {
+					producer
+						.route_prefix(
+							format!(".stats/p{}/node/edge{i}", i % 8),
+							moq_net::origin::RouteOptions::default(),
+						)
+						.unwrap()
+				})
 				.collect();
 			b.iter(|| {
 				// A fresh waiter per sweep, so every poll pays a real registration: a
@@ -721,7 +759,7 @@ fn bench_serve_idle(c: &mut Criterion) {
 				let waiter = kio::Waiter::noop();
 				// Nothing is queued, so every poll parks again: the idle sweep.
 				for dynamic in &dynamics {
-					assert!(dynamic.poll_requested_broadcast(&waiter).is_pending());
+					assert!(dynamic.poll_requested(&waiter).is_pending());
 				}
 			});
 		});
@@ -759,7 +797,10 @@ fn bench_request(c: &mut Criterion) {
 	for publishers in [100, 1_000] {
 		for requesters in [1, 8, 32] {
 			let mut fleet = fanout(publishers, 0);
-			let _covering = fleet.producer.publish("room", origin::Route::default()).unwrap();
+			let _covering = fleet
+				.producer
+				.route("room", moq_net::origin::RouteOptions::default())
+				.unwrap();
 			let waiter = kio::Waiter::noop();
 			let shape = format!("{publishers}p_{requesters}r");
 			group.throughput(Throughput::Elements(requesters));
@@ -842,7 +883,7 @@ const POOL_HOP: u64 = 1_000;
 struct Pool {
 	producer: origin::Producer,
 	driver: origin::Driver,
-	_members: Vec<origin::Requests>,
+	_members: Vec<origin::Route>,
 	_producers: Vec<broadcast::Producer>,
 	_consumers: Vec<broadcast::Consumer>,
 	cursors: Vec<origin::Routes>,
@@ -879,9 +920,9 @@ fn pool(members: usize, paths: usize, cursors: usize) -> Pool {
 	driver.poll(moq_net::time::Instant::now(), &waiter).unwrap();
 	let mut producers = Vec::with_capacity(paths);
 	for member in &members {
-		while let Poll::Ready(request) = member.poll_requested_broadcast(&waiter) {
+		while let Poll::Ready(Some(request)) = member.poll_requested(&waiter) {
 			let broadcast = broadcast::Info::new().produce();
-			request.unwrap().serve(&broadcast);
+			request.serve(&broadcast);
 			producers.push(broadcast);
 		}
 	}
@@ -905,7 +946,7 @@ fn pool(members: usize, paths: usize, cursors: usize) -> Pool {
 }
 
 /// A pool member's claim: one hop, at the same cost as every other member.
-fn pool_route(hop: u64) -> origin::Route {
+fn pool_route(hop: u64) -> origin::RouteInfo {
 	peer_route(hop, 3)
 }
 
@@ -922,7 +963,7 @@ fn bench_restart_fronts(c: &mut Criterion) {
 						let pool = pool(1, fronts, 0);
 						moq_net::fuzz::update_route(
 							&pool._members[0],
-							pool_route(POOL_HOP).with_instance(Instance::random(), 0),
+							peer_instance(POOL_HOP, 3, Some(Instance::random())),
 						)
 						.unwrap();
 						let paths: Vec<_> = (0..restarting).map(|i| format!("pool/job-{i}")).collect();
@@ -1069,15 +1110,21 @@ fn bench_handoff(c: &mut Criterion) {
 			runtime.spawn(moq_net::time::run(driver));
 			let consumer = producer.consume();
 			let _others: Vec<_> = (0..publishers)
-				.map(|i| producer.publish(format!("room/{i}"), origin::Route::default()).unwrap())
+				.map(|i| {
+					producer
+						.route(format!("room/{i}"), moq_net::origin::RouteOptions::default())
+						.unwrap()
+				})
 				.collect();
 
 			b.iter_custom(|iterations| {
 				runtime.block_on(async {
 					let mut total = Duration::ZERO;
 					for _ in 0..iterations {
-						let incumbent = producer.publish("room/live", origin::Route::default()).unwrap();
-						let track = incumbent.create_track("video", timed()).unwrap();
+						let incumbent = producer
+							.route("room/live", moq_net::origin::RouteOptions::default())
+							.unwrap();
+						let track = incumbent.broadcast().create_track("video", timed()).unwrap();
 						let mut first = track.append_group().unwrap();
 						first.write_frame(Timestamp::ZERO, b"one".as_ref()).unwrap();
 						first.finish().unwrap();
@@ -1087,13 +1134,15 @@ fn bench_handoff(c: &mut Criterion) {
 						subscription.recv_group().await.unwrap().expect("first group");
 
 						let started = std::time::Instant::now();
-						let standby = producer.create_broadcast("room/live").unwrap();
-						let track = standby.create_track("video", timed()).unwrap();
+						let standby = producer
+							.route("room/live", moq_net::origin::RouteOptions::hidden())
+							.unwrap();
+						let track = standby.broadcast().create_track("video", timed()).unwrap();
 						let mut second = track.create_group(moq_net::group::Info { sequence: 1 }).unwrap();
 						second.write_frame(Timestamp::ZERO, b"two".as_ref()).unwrap();
 						second.finish().unwrap();
 						// Announcing is what makes the standby a route the front can take.
-						standby.announce(origin::Route::default()).unwrap();
+						standby.announce().unwrap();
 						let replaced = consumer.request("room/live", None).await.unwrap();
 						let mut replacement = replaced.track("video").unwrap().subscribe(None).await.unwrap();
 						let group = replacement.recv_group().await.unwrap().expect("standby group");
@@ -1103,8 +1152,8 @@ fn bench_handoff(c: &mut Criterion) {
 
 						drop(subscription);
 						drop(replacement);
-						incumbent.close();
-						standby.close();
+						incumbent.broadcast().close();
+						standby.broadcast().close();
 						// Wait for the fronts to close so the next iteration starts fresh ones.
 						resolved.closed().await;
 						replaced.closed().await;
@@ -1128,7 +1177,7 @@ struct Watching {
 	pair: MockPair,
 	tracks: Vec<track::Producer>,
 	subscriptions: Vec<track::Subscriber>,
-	_broadcasts: Vec<origin::Publication>,
+	_broadcasts: Vec<origin::Route>,
 	_origins: [origin::Producer; 2],
 }
 
@@ -1151,8 +1200,10 @@ async fn watching(routes: usize, subscribers: usize) -> Watching {
 	let mut broadcasts = Vec::new();
 	let mut tracks = Vec::new();
 	for index in 0..routes {
-		let broadcast = relay.publish(watched_path(index), origin::Route::default()).unwrap();
-		tracks.push(broadcast.create_track("video", timed()).unwrap());
+		let broadcast = relay
+			.route(watched_path(index), moq_net::origin::RouteOptions::default())
+			.unwrap();
+		tracks.push(broadcast.broadcast().create_track("video", timed()).unwrap());
 		broadcasts.push(broadcast);
 	}
 
@@ -1291,9 +1342,11 @@ fn bench_relay(c: &mut Criterion) {
 				.unwrap();
 			let (producer, driver) = origin::Producer::new(origin::Config::default());
 			runtime.spawn(moq_net::time::run(driver));
-			let broadcast = producer.publish("room/live", origin::Route::default()).unwrap();
+			let broadcast = producer
+				.route("room/live", moq_net::origin::RouteOptions::default())
+				.unwrap();
 			let sources: Vec<_> = (0..tracks)
-				.map(|i| broadcast.create_track(format!("{i}"), timed()).unwrap())
+				.map(|i| broadcast.broadcast().create_track(format!("{i}"), timed()).unwrap())
 				.collect();
 			let mut subscriptions = runtime.block_on(async {
 				let resolved = producer.consume().request("room/live", None).await.unwrap();
@@ -1351,8 +1404,10 @@ fn bench_passthrough(c: &mut Criterion) {
 				.unwrap();
 			let (producer, driver) = origin::Producer::new(origin::Config::default());
 			runtime.spawn(moq_net::time::run(driver));
-			let broadcast = producer.publish("room/live", origin::Route::default()).unwrap();
-			let source = broadcast.create_track("0", timed()).unwrap();
+			let broadcast = producer
+				.route("room/live", moq_net::origin::RouteOptions::default())
+				.unwrap();
+			let source = broadcast.broadcast().create_track("0", timed()).unwrap();
 			let mut subscriptions = runtime.block_on(async {
 				let resolved = producer.consume().request("room/live", None).await.unwrap();
 				let track = resolved.track("0").unwrap();
@@ -1406,10 +1461,13 @@ fn bench_parked(c: &mut Criterion) {
 					.unwrap();
 				let (producer, driver) = origin::Producer::new(origin::Config::default());
 				runtime.spawn(moq_net::time::run(driver));
-				let broadcast = producer.publish("room/live", origin::Route::default()).unwrap();
+				let broadcast = producer
+					.route("room/live", moq_net::origin::RouteOptions::default())
+					.unwrap();
 				let sources: Vec<_> = (0..tracks)
 					.map(|i| {
 						broadcast
+							.broadcast()
 							.create_track(format!("{i}"), moq_net::track::Info::default().with_max_age(None))
 							.unwrap()
 					})
@@ -1455,18 +1513,23 @@ const COPY_WAIT: Duration = Duration::from_secs(5);
 
 /// One generation at [`COPY_PATH`], held so its copies stay subscribed.
 struct Generation {
-	broadcast: origin::Publication,
+	broadcast: origin::Route,
 	tracks: Vec<track::Producer>,
 }
 
 impl Generation {
-	/// Create a hidden generation and leave a finished group on every track, so a
-	/// reader that does look has something to resume.
-	fn build(producer: &origin::Producer, tracks: usize) -> Self {
-		let broadcast = producer.create_broadcast(COPY_PATH).unwrap();
+	/// Create a hidden generation of `instance` and leave a finished group on every
+	/// track, so a reader that does look has something to resume.
+	fn build(producer: &origin::Producer, tracks: usize, instance: &Instance) -> Self {
+		let broadcast = producer
+			.route(
+				COPY_PATH,
+				moq_net::origin::RouteOptions::hidden().with_instance(instance.clone(), 0),
+			)
+			.unwrap();
 		let mut held = Vec::with_capacity(tracks);
 		for i in 0..tracks {
-			let track = broadcast.create_track(format!("{i}"), timed()).unwrap();
+			let track = broadcast.broadcast().create_track(format!("{i}"), timed()).unwrap();
 			let mut written = track.append_group().unwrap();
 			written.write_frame(Timestamp::ZERO, b"f".as_ref()).unwrap();
 			written.finish().unwrap();
@@ -1479,10 +1542,8 @@ impl Generation {
 	}
 
 	/// Route the front to this generation without waiting.
-	fn route(&self, instance: &Instance) {
-		self.broadcast
-			.announce(origin::Route::default().with_instance(instance.clone(), 0))
-			.unwrap();
+	fn route(&self) {
+		self.broadcast.announce().unwrap();
 	}
 
 	/// Route the front to this generation and wait until every track is spliced.
@@ -1491,8 +1552,8 @@ impl Generation {
 	/// copy, before its splice. That bounds the splice only on a current-thread
 	/// runtime, where every local query is ready within the front poll that
 	/// splices it.
-	async fn announce(&self, instance: &Instance) {
-		self.route(instance);
+	async fn announce(&self) {
+		self.route();
 		for track in &self.tracks {
 			kio::clock::timeout(COPY_WAIT, support::wanted(track.demand()))
 				.await
@@ -1504,7 +1565,6 @@ impl Generation {
 
 /// A front serving [`COPY_PATH`], with `copies` route copies on each of its tracks.
 struct CopyWalk {
-	instance: Instance,
 	_producer: origin::Producer,
 	_subscribers: Vec<track::Subscriber>,
 	generations: Vec<Generation>,
@@ -1522,8 +1582,8 @@ async fn copy_walk(tracks: usize, copies: usize) -> CopyWalk {
 	let (producer, driver) = origin::Producer::new(origin::Config::default());
 	tokio::spawn(moq_net::time::run(driver));
 	let instance = Instance::random();
-	let first = Generation::build(&producer, tracks);
-	first.route(&instance);
+	let first = Generation::build(&producer, tracks, &instance);
+	first.route();
 	let resolved = kio::clock::timeout(COPY_WAIT, producer.consume().request(COPY_PATH, None))
 		.await
 		.expect("front did not resolve")
@@ -1540,13 +1600,12 @@ async fn copy_walk(tracks: usize, copies: usize) -> CopyWalk {
 	let mut generations = Vec::with_capacity(copies + 1);
 	generations.push(first);
 	for _ in 1..copies {
-		let generation = Generation::build(&producer, tracks);
-		generation.announce(&instance).await;
+		let generation = Generation::build(&producer, tracks, &instance);
+		generation.announce().await;
 		generations.push(generation);
 	}
 	CopyWalk {
-		next: Some(Generation::build(&producer, tracks)),
-		instance,
+		next: Some(Generation::build(&producer, tracks, &instance)),
 		_producer: producer,
 		_subscribers: subscribers,
 		generations,
@@ -1560,7 +1619,7 @@ impl CopyWalk {
 	/// every track, and each reader walks its copies in one driver turn.
 	async fn swap(&mut self) {
 		let generation = self.next.take().expect("one swap per setup");
-		generation.announce(&self.instance).await;
+		generation.announce().await;
 		self.generations.push(generation);
 	}
 }
@@ -1618,7 +1677,7 @@ const RESUME_OVERLAP: [(usize, usize, usize); 17] = [
 /// groups, each replacement in reverse arrival order.
 struct ResumeOverlap {
 	_producer: origin::Producer,
-	_generations: Vec<(origin::Publication, track::Producer)>,
+	_generations: Vec<(origin::Route, track::Producer)>,
 	readers: Vec<ResumeReader>,
 }
 
@@ -1668,8 +1727,13 @@ async fn resume_overlap(shape: ResumeShape, ordered: bool) -> ResumeOverlap {
 	tokio::spawn(moq_net::time::run(driver));
 	let instance = Instance::random();
 	let generation = |order: &mut dyn Iterator<Item = usize>| {
-		let broadcast = producer.create_broadcast(COPY_PATH).unwrap();
-		let track = broadcast.create_track("0", timed()).unwrap();
+		let broadcast = producer
+			.route(
+				COPY_PATH,
+				moq_net::origin::RouteOptions::hidden().with_instance(instance.clone(), 0),
+			)
+			.unwrap();
+		let track = broadcast.broadcast().create_track("0", timed()).unwrap();
 		for sequence in order {
 			let mut group = track
 				.create_group(moq_net::group::Info {
@@ -1679,9 +1743,7 @@ async fn resume_overlap(shape: ResumeShape, ordered: bool) -> ResumeOverlap {
 			group.write_frame(Timestamp::ZERO, b"f".as_ref()).unwrap();
 			group.finish().unwrap();
 		}
-		broadcast
-			.announce(origin::Route::default().with_instance(instance.clone(), 0))
-			.unwrap();
+		broadcast.announce().unwrap();
 		(broadcast, track)
 	};
 	let mut generations = vec![generation(&mut (0..retained))];
diff --git a/rs/moq-net/benches/path.rs b/rs/moq-net/benches/path.rs
index 26d8665e784..fe055528674 100644
--- a/rs/moq-net/benches/path.rs
+++ b/rs/moq-net/benches/path.rs
@@ -130,9 +130,13 @@ fn requests() {
 		let (producer, mut driver) = origin::Producer::new(origin::Config::default());
 		let consumer = producer.consume();
 		let _pubs: Vec<_> = (0..1000)
-			.map(|i| producer.publish(format!("{s}/{i}"), origin::Route::default()).unwrap())
+			.map(|i| {
+				producer
+					.route(format!("{s}/{i}"), moq_net::origin::RouteOptions::default())
+					.unwrap()
+			})
 			.collect();
-		let _covering = producer.publish(s, origin::Route::default()).unwrap();
+		let _covering = producer.route(s, moq_net::origin::RouteOptions::default()).unwrap();
 		let waiter = kio::Waiter::noop();
 
 		let mut local = |request: &dyn Fn() -> kio::Pending<origin::Requesting>| {
@@ -171,7 +175,11 @@ fn fanout() {
 		let (producer, _driver) = origin::Producer::new(origin::Config::default());
 		let consumer = producer.consume();
 		let _pubs: Vec<_> = (0..100)
-			.map(|i| producer.publish(format!("room/{i}"), origin::Route::default()).unwrap())
+			.map(|i| {
+				producer
+					.route(format!("room/{i}"), moq_net::origin::RouteOptions::default())
+					.unwrap()
+			})
 			.collect();
 		let mut cursors: Vec<origin::Routes> = (0..100).map(|_| consumer.routes()).collect();
 		for cursor in &mut cursors {
@@ -180,7 +188,7 @@ fn fanout() {
 
 		// Per cursor, per publish and retract.
 		allocs(&format!("origin/announce_fanout/{name}"), 500, 100, || {
-			let publication = producer.publish(s, origin::Route::default()).unwrap();
+			let publication = producer.route(s, moq_net::origin::RouteOptions::default()).unwrap();
 			for cursor in &mut cursors {
 				cursor.next().now_or_never().flatten().expect("announce delivered");
 			}
diff --git a/rs/moq-net/benches/retirement.rs b/rs/moq-net/benches/retirement.rs
index 9981821d53b..7fe34dfcde7 100644
--- a/rs/moq-net/benches/retirement.rs
+++ b/rs/moq-net/benches/retirement.rs
@@ -22,7 +22,14 @@ fn retirement(c: &mut Criterion) {
 							|| {
 								let (origin, driver) = origin::Producer::new(origin::Config::default());
 								let routes: Vec<_> = (0..routes)
-									.map(|i| origin.requests(format!("route/{i}")).unwrap())
+									.map(|i| {
+										origin
+											.route_prefix(
+												format!("route/{i}"),
+												moq_net::origin::RouteOptions::default(),
+											)
+											.unwrap()
+									})
 									.collect();
 								let mut watches = Vec::new();
 								let mut controls = Vec::new();
@@ -46,7 +53,10 @@ fn retirement(c: &mut Criterion) {
 								(origin, driver, routes, watches, controls, pending)
 							},
 							|fixture| {
-								let replacement = fixture.0.requests("route/0/jobs").unwrap();
+								let replacement = fixture
+									.0
+									.route_prefix("route/0/jobs", moq_net::origin::RouteOptions::default())
+									.unwrap();
 								let refused = fixture
 									.5
 									.iter()
diff --git a/rs/moq-net/benches/session/mod.rs b/rs/moq-net/benches/session/mod.rs
index 1c50fba8cce..67cda4335e3 100644
--- a/rs/moq-net/benches/session/mod.rs
+++ b/rs/moq-net/benches/session/mod.rs
@@ -594,7 +594,7 @@ struct Cluster<B: Backend> {
 	tracks: Vec<track::Producer>,
 	/// One datagram track per broadcast, indexed like [`path`], for datagram shapes only.
 	datagrams: Vec<datagram::Producer>,
-	_broadcasts: Vec<origin::Publication>,
+	_broadcasts: Vec<origin::Route>,
 	_origins: Vec<origin::Producer>,
 	_pairs: Vec<Pair>,
 	next_hop: u64,
@@ -652,17 +652,21 @@ impl<B: Backend> Cluster<B> {
 			this.pools.push(pool);
 			for index in 0..shape.broadcasts {
 				let broadcast = origin
-					.publish(path(publisher * shape.broadcasts + index), Default::default())
+					.route(
+						path(publisher * shape.broadcasts + index),
+						origin::RouteOptions::default(),
+					)
 					.unwrap();
 				this.tracks.push(
 					broadcast
+						.broadcast()
 						.create_track(TRACK, timed().with_compress(shape.compress))
 						.unwrap(),
 				);
 				if shape.datagrams {
 					let info = datagram::Info::default().with_timescale(moq_net::Timescale::MILLI);
 					this.datagrams
-						.push(broadcast.create_datagrams(DATAGRAMS, info).unwrap());
+						.push(broadcast.broadcast().create_datagrams(DATAGRAMS, info).unwrap());
 				}
 				this._broadcasts.push(broadcast);
 			}
@@ -1484,7 +1488,7 @@ impl Dash {
 struct DashRoom<B: Backend> {
 	_cluster: Cluster<B>,
 	tracks: Vec<track::Producer>,
-	_broadcasts: Vec<origin::Publication>,
+	_broadcasts: Vec<origin::Route>,
 	dash: Viewer,
 	payload: Bytes,
 }
@@ -1512,10 +1516,10 @@ impl<B: Backend> DashRoom<B> {
 			for project in 0..shape.projects {
 				let path = format!(".stats/{project}/node/{node}");
 				let broadcast = B::origin(&cluster.relays[node])
-					.publish(path.as_str(), Default::default())
+					.route(path.as_str(), origin::RouteOptions::default())
 					.unwrap();
 				for name in &names {
-					tracks.push(broadcast.create_track(name.as_str(), timed()).unwrap());
+					tracks.push(broadcast.broadcast().create_track(name.as_str(), timed()).unwrap());
 				}
 				broadcasts.push(broadcast);
 				paths.push(path);
@@ -1667,7 +1671,7 @@ impl<B: Backend> ChurnRoom<B> {
 			false,
 		)
 		.await;
-		let published = &cluster._broadcasts[0];
+		let published = cluster._broadcasts[0].broadcast();
 		let held: Vec<_> = (0..shape.held).map(|i| format!("held{i}")).collect();
 		let tracks: Vec<_> = held
 			.iter()
@@ -1885,7 +1889,7 @@ pub(crate) fn withdrawal<B: Backend>(c: &mut Criterion) {
 							let live: Vec<_> = (0..broadcasts)
 								.map(|i| {
 									B::origin(&cluster.relays[i % (relays - 1)])
-										.publish(path(i), Default::default())
+										.route(path(i), origin::RouteOptions::default())
 										.unwrap()
 								})
 								.collect();
diff --git a/rs/moq-net/benches/stats.rs b/rs/moq-net/benches/stats.rs
index e04d3e28b30..1369af72ede 100644
--- a/rs/moq-net/benches/stats.rs
+++ b/rs/moq-net/benches/stats.rs
@@ -16,7 +16,7 @@ const SHAPES: [(usize, usize); 4] = [(100, 1), (1_000, 1), (100, 10), (1_000, 10
 struct Registry {
 	registry: stats::Registry,
 	_driver: origin::Driver,
-	_publishers: Vec<origin::Publication>,
+	_publishers: Vec<origin::Route>,
 	_cursors: Vec<origin::Routes>,
 }
 
@@ -24,7 +24,11 @@ fn registry(broadcasts: usize, tiers: usize) -> Registry {
 	let registry = stats::Registry::new(stats::Config::new());
 	let (producer, driver) = origin::Producer::new(origin::Config::default());
 	let publishers = (0..broadcasts)
-		.map(|i| producer.publish(format!("room/{i}"), origin::Route::default()).unwrap())
+		.map(|i| {
+			producer
+				.route(format!("room/{i}"), moq_net::origin::RouteOptions::default())
+				.unwrap()
+		})
 		.collect();
 	let cursors = (0..tiers)
 		.map(|t| {
diff --git a/rs/moq-net/benches/viewers.rs b/rs/moq-net/benches/viewers.rs
index 2902b382b4e..4dd7455486f 100644
--- a/rs/moq-net/benches/viewers.rs
+++ b/rs/moq-net/benches/viewers.rs
@@ -69,7 +69,7 @@ struct Room {
 	producer: origin::Producer,
 	driver: origin::Driver,
 	broadcasts: usize,
-	_sources: Vec<(origin::Publication, moq_net::track::Producer)>,
+	_sources: Vec<(origin::Route, moq_net::track::Producer)>,
 }
 
 impl Room {
@@ -77,8 +77,10 @@ impl Room {
 		let (producer, driver) = origin::Producer::new(origin::Config::default());
 		let _sources = (0..broadcasts)
 			.map(|i| {
-				let broadcast = producer.publish(format!("room/{i}"), origin::Route::default()).unwrap();
-				let track = broadcast.create_track("video", timed()).unwrap();
+				let broadcast = producer
+					.route(format!("room/{i}"), moq_net::origin::RouteOptions::default())
+					.unwrap();
+				let track = broadcast.broadcast().create_track("video", timed()).unwrap();
 				let mut group = track.append_group().unwrap();
 				group.write_frame(Timestamp::ZERO, b"frame".as_ref()).unwrap();
 				group.finish().unwrap();
@@ -183,7 +185,10 @@ fn bench_churn(c: &mut Criterion) {
 				room.leave(subscription);
 			}
 			b.iter(|| {
-				let covering = room.producer.requests("room").unwrap();
+				let covering = room
+					.producer
+					.route_prefix("room", moq_net::origin::RouteOptions::default())
+					.unwrap();
 				room.poll();
 				drop(covering);
 				room.poll();
diff --git a/rs/moq-net/src/auth.rs b/rs/moq-net/src/auth.rs
index a79093e520a..35b6955bf14 100644
--- a/rs/moq-net/src/auth.rs
+++ b/rs/moq-net/src/auth.rs
@@ -6,7 +6,7 @@
 //! returns the [`Handle`]: [`grant`](Handle::grant) is the union of every token
 //! this side presented, and `add` presents another without
 //! reconnecting. The returned [`Credential`] is cloneable; dropping its last clone withdraws it.
-//! A [`Route`](crate::origin::Route) can name it, so the request advertising the route
+//! A [`Route`](crate::origin::RouteInfo) can name it, so the request advertising the route
 //! carries it too, and swapping it renews that request in place.
 //!
 //! A handle passed to `Client::with_auth` outlives its sessions: each session built on it
@@ -1385,7 +1385,7 @@ fn attached(links: &mut BTreeMap<u64, Attached>, id: u64) -> &mut Attached {
 ///
 /// Cheap to clone, and every clone names the same credential. It stays presented on
 /// every session of its handle until the last clone drops, which closes its streams and
-/// removes its grant from the union. A [`Route`](crate::origin::Route) holding one keeps
+/// removes its grant from the union. A [`Route`](crate::origin::RouteInfo) holding one keeps
 /// it presented while the route stands, across the handle's sessions.
 #[derive(Clone)]
 pub struct Credential {
diff --git a/rs/moq-net/src/fuzz.rs b/rs/moq-net/src/fuzz.rs
index ce956c6edeb..bc08a7261ef 100644
--- a/rs/moq-net/src/fuzz.rs
+++ b/rs/moq-net/src/fuzz.rs
@@ -433,13 +433,23 @@ pub fn excluding(origin: crate::origin::Consumer, peer: crate::Hop) -> crate::or
 	origin.excluding(peer)
 }
 
+/// A peer's wire route: its hop chain, cost, and instance at an epoch, as a session
+/// decodes one, for benches and tests that land or update forwarded routes.
+pub fn route_info(hops: crate::Hops, cost: u64, instance: Option<(crate::Instance, u64)>) -> crate::origin::RouteInfo {
+	let info = crate::origin::RouteInfo::default().with_hops(hops).with_cost(cost);
+	match instance {
+		Some((instance, epoch)) => info.with_instance(instance, epoch),
+		None => info,
+	}
+}
+
 /// Land a claim with a peer's wire route, as a session does, for the origin bench.
 pub fn requests_route(
 	origin: &crate::origin::Producer,
 	prefix: impl Into<crate::Path>,
-	route: crate::origin::Route,
-) -> Result<crate::origin::Requests, crate::Error> {
-	origin.requests_route(prefix, route, None)
+	route: crate::origin::RouteInfo,
+) -> Result<crate::origin::Route, crate::Error> {
+	origin.forward(prefix, route, None)
 }
 
 /// Land a claim taking over the peer's `predecessor` claim, as a session lands an
@@ -447,15 +457,15 @@ pub fn requests_route(
 pub fn takeover_route(
 	origin: &crate::origin::Producer,
 	prefix: impl Into<crate::Path>,
-	route: crate::origin::Route,
-	predecessor: &crate::origin::Requests,
-) -> Result<crate::origin::Requests, crate::Error> {
-	origin.requests_route(prefix, route, Some(predecessor))
+	route: crate::origin::RouteInfo,
+	predecessor: &crate::origin::Route,
+) -> Result<crate::origin::Route, crate::Error> {
+	origin.forward(prefix, route, Some(predecessor))
 }
 
 /// Replace a peer claim's route in place, as a session does on a route update.
-pub fn update_route(dynamic: &crate::origin::Requests, route: crate::origin::Route) -> Result<(), crate::Error> {
-	dynamic.update_route(route)
+pub fn update_route(dynamic: &crate::origin::Route, route: crate::origin::RouteInfo) -> Result<(), crate::Error> {
+	dynamic.update(route)
 }
 
 /// A session's snapshot of its peer's initial announcements, for the synced bench.
@@ -1887,7 +1897,7 @@ pub struct RequestValidity {
 
 impl RequestValidity {
 	/// Watch which instance this route's peer selects for a path.
-	pub fn new(route: &crate::origin::Requests, path: &crate::Path) -> Self {
+	pub fn new(route: &crate::origin::Route, path: &crate::Path) -> Self {
 		Self {
 			watch: crate::model::broadcast::RequestValidity::for_source(route, path),
 			periods: Vec::new(),
@@ -1923,7 +1933,7 @@ mod tests {
 		let _driver = driver;
 		let tier = crate::stats::Tier::new(crate::Path::from_static("t"));
 		let session = registry.tier(tier.clone()).session(crate::Path::from_static("root"));
-		let _broadcast = origin.publish("room/1", crate::origin::Route::default()).unwrap();
+		let _broadcast = origin.route("room/1", crate::origin::RouteOptions::default()).unwrap();
 		let mut cursor = origin.consume().with_stats(session).routes();
 		while cursor.next().now_or_never().flatten().is_some() {}
 
diff --git a/rs/moq-net/src/ietf/cluster.rs b/rs/moq-net/src/ietf/cluster.rs
index e7555d54c5a..d3a633dee82 100644
--- a/rs/moq-net/src/ietf/cluster.rs
+++ b/rs/moq-net/src/ietf/cluster.rs
@@ -12,7 +12,7 @@
 //!   ROUTE_COST of that path, as Key-Value-Pair message parameters.
 //!
 //! The semantics are the same ones moq-lite carries natively (see
-//! [`crate::origin::Route`]); this module is only the moq-transport binding.
+//! [`crate::origin::RouteInfo`]); this module is only the moq-transport binding.
 
 use crate::coding::{Decode, DecodeError, Decoder, Encode, EncodeError, Encoder};
 use crate::{Hop, Hops};
@@ -158,11 +158,11 @@ impl Advert {
 	/// instead of overflowing to best.
 	///
 	/// Add the arriving link price to the peer's static route cost.
-	pub fn route(&self, link_cost: u64) -> crate::origin::Route {
+	pub fn route(&self, link_cost: u64) -> crate::origin::RouteInfo {
 		let advertised = crate::origin::Cost::new(self.cost);
 		// The prefix travels separately: it is stamped where the advertisement
 		// attaches (the namespace).
-		crate::origin::Route::default()
+		crate::origin::RouteInfo::default()
 			.with_hops(self.hops.hops().clone())
 			.with_cost(advertised.charged(link_cost))
 	}
diff --git a/rs/moq-net/src/ietf/publisher.rs b/rs/moq-net/src/ietf/publisher.rs
index 3f73ab77ae1..0ed10727bfb 100644
--- a/rs/moq-net/src/ietf/publisher.rs
+++ b/rs/moq-net/src/ietf/publisher.rs
@@ -494,7 +494,7 @@ impl FindFetch {
 /// namespace becoming (un)advertisable, or its path or cost moving.
 struct Watched {
 	/// The route last announced for this namespace, as the origin delivered it.
-	route: crate::origin::Route,
+	route: crate::origin::RouteInfo,
 	/// The advertisement last buffered for this namespace, or [`Advert::None`] while
 	/// filtered. A different selection needs another message once this one is answered.
 	sent: Advert,
@@ -547,7 +547,7 @@ impl Refused {
 }
 
 impl Watched {
-	fn new(route: crate::origin::Route) -> Self {
+	fn new(route: crate::origin::RouteInfo) -> Self {
 		Self {
 			route,
 			sent: Advert::None,
@@ -1440,7 +1440,7 @@ impl Serving {
 			track: None,
 			// We just received a subscribe for this exact namespace, so the peer must have
 			// already seen the announcement. The immediate lookup resolves it at once, or
-			// falls back to the route covering it (an `origin::Requests`), if any.
+			// falls back to the route covering it (an `origin::Route`), if any.
 			step: ServingStep::Resolve(Resolve::new(
 				publisher.session.clone(),
 				msg.track_namespace.clone(),
@@ -2752,7 +2752,7 @@ impl Publisher {
 	///
 	/// The origin's announce cursor already filters routes through the peer
 	/// (control-plane split horizon); this only shapes what the wire can carry.
-	fn select(&self, route: &crate::origin::Route, peer: &cluster::Peer) -> Advert {
+	fn select(&self, route: &crate::origin::RouteInfo, peer: &cluster::Peer) -> Advert {
 		// A route that already passed through us is a reflection. The origin
 		// filters these on receive, so this is defensive.
 		if self.self_origin != crate::Hop::UNKNOWN && route.hops.contains(&self.self_origin) {
@@ -8947,7 +8947,7 @@ mod serve_tests {
 		log: Log,
 		track: track::Producer,
 		_origin: origin::Producer,
-		_broadcast: crate::origin::Publication,
+		_broadcast: crate::origin::Route,
 	}
 
 	fn serve(version: Version) -> Serve {
@@ -8956,24 +8956,14 @@ mod serve_tests {
 
 	/// The same, with the track described by `info`.
 	fn serve_track(version: Version, info: crate::track::Info) -> Serve {
-		serve_route(version, info, crate::origin::Route::default())
-	}
-
-	/// The same, with the broadcast announced on `route`.
-	fn serve_route(version: Version, info: crate::track::Info, route: crate::origin::Route) -> Serve {
-		serve_session(version, info, route, ScriptedSession::per_stream(vec![Vec::new()]))
+		serve_session(version, info, ScriptedSession::per_stream(vec![Vec::new()]))
 	}
 
 	/// The same, over `session`.
-	fn serve_session(
-		version: Version,
-		info: crate::track::Info,
-		route: crate::origin::Route,
-		session: ScriptedSession,
-	) -> Serve {
+	fn serve_session(version: Version, info: crate::track::Info, session: ScriptedSession) -> Serve {
 		let origin = crate::origin::Config::new(crate::Hop::new(1).unwrap()).produce();
-		let broadcast = origin.publish("room", route).unwrap();
-		let track = broadcast.create_track("video", info).unwrap();
+		let broadcast = origin.route("room", crate::origin::RouteOptions::default()).unwrap();
+		let track = broadcast.broadcast().create_track("video", info).unwrap();
 
 		let log = session.log.clone();
 
@@ -9469,12 +9459,7 @@ mod serve_tests {
 	async fn publish_done_waits_on_an_unacknowledged_fin_until_the_group_is_stale() {
 		let version = Version::Draft22;
 		let session = ScriptedSession::per_stream(vec![Vec::new()]).with_unacked_uni_fins(1);
-		let h = serve_session(
-			version,
-			crate::track::Info::timed(),
-			crate::origin::Route::default(),
-			session,
-		);
+		let h = serve_session(version, crate::track::Info::timed(), session);
 		// Well past the cache window, which only dates idleness once a sweep passes.
 		let budget = crate::cache::DEFAULT_EXPIRY * 4;
 		let mut msg = subscribe(Filter::NextObject, None);
@@ -10361,11 +10346,11 @@ mod serve_tests {
 			let h = serve(version);
 			let _old = h
 				._origin
-				.announce("old/first", crate::origin::Route::default())
+				.announce("old/first", crate::origin::RouteInfo::default())
 				.unwrap();
 			let _new = h
 				._origin
-				.announce("new/second", crate::origin::Route::default())
+				.announce("new/second", crate::origin::RouteInfo::default())
 				.unwrap();
 			settle().await;
 			let session = ScriptedSession::new(Vec::new());
@@ -10516,7 +10501,10 @@ mod serve_tests {
 			session.push(&update_with_tokens(&[TOKEN]));
 			let request = taken_token(&mut running, &mut requests).await;
 
-			let other = h._origin.announce("other", crate::origin::Route::default()).unwrap();
+			let other = h
+				._origin
+				.announce("other", crate::origin::RouteInfo::default())
+				.unwrap();
 			settle().await;
 			assert!(futures::poll!(running.as_mut()).is_pending());
 			drop(other);
@@ -10688,7 +10676,10 @@ mod serve_tests {
 		let request = taken_token(&mut running, &mut requests).await;
 
 		session.log.fail_writes();
-		let _other = h._origin.announce("other", crate::origin::Route::default()).unwrap();
+		let _other = h
+			._origin
+			.announce("other", crate::origin::RouteInfo::default())
+			.unwrap();
 		for _ in 0..10 {
 			assert!(
 				futures::poll!(running.as_mut()).is_pending(),
@@ -10931,7 +10922,6 @@ mod serve_tests {
 			let h = serve_session(
 				version,
 				track::Info::timed(),
-				crate::origin::Route::default(),
 				ScriptedSession::per_stream_eof(vec![Vec::new()]),
 			);
 			let stream = Stream::open(&crate::driver::Transport::new(h.session.clone()), version)
@@ -11035,7 +11025,7 @@ mod serve_tests {
 			let mut h = serve(version);
 			let claim = h
 				._origin
-				.requests_route("live", crate::origin::Route::default(), None)
+				.forward("live", crate::origin::RouteInfo::default(), None)
 				.unwrap();
 			let auth = crate::auth::Link::new(false);
 			auth.handle().authorize(&nothing());
@@ -11049,7 +11039,7 @@ mod serve_tests {
 			assert_eq!(code, Some(unauthorized(version)), "{version}: denied up front");
 			use futures::FutureExt;
 			assert!(
-				claim.requested_broadcast().now_or_never().is_none(),
+				claim.requested().now_or_never().is_none(),
 				"{version}: a denied request reached the origin"
 			);
 		}
@@ -11058,7 +11048,7 @@ mod serve_tests {
 			let mut h = serve(version);
 			let claim = h
 				._origin
-				.requests_route("live", crate::origin::Route::default(), None)
+				.forward("live", crate::origin::RouteInfo::default(), None)
 				.unwrap();
 			let auth = crate::auth::Link::new(false);
 			h.publisher = h.publisher.clone().with_auth(auth.clone());
@@ -11077,7 +11067,7 @@ mod serve_tests {
 			assert!(futures::poll!(answer.as_mut()).is_pending(), "{version}");
 
 			// Parked resolving the broadcast when the grant narrows.
-			let request = claim.requested_broadcast().await.unwrap();
+			let request = claim.requested().await.unwrap();
 			auth.handle().authorize(&nothing());
 			let output = crate::broadcast::Info::new().produce();
 			let _track = output.create_track("video", None).unwrap();
@@ -11121,8 +11111,8 @@ mod serve_tests {
 	async fn track_status_narrowed_while_answering_is_reset() {
 		for version in ALL_VERSIONS {
 			let origin = crate::origin::Config::new(crate::Hop::new(1).unwrap()).produce();
-			let broadcast = origin.publish("room", crate::origin::Route::default()).unwrap();
-			let _track = broadcast.create_track("video", None).unwrap();
+			let broadcast = origin.route("room", crate::origin::RouteOptions::default()).unwrap();
+			let _track = broadcast.broadcast().create_track("video", None).unwrap();
 			settle().await;
 
 			let bi = kio::Producer::new(true);
@@ -11378,7 +11368,7 @@ mod serve_tests {
 			let h = serve(version);
 			let claim = h
 				._origin
-				.requests_route("", crate::origin::Route::default(), None)
+				.forward("", crate::origin::RouteInfo::default(), None)
 				.unwrap();
 			settle().await;
 			let stream = Stream::open(&crate::driver::Transport::new(h.session.clone()), version)
@@ -11394,7 +11384,7 @@ mod serve_tests {
 			));
 			let done = futures::poll!(serving.as_mut());
 			assert!(
-				futures::FutureExt::now_or_never(claim.requested_broadcast()).is_none(),
+				futures::FutureExt::now_or_never(claim.requested()).is_none(),
 				"{version}: {path} reached the application"
 			);
 			assert!(done.is_ready(), "{version}: {path} was left waiting");
@@ -12757,12 +12747,7 @@ mod serve_tests {
 	async fn an_update_after_publish_done_keeps_the_join() {
 		for version in JOINING_DRAFTS {
 			// One script shared by every stream, so the update can arrive after PUBLISH_DONE.
-			let mut h = serve_session(
-				version,
-				crate::track::Info::timed(),
-				crate::origin::Route::default(),
-				ScriptedSession::new(Vec::new()),
-			);
+			let mut h = serve_session(version, crate::track::Info::timed(), ScriptedSession::new(Vec::new()));
 			publish_groups(&mut h, 5);
 			settle().await;
 			let stream = Stream::open(&crate::driver::Transport::new(h.session.clone()), version)
@@ -12800,8 +12785,11 @@ mod serve_tests {
 	async fn a_kept_join_ends_with_its_token_while_publish_done_waits() {
 		for version in JOINING_DRAFTS {
 			let origin = crate::origin::Config::new(crate::Hop::new(1).unwrap()).produce();
-			let broadcast = origin.publish("room", crate::origin::Route::default()).unwrap();
-			let track = broadcast.create_track("video", crate::track::Info::timed()).unwrap();
+			let broadcast = origin.route("room", crate::origin::RouteOptions::default()).unwrap();
+			let track = broadcast
+				.broadcast()
+				.create_track("video", crate::track::Info::timed())
+				.unwrap();
 			let mut group = track.create_group(group::Info { sequence: 0 }).unwrap();
 			group.write_frame(timestamp(), b"frame".to_vec()).unwrap();
 			group.finish().unwrap();
@@ -13421,7 +13409,7 @@ mod serve_tests {
 				}
 				Some(
 					h._origin
-						.requests_route("lobby", crate::origin::Route::default(), None)
+						.forward("lobby", crate::origin::RouteInfo::default(), None)
 						.unwrap(),
 				)
 			}
@@ -13596,7 +13584,7 @@ mod serve_tests {
 			let opt_out = Filter::is_draft20(version).then_some(false);
 			for wanted in [Some(true), opt_out].into_iter().flatten() {
 				let h = serve(version);
-				let track = h._broadcast.create_track("timed", info.clone()).unwrap();
+				let track = h._broadcast.broadcast().create_track("timed", info.clone()).unwrap();
 				let mut group = track.create_group(group::Info { sequence: 0 }).unwrap();
 				group.write_frame(stamp, b"stamped".as_slice()).unwrap();
 				group.finish().unwrap();
@@ -13828,8 +13816,8 @@ mod serve_tests {
 	/// published with `info`.
 	async fn across_a_hop(info: track::Info) -> track::Info {
 		let upstream = crate::origin::Config::new(crate::Hop::new(2).unwrap()).produce();
-		let broadcast = upstream.publish("room", crate::origin::Route::default()).unwrap();
-		let _track = broadcast.create_track("video", info).unwrap();
+		let broadcast = upstream.route("room", crate::origin::RouteOptions::default()).unwrap();
+		let _track = broadcast.broadcast().create_track("video", info).unwrap();
 		let (downstream, _sessions) = crate::lite::ietf::test_hop(&upstream, "room", [true, true]).await;
 		let broadcast = downstream.consume().request("room", None).await.unwrap();
 		broadcast.track("video").unwrap().info().await.unwrap()
@@ -14117,7 +14105,7 @@ mod serve_tests {
 	async fn a_draft22_fetch_of_a_fetch_only_cache_is_not_capped() {
 		let version = Version::Draft22;
 		let h = serve(version);
-		let request = h._broadcast.reserve_track("cam").unwrap();
+		let request = h._broadcast.broadcast().reserve_track("cam").unwrap();
 		let dynamic = request.requests();
 		let fetching = request.consume().fetch_group(4, None);
 		let mut fetched = dynamic.requested_fill_group().await.unwrap().accept(None).unwrap();
@@ -14462,8 +14450,11 @@ mod serve_tests {
 	async fn a_standalone_fetch_narrowed_while_responding_stops() {
 		for version in FETCH_DRAFTS {
 			let origin = crate::origin::Config::new(crate::Hop::new(1).unwrap()).produce();
-			let broadcast = origin.publish("room", crate::origin::Route::default()).unwrap();
-			let track = broadcast.create_track("video", crate::track::Info::timed()).unwrap();
+			let broadcast = origin.route("room", crate::origin::RouteOptions::default()).unwrap();
+			let track = broadcast
+				.broadcast()
+				.create_track("video", crate::track::Info::timed())
+				.unwrap();
 			let mut group = track.create_group(group::Info { sequence: 0 }).unwrap();
 			group.write_frame(timestamp(), b"0-0".to_vec()).unwrap();
 			group.finish().unwrap();
@@ -14558,8 +14549,11 @@ mod serve_tests {
 				},
 			] {
 				let origin = crate::origin::Config::new(crate::Hop::new(1).unwrap()).produce();
-				let broadcast = origin.publish("room", crate::origin::Route::default()).unwrap();
-				let track = broadcast.create_track("video", crate::track::Info::timed()).unwrap();
+				let broadcast = origin.route("room", crate::origin::RouteOptions::default()).unwrap();
+				let track = broadcast
+					.broadcast()
+					.create_track("video", crate::track::Info::timed())
+					.unwrap();
 				let mut group = track.create_group(group::Info { sequence: 0 }).unwrap();
 				group.write_frame(timestamp(), PAYLOAD.to_vec()).unwrap();
 				settle().await;
@@ -14689,8 +14683,11 @@ mod serve_tests {
 		}) {
 			let token = end != JoinEnd::Ended;
 			let origin = crate::origin::Config::new(crate::Hop::new(1).unwrap()).produce();
-			let broadcast = origin.publish("room", crate::origin::Route::default()).unwrap();
-			let track = broadcast.create_track("video", crate::track::Info::timed()).unwrap();
+			let broadcast = origin.route("room", crate::origin::RouteOptions::default()).unwrap();
+			let track = broadcast
+				.broadcast()
+				.create_track("video", crate::track::Info::timed())
+				.unwrap();
 			let mut group = track.create_group(group::Info { sequence: 0 }).unwrap();
 			group.write_frame(timestamp(), PAYLOAD.to_vec()).unwrap();
 			settle().await;
@@ -15024,14 +15021,17 @@ mod serve_tests {
 			Parked::Resolving => (
 				Some(
 					origin
-						.requests_route("room", crate::origin::Route::default(), None)
+						.forward("room", crate::origin::RouteInfo::default(), None)
 						.unwrap(),
 				),
 				None,
 			),
 			Parked::Acking | Parked::Ending => {
-				let broadcast = origin.publish("room", crate::origin::Route::default()).unwrap();
-				let track = broadcast.create_track("video", crate::track::Info::timed()).unwrap();
+				let broadcast = origin.route("room", crate::origin::RouteOptions::default()).unwrap();
+				let track = broadcast
+					.broadcast()
+					.create_track("video", crate::track::Info::timed())
+					.unwrap();
 				match parked {
 					// One published group, so the subscription parks at the live edge.
 					Parked::Acking => {
@@ -15081,7 +15081,7 @@ mod serve_tests {
 		// Drive the subscription to where it parks.
 		let _route = match &claim {
 			Some(claim) => {
-				let requested = std::pin::pin!(claim.requested_broadcast());
+				let requested = std::pin::pin!(claim.requested());
 				match futures::future::select(requested, subscription.as_mut()).await {
 					futures::future::Either::Left((route, _)) => Some(route.unwrap()),
 					futures::future::Either::Right((res, _)) => panic!("{version} {parked:?}: ended: {res:?}"),
@@ -15261,10 +15261,10 @@ mod serve_tests {
 		match setup {
 			Setup::Resolving => {
 				let route = origin
-					.requests_route("room", crate::origin::Route::default(), None)
+					.forward("room", crate::origin::RouteInfo::default(), None)
 					.unwrap();
 				let request = {
-					let requested = std::pin::pin!(route.requested_broadcast());
+					let requested = std::pin::pin!(route.requested());
 					match futures::future::select(requested, serving.as_mut()).await {
 						futures::future::Either::Left((request, _)) => request.unwrap(),
 						futures::future::Either::Right((res, _)) => panic!("{version} {setup:?}: ended: {res:?}"),
@@ -15273,8 +15273,8 @@ mod serve_tests {
 				claim = Some((route, request));
 			}
 			Setup::Subscribing => {
-				let broadcast = origin.publish("room", crate::origin::Route::default()).unwrap();
-				let mut dynamic = broadcast.requests();
+				let broadcast = origin.route("room", crate::origin::RouteOptions::default()).unwrap();
+				let mut dynamic = broadcast.broadcast().requests();
 				let request = {
 					let requested = std::pin::pin!(dynamic.requested_track());
 					match futures::future::select(requested, serving.as_mut()).await {
@@ -15285,8 +15285,11 @@ mod serve_tests {
 				asked = Some((broadcast, dynamic, request));
 			}
 			Setup::Live => {
-				let broadcast = origin.publish("room", crate::origin::Route::default()).unwrap();
-				let mut track = broadcast.create_track("video", crate::track::Info::timed()).unwrap();
+				let broadcast = origin.route("room", crate::origin::RouteOptions::default()).unwrap();
+				let mut track = broadcast
+					.broadcast()
+					.create_track("video", crate::track::Info::timed())
+					.unwrap();
 				track.set_idle();
 				serve_until(serving.as_mut(), "the upstream subscription", || {
 					track.subscription().is_some()
@@ -15714,8 +15717,11 @@ mod serve_tests {
 	/// its script.
 	fn serve_on(version: Version, auth: crate::auth::Link, session: ScriptedSession) -> Serve {
 		let origin = crate::origin::Config::new(crate::Hop::new(1).unwrap()).produce();
-		let broadcast = origin.publish("room", crate::origin::Route::default()).unwrap();
-		let track = broadcast.create_track("video", crate::track::Info::timed()).unwrap();
+		let broadcast = origin.route("room", crate::origin::RouteOptions::default()).unwrap();
+		let track = broadcast
+			.broadcast()
+			.create_track("video", crate::track::Info::timed())
+			.unwrap();
 
 		let log = session.log.clone();
 
@@ -17342,7 +17348,7 @@ mod tests {
 		let echoed = origin
 			.announce(
 				"from/peer",
-				crate::origin::Route::default()
+				crate::origin::RouteInfo::default()
 					.with_hops(echoed_hops)
 					.with_via(assigned),
 			)
@@ -17351,7 +17357,7 @@ mod tests {
 		let mut local_hops = crate::Hops::new();
 		local_hops.push(other).unwrap();
 		let local = origin
-			.announce("from/us", crate::origin::Route::default().with_hops(local_hops))
+			.announce("from/us", crate::origin::RouteInfo::default().with_hops(local_hops))
 			.unwrap();
 
 		(publisher, consumer, vec![echoed, local])
@@ -17401,7 +17407,7 @@ mod tests {
 		let _echoed = origin
 			.announce(
 				"from/peer",
-				crate::origin::Route::default().with_hops(hops.clone()).with_via(r1),
+				crate::origin::RouteInfo::default().with_hops(hops.clone()).with_via(r1),
 			)
 			.unwrap();
 
@@ -17473,7 +17479,7 @@ mod tests {
 		let _echoed = origin
 			.announce(
 				"from/peer",
-				crate::origin::Route::default().with_hops(hops).with_via(assigned),
+				crate::origin::RouteInfo::default().with_hops(hops).with_via(assigned),
 			)
 			.unwrap();
 
@@ -17517,13 +17523,13 @@ mod tests {
 		let mut clean = crate::Hops::new();
 		clean.push(crate::Hop::new(778).unwrap()).unwrap();
 		let _clean = origin
-			.announce("cam-clean", crate::origin::Route::default().with_hops(clean))
+			.announce("cam-clean", crate::origin::RouteInfo::default().with_hops(clean))
 			.unwrap();
 		// A chain with no room left for our own hop cannot be forwarded.
 		let mut full = crate::Hops::new();
 		while full.push(crate::Hop::new(100 + full.len() as u64).unwrap()).is_ok() {}
 		let _full = origin
-			.announce("cam-full", crate::origin::Route::default().with_hops(full))
+			.announce("cam-full", crate::origin::RouteInfo::default().with_hops(full))
 			.unwrap();
 		settle().await;
 
@@ -17592,7 +17598,7 @@ mod tests {
 		let _tainted = origin
 			.announce(
 				"route-flip-cam",
-				crate::origin::Route::default()
+				crate::origin::RouteInfo::default()
 					.with_hops(tainted_hops)
 					.with_via(assigned),
 			)
@@ -17620,7 +17626,10 @@ mod tests {
 		let mut clean_hops = crate::Hops::new();
 		clean_hops.push(clean_publisher).unwrap();
 		let clean = origin
-			.announce("route-flip-cam", crate::origin::Route::default().with_hops(clean_hops))
+			.announce(
+				"route-flip-cam",
+				crate::origin::RouteInfo::default().with_hops(clean_hops),
+			)
 			.unwrap();
 		settle().await;
 		assert!(futures::poll!(run.as_mut()).is_pending());
@@ -17675,7 +17684,9 @@ mod tests {
 		const VERSION: Version = Version::Draft18;
 
 		let origin = crate::origin::Config::new(crate::Hop::new(1).unwrap()).produce();
-		let _cam = origin.announce("lonely-cam", crate::origin::Route::default()).unwrap();
+		let _cam = origin
+			.announce("lonely-cam", crate::origin::RouteInfo::default())
+			.unwrap();
 		settle().await;
 
 		// Every stream is answered with the same refusal, so a retry would show up as a
@@ -17747,7 +17758,9 @@ mod tests {
 		const VERSION: Version = Version::Draft18;
 
 		let origin = crate::origin::Config::new(crate::Hop::new(1).unwrap()).produce();
-		let _local = origin.announce("local-cam", crate::origin::Route::default()).unwrap();
+		let _local = origin
+			.announce("local-cam", crate::origin::RouteInfo::default())
+			.unwrap();
 		settle().await;
 
 		// The only stream is the PUBLISH_NAMESPACE request we open ourselves.
@@ -17791,7 +17804,9 @@ mod tests {
 	async fn publish_namespace_withdraws_by_reset() {
 		for version in [Version::Draft18, Version::Draft20, Version::Draft22] {
 			let origin = crate::origin::Config::new(crate::Hop::new(1).unwrap()).produce();
-			let local = origin.announce("local-cam", crate::origin::Route::default()).unwrap();
+			let local = origin
+				.announce("local-cam", crate::origin::RouteInfo::default())
+				.unwrap();
 			settle().await;
 
 			let session =
@@ -17855,7 +17870,9 @@ mod tests {
 		const VERSION: Version = Version::Draft18;
 
 		let origin = crate::origin::Config::new(crate::Hop::new(1).unwrap()).produce();
-		let _local = origin.announce("local-cam", crate::origin::Route::default()).unwrap();
+		let _local = origin
+			.announce("local-cam", crate::origin::RouteInfo::default())
+			.unwrap();
 		settle().await;
 
 		let ok = crate::lite::test_transport::Log::default();
@@ -17946,8 +17963,10 @@ mod tests {
 			scoped,
 		} = case;
 		let origin = crate::origin::Config::new(crate::Hop::new(1).unwrap()).produce();
-		let _cam = origin.announce("cam", crate::origin::Route::default()).unwrap();
-		let _stats = origin.announce(".stats/node", crate::origin::Route::default()).unwrap();
+		let _cam = origin.announce("cam", crate::origin::RouteInfo::default()).unwrap();
+		let _stats = origin
+			.announce(".stats/node", crate::origin::RouteInfo::default())
+			.unwrap();
 		settle().await;
 
 		// Stream 1 is the peer's SUBSCRIBE_NAMESPACE; stream 2, if opened at all, is our
@@ -18093,7 +18112,9 @@ mod tests {
 	async fn a_non_solicit_subscribe_namespace_carries_namespace() {
 		for version in [Version::Draft18] {
 			let origin = crate::origin::Config::new(crate::Hop::new(1).unwrap()).produce();
-			let early = origin.announce("early-cam", crate::origin::Route::default()).unwrap();
+			let early = origin
+				.announce("early-cam", crate::origin::RouteInfo::default())
+				.unwrap();
 			settle().await;
 
 			let session = crate::lite::test_transport::ScriptedSession::per_stream(vec![Vec::new()]);
@@ -18137,7 +18158,9 @@ mod tests {
 				"{version:?}: existing match",
 			);
 
-			let _late = origin.announce("late-cam", crate::origin::Route::default()).unwrap();
+			let _late = origin
+				.announce("late-cam", crate::origin::RouteInfo::default())
+				.unwrap();
 			for _ in 0..100 {
 				assert!(futures::poll!(run.as_mut()).is_pending());
 				if occurrences(&log, b"late-cam") >= 1 {
@@ -18184,7 +18207,9 @@ mod tests {
 		const VERSION: Version = Version::Draft18;
 
 		let origin = crate::origin::Config::new(crate::Hop::new(1).unwrap()).produce();
-		let first = origin.announce("first-cam", crate::origin::Route::default()).unwrap();
+		let first = origin
+			.announce("first-cam", crate::origin::RouteInfo::default())
+			.unwrap();
 		settle().await;
 
 		// The first advertisement has send capacity, and the peer answers it.
@@ -18219,7 +18244,9 @@ mod tests {
 
 		// Send capacity runs out before the second advertisement can send its header.
 		set_gate(&gate, false);
-		let _second = origin.announce("second-cam", crate::origin::Route::default()).unwrap();
+		let _second = origin
+			.announce("second-cam", crate::origin::RouteInfo::default())
+			.unwrap();
 		settle().await;
 
 		// Retiring the first needs no new stream, so the loop has to reach
@@ -18285,7 +18312,7 @@ mod tests {
 		// The state a refused or failed offer leaves behind: the peer holds nothing, and
 		// the loop is coming back to it on a timer.
 		let suffix: crate::Path = crate::Path::from_static("from/peer");
-		let mut watch = Watched::new(crate::origin::Route::default().with_hops(hops));
+		let mut watch = Watched::new(crate::origin::RouteInfo::default().with_hops(hops));
 		watch.deferred = true;
 
 		let mut ns = Namespaces::new(cluster::Peer::default(), Target::Requests);
@@ -18312,7 +18339,7 @@ mod tests {
 		let cam = origin
 			.announce(
 				"solo-cam",
-				crate::origin::Route::default().with_instance(instance.clone(), 0),
+				crate::origin::RouteInfo::default().with_instance(instance.clone(), 0),
 			)
 			.unwrap();
 		settle().await;
@@ -18348,7 +18375,9 @@ mod tests {
 		let _standby = origin
 			.announce(
 				"solo-cam",
-				crate::origin::Route::default().with_instance(instance, 0).with_cost(0),
+				crate::origin::RouteInfo::default()
+					.with_instance(instance, 0)
+					.with_cost(0),
 			)
 			.unwrap();
 
@@ -18416,7 +18445,7 @@ mod tests {
 		let _cold = origin
 			.announce(
 				"cam",
-				crate::origin::Route::default()
+				crate::origin::RouteInfo::default()
 					.with_instance(instance.clone(), 0)
 					.with_cost(4),
 			)
@@ -18453,7 +18482,9 @@ mod tests {
 		let _warm = origin
 			.announce(
 				"cam",
-				crate::origin::Route::default().with_instance(instance, 0).with_cost(0),
+				crate::origin::RouteInfo::default()
+					.with_instance(instance, 0)
+					.with_cost(0),
 			)
 			.unwrap();
 
@@ -18493,7 +18524,7 @@ mod tests {
 		let _cold = origin
 			.announce(
 				"cam",
-				crate::origin::Route::default()
+				crate::origin::RouteInfo::default()
 					.with_instance(instance.clone(), 0)
 					.with_cost(4),
 			)
@@ -18547,7 +18578,9 @@ mod tests {
 		let _warm = origin
 			.announce(
 				"cam",
-				crate::origin::Route::default().with_instance(instance, 0).with_cost(0),
+				crate::origin::RouteInfo::default()
+					.with_instance(instance, 0)
+					.with_cost(0),
 			)
 			.unwrap();
 
@@ -18580,7 +18613,7 @@ mod tests {
 		let _from_a = origin
 			.announce(
 				"cam",
-				crate::origin::Route::default()
+				crate::origin::RouteInfo::default()
 					.with_instance(instance.clone(), 0)
 					.with_hops(publisher_a)
 					.with_cost(4),
@@ -18618,7 +18651,7 @@ mod tests {
 		let _from_b = origin
 			.announce(
 				"cam",
-				crate::origin::Route::default()
+				crate::origin::RouteInfo::default()
 					.with_instance(instance, 0)
 					.with_hops(publisher_b)
 					.with_cost(0),
@@ -18721,7 +18754,7 @@ mod tests {
 			.present(bytes::Bytes::from_static(b"second-secret"), false)
 			.unwrap();
 		let cam = origin
-			.announce("cam", crate::origin::Route::default().with_auth(first))
+			.announce("cam", crate::origin::RouteInfo::default().with_auth(first))
 			.unwrap();
 		settle().await;
 
@@ -18743,7 +18776,8 @@ mod tests {
 			"{version}: PUBLISH_NAMESPACE carries the auth"
 		);
 
-		cam.update(crate::origin::Route::default().with_auth(second)).unwrap();
+		cam.update(crate::origin::RouteInfo::default().with_auth(second))
+			.unwrap();
 		let expected = request_update(
 			version,
 			&ietf::PublishNamespaceUpdate {
@@ -18786,7 +18820,7 @@ mod tests {
 			.present(bytes::Bytes::from_static(b"foreign-secret"), false)
 			.unwrap();
 		let _cam = origin
-			.announce("cam", crate::origin::Route::default().with_auth(foreign))
+			.announce("cam", crate::origin::RouteInfo::default().with_auth(foreign))
 			.unwrap();
 		settle().await;
 
@@ -18812,7 +18846,7 @@ mod tests {
 		let origin = unheld_origin();
 		let auth = crate::auth::Link::ietf(false);
 		let token = auth.present(bytes::Bytes::from_static(b"late-secret"), false).unwrap();
-		let cam = origin.announce("cam", crate::origin::Route::default()).unwrap();
+		let cam = origin.announce("cam", crate::origin::RouteInfo::default()).unwrap();
 		settle().await;
 
 		let ok = publish_namespace_ok(VERSION).await;
@@ -18821,7 +18855,8 @@ mod tests {
 		poll_until(&mut run, &log, b"cam", 1).await;
 		assert_eq!(occurrences(&log, b"late-secret"), 0, "named before it had an auth");
 
-		cam.update(crate::origin::Route::default().with_auth(token)).unwrap();
+		cam.update(crate::origin::RouteInfo::default().with_auth(token))
+			.unwrap();
 		poll_until(&mut run, &log, b"cam", 2).await;
 
 		assert_eq!(occurrences(&log, b"cam"), 2, "the request was not made again");
@@ -18839,10 +18874,16 @@ mod tests {
 		let auth = crate::auth::Link::ietf(false);
 		let present = |token: &'static [u8]| auth.present(bytes::Bytes::from_static(token), false).unwrap();
 		let a = origin
-			.announce("cam-a", crate::origin::Route::default().with_auth(present(b"a-first")))
+			.announce(
+				"cam-a",
+				crate::origin::RouteInfo::default().with_auth(present(b"a-first")),
+			)
 			.unwrap();
 		let b = origin
-			.announce("cam-b", crate::origin::Route::default().with_auth(present(b"b-first")))
+			.announce(
+				"cam-b",
+				crate::origin::RouteInfo::default().with_auth(present(b"b-first")),
+			)
 			.unwrap();
 		settle().await;
 
@@ -18854,9 +18895,9 @@ mod tests {
 		assert_eq!(occurrences(&log, b"cam-a"), 1, "cam-a was never advertised");
 		assert_eq!(occurrences(&log, b"cam-b"), 1, "cam-b was never advertised");
 
-		a.update(crate::origin::Route::default().with_auth(present(b"a-second")))
+		a.update(crate::origin::RouteInfo::default().with_auth(present(b"a-second")))
 			.unwrap();
-		b.update(crate::origin::Route::default().with_auth(present(b"b-second")))
+		b.update(crate::origin::RouteInfo::default().with_auth(present(b"b-second")))
 			.unwrap();
 		poll_until(&mut run, &log, b"b-second", 1).await;
 		assert_eq!(occurrences(&log, b"a-second"), 1, "cam-a's renewal never went out");
@@ -18866,7 +18907,7 @@ mod tests {
 			"cam-b's renewal waited on cam-a's answer"
 		);
 
-		let _c = origin.announce("cam-c", crate::origin::Route::default()).unwrap();
+		let _c = origin.announce("cam-c", crate::origin::RouteInfo::default()).unwrap();
 		poll_until(&mut run, &log, b"cam-c", 1).await;
 		assert_eq!(
 			occurrences(&log, b"cam-c"),
@@ -18885,7 +18926,7 @@ mod tests {
 
 		for fin in [true, false] {
 			let origin = unheld_origin();
-			let _cam = origin.announce("cam", crate::origin::Route::default()).unwrap();
+			let _cam = origin.announce("cam", crate::origin::RouteInfo::default()).unwrap();
 			settle().await;
 
 			let (session, peer) = memory::pair(memory::Config::default());
@@ -18953,7 +18994,12 @@ mod tests {
 		let origin = unheld_origin();
 		let mut cams: HashMap<&str, _> = ["a-cam", "b-cam"]
 			.into_iter()
-			.map(|name| (name, origin.announce(name, crate::origin::Route::default()).unwrap()))
+			.map(|name| {
+				(
+					name,
+					origin.announce(name, crate::origin::RouteInfo::default()).unwrap(),
+				)
+			})
 			.collect();
 		settle().await;
 
@@ -19038,7 +19084,7 @@ mod tests {
 			let auth = crate::auth::Link::ietf(false);
 			let token = auth.present(bytes::Bytes::from(vec![0; 70_000]), false).unwrap();
 			let _cam = origin
-				.announce("cam", crate::origin::Route::default().with_auth(token))
+				.announce("cam", crate::origin::RouteInfo::default().with_auth(token))
 				.unwrap();
 			settle().await;
 
@@ -19085,7 +19131,7 @@ mod tests {
 		let auth = crate::auth::Link::ietf(false);
 		let present = |token: &'static [u8]| auth.present(bytes::Bytes::from_static(token), false).unwrap();
 		let cam = origin
-			.announce("cam", crate::origin::Route::default().with_auth(present(b"first")))
+			.announce("cam", crate::origin::RouteInfo::default().with_auth(present(b"first")))
 			.unwrap();
 		settle().await;
 
@@ -19108,7 +19154,7 @@ mod tests {
 		// The idle request has read its OK and parked, so the reset waits for the renewal
 		// to wake it.
 		peer.close(crate::lite::test_transport::Close::Reset);
-		cam.update(crate::origin::Route::default().with_auth(present(b"second")))
+		cam.update(crate::origin::RouteInfo::default().with_auth(present(b"second")))
 			.unwrap();
 		poll_until(&mut run, &log, b"second", 1).await;
 		assert!(futures::poll!(run.as_mut()).is_pending());
@@ -19138,7 +19184,7 @@ mod tests {
 		let auth = crate::auth::Link::ietf(false);
 		let present = |token: &'static [u8]| auth.present(bytes::Bytes::from_static(token), false).unwrap();
 		let cam = origin
-			.announce("cam", crate::origin::Route::default().with_auth(present(b"first")))
+			.announce("cam", crate::origin::RouteInfo::default().with_auth(present(b"first")))
 			.unwrap();
 		settle().await;
 
@@ -19146,7 +19192,7 @@ mod tests {
 		let (publisher, log) = auth_publisher(&origin, &auth, vec![ok.clone(), ok], version);
 		let mut run = std::pin::pin!(publisher.run_publish_namespaces());
 		poll_until(&mut run, &log, b"first", 1).await;
-		cam.update(crate::origin::Route::default().with_auth(present(b"second")))
+		cam.update(crate::origin::RouteInfo::default().with_auth(present(b"second")))
 			.unwrap();
 		poll_until(&mut run, &log, b"second", 1).await;
 		assert_eq!(occurrences(&log, b"second"), 1, "the renewal never went out");
@@ -19178,7 +19224,7 @@ mod tests {
 		}
 		.produce();
 		let _old = origin
-			.announce("cam", crate::origin::Route::default().with_cost(4))
+			.announce("cam", crate::origin::RouteInfo::default().with_cost(4))
 			.unwrap();
 		settle().await;
 
@@ -19207,7 +19253,7 @@ mod tests {
 		assert_eq!(occurrences(&log, b"cam"), 1, "the advertisement never went out");
 
 		let _new = origin
-			.announce("cam", crate::origin::Route::default().with_cost(0))
+			.announce("cam", crate::origin::RouteInfo::default().with_cost(0))
 			.unwrap();
 		for _ in 0..100 {
 			assert!(futures::poll!(run.as_mut()).is_pending());
@@ -19234,7 +19280,7 @@ mod tests {
 		let _cold = origin
 			.announce(
 				"cam",
-				crate::origin::Route::default()
+				crate::origin::RouteInfo::default()
 					.with_instance(instance.clone(), 0)
 					.with_cost(4),
 			)
@@ -19274,7 +19320,9 @@ mod tests {
 		let _warm = origin
 			.announce(
 				"cam",
-				crate::origin::Route::default().with_instance(instance, 0).with_cost(0),
+				crate::origin::RouteInfo::default()
+					.with_instance(instance, 0)
+					.with_cost(0),
 			)
 			.unwrap();
 
@@ -19307,8 +19355,12 @@ mod tests {
 		const VERSION: Version = Version::Draft18;
 
 		let origin = crate::origin::Config::new(crate::Hop::new(1).unwrap()).produce();
-		let _first = origin.announce("first-cam", crate::origin::Route::default()).unwrap();
-		let _second = origin.announce("second-cam", crate::origin::Route::default()).unwrap();
+		let _first = origin
+			.announce("first-cam", crate::origin::RouteInfo::default())
+			.unwrap();
+		let _second = origin
+			.announce("second-cam", crate::origin::RouteInfo::default())
+			.unwrap();
 		settle().await;
 
 		// Every stream opens and then goes silent: an exhausted script parks rather than
@@ -19372,7 +19424,7 @@ mod tests {
 						let first = auth.present(bytes::Bytes::from_static(b"first"), false).unwrap();
 						let mut first_grant = first.grant();
 						let cam = origin
-							.announce("cam", crate::origin::Route::default().with_auth(first))
+							.announce("cam", crate::origin::RouteInfo::default().with_auth(first))
 							.unwrap();
 						settle().await;
 
@@ -19413,7 +19465,8 @@ mod tests {
 						assert!(futures::poll!(run.as_mut()).is_pending());
 						if matches!(stage, Stage::UpdateWrite) {
 							let second = auth.present(bytes::Bytes::from_static(b"second"), false).unwrap();
-							cam.update(crate::origin::Route::default().with_auth(second)).unwrap();
+							cam.update(crate::origin::RouteInfo::default().with_auth(second))
+								.unwrap();
 							settle().await;
 							assert!(futures::poll!(run.as_mut()).is_pending());
 							assert!(
@@ -19465,7 +19518,7 @@ mod tests {
 	async fn an_unanswered_advertisement_is_withdrawn() {
 		for version in [Version::Draft18] {
 			let origin = unheld_origin();
-			let _cam = origin.announce("cam", crate::origin::Route::default()).unwrap();
+			let _cam = origin.announce("cam", crate::origin::RouteInfo::default()).unwrap();
 			settle().await;
 
 			// The peer takes the request and answers nothing.
@@ -19505,7 +19558,9 @@ mod tests {
 	async fn an_advertisement_without_credit_is_retried_and_spends_no_id() {
 		for version in [Version::Draft18] {
 			let origin = crate::origin::Config::new(crate::Hop::new(1).unwrap()).produce();
-			let _cam = origin.announce("lonely-cam", crate::origin::Route::default()).unwrap();
+			let _cam = origin
+				.announce("lonely-cam", crate::origin::RouteInfo::default())
+				.unwrap();
 			settle().await;
 			let session =
 				crate::lite::test_transport::ScriptedSession::new(publish_namespace_ok(version).await).without_credit();
@@ -19555,7 +19610,9 @@ mod tests {
 		const VERSION: Version = Version::Draft18;
 
 		let origin = crate::origin::Config::new(crate::Hop::new(1).unwrap()).produce();
-		let _cam = origin.announce("lonely-cam", crate::origin::Route::default()).unwrap();
+		let _cam = origin
+			.announce("lonely-cam", crate::origin::RouteInfo::default())
+			.unwrap();
 		settle().await;
 
 		// No send capacity from the start: an admitted header cannot finish.
diff --git a/rs/moq-net/src/ietf/session.rs b/rs/moq-net/src/ietf/session.rs
index ec105d59d5e..7ab881730c1 100644
--- a/rs/moq-net/src/ietf/session.rs
+++ b/rs/moq-net/src/ietf/session.rs
@@ -2615,7 +2615,9 @@ mod tests {
 	/// enough: the question is only whether the bytes went out unasked.
 	async fn announce_occurrences(peer_declared: Option<peer::Peer>) -> usize {
 		let origin = crate::origin::Config::new(crate::Hop::new(1).unwrap()).produce();
-		let _cam = origin.announce("solo-cam", crate::origin::Route::default()).unwrap();
+		let _cam = origin
+			.announce("solo-cam", crate::origin::RouteInfo::default())
+			.unwrap();
 
 		// An open gate: an unsolicited PUBLISH_NAMESPACE can reach the wire.
 		let gate = kio::Producer::new(true);
@@ -2720,7 +2722,9 @@ mod tests {
 
 	fn auth_session(auth: bool) -> AuthSession {
 		let origin = crate::origin::Config::new(crate::Hop::new(1).unwrap()).produce();
-		let cam = origin.announce("solo-cam", crate::origin::Route::default()).unwrap();
+		let cam = origin
+			.announce("solo-cam", crate::origin::RouteInfo::default())
+			.unwrap();
 
 		let gate = kio::Producer::new(true);
 		let session = crate::lite::test_transport::SinkSession::gated_bi(gate.consume());
@@ -3378,8 +3382,8 @@ mod tests {
 		// Stall before the type, then after it while the body has not arrived.
 		for stalled in [Vec::new(), vec![ietf::Subscribe::ID as u8]] {
 			let origin = crate::origin::Config::new(crate::Hop::new(1).unwrap()).produce();
-			let broadcast = origin.publish("room", crate::origin::Route::default()).unwrap();
-			let mut track = broadcast.create_track("video", None).unwrap();
+			let broadcast = origin.route("room", crate::origin::RouteOptions::default()).unwrap();
+			let mut track = broadcast.broadcast().create_track("video", None).unwrap();
 			let session = crate::lite::test_transport::ScriptedSession::new(Vec::new())
 				.with_incoming_bidis(vec![stalled, subscribe.clone()]);
 			let driver = bidi_driver(session, Some(origin.consume()));
diff --git a/rs/moq-net/src/ietf/subscriber.rs b/rs/moq-net/src/ietf/subscriber.rs
index 7779bd52ace..601aed8db01 100644
--- a/rs/moq-net/src/ietf/subscriber.rs
+++ b/rs/moq-net/src/ietf/subscriber.rs
@@ -864,18 +864,18 @@ impl TrackState {
 struct BroadcastState {
 	// The route announced into our origin for this namespace, post-charge: the newest
 	// live advertisement's.
-	route: crate::origin::Route,
+	route: crate::origin::RouteInfo,
 
 	// Each live advertisement of the namespace with the route it describes, oldest first.
 	// A publisher replacing its instance withdraws one advertisement and makes another, on
 	// separate streams that can arrive in either order: the newest stands until it goes,
 	// and an update to an older one changes nothing.
-	adverts: Vec<(u64, crate::origin::Route)>,
+	adverts: Vec<(u64, crate::origin::RouteInfo)>,
 
 	// The served route: dropping it (and the serve task's clone) retracts the
 	// route and rejects its queued requests. `None` while the session's limit holds
 	// it back, though the peer still advertises it.
-	dynamic: Option<crate::origin::Requests>,
+	dynamic: Option<crate::origin::Route>,
 
 	// Bumped each time the route attaches, so a serve task outlived by a limit that
 	// took the route away and gave it back ends rather than serve beside the new one.
@@ -944,7 +944,7 @@ enum Withdraw {
 struct Advertised {
 	/// The route it describes, with this link's price already charged. The prefix
 	/// is stamped where the advertisement attaches (the namespace).
-	route: crate::origin::Route,
+	route: crate::origin::RouteInfo,
 }
 
 /// One NAMESPACE a SUBSCRIBE_NAMESPACE stream holds, live on the wire until its
@@ -1289,11 +1289,11 @@ impl Subscriber {
 	/// its true length. An anonymous route already ranks below every identified one,
 	/// so that understatement cannot beat a real path. Price such a link with
 	/// [`crate::Client::with_cost`] among other anonymous routes.
-	fn session_route(&self, peer: &cluster::Peer) -> crate::origin::Route {
+	fn session_route(&self, peer: &cluster::Peer) -> crate::origin::RouteInfo {
 		let mut hops = crate::Hops::new();
 		hops.push(crate::Hop::UNKNOWN)
 			.expect("an empty hop chain has room for one entry");
-		crate::origin::Route::default()
+		crate::origin::RouteInfo::default()
 			.with_hops(hops)
 			.with_via(self.via(peer))
 			// A peer without Cluster contributes only the arriving link price.
@@ -2812,7 +2812,7 @@ impl Subscriber {
 		if self.going_away.is_set() {
 			route.cost = crate::origin::Cost::DRAIN;
 		}
-		entry.dynamic = Some(self.origin.requests_route(path, route, None)?);
+		entry.dynamic = Some(self.origin.forward(path, route, None)?);
 		entry.generation += 1;
 		tracing::info!(route = %crate::path::Rooted(self.origin.root(), path), "namespace authorized again");
 		Ok(Some(entry.generation))
@@ -2873,7 +2873,7 @@ impl Subscriber {
 				if *newest == id {
 					entry.route = route.clone();
 					if let Some(dynamic) = &entry.dynamic {
-						dynamic.update_route(entry.route.clone())?;
+						dynamic.update(entry.route.clone())?;
 					}
 				}
 				Ok(())
@@ -2905,7 +2905,7 @@ impl Subscriber {
 					return Ok(());
 				}
 				// Propagates Error::Unauthorized if the namespace is out of scope.
-				let dynamic = self.origin.requests_route(&path, route.clone(), None)?;
+				let dynamic = self.origin.forward(&path, route.clone(), None)?;
 
 				entry.insert(BroadcastState {
 					route: route.clone(),
@@ -2960,7 +2960,7 @@ impl Subscriber {
 				if *newest != state.route {
 					state.route = newest.clone();
 					if let Some(dynamic) = &state.dynamic {
-						dynamic.update_route(state.route.clone())?;
+						dynamic.update(state.route.clone())?;
 					}
 				}
 				if state.tokens == 0
@@ -3006,7 +3006,7 @@ impl Subscriber {
 			route.cost = crate::origin::Cost::DRAIN;
 		}
 		if let Some(dynamic) = &entry.dynamic {
-			let _ = dynamic.update_route(entry.route.clone());
+			let _ = dynamic.update(entry.route.clone());
 		}
 	}
 
@@ -3153,7 +3153,9 @@ impl RunRoute {
 			entry.live = Default::default();
 		}
 		match &mut entry.dynamic {
-			Some(dynamic) => dynamic.poll_requested_broadcast(waiter).map(Some),
+			Some(dynamic) => dynamic
+				.poll_requested(waiter)
+				.map(|request| Some(request.ok_or(crate::Error::Closed))),
 			None => Poll::Ready(None),
 		}
 	}
@@ -9966,11 +9968,11 @@ mod tests {
 
 		for version in [Version::Draft18, Version::Draft20, Version::Draft22] {
 			let origin = crate::origin::Config::new(crate::Hop::new(1).unwrap()).produce();
-			let source = origin.publish("broadcast", Default::default()).unwrap();
+			let source = origin.route("broadcast", Default::default()).unwrap();
 			let resolved = origin.consume().request("broadcast", None).await.unwrap();
 			let peer = Arc::new(Peer {
 				version,
-				dynamic: Mutex::new(Some(source.requests())),
+				dynamic: Mutex::new(Some(source.broadcast().requests())),
 				park: Default::default(),
 				log: Default::default(),
 			});
@@ -10405,7 +10407,10 @@ mod tests {
 		// What we are publishing to the peer: a real upstream route.
 		let upstream = crate::Hops::try_from(vec![crate::Hop::new(7).unwrap()]).unwrap();
 		let _source = origin
-			.announce("room/host", crate::origin::Route::default().with_hops(upstream.clone()))
+			.announce(
+				"room/host",
+				crate::origin::RouteInfo::default().with_hops(upstream.clone()),
+			)
 			.unwrap();
 		announced.expect_next_active("room/host").await;
 		let _advertised = publishing.expect_next_active("room/host").await;
@@ -10519,7 +10524,7 @@ mod tests {
 	}
 
 	/// The current best route covering `path`, if any (synchronous peek).
-	fn routed_now(consumer: &crate::origin::Consumer, path: &str) -> Option<crate::origin::Route> {
+	fn routed_now(consumer: &crate::origin::Consumer, path: &str) -> Option<crate::origin::RouteInfo> {
 		use futures::FutureExt;
 		match consumer.path_routes(path).ok()?.next().now_or_never()?? {
 			crate::origin::RouteEvent::End(_) => None,
@@ -11020,7 +11025,7 @@ mod tests {
 		let path = crate::Path::from_static("room/host");
 
 		let first = Advertised {
-			route: crate::origin::Route::default()
+			route: crate::origin::RouteInfo::default()
 				.with_hops(hop_path(&[7, 9]).hops().clone())
 				.with_cost(4),
 		};
@@ -11031,7 +11036,7 @@ mod tests {
 
 		// A new chain and cost: the route updates in place.
 		let rerouted = Advertised {
-			route: crate::origin::Route::default()
+			route: crate::origin::RouteInfo::default()
 				.with_hops(hop_path(&[7, 11]).hops().clone())
 				.with_cost(2),
 		};
@@ -14692,8 +14697,9 @@ mod stitch_tests {
 	) -> (Vec<u8>, crate::lite::test_transport::Log) {
 		use crate::lite::test_transport::Sent;
 		let origin = crate::origin::Config::new(crate::Hop::new(2).unwrap()).produce();
-		let broadcast = origin.publish("room", crate::origin::Route::default()).unwrap();
+		let broadcast = origin.route("room", crate::origin::RouteOptions::default()).unwrap();
 		let track = broadcast
+			.broadcast()
 			.create_track(
 				"video",
 				accepted_info(
diff --git a/rs/moq-net/src/lite/fetch.rs b/rs/moq-net/src/lite/fetch.rs
index 0b5475adcf5..575136726a6 100644
--- a/rs/moq-net/src/lite/fetch.rs
+++ b/rs/moq-net/src/lite/fetch.rs
@@ -13,7 +13,7 @@ use super::{Message, Version};
 #[derive(Clone, Debug)]
 pub struct Fetch<'a> {
 	pub broadcast: Path,
-	/// The instance the subscriber expects; see [`crate::origin::Route::instance`].
+	/// The instance the subscriber expects; see [`crate::origin::RouteInfo::instance`].
 	/// Lite07+ only.
 	pub instance: Option<crate::Instance>,
 	pub track: Cow<'a, str>,
diff --git a/rs/moq-net/src/lite/ietf.rs b/rs/moq-net/src/lite/ietf.rs
index 967c96f239b..c3ee0e632b5 100644
--- a/rs/moq-net/src/lite/ietf.rs
+++ b/rs/moq-net/src/lite/ietf.rs
@@ -875,14 +875,14 @@ mod hop_tests {
 		for offer in [[true, true], [true, false], [false, true]] {
 			let negotiated = offer == [true, true];
 			let upstream = crate::origin::Config::new(crate::Hop::new(2).unwrap()).produce();
-			let broadcast = upstream.publish("room", crate::origin::Route::default()).unwrap();
+			let broadcast = upstream.route("room", crate::origin::RouteOptions::default()).unwrap();
 			let mut info = track::Info::timed().with_timescale(Timescale::MILLI);
 			info.max_age = Some(Duration::from_secs(7));
 			info.priority = 9;
 			info.refresh = Some(0);
 			let track_properties = draft22(vec![property(0x40, 3)]);
 			info.properties = track_properties.clone();
-			let track = broadcast.create_track("video", info).unwrap();
+			let track = broadcast.broadcast().create_track("video", info).unwrap();
 
 			let mut group = track.create_group(group::Info { sequence: 0 }).unwrap();
 			group
@@ -982,8 +982,8 @@ mod hop_tests {
 	/// Subscribe across a negotiated hop to a track with `info`.
 	async fn subscribe_across_info(info: track::Info) -> Result<(), crate::Error> {
 		let upstream = crate::origin::Config::new(crate::Hop::new(2).unwrap()).produce();
-		let broadcast = upstream.publish("room", crate::origin::Route::default()).unwrap();
-		let _track = broadcast.create_track("video", info).unwrap();
+		let broadcast = upstream.route("room", crate::origin::RouteOptions::default()).unwrap();
+		let _track = broadcast.broadcast().create_track("video", info).unwrap();
 
 		let (downstream, _sessions) = test_hop(&upstream, "room", [true, true]).await;
 		let broadcast = kio::clock::timeout(TIMEOUT, downstream.consume().request("room", None))
@@ -1091,8 +1091,9 @@ mod hop_tests {
 	#[kio::test]
 	async fn plain_media_crosses_unchanged() {
 		let upstream = crate::origin::Config::new(crate::Hop::new(2).unwrap()).produce();
-		let broadcast = upstream.publish("room", crate::origin::Route::default()).unwrap();
+		let broadcast = upstream.route("room", crate::origin::RouteOptions::default()).unwrap();
 		let track = broadcast
+			.broadcast()
 			.create_track("video", track::Info::timed().with_timescale(Timescale::MILLI))
 			.unwrap();
 		let (downstream, sessions) = test_hop(&upstream, "room", [true, true]).await;
@@ -1130,12 +1131,12 @@ mod hop_tests {
 		for offer in [[true, true], [true, false], [false, true]] {
 			let negotiated = offer == [true, true];
 			let upstream = crate::origin::Config::new(crate::Hop::new(2).unwrap()).produce();
-			let broadcast = upstream.publish("room", crate::origin::Route::default()).unwrap();
+			let broadcast = upstream.route("room", crate::origin::RouteOptions::default()).unwrap();
 			let info = track::Info {
 				properties: draft22(Vec::new()),
 				..track::Info::timed()
 			};
-			let track = broadcast.create_track("video", info).unwrap();
+			let track = broadcast.broadcast().create_track("video", info).unwrap();
 			let mut head = track.create_group(0u64.into()).unwrap();
 			head.write_frame(ts(100), b"frame".to_vec()).unwrap();
 			head.finish().unwrap();
@@ -1198,11 +1199,11 @@ mod hop_tests {
 	#[kio::test]
 	async fn compressed_media_crosses_a_negotiated_hop() {
 		let upstream = crate::origin::Config::new(crate::Hop::new(2).unwrap()).produce();
-		let broadcast = upstream.publish("room", crate::origin::Route::default()).unwrap();
+		let broadcast = upstream.route("room", crate::origin::RouteOptions::default()).unwrap();
 		let info = track::Info::timed()
 			.with_timescale(Timescale::MILLI)
 			.with_compress(true);
-		let track = broadcast.create_track("video", info).unwrap();
+		let track = broadcast.broadcast().create_track("video", info).unwrap();
 		let (downstream, sessions) = test_hop(&upstream, "room", [true, true]).await;
 		let (_copy, mut subscriber) = subscribe(&downstream).await;
 		assert!(subscriber.info().compress);
diff --git a/rs/moq-net/src/lite/publisher.rs b/rs/moq-net/src/lite/publisher.rs
index e9cf3c1f39f..352701606d9 100644
--- a/rs/moq-net/src/lite/publisher.rs
+++ b/rs/moq-net/src/lite/publisher.rs
@@ -1090,7 +1090,7 @@ struct Advertised {
 type Served = (Option<crate::Instance>, u64);
 
 /// What `route` serves; see [`Served`].
-fn served(route: &crate::origin::Route) -> Served {
+fn served(route: &crate::origin::RouteInfo) -> Served {
 	(route.instance.clone(), route.epoch)
 }
 
@@ -1171,7 +1171,7 @@ impl AnnounceRun {
 		// whatever it has pending for the routes the peer holds (an update, a restart, an end
 		// still waiting out its hold) arrives through the loop as usual.
 		let mut snapshot = origin.routes();
-		let mut current: HashMap<crate::Path, crate::origin::Route> = HashMap::new();
+		let mut current: HashMap<crate::Path, crate::origin::RouteInfo> = HashMap::new();
 		while let Some(event) = snapshot.try_next() {
 			match event {
 				origin::RouteEvent::Start(update)
@@ -1253,7 +1253,11 @@ impl AnnounceRun {
 
 	/// The chain and cost to put on the wire for `route`, or `None` when it must
 	/// not be forwarded.
-	fn outgoing(&self, route: &crate::origin::Route, absolute: &crate::Path) -> Option<(Hops, crate::origin::Cost)> {
+	fn outgoing(
+		&self,
+		route: &crate::origin::RouteInfo,
+		absolute: &crate::Path,
+	) -> Option<(Hops, crate::origin::Cost)> {
 		let mut hops = route.hops.clone();
 
 		// A route that already passed through us is a reflection. The origin
@@ -1949,7 +1953,7 @@ impl<R: Request> RequestServe<R> {
 					if requesting.is_none() {
 						// The peer requested this exact path, so it has already seen an
 						// announcement for it. The immediate lookup resolves it at once, is
-						// served on demand by the route covering it (an `origin::Requests`), or
+						// served on demand by the route covering it (an `origin::Route`), or
 						// errors when there is none.
 						let origin = ready!(self.shared.poll_serving_origin(waiter));
 						let path = R::target(msg).0.clone();
@@ -3468,7 +3472,7 @@ mod announce_test {
 		let update = |prefix: &'static str, cost| crate::announce::Announce {
 			prefix: crate::Path::try_from(prefix).unwrap(),
 			captures: None,
-			route: origin::Route::default().with_cost(cost),
+			route: origin::RouteInfo::default().with_cost(cost),
 		};
 		let events = [
 			origin::RouteEvent::Start(update("a", 1)),
@@ -3496,8 +3500,8 @@ mod announce_test {
 	#[test]
 	fn synced_survives_a_removed_initial_route_and_live_churn() {
 		let origin = Hop::new(1).unwrap().produce();
-		let removed = origin.announce("z/removed", origin::Route::default()).unwrap();
-		let _initial = origin.announce("z/retained", origin::Route::default()).unwrap();
+		let removed = origin.announce("z/removed", origin::RouteInfo::default()).unwrap();
+		let _initial = origin.announce("z/retained", origin::RouteInfo::default()).unwrap();
 		let consumer = origin.consume();
 		let mut announced = consumer.routes();
 		let budget = kio::Producer::new(0usize);
@@ -3520,7 +3524,11 @@ mod announce_test {
 		drop(removed);
 		let mut churn = Vec::new();
 		for limit in 1..=4 {
-			churn.push(origin.announce(format!("a/{limit}"), origin::Route::default()).unwrap());
+			churn.push(
+				origin
+					.announce(format!("a/{limit}"), origin::RouteInfo::default())
+					.unwrap(),
+			);
 			*budget.write().ok().unwrap() = limit;
 			assert!(run.poll(&mut stream, &consumer, &mut announced, &waiter).is_pending());
 		}
@@ -3538,8 +3546,8 @@ mod announce_test {
 	#[test]
 	fn a_partial_regrant_cannot_overtake_an_initial_route() {
 		let origin = Hop::new(1).unwrap().produce();
-		let _a = origin.announce("a", origin::Route::default()).unwrap();
-		let _b = origin.announce("b", origin::Route::default()).unwrap();
+		let _a = origin.announce("a", origin::RouteInfo::default()).unwrap();
+		let _b = origin.announce("b", origin::RouteInfo::default()).unwrap();
 		let consumer = origin.consume();
 		let mut announced = consumer.routes();
 		let budget = kio::Producer::new(1usize);
@@ -3580,8 +3588,8 @@ mod announce_test {
 	#[test]
 	fn synced_cuts_a_regrant_burst_at_the_initial_bound() {
 		let origin = Hop::new(1).unwrap().produce();
-		let _a = origin.announce("a", origin::Route::default()).unwrap();
-		let _b = origin.announce("b", origin::Route::default()).unwrap();
+		let _a = origin.announce("a", origin::RouteInfo::default()).unwrap();
+		let _b = origin.announce("b", origin::RouteInfo::default()).unwrap();
 		let consumer = origin.consume();
 		let mut announced = consumer.routes();
 		let budget = kio::Producer::new(0usize);
@@ -3607,7 +3615,7 @@ mod announce_test {
 			panic!("the changed grant is ready");
 		};
 		run.regrant(&mut stream, &consumer, restricted).unwrap();
-		let _live = origin.announce("c", origin::Route::default()).unwrap();
+		let _live = origin.announce("c", origin::RouteInfo::default()).unwrap();
 		run.regrant(&mut stream, &consumer, crate::auth::Permit::default())
 			.unwrap();
 		*budget.write().ok().unwrap() = 4;
@@ -3636,8 +3644,8 @@ mod announce_test {
 	#[test]
 	fn a_seen_retraction_can_precede_synced() {
 		let origin = Hop::new(1).unwrap().produce();
-		let first = origin.announce("a", origin::Route::default()).unwrap();
-		let unseen = origin.announce("b", origin::Route::default()).unwrap();
+		let first = origin.announce("a", origin::RouteInfo::default()).unwrap();
+		let unseen = origin.announce("b", origin::RouteInfo::default()).unwrap();
 		let consumer = origin.consume();
 		let mut announced = consumer.routes();
 		let budget = kio::Producer::new(1usize);
@@ -3792,7 +3800,7 @@ mod announce_test {
 	#[kio::test]
 	async fn a_silent_upstream_never_delays_the_answer() {
 		let origin = Hop::new(1).unwrap().produce();
-		let _route = origin.announce("cam", crate::origin::Route::default()).unwrap();
+		let _route = origin.announce("cam", crate::origin::RouteInfo::default()).unwrap();
 		// An upstream that never answers its announce request.
 		let _silent = origin.clone().with_link(crate::origin::Link::Upstream).snapshot("");
 
@@ -3826,7 +3834,7 @@ mod announce_test {
 		let announcement = origin
 			.announce(
 				"cam",
-				crate::origin::Route::default().with_hops(pub_hops()).with_cost(7),
+				crate::origin::RouteInfo::default().with_hops(pub_hops()).with_cost(7),
 			)
 			.unwrap();
 
@@ -3883,7 +3891,7 @@ mod announce_test {
 
 		let late = h
 			.origin
-			.announce("mic", crate::origin::Route::default().with_hops(pub_hops()))
+			.announce("mic", crate::origin::RouteInfo::default().with_hops(pub_hops()))
 			.unwrap();
 		settle().await;
 		match h.wire.take_announces().as_slice() {
@@ -3907,7 +3915,7 @@ mod announce_test {
 		let mut h = harness().await;
 
 		h.announcement
-			.update(crate::origin::Route::default().with_hops(pub_hops()).with_cost(3))
+			.update(crate::origin::RouteInfo::default().with_hops(pub_hops()).with_cost(3))
 			.unwrap();
 		kio::clock::sleep(crate::origin::Config::default().update_hold).await;
 		settle().await;
@@ -3926,7 +3934,7 @@ mod announce_test {
 	async fn identical_update_is_quiet() {
 		let h = harness().await;
 		h.announcement
-			.update(crate::origin::Route::default().with_hops(pub_hops()).with_cost(7))
+			.update(crate::origin::RouteInfo::default().with_hops(pub_hops()).with_cost(7))
 			.unwrap();
 		settle().await;
 		h.assert_idle();
@@ -3940,7 +3948,7 @@ mod announce_test {
 	async fn source_flip_restarts() {
 		for version in [Version::Lite06, Version::Lite07] {
 			let mut h = harness_on(version).await;
-			let route = crate::origin::Route::default().with_hops(pub_hops()).with_cost(7);
+			let route = crate::origin::RouteInfo::default().with_hops(pub_hops()).with_cost(7);
 			let newer = h.origin.announce("cam", route.clone()).unwrap();
 			// A restart waits out the update hold like an update.
 			kio::clock::sleep(crate::origin::Config::default().update_hold).await;
@@ -3987,7 +3995,7 @@ mod announce_test {
 		let mut h = harness_on(Version::Lite07).await;
 		let instance = crate::Instance::random();
 		let route = |epoch| {
-			crate::origin::Route::default()
+			crate::origin::RouteInfo::default()
 				.with_instance(instance.clone(), epoch)
 				.with_hops(pub_hops())
 				.with_cost(7)
@@ -4030,7 +4038,7 @@ mod announce_test {
 			let mut h = harness_with(Version::Lite07, Some(auth.clone())).await;
 
 			// Same chain and cost, so only the instance changed. Both land before the loop polls.
-			let route = crate::origin::Route::default().with_hops(pub_hops()).with_cost(7);
+			let route = crate::origin::RouteInfo::default().with_hops(pub_hops()).with_cost(7);
 			let named = (!anonymous).then(crate::Instance::random);
 			let route = match &named {
 				Some(instance) => route.with_instance(instance.clone(), 0),
@@ -4060,7 +4068,11 @@ mod announce_test {
 	#[kio::test]
 	async fn clamped_cost_change_is_quiet() {
 		let mut h = harness().await;
-		let route = |cost| crate::origin::Route::default().with_hops(pub_hops()).with_cost(cost);
+		let route = |cost| {
+			crate::origin::RouteInfo::default()
+				.with_hops(pub_hops())
+				.with_cost(cost)
+		};
 		h.announcement.update(route(u64::MAX)).unwrap();
 		kio::clock::sleep(crate::origin::Config::default().update_hold).await;
 		settle().await;
@@ -4081,10 +4093,10 @@ mod announce_test {
 
 		let tainted = Hops::try_from(vec![peer]).unwrap();
 		let _tainted = origin
-			.announce("echoed", crate::origin::Route::default().with_hops(tainted))
+			.announce("echoed", crate::origin::RouteInfo::default().with_hops(tainted))
 			.unwrap();
 		let _clean = origin
-			.announce("local", crate::origin::Route::default().with_hops(pub_hops()))
+			.announce("local", crate::origin::RouteInfo::default().with_hops(pub_hops()))
 			.unwrap();
 
 		let log = Log::default();
@@ -4120,7 +4132,7 @@ mod announce_test {
 		let mut h = harness().await;
 		let _late = h
 			.origin
-			.announce("mic", crate::origin::Route::default().with_hops(pub_hops()))
+			.announce("mic", crate::origin::RouteInfo::default().with_hops(pub_hops()))
 			.unwrap();
 		settle().await;
 		match h.wire.take_announces().as_slice() {
@@ -4136,7 +4148,7 @@ mod announce_test {
 		let mut h = harness().await;
 		h.announcement
 			.update(
-				crate::origin::Route::default()
+				crate::origin::RouteInfo::default()
 					.with_hops(pub_hops())
 					.with_cost(u64::MAX),
 			)
@@ -7762,10 +7774,13 @@ mod serve_group_test {
 			let mut starts = Vec::new();
 			for warm in [false, true] {
 				let publisher = origin(1);
-				let broadcast = publisher.create_broadcast("room").unwrap();
-				let mut track = broadcast.create_track("test", crate::track::Info::timed()).unwrap();
+				let broadcast = publisher.route("room", crate::origin::RouteOptions::hidden()).unwrap();
+				let mut track = broadcast
+					.broadcast()
+					.create_track("test", crate::track::Info::timed())
+					.unwrap();
 				track.start_at(0).unwrap();
-				broadcast.announce(Default::default()).unwrap();
+				broadcast.announce().unwrap();
 				let relay = origin(2);
 				let _upstream = connect(version, &publisher, &relay).await;
 				let remote = relay
@@ -8547,9 +8562,9 @@ mod tests {
 		let mut echoed_hops = Hops::new();
 		echoed_hops.push(crate::Hop::UNKNOWN).unwrap();
 		let _echoed = origin
-			.requests_route(
+			.forward(
 				"echoed",
-				crate::origin::Route::default()
+				crate::origin::RouteInfo::default()
 					.with_hops(echoed_hops)
 					.with_via(assigned),
 				None,
@@ -8559,7 +8574,7 @@ mod tests {
 		let mut local_hops = Hops::new();
 		local_hops.push(upstream).unwrap();
 		let _local = origin
-			.requests_route("local", crate::origin::Route::default().with_hops(local_hops), None)
+			.forward("local", crate::origin::RouteInfo::default().with_hops(local_hops), None)
 			.unwrap();
 
 		// A SETUP that declares no origin of its own, so only the assigned one applies.
@@ -8610,7 +8625,7 @@ mod tests {
 		let _tainted = origin
 			.announce(
 				"echoed",
-				crate::origin::Route::default()
+				crate::origin::RouteInfo::default()
 					.with_hops(tainted_hops)
 					.with_via(assigned),
 			)
@@ -8619,7 +8634,7 @@ mod tests {
 		let mut clean_hops = Hops::new();
 		clean_hops.push(clean_publisher).unwrap();
 		let _clean = origin
-			.announce("local", crate::origin::Route::default().with_hops(clean_hops))
+			.announce("local", crate::origin::RouteInfo::default().with_hops(clean_hops))
 			.unwrap();
 
 		let gate = kio::Producer::new(true);
@@ -8664,7 +8679,7 @@ mod tests {
 		let _broadcasts: Vec<_> = (0..max / 500 + 1)
 			.map(|i| {
 				origin
-					.announce(format!("{name}{i}"), crate::origin::Route::default())
+					.announce(format!("{name}{i}"), crate::origin::RouteInfo::default())
 					.unwrap()
 			})
 			.collect();
@@ -8695,7 +8710,7 @@ mod tests {
 	async fn announce_init_broadcast_ends() {
 		let self_origin = crate::Hop::new(1).unwrap();
 		let origin = crate::origin::Config::new(self_origin).produce();
-		let cam = origin.announce("cam", crate::origin::Route::default()).unwrap();
+		let cam = origin.announce("cam", crate::origin::RouteInfo::default()).unwrap();
 
 		let gate = kio::Producer::new(true);
 		let session = SinkSession::gated_bi(gate.consume());
@@ -8731,7 +8746,7 @@ mod tests {
 	async fn withdraw_before_init_sends_the_initial_burst() {
 		let self_origin = crate::Hop::new(1).unwrap();
 		let origin = crate::origin::Config::new(self_origin).produce();
-		let _cam = origin.announce("cam", crate::origin::Route::default()).unwrap();
+		let _cam = origin.announce("cam", crate::origin::RouteInfo::default()).unwrap();
 
 		let gate = kio::Producer::new(true);
 		let session = SinkSession::gated_bi(gate.consume());
@@ -9136,14 +9151,14 @@ mod tests {
 			Wait::Broadcast => {
 				_route = Some(
 					origin
-						.requests_route("room", crate::origin::Route::default(), None)
+						.forward("room", crate::origin::RouteInfo::default(), None)
 						.unwrap(),
 				)
 			}
 			Wait::Track => {
-				let broadcast = origin.create_broadcast("room").unwrap();
-				let dynamic = broadcast.requests();
-				broadcast.announce(Default::default()).unwrap();
+				let broadcast = origin.route("room", crate::origin::RouteOptions::hidden()).unwrap();
+				let dynamic = broadcast.broadcast().requests();
+				broadcast.announce().unwrap();
 				held = Some((broadcast, dynamic));
 			}
 		}
@@ -9335,9 +9350,12 @@ mod tests {
 	async fn track_info_outranks_the_track_groups() {
 		let version = Version::Lite07;
 		let origin = crate::origin::Config::new(crate::Hop::new(1).unwrap()).produce();
-		let broadcast = origin.create_broadcast("room").unwrap();
-		let _track = broadcast.create_track("video", crate::track::Info::timed()).unwrap();
-		broadcast.announce(Default::default()).unwrap();
+		let broadcast = origin.route("room", crate::origin::RouteOptions::hidden()).unwrap();
+		let _track = broadcast
+			.broadcast()
+			.create_track("video", crate::track::Info::timed())
+			.unwrap();
+		broadcast.announce().unwrap();
 		let peer_setup = crate::lite::PeerSetup::new(false, crate::transport::Address::Setup);
 		peer_setup.set(crate::lite::Setup::default()).unwrap();
 		let (_, goaway) = crate::goaway::Handle::new(true);
@@ -9392,9 +9410,12 @@ mod tests {
 				for blocked in [false, true] {
 					let case = format!("{version:?}, {close:?}, blocked {blocked}");
 					let origin = crate::origin::Config::new(crate::Hop::new(1).unwrap()).produce();
-					let broadcast = origin.create_broadcast("room").unwrap();
-					let track = broadcast.create_track("video", crate::track::Info::timed()).unwrap();
-					broadcast.announce(Default::default()).unwrap();
+					let broadcast = origin.route("room", crate::origin::RouteOptions::hidden()).unwrap();
+					let track = broadcast
+						.broadcast()
+						.create_track("video", crate::track::Info::timed())
+						.unwrap();
+					broadcast.announce().unwrap();
 
 					let peer_setup = crate::lite::PeerSetup::new(false, crate::transport::Address::Setup);
 					peer_setup.set(crate::lite::Setup::default()).unwrap();
@@ -9524,10 +9545,10 @@ mod tests {
 			] {
 				for start in [None, Some(0)] {
 					let origin = crate::origin::Config::new(crate::Hop::new(1).unwrap()).produce();
-					let broadcast = origin.create_broadcast("room").unwrap();
-					let mut dynamic = broadcast.requests();
-					broadcast.announce(Default::default()).unwrap();
-					let copy = broadcast.consume().track("video").unwrap();
+					let broadcast = origin.route("room", crate::origin::RouteOptions::hidden()).unwrap();
+					let mut dynamic = broadcast.broadcast().requests();
+					broadcast.announce().unwrap();
+					let copy = broadcast.broadcast().consume().track("video").unwrap();
 					let held = copy.info().into_inner();
 					assert!(held.poll_ok(&kio::Waiter::noop()).is_pending());
 					let request = dynamic.requested_track().await.unwrap();
@@ -9573,7 +9594,8 @@ mod tests {
 						ranges: vec![lite::Range::span(start, 0, None, None)],
 					};
 					let mut serve =
-						SubscribeServe::start(&publisher.shared, msg, "video", broadcast.consume()).unwrap();
+						SubscribeServe::start(&publisher.shared, msg, "video", broadcast.broadcast().consume())
+							.unwrap();
 					let mut writer = Writer::new(
 						crate::transport::boxed::SendStream::new(SinkSend::new(Log::default())),
 						version,
@@ -9669,9 +9691,9 @@ mod tests {
 	#[kio::test]
 	async fn a_subscribe_update_is_not_a_close() {
 		let origin = crate::origin::Config::new(crate::Hop::new(1).unwrap()).produce();
-		let broadcast = origin.create_broadcast("room").unwrap();
-		let mut dynamic = broadcast.requests();
-		broadcast.announce(Default::default()).unwrap();
+		let broadcast = origin.route("room", crate::origin::RouteOptions::hidden()).unwrap();
+		let mut dynamic = broadcast.broadcast().requests();
+		broadcast.announce().unwrap();
 
 		let peer_setup = crate::lite::PeerSetup::new(false, crate::transport::Address::Setup);
 		peer_setup.set(crate::lite::Setup::default()).unwrap();
@@ -9777,7 +9799,7 @@ mod tests {
 		serve: RequestServe<SubscribeServe>,
 		session: ScriptedSession,
 		track: track::Producer,
-		_broadcast: crate::origin::Publication,
+		_broadcast: crate::origin::Route,
 		_origin: crate::origin::Producer,
 	}
 
@@ -9798,9 +9820,9 @@ mod tests {
 
 	async fn running() -> Running {
 		let origin = crate::origin::Config::new(crate::Hop::new(1).unwrap()).produce();
-		let broadcast = origin.create_broadcast("room").unwrap();
-		let mut dynamic = broadcast.requests();
-		broadcast.announce(Default::default()).unwrap();
+		let broadcast = origin.route("room", crate::origin::RouteOptions::hidden()).unwrap();
+		let mut dynamic = broadcast.broadcast().requests();
+		broadcast.announce().unwrap();
 
 		let peer_setup = crate::lite::PeerSetup::new(false, crate::transport::Address::Setup);
 		peer_setup.set(crate::lite::Setup::default()).unwrap();
@@ -10051,8 +10073,11 @@ mod tests {
 	#[kio::test]
 	async fn a_cold_bounded_fetch_requests_the_prefix() {
 		let origin = crate::origin::Config::new(Hop::new(1).unwrap()).produce();
-		let broadcast = origin.create_broadcast("room").unwrap();
-		let track = broadcast.create_track("video", track::Info::timed()).unwrap();
+		let broadcast = origin.route("room", crate::origin::RouteOptions::hidden()).unwrap();
+		let track = broadcast
+			.broadcast()
+			.create_track("video", track::Info::timed())
+			.unwrap();
 		let dynamic = track.requests();
 		let peer_setup = crate::lite::PeerSetup::new(false, crate::transport::Address::Setup);
 		peer_setup.set(crate::lite::Setup::default()).unwrap();
@@ -10084,7 +10109,7 @@ mod tests {
 				end_frame: Some(3),
 			},
 			"video",
-			broadcast.consume(),
+			broadcast.broadcast().consume(),
 		)
 		.unwrap();
 		let request = dynamic.requested_fill_group().await.unwrap();
@@ -10098,9 +10123,12 @@ mod tests {
 	async fn an_expired_fetch_resets_rather_than_finishing() {
 		const VERSION: Version = Version::Lite07;
 		let origin = crate::origin::Config::new(Hop::new(1).unwrap()).produce();
-		let broadcast = origin.create_broadcast("room").unwrap();
-		let track = broadcast.create_track("video", track::Info::timed()).unwrap();
-		broadcast.announce(Default::default()).unwrap();
+		let broadcast = origin.route("room", crate::origin::RouteOptions::hidden()).unwrap();
+		let track = broadcast
+			.broadcast()
+			.create_track("video", track::Info::timed())
+			.unwrap();
+		broadcast.announce().unwrap();
 		let mut open = track.append_group().unwrap();
 		open.write_frame(crate::Timestamp::ZERO, b"a".to_vec()).unwrap();
 
@@ -10241,9 +10269,9 @@ mod tests {
 		use kio::Task;
 		for version in [Version::Lite05, Version::Lite06, Version::Lite07] {
 			let origin = crate::origin::Config::new(Hop::random()).produce();
-			let broadcast = origin.create_broadcast("room").unwrap();
-			let _dynamic = broadcast.requests();
-			broadcast.announce(Default::default()).unwrap();
+			let broadcast = origin.route("room", crate::origin::RouteOptions::hidden()).unwrap();
+			let _dynamic = broadcast.broadcast().requests();
+			broadcast.announce().unwrap();
 			let request = lite::Subscribe {
 				order: crate::track::Order::Descending,
 				instance: None,
@@ -10300,8 +10328,8 @@ mod tests {
 		use kio::Task;
 		let version = Version::Lite07;
 		let origin = crate::origin::Config::new(Hop::random()).produce();
-		let broadcast = origin.create_broadcast("room").unwrap();
-		broadcast.announce(Default::default()).unwrap();
+		let broadcast = origin.route("room", crate::origin::RouteOptions::hidden()).unwrap();
+		broadcast.announce().unwrap();
 		let request = lite::Tracks {
 			broadcast: crate::Path::from_static("room"),
 			instance: None,
@@ -10353,9 +10381,9 @@ mod tests {
 		use kio::Task;
 		for version in [Version::Lite05, Version::Lite06, Version::Lite07] {
 			let origin = crate::origin::Config::new(Hop::random()).produce();
-			let broadcast = origin.create_broadcast("room").unwrap();
-			let mut dynamic = broadcast.requests();
-			broadcast.announce(Default::default()).unwrap();
+			let broadcast = origin.route("room", crate::origin::RouteOptions::hidden()).unwrap();
+			let mut dynamic = broadcast.broadcast().requests();
+			broadcast.announce().unwrap();
 			let request = lite::Subscribe {
 				order: crate::track::Order::Descending,
 				instance: None,
@@ -10539,9 +10567,9 @@ mod tests {
 	#[kio::test]
 	async fn send_group_ranks_by_the_subscriber_then_the_publisher() {
 		let origin = crate::origin::Config::new(Hop::new(1).unwrap()).produce();
-		let broadcast = origin.create_broadcast("a").unwrap();
-		let mut dynamic = broadcast.requests();
-		broadcast.announce(Default::default()).unwrap();
+		let broadcast = origin.route("a", crate::origin::RouteOptions::hidden()).unwrap();
+		let mut dynamic = broadcast.broadcast().requests();
+		broadcast.announce().unwrap();
 		let (publisher, log) = grouped_publisher(origin.consume());
 
 		let video = track::Info::timed().with_priority(60);
diff --git a/rs/moq-net/src/lite/subscribe.rs b/rs/moq-net/src/lite/subscribe.rs
index 7967fe06ef2..87b9e1a21bb 100644
--- a/rs/moq-net/src/lite/subscribe.rs
+++ b/rs/moq-net/src/lite/subscribe.rs
@@ -15,7 +15,7 @@ use crate::track::Order;
 pub struct Subscribe<'a> {
 	pub id: u64,
 	pub broadcast: Path,
-	/// The instance the subscriber expects; see [`crate::origin::Route::instance`].
+	/// The instance the subscriber expects; see [`crate::origin::RouteInfo::instance`].
 	/// Lite07+ only.
 	pub instance: Option<crate::Instance>,
 	pub track: Cow<'a, str>,
diff --git a/rs/moq-net/src/lite/subscriber.rs b/rs/moq-net/src/lite/subscriber.rs
index e64801e968c..7a7f906b16c 100644
--- a/rs/moq-net/src/lite/subscriber.rs
+++ b/rs/moq-net/src/lite/subscriber.rs
@@ -724,10 +724,10 @@ impl Subscriber {
 		link_cost: u64,
 		responder: Option<crate::Hop>,
 		announced: &Announced,
-	) -> crate::origin::Route {
+	) -> crate::origin::RouteInfo {
 		let mut route = match announced.instance(path) {
-			Some((instance, epoch)) => crate::origin::Route::default().with_instance(instance, epoch),
-			None => crate::origin::Route::default(),
+			Some((instance, epoch)) => crate::origin::RouteInfo::default().with_instance(instance, epoch),
+			None => crate::origin::RouteInfo::default(),
 		}
 		.with_hops(hops)
 		.with_cost(cost.charged(link_cost))
@@ -2090,7 +2090,7 @@ impl AnnouncePrefix {
 				let path = self.prefix.join(&suffix)?;
 				// Lite01/02 don't carry hop information; the broadcast starts with
 				// an empty chain and an unpriced link. Stats are attributed in the
-				// model when this enters the origin via `create_broadcast`.
+				// model when this enters the origin via `route`.
 				self.subscriber.start_announce(
 					path,
 					None,
@@ -7148,8 +7148,13 @@ mod tests {
 		let origin = origin::Config::new(relay).produce();
 		let assigned = crate::Hop::new(777).unwrap();
 
-		let local = origin.publish("room/host", origin::Route::default()).unwrap();
-		let track = local.create_track("video", crate::track::Info::timed()).unwrap();
+		let local = origin
+			.route("room/host", crate::origin::RouteOptions::default())
+			.unwrap();
+		let track = local
+			.broadcast()
+			.create_track("video", crate::track::Info::timed())
+			.unwrap();
 		let mut group = track.append_group().unwrap();
 		group.write_frame(crate::Timestamp::ZERO, b"local".as_ref()).unwrap();
 		group.finish().unwrap();
@@ -8312,7 +8317,7 @@ enum Held {
 	Declined,
 	/// Outside the session's limit: the route as advertised, attached once a
 	/// limit allows it.
-	Withheld(crate::origin::Route),
+	Withheld(crate::origin::RouteInfo),
 	/// In the origin, serving requests.
 	Attached(Box<AnnouncedRoute>),
 }
@@ -8352,7 +8357,7 @@ impl Announced {
 	}
 
 	/// Attach a route, queued for its first serve pass.
-	fn attach(&mut self, path: Path, route: crate::origin::Route, dynamic: crate::origin::Requests) {
+	fn attach(&mut self, path: Path, route: crate::origin::RouteInfo, dynamic: crate::origin::Route) {
 		let wake = crate::util::QueueWake::new(path.clone(), self.ready.clone());
 		let route = AnnouncedRoute::new(route, dynamic, wake);
 		route.waker.wake_by_ref();
@@ -8367,7 +8372,7 @@ impl Announced {
 		&mut self,
 		subscriber: &Subscriber,
 		path: Path,
-		route: crate::origin::Route,
+		route: crate::origin::RouteInfo,
 		predecessor: Option<&Path>,
 	) -> bool {
 		if !subscriber
@@ -8384,7 +8389,7 @@ impl Announced {
 			Held::Attached(attached) => Some(&attached.dynamic),
 			_ => None,
 		});
-		match subscriber.origin.requests_route(&path, route.clone(), predecessor) {
+		match subscriber.origin.forward(&path, route.clone(), predecessor) {
 			Ok(dynamic) => {
 				// In place, the successor continues the instance the predecessor's sources
 				// serve: they live on with it rather than closing with the advertisement.
@@ -8488,7 +8493,7 @@ impl Announced {
 			entry.wake.popped();
 			let cx = std::task::Context::from_waker(&entry.waker);
 			let route_waiter = entry.park.hold(&cx);
-			while let Poll::Ready(Ok(request)) = entry.dynamic.poll_requested_broadcast(route_waiter) {
+			while let Poll::Ready(Some(request)) = entry.dynamic.poll_requested(route_waiter) {
 				// The request path is absolute; the wire (and our origin handle)
 				// speak paths relative to the session's root.
 				let Some(path) = request.path().strip_prefix(root) else {
@@ -8570,9 +8575,9 @@ impl Announced {
 struct AnnouncedRoute {
 	/// The route as last announced (post-charge), so a drain can re-price it
 	/// without recomputing the chain.
-	route: crate::origin::Route,
+	route: crate::origin::RouteInfo,
 	/// Dropping it retracts the route and rejects its queued requests.
-	dynamic: crate::origin::Requests,
+	dynamic: crate::origin::Route,
 	/// Closes as the route goes, which closes every source it minted.
 	live: kio::Producer<()>,
 	/// Whether the GOAWAY drain already re-priced this route.
@@ -8586,8 +8591,8 @@ struct AnnouncedRoute {
 
 impl AnnouncedRoute {
 	fn new(
-		route: crate::origin::Route,
-		dynamic: crate::origin::Requests,
+		route: crate::origin::RouteInfo,
+		dynamic: crate::origin::Route,
 		wake: Arc<crate::util::QueueWake<Path>>,
 	) -> Self {
 		Self {
@@ -8602,10 +8607,10 @@ impl AnnouncedRoute {
 	}
 
 	/// Update the route metadata without changing its content identity.
-	fn update(&mut self, route: crate::origin::Route) {
+	fn update(&mut self, route: crate::origin::RouteInfo) {
 		self.route = route.clone();
 		self.drained = false;
-		let _ = self.dynamic.update_route(route);
+		let _ = self.dynamic.update(route);
 	}
 
 	/// Re-price the route to [`crate::origin::Cost::DRAIN`] (the peer sent a
@@ -8618,7 +8623,7 @@ impl AnnouncedRoute {
 		self.drained = true;
 		let mut route = self.route.clone();
 		route.cost = crate::origin::Cost::DRAIN;
-		let _ = self.dynamic.update_route(route);
+		let _ = self.dynamic.update(route);
 	}
 }
 
diff --git a/rs/moq-net/src/lite/track.rs b/rs/moq-net/src/lite/track.rs
index 4d25d389fed..4c678e43578 100644
--- a/rs/moq-net/src/lite/track.rs
+++ b/rs/moq-net/src/lite/track.rs
@@ -17,7 +17,7 @@ const LEGACY_UNLIMITED: u64 = (1u64 << 53) - 1;
 #[derive(Clone, Debug)]
 pub struct Track<'a> {
 	pub broadcast: Path,
-	/// The instance the subscriber expects; see [`crate::origin::Route::instance`].
+	/// The instance the subscriber expects; see [`crate::origin::RouteInfo::instance`].
 	/// Lite07+ only.
 	pub instance: Option<crate::Instance>,
 	pub track: Cow<'a, str>,
diff --git a/rs/moq-net/src/lite/tracks.rs b/rs/moq-net/src/lite/tracks.rs
index 9aa4e8818c7..6a581efe9b3 100644
--- a/rs/moq-net/src/lite/tracks.rs
+++ b/rs/moq-net/src/lite/tracks.rs
@@ -19,7 +19,7 @@ const SYNCED: u64 = 0x4;
 #[derive(Clone, Debug)]
 pub struct Tracks {
 	pub broadcast: Path,
-	/// The instance the subscriber expects; see [`crate::origin::Route::instance`].
+	/// The instance the subscriber expects; see [`crate::origin::RouteInfo::instance`].
 	pub instance: Option<crate::Instance>,
 }
 
diff --git a/rs/moq-net/src/model/announced.rs b/rs/moq-net/src/model/announced.rs
index a01fb82a1f4..c33c6d116cc 100644
--- a/rs/moq-net/src/model/announced.rs
+++ b/rs/moq-net/src/model/announced.rs
@@ -132,7 +132,7 @@ mod tests {
 	use super::*;
 	use crate::{
 		Hop, Instance,
-		origin::{Cost, Route},
+		origin::{Cost, RouteInfo, RouteOptions},
 	};
 
 	/// The listing's next event as `present path` or `absent path`, within the update hold.
@@ -154,8 +154,8 @@ mod tests {
 		}
 	}
 
-	fn route(instance: &Instance) -> Route {
-		Route::default().with_instance(instance.clone(), 0)
+	fn route(instance: &Instance) -> RouteOptions {
+		RouteOptions::default().with_instance(instance.clone(), 0)
 	}
 
 	/// A path stays present while another instance takes it over or its route changes, and is
@@ -166,18 +166,22 @@ mod tests {
 		let mut announced = origin.consume().announced();
 		let mut routes = origin.consume().routes();
 
-		let first = origin.publish("live", route(&Instance::random())).unwrap();
+		let first = origin.route("live", route(&Instance::random())).unwrap();
 		assert_eq!(listed(&mut announced).await, "present live");
 		assert!(matches!(routes.next().await, Some(RouteEvent::Start(_))));
 
 		first
-			.announce(route(&Instance::random()).with_cost(Cost::new(5)))
+			.announce_info(
+				RouteInfo::default()
+					.with_instance(Instance::random(), 0)
+					.with_cost(Cost::new(5)),
+			)
 			.unwrap();
 		quiet(&mut announced).await;
 		// The relay-level stream still reports the replacement.
 		assert!(matches!(routes.next().await, Some(RouteEvent::Restart(_))));
 
-		let second = origin.publish("live", route(&Instance::random())).unwrap();
+		let second = origin.route("live", route(&Instance::random())).unwrap();
 		drop(first);
 		quiet(&mut announced).await;
 
diff --git a/rs/moq-net/src/model/broadcast.rs b/rs/moq-net/src/model/broadcast.rs
index 7d068b215ea..3f2e59427f3 100644
--- a/rs/moq-net/src/model/broadcast.rs
+++ b/rs/moq-net/src/model/broadcast.rs
@@ -18,9 +18,7 @@ use std::{
 };
 
 use crate::Error;
-use crate::origin::Route;
 
-use super::origin_impl::Announcer;
 use super::{RequestQueue, WeakCache, WeakEntry};
 
 #[path = "listing.rs"]
@@ -47,7 +45,7 @@ pub struct Info {
 	/// The path this broadcast is named by, which relative references in a catalog it
 	/// serves (hang's `broadcast` field) resolve against.
 	///
-	/// [`origin::Producer::create_broadcast`](super::origin::Producer::create_broadcast) stamps
+	/// [`origin::Producer::route`](super::origin::Producer::route) stamps
 	/// the path the broadcast was created at, relative to the origin root (including through a
 	/// scoped producer). Every [`Consumer`] an origin hands out is then re-stamped with the path
 	/// *that handle* was requested or announced at, relative to its cursor's root, since the
@@ -248,7 +246,7 @@ pub struct Producer {
 	state: kio::Shared<BroadcastState>,
 
 	// Ingress stats scope, set by a tagged `origin::Producer` at
-	// `create_broadcast`. Inherited by the tracks this producer creates. Empty
+	// `route`. Inherited by the tracks this producer creates. Empty
 	// (no-op) for an untagged broadcast.
 	stats: stats::Scope,
 }
@@ -266,17 +264,25 @@ impl Producer {
 	}
 
 	/// Attach an ingress stats scope, inherited by the tracks created on this
-	/// broadcast. Set by a tagged `origin::Producer` at `create_broadcast`.
+	/// broadcast. Set by a tagged `origin::Producer` at `route`.
 	pub(super) fn with_stats(mut self, scope: stats::Scope) -> Self {
 		self.stats = scope;
 		self
 	}
 
-	/// Attach the advertisement of this broadcast's exact path. Set by
-	/// `origin::Producer::create_broadcast`; a standalone broadcast has none.
-	pub(super) fn with_announcer(self, announcer: Announcer) -> Self {
-		*self.alive.announcer.lock() = Some(announcer);
-		self
+	/// Run `hook` once the broadcast closes: on [`Self::close`], an abort, or the last
+	/// producer-side handle dropping. Runs at once on a broadcast already closed. One hook
+	/// per broadcast: the route that owns it, which retracts when it closes.
+	pub(super) fn on_close(&self, hook: Box<dyn FnOnce() + Send>) {
+		{
+			let mut slot = self.alive.on_close.lock();
+			debug_assert!(slot.is_none(), "a close hook was already installed");
+			if !self.alive.state.lock().closing {
+				*slot = Some(hook);
+				return;
+			}
+		}
+		hook();
 	}
 
 	/// Answer track requests only while `validity` holds, ending the broadcast once it
@@ -288,74 +294,6 @@ impl Producer {
 		self
 	}
 
-	/// The route this broadcast is announced with, or `None` while it is not.
-	pub(super) fn route(&self) -> Option<Route> {
-		self.alive.announcer.lock().as_ref()?.route()
-	}
-
-	/// Advertise this broadcast's exact path as a route, or replace the standing
-	/// advertisement's route. A route naming no instance keeps the broadcast's, so
-	/// `broadcast.announce(Route::default().with_cost(cost))` re-prices it; one naming
-	/// another instance announces a new stream.
-	///
-	/// Until this is called the broadcast exists for nobody: announce cursors do
-	/// not list it and requests for its path fail with [`Error::Unroutable`], for
-	/// local consumers and peers alike. Call it once the tracks a subscriber needs
-	/// first (a catalog) exist, so the advertisement lands with them in place:
-	/// consumers act on it immediately. The route retracts on [`unannounce`](Self::unannounce),
-	/// [`close`](Self::close), or the last producer dropping.
-	///
-	/// Fails with [`Error::Closed`] on a standalone broadcast (one not created
-	/// through an origin, so there is nothing to announce into), on a claim answer
-	/// still being [prepared](super::origin::Request::prepare), once the broadcast
-	/// has closed, or once the origin's driver has been dropped.
-	pub(super) fn announce(&self, route: Route) -> Result<(), Error> {
-		let mut announcer = self.alive.announcer.lock();
-		let announcer = announcer.as_mut().ok_or(Error::Closed)?;
-		announcer.announce(route)
-	}
-
-	/// Hand back an announcer withheld at creation and announce `route` once `admit`
-	/// agrees, decided under the origin's table lock. The announcer is installed only
-	/// when admitted; otherwise it drops, so this broadcast can never announce.
-	pub(super) fn announce_withheld(
-		&self,
-		mut announcer: Announcer,
-		route: Route,
-		predecessor: Option<&kio::Shared<crate::model::origin_impl::ServeState>>,
-		admit: impl FnOnce() -> bool,
-	) -> Result<bool, Error> {
-		let refused = {
-			let mut slot = self.alive.announcer.lock();
-			debug_assert!(slot.is_none(), "an announcer was already installed");
-			// A close already retracted the slot, so an announcer installed now would
-			// outlive the broadcast.
-			if self.alive.state.lock().closing {
-				Err(Error::Closed)
-			} else {
-				match announcer.announce_if(route, predecessor, admit) {
-					Ok(true) => {
-						*slot = Some(announcer);
-						return Ok(true);
-					}
-					refused => refused,
-				}
-			}
-		};
-		// Dropped outside the announcer lock, as in `Alive::retract`.
-		drop(announcer);
-		refused
-	}
-
-	/// Retract this broadcast's advertisement, if any, from local consumers and
-	/// peers alike. New requests for the path fail with [`Error::Unroutable`] and
-	/// the broadcast the origin served from it ends, while tracks already in
-	/// flight carry on to their own end. [`announce`](Self::announce) brings it
-	/// back.
-	pub(super) fn unannounce(&self) {
-		self.alive.unannounce();
-	}
-
 	/// The broadcast's static metadata, fixed when it was created.
 	pub fn info(&self) -> &Info {
 		&self.info
@@ -533,7 +471,7 @@ impl Producer {
 
 	/// End the broadcast for good, whether or not other clones are still alive.
 	///
-	/// Retracts its announcement and local discovery; a later [`super::origin::Publication::announce`] fails
+	/// Retracts its announcement and local discovery; a later [`super::origin::Route::announce`] fails
 	/// with [`Error::Closed`]. Tracks already handed out carry on and end with their
 	/// own finish or abort. Every later [`Consumer::track`], and every name reserved or
 	/// still queued for a handler, answers [`Error::Unroutable`]: the same answer an
@@ -586,9 +524,9 @@ impl Producer {
 struct Alive {
 	token: kio::Producer<()>,
 	state: kio::Shared<BroadcastState>,
-	// The advertisement of the broadcast's exact path, owned here so it retracts
-	// with the broadcast: on close or the last producer-side handle dropping. `None` for a standalone broadcast.
-	announcer: kio::Lock<Option<Announcer>>,
+	// Run once the broadcast ends: on close or the last producer-side handle dropping.
+	// The route owning the broadcast retracts through it. `None` for a standalone broadcast.
+	on_close: kio::Lock<Option<Box<dyn FnOnce() + Send>>>,
 	// How long a session's source still names the instance that minted it. Held on the
 	// producer side, never by a consumer, so the selection it may hold is dropped by its
 	// session rather than wherever the last consumer goes.
@@ -600,18 +538,11 @@ impl Alive {
 		Arc::new(Self {
 			token: kio::Producer::default(),
 			state,
-			announcer: kio::Lock::new(None),
+			on_close: kio::Lock::new(None),
 			validity: RequestValidity::default(),
 		})
 	}
 
-	/// Withdraw the path's advertisement, if any; the broadcast stays alive.
-	fn unannounce(&self) {
-		if let Some(announcer) = self.announcer.lock().as_mut() {
-			announcer.withdraw();
-		}
-	}
-
 	/// End the broadcast. See [`Producer::close`].
 	fn close(&self) {
 		{
@@ -657,12 +588,13 @@ impl Alive {
 		true
 	}
 
-	/// Drop the announcer for good, so a later `announce` fails with `Closed`. Dropped
-	/// outside the announcer lock: the entry's removal re-syncs the origin's cursors under
-	/// the origin's own lock.
+	/// Run the close hook, if any. Outside the hook's lock: the route's retraction
+	/// re-syncs the origin's cursors under the origin's own lock.
 	fn retract(&self) {
-		let announcer = self.announcer.lock().take();
-		drop(announcer);
+		let hook = self.on_close.lock().take();
+		if let Some(hook) = hook {
+			hook();
+		}
 	}
 }
 
@@ -697,7 +629,7 @@ impl RequestValidity {
 	}
 
 	#[cfg_attr(not(feature = "async"), allow(dead_code, reason = "async-only"))]
-	pub(crate) fn for_source(route: &crate::origin::Requests, path: &crate::Path) -> Self {
+	pub(crate) fn for_source(route: &crate::origin::Route, path: &crate::Path) -> Self {
 		route
 			.request_validity(path)
 			.map(|selected| Self::Selected(std::sync::Arc::new(selected)))
diff --git a/rs/moq-net/src/model/follow.rs b/rs/moq-net/src/model/follow.rs
index 66304339567..4b076ac7e65 100644
--- a/rs/moq-net/src/model/follow.rs
+++ b/rs/moq-net/src/model/follow.rs
@@ -397,7 +397,7 @@ mod tests {
 	use super::*;
 	use crate::{
 		Error, Hop, Instance, Pattern, Patterns,
-		origin::{Cost, Route},
+		origin::{Cost, RouteInfo, RouteOptions},
 	};
 
 	/// The follower's next event, which must arrive within the origin's update hold.
@@ -422,8 +422,12 @@ mod tests {
 		}
 	}
 
-	fn route(instance: &Instance) -> Route {
-		Route::default().with_instance(instance.clone(), 0)
+	fn route(instance: &Instance) -> RouteInfo {
+		RouteInfo::default().with_instance(instance.clone(), 0)
+	}
+
+	fn options(instance: &Instance) -> RouteOptions {
+		RouteOptions::default().with_instance(instance.clone(), 0)
 	}
 
 	#[kio::test]
@@ -433,30 +437,30 @@ mod tests {
 		let instance = Instance::random();
 
 		// A prefix above the path covers it.
-		let pool = origin.requests_route("pool", route(&instance), None).unwrap();
+		let pool = origin.forward("pool", route(&instance), None).unwrap();
 		assert_eq!(followed(&mut follow).await, ("start", "pool".into()));
 
 		// A route beneath the path serves another broadcast.
-		let _beneath = origin.publish("pool/job/thumbnail", Route::default()).unwrap();
+		let _beneath = origin.route("pool/job/thumbnail", RouteOptions::default()).unwrap();
 		quiet(&mut follow).await;
 
 		// The path itself, from the same instance, takes over without a restart.
-		let exact = origin.publish("pool/job", route(&instance)).unwrap();
+		let exact = origin.route("pool/job", options(&instance)).unwrap();
 		assert_eq!(followed(&mut follow).await, ("update", "pool/job".into()));
 
 		// The covering prefix no longer serves the path, so its changes are not seen.
-		pool.update_route(pool.route().with_cost(5)).unwrap();
+		pool.update(pool.route().unwrap().with_cost(5)).unwrap();
 		quiet(&mut follow).await;
 
 		// Another instance at the path.
-		exact.announce(route(&Instance::random())).unwrap();
+		exact.announce_info(route(&Instance::random())).unwrap();
 		assert_eq!(followed(&mut follow).await, ("restart", "pool/job".into()));
 
 		// It goes, so the prefix serves the path again: another instance.
 		drop(exact);
 		assert_eq!(followed(&mut follow).await, ("restart", "pool".into()));
 
-		pool.update_route(pool.route().with_cost(9)).unwrap();
+		pool.update(pool.route().unwrap().with_cost(9)).unwrap();
 		assert_eq!(followed(&mut follow).await, ("update", "pool".into()));
 
 		drop(pool);
@@ -468,8 +472,8 @@ mod tests {
 	#[kio::test]
 	async fn follow_starts_on_the_serving_route_when_joining_late() {
 		let origin = Hop::new(1).unwrap().produce();
-		let _pool = origin.requests_route("pool", Route::default(), None).unwrap();
-		let _exact = origin.publish("pool/job", Route::default()).unwrap();
+		let _pool = origin.forward("pool", RouteInfo::default(), None).unwrap();
+		let _exact = origin.route("pool/job", RouteOptions::default()).unwrap();
 
 		let mut follow = origin.consume().path_routes("pool/job").unwrap();
 		assert_eq!(followed(&mut follow).await, ("start", "pool/job".into()));
@@ -482,19 +486,19 @@ mod tests {
 	async fn follow_keeps_a_gap_between_routes_of_one_instance() {
 		let origin = Hop::new(1).unwrap().produce();
 		let instance = Instance::random();
-		let exact = origin.publish("pool/job", route(&instance)).unwrap();
+		let exact = origin.route("pool/job", options(&instance)).unwrap();
 		let mut follow = origin.consume().path_routes("pool/job").unwrap();
 		assert_eq!(followed(&mut follow).await, ("start", "pool/job".into()));
 
 		// Both land before the follower reads again, and the cursor delivers the prefix's start
 		// ahead of the path's end, but the path went unserved in between.
 		drop(exact);
-		let _pool = origin.requests_route("pool", route(&instance), None).unwrap();
+		let _pool = origin.forward("pool", route(&instance), None).unwrap();
 		assert_eq!(followed(&mut follow).await, ("end", "pool/job".into()));
 		assert_eq!(followed(&mut follow).await, ("start", "pool".into()));
 
 		// A prefix standing while the path's route goes takes over in place.
-		let exact = origin.publish("pool/job", route(&instance)).unwrap();
+		let exact = origin.route("pool/job", options(&instance)).unwrap();
 		assert_eq!(followed(&mut follow).await, ("update", "pool/job".into()));
 		drop(exact);
 		assert_eq!(followed(&mut follow).await, ("update", "pool".into()));
@@ -505,13 +509,13 @@ mod tests {
 	#[kio::test]
 	async fn follow_hands_over_to_a_prefix_that_started_before_the_last_change() {
 		let origin = Hop::new(1).unwrap().produce();
-		let exact = origin.publish("pool/job", route(&Instance::random())).unwrap();
+		let exact = origin.route("pool/job", RouteOptions::default()).unwrap();
 		let mut follow = origin.consume().path_routes("pool/job").unwrap();
 		assert_eq!(followed(&mut follow).await, ("start", "pool/job".into()));
 
 		let instance = Instance::random();
-		let _pool = origin.requests_route("pool", route(&instance), None).unwrap();
-		exact.announce(route(&instance)).unwrap();
+		let _pool = origin.forward("pool", route(&instance), None).unwrap();
+		exact.announce_info(route(&instance)).unwrap();
 		assert_eq!(followed(&mut follow).await, ("restart", "pool/job".into()));
 
 		drop(exact);
@@ -524,10 +528,10 @@ mod tests {
 		let origin = Hop::new(1).unwrap().produce();
 		let mut follow = origin.consume().path_routes("pool/job").unwrap();
 
-		let _pool = origin.requests_route("pool", Route::default(), None).unwrap();
+		let _pool = origin.forward("pool", RouteInfo::default(), None).unwrap();
 		assert_eq!(followed(&mut follow).await, ("start", "pool".into()));
 
-		let _exact = origin.publish("pool/job", Route::default()).unwrap();
+		let _exact = origin.route("pool/job", RouteOptions::default()).unwrap();
 		assert_eq!(followed(&mut follow).await, ("restart", "pool/job".into()));
 	}
 
@@ -540,11 +544,13 @@ mod tests {
 		let _chat = origin
 			.scope("", &chat)
 			.unwrap()
-			.requests_route("room/alice", Route::default(), None)
+			.forward("room/alice", RouteInfo::default(), None)
 			.unwrap();
 		let mut follow = origin.consume().path_routes("room/alice").unwrap();
 
-		let first = origin.publish("room/alice", Route::default().with_cost(5)).unwrap();
+		let first = origin
+			.route("room/alice", RouteOptions::default().with_cost(5))
+			.unwrap();
 		let event = kio::clock::timeout(Duration::from_secs(1), follow.next())
 			.await
 			.unwrap()
@@ -555,7 +561,9 @@ mod tests {
 		);
 
 		// A republish is another instance of the route that serves the path.
-		let _second = origin.publish("room/alice", Route::default().with_cost(5)).unwrap();
+		let _second = origin
+			.route("room/alice", RouteOptions::default().with_cost(5))
+			.unwrap();
 		drop(first);
 		let event = kio::clock::timeout(Duration::from_secs(1), follow.next())
 			.await
@@ -599,8 +607,8 @@ mod tests {
 	}
 
 	/// The next request a dynamic route receives for its path.
-	async fn requested(dynamic: &crate::origin::Requests) -> crate::origin::Request {
-		kio::clock::timeout(Duration::from_secs(1), dynamic.requested_broadcast())
+	async fn requested(dynamic: &crate::origin::Route) -> crate::origin::Request {
+		kio::clock::timeout(Duration::from_secs(1), dynamic.requested())
 			.await
 			.expect("never asked")
 			.expect("the route closed")
@@ -611,13 +619,13 @@ mod tests {
 	#[kio::test]
 	async fn announced_hands_out_a_held_takeover_once() {
 		let origin = Hop::new(1).unwrap().produce();
-		let dynamic = origin.requests("live").unwrap();
+		let dynamic = origin.route_prefix("live", RouteOptions::default()).unwrap();
 		let mut announced = origin.consume().follow("live", None).unwrap();
 
 		// The wait is on the dynamic route's answer when the exact path takes over under another instance.
 		let (_takeover, _publish) = futures::join!(available(&mut announced), async {
 			let _unanswered = requested(&dynamic).await;
-			origin.publish("live", Route::default()).unwrap()
+			origin.route("live", RouteOptions::default()).unwrap()
 		});
 		none(&mut announced).await;
 	}
@@ -628,14 +636,14 @@ mod tests {
 	#[kio::test]
 	async fn announced_hands_out_a_gap_while_resolving_once() {
 		let origin = Hop::new(1).unwrap().produce();
-		let dynamic = origin.requests("").unwrap();
+		let dynamic = origin.route_prefix("", RouteOptions::default()).unwrap();
 		let mut announced = origin.consume().follow("live", None).unwrap();
 
 		let (_arrival, _publish) = futures::join!(available(&mut announced), async {
 			let _unanswered = requested(&dynamic).await;
 			drop(dynamic);
 			kio::clock::sleep(super::super::origin_impl::DEFAULT_UPDATE_HOLD * 2).await;
-			origin.publish("live", Route::default()).unwrap()
+			origin.route("live", RouteOptions::default()).unwrap()
 		});
 		none(&mut announced).await;
 	}
@@ -648,11 +656,11 @@ mod tests {
 		let origin = Hop::new(1).unwrap().produce();
 		let instance = Instance::random();
 		let mut announced = origin.consume().follow("live", None).unwrap();
-		let exact = origin.publish("live", route(&instance)).unwrap();
+		let exact = origin.route("live", options(&instance)).unwrap();
 		let first = available(&mut announced).await;
 
-		let dynamic = origin.requests_route("", route(&instance), None).unwrap();
-		exact.unannounce();
+		let dynamic = origin.forward("", route(&instance), None).unwrap();
+		exact.withdraw();
 		ended(&mut announced).await;
 		let served = broadcast::Info::new().produce();
 		let (again, ()) = futures::join!(available(&mut announced), async {
@@ -667,12 +675,12 @@ mod tests {
 	async fn announced_pinned_refuses_another_instance() {
 		let origin = Hop::new(1).unwrap().produce();
 		let instance = Instance::random();
-		let _first = origin.publish("live", route(&instance)).unwrap();
+		let _first = origin.route("live", options(&instance)).unwrap();
 		let mut announced = origin.consume().follow("live", instance.clone()).unwrap();
 		let pinned = available(&mut announced).await;
 		assert_eq!(pinned.info().instance.as_ref(), Some(&instance));
 
-		let second = origin.publish("live", route(&Instance::random())).unwrap();
+		let second = origin.route("live", RouteOptions::default()).unwrap();
 		ended(&mut announced).await;
 		none(&mut announced).await;
 
@@ -698,13 +706,13 @@ mod tests {
 		let mut announced = origin.consume().follow("live", None).unwrap();
 		none(&mut announced).await;
 
-		let first = origin.publish("live", Route::default()).unwrap();
+		let first = origin.route("live", RouteOptions::default()).unwrap();
 		let started = available(&mut announced).await;
 		drop(first);
 		ended(&mut announced).await;
 		none(&mut announced).await;
 
-		let _second = origin.publish("live", Route::default()).unwrap();
+		let _second = origin.route("live", RouteOptions::default()).unwrap();
 		assert!(!available(&mut announced).await.is_clone(&started));
 	}
 
@@ -712,16 +720,16 @@ mod tests {
 	async fn announced_pinned_hands_out_its_instance_after_a_gap() {
 		let origin = Hop::new(1).unwrap().produce();
 		let instance = Instance::random();
-		let first = origin.publish("live", route(&instance)).unwrap();
+		let first = origin.route("live", options(&instance)).unwrap();
 		let mut announced = origin.consume().follow("live", instance.clone()).unwrap();
 		assert_eq!(
 			available(&mut announced).await.info().instance.as_ref(),
 			Some(&instance)
 		);
-		first.unannounce();
+		first.withdraw();
 		ended(&mut announced).await;
 		none(&mut announced).await;
-		first.announce(route(&instance)).unwrap();
+		first.announce().unwrap();
 		assert_eq!(
 			available(&mut announced).await.info().instance.as_ref(),
 			Some(&instance)
@@ -731,12 +739,12 @@ mod tests {
 	#[kio::test]
 	async fn announced_reports_a_dropped_prepared_answer() {
 		let origin = Hop::new(1).unwrap().produce();
-		let claim = origin.requests("live").unwrap();
+		let claim = origin.route_prefix("live", RouteOptions::default()).unwrap();
 		let mut announced = origin.consume().follow("live", None).unwrap();
 		let (result, ()) = futures::join!(
 			kio::clock::timeout(Duration::from_secs(1), announced.available()),
 			async {
-				let prepared = requested(&claim).await.prepare().unwrap();
+				let prepared = requested(&claim).await.route(RouteOptions::hidden()).unwrap();
 				drop(prepared);
 			}
 		);
@@ -747,12 +755,12 @@ mod tests {
 		// The refusing route is not asked again, and the next announcement is handed out.
 		let ((), again) = futures::join!(
 			none(&mut announced),
-			kio::clock::timeout(Duration::from_secs(1), claim.requested_broadcast())
+			kio::clock::timeout(Duration::from_secs(1), claim.requested())
 		);
 		assert!(again.is_err(), "the refusing route was asked again");
 		drop(claim);
 		let instance = Instance::random();
-		let _published = origin.publish("live", route(&instance)).unwrap();
+		let _published = origin.route("live", options(&instance)).unwrap();
 		assert_eq!(
 			available(&mut announced).await.info().instance.as_ref(),
 			Some(&instance)
@@ -764,7 +772,7 @@ mod tests {
 	async fn announced_retries_a_refusal_on_another_route_of_the_instance() {
 		let origin = Hop::new(1).unwrap().produce();
 		let instance = Instance::random();
-		let claim = origin.requests_route("", route(&instance), None).unwrap();
+		let claim = origin.route_prefix("", options(&instance)).unwrap();
 		let mut announced = origin.consume().follow("live", None).unwrap();
 		let (result, ()) = futures::join!(
 			kio::clock::timeout(Duration::from_secs(1), announced.available()),
@@ -776,7 +784,7 @@ mod tests {
 			result.expect("the refusal must answer"),
 			Err(Error::Unroutable)
 		));
-		let _exact = origin.publish("live", route(&instance)).unwrap();
+		let _exact = origin.route("live", options(&instance)).unwrap();
 		assert_eq!(
 			available(&mut announced).await.info().instance.as_ref(),
 			Some(&instance)
@@ -788,7 +796,7 @@ mod tests {
 	#[kio::test]
 	async fn announced_waits_for_a_route_change_after_a_refusal() {
 		let origin = Hop::new(1).unwrap().produce();
-		let claim = origin.requests("live").unwrap();
+		let claim = origin.route_prefix("live", RouteOptions::default()).unwrap();
 		let mut announced = origin.consume().follow("live", None).unwrap();
 		let (result, ()) = futures::join!(
 			kio::clock::timeout(Duration::from_secs(1), announced.available()),
@@ -796,11 +804,11 @@ mod tests {
 		);
 		assert!(matches!(result.expect("the refusal answers"), Err(Error::NotFound)));
 		none(&mut announced).await;
-		let again = kio::clock::timeout(Duration::from_secs(1), claim.requested_broadcast()).await;
+		let again = kio::clock::timeout(Duration::from_secs(1), claim.requested()).await;
 		assert!(again.is_err(), "the refusing handler was asked again");
 
 		// A publisher takes the path over from the claim, and is handed out.
-		let _publisher = origin.publish("live", route(&Instance::random())).unwrap();
+		let _publisher = origin.route("live", options(&Instance::random())).unwrap();
 		let _served = available(&mut announced).await;
 	}
 
@@ -810,8 +818,8 @@ mod tests {
 	#[kio::test]
 	async fn announced_does_not_retry_a_refusal_after_a_takeover() {
 		let origin = Hop::new(1).unwrap().produce();
-		let dynamic = origin.requests_route("", route(&Instance::random()), None).unwrap();
-		let exact = origin.publish("live", route(&Instance::random())).unwrap();
+		let dynamic = origin.route_prefix("", options(&Instance::random())).unwrap();
+		let exact = origin.route("live", options(&Instance::random())).unwrap();
 		let mut announced = origin.consume().follow("live", None).unwrap();
 		let _first = available(&mut announced).await;
 
@@ -822,7 +830,7 @@ mod tests {
 		);
 		assert!(matches!(result.expect("the refusal answers"), Err(Error::NotFound)));
 		none(&mut announced).await;
-		let again = kio::clock::timeout(Duration::from_secs(1), dynamic.requested_broadcast()).await;
+		let again = kio::clock::timeout(Duration::from_secs(1), dynamic.requested()).await;
 		assert!(again.is_err(), "the refusing handler was asked again");
 
 		// The broadcast handed out before the refusal is still owed its end once the path goes
diff --git a/rs/moq-net/src/model/mod.rs b/rs/moq-net/src/model/mod.rs
index eec7b20bbdf..b010421a7b5 100644
--- a/rs/moq-net/src/model/mod.rs
+++ b/rs/moq-net/src/model/mod.rs
@@ -52,7 +52,7 @@ pub use datagram::Datagram;
 pub use time::*;
 pub use timed::Timed;
 
-/// Publishing broadcasts, announcing routes, and consuming both through an origin.
+/// Routing broadcasts into an origin, and consuming them through it.
 pub mod origin {
 	pub use super::follow::Following;
 	pub(crate) use super::origin_impl::HiddenWithheld;
@@ -62,8 +62,8 @@ pub mod origin {
 	// private: capability gap
 	pub(crate) use super::origin_impl::Lookup;
 	pub use super::origin_impl::{
-		Config, Consumer, Cost, Driver, HopLimit, Link, Preference, Prepared, Producer, Publication, Request,
-		Requesting, Requests, Route, Source,
+		Config, Consumer, Cost, Driver, HopLimit, Link, Preference, Producer, Request, Requesting, Route, RouteInfo,
+		RouteOptions, Source,
 	};
 	pub use crate::route::RouteKey;
 
diff --git a/rs/moq-net/src/model/origin.rs b/rs/moq-net/src/model/origin.rs
index e1bc2bdd0c9..00ef399a985 100644
--- a/rs/moq-net/src/model/origin.rs
+++ b/rs/moq-net/src/model/origin.rs
@@ -467,45 +467,34 @@ impl From<i8> for Preference {
 	}
 }
 
-/// The stream a route serves, the path it took through the mesh, and what using it costs.
+/// The stream a received route serves, the path it took through the mesh, and what
+/// using it costs: read-only facts on an announcement.
 ///
-/// The metadata half of an advertisement: [`Producer::requests`] pairs it with
-/// the prefix it covers, [`Publication::announce`] with the
-/// broadcast's exact path, and [`Consumer::announced`] yields both. A route
-/// claims capability, not inventory: it says paths under its prefix are
-/// servable, never that any specific broadcast exists. The common convention is
-/// that a publisher announces each broadcast's exact path, so subscribers can
-/// enumerate broadcasts; a service instead announces one short prefix and
-/// answers whatever is requested beneath it.
+/// Carried by [`Announce::route`]. A route claims capability, not inventory: it says
+/// paths under its prefix are servable, never that any specific broadcast exists. The
+/// common convention is that a publisher announces each broadcast's exact path with
+/// [`Producer::route`], so subscribers can enumerate broadcasts; a service instead
+/// announces one short prefix with [`Producer::route_prefix`] and answers whatever is
+/// requested beneath it.
+///
+/// Applications never build one: a [`Route`] takes [`RouteOptions`], and the origin
+/// and the relays fill in the rest.
 #[derive(Clone, Debug, PartialEq, Eq)]
-#[non_exhaustive]
-pub struct Route {
-	/// The stream the route serves: routes with one instance serve one continuous
-	/// sequence space, so a subscription resumes from one to another. Changing it on a
-	/// standing advertisement is an [`RouteEvent::Restart`].
-	///
-	/// Always set on a route the origin delivers. Given to an announcing handle, `None`
-	/// keeps the instance its route already has: a fresh random one, minted when the
-	/// handle was made, unless [`Self::with_instance`] set another.
-	pub instance: Option<Instance>,
+pub struct RouteInfo {
+	/// The stream the route serves; see [`Self::instance`]. Always set on a route the
+	/// origin delivers. Given to a route a session lands, `None` mints one.
+	pub(crate) instance: Option<Instance>,
 
 	/// Orders the incarnations of one instance: among its routes at one prefix only the
 	/// highest epoch is eligible. Never compared across instances, and never shown to
 	/// readers.
 	pub(crate) epoch: u64,
 
-	/// The chain of origins the route has traversed, oldest first. Each relay
-	/// appends its own [`crate::Hop`] when forwarding; used for loop detection
-	/// and as the selection tie-break. A 0 entry is the anonymous mark and
-	/// travels unchanged; see [`Self::is_anonymous`].
-	pub hops: Hops,
+	/// The chain of origins the route has traversed, oldest first; see [`Self::hops`].
+	pub(crate) hops: Hops,
 
-	/// What pulling content via this route costs, accumulated per link: lower wins
-	/// among routes of the same anonymity, with ties broken by a broadcast published
-	/// on this origin, then hop length, then a hash of the instance and the requested
-	/// path (except for a route that entered here, at its own path), and finally the
-	/// most recently announced route. See [`Cost`].
-	pub cost: Cost,
+	/// What pulling content via this route costs; see [`Self::cost`].
+	pub(crate) cost: Cost,
 
 	/// The credential the request advertising this route carries, from
 	/// `auth::Handle::add`, or `None` for the session's scope.
@@ -517,7 +506,7 @@ pub struct Route {
 	/// REQUEST_UPDATE. A handle passed to
 	/// `Client::with_auth` presents it on every session it backs, so the route keeps it
 	/// across a reconnect. Local, like [`Self::source`]: a relay never forwards it.
-	pub auth: Option<crate::auth::Credential>,
+	pub(crate) auth: Option<crate::auth::Credential>,
 
 	/// The announcing session's declared or assigned identity.
 	///
@@ -530,7 +519,7 @@ pub struct Route {
 	pub(crate) source: Source,
 }
 
-impl Default for Route {
+impl Default for RouteInfo {
 	fn default() -> Self {
 		Self {
 			instance: None,
@@ -559,39 +548,56 @@ pub enum Source {
 	Peer(Hop),
 }
 
-impl Route {
-	/// Serve a stable `instance` at `epoch`, in place of the one the handle minted.
-	///
-	/// Only for a publisher that continues the instance's sequence space across restarts,
-	/// announcing a higher `epoch` each time, such as a counter persisted on disk. Readers
-	/// stitch every route of one instance together, so a publisher that restarts its
-	/// group sequences under an old instance splices unrelated groups into their tracks.
-	/// The highest epoch wins over every older one of the instance, cheaper or not.
-	///
-	/// Do not start a named instance with `~`: that marks one a relay minted
-	/// ([`Instance::is_minted`]), which moq-crypto's signing refuses to bind and a catalog's instance
-	/// check skips. The mark is not refused, since a relay forwarding a route keeps the
-	/// instance it received.
-	pub fn with_instance(mut self, instance: Instance, epoch: u64) -> Self {
+impl RouteInfo {
+	/// The stream the route serves: routes with one instance serve one continuous
+	/// sequence space, so a subscription resumes from one to another. Pass it to
+	/// [`Consumer::request`] to pin this stream.
+	pub fn instance(&self) -> &Instance {
+		self.instance.as_ref().expect("a delivered route has an instance")
+	}
+
+	/// The chain of origins the route has traversed, oldest first. Each relay
+	/// appends its own hop when forwarding; used for loop detection and as the
+	/// selection tie-break. A 0 entry is the anonymous mark and travels unchanged;
+	/// see [`Self::is_anonymous`]. A route announced on this origin has none.
+	pub fn hops(&self) -> &Hops {
+		&self.hops
+	}
+
+	/// What pulling content via this route costs, accumulated per link: lower wins
+	/// among routes of the same anonymity, with ties broken by a broadcast published
+	/// on this origin, then hop length, then a hash of the instance and the requested
+	/// path (except for a route that entered here, at its own path), and finally the
+	/// most recently announced route. See [`Cost`].
+	pub fn cost(&self) -> Cost {
+		self.cost
+	}
+
+	/// Serve a stable `instance` at `epoch`; see [`RouteOptions::with_instance`].
+	#[cfg_attr(not(feature = "async"), allow(dead_code, reason = "async-only"))]
+	pub(crate) fn with_instance(mut self, instance: Instance, epoch: u64) -> Self {
 		self.instance = Some(instance);
 		self.epoch = epoch;
 		self
 	}
 
 	/// Replace the hop chain.
-	pub fn with_hops(mut self, hops: Hops) -> Self {
+	#[cfg_attr(not(feature = "async"), allow(dead_code, reason = "async-only"))]
+	pub(crate) fn with_hops(mut self, hops: Hops) -> Self {
 		self.hops = hops;
 		self
 	}
 
 	/// Set the cost: lower wins among routes covering the same prefix and anonymity.
-	pub fn with_cost(mut self, cost: impl Into<Cost>) -> Self {
+	#[cfg_attr(not(feature = "async"), allow(dead_code, reason = "async-only"))]
+	pub(crate) fn with_cost(mut self, cost: impl Into<Cost>) -> Self {
 		self.cost = cost.into();
 		self
 	}
 
 	/// Set the credential the advertising request carries; see [`Self::auth`].
-	pub fn with_auth(mut self, auth: crate::auth::Credential) -> Self {
+	#[cfg(all(test, feature = "async"))]
+	pub(crate) fn with_auth(mut self, auth: crate::auth::Credential) -> Self {
 		self.auth = Some(auth);
 		self
 	}
@@ -617,15 +623,84 @@ impl Route {
 		self.hops.iter().any(|hop| *hop == Hop::UNKNOWN)
 	}
 
-	/// Where the route entered this origin, as delivered by [`Consumer::announced`].
-	///
-	/// Set by the origin, not the announcer: a route handed to
-	/// [`Producer::requests`] reports [`Source::Local`] until the origin delivers it.
+	/// Where the route entered this origin.
 	pub fn source(&self) -> Source {
 		self.source
 	}
 }
 
+/// How an application advertises a [`Route`]: its visibility at creation, its price,
+/// its credential, and, rarely, a stable instance.
+///
+/// The default announces at once, at cost 0, under the session's scope, serving a
+/// fresh random instance minted when the route is created.
+#[derive(Clone, Debug, Default)]
+pub struct RouteOptions {
+	hidden: bool,
+	cost: Cost,
+	auth: Option<crate::auth::Credential>,
+	instance: Option<(Instance, u64)>,
+}
+
+impl RouteOptions {
+	/// Create the route hidden: it exists for nobody until [`Route::announce`].
+	///
+	/// For a publisher that fills its catalog first, or answers a negotiation, before
+	/// readers may find it.
+	pub fn hidden() -> Self {
+		Self {
+			hidden: true,
+			..Self::default()
+		}
+	}
+
+	/// Set the cost: lower wins among routes covering the same prefix and anonymity.
+	/// A publisher prices content it already produces at zero, and content it would
+	/// have to start producing on demand higher.
+	pub fn with_cost(mut self, cost: impl Into<Cost>) -> Self {
+		self.cost = cost.into();
+		self
+	}
+
+	/// Set the credential the advertising request carries, from `auth::Handle::add`.
+	///
+	/// Only a session built on the handle that issued it presents it, as the token on
+	/// its moq-transport PUBLISH_NAMESPACE; every other session advertises the route
+	/// under its own scope.
+	pub fn with_auth(mut self, auth: crate::auth::Credential) -> Self {
+		self.auth = Some(auth);
+		self
+	}
+
+	/// Serve a stable `instance` at `epoch`, in place of a freshly minted one.
+	///
+	/// Only for a publisher that continues the instance's sequence space across restarts,
+	/// announcing a higher `epoch` each time, such as a counter persisted on disk. Readers
+	/// stitch every route of one instance together, so a publisher that restarts its
+	/// group sequences under an old instance splices unrelated groups into their tracks.
+	/// The highest epoch wins over every older one of the instance, cheaper or not.
+	/// Naming an instance grants nothing: publishing still needs the path's grant.
+	///
+	/// Do not start a named instance with `~`: that marks one a relay minted
+	/// ([`Instance::is_minted`]), which moq-crypto's signing refuses to bind and a catalog's instance
+	/// check skips.
+	pub fn with_instance(mut self, instance: Instance, epoch: u64) -> Self {
+		self.instance = Some((instance, epoch));
+		self
+	}
+
+	/// The route metadata these options advertise, under `instance` at `epoch`.
+	fn info(&self, instance: &Instance, epoch: u64) -> RouteInfo {
+		RouteInfo {
+			instance: Some(instance.clone()),
+			epoch,
+			cost: self.cost,
+			auth: self.auth.clone(),
+			..RouteInfo::default()
+		}
+	}
+}
+
 static NEXT_CONSUMER_ID: AtomicU64 = AtomicU64::new(0);
 
 #[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, PartialOrd, Ord)]
@@ -1206,7 +1281,7 @@ impl OriginConsumerState {
 		let announce = Announce {
 			prefix,
 			captures,
-			route: Route {
+			route: RouteInfo {
 				hops: meta.0,
 				cost: meta.1,
 				via: Hop::UNKNOWN,
@@ -1230,9 +1305,9 @@ impl OriginConsumerState {
 /// One announced route in the origin's table, absolute prefix.
 struct RouteEntry {
 	id: u64,
-	/// The stream this route serves; see [`Route::instance`].
+	/// The stream this route serves; see [`RouteInfo::instance`].
 	instance: Instance,
-	/// Which incarnation of the instance; see [`Route::epoch`].
+	/// Which incarnation of the instance; see [`RouteInfo::epoch`].
 	epoch: u64,
 	prefix: Path,
 	/// The absolute patterns the announcing producer may serve. The prefix is
@@ -1240,7 +1315,7 @@ struct RouteEntry {
 	scope: Patterns,
 	hops: Hops,
 	cost: Cost,
-	/// The auth the request advertising the route carries; see [`Route::auth`].
+	/// The auth the request advertising the route carries; see [`RouteInfo::auth`].
 	auth: Option<crate::auth::Credential>,
 	/// The rank of the link the entry arrived on; see [`Producer::with_preference`].
 	preference: Preference,
@@ -1254,7 +1329,7 @@ struct RouteEntry {
 	/// The link the entry arrived on, from the handle that inserted it.
 	link: Link,
 	/// The queue requests under this route are served from, when the announcer
-	/// serves content on demand (a [`Requests`]). `None` for an advertise-only
+	/// serves content on demand (a prefix [`Route`]). `None` for an advertise-only
 	/// announcement ([`Producer::announce`]) and for a local broadcast.
 	server: Option<kio::Shared<ServeState>>,
 	/// The broadcast published on this origin at exactly `prefix`, when the
@@ -1267,7 +1342,7 @@ struct RouteEntry {
 	advertised: bool,
 	/// Whether a peer the chain passes through has since withdrawn this prefix.
 	/// The route was derived from that peer's advertisement, so it serves nobody
-	/// until the peer announces again. See [`Requests::withdrawn`].
+	/// until the peer announces again. See [`Route::withdrawn`].
 	stale: bool,
 	/// [`prefix_claim`] of [`Self::prefix`], built once at announce time.
 	///
@@ -1395,7 +1470,7 @@ fn prefix_claim(prefix: &Path) -> Result<Pattern, InvalidPattern> {
 /// A served route's request queue: what materializes a requested path on demand.
 ///
 /// Shared by every requester resolving through the owning route and the
-/// [`Requests`] draining it, so both sides work under one lock.
+/// prefix [`Route`] draining it, so both sides work under one lock.
 #[derive(Default)]
 pub(super) struct ServeState {
 	// Result channels for pending requests, keyed by absolute path so concurrent
@@ -2073,7 +2148,7 @@ pub struct Announce {
 	pub captures: Option<Vec<Pattern>>,
 	/// The route serving the prefix. On a retraction this carries its last
 	/// advertised metadata.
-	pub route: Route,
+	pub route: RouteInfo,
 }
 
 /// Publishes broadcasts and announces routes into an origin.
@@ -2211,8 +2286,8 @@ impl Producer {
 	/// Rank the link this handle (and any handle derived from it) is given to:
 	/// higher wins, and every handle starts at the neutral [`Preference::default`].
 	///
-	/// Applies to what [`Self::requests`] advertises, which is how a session lands its
-	/// peer's routes, not to a broadcast published here. Only an instance's newest epoch is
+	/// Applies to the routes a session lands from its peer through this handle, not to
+	/// a route created here. Only an instance's newest epoch is
 	/// eligible, but among eligible routes preference decides before cost, so links to different
 	/// operators rank by this instead of comparing their metrics. Hand each CDN's
 	/// session its own rank to use the primary while it has a route and fail over to
@@ -2278,29 +2353,28 @@ impl Producer {
 		}
 	}
 
-	/// Create an unannounced publication at `path` and its broadcast fill surface.
+	/// Create a route at exactly `path`, owning a new broadcast to fill.
 	///
-	/// This is how local content enters an origin. The returned [`Publication`]
-	/// controls its advertisement; [`Publication::broadcast`] borrows the fill producer.
-	/// It serves a fresh random [`Route::instance`], kept across announce, unannounce
-	/// and re-announce since its sequences continue, so a new publication is a new
-	/// stream that never splices into an old one. A publisher that continues one
-	/// sequence space across restarts may name a stable instance instead
-	/// ([`Route::with_instance`]).
+	/// This is how local content enters an origin. Fill the broadcast through
+	/// [`Route::broadcast`]. The route serves a fresh random instance, minted here and
+	/// kept for its lifetime, across [`Route::withdraw`] and [`Route::announce`], since
+	/// its sequences continue: a new route is a new stream that never splices into an
+	/// old one. A publisher that continues one sequence space across restarts may name
+	/// a stable instance instead ([`RouteOptions::with_instance`]).
 	///
-	/// The broadcast exists for nobody until [`Publication::announce`]:
-	/// until then no announce cursor lists it and a request for its path fails
-	/// with [`Error::Unroutable`], for a consumer of this origin exactly as for a
-	/// peer. Announce once the tracks a subscriber needs first exist. To serve
-	/// paths on demand without publishing each one, use [`Self::requests`].
+	/// Announced at once unless created [`RouteOptions::hidden`]. A hidden route exists
+	/// for nobody until [`Route::announce`]: until then no announce cursor lists it and
+	/// a request for its path fails with [`Error::Unroutable`], for a consumer of this
+	/// origin exactly as for a peer. Create it hidden when the tracks a subscriber needs
+	/// first, such as a catalog, are not there yet. To serve paths on demand without
+	/// publishing each one, use [`Self::route_prefix`].
 	///
-	/// Announcing is visible to local consumers before it returns; only
-	/// lifecycle work (track serving, teardown) waits for the [`Driver`] to be
-	/// polled. Register a [`broadcast::Producer::requests`] handler before
-	/// announcing, so the first consumer finds the tracks it serves.
+	/// Announcing is visible to local consumers before it returns; only lifecycle work
+	/// (track serving, teardown) waits for the [`Driver`] to be polled. Register a
+	/// [`broadcast::Producer::requests`] handler before announcing, so the first
+	/// consumer finds the tracks it serves.
 	///
-	/// End the broadcast with [`broadcast::Producer::close`] or by dropping it;
-	/// either way the path closes once it was the last source.
+	/// Dropping the last clone of the route retracts it, as does closing its broadcast.
 	///
 	/// Fails with [`Error::Unauthorized`] if `path` is outside the prefixes this
 	/// producer may publish under (after [`scope`](Self::scope)) or beneath a
@@ -2310,17 +2384,14 @@ impl Producer {
 	/// pattern can spell (`*` or `**`), [`Error::NavigationSegment`] for a literal `.` or `..`,
 	/// or [`Error::Closed`] once the origin's
 	/// [`Driver`] has been dropped.
-	pub fn create_broadcast(&self, path: impl TryInto<Path, Error: Into<Error>>) -> Result<Publication, Error> {
+	pub fn route(&self, path: impl TryInto<Path, Error: Into<Error>>, options: RouteOptions) -> Result<Route, Error> {
 		let full = self.root.join(&path::convert(path)?)?;
-		let (broadcast, announcer) = self.create_withheld(full)?;
-		Ok(Publication {
-			broadcast: broadcast.with_announcer(announcer),
-		})
+		self.exact(full, options, None)
 	}
 
-	/// A new broadcast at `full` with its announcer withheld, so it cannot announce
-	/// until the announcer is handed back.
-	fn create_withheld(&self, full: Path) -> Result<(broadcast::Producer, Announcer), Error> {
+	/// An exact route at the absolute `full` path, answering `request` on its first
+	/// announce when it is a job's.
+	fn exact(&self, full: Path, options: RouteOptions, request: Option<Request>) -> Result<Route, Error> {
 		publish_path(&full)?;
 		if !self.scope.permits(&full) || !self.scope.publishes(&full) {
 			return Err(Error::Unauthorized);
@@ -2340,8 +2411,7 @@ impl Producer {
 
 		// The broadcast is a route table entry at its exact path from the start,
 		// hidden from cursors and requests until it announces. The entry lives
-		// as long as the broadcast: its announcer drops on close, abort, or the
-		// last handle.
+		// as long as the route, or until the broadcast closes.
 		let announcing = Announcing {
 			hop: self.hop,
 			shared: self.shared.clone(),
@@ -2360,9 +2430,10 @@ impl Producer {
 			instance: None,
 			frames: self.frames.clone(),
 		};
-		let source = info.produce().with_stats(ingress.clone());
+		let source = info.produce().with_stats(ingress);
+		let (instance, epoch) = options.instance.clone().unwrap_or_else(|| (Instance::random(), 0));
 		let entry = announcing.announce(
-			Route::default(),
+			options.info(&instance, epoch),
 			Serving {
 				server: None,
 				source: Some(source.consume()),
@@ -2370,25 +2441,39 @@ impl Producer {
 			},
 			None,
 		)?;
-		let announcer = Announcer {
-			entry,
-			ingress,
+		let hidden = options.hidden;
+		let route = Route::new(RouteState {
+			announcement: entry,
+			broadcast: Some(source.clone()),
+			server: None,
+			publisher: None,
+			control: kio::Lock::new(RouteControl {
+				options,
+				instance,
+				epoch,
+				request,
+			}),
 			_keepalive: self.tasks.keepalive(),
-		};
-		Ok((source, announcer))
-	}
-
-	/// Create and advertise a broadcast in one call.
-	pub fn publish(&self, path: impl TryInto<Path, Error: Into<Error>>, route: Route) -> Result<Publication, Error> {
-		let broadcast = self.create_broadcast(path)?;
-		broadcast.announce(route)?;
-		Ok(broadcast)
+		});
+		// Closing the broadcast retracts the route, and refuses the request a job's route
+		// has not answered yet. The broadcast holds only a weak reference, so it never
+		// keeps the route alive.
+		let weak = Arc::downgrade(&route.state);
+		source.on_close(Box::new(move || {
+			if let Some(state) = weak.upgrade() {
+				state.ended();
+			}
+		}));
+		if !hidden {
+			route.announce()?;
+		}
+		Ok(route)
 	}
 
 	/// Mint a standalone source broadcast for a served-route request: it carries
 	/// this origin's cache policy and ingress attribution, but
 	/// is *not* entered into the route table. Sessions answer
-	/// [`Requests`] requests with one of these; the requester already holds
+	/// a prefix route's requests with one of these; the requester already holds
 	/// the request's result channel, so the table never needs to resolve it.
 	/// The source takes new tracks only while `validity` holds.
 	#[cfg_attr(not(feature = "async"), allow(dead_code, reason = "async-only"))]
@@ -2416,15 +2501,14 @@ impl Producer {
 	/// can be served, answered by nothing.
 	///
 	/// A request under an advertise-only route resolves [`Error::Unroutable`]
-	/// unless an announced broadcast or a served route ([`Self::requests`]) covers
+	/// unless an announced broadcast or a prefix route ([`Self::route_prefix`]) covers
 	/// the path too. Tests use it to shape the route table; everything else
-	/// advertises through a broadcast ([`Publication::announce`]) or a
-	/// [`Requests`] handler, which serve what they claim.
+	/// advertises through an exact or prefix [`Route`], which serves what it claims.
 	#[cfg(test)]
 	pub(crate) fn announce(
 		&self,
 		prefix: impl TryInto<Path, Error: Into<Error>>,
-		route: Route,
+		route: RouteInfo,
 	) -> Result<AnnounceProducer, Error> {
 		Announcing::new(self, prefix)?.announce(
 			route,
@@ -2500,70 +2584,97 @@ impl Producer {
 		self.link != Link::Local
 	}
 
-	/// Advertise a route over `prefix` and serve the requests beneath it.
+	/// Create a route over `prefix` that serves the requests beneath it.
 	///
-	/// A route is always a prefix: it claims `prefix` and every path beneath it
-	/// (the empty prefix claims every path). A service that only serves some of
+	/// A route is always a prefix on the wire: it claims `prefix` and every path beneath
+	/// it (the empty prefix claims every path). A service that only serves some of
 	/// them, say `pid/*.hang`, advertises the covering prefix and refuses the
 	/// rest as they are requested; consumers narrow with a [`Pattern`] locally.
 	/// This is the one shape every wire carries, so a route means the same
 	/// thing on every hop.
 	///
-	/// The advertisement is visible to [`Consumer::announced`] and forwarded by
-	/// sessions for as long as the returned [`Requests`] (and every clone) lives.
-	/// A consumer resolving a path under it through this route is handed to the
-	/// handler as a [`Request`] to materialize on demand: [`Request::prepare`]
-	/// under a new instance, fill, then [`Prepared::publish`] the exact path. Each
-	/// answer is its own stream, so restarting one output never splices into a copy
-	/// of the last. The route itself serves a random instance, minted here. This is how a service answers a whole
+	/// A consumer resolving a path under it through this route is handed to
+	/// [`Route::requested`] as a [`Request`]: answer it by serving a broadcast already
+	/// held ([`Request::serve`]), under this route's instance, or by creating the path's
+	/// own exact route ([`Request::route`]), under a fresh instance, so restarting one
+	/// job never splices into a copy of the last. This is how a service answers a whole
 	/// subtree without publishing each path ahead of time; a publisher that
-	/// knows its broadcasts advertises each one's exact path with
-	/// [`Publication::announce`] instead, so subscribers can enumerate
-	/// them.
+	/// knows its broadcasts creates each one's exact route with [`Self::route`]
+	/// instead, so subscribers can enumerate them.
+	///
+	/// The route is priced, credentialed and shown like an exact one. It is visible
+	/// for as long as the returned [`Route`] (and every clone) lives, unless withdrawn.
 	///
 	/// The prefix must overlap this producer's pattern scope. Individual requests
 	/// remain authoritative and are refused when they do not match the scope.
-	pub fn requests(&self, prefix: impl TryInto<Path, Error: Into<Error>>) -> Result<Requests, Error> {
-		self.requests_inner(prefix, Route::default(), true, None)
+	pub fn route_prefix(
+		&self,
+		prefix: impl TryInto<Path, Error: Into<Error>>,
+		options: RouteOptions,
+	) -> Result<Route, Error> {
+		let (instance, epoch) = options.instance.clone().unwrap_or_else(|| (Instance::random(), 0));
+		let info = options.info(&instance, epoch);
+		let advertised = !options.hidden;
+		self.serving_route(prefix, info, Some(self.clone()), advertised, None, options)
 	}
 
-	/// Land a peer's claim with its wire route metadata, continuing what the peer's
-	/// `predecessor` claim served beneath it when the peer took it over.
+	/// Land a peer's route with its wire metadata, continuing what the peer's
+	/// `predecessor` route served beneath it when the peer took it over.
 	#[cfg(any(feature = "async", test))]
-	pub(crate) fn requests_route(
+	pub(crate) fn forward(
 		&self,
 		prefix: impl TryInto<Path, Error: Into<Error>>,
-		route: Route,
-		predecessor: Option<&Requests>,
-	) -> Result<Requests, Error> {
-		self.requests_inner(prefix, route, false, predecessor.map(|claim| &claim.state))
+		mut info: RouteInfo,
+		predecessor: Option<&Route>,
+	) -> Result<Route, Error> {
+		// A handle that names no instance serves one of its own.
+		let instance = info.instance.get_or_insert_with(Instance::random).clone();
+		let options = RouteOptions {
+			hidden: false,
+			cost: info.cost,
+			auth: info.auth.clone(),
+			instance: Some((instance, info.epoch)),
+		};
+		let predecessor = predecessor.and_then(|route| route.state.server.as_ref());
+		self.serving_route(prefix, info, None, true, predecessor, options)
 	}
 
-	fn requests_inner(
+	fn serving_route(
 		&self,
 		prefix: impl TryInto<Path, Error: Into<Error>>,
-		route: Route,
-		publishes: bool,
+		info: RouteInfo,
+		publisher: Option<Producer>,
+		advertised: bool,
 		predecessor: Option<&kio::Shared<ServeState>>,
-	) -> Result<Requests, Error> {
+		options: RouteOptions,
+	) -> Result<Route, Error> {
 		let announcing = Announcing::new(self, prefix)?;
 		let serve = kio::Shared::<ServeState>::default();
 		serve.lock().requests.add_handler();
+		let instance = info.instance.clone().expect("the caller names the instance");
+		let epoch = info.epoch;
 		let announcement = announcing.announce(
-			route,
+			info,
 			Serving {
 				server: Some(serve.clone()),
 				source: None,
-				advertised: true,
+				advertised,
 			},
 			predecessor,
 		)?;
-		Ok(Requests {
+		Ok(Route::new(RouteState {
 			announcement,
-			state: serve,
-			publisher: publishes.then(|| self.clone()),
+			broadcast: None,
+			server: Some(serve),
+			publisher,
+			control: kio::Lock::new(RouteControl {
+				options,
+				instance,
+				epoch,
+				request: None,
+			}),
 			_keepalive: self.tasks.keepalive(),
-		})
+		}))
 	}
 
 	/// Returns a producer rooted at `root` and restricted to matching `patterns`.
@@ -2686,8 +2797,8 @@ impl Producer {
 }
 
 /// What it takes to insert a route: the prefixes it covers and the origin table
-/// to insert them into. Built by [`Producer::announce`], [`Producer::requests`],
-/// and [`Announcer`], which is the same advertisement re-issued from a broadcast.
+/// to insert them into. Built by [`Producer::route`], [`Producer::route_prefix`]
+/// and the advertise-only test helper.
 struct Announcing {
 	hop: Hop,
 	shared: SendCell<kio::Shared<OriginState>>,
@@ -2736,7 +2847,7 @@ impl Announcing {
 	/// beneath it, when it is one.
 	fn announce(
 		&self,
-		route: Route,
+		route: RouteInfo,
 		serving: Serving,
 		predecessor: Option<&kio::Shared<ServeState>>,
 	) -> Result<AnnounceProducer, Error> {
@@ -2788,14 +2899,14 @@ impl Announcing {
 		drop(shared);
 
 		// Ingress announce guard: held while the route is advertised.
-		let guard = serving
-			.advertised
-			.then(|| self.stats.ingress(&self.requested).announce());
+		let ingress = self.stats.ingress(&self.requested);
+		let guard = serving.advertised.then(|| ingress.announce());
 
 		Ok(AnnounceProducer {
 			shared: self.shared.clone(),
 			entries,
-			guard,
+			ingress,
+			guard: kio::Lock::new(guard),
 		})
 	}
 }
@@ -2807,123 +2918,356 @@ struct Serving {
 	advertised: bool,
 }
 
-/// An origin-owned broadcast publication, with a fill surface and its announcement capability.
+/// A route on an origin: an exact path owning one broadcast, or a prefix serving the
+/// requests beneath it.
+///
+/// On the publishing side ownership runs origin → route → broadcast → track → group →
+/// frame. Created by [`Producer::route`] (exact), [`Producer::route_prefix`] (prefix),
+/// or [`Request::route`] (the path's own exact route, answering a request).
 ///
-/// Clones share one broadcast and route. Closing the fill broadcast retracts the
-/// route for every clone. Dropping the last fill handle does the same; a cloned
-/// fill handle retains the publication even after the last `Publication` handle
-/// drops. Use [`Self::unannounce`] to withdraw earlier.
+/// A route mints its instance when it is created and keeps it for its lifetime, across
+/// [`withdraw`](Self::withdraw), [`announce`](Self::announce) and reconnects, since it
+/// owns the same broadcast and its sequences continue. A new run is a new route.
+///
+/// ```
+/// # fn run(origin: moq_net::origin::Producer) -> Result<(), moq_net::Error> {
+/// use moq_net::origin::RouteOptions;
+///
+/// // Fill the catalog before readers can find it.
+/// let route = origin.route("live/alice", RouteOptions::hidden())?;
+/// let _catalog = route.broadcast().create_track("catalog.json", Default::default())?;
+/// route.announce()?; // visible now, same instance
+/// route.set_cost(5)?; // re-prices in place
+/// route.withdraw(); // hidden; announce() again continues the same stream
+/// # Ok(())
+/// # }
+/// ```
+///
+/// Clones share one route. Dropping the last clone retracts it, and so does closing
+/// its broadcast. The broadcast lives on for the subscriptions already on it for as
+/// long as another of its producer handles does. The route keeps the origin's
+/// [`Driver`] running, so a publisher can drop every [`Producer`] and keep serving.
 #[derive(Clone)]
-pub struct Publication {
-	broadcast: broadcast::Producer,
+#[must_use = "dropping the last clone of a route retracts it"]
+pub struct Route {
+	state: Arc<RouteState>,
+}
+
+struct RouteState {
+	/// The advertisement, retracted on drop.
+	announcement: AnnounceProducer,
+	/// The broadcast an exact route owns.
+	broadcast: Option<broadcast::Producer>,
+	/// The queue a prefix route's requests arrive on.
+	server: Option<kio::Shared<ServeState>>,
+	/// Present for an application's prefix route, whose requests may create their own
+	/// exact routes. A session-forwarded request can only serve its peer's broadcast.
+	publisher: Option<Producer>,
+	control: kio::Lock<RouteControl>,
+	/// A route is lifecycle work: the origin's driver keeps running for as long as one
+	/// lives, even once every producer handle is gone.
+	_keepalive: Keepalive,
+}
+
+/// What a route advertises when it announces, changed under one lock so concurrent
+/// announces, withdrawals and re-prices land in order.
+struct RouteControl {
+	options: RouteOptions,
+	instance: Instance,
+	epoch: u64,
+	/// The request a job's route answers when it first announces.
+	request: Option<Request>,
+}
+
+impl RouteControl {
+	fn info(&self) -> RouteInfo {
+		self.options.info(&self.instance, self.epoch)
+	}
+}
+
+impl RouteState {
+	/// The broadcast closed: retract the route for good and refuse a job's unanswered
+	/// request.
+	fn ended(&self) {
+		// Retracted under the control lock, so an announce racing the close either lands
+		// first or finds the entries gone, never advertises after it.
+		let mut control = self.control.lock();
+		let request = control.request.take();
+		self.announcement.retract(false);
+		drop(control);
+		// Dropped outside every lock: refusing it wakes the requesters.
+		drop(request);
+	}
 }
 
-impl Publication {
-	/// The broadcast to fill, without announcement control.
+impl Route {
+	fn new(state: RouteState) -> Self {
+		Self { state: Arc::new(state) }
+	}
+
+	/// The broadcast this exact route owns, to fill with tracks.
+	///
+	/// # Panics
+	///
+	/// On a prefix route ([`Producer::route_prefix`]), which owns none: answer its
+	/// requests instead.
 	pub fn broadcast(&self) -> &broadcast::Producer {
-		&self.broadcast
+		self.state
+			.broadcast
+			.as_ref()
+			.expect("a prefix route owns no broadcast; answer its requests")
 	}
 
-	/// Advertise this publication's path or replace its route.
-	pub fn announce(&self, route: Route) -> Result<(), Error> {
-		self.broadcast.announce(route)
+	/// The stream this route serves, minted when it was created unless
+	/// [`RouteOptions::with_instance`] named one.
+	pub fn instance(&self) -> Instance {
+		self.state.control.lock().instance.clone()
 	}
 
-	/// Withdraw this publication while keeping its filled tracks alive.
-	pub fn unannounce(&self) {
-		self.broadcast.unannounce();
+	/// Make the route visible, or keep it so. Idempotent.
+	///
+	/// Visible to local consumers before it returns. A job's route ([`Request::route`])
+	/// also answers the requesters waiting on its path.
+	///
+	/// Fails with [`Error::Closed`] once the route's broadcast closed or the origin's
+	/// [`Driver`] was dropped, and with [`Error::Unroutable`], announcing nothing, when a
+	/// job's request was released or its prefix route retracted meanwhile: that route can
+	/// never announce.
+	pub fn announce(&self) -> Result<(), Error> {
+		let mut control = self.state.control.lock();
+		let info = control.info();
+		let Some(request) = control.request.take() else {
+			return self.state.announcement.update_if(info, None, |_| true).map(|_| ());
+		};
+		let answer = self.broadcast().consume();
+		let mut resolved = None;
+		// Answered under the table lock that every release takes first, so the route
+		// lands only for a request still pending and no release can slip in between.
+		// The answer continues what the prefix route served for the path: requesters
+		// waiting on it, and whatever resolved through the prefix route's current instance
+		// beneath it. Answered and taken over under one lock, so nothing resolves in between.
+		let admitted = self.state.announcement.update_if(info, Some(&request.home), |table| {
+			// The prefix route's entries leave the table before its retraction releases the
+			// request, so one gone from it no longer answers, even before that release.
+			let home = table.routes.covering(&request.path).any(|entry| {
+				entry
+					.server
+					.as_ref()
+					.is_some_and(|server| server.same_channel(&request.home))
+			});
+			if !home {
+				return false;
+			}
+			// The exact route owns this answer's availability. Caching it under the
+			// prefix would keep serving it after this route is withdrawn.
+			resolved = request
+				.home
+				.lock()
+				.take(&request.path, &request.producer)
+				.map(|()| Ok(answer));
+			resolved.is_some()
+		});
+		let Some(resolved) = resolved.filter(|_| matches!(admitted, Ok(true))) else {
+			// A failed answer can never announce. Retracted under the control lock, as
+			// `ended` does, so a clone's racing announce finds the entries gone rather than
+			// advertising through the ordinary branch now that the request is taken.
+			self.state.announcement.retract(false);
+			drop(control);
+			return Err(admitted.err().unwrap_or(Error::Unroutable));
+		};
+		drop(control);
+		// Woken outside every lock: a front re-entering the table must not find it held.
+		if let Ok(mut pending) = request.producer.write() {
+			pending.resolved.get_or_insert(resolved);
+		}
+		Ok(())
 	}
 
-	/// The route this publication currently advertises, if any.
-	pub fn route(&self) -> Option<Route> {
-		self.broadcast.route()
+	/// Hide the route from everyone, local and remote alike, keeping its broadcast and
+	/// instance: [`Self::announce`] brings the same stream back. Requests for the path
+	/// fail with [`Error::Unroutable`] meanwhile, while tracks already in flight carry
+	/// on to their own end. Idempotent.
+	pub fn withdraw(&self) {
+		let _control = self.state.control.lock();
+		self.state.announcement.withdraw();
 	}
-}
 
-impl std::ops::Deref for Publication {
-	type Target = broadcast::Producer;
+	/// Whether the route is visible.
+	pub fn is_announced(&self) -> bool {
+		self.state.announcement.route().is_some()
+	}
 
-	fn deref(&self) -> &Self::Target {
-		&self.broadcast
+	/// Re-price the route: lower wins among routes covering the same prefix and anonymity.
+	/// A visible route changes in place, as an update to its readers; a hidden one
+	/// keeps the price for when it next announces.
+	///
+	/// Fails with [`Error::Closed`] once the route's broadcast closed or the origin's
+	/// [`Driver`] was dropped.
+	pub fn set_cost(&self, cost: impl Into<Cost>) -> Result<(), Error> {
+		let cost = cost.into();
+		self.change(|options| options.cost = cost)
 	}
-}
 
-/// The table entry a broadcast owns: its exact path, advertised and withdrawn
-/// through [`Publication::announce`] and
-/// [`Publication::unannounce`], and removed when the broadcast ends.
-///
-/// Handed to the broadcast by [`Producer::create_broadcast`], so a standalone
-/// broadcast has none and cannot announce.
-pub(super) struct Announcer {
-	entry: AnnounceProducer,
-	/// The ingress counters an advertised interval's announce guard comes from.
-	ingress: stats::Scope,
-	/// A published broadcast is lifecycle work: the origin's driver keeps
-	/// running for as long as one lives, even once every producer handle is
-	/// gone, so a session handed a producer can drop it and keep serving.
-	_keepalive: Keepalive,
-}
+	/// Swap the credential the advertising request carries; see [`RouteOptions::with_auth`].
+	/// `None` advertises under the session's scope.
+	///
+	/// Fails with [`Error::Closed`] once the route's broadcast closed or the origin's
+	/// [`Driver`] was dropped.
+	pub fn set_auth(&self, auth: Option<crate::auth::Credential>) -> Result<(), Error> {
+		self.change(|options| options.auth = auth)
+	}
 
-impl Announcer {
-	/// Advertise the broadcast's path with `route`, or re-price it in place.
-	pub(super) fn announce(&mut self, route: Route) -> Result<(), Error> {
-		self.announce_if(route, None, || true).map(|_| ())
+	fn change(&self, update: impl FnOnce(&mut RouteOptions)) -> Result<(), Error> {
+		let mut control = self.state.control.lock();
+		update(&mut control.options);
+		if !self.state.announcement.is_live()? {
+			return Ok(());
+		}
+		self.state
+			.announcement
+			.update_if(control.info(), None, |_| true)
+			.map(|_| ())
 	}
 
-	/// [`Self::announce`] once `admit` agrees; see [`AnnounceProducer::update_if`].
-	pub(super) fn announce_if(
-		&mut self,
-		route: Route,
-		predecessor: Option<&kio::Shared<ServeState>>,
-		admit: impl FnOnce() -> bool,
-	) -> Result<bool, Error> {
-		if !self.entry.update_if(route, predecessor, admit)? {
-			return Ok(false);
+	/// The next path a consumer requests under this prefix route, as a [`Request`] to answer.
+	///
+	/// Takes `&self` so a handler can answer from one task while another re-prices the
+	/// route; concurrent callers each receive distinct requests. Returns `None` once the
+	/// route is retracted or the origin's [`Driver`] was dropped, so handler loops end,
+	/// and at once on an exact route, which yields no requests.
+	#[cfg_attr(feature = "async", kio::wrapper)]
+	pub fn poll_requested(&self, waiter: &kio::Waiter) -> Poll<Option<Request>> {
+		let Some(server) = &self.state.server else {
+			return Poll::Ready(None);
+		};
+		let mut state = ready!(server.poll(waiter, |state| {
+			if state.closed || state.requests.has_queued() {
+				Poll::Ready(())
+			} else {
+				Poll::Pending
+			}
+		}));
+
+		// The teardown already drained the queue, so there is nothing left to pop.
+		if state.closed {
+			return Poll::Ready(None);
 		}
-		if self.entry.guard.is_none() {
-			self.entry.guard = Some(self.ingress.announce());
+
+		let path = state.requests.pop().expect("predicate guaranteed a request");
+		// The popped request stays pending, so a repeat request in the window between
+		// hand-off and answer coalesces onto it instead of re-invoking the handler. The
+		// producer is a shared clone; answering or dropping the `Request` removes the
+		// entry. This mirrors how `poll_requested_track` keeps a served track
+		// discoverable via the weak cache across the same window.
+		let producer = state.requests.get(&path).expect("popped key must be pending").clone();
+		Poll::Ready(Some(Request {
+			path,
+			producer,
+			home: server.clone(),
+			publisher: self.state.publisher.clone(),
+		}))
+	}
+
+	/// The route metadata as advertised, or `None` while hidden.
+	#[cfg(test)]
+	pub(crate) fn route(&self) -> Option<RouteInfo> {
+		self.state.announcement.route()
+	}
+
+	/// Announce with `info` as given, instance included when it names one, as a
+	/// session's update does: for tests that shape an exact route's metadata.
+	#[cfg(all(test, feature = "async"))]
+	pub(crate) fn announce_info(&self, mut info: RouteInfo) -> Result<(), Error> {
+		let mut control = self.state.control.lock();
+		match &info.instance {
+			Some(instance) => {
+				control.instance = instance.clone();
+				control.epoch = info.epoch;
+			}
+			None => {
+				info.instance = Some(control.instance.clone());
+				info.epoch = control.epoch;
+			}
 		}
-		Ok(true)
+		control.options.cost = info.cost;
+		control.options.auth = info.auth.clone();
+		self.state.announcement.update_if(info, None, |_| true).map(|_| ())
 	}
 
-	/// Withdraw the advertisement from local and remote consumers alike.
-	pub(super) fn withdraw(&mut self) {
-		self.entry.withdraw();
-		self.entry.guard = None;
+	/// The queue a prefix route's requests arrive on, for tests that inspect it.
+	#[cfg(test)]
+	fn server(&self) -> &kio::Shared<ServeState> {
+		self.state.server.as_ref().expect("a prefix route has a server")
+	}
+
+	/// Replace a forwarded route's metadata in place, taken as given.
+	///
+	/// A route naming no [`RouteInfo::instance`], or the same one, re-prices: consumers
+	/// observe an update and every handle survives. Another instance is another stream:
+	/// consumers see a restart, and a re-request never joins what was resolved under the
+	/// old one. Requests still waiting on this handle carry over: the handler is asked
+	/// again under the new instance, and its answer to a request asked before the change
+	/// is dropped, never served under the new one. A request pinned to the old instance
+	/// is refused with [`Error::Unroutable`]. The answers already served are forgotten,
+	/// so the next request for one of those paths asks the handler again too. The
+	/// broadcasts it served keep running for the subscriptions already on them.
+	///
+	/// Fails with [`Error::Closed`] once the origin's [`Driver`] has been dropped.
+	#[cfg(any(feature = "async", test))]
+	pub(crate) fn update(&self, info: RouteInfo) -> Result<(), Error> {
+		let mut control = self.state.control.lock();
+		if let Some(instance) = &info.instance {
+			control.instance = instance.clone();
+			control.epoch = info.epoch;
+		}
+		control.options.cost = info.cost;
+		control.options.auth = info.auth.clone();
+		self.state.announcement.update(info)
+	}
+
+	/// Retire an explicit peer withdrawal, hiding derived paths only once its
+	/// last live advertisement at the prefix is gone. A lost session just drops.
+	#[cfg_attr(not(feature = "async"), allow(dead_code, reason = "async-only"))]
+	pub(crate) fn withdrawn(self) {
+		self.state.announcement.retract(true);
 	}
+}
 
-	/// The route the broadcast's path is advertised with, if it is.
-	pub(super) fn route(&self) -> Option<Route> {
-		self.entry.route()
+impl Drop for RouteState {
+	fn drop(&mut self) {
+		// Retract before a job's unanswered request drops, so its requesters are refused
+		// rather than asked again through this route.
+		self.announcement.retract(false);
 	}
 }
 
 /// The write half of an advertisement: a live claim that paths under a
 /// [`Pattern`] can be served.
 ///
-/// Held by a [`Requests`] and by a broadcast's [`Announcer`]; dropping it
-/// retracts the route, which [`Routes`]s observe and sessions withdraw
-/// from their peers.
+/// Held by a [`Route`]; dropping it retracts the route, which [`Routes`]s
+/// observe and sessions withdraw from their peers.
 #[must_use = "dropping an announcement retracts the route"]
 pub(crate) struct AnnounceProducer {
 	shared: SendCell<kio::Shared<OriginState>>,
 	/// The table entries this advertisement created, by prefix and id. A prefix
 	/// remains unchanged; pattern scopes only filter its visibility and requests.
 	entries: Vec<(Path, u64)>,
+	/// The ingress counters an advertised interval's announce guard comes from.
+	ingress: stats::Scope,
 	/// Ingress announce stats guard, held only while the entries are advertised.
-	guard: Option<stats::Announce>,
+	guard: kio::Lock<Option<stats::Announce>>,
 }
 
 impl AnnounceProducer {
 	/// Replace the route in place, instance included when it names one; see
-	/// [`Requests::update_route`].
+	/// [`Route::update`].
 	///
-	/// The prefix is fixed at announce time and a [`Route`] cannot name one: to
+	/// The prefix is fixed at announce time and a [`RouteInfo`] cannot name one: to
 	/// move an advertisement, drop this and announce again. Fails with
 	/// [`Error::Closed`] once the origin's [`Driver`] has been dropped.
 	#[cfg(any(feature = "async", test))]
-	pub fn update(&self, route: Route) -> Result<(), Error> {
-		self.update_if(route, None, || true).map(|_| ())
+	pub fn update(&self, route: RouteInfo) -> Result<(), Error> {
+		self.update_if(route, None, |_| true).map(|_| ())
 	}
 
 	/// [`Self::update`] once `admit` agrees, returning whether it did. `admit` runs
@@ -2932,11 +3276,11 @@ impl AnnounceProducer {
 	///
 	/// An entry advertised by this update continues what `predecessor`, a covering
 	/// served route, served beneath it; see [`Takeover`].
-	pub(super) fn update_if(
+	fn update_if(
 		&self,
-		route: Route,
+		route: RouteInfo,
 		predecessor: Option<&kio::Shared<ServeState>>,
-		admit: impl FnOnce() -> bool,
+		admit: impl FnOnce(&OriginState) -> bool,
 	) -> Result<bool, Error> {
 		let mut shared = self.shared.lock();
 		if shared.closed {
@@ -2949,7 +3293,7 @@ impl AnnounceProducer {
 		{
 			return Err(Error::Closed);
 		}
-		if !admit() {
+		if !admit(&shared) {
 			return Ok(false);
 		}
 		// The requests an instance change released, refused once the table lock is gone: the
@@ -2998,6 +3342,9 @@ impl AnnounceProducer {
 			shared.sync_route(prefix, &claim);
 			shared.prune_withdrawn(prefix);
 		}
+		// Under the table lock, as withdrawing and retracting clear it, so a racing one
+		// never leaves the guard held for entries no longer advertised.
+		self.guard.lock().get_or_insert_with(|| self.ingress.announce());
 		drop(shared);
 		for producer in released {
 			if let Ok(mut request) = producer.write() {
@@ -3007,12 +3354,25 @@ impl AnnounceProducer {
 		Ok(true)
 	}
 
+	/// Whether the entries are advertised, or [`Error::Closed`] once they are gone.
+	fn is_live(&self) -> Result<bool, Error> {
+		let shared = self.shared.lock();
+		if shared.closed {
+			return Err(Error::Closed);
+		}
+		let mut advertised = false;
+		for (prefix, id) in &self.entries {
+			advertised |= shared.routes.entry(prefix, *id).ok_or(Error::Closed)?.advertised;
+		}
+		Ok(advertised)
+	}
+
 	/// The route as last given, while advertised: every entry carries the same one.
-	pub(crate) fn route(&self) -> Option<Route> {
+	pub(crate) fn route(&self) -> Option<RouteInfo> {
 		let shared = self.shared.lock();
 		let (prefix, id) = self.entries.first()?;
 		let entry = shared.routes.entry(prefix, *id).filter(|entry| entry.advertised)?;
-		Some(Route {
+		Some(RouteInfo {
 			instance: Some(entry.instance.clone()),
 			epoch: entry.epoch,
 			hops: entry.hops.clone(),
@@ -3025,10 +3385,15 @@ impl AnnounceProducer {
 
 	/// Hide the entries from everyone, local and remote alike: cursors see a
 	/// retraction and requests stop resolving through them. The entries stay,
-	/// so announcing again restores the same route. What
-	/// [`Publication::unannounce`] does.
+	/// so announcing again restores the same route. What [`Route::withdraw`] does.
+	///
+	/// A prefix route's pending requests, queued or handed to a handler, are released
+	/// under the table lock, so an answer prepared for one, such as a hidden job route,
+	/// can no longer land once the route is withdrawn.
 	fn withdraw(&self) {
 		let mut shared = self.shared.lock();
+		let guard = self.guard.lock().take();
+		let mut released = Vec::new();
 		for (prefix, id) in &self.entries {
 			let Some(entry) = shared.routes.entry_mut(prefix, *id) else {
 				continue;
@@ -3037,15 +3402,28 @@ impl AnnounceProducer {
 				continue;
 			}
 			entry.advertised = false;
+			if let Some(server) = &entry.server {
+				released.extend(server.lock().renew());
+			}
 			let claim = entry.claim.clone();
 			shared.sync_route(prefix, &claim);
 		}
+		drop(shared);
+		drop(guard);
+		// Refused once the table lock is gone: the refusal wakes their fronts, which read
+		// the table.
+		for producer in released {
+			if let Ok(mut request) = producer.write() {
+				request.resolved.get_or_insert(Err(Error::Unroutable));
+			}
+		}
 	}
 
 	/// Retract the route now: remove its table entries and reject anything still
 	/// waiting on its queue. Idempotent, and what dropping the advertisement does.
 	fn retract(&self, withdrawn: bool) {
 		let mut shared = self.shared.lock();
+		let guard = self.guard.lock().take();
 		let mut servers = Vec::new();
 		for (prefix, id) in &self.entries {
 			let Some(entry) = shared.routes.remove(prefix, *id) else {
@@ -3071,10 +3449,12 @@ impl AnnounceProducer {
 			shared.prune_withdrawn(&entry.prefix);
 		}
 		drop(shared);
+		drop(guard);
 		// Reject anything still waiting on this route's server; a request already
 		// handed to the handler resolves through its own `Request`. Closing wakes
 		// the server's waiters, so it runs after the table unlocks; the entries
-		// already left it, so nothing new routes here meanwhile.
+		// already left it, so nothing new routes here meanwhile, and a job route
+		// answering one of them finds its prefix route gone (see [`Route::announce`]).
 		for server in servers {
 			let released = {
 				let mut server = server.lock();
@@ -3099,13 +3479,12 @@ impl Drop for AnnounceProducer {
 /// Drives origin lifecycle work and cache expiration with caller-supplied time.
 ///
 /// Returned by [`Producer::new`]. Poll on external activity or at the deadline
-/// it returns, supplying nondecreasing instants. Route changes, track serving, linger,
+/// it returns, supplying nondecreasing instants. RouteInfo changes, track serving, linger,
 /// failover, and teardown run here; the route table and announce cursors update
 /// synchronously when a route is announced or retracted.
 ///
 /// It holds no [`Producer`] clone, so it never keeps the origin alive. It
-/// finishes once every owner is gone: each [`Producer`] clone, published
-/// broadcast, and [`Requests`]. Read handles ([`Consumer`], [`Routes`])
+/// finishes once every owner is gone: each [`Producer`] clone and [`Route`]. Read handles ([`Consumer`], [`Routes`])
 /// are not owners. Dropping it aborts active fronts, rejects pending requests,
 /// ends announcements, and makes subsequent producer mutations fail with
 /// [`Error::Closed`].
@@ -3136,8 +3515,7 @@ impl Driver {
 	/// Process ready origin work using caller-supplied monotonic time.
 	///
 	/// See [`crate::time::Driver`] for the contract. Finishes with
-	/// [`Error::Closed`] once every owner (a [`Producer`] clone, published
-	/// broadcast, or [`Requests`]) has dropped and the remaining lifecycle work
+	/// [`Error::Closed`] once every owner (a [`Producer`] clone or [`Route`]) has dropped and the remaining lifecycle work
 	/// has drained.
 	pub fn poll(&mut self, now: Instant, waiter: &kio::Waiter) -> Result<Option<Instant>, Error> {
 		waiter.batch(|| {
@@ -3179,7 +3557,7 @@ impl DriverState {
 		drop(std::mem::replace(&mut self.set, TaskSet::owned()));
 
 		// Refuse new work and take the pending requests, under the same lock
-		// `create_broadcast` holds across its attach: a concurrent create either
+		// `route` holds across its attach: a concurrent create either
 		// finishes before this (the walk below cleans its entry up) or observes
 		// `closed` and fails with `Closed`.
 		let (servers, cursors, fronts) = {
@@ -4057,13 +4435,24 @@ impl kio::Task for FrontServe {
 								self.broadcast.serve_datagrams_from(self.sources.get(&source).cloned());
 							}
 							self.resolved = Some(instance.clone());
+							// Under the table's lock, as each takeover carries the front: a route
+							// that took over the one asked before this answer landed (a job route
+							// answering its prefix route's request) continues it, so requesters
+							// get its instance rather than one already superseded.
+							let table = self.shared.read();
 							if let Ok(mut pending) = self.request.write()
 								&& pending.resolved.is_none()
 							{
 								pending.first = Some(instance.clone());
 								pending.resolved = Some(Ok(instance));
 								pending.via = Some((route, asked));
+								if let Some(best) =
+									table.best_route(&self.path, self.horizon, &HashSet::new(), |_| true)
+								{
+									PendingFront::continue_with(&mut pending, best);
+								}
 							}
+							drop(table);
 						}
 						Action::Query { track: name, source } => {
 							let Some(io) = self.tracks.get_mut(&name) else { continue };
@@ -5290,7 +5679,7 @@ struct OriginState {
 	// The announced routes, keyed by prefix. The table holds one entry per live
 	// advertisement, not one per broadcast consumer.
 	routes: RouteTable,
-	// Route ids.
+	// RouteInfo ids.
 	next_route: u64,
 	next_watch: u64,
 	next_snapshot: u64,
@@ -5307,7 +5696,7 @@ struct OriginState {
 	fronts: WeakCache<FrontKey, RemoteFront>,
 
 	// Peers that withdrew a prefix while routes there still passed through them,
-	// which are stale. See [`Requests::withdrawn`].
+	// which are stale. See [`Route::withdrawn`].
 	withdrawn: HashMap<Path, HashSet<Hop>>,
 
 	// Set when the origin's driver dropped: new requests fail with `Closed`
@@ -5863,46 +6252,17 @@ impl FrontWatch {
 	}
 }
 
-/// A served route, from [`Producer::requests`]: advertises a path prefix and
-/// answers the [`Consumer::request`] calls beneath it.
-///
-/// The origin-level analogue of [`broadcast::Requests`]: where that serves tracks
-/// on demand within a broadcast, this serves whole broadcasts on demand within
-/// an origin. A relay holds one per route a peer announces to it, materializing
-/// a requested path from that peer; an application holds one to answer a
-/// subtree it never publishes ahead of time.
-///
-/// Drop it to retract the route and reject the requests still waiting to be
-/// served.
-///
-/// It keeps the origin's [`Driver`] running, like a published broadcast: a
-/// handler can drop every [`Producer`] and keep serving.
-#[must_use = "dropping an origin::Requests retracts the route"]
-pub struct Requests {
-	/// The advertisement, retracted on drop.
-	announcement: AnnounceProducer,
-	state: kio::Shared<ServeState>,
-	/// Present for application claims, which publish each answer as an exact route.
-	publisher: Option<Producer>,
-	/// Producer-side children pin their parent where no cycle exists. The
-	/// origin's state holds only the [`ServeState`], never this handle, so the
-	/// driver cannot keep itself alive.
-	_keepalive: Keepalive,
-}
-
-impl Requests {
+impl Route {
 	#[cfg_attr(not(feature = "async"), allow(dead_code, reason = "async-only"))]
 	pub(super) fn request_validity(&self, path: &Path) -> Option<Selection> {
-		let shared = &self.announcement.shared;
+		let shared = &self.state.announcement.shared;
+		let server = self.state.server.as_ref()?;
 		let mut table = shared.lock();
 		if table.closed {
 			return None;
 		}
 		let entry = table.best_route(path, Horizon::default(), &HashSet::new(), |entry| {
-			entry
-				.server
-				.as_ref()
-				.is_some_and(|server| server.same_channel(&self.state))
+			entry.server.as_ref().is_some_and(|entry| entry.same_channel(server))
 		})?;
 		let via = entry.via;
 		let instance = entry.instance.clone();
@@ -5935,77 +6295,6 @@ impl Requests {
 			signal,
 		})
 	}
-
-	/// Retire an explicit peer withdrawal, hiding derived paths only once its
-	/// last live advertisement at the prefix is gone. A lost session just drops.
-	#[cfg_attr(not(feature = "async"), allow(dead_code, reason = "async-only"))]
-	pub(crate) fn withdrawn(self) {
-		self.announcement.retract(true);
-	}
-
-	/// The route this handle advertises, as last given.
-	pub fn route(&self) -> Route {
-		self.announcement
-			.route()
-			.expect("a dynamic route stands until its handle drops")
-	}
-
-	/// Replace the route in place, taken as given.
-	///
-	/// A route naming no [`Route::instance`], or the same one, re-prices: consumers observe
-	/// an update and every handle survives. Another instance is another stream: consumers
-	/// see an [`RouteEvent::Restart`], and a re-request never joins what was resolved
-	/// under the old one. Requests still waiting on this handle carry over: the handler is
-	/// asked again under the new instance, and its answer to a request asked before the
-	/// change is dropped, never served under the new one. A request pinned to the old
-	/// instance is refused with [`Error::Unroutable`]. The answers already served are
-	/// forgotten, so the next request for one of those paths asks the handler again too.
-	/// The broadcasts it served keep running for the subscriptions already on them; close
-	/// them to end those too.
-	///
-	/// The prefix is fixed at announce time: to move a route, drop this and call
-	/// [`Producer::requests`] again. Fails with [`Error::Closed`] once the origin's
-	/// [`Driver`] has been dropped.
-	#[cfg(any(feature = "async", test))]
-	pub(crate) fn update_route(&self, route: Route) -> Result<(), Error> {
-		self.announcement.update(route)
-	}
-
-	/// The next path a consumer requests under this route, as a [`Request`] to serve.
-	///
-	/// Takes `&self` so a handler can serve from one task while another re-prices
-	/// the route; concurrent callers each receive distinct requests. Returns
-	/// [`Error::Closed`] once the origin's [`Driver`] has been dropped: no request will
-	/// ever arrive again, so handler loops should end.
-	#[cfg_attr(feature = "async", kio::wrapper)]
-	pub fn poll_requested_broadcast(&self, waiter: &kio::Waiter) -> Poll<Result<Request, Error>> {
-		let mut state = ready!(self.state.poll(waiter, |state| {
-			if state.closed || state.requests.has_queued() {
-				Poll::Ready(())
-			} else {
-				Poll::Pending
-			}
-		}));
-
-		// The teardown already drained the queue, so there is nothing left to pop.
-		if state.closed {
-			return Poll::Ready(Err(Error::Closed));
-		}
-
-		let path = state.requests.pop().expect("predicate guaranteed a request");
-		// The popped request stays pending, so a repeat request in the window between
-		// hand-off and accept coalesces onto it instead of re-invoking the handler. The
-		// producer is a shared clone; `Request::{accept, reject, drop}` removes the
-		// entry. This mirrors how `poll_requested_track` keeps a served track
-		// discoverable via the weak cache across the same window.
-		let producer = state.requests.get(&path).expect("popped key must be pending").clone();
-		Poll::Ready(Ok(Request {
-			path,
-			producer,
-			home: self.state.clone(),
-			publisher: self.publisher.clone(),
-		}))
-	}
 }
 
 impl ServeState {
@@ -6100,10 +6389,11 @@ impl ServeState {
 
 /// A pending request for a broadcast to be served on demand.
 ///
-/// Yielded by [`Requests::poll_requested_broadcast`]. The requester is awaiting inside
-/// [`Consumer::request`]; [`prepare`](Self::prepare) then [`Prepared::publish`]
-/// resolves it with a new exact-path broadcast, [`serve`](Self::serve) answers with a held
-/// broadcast, and [`reject`](Self::reject) resolves it with an error. Dropping it rejects it.
+/// Yielded by [`Route::requested`]. The requester is awaiting inside
+/// [`Consumer::request`]. Answer it one of three ways: [`serve`](Self::serve) a
+/// broadcast already held, under the prefix route's instance; create the path's own
+/// exact route with [`route`](Self::route), under a fresh instance; or
+/// [`reject`](Self::reject) it with an error. Dropping it rejects it.
 ///
 /// Serve a held broadcast without announcing an exact route:
 ///
@@ -6124,7 +6414,7 @@ pub struct Request {
 	// broadcast for repeat requests.
 	home: kio::Shared<ServeState>,
 
-	// Applications can prepare answers in this origin; a session-forwarded request
+	// Applications can create routes in this origin; a session-forwarded request
 	// can only serve its peer's already-routed broadcast.
 	publisher: Option<Producer>,
 }
@@ -6135,15 +6425,24 @@ impl Request {
 		&self.path
 	}
 
-	/// Start an answer under a fresh random instance, hidden until it is published.
-	pub fn prepare(self) -> Result<Prepared, Error> {
+	/// Answer with the path's own exact route, owning a new broadcast.
+	///
+	/// The route serves a fresh instance unless `options` names one, so a job that ends
+	/// and restarts beneath the same prefix is a new stream for its restarted sequences.
+	/// Ending the route withdraws only this path: the prefix route keeps answering later
+	/// requests. Created visible, the route announces now and answers the requesters
+	/// waiting on its path. Created [`RouteOptions::hidden`], they wait until
+	/// [`Route::announce`], so the job can fill its catalog first; dropping the route
+	/// before then refuses them.
+	///
+	/// Fails with [`Error::Unroutable`] on a request a session forwarded, which can only
+	/// [`serve`](Self::serve) its peer's broadcast, and, announcing nothing, once the
+	/// request was released or its prefix route retracted. Otherwise it fails as
+	/// [`Producer::route`] does.
+	pub fn route(self, options: RouteOptions) -> Result<Route, Error> {
 		let publisher = self.publisher.clone().ok_or(Error::Unroutable)?;
-		let (broadcast, announcer) = publisher.create_withheld(self.path.clone())?;
-		Ok(Prepared {
-			request: self,
-			broadcast,
-			announcer,
-		})
+		let path = self.path.clone();
+		publisher.exact(path, options, Some(self))
 	}
 
 	/// Serve a held broadcast under this prefix route without announcing an exact route.
@@ -6151,7 +6450,7 @@ impl Request {
 	/// The answer belongs to the prefix route's instance at this path: every answer for
 	/// that path must continue the same sequence space and bytes. Start a new prefix
 	/// route to serve different content there. For a job that may restart independently,
-	/// use [`Self::prepare`] and [`Prepared::publish`] to announce its own instance.
+	/// use [`Self::route`] to announce its own instance.
 	pub fn serve(self, broadcast: impl Consume<broadcast::Consumer>) {
 		let broadcast = broadcast.consume();
 		let _ = ServeState::resolve(&self.home, &self.path, &self.producer, Ok(broadcast));
@@ -6164,63 +6463,6 @@ impl Request {
 	}
 }
 
-/// A claim answer being filled before its exact route is announced.
-///
-/// Dropping it unpublished refuses the request, as dropping a [`Request`] does.
-pub struct Prepared {
-	request: Request,
-	broadcast: broadcast::Producer,
-	// Withheld from the broadcast until `publish`, so the answer cannot announce
-	// itself under another instance or skip the request's admission.
-	announcer: Announcer,
-}
-
-impl Prepared {
-	/// The unannounced fill surface; only [`Self::publish`] can announce the answer.
-	pub fn broadcast(&self) -> &broadcast::Producer {
-		&self.broadcast
-	}
-
-	/// Announce the filled broadcast and resolve every requester waiting for it.
-	///
-	/// Fails with [`Error::Unroutable`], announcing nothing, once the request was
-	/// released or its claim retracted, or with [`Error::Closed`] once the broadcast
-	/// closed. A failed answer can never announce.
-	pub fn publish(self) -> Result<Publication, Error> {
-		let Self {
-			request,
-			broadcast,
-			announcer,
-		} = self;
-		let route = Route::default();
-		let answer = broadcast.consume();
-		let mut resolved = None;
-		// Answered under the table lock that every release takes first, so the route
-		// lands only for a request still pending and no release can slip in between.
-		// The answer continues what the claim served for the path: requesters waiting on it,
-		// and whatever resolved through the claim's current instance beneath it. Answered
-		// and taken over under one lock, so nothing resolves in between.
-		let admitted = broadcast.announce_withheld(announcer, route, Some(&request.home), || {
-			// The exact route owns this answer's availability. Caching it under the
-			// prefix would keep serving it after that route is withdrawn.
-			resolved = request
-				.home
-				.lock()
-				.take(&request.path, &request.producer)
-				.map(|()| Ok(answer));
-			resolved.is_some()
-		})?;
-		let Some(resolved) = resolved.filter(|_| admitted) else {
-			return Err(Error::Unroutable);
-		};
-		// Woken outside every lock: a front re-entering the table must not find it held.
-		if let Ok(mut pending) = request.producer.write() {
-			pending.resolved.get_or_insert(resolved);
-		}
-		Ok(Publication { broadcast })
-	}
-}
-
 impl Drop for Request {
 	fn drop(&mut self) {
 		// Handed off but neither accepted nor rejected: drop the still-pending entry so its
@@ -6610,7 +6852,7 @@ pub struct Consumer {
 	interested: bool,
 
 	// The cache policy remote fronts inherit, mirroring what
-	// `create_broadcast` gives a local front.
+	// `route` gives a local front.
 	pool: cache::Pool,
 	cache_duration: Duration,
 
@@ -7350,7 +7592,10 @@ impl Routes {
 	}
 
 	#[cfg(test)]
-	pub(crate) async fn expect_next_active(&mut self, expected: impl TryInto<Path, Error: std::fmt::Debug>) -> Route {
+	pub(crate) async fn expect_next_active(
+		&mut self,
+		expected: impl TryInto<Path, Error: std::fmt::Debug>,
+	) -> RouteInfo {
 		let event = self.expect_next().await;
 		Self::active(event, &expected.try_into().expect("expected path"))
 	}
@@ -7359,7 +7604,7 @@ impl Routes {
 	pub(crate) async fn expect_next_restarted(
 		&mut self,
 		expected: impl TryInto<Path, Error: std::fmt::Debug>,
-	) -> Route {
+	) -> RouteInfo {
 		match self.expect_next().await {
 			RouteEvent::Restart(announce) => {
 				assert_eq!(
@@ -7734,7 +7979,7 @@ use futures::FutureExt;
 #[expect(missing_docs, reason = "test-only assertion helpers")]
 impl Routes {
 	/// The route of an active event at `expected`.
-	fn active(event: RouteEvent, expected: &Path) -> Route {
+	fn active(event: RouteEvent, expected: &Path) -> RouteInfo {
 		match event {
 			RouteEvent::Start(announce) | RouteEvent::Update(announce) | RouteEvent::Restart(announce) => {
 				assert_eq!(announce.prefix, *expected, "wrong prefix");
@@ -7745,7 +7990,7 @@ impl Routes {
 	}
 
 	/// The next update must be an active route at `expected`; returns it.
-	pub fn assert_next_active(&mut self, expected: impl TryInto<Path, Error: std::fmt::Debug>) -> Route {
+	pub fn assert_next_active(&mut self, expected: impl TryInto<Path, Error: std::fmt::Debug>) -> RouteInfo {
 		let event = kio::wait(|waiter| self.poll_next(waiter))
 			.now_or_never()
 			.expect("next blocked")
@@ -7754,13 +7999,13 @@ impl Routes {
 	}
 
 	/// The `try_next` counterpart of [`Self::assert_next_active`].
-	pub fn assert_try_next_active(&mut self, expected: impl TryInto<Path, Error: std::fmt::Debug>) -> Route {
+	pub fn assert_try_next_active(&mut self, expected: impl TryInto<Path, Error: std::fmt::Debug>) -> RouteInfo {
 		let event = self.try_next().expect("no next");
 		Self::active(event, &expected.try_into().expect("expected path"))
 	}
 
 	/// The next update must be a restart at `expected`; returns its route.
-	pub fn assert_next_restarted(&mut self, expected: impl TryInto<Path, Error: std::fmt::Debug>) -> Route {
+	pub fn assert_next_restarted(&mut self, expected: impl TryInto<Path, Error: std::fmt::Debug>) -> RouteInfo {
 		match kio::wait(|waiter| self.poll_next(waiter))
 			.now_or_never()
 			.expect("next blocked")
@@ -7847,8 +8092,8 @@ impl ProduceTest for Hop {
 #[cfg(all(test, feature = "async"))]
 pub(crate) struct TestSelection {
 	origin: Producer,
-	route: Option<Requests>,
-	replacement: Option<Requests>,
+	route: Option<Route>,
+	replacement: Option<Route>,
 }
 
 #[cfg(all(test, feature = "async"))]
@@ -7858,7 +8103,11 @@ impl TestSelection {
 	pub(crate) fn new() -> Self {
 		let origin = Hop::new(1).unwrap().produce();
 		let route = origin
-			.requests_route("room", Route::default().with_via(Hop::new(Self::PEER).unwrap()), None)
+			.forward(
+				"room",
+				RouteInfo::default().with_via(Hop::new(Self::PEER).unwrap()),
+				None,
+			)
 			.unwrap();
 		Self {
 			origin,
@@ -7879,8 +8128,8 @@ impl TestSelection {
 
 	/// Another instance of the peer takes the path.
 	pub(crate) fn replace(&mut self) {
-		let route = Route::default().with_via(Hop::new(Self::PEER).unwrap());
-		self.replacement = Some(self.origin.requests_route("room/a", route, None).unwrap());
+		let route = RouteInfo::default().with_via(Hop::new(Self::PEER).unwrap());
+		self.replacement = Some(self.origin.forward("room/a", route, None).unwrap());
 	}
 }
 
@@ -7944,14 +8193,14 @@ mod tests {
 		let waiter = kio::Waiter::noop();
 		let (producer, mut driver) = Producer::new(Config::new(origin(1)));
 		let server = producer
-			.requests_route("room", Route::default().with_hops(hops(&[10])), None)
+			.forward("room", RouteInfo::default().with_hops(hops(&[10])), None)
 			.unwrap();
 		let broadcast = broadcast::Info::new().produce();
 		let track = broadcast.reserve_track("video").unwrap();
 
 		let mut requesting = producer.consume().request("room", None);
 		driver.poll(now, &waiter).unwrap();
-		let Poll::Ready(Ok(request)) = server.poll_requested_broadcast(&waiter) else {
+		let Poll::Ready(Some(request)) = server.poll_requested(&waiter) else {
 			panic!("the route receives the request");
 		};
 		request.serve(&broadcast);
@@ -8061,10 +8310,10 @@ mod tests {
 
 	/// Yield to the driver until the server's front watcher delivers a request.
 	#[cfg(feature = "async")]
-	async fn queued(server: &Requests) -> Request {
+	async fn queued(server: &Route) -> Request {
 		let mut request = None;
-		settle(|| match server.poll_requested_broadcast(&kio::Waiter::noop()) {
-			Poll::Ready(Ok(popped)) => {
+		settle(|| match server.poll_requested(&kio::Waiter::noop()) {
+			Poll::Ready(Some(popped)) => {
 				request = Some(popped);
 				true
 			}
@@ -8096,7 +8345,7 @@ mod tests {
 		let mut announced = consumer.routes();
 		announced.assert_next_wait();
 
-		let announcement = producer.announce("room/alice", Route::default()).unwrap();
+		let announcement = producer.announce("room/alice", RouteInfo::default()).unwrap();
 		let route = announced.expect_next_active("room/alice").await;
 		assert!(route.hops.is_empty());
 		assert_eq!(route.cost, Cost::default());
@@ -8115,7 +8364,7 @@ mod tests {
 		let mut announced = producer.consume().routes();
 		assert!(!announced.is_synced(), "a snapshot in flight holds it");
 
-		let _alice = producer.announce("room/alice", Route::default()).unwrap();
+		let _alice = producer.announce("room/alice", RouteInfo::default()).unwrap();
 		drop(snapshot);
 		assert!(!announced.is_synced(), "never before an earlier event is read");
 
@@ -8123,7 +8372,7 @@ mod tests {
 		assert!(announced.is_synced());
 
 		// A later announcement is news, not part of what it synced with.
-		let _bob = producer.announce("room/bob", Route::default()).unwrap();
+		let _bob = producer.announce("room/bob", RouteInfo::default()).unwrap();
 		assert!(announced.is_synced());
 	}
 
@@ -8135,7 +8384,7 @@ mod tests {
 		assert!(empty.is_synced(), "nothing to wait on");
 		empty.assert_next_wait();
 
-		let _alice = producer.announce("room/alice", Route::default()).unwrap();
+		let _alice = producer.announce("room/alice", RouteInfo::default()).unwrap();
 		let mut announced = producer.consume().routes();
 		assert!(!announced.is_synced(), "the replay is owed");
 		announced.assert_next_active("room/alice");
@@ -8145,9 +8394,9 @@ mod tests {
 	#[test]
 	fn initial_routes_precede_live_prefixes() {
 		let producer = origin(1).produce();
-		let _initial = producer.announce("z/initial", Route::default()).unwrap();
+		let _initial = producer.announce("z/initial", RouteInfo::default()).unwrap();
 		let mut announced = producer.consume().routes();
-		let _live = producer.announce("a/live", Route::default()).unwrap();
+		let _live = producer.announce("a/live", RouteInfo::default()).unwrap();
 		announced.assert_next_active("z/initial");
 		assert!(announced.is_synced());
 	}
@@ -8155,11 +8404,11 @@ mod tests {
 	#[test]
 	fn stalled_initial_replay_collapses_churn_without_a_backlog() {
 		let producer = origin(1).produce();
-		let initial = producer.announce("z/initial", Route::default()).unwrap();
+		let initial = producer.announce("z/initial", RouteInfo::default()).unwrap();
 		let mut announced = producer.consume().routes();
 		for i in 0..1_000 {
-			let transient = producer.announce(format!("a/{i}"), Route::default()).unwrap();
-			initial.update(Route::default().with_cost(i)).unwrap();
+			let transient = producer.announce(format!("a/{i}"), RouteInfo::default()).unwrap();
+			initial.update(RouteInfo::default().with_cost(i)).unwrap();
 			drop(transient);
 			assert_eq!(announced.state.read().pending.len(), 1);
 		}
@@ -8175,7 +8424,7 @@ mod tests {
 		let snapshot = producer.snapshot("");
 		let mut announced = producer.consume().routes();
 
-		let alice = producer.announce("room/alice", Route::default()).unwrap();
+		let alice = producer.announce("room/alice", RouteInfo::default()).unwrap();
 		drop(snapshot);
 		assert!(!announced.is_synced());
 		drop(alice);
@@ -8188,11 +8437,11 @@ mod tests {
 	fn an_update_is_not_owed() {
 		let producer = origin(1).produce();
 		let mut announced = producer.consume().routes();
-		let alice = producer.announce("room/alice", Route::default()).unwrap();
+		let alice = producer.announce("room/alice", RouteInfo::default()).unwrap();
 		announced.assert_next_active("room/alice");
 
 		let snapshot = producer.snapshot("");
-		alice.update(Route::default().with_cost(5)).unwrap();
+		alice.update(RouteInfo::default().with_cost(5)).unwrap();
 		drop(snapshot);
 		assert!(announced.is_synced());
 	}
@@ -8320,11 +8569,11 @@ mod tests {
 	async fn hidden_routes_need_an_opt_in() {
 		let producer = origin(1).produce();
 		let consumer = producer.consume();
-		let _visible = producer.announce("room/alice", Route::default()).unwrap();
-		let _stats = producer.announce(".stats/node", Route::default()).unwrap();
-		let _nested = producer.announce("room/.internal", Route::default()).unwrap();
+		let _visible = producer.announce("room/alice", RouteInfo::default()).unwrap();
+		let _stats = producer.announce(".stats/node", RouteInfo::default()).unwrap();
+		let _nested = producer.announce("room/.internal", RouteInfo::default()).unwrap();
 		// Only a leading dot hides: a suffix is part of the name.
-		let _suffix = producer.announce("room/catalog.pro", Route::default()).unwrap();
+		let _suffix = producer.announce("room/catalog.pro", RouteInfo::default()).unwrap();
 
 		let mut announced = consumer.routes();
 		announced.expect_next_active("room/alice").await;
@@ -8356,8 +8605,8 @@ mod tests {
 	async fn hidden_broadcast_resolves_by_path() {
 		let producer = origin(1).produce();
 		let consumer = producer.consume();
-		let broadcast = producer.create_broadcast(".stats/node").unwrap();
-		broadcast.announce(Route::default()).unwrap();
+		let broadcast = producer.route(".stats/node", RouteOptions::hidden()).unwrap();
+		broadcast.announce().unwrap();
 
 		consumer.routes().assert_next_wait();
 		let resolved = consumer.request(".stats/node", None).await.expect("resolves");
@@ -8370,10 +8619,10 @@ mod tests {
 	#[cfg(feature = "async")]
 	async fn exclude_hides_and_refuses_the_subtree() {
 		let producer = origin(1).produce();
-		let _claim = producer.announce("p1", Route::default()).unwrap();
-		let _cam = producer.publish("p1/cam", Route::default()).unwrap();
-		let _private = producer.publish("p1/.private/cam", Route::default()).unwrap();
-		let _overlay = producer.publish("p1/.pro/cam", Route::default()).unwrap();
+		let _claim = producer.announce("p1", RouteInfo::default()).unwrap();
+		let _cam = producer.route("p1/cam", RouteOptions::default()).unwrap();
+		let _private = producer.route("p1/.private/cam", RouteOptions::default()).unwrap();
+		let _overlay = producer.route("p1/.pro/cam", RouteOptions::default()).unwrap();
 		let consumer = producer
 			.consume()
 			.scope("p1", &Patterns::from(Pattern::all()))
@@ -8398,7 +8647,7 @@ mod tests {
 			);
 		}
 		// Only whole segments: a sibling sharing the prefix text is untouched.
-		let _sibling = producer.publish("p1/.prod", Route::default()).unwrap();
+		let _sibling = producer.route("p1/.prod", RouteOptions::default()).unwrap();
 		announced.expect_next_active(".prod").await;
 	}
 
@@ -8407,9 +8656,9 @@ mod tests {
 	#[kio::test]
 	async fn exclude_reaches_into_a_mount() {
 		let producer = origin(1).produce();
-		let _foo = producer.publish(".svc/p1/foo", Route::default()).unwrap();
-		let _bar = producer.publish(".svc/p1/bar", Route::default()).unwrap();
-		let _cam = producer.publish("p1/cam", Route::default()).unwrap();
+		let _foo = producer.route(".svc/p1/foo", RouteOptions::default()).unwrap();
+		let _bar = producer.route(".svc/p1/bar", RouteOptions::default()).unwrap();
+		let _cam = producer.route("p1/cam", RouteOptions::default()).unwrap();
 		let project = mounted(&producer, "p1", &["**"]).with_hidden(true);
 
 		let mut announced = project.exclude(".svc/foo").unwrap().routes();
@@ -8449,7 +8698,7 @@ mod tests {
 	#[cfg(feature = "async")]
 	async fn mount_resolves_on_the_target_front() {
 		let producer = origin(1).produce();
-		let server = producer.requests_route(".svc", Route::default(), None).unwrap();
+		let server = producer.forward(".svc", RouteInfo::default(), None).unwrap();
 		let project = mounted(&producer, "p1", &["**"]);
 
 		let through = project.request(".svc/foo", None);
@@ -8457,7 +8706,7 @@ mod tests {
 
 		let request = queued(&server).await;
 		assert_eq!(request.path().as_str(), ".svc/p1/foo");
-		assert!(server.poll_requested_broadcast(&kio::Waiter::noop()).is_pending());
+		assert!(server.poll_requested(&kio::Waiter::noop()).is_pending());
 		let source = broadcast::Info::new().produce();
 		request.serve(&source);
 
@@ -8474,11 +8723,11 @@ mod tests {
 	#[cfg(feature = "async")]
 	async fn mount_presents_target_routes_under_the_mount() {
 		let producer = origin(1).produce();
-		let _claim = producer.announce(".svc", Route::default()).unwrap();
-		let foo = producer.publish(".svc/p1/foo", Route::default()).unwrap();
-		let _other = producer.publish(".svc/p2/bar", Route::default()).unwrap();
-		let _cam = producer.publish("p1/cam", Route::default()).unwrap();
-		let _shadowed = producer.publish("p1/.svc/forged", Route::default()).unwrap();
+		let _claim = producer.announce(".svc", RouteInfo::default()).unwrap();
+		let foo = producer.route(".svc/p1/foo", RouteOptions::default()).unwrap();
+		let _other = producer.route(".svc/p2/bar", RouteOptions::default()).unwrap();
+		let _cam = producer.route("p1/cam", RouteOptions::default()).unwrap();
+		let _shadowed = producer.route("p1/.svc/forged", RouteOptions::default()).unwrap();
 		let project = mounted(&producer, "p1", &["**"]);
 
 		// A dot segment hides the mount like any other.
@@ -8518,8 +8767,8 @@ mod tests {
 	#[cfg(feature = "async")]
 	async fn mount_authorizes_the_named_path() {
 		let producer = origin(1).produce();
-		let _foo = producer.publish(".svc/p1/foo", Route::default()).unwrap();
-		let _bar = producer.publish(".svc/p1/bar", Route::default()).unwrap();
+		let _foo = producer.route(".svc/p1/foo", RouteOptions::default()).unwrap();
+		let _bar = producer.route(".svc/p1/bar", RouteOptions::default()).unwrap();
 
 		let granted = mounted(&producer, "p1", &["foo", ".svc/foo"]);
 		granted.request(".svc/foo", None).await.expect("granted");
@@ -8552,7 +8801,7 @@ mod tests {
 	#[kio::test]
 	async fn mount_captures_the_named_path() {
 		let producer = origin(1).produce();
-		let _foo = producer.publish(".svc/p1/foo", Route::default()).unwrap();
+		let _foo = producer.route(".svc/p1/foo", RouteOptions::default()).unwrap();
 		let project = mounted(&producer, "p1", &["**"]).with_hidden(true);
 
 		let Some(RouteEvent::Start(update)) = project.routes().try_next() else {
@@ -8576,7 +8825,7 @@ mod tests {
 	async fn mount_keeps_a_max_depth_target() {
 		let producer = origin(1).produce();
 		let deep = vec!["d"; Path::MAX_PARTS].join("/");
-		let _leaf = producer.publish(deep.as_str(), Route::default()).unwrap();
+		let _leaf = producer.route(deep.as_str(), RouteOptions::default()).unwrap();
 		let project = producer
 			.mount("p1/.svc", deep.as_str())
 			.unwrap()
@@ -8601,9 +8850,9 @@ mod tests {
 	#[kio::test]
 	async fn mount_bounds_the_named_path() {
 		let producer = origin(1).produce();
-		let _near = producer.publish("t/x", Route::default()).unwrap();
+		let _near = producer.route("t/x", RouteOptions::default()).unwrap();
 		let deep = format!("t/{}", vec!["d"; Path::MAX_PARTS - 1].join("/"));
-		let _deep = producer.publish(deep.as_str(), Route::default()).unwrap();
+		let _deep = producer.route(deep.as_str(), RouteOptions::default()).unwrap();
 		let project = producer
 			.mount("p1/a/b", "t")
 			.unwrap()
@@ -8631,16 +8880,19 @@ mod tests {
 			.unwrap()
 			.scope("p1", &Patterns::from(Pattern::all()))
 			.unwrap();
-		assert!(matches!(project.create_broadcast(".svc/foo"), Err(Error::Unauthorized)));
 		assert!(matches!(
-			project.requests_route(".svc", Route::default(), None),
+			project.route(".svc/foo", RouteOptions::hidden()),
+			Err(Error::Unauthorized)
+		));
+		assert!(matches!(
+			project.forward(".svc", RouteInfo::default(), None),
 			Err(Error::Unauthorized)
 		));
 		assert!(matches!(
-			project.requests_route(".svc/foo", Route::default(), None),
+			project.forward(".svc/foo", RouteInfo::default(), None),
 			Err(Error::Unauthorized)
 		));
-		project.publish("cam", Route::default()).unwrap();
+		let _cam = project.route("cam", RouteOptions::default()).unwrap();
 	}
 
 	/// A mount reaches only what the handle already reaches, and mounts never nest.
@@ -8690,7 +8942,7 @@ mod tests {
 	async fn mount_egress_counts_under_the_named_path() {
 		let registry = stats::Registry::new(stats::Config::new());
 		let producer = origin(1).produce();
-		let _foo = producer.publish(".svc/p1/foo", Route::default()).unwrap();
+		let _foo = producer.route(".svc/p1/foo", RouteOptions::default()).unwrap();
 		let project = mounted(&producer, "p1", &["**"])
 			.with_stats(
 				registry
@@ -8721,7 +8973,7 @@ mod tests {
 		let mut announced = consumer.routes();
 		let mut opted = consumer.clone().with_hidden(true).routes();
 
-		let hidden = producer.announce(".stats/node", Route::default()).unwrap();
+		let hidden = producer.announce(".stats/node", RouteInfo::default()).unwrap();
 		announced.assert_next_wait();
 		opted.expect_next_active(".stats/node").await;
 
@@ -8733,7 +8985,7 @@ mod tests {
 	#[kio::test]
 	async fn a_replayed_route_retracted_before_delivery_cancels() {
 		let producer = origin(1).produce();
-		let alice = producer.announce("alice", Route::default()).unwrap();
+		let alice = producer.announce("alice", RouteInfo::default()).unwrap();
 		let mut announced = producer.consume().routes();
 		drop(alice);
 		announced.assert_next_wait();
@@ -8741,85 +8993,81 @@ mod tests {
 
 	#[kio::test]
 	#[cfg(feature = "async")]
-	async fn broadcast_announces_its_own_path() {
+	async fn a_hidden_route_announces_its_own_path() {
 		let producer = origin(1).produce();
 		let consumer = producer.consume();
 		let mut announced = consumer.routes();
 		let mut peer = consumer.clone().excluding(Hop::UNKNOWN).routes();
 
-		// Created but not announced: invisible to local and peer cursors alike.
-		let broadcast = producer.create_broadcast("room/alice").unwrap();
+		// Created but not announced: invisible to local and peer cursors alike, even
+		// once priced.
+		let broadcast = producer.route("room/alice", RouteOptions::hidden()).unwrap();
+		broadcast.set_cost(3).unwrap();
 		announced.assert_next_wait();
 		peer.assert_next_wait();
 
-		broadcast.announce(Route::default().with_cost(3)).unwrap();
+		broadcast.announce().unwrap();
 		assert_eq!(announced.expect_next_active("room/alice").await.cost, Cost::new(3));
 		assert_eq!(peer.expect_next_active("room/alice").await.cost, Cost::new(3));
 
-		// Announcing again re-prices in place.
-		broadcast.announce(Route::default().with_cost(1)).unwrap();
+		// Re-pricing a visible route updates it in place.
+		broadcast.set_cost(1).unwrap();
 		assert_eq!(announced.expect_next_active("room/alice").await.cost, Cost::new(1));
 		assert_eq!(peer.expect_next_active("room/alice").await.cost, Cost::new(1));
 
 		// Off the air: the route retracts for everyone and the path is unroutable.
-		broadcast.unannounce();
+		broadcast.withdraw();
 		announced.expect_next_ended("room/alice").await;
 		peer.expect_next_ended("room/alice").await;
-		broadcast.unannounce();
+		broadcast.withdraw();
 		announced.assert_next_wait();
 		let err = consumer.request("room/alice", None).await.err().unwrap();
 		assert!(matches!(err, Error::Unroutable));
 
 		// Back on the air, then the end of the broadcast retracts for good.
-		broadcast.announce(Route::default()).unwrap();
+		broadcast.announce().unwrap();
 		announced.expect_next_active("room/alice").await;
 		peer.expect_next_active("room/alice").await;
-		broadcast.close();
+		broadcast.broadcast().close();
 		announced.expect_next_ended("room/alice").await;
 		peer.expect_next_ended("room/alice").await;
-		assert!(matches!(broadcast.announce(Route::default()), Err(Error::Closed)));
+		assert!(matches!(broadcast.announce(), Err(Error::Closed)));
 		announced.assert_next_wait();
 	}
 
 	#[kio::test]
-	async fn broadcast_announcement_retracts_with_the_last_producer() {
+	async fn a_route_retracts_with_its_last_clone() {
 		let producer = origin(1).produce();
 		let consumer = producer.consume();
 		let mut announced = consumer.routes();
 
-		let broadcast = producer.create_broadcast("room/alice").unwrap();
-		let clone = broadcast.clone();
-		broadcast.announce(Route::default()).unwrap();
+		let route = producer.route("room/alice", RouteOptions::hidden()).unwrap();
+		let clone = route.clone();
+		let source = route.broadcast().clone();
+		route.announce().unwrap();
 		announced.expect_next_active("room/alice").await;
 
-		// A clone keeps the broadcast, and its advertisement, alive.
-		drop(broadcast);
+		// A clone keeps the route alive; a broadcast producer does not.
+		drop(route);
 		announced.assert_next_wait();
 		drop(clone);
 		announced.expect_next_ended("room/alice").await;
+		assert!(!source.consume().is_closed());
 	}
 
 	#[kio::test]
 	async fn publish_creates_and_announces_together() {
 		let producer = origin(1).produce();
 		let mut announced = producer.consume().routes();
-		let _broadcast = producer.publish("room/alice", Route::default()).unwrap();
+		let _broadcast = producer.route("room/alice", RouteOptions::default()).unwrap();
 		announced.expect_next_active("room/alice").await;
 	}
 
-	#[kio::test]
-	async fn standalone_broadcast_cannot_announce() {
-		let broadcast = broadcast::Info::new().produce();
-		assert!(matches!(broadcast.announce(Route::default()), Err(Error::Closed)));
-		// Harmless without an advertisement to retract.
-		broadcast.unannounce();
-	}
-
 	#[kio::test]
 	async fn announce_replays_to_late_cursor() {
 		let producer = origin(1).produce();
-		let _a = producer.announce("room/alice", Route::default()).unwrap();
-		let _b = producer.announce("room/bob", Route::default()).unwrap();
+		let _a = producer.announce("room/alice", RouteInfo::default()).unwrap();
+		let _b = producer.announce("room/bob", RouteInfo::default()).unwrap();
 
 		let mut announced = producer.consume().routes();
 		// Replay follows the table traversal order.
@@ -8834,13 +9082,13 @@ mod tests {
 		let scoped = producer.scope("", &scopes(&["room"])).unwrap();
 
 		// Prefix advertisements stay prefixes. The scope filters requests locally.
-		let _a = scoped.announce("", Route::default()).unwrap();
+		let _a = scoped.announce("", RouteInfo::default()).unwrap();
 		let mut announced = producer.consume().routes();
 		announced.expect_next_active("").await;
 
 		// Disjoint prefixes cannot be claimed at all.
 		assert!(matches!(
-			scoped.announce("other", Route::default()),
+			scoped.announce("other", RouteInfo::default()),
 			Err(Error::Unauthorized)
 		));
 	}
@@ -8848,7 +9096,7 @@ mod tests {
 	#[kio::test]
 	async fn cursor_keeps_an_overlapping_prefix_above_its_scope() {
 		let producer = origin(1).produce();
-		let _a = producer.announce("", Route::default()).unwrap();
+		let _a = producer.announce("", RouteInfo::default()).unwrap();
 
 		let consumer = producer.consume().scope("", &scopes(&["room"])).unwrap();
 		let mut announced = consumer.clone().covering().routes();
@@ -8859,7 +9107,7 @@ mod tests {
 	#[kio::test]
 	async fn cursor_root_strips_prefix() {
 		let producer = origin(1).produce();
-		let _a = producer.announce("room/alice", Route::default()).unwrap();
+		let _a = producer.announce("room/alice", RouteInfo::default()).unwrap();
 
 		let consumer = producer
 			.consume()
@@ -8875,14 +9123,14 @@ mod tests {
 		let mut announced = producer.consume().routes();
 
 		let expensive = producer
-			.announce("room", Route::default().with_hops(hops(&[10])).with_cost(5))
+			.announce("room", RouteInfo::default().with_hops(hops(&[10])).with_cost(5))
 			.unwrap();
 		let route = announced.expect_next_active("room").await;
 		assert_eq!(route.cost, Cost::new(5));
 
 		// A cheaper route for the same prefix takes over in place.
 		let cheap = producer
-			.announce("room", Route::default().with_hops(hops(&[20])).with_cost(1))
+			.announce("room", RouteInfo::default().with_hops(hops(&[20])).with_cost(1))
 			.unwrap();
 		let route = announced.expect_next_active("room").await;
 		assert_eq!(route.cost, Cost::new(1));
@@ -8919,12 +9167,12 @@ mod tests {
 		// arrived in `order`.
 		fn winners(order: impl Iterator<Item = u64>) -> Vec<Hop> {
 			let producer = origin(1).produce();
-			let _pool: Vec<Requests> = order
+			let _pool: Vec<Route> = order
 				.map(|id| {
 					producer
-						.requests_route(
+						.forward(
 							"pool",
-							Route::default()
+							RouteInfo::default()
 								.with_instance(format!("worker-{id}").parse().unwrap(), 0)
 								.with_hops(hops(&[id]))
 								.with_cost(3),
@@ -8975,7 +9223,7 @@ mod tests {
 		for named in [None, Some(instance())] {
 			let producer = origin(1).produce();
 			let mut announced = producer.consume().routes();
-			let mut route = Route::default().with_hops(hops(&[10]));
+			let mut route = RouteInfo::default().with_hops(hops(&[10]));
 			route.instance = named.clone();
 
 			let old = producer.announce("room", route.clone()).unwrap();
@@ -9000,11 +9248,11 @@ mod tests {
 		let producer = origin(1).produce();
 		let mut announced = producer.consume().routes();
 		let route = producer
-			.requests_route("room", Route::default().with_cost(3), None)
+			.forward("room", RouteInfo::default().with_cost(3), None)
 			.unwrap();
 		announced.expect_next_active("room").await;
 
-		route.update_route(Route::default().with_cost(5)).unwrap();
+		route.update(RouteInfo::default().with_cost(5)).unwrap();
 		match announced.next().await.expect("no next") {
 			RouteEvent::Update(update) => assert_eq!(update.route.cost, Cost::new(5)),
 			other => panic!("should be an update: got {other:?}"),
@@ -9022,11 +9270,11 @@ mod tests {
 		let producer = origin(1).produce();
 		let mut announced = producer.consume().routes();
 		let route = producer
-			.requests_route("room", Route::default().with_auth(first.clone()), None)
+			.forward("room", RouteInfo::default().with_auth(first.clone()), None)
 			.unwrap();
 		assert_eq!(announced.expect_next_active("room").await.auth, Some(first));
 
-		route.update_route(Route::default().with_auth(second.clone())).unwrap();
+		route.update(RouteInfo::default().with_auth(second.clone())).unwrap();
 		match announced.next().await.expect("no next") {
 			RouteEvent::Update(update) => assert_eq!(update.route.auth, Some(second)),
 			other => panic!("should be an update: got {other:?}"),
@@ -9051,9 +9299,9 @@ mod tests {
 		let mut announced = consumer.routes();
 		let peer = producer.clone().with_link(Link::Peer);
 		let old = peer
-			.requests_route(
+			.forward(
 				"pool/job-0",
-				Route::default()
+				RouteInfo::default()
 					.with_instance("a".parse().unwrap(), 0)
 					.with_hops(hops(&[11])),
 				None,
@@ -9062,9 +9310,9 @@ mod tests {
 		announced.expect_next_active("pool/job-0").await;
 
 		let new = peer
-			.requests_route(
+			.forward(
 				"pool/job-0",
-				Route::default()
+				RouteInfo::default()
 					.with_instance("b".parse().unwrap(), 0)
 					.with_hops(hops(&[10])),
 				None,
@@ -9077,7 +9325,7 @@ mod tests {
 		let first = broadcast::Info::new().produce();
 		request.serve(&first);
 		let resolved = pending.await.expect("the old route resolves");
-		assert!(new.poll_requested_broadcast(&kio::Waiter::noop()).is_pending());
+		assert!(new.poll_requested(&kio::Waiter::noop()).is_pending());
 
 		drop(old);
 		assert_eq!(announced.expect_next_restarted("pool/job-0").await.hops, hops(&[10]));
@@ -9105,12 +9353,12 @@ mod tests {
 			let consumer = producer.consume();
 			let mut announced = consumer.routes();
 			let _old = producer
-				.requests_route("pool/job-0", Route::default().with_hops(hops(&[old_hop])), None)
+				.forward("pool/job-0", RouteInfo::default().with_hops(hops(&[old_hop])), None)
 				.unwrap();
 			announced.expect_next_active("pool/job-0").await;
 
 			let new = producer
-				.requests_route("pool/job-0", Route::default().with_hops(hops(&[new_hop])), None)
+				.forward("pool/job-0", RouteInfo::default().with_hops(hops(&[new_hop])), None)
 				.unwrap();
 			assert_eq!(
 				announced.expect_next_restarted("pool/job-0").await.hops,
@@ -9126,7 +9374,7 @@ mod tests {
 	/// An origin delivering restarts at once, and a way to claim `prefix` with a
 	/// producer scoped to `scope`, from `hop` at `cost`.
 	#[cfg(feature = "async")]
-	fn scoped_pool() -> (Producer, impl Fn(&str, &str, u64, u64) -> Requests) {
+	fn scoped_pool() -> (Producer, impl Fn(&str, &str, u64, u64) -> Route) {
 		let producer = Config {
 			update_hold: Duration::ZERO,
 			..Config::new(origin(1))
@@ -9137,7 +9385,11 @@ mod tests {
 			claims
 				.scope("", &scopes(&[scope]))
 				.unwrap()
-				.requests_route(prefix, Route::default().with_hops(hops(&[hop])).with_cost(cost), None)
+				.forward(
+					prefix,
+					RouteInfo::default().with_hops(hops(&[hop])).with_cost(cost),
+					None,
+				)
 				.unwrap()
 		};
 		(producer, claim)
@@ -9146,7 +9398,7 @@ mod tests {
 	/// Request `path` from `consumer` and have `server` answer it: the answer, and
 	/// the requester's broadcast.
 	#[cfg(feature = "async")]
-	async fn hold(consumer: &Consumer, path: &str, server: &Requests) -> (broadcast::Producer, broadcast::Consumer) {
+	async fn hold(consumer: &Consumer, path: &str, server: &Route) -> (broadcast::Producer, broadcast::Consumer) {
 		let pending = consumer.request(path, None);
 		let answer = broadcast::Info::new().produce();
 		queued(server).await.serve(&answer);
@@ -9175,7 +9427,7 @@ mod tests {
 		assert_eq!(announced.expect_next_active("room").await.cost, Cost::new(5));
 		let _sticky = hold(&consumer, "room/job", &a).await;
 
-		b.update_route(Route::default().with_hops(hops(&[11])).with_cost(3))
+		b.update(RouteInfo::default().with_hops(hops(&[11])).with_cost(3))
 			.unwrap();
 		assert_eq!(announced.expect_next_restarted("room").await.cost, Cost::new(3));
 		quiet(&mut announced).await;
@@ -9185,7 +9437,7 @@ mod tests {
 	async fn exclude_hides_routes_through_the_peer() {
 		let producer = origin(1).produce();
 		let _a = producer
-			.announce("room", Route::default().with_hops(hops(&[7])))
+			.announce("room", RouteInfo::default().with_hops(hops(&[7])))
 			.unwrap();
 
 		let mut hidden = producer.consume().excluding(origin(7)).routes();
@@ -9200,10 +9452,10 @@ mod tests {
 		let producer = origin(1).produce();
 		let assigned = origin(777);
 		let _echoed = producer
-			.announce("echoed", Route::default().with_hops(hops(&[0])).with_via(assigned))
+			.announce("echoed", RouteInfo::default().with_hops(hops(&[0])).with_via(assigned))
 			.unwrap();
 		let _local = producer
-			.announce("local", Route::default().with_hops(hops(&[10])))
+			.announce("local", RouteInfo::default().with_hops(hops(&[10])))
 			.unwrap();
 
 		let mut hidden = producer.consume().excluding(assigned).routes();
@@ -9217,14 +9469,14 @@ mod tests {
 		let mut announced = producer.consume().routes();
 
 		let _anonymous = producer
-			.announce("room", Route::default().with_hops(hops(&[0])).with_cost(1))
+			.announce("room", RouteInfo::default().with_hops(hops(&[0])).with_cost(1))
 			.unwrap();
 		let route = announced.expect_next_active("room").await;
 		assert!(route.is_anonymous());
 		assert_eq!(route.cost, Cost::new(1));
 
 		let _identified = producer
-			.announce("room", Route::default().with_hops(hops(&[10])).with_cost(5))
+			.announce("room", RouteInfo::default().with_hops(hops(&[10])).with_cost(5))
 			.unwrap();
 		let route = announced.expect_next_active("room").await;
 		assert!(!route.is_anonymous());
@@ -9237,13 +9489,13 @@ mod tests {
 		let mut announced = producer.consume().routes();
 
 		let expensive = producer
-			.announce("room", Route::default().with_hops(hops(&[0])).with_cost(5))
+			.announce("room", RouteInfo::default().with_hops(hops(&[0])).with_cost(5))
 			.unwrap();
 		let route = announced.expect_next_active("room").await;
 		assert_eq!(route.cost, Cost::new(5));
 
 		let _cheap = producer
-			.announce("room", Route::default().with_hops(hops(&[0, 7])).with_cost(1))
+			.announce("room", RouteInfo::default().with_hops(hops(&[0, 7])).with_cost(1))
 			.unwrap();
 		let route = announced.expect_next_active("room").await;
 		assert!(route.is_anonymous());
@@ -9261,7 +9513,7 @@ mod tests {
 		let _anonymous = producer
 			.announce(
 				"room",
-				Route::default()
+				RouteInfo::default()
 					.with_hops(hops(&[0, 7]))
 					.with_cost(1)
 					.with_via(origin(7)),
@@ -9270,7 +9522,7 @@ mod tests {
 		announced.expect_next_active("room").await;
 
 		let _identified = producer
-			.announce("room", Route::default().with_hops(hops(&[10, 20])).with_cost(5))
+			.announce("room", RouteInfo::default().with_hops(hops(&[10, 20])).with_cost(5))
 			.unwrap();
 		let route = announced.expect_next_active("room").await;
 		assert!(!route.is_anonymous());
@@ -9284,17 +9536,17 @@ mod tests {
 		let consumer = producer.consume();
 
 		let anonymous = producer
-			.requests_route("room", Route::default().with_hops(hops(&[0])).with_cost(1), None)
+			.forward("room", RouteInfo::default().with_hops(hops(&[0])).with_cost(1), None)
 			.unwrap();
 		let identified = producer
-			.requests_route("room", Route::default().with_hops(hops(&[10])).with_cost(5), None)
+			.forward("room", RouteInfo::default().with_hops(hops(&[10])).with_cost(5), None)
 			.unwrap();
 
 		let _pending = consumer.request("room/alice", None);
 		let request = queued(&identified).await;
 		assert_eq!(request.path().as_str(), "room/alice");
 		assert!(
-			anonymous.poll_requested_broadcast(&kio::Waiter::noop()).is_pending(),
+			anonymous.poll_requested(&kio::Waiter::noop()).is_pending(),
 			"the cheaper anonymous route must not serve"
 		);
 	}
@@ -9308,17 +9560,17 @@ mod tests {
 		let demoted = producer
 			.clone()
 			.with_preference(Preference::new(-1))
-			.requests_route("room", Route::default().with_hops(hops(&[10])).with_cost(1), None)
+			.forward("room", RouteInfo::default().with_hops(hops(&[10])).with_cost(1), None)
 			.unwrap();
 		let unranked = producer
-			.requests_route("room", Route::default().with_hops(hops(&[11])).with_cost(5), None)
+			.forward("room", RouteInfo::default().with_hops(hops(&[11])).with_cost(5), None)
 			.unwrap();
 
 		let _pending = consumer.request("room/alice", None);
 		let request = queued(&unranked).await;
 		assert_eq!(request.path().as_str(), "room/alice");
 		assert!(
-			demoted.poll_requested_broadcast(&kio::Waiter::noop()).is_pending(),
+			demoted.poll_requested(&kio::Waiter::noop()).is_pending(),
 			"the cheaper demoted link must not serve"
 		);
 	}
@@ -9328,10 +9580,10 @@ mod tests {
 		let producer = origin(1).produce();
 		let mut announced = producer.consume().routes();
 
-		let announcement = producer.announce("room", Route::default()).unwrap();
+		let announcement = producer.announce("room", RouteInfo::default()).unwrap();
 		announced.expect_next_active("room").await;
 
-		announcement.update(Route::default().with_cost(9)).unwrap();
+		announcement.update(RouteInfo::default().with_cost(9)).unwrap();
 		let route = announced.expect_next_active("room").await;
 		assert_eq!(route.cost, Cost::new(9));
 	}
@@ -9343,24 +9595,27 @@ mod tests {
 		let mut announced = producer.consume().routes();
 
 		let dynamic = producer
-			.requests_route("room", Route::default().with_instance(instance(), 0).with_cost(5), None)
+			.forward(
+				"room",
+				RouteInfo::default().with_instance(instance(), 0).with_cost(5),
+				None,
+			)
 			.unwrap();
 		announced.expect_next_active("room").await;
-		dynamic.update_route(dynamic.route().with_cost(1)).unwrap();
+		dynamic.update(dynamic.route().unwrap().with_cost(1)).unwrap();
 		let route = announced.expect_next_active("room").await;
 		assert_eq!((route.instance, route.cost), (Some(instance()), Cost::new(1)));
-		assert_eq!(dynamic.route().cost, Cost::new(1));
+		assert_eq!(dynamic.route().unwrap().cost, Cost::new(1));
 
-		let broadcast = producer.create_broadcast("lobby").unwrap();
+		let options = RouteOptions::hidden().with_instance(instance(), 0).with_cost(5);
+		let broadcast = producer.route("lobby", options).unwrap();
 		assert!(broadcast.route().is_none(), "not announced yet");
-		broadcast
-			.announce(Route::default().with_instance(instance(), 0).with_cost(5))
-			.unwrap();
+		broadcast.announce().unwrap();
 		announced.expect_next_active("lobby").await;
-		broadcast.announce(broadcast.route().unwrap().with_cost(1)).unwrap();
+		broadcast.set_cost(1).unwrap();
 		let route = announced.expect_next_active("lobby").await;
 		assert_eq!((route.instance, route.cost), (Some(instance()), Cost::new(1)));
-		broadcast.unannounce();
+		broadcast.withdraw();
 		assert!(broadcast.route().is_none(), "withdrawn");
 	}
 
@@ -9369,13 +9624,13 @@ mod tests {
 		let producer = origin(1).produce();
 		let mut announced = producer.consume().routes();
 
-		let announcement = producer.announce("room", Route::default()).unwrap();
+		let announcement = producer.announce("room", RouteInfo::default()).unwrap();
 		announced.expect_next_active("room").await;
 
 		// Reprice, then retract before the consumer observes the reprice: the
 		// pending metadata update must not cancel the retraction the delivered
 		// announce still owes.
-		announcement.update(Route::default().with_cost(9)).unwrap();
+		announcement.update(RouteInfo::default().with_cost(9)).unwrap();
 		drop(announcement);
 		announced.expect_next_ended("room").await;
 		announced.assert_next_wait();
@@ -9386,8 +9641,10 @@ mod tests {
 		let producer = origin(1).produce();
 		// Broad and cheap; narrow and expensive. Both present relative to a cursor
 		// rooted below them, and the narrow one is what a request there resolves.
-		let _broad = producer.announce("room", Route::default().with_cost(1)).unwrap();
-		let _narrow = producer.announce("room/alice", Route::default().with_cost(9)).unwrap();
+		let _broad = producer.announce("room", RouteInfo::default().with_cost(1)).unwrap();
+		let _narrow = producer
+			.announce("room/alice", RouteInfo::default().with_cost(9))
+			.unwrap();
 
 		let consumer = producer
 			.consume()
@@ -9403,8 +9660,8 @@ mod tests {
 	#[cfg(feature = "async")]
 	async fn capture_change_retracts_before_reannouncing_a_presented_prefix() {
 		let producer = origin(1).produce();
-		let _broad = producer.announce("room", Route::default()).unwrap();
-		let exact = producer.announce("room/alice", Route::default()).unwrap();
+		let _broad = producer.announce("room", RouteInfo::default()).unwrap();
+		let exact = producer.announce("room/alice", RouteInfo::default()).unwrap();
 		let consumer = producer
 			.consume()
 			.scope("", &Patterns::from("room/*".parse::<Pattern>().unwrap()))
@@ -9453,13 +9710,13 @@ mod tests {
 		assert!((&mut resolving).now_or_never().is_none());
 
 		// Creating is not announcing: still parked.
-		let broadcast = producer.create_broadcast("room/alice").unwrap();
+		let broadcast = producer.route("room/alice", RouteOptions::hidden()).unwrap();
 		for _ in 0..20 {
 			kio::clock::sim::yield_now().await;
 		}
 		assert!((&mut resolving).now_or_never().is_none());
 
-		broadcast.announce(Route::default()).unwrap();
+		broadcast.announce().unwrap();
 		let resolved = resolving.await.expect("resolves once announced").unwrap();
 		assert_eq!(resolved.info().path.as_str(), "room/alice");
 		drop(broadcast);
@@ -9475,14 +9732,17 @@ mod tests {
 		let mut announced = consumer.routes();
 
 		let _local = producer
-			.publish("room/alice", Route::default().with_instance(instance(), 0).with_cost(5))
+			.route(
+				"room/alice",
+				RouteOptions::default().with_instance(instance(), 0).with_cost(5),
+			)
 			.unwrap();
 		assert_eq!(announced.expect_next_active("room/alice").await.cost, Cost::new(5));
 
 		let server = producer
-			.requests_route(
+			.forward(
 				"room/alice",
-				Route::default()
+				RouteInfo::default()
 					.with_instance(instance(), 0)
 					.with_hops(hops(&[10]))
 					.with_cost(1),
@@ -9510,9 +9770,9 @@ mod tests {
 		let consumer = producer.consume();
 
 		let _stable = producer
-			.publish("room/alice", Route::default().with_instance(instance(), 0))
+			.route("room/alice", RouteOptions::default().with_instance(instance(), 0))
 			.unwrap();
-		let minted = producer.publish("room/bob", Route::default()).unwrap();
+		let minted = producer.route("room/bob", RouteOptions::default()).unwrap();
 
 		let alice = consumer.request("room/alice", None).await.unwrap();
 		assert_eq!(alice.info().instance, Some(instance()));
@@ -9531,14 +9791,17 @@ mod tests {
 		let consumer = producer.consume();
 
 		let _local = producer
-			.publish("room/alice", Route::default().with_instance(instance(), 0).with_cost(5))
+			.route(
+				"room/alice",
+				RouteOptions::default().with_instance(instance(), 0).with_cost(5),
+			)
 			.unwrap();
 		let first = consumer.request("room/alice", None).await.expect("resolves locally");
 
 		let server = producer
-			.requests_route(
+			.forward(
 				"room/alice",
-				Route::default()
+				RouteInfo::default()
 					.with_instance(instance(), 0)
 					.with_hops(hops(&[10]))
 					.with_cost(1),
@@ -9571,15 +9834,15 @@ mod tests {
 	async fn a_front_lists_its_source() {
 		let producer = origin(1).produce();
 		let consumer = producer.consume();
-		let source = producer.publish("room/alice", Route::default()).unwrap();
-		let video = source.create_track("video", None).unwrap();
+		let source = producer.route("room/alice", RouteOptions::default()).unwrap();
+		let video = source.broadcast().create_track("video", None).unwrap();
 
 		let front = consumer.request("room/alice", None).await.unwrap();
 		let mut tracks = front.tracks().unwrap();
 		assert_eq!(listed(&mut tracks).await, "+video");
 		assert_eq!(listed(&mut tracks).await, "synced");
 
-		let _audio = source.create_track("audio", None).unwrap();
+		let _audio = source.broadcast().create_track("audio", None).unwrap();
 		assert_eq!(listed(&mut tracks).await, "+audio");
 		drop(video);
 		assert_eq!(listed(&mut tracks).await, "-video");
@@ -9595,10 +9858,10 @@ mod tests {
 	async fn a_front_forwards_the_finishes_before_its_source_closed() {
 		let producer = origin(1).produce();
 		let consumer = producer.consume();
-		let source = producer.publish("room/alice", Route::default()).unwrap();
-		let dropped = source.create_track("dropped", None).unwrap();
-		let held = source.create_track("held", None).unwrap();
-		let _live = source.create_track("live", None).unwrap();
+		let source = producer.route("room/alice", RouteOptions::default()).unwrap();
+		let dropped = source.broadcast().create_track("dropped", None).unwrap();
+		let held = source.broadcast().create_track("held", None).unwrap();
+		let _live = source.broadcast().create_track("live", None).unwrap();
 
 		let front = consumer.request("room/alice", None).await.unwrap();
 		let mut tracks = front.tracks().unwrap();
@@ -9609,7 +9872,7 @@ mod tests {
 		dropped.finish().unwrap();
 		drop(dropped);
 		held.finish().unwrap();
-		source.close();
+		source.broadcast().close();
 		for event in ["~dropped", "~held", "end"] {
 			assert_eq!(listed(&mut tracks).await, event);
 		}
@@ -9622,8 +9885,8 @@ mod tests {
 	async fn a_front_ends_its_listing_with_its_sources() {
 		let producer = origin(1).produce();
 		let consumer = producer.consume();
-		let source = producer.publish("room/alice", Route::default()).unwrap();
-		let lister = source.requests().lister().unwrap();
+		let source = producer.route("room/alice", RouteOptions::default()).unwrap();
+		let lister = source.broadcast().requests().lister().unwrap();
 		lister.add("video", crate::track::Info::default()).unwrap();
 		lister.synced();
 
@@ -9645,10 +9908,13 @@ mod tests {
 		let producer = origin(1).produce();
 		let consumer = producer.consume();
 		let local = producer
-			.publish("room/alice", Route::default().with_instance(instance(), 0).with_cost(5))
+			.route(
+				"room/alice",
+				RouteOptions::default().with_instance(instance(), 0).with_cost(5),
+			)
 			.unwrap();
-		let _a = local.create_track("a", None).unwrap();
-		let _b = local.create_track("b", None).unwrap();
+		let _a = local.broadcast().create_track("a", None).unwrap();
+		let _b = local.broadcast().create_track("b", None).unwrap();
 
 		let front = consumer.request("room/alice", None).await.unwrap();
 		let mut tracks = front.tracks().unwrap();
@@ -9657,9 +9923,9 @@ mod tests {
 		assert_eq!(listed(&mut tracks).await, "synced");
 
 		let server = producer
-			.requests_route(
+			.forward(
 				"room/alice",
-				Route::default()
+				RouteInfo::default()
 					.with_instance(instance(), 0)
 					.with_hops(hops(&[10]))
 					.with_cost(1),
@@ -9683,7 +9949,7 @@ mod tests {
 		let producer = origin(1).produce();
 		let consumer = producer.consume();
 		let first = producer
-			.requests_route("room/alice", Route::default().with_hops(hops(&[10])), None)
+			.forward("room/alice", RouteInfo::default().with_hops(hops(&[10])), None)
 			.unwrap();
 		let pending = consumer.request("room/alice", None);
 		let upstream = broadcast::Info::new().produce();
@@ -9695,7 +9961,7 @@ mod tests {
 		assert_eq!(listed(&mut tracks).await, "synced");
 
 		let second = producer
-			.requests_route("room/alice", Route::default().with_hops(hops(&[10])), Some(&first))
+			.forward("room/alice", RouteInfo::default().with_hops(hops(&[10])), Some(&first))
 			.unwrap();
 		kio::clock::sim::yield_now().await;
 		drop(first);
@@ -9726,7 +9992,7 @@ mod tests {
 	#[cfg(feature = "async")]
 	async fn follows_a_chain_of_takeovers(links: u64, named: bool) {
 		let route = |link: u64| {
-			let route = Route::default().with_hops(hops(&[10]));
+			let route = RouteInfo::default().with_hops(hops(&[10]));
 			match named {
 				true => route.with_instance(format!("link-{link}").parse().unwrap(), 0),
 				false => route,
@@ -9734,7 +10000,7 @@ mod tests {
 		};
 		let producer = origin(1).produce();
 		let consumer = producer.consume();
-		let first = producer.requests_route("room/alice", route(0), None).unwrap();
+		let first = producer.forward("room/alice", route(0), None).unwrap();
 		let pending = consumer.request("room/alice", None);
 		let upstream = broadcast::Info::new().produce();
 		let _a = upstream.create_track("a", None).unwrap();
@@ -9747,7 +10013,7 @@ mod tests {
 		// Each link takes over the one before and retires it, with no yield between.
 		let mut last = first;
 		for link in 1..=links {
-			let next = producer.requests_route("room/alice", route(link), Some(&last)).unwrap();
+			let next = producer.forward("room/alice", route(link), Some(&last)).unwrap();
 			drop(std::mem::replace(&mut last, next));
 		}
 
@@ -9771,21 +10037,21 @@ mod tests {
 	#[cfg(feature = "async")]
 	async fn a_renewed_successor_continues_nothing() {
 		let route = |link: u64| {
-			Route::default()
+			RouteInfo::default()
 				.with_hops(hops(&[10]))
 				.with_instance(format!("link-{link}").parse().unwrap(), 0)
 		};
 		let producer = origin(1).produce();
 		let consumer = producer.consume();
-		let first = producer.requests_route("room/alice", route(0), None).unwrap();
+		let first = producer.forward("room/alice", route(0), None).unwrap();
 		let pending = consumer.request("room/alice", None);
 		let upstream = broadcast::Info::new().produce();
 		queued(&first).await.serve(&upstream);
 		let resolved = pending.await.unwrap();
 
 		// Taken over, then renewed, with no yield between.
-		let second = producer.requests_route("room/alice", route(1), Some(&first)).unwrap();
-		second.update_route(route(2)).unwrap();
+		let second = producer.forward("room/alice", route(1), Some(&first)).unwrap();
+		second.update(route(2)).unwrap();
 		kio::clock::sim::yield_now().await;
 
 		let pending = consumer.request("room/alice", None);
@@ -9809,7 +10075,7 @@ mod tests {
 	async fn a_front_through_a_covering_prefix_lists_nothing() {
 		let producer = origin(1).produce();
 		let consumer = producer.consume();
-		let server = producer.requests_route("room", Route::default(), None).unwrap();
+		let server = producer.forward("room", RouteInfo::default(), None).unwrap();
 		let pending = consumer.request("room/alice", None);
 		let upstream = broadcast::Info::new().produce();
 		let _video = upstream.create_track("video", None).unwrap();
@@ -9829,8 +10095,8 @@ mod tests {
 		let producer = origin(1).produce();
 		let consumer = producer.consume();
 
-		let _local = producer.publish("room/alice", Route::default()).unwrap();
-		let server = producer.requests_route("room/alice", Route::default(), None).unwrap();
+		let _local = producer.route("room/alice", RouteOptions::default()).unwrap();
+		let server = producer.forward("room/alice", RouteInfo::default(), None).unwrap();
 
 		// Were the claim to win, the request would park on its handler forever.
 		let resolved = kio::clock::timeout(Duration::from_secs(1), consumer.request("room/alice", None))
@@ -9838,7 +10104,7 @@ mod tests {
 			.expect("the newer hopless route won the tie")
 			.expect("resolves");
 		assert_eq!(resolved.info().path.as_str(), "room/alice");
-		assert!(server.poll_requested_broadcast(&kio::Waiter::noop()).is_pending());
+		assert!(server.poll_requested(&kio::Waiter::noop()).is_pending());
 	}
 
 	/// Ingress announce stats count advertised intervals, not the broadcast's
@@ -9861,19 +10127,14 @@ mod tests {
 				.unwrap_or_default()
 		};
 
-		let broadcast = producer.create_broadcast("room/alice").unwrap();
+		let broadcast = producer.route("room/alice", RouteOptions::hidden()).unwrap();
 		assert_eq!(announces(), (0, 0), "a hidden broadcast is not announced");
-		broadcast.announce(Route::default()).unwrap();
-		broadcast
-			.announce(Route {
-				cost: Cost::new(3),
-				..Route::default()
-			})
-			.unwrap();
+		broadcast.announce().unwrap();
+		broadcast.set_cost(3).unwrap();
 		assert_eq!(announces(), (1, 0), "a re-price is not another announce");
-		broadcast.unannounce();
+		broadcast.withdraw();
 		assert_eq!(announces(), (1, 1));
-		broadcast.announce(Route::default()).unwrap();
+		broadcast.announce().unwrap();
 		drop(broadcast);
 		assert_eq!(announces(), (2, 2));
 	}
@@ -9887,9 +10148,9 @@ mod tests {
 		let mut announced = consumer.routes();
 
 		let server = producer
-			.requests_route(
+			.forward(
 				"room/alice",
-				Route::default()
+				RouteInfo::default()
 					.with_instance(instance(), 0)
 					.with_hops(hops(&[10]))
 					.with_cost(2),
@@ -9898,7 +10159,10 @@ mod tests {
 			.unwrap();
 		announced.expect_next_active("room/alice").await;
 		let _local = producer
-			.publish("room/alice", Route::default().with_instance(instance(), 0).with_cost(2))
+			.route(
+				"room/alice",
+				RouteOptions::default().with_instance(instance(), 0).with_cost(2),
+			)
 			.unwrap();
 		assert!(announced.expect_next_active("room/alice").await.hops.is_empty());
 
@@ -9907,7 +10171,7 @@ mod tests {
 		for _ in 0..20 {
 			kio::clock::sim::yield_now().await;
 		}
-		assert!(server.poll_requested_broadcast(&kio::Waiter::noop()).is_pending());
+		assert!(server.poll_requested(&kio::Waiter::noop()).is_pending());
 	}
 
 	/// Unannouncing ends the front the origin served from the broadcast and
@@ -9918,17 +10182,20 @@ mod tests {
 		let producer = origin(1).produce();
 		let consumer = producer.consume();
 
-		let broadcast = producer.publish("room/alice", Route::default()).unwrap();
+		let broadcast = producer.route("room/alice", RouteOptions::default()).unwrap();
 		let resolved = consumer.request("room/alice", None).await.expect("resolves");
 
-		broadcast.unannounce();
+		broadcast.withdraw();
 		let err = consumer.request("room/alice", None).await.err().unwrap();
 		assert!(matches!(err, Error::Unroutable), "joined a retracted front: {err}");
 		settle(|| resolved.is_closed()).await;
-		assert!(!broadcast.consume().is_closed(), "the broadcast itself lives on");
+		assert!(
+			!broadcast.broadcast().consume().is_closed(),
+			"the broadcast itself lives on"
+		);
 
 		// Announcing again serves a fresh front.
-		broadcast.announce(Route::default()).unwrap();
+		broadcast.announce().unwrap();
 		let again = consumer.request("room/alice", None).await.expect("resolves again");
 		assert!(!again.is_clone(&resolved));
 	}
@@ -9944,12 +10211,12 @@ mod tests {
 				let consumer = producer.consume();
 
 				let broadcast = producer
-					.publish(
+					.route(
 						"room/alice",
-						Route::default().with_instance(crate::Instance::random(), 0),
+						RouteOptions::default().with_instance(crate::Instance::random(), 0),
 					)
 					.unwrap();
-				let mut dynamic = broadcast.requests();
+				let mut dynamic = broadcast.broadcast().requests();
 				let resolved = consumer.request("room/alice", None).await.expect("resolves");
 				let track = resolved.track("video").unwrap();
 				let mut subscribing = track.subscribe(crate::track::Subscription::default().with_priority(3));
@@ -9960,9 +10227,9 @@ mod tests {
 					.expect("request");
 				let _replacement = replacement.then(|| {
 					producer
-						.requests_route(
+						.forward(
 							"room/alice",
-							Route::default()
+							RouteInfo::default()
 								.with_instance(crate::Instance::random(), 0)
 								.with_hops(hops(&[10])),
 							None,
@@ -9971,9 +10238,9 @@ mod tests {
 				});
 
 				if close {
-					broadcast.close();
+					broadcast.broadcast().close();
 				} else {
-					broadcast.unannounce();
+					broadcast.withdraw();
 				}
 				settle(|| resolved.is_closed()).await;
 				subscribing
@@ -10004,11 +10271,11 @@ mod tests {
 	/// A front resolved through a served route, as a relay's upstream session serves
 	/// one: the upstream broadcast's track requests arrive on the returned handle.
 	#[cfg(feature = "async")]
-	async fn served_front() -> (Requests, broadcast::Producer, broadcast::Requests, broadcast::Consumer) {
+	async fn served_front() -> (Route, broadcast::Producer, broadcast::Requests, broadcast::Consumer) {
 		let producer = origin(1).produce();
 		let consumer = producer.consume();
 		let server = producer
-			.requests_route("room/alice", Route::default().with_hops(hops(&[10])), None)
+			.forward("room/alice", RouteInfo::default().with_hops(hops(&[10])), None)
 			.unwrap();
 		let pending = consumer.request("room/alice", None);
 		let upstream = broadcast::Info::new().produce();
@@ -10089,7 +10356,7 @@ mod tests {
 		let producer = origin(1).produce();
 		// A prefix route, which resolves any path beneath it optimistically.
 		let server = producer
-			.requests_route("room", Route::default().with_hops(hops(&[10])), None)
+			.forward("room", RouteInfo::default().with_hops(hops(&[10])), None)
 			.unwrap();
 		let upstream = broadcast::Info::new().produce();
 		let source = upstream.create_track("video", crate::track::Info::timed()).unwrap();
@@ -10141,7 +10408,7 @@ mod tests {
 	async fn a_hop_in_a_chain_gets_its_own_front() {
 		let producer = origin(1).produce();
 		let _incumbent = producer
-			.requests_route("room", Route::default().with_hops(hops(&[10])), None)
+			.forward("room", RouteInfo::default().with_hops(hops(&[10])), None)
 			.unwrap();
 		let fronts = || producer.shared.lock().fronts.len();
 
@@ -10152,7 +10419,7 @@ mod tests {
 
 		// The same publisher, now also reached through the peer.
 		let _echo = producer
-			.requests_route("room", Route::default().with_hops(hops(&[10, 7])), None)
+			.forward("room", RouteInfo::default().with_hops(hops(&[10, 7])), None)
 			.unwrap();
 		let _filtered = peer.request("room/alice", None);
 		assert_eq!(fronts(), 2, "the peer still shares the plain front");
@@ -10168,7 +10435,7 @@ mod tests {
 		let producer = origin(1).produce();
 		let consumer = producer.consume();
 		let server = producer
-			.requests_route("room", Route::default().with_hops(hops(&[10])), None)
+			.forward("room", RouteInfo::default().with_hops(hops(&[10])), None)
 			.unwrap();
 		let upstream = broadcast::Info::new().produce();
 		let source = upstream.create_track("video", crate::track::Info::timed()).unwrap();
@@ -10203,7 +10470,7 @@ mod tests {
 	async fn a_request_racing_a_front_retiring_never_joins_it_ending() {
 		let producer = origin(1).produce();
 		let consumer = producer.consume();
-		let _broadcast = producer.publish("room/alice", Route::default()).unwrap();
+		let _broadcast = producer.route("room/alice", RouteOptions::default()).unwrap();
 		let fronts = || producer.shared.lock().fronts.len();
 
 		let first = consumer.request("room/alice", None).await.expect("resolves");
@@ -10229,7 +10496,7 @@ mod tests {
 		let producer = origin(1).produce();
 		let consumer = producer.consume();
 		let server = producer
-			.requests_route("room", Route::default().with_hops(hops(&[10])), None)
+			.forward("room", RouteInfo::default().with_hops(hops(&[10])), None)
 			.unwrap();
 		let upstream = broadcast::Info::new().produce();
 		let source = upstream.create_track("video", None).unwrap();
@@ -10258,7 +10525,7 @@ mod tests {
 	async fn a_front_whose_broadcast_closes_ends() {
 		let producer = origin(1).produce();
 		let consumer = producer.consume();
-		let _published = producer.publish("room/alice", Route::default()).unwrap();
+		let _published = producer.route("room/alice", RouteOptions::default()).unwrap();
 		let path = consumer.absolute("room/alice").unwrap();
 		let broadcast = broadcast::Info::new().produce();
 		// Held, so the front waits on its holder rather than retiring on its own.
@@ -10299,11 +10566,15 @@ mod tests {
 	async fn a_peers_filtered_front_ends_once_unread() {
 		let producer = origin(1).produce();
 		let server = producer
-			.requests_route("room", Route::default().with_hops(hops(&[10])), None)
+			.forward("room", RouteInfo::default().with_hops(hops(&[10])), None)
 			.unwrap();
 		// The same publisher, also reached through the peer, at a price the plain front skips.
 		let _echo = producer
-			.requests_route("room", Route::default().with_hops(hops(&[10, 7])).with_cost(100), None)
+			.forward(
+				"room",
+				RouteInfo::default().with_hops(hops(&[10, 7])).with_cost(100),
+				None,
+			)
 			.unwrap();
 		let upstream = broadcast::Info::new().produce();
 		let source = upstream.create_track("video", crate::track::Info::timed()).unwrap();
@@ -10339,9 +10610,9 @@ mod tests {
 		let peer = producer.consume().excluding(origin(7));
 		let mut view = peer.routes();
 		let incumbent = producer
-			.requests_route(
+			.forward(
 				"room",
-				Route::default().with_instance(instance(), 0).with_hops(hops(&[10])),
+				RouteInfo::default().with_instance(instance(), 0).with_hops(hops(&[10])),
 				None,
 			)
 			.unwrap();
@@ -10354,9 +10625,11 @@ mod tests {
 
 		// The same publisher, now also reached through the peer, outlives the incumbent.
 		let echo = producer
-			.requests_route(
+			.forward(
 				"room",
-				Route::default().with_instance(instance(), 0).with_hops(hops(&[10, 7])),
+				RouteInfo::default()
+					.with_instance(instance(), 0)
+					.with_hops(hops(&[10, 7])),
 				None,
 			)
 			.unwrap();
@@ -10387,9 +10660,9 @@ mod tests {
 	async fn takeover_keeps_the_open_group_head(dies_first: bool) {
 		let producer = origin(1).produce();
 		let first_server = producer
-			.requests_route(
+			.forward(
 				"room/alice",
-				Route::default()
+				RouteInfo::default()
 					.with_instance(instance(), 0)
 					.with_hops(hops(&[10]))
 					.with_cost(5),
@@ -10446,9 +10719,9 @@ mod tests {
 		}
 		let cost = if dies_first { 5 } else { 0 };
 		let replacement_server = producer
-			.requests_route(
+			.forward(
 				"room/alice",
-				Route::default()
+				RouteInfo::default()
 					.with_instance(instance(), 0)
 					.with_hops(hops(&[10]))
 					.with_cost(cost),
@@ -10560,8 +10833,8 @@ mod tests {
 		let producer = origin(1).produce();
 		let consumer = producer.consume();
 
-		let broadcast = producer.publish("room/alice", Route::default()).unwrap();
-		let mut dynamic = broadcast.requests();
+		let broadcast = producer.route("room/alice", RouteOptions::default()).unwrap();
+		let mut dynamic = broadcast.broadcast().requests();
 		let resolved = consumer.request("room/alice", None).await.expect("resolves");
 		let track = resolved.track("video").unwrap();
 		let subscribing = kio::clock::sim::spawn(async move { track.subscribe(None).await });
@@ -10591,7 +10864,7 @@ mod tests {
 			.expect("the front asked the source again")
 			.expect("request");
 
-		broadcast.unannounce();
+		broadcast.withdraw();
 		settle(|| resolved.is_closed()).await;
 
 		// A fresh source copy numbers groups past what the cache already delivered.
@@ -10617,11 +10890,11 @@ mod tests {
 		let producer = origin(1).produce();
 		let consumer = producer.consume();
 
-		let broadcast = producer.publish("room/alice", Route::default()).unwrap();
+		let broadcast = producer.route("room/alice", RouteOptions::default()).unwrap();
 		let resolved = consumer.request("room/alice", None).await.expect("resolves");
 
-		broadcast.unannounce();
-		broadcast.announce(Route::default()).unwrap();
+		broadcast.withdraw();
+		broadcast.announce().unwrap();
 		for _ in 0..20 {
 			kio::clock::sim::yield_now().await;
 		}
@@ -10637,7 +10910,7 @@ mod tests {
 		let consumer = producer.consume();
 
 		// Created but not announced: nobody can reach it, locally included.
-		let broadcast = producer.create_broadcast("room/alice").unwrap();
+		let broadcast = producer.route("room/alice", RouteOptions::hidden()).unwrap();
 		let err = consumer
 			.request("room/alice", None)
 			.now_or_never()
@@ -10646,7 +10919,7 @@ mod tests {
 			.unwrap();
 		assert!(matches!(err, Error::Unroutable));
 
-		broadcast.announce(Route::default()).unwrap();
+		broadcast.announce().unwrap();
 		let resolved = consumer.request("room/alice", None).await.expect("resolves");
 		assert_eq!(resolved.info().path.as_str(), "room/alice");
 		drop(broadcast);
@@ -10662,13 +10935,15 @@ mod tests {
 	}
 
 	#[kio::test]
-	async fn create_broadcast_accepts_a_path_at_the_wire_limits() {
+	async fn route_accepts_a_path_at_the_wire_limits() {
 		let producer = origin(1).produce();
 		let path = vec!["a"; Path::MAX_PARTS].join("/");
-		let _broadcast = producer.create_broadcast(path.as_str()).expect("max depth is allowed");
+		let _broadcast = producer
+			.route(path.as_str(), RouteOptions::hidden())
+			.expect("max depth is allowed");
 		let deeper = vec!["a"; Path::MAX_PARTS + 1].join("/");
 		assert!(matches!(
-			producer.create_broadcast(deeper.as_str()),
+			producer.route(deeper.as_str(), RouteOptions::hidden()),
 			Err(Error::BoundsExceeded(_))
 		));
 
@@ -10676,11 +10951,11 @@ mod tests {
 		let rooted = producer.scope("r", &Patterns::from(Pattern::all())).unwrap();
 		let longest = "b".repeat(Path::MAX_BYTES - 2);
 		let _long = rooted
-			.create_broadcast(longest.as_str())
+			.route(longest.as_str(), RouteOptions::hidden())
 			.expect("max length is allowed");
 		let longer = "c".repeat(Path::MAX_BYTES - 1);
 		assert!(matches!(
-			rooted.create_broadcast(longer.as_str()),
+			rooted.route(longer.as_str(), RouteOptions::hidden()),
 			Err(Error::BoundsExceeded(_))
 		));
 	}
@@ -10690,10 +10965,10 @@ mod tests {
 	async fn duplicate_routes_aggregate_until_the_last_leaves() {
 		let producer = origin(1).produce();
 		let first = producer
-			.requests_route("live", Route::default().with_cost(3), None)
+			.forward("live", RouteInfo::default().with_cost(3), None)
 			.unwrap();
 		let second = producer
-			.requests_route("live", Route::default().with_cost(1), None)
+			.forward("live", RouteInfo::default().with_cost(1), None)
 			.unwrap();
 
 		let mut announced = producer.consume().routes();
@@ -10718,25 +10993,25 @@ mod tests {
 		let producer = origin(1).produce();
 		let scoped = producer.scope("", &scopes(&["room"])).unwrap();
 		let _broad = scoped
-			.requests_route("", Route::default(), None)
+			.forward("", RouteInfo::default(), None)
 			.expect("an overlapping prefix is accepted");
 
 		let _ok = scoped
-			.requests_route("room/alice", Route::default(), None)
+			.forward("room/alice", RouteInfo::default(), None)
 			.expect("a contained prefix is accepted");
 		assert!(matches!(
-			scoped.requests_route("other", Route::default(), None),
+			scoped.forward("other", RouteInfo::default(), None),
 			Err(Error::Unauthorized)
 		));
 	}
 
 	#[kio::test]
 	#[cfg(feature = "async")]
-	async fn requests_route_keeps_its_producer_scope() {
+	async fn forward_keeps_its_producer_scope() {
 		let producer = origin(1).produce();
 		let scope = Patterns::from("*/chat".parse::<Pattern>().unwrap());
 		let scoped = producer.scope("", &scope).unwrap();
-		let dynamic = scoped.requests_route("", Route::default(), None).unwrap();
+		let dynamic = scoped.forward("", RouteInfo::default(), None).unwrap();
 
 		let mut matching = producer
 			.consume()
@@ -10759,7 +11034,7 @@ mod tests {
 			.now_or_never()
 			.expect("an out-of-scope request must be refused synchronously");
 		assert!(matches!(refused, Err(Error::Unroutable)));
-		assert!(dynamic.requested_broadcast().now_or_never().is_none());
+		assert!(dynamic.requested().now_or_never().is_none());
 
 		let _pending = producer.consume().request("room/chat", None);
 		let request = queued(&dynamic).await;
@@ -10775,10 +11050,10 @@ mod tests {
 				.unwrap()
 		};
 		let _chat = scoped("*/chat")
-			.requests_route("", Route::default().with_cost(1), None)
+			.forward("", RouteInfo::default().with_cost(1), None)
 			.unwrap();
 		let _video = scoped("*/video")
-			.requests_route("", Route::default().with_cost(5), None)
+			.forward("", RouteInfo::default().with_cost(5), None)
 			.unwrap();
 
 		let mut video = producer
@@ -10811,7 +11086,11 @@ mod tests {
 		let chat = producer
 			.scope("", &scopes(&["room/live/chat"]))
 			.unwrap()
-			.requests_route("room/live", Route::default().with_hops(hops(&[7])).with_cost(1), None)
+			.forward(
+				"room/live",
+				RouteInfo::default().with_hops(hops(&[7])).with_cost(1),
+				None,
+			)
 			.unwrap();
 		assert_eq!(all.expect_next_active("room/live").await.cost, Cost::new(1));
 		assert_eq!(rooted.expect_next_active("").await.cost, Cost::new(1));
@@ -10821,14 +11100,18 @@ mod tests {
 		let video_route = producer
 			.scope("", &scopes(&["room/live/video"]))
 			.unwrap()
-			.requests_route("room/live", Route::default().with_hops(hops(&[8])).with_cost(5), None)
+			.forward(
+				"room/live",
+				RouteInfo::default().with_hops(hops(&[8])).with_cost(5),
+				None,
+			)
 			.unwrap();
 		all.assert_next_wait();
 		rooted.assert_next_wait();
 		assert_eq!(excluded.expect_next_active("room/live").await.cost, Cost::new(5));
 		assert_eq!(video.expect_next_active("room/live").await.cost, Cost::new(5));
 
-		chat.update_route(Route::default().with_hops(hops(&[7])).with_cost(9))
+		chat.update(RouteInfo::default().with_hops(hops(&[7])).with_cost(9))
 			.unwrap();
 		assert_eq!(all.expect_next_active("room/live").await.cost, Cost::new(5));
 		assert_eq!(rooted.expect_next_active("").await.cost, Cost::new(5));
@@ -10847,10 +11130,10 @@ mod tests {
 	async fn root_cursor_keeps_the_more_specific_covering_route() {
 		let producer = origin(1).produce();
 		let broad = producer
-			.requests_route("room", Route::default().with_cost(1), None)
+			.forward("room", RouteInfo::default().with_cost(1), None)
 			.unwrap();
 		let narrow = producer
-			.requests_route("room/live", Route::default().with_cost(9), None)
+			.forward("room/live", RouteInfo::default().with_cost(9), None)
 			.unwrap();
 		let mut announced = producer
 			.consume()
@@ -10860,9 +11143,9 @@ mod tests {
 			.routes();
 		assert_eq!(announced.expect_next_active("").await.cost, Cost::new(9));
 
-		broad.update_route(Route::default().with_cost(0)).unwrap();
+		broad.update(RouteInfo::default().with_cost(0)).unwrap();
 		announced.assert_next_wait();
-		narrow.update_route(Route::default().with_cost(8)).unwrap();
+		narrow.update(RouteInfo::default().with_cost(8)).unwrap();
 		assert_eq!(announced.expect_next_active("").await.cost, Cost::new(8));
 		drop(narrow);
 		assert_eq!(announced.expect_next_active("").await.cost, Cost::new(0));
@@ -10879,7 +11162,7 @@ mod tests {
 		let mut announced = producer.consume().routes();
 
 		let dynamic = producer
-			.requests_route(&path, Route::default(), None)
+			.forward(&path, RouteInfo::default(), None)
 			.expect("max depth is allowed");
 		announced.expect_next_active(&path).await;
 
@@ -10892,7 +11175,7 @@ mod tests {
 	async fn dynamic_exclusion_skips_routes_through_the_subscriber() {
 		let producer = origin(1).produce();
 		let _server = producer
-			.requests_route("live", Route::default().with_hops(hops(&[7])), None)
+			.forward("live", RouteInfo::default().with_hops(hops(&[7])), None)
 			.unwrap();
 
 		let mut excluded = producer.consume().excluding(origin(7)).routes();
@@ -10908,7 +11191,7 @@ mod tests {
 	async fn announce_consumer_is_a_stream() {
 		use futures::StreamExt;
 		let producer = origin(1).produce();
-		let server = producer.requests_route("live", Route::default(), None).unwrap();
+		let server = producer.forward("live", RouteInfo::default(), None).unwrap();
 		let mut announced = producer.consume().routes();
 		let mut next = || StreamExt::next(&mut announced).now_or_never();
 		let Some(Some(RouteEvent::Start(update))) = next() else {
@@ -10923,7 +11206,7 @@ mod tests {
 	#[kio::test]
 	async fn dynamic_retracts() {
 		let producer = origin(1).produce();
-		let server = producer.requests_route("live", Route::default(), None).unwrap();
+		let server = producer.forward("live", RouteInfo::default(), None).unwrap();
 		let mut announced = producer.consume().routes();
 		announced.expect_next_active("live").await;
 
@@ -10936,11 +11219,11 @@ mod tests {
 		let producer = origin(1).produce();
 		let mut local = producer.consume().routes();
 		let mut peer = producer.consume().excluding(Hop::UNKNOWN).routes();
-		let broadcast = producer.create_broadcast("room/alice").unwrap();
+		let broadcast = producer.route("room/alice", RouteOptions::hidden()).unwrap();
 		local.assert_next_wait();
 		peer.assert_next_wait();
 
-		broadcast.announce(Route::default()).unwrap();
+		broadcast.announce().unwrap();
 		local.expect_next_active("room/alice").await;
 		peer.expect_next_active("room/alice").await;
 
@@ -10955,7 +11238,7 @@ mod tests {
 		let producer = origin(1).produce();
 		let consumer = producer.consume();
 
-		let server = producer.requests("room").unwrap();
+		let server = producer.route_prefix("room", RouteOptions::default()).unwrap();
 
 		let pending = consumer.request("room/alice", None);
 		let request = queued(&server).await;
@@ -10978,14 +11261,14 @@ mod tests {
 	async fn served_requests_coalesce() {
 		let producer = origin(1).produce();
 		let consumer = producer.consume();
-		let server = producer.requests_route("room", Route::default(), None).unwrap();
+		let server = producer.forward("room", RouteInfo::default(), None).unwrap();
 
 		let first = consumer.request("room/alice", None);
 		let second = consumer.request("room/alice", None);
 
 		let request = queued(&server).await;
 		// Only one request reaches the server.
-		assert!(server.poll_requested_broadcast(&kio::Waiter::noop()).is_pending());
+		assert!(server.poll_requested(&kio::Waiter::noop()).is_pending());
 
 		let source = broadcast::Info::new().produce();
 		request.serve(&source);
@@ -11000,7 +11283,7 @@ mod tests {
 	async fn retract_rejects_pending_requests() {
 		let producer = origin(1).produce();
 		let consumer = producer.consume();
-		let server = producer.requests_route("room", Route::default(), None).unwrap();
+		let server = producer.forward("room", RouteInfo::default(), None).unwrap();
 
 		let pending = consumer.request("room/alice", None);
 		drop(server);
@@ -11026,9 +11309,9 @@ mod tests {
 
 		// Three identical routes, oldest first: the newest identical route wins
 		// requests, and swapping between them emits no announce update.
-		let standby_server = producer.requests_route("room", Route::default(), None).unwrap();
-		let second_server = producer.requests_route("room", Route::default(), None).unwrap();
-		let incumbent_server = producer.requests_route("room", Route::default(), None).unwrap();
+		let standby_server = producer.forward("room", RouteInfo::default(), None).unwrap();
+		let second_server = producer.forward("room", RouteInfo::default(), None).unwrap();
+		let incumbent_server = producer.forward("room", RouteInfo::default(), None).unwrap();
 
 		let mut following = consumer.follow("room/alice", None).unwrap();
 		let mut resolving = Box::pin(following.available());
@@ -11056,7 +11339,7 @@ mod tests {
 	async fn split_horizon_skips_routes_through_the_requester() {
 		let producer = origin(1).produce();
 		let _server = producer
-			.requests_route("room", Route::default().with_hops(hops(&[7])), None)
+			.forward("room", RouteInfo::default().with_hops(hops(&[7])), None)
 			.unwrap();
 
 		// The requester's own bytes must not be served back to it.
@@ -11082,17 +11365,17 @@ mod tests {
 		let mut announced = producer.consume().routes();
 
 		let _ingest = producer
-			.requests_route(
+			.forward(
 				"client",
-				Route::default().with_hops(hops(&[5])).with_via(origin(5)),
+				RouteInfo::default().with_hops(hops(&[5])).with_via(origin(5)),
 				None,
 			)
 			.unwrap();
-		let _gateway = producer.publish("gateway", Route::default()).unwrap();
+		let _gateway = producer.route("gateway", RouteOptions::default()).unwrap();
 		let _forwarded = peer
-			.requests_route(
+			.forward(
 				"forwarded",
-				Route::default().with_hops(hops(&[5, 7])).with_via(origin(7)),
+				RouteInfo::default().with_hops(hops(&[5, 7])).with_via(origin(7)),
 				None,
 			)
 			.unwrap();
@@ -11107,7 +11390,7 @@ mod tests {
 		// The mark survives narrowing the handle.
 		let scoped = peer.scope("room", &Patterns::from(Pattern::all())).unwrap();
 		let _nested = scoped
-			.requests_route("x", Route::default().with_via(origin(8)), None)
+			.forward("x", RouteInfo::default().with_via(origin(8)), None)
 			.unwrap();
 		assert_eq!(
 			announced.expect_next_active("room/x").await.source(),
@@ -11137,15 +11420,15 @@ mod tests {
 
 		// One instance, so the winner moving between routes is an update, not a restart.
 		let route = |chain: &[u64], via| {
-			Route::default()
+			RouteInfo::default()
 				.with_instance(instance(), 0)
 				.with_hops(hops(chain))
 				.with_via(origin(via))
 		};
-		let near = peer.requests_route("room", route(&[9, 2], 2), None).unwrap();
+		let near = peer.forward("room", route(&[9, 2], 2), None).unwrap();
 		announced.assert_try_next_active("room");
 
-		let _far = peer.requests_route("room", route(&[9, 3, 4], 4), None).unwrap();
+		let _far = peer.forward("room", route(&[9, 3, 4], 4), None).unwrap();
 		drop(near);
 		assert!(announced.try_next().is_none(), "the update is held");
 		step(Duration::from_millis(1)).await;
@@ -11172,7 +11455,7 @@ mod tests {
 			let peer = producer.clone().with_link(Link::Peer);
 			// One instance, so the winner moving between routes is an update, not a restart.
 			let route = |chain: &[u64], via| {
-				Route::default()
+				RouteInfo::default()
 					.with_instance(instance(), 0)
 					.with_hops(hops(chain))
 					.with_via(origin(via))
@@ -11180,14 +11463,8 @@ mod tests {
 			let mut near = Vec::new();
 			let mut far = Vec::new();
 			for i in 0..k {
-				near.push(
-					peer.requests_route(format!("room/{i}"), route(&[9, 2], 2), None)
-						.unwrap(),
-				);
-				far.push(
-					peer.requests_route(format!("room/{i}"), route(&[9, 3, 4], 4), None)
-						.unwrap(),
-				);
+				near.push(peer.forward(format!("room/{i}"), route(&[9, 2], 2), None).unwrap());
+				far.push(peer.forward(format!("room/{i}"), route(&[9, 3, 4], 4), None).unwrap());
 			}
 			let mut announced = producer.consume().routes();
 			for _ in 0..k {
@@ -11227,17 +11504,17 @@ mod tests {
 
 		// One instance, so the winner moving between routes is an update, not a restart.
 		let route = |chain: &[u64], via| {
-			Route::default()
+			RouteInfo::default()
 				.with_instance(instance(), 0)
 				.with_hops(hops(chain))
 				.with_via(origin(via))
 		};
-		let near = peer.requests_route("room", route(&[9, 2], 2), None).unwrap();
+		let near = peer.forward("room", route(&[9, 2], 2), None).unwrap();
 		announced.expect_next_active("room").await;
 
 		// The best route changes twice; the consumer sees only the last, once.
-		let far = peer.requests_route("room", route(&[9, 3, 4], 4), None).unwrap();
-		let farther = peer.requests_route("room", route(&[9, 5, 6, 7], 7), None).unwrap();
+		let far = peer.forward("room", route(&[9, 3, 4], 4), None).unwrap();
+		let farther = peer.forward("room", route(&[9, 5, 6, 7], 7), None).unwrap();
 		let start = kio::clock::now();
 		drop(near);
 		drop(far);
@@ -11265,36 +11542,36 @@ mod tests {
 
 		// Every path is to one publisher, so to one instance.
 		let route = |chain: &[u64], via| {
-			Route::default()
+			RouteInfo::default()
 				.with_instance(instance(), 0)
 				.with_hops(hops(chain))
 				.with_via(origin(via))
 		};
 
-		let near = peer.requests_route("named", route(&[9, 2], 2), None).unwrap();
+		let near = peer.forward("named", route(&[9, 2], 2), None).unwrap();
 		announced.expect_next_active("named").await;
 		drop(near);
 		announced.expect_next_ended("named").await;
 		let start = kio::clock::now();
-		let _stale = peer.requests_route("named", route(&[9, 3, 4], 4), None).unwrap();
+		let _stale = peer.forward("named", route(&[9, 3, 4], 4), None).unwrap();
 		match announced.next().await.unwrap() {
 			RouteEvent::Start(announce) => assert_eq!(announce.route.hops, hops(&[9, 3, 4])),
 			other => panic!("should be a start: got {other:?}"),
 		}
 		assert!(kio::clock::now() - start >= RETRACT_QUARANTINE);
 
-		let near = peer.requests_route("anonymous", route(&[0, 2], 2), None).unwrap();
+		let near = peer.forward("anonymous", route(&[0, 2], 2), None).unwrap();
 		announced.expect_next_active("anonymous").await;
 		drop(near);
 		announced.expect_next_ended("anonymous").await;
-		let _other = peer.requests_route("anonymous", route(&[0, 3, 4], 4), None).unwrap();
+		let _other = peer.forward("anonymous", route(&[0, 3, 4], 4), None).unwrap();
 		announced.expect_next_active("anonymous").await;
 
 		// Retract and announce cycles at one clock reading queue the prefix once,
 		// whether or not the route names its publisher.
 		let queued = announced.anchoring.len();
 		for chain in [[9, 2], [0, 2], [9, 2], [0, 2]] {
-			let churn = peer.requests_route("churn", route(&chain, 2), None).unwrap();
+			let churn = peer.forward("churn", route(&chain, 2), None).unwrap();
 			announced.expect_next_active("churn").await;
 			drop(churn);
 			announced.expect_next_ended("churn").await;
@@ -11303,7 +11580,7 @@ mod tests {
 
 		// A quarantine is forgotten once it ends: the cursor wakes to anchor it,
 		// then again to drop it.
-		let gone = peer.requests_route("gone", route(&[9, 2], 2), None).unwrap();
+		let gone = peer.forward("gone", route(&[9, 2], 2), None).unwrap();
 		announced.expect_next_active("gone").await;
 		drop(gone);
 		announced.expect_next_ended("gone").await;
@@ -11326,12 +11603,12 @@ mod tests {
 		let mut announced = producer.consume().routes();
 
 		// Publisher 9 ingests at relay 2; relay 3 relays 2's route.
-		let direct = || Route::default().with_hops(hops(&[9, 2])).with_via(origin(2));
-		let first = peer.requests_route("room", direct(), None).unwrap();
+		let direct = || RouteInfo::default().with_hops(hops(&[9, 2])).with_via(origin(2));
+		let first = peer.forward("room", direct(), None).unwrap();
 		let relayed = peer
-			.requests_route(
+			.forward(
 				"room",
-				Route::default().with_hops(hops(&[9, 2, 3])).with_via(origin(3)),
+				RouteInfo::default().with_hops(hops(&[9, 2, 3])).with_via(origin(3)),
 				None,
 			)
 			.unwrap();
@@ -11344,7 +11621,7 @@ mod tests {
 		announced.assert_next_wait();
 
 		// Relay 2 announces again, and the relayed copy is live with it.
-		let second = peer.requests_route("room", direct(), None).unwrap();
+		let second = peer.forward("room", direct(), None).unwrap();
 		announced.expect_next_active("room").await;
 		assert!(producer.shared.lock().withdrawn.is_empty());
 
@@ -11363,9 +11640,11 @@ mod tests {
 			let producer = origin(1).produce();
 			let peer = producer.clone().with_link(Link::Peer);
 			let mut announced = producer.consume().routes();
-			let route = Route::default().with_instance(instance(), 0).with_hops(hops(&[9, 2]));
-			let first = peer.requests_route("room", route.clone(), None).unwrap();
-			let second = peer.requests_route("room", route.clone(), None).unwrap();
+			let route = RouteInfo::default()
+				.with_instance(instance(), 0)
+				.with_hops(hops(&[9, 2]));
+			let first = peer.forward("room", route.clone(), None).unwrap();
+			let second = peer.forward("room", route.clone(), None).unwrap();
 			announced.expect_next_active("room").await;
 			announced.assert_next_wait();
 			let remaining = if old_first {
@@ -11388,10 +11667,10 @@ mod tests {
 		let producer = origin(1).produce();
 		let peer = producer.clone().with_link(Link::Peer);
 		let direct = peer
-			.requests_route("room", Route::default().with_hops(hops(&[9, 2])), None)
+			.forward("room", RouteInfo::default().with_hops(hops(&[9, 2])), None)
 			.unwrap();
 		let _relayed = peer
-			.requests_route("room", Route::default().with_hops(hops(&[9, 2, 3])), None)
+			.forward("room", RouteInfo::default().with_hops(hops(&[9, 2, 3])), None)
 			.unwrap();
 		let path = Path::from_static("room/video");
 		let id = producer
@@ -11417,18 +11696,18 @@ mod tests {
 		let peer = producer.clone().with_link(Link::Peer);
 		let mut announced = producer.consume().routes();
 
-		let route = Route::default()
+		let route = RouteInfo::default()
 			.with_instance(instance(), 0)
 			.with_hops(hops(&[7]))
 			.with_via(origin(7));
-		let _forwarded = peer.requests_route("room", route.clone(), None).unwrap();
+		let _forwarded = peer.forward("room", route.clone(), None).unwrap();
 		assert_eq!(
 			announced.expect_next_active("room").await.source(),
 			Source::Peer(origin(7))
 		);
 
 		// The newest identical route wins, so the local twin takes over.
-		let local = producer.requests_route("room", route, None).unwrap();
+		let local = producer.forward("room", route, None).unwrap();
 		match announced.next().await.expect("no next") {
 			RouteEvent::Update(announce) => assert_eq!(announce.route.source(), Source::Local),
 			other => panic!("should be an update: got {other:?}"),
@@ -11448,9 +11727,9 @@ mod tests {
 		let mut local = producer.consume().local().routes();
 
 		let _forwarded = peer
-			.requests_route(
+			.forward(
 				"remote",
-				Route::default().with_hops(hops(&[7])).with_via(origin(7)),
+				RouteInfo::default().with_hops(hops(&[7])).with_via(origin(7)),
 				None,
 			)
 			.unwrap();
@@ -11460,12 +11739,19 @@ mod tests {
 		// and retracts from the local view when the local route goes, even though
 		// the peer's still covers it.
 		let _shadow = peer
-			.requests_route("both", Route::default().with_hops(hops(&[7])).with_via(origin(7)), None)
+			.forward(
+				"both",
+				RouteInfo::default().with_hops(hops(&[7])).with_via(origin(7)),
+				None,
+			)
 			.unwrap();
 		let ingest = producer
-			.requests_route(
+			.forward(
 				"both",
-				Route::default().with_hops(hops(&[5])).with_via(origin(5)).with_cost(9),
+				RouteInfo::default()
+					.with_hops(hops(&[5]))
+					.with_via(origin(5))
+					.with_cost(9),
 				None,
 			)
 			.unwrap();
@@ -11505,7 +11791,11 @@ mod tests {
 		let mut everyone = producer.consume().routes();
 
 		let _core = core
-			.requests_route("core", Route::default().with_hops(hops(&[7])).with_via(origin(7)), None)
+			.forward(
+				"core",
+				RouteInfo::default().with_hops(hops(&[7])).with_via(origin(7)),
+				None,
+			)
 			.unwrap();
 		assert_eq!(
 			everyone.expect_next_active("core").await.source(),
@@ -11514,7 +11804,11 @@ mod tests {
 		toward_core.assert_next_wait();
 
 		let _mesh = peer
-			.requests_route("mesh", Route::default().with_hops(hops(&[8])).with_via(origin(8)), None)
+			.forward(
+				"mesh",
+				RouteInfo::default().with_hops(hops(&[8])).with_via(origin(8)),
+				None,
+			)
 			.unwrap();
 		assert_eq!(
 			toward_core.expect_next_active("mesh").await.source(),
@@ -11524,12 +11818,19 @@ mod tests {
 		// A path both an upstream and a mesh peer reach: the upstream route is
 		// cheaper, yet the upstream view selects the mesh peer's.
 		let _cheap = core
-			.requests_route("both", Route::default().with_hops(hops(&[7])).with_via(origin(7)), None)
+			.forward(
+				"both",
+				RouteInfo::default().with_hops(hops(&[7])).with_via(origin(7)),
+				None,
+			)
 			.unwrap();
 		let mesh = peer
-			.requests_route(
+			.forward(
 				"both",
-				Route::default().with_hops(hops(&[8])).with_via(origin(8)).with_cost(9),
+				RouteInfo::default()
+					.with_hops(hops(&[8]))
+					.with_via(origin(8))
+					.with_cost(9),
 				None,
 			)
 			.unwrap();
@@ -11561,7 +11862,7 @@ mod tests {
 	async fn handler_rejection_is_final() {
 		let producer = origin(1).produce();
 		let consumer = producer.consume();
-		let server = producer.requests_route("room", Route::default(), None).unwrap();
+		let server = producer.forward("room", RouteInfo::default(), None).unwrap();
 
 		let pending = consumer.request("room/alice", None);
 		let request = queued(&server).await;
@@ -11587,78 +11888,85 @@ mod tests {
 	async fn claim_answer_is_hidden_until_published_with_its_instance() {
 		let producer = origin(1).produce();
 		let consumer = producer.consume();
-		let claim = producer.requests("room").unwrap();
+		let claim = producer.route_prefix("room", RouteOptions::default()).unwrap();
 		let mut pending = Box::pin(consumer.request("room/alice", None));
 		assert!((&mut pending).now_or_never().is_none());
 
-		let prepared = queued(&claim).await.prepare().unwrap();
+		let prepared = queued(&claim).await.route(RouteOptions::hidden()).unwrap();
 		let _track = prepared
 			.broadcast()
 			.create_track("video", crate::track::Info::timed())
 			.unwrap();
 		assert!((&mut pending).now_or_never().is_none());
 
-		let published = prepared.publish().unwrap();
+		prepared.announce().unwrap();
 		let resolved = pending.await.unwrap();
-		assert_eq!(resolved.info().instance, published.route().unwrap().instance);
+		assert_eq!(resolved.info().instance, prepared.route().unwrap().instance);
 		assert_ne!(
 			resolved.info().instance,
-			claim.route().instance,
+			claim.route().unwrap().instance,
 			"a job is a stream of its own"
 		);
 		assert!(resolved.track("video").is_ok());
 	}
 
-	/// Only `publish` announces a prepared answer, under its instance and after admission.
+	/// A hidden job's route is listed by no cursor until it announces, under its instance.
 	#[kio::test]
 	#[cfg(feature = "async")]
-	async fn a_prepared_answer_cannot_announce_itself() {
+	async fn a_hidden_job_route_is_listed_only_once_announced() {
 		let producer = origin(1).produce();
 		let mut announced = producer.consume().routes();
-		let claim = producer.requests("room").unwrap();
+		let claim = producer.route_prefix("room", RouteOptions::default()).unwrap();
 		announced.assert_next_active("room");
 		let pending = producer.consume().request("room/alice", None);
-		let prepared = queued(&claim).await.prepare().unwrap();
-		let answer = prepared.broadcast().clone();
-
-		let other = Route::default().with_instance(crate::Instance::random(), 0);
-		assert!(matches!(answer.announce(other), Err(Error::Closed)));
-		assert!(answer.route().is_none());
+		let prepared = queued(&claim).await.route(RouteOptions::hidden()).unwrap();
+		assert!(prepared.route().is_none());
 		announced.assert_next_wait();
 
-		let published = prepared.publish().unwrap();
-		let instance = published.route().and_then(|route| route.instance);
+		prepared.announce().unwrap();
+		let instance = prepared.route().and_then(|route| route.instance);
 		assert!(instance.is_some());
+		match announced.expect_next().await {
+			RouteEvent::Takeover { announce, .. } => {
+				assert_eq!(announce.prefix.as_str(), "room/alice");
+				assert_eq!(announce.route.instance, instance);
+			}
+			other => panic!("should take over from the claim: got {other:?}"),
+		}
 		assert_eq!(pending.await.unwrap().info().instance, instance);
 	}
 
-	/// Announcement control follows the origin role while fill clones retain publication lifetime.
+	/// Route clones share announcement control, while a fill handle on its broadcast
+	/// keeps the broadcast alive but not the route.
 	#[kio::test]
 	#[cfg(feature = "async")]
-	async fn publication_clones_share_control_and_fill_retention() {
+	async fn route_clones_share_control_and_fill_handles_do_not_retain_it() {
 		let producer = origin(1).produce();
 		let consumer = producer.consume();
 		let mut events = consumer.routes();
-		let publication = producer.create_broadcast("room/alice").unwrap();
+		let publication = producer
+			.route("room/alice", RouteOptions::hidden().with_instance(instance(), 0))
+			.unwrap();
 		let fill = publication.broadcast().clone();
 		let control = publication.clone();
-		publication
-			.announce(Route::default().with_instance(instance(), 0))
-			.unwrap();
-		events.expect_next_active("room/alice").await;
-		control.unannounce();
+		publication.announce().unwrap();
+		assert_eq!(events.expect_next_active("room/alice").await.instance, Some(instance()));
+		control.withdraw();
 		events.expect_next_ended("room/alice").await;
 		assert!(publication.route().is_none());
-		publication
-			.announce(Route::default().with_instance(instance(), 0))
-			.unwrap();
-		events.expect_next_active("room/alice").await;
+		publication.announce().unwrap();
+		assert_eq!(events.expect_next_active("room/alice").await.instance, Some(instance()));
 		drop(control);
-		drop(publication);
 		events.assert_next_wait();
-		consumer.request("room/alice", None).await.unwrap();
-		drop(fill);
+		let held = consumer.request("room/alice", None).await.unwrap();
+		drop(publication);
 		events.expect_next_ended("room/alice").await;
+		assert!(matches!(
+			consumer.request("room/alice", None).await,
+			Err(Error::Unroutable)
+		));
+		assert!(!held.is_closed(), "the fill handle keeps the broadcast alive");
+		drop(fill);
 	}
 
 	/// A withdrawn stale publication cannot remove a replacement instance's route.
@@ -11668,17 +11976,17 @@ mod tests {
 		let producer = origin(1).produce();
 		let consumer = producer.consume();
 		let old = producer
-			.publish("room/alice", Route::default().with_instance(instance(), 0))
+			.route("room/alice", RouteOptions::default().with_instance(instance(), 0))
 			.unwrap();
 		let replacement_instance: crate::Instance = "01900000-0000-7000-8000-000000000002".parse().unwrap();
 		let replacement = producer
-			.publish(
+			.route(
 				"room/alice",
-				Route::default().with_instance(replacement_instance.clone(), 0),
+				RouteOptions::default().with_instance(replacement_instance.clone(), 0),
 			)
 			.unwrap();
-		old.unannounce();
-		old.close();
+		old.withdraw();
+		old.broadcast().close();
 		assert_eq!(
 			replacement.route().unwrap().instance,
 			Some(replacement_instance.clone())
@@ -11695,14 +12003,14 @@ mod tests {
 	#[cfg(feature = "async")]
 	async fn a_refused_prepared_answer_cannot_announce_later() {
 		let producer = origin(1).produce();
-		let claim = producer.requests("room").unwrap();
+		let claim = producer.route_prefix("room", RouteOptions::default()).unwrap();
 		let _pending = producer.consume().request("room/alice", None);
-		let prepared = queued(&claim).await.prepare().unwrap();
-		let answer = prepared.broadcast().clone();
+		let prepared = queued(&claim).await.route(RouteOptions::hidden()).unwrap();
+		let clone = prepared.clone();
 
 		drop(claim);
-		assert!(matches!(prepared.publish(), Err(Error::Unroutable)));
-		assert!(matches!(answer.announce(Route::default()), Err(Error::Closed)));
+		assert!(matches!(prepared.announce(), Err(Error::Unroutable)));
+		assert!(matches!(clone.announce(), Err(Error::Closed)));
 	}
 
 	#[kio::test]
@@ -11710,9 +12018,9 @@ mod tests {
 	async fn dropping_a_prepared_claim_answer_refuses_the_request() {
 		let producer = origin(1).produce();
 		let consumer = producer.consume();
-		let claim = producer.requests("room").unwrap();
+		let claim = producer.route_prefix("room", RouteOptions::default()).unwrap();
 		let pending = consumer.request("room/alice", None);
-		let prepared = queued(&claim).await.prepare().unwrap();
+		let prepared = queued(&claim).await.route(RouteOptions::hidden()).unwrap();
 		drop(prepared);
 		assert!(matches!(pending.await, Err(Error::Unroutable)));
 	}
@@ -11723,15 +12031,41 @@ mod tests {
 	async fn a_prepared_answer_for_an_abandoned_claim_is_never_announced() {
 		let producer = origin(1).produce();
 		let mut announced = producer.consume().routes();
-		let claim = producer.requests("room").unwrap();
+		let claim = producer.route_prefix("room", RouteOptions::default()).unwrap();
 		announced.assert_next_active("room");
 		let _pending = producer.consume().request("room/alice", None);
-		let prepared = queued(&claim).await.prepare().unwrap();
+		let prepared = queued(&claim).await.route(RouteOptions::hidden()).unwrap();
 
 		drop(claim);
 		announced.assert_next_ended("room");
-		assert!(matches!(prepared.publish(), Err(Error::Unroutable)));
+		assert!(matches!(prepared.announce(), Err(Error::Unroutable)));
+		announced.assert_next_wait();
+	}
+
+	/// Withdrawing a prefix route releases its pending requests, so a hidden job route
+	/// prepared for one is refused rather than announced, and the requester is refused.
+	#[kio::test]
+	#[cfg(feature = "async")]
+	async fn a_job_route_for_a_withdrawn_prefix_is_never_announced() {
+		let producer = origin(1).produce();
+		let mut announced = producer.consume().routes();
+		let claim = producer.route_prefix("room", RouteOptions::default()).unwrap();
+		announced.assert_next_active("room");
+		let pending = producer.consume().request("room/alice", None);
+		let job = queued(&claim).await.route(RouteOptions::hidden()).unwrap();
+
+		claim.withdraw();
+		announced.assert_next_ended("room");
+		assert!(matches!(job.announce(), Err(Error::Unroutable)));
+		assert!(!job.is_announced());
+		assert!(matches!(pending.await, Err(Error::Unroutable)));
 		announced.assert_next_wait();
+
+		// The prefix route itself comes back and answers new requests.
+		claim.announce().unwrap();
+		announced.assert_next_active("room");
+		let _again = producer.consume().request("room/bob", None);
+		assert_eq!(queued(&claim).await.path().as_str(), "room/bob");
 	}
 
 	/// An answer prepared before the claim changed instance is refused, never announced.
@@ -11740,16 +12074,16 @@ mod tests {
 	async fn a_prepared_answer_for_a_released_request_is_never_announced() {
 		let producer = origin(1).produce();
 		let mut announced = producer.consume().routes();
-		let claim = producer.requests("room").unwrap();
+		let claim = producer.route_prefix("room", RouteOptions::default()).unwrap();
 		announced.assert_next_active("room");
 		let _pending = producer.consume().request("room/alice", None);
-		let prepared = queued(&claim).await.prepare().unwrap();
+		let prepared = queued(&claim).await.route(RouteOptions::hidden()).unwrap();
 
 		claim
-			.update_route(Route::default().with_instance(crate::Instance::random(), 0))
+			.update(RouteInfo::default().with_instance(crate::Instance::random(), 0))
 			.unwrap();
 		announced.assert_next_restarted("room");
-		assert!(matches!(prepared.publish(), Err(Error::Unroutable)));
+		assert!(matches!(prepared.announce(), Err(Error::Unroutable)));
 		announced.assert_next_wait();
 	}
 
@@ -11759,14 +12093,14 @@ mod tests {
 	#[cfg(feature = "async")]
 	async fn a_withdrawn_publication_is_not_a_cached_claim_answer() {
 		let producer = origin(1).produce();
-		let claim = producer.requests("room").unwrap();
+		let claim = producer.route_prefix("room", RouteOptions::default()).unwrap();
 		let path = Path::from_static("room/alice");
 		let pending = producer.consume().request(path.clone(), None);
-		let publication = queued(&claim).await.prepare().unwrap().publish().unwrap();
+		let publication = queued(&claim).await.route(RouteOptions::default()).unwrap();
 		let held = pending.await.unwrap();
-		publication.unannounce();
+		publication.withdraw();
 		assert!(
-			claim.state.lock().served.get(&path).is_none(),
+			claim.server().lock().served.get(&path).is_none(),
 			"withdrawn job still cached"
 		);
 		let next = producer.consume().request(path, None);
@@ -11785,12 +12119,12 @@ mod tests {
 		let producer = origin(1).produce();
 		let consumer = producer.consume();
 		let mut announced = consumer.routes();
-		let claim = producer.requests("room").unwrap();
+		let claim = producer.route_prefix("room", RouteOptions::default()).unwrap();
 		announced.assert_next_active("room");
 
 		let answer = async |path: &str| {
 			let pending = consumer.request(path, None);
-			let published = queued(&claim).await.prepare().unwrap().publish().unwrap();
+			let published = queued(&claim).await.route(RouteOptions::default()).unwrap();
 			pending.await.unwrap();
 			published
 		};
@@ -11804,7 +12138,7 @@ mod tests {
 			other => panic!("should be a takeover: got {other:?}"),
 		}
 
-		answer("room/bob").await.unannounce();
+		answer("room/bob").await.withdraw();
 		let _carol = answer("room/carol").await;
 		match announced.expect_next().await {
 			RouteEvent::Start(announce) => assert_eq!(announce.prefix.as_str(), "room/carol"),
@@ -11820,12 +12154,12 @@ mod tests {
 	async fn a_pinned_request_resolves_only_through_the_published_instance() {
 		let producer = origin(1).produce();
 		let consumer = producer.consume();
-		let claim = producer.requests("room").unwrap();
+		let claim = producer.route_prefix("room", RouteOptions::default()).unwrap();
 		let unknown = consumer.request("room/alice", crate::Instance::random());
 		assert!(matches!(unknown.await, Err(Error::Unroutable)));
 
 		let pending = consumer.request("room/alice", None);
-		let published = queued(&claim).await.prepare().unwrap().publish().unwrap();
+		let published = queued(&claim).await.route(RouteOptions::default()).unwrap();
 		let instance = published.route().unwrap().instance.unwrap();
 		pending.await.expect("resolves");
 
@@ -11842,10 +12176,10 @@ mod tests {
 	async fn refusal_never_falls_through() {
 		let producer = origin(1).produce();
 		let consumer = producer.consume();
-		let catch_all = producer.requests_route("", Route::default(), None).unwrap();
-		let winner = producer.requests_route("room", Route::default(), None).unwrap();
+		let catch_all = producer.forward("", RouteInfo::default(), None).unwrap();
+		let winner = producer.forward("room", RouteInfo::default(), None).unwrap();
 		let sibling = producer
-			.requests_route("room", Route::default().with_cost(2), None)
+			.forward("room", RouteInfo::default().with_cost(2), None)
 			.unwrap();
 
 		let mut pending = Box::pin(consumer.request("room/alice", None));
@@ -11861,7 +12195,7 @@ mod tests {
 		assert!(matches!(err, Error::NotFound), "unexpected end: {err}");
 
 		for other in [&sibling, &catch_all] {
-			assert!(other.poll_requested_broadcast(&kio::Waiter::noop()).is_pending());
+			assert!(other.poll_requested(&kio::Waiter::noop()).is_pending());
 		}
 	}
 
@@ -11872,15 +12206,15 @@ mod tests {
 	async fn superseded_refusal_does_not_end_the_request() {
 		let producer = origin(1).produce();
 		let consumer = producer.consume();
-		let stale = producer.requests_route("room", Route::default(), None).unwrap();
+		let stale = producer.forward("room", RouteInfo::default(), None).unwrap();
 
 		let mut pending = Box::pin(consumer.request("room/alice", None));
 		assert!((&mut pending).now_or_never().is_none());
 		let request = queued(&stale).await;
 
 		// The local broadcast wins before the front sees the rejection.
-		let local = producer.create_broadcast("room/alice").unwrap();
-		local.announce(Route::default()).unwrap();
+		let local = producer.route("room/alice", RouteOptions::hidden()).unwrap();
+		local.announce().unwrap();
 		request.reject(Error::NotFound);
 
 		let mut result = None;
@@ -11899,13 +12233,13 @@ mod tests {
 	async fn refusal_from_a_beaten_route_asks_the_new_winner() {
 		let producer = origin(1).produce();
 		let consumer = producer.consume();
-		let stale = producer.requests_route("room", Route::default(), None).unwrap();
+		let stale = producer.forward("room", RouteInfo::default(), None).unwrap();
 
 		let mut pending = Box::pin(consumer.request("room/alice", None));
 		assert!((&mut pending).now_or_never().is_none());
 		let request = queued(&stale).await;
 
-		let winner = producer.requests_route("room/alice", Route::default(), None).unwrap();
+		let winner = producer.forward("room/alice", RouteInfo::default(), None).unwrap();
 		request.reject(Error::NotFound);
 		let source = broadcast::Info::new().produce();
 		queued(&winner).await.serve(&source);
@@ -11925,7 +12259,7 @@ mod tests {
 	async fn follow_reports_teardown_as_closed() {
 		let (producer, driver) = Producer::new(Config::new(origin(1)));
 		let consumer = producer.consume();
-		let _server = producer.requests_route("room", Route::default(), None).unwrap();
+		let _server = producer.forward("room", RouteInfo::default(), None).unwrap();
 
 		// Park on the covering route, past the loop's closed check.
 		let mut following = consumer.follow("room/alice", None).unwrap();
@@ -11948,8 +12282,9 @@ mod tests {
 	#[cfg(feature = "async")]
 	async fn a_front_serves_its_sources_datagram_tracks() {
 		let producer = origin(1).produce();
-		let publication = producer.publish("room", Route::default()).unwrap();
+		let publication = producer.route("room", RouteOptions::default()).unwrap();
 		let mut datagrams = publication
+			.broadcast()
 			.create_datagrams("audio", crate::datagram::Info::default())
 			.unwrap();
 
@@ -11968,7 +12303,7 @@ mod tests {
 	async fn late_track_on_a_served_front_replays() {
 		let producer = origin(1).produce();
 		let consumer = producer.consume();
-		let server = producer.requests_route("room", Route::default(), None).unwrap();
+		let server = producer.forward("room", RouteInfo::default(), None).unwrap();
 
 		let source = broadcast::Info::new().produce();
 		for name in ["a", "b"] {
@@ -12009,10 +12344,10 @@ mod tests {
 		let producer = origin(1).produce();
 		let consumer = producer.consume();
 
-		let broad_server = producer.requests_route("", Route::default(), None).unwrap();
+		let broad_server = producer.forward("", RouteInfo::default(), None).unwrap();
 		// A narrow advertise-only claim: requests under it must NOT route to the
 		// broad server; they fall through to the (absent) fallback handler.
-		let _narrow = producer.announce(".dash", Route::default()).unwrap();
+		let _narrow = producer.announce(".dash", RouteInfo::default()).unwrap();
 
 		let err = consumer
 			.request(".dash/pid", None)
@@ -12034,7 +12369,7 @@ mod tests {
 		let producer = origin(1).produce();
 		let consumer = producer.consume();
 		let mut announced = consumer.routes();
-		let dynamic = producer.requests_route("", Route::default(), None).unwrap();
+		let dynamic = producer.forward("", RouteInfo::default(), None).unwrap();
 		// The root claim is advertised like any other prefix.
 		announced.expect_next_active("").await;
 
@@ -12068,7 +12403,7 @@ mod tests {
 	#[cfg(feature = "async")]
 	async fn out_of_scope_request_never_reaches_the_dynamic_handler() {
 		let producer = origin(1).produce();
-		let dynamic = producer.requests_route("", Route::default(), None).unwrap();
+		let dynamic = producer.forward("", RouteInfo::default(), None).unwrap();
 		let scoped = producer.consume().scope("", &scopes(&["tenant-a"])).unwrap();
 
 		// `tenant-a-other` shares a character prefix but not a segment, so this
@@ -12080,7 +12415,7 @@ mod tests {
 				.expect("an out-of-scope request must be refused synchronously, not queued");
 			assert!(matches!(refused, Err(Error::Unauthorized)));
 			assert!(
-				dynamic.requested_broadcast().now_or_never().is_none(),
+				dynamic.requested().now_or_never().is_none(),
 				"the dynamic handler was asked to create a broadcast the requester may not read"
 			);
 		}
@@ -12088,7 +12423,7 @@ mod tests {
 
 	/// The route a follower's first event starts on.
 	#[cfg(feature = "async")]
-	fn started(event: Option<RouteEvent>) -> Route {
+	fn started(event: Option<RouteEvent>) -> RouteInfo {
 		match event.expect("routed") {
 			RouteEvent::Start(announce) => announce.route,
 			other => panic!("should start: got {other:?}"),
@@ -12106,7 +12441,7 @@ mod tests {
 		assert!((&mut fut).now_or_never().is_none());
 
 		// A covering prefix resolves the wait.
-		let _a = producer.announce("room", Route::default().with_cost(3)).unwrap();
+		let _a = producer.announce("room", RouteInfo::default().with_cost(3)).unwrap();
 		let route = started(fut.now_or_never().expect("covered"));
 		assert_eq!(route.cost, Cost::new(3));
 
@@ -12122,12 +12457,12 @@ mod tests {
 		let consumer = producer.consume();
 
 		// A deeper route does not cover the shorter path.
-		let _deep = producer.announce("room/alice/cam", Route::default()).unwrap();
+		let _deep = producer.announce("room/alice/cam", RouteInfo::default()).unwrap();
 		let mut routes = consumer.path_routes("room/alice").unwrap();
 		let mut fut = routes.next().boxed();
 		assert!((&mut fut).now_or_never().is_none());
 
-		let _exact = producer.announce("room/alice", Route::default()).unwrap();
+		let _exact = producer.announce("room/alice", RouteInfo::default()).unwrap();
 		started(fut.now_or_never().expect("covered"));
 	}
 
@@ -12149,7 +12484,7 @@ mod tests {
 		assert!((&mut fut).now_or_never().is_none());
 
 		// A covering root still resolves: the lookup must not require `path/**`.
-		let _a = producer.announce("", Route::default()).unwrap();
+		let _a = producer.announce("", RouteInfo::default()).unwrap();
 		started(fut.now_or_never().expect("covered"));
 	}
 
@@ -12158,11 +12493,11 @@ mod tests {
 	async fn teardown_ends_everything() {
 		let (producer, driver) = Producer::new(Config::new(origin(1)));
 		let consumer = producer.consume();
-		let _announcement = producer.announce("room", Route::default()).unwrap();
+		let _announcement = producer.announce("room", RouteInfo::default()).unwrap();
 		let mut announced = consumer.routes();
 		announced.expect_next_active("room").await;
 
-		let _server = producer.requests_route("served", Route::default(), None).unwrap();
+		let _server = producer.forward("served", RouteInfo::default(), None).unwrap();
 		let pending = consumer.request("served/path", None);
 
 		drop(driver);
@@ -12173,8 +12508,14 @@ mod tests {
 
 		// Pending requests reject; new work refuses.
 		assert!(matches!(pending.now_or_never().expect("rejected"), Err(Error::Closed)));
-		assert!(matches!(producer.announce("x", Route::default()), Err(Error::Closed)));
-		assert!(matches!(producer.create_broadcast("x"), Err(Error::Closed)));
+		assert!(matches!(
+			producer.announce("x", RouteInfo::default()),
+			Err(Error::Closed)
+		));
+		assert!(matches!(
+			producer.route("x", RouteOptions::hidden()),
+			Err(Error::Closed)
+		));
 		let err = consumer
 			.request("y", None)
 			.now_or_never()
@@ -12195,7 +12536,7 @@ mod tests {
 		let (producer, driver) = Producer::new(Config::new(origin(1)));
 		let snapshot = producer.snapshot("room");
 		let mut announced = producer.consume().routes();
-		let _alice = producer.announce("room/alice", Route::default()).unwrap();
+		let _alice = producer.announce("room/alice", RouteInfo::default()).unwrap();
 
 		drop(driver);
 		assert!(!announced.is_synced(), "the queue is still owed");
@@ -12207,10 +12548,10 @@ mod tests {
 	#[test]
 	fn internal_route_requests_are_closed_on_teardown() {
 		let (producer, mut driver) = Producer::new(Config::new(origin(1)));
-		let server = producer.requests_route("room", Route::default(), None).unwrap();
+		let server = producer.forward("room", RouteInfo::default(), None).unwrap();
 		let _pending = producer.consume().request("room/alice", None);
 		driver.poll(Instant::now(), &kio::Waiter::noop()).unwrap();
-		let Poll::Ready(Ok(request)) = server.poll_requested_broadcast(&kio::Waiter::noop()) else {
+		let Poll::Ready(Some(request)) = server.poll_requested(&kio::Waiter::noop()) else {
 			panic!("front requested its route");
 		};
 		drop(driver);
@@ -12235,11 +12576,11 @@ mod tests {
 
 		for teardown in [false, true] {
 			let (producer, mut driver) = Producer::new(Config::new(origin(1)));
-			let server = producer.requests_route("room", Route::default(), None).unwrap();
+			let server = producer.forward("room", RouteInfo::default(), None).unwrap();
 			let _pending = producer.consume().request("room/alice", None);
 			driver.poll(Instant::ZERO, &kio::Waiter::noop()).unwrap();
 			let channel = server
-				.state
+				.server()
 				.read()
 				.requests
 				.get(&Path::from_static("room/alice"))
@@ -12249,7 +12590,7 @@ mod tests {
 			let reenter = || {
 				Arc::new(Reenter {
 					table: producer.shared.clone(),
-					server: server.state.clone(),
+					server: server.server().clone(),
 					woken: AtomicBool::new(false),
 				})
 			};
@@ -12257,7 +12598,7 @@ mod tests {
 			let waiter = kio::Waiter::new(std::task::Waker::from(request.clone()));
 			assert!(channel.poll(&waiter, |_| Poll::<()>::Pending).is_pending());
 			let waiter = kio::Waiter::new(std::task::Waker::from(queue.clone()));
-			assert!(server.state.poll(&waiter, |_| Poll::Pending).is_pending());
+			assert!(server.server().poll(&waiter, |_| Poll::Pending).is_pending());
 			if teardown {
 				drop(driver);
 			} else {
@@ -12285,14 +12626,14 @@ mod tests {
 		/// Announce a served route with `first` as its first hop, materialize
 		/// "room/alice" through it with a one-group "before" track, and subscribe.
 		#[cfg(feature = "async")]
-		async fn new(first: &[u64]) -> (Self, Requests, broadcast::Producer) {
+		async fn new(first: &[u64]) -> (Self, Route, broadcast::Producer) {
 			let producer = origin(1).produce();
 			let consumer = producer.consume();
 
 			let server = producer
-				.requests_route(
+				.forward(
 					"room",
-					Route::default().with_instance(instance(), 0).with_hops(hops(first)),
+					RouteInfo::default().with_instance(instance(), 0).with_hops(hops(first)),
 					None,
 				)
 				.unwrap();
@@ -12335,11 +12676,11 @@ mod tests {
 
 		/// Stand up a second served route with `first` as its first hop and hand
 		/// back its handle, ready to answer the front's re-request.
-		fn standby(&self, first: &[u64]) -> Requests {
+		fn standby(&self, first: &[u64]) -> Route {
 			self.producer
-				.requests_route(
+				.forward(
 					"room",
-					Route::default().with_instance(instance(), 0).with_hops(hops(first)),
+					RouteInfo::default().with_instance(instance(), 0).with_hops(hops(first)),
 					None,
 				)
 				.unwrap()
@@ -12351,7 +12692,7 @@ mod tests {
 	/// rig's subscription resumes onto it: the successor group is delivered on
 	/// the same subscription, at the group boundary.
 	#[cfg(feature = "async")]
-	async fn assert_resumes(rig: &mut ResumeRig, server: &Requests) {
+	async fn assert_resumes(rig: &mut ResumeRig, server: &Route) {
 		let request = queued(server).await;
 		let replacement = broadcast::Info::new().produce();
 		let track = replacement.create_track("video", crate::track::Info::timed()).unwrap();
@@ -12386,9 +12727,9 @@ mod tests {
 		let (mut rig, _incumbent, _source) = ResumeRig::new(&[10]).await;
 		let newer = rig
 			.producer
-			.requests_route(
+			.forward(
 				"room",
-				Route::default()
+				RouteInfo::default()
 					.with_instance(instance(), 1)
 					.with_hops(hops(&[11]))
 					.with_cost(9),
@@ -12413,9 +12754,9 @@ mod tests {
 		let consumer = producer.consume();
 		let host = |name: &str, hop| {
 			producer
-				.requests_route(
+				.forward(
 					"pool",
-					Route::default()
+					RouteInfo::default()
 						.with_instance(name.parse().unwrap(), 0)
 						.with_hops(hops(&[hop])),
 					None,
@@ -12452,9 +12793,9 @@ mod tests {
 		let consumer = producer.consume();
 		let host = |name: &str, hop| {
 			producer
-				.requests_route(
+				.forward(
 					"pool",
-					Route::default()
+					RouteInfo::default()
 						.with_instance(name.parse().unwrap(), 0)
 						.with_hops(hops(&[hop])),
 					None,
@@ -12482,7 +12823,7 @@ mod tests {
 			);
 			kio::clock::sim::yield_now().await;
 			assert!(
-				a.poll_requested_broadcast(&kio::Waiter::noop()).is_pending(),
+				a.poll_requested(&kio::Waiter::noop()).is_pending(),
 				"the host asked again"
 			);
 		}
@@ -12512,7 +12853,7 @@ mod tests {
 		let producer = origin(1).produce();
 		let consumer = producer.consume();
 		let first = producer
-			.requests_route("room", Route::default().with_hops(hops(&[10])).with_cost(5), None)
+			.forward("room", RouteInfo::default().with_hops(hops(&[10])).with_cost(5), None)
 			.unwrap();
 		let pending = consumer.request("room/alice", None);
 		let source = broadcast::Info::new().produce();
@@ -12523,7 +12864,7 @@ mod tests {
 		deliver(&track, &mut subscription, b"first").await;
 
 		let second = producer
-			.requests_route("room", Route::default().with_hops(hops(&[11])).with_cost(1), None)
+			.forward("room", RouteInfo::default().with_hops(hops(&[11])).with_cost(1), None)
 			.unwrap();
 		deliver(&track, &mut subscription, b"pinned").await;
 
@@ -12536,7 +12877,7 @@ mod tests {
 		);
 		settle(|| resolved.is_closed()).await;
 		assert!(
-			second.poll_requested_broadcast(&kio::Waiter::noop()).is_pending(),
+			second.poll_requested(&kio::Waiter::noop()).is_pending(),
 			"a route of another instance is never asked to resume"
 		);
 	}
@@ -12549,27 +12890,33 @@ mod tests {
 		let producer = origin(1).produce();
 		let consumer = producer.consume();
 		let old = producer
-			.publish(
+			.route(
 				"room/alice",
-				Route::default()
+				RouteOptions::default()
 					.with_instance(crate::Instance::random(), 0)
 					.with_cost(9),
 			)
 			.unwrap();
-		let old_track = old.create_track("video", crate::track::Info::timed()).unwrap();
+		let old_track = old
+			.broadcast()
+			.create_track("video", crate::track::Info::timed())
+			.unwrap();
 		let resolved = consumer.request("room/alice", None).await.expect("resolves");
 		let mut subscription = resolved.track("video").unwrap().subscribe(None).await.unwrap();
 		deliver(&old_track, &mut subscription, b"old").await;
 
 		let new = producer
-			.publish(
+			.route(
 				"room/alice",
-				Route::default()
+				RouteOptions::default()
 					.with_instance(crate::Instance::random(), 0)
 					.with_cost(1),
 			)
 			.unwrap();
-		let new_track = new.create_track("video", crate::track::Info::timed()).unwrap();
+		let new_track = new
+			.broadcast()
+			.create_track("video", crate::track::Info::timed())
+			.unwrap();
 		deliver(&old_track, &mut subscription, b"sticky").await;
 
 		let replaced = consumer.request("room/alice", None).await.expect("resolves");
@@ -12598,9 +12945,12 @@ mod tests {
 		let consumer = producer.consume();
 		let first = crate::Instance::random();
 		let old = producer
-			.publish("room/alice", Route::default().with_instance(first.clone(), 0))
+			.route("room/alice", RouteOptions::default().with_instance(first.clone(), 0))
+			.unwrap();
+		let _old_track = old
+			.broadcast()
+			.create_track("video", crate::track::Info::timed())
 			.unwrap();
-		let _old_track = old.create_track("video", crate::track::Info::timed()).unwrap();
 		let resolved = consumer.request("room/alice", None).await.expect("resolves");
 		assert_eq!(
 			resolved.info().instance.as_ref(),
@@ -12610,9 +12960,12 @@ mod tests {
 
 		let instance = crate::Instance::random();
 		let new = producer
-			.publish("room/alice", Route::default().with_instance(instance.clone(), 0))
+			.route("room/alice", RouteOptions::default().with_instance(instance.clone(), 0))
+			.unwrap();
+		let new_track = new
+			.broadcast()
+			.create_track("video", crate::track::Info::timed())
 			.unwrap();
-		let new_track = new.create_track("video", crate::track::Info::timed()).unwrap();
 		let named = consumer.request("room/alice", instance.clone());
 		let bare = consumer.request("room/alice", None);
 
@@ -12641,9 +12994,9 @@ mod tests {
 		let producer = origin(1).produce();
 		let consumer = producer.consume();
 		let old = producer
-			.requests_route(
+			.forward(
 				"room",
-				Route::default().with_instance(crate::Instance::random(), 0),
+				RouteInfo::default().with_instance(crate::Instance::random(), 0),
 				None,
 			)
 			.unwrap();
@@ -12652,12 +13005,15 @@ mod tests {
 
 		// The answer and the new instance land in the same tick.
 		let new = producer
-			.publish(
+			.route(
 				"room/alice",
-				Route::default().with_instance(crate::Instance::random(), 0),
+				RouteOptions::default().with_instance(crate::Instance::random(), 0),
 			)
 			.unwrap();
-		let new_track = new.create_track("video", crate::track::Info::timed()).unwrap();
+		let new_track = new
+			.broadcast()
+			.create_track("video", crate::track::Info::timed())
+			.unwrap();
 		let stale = broadcast::Info::new().produce();
 		let _stale_track = stale.create_track("video", crate::track::Info::timed()).unwrap();
 		request.serve(&stale);
@@ -12678,7 +13034,7 @@ mod tests {
 		let consumer = producer.consume();
 		let old = crate::Instance::random();
 		let dynamic = producer
-			.requests_route("room", Route::default().with_instance(old.clone(), 0), None)
+			.forward("room", RouteInfo::default().with_instance(old.clone(), 0), None)
 			.unwrap();
 		let pending = consumer.request("room/alice", None);
 		let pinned = consumer.request("room/alice", old);
@@ -12690,11 +13046,11 @@ mod tests {
 		if answer_first {
 			request.serve(&stale);
 			dynamic
-				.update_route(dynamic.route().with_instance(instance.clone(), 0))
+				.update(dynamic.route().unwrap().with_instance(instance.clone(), 0))
 				.unwrap();
 		} else {
 			dynamic
-				.update_route(dynamic.route().with_instance(instance.clone(), 0))
+				.update(dynamic.route().unwrap().with_instance(instance.clone(), 0))
 				.unwrap();
 			request.serve(&stale);
 		}
@@ -12709,7 +13065,7 @@ mod tests {
 			matches!(pinned.await, Err(Error::Unroutable)),
 			"a request pinned to the old instance resolved"
 		);
-		let cached = dynamic.state.lock().served.get(&Path::from_static("room/alice"));
+		let cached = dynamic.server().lock().served.get(&Path::from_static("room/alice"));
 		assert!(
 			cached.is_some_and(|cached| cached.consume().is_clone(&fresh.consume())),
 			"the old answer was cached"
@@ -12738,9 +13094,9 @@ mod tests {
 		let producer = origin(1).produce();
 		let consumer = producer.consume();
 		let dynamic = producer
-			.requests_route(
+			.forward(
 				"room",
-				Route::default().with_instance(crate::Instance::random(), 0),
+				RouteInfo::default().with_instance(crate::Instance::random(), 0),
 				None,
 			)
 			.unwrap();
@@ -12748,7 +13104,7 @@ mod tests {
 		queued(&dynamic).await.reject(Error::NotFound);
 		let instance = crate::Instance::random();
 		dynamic
-			.update_route(dynamic.route().with_instance(instance.clone(), 0))
+			.update(dynamic.route().unwrap().with_instance(instance.clone(), 0))
 			.unwrap();
 
 		let fresh = broadcast::Info::new().produce();
@@ -12769,16 +13125,16 @@ mod tests {
 		let consumer = producer.consume();
 		let old = crate::Instance::random();
 		let dynamic = producer
-			.requests_route("room", Route::default().with_instance(old.clone(), 0), None)
+			.forward("room", RouteInfo::default().with_instance(old.clone(), 0), None)
 			.unwrap();
 		let pending = consumer.request("room/alice", None);
 		let request = queued(&dynamic).await;
 
 		dynamic
-			.update_route(dynamic.route().with_instance(crate::Instance::random(), 0))
+			.update(dynamic.route().unwrap().with_instance(crate::Instance::random(), 0))
 			.unwrap();
 		dynamic
-			.update_route(dynamic.route().with_instance(old.clone(), 0))
+			.update(dynamic.route().unwrap().with_instance(old.clone(), 0))
 			.unwrap();
 		let stale = broadcast::Info::new().produce();
 		let _stale_track = stale.create_track("video", crate::track::Info::timed()).unwrap();
@@ -12802,17 +13158,17 @@ mod tests {
 		let mut announced = producer.consume().routes();
 		let instance = crate::Instance::random();
 		let _old = producer
-			.publish(
+			.route(
 				"room/alice",
-				Route::default().with_instance(instance.clone(), 1).with_cost(1),
+				RouteOptions::default().with_instance(instance.clone(), 1).with_cost(1),
 			)
 			.unwrap();
 		assert_eq!(announced.expect_next_active("room/alice").await.cost, Cost::new(1));
 
 		let new = producer
-			.publish(
+			.route(
 				"room/alice",
-				Route::default().with_instance(instance.clone(), 2).with_cost(9),
+				RouteOptions::default().with_instance(instance.clone(), 2).with_cost(9),
 			)
 			.unwrap();
 		let newest = announced.expect_next_active("room/alice").await;
@@ -12834,7 +13190,7 @@ mod tests {
 		let producer = origin(1).produce();
 		let consumer = producer.consume();
 		let _broadcast = producer
-			.publish("room/alice", Route::default().with_instance(instance(), 0))
+			.route("room/alice", RouteOptions::default().with_instance(instance(), 0))
 			.unwrap();
 
 		let other: crate::Instance = "01900000-0000-7000-8000-000000000002".parse().unwrap();
@@ -12962,7 +13318,7 @@ mod tests {
 		for first in [&[][..], &[0][..], &[10][..]] {
 			let (mut rig, server, _source) = ResumeRig::new(first).await;
 			let standby = rig.standby(&[10, 20]);
-			server.update_route(Route::default().with_hops(hops(&[11]))).unwrap();
+			server.update(RouteInfo::default().with_hops(hops(&[11]))).unwrap();
 
 			let mut group = rig.incumbent_track.append_group().unwrap();
 			group.write_frame(crate::Timestamp::ZERO, b"after".as_ref()).unwrap();
@@ -12977,7 +13333,7 @@ mod tests {
 			let resolved = rig.producer.consume().request("room/alice", None).await.unwrap();
 			assert!(resolved.is_clone(&rig.resolved), "first hop {first:?} left the front");
 			assert!(
-				standby.poll_requested_broadcast(&kio::Waiter::noop()).is_pending(),
+				standby.poll_requested(&kio::Waiter::noop()).is_pending(),
 				"first hop {first:?} moved off a route that still serves"
 			);
 		}
@@ -12996,17 +13352,19 @@ mod tests {
 				None => producer.consume(),
 			};
 			let incumbent = producer
-				.requests_route(
+				.forward(
 					"room",
-					Route::default().with_instance(instance(), 0).with_hops(hops(&[10])),
+					RouteInfo::default().with_instance(instance(), 0).with_hops(hops(&[10])),
 					None,
 				)
 				.unwrap();
 			// The same publisher, reached through the requesting peer.
 			let echo = producer
-				.requests_route(
+				.forward(
 					"room",
-					Route::default().with_instance(instance(), 0).with_hops(hops(&[10, 7])),
+					RouteInfo::default()
+						.with_instance(instance(), 0)
+						.with_hops(hops(&[10, 7])),
 					None,
 				)
 				.unwrap();
@@ -13035,7 +13393,7 @@ mod tests {
 					let err = next_group(&mut subscription).await.err().expect("subscription ends");
 					assert!(matches!(err, Error::Dropped), "unexpected end: {err}");
 					assert!(
-						echo.poll_requested_broadcast(&kio::Waiter::noop()).is_pending(),
+						echo.poll_requested(&kio::Waiter::noop()).is_pending(),
 						"the front asked the requester for its own copy"
 					);
 				}
@@ -13071,7 +13429,7 @@ mod tests {
 
 		// Session A: an assigned anonymous hop serving the path.
 		let server_a = producer
-			.requests_route("room", Route::default().with_hops(hops(&[10])), None)
+			.forward("room", RouteInfo::default().with_hops(hops(&[10])), None)
 			.unwrap();
 
 		// Session C: a third anonymous session, excluding the hop the server
@@ -13127,7 +13485,7 @@ mod tests {
 
 		// Session B attaches at the same path. Its front is served immediately.
 		let server_b = producer
-			.requests_route("room", Route::default().with_hops(hops(&[20])), None)
+			.forward("room", RouteInfo::default().with_hops(hops(&[20])), None)
 			.unwrap();
 		let pending = consumer.request("room/alice", None);
 		let request = queued(&server_b).await;
@@ -13169,7 +13527,7 @@ mod tests {
 		// A metadata-only reprice of the only route: nothing re-requests and the
 		// subscription keeps flowing from the same source.
 		incumbent
-			.update_route(Route::default().with_hops(hops(&[10])).with_cost(9))
+			.update(RouteInfo::default().with_hops(hops(&[10])).with_cost(9))
 			.unwrap();
 
 		let track = source.create_track("audio", crate::track::Info::timed()).unwrap();
@@ -13203,8 +13561,8 @@ mod tests {
 		// keeps serving. The front migrates to the standby without waiting for
 		// the death.
 		incumbent
-			.update_route(
-				Route::default()
+			.update(
+				RouteInfo::default()
 					.with_instance(instance(), 0)
 					.with_hops(hops(&[10]))
 					.with_cost(Cost::DRAIN),
@@ -13226,21 +13584,21 @@ mod tests {
 		let producer = origin(1).produce();
 		let consumer = producer.consume();
 
-		let first = producer.publish("room/alice", Route::default()).unwrap();
+		let first = producer.route("room/alice", RouteOptions::default()).unwrap();
 		let resolved = consumer.request("room/alice", None).await.expect("resolves");
 
-		let second = producer.publish("room/alice", Route::default()).unwrap();
+		let second = producer.route("room/alice", RouteOptions::default()).unwrap();
 		let again = consumer.request("room/alice", None).await.expect("resolves");
 		assert!(!again.is_clone(&resolved));
 
 		// Losing one source leaves the path served; losing both frees it.
-		second.close();
+		second.broadcast().close();
 		settle(|| consumer.get_broadcast("room/alice").is_some()).await;
-		first.close();
+		first.broadcast().close();
 		settle(|| consumer.get_broadcast("room/alice").is_none()).await;
 
 		// The path is free again for a fresh broadcast.
-		let _third = producer.publish("room/alice", Route::default()).unwrap();
+		let _third = producer.route("room/alice", RouteOptions::default()).unwrap();
 		assert!(consumer.get_broadcast("room/alice").is_some());
 	}
 
@@ -13253,7 +13611,7 @@ mod tests {
 		let producer = origin(1).produce();
 		let consumer = producer.consume();
 		let server = producer
-			.requests_route("room", Route::default().with_hops(hops(&[10])), None)
+			.forward("room", RouteInfo::default().with_hops(hops(&[10])), None)
 			.unwrap();
 
 		// The front selected the covering route and waits on its answer.
@@ -13261,7 +13619,7 @@ mod tests {
 		let _request = queued(&server).await;
 
 		// The exact path beats the covering route before the front resolves.
-		let _winner = producer.publish("room/alice", Route::default()).unwrap();
+		let _winner = producer.route("room/alice", RouteOptions::default()).unwrap();
 		let again = consumer.request("room/alice", None).await.expect("resolves");
 		let first = pending.await.expect("the first front moves to the winner");
 		assert!(!again.is_clone(&first), "joined a front resolving the beaten route");
@@ -13275,14 +13633,14 @@ mod tests {
 		let producer = origin(1).produce();
 		let consumer = producer.consume();
 		let covering = producer
-			.requests_route("room", Route::default().with_hops(hops(&[10])), None)
+			.forward("room", RouteInfo::default().with_hops(hops(&[10])), None)
 			.unwrap();
 		let pending = consumer.request("room/alice", None);
 		let _beaten = queued(&covering).await;
 
 		// The exact path wins, and the front asks it in turn.
 		let exact = producer
-			.requests_route("room/alice", Route::default().with_hops(hops(&[10])), None)
+			.forward("room/alice", RouteInfo::default().with_hops(hops(&[10])), None)
 			.unwrap();
 		let request = queued(&exact).await;
 		let again = consumer.request("room/alice", None);
@@ -13310,8 +13668,11 @@ mod tests {
 		let producer = origin(1).produce();
 		let consumer = producer.consume();
 
-		let broadcast = producer.publish("room/alice", Route::default()).unwrap();
-		let track = broadcast.create_track("video", crate::track::Info::timed()).unwrap();
+		let broadcast = producer.route("room/alice", RouteOptions::default()).unwrap();
+		let track = broadcast
+			.broadcast()
+			.create_track("video", crate::track::Info::timed())
+			.unwrap();
 
 		let resolved = consumer.request("room/alice", None).await.expect("resolves");
 		let mut subscription = resolved
@@ -13326,7 +13687,7 @@ mod tests {
 		group.finish().unwrap();
 		track.finish().unwrap();
 		drop(track);
-		broadcast.close();
+		broadcast.broadcast().close();
 
 		let mut group = next_group(&mut subscription)
 			.await
@@ -13353,7 +13714,7 @@ mod tests {
 		let producer = origin(1).produce();
 		let consumer = producer.consume();
 		let server = producer
-			.requests_route("room", Route::default().with_hops(hops(&[10])), None)
+			.forward("room", RouteInfo::default().with_hops(hops(&[10])), None)
 			.unwrap();
 
 		let pending = consumer.request("room/alice", None);
@@ -13401,7 +13762,7 @@ mod tests {
 	async fn a_closed_source_is_not_requested_again_from_its_standing_route() {
 		let producer = origin(1).produce();
 		let server = producer
-			.requests_route("room", Route::default().with_hops(hops(&[10])), None)
+			.forward("room", RouteInfo::default().with_hops(hops(&[10])), None)
 			.unwrap();
 		let pending = producer.consume().request("room/alice", None);
 		let source = broadcast::Info::new().produce();
@@ -13411,7 +13772,7 @@ mod tests {
 		source.close();
 		settle(|| resolved.is_closed()).await;
 		assert!(
-			server.poll_requested_broadcast(&kio::Waiter::noop()).is_pending(),
+			server.poll_requested(&kio::Waiter::noop()).is_pending(),
 			"the closed source was requested again"
 		);
 	}
@@ -13426,8 +13787,11 @@ mod tests {
 		let producer = origin(1).produce();
 		let consumer = producer.consume();
 
-		let broadcast = producer.publish("room/alice", Route::default()).unwrap();
-		let track = broadcast.create_track("video", crate::track::Info::timed()).unwrap();
+		let broadcast = producer.route("room/alice", RouteOptions::default()).unwrap();
+		let track = broadcast
+			.broadcast()
+			.create_track("video", crate::track::Info::timed())
+			.unwrap();
 		let mut group = track.append_group().unwrap();
 		group.write_frame(crate::Timestamp::ZERO, b"cached".as_ref()).unwrap();
 		group.finish().unwrap();
@@ -13490,7 +13854,7 @@ mod tests {
 	async fn a_held_group_continues_after_its_track_goes_unread() {
 		let producer = origin(1).produce();
 		let server = producer
-			.requests_route("live", Route::default().with_hops(hops(&[10])), None)
+			.forward("live", RouteInfo::default().with_hops(hops(&[10])), None)
 			.unwrap();
 		let pending = producer.consume().request("live", None);
 		let source = broadcast::Info::new().produce();
@@ -13530,8 +13894,11 @@ mod tests {
 	#[cfg(feature = "async")]
 	async fn a_group_the_source_aborts_ends_while_the_track_lives() {
 		let producer = origin(1).produce();
-		let broadcast = producer.publish("live", Route::default()).unwrap();
-		let track = broadcast.create_track("video", crate::track::Info::timed()).unwrap();
+		let broadcast = producer.route("live", RouteOptions::default()).unwrap();
+		let track = broadcast
+			.broadcast()
+			.create_track("video", crate::track::Info::timed())
+			.unwrap();
 		let resolved = producer.consume().request("live", None).await.unwrap();
 		let mut subscription = resolved.track("video").unwrap().subscribe(None).await.unwrap();
 
@@ -13565,8 +13932,11 @@ mod tests {
 		let leaf = origin(1).produce();
 		let leaf_consumer = leaf.consume();
 
-		let broadcast = leaf.publish("room/alice", Route::default()).unwrap();
-		let track = broadcast.create_track("video", crate::track::Info::timed()).unwrap();
+		let broadcast = leaf.route("room/alice", RouteOptions::default()).unwrap();
+		let track = broadcast
+			.broadcast()
+			.create_track("video", crate::track::Info::timed())
+			.unwrap();
 		let mut group = track.append_group().unwrap();
 		group.write_frame(crate::Timestamp::ZERO, b"cached".as_ref()).unwrap();
 		group.finish().unwrap();
@@ -13576,7 +13946,7 @@ mod tests {
 
 		let mid = origin(2).produce();
 		let mid_server = mid
-			.requests_route("room", Route::default().with_hops(hops(&[10])), None)
+			.forward("room", RouteInfo::default().with_hops(hops(&[10])), None)
 			.unwrap();
 		let mid_pending = mid.consume().request("room/alice", None);
 		queued(&mid_server).await.serve(&leaf_front);
@@ -13584,7 +13954,7 @@ mod tests {
 
 		let edge = origin(3).produce();
 		let edge_server = edge
-			.requests_route("room", Route::default().with_hops(hops(&[20])), None)
+			.forward("room", RouteInfo::default().with_hops(hops(&[20])), None)
 			.unwrap();
 		let edge_pending = edge.consume().request("room/alice", None);
 		queued(&edge_server).await.serve(&mid_resolved);
@@ -13664,9 +14034,12 @@ mod tests {
 		let consumer = producer.consume();
 
 		let first = producer
-			.publish("room/alice", Route::default().with_instance(instance(), 0))
+			.route("room/alice", RouteOptions::default().with_instance(instance(), 0))
+			.unwrap();
+		let track = first
+			.broadcast()
+			.create_track("video", crate::track::Info::timed())
 			.unwrap();
-		let track = first.create_track("video", crate::track::Info::timed()).unwrap();
 		let resolved = consumer.request("room/alice", None).await.expect("resolves");
 		let mut subscription = resolved
 			.track("video")
@@ -13682,9 +14055,10 @@ mod tests {
 
 		// The newest source is dispatched the track, and refused for its metadata.
 		let second = producer
-			.publish("room/alice", Route::default().with_instance(instance(), 0))
+			.route("room/alice", RouteOptions::default().with_instance(instance(), 0))
 			.unwrap();
 		let _incompatible = second
+			.broadcast()
 			.create_track("video", track::Info::default().with_timescale(crate::Timescale::MICRO))
 			.unwrap();
 		for _ in 0..10 {
@@ -13700,25 +14074,19 @@ mod tests {
 
 		// The incumbent leaving exhausts the table: the refusal is never retried.
 		drop(track);
-		first.close();
+		first.broadcast().close();
 		assert!(matches!(subscription.recv_group().await, Err(Error::Unsupported)));
 	}
 
 	/// A remote front serving "room/alice" with one read track, "video", whose first
 	/// group was delivered. Returns the producer, the incumbent's track, and the reader.
 	#[cfg(feature = "async")]
-	async fn remote_front() -> (
-		Producer,
-		Requests,
-		broadcast::Producer,
-		track::Producer,
-		track::Subscriber,
-	) {
+	async fn remote_front() -> (Producer, Route, broadcast::Producer, track::Producer, track::Subscriber) {
 		let producer = origin(1).produce();
 		let server = producer
-			.requests_route(
+			.forward(
 				"room",
-				Route::default().with_instance(instance(), 0).with_hops(hops(&[10])),
+				RouteInfo::default().with_instance(instance(), 0).with_hops(hops(&[10])),
 				None,
 			)
 			.unwrap();
@@ -13744,11 +14112,11 @@ mod tests {
 	async fn an_unread_draining_track_releases_the_old_source() {
 		let (producer, _server, _upstream, old, subscription) = remote_front().await;
 
-		let newcomer = producer.create_broadcast("room/alice").unwrap();
-		let mut handler = newcomer.requests();
-		newcomer
-			.announce(Route::default().with_instance(instance(), 0))
+		let newcomer = producer
+			.route("room/alice", RouteOptions::hidden().with_instance(instance(), 0))
 			.unwrap();
+		let mut handler = newcomer.broadcast().requests();
+		newcomer.announce().unwrap();
 		let _unanswered = kio::clock::timeout(Duration::from_secs(1), handler.requested_track())
 			.await
 			.expect("the front asked the newcomer")
@@ -13769,11 +14137,11 @@ mod tests {
 	async fn a_replacement_aborted_without_history_keeps_the_incumbent() {
 		let (producer, _server, _upstream, old, mut subscription) = remote_front().await;
 
-		let newcomer = producer.create_broadcast("room/alice").unwrap();
-		let mut handler = newcomer.requests();
-		newcomer
-			.announce(Route::default().with_instance(instance(), 0))
+		let newcomer = producer
+			.route("room/alice", RouteOptions::hidden().with_instance(instance(), 0))
 			.unwrap();
+		let mut handler = newcomer.broadcast().requests();
+		newcomer.announce().unwrap();
 		let request = kio::clock::timeout(Duration::from_secs(1), handler.requested_track())
 			.await
 			.expect("the front asked the newcomer")
@@ -13812,7 +14180,7 @@ mod tests {
 
 		// No handler and no track: refuses "video" with NotFound.
 		let _second = producer
-			.publish("room/alice", Route::default().with_instance(instance(), 0))
+			.route("room/alice", RouteOptions::default().with_instance(instance(), 0))
 			.unwrap();
 		for _ in 0..10 {
 			kio::clock::sim::yield_now().await;
@@ -13831,7 +14199,7 @@ mod tests {
 			.expect("open");
 
 		let _third = producer
-			.publish("room/alice", Route::default().with_instance(instance(), 0))
+			.route("room/alice", RouteOptions::default().with_instance(instance(), 0))
 			.unwrap();
 		for _ in 0..10 {
 			kio::clock::sim::yield_now().await;
@@ -13907,9 +14275,12 @@ mod tests {
 			.expect("open");
 
 		let newcomer = producer
-			.publish("room/alice", Route::default().with_instance(instance(), 0))
+			.route("room/alice", RouteOptions::default().with_instance(instance(), 0))
+			.unwrap();
+		let _video = newcomer
+			.broadcast()
+			.create_track("video", crate::track::Info::timed())
 			.unwrap();
-		let _video = newcomer.create_track("video", crate::track::Info::timed()).unwrap();
 		for _ in 0..10 {
 			kio::clock::sim::yield_now().await;
 		}
@@ -13930,9 +14301,12 @@ mod tests {
 		let producer = origin(1).produce();
 		let consumer = producer.consume();
 		let first = producer
-			.publish("room/alice", Route::default().with_instance(instance(), 0))
+			.route("room/alice", RouteOptions::default().with_instance(instance(), 0))
+			.unwrap();
+		let track = first
+			.broadcast()
+			.create_track("video", crate::track::Info::timed())
 			.unwrap();
-		let track = first.create_track("video", crate::track::Info::timed()).unwrap();
 		let resolved = consumer.request("room/alice", None).await.expect("resolves");
 		let mut subscription = resolved.track("video").unwrap().subscribe(None).await.unwrap();
 		let mut group = track.append_group().unwrap();
@@ -13942,9 +14316,10 @@ mod tests {
 		assert_eq!(&group.read_frame().await.unwrap().unwrap().payload[..], b"before");
 
 		let second = producer
-			.publish("room/alice", Route::default().with_instance(instance(), 0))
+			.route("room/alice", RouteOptions::default().with_instance(instance(), 0))
 			.unwrap();
 		let incompatible = second
+			.broadcast()
 			.create_track("video", track::Info::default().with_timescale(crate::Timescale::MICRO))
 			.unwrap();
 		for _ in 0..10 {
@@ -13957,7 +14332,7 @@ mod tests {
 
 		// The refusal happened: the incumbent leaving surfaces it.
 		drop(track);
-		first.close();
+		first.broadcast().close();
 		assert!(matches!(subscription.recv_group().await, Err(Error::Unsupported)));
 	}
 
@@ -13970,9 +14345,12 @@ mod tests {
 		let producer = origin(1).produce();
 		let consumer = producer.consume();
 		let first = producer
-			.publish("room/alice", Route::default().with_instance(instance(), 0))
+			.route("room/alice", RouteOptions::default().with_instance(instance(), 0))
+			.unwrap();
+		let track = first
+			.broadcast()
+			.create_track("video", crate::track::Info::timed())
 			.unwrap();
-		let track = first.create_track("video", crate::track::Info::timed()).unwrap();
 		let resolved = consumer.request("room/alice", None).await.expect("resolves");
 		let mut subscription = resolved.track("video").unwrap().subscribe(None).await.unwrap();
 		let mut group = track.append_group().unwrap();
@@ -13983,17 +14361,18 @@ mod tests {
 		drop(group);
 
 		let second = producer
-			.publish("room/alice", Route::default().with_instance(instance(), 0))
+			.route("room/alice", RouteOptions::default().with_instance(instance(), 0))
 			.unwrap();
 		let incompatible = second
+			.broadcast()
 			.create_track("video", track::Info::default().with_timescale(crate::Timescale::MICRO))
 			.unwrap();
 		for _ in 0..10 {
 			kio::clock::sim::yield_now().await;
 		}
 
-		first.unannounce();
-		second.unannounce();
+		first.withdraw();
+		second.withdraw();
 		settle(|| resolved.is_closed()).await;
 
 		let mut group = track.append_group().unwrap();
@@ -14026,9 +14405,12 @@ mod tests {
 		let producer = origin(1).produce();
 		let consumer = producer.consume();
 		let first = producer
-			.publish("room/alice", Route::default().with_instance(instance(), 0))
+			.route("room/alice", RouteOptions::default().with_instance(instance(), 0))
+			.unwrap();
+		let track = first
+			.broadcast()
+			.create_track("video", crate::track::Info::timed())
 			.unwrap();
-		let track = first.create_track("video", crate::track::Info::timed()).unwrap();
 		let resolved = consumer.request("room/alice", None).await.expect("resolves");
 		let mut subscription = resolved.track("video").unwrap().subscribe(None).await.unwrap();
 		let mut group = track.append_group().unwrap();
@@ -14038,16 +14420,18 @@ mod tests {
 		assert_eq!(&group.read_frame().await.unwrap().unwrap().payload[..], b"before");
 		drop(group);
 
-		let second = producer.create_broadcast("room/alice").unwrap();
-		let mut handler = second.requests();
-		second.announce(Route::default().with_instance(instance(), 0)).unwrap();
+		let second = producer
+			.route("room/alice", RouteOptions::hidden().with_instance(instance(), 0))
+			.unwrap();
+		let mut handler = second.broadcast().requests();
+		second.announce().unwrap();
 		let request = kio::clock::timeout(Duration::from_secs(1), handler.requested_track())
 			.await
 			.expect("the front asked the newcomer")
 			.expect("request");
 
-		first.unannounce();
-		second.unannounce();
+		first.withdraw();
+		second.withdraw();
 		settle(|| resolved.is_closed()).await;
 
 		let mut group = track.append_group().unwrap();
@@ -14065,7 +14449,7 @@ mod tests {
 	#[kio::test]
 	async fn multiple_scopes_present_one_broad_prefix() {
 		let producer = origin(1).produce();
-		let _a = producer.announce("", Route::default()).unwrap();
+		let _a = producer.announce("", RouteInfo::default()).unwrap();
 
 		let consumer = producer
 			.consume()
@@ -14124,7 +14508,7 @@ mod tests {
 			.scope("", &scopes(&["room/a", "other/deep/head"]))
 			.unwrap()
 			.routes();
-		let route = producer.announce("room/a/b/c", Route::default()).unwrap();
+		let route = producer.announce("room/a/b/c", RouteInfo::default()).unwrap();
 		{
 			let table = producer.shared.lock();
 			assert!(
@@ -14158,7 +14542,7 @@ mod tests {
 	async fn a_published_broadcast_keeps_the_driver_running() {
 		let (producer, mut driver) = Producer::new(Config::new(origin(1)));
 		let waiter = kio::Waiter::noop();
-		let broadcast = producer.create_broadcast("room/a").unwrap();
+		let broadcast = producer.route("room/a", RouteOptions::hidden()).unwrap();
 		drop(producer);
 		assert!(
 			driver.poll(Instant::now(), &waiter).is_ok(),
@@ -14168,7 +14552,7 @@ mod tests {
 		assert!(matches!(driver.poll(Instant::now(), &waiter), Err(Error::Closed)));
 	}
 
-	/// A handler holding only its `Requests` keeps serving once every producer
+	/// A handler holding only its `Route` keeps serving once every producer
 	/// handle drops, and the driver finishes once the handler is gone too.
 	#[kio::test]
 	#[cfg(feature = "async")]
@@ -14176,7 +14560,7 @@ mod tests {
 		let (producer, driver) = Producer::new(Config::new(origin(1)));
 		let run = kio::clock::sim::spawn(crate::time::run(driver));
 		let consumer = producer.consume();
-		let server = producer.requests_route("room", Route::default(), None).unwrap();
+		let server = producer.forward("room", RouteInfo::default(), None).unwrap();
 		drop(producer);
 
 		let pending = consumer.request("room/alice", None);
@@ -14203,12 +14587,15 @@ mod tests {
 		let (producer, driver) = Producer::new(Config::new(origin(1)));
 		let run = kio::clock::sim::spawn(crate::time::run(driver));
 		let consumer = producer.consume();
-		let broadcast = producer.publish("room/alice", Route::default()).unwrap();
-		let track = broadcast.create_track("video", crate::track::Info::timed()).unwrap();
+		let broadcast = producer.route("room/alice", RouteOptions::default()).unwrap();
+		let track = broadcast
+			.broadcast()
+			.create_track("video", crate::track::Info::timed())
+			.unwrap();
 		let resolved = consumer.request("room/alice", None).await.expect("resolves");
 		let sub = resolved.track("video").unwrap().subscribe(None).await.unwrap();
 
-		broadcast.unannounce();
+		broadcast.withdraw();
 		settle(|| resolved.is_closed()).await;
 		drop(broadcast);
 		drop(producer);
@@ -14228,13 +14615,16 @@ mod tests {
 		let (producer, driver) = Producer::new(Config::new(origin(1)));
 		let run = kio::clock::sim::spawn(crate::time::run(driver));
 		let consumer = producer.consume();
-		let broadcast = producer.publish("room/alice", Route::default()).unwrap();
-		let mut track = broadcast.create_track("video", crate::track::Info::timed()).unwrap();
+		let broadcast = producer.route("room/alice", RouteOptions::default()).unwrap();
+		let mut track = broadcast
+			.broadcast()
+			.create_track("video", crate::track::Info::timed())
+			.unwrap();
 		let resolved = consumer.request("room/alice", None).await.expect("resolves");
 		let sub = resolved.track("video").unwrap().subscribe(None).await.unwrap();
 		let pending = resolved.track("video").unwrap().subscribe(None);
 
-		broadcast.unannounce();
+		broadcast.withdraw();
 		settle(|| resolved.is_closed()).await;
 		drop(broadcast);
 		drop(producer);
@@ -14256,8 +14646,11 @@ mod tests {
 	async fn a_track_unread_as_its_broadcast_ends_releases_its_source() {
 		let producer = origin(1).produce();
 		let consumer = producer.consume();
-		let broadcast = producer.publish("room/alice", Route::default()).unwrap();
-		let track = broadcast.create_track("video", crate::track::Info::timed()).unwrap();
+		let broadcast = producer.route("room/alice", RouteOptions::default()).unwrap();
+		let track = broadcast
+			.broadcast()
+			.create_track("video", crate::track::Info::timed())
+			.unwrap();
 		let resolved = consumer.request("room/alice", None).await.expect("resolves");
 		let sub = resolved.track("video").unwrap().subscribe(None).await.unwrap();
 		kio::clock::timeout(Duration::from_secs(1), track.demand().until(|wanted| wanted.is_some()))
@@ -14281,20 +14674,20 @@ mod tests {
 	async fn source_selection_leases_survive_reprices_but_never_revive_pending_work() {
 		let producer = origin(1).produce();
 		let broad = producer
-			.requests_route("room", Route::default().with_via(origin(2)), None)
+			.forward("room", RouteInfo::default().with_via(origin(2)), None)
 			.unwrap();
 		let selected = broad.request_validity(&Path::from_static("room/a")).unwrap();
 		let pending = selected.current();
 		assert!(!pending.is_closed());
-		broad.update_route(broad.route().with_cost(Cost::from(7))).unwrap();
+		broad.update(broad.route().unwrap().with_cost(Cost::from(7))).unwrap();
 		assert!(!pending.is_closed());
 		// Another peer's winning route cannot change what a request on peer 2 names.
 		let other = producer
-			.requests_route("room/a", Route::default().with_via(origin(3)), None)
+			.forward("room/a", RouteInfo::default().with_via(origin(3)), None)
 			.unwrap();
 		assert!(!pending.is_closed());
 		let replacement = producer
-			.requests_route("room/a", Route::default().with_via(origin(2)), None)
+			.forward("room/a", RouteInfo::default().with_via(origin(2)), None)
 			.unwrap();
 		assert!(pending.is_closed());
 		assert!(selected.current().is_closed());
@@ -14316,15 +14709,15 @@ mod tests {
 		let producer = origin(1).produce();
 		let path = Path::from_static("room/a");
 		let first = producer
-			.requests_route("room", Route::default().with_via(origin(2)), None)
+			.forward("room", RouteInfo::default().with_via(origin(2)), None)
 			.unwrap();
 		let selected = first.request_validity(&path).unwrap();
 		let answering = selected.answering();
 		// A route that loses to the selected one replaces nothing.
 		let worse = producer
-			.requests_route(
+			.forward(
 				"room",
-				Route::default().with_via(origin(2)).with_cost(Cost::from(7)),
+				RouteInfo::default().with_via(origin(2)).with_cost(Cost::from(7)),
 				None,
 			)
 			.unwrap();
@@ -14332,7 +14725,7 @@ mod tests {
 		drop(worse);
 
 		let replacement = producer
-			.requests_route("room/a", Route::default().with_via(origin(2)), None)
+			.forward("room/a", RouteInfo::default().with_via(origin(2)), None)
 			.unwrap();
 		assert!(answering.is_closed());
 		// Winning again opens a new lease, which a withdrawal leaves open.
@@ -14345,7 +14738,7 @@ mod tests {
 
 		// Announced again, the path has a new instance: a replacement.
 		let _again = producer
-			.requests_route("room", Route::default().with_via(origin(2)), None)
+			.forward("room", RouteInfo::default().with_via(origin(2)), None)
 			.unwrap();
 		assert!(answering.is_closed());
 	}
@@ -14354,7 +14747,7 @@ mod tests {
 	async fn source_selection_unregisters_without_retaining_the_source() {
 		let producer = origin(1).produce();
 		let route = producer
-			.requests_route("room", Route::default().with_via(origin(2)), None)
+			.forward("room", RouteInfo::default().with_via(origin(2)), None)
 			.unwrap();
 		let path = Path::from_static("room/a");
 		let selected = route.request_validity(&path).unwrap();
@@ -14376,12 +14769,12 @@ mod tests {
 		let seen = watch.seen();
 
 		// A route beside the path or beneath it covers nothing at the path.
-		let _other = producer.announce("other", Route::default()).unwrap();
-		let _below = producer.announce("room/a/b", Route::default()).unwrap();
+		let _other = producer.announce("other", RouteInfo::default()).unwrap();
+		let _below = producer.announce("room/a/b", RouteInfo::default()).unwrap();
 		assert!(watch.poll_changed(&waiter, seen).is_pending());
 
 		// A route above it does, and so does its retraction.
-		let above = producer.announce("room", Route::default()).unwrap();
+		let above = producer.announce("room", RouteInfo::default()).unwrap();
 		assert!(watch.poll_changed(&waiter, seen).is_ready());
 		let seen = watch.seen();
 		drop(above);
@@ -14389,9 +14782,9 @@ mod tests {
 		let seen = watch.seen();
 
 		// A local broadcast attaching at the exact path does; one beside it does not.
-		let _beside = producer.create_broadcast("room/b").unwrap();
+		let _beside = producer.route("room/b", RouteOptions::hidden()).unwrap();
 		assert!(watch.poll_changed(&waiter, seen).is_pending());
-		let _here = producer.create_broadcast("room/a").unwrap();
+		let _here = producer.route("room/a", RouteOptions::hidden()).unwrap();
 		assert!(watch.poll_changed(&waiter, seen).is_ready());
 
 		// Dropping the watch takes it out of the table.
@@ -14413,7 +14806,7 @@ mod tests {
 			..Default::default()
 		});
 		let consumer = producer.consume();
-		let _served = producer.requests_route("room", Route::default(), None).unwrap();
+		let _served = producer.forward("room", RouteInfo::default(), None).unwrap();
 		// A consumer outlives its producer by design, so the task set can refuse
 		// submissions while the origin is still open. The front's task is then
 		// dropped on the spot, taking its `Watch` with it: the request must not
@@ -14426,31 +14819,34 @@ mod tests {
 	async fn published_names_refuse_navigation_segments() {
 		let producer = origin(1).produce();
 		for path in ["room/./cam", "room/../cam", ".", ".."] {
-			assert!(producer.create_broadcast(path).is_err(), "created {path}");
-			assert!(producer.announce(path, Route::default()).is_err(), "announced {path}");
+			assert!(producer.route(path, RouteOptions::hidden()).is_err(), "created {path}");
+			assert!(
+				producer.announce(path, RouteInfo::default()).is_err(),
+				"announced {path}"
+			);
 		}
 		let scoped = producer
 			.scope("room/..", &Patterns::from_iter([Pattern::all()]))
 			.unwrap();
-		assert!(scoped.create_broadcast("cam").is_err());
+		assert!(scoped.route("cam", RouteOptions::hidden()).is_err());
 		for path in ["room/.pro/cam", "room/a..b", "room/cam"] {
-			producer.create_broadcast(path).unwrap();
+			let _route = producer.route(path, RouteOptions::hidden()).unwrap();
 		}
 	}
 
 	#[kio::test]
-	async fn create_broadcast_refuses_a_path_no_pattern_can_spell() {
+	async fn route_refuses_a_path_no_pattern_can_spell() {
 		let producer = origin(1).produce();
 
 		// A `*` segment is a valid path but an invalid literal, so its route could
 		// never be built: refuse the broadcast instead of publishing one that
 		// announces nowhere.
 		assert!(matches!(
-			producer.create_broadcast("room/*"),
+			producer.route("room/*", RouteOptions::hidden()),
 			Err(Error::InvalidPath(_))
 		));
 		assert!(matches!(
-			producer.announce("room/**", Route::default()),
+			producer.announce("room/**", RouteInfo::default()),
 			Err(Error::InvalidPath(_))
 		));
 	}
@@ -14487,9 +14883,9 @@ mod tests {
 		assert_eq!(rooted.allowed(), scopes(&[""]));
 
 		// Publishing through the nested view lands where the root says.
-		let broadcast = nested.create_broadcast("room/chat/live").unwrap();
+		let broadcast = nested.route("room/chat/live", RouteOptions::hidden()).unwrap();
 		assert!(producer.consume().get_broadcast("room/chat/live").is_some());
-		broadcast.close();
+		broadcast.broadcast().close();
 	}
 
 	#[kio::test]
@@ -14513,9 +14909,9 @@ mod tests {
 			Err(Error::Unauthorized)
 		));
 
-		let broadcast = exact.create_broadcast("room/alice").unwrap();
+		let broadcast = exact.route("room/alice", RouteOptions::hidden()).unwrap();
 		assert!(matches!(
-			exact.create_broadcast("room/alice/cam"),
+			exact.route("room/alice/cam", RouteOptions::hidden()),
 			Err(Error::Unauthorized)
 		));
 		assert!(producer.consume().get_broadcast("room/alice").is_some());
@@ -14532,8 +14928,8 @@ mod tests {
 		let mut listed = consumer.routes();
 		let mut announced = consumer.covering().routes();
 
-		let alice = producer.create_broadcast("room/alice/chat").unwrap();
-		alice.announce(Route::default()).unwrap();
+		let alice = producer.route("room/alice/chat", RouteOptions::hidden()).unwrap();
+		alice.announce().unwrap();
 		let Some(RouteEvent::Start(update)) = announced.try_next() else {
 			panic!("expected alice's chat");
 		};
@@ -14541,11 +14937,11 @@ mod tests {
 		assert_eq!(update.captures, Some(vec!["alice".parse::<Pattern>().unwrap()]));
 		listed.expect_next_active("room/alice/chat").await;
 
-		let audio = producer.create_broadcast("room/alice/audio").unwrap();
-		audio.announce(Route::default()).unwrap();
+		let audio = producer.route("room/alice/audio", RouteOptions::hidden()).unwrap();
+		audio.announce().unwrap();
 		announced.assert_next_wait();
 
-		let broad = producer.announce("room", Route::default()).unwrap();
+		let broad = producer.announce("room", RouteInfo::default()).unwrap();
 		let Some(RouteEvent::Start(update)) = announced.try_next() else {
 			panic!("expected the overlapping broad route");
 		};
@@ -14566,9 +14962,11 @@ mod tests {
 			.map(|p| p.parse::<Pattern>().unwrap())
 			.collect();
 		let consumer = producer.consume().scope("project", &patterns).unwrap();
-		let cam = producer.announce("project/cam.hang", Route::default()).unwrap();
-		let overlap = producer.announce("project/room/mic.hang", Route::default()).unwrap();
-		let chat = producer.announce("project/lobby.chat", Route::default()).unwrap();
+		let cam = producer.announce("project/cam.hang", RouteInfo::default()).unwrap();
+		let overlap = producer
+			.announce("project/room/mic.hang", RouteInfo::default())
+			.unwrap();
+		let chat = producer.announce("project/lobby.chat", RouteInfo::default()).unwrap();
 		let mut routing = consumer.clone().covering().routes();
 		routing.expect_next_active("cam.hang").await;
 		routing.expect_next_active("lobby.chat").await;
@@ -14578,9 +14976,11 @@ mod tests {
 		selected.expect_next_active("lobby.chat").await;
 		selected.assert_next_wait();
 
-		let nested = producer.announce("project/room/lobby.chat", Route::default()).unwrap();
+		let nested = producer
+			.announce("project/room/lobby.chat", RouteInfo::default())
+			.unwrap();
 		selected.expect_next_active("room/lobby.chat").await;
-		overlap.update(Route::default().with_cost(2)).unwrap();
+		overlap.update(RouteInfo::default().with_cost(2)).unwrap();
 		drop(overlap);
 		selected.assert_next_wait();
 		drop(nested);
@@ -14596,29 +14996,32 @@ mod tests {
 			.consume()
 			.scope("room/alice", &Patterns::from(Pattern::all()))
 			.unwrap();
-		let broad = producer.announce("room", Route::default()).unwrap();
+		let broad = producer.announce("room", RouteInfo::default()).unwrap();
 		let mut selected = consumer.routes();
 		selected.assert_next_wait();
 
 		let first_instance = crate::Instance::random();
 		let exact = producer
-			.announce("room/alice", Route::default().with_instance(first_instance.clone(), 0))
+			.announce(
+				"room/alice",
+				RouteInfo::default().with_instance(first_instance.clone(), 0),
+			)
 			.unwrap();
 		assert!(
 			matches!(selected.expect_next().await, RouteEvent::Start(a) if a.prefix.is_empty() && a.captures.is_some())
 		);
 		exact
-			.update(Route::default().with_instance(first_instance, 0).with_cost(2))
+			.update(RouteInfo::default().with_instance(first_instance, 0).with_cost(2))
 			.unwrap();
 		assert!(matches!(selected.expect_next().await, RouteEvent::Update(a) if a.route.cost == Cost::new(2)));
 		exact
-			.update(Route::default().with_instance(crate::Instance::random(), 0))
+			.update(RouteInfo::default().with_instance(crate::Instance::random(), 0))
 			.unwrap();
 		assert!(matches!(selected.expect_next().await, RouteEvent::Restart(_)));
 		drop(exact);
 		selected.expect_next_ended("").await;
 		selected.assert_next_wait();
-		let _again = producer.announce("room/alice", Route::default()).unwrap();
+		let _again = producer.announce("room/alice", RouteInfo::default()).unwrap();
 		assert!(matches!(selected.expect_next().await, RouteEvent::Start(_)));
 		drop(broad);
 		selected.assert_next_wait();
@@ -14631,13 +15034,13 @@ mod tests {
 	#[kio::test]
 	async fn announced_matches_mounted_names_and_keeps_exclusions() {
 		let producer = origin(1).produce();
-		let _broad = producer.announce(".svc", Route::default()).unwrap();
-		let _overlap = producer.announce(".svc/p1/mic.hang", Route::default()).unwrap();
+		let _broad = producer.announce(".svc", RouteInfo::default()).unwrap();
+		let _overlap = producer.announce(".svc/p1/mic.hang", RouteInfo::default()).unwrap();
 		let _hidden = producer
-			.announce(".svc/p1/.private/lobby.chat", Route::default())
+			.announce(".svc/p1/.private/lobby.chat", RouteInfo::default())
 			.unwrap();
 		let _excluded = producer
-			.announce(".svc/p1/private/lobby.chat", Route::default())
+			.announce(".svc/p1/private/lobby.chat", RouteInfo::default())
 			.unwrap();
 		let project = mounted(&producer, "p1", &["**/*.chat"])
 			.with_hidden(true)
@@ -14649,7 +15052,7 @@ mod tests {
 		let mut inside = project.scope(".svc", &Patterns::from(Pattern::all())).unwrap().routes();
 		inside.expect_next_active(".private/lobby.chat").await;
 		inside.assert_next_wait();
-		let live = producer.announce(".svc/p1/lobby.chat", Route::default()).unwrap();
+		let live = producer.announce(".svc/p1/lobby.chat", RouteInfo::default()).unwrap();
 		selected.expect_next_active(".svc/lobby.chat").await;
 		inside.expect_next_active("lobby.chat").await;
 		drop(live);
@@ -14662,8 +15065,8 @@ mod tests {
 	async fn announced_requests_covering_routes_and_preserves_shared_fronts_and_stats() {
 		let registry = stats::Registry::new(stats::Config::new());
 		let producer = origin(1).produce();
-		let local = producer.publish("project/cam.chat", Route::default()).unwrap();
-		let overlap = producer.announce("project/room", Route::default()).unwrap();
+		let local = producer.route("project/cam.chat", RouteOptions::default()).unwrap();
+		let overlap = producer.announce("project/room", RouteInfo::default()).unwrap();
 		let consumer = producer
 			.consume()
 			.scope("project", &Patterns::from("**/*.chat".parse::<Pattern>().unwrap()))
@@ -14688,7 +15091,10 @@ mod tests {
 			resolved.is_clone(&original),
 			"the view shares the origin's existing front"
 		);
-		let track = local.create_track("video", crate::track::Info::timed()).unwrap();
+		let track = local
+			.broadcast()
+			.create_track("video", crate::track::Info::timed())
+			.unwrap();
 		let mut written = track.append_group().unwrap();
 		written.write_frame(crate::Timestamp::ZERO, b"frame".as_ref()).unwrap();
 		written.finish().unwrap();
@@ -14711,19 +15117,21 @@ mod tests {
 		assert!(routes.next().await.is_some());
 		drop(routes);
 		drop(overlap);
-		let source = producer.requests("project/room").unwrap();
+		let source = producer.route_prefix("project/room", RouteOptions::default()).unwrap();
 		let pending = consumer.request("room/lobby.chat", None);
-		let request = source.requested_broadcast().await.unwrap();
-		request.serve(local.consume());
+		let request = source.requested().await.unwrap();
+		request.serve(local.broadcast().consume());
 		pending.await.unwrap();
 	}
 
 	#[kio::test]
 	async fn local_broadcast_wins_announcement_ties() {
 		let producer = origin(1).produce();
-		let remote = producer.announce("room/alice", Route::default().with_cost(9)).unwrap();
-		let local = producer.create_broadcast("room/alice").unwrap();
-		local.announce(Route::default()).unwrap();
+		let remote = producer
+			.announce("room/alice", RouteInfo::default().with_cost(9))
+			.unwrap();
+		let local = producer.route("room/alice", RouteOptions::hidden()).unwrap();
+		local.announce().unwrap();
 
 		let mut announced = producer.consume().routes();
 		let Some(RouteEvent::Start(update)) = announced.try_next() else {
@@ -14768,8 +15176,11 @@ mod tests {
 	async fn stalled_publisher_open_group_is_reclaimed() {
 		let expiry = Duration::from_secs(1);
 		let origin = expiring_origin(expiry);
-		let broadcast = origin.create_broadcast("test").unwrap();
-		let track = broadcast.create_track("video", crate::track::Info::timed()).unwrap();
+		let broadcast = origin.route("test", RouteOptions::hidden()).unwrap();
+		let track = broadcast
+			.broadcast()
+			.create_track("video", crate::track::Info::timed())
+			.unwrap();
 
 		let mut stalled = track.append_group().unwrap();
 		stalled.write_frame(crate::Timestamp::ZERO, b"x".as_slice()).unwrap();
@@ -14801,8 +15212,11 @@ mod tests {
 			..Config::default()
 		}
 		.produce();
-		let broadcast = origin.create_broadcast("test").unwrap();
-		let track = broadcast.create_track("video", crate::track::Info::timed()).unwrap();
+		let broadcast = origin.route("test", RouteOptions::hidden()).unwrap();
+		let track = broadcast
+			.broadcast()
+			.create_track("video", crate::track::Info::timed())
+			.unwrap();
 
 		let mut stalled = track.append_group().unwrap();
 		stalled.write_frame(crate::Timestamp::ZERO, b"x".as_slice()).unwrap();
diff --git a/rs/moq-net/src/model/resume_model.rs b/rs/moq-net/src/model/resume_model.rs
index ae543920738..cac76dd195c 100644
--- a/rs/moq-net/src/model/resume_model.rs
+++ b/rs/moq-net/src/model/resume_model.rs
@@ -19,7 +19,7 @@ use std::time::Duration;
 use proptest::prelude::*;
 use proptest::test_runner::{Config, RngSeed, TestCaseError, TestRunner};
 
-use super::origin::{Producer, Route};
+use super::origin::{Producer, RouteInfo};
 use crate::{Error, Hop, Hops, Instance, SessionError, StreamError, Timestamp, broadcast, group, origin, track};
 
 /// Groups in the logical track; group `g` has `1 + g % 3` frames.
@@ -448,17 +448,17 @@ impl Model {
 		let mut hops = Hops::new();
 		hops.push(Hop::new(10 * (instance as u64 + 1) + slot as u64).unwrap())
 			.unwrap();
-		let route = Route::default()
+		let route = RouteInfo::default()
 			.with_instance(self::instance(instance), 0)
 			.with_hops(hops)
 			// The second instance's routes all undercut the first's.
 			.with_cost(((INSTANCES - instance) * SLOTS - slot) as u64);
-		let requests = self.origin.requests_route(PATH, route, None).unwrap();
+		let requests = self.origin.forward(PATH, route, None).unwrap();
 		let broadcast = broadcast::Info::new().produce();
 		let track = broadcast.create_track("video", track::Info::timed()).unwrap();
 		let upstream = broadcast.consume();
 		let serving = kio::clock::sim::spawn(async move {
-			while let Ok(request) = kio::wait(|waiter| requests.poll_requested_broadcast(waiter)).await {
+			while let Some(request) = kio::wait(|waiter| requests.poll_requested(waiter)).await {
 				request.serve(&upstream);
 			}
 		});
diff --git a/rs/moq-net/src/model/socket.rs b/rs/moq-net/src/model/socket.rs
index 9c47c581f43..41428a77e03 100644
--- a/rs/moq-net/src/model/socket.rs
+++ b/rs/moq-net/src/model/socket.rs
@@ -34,7 +34,7 @@ use std::task::{Poll, ready};
 use crate::{Error, Path};
 
 use super::WeakEntry;
-use super::origin::{self, Route};
+use super::origin::{self, RouteOptions};
 use super::track::{self, Delay, Order, Subscription};
 use super::{frame, group};
 
@@ -125,8 +125,8 @@ mod sealed {
 		pub(super) origin: origin::Consumer,
 		/// Where the `tcp` sessions' pumps run: the origin's driver.
 		pub(super) tasks: crate::util::TasksWeak,
-		/// This endpoint's broadcast.
-		pub(super) publication: origin::Publication,
+		/// This endpoint's route, which owns its broadcast.
+		pub(super) route: origin::Route,
 		/// The sessions withholding the broadcast from their peer.
 		pub(super) withheld: origin::HiddenWithheld,
 		pub(super) state: kio::Lock<State>,
@@ -393,7 +393,7 @@ impl Shared {
 			} else {
 				match std::mem::replace(&mut state.handler, Handler::Taken(kio::WaiterList::new())) {
 					Handler::Idle(requests) => Some(requests),
-					Handler::None => Some(self.publication.requests()),
+					Handler::None => Some(self.route.broadcast().requests()),
 					Handler::Taken(_) => unreachable!("checked above"),
 				}
 			}
@@ -485,7 +485,7 @@ impl Shared {
 		if let Some(retired) = retired {
 			// Closed first, as `close` may not have yet: dropping the last handler rejects
 			// the dials still queued with `Dropped`, rather than the close's `Unroutable`.
-			self.publication.close();
+			self.route.broadcast().close();
 			drop(retired);
 		}
 		for mut wake in wakes {
@@ -514,7 +514,7 @@ impl Shared {
 		if let Some(err) = &self.state.lock().end {
 			return Err(err.clone());
 		}
-		match self.publication.poll_closed(waiter) {
+		match self.route.broadcast().poll_closed(waiter) {
 			Poll::Ready(()) => Err(Error::Closed),
 			Poll::Pending => Ok(()),
 		}
@@ -542,7 +542,7 @@ impl Shared {
 		let streams = std::mem::take(&mut state.streams);
 		drop(guard);
 
-		self.publication.close();
+		self.route.broadcast().close();
 		// Reset outside the lock.
 		for stream in streams {
 			stream.abort(Error::Cancel);
@@ -589,7 +589,7 @@ impl Endpoint {
 	///
 	/// `id` names the endpoint: a well-known name for a server, or a random one for a
 	/// client. It must be one path segment. Fails like
-	/// [`origin::Producer::create_broadcast`] when `origin` may not publish
+	/// [`origin::Producer::route`] when `origin` may not publish
 	/// `<prefix>/.socket/<id>`.
 	pub fn new(
 		origin: &origin::Producer,
@@ -597,8 +597,7 @@ impl Endpoint {
 		id: &str,
 	) -> Result<Self, Error> {
 		let prefix = crate::path::convert(prefix)?;
-		let publication = origin.create_broadcast(endpoint_path(&prefix, id)?)?;
-		publication.announce(Route::default())?;
+		let route = origin.route(endpoint_path(&prefix, id)?, RouteOptions::default())?;
 		let consumer = origin.consume();
 		Ok(Self {
 			shared: Arc::new(Shared {
@@ -607,7 +606,7 @@ impl Endpoint {
 				withheld: consumer.hidden_withheld(),
 				origin: consumer,
 				tasks: origin.tasks(),
-				publication,
+				route,
 				state: kio::Lock::new(State {
 					handler: Handler::None,
 					tcp: Queue::default(),
@@ -665,7 +664,7 @@ impl Endpoint {
 		let name = track_name(S::PROTOCOL.as_str(), &shared.id, peer, &session);
 		// This side's half, waiting for the peer to ask for it, which only the peer can:
 		// nobody else knows the session.
-		let answer = shared.publication.reserve_unlisted_track(name.clone())?;
+		let answer = shared.route.broadcast().reserve_unlisted_track(name.clone())?;
 		// Followed rather than requested, so a peer not announced yet is waited for.
 		let resolving = Box::new(shared.origin.follow(path, None)?);
 		Ok(kio::Pending::new(Dialing {
@@ -1298,7 +1297,7 @@ mod tests {
 			// Listening, so the dial queues for the handler.
 			assert!(endpoint.poll_accept_tcp(&noop).is_pending());
 
-			let broadcast = endpoint.shared.publication.broadcast().consume();
+			let broadcast = endpoint.shared.route.broadcast().consume();
 			let dial = broadcast
 				.track("tcp/alice/bob/0123456789abcdef0123456789abcdef")
 				.unwrap()
@@ -1338,7 +1337,7 @@ mod tests {
 		assert!(endpoint.poll_accept_track(&noop).is_pending());
 		assert!(endpoint.poll_accept_tcp(&noop).is_pending());
 
-		let broadcast = endpoint.shared.publication.broadcast().consume();
+		let broadcast = endpoint.shared.route.broadcast().consume();
 		let queued = || endpoint.shared.state.lock().track.dials.len();
 		let dial = |session: u32| {
 			let dial = broadcast
diff --git a/rs/moq-net/src/server.rs b/rs/moq-net/src/server.rs
index 994db90172e..07343c53954 100644
--- a/rs/moq-net/src/server.rs
+++ b/rs/moq-net/src/server.rs
@@ -1990,7 +1990,7 @@ mod tests {
 		let _echoed = origin
 			.announce(
 				"echoed-route",
-				crate::origin::Route::default()
+				crate::origin::RouteInfo::default()
 					.with_hops(echoed_hops)
 					.with_via(assigned),
 			)
@@ -1999,7 +1999,7 @@ mod tests {
 		let mut local_hops = crate::Hops::new();
 		local_hops.push(other).unwrap();
 		let _local = origin
-			.announce("local-route", crate::origin::Route::default().with_hops(local_hops))
+			.announce("local-route", crate::origin::RouteInfo::default().with_hops(local_hops))
 			.unwrap();
 
 		let (session, driver) = request.ok().await.unwrap();
diff --git a/rs/moq-net/src/stats.rs b/rs/moq-net/src/stats.rs
index b1393c0340f..9ad67de8065 100644
--- a/rs/moq-net/src/stats.rs
+++ b/rs/moq-net/src/stats.rs
@@ -29,7 +29,7 @@
 //!
 //! * `announces_started` / `announces_ended`: cumulative broadcast
 //!   announce/unannounce events on this `(tier, role)`. Driven by the tagged
-//!   announce stream on the egress side, and by `create_broadcast` route
+//!   announce stream on the egress side, and by `origin::Producer::route`
 //!   transitions on the ingress side.
 //! * `announced_bytes`: cumulative broadcast-name length summed over each
 //!   model-visible announce and unannounce of this broadcast (the name, not the
diff --git a/rs/moq-net/src/util.rs b/rs/moq-net/src/util.rs
index 23ea5c01c72..a25c31f0700 100644
--- a/rs/moq-net/src/util.rs
+++ b/rs/moq-net/src/util.rs
@@ -27,7 +27,7 @@ pub(crate) struct Tasks {
 }
 
 /// A claim on a [`TaskSet`]'s lifetime with no submission queue: what a
-/// broadcast published on an origin and an `origin::Requests` hold, so the
+/// broadcast published on an origin and an `origin::Route` hold, so the
 /// driver outlives the producer handles a session was given and dropped.
 pub(crate) struct Keepalive {
 	_alive: kio::Producer<()>,
diff --git a/rs/moq-net/tests/integration/announce_covering_route.rs b/rs/moq-net/tests/integration/announce_covering_route.rs
index c88a1524e01..c7337a94d88 100644
--- a/rs/moq-net/tests/integration/announce_covering_route.rs
+++ b/rs/moq-net/tests/integration/announce_covering_route.rs
@@ -65,13 +65,17 @@ async fn covering(version: Option<&str>) -> Vec<String> {
 	let mut announced = observer.scope(REQUESTED, &everything).unwrap().covering().routes();
 	let mut log = Vec::new();
 
-	let served = publisher.create_broadcast(SERVED).unwrap();
-	served.announce(Default::default()).unwrap();
+	let served = publisher
+		.route(SERVED, moq_net::origin::RouteOptions::hidden())
+		.unwrap();
+	served.announce().unwrap();
 	kio::clock::sleep(SETTLE).await;
 	log.push(format!("served: {:?}", drain(&mut announced)));
 
-	let below = publisher.create_broadcast(format!("{REQUESTED}/cam")).unwrap();
-	below.announce(Default::default()).unwrap();
+	let below = publisher
+		.route(format!("{REQUESTED}/cam"), moq_net::origin::RouteOptions::hidden())
+		.unwrap();
+	below.announce().unwrap();
 	kio::clock::sleep(SETTLE).await;
 	log.push(format!("below: {:?}", drain(&mut announced)));
 
@@ -129,9 +133,13 @@ async fn relays_route_a_covering_claim_that_listings_omit() {
 	] {
 		let version: Version = version.parse().unwrap();
 		let publisher = produce_origin(1);
-		let claim = publisher.requests("room").unwrap();
-		let listed = publisher.create_broadcast("lobby.chat").unwrap();
-		listed.announce(Default::default()).unwrap();
+		let claim = publisher
+			.route_prefix("room", moq_net::origin::RouteOptions::default())
+			.unwrap();
+		let listed = publisher
+			.route("lobby.chat", moq_net::origin::RouteOptions::hidden())
+			.unwrap();
+		listed.announce().unwrap();
 
 		let relay = produce_origin(2);
 		let mut options = MockConnectOptions::new(version);
@@ -161,7 +169,7 @@ async fn relays_route_a_covering_claim_that_listings_omit() {
 			.unwrap();
 		let track = broadcast.track("video").unwrap();
 		let _subscribing = kio::clock::sim::spawn(async move { track.subscribe(None).await.map(drop) });
-		let request = kio::clock::timeout(SETTLE, claim.requested_broadcast())
+		let request = kio::clock::timeout(SETTLE, claim.requested())
 			.await
 			.expect("the request crossed both hops")
 			.unwrap();
diff --git a/rs/moq-net/tests/integration/announce_takeover.rs b/rs/moq-net/tests/integration/announce_takeover.rs
index f3c08ef14c0..90cdb661d58 100644
--- a/rs/moq-net/tests/integration/announce_takeover.rs
+++ b/rs/moq-net/tests/integration/announce_takeover.rs
@@ -37,20 +37,24 @@ async fn settle() {
 /// A worker claiming `claim`, answering each request with an output whose `video` track
 /// carries the worker's name.
 struct Worker {
-	_claim: Rc<origin::Requests>,
-	outputs: Rc<RefCell<Vec<(origin::Publication, track::Producer)>>>,
+	_claim: Rc<origin::Route>,
+	outputs: Rc<RefCell<Vec<(origin::Route, track::Producer)>>>,
 	origin: origin::Producer,
 }
 
 impl Worker {
 	fn new(hop: u64, claim: &str, name: &'static str) -> Self {
 		let origin = produce_origin(hop);
-		let claim = Rc::new(origin.requests(claim).unwrap());
+		let claim = Rc::new(
+			origin
+				.route_prefix(claim, moq_net::origin::RouteOptions::default())
+				.unwrap(),
+		);
 		let outputs = Rc::new(RefCell::new(Vec::new()));
 		let (handler, served) = (claim.clone(), outputs.clone());
 		drop(kio::clock::sim::spawn(async move {
-			while let Ok(request) = handler.requested_broadcast().await {
-				let prepared = request.prepare().unwrap();
+			while let Some(request) = handler.requested().await {
+				let prepared = request.route(moq_net::origin::RouteOptions::hidden()).unwrap();
 				let track = prepared
 					.broadcast()
 					.create_track(
@@ -61,7 +65,8 @@ impl Worker {
 				let mut group = track.append_group().unwrap();
 				group.write_frame(Timestamp::ZERO, name.as_bytes().to_vec()).unwrap();
 				group.finish().unwrap();
-				served.borrow_mut().push((prepared.publish().unwrap(), track));
+				prepared.announce().unwrap();
+				served.borrow_mut().push((prepared, track));
 			}
 		}));
 		Self {
@@ -220,7 +225,10 @@ async fn an_unrequested_publish_is_a_start() {
 		let mut announced = relay.consume().routes();
 		assert_eq!(drain(&mut announced).await, [("start", "pool".to_string(), None)]);
 
-		let _direct = worker.origin.publish("pool/q", origin::Route::default()).unwrap();
+		let _direct = worker
+			.origin
+			.route("pool/q", moq_net::origin::RouteOptions::default())
+			.unwrap();
 		settle().await;
 		assert_eq!(drain(&mut announced).await, [("start", "pool/q".to_string(), None)]);
 	})
diff --git a/rs/moq-net/tests/integration/announce_to_serve.rs b/rs/moq-net/tests/integration/announce_to_serve.rs
index 112ac37fba1..c41ca7e1160 100644
--- a/rs/moq-net/tests/integration/announce_to_serve.rs
+++ b/rs/moq-net/tests/integration/announce_to_serve.rs
@@ -145,8 +145,8 @@ async fn lifecycle(observer: Observer) -> Vec<String> {
 	let mut log = Vec::new();
 
 	// Created, not yet announced: nobody can see or reach it.
-	let broadcast = publisher.create_broadcast(PATH).unwrap();
-	let track = broadcast.create_track("video", timed()).unwrap();
+	let broadcast = publisher.route(PATH, moq_net::origin::RouteOptions::hidden()).unwrap();
+	let track = broadcast.broadcast().create_track("video", timed()).unwrap();
 	kio::clock::sleep(SETTLE).await;
 	log.push(format!(
 		"created: {:?} {}",
@@ -155,7 +155,7 @@ async fn lifecycle(observer: Observer) -> Vec<String> {
 	));
 
 	// Announced: listed, and a request resolves.
-	broadcast.announce(Default::default()).unwrap();
+	broadcast.announce().unwrap();
 	kio::clock::sleep(SETTLE).await;
 	let first = request(&consumer).await;
 	log.push(format!("announced: {:?} {}", drain(&mut announced), outcome(&first)));
@@ -173,7 +173,7 @@ async fn lifecycle(observer: Observer) -> Vec<String> {
 	// Unannounced: retracted for everyone. A fresh request is refused rather
 	// than joining the broadcast still draining, which ends, while the track
 	// already in flight carries on to its own end.
-	broadcast.unannounce();
+	broadcast.withdraw();
 	kio::clock::sleep(SETTLE).await;
 	log.push(format!(
 		"unannounced: {:?} {} closed={}",
@@ -190,7 +190,7 @@ async fn lifecycle(observer: Observer) -> Vec<String> {
 	));
 
 	// Announced again: listed and servable, through a fresh broadcast.
-	broadcast.announce(Default::default()).unwrap();
+	broadcast.announce().unwrap();
 	kio::clock::sleep(SETTLE).await;
 	let again = request(&consumer).await;
 	log.push(format!(
@@ -201,7 +201,7 @@ async fn lifecycle(observer: Observer) -> Vec<String> {
 	));
 	let again = again.expect("a reannounced broadcast resolves");
 
-	let audio = broadcast.create_track("audio", timed()).unwrap();
+	let audio = broadcast.broadcast().create_track("audio", timed()).unwrap();
 	let mut reader = read(&again, "audio").await;
 	kio::clock::timeout(SETTLE, crate::support::wanted(audio.demand()))
 		.await
diff --git a/rs/moq-net/tests/integration/auth.rs b/rs/moq-net/tests/integration/auth.rs
index 57fdedb60b2..9540a755b62 100644
--- a/rs/moq-net/tests/integration/auth.rs
+++ b/rs/moq-net/tests/integration/auth.rs
@@ -143,8 +143,9 @@ async fn moqt_22_renewing_a_cancelled_announce_keeps_the_session() {
 		let mut tokens = serve(pair.requests.take().unwrap(), |_| Some(Grant::all()));
 		let (first, answer) = pair.client.auth().add("first").await.expect("kept for requests");
 		assert_eq!(answer, auth::Answer::Requests);
-		let broadcast = client_origin.create_broadcast("room/x").unwrap();
-		broadcast.announce(origin::Route::default().with_auth(first)).unwrap();
+		let broadcast = client_origin
+			.route("room/x", origin::RouteOptions::default().with_auth(first))
+			.unwrap();
 		let (_, first) = tokens.next().await.expect("the announce's token");
 
 		// Ending the grant cancels the announcement. The idle request reads that and the
@@ -155,7 +156,7 @@ async fn moqt_22_renewing_a_cancelled_announce_keeps_the_session() {
 		assert_eq!(token, b"first");
 		kio::clock::sleep(Duration::from_secs(1)).await;
 		let (second, _) = pair.client.auth().add("second").await.expect("kept for requests");
-		broadcast.announce(origin::Route::default().with_auth(second)).unwrap();
+		broadcast.set_auth(Some(second)).unwrap();
 		let (token, _second) = tokens.next().await.expect("announced again");
 		assert_eq!(token, b"second");
 		assert_eq!(pair.client_transport.close_reason(), None);
@@ -174,12 +175,13 @@ async fn moqt_22_a_cancelled_renewal_keeps_the_session() {
 			(token == b"first").then(Grant::all)
 		});
 		let (first, _) = pair.client.auth().add("first").await.expect("kept for requests");
-		let broadcast = client_origin.create_broadcast("room/x").unwrap();
-		broadcast.announce(origin::Route::default().with_auth(first)).unwrap();
+		let broadcast = client_origin
+			.route("room/x", origin::RouteOptions::default().with_auth(first))
+			.unwrap();
 		let (_, first) = tokens.next().await.expect("the announce's token");
 
 		let (second, _) = pair.client.auth().add("second").await.expect("kept for requests");
-		broadcast.announce(origin::Route::default().with_auth(second)).unwrap();
+		broadcast.set_auth(Some(second)).unwrap();
 		kio::clock::sleep(Duration::from_secs(1)).await;
 		drop(first);
 		kio::clock::sleep(Duration::from_secs(1)).await;
@@ -198,8 +200,9 @@ async fn moqt_22_dropping_the_old_grant_with_its_renewal_keeps_the_announce() {
 		let (mut pair, client_origin, server_origin) = connect_route_auth(MOQT_22).await;
 		let mut requests = pair.requests.take().unwrap();
 		let (first, _) = pair.client.auth().add("first").await.expect("kept for requests");
-		let broadcast = client_origin.create_broadcast("room/x").unwrap();
-		broadcast.announce(origin::Route::default().with_auth(first)).unwrap();
+		let broadcast = client_origin
+			.route("room/x", origin::RouteOptions::default().with_auth(first))
+			.unwrap();
 		let first = requests
 			.next()
 			.await
@@ -208,7 +211,7 @@ async fn moqt_22_dropping_the_old_grant_with_its_renewal_keeps_the_announce() {
 		wait_announced(&server_origin.consume(), "room/x", true).await;
 
 		let (second, _) = pair.client.auth().add("second").await.expect("kept for requests");
-		broadcast.announce(origin::Route::default().with_auth(second)).unwrap();
+		broadcast.set_auth(Some(second)).unwrap();
 		let renewal = requests.next().await.expect("the renewal's token");
 		assert_eq!(renewal.token().as_ref(), b"second");
 		let second = renewal.accept(Grant::all());
@@ -253,8 +256,9 @@ async fn moqt_22_a_revoked_route_auth_remakes_its_announce() {
 		let (first, _) = pair.client.auth().add("first").await.expect("granted");
 		let (token, presented) = tokens.next().await.expect("the AUTH stream's token");
 		assert_eq!(token, b"first");
-		let broadcast = client_origin.create_broadcast("room/x").unwrap();
-		broadcast.announce(origin::Route::default().with_auth(first)).unwrap();
+		let _route = client_origin
+			.route("room/x", origin::RouteOptions::default().with_auth(first))
+			.unwrap();
 		let (token, carried) = tokens.next().await.expect("the announce's token");
 		assert_eq!(token, b"first");
 		wait_announced(&server_origin.consume(), "room/x", true).await;
@@ -313,8 +317,9 @@ async fn a_route_auth_survives_a_reconnect(version: &'static str) {
 		let mut first = connect_route_auth_on(version, &client_origin, &server_origin, Some(handle.clone())).await;
 		let mut tokens = serve(first.requests.take().unwrap(), |_| Some(Grant::all()));
 		let (token, _) = handle.add("first").await.expect("kept for requests");
-		let broadcast = client_origin.create_broadcast("room/x").unwrap();
-		broadcast.announce(origin::Route::default().with_auth(token)).unwrap();
+		let _route = client_origin
+			.route("room/x", origin::RouteOptions::default().with_auth(token))
+			.unwrap();
 		let (token, _first) = tokens.next().await.expect("the announce's token");
 		assert_eq!(token, b"first");
 
@@ -339,14 +344,15 @@ async fn a_route_auth_renews_its_announce(version: &'static str) {
 		let mut tokens = serve(pair.requests.take().unwrap(), |_| Some(Grant::all()));
 
 		let (first, _) = pair.client.auth().add("first").await.expect("kept for requests");
-		let broadcast = client_origin.create_broadcast("room/x").unwrap();
-		broadcast.announce(origin::Route::default().with_auth(first)).unwrap();
+		let route = client_origin
+			.route("room/x", origin::RouteOptions::default().with_auth(first))
+			.unwrap();
 		let (token, _first) = tokens.next().await.expect("the announce's token");
 		assert_eq!(token, b"first");
 		wait_announced(&server_origin.consume(), "room/x", true).await;
 
 		let (second, _) = pair.client.auth().add("second").await.expect("kept for requests");
-		broadcast.announce(origin::Route::default().with_auth(second)).unwrap();
+		route.set_auth(Some(second)).unwrap();
 		let (token, _second) = tokens.next().await.expect("the renewal's token");
 		assert_eq!(token, b"second");
 		wait_announced(&server_origin.consume(), "room/x", true).await;
@@ -608,13 +614,17 @@ async fn an_out_of_scope_announce_aborts_with_the_path(version: &'static str) {
 		.await;
 
 		// In scope: served, and nothing aborts.
-		let ok = publisher.create_broadcast("baz/ok").unwrap();
-		ok.announce(Default::default()).unwrap();
+		let ok = publisher
+			.route("baz/ok", moq_net::origin::RouteOptions::hidden())
+			.unwrap();
+		ok.announce().unwrap();
 		wait_announced(&relay.consume(), "baz/ok", true).await;
 		assert_eq!(pair.client_transport.close_reason(), None);
 
-		let bad = publisher.create_broadcast("foo/bar").unwrap();
-		bad.announce(Default::default()).unwrap();
+		let bad = publisher
+			.route("foo/bar", moq_net::origin::RouteOptions::hidden())
+			.unwrap();
+		bad.announce().unwrap();
 		let err = pair.server.closed().await;
 		assert!(
 			matches!(err, Error::Session(SessionError::Unauthorized)),
@@ -632,8 +642,10 @@ async fn an_out_of_scope_announce_aborts_with_the_path(version: &'static str) {
 async fn a_broadcast_published_before_the_grant_is_checked(version: &'static str) {
 	within(async {
 		let publisher = produce_origin(2);
-		let early = publisher.create_broadcast("foo/bar").unwrap();
-		early.announce(Default::default()).unwrap();
+		let early = publisher
+			.route("foo/bar", moq_net::origin::RouteOptions::hidden())
+			.unwrap();
+		early.announce().unwrap();
 
 		let pair = connect(Options {
 			version: Some(version),
@@ -674,8 +686,10 @@ async fn an_unanswered_token_holds_the_check(version: &'static str) {
 		let auth = pair.client.auth();
 		let pending = kio::clock::sim::spawn(async move { auth.add("new").await });
 		let unanswered = requests.next().await.unwrap();
-		let broadcast = publisher.create_broadcast("foo/bar").unwrap();
-		broadcast.announce(Default::default()).unwrap();
+		let broadcast = publisher
+			.route("foo/bar", moq_net::origin::RouteOptions::hidden())
+			.unwrap();
+		broadcast.announce().unwrap();
 		kio::clock::sleep(Duration::from_secs(1)).await;
 		use futures::FutureExt;
 		assert!(
@@ -685,8 +699,10 @@ async fn an_unanswered_token_holds_the_check(version: &'static str) {
 		let _issued = unanswered.accept(grant(&["foo"], &[]));
 		let _token = pending.await.unwrap().unwrap();
 		assert_eq!(granted(&pair.client).await, grant(&["baz", "foo"], &[]));
-		let bad = publisher.create_broadcast("still-bad").unwrap();
-		bad.announce(Default::default()).unwrap();
+		let bad = publisher
+			.route("still-bad", moq_net::origin::RouteOptions::hidden())
+			.unwrap();
+		bad.announce().unwrap();
 		assert!(matches!(
 			pair.server.closed().await,
 			Error::Session(SessionError::Unauthorized)
@@ -716,17 +732,21 @@ async fn a_broadcast_withdrawn_while_its_token_waits_is_not_refused(version: &'s
 		let auth = pair.client.auth();
 		let pending = kio::clock::sim::spawn(async move { auth.add("new").await });
 		let unanswered = requests.next().await.unwrap();
-		let withdrawn = publisher.create_broadcast("foo/bar").unwrap();
-		withdrawn.announce(Default::default()).unwrap();
+		let withdrawn = publisher
+			.route("foo/bar", moq_net::origin::RouteOptions::hidden())
+			.unwrap();
+		withdrawn.announce().unwrap();
 		kio::clock::sleep(Duration::from_secs(1)).await;
-		withdrawn.unannounce();
+		withdrawn.withdraw();
 		kio::clock::sleep(Duration::from_secs(1)).await;
 		let _issued = unanswered.accept(grant(&["other"], &[]));
 		let _token = pending.await.unwrap().unwrap();
 		assert_eq!(granted(&pair.client).await, grant(&["baz", "other"], &[]));
 		// Still enforcing: the next uncovered broadcast is the one named.
-		let bad = publisher.create_broadcast("still-bad").unwrap();
-		bad.announce(Default::default()).unwrap();
+		let bad = publisher
+			.route("still-bad", moq_net::origin::RouteOptions::hidden())
+			.unwrap();
+		bad.announce().unwrap();
 		assert!(matches!(
 			pair.server.closed().await,
 			Error::Session(SessionError::Unauthorized)
@@ -764,10 +784,10 @@ async fn tokens_union_and_withdrawing_one_shrinks_it(version: &'static str) {
 		assert_eq!(t1.grant().peek(), Some(grant(&["b"], &[])));
 		assert_eq!(granted(&pair.client).await, grant(&["a", "b"], &[]));
 
-		let a = publisher.create_broadcast("a/x").unwrap();
-		a.announce(Default::default()).unwrap();
-		let b = publisher.create_broadcast("b/y").unwrap();
-		b.announce(Default::default()).unwrap();
+		let a = publisher.route("a/x", moq_net::origin::RouteOptions::hidden()).unwrap();
+		a.announce().unwrap();
+		let b = publisher.route("b/y", moq_net::origin::RouteOptions::hidden()).unwrap();
+		b.announce().unwrap();
 		let served = relay.consume();
 		wait_announced(&served, "a/x", true).await;
 		wait_announced(&served, "b/y", true).await;
@@ -832,8 +852,8 @@ async fn a_revoked_grant_withdraws_and_can_be_restored(version: &'static str) {
 		});
 		let (_, setup) = issued.next().await.unwrap();
 
-		let a = publisher.create_broadcast("a/x").unwrap();
-		a.announce(Default::default()).unwrap();
+		let a = publisher.route("a/x", moq_net::origin::RouteOptions::hidden()).unwrap();
+		a.announce().unwrap();
 		let served = relay.consume();
 		wait_announced(&served, "a/x", true).await;
 
@@ -1080,9 +1100,9 @@ async fn exact_and_subtree_grants_admit_their_broadcast(version: &'static str) {
 	for scope in ["ch1", "ch1/**"] {
 		within(async {
 			let relay = produce_origin(1);
-			let broadcast = relay.create_broadcast("ch1").unwrap();
-			let track = broadcast.create_track("video", timed()).unwrap();
-			broadcast.announce(Default::default()).unwrap();
+			let broadcast = relay.route("ch1", moq_net::origin::RouteOptions::hidden()).unwrap();
+			let track = broadcast.broadcast().create_track("video", timed()).unwrap();
+			broadcast.announce().unwrap();
 
 			let received = produce_origin(2);
 			let scope = pattern_set(&[scope]);
@@ -1122,10 +1142,12 @@ async fn exact_and_subtree_grants_admit_their_broadcast(version: &'static str) {
 /// Connect on `version` and wait for a client announcement to reach the server. Each
 /// driver presents its setup token before it handles any other stream, so by then a
 /// version with AUTH has opened its Auth Stream on both sides.
-async fn connect_announced(version: &'static str) -> (Pair, moq_net::origin::Publication) {
+async fn connect_announced(version: &'static str) -> (Pair, moq_net::origin::Route) {
 	let client_origin = produce_origin(2);
-	let broadcast = client_origin.create_broadcast("room/x").unwrap();
-	broadcast.announce(Default::default()).unwrap();
+	let broadcast = client_origin
+		.route("room/x", moq_net::origin::RouteOptions::hidden())
+		.unwrap();
+	broadcast.announce().unwrap();
 	let server_origin = produce_origin(1);
 	let pair = connect(Options {
 		version: Some(version),
@@ -1141,9 +1163,11 @@ async fn connect_announced(version: &'static str) -> (Pair, moq_net::origin::Pub
 async fn a_live_subscription_survives_union_renewal(version: &'static str) {
 	within(async {
 		let publisher = produce_origin(1);
-		let broadcast = publisher.create_broadcast("room/x").unwrap();
-		let published = broadcast.create_track("video", timed()).unwrap();
-		broadcast.announce(Default::default()).unwrap();
+		let broadcast = publisher
+			.route("room/x", moq_net::origin::RouteOptions::hidden())
+			.unwrap();
+		let published = broadcast.broadcast().create_track("video", timed()).unwrap();
+		broadcast.announce().unwrap();
 		let received = produce_origin(2);
 		let mut pair = connect(Options {
 			version: Some(version),
@@ -1212,14 +1236,18 @@ async fn a_revoked_grant_cancels_its_subscriptions(version: &'static str) {
 
 		// The server publishes room/x to the client; the client publishes up/y to the server.
 		let server_origin = produce_origin(1);
-		let down = server_origin.create_broadcast("room/x").unwrap();
-		let down_track = down.create_track("video", timed()).unwrap();
-		down.announce(Default::default()).unwrap();
+		let down = server_origin
+			.route("room/x", moq_net::origin::RouteOptions::hidden())
+			.unwrap();
+		let down_track = down.broadcast().create_track("video", timed()).unwrap();
+		down.announce().unwrap();
 
 		let client_origin = produce_origin(2);
-		let up = client_origin.create_broadcast("up/y").unwrap();
-		let up_track = up.create_track("video", timed()).unwrap();
-		up.announce(Default::default()).unwrap();
+		let up = client_origin
+			.route("up/y", moq_net::origin::RouteOptions::hidden())
+			.unwrap();
+		let up_track = up.broadcast().create_track("video", timed()).unwrap();
+		up.announce().unwrap();
 
 		let received = produce_origin(3);
 		let mut pair = connect(Options {
@@ -1306,14 +1334,17 @@ async fn a_revoked_grant_cancels_its_subscriptions(version: &'static str) {
 async fn lite_07_a_revoked_grant_cancels_its_datagram_subscriptions() {
 	within(async {
 		let server_origin = produce_origin(1);
-		let down = server_origin.create_broadcast("room/x").unwrap();
+		let down = server_origin
+			.route("room/x", moq_net::origin::RouteOptions::hidden())
+			.unwrap();
 		let mut audio = down
+			.broadcast()
 			.create_datagrams(
 				"audio",
 				moq_net::datagram::Info::default().with_timescale(moq_net::Timescale::MILLI),
 			)
 			.unwrap();
-		down.announce(Default::default()).unwrap();
+		down.announce().unwrap();
 
 		let received = produce_origin(3);
 		let mut pair = connect(Options {
@@ -1512,15 +1543,17 @@ async fn a_wildcard_grant_is_enforced(version: &'static str) {
 
 		let mut held = Vec::new();
 		for path in ["room/alice/cam", "b.hang", "deep/x/b.hang"] {
-			let broadcast = publisher.create_broadcast(path).unwrap();
-			broadcast.announce(Default::default()).unwrap();
+			let broadcast = publisher.route(path, moq_net::origin::RouteOptions::hidden()).unwrap();
+			broadcast.announce().unwrap();
 			wait_announced(&relay.consume(), path, true).await;
 			held.push(broadcast);
 		}
 		assert_eq!(pair.client_transport.close_reason(), None);
 
-		let bad = publisher.create_broadcast("room/alice/mic").unwrap();
-		bad.announce(Default::default()).unwrap();
+		let bad = publisher
+			.route("room/alice/mic", moq_net::origin::RouteOptions::hidden())
+			.unwrap();
+		bad.announce().unwrap();
 		assert!(matches!(
 			pair.server.closed().await,
 			Error::Session(SessionError::Unauthorized)
@@ -1540,8 +1573,10 @@ async fn a_wildcard_grant_is_enforced(version: &'static str) {
 async fn nothing_outside_the_grant_reaches_the_peer(version: &'static str) {
 	within(async {
 		let publisher = produce_origin(2);
-		let early = publisher.create_broadcast("foo/bar").unwrap();
-		early.announce(Default::default()).unwrap();
+		let early = publisher
+			.route("foo/bar", moq_net::origin::RouteOptions::hidden())
+			.unwrap();
+		early.announce().unwrap();
 
 		// The relay accepts anything; only the grant it tells the client is narrow.
 		let relay = produce_origin(1);
@@ -1580,8 +1615,10 @@ async fn a_broadcast_received_from_the_peer_is_not_ours_to_check(version: &'stat
 	within(async {
 		let local = produce_origin(2);
 		let relay = produce_origin(1);
-		let remote = relay.create_broadcast("remote/x").unwrap();
-		remote.announce(Default::default()).unwrap();
+		let remote = relay
+			.route("remote/x", moq_net::origin::RouteOptions::hidden())
+			.unwrap();
+		remote.announce().unwrap();
 
 		let pair = connect(Options {
 			version: Some(version),
@@ -1597,8 +1634,8 @@ async fn a_broadcast_received_from_the_peer_is_not_ours_to_check(version: &'stat
 		wait_announced(&local.consume(), "remote/x", true).await;
 
 		// The first broadcast refused is the one we published, not the one we received.
-		let bad = local.create_broadcast("bad/x").unwrap();
-		bad.announce(Default::default()).unwrap();
+		let bad = local.route("bad/x", moq_net::origin::RouteOptions::hidden()).unwrap();
+		bad.announce().unwrap();
 		assert!(matches!(
 			pair.server.closed().await,
 			Error::Session(SessionError::Unauthorized)
@@ -1685,12 +1722,16 @@ async fn a_narrowing_deafens_one_path(version: &'static str) {
 		};
 
 		let relay = produce_origin(1);
-		let audio = relay.create_broadcast("room/alice/audio").unwrap();
-		let audio_track = audio.create_track("opus", timed()).unwrap();
-		audio.announce(Default::default()).unwrap();
-		let video = relay.create_broadcast("room/alice/video").unwrap();
-		let video_track = video.create_track("h264", timed()).unwrap();
-		video.announce(Default::default()).unwrap();
+		let audio = relay
+			.route("room/alice/audio", moq_net::origin::RouteOptions::hidden())
+			.unwrap();
+		let audio_track = audio.broadcast().create_track("opus", timed()).unwrap();
+		audio.announce().unwrap();
+		let video = relay
+			.route("room/alice/video", moq_net::origin::RouteOptions::hidden())
+			.unwrap();
+		let video_track = video.broadcast().create_track("h264", timed()).unwrap();
+		video.announce().unwrap();
 
 		let received = produce_origin(3);
 		let pair = connect(Options {
@@ -1775,12 +1816,16 @@ async fn a_narrowing_aborts_what_the_peer_published(version: &'static str) {
 		};
 
 		let client_origin = produce_origin(2);
-		let mic = client_origin.create_broadcast("room/bob/mic").unwrap();
-		let mic_track = mic.create_track("opus", timed()).unwrap();
-		mic.announce(Default::default()).unwrap();
-		let cam = client_origin.create_broadcast("room/bob/cam").unwrap();
-		let cam_track = cam.create_track("h264", timed()).unwrap();
-		cam.announce(Default::default()).unwrap();
+		let mic = client_origin
+			.route("room/bob/mic", moq_net::origin::RouteOptions::hidden())
+			.unwrap();
+		let mic_track = mic.broadcast().create_track("opus", timed()).unwrap();
+		mic.announce().unwrap();
+		let cam = client_origin
+			.route("room/bob/cam", moq_net::origin::RouteOptions::hidden())
+			.unwrap();
+		let cam_track = cam.broadcast().create_track("h264", timed()).unwrap();
+		cam.announce().unwrap();
 
 		let relay = produce_origin(1);
 		let pair = connect(Options {
@@ -1842,9 +1887,9 @@ async fn a_narrowing_resets_a_fetch_in_flight(version: &'static str) {
 		let ts = |ms| moq_net::Timestamp::from_millis(ms).unwrap();
 
 		let relay = produce_origin(1);
-		let broadcast = relay.create_broadcast("room/x").unwrap();
-		let track = broadcast.create_track("video", timed()).unwrap();
-		broadcast.announce(Default::default()).unwrap();
+		let broadcast = relay.route("room/x", moq_net::origin::RouteOptions::hidden()).unwrap();
+		let track = broadcast.broadcast().create_track("video", timed()).unwrap();
+		broadcast.announce().unwrap();
 		// The group stays open, so the fetch is still in flight when the grant narrows.
 		let mut group = track.append_group().unwrap();
 		group.write_frame(ts(0), b"first".as_ref()).unwrap();
@@ -1915,9 +1960,11 @@ async fn a_widening_brings_back_a_deafened_path(version: &'static str) {
 		};
 
 		let relay = produce_origin(1);
-		let audio = relay.create_broadcast("room/alice/audio").unwrap();
-		let audio_track = audio.create_track("opus", timed()).unwrap();
-		audio.announce(Default::default()).unwrap();
+		let audio = relay
+			.route("room/alice/audio", moq_net::origin::RouteOptions::hidden())
+			.unwrap();
+		let audio_track = audio.broadcast().create_track("opus", timed()).unwrap();
+		audio.announce().unwrap();
 
 		let received = produce_origin(3);
 		let pair = connect(Options {
@@ -1989,9 +2036,11 @@ async fn a_widening_brings_back_what_the_peer_published(version: &'static str) {
 		};
 
 		let client_origin = produce_origin(2);
-		let mic = client_origin.create_broadcast("room/bob/mic").unwrap();
-		let mic_track = mic.create_track("opus", timed()).unwrap();
-		mic.announce(Default::default()).unwrap();
+		let mic = client_origin
+			.route("room/bob/mic", moq_net::origin::RouteOptions::hidden())
+			.unwrap();
+		let mic_track = mic.broadcast().create_track("opus", timed()).unwrap();
+		mic.announce().unwrap();
 
 		let relay = produce_origin(1);
 		let pair = connect(Options {
diff --git a/rs/moq-net/tests/integration/broadcast_close.rs b/rs/moq-net/tests/integration/broadcast_close.rs
index 12b8087d2f1..2f44c6ae7c0 100644
--- a/rs/moq-net/tests/integration/broadcast_close.rs
+++ b/rs/moq-net/tests/integration/broadcast_close.rs
@@ -22,9 +22,11 @@ fn produce_origin(hop: u64) -> moq_net::origin::Producer {
 
 /// Close a published broadcast and check what `reader`'s origin answers afterwards.
 async fn close_then_lookup(publisher: moq_net::origin::Producer, reader: moq_net::origin::Producer) {
-	let broadcast = publisher.create_broadcast("bcast").unwrap();
-	let _track = broadcast.create_track("video", None).unwrap();
-	broadcast.announce(Default::default()).unwrap();
+	let broadcast = publisher
+		.route("bcast", moq_net::origin::RouteOptions::hidden())
+		.unwrap();
+	let _track = broadcast.broadcast().create_track("video", None).unwrap();
+	broadcast.announce().unwrap();
 
 	let consumer = reader.consume();
 	let handle = kio::clock::timeout(TIMEOUT, consumer.follow("bcast", None).unwrap().available())
@@ -34,7 +36,7 @@ async fn close_then_lookup(publisher: moq_net::origin::Producer, reader: moq_net
 		.unwrap();
 	handle.track("video").expect("a live broadcast serves its track");
 
-	broadcast.close();
+	broadcast.broadcast().close();
 
 	kio::clock::timeout(TIMEOUT, handle.closed())
 		.await
@@ -42,7 +44,7 @@ async fn close_then_lookup(publisher: moq_net::origin::Producer, reader: moq_net
 	assert!(matches!(handle.track("video"), Err(Error::Unroutable)));
 	assert!(matches!(handle.track("audio"), Err(Error::Unroutable)));
 	assert!(matches!(consumer.request("bcast", None).await, Err(Error::Unroutable)));
-	assert!(matches!(broadcast.announce(Default::default()), Err(Error::Closed)));
+	assert!(matches!(broadcast.announce(), Err(Error::Closed)));
 }
 
 #[kio::test]
diff --git a/rs/moq-net/tests/integration/catalog_acquisition.rs b/rs/moq-net/tests/integration/catalog_acquisition.rs
index 413282e2b71..b8285e421ef 100644
--- a/rs/moq-net/tests/integration/catalog_acquisition.rs
+++ b/rs/moq-net/tests/integration/catalog_acquisition.rs
@@ -26,11 +26,11 @@ async fn acquisition(version: &str, carries_instance: bool) {
 	let version: Version = version.parse().unwrap();
 	let publisher = origin(1);
 	let subscriber = origin(2);
-	let broadcast = publisher.create_broadcast("live").unwrap();
-	let mut dynamic = broadcast.requests();
-	broadcast
-		.announce(origin::Route::default().with_instance(moq_net::Instance::random(), 0))
+	let broadcast = publisher
+		.route("live", moq_net::origin::RouteOptions::hidden())
 		.unwrap();
+	let mut dynamic = broadcast.broadcast().requests();
+	broadcast.announce().unwrap();
 	let _old = link(version, &publisher, &subscriber, 100).await;
 	let remote = subscriber
 		.consume()
@@ -42,7 +42,7 @@ async fn acquisition(version: &str, carries_instance: bool) {
 		.unwrap();
 	let mut announced = subscriber.consume().routes();
 	let old_cost = match announced.next().await {
-		Some(moq_net::origin::RouteEvent::Start(announce)) => announce.route.cost,
+		Some(moq_net::origin::RouteEvent::Start(announce)) => announce.route.cost(),
 		other => panic!("expected the first route, got {other:?}"),
 	};
 	let mut pending = Box::pin(remote.track("catalog.json").unwrap().subscribe(None));
@@ -56,8 +56,8 @@ async fn acquisition(version: &str, carries_instance: bool) {
 	// A replacement under a minted instance restarts the advertisement; a carried one only
 	// updates it.
 	let new_cost = match announced.next().await {
-		Some(moq_net::origin::RouteEvent::Update(announce)) if carries_instance => announce.route.cost,
-		Some(moq_net::origin::RouteEvent::Restart(announce)) if !carries_instance => announce.route.cost,
+		Some(moq_net::origin::RouteEvent::Update(announce)) if carries_instance => announce.route.cost(),
+		Some(moq_net::origin::RouteEvent::Restart(announce)) if !carries_instance => announce.route.cost(),
 		other => panic!("{version}: unexpected route change {other:?}"),
 	};
 	assert!(new_cost < old_cost, "the cheaper session wins the route");
diff --git a/rs/moq-net/tests/integration/catalog_churn.rs b/rs/moq-net/tests/integration/catalog_churn.rs
index 6523b31c160..2e0f918e5b1 100644
--- a/rs/moq-net/tests/integration/catalog_churn.rs
+++ b/rs/moq-net/tests/integration/catalog_churn.rs
@@ -279,12 +279,12 @@ async fn execute(version: Version, ops: &[Op]) -> Result<(), Failure> {
 	let relay_b = produce_origin(3);
 	let subscriber = produce_origin(4);
 
-	let broadcast = publisher.create_broadcast("live").unwrap();
-	let info = track::Info::default().with_timescale(moq_net::Timescale::MILLI);
-	let track = broadcast.create_track("catalog.json", info).unwrap();
-	broadcast
-		.announce(origin::Route::default().with_instance(moq_net::Instance::random(), 0))
+	let broadcast = publisher
+		.route("live", moq_net::origin::RouteOptions::hidden())
 		.unwrap();
+	let info = track::Info::default().with_timescale(moq_net::Timescale::MILLI);
+	let track = broadcast.broadcast().create_track("catalog.json", info).unwrap();
+	broadcast.announce().unwrap();
 
 	let upstream = vec![
 		link(version, &publisher, &relay_a).await,
diff --git a/rs/moq-net/tests/integration/catalog_handover.rs b/rs/moq-net/tests/integration/catalog_handover.rs
index 25dbf4c2ba3..0e9fd55c34f 100644
--- a/rs/moq-net/tests/integration/catalog_handover.rs
+++ b/rs/moq-net/tests/integration/catalog_handover.rs
@@ -91,7 +91,7 @@ struct Topology {
 	p_to_a: Option<MockPair>,
 	a_to_r: Option<MockPair>,
 	links: Vec<MockPair>,
-	_broadcast: moq_net::origin::Publication,
+	_broadcast: moq_net::origin::Route,
 	_track: track::Producer,
 	/// Every payload written to the open group so far.
 	written: Vec<String>,
@@ -104,11 +104,11 @@ impl Topology {
 		let relay_b = produce_origin(3);
 		let subscriber = produce_origin(4);
 
-		let broadcast = publisher.create_broadcast("live").unwrap();
-		let track = broadcast.create_track("catalog.json", timed()).unwrap();
-		broadcast
-			.announce(origin::Route::default().with_instance(moq_net::Instance::random(), 0))
+		let broadcast = publisher
+			.route("live", moq_net::origin::RouteOptions::hidden())
 			.unwrap();
+		let track = broadcast.broadcast().create_track("catalog.json", timed()).unwrap();
+		broadcast.announce().unwrap();
 		let group = track.append_group().unwrap();
 
 		let p_to_a = link(version, &publisher, &relay_a, None).await;
diff --git a/rs/moq-net/tests/integration/compress.rs b/rs/moq-net/tests/integration/compress.rs
index 140957d3803..d11d343b3c7 100644
--- a/rs/moq-net/tests/integration/compress.rs
+++ b/rs/moq-net/tests/integration/compress.rs
@@ -43,7 +43,7 @@ fn payload(frame: u64) -> Vec<u8> {
 struct Fixture {
 	track: moq_net::track::Producer,
 	subscriber: moq_net::track::Subscriber,
-	_broadcast: moq_net::origin::Publication,
+	_broadcast: moq_net::origin::Route,
 	_hops: Vec<MockPair>,
 	_origins: Vec<moq_net::origin::Producer>,
 }
@@ -51,16 +51,18 @@ struct Fixture {
 /// A track announced by the original publisher, before any relay carries it.
 struct Published {
 	publisher: moq_net::origin::Producer,
-	broadcast: moq_net::origin::Publication,
+	broadcast: moq_net::origin::Route,
 	track: moq_net::track::Producer,
 }
 
 /// Announce one track described by `info`.
 fn publish(info: moq_net::track::Info) -> Published {
 	let publisher = produce_origin(1);
-	let broadcast = publisher.create_broadcast("bcast").unwrap();
-	let track = broadcast.create_track("data", info).unwrap();
-	broadcast.announce(Default::default()).unwrap();
+	let broadcast = publisher
+		.route("bcast", moq_net::origin::RouteOptions::hidden())
+		.unwrap();
+	let track = broadcast.broadcast().create_track("data", info).unwrap();
+	broadcast.announce().unwrap();
 	Published {
 		publisher,
 		broadcast,
@@ -270,8 +272,10 @@ async fn ietf_fetch_keeps_the_stored_form() {
 	for version in ["moq-transport-18", "moq-transport-22"] {
 		kio::clock::timeout(TIMEOUT, async {
 			let publisher = produce_origin(1);
-			let broadcast = publisher.create_broadcast("bcast").unwrap();
-			let track = broadcast.create_track("data", compressed()).unwrap();
+			let broadcast = publisher
+				.route("bcast", moq_net::origin::RouteOptions::hidden())
+				.unwrap();
+			let track = broadcast.broadcast().create_track("data", compressed()).unwrap();
 			let mut group = track.append_group().unwrap();
 			for index in 0..3 {
 				group
@@ -280,7 +284,7 @@ async fn ietf_fetch_keeps_the_stored_form() {
 			}
 			group.finish().unwrap();
 			track.finish().unwrap();
-			broadcast.announce(Default::default()).unwrap();
+			broadcast.announce().unwrap();
 			let origin = produce_origin(2);
 			let mut options = MockConnectOptions::new(version.parse().unwrap());
 			options.server_publish = Some(publisher.consume());
diff --git a/rs/moq-net/tests/integration/control_stats.rs b/rs/moq-net/tests/integration/control_stats.rs
index fcf0ea05e5b..bf635fec0af 100644
--- a/rs/moq-net/tests/integration/control_stats.rs
+++ b/rs/moq-net/tests/integration/control_stats.rs
@@ -29,14 +29,17 @@ async fn control_classes_cross_lite_and_ietf_sessions_without_counting_payload()
 		options.client_publish = Some(publisher.consume());
 		options.server_subscribe = Some(subscriber.clone());
 		let _pair = connect_mock(options).await;
-		let broadcast = publisher.create_broadcast("room").unwrap();
+		let broadcast = publisher
+			.route("room", moq_net::origin::RouteOptions::hidden())
+			.unwrap();
 		let track = broadcast
+			.broadcast()
 			.create_track(
 				"video",
 				moq_net::track::Info::default().with_timescale(Timescale::MILLI),
 			)
 			.unwrap();
-		broadcast.announce(Default::default()).unwrap();
+		broadcast.announce().unwrap();
 		let remote = subscriber
 			.consume()
 			.follow("room", None)
diff --git a/rs/moq-net/tests/integration/datagram.rs b/rs/moq-net/tests/integration/datagram.rs
index f9a6fe309c7..b13ca495a41 100644
--- a/rs/moq-net/tests/integration/datagram.rs
+++ b/rs/moq-net/tests/integration/datagram.rs
@@ -41,7 +41,7 @@ fn timed() -> datagram::Info {
 struct Chain {
 	nodes: Vec<origin::Producer>,
 	pairs: Vec<MockPair>,
-	publication: origin::Publication,
+	publication: origin::Route,
 }
 
 impl Chain {
@@ -57,8 +57,8 @@ impl Chain {
 			let version = version.parse::<Version>().unwrap();
 			pairs.push(peer_with_latency(version, &pair[0], &pair[1], latency).await);
 		}
-		let publication = nodes[0].create_broadcast("room").unwrap();
-		publication.announce(Default::default()).unwrap();
+		let publication = nodes[0].route("room", moq_net::origin::RouteOptions::hidden()).unwrap();
+		publication.announce().unwrap();
 		Self {
 			nodes,
 			pairs,
@@ -110,7 +110,7 @@ async fn a_datagram_track_crosses_a_session() {
 	for timescale in [Some(Timescale::MILLI), None] {
 		let chain = Chain::new(&["moq-lite-07-wip"]).await;
 		let info = datagram::Info::default().with_timescale(timescale).with_priority(3);
-		let mut producer = chain.publication.create_datagrams(TRACK, info).unwrap();
+		let mut producer = chain.publication.broadcast().create_datagrams(TRACK, info).unwrap();
 		let timestamp = |ms| timescale.map(|_| millis(ms));
 		// Nobody reads it yet, so nobody ever will.
 		assert_eq!(producer.append(timestamp(1), &b"early"[..]).unwrap(), 0);
@@ -132,7 +132,7 @@ async fn a_datagram_track_crosses_a_session() {
 #[kio::test]
 async fn an_aborted_datagram_track_ends_with_its_error() {
 	let chain = Chain::new(&["moq-lite-07-wip"]).await;
-	let producer = chain.publication.create_datagrams(TRACK, timed()).unwrap();
+	let producer = chain.publication.broadcast().create_datagrams(TRACK, timed()).unwrap();
 	let mut consumer = chain.consume(&producer, 0).await;
 	producer.abort(Error::App(7));
 	let err = recv(&mut consumer).await.unwrap_err();
@@ -144,7 +144,7 @@ async fn an_aborted_datagram_track_ends_with_its_error() {
 #[kio::test]
 async fn a_consumer_priority_reaches_the_publisher() {
 	let chain = Chain::with_latency(&["moq-lite-07-wip"], Duration::from_millis(10)).await;
-	let producer = chain.publication.create_datagrams(TRACK, timed()).unwrap();
+	let producer = chain.publication.broadcast().create_datagrams(TRACK, timed()).unwrap();
 	let mut consumer = chain.remote().await.datagrams(TRACK).unwrap();
 	kio::clock::timeout(TIMEOUT, datagram_priority(&producer, Some(0)))
 		.await
@@ -161,7 +161,7 @@ async fn a_consumer_priority_reaches_the_publisher() {
 #[kio::test]
 async fn the_last_consumer_leaving_ends_the_subscription() {
 	let chain = Chain::new(&["moq-lite-07-wip"]).await;
-	let producer = chain.publication.create_datagrams(TRACK, timed()).unwrap();
+	let producer = chain.publication.broadcast().create_datagrams(TRACK, timed()).unwrap();
 	let consumer = chain.consume(&producer, 0).await;
 	drop(consumer);
 	kio::clock::timeout(TIMEOUT, datagram_priority(&producer, None))
@@ -173,7 +173,7 @@ async fn the_last_consumer_leaving_ends_the_subscription() {
 #[kio::test]
 async fn a_relay_carries_a_datagram_track() {
 	let chain = Chain::new(&["moq-lite-07-wip", "moq-lite-07-wip"]).await;
-	let mut producer = chain.publication.create_datagrams(TRACK, timed()).unwrap();
+	let mut producer = chain.publication.broadcast().create_datagrams(TRACK, timed()).unwrap();
 	let mut consumer = chain.consume(&producer, 2).await;
 
 	assert_eq!(producer.append(millis(5), &b"relayed"[..]).unwrap(), 0);
@@ -198,9 +198,10 @@ async fn a_stream_track_and_a_datagram_track_share_a_name_independently() {
 	let chain = Chain::new(&["moq-lite-07-wip"]).await;
 	let mut track = chain
 		.publication
+		.broadcast()
 		.create_track(TRACK, moq_net::track::Info::default().with_timescale(Timescale::MILLI))
 		.unwrap();
-	let mut datagrams = chain.publication.create_datagrams(TRACK, timed()).unwrap();
+	let mut datagrams = chain.publication.broadcast().create_datagrams(TRACK, timed()).unwrap();
 	let remote = chain.remote().await;
 	let mut subscriber = kio::clock::timeout(TIMEOUT, remote.track(TRACK).unwrap().subscribe(None))
 		.await
@@ -241,7 +242,7 @@ async fn a_stream_track_and_a_datagram_track_share_a_name_independently() {
 #[kio::test]
 async fn a_lite07_stream_subscription_never_takes_datagrams() {
 	let chain = Chain::new(&["moq-lite-07-wip"]).await;
-	let _datagrams = chain.publication.create_datagrams(TRACK, timed()).unwrap();
+	let _datagrams = chain.publication.broadcast().create_datagrams(TRACK, timed()).unwrap();
 	let remote = chain.remote().await;
 	let result = kio::clock::timeout(TIMEOUT, remote.track(TRACK).unwrap().subscribe(None))
 		.await
@@ -262,7 +263,7 @@ async fn a_lite07_stream_subscription_never_takes_datagrams() {
 async fn lite05_and_lite06_map_a_datagram_track_onto_a_subscription() {
 	for version in ["moq-lite-05", "moq-lite-06"] {
 		let chain = Chain::new(&[version]).await;
-		let mut producer = chain.publication.create_datagrams(TRACK, timed()).unwrap();
+		let mut producer = chain.publication.broadcast().create_datagrams(TRACK, timed()).unwrap();
 		producer.append(millis(1), &b"early"[..]).unwrap();
 		// A priority other than the default, which the TRACK lookup ahead of the SUBSCRIBE
 		// holds while it is answered.
@@ -299,12 +300,13 @@ async fn lite05_and_lite06_carry_both_kinds_of_a_name() {
 		let chain = Chain::new(hops).await;
 		let mut track = chain
 			.publication
+			.broadcast()
 			.create_track(TRACK, moq_net::track::Info::default().with_timescale(Timescale::MILLI))
 			.unwrap();
 		// Another scale than the stream track's, whose TRACK_INFO declares the one both
 		// kinds are stamped in on the wire.
 		let info = datagram::Info::default().with_timescale(Timescale::MICRO);
-		let mut producer = chain.publication.create_datagrams(TRACK, info).unwrap();
+		let mut producer = chain.publication.broadcast().create_datagrams(TRACK, info).unwrap();
 		let remote = chain.remote().await;
 		let mut subscriber = kio::clock::timeout(TIMEOUT, remote.track(TRACK).unwrap().subscribe(None))
 			.await
@@ -353,9 +355,10 @@ async fn lite06_shared_datagrams_end_with_their_subscription() {
 	let chain = Chain::new(&["moq-lite-06"]).await;
 	let track = chain
 		.publication
+		.broadcast()
 		.create_track(TRACK, moq_net::track::Info::default().with_timescale(Timescale::MILLI))
 		.unwrap();
-	let producer = chain.publication.create_datagrams(TRACK, timed()).unwrap();
+	let producer = chain.publication.broadcast().create_datagrams(TRACK, timed()).unwrap();
 	let remote = chain.remote().await;
 	let _subscriber = kio::clock::timeout(TIMEOUT, remote.track(TRACK).unwrap().subscribe(None))
 		.await
@@ -382,7 +385,7 @@ async fn lite06_shared_datagrams_end_with_their_subscription() {
 async fn lite05_and_lite06_finish_a_datagram_track_as_a_stream_subscriber_expects() {
 	for version in ["moq-lite-05", "moq-lite-06"] {
 		let chain = Chain::new(&[version]).await;
-		let mut producer = chain.publication.create_datagrams(TRACK, timed()).unwrap();
+		let mut producer = chain.publication.broadcast().create_datagrams(TRACK, timed()).unwrap();
 		let remote = chain.remote().await;
 		let mut subscriber = kio::clock::timeout(TIMEOUT, remote.track(TRACK).unwrap().subscribe(None))
 			.await
@@ -415,7 +418,7 @@ async fn lite05_and_lite06_answer_a_datagram_request_beside_a_silent_stream_hand
 	for version in ["moq-lite-05", "moq-lite-06"] {
 		let chain = Chain::new(&[version]).await;
 		// Never polled: a stream lookup of the name waits on it for good.
-		let requests = chain.publication.requests();
+		let requests = chain.publication.broadcast().requests();
 		let mut handler = requests.datagrams();
 		let mut consumer = chain.remote().await.datagrams(TRACK).unwrap();
 		let request = kio::clock::timeout(TIMEOUT, handler.requested())
@@ -444,7 +447,7 @@ async fn lite05_and_lite06_answer_a_datagram_request_beside_a_silent_stream_hand
 #[kio::test]
 async fn lite06_asks_a_late_datagram_handler_once_the_stream_track_is_not_found() {
 	let chain = Chain::new(&["moq-lite-06"]).await;
-	let mut requests = chain.publication.requests();
+	let mut requests = chain.publication.broadcast().requests();
 	let mut consumer = chain.remote().await.datagrams(TRACK).unwrap();
 	let stream = kio::clock::timeout(TIMEOUT, requests.requested_track())
 		.await
@@ -474,7 +477,7 @@ async fn lite06_asks_a_late_datagram_handler_once_the_stream_track_is_not_found(
 #[kio::test]
 async fn an_old_subscriber_reaches_a_datagram_track_through_a_lite07_relay() {
 	let chain = Chain::new(&["moq-lite-07-wip", "moq-lite-06"]).await;
-	let mut producer = chain.publication.create_datagrams(TRACK, timed()).unwrap();
+	let mut producer = chain.publication.broadcast().create_datagrams(TRACK, timed()).unwrap();
 	let mut consumer = chain.consume(&producer, 2).await;
 	producer.append(millis(4), &b"relayed"[..]).unwrap();
 	let datagram = recv(&mut consumer).await.unwrap().expect("a datagram");
@@ -494,6 +497,7 @@ async fn an_old_subscriber_keeps_a_stream_track_across_mixed_hops() {
 		let chain = Chain::new(hops).await;
 		let mut track = chain
 			.publication
+			.broadcast()
 			.create_track(TRACK, moq_net::track::Info::default().with_timescale(Timescale::MILLI))
 			.unwrap();
 		let remote = chain.remote().await;
@@ -525,7 +529,7 @@ async fn a_datagram_track_needs_datagrams() {
 			// The second node subscribes through the session it accepted.
 			chain.pairs[0].server_transport.disable_datagrams();
 		}
-		let _producer = chain.publication.create_datagrams(TRACK, timed()).unwrap();
+		let _producer = chain.publication.broadcast().create_datagrams(TRACK, timed()).unwrap();
 		let mut consumer = chain.remote().await.datagrams(TRACK).unwrap();
 		let err = recv(&mut consumer).await.unwrap_err();
 		assert!(matches!(err, Error::Unsupported), "{version}: {err:?}");
@@ -539,9 +543,10 @@ async fn moq_transport_has_no_datagram_tracks() {
 	let chain = Chain::new(&["moq-transport-22"]).await;
 	let mut track = chain
 		.publication
+		.broadcast()
 		.create_track(TRACK, moq_net::track::Info::default().with_timescale(Timescale::MILLI))
 		.unwrap();
-	let _datagrams = chain.publication.create_datagrams(TRACK, timed()).unwrap();
+	let _datagrams = chain.publication.broadcast().create_datagrams(TRACK, timed()).unwrap();
 	let remote = chain.remote().await;
 	assert!(matches!(remote.datagrams(TRACK), Err(Error::NotFound)));
 
diff --git a/rs/moq-net/tests/integration/dial_split_horizon.rs b/rs/moq-net/tests/integration/dial_split_horizon.rs
index 6b3ebf74f1d..5e5383ba3a6 100644
--- a/rs/moq-net/tests/integration/dial_split_horizon.rs
+++ b/rs/moq-net/tests/integration/dial_split_horizon.rs
@@ -147,9 +147,11 @@ async fn split_horizon(version: &str, [publisher_hop, subscriber_hop]: [Hop; 2])
 	let to_publisher = dial(version, &dialer, &publisher).await;
 	let to_subscriber = dial(version, &dialer, &subscriber).await;
 
-	let broadcast = publisher.create_broadcast("room").unwrap();
-	let track = broadcast.create_track("video", None).unwrap();
-	broadcast.announce(origin::Route::default()).unwrap();
+	let broadcast = publisher
+		.route("room", moq_net::origin::RouteOptions::hidden())
+		.unwrap();
+	let track = broadcast.broadcast().create_track("video", None).unwrap();
+	broadcast.announce().unwrap();
 
 	let publisher_hop = learned_hop(&dialer, "room").await;
 	assert_ne!(
diff --git a/rs/moq-net/tests/integration/drained_claim.rs b/rs/moq-net/tests/integration/drained_claim.rs
index a3c83e8eef2..f87c986ebef 100644
--- a/rs/moq-net/tests/integration/drained_claim.rs
+++ b/rs/moq-net/tests/integration/drained_claim.rs
@@ -46,26 +46,31 @@ async fn settle() {
 /// A worker claiming `pool`, answering each request with an output whose `video`
 /// track carries the worker's name.
 struct Worker {
-	_claim: Rc<origin::Requests>,
-	/// Each output with its track, which would end once its publication drops.
-	outputs: Rc<RefCell<Vec<(origin::Publication, track::Producer)>>>,
+	_claim: Rc<origin::Route>,
+	/// Each output with its track, which would end once its route drops.
+	outputs: Rc<RefCell<Vec<(origin::Route, track::Producer)>>>,
 	origin: origin::Producer,
 }
 
 impl Worker {
 	fn new(hop: u64, name: &'static str) -> Self {
 		let origin = produce_origin(hop);
-		let claim = Rc::new(origin.requests("pool").unwrap());
+		let claim = Rc::new(
+			origin
+				.route_prefix("pool", moq_net::origin::RouteOptions::default())
+				.unwrap(),
+		);
 		let outputs = Rc::new(RefCell::new(Vec::new()));
 		let (handler, served) = (claim.clone(), outputs.clone());
 		drop(kio::clock::sim::spawn(async move {
-			while let Ok(request) = handler.requested_broadcast().await {
-				let prepared = request.prepare().unwrap();
+			while let Some(request) = handler.requested().await {
+				let prepared = request.route(moq_net::origin::RouteOptions::hidden()).unwrap();
 				let track = prepared.broadcast().create_track("video", timed()).unwrap();
 				let mut group = track.append_group().unwrap();
 				group.write_frame(Timestamp::ZERO, name.as_bytes().to_vec()).unwrap();
 				group.finish().unwrap();
-				served.borrow_mut().push((prepared.publish().unwrap(), track));
+				prepared.announce().unwrap();
+				served.borrow_mut().push((prepared, track));
 			}
 		}));
 		Self {
@@ -110,7 +115,10 @@ async fn drained_claim(version: &str) {
 	assert_eq!(watch(version, &relay).await, "a", "{version}");
 
 	// A closes its output and drains its session, so B wins the path from here on.
-	a.outputs.borrow().iter().for_each(|(output, _)| output.close());
+	a.outputs
+		.borrow()
+		.iter()
+		.for_each(|(output, _)| output.broadcast().close());
 	a_link.server.drain().send(Goaway::new()).unwrap();
 	// Past the linger, which is as long as the cache window, nothing reads the relay's
 	// front for the path.
diff --git a/rs/moq-net/tests/integration/empty_group.rs b/rs/moq-net/tests/integration/empty_group.rs
index e8939361e74..264bf9db448 100644
--- a/rs/moq-net/tests/integration/empty_group.rs
+++ b/rs/moq-net/tests/integration/empty_group.rs
@@ -31,9 +31,11 @@ async fn an_empty_group_arrives_empty() {
 		let subscriber = produce_origin(2);
 		let _pair = peer(version.parse::<Version>().unwrap(), &publisher, &subscriber).await;
 
-		let broadcast = publisher.create_broadcast("room").unwrap();
-		let track = broadcast.create_track("data", timed()).unwrap();
-		broadcast.announce(Default::default()).unwrap();
+		let broadcast = publisher
+			.route("room", moq_net::origin::RouteOptions::hidden())
+			.unwrap();
+		let track = broadcast.broadcast().create_track("data", timed()).unwrap();
+		broadcast.announce().unwrap();
 
 		let consumer = subscriber.consume();
 		let remote = kio::clock::timeout(TIMEOUT, consumer.follow("room", None).unwrap().available())
diff --git a/rs/moq-net/tests/integration/errored_end.rs b/rs/moq-net/tests/integration/errored_end.rs
index b8e01ef86bb..f7adc0ae44b 100644
--- a/rs/moq-net/tests/integration/errored_end.rs
+++ b/rs/moq-net/tests/integration/errored_end.rs
@@ -78,12 +78,14 @@ async fn an_errored_end_keeps_its_history_across_a_hop() {
 		let label = format!("{name} subscribe_first={subscribe_first}");
 		let version: Version = name.parse().unwrap();
 		let publisher = produce_origin(1);
-		let broadcast = publisher.create_broadcast("bcast").unwrap();
+		let broadcast = publisher
+			.route("bcast", moq_net::origin::RouteOptions::hidden())
+			.unwrap();
 		let info = moq_net::track::Info::default()
 			.with_timescale(moq_net::Timescale::MILLI)
 			.with_max_age(None);
-		let mut track = broadcast.create_track("video", info).unwrap();
-		broadcast.announce(Default::default()).unwrap();
+		let mut track = broadcast.broadcast().create_track("video", info).unwrap();
+		broadcast.announce().unwrap();
 		for _ in 0..GROUPS {
 			let mut group = track.append_group().unwrap();
 			for frame in FRAMES {
diff --git a/rs/moq-net/tests/integration/extensions.rs b/rs/moq-net/tests/integration/extensions.rs
index ecadc6b76a2..24d693f5d2f 100644
--- a/rs/moq-net/tests/integration/extensions.rs
+++ b/rs/moq-net/tests/integration/extensions.rs
@@ -86,8 +86,10 @@ async fn a_side_that_declines_solicit_takes_unsolicited_announces() {
 			}
 			let pair = connect_mock(options).await;
 
-			let broadcast = publisher.create_broadcast("room/cam").unwrap();
-			broadcast.announce(Default::default()).unwrap();
+			let broadcast = publisher
+				.route("room/cam", moq_net::origin::RouteOptions::hidden())
+				.unwrap();
+			broadcast.announce().unwrap();
 			kio::clock::sleep(SETTLE).await;
 
 			assert!(announced(&subscriber, "room/cam"), "{context}: never announced");
diff --git a/rs/moq-net/tests/integration/fastest_reader.rs b/rs/moq-net/tests/integration/fastest_reader.rs
index ee34fabce4c..297638f8af6 100644
--- a/rs/moq-net/tests/integration/fastest_reader.rs
+++ b/rs/moq-net/tests/integration/fastest_reader.rs
@@ -33,7 +33,7 @@ fn origin(hop: u64) -> origin::Producer {
 struct Relay {
 	track: track::Producer,
 	subscriber: track::Subscriber,
-	_broadcast: origin::Publication,
+	_broadcast: origin::Route,
 	pair: MockPair,
 	_origins: [origin::Producer; 2],
 }
@@ -43,11 +43,14 @@ async fn relay(version: &str) -> Relay {
 	let relay = origin(2);
 	let pair = peer(version.parse::<Version>().unwrap(), &publisher, &relay).await;
 
-	let broadcast = publisher.create_broadcast("live").unwrap();
+	let broadcast = publisher
+		.route("live", moq_net::origin::RouteOptions::hidden())
+		.unwrap();
 	let track = broadcast
+		.broadcast()
 		.create_track("data", track::Info::default().with_timescale(moq_net::Timescale::MILLI))
 		.unwrap();
-	broadcast.announce(Default::default()).unwrap();
+	broadcast.announce().unwrap();
 
 	let remote = kio::clock::timeout(TIMEOUT, relay.consume().follow("live", None).unwrap().available())
 		.await
@@ -295,11 +298,14 @@ async fn two_relays_bound_their_cache_and_resume_without_a_hole() {
 			pair.server_transport
 				.set_receive_window(Some(ReceiveWindow::new(4 * MB as u64, MB as u64)));
 		}
-		let broadcast = publisher.create_broadcast("chain").unwrap();
+		let broadcast = publisher
+			.route("chain", moq_net::origin::RouteOptions::hidden())
+			.unwrap();
 		let track = broadcast
+			.broadcast()
 			.create_track("data", track::Info::default().with_timescale(moq_net::Timescale::MILLI))
 			.unwrap();
-		broadcast.announce(Default::default()).unwrap();
+		broadcast.announce().unwrap();
 		let remote = second
 			.consume()
 			.follow("chain", None)
diff --git a/rs/moq-net/tests/integration/fetch_cancel.rs b/rs/moq-net/tests/integration/fetch_cancel.rs
index 24e3d2cfb9b..3f444eb3f7f 100644
--- a/rs/moq-net/tests/integration/fetch_cancel.rs
+++ b/rs/moq-net/tests/integration/fetch_cancel.rs
@@ -47,9 +47,9 @@ async fn abandoned_fetch_reaches_the_publisher(version: &str, relays: u64, stage
 		_pairs.push(peer(version, &pair[0], &pair[1]).await);
 	}
 
-	let broadcast = nodes[0].create_broadcast("room").unwrap();
-	let mut dynamic = broadcast.requests();
-	broadcast.announce(Default::default()).unwrap();
+	let broadcast = nodes[0].route("room", moq_net::origin::RouteOptions::hidden()).unwrap();
+	let mut dynamic = broadcast.broadcast().requests();
+	broadcast.announce().unwrap();
 	kio::clock::sleep(Duration::from_secs(1)).await;
 
 	let consumer = nodes[relays as usize].consume().request("room", None).await.unwrap();
@@ -172,9 +172,11 @@ async fn a_refetch_within_the_linger_stays_on_the_relay(version: &str) {
 	let relay = produce_origin(2);
 	let _pair = peer(version, &publisher, &relay).await;
 
-	let broadcast = publisher.create_broadcast("room").unwrap();
-	let mut dynamic = broadcast.requests();
-	broadcast.announce(Default::default()).unwrap();
+	let broadcast = publisher
+		.route("room", moq_net::origin::RouteOptions::hidden())
+		.unwrap();
+	let mut dynamic = broadcast.broadcast().requests();
+	broadcast.announce().unwrap();
 	kio::clock::sleep(Duration::from_secs(1)).await;
 
 	let consumer = relay.consume().request("room", None).await.unwrap();
diff --git a/rs/moq-net/tests/integration/fetch_fanout.rs b/rs/moq-net/tests/integration/fetch_fanout.rs
index 0288444bf41..0caa3224edc 100644
--- a/rs/moq-net/tests/integration/fetch_fanout.rs
+++ b/rs/moq-net/tests/integration/fetch_fanout.rs
@@ -19,8 +19,9 @@ async fn sequential_viewers_share_the_relays_fetched_groups() {
 	for version in ["moq-lite-05", "moq-lite-06", "moq-lite-07-wip"] {
 		let version: Version = version.parse().unwrap();
 		let publisher = origin(1);
-		let broadcast = publisher.publish("room", Default::default()).unwrap();
+		let broadcast = publisher.route("room", origin::RouteOptions::default()).unwrap();
 		let track = broadcast
+			.broadcast()
 			.create_track(
 				"video",
 				track::Info::default().with_timescale(moq_net::Timescale::MILLI),
diff --git a/rs/moq-net/tests/integration/fetch_from_feed.rs b/rs/moq-net/tests/integration/fetch_from_feed.rs
index e912b320558..d0ceba8d40f 100644
--- a/rs/moq-net/tests/integration/fetch_from_feed.rs
+++ b/rs/moq-net/tests/integration/fetch_from_feed.rs
@@ -24,7 +24,7 @@ fn produce_origin(hop: u64) -> moq_net::origin::Producer {
 struct Relay {
 	track: moq_net::track::Producer,
 	remote: moq_net::broadcast::Consumer,
-	_broadcast: moq_net::origin::Publication,
+	_broadcast: moq_net::origin::Route,
 	_pair: support::harness::MockPair,
 	_origins: (moq_net::origin::Producer, moq_net::origin::Producer),
 }
@@ -32,11 +32,14 @@ struct Relay {
 /// A publisher on `version` with group 0 of an untimed track written, and the relay's view of it.
 async fn relay(version: &str) -> Relay {
 	let publisher = produce_origin(1);
-	let broadcast = publisher.create_broadcast("bcast").unwrap();
+	let broadcast = publisher
+		.route("bcast", moq_net::origin::RouteOptions::hidden())
+		.unwrap();
 	let mut track = broadcast
+		.broadcast()
 		.create_track("video", moq_net::track::Info::default().with_timescale(None))
 		.unwrap();
-	broadcast.announce(Default::default()).unwrap();
+	broadcast.announce().unwrap();
 	track.write_frame(None, &b"0"[..]).unwrap();
 
 	let client = produce_origin(2);
diff --git a/rs/moq-net/tests/integration/fetch_only.rs b/rs/moq-net/tests/integration/fetch_only.rs
index 28a9c6589a2..c8974aa6ab6 100644
--- a/rs/moq-net/tests/integration/fetch_only.rs
+++ b/rs/moq-net/tests/integration/fetch_only.rs
@@ -41,10 +41,10 @@ async fn resolve(origin: &moq_net::origin::Producer) -> moq_net::broadcast::Cons
 }
 
 /// Publish a finished track of three groups, and flag any subscription it ever gets.
-fn publish_finished(origin: &moq_net::origin::Producer) -> (moq_net::origin::Publication, Arc<AtomicBool>) {
-	let broadcast = origin.create_broadcast("bcast").unwrap();
-	let mut track = broadcast.create_track("video", timed()).unwrap();
-	broadcast.announce(Default::default()).unwrap();
+fn publish_finished(origin: &moq_net::origin::Producer) -> (moq_net::origin::Route, Arc<AtomicBool>) {
+	let broadcast = origin.route("bcast", moq_net::origin::RouteOptions::hidden()).unwrap();
+	let mut track = broadcast.broadcast().create_track("video", timed()).unwrap();
+	broadcast.announce().unwrap();
 	for sequence in 0..3u64 {
 		let mut group = track.append_group().unwrap();
 		for frame in 0..2 {
@@ -160,9 +160,11 @@ async fn a_subscribe_after_track_status_keeps_timestamps() {
 	for version in ["moq-transport-18", "moq-transport-22"] {
 		kio::clock::timeout(TIMEOUT, async {
 			let publisher = produce_origin(1);
-			let broadcast = publisher.create_broadcast("bcast").unwrap();
-			let track = broadcast.create_track("video", timed()).unwrap();
-			broadcast.announce(Default::default()).unwrap();
+			let broadcast = publisher
+				.route("bcast", moq_net::origin::RouteOptions::hidden())
+				.unwrap();
+			let track = broadcast.broadcast().create_track("video", timed()).unwrap();
+			broadcast.announce().unwrap();
 
 			let client = produce_origin(2);
 			let mut options = MockConnectOptions::new(version.parse::<Version>().unwrap());
@@ -338,10 +340,10 @@ fn publish_live(
 	origin: &moq_net::origin::Producer,
 	info: moq_net::track::Info,
 	groups: u64,
-) -> (moq_net::origin::Publication, moq_net::track::Producer) {
-	let broadcast = origin.create_broadcast("bcast").unwrap();
-	let track = broadcast.create_track("video", info).unwrap();
-	broadcast.announce(Default::default()).unwrap();
+) -> (moq_net::origin::Route, moq_net::track::Producer) {
+	let broadcast = origin.route("bcast", moq_net::origin::RouteOptions::hidden()).unwrap();
+	let track = broadcast.broadcast().create_track("video", info).unwrap();
+	broadcast.announce().unwrap();
 	for sequence in 0..groups {
 		write_group(&track, sequence);
 	}
diff --git a/rs/moq-net/tests/integration/fetch_pipeline.rs b/rs/moq-net/tests/integration/fetch_pipeline.rs
index cc792354fb7..75c681a6961 100644
--- a/rs/moq-net/tests/integration/fetch_pipeline.rs
+++ b/rs/moq-net/tests/integration/fetch_pipeline.rs
@@ -36,7 +36,7 @@ async fn link(version: Version, from: &moq_net::origin::Producer, to: &moq_net::
 /// What keeps the publisher and the hops to the reader up.
 struct Held {
 	_publisher: moq_net::origin::Producer,
-	_broadcast: moq_net::origin::Publication,
+	_broadcast: moq_net::origin::Route,
 	_links: Vec<MockPair>,
 }
 
@@ -54,9 +54,11 @@ async fn fetch_ahead(
 ) {
 	let version: Version = version.parse().unwrap();
 	let publisher = produce_origin(1);
-	let broadcast = publisher.create_broadcast("bcast").unwrap();
-	let mut dynamic = broadcast.requests();
-	broadcast.announce(Default::default()).unwrap();
+	let broadcast = publisher
+		.route("bcast", moq_net::origin::RouteOptions::hidden())
+		.unwrap();
+	let mut dynamic = broadcast.broadcast().requests();
+	broadcast.announce().unwrap();
 
 	let mut links = Vec::new();
 	let mut upstream = publisher.clone();
@@ -136,9 +138,11 @@ async fn a_refused_info_fails_the_fetch_sent_with_it() {
 async fn first_fetch(version: &str, relays: u64, rtt: Duration) -> Duration {
 	let version: Version = version.parse().unwrap();
 	let publisher = produce_origin(1);
-	let broadcast = publisher.create_broadcast("bcast").unwrap();
-	let track = broadcast.create_track("video", timed()).unwrap();
-	broadcast.announce(Default::default()).unwrap();
+	let broadcast = publisher
+		.route("bcast", moq_net::origin::RouteOptions::hidden())
+		.unwrap();
+	let track = broadcast.broadcast().create_track("video", timed()).unwrap();
+	broadcast.announce().unwrap();
 	let mut group = track.append_group().unwrap();
 	group.write_frame(Timestamp::ZERO, b"frame".as_ref()).unwrap();
 	group.finish().unwrap();
diff --git a/rs/moq-net/tests/integration/finished_broadcast_mock.rs b/rs/moq-net/tests/integration/finished_broadcast_mock.rs
index 5695bfba586..931e2fa6c08 100644
--- a/rs/moq-net/tests/integration/finished_broadcast_mock.rs
+++ b/rs/moq-net/tests/integration/finished_broadcast_mock.rs
@@ -39,9 +39,11 @@ fn produce_origin(hop: u64) -> moq_net::origin::Producer {
 /// the subscriber read: the frame payloads and the error it ended with, if any.
 async fn round(finish_broadcast: bool) -> (Vec<Vec<u8>>, Option<moq_net::Error>) {
 	let publisher = produce_origin(1);
-	let broadcast = publisher.create_broadcast("bcast").unwrap();
-	let track = broadcast.create_track("video", timed()).unwrap();
-	broadcast.announce(Default::default()).unwrap();
+	let broadcast = publisher
+		.route("bcast", moq_net::origin::RouteOptions::hidden())
+		.unwrap();
+	let track = broadcast.broadcast().create_track("video", timed()).unwrap();
+	broadcast.announce().unwrap();
 
 	let subscriber = produce_origin(2);
 	let mut options = MockConnectOptions::new("moq-lite-05".parse::<Version>().unwrap());
@@ -93,7 +95,7 @@ async fn round(finish_broadcast: bool) -> (Vec<Vec<u8>>, Option<moq_net::Error>)
 	track.finish().unwrap();
 	drop(track);
 	if finish_broadcast {
-		broadcast.close();
+		broadcast.broadcast().close();
 	}
 
 	// The session and both origins stay up until the reader is done.
diff --git a/rs/moq-net/tests/integration/finite_relay.rs b/rs/moq-net/tests/integration/finite_relay.rs
index c3a4ddb0c29..25ccfd72434 100644
--- a/rs/moq-net/tests/integration/finite_relay.rs
+++ b/rs/moq-net/tests/integration/finite_relay.rs
@@ -63,9 +63,11 @@ enum Arrival {
 async fn round(name: &str, arrival: Arrival) -> (Vec<u64>, Result<(), moq_net::Error>) {
 	let version: Version = name.parse().unwrap();
 	let publisher = produce_origin(1);
-	let broadcast = publisher.create_broadcast("bcast").unwrap();
-	let mut track = broadcast.create_track("tail", timed()).unwrap();
-	broadcast.announce(Default::default()).unwrap();
+	let broadcast = publisher
+		.route("bcast", moq_net::origin::RouteOptions::hidden())
+		.unwrap();
+	let mut track = broadcast.broadcast().create_track("tail", timed()).unwrap();
+	broadcast.announce().unwrap();
 
 	let relay = produce_origin(2);
 	let mut options = MockConnectOptions::new(version);
diff --git a/rs/moq-net/tests/integration/flights.rs b/rs/moq-net/tests/integration/flights.rs
index b51236a7ce0..846be1ee3a8 100644
--- a/rs/moq-net/tests/integration/flights.rs
+++ b/rs/moq-net/tests/integration/flights.rs
@@ -153,9 +153,9 @@ async fn moq_transport_relays_a_cold_finished_group() {
 	let upper = origin(2, &pools[1]);
 	let lower = origin(3, &pools[2]);
 
-	let broadcast = publisher.create_broadcast("live").unwrap();
-	let track = broadcast.create_track("data", track::Info::default()).unwrap();
-	broadcast.announce(Default::default()).unwrap();
+	let route = publisher.route("live", origin::RouteOptions::hidden()).unwrap();
+	let track = route.broadcast().create_track("data", track::Info::default()).unwrap();
+	route.announce().unwrap();
 	let (written, ended) = (Arc::new(AtomicU64::new(0)), Arc::new(AtomicU64::new(0)));
 	serve(track.requests(), written, ended, true);
 	let mut group = track.append_group().unwrap();
@@ -210,9 +210,9 @@ async fn chain(version: &str, replay: Replay) {
 	let upper = origin(2, &pools[1]);
 	let lower = origin(3, &pools[2]);
 
-	let broadcast = publisher.create_broadcast("live").unwrap();
-	let track = broadcast.create_track("data", track::Info::default()).unwrap();
-	broadcast.announce(Default::default()).unwrap();
+	let route = publisher.route("live", origin::RouteOptions::hidden()).unwrap();
+	let track = route.broadcast().create_track("data", track::Info::default()).unwrap();
+	route.announce().unwrap();
 	let (written, ended) = (Arc::new(AtomicU64::new(0)), Arc::new(AtomicU64::new(0)));
 	serve(
 		track.requests(),
diff --git a/rs/moq-net/tests/integration/goaway.rs b/rs/moq-net/tests/integration/goaway.rs
index a8484e96229..a56fa1487bc 100644
--- a/rs/moq-net/tests/integration/goaway.rs
+++ b/rs/moq-net/tests/integration/goaway.rs
@@ -369,11 +369,19 @@ async fn goaway_keeps_new_subscribes(version: Version) {
 	kio::clock::timeout(TEST_TIMEOUT, async {
 		// Server publishes a broadcast with one live track.
 		let pub_origin = produce_origin(Hop::random());
-		let broadcast = pub_origin.create_broadcast("test").expect("create broadcast");
-		broadcast.announce(moq_net::origin::Route::default()).expect("announce");
-		let track = broadcast.create_track("video", timed()).expect("create track");
+		let broadcast = pub_origin
+			.route("test", moq_net::origin::RouteOptions::hidden())
+			.expect("create broadcast");
+		broadcast.announce().expect("announce");
+		let track = broadcast
+			.broadcast()
+			.create_track("video", timed())
+			.expect("create track");
 		// A second track with content ready for the subscribe opened after the GOAWAY.
-		let audio = broadcast.create_track("audio", timed()).expect("create track");
+		let audio = broadcast
+			.broadcast()
+			.create_track("audio", timed())
+			.expect("create track");
 		let mut audio_group = audio.append_group().expect("append group");
 		audio_group
 			.write_frame(moq_net::Timestamp::ZERO, b"audio".as_ref())
@@ -484,8 +492,10 @@ async fn goaway_keeps_new_subscribes_moq_transport_22() {
 async fn goaway_drains_routes(version: Version) {
 	kio::clock::timeout(TEST_TIMEOUT, async {
 		let pub_origin = produce_origin(Hop::random());
-		let broadcast = pub_origin.create_broadcast("test").expect("create broadcast");
-		broadcast.announce(moq_net::origin::Route::default()).expect("announce");
+		let broadcast = pub_origin
+			.route("test", moq_net::origin::RouteOptions::hidden())
+			.expect("create broadcast");
+		broadcast.announce().expect("announce");
 
 		let sub_origin = produce_origin(Hop::random());
 
@@ -497,7 +507,7 @@ async fn goaway_drains_routes(version: Version) {
 		let sub = sub_origin.consume();
 		let route = crate::support::announced(&sub, "test").await;
 		assert_ne!(
-			route.cost,
+			route.cost(),
 			moq_net::origin::Cost::DRAIN,
 			"a healthy route must not start out draining"
 		);
@@ -515,7 +525,7 @@ async fn goaway_drains_routes(version: Version) {
 			else {
 				continue;
 			};
-			if update.prefix.as_str() == "test" && update.route.cost == moq_net::origin::Cost::DRAIN {
+			if update.prefix.as_str() == "test" && update.route.cost() == moq_net::origin::Cost::DRAIN {
 				break;
 			}
 		}
diff --git a/rs/moq-net/tests/integration/group_order.rs b/rs/moq-net/tests/integration/group_order.rs
index dc372896fd3..370a0a58ba4 100644
--- a/rs/moq-net/tests/integration/group_order.rs
+++ b/rs/moq-net/tests/integration/group_order.rs
@@ -114,14 +114,17 @@ fn carries_order(version: &str) -> bool {
 async fn round(version: &str, relay: bool, order: Order) -> Vec<u64> {
 	let version: Version = version.parse().unwrap();
 	let publisher = produce_origin(1);
-	let broadcast = publisher.create_broadcast("bcast").unwrap();
+	let broadcast = publisher
+		.route("bcast", moq_net::origin::RouteOptions::hidden())
+		.unwrap();
 	let track = broadcast
+		.broadcast()
 		.create_track(
 			"ordered",
 			Info::default().with_timescale(Timescale::MILLI).with_max_age(FOREVER),
 		)
 		.unwrap();
-	broadcast.announce(Default::default()).unwrap();
+	broadcast.announce().unwrap();
 
 	let upstream = match relay {
 		true => Some(connect(version, publisher.consume(), 2).await),
@@ -188,14 +191,17 @@ async fn merged_subscribers_keep_their_own_order() {
 	for version in ["moq-lite-07-wip", "moq-transport-18"] {
 		let version: Version = version.parse().unwrap();
 		let publisher = produce_origin(1);
-		let broadcast = publisher.create_broadcast("bcast").unwrap();
+		let broadcast = publisher
+			.route("bcast", moq_net::origin::RouteOptions::hidden())
+			.unwrap();
 		let track = broadcast
+			.broadcast()
 			.create_track(
 				"ordered",
 				Info::default().with_timescale(Timescale::MILLI).with_max_age(FOREVER),
 			)
 			.unwrap();
-		broadcast.announce(Default::default()).unwrap();
+		broadcast.announce().unwrap();
 
 		let (upstream, relay) = connect(version, publisher.consume(), 2).await;
 		let (descending_pair, descending_origin) = connect(version, relay.consume(), 3).await;
diff --git a/rs/moq-net/tests/integration/history_groups.rs b/rs/moq-net/tests/integration/history_groups.rs
index be77e0f69c1..21c357a9353 100644
--- a/rs/moq-net/tests/integration/history_groups.rs
+++ b/rs/moq-net/tests/integration/history_groups.rs
@@ -42,14 +42,17 @@ fn produce_origin(hop: u64) -> moq_net::origin::Producer {
 async fn round(version: &str, relay: bool, newest_first: bool) -> Vec<(u64, usize)> {
 	let version: Version = version.parse().unwrap();
 	let publisher = produce_origin(1);
-	let broadcast = publisher.create_broadcast("bcast").unwrap();
+	let broadcast = publisher
+		.route("bcast", moq_net::origin::RouteOptions::hidden())
+		.unwrap();
 	let track = broadcast
+		.broadcast()
 		.create_track(
 			"history",
 			Info::default().with_timescale(Timescale::MILLI).with_max_age(FOREVER),
 		)
 		.unwrap();
-	broadcast.announce(Default::default()).unwrap();
+	broadcast.announce().unwrap();
 
 	let relay_origin = produce_origin(2);
 	let upstream = match relay {
@@ -201,14 +204,17 @@ async fn a_late_subscriber_receives_the_relays_cached_history() {
 	// Older drafts canonicalize group 0 to the live edge instead of replay.
 	let version: Version = "moq-lite-07-wip".parse().unwrap();
 	let publisher = produce_origin(1);
-	let broadcast = publisher.create_broadcast("bcast").unwrap();
+	let broadcast = publisher
+		.route("bcast", moq_net::origin::RouteOptions::hidden())
+		.unwrap();
 	let track = broadcast
+		.broadcast()
 		.create_track(
 			"history",
 			Info::default().with_timescale(Timescale::MILLI).with_max_age(FOREVER),
 		)
 		.unwrap();
-	broadcast.announce(Default::default()).unwrap();
+	broadcast.announce().unwrap();
 	let relay = produce_origin(2);
 	let mut options = MockConnectOptions::new(version);
 	options.server_publish = Some(publisher.consume());
diff --git a/rs/moq-net/tests/integration/idle_cancel_refetch.rs b/rs/moq-net/tests/integration/idle_cancel_refetch.rs
index 04ff961ba2f..a2cb27ea80b 100644
--- a/rs/moq-net/tests/integration/idle_cancel_refetch.rs
+++ b/rs/moq-net/tests/integration/idle_cancel_refetch.rs
@@ -21,14 +21,17 @@ fn produce_origin(hop: u64) -> moq_net::origin::Producer {
 #[kio::test]
 async fn a_group_cut_by_an_idle_cancel_is_refetched_whole() {
 	let publisher = produce_origin(1);
-	let broadcast = publisher.create_broadcast("bcast").unwrap();
+	let broadcast = publisher
+		.route("bcast", moq_net::origin::RouteOptions::hidden())
+		.unwrap();
 	let track = broadcast
+		.broadcast()
 		.create_track(
 			"audio",
 			moq_net::track::Info::default().with_timescale(None).with_max_age(None),
 		)
 		.unwrap();
-	broadcast.announce(Default::default()).unwrap();
+	broadcast.announce().unwrap();
 
 	let mut g0 = track.create_group(moq_net::group::Info { sequence: 0 }).unwrap();
 	g0.write_frame(None, &b"0a"[..]).unwrap();
diff --git a/rs/moq-net/tests/integration/idle_session.rs b/rs/moq-net/tests/integration/idle_session.rs
index 8f1cf854992..4f1547f7c7a 100644
--- a/rs/moq-net/tests/integration/idle_session.rs
+++ b/rs/moq-net/tests/integration/idle_session.rs
@@ -95,8 +95,8 @@ async fn busy_viewer_sees_the_estimate_move() {
 			..STATS
 		});
 		// Server work for this session: announcing a broadcast to the viewer.
-		let broadcast = origin.create_broadcast("live").unwrap();
-		broadcast.announce(Default::default()).unwrap();
+		let broadcast = origin.route("live", moq_net::origin::RouteOptions::hidden()).unwrap();
+		broadcast.announce().unwrap();
 
 		let moved = kio::clock::timeout(Duration::from_millis(1), probe.changed()).await;
 		assert_eq!(
diff --git a/rs/moq-net/tests/integration/instance.rs b/rs/moq-net/tests/integration/instance.rs
index 1210936a07d..f48942da2c6 100644
--- a/rs/moq-net/tests/integration/instance.rs
+++ b/rs/moq-net/tests/integration/instance.rs
@@ -30,7 +30,7 @@ async fn started(announced: &mut origin::Routes) -> Instance {
 		.expect("announce hung")
 		.expect("announce ended")
 	{
-		origin::RouteEvent::Start(announce) => announce.route.instance.expect("a delivered route has an instance"),
+		origin::RouteEvent::Start(announce) => announce.route.instance().clone(),
 		other => panic!("expected a start, got {other:?}"),
 	}
 }
@@ -56,15 +56,18 @@ async fn job_reannounced(version: &str) {
 	let relay = produce_origin(2);
 	let instance: Instance = "job".parse().unwrap();
 	let job = publisher
-		.publish("job", origin::Route::default().with_instance(instance.clone(), 0))
+		.route(
+			"job",
+			moq_net::origin::RouteOptions::default().with_instance(instance.clone(), 0),
+		)
 		.unwrap();
 	let _session = link(version, &publisher, &relay).await;
 	let mut announced = relay.consume().routes();
 
 	let first = started(&mut announced).await;
-	job.unannounce();
+	job.withdraw();
 	ended(&mut announced).await;
-	job.announce(origin::Route::default()).unwrap();
+	job.announce().unwrap();
 	let second = started(&mut announced).await;
 
 	match version.to_string().as_str() {
diff --git a/rs/moq-net/tests/integration/late_lower_group.rs b/rs/moq-net/tests/integration/late_lower_group.rs
index 5973d5bd659..b5882acac76 100644
--- a/rs/moq-net/tests/integration/late_lower_group.rs
+++ b/rs/moq-net/tests/integration/late_lower_group.rs
@@ -83,8 +83,11 @@ async fn read_all(sub: &mut moq_net::track::Subscriber) -> Vec<(u64, usize)> {
 async fn session(version: &str, relay: bool, start: Option<u64>) -> Vec<(u64, usize)> {
 	let version: Version = version.parse().unwrap();
 	let publisher = produce_origin(1);
-	let broadcast = publisher.create_broadcast("bcast").unwrap();
+	let broadcast = publisher
+		.route("bcast", moq_net::origin::RouteOptions::hidden())
+		.unwrap();
 	let track = broadcast
+		.broadcast()
 		.create_track(
 			"late",
 			Info::default()
@@ -92,7 +95,7 @@ async fn session(version: &str, relay: bool, start: Option<u64>) -> Vec<(u64, us
 				.with_max_age(FOREVER),
 		)
 		.unwrap();
-	broadcast.announce(Default::default()).unwrap();
+	broadcast.announce().unwrap();
 
 	let relay_origin = produce_origin(2);
 	let upstream = match relay {
@@ -156,8 +159,11 @@ async fn session(version: &str, relay: bool, start: Option<u64>) -> Vec<(u64, us
 
 async fn in_process(start: Option<u64>) -> Vec<(u64, usize)> {
 	let publisher = produce_origin(1);
-	let broadcast = publisher.create_broadcast("bcast").unwrap();
+	let broadcast = publisher
+		.route("bcast", moq_net::origin::RouteOptions::hidden())
+		.unwrap();
 	let track = broadcast
+		.broadcast()
 		.create_track(
 			"late",
 			Info::default()
@@ -209,8 +215,11 @@ async fn an_explicit_floor_receives_a_group_created_below_the_first_served_group
 async fn merged(version: &str) -> (Vec<(u64, usize)>, Vec<(u64, usize)>) {
 	let version: Version = version.parse().unwrap();
 	let publisher = produce_origin(1);
-	let broadcast = publisher.create_broadcast("bcast").unwrap();
+	let broadcast = publisher
+		.route("bcast", moq_net::origin::RouteOptions::hidden())
+		.unwrap();
 	let track = broadcast
+		.broadcast()
 		.create_track(
 			"late",
 			Info::default()
@@ -218,7 +227,7 @@ async fn merged(version: &str) -> (Vec<(u64, usize)>, Vec<(u64, usize)>) {
 				.with_max_age(FOREVER),
 		)
 		.unwrap();
-	broadcast.announce(Default::default()).unwrap();
+	broadcast.announce().unwrap();
 
 	let relay_origin = produce_origin(2);
 	let mut options = MockConnectOptions::new(version);
diff --git a/rs/moq-net/tests/integration/lazy_discovery.rs b/rs/moq-net/tests/integration/lazy_discovery.rs
index e5d65118542..19cfee840d4 100644
--- a/rs/moq-net/tests/integration/lazy_discovery.rs
+++ b/rs/moq-net/tests/integration/lazy_discovery.rs
@@ -34,7 +34,7 @@ fn produce_origin(hop: u64) -> origin::Producer {
 struct Lazy {
 	subscriber: origin::Producer,
 	pair: MockPair,
-	_broadcasts: Vec<moq_net::origin::Publication>,
+	_broadcasts: Vec<moq_net::origin::Route>,
 }
 
 impl Lazy {
@@ -47,8 +47,8 @@ impl Lazy {
 		let broadcasts = ["a/x", "b/y"]
 			.into_iter()
 			.map(|path| {
-				let broadcast = publisher.create_broadcast(path).unwrap();
-				broadcast.announce(Default::default()).unwrap();
+				let broadcast = publisher.route(path, moq_net::origin::RouteOptions::hidden()).unwrap();
+				broadcast.announce().unwrap();
 				broadcast
 			})
 			.collect();
@@ -321,8 +321,8 @@ async fn a_relay_link_asks_for_everything() {
 async fn a_server_asks_for_everything() {
 	for version in VERSIONS {
 		let publisher = produce_origin(1);
-		let broadcast = publisher.create_broadcast("a/x").unwrap();
-		broadcast.announce(Default::default()).unwrap();
+		let broadcast = publisher.route("a/x", moq_net::origin::RouteOptions::hidden()).unwrap();
+		broadcast.announce().unwrap();
 		let relay = produce_origin(2);
 		let mut options = MockConnectOptions::new(version.parse::<Version>().unwrap());
 		options.client_publish = Some(publisher.consume());
@@ -340,8 +340,8 @@ async fn serving_the_peer_asks_nothing() {
 	for version in VERSIONS {
 		let local = produce_origin(2);
 		let remote = produce_origin(1);
-		let broadcast = remote.create_broadcast("a/x").unwrap();
-		broadcast.announce(Default::default()).unwrap();
+		let broadcast = remote.route("a/x", moq_net::origin::RouteOptions::hidden()).unwrap();
+		broadcast.announce().unwrap();
 
 		let mut options = MockConnectOptions::new(version.parse::<Version>().unwrap());
 		options.client_publish = Some(local.consume());
diff --git a/rs/moq-net/tests/integration/mesh_withdraw.rs b/rs/moq-net/tests/integration/mesh_withdraw.rs
index d69f27178fb..273abe197f2 100644
--- a/rs/moq-net/tests/integration/mesh_withdraw.rs
+++ b/rs/moq-net/tests/integration/mesh_withdraw.rs
@@ -9,12 +9,13 @@
 
 use crate::support;
 
-use std::{collections::HashMap, time::Duration};
+use std::time::Duration;
 
 use futures::channel::mpsc;
 
 use moq_net::{Hop, Version, cache, origin};
 use support::harness::{MockConnectOptions, MockPair, connect_mock, peer, peer_with_latency};
+use support::{Kind, drain, watch};
 
 fn produce_origin(hop: u64) -> origin::Producer {
 	produce(hop, origin::Config::default().update_hold)
@@ -32,48 +33,6 @@ fn produce(hop: u64, hold: Duration) -> origin::Producer {
 	producer
 }
 
-/// The kind of an [`origin::RouteEvent`] for a prefix.
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-enum Kind {
-	Start,
-	Update,
-	Restart,
-	Takeover,
-	End,
-}
-
-/// Every update per prefix the watcher has seen. Await [`kio::clock::sim::idle`]
-/// first, so every link, hold and quarantine in the mesh has settled.
-fn drain(watched: &mut mpsc::UnboundedReceiver<(String, Kind)>) -> HashMap<String, Vec<Kind>> {
-	let mut updates = HashMap::<String, Vec<Kind>>::new();
-	while let Ok((prefix, kind)) = watched.try_recv() {
-		updates.entry(prefix).or_default().push(kind);
-	}
-	updates
-}
-
-/// Watch `announced` from its own task, the way a session's announce writer does:
-/// it runs when woken, between the relays' own tasks, rather than only once the
-/// test task is polled again, which would coalesce every intermediate update.
-fn watch(mut announced: origin::Routes) -> mpsc::UnboundedReceiver<(String, Kind)> {
-	let (tx, rx) = mpsc::unbounded();
-	kio::clock::sim::spawn(async move {
-		while let Some(event) = announced.next().await {
-			let (kind, announce) = match event {
-				origin::RouteEvent::Start(announce) => (Kind::Start, announce),
-				origin::RouteEvent::Update(announce) => (Kind::Update, announce),
-				origin::RouteEvent::Restart(announce) => (Kind::Restart, announce),
-				origin::RouteEvent::Takeover { announce, .. } => (Kind::Takeover, announce),
-				origin::RouteEvent::End(announce) => (Kind::End, announce),
-			};
-			if tx.unbounded_send((announce.prefix.to_string(), kind)).is_err() {
-				break;
-			}
-		}
-	});
-	rx
-}
-
 /// `n` relays meshed over `edges`, watched from the last one.
 struct Mesh {
 	nodes: Vec<origin::Producer>,
@@ -99,14 +58,14 @@ impl Mesh {
 
 	/// Publish `count` broadcasts spread over every relay but the watcher, starting
 	/// at relay `offset`, and require the watcher to see each announced.
-	async fn publish(&mut self, count: usize, offset: usize) -> Vec<moq_net::origin::Publication> {
+	async fn publish(&mut self, count: usize, offset: usize) -> Vec<moq_net::origin::Route> {
 		let relays = self.nodes.len() - 1;
 		let broadcasts = (0..count)
 			.map(|i| {
 				let broadcast = self.nodes[(i + offset) % relays]
-					.create_broadcast(format!("room/{i}"))
+					.route(format!("room/{i}"), moq_net::origin::RouteOptions::hidden())
 					.unwrap();
-				broadcast.announce(Default::default()).unwrap();
+				broadcast.announce().unwrap();
 				broadcast
 			})
 			.collect();
@@ -226,8 +185,10 @@ async fn partial_mesh_withdraw_retracts_once() {
 	let mut watched: Vec<_> = nodes.iter().map(|node| watch(node.consume().routes())).collect();
 
 	for publisher in [5, 13, 22, 26, 32] {
-		let broadcast = nodes[publisher].create_broadcast(format!("room/{publisher}")).unwrap();
-		broadcast.announce(Default::default()).unwrap();
+		let broadcast = nodes[publisher]
+			.route(format!("room/{publisher}"), moq_net::origin::RouteOptions::hidden())
+			.unwrap();
+		broadcast.announce().unwrap();
 		kio::clock::sim::idle().await;
 		for (relay, watched) in watched.iter_mut().enumerate() {
 			let updates = drain(watched);
@@ -280,8 +241,10 @@ async fn retracted_relay_ignores_a_stale_path() {
 	}
 	let mut watched: Vec<_> = nodes.iter().map(|node| watch(node.consume().routes())).collect();
 
-	let broadcast = nodes[7].create_broadcast("room/7").unwrap();
-	broadcast.announce(Default::default()).unwrap();
+	let broadcast = nodes[7]
+		.route("room/7", moq_net::origin::RouteOptions::hidden())
+		.unwrap();
+	broadcast.announce().unwrap();
 	kio::clock::sim::idle().await;
 	for watched in watched.iter_mut() {
 		drain(watched);
@@ -362,9 +325,12 @@ impl Cluster {
 
 	/// Publish `path` from the client and require everyone to see it. Returns
 	/// what the watching client saw.
-	async fn publish(&mut self, path: &str) -> (moq_net::origin::Publication, Vec<Kind>) {
-		let broadcast = self.publisher.create_broadcast(path).unwrap();
-		broadcast.announce(Default::default()).unwrap();
+	async fn publish(&mut self, path: &str) -> (moq_net::origin::Route, Vec<Kind>) {
+		let broadcast = self
+			.publisher
+			.route(path, moq_net::origin::RouteOptions::hidden())
+			.unwrap();
+		broadcast.announce().unwrap();
 		kio::clock::sim::idle().await;
 		let client = drain(&mut self.client).remove(path).unwrap();
 		assert_ne!(client.last(), Some(&Kind::End), "client: {client:?}");
@@ -376,7 +342,7 @@ impl Cluster {
 	}
 
 	/// Close `broadcast` cleanly: what the watching client, then each relay, saw.
-	async fn close(&mut self, path: &str, broadcast: moq_net::origin::Publication) -> (Vec<Kind>, Vec<Vec<Kind>>) {
+	async fn close(&mut self, path: &str, broadcast: moq_net::origin::Route) -> (Vec<Kind>, Vec<Vec<Kind>>) {
 		drop(broadcast);
 		kio::clock::sim::idle().await;
 		let client = drain(&mut self.client).remove(path).unwrap();
@@ -474,8 +440,10 @@ async fn late_better_path(mesh: &str, client: &str) -> (Vec<Kind>, Vec<Kind>) {
 	kio::clock::sim::idle().await;
 	assert!(drain(&mut watcher).is_empty());
 
-	let broadcast = publishing.create_broadcast("room/a").unwrap();
-	broadcast.announce(Default::default()).unwrap();
+	let broadcast = publishing
+		.route("room/a", moq_net::origin::RouteOptions::hidden())
+		.unwrap();
+	broadcast.announce().unwrap();
 	kio::clock::sim::idle().await;
 	let published = drain(&mut watcher).remove("room/a").unwrap();
 	drop(broadcast);
@@ -685,129 +653,3 @@ async fn withdrawal_counts(capped: bool) -> (usize, usize, usize) {
 	}
 	(hunted, revived, extra)
 }
-
-/// A permissive source sends an over-limit path to prove ingress refusal; an
-/// accepted boundary path then proves egress counts the relay's own stamp.
-#[kio::test]
-async fn hop_limit_bounds_receive_and_send() {
-	for name in [
-		"moq-lite-03",
-		"moq-lite-04",
-		"moq-lite-05",
-		"moq-lite-06",
-		"moq-lite-07-wip",
-		"moq-transport-18",
-		"moq-transport-22",
-	] {
-		let version = name.parse().unwrap();
-		let source = produce_origin(1);
-		let mut config = origin::Config::new(Hop::new(2).unwrap());
-		config.max_hops = origin::HopLimit::new(2).unwrap();
-		config.pool = cache::Pool::unbounded();
-		let (relay, driver) = origin::Producer::new(config);
-		support::harness::spawn(driver);
-		let sink = produce_origin(3);
-		let _upstream = peer(version, &source, &relay).await;
-		let _downstream = peer(version, &relay, &sink).await;
-		let mut received = watch(relay.consume().routes());
-		let mut sent = watch(sink.consume().routes());
-		kio::clock::sim::idle().await;
-		let route = |count: u64| {
-			origin::Route::default().with_hops(
-				moq_net::Hops::try_from((100..100 + count).map(|id| Hop::new(id).unwrap()).collect::<Vec<_>>())
-					.unwrap(),
-			)
-		};
-		let _long = source.publish("long", route(2)).unwrap();
-		let _boundary = source.publish("boundary", route(1)).unwrap();
-		let short = source.publish("short", route(0)).unwrap();
-		kio::clock::sim::idle().await;
-		let received = drain(&mut received);
-		assert!(!received.contains_key("long"), "{name}: accepted over-limit path");
-		assert!(received.contains_key("boundary"), "{name}: refused boundary path");
-		assert!(received.contains_key("short"), "{name}: refused short path");
-		let sent_initial = drain(&mut sent);
-		assert_eq!(sent_initial.len(), 1, "{name}: {sent_initial:?}");
-		assert!(sent_initial.contains_key("short"), "{name}: forwarded over-limit path");
-
-		if matches!(name, "moq-lite-03" | "moq-lite-04") {
-			// These wires have no route metadata update: withdraw, then replace it.
-			drop(short);
-			kio::clock::sim::idle().await;
-			assert_eq!(
-				drain(&mut sent).get("short").and_then(|kinds| kinds.last()),
-				Some(&Kind::End),
-				"{name}"
-			);
-			let _replacement = source.publish("short", route(1)).unwrap();
-			kio::clock::sim::idle().await;
-			assert!(drain(&mut sent).is_empty(), "{name}: forwarded over-limit replacement");
-			continue;
-		}
-		short.announce(route(1)).unwrap();
-		kio::clock::sim::idle().await;
-		let ended = drain(&mut sent);
-		assert_eq!(
-			ended.get("short").and_then(|kinds| kinds.last()),
-			Some(&Kind::End),
-			"{name}: {ended:?}"
-		);
-	}
-}
-
-/// A cheaper route at the cap wins locally but cannot be forwarded, so the relay
-/// advertises the pricier in-cap route instead of withdrawing the prefix, and
-/// withdraws only once no in-cap route is left.
-#[kio::test]
-async fn hop_limit_falls_back_to_a_forwardable_route() {
-	// Only wires carrying a route cost can rank a longer route first.
-	for name in ["moq-lite-06", "moq-lite-07-wip", "moq-transport-18", "moq-transport-22"] {
-		let version = name.parse().unwrap();
-		let near = produce_origin(1);
-		let far = produce_origin(4);
-		let mut config = origin::Config::new(Hop::new(2).unwrap());
-		config.max_hops = origin::HopLimit::new(3).unwrap();
-		config.pool = cache::Pool::unbounded();
-		let (relay, driver) = origin::Producer::new(config);
-		support::harness::spawn(driver);
-		let sink = produce_origin(3);
-		let _near = peer(version, &near, &relay).await;
-		let _far = peer(version, &far, &relay).await;
-		let _downstream = peer(version, &relay, &sink).await;
-		let mut sent = watch(sink.consume().routes());
-		kio::clock::sim::idle().await;
-
-		let route = |first: u64, count: u64, cost: u64| {
-			origin::Route::default()
-				.with_hops(
-					moq_net::Hops::try_from(
-						(first..first + count)
-							.map(|id| Hop::new(id).unwrap())
-							.collect::<Vec<_>>(),
-					)
-					.unwrap(),
-				)
-				.with_cost(origin::Cost::new(cost))
-		};
-		// Three hops at the relay once the sender is appended: in the cap, but full.
-		let _cheap = far.publish("room", route(100, 2, 1)).unwrap();
-		// Two hops at the relay, so it has room for the relay's own.
-		let pricey = near.publish("room", route(200, 1, 50)).unwrap();
-		kio::clock::sim::idle().await;
-		let started = drain(&mut sent);
-		assert_eq!(
-			started.get("room").and_then(|kinds| kinds.last()),
-			Some(&Kind::Start),
-			"{name}: withdrew a prefix an in-cap route reaches: {started:?}"
-		);
-
-		drop(pricey);
-		kio::clock::sim::idle().await;
-		let ended = drain(&mut sent);
-		assert_eq!(
-			ended.get("room").and_then(|kinds| kinds.last()),
-			Some(&Kind::End),
-			"{name}: forwarded a route at the cap: {ended:?}"
-		);
-	}
-}
diff --git a/rs/moq-net/tests/integration/model.rs b/rs/moq-net/tests/integration/model.rs
index d77efb0e9a0..8c9b1786158 100644
--- a/rs/moq-net/tests/integration/model.rs
+++ b/rs/moq-net/tests/integration/model.rs
@@ -16,8 +16,11 @@ fn origin_front_serves_media_with_only_explicit_polls() {
 	let waiter = kio::Waiter::noop();
 	let (origin, mut driver) = origin::Producer::new(origin::Config::new(Hop::new(1).unwrap()));
 	driver.poll(now, &waiter).unwrap();
-	let broadcast = origin.create_broadcast("room/live").unwrap();
+	let broadcast = origin
+		.route("room/live", moq_net::origin::RouteOptions::hidden())
+		.unwrap();
 	let track = broadcast
+		.broadcast()
 		.create_track(
 			"video",
 			track::Info::default().with_timescale(moq_net::Timescale::MILLI),
@@ -26,7 +29,7 @@ fn origin_front_serves_media_with_only_explicit_polls() {
 	let mut group = track.create_group(group::Info { sequence: 7 }).unwrap();
 	group.write_frame(Timestamp::ZERO, b"media").unwrap();
 	group.finish().unwrap();
-	broadcast.announce(origin::Route::default()).unwrap();
+	broadcast.announce().unwrap();
 
 	// Resolving and subscribing pass through the origin's core front tasks.
 	let mut requesting = origin.consume().request("room/live", None);
@@ -44,7 +47,10 @@ fn origin_front_serves_media_with_only_explicit_polls() {
 
 	// Driver teardown also works without any executor-owned tasks.
 	drop(driver);
-	assert!(matches!(origin.create_broadcast("after-close"), Err(Error::Closed)));
+	assert!(matches!(
+		origin.route("after-close", moq_net::origin::RouteOptions::hidden()),
+		Err(Error::Closed)
+	));
 }
 
 #[test]
@@ -57,11 +63,13 @@ fn follow_resolves_with_only_explicit_polls() {
 	// Nothing covers the path yet: the follower waits for an announcement.
 	let mut following = origin.consume().follow("room/live", None).unwrap();
 	assert!(following.poll_available(&waiter).is_pending());
-	let broadcast = origin.create_broadcast("room/live").unwrap();
+	let broadcast = origin
+		.route("room/live", moq_net::origin::RouteOptions::hidden())
+		.unwrap();
 	assert!(following.poll_available(&waiter).is_pending());
 
 	// Announcing starts the path, so the next poll asks and the driver serves it.
-	broadcast.announce(origin::Route::default()).unwrap();
+	broadcast.announce().unwrap();
 	assert!(following.poll_available(&waiter).is_pending());
 	driver.poll(now, &waiter).unwrap();
 	let resolved = ready(following.poll_available(&waiter)).unwrap().unwrap();
diff --git a/rs/moq-net/tests/integration/multi_cdn.rs b/rs/moq-net/tests/integration/multi_cdn.rs
index 9dceb213ee0..7b659d373a3 100644
--- a/rs/moq-net/tests/integration/multi_cdn.rs
+++ b/rs/moq-net/tests/integration/multi_cdn.rs
@@ -135,7 +135,7 @@ fn via_a(announce: &origin::RouteEvent) -> bool {
 		| origin::RouteEvent::Takeover { announce: a, .. } => &a.route,
 		origin::RouteEvent::End(_) => return false,
 	};
-	route.hops.iter().any(|hop| *hop == Hop::new(A).unwrap())
+	route.hops().iter().any(|hop| *hop == Hop::new(A).unwrap())
 }
 
 struct Topology {
@@ -144,7 +144,7 @@ struct Topology {
 	cdn_b: origin::Producer,
 	subscriber: origin::Producer,
 	track: track::Producer,
-	_broadcast: moq_net::origin::Publication,
+	_broadcast: moq_net::origin::Route,
 	_pushes: Vec<MockPair>,
 	s_to_a: Option<MockPair>,
 	s_to_b: MockPair,
@@ -161,11 +161,11 @@ impl Topology {
 		let cdn_b = produce_origin(3);
 		let subscriber = produce_origin(4);
 
-		let broadcast = publisher.create_broadcast("live").unwrap();
-		let track = broadcast.create_track("video", timed()).unwrap();
-		broadcast
-			.announce(origin::Route::default().with_instance(moq_net::Instance::random(), 0))
+		let broadcast = publisher
+			.route("live", moq_net::origin::RouteOptions::hidden())
 			.unwrap();
+		let track = broadcast.broadcast().create_track("video", timed()).unwrap();
+		broadcast.announce().unwrap();
 
 		let pushes = vec![
 			push(lite, &publisher, &cdn_a).await,
diff --git a/rs/moq-net/tests/integration/partial_group.rs b/rs/moq-net/tests/integration/partial_group.rs
index 05c35951762..5dbc2ea8a3c 100644
--- a/rs/moq-net/tests/integration/partial_group.rs
+++ b/rs/moq-net/tests/integration/partial_group.rs
@@ -34,11 +34,14 @@ async fn round(version: &str) -> Option<Result<Option<usize>, moq_net::Error>> {
 	let downstream = produce_origin(2);
 	let _pair = peer(version.parse::<Version>().unwrap(), &publisher, &downstream).await;
 
-	let broadcast = publisher.create_broadcast("room").unwrap();
+	let broadcast = publisher
+		.route("room", moq_net::origin::RouteOptions::hidden())
+		.unwrap();
 	let track = broadcast
+		.broadcast()
 		.create_track("data", Info::default().with_timescale(Timescale::MILLI))
 		.unwrap();
-	broadcast.announce(Default::default()).unwrap();
+	broadcast.announce().unwrap();
 
 	let consumer = downstream.consume();
 	let remote = kio::clock::timeout(TIMEOUT, consumer.follow("room", None).unwrap().available())
diff --git a/rs/moq-net/tests/integration/quiet_catalog.rs b/rs/moq-net/tests/integration/quiet_catalog.rs
index 740d7a32e8f..e43b4def645 100644
--- a/rs/moq-net/tests/integration/quiet_catalog.rs
+++ b/rs/moq-net/tests/integration/quiet_catalog.rs
@@ -47,10 +47,10 @@ async fn settle() {
 }
 
 /// Announce `live/catalog.json` holding one finished snapshot group.
-fn publish(origin: &origin::Producer) -> (moq_net::origin::Publication, track::Producer) {
-	let broadcast = origin.create_broadcast("live").unwrap();
-	let track = broadcast.create_track("catalog.json", timed()).unwrap();
-	broadcast.announce(Default::default()).unwrap();
+fn publish(origin: &origin::Producer) -> (moq_net::origin::Route, track::Producer) {
+	let broadcast = origin.route("live", moq_net::origin::RouteOptions::hidden()).unwrap();
+	let track = broadcast.broadcast().create_track("catalog.json", timed()).unwrap();
+	broadcast.announce().unwrap();
 	let mut group = track.append_group().unwrap();
 	group.write_frame(Timestamp::ZERO, b"snapshot").unwrap();
 	group.finish().unwrap();
diff --git a/rs/moq-net/tests/integration/range_anchors.rs b/rs/moq-net/tests/integration/range_anchors.rs
index df70c1bc4fc..99e7d98fd60 100644
--- a/rs/moq-net/tests/integration/range_anchors.rs
+++ b/rs/moq-net/tests/integration/range_anchors.rs
@@ -45,14 +45,17 @@ fn millis(ms: u64) -> Timestamp {
 /// over one session on it.
 async fn read(version: Option<&str>, range: Range) -> Result<Vec<u64>, Error> {
 	let publisher = produce_origin(1);
-	let broadcast = publisher.create_broadcast("room").unwrap();
+	let broadcast = publisher
+		.route("room", moq_net::origin::RouteOptions::hidden())
+		.unwrap();
 	let track = broadcast
+		.broadcast()
 		.create_track(
 			"data",
 			Info::default().with_timescale(Timescale::MILLI).with_max_age(FOREVER),
 		)
 		.unwrap();
-	broadcast.announce(Default::default()).unwrap();
+	broadcast.announce().unwrap();
 	for sequence in 0..5 {
 		let mut group = track.create_group(moq_net::group::Info { sequence }).unwrap();
 		group.write_frame(millis(sequence * 1000), &b"x"[..]).unwrap();
diff --git a/rs/moq-net/tests/integration/range_fill.rs b/rs/moq-net/tests/integration/range_fill.rs
index 6792429dbd2..340077a9619 100644
--- a/rs/moq-net/tests/integration/range_fill.rs
+++ b/rs/moq-net/tests/integration/range_fill.rs
@@ -34,7 +34,7 @@ struct Fixture {
 	track: moq_net::track::Producer,
 	remote: moq_net::broadcast::Consumer,
 	pair: MockPair,
-	_broadcast: moq_net::origin::Publication,
+	_broadcast: moq_net::origin::Route,
 	_origins: (moq_net::origin::Producer, moq_net::origin::Producer),
 }
 
@@ -42,14 +42,17 @@ impl Fixture {
 	/// A lite-07 publisher holding `groups` for good, and a copy whose cache expires them.
 	async fn new(groups: u64) -> Self {
 		let publisher = origin(1, Some(cache::Pool::unbounded()));
-		let broadcast = publisher.create_broadcast("bcast").unwrap();
+		let broadcast = publisher
+			.route("bcast", moq_net::origin::RouteOptions::hidden())
+			.unwrap();
 		let track = broadcast
+			.broadcast()
 			.create_track(
 				"video",
 				Info::default().with_timescale(Timescale::MILLI).with_max_age(None),
 			)
 			.unwrap();
-		broadcast.announce(Default::default()).unwrap();
+		broadcast.announce().unwrap();
 		for sequence in 0..groups {
 			let mut group = track.create_group(moq_net::group::Info { sequence }).unwrap();
 			group
diff --git a/rs/moq-net/tests/integration/range_read.rs b/rs/moq-net/tests/integration/range_read.rs
index e1b7a0c121a..c07fe4bbaeb 100644
--- a/rs/moq-net/tests/integration/range_read.rs
+++ b/rs/moq-net/tests/integration/range_read.rs
@@ -63,8 +63,11 @@ async fn fixture(
 	relay: bool,
 ) -> (moq_net::broadcast::Consumer, moq_net::track::Producer, impl Sized) {
 	let publisher = produce_origin(1);
-	let broadcast = publisher.create_broadcast("bcast").unwrap();
+	let broadcast = publisher
+		.route("bcast", moq_net::origin::RouteOptions::hidden())
+		.unwrap();
 	let mut track = broadcast
+		.broadcast()
 		.create_track(
 			"video",
 			moq_net::track::Info::default()
@@ -72,7 +75,7 @@ async fn fixture(
 				.with_max_age(None),
 		)
 		.unwrap();
-	broadcast.announce(Default::default()).unwrap();
+	broadcast.announce().unwrap();
 	for sequence in 0..3 {
 		write_group(&mut track, sequence);
 	}
diff --git a/rs/moq-net/tests/integration/received_rewind.rs b/rs/moq-net/tests/integration/received_rewind.rs
index 41767d1abca..7866e2a18da 100644
--- a/rs/moq-net/tests/integration/received_rewind.rs
+++ b/rs/moq-net/tests/integration/received_rewind.rs
@@ -53,11 +53,14 @@ async fn relay(
 	timescale: Option<moq_net::Timescale>,
 ) -> (Option<moq_net::Timescale>, Vec<Read>) {
 	let publisher = produce_origin(1);
-	let broadcast = publisher.create_broadcast("bcast").unwrap();
+	let broadcast = publisher
+		.route("bcast", moq_net::origin::RouteOptions::hidden())
+		.unwrap();
 	let track = broadcast
+		.broadcast()
 		.create_track("data", Info::default().with_timescale(timescale).with_max_age(None))
 		.unwrap();
-	broadcast.announce(Default::default()).unwrap();
+	broadcast.announce().unwrap();
 
 	let relay_origin = produce_origin(2);
 	let mut options = MockConnectOptions::new(upstream.parse::<Version>().unwrap());
@@ -177,11 +180,14 @@ async fn a_timed_track_keeps_its_timestamps_through_a_relay() {
 /// timestamp.
 async fn fetch_only(version: &str) -> Vec<Result<Option<moq_net::Timestamp>, moq_net::Error>> {
 	let publisher = produce_origin(1);
-	let broadcast = publisher.create_broadcast("bcast").unwrap();
+	let broadcast = publisher
+		.route("bcast", moq_net::origin::RouteOptions::hidden())
+		.unwrap();
 	let track = broadcast
+		.broadcast()
 		.create_track("data", Info::default().with_max_age(None))
 		.unwrap();
-	broadcast.announce(Default::default()).unwrap();
+	broadcast.announce().unwrap();
 	write_group(&track, 0);
 	write_group(&track, 1);
 	track.finish().unwrap();
diff --git a/rs/moq-net/tests/integration/rejoin.rs b/rs/moq-net/tests/integration/rejoin.rs
index a2f5e9d313d..7e84ee6b8dd 100644
--- a/rs/moq-net/tests/integration/rejoin.rs
+++ b/rs/moq-net/tests/integration/rejoin.rs
@@ -48,9 +48,11 @@ async fn rejoin_recovers_the_group_reset_on_leave() {
 				let publisher = produce_origin(1);
 				let relay = produce_origin(2);
 
-				let broadcast = publisher.create_broadcast("bench").unwrap();
-				let track = broadcast.create_track("video", timed()).unwrap();
-				broadcast.announce(Default::default()).unwrap();
+				let broadcast = publisher
+					.route("bench", moq_net::origin::RouteOptions::hidden())
+					.unwrap();
+				let track = broadcast.broadcast().create_track("video", timed()).unwrap();
+				broadcast.announce().unwrap();
 
 				let mut options = MockConnectOptions::new(version.parse::<Version>().unwrap());
 				options.server_publish = Some(publisher.consume());
@@ -148,9 +150,11 @@ async fn rejoin_skips_a_cache_kept_by_another_handle() {
 			let publisher = produce_origin(1);
 			let relay = produce_origin(2);
 
-			let broadcast = publisher.create_broadcast("bench").unwrap();
-			let track = broadcast.create_track("video", timed()).unwrap();
-			broadcast.announce(Default::default()).unwrap();
+			let broadcast = publisher
+				.route("bench", moq_net::origin::RouteOptions::hidden())
+				.unwrap();
+			let track = broadcast.broadcast().create_track("video", timed()).unwrap();
+			broadcast.announce().unwrap();
 
 			let mut options = MockConnectOptions::new(version.parse::<Version>().unwrap());
 			options.server_publish = Some(publisher.consume());
@@ -212,9 +216,11 @@ async fn rejoin_keeps_the_cache_when_the_backlog_lands_newest_first() {
 			let publisher = produce_origin(1);
 			let relay = produce_origin(2);
 
-			let broadcast = publisher.create_broadcast("bench").unwrap();
-			let track = broadcast.create_track("video", timed()).unwrap();
-			broadcast.announce(Default::default()).unwrap();
+			let broadcast = publisher
+				.route("bench", moq_net::origin::RouteOptions::hidden())
+				.unwrap();
+			let track = broadcast.broadcast().create_track("video", timed()).unwrap();
+			broadcast.announce().unwrap();
 
 			let mut options = MockConnectOptions::new(version.parse::<Version>().unwrap());
 			options.server_publish = Some(publisher.consume());
@@ -292,9 +298,11 @@ async fn rejoin_mid_group_keeps_the_head_for_later_readers() {
 			let relay = produce_origin(2);
 			let client = produce_origin(3);
 
-			let broadcast = publisher.create_broadcast("bench").unwrap();
-			let track = broadcast.create_track("video", timed()).unwrap();
-			broadcast.announce(Default::default()).unwrap();
+			let broadcast = publisher
+				.route("bench", moq_net::origin::RouteOptions::hidden())
+				.unwrap();
+			let track = broadcast.broadcast().create_track("video", timed()).unwrap();
+			broadcast.announce().unwrap();
 			// Left open, as a JSON snapshot group stays open for its deltas.
 			let mut open = track.append_group().unwrap();
 			open.write_frame(Timestamp::ZERO, b"a0".as_ref()).unwrap();
@@ -370,9 +378,11 @@ async fn rejoin_goes_live_without_the_join_head() {
 			let relay = produce_origin(2);
 			let client = produce_origin(3);
 
-			let broadcast = publisher.create_broadcast("bench").unwrap();
-			let track = broadcast.create_track("video", timed()).unwrap();
-			broadcast.announce(Default::default()).unwrap();
+			let broadcast = publisher
+				.route("bench", moq_net::origin::RouteOptions::hidden())
+				.unwrap();
+			let track = broadcast.broadcast().create_track("video", timed()).unwrap();
+			broadcast.announce().unwrap();
 			let mut open = track.append_group().unwrap();
 			open.write_frame(Timestamp::ZERO, b"a0".as_ref()).unwrap();
 
@@ -445,9 +455,11 @@ async fn rejoin_during_the_cancel_skips_the_cache() {
 			let publisher = produce_origin(1);
 			let relay = produce_origin(2);
 
-			let broadcast = publisher.create_broadcast("bench").unwrap();
-			let track = broadcast.create_track("video", timed()).unwrap();
-			broadcast.announce(Default::default()).unwrap();
+			let broadcast = publisher
+				.route("bench", moq_net::origin::RouteOptions::hidden())
+				.unwrap();
+			let track = broadcast.broadcast().create_track("video", timed()).unwrap();
+			broadcast.announce().unwrap();
 
 			let mut options = MockConnectOptions::new(version);
 			options.server_publish = Some(publisher.consume());
@@ -514,9 +526,11 @@ async fn rejoin_waits_for_the_answers_first_frame() {
 			let publisher = produce_origin(1);
 			let relay = produce_origin(2);
 
-			let broadcast = publisher.create_broadcast("bench").unwrap();
-			let track = broadcast.create_track("video", timed()).unwrap();
-			broadcast.announce(Default::default()).unwrap();
+			let broadcast = publisher
+				.route("bench", moq_net::origin::RouteOptions::hidden())
+				.unwrap();
+			let track = broadcast.broadcast().create_track("video", timed()).unwrap();
+			broadcast.announce().unwrap();
 
 			let mut options = MockConnectOptions::new(version);
 			options.server_publish = Some(publisher.consume());
@@ -592,9 +606,11 @@ async fn leaving_after_the_cache_window_keeps_the_latest_group() {
 			let publisher = produce_origin(1);
 			let relay = produce_origin(2);
 
-			let broadcast = publisher.create_broadcast("bench").unwrap();
-			let track = broadcast.create_track("catalog", timed()).unwrap();
-			broadcast.announce(Default::default()).unwrap();
+			let broadcast = publisher
+				.route("bench", moq_net::origin::RouteOptions::hidden())
+				.unwrap();
+			let track = broadcast.broadcast().create_track("catalog", timed()).unwrap();
+			broadcast.announce().unwrap();
 			let mut group = track.append_group().unwrap();
 			group.write_frame(Timestamp::ZERO, b"c0".as_ref()).unwrap();
 			group.finish().unwrap();
@@ -672,9 +688,11 @@ async fn rejoin_keeps_source_timestamps() {
 			let publisher = produce_origin(1);
 			let client = produce_origin(2);
 
-			let broadcast = publisher.create_broadcast("bench").unwrap();
-			let track = broadcast.create_track("video", timed()).unwrap();
-			broadcast.announce(Default::default()).unwrap();
+			let broadcast = publisher
+				.route("bench", moq_net::origin::RouteOptions::hidden())
+				.unwrap();
+			let track = broadcast.broadcast().create_track("video", timed()).unwrap();
+			broadcast.announce().unwrap();
 
 			let mut options = MockConnectOptions::new(version.parse::<Version>().unwrap());
 			options.server_publish = Some(publisher.consume());
@@ -762,11 +780,11 @@ async fn quiet_catalog_survives_cache_expiry(version: Version, takeover: bool) {
 	kio::clock::timeout(TEST_TIMEOUT + moq_net::cache::DEFAULT_EXPIRY * 5, async {
 		let publisher = produce_origin(1);
 		let relay = produce_origin(2);
-		let broadcast = publisher.create_broadcast("bench").unwrap();
-		let track = broadcast.create_track("catalog", timed()).unwrap();
-		broadcast
-			.announce(moq_net::origin::Route::default().with_instance(moq_net::Instance::random(), 0))
+		let broadcast = publisher
+			.route("bench", moq_net::origin::RouteOptions::hidden())
 			.unwrap();
+		let track = broadcast.broadcast().create_track("catalog", timed()).unwrap();
+		broadcast.announce().unwrap();
 		let mut group = track.append_group().unwrap();
 		group.write_frame(Timestamp::ZERO, b"catalog".as_ref()).unwrap();
 		group.finish().unwrap();
diff --git a/rs/moq-net/tests/integration/relay_upstream_close.rs b/rs/moq-net/tests/integration/relay_upstream_close.rs
index 8ec827887b2..f2d903dc1a3 100644
--- a/rs/moq-net/tests/integration/relay_upstream_close.rs
+++ b/rs/moq-net/tests/integration/relay_upstream_close.rs
@@ -93,15 +93,18 @@ async fn read(mut sub: moq_net::track::Subscriber) -> Outcome {
 async fn round(name: &str, end: End) -> Vec<Outcome> {
 	let version: Version = name.parse().unwrap();
 	let publisher = produce_origin(1);
-	let broadcast = publisher.create_broadcast("bcast").unwrap();
+	let broadcast = publisher
+		.route("bcast", moq_net::origin::RouteOptions::hidden())
+		.unwrap();
 	let tracks: Vec<_> = (0..TRACKS)
 		.map(|index| {
 			broadcast
+				.broadcast()
 				.create_track(format!("track{index}").as_str(), timed())
 				.unwrap()
 		})
 		.collect();
-	broadcast.announce(Default::default()).unwrap();
+	broadcast.announce().unwrap();
 
 	let relay = produce_origin(2);
 	let mut options = MockConnectOptions::new(version);
diff --git a/rs/moq-net/tests/integration/replacement.rs b/rs/moq-net/tests/integration/replacement.rs
index 15006530fe8..23e13a99918 100644
--- a/rs/moq-net/tests/integration/replacement.rs
+++ b/rs/moq-net/tests/integration/replacement.rs
@@ -82,19 +82,21 @@ async fn replace(version: &str, instance: Option<Instance>) {
 	let publisher = produce_origin(1);
 	let viewer = produce_origin(3);
 
-	let mut route = origin::Route::default();
-	route.instance = instance.clone();
-	let cam = publisher.publish("cam", route).unwrap();
-	let video = cam.create_track("video", timed()).unwrap();
-	let audio = cam.create_track("audio", timed()).unwrap();
-	let meta = cam.create_track("meta", timed()).unwrap();
+	let options = match &instance {
+		Some(instance) => origin::RouteOptions::default().with_instance(instance.clone(), 0),
+		None => origin::RouteOptions::default(),
+	};
+	let cam = publisher.route("cam", options).unwrap();
+	let video = cam.broadcast().create_track("video", timed()).unwrap();
+	let audio = cam.broadcast().create_track("audio", timed()).unwrap();
+	let meta = cam.broadcast().create_track("meta", timed()).unwrap();
 
 	let _first = link(version, &publisher, &viewer).await;
 	let mut announced = viewer.consume().routes();
 	match next_event(&mut announced).await {
 		origin::RouteEvent::Start(announce) => {
 			assert_eq!(announce.prefix.as_str(), "cam");
-			let carried = announce.route.instance.as_ref().expect("every route has an instance");
+			let carried = announce.route.instance();
 			assert_eq!(carried.is_minted(), !carries, "{version}: minted {carried}");
 			if carries && let Some(instance) = &instance {
 				assert_eq!(carried, instance, "{version}: carried instance");
@@ -157,7 +159,7 @@ async fn minted_lite06() {
 		.expect("timed out");
 }
 
-/// lite-07 carries the instance the publication minted, or the stable one it names.
+/// lite-07 carries the instance the route minted, or the stable one it names.
 #[kio::test]
 async fn carried_lite07() {
 	for instance in [None, Some("cam".parse().unwrap())] {
@@ -190,8 +192,10 @@ async fn route_death(version: &str, relayed: bool, wait: Duration) {
 	let relay = produce_origin(2);
 	let viewer = produce_origin(3);
 
-	let cam = publisher.publish("cam", origin::Route::default()).unwrap();
-	let video = cam.create_track("video", timed()).unwrap();
+	let cam = publisher
+		.route("cam", moq_net::origin::RouteOptions::default())
+		.unwrap();
+	let video = cam.broadcast().create_track("video", timed()).unwrap();
 
 	let upstream = if relayed { &relay } else { &viewer };
 	let old_session = link(version, &publisher, upstream).await;
@@ -273,8 +277,8 @@ async fn restart_while_the_old_session_lingers(version: &str, old_hop: u64, new_
 	let viewer = produce_origin(3);
 
 	let old = produce_origin(old_hop);
-	let old_cam = old.publish("cam", origin::Route::default()).unwrap();
-	let _old_video = old_cam.create_track("video", timed()).unwrap();
+	let old_cam = old.route("cam", moq_net::origin::RouteOptions::default()).unwrap();
+	let _old_video = old_cam.broadcast().create_track("video", timed()).unwrap();
 	let old_session = link(version, &old, &viewer).await;
 	let mut announced = viewer.consume().routes();
 	next_event(&mut announced).await;
@@ -284,8 +288,8 @@ async fn restart_while_the_old_session_lingers(version: &str, old_hop: u64, new_
 	old_session.server_transport.set_latency(Duration::from_secs(3600));
 
 	let new = produce_origin(new_hop);
-	let new_cam = new.publish("cam", origin::Route::default()).unwrap();
-	let new_video = new_cam.create_track("video", timed()).unwrap();
+	let new_cam = new.route("cam", moq_net::origin::RouteOptions::default()).unwrap();
+	let new_video = new_cam.broadcast().create_track("video", timed()).unwrap();
 	let _new_session = link(version, &new, &viewer).await;
 	kio::clock::sleep(PAST_HOLD).await;
 
diff --git a/rs/moq-net/tests/integration/request_caps.rs b/rs/moq-net/tests/integration/request_caps.rs
index 03ff43f92e4..6e3928fc3fa 100644
--- a/rs/moq-net/tests/integration/request_caps.rs
+++ b/rs/moq-net/tests/integration/request_caps.rs
@@ -27,7 +27,7 @@ fn produce_origin(hop: u64) -> moq_net::origin::Producer {
 struct Setup {
 	client: moq_net::origin::Producer,
 	_server: moq_net::origin::Producer,
-	_broadcast: moq_net::origin::Publication,
+	_broadcast: moq_net::origin::Route,
 	tracks: Vec<moq_net::track::Producer>,
 	_pair: MockPair,
 }
@@ -37,11 +37,11 @@ async fn setup(version: &str, limits: Limits, tracks: usize) -> Setup {
 	let server = produce_origin(1);
 	let client = produce_origin(2);
 
-	let broadcast = server.create_broadcast("bcast").unwrap();
+	let broadcast = server.route("bcast", moq_net::origin::RouteOptions::hidden()).unwrap();
 	let tracks = (0..tracks)
-		.map(|i| broadcast.create_track(format!("t{i}"), None).unwrap())
+		.map(|i| broadcast.broadcast().create_track(format!("t{i}"), None).unwrap())
 		.collect();
-	broadcast.announce(Default::default()).unwrap();
+	broadcast.announce().unwrap();
 
 	let mut options = MockConnectOptions::new(version);
 	options.server_publish = Some(server.consume());
@@ -113,11 +113,11 @@ async fn flow_control_bounds_the_subscriptions_a_peer_holds() {
 		let version: Version = version.parse().unwrap();
 		let server = produce_origin(1);
 		let client = produce_origin(2);
-		let broadcast = server.create_broadcast("bcast").unwrap();
+		let broadcast = server.route("bcast", moq_net::origin::RouteOptions::hidden()).unwrap();
 		let tracks: Vec<_> = (0..TRACKS)
-			.map(|i| broadcast.create_track(format!("t{i}"), None).unwrap())
+			.map(|i| broadcast.broadcast().create_track(format!("t{i}"), None).unwrap())
 			.collect();
-		broadcast.announce(Default::default()).unwrap();
+		broadcast.announce().unwrap();
 
 		let mut options = MockConnectOptions::new(version);
 		options.transport.max_concurrent_bi_streams = Some(BOUND);
@@ -164,10 +164,10 @@ async fn an_announce_past_the_cap_closes_the_session() {
 		let version: Version = version.parse().unwrap();
 		let client = produce_origin(1);
 		let server = produce_origin(2);
-		let a = client.create_broadcast("a").unwrap();
-		let b = client.create_broadcast("b").unwrap();
-		a.announce(Default::default()).unwrap();
-		b.announce(Default::default()).unwrap();
+		let a = client.route("a", moq_net::origin::RouteOptions::hidden()).unwrap();
+		let b = client.route("b", moq_net::origin::RouteOptions::hidden()).unwrap();
+		a.announce().unwrap();
+		b.announce().unwrap();
 
 		let mut options = MockConnectOptions::new(version);
 		options.client_publish = Some(client.consume());
diff --git a/rs/moq-net/tests/integration/route_change.rs b/rs/moq-net/tests/integration/route_change.rs
index 2052cade2ce..ee1e11420e4 100644
--- a/rs/moq-net/tests/integration/route_change.rs
+++ b/rs/moq-net/tests/integration/route_change.rs
@@ -104,7 +104,7 @@ struct Topology {
 	publisher: origin::Producer,
 	relay_b: origin::Producer,
 	subscriber: origin::Producer,
-	_broadcast: moq_net::origin::Publication,
+	_broadcast: moq_net::origin::Route,
 	track: track::Producer,
 	p_to_a: Option<MockPair>,
 	a_to_r: Option<MockPair>,
@@ -121,11 +121,11 @@ impl Topology {
 		let relay_b = produce_origin(3);
 		let subscriber = produce_origin(4);
 
-		let broadcast = publisher.create_broadcast("live").unwrap();
-		let track = broadcast.create_track("video", timed()).unwrap();
-		broadcast
-			.announce(origin::Route::default().with_instance(moq_net::Instance::random(), 0))
+		let broadcast = publisher
+			.route("live", moq_net::origin::RouteOptions::hidden())
 			.unwrap();
+		let track = broadcast.broadcast().create_track("video", timed()).unwrap();
+		broadcast.announce().unwrap();
 
 		let p_to_a = link(version, &publisher, &relay_a).await;
 		let p_to_b = link(version, &publisher, &relay_b).await;
@@ -396,14 +396,15 @@ async fn route_dies_across_instances(version: &str, trigger: Trigger) {
 	let relay_b = produce_origin(4);
 	let relay = produce_origin(5);
 	let downstream = produce_origin(6);
-	let broadcast_a = publisher_a.publish("live", origin::Route::default()).unwrap();
-	let broadcast_b = publisher_b.publish("live", origin::Route::default()).unwrap();
-	let track_a = broadcast_a.create_track("video", timed()).unwrap();
-	let track_b = broadcast_b.create_track("video", timed()).unwrap();
-	assert_ne!(
-		broadcast_a.route().unwrap().instance,
-		broadcast_b.route().unwrap().instance
-	);
+	let broadcast_a = publisher_a
+		.route("live", moq_net::origin::RouteOptions::default())
+		.unwrap();
+	let broadcast_b = publisher_b
+		.route("live", moq_net::origin::RouteOptions::default())
+		.unwrap();
+	let track_a = broadcast_a.broadcast().create_track("video", timed()).unwrap();
+	let track_b = broadcast_b.broadcast().create_track("video", timed()).unwrap();
+	assert_ne!(broadcast_a.instance(), broadcast_b.instance());
 
 	let p_to_a = link(version, &publisher_a, &relay_a).await;
 	let _p_to_b = link(version, &publisher_b, &relay_b).await;
@@ -455,8 +456,8 @@ async fn route_dies_across_instances(version: &str, trigger: Trigger) {
 			origin::RouteEvent::Restart(announce) => {
 				assert_eq!(announce.prefix.as_str(), "live");
 				assert_eq!(
-					announce.route.instance,
-					broadcast_b.route().unwrap().instance,
+					announce.route.instance(),
+					&broadcast_b.instance(),
 					"{version} {trigger:?}: restarted onto the wrong instance"
 				);
 			}
@@ -520,7 +521,7 @@ async fn better_route_restarts(version: &str) {
 	match announced.next().await.expect("announced") {
 		origin::RouteEvent::Restart(announce) => {
 			assert_eq!(announce.prefix.as_str(), "live");
-			assert_eq!(announce.route.hops.len(), 1, "{version}: the direct route");
+			assert_eq!(announce.route.hops().len(), 1, "{version}: the direct route");
 		}
 		other => panic!("{version}: expected a restart, got {other:?}"),
 	}
@@ -706,11 +707,9 @@ async fn lagging_route_dies(version: Version) {
 		produce_origin(4),
 		produce_origin(5),
 	);
-	let broadcast = p.create_broadcast("live").unwrap();
-	let track = broadcast.create_track("video", timed()).unwrap();
-	broadcast
-		.announce(origin::Route::default().with_instance(moq_net::Instance::random(), 0))
-		.unwrap();
+	let broadcast = p.route("live", moq_net::origin::RouteOptions::hidden()).unwrap();
+	let track = broadcast.broadcast().create_track("video", timed()).unwrap();
+	broadcast.announce().unwrap();
 	let p_a = lagged(version, &p, &a, Duration::from_millis(300)).await;
 	let p_b = lagged(version, &p, &b, Duration::ZERO).await;
 	let a_r = lagged(version, &a, &r, Duration::ZERO).await;
@@ -795,11 +794,9 @@ async fn undetected_outage(budget: Duration) -> BTreeMap<u64, Vec<String>> {
 		produce_origin(4),
 		produce_origin(5),
 	);
-	let broadcast = p.create_broadcast("live").unwrap();
-	let track = broadcast.create_track("video", timed()).unwrap();
-	broadcast
-		.announce(origin::Route::default().with_instance(moq_net::Instance::random(), 0))
-		.unwrap();
+	let broadcast = p.route("live", moq_net::origin::RouteOptions::hidden()).unwrap();
+	let track = broadcast.broadcast().create_track("video", timed()).unwrap();
+	broadcast.announce().unwrap();
 	let p_o = link(version, &p, &o).await;
 	let o_m1 = link(version, &o, &m1).await;
 	let o_m2 = link(version, &o, &m2).await;
@@ -922,7 +919,7 @@ struct Replica {
 	/// Tags its payloads, so the reader shows which replica served each frame.
 	name: &'static str,
 	origin: origin::Producer,
-	broadcast: moq_net::origin::Publication,
+	broadcast: moq_net::origin::Route,
 	track: track::Producer,
 	group: Option<moq_net::group::Producer>,
 	link: Option<MockPair>,
@@ -938,9 +935,11 @@ async fn redundant_pair_follows_the_next_instance(version: &str, loss: Loss) {
 	let mut replicas = Vec::new();
 	for (name, hop, cost) in [("P1", 1, 1), ("P2", 2, 5)] {
 		let publisher = produce_origin(hop);
-		let broadcast = publisher.create_broadcast("live").unwrap();
-		let track = broadcast.create_track("video", timed()).unwrap();
-		broadcast.announce(origin::Route::default().with_cost(cost)).unwrap();
+		let broadcast = publisher
+			.route("live", origin::RouteOptions::hidden().with_cost(cost))
+			.unwrap();
+		let track = broadcast.broadcast().create_track("video", timed()).unwrap();
+		broadcast.announce().unwrap();
 		let link = link(version, &publisher, &subscriber).await;
 		replicas.push(Replica {
 			name,
@@ -1051,9 +1050,11 @@ async fn replaced_behind_a_relay(version: &str) {
 	let mut replicas = Vec::new();
 	for (name, hop, cost) in [("P1", 1, None), ("P2", 2, Some(1_000))] {
 		let publisher = produce_origin(hop);
-		let broadcast = publisher.create_broadcast("live").unwrap();
-		let track = broadcast.create_track("video", timed()).unwrap();
-		broadcast.announce(origin::Route::default()).unwrap();
+		let broadcast = publisher
+			.route("live", moq_net::origin::RouteOptions::hidden())
+			.unwrap();
+		let track = broadcast.broadcast().create_track("video", timed()).unwrap();
+		broadcast.announce().unwrap();
 		let link = priced_link(version, &publisher, &relay, cost).await;
 		replicas.push(Replica {
 			name,
@@ -1150,13 +1151,17 @@ async fn compression_changes_behind_a_relay(compress: bool) {
 	let mut replicas = Vec::new();
 	for (name, hop, cost, compress) in [("P1", 1, None, true), ("P2", 2, Some(1_000), compress)] {
 		let publisher = produce_origin(hop);
-		let broadcast = publisher.create_broadcast("live").unwrap();
+		let broadcast = publisher
+			.route(
+				"live",
+				origin::RouteOptions::hidden().with_instance(instance.clone(), 0),
+			)
+			.unwrap();
 		let track = broadcast
+			.broadcast()
 			.create_track("video", timed().with_compress(compress))
 			.unwrap();
-		broadcast
-			.announce(origin::Route::default().with_instance(instance.clone(), 0))
-			.unwrap();
+		broadcast.announce().unwrap();
 		let link = priced_link(version, &publisher, &relay, cost).await;
 		replicas.push(Replica {
 			name,
@@ -1252,11 +1257,11 @@ async fn producer_replaced(version: &str) {
 	let relay = produce_origin(2);
 	let subscriber = produce_origin(3);
 
-	let broadcast = publisher.create_broadcast("live").unwrap();
-	let mut dynamic = broadcast.requests();
-	broadcast
-		.announce(origin::Route::default().with_instance(moq_net::Instance::random(), 0))
+	let broadcast = publisher
+		.route("live", moq_net::origin::RouteOptions::hidden())
 		.unwrap();
+	let mut dynamic = broadcast.broadcast().requests();
+	broadcast.announce().unwrap();
 	let (tx, mut producers) = mpsc::unbounded();
 	kio::clock::sim::spawn(async move {
 		while let Ok(request) = dynamic.requested_track().await {
diff --git a/rs/moq-net/tests/integration/route_health.rs b/rs/moq-net/tests/integration/route_health.rs
index bd9ba49a735..e573ab5e8b9 100644
--- a/rs/moq-net/tests/integration/route_health.rs
+++ b/rs/moq-net/tests/integration/route_health.rs
@@ -54,11 +54,9 @@ async fn silent_kill(budget: Duration, detect: Duration) -> Vec<u64> {
 		produce_origin(4),
 		produce_origin(5),
 	);
-	let broadcast = p.create_broadcast("live").unwrap();
-	let track = broadcast.create_track("video", timed()).unwrap();
-	broadcast
-		.announce(origin::Route::default().with_instance(moq_net::Instance::random(), 0))
-		.unwrap();
+	let broadcast = p.route("live", moq_net::origin::RouteOptions::hidden()).unwrap();
+	let track = broadcast.broadcast().create_track("video", timed()).unwrap();
+	broadcast.announce().unwrap();
 	let p_o = link(version, &p, &o).await;
 	let o_m1 = link(version, &o, &m1).await;
 	let o_m2 = link(version, &o, &m2).await;
@@ -197,11 +195,9 @@ async fn payload_stall(stall: Stall, span: Duration) -> (Observed, Observed) {
 		produce_origin(5),
 		produce_origin(6),
 	);
-	let broadcast = p.create_broadcast("live").unwrap();
-	let track = broadcast.create_track("video", timed()).unwrap();
-	broadcast
-		.announce(origin::Route::default().with_instance(moq_net::Instance::random(), 0))
-		.unwrap();
+	let broadcast = p.route("live", moq_net::origin::RouteOptions::hidden()).unwrap();
+	let track = broadcast.broadcast().create_track("video", timed()).unwrap();
+	broadcast.announce().unwrap();
 	let p_o = link(version, &p, &o).await;
 	let o_m1 = link(version, &o, &m1).await;
 	let o_m2 = link(version, &o, &m2).await;
diff --git a/rs/moq-net/tests/integration/segmented_frame.rs b/rs/moq-net/tests/integration/segmented_frame.rs
index a5a8e993db6..fc8d33bbf54 100644
--- a/rs/moq-net/tests/integration/segmented_frame.rs
+++ b/rs/moq-net/tests/integration/segmented_frame.rs
@@ -30,10 +30,12 @@ async fn a_segmented_frame_crosses_whole() {
 		let version: Version = version.parse().unwrap();
 		let publisher = origin(1);
 		let viewer = origin(2);
-		let broadcast = publisher.create_broadcast("room").unwrap();
+		let broadcast = publisher
+			.route("room", moq_net::origin::RouteOptions::hidden())
+			.unwrap();
 		let info = track::Info::default().with_timescale(moq_net::Timescale::MILLI);
-		let track = broadcast.create_track("file", info).unwrap();
-		broadcast.announce(Default::default()).unwrap();
+		let track = broadcast.broadcast().create_track("file", info).unwrap();
+		broadcast.announce().unwrap();
 
 		let mut options = MockConnectOptions::new(version);
 		options.server_publish = Some(publisher.consume());
diff --git a/rs/moq-net/tests/integration/session_close.rs b/rs/moq-net/tests/integration/session_close.rs
index 9793f301523..d65d5206a72 100644
--- a/rs/moq-net/tests/integration/session_close.rs
+++ b/rs/moq-net/tests/integration/session_close.rs
@@ -33,7 +33,7 @@ struct Setup {
 	pair: MockPair,
 	track: moq_net::track::Producer,
 	reader: kio::clock::sim::JoinHandle<Read>,
-	_broadcast: moq_net::origin::Publication,
+	_broadcast: moq_net::origin::Route,
 }
 
 async fn setup(version: &str) -> Setup {
@@ -42,9 +42,11 @@ async fn setup(version: &str) -> Setup {
 
 async fn setup_with_gate(version: &str, gate: Option<kio::Consumer<bool>>) -> Setup {
 	let publisher = produce_origin(1);
-	let broadcast = publisher.create_broadcast("bcast").unwrap();
-	let track = broadcast.create_track("video", timed()).unwrap();
-	broadcast.announce(Default::default()).unwrap();
+	let broadcast = publisher
+		.route("bcast", moq_net::origin::RouteOptions::hidden())
+		.unwrap();
+	let track = broadcast.broadcast().create_track("video", timed()).unwrap();
+	broadcast.announce().unwrap();
 
 	let subscriber = produce_origin(2);
 	let mut options = MockConnectOptions::new(version.parse::<Version>().unwrap());
@@ -105,9 +107,11 @@ async fn setup_with_gate(version: &str, gate: Option<kio::Consumer<bool>>) -> Se
 async fn track_info_interest_precedes_a_subscription() {
 	for version in ["moq-lite-05", "moq-lite-06", "moq-lite-07-wip"] {
 		let publisher = produce_origin(1);
-		let broadcast = publisher.create_broadcast("bcast").unwrap();
-		let track = broadcast.create_track("video", timed()).unwrap();
-		broadcast.announce(Default::default()).unwrap();
+		let broadcast = publisher
+			.route("bcast", moq_net::origin::RouteOptions::hidden())
+			.unwrap();
+		let track = broadcast.broadcast().create_track("video", timed()).unwrap();
+		broadcast.announce().unwrap();
 		let subscriber = produce_origin(2);
 		let mut options = MockConnectOptions::new(version.parse().unwrap());
 		options.server_publish = Some(publisher.consume());
@@ -233,8 +237,10 @@ async fn abort_cuts_a_drain_short_for(version: &str) {
 async fn close_withdraws_announcements_before_closing_the_transport() {
 	for version in ["moq-lite-01", "moq-lite-07-wip", "moq-transport-18", "moq-transport-22"] {
 		let publisher = produce_origin(1);
-		let broadcast = publisher.create_broadcast("bcast").unwrap();
-		broadcast.announce(Default::default()).unwrap();
+		let broadcast = publisher
+			.route("bcast", moq_net::origin::RouteOptions::hidden())
+			.unwrap();
+		broadcast.announce().unwrap();
 		let subscriber = produce_origin(2);
 		let mut options = MockConnectOptions::new(version.parse().unwrap());
 		options.client_publish = Some(publisher.consume());
@@ -254,8 +260,10 @@ async fn close_withdraws_announcements_before_closing_the_transport() {
 async fn close_times_out_waiting_for_announcement_acknowledgements() {
 	for version in ["moq-lite-01", "moq-lite-07-wip", "moq-transport-18", "moq-transport-22"] {
 		let publisher = produce_origin(1);
-		let broadcast = publisher.create_broadcast("bcast").unwrap();
-		broadcast.announce(Default::default()).unwrap();
+		let broadcast = publisher
+			.route("bcast", moq_net::origin::RouteOptions::hidden())
+			.unwrap();
+		broadcast.announce().unwrap();
 		let subscriber = produce_origin(2);
 		let mut options = MockConnectOptions::new(version.parse().unwrap());
 		options.client_publish = Some(publisher.consume());
diff --git a/rs/moq-net/tests/integration/session_idle.rs b/rs/moq-net/tests/integration/session_idle.rs
index 7e798485a75..83fc89bb478 100644
--- a/rs/moq-net/tests/integration/session_idle.rs
+++ b/rs/moq-net/tests/integration/session_idle.rs
@@ -34,14 +34,16 @@ struct Setup {
 	pair: MockPair,
 	track: moq_net::track::Producer,
 	remote: moq_net::broadcast::Consumer,
-	_broadcast: moq_net::origin::Publication,
+	_broadcast: moq_net::origin::Route,
 }
 
 async fn setup(version: &str) -> Setup {
 	let publisher = produce_origin(1);
-	let broadcast = publisher.create_broadcast("bcast").unwrap();
-	let track = broadcast.create_track("video", timed()).unwrap();
-	broadcast.announce(Default::default()).unwrap();
+	let broadcast = publisher
+		.route("bcast", moq_net::origin::RouteOptions::hidden())
+		.unwrap();
+	let track = broadcast.broadcast().create_track("video", timed()).unwrap();
+	broadcast.announce().unwrap();
 
 	let subscriber = produce_origin(2);
 	let mut options = MockConnectOptions::new(version.parse::<Version>().unwrap());
diff --git a/rs/moq-net/tests/integration/session_panic.rs b/rs/moq-net/tests/integration/session_panic.rs
index ecd374fb214..08799c1b57e 100644
--- a/rs/moq-net/tests/integration/session_panic.rs
+++ b/rs/moq-net/tests/integration/session_panic.rs
@@ -34,13 +34,13 @@ struct Publisher {
 	server_driver: kio::clock::sim::JoinHandle<moq_net::Error>,
 	/// The client's origin, which it publishes from.
 	origin: origin::Producer,
-	_broadcast: moq_net::origin::Publication,
+	_broadcast: moq_net::origin::Route,
 }
 
 async fn publish(version: Version, relay: &origin::Producer, hop: u64, name: &str) -> Publisher {
 	let origin = produce_origin(hop);
-	let broadcast = origin.create_broadcast(name).unwrap();
-	broadcast.announce(Default::default()).unwrap();
+	let broadcast = origin.route(name, moq_net::origin::RouteOptions::hidden()).unwrap();
+	broadcast.announce().unwrap();
 
 	let mut mock = moq_net::transport::memory::Config::default();
 	mock.protocol = Some(version.alpn().to_string());
@@ -125,8 +125,11 @@ async fn a_panicking_session_leaves_the_others_serving() {
 			.unwrap_or_else(|_| panic!("{version}: the panicked session never closed"));
 
 		// The other session still serves: a fresh announcement reaches the relay.
-		let later = healthy.origin.create_broadcast("later").unwrap();
-		later.announce(Default::default()).unwrap();
+		let later = healthy
+			.origin
+			.route("later", moq_net::origin::RouteOptions::hidden())
+			.unwrap();
+		later.announce().unwrap();
 		until(&mut announced, "later", true).await;
 		crate::support::announced(&relay.consume(), "healthy").await;
 		drop((healthy, broken.client, later));
diff --git a/rs/moq-net/tests/integration/settled_end_survives_abort.rs b/rs/moq-net/tests/integration/settled_end_survives_abort.rs
index 7aa4ab64f2e..6af9a412c46 100644
--- a/rs/moq-net/tests/integration/settled_end_survives_abort.rs
+++ b/rs/moq-net/tests/integration/settled_end_survives_abort.rs
@@ -30,8 +30,8 @@ const GROUPS: u64 = 2;
 /// or in sequence order, and how the read ended.
 async fn round(abort: bool, ordered: bool) -> (Vec<u64>, Option<Error>) {
 	let origin = produce_origin(1);
-	let broadcast = origin.create_broadcast("bcast").unwrap();
-	let mut track = broadcast.create_track("video", timed()).unwrap();
+	let broadcast = origin.route("bcast", moq_net::origin::RouteOptions::hidden()).unwrap();
+	let mut track = broadcast.broadcast().create_track("video", timed()).unwrap();
 	// From the first group with a replay window: a late reader is owed the whole track,
 	// not the live edge.
 	let subscription = moq_net::track::Subscription::default()
diff --git a/rs/moq-net/tests/integration/setup_negotiation.rs b/rs/moq-net/tests/integration/setup_negotiation.rs
index 48c7fffa682..79b5df79a09 100644
--- a/rs/moq-net/tests/integration/setup_negotiation.rs
+++ b/rs/moq-net/tests/integration/setup_negotiation.rs
@@ -57,8 +57,8 @@ async fn every_lite_version_negotiates_in_setup() {
 		let version: Version = name.parse().unwrap();
 		let versions: Versions = vec![version, "moq-lite-02".parse().unwrap()].into();
 		let (upstream, downstream) = (origin(), origin());
-		let broadcast = upstream.create_broadcast("room").unwrap();
-		broadcast.announce(Default::default()).unwrap();
+		let broadcast = upstream.route("room", moq_net::origin::RouteOptions::hidden()).unwrap();
+		broadcast.announce().unwrap();
 
 		let (client, server) = dial(versions.clone(), versions, &upstream, &downstream).await;
 		let sessions = [client.unwrap(), server.unwrap()];
diff --git a/rs/moq-net/tests/integration/slow_joiner.rs b/rs/moq-net/tests/integration/slow_joiner.rs
index 87aa0ca22b8..39d068a918d 100644
--- a/rs/moq-net/tests/integration/slow_joiner.rs
+++ b/rs/moq-net/tests/integration/slow_joiner.rs
@@ -30,8 +30,11 @@ async fn stalled_read(version: Version, budget: Duration) -> BTreeSet<u64> {
 	let publisher = origin(1);
 	let relay = origin(2);
 	let viewer = origin(3);
-	let broadcast = publisher.create_broadcast("live").unwrap();
+	let broadcast = publisher
+		.route("live", moq_net::origin::RouteOptions::hidden())
+		.unwrap();
 	let source = broadcast
+		.broadcast()
 		.create_track(
 			"audio",
 			track::Info::default()
@@ -39,7 +42,7 @@ async fn stalled_read(version: Version, budget: Duration) -> BTreeSet<u64> {
 				.with_max_age(None),
 		)
 		.unwrap();
-	broadcast.announce(Default::default()).unwrap();
+	broadcast.announce().unwrap();
 
 	let mut upstream = MockConnectOptions::new(version);
 	upstream.client_publish = Some(publisher.consume());
diff --git a/rs/moq-net/tests/integration/socket.rs b/rs/moq-net/tests/integration/socket.rs
index 7439ec46e6b..40cac69da67 100644
--- a/rs/moq-net/tests/integration/socket.rs
+++ b/rs/moq-net/tests/integration/socket.rs
@@ -284,16 +284,18 @@ struct ByHand {
 	/// Carol's half, which she writes groups to as she likes.
 	half: track::Producer,
 	_dialed: track::Subscriber,
-	_endpoint: origin::Publication,
+	_endpoint: origin::Route,
 	_carol: origin::Producer,
 }
 
 /// Dial bob by hand from carol in a `tcp` session.
 async fn dial_by_hand(fixture: &mut Fixture, bob: &Endpoint) -> ByHand {
 	let carol = fixture.client(LITE).await;
-	let endpoint = carol.create_broadcast("room/.socket/carol").unwrap();
-	endpoint.announce(Default::default()).unwrap();
-	let mut requests = endpoint.requests();
+	let endpoint = carol
+		.route("room/.socket/carol", moq_net::origin::RouteOptions::hidden())
+		.unwrap();
+	endpoint.announce().unwrap();
+	let mut requests = endpoint.broadcast().requests();
 	let name = "tcp/carol/bob/0123456789abcdef0123456789abcdef";
 	let broadcast = kio::clock::timeout(TIMEOUT, carol.consume().request("room/.socket/bob", None))
 		.await
@@ -605,9 +607,11 @@ async fn an_accept_waits_for_its_dialer() {
 		"bob's accept ended before carol announced"
 	);
 
-	let endpoint = carol.create_broadcast("room/.socket/carol").unwrap();
-	let mut requests = endpoint.requests();
-	endpoint.announce(Default::default()).unwrap();
+	let endpoint = carol
+		.route("room/.socket/carol", moq_net::origin::RouteOptions::hidden())
+		.unwrap();
+	let mut requests = endpoint.broadcast().requests();
+	endpoint.announce().unwrap();
 	let answer = async {
 		let request = kio::wait(|waiter| requests.poll_requested_track(waiter)).await.unwrap();
 		assert_eq!(request.name(), name);
diff --git a/rs/moq-net/tests/integration/source_errors.rs b/rs/moq-net/tests/integration/source_errors.rs
index c85b21983a2..426cdf5a2c3 100644
--- a/rs/moq-net/tests/integration/source_errors.rs
+++ b/rs/moq-net/tests/integration/source_errors.rs
@@ -31,7 +31,7 @@ fn produce_origin(hop: u64) -> moq_net::origin::Producer {
 /// to the relay, with `bcast` resolved at the relay and the far end.
 struct Relayed {
 	_publisher: moq_net::origin::Producer,
-	broadcast: moq_net::origin::Publication,
+	broadcast: moq_net::origin::Route,
 	upstream: MockPair,
 	_downstream: MockPair,
 	relayed: moq_net::broadcast::Consumer,
@@ -52,8 +52,10 @@ async fn relayed(version: &str) -> Relayed {
 	let publisher = produce_origin(1);
 	let relay = produce_origin(2);
 	let far = produce_origin(3);
-	let broadcast = publisher.create_broadcast("bcast").unwrap();
-	broadcast.announce(Default::default()).unwrap();
+	let broadcast = publisher
+		.route("bcast", moq_net::origin::RouteOptions::hidden())
+		.unwrap();
+	broadcast.announce().unwrap();
 
 	let mut options = MockConnectOptions::new(version);
 	options.server_publish = Some(publisher.consume());
@@ -106,7 +108,7 @@ fn assert_ended(result: Result<(), Error>, expected: StreamError, version: &str)
 async fn request_in_flight_to_a_dead_upstream_is_unroutable() {
 	for version in VERSIONS {
 		let setup = relayed(version).await;
-		let _track = setup.broadcast.create_track("catalog", timed()).unwrap();
+		let _track = setup.broadcast.broadcast().create_track("catalog", timed()).unwrap();
 		// The relay's requests never reach the publisher.
 		setup.upstream.client_transport.hold_bidis();
 		let relayed = kio::clock::sim::spawn(read_to_end(setup.relayed.clone(), "catalog"));
@@ -130,7 +132,7 @@ async fn request_in_flight_to_a_dead_upstream_is_unroutable() {
 async fn track_in_flight_through_a_dead_upstream_is_unroutable() {
 	for version in VERSIONS {
 		let setup = relayed(version).await;
-		let track = setup.broadcast.create_track("video", timed()).unwrap();
+		let track = setup.broadcast.broadcast().create_track("video", timed()).unwrap();
 		let mut sub = setup.remote.track("video").unwrap().subscribe(None).await.unwrap();
 		let mut group = track.append_group().unwrap();
 		group.write_frame(Timestamp::ZERO, b"head".as_ref()).unwrap();
@@ -158,7 +160,7 @@ async fn track_in_flight_through_a_dead_upstream_is_unroutable() {
 async fn withdrawn_broadcast_keeps_the_source_error() {
 	for version in VERSIONS {
 		let setup = relayed(version).await;
-		let track = setup.broadcast.create_track("video", timed()).unwrap();
+		let track = setup.broadcast.broadcast().create_track("video", timed()).unwrap();
 		let mut sub = setup.remote.track("video").unwrap().subscribe(None).await.unwrap();
 		let mut group = track.append_group().unwrap();
 		group.write_frame(Timestamp::ZERO, b"head".as_ref()).unwrap();
@@ -168,7 +170,7 @@ async fn withdrawn_broadcast_keeps_the_source_error() {
 			.expect("group timeout")
 			.unwrap()
 			.unwrap();
-		setup.broadcast.unannounce();
+		setup.broadcast.withdraw();
 		kio::clock::sleep(Duration::from_secs(1)).await;
 		track.abort(Error::App(7)).unwrap();
 		let result = kio::clock::timeout(TIMEOUT, async {
@@ -186,8 +188,8 @@ async fn withdrawn_broadcast_keeps_the_source_error() {
 async fn subscribe_after_withdrawal_is_unroutable() {
 	for version in VERSIONS {
 		let setup = relayed(version).await;
-		let _track = setup.broadcast.create_track("video", timed()).unwrap();
-		setup.broadcast.unannounce();
+		let _track = setup.broadcast.broadcast().create_track("video", timed()).unwrap();
+		setup.broadcast.withdraw();
 		kio::clock::sleep(Duration::from_secs(1)).await;
 		for broadcast in [setup.relayed.clone(), setup.remote.clone()] {
 			let result = kio::clock::timeout(TIMEOUT, read_to_end(broadcast, "video"))
diff --git a/rs/moq-net/tests/integration/stream_credit.rs b/rs/moq-net/tests/integration/stream_credit.rs
index 963b555f7d0..82e83f2d486 100644
--- a/rs/moq-net/tests/integration/stream_credit.rs
+++ b/rs/moq-net/tests/integration/stream_credit.rs
@@ -21,14 +21,21 @@ async fn one_stream_credit_serves_every_backlogged_group() {
 		let version: Version = version.parse().unwrap();
 		let publisher = origin(1);
 		let viewer = origin(2);
-		let broadcast = publisher.create_broadcast("live").unwrap();
+		let broadcast = publisher
+			.route("live", moq_net::origin::RouteOptions::hidden())
+			.unwrap();
 		let info = track::Info::default()
 			.with_timescale(moq_net::Timescale::MILLI)
 			.with_max_age(None);
 		let tracks: Vec<_> = (0..2)
-			.map(|i| broadcast.create_track(format!("{i}"), info.clone()).unwrap())
+			.map(|i| {
+				broadcast
+					.broadcast()
+					.create_track(format!("{i}"), info.clone())
+					.unwrap()
+			})
 			.collect();
-		broadcast.announce(Default::default()).unwrap();
+		broadcast.announce().unwrap();
 
 		let mut options = MockConnectOptions::new(version);
 		// Draft 22 keeps its SETUP stream open, so it needs one more for groups.
@@ -87,13 +94,15 @@ async fn a_subscription_past_the_credit_is_served_once_credit_returns() {
 		let version: Version = version.parse().unwrap();
 		let publisher = origin(1);
 		let viewer = origin(2);
-		let broadcast = publisher.create_broadcast("live").unwrap();
+		let broadcast = publisher
+			.route("live", moq_net::origin::RouteOptions::hidden())
+			.unwrap();
 		let info = track::Info::default()
 			.with_timescale(moq_net::Timescale::MILLI)
 			.with_max_age(None);
-		let first = broadcast.create_track("first", info.clone()).unwrap();
-		let second = broadcast.create_track("second", info).unwrap();
-		broadcast.announce(Default::default()).unwrap();
+		let first = broadcast.broadcast().create_track("first", info.clone()).unwrap();
+		let second = broadcast.broadcast().create_track("second", info).unwrap();
+		broadcast.announce().unwrap();
 
 		let mut options = MockConnectOptions::new(version);
 		options.transport.max_concurrent_bi_streams = Some(credit);
diff --git a/rs/moq-net/tests/integration/subscribe_priority.rs b/rs/moq-net/tests/integration/subscribe_priority.rs
index 65ba7482252..2f66d8f0428 100644
--- a/rs/moq-net/tests/integration/subscribe_priority.rs
+++ b/rs/moq-net/tests/integration/subscribe_priority.rs
@@ -48,11 +48,14 @@ async fn priority(track: &moq_net::track::Producer, want: i8) -> Result<(), Stri
 /// publisher sees the priority rise and fall back.
 async fn follows(version: Version, relay: bool) -> Result<(), String> {
 	let publisher = produce_origin(1);
-	let broadcast = publisher.create_broadcast("bcast").unwrap();
+	let broadcast = publisher
+		.route("bcast", moq_net::origin::RouteOptions::hidden())
+		.unwrap();
 	let track = broadcast
+		.broadcast()
 		.create_track("video", Info::default().with_timescale(Timescale::MILLI))
 		.unwrap();
-	broadcast.announce(Default::default()).unwrap();
+	broadcast.announce().unwrap();
 
 	let relay_origin = produce_origin(2);
 	let subscriber = produce_origin(3);
diff --git a/rs/moq-net/tests/integration/subscribe_ranges.rs b/rs/moq-net/tests/integration/subscribe_ranges.rs
index 30d0ea13136..021037d8204 100644
--- a/rs/moq-net/tests/integration/subscribe_ranges.rs
+++ b/rs/moq-net/tests/integration/subscribe_ranges.rs
@@ -68,9 +68,11 @@ async fn subscribe(remote: &moq_net::broadcast::Consumer, subscription: Subscrip
 /// one joins.
 async fn ahead_then_live(version: Option<&str>, relay: bool) -> (Vec<u64>, Vec<u64>) {
 	let publisher = produce_origin(1);
-	let broadcast = publisher.create_broadcast("bcast").unwrap();
-	let track = broadcast.create_track("quiet", timed()).unwrap();
-	broadcast.announce(Default::default()).unwrap();
+	let broadcast = publisher
+		.route("bcast", moq_net::origin::RouteOptions::hidden())
+		.unwrap();
+	let track = broadcast.broadcast().create_track("quiet", timed()).unwrap();
+	broadcast.announce().unwrap();
 	for sequence in 0..=3 {
 		write_group(&track, sequence);
 	}
@@ -79,7 +81,7 @@ async fn ahead_then_live(version: Option<&str>, relay: bool) -> (Vec<u64>, Vec<u
 	let subscriber = produce_origin(3);
 	let mut sessions = Vec::new();
 	let remote = match version {
-		None => broadcast.consume(),
+		None => broadcast.broadcast().consume(),
 		Some(version) => {
 			let version: Version = version.parse().unwrap();
 			if relay {
@@ -132,9 +134,11 @@ async fn sparse_ranges_reach_the_publisher_on_lite07() {
 	let sparse = [Range::groups(0..1), Range::groups(3..4)];
 	for version in LITE {
 		let publisher = produce_origin(1);
-		let broadcast = publisher.create_broadcast("bcast").unwrap();
-		let track = broadcast.create_track("quiet", timed()).unwrap();
-		broadcast.announce(Default::default()).unwrap();
+		let broadcast = publisher
+			.route("bcast", moq_net::origin::RouteOptions::hidden())
+			.unwrap();
+		let track = broadcast.broadcast().create_track("quiet", timed()).unwrap();
+		broadcast.announce().unwrap();
 
 		let subscriber = produce_origin(2);
 		let mut options = MockConnectOptions::new(version.parse::<Version>().unwrap());
@@ -202,7 +206,7 @@ struct RangeFixture {
 	remote: moq_net::broadcast::Consumer,
 	_sessions: Vec<support::harness::MockPair>,
 	_origins: [moq_net::origin::Producer; 3],
-	_broadcast: moq_net::origin::Publication,
+	_broadcast: moq_net::origin::Route,
 }
 
 async fn range_fixture(relay: bool) -> RangeFixture {
@@ -215,9 +219,11 @@ async fn range_fixture_version(version: &str, relay: bool) -> RangeFixture {
 
 async fn range_fixture_history(version: &str, relay: bool, history: u64) -> RangeFixture {
 	let publisher = produce_origin(1);
-	let broadcast = publisher.create_broadcast("ranges").unwrap();
-	let track = broadcast.create_track("quiet", timed()).unwrap();
-	broadcast.announce(Default::default()).unwrap();
+	let broadcast = publisher
+		.route("ranges", moq_net::origin::RouteOptions::hidden())
+		.unwrap();
+	let track = broadcast.broadcast().create_track("quiet", timed()).unwrap();
+	broadcast.announce().unwrap();
 	for sequence in 0..history {
 		let mut group = track.create_group(moq_net::group::Info { sequence }).unwrap();
 		group
@@ -754,9 +760,11 @@ async fn unresolved_time_reader_never_changes_sibling_demand() {
 async fn a_covered_bounded_subscription_stays_open() {
 	for version in LITE {
 		let publisher = produce_origin(1);
-		let broadcast = publisher.create_broadcast("bcast").unwrap();
-		let track = broadcast.create_track("quiet", timed()).unwrap();
-		broadcast.announce(Default::default()).unwrap();
+		let broadcast = publisher
+			.route("bcast", moq_net::origin::RouteOptions::hidden())
+			.unwrap();
+		let track = broadcast.broadcast().create_track("quiet", timed()).unwrap();
+		broadcast.announce().unwrap();
 		for sequence in [0, 1, 2, 4, 5] {
 			write_group(&track, sequence);
 		}
diff --git a/rs/moq-net/tests/integration/subscribe_tracks.rs b/rs/moq-net/tests/integration/subscribe_tracks.rs
index 9425c44b6db..c0b02d2a8e9 100644
--- a/rs/moq-net/tests/integration/subscribe_tracks.rs
+++ b/rs/moq-net/tests/integration/subscribe_tracks.rs
@@ -44,14 +44,16 @@ struct Setup {
 	pair: MockPair,
 	track: moq_net::track::Producer,
 	frames: futures::channel::mpsc::UnboundedReceiver<Vec<u8>>,
-	_broadcast: moq_net::origin::Publication,
+	_broadcast: moq_net::origin::Route,
 }
 
 async fn setup(version: Version) -> Setup {
 	let publisher = produce_origin(1);
-	let broadcast = publisher.create_broadcast("room").unwrap();
-	let track = broadcast.create_track("video", timed()).unwrap();
-	broadcast.announce(Default::default()).unwrap();
+	let broadcast = publisher
+		.route("room", moq_net::origin::RouteOptions::hidden())
+		.unwrap();
+	let track = broadcast.broadcast().create_track("video", timed()).unwrap();
+	broadcast.announce().unwrap();
 
 	let subscriber = produce_origin(2);
 	let mut options = MockConnectOptions::new(version);
diff --git a/rs/moq-net/tests/integration/subscribe_with_track.rs b/rs/moq-net/tests/integration/subscribe_with_track.rs
index 7f5e945a173..80517410d6b 100644
--- a/rs/moq-net/tests/integration/subscribe_with_track.rs
+++ b/rs/moq-net/tests/integration/subscribe_with_track.rs
@@ -66,8 +66,9 @@ async fn first_frame(version: &str, relays: usize, arrival: Arrival) -> Duration
 	}
 	let reader = &links.last().unwrap().client_transport;
 
-	let broadcast = nodes[0].create_broadcast("room").unwrap();
+	let broadcast = nodes[0].route("room", moq_net::origin::RouteOptions::hidden()).unwrap();
 	let track = broadcast
+		.broadcast()
 		.create_track(
 			"video",
 			moq_net::track::Info::default().with_timescale(moq_net::Timescale::MILLI),
@@ -76,7 +77,7 @@ async fn first_frame(version: &str, relays: usize, arrival: Arrival) -> Duration
 	let mut cached = track.append_group().unwrap();
 	cached.write_frame(Timestamp::ZERO, b"cached".as_ref()).unwrap();
 	cached.finish().unwrap();
-	broadcast.announce(Default::default()).unwrap();
+	broadcast.announce().unwrap();
 
 	let consumer = nodes.last().unwrap().consume();
 	let remote = consumer
diff --git a/rs/moq-net/tests/integration/subscriber_max_age.rs b/rs/moq-net/tests/integration/subscriber_max_age.rs
index ee474e46162..a8ae860d80a 100644
--- a/rs/moq-net/tests/integration/subscriber_max_age.rs
+++ b/rs/moq-net/tests/integration/subscriber_max_age.rs
@@ -39,8 +39,11 @@ async fn relay_forwards_the_most_tolerant_subscriber_max_age() {
 		let viewer = origin(3);
 		let _upstream = peer(version, &publisher, &relay).await;
 		let _downstream = peer(version, &relay, &viewer).await;
-		let broadcast = publisher.create_broadcast("live").unwrap();
+		let broadcast = publisher
+			.route("live", moq_net::origin::RouteOptions::hidden())
+			.unwrap();
 		let mut source = broadcast
+			.broadcast()
 			.create_track(
 				"catalog",
 				track::Info::default().with_timescale(moq_net::Timescale::MILLI),
@@ -49,7 +52,7 @@ async fn relay_forwards_the_most_tolerant_subscriber_max_age() {
 		let mut group = source.append_group().unwrap();
 		group.write_frame(Timestamp::ZERO, b"catalog").unwrap();
 		group.finish().unwrap();
-		broadcast.announce(Default::default()).unwrap();
+		broadcast.announce().unwrap();
 		let consumer = viewer.consume();
 		let remote = consumer
 			.follow("live", None)
@@ -111,8 +114,11 @@ async fn relay_forwards_the_smallest_stated_min_delay() {
 	let _upstream = peer(lite07, &publisher, &relay).await;
 	let _modern = peer(lite07, &relay, &modern).await;
 	let _legacy = peer(lite06, &relay, &legacy).await;
-	let broadcast = publisher.create_broadcast("live").unwrap();
+	let broadcast = publisher
+		.route("live", moq_net::origin::RouteOptions::hidden())
+		.unwrap();
 	let mut source = broadcast
+		.broadcast()
 		.create_track(
 			"catalog",
 			track::Info::default().with_timescale(moq_net::Timescale::MILLI),
@@ -121,7 +127,7 @@ async fn relay_forwards_the_smallest_stated_min_delay() {
 	let mut group = source.append_group().unwrap();
 	group.write_frame(Timestamp::ZERO, b"catalog").unwrap();
 	group.finish().unwrap();
-	broadcast.announce(Default::default()).unwrap();
+	broadcast.announce().unwrap();
 
 	let cache = |origin: &origin::Producer| {
 		let origin = origin.clone();
diff --git a/rs/moq-net/tests/integration/subscription_end_integrity.rs b/rs/moq-net/tests/integration/subscription_end_integrity.rs
index 6a2ec2d1daf..ffca1a3130d 100644
--- a/rs/moq-net/tests/integration/subscription_end_integrity.rs
+++ b/rs/moq-net/tests/integration/subscription_end_integrity.rs
@@ -56,9 +56,11 @@ fn expected() -> Vec<Vec<u8>> {
 /// payloads and the error it ended with, if any.
 async fn round(drop_session: bool) -> (Vec<Vec<u8>>, Option<moq_net::Error>) {
 	let publisher = produce_origin(1);
-	let broadcast = publisher.create_broadcast("bcast").unwrap();
-	let track = broadcast.create_track("video", timed()).unwrap();
-	broadcast.announce(Default::default()).unwrap();
+	let broadcast = publisher
+		.route("bcast", moq_net::origin::RouteOptions::hidden())
+		.unwrap();
+	let track = broadcast.broadcast().create_track("video", timed()).unwrap();
+	broadcast.announce().unwrap();
 
 	let subscriber = produce_origin(2);
 	let mut options = MockConnectOptions::new("moq-lite-05".parse::<Version>().unwrap());
@@ -214,9 +216,11 @@ enum Kill {
 /// `recv_group` and that group end with once it drains what arrived.
 async fn killed(version: &str, kill: Kill) -> (Option<moq_net::Error>, Option<moq_net::Error>) {
 	let publisher = produce_origin(1);
-	let broadcast = publisher.create_broadcast("bcast").unwrap();
-	let track = broadcast.create_track("video", timed()).unwrap();
-	broadcast.announce(Default::default()).unwrap();
+	let broadcast = publisher
+		.route("bcast", moq_net::origin::RouteOptions::hidden())
+		.unwrap();
+	let track = broadcast.broadcast().create_track("video", timed()).unwrap();
+	broadcast.announce().unwrap();
 
 	let subscriber = produce_origin(2);
 	let mut options = MockConnectOptions::new(version.parse::<Version>().unwrap());
@@ -320,9 +324,11 @@ async fn a_session_close_cancels_the_track_from_either_side() {
 /// the error the fetch ends with.
 async fn fetch_killed(version: &str, kill: Kill) -> moq_net::Error {
 	let publisher = produce_origin(1);
-	let broadcast = publisher.create_broadcast("bcast").unwrap();
-	let mut dynamic = broadcast.requests();
-	broadcast.announce(Default::default()).unwrap();
+	let broadcast = publisher
+		.route("bcast", moq_net::origin::RouteOptions::hidden())
+		.unwrap();
+	let mut dynamic = broadcast.broadcast().requests();
+	broadcast.announce().unwrap();
 
 	let subscriber = produce_origin(2);
 	let mut options = MockConnectOptions::new(version.parse::<Version>().unwrap());
diff --git a/rs/moq-net/tests/integration/support/mod.rs b/rs/moq-net/tests/integration/support/mod.rs
index 8cbc4ddf5c3..f9d2a692771 100644
--- a/rs/moq-net/tests/integration/support/mod.rs
+++ b/rs/moq-net/tests/integration/support/mod.rs
@@ -3,6 +3,7 @@
 pub mod harness;
 pub mod mock;
 
+use futures::channel::mpsc;
 use moq_net::{datagram, goaway, origin, track};
 
 /// Wait until anyone wants the track, returning the group they want.
@@ -34,7 +35,7 @@ pub async fn datagram_priority(producer: &datagram::Producer, want: Option<i8>)
 
 /// Wait until `consumer` sees a route announced at exactly `path`, and return it.
 #[allow(dead_code, reason = "shared by several test binaries, each using only part of it")]
-pub async fn announced(consumer: &origin::Consumer, path: &str) -> origin::Route {
+pub async fn announced(consumer: &origin::Consumer, path: &str) -> origin::RouteInfo {
 	let mut announced = consumer.routes();
 	loop {
 		match announced.next().await.expect("the origin closed") {
@@ -50,6 +51,51 @@ pub async fn announced(consumer: &origin::Consumer, path: &str) -> origin::Route
 	}
 }
 
+/// The kind of an [`origin::RouteEvent`] for a prefix.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+#[allow(dead_code, reason = "shared by several test binaries, each using only part of it")]
+pub enum Kind {
+	Start,
+	Update,
+	Restart,
+	Takeover,
+	End,
+}
+
+/// Every update per prefix the watcher has seen. Await [`kio::clock::sim::idle`]
+/// first, so every link, hold and quarantine in the mesh has settled.
+#[allow(dead_code, reason = "shared by several test binaries, each using only part of it")]
+pub fn drain(watched: &mut mpsc::UnboundedReceiver<(String, Kind)>) -> std::collections::HashMap<String, Vec<Kind>> {
+	let mut updates = std::collections::HashMap::<String, Vec<Kind>>::new();
+	while let Ok((prefix, kind)) = watched.try_recv() {
+		updates.entry(prefix).or_default().push(kind);
+	}
+	updates
+}
+
+/// Watch `announced` from its own task, the way a session's announce writer does:
+/// it runs when woken, between the relays' own tasks, rather than only once the
+/// test task is polled again, which would coalesce every intermediate update.
+#[allow(dead_code, reason = "shared by several test binaries, each using only part of it")]
+pub fn watch(mut announced: origin::Routes) -> mpsc::UnboundedReceiver<(String, Kind)> {
+	let (tx, rx) = mpsc::unbounded();
+	kio::clock::sim::spawn(async move {
+		while let Some(event) = announced.next().await {
+			let (kind, announce) = match event {
+				origin::RouteEvent::Start(announce) => (Kind::Start, announce),
+				origin::RouteEvent::Update(announce) => (Kind::Update, announce),
+				origin::RouteEvent::Restart(announce) => (Kind::Restart, announce),
+				origin::RouteEvent::Takeover { announce, .. } => (Kind::Takeover, announce),
+				origin::RouteEvent::End(announce) => (Kind::End, announce),
+			};
+			if tx.unbounded_send((announce.prefix.to_string(), kind)).is_err() {
+				break;
+			}
+		}
+	});
+	rx
+}
+
 /// Reads of the peer's GOAWAY over [`goaway::Consumer::poll`].
 #[allow(dead_code, reason = "shared by several test binaries, each using only part of it")]
 pub trait Draining {
diff --git a/rs/moq-net/tests/integration/synced.rs b/rs/moq-net/tests/integration/synced.rs
index 2394a2de908..5deeaac65e3 100644
--- a/rs/moq-net/tests/integration/synced.rs
+++ b/rs/moq-net/tests/integration/synced.rs
@@ -48,10 +48,10 @@ async fn read_until_synced(announced: &mut origin::Routes) -> BTreeSet<String> {
 /// origin's consumer had read when it synced.
 async fn synced(version: &str) -> BTreeSet<String> {
 	let publisher = produce_origin(1);
-	let a = publisher.create_broadcast("a").unwrap();
-	a.announce(Default::default()).unwrap();
-	let b = publisher.create_broadcast("b").unwrap();
-	b.announce(Default::default()).unwrap();
+	let a = publisher.route("a", moq_net::origin::RouteOptions::hidden()).unwrap();
+	a.announce().unwrap();
+	let b = publisher.route("b", moq_net::origin::RouteOptions::hidden()).unwrap();
+	b.announce().unwrap();
 
 	let subscriber = produce_origin(2);
 	let mut options = MockConnectOptions::new(version.parse::<Version>().unwrap());
@@ -94,8 +94,8 @@ async fn a_best_effort_boundary_still_catches_up() {
 #[kio::test]
 async fn a_second_session_catches_up() {
 	let publisher = produce_origin(1);
-	let a = publisher.create_broadcast("a").unwrap();
-	a.announce(Default::default()).unwrap();
+	let a = publisher.route("a", moq_net::origin::RouteOptions::hidden()).unwrap();
+	a.announce().unwrap();
 
 	let subscriber = produce_origin(2);
 	let connect = || {
@@ -133,8 +133,10 @@ async fn a_cold_relay_syncs_then_forwards_upstream_routes_as_live() {
 	assert!(announced.try_next().is_none());
 
 	let upstream = produce_origin(1);
-	let broadcast = upstream.create_broadcast("room/cam").unwrap();
-	broadcast.announce(Default::default()).unwrap();
+	let broadcast = upstream
+		.route("room/cam", moq_net::origin::RouteOptions::hidden())
+		.unwrap();
+	broadcast.announce().unwrap();
 	let mut options = MockConnectOptions::new(version);
 	options.server_publish = Some(upstream.consume());
 	options.client_subscribe = Some(relay.clone());
diff --git a/rs/moq-net/tests/integration/track_abort_over_session.rs b/rs/moq-net/tests/integration/track_abort_over_session.rs
index c2475a7b26c..5d3cb9750be 100644
--- a/rs/moq-net/tests/integration/track_abort_over_session.rs
+++ b/rs/moq-net/tests/integration/track_abort_over_session.rs
@@ -26,9 +26,11 @@ async fn after_abort(version: &str, hops: u32) {
 	let publisher = produce_origin(1);
 	let relay = produce_origin(2);
 	let far = produce_origin(3);
-	let broadcast = publisher.create_broadcast("bench").unwrap();
-	let track = broadcast.create_track("video", timed()).unwrap();
-	broadcast.announce(Default::default()).unwrap();
+	let broadcast = publisher
+		.route("bench", moq_net::origin::RouteOptions::hidden())
+		.unwrap();
+	let track = broadcast.broadcast().create_track("video", timed()).unwrap();
+	broadcast.announce().unwrap();
 	let mut options = MockConnectOptions::new(version.parse::<Version>().unwrap());
 	options.server_publish = Some(publisher.consume());
 	options.client_subscribe = Some(relay.clone());
@@ -82,11 +84,9 @@ abort_test!(abort_06_two, "moq-lite-06", 2);
 /// group.
 async fn recreate(finish: bool) {
 	let origin = produce_origin(1);
-	let broadcast = origin.create_broadcast("bench").unwrap();
-	broadcast
-		.announce(moq_net::origin::Route::default().with_instance(moq_net::Instance::random(), 0))
-		.unwrap();
-	let track = broadcast.create_track("video", timed()).unwrap();
+	let broadcast = origin.route("bench", moq_net::origin::RouteOptions::hidden()).unwrap();
+	broadcast.announce().unwrap();
+	let track = broadcast.broadcast().create_track("video", timed()).unwrap();
 	let remote = origin.consume().request("bench", None).await.unwrap();
 	let mut sub = remote.track("video").unwrap().subscribe(None).await.unwrap();
 	let mut open = track.create_group(moq_net::group::Info { sequence: 2 }).unwrap();
@@ -95,7 +95,7 @@ async fn recreate(finish: bool) {
 	assert_eq!(group.sequence, 2);
 	group.read_frame().await.unwrap().unwrap();
 	track.abort(moq_net::Error::Cancel).unwrap();
-	let fresh = broadcast.create_track("video", timed()).unwrap();
+	let fresh = broadcast.broadcast().create_track("video", timed()).unwrap();
 	let mut next = fresh.create_group(moq_net::group::Info { sequence: 3 }).unwrap();
 	next.write_frame(Timestamp::from_millis(1).unwrap(), b"next".as_ref())
 		.unwrap();
diff --git a/rs/moq-net/tests/integration/track_info_cancel.rs b/rs/moq-net/tests/integration/track_info_cancel.rs
index bf9fe31178a..e829eb814a1 100644
--- a/rs/moq-net/tests/integration/track_info_cancel.rs
+++ b/rs/moq-net/tests/integration/track_info_cancel.rs
@@ -30,9 +30,9 @@ async fn abandoned_request_reaches_the_publisher(version: &str, relays: u64) {
 		_pairs.push(peer(version, &pair[0], &pair[1]).await);
 	}
 
-	let broadcast = nodes[0].create_broadcast("room").unwrap();
-	let mut dynamic = broadcast.requests();
-	broadcast.announce(Default::default()).unwrap();
+	let broadcast = nodes[0].route("room", moq_net::origin::RouteOptions::hidden()).unwrap();
+	let mut dynamic = broadcast.broadcast().requests();
+	broadcast.announce().unwrap();
 	kio::clock::sleep(Duration::from_secs(1)).await;
 
 	let consumer = nodes[relays as usize].consume().request("room", None).await.unwrap();
@@ -70,13 +70,13 @@ async fn withdrawn_broadcast_releases_track_info(version: &str, answered: bool,
 	let version: Version = version.parse().unwrap();
 	let publisher = produce_origin(1);
 	let reader = produce_origin(2);
-	let broadcast = publisher.create_broadcast("room").unwrap();
-	let mut dynamic = broadcast.requests();
-	let mut route = origin::Route::default();
+	let mut options = origin::RouteOptions::hidden();
 	if explicit {
-		route.instance = Some("019a1234-5678-7000-8000-000000000001".parse().unwrap());
+		options = options.with_instance("019a1234-5678-7000-8000-000000000001".parse().unwrap(), 0);
 	}
-	broadcast.announce(route).unwrap();
+	let broadcast = publisher.route("room", options).unwrap();
+	let mut dynamic = broadcast.broadcast().requests();
+	broadcast.announce().unwrap();
 	let mut options = MockConnectOptions::new(version);
 	options.server_publish = Some(publisher.consume());
 	options.client_subscribe = Some(reader.clone());
@@ -105,7 +105,7 @@ async fn withdrawn_broadcast_releases_track_info(version: &str, answered: bool,
 		None
 	};
 	let finished = pair.client_transport.finished_streams();
-	broadcast.close();
+	broadcast.broadcast().close();
 	kio::clock::timeout(Duration::from_secs(5), crate::support::unwanted(demand))
 		.await
 		.unwrap_or_else(|_| panic!("{version}, answered={answered}, explicit={explicit}: TRACK outlived its broadcast"))
diff --git a/rs/moq-net/tests/integration/track_stream_demand.rs b/rs/moq-net/tests/integration/track_stream_demand.rs
index 1aaf88560b4..6cec3a0fae2 100644
--- a/rs/moq-net/tests/integration/track_stream_demand.rs
+++ b/rs/moq-net/tests/integration/track_stream_demand.rs
@@ -81,9 +81,9 @@ async fn one_used_edge(version: &str, relays: usize, reorder: bool) {
 	}
 	let reader: &MockSession = &links.last().unwrap().client_transport;
 
-	let broadcast = nodes[0].create_broadcast("room").unwrap();
-	let mut dynamic = broadcast.requests();
-	broadcast.announce(Default::default()).unwrap();
+	let broadcast = nodes[0].route("room", moq_net::origin::RouteOptions::hidden()).unwrap();
+	let mut dynamic = broadcast.broadcast().requests();
+	broadcast.announce().unwrap();
 	// Serve every request for the track, keeping what it started.
 	let requests = Rc::new(RefCell::new(Vec::new()));
 	let track_edges = Rc::new(RefCell::new(None));
@@ -181,9 +181,9 @@ async fn bare_handle_is_lazy(version: &str, relays: usize) {
 		links.push(link(version, &pair[0], &pair[1]).await);
 	}
 
-	let broadcast = nodes[0].create_broadcast("room").unwrap();
-	let mut dynamic = broadcast.requests();
-	broadcast.announce(Default::default()).unwrap();
+	let broadcast = nodes[0].route("room", moq_net::origin::RouteOptions::hidden()).unwrap();
+	let mut dynamic = broadcast.broadcast().requests();
+	broadcast.announce().unwrap();
 	let requests = Rc::new(RefCell::new(Vec::new()));
 	let served = requests.clone();
 	let publisher = kio::clock::sim::spawn(async move {
diff --git a/rs/moq-net/tests/integration/track_tail.rs b/rs/moq-net/tests/integration/track_tail.rs
index 6235bbed4f4..a2a2eaba949 100644
--- a/rs/moq-net/tests/integration/track_tail.rs
+++ b/rs/moq-net/tests/integration/track_tail.rs
@@ -75,7 +75,7 @@ struct Pair {
 	track: moq_net::track::Producer,
 	remote: moq_net::broadcast::Consumer,
 	_keep: (
-		moq_net::origin::Publication,
+		moq_net::origin::Route,
 		moq_net::origin::Producer,
 		moq_net::origin::Producer,
 	),
@@ -83,9 +83,11 @@ struct Pair {
 
 async fn connect(version: &str) -> Pair {
 	let publisher = produce_origin(1);
-	let broadcast = publisher.create_broadcast("bcast").unwrap();
-	let track = broadcast.create_track("video", timed()).unwrap();
-	broadcast.announce(Default::default()).unwrap();
+	let broadcast = publisher
+		.route("bcast", moq_net::origin::RouteOptions::hidden())
+		.unwrap();
+	let track = broadcast.broadcast().create_track("video", timed()).unwrap();
+	broadcast.announce().unwrap();
 
 	let subscriber = produce_origin(2);
 	let mut options = MockConnectOptions::new(version.parse::<Version>().unwrap());
diff --git a/rs/moq-net/tests/integration/tracks.rs b/rs/moq-net/tests/integration/tracks.rs
index e394273b83c..da61c174a17 100644
--- a/rs/moq-net/tests/integration/tracks.rs
+++ b/rs/moq-net/tests/integration/tracks.rs
@@ -65,9 +65,11 @@ async fn resolve(origin: &moq_net::origin::Producer) -> moq_net::broadcast::Cons
 #[kio::test]
 async fn a_session_lists_its_peers_tracks() {
 	let publisher = produce_origin(1);
-	let broadcast = publisher.create_broadcast("bcast").unwrap();
-	let a = broadcast.create_track("a", None).unwrap();
-	broadcast.announce(Default::default()).unwrap();
+	let broadcast = publisher
+		.route("bcast", moq_net::origin::RouteOptions::hidden())
+		.unwrap();
+	let a = broadcast.broadcast().create_track("a", None).unwrap();
+	broadcast.announce().unwrap();
 
 	let (subscriber, _pair) = connect(&publisher, 2, lite07()).await;
 	let remote = resolve(&subscriber).await;
@@ -79,7 +81,7 @@ async fn a_session_lists_its_peers_tracks() {
 	);
 	assert_eq!(next(&mut tracks).await, "+a");
 
-	let b = broadcast.create_track("b", None).unwrap();
+	let b = broadcast.broadcast().create_track("b", None).unwrap();
 	assert_eq!(next(&mut tracks).await, "+b");
 	drop(a);
 	assert_eq!(next(&mut tracks).await, "-a");
@@ -87,7 +89,7 @@ async fn a_session_lists_its_peers_tracks() {
 	drop(b);
 	assert_eq!(next(&mut tracks).await, "~b", "TRACKS_FINISH, not TRACKS_REMOVE");
 
-	broadcast.close();
+	broadcast.broadcast().close();
 	assert_eq!(next(&mut tracks).await, "end");
 }
 
@@ -95,15 +97,17 @@ async fn a_session_lists_its_peers_tracks() {
 #[kio::test]
 async fn a_listing_carries_track_info() {
 	let publisher = produce_origin(1);
-	let broadcast = publisher.create_broadcast("bcast").unwrap();
+	let broadcast = publisher
+		.route("bcast", moq_net::origin::RouteOptions::hidden())
+		.unwrap();
 	let info = moq_net::track::Info::default()
 		.with_timescale(moq_net::Timescale::MILLI)
 		.with_max_age(Duration::from_secs(3))
 		.with_priority(9)
 		.with_refresh(4)
 		.with_compress(true);
-	let _a = broadcast.create_track("a", info).unwrap();
-	broadcast.announce(Default::default()).unwrap();
+	let _a = broadcast.broadcast().create_track("a", info).unwrap();
+	broadcast.announce().unwrap();
 
 	let (subscriber, _pair) = connect(&publisher, 2, lite07()).await;
 	let mut tracks = resolve(&subscriber).await.tracks().unwrap();
@@ -128,15 +132,17 @@ async fn a_listing_carries_track_info() {
 #[kio::test]
 async fn a_listed_track_serves_its_cached_group() {
 	let publisher = produce_origin(1);
-	let broadcast = publisher.create_broadcast("bcast").unwrap();
-	broadcast.announce(Default::default()).unwrap();
+	let broadcast = publisher
+		.route("bcast", moq_net::origin::RouteOptions::hidden())
+		.unwrap();
+	broadcast.announce().unwrap();
 
 	let (subscriber, _pair) = connect(&publisher, 2, lite07()).await;
 	let remote = resolve(&subscriber).await;
 	let mut tracks = remote.tracks().unwrap();
 	assert_eq!(next(&mut tracks).await, "synced");
 
-	let late = broadcast.create_track("late", None).unwrap();
+	let late = broadcast.broadcast().create_track("late", None).unwrap();
 	let mut group = late.append_group().unwrap();
 	group.write_frame(None, &b"first"[..]).unwrap();
 	group.finish().unwrap();
@@ -161,9 +167,11 @@ async fn a_listed_track_serves_its_cached_group() {
 #[kio::test]
 async fn a_relay_shares_its_upstream_listing() {
 	let publisher = produce_origin(1);
-	let broadcast = publisher.create_broadcast("bcast").unwrap();
-	let a = broadcast.create_track("a", None).unwrap();
-	broadcast.announce(Default::default()).unwrap();
+	let broadcast = publisher
+		.route("bcast", moq_net::origin::RouteOptions::hidden())
+		.unwrap();
+	let a = broadcast.broadcast().create_track("a", None).unwrap();
+	broadcast.announce().unwrap();
 
 	let (relay, _upstream) = connect(&publisher, 2, lite07()).await;
 	let (first, _first) = connect(&relay, 3, lite07()).await;
@@ -178,7 +186,7 @@ async fn a_relay_shares_its_upstream_listing() {
 	assert_eq!(next(&mut two).await, "synced");
 	assert_eq!(next(&mut two).await, "+a");
 
-	let b = broadcast.create_track("b", None).unwrap();
+	let b = broadcast.broadcast().create_track("b", None).unwrap();
 	assert_eq!(next(&mut one).await, "+b");
 	assert_eq!(next(&mut two).await, "+b");
 
@@ -195,9 +203,11 @@ async fn a_relay_shares_its_upstream_listing() {
 #[kio::test]
 async fn lite06_cannot_list() {
 	let publisher = produce_origin(1);
-	let broadcast = publisher.create_broadcast("bcast").unwrap();
-	let _a = broadcast.create_track("a", None).unwrap();
-	broadcast.announce(Default::default()).unwrap();
+	let broadcast = publisher
+		.route("bcast", moq_net::origin::RouteOptions::hidden())
+		.unwrap();
+	let _a = broadcast.broadcast().create_track("a", None).unwrap();
+	broadcast.announce().unwrap();
 
 	let (subscriber, _pair) = connect(&publisher, 2, "moq-lite-06".parse().unwrap()).await;
 	let mut tracks = resolve(&subscriber).await.tracks().unwrap();
@@ -212,12 +222,14 @@ async fn lite06_cannot_list() {
 #[kio::test]
 async fn a_listing_past_the_announces_cap_is_reset() {
 	let publisher = produce_origin(1);
-	let broadcast = publisher.create_broadcast("bcast").unwrap();
+	let broadcast = publisher
+		.route("bcast", moq_net::origin::RouteOptions::hidden())
+		.unwrap();
 	const CAP: usize = 10;
 	let _tracks: Vec<_> = (0..CAP)
-		.map(|i| broadcast.create_track(format!("t{i}"), None).unwrap())
+		.map(|i| broadcast.broadcast().create_track(format!("t{i}"), None).unwrap())
 		.collect();
-	broadcast.announce(Default::default()).unwrap();
+	broadcast.announce().unwrap();
 
 	let mut limits = Limits::default();
 	limits.announces = CAP;
diff --git a/rs/moq-net/tests/integration/tracks_ietf.rs b/rs/moq-net/tests/integration/tracks_ietf.rs
index 4693717ffd1..94e2fcc4145 100644
--- a/rs/moq-net/tests/integration/tracks_ietf.rs
+++ b/rs/moq-net/tests/integration/tracks_ietf.rs
@@ -99,9 +99,11 @@ async fn read(sub: &mut moq_net::track::Subscriber) -> Option<(u64, Vec<u8>)> {
 async fn a_listing_of_our_own_peer_fails_alone() {
 	for version in DRAFTS {
 		let publisher = produce_origin(1);
-		let broadcast = publisher.create_broadcast("bcast").unwrap();
-		let video = broadcast.create_track("video", None).unwrap();
-		broadcast.announce(Default::default()).unwrap();
+		let broadcast = publisher
+			.route("bcast", moq_net::origin::RouteOptions::hidden())
+			.unwrap();
+		let video = broadcast.broadcast().create_track("video", None).unwrap();
+		broadcast.announce().unwrap();
 
 		let (subscriber, pair) = connect(&publisher, version).await;
 		let remote = resolve(&subscriber, "bcast").await;
diff --git a/rs/moq-net/tests/integration/unannounce_release.rs b/rs/moq-net/tests/integration/unannounce_release.rs
index e86543f5af1..581a3d4fa42 100644
--- a/rs/moq-net/tests/integration/unannounce_release.rs
+++ b/rs/moq-net/tests/integration/unannounce_release.rs
@@ -24,8 +24,10 @@ async fn release(version: Version) {
 	options.client_subscribe = Some(relay.clone());
 	let _pair = connect_mock(options).await;
 
-	let broadcast = publisher.publish("a/b", moq_net::origin::Route::default()).unwrap();
-	let track = broadcast.create_track("t", None).unwrap();
+	let broadcast = publisher
+		.route("a/b", moq_net::origin::RouteOptions::default())
+		.unwrap();
+	let track = broadcast.broadcast().create_track("t", None).unwrap();
 
 	let consumer = relay.consume();
 	let remote = consumer
@@ -38,7 +40,7 @@ async fn release(version: Version) {
 	let sub = remote.track("t").unwrap().subscribe(None).await.expect("subscribes");
 	crate::support::wanted(track.demand()).await.unwrap();
 
-	broadcast.unannounce();
+	broadcast.withdraw();
 	kio::clock::sleep(Duration::from_secs(1)).await;
 
 	drop(sub);
diff --git a/rs/moq-net/tests/integration/untimed.rs b/rs/moq-net/tests/integration/untimed.rs
index f09784f9633..e5bd86b751a 100644
--- a/rs/moq-net/tests/integration/untimed.rs
+++ b/rs/moq-net/tests/integration/untimed.rs
@@ -111,9 +111,11 @@ async fn next_frame(subscriber: &mut track::Subscriber) -> Option<Timestamp> {
 async fn frame_through(hops: &[&str], info: track::Info) -> (Option<Timestamp>, track::Info) {
 	let timestamp = info.timescale.map(|_| millis(7));
 	let chain = Chain::new(hops).await;
-	let broadcast = chain.nodes[0].create_broadcast("room").unwrap();
-	let mut producer = broadcast.create_track("data", info).unwrap();
-	broadcast.announce(Default::default()).unwrap();
+	let broadcast = chain.nodes[0]
+		.route("room", moq_net::origin::RouteOptions::hidden())
+		.unwrap();
+	let mut producer = broadcast.broadcast().create_track("data", info).unwrap();
+	broadcast.announce().unwrap();
 	kio::clock::sleep(Duration::from_secs(1)).await;
 
 	let mut subscriber = chain.subscribe("data").await;
@@ -177,9 +179,11 @@ async fn a_relay_forwards_an_untimed_track_untimed() {
 async fn an_explicit_start_holds_on_an_untimed_track() {
 	for version in ["moq-lite-03", "moq-lite-06", "moq-lite-07-wip", "moq-transport-22"] {
 		let chain = Chain::new(&[version]).await;
-		let broadcast = chain.nodes[0].create_broadcast("room").unwrap();
-		let mut producer = broadcast.create_track("data", untimed()).unwrap();
-		broadcast.announce(Default::default()).unwrap();
+		let broadcast = chain.nodes[0]
+			.route("room", moq_net::origin::RouteOptions::hidden())
+			.unwrap();
+		let mut producer = broadcast.broadcast().create_track("data", untimed()).unwrap();
+		broadcast.announce().unwrap();
 		for _ in 0..5 {
 			producer.write_frame(None, &b"untimed"[..]).unwrap();
 		}
@@ -212,9 +216,14 @@ async fn an_explicit_start_holds_on_an_untimed_track() {
 async fn datagrams_arrive_as_published() {
 	for version in ["moq-lite-05", "moq-lite-07-wip"] {
 		let chain = Chain::new(&[version]).await;
-		let broadcast = chain.nodes[0].create_broadcast("room").unwrap();
-		let mut producer = broadcast.create_datagrams("data", datagram::Info::default()).unwrap();
-		broadcast.announce(Default::default()).unwrap();
+		let broadcast = chain.nodes[0]
+			.route("room", moq_net::origin::RouteOptions::hidden())
+			.unwrap();
+		let mut producer = broadcast
+			.broadcast()
+			.create_datagrams("data", datagram::Info::default())
+			.unwrap();
+		broadcast.announce().unwrap();
 
 		let consumer = kio::clock::timeout(TIMEOUT, chain.nodes[1].consume().request("room", None))
 			.await
@@ -247,9 +256,11 @@ async fn datagrams_arrive_as_published() {
 async fn a_fetched_untimed_frame_arrives_untimed() {
 	for version in ["moq-lite-06", "moq-lite-07-wip", "moq-transport-18"] {
 		let chain = Chain::new(&[version]).await;
-		let broadcast = chain.nodes[0].create_broadcast("room").unwrap();
-		let mut dynamic = broadcast.requests();
-		broadcast.announce(Default::default()).unwrap();
+		let broadcast = chain.nodes[0]
+			.route("room", moq_net::origin::RouteOptions::hidden())
+			.unwrap();
+		let mut dynamic = broadcast.broadcast().requests();
+		broadcast.announce().unwrap();
 		kio::clock::sleep(Duration::from_secs(1)).await;
 
 		let consumer = chain.nodes[1].consume().request("room", None).await.unwrap();
diff --git a/rs/moq-net/tests/integration/warm_backfill.rs b/rs/moq-net/tests/integration/warm_backfill.rs
index 5edae666fc1..f9678db578a 100644
--- a/rs/moq-net/tests/integration/warm_backfill.rs
+++ b/rs/moq-net/tests/integration/warm_backfill.rs
@@ -71,8 +71,11 @@ async fn a_newcomer_on_a_warm_relay_gets_the_backfill() {
 		let publisher = origin(1);
 		let relay = origin(2);
 		let _link = peer(version.parse::<Version>().unwrap(), &publisher, &relay).await;
-		let broadcast = publisher.create_broadcast("live").unwrap();
+		let broadcast = publisher
+			.route("live", moq_net::origin::RouteOptions::hidden())
+			.unwrap();
 		let source = broadcast
+			.broadcast()
 			.create_track(
 				"video",
 				Info::default().with_timescale(Timescale::MILLI).with_max_age(None),
@@ -85,7 +88,7 @@ async fn a_newcomer_on_a_warm_relay_gets_the_backfill() {
 				.unwrap();
 			group.finish().unwrap();
 		}
-		broadcast.announce(Default::default()).unwrap();
+		broadcast.announce().unwrap();
 
 		let mut first = kio::clock::timeout(TIMEOUT, subscribe(&relay)).await.unwrap();
 		let cold = kio::clock::timeout(TIMEOUT, received(&mut first)).await.unwrap();
@@ -105,8 +108,11 @@ async fn a_refused_transport_backfill_keeps_delivering_live() {
 		let publisher = origin(1);
 		let relay = origin(2);
 		let _link = peer(version.parse::<Version>().unwrap(), &publisher, &relay).await;
-		let broadcast = publisher.create_broadcast("live").unwrap();
+		let broadcast = publisher
+			.route("live", moq_net::origin::RouteOptions::hidden())
+			.unwrap();
 		let source = broadcast
+			.broadcast()
 			.create_track("video", Info::default().with_timescale(Timescale::MILLI))
 			.unwrap();
 		for sequence in 0..GROUPS {
@@ -116,7 +122,7 @@ async fn a_refused_transport_backfill_keeps_delivering_live() {
 				.unwrap();
 			group.finish().unwrap();
 		}
-		broadcast.announce(Default::default()).unwrap();
+		broadcast.announce().unwrap();
 		let mut subscriber = kio::clock::timeout(TIMEOUT, subscribe(&relay)).await.unwrap();
 		let got = kio::clock::timeout(TIMEOUT, received(&mut subscriber)).await.unwrap();
 		assert_eq!(got, BTreeSet::from([GROUPS - 1]), "{version}: only the live edge");
diff --git a/rs/moq-net/tests/integration/wide_hop.rs b/rs/moq-net/tests/integration/wide_hop.rs
index ed449b3eb19..d0f4854c536 100644
--- a/rs/moq-net/tests/integration/wide_hop.rs
+++ b/rs/moq-net/tests/integration/wide_hop.rs
@@ -28,10 +28,12 @@ async fn widest_hop_crosses_each_varint_form() {
 		let upstream: Version = "moq-transport-18".parse().unwrap();
 		let _upstream = peer(upstream, &source, &relay).await;
 		let _downstream = peer(downstream.parse().unwrap(), &relay, &sink).await;
-		let _route = source.requests("room").unwrap();
+		let _route = source
+			.route_prefix("room", moq_net::origin::RouteOptions::default())
+			.unwrap();
 		kio::clock::sim::idle().await;
 
-		let ids = |route: origin::Route| route.hops.iter().map(|hop| hop.id()).collect::<Vec<_>>();
+		let ids = |route: origin::RouteInfo| route.hops().iter().map(|hop| hop.id()).collect::<Vec<_>>();
 		let at_relay = crate::support::announced(&relay.consume(), "room").await;
 		assert_eq!(ids(at_relay), [u64::MAX], "{downstream}");
 		let at_sink = crate::support::announced(&sink.consume(), "room").await;
diff --git a/rs/moq-net/tests/integration/wide_sequence.rs b/rs/moq-net/tests/integration/wide_sequence.rs
index f17fb410fb4..6584fa8b8a4 100644
--- a/rs/moq-net/tests/integration/wide_sequence.rs
+++ b/rs/moq-net/tests/integration/wide_sequence.rs
@@ -19,10 +19,12 @@ async fn largest_quic_sequence_reaches_the_subscriber() {
 			let publisher = produce_origin(1);
 			let relay = produce_origin(2);
 			let client = produce_origin(3);
-			let broadcast = publisher.create_broadcast("ladder").unwrap();
+			let broadcast = publisher
+				.route("ladder", moq_net::origin::RouteOptions::hidden())
+				.unwrap();
 			let info = moq_net::track::Info::default().with_timescale(moq_net::Timescale::MICRO);
-			let track = broadcast.create_track("data", info).unwrap();
-			broadcast.announce(Default::default()).unwrap();
+			let track = broadcast.broadcast().create_track("data", info).unwrap();
+			broadcast.announce().unwrap();
 			let mut options = MockConnectOptions::new(version);
 			options.server_publish = Some(publisher.consume());
 			options.client_subscribe = Some(if relayed { relay.clone() } else { client.clone() });
@@ -87,10 +89,12 @@ async fn wide_sequence_fails_only_its_subscription() {
 	let relay = produce_origin(2);
 	let client = produce_origin(3);
 
-	let broadcast = publisher.create_broadcast("bench").unwrap();
-	let wide = broadcast.create_track("wide", timed()).unwrap();
-	let narrow = broadcast.create_track("narrow", timed()).unwrap();
-	broadcast.announce(Default::default()).unwrap();
+	let broadcast = publisher
+		.route("bench", moq_net::origin::RouteOptions::hidden())
+		.unwrap();
+	let wide = broadcast.broadcast().create_track("wide", timed()).unwrap();
+	let narrow = broadcast.broadcast().create_track("narrow", timed()).unwrap();
+	broadcast.announce().unwrap();
 	let mut group = wide.create_group(moq_net::group::Info { sequence: WIDE }).unwrap();
 	group.write_frame(Timestamp::ZERO, b"wide".as_ref()).unwrap();
 	let mut group = narrow.append_group().unwrap();
@@ -154,10 +158,12 @@ async fn a_later_wide_group_fails_only_that_subscription() {
 	let relay = produce_origin(2);
 	let client = produce_origin(3);
 
-	let broadcast = publisher.create_broadcast("bench").unwrap();
-	let wide = broadcast.create_track("wide", timed()).unwrap();
-	let narrow = broadcast.create_track("narrow", timed()).unwrap();
-	broadcast.announce(Default::default()).unwrap();
+	let broadcast = publisher
+		.route("bench", moq_net::origin::RouteOptions::hidden())
+		.unwrap();
+	let wide = broadcast.broadcast().create_track("wide", timed()).unwrap();
+	let narrow = broadcast.broadcast().create_track("narrow", timed()).unwrap();
+	broadcast.announce().unwrap();
 	let mut group = wide.append_group().unwrap();
 	group.write_frame(Timestamp::ZERO, b"first".as_ref()).unwrap();
 	let mut group = narrow.append_group().unwrap();
diff --git a/rs/moq-net/tests/integration/widened_max_age.rs b/rs/moq-net/tests/integration/widened_max_age.rs
index 2e4d9711eca..5d0403b9123 100644
--- a/rs/moq-net/tests/integration/widened_max_age.rs
+++ b/rs/moq-net/tests/integration/widened_max_age.rs
@@ -78,9 +78,11 @@ impl Chain {
 		if let Some(relay) = &relay {
 			links.push(peer(version, relay, &viewer).await);
 		}
-		let broadcast = publisher.create_broadcast("live").unwrap();
-		let source = broadcast.create_track("video", timed()).unwrap();
-		broadcast.announce(Default::default()).unwrap();
+		let broadcast = publisher
+			.route("live", moq_net::origin::RouteOptions::hidden())
+			.unwrap();
+		let source = broadcast.broadcast().create_track("video", timed()).unwrap();
+		broadcast.announce().unwrap();
 		Self {
 			source,
 			viewer,
@@ -307,8 +309,10 @@ async fn wider_newcomers_after_the_first_pull_nothing_upstream() {
 		.tier(moq_net::stats::Tier::new(moq_net::Path::from_static("upstream")))
 		.session(moq_net::Path::from_static(""));
 	let _upstream = connect_mock(options).await;
-	let broadcast = publisher.create_broadcast("live").unwrap();
-	let source = broadcast.create_track("video", timed()).unwrap();
+	let broadcast = publisher
+		.route("live", moq_net::origin::RouteOptions::hidden())
+		.unwrap();
+	let source = broadcast.broadcast().create_track("video", timed()).unwrap();
 	for sequence in 0..GROUPS {
 		let mut group = source.create_group(moq_net::group::Info { sequence }).unwrap();
 		group
@@ -316,7 +320,7 @@ async fn wider_newcomers_after_the_first_pull_nothing_upstream() {
 			.unwrap();
 		group.finish().unwrap();
 	}
-	broadcast.announce(Default::default()).unwrap();
+	broadcast.announce().unwrap();
 
 	let mut links = Vec::new();
 	let mut readers = Vec::new();
@@ -365,9 +369,11 @@ async fn a_legacy_viewer_beating_a_relay_copy_joins_at_the_live_edge() {
 		options.client_subscribe = Some(relay.clone());
 		let upstream = connect_mock(options).await;
 		let _downstream = peer(legacy.parse().unwrap(), &relay, &viewer).await;
-		let broadcast = publisher.create_broadcast("live").unwrap();
-		let source = broadcast.create_track("video", timed()).unwrap();
-		broadcast.announce(Default::default()).unwrap();
+		let route = publisher
+			.route("live", moq_net::origin::RouteOptions::hidden())
+			.unwrap();
+		let source = route.broadcast().create_track("video", timed()).unwrap();
+		route.announce().unwrap();
 		for sequence in 0..GROUPS {
 			let mut group = source.create_group(moq_net::group::Info { sequence }).unwrap();
 			group
diff --git a/rs/moq-net/tests/integration/zero_copy.rs b/rs/moq-net/tests/integration/zero_copy.rs
index 3779106d2eb..f8668ef9a56 100644
--- a/rs/moq-net/tests/integration/zero_copy.rs
+++ b/rs/moq-net/tests/integration/zero_copy.rs
@@ -54,10 +54,12 @@ async fn frames_cross_without_a_copy() {
 			}
 		);
 
-		let broadcast = publisher.create_broadcast("room").unwrap();
+		let broadcast = publisher
+			.route("room", moq_net::origin::RouteOptions::hidden())
+			.unwrap();
 		let info = moq_net::track::Info::default().with_timescale(moq_net::Timescale::MILLI);
-		let track = broadcast.create_track("video", info).unwrap();
-		broadcast.announce(Default::default()).unwrap();
+		let track = broadcast.broadcast().create_track("video", info).unwrap();
+		broadcast.announce().unwrap();
 
 		let consumer = subscriber.consume();
 		let remote = kio::clock::timeout(TIMEOUT, consumer.follow("room", None).unwrap().available())
diff --git a/rs/moq-relay/src/cluster.rs b/rs/moq-relay/src/cluster.rs
index fed98c4e4ce..86edbb4178f 100644
--- a/rs/moq-relay/src/cluster.rs
+++ b/rs/moq-relay/src/cluster.rs
@@ -2530,8 +2530,10 @@ mod tests {
 	#[tokio::test]
 	async fn only_a_peer_grant_discovers_hidden_routes() {
 		let cluster = new_cluster(Config::default()).expect("cluster");
-		let _hidden = cluster.origin.publish(".stats/node", origin::Route::default());
-		let _visible = cluster.origin.publish("room", origin::Route::default());
+		let _hidden = cluster
+			.origin
+			.route(".stats/node", moq_net::origin::RouteOptions::default());
+		let _visible = cluster.origin.route("room", moq_net::origin::RouteOptions::default());
 		let mut request = moq_auth::Request::new("test", moq_auth::Transport::Quic, "/");
 		request.tls = Some(moq_auth::Peer {
 			name: "edge0".into(),
@@ -2602,7 +2604,7 @@ mod tests {
 
 		let _worker = cluster
 			.origin
-			.publish(".svc/pid/foo", origin::Route::default())
+			.route(".svc/pid/foo", moq_net::origin::RouteOptions::default())
 			.expect("publish at the fleet path");
 		let subscriber = cluster.subscriber(&token).expect("subscribe grant").consume();
 		let broadcast = subscriber
@@ -2612,8 +2614,14 @@ mod tests {
 		assert_eq!(broadcast.info().path.as_str(), ".svc/foo");
 
 		let publisher = cluster.publisher(&token).expect("publish grant");
-		assert!(publisher.create_broadcast(".svc/foo").is_err());
-		publisher.create_broadcast("cam").expect("publish outside the mount");
+		assert!(
+			publisher
+				.route(".svc/foo", moq_net::origin::RouteOptions::hidden())
+				.is_err()
+		);
+		let _cam = publisher
+			.route("cam", moq_net::origin::RouteOptions::hidden())
+			.expect("publish outside the mount");
 
 		// A mount the origin refuses admits nothing rather than half a grant.
 		grant.mounts.insert(".svc/x".into(), ".other".into());
@@ -3391,9 +3399,10 @@ mod tests {
 		assert_eq!(origin.config().cache_duration, duration);
 		assert_eq!(origin.config().pool.expiry(), Some(duration));
 
-		let broadcast = origin.create_broadcast("cam").expect("create");
-		broadcast.announce(Default::default()).expect("announce");
-		let mut track = broadcast.create_track("data", timed()).expect("track");
+		let broadcast = origin
+			.route("cam", moq_net::origin::RouteOptions::default())
+			.expect("create");
+		let mut track = broadcast.broadcast().create_track("data", timed()).expect("track");
 		track.write_frame(moq_net::Timestamp::ZERO, b"hello").expect("write");
 		assert!(pool.used() > 0, "writes charge the constructed cache pool");
 
@@ -3857,8 +3866,10 @@ mod tests {
 		let node = new_cluster(Config::default()).expect("node cluster");
 		let fingerprint = new_cluster(Config::default()).expect("fingerprint cluster");
 
-		let _from_node = node.origin.create_broadcast("from-node").expect("create");
-		_from_node.announce(Default::default()).expect("announce");
+		let _from_node = node
+			.origin
+			.route("from-node", moq_net::origin::RouteOptions::default())
+			.expect("create");
 
 		let mut listen = moq_tokio::listen::Config::default();
 		listen.bind = Some("127.0.0.1:0".parse().unwrap());
@@ -3912,8 +3923,10 @@ mod tests {
 		// The dialer marks what the peer forwards: it entered at `node`, not here.
 		assert_eq!(update.route.source(), origin::Source::Peer(node.origin.hop()));
 
-		let _from_fp = fingerprint.origin.create_broadcast("from-fingerprint").expect("create");
-		_from_fp.announce(Default::default()).expect("announce");
+		let _from_fp = fingerprint
+			.origin
+			.route("from-fingerprint", moq_net::origin::RouteOptions::default())
+			.expect("create");
 		let mut announced = node.origin.consume().routes();
 		loop {
 			let (update, _) = kio::clock::timeout(TIMEOUT, next_update(&mut announced))
@@ -4214,8 +4227,10 @@ mod tests {
 				let dialer = new_cluster(Config::default())
 					.expect("dialer cluster")
 					.with_connect(Default::default(), quic);
-				let broadcast = dialer.origin.create_broadcast("from-dialer").expect("create");
-				broadcast.announce(Default::default()).expect("announce");
+				let broadcast = dialer
+					.origin
+					.route("from-dialer", moq_net::origin::RouteOptions::default())
+					.expect("create");
 				let dial = dialer.nodes.dial(&target.key);
 				tokio::spawn(dialer.clone().supervise_remote(target, String::new(), dial));
 				(dialer, broadcast)
@@ -4265,11 +4280,11 @@ mod tests {
 		let _ingest = cluster
 			.publisher(&client)
 			.expect("client")
-			.publish("ingest", Default::default());
+			.route("ingest", Default::default());
 		let _forwarded = cluster
 			.publisher(&peer)
 			.expect("peer")
-			.publish("forwarded", Default::default());
+			.route("forwarded", Default::default());
 
 		let mut announced = cluster.origin.consume().routes();
 		let forwarded = try_next_announced(&mut announced).expect("forwarded");
@@ -4303,15 +4318,15 @@ mod tests {
 		let _ingest = cluster
 			.publisher(&client)
 			.expect("client")
-			.publish("ingest", Default::default());
+			.route("ingest", Default::default());
 		let _mesh = cluster
 			.publisher(&peer)
 			.expect("peer")
-			.publish("mesh", Default::default());
+			.route("mesh", Default::default());
 		let _core = cluster
 			.publisher(&core)
 			.expect("core")
-			.publish("core", Default::default());
+			.route("core", Default::default());
 
 		let mut everyone = cluster.subscriber(&client).expect("client").consume().routes();
 		let mut prefixes = std::iter::from_fn(|| try_next_announced(&mut everyone))
diff --git a/rs/moq-relay/src/internal.rs b/rs/moq-relay/src/internal.rs
index 75f690b2934..3f9f99de3ca 100644
--- a/rs/moq-relay/src/internal.rs
+++ b/rs/moq-relay/src/internal.rs
@@ -1786,8 +1786,9 @@ mod tests {
 				.tier(moq_net::stats::Tier::new(moq_net::Path::from_static("edge")))
 				.session(moq_net::Path::from_static("root")),
 		);
-		let broadcast = producer.create_broadcast("demo/retired").unwrap();
-		broadcast.announce(Default::default()).unwrap();
+		let broadcast = producer
+			.route("demo/retired", moq_net::origin::RouteOptions::default())
+			.unwrap();
 
 		let body = render_metrics(&stats.snapshot(), &[], &[]);
 		assert!(
@@ -1799,7 +1800,7 @@ mod tests {
 			"live announce end:\n{body}"
 		);
 
-		broadcast.unannounce();
+		broadcast.withdraw();
 		drop(broadcast);
 		drop(producer);
 		let mut report = moq_net::stats::Report::default();
@@ -1832,9 +1833,10 @@ mod tests {
 		let pub_origin = moq_tokio::origin::spawn();
 		let egress = pub_origin.consume().with_stats(default_ctx.clone());
 		let mut announced = egress.routes();
-		let pub_source = pub_origin.create_broadcast("demo/x").unwrap();
-		pub_source.announce(Default::default()).unwrap();
-		let pub_track = pub_source.create_track("video", timed()).unwrap();
+		let pub_source = pub_origin
+			.route("demo/x", moq_net::origin::RouteOptions::default())
+			.unwrap();
+		let pub_track = pub_source.broadcast().create_track("video", timed()).unwrap();
 
 		// Named-tier ingress: a tagged ingress producer writes, so subscriber
 		// `bytes` advance on the regional tier.
@@ -1842,9 +1844,10 @@ mod tests {
 			.tier(Tier::new(moq_net::Path::from_static("region/sjc")))
 			.session(moq_net::Path::from_static("peer"));
 		let sub_origin = moq_tokio::origin::spawn().with_stats(regional_ctx.clone());
-		let sub_source = sub_origin.create_broadcast("demo/x").unwrap();
-		sub_source.announce(Default::default()).unwrap();
-		let sub_track = sub_source.create_track("audio", timed()).unwrap();
+		let sub_source = sub_origin
+			.route("demo/x", moq_net::origin::RouteOptions::default())
+			.unwrap();
+		let sub_track = sub_source.broadcast().create_track("audio", timed()).unwrap();
 
 		kio::clock::sleep(std::time::Duration::from_millis(1)).await;
 		kio::clock::sleep(std::time::Duration::from_millis(1)).await;
@@ -1915,9 +1918,11 @@ mod tests {
 
 		let stats = Registry::new(Default::default());
 		let origin = moq_tokio::origin::spawn();
-		let source = origin.create_broadcast("demo/x").unwrap();
-		source.announce(Default::default()).unwrap();
+		let source = origin
+			.route("demo/x", moq_net::origin::RouteOptions::default())
+			.unwrap();
 		let track = source
+			.broadcast()
 			.create_track("catalog.json", timed().with_compress(true))
 			.unwrap();
 		let payload = format!("{{\"pad\":\"{}\"}}", "abc".repeat(300));
@@ -2019,8 +2024,7 @@ mod tests {
 		let stats = moq_net::stats::Registry::new(Default::default());
 		let edge = stats.tier(moq_net::stats::Tier::new(moq_net::Path::from_static("edge")));
 		let origin = moq_tokio::origin::spawn().with_stats(edge.session(moq_net::Path::from_static("root")));
-		let broadcast = origin.create_broadcast("demo").unwrap();
-		broadcast.announce(Default::default()).unwrap();
+		let _broadcast = origin.route("demo", moq_net::origin::RouteOptions::default()).unwrap();
 		drop(edge.request(moq_net::Path::from_static("root")));
 		let refusals = crate::refusals::Refusals::default();
 		refusals.record(crate::refusals::RefusalKind::Unavailable);
diff --git a/rs/moq-relay/src/web.rs b/rs/moq-relay/src/web.rs
index f779eef74a2..37a8d1a210e 100644
--- a/rs/moq-relay/src/web.rs
+++ b/rs/moq-relay/src/web.rs
@@ -1209,9 +1209,12 @@ mod tests {
 		.init("test", &moq_tokio::tls::Connect::default(), false)
 		.unwrap();
 		let cluster = cluster::Cluster::spawn(crate::cluster::Options::default()).unwrap();
-		let broadcast = cluster.origin.create_broadcast("room").unwrap();
-		broadcast.announce(Default::default()).unwrap();
+		let broadcast = cluster
+			.origin
+			.route("room", moq_net::origin::RouteOptions::default())
+			.unwrap();
 		let track = broadcast
+			.broadcast()
 			.create_track(
 				"video",
 				moq_net::track::Info::default().with_timescale(moq_net::Timescale::MILLI),
@@ -1440,9 +1443,12 @@ mod tests {
 		});
 		let mut cluster = cluster::Cluster::spawn(crate::cluster::Options::default()).unwrap();
 		cluster.stats = Registry::new(Default::default());
-		let broadcast = cluster.origin.create_broadcast("room").unwrap();
-		broadcast.announce(Default::default()).unwrap();
+		let broadcast = cluster
+			.origin
+			.route("room", moq_net::origin::RouteOptions::default())
+			.unwrap();
 		let track = broadcast
+			.broadcast()
 			.create_track(
 				"video",
 				moq_net::track::Info::default().with_timescale(moq_net::Timescale::MILLI),
@@ -1542,9 +1548,12 @@ mod tests {
 		.init("test", &moq_tokio::tls::Connect::default(), false)
 		.unwrap();
 		let cluster = cluster::Cluster::spawn(crate::cluster::Options::default()).unwrap();
-		let broadcast = cluster.origin.create_broadcast("room").unwrap();
-		broadcast.announce(Default::default()).unwrap();
+		let broadcast = cluster
+			.origin
+			.route("room", moq_net::origin::RouteOptions::default())
+			.unwrap();
 		let track = broadcast
+			.broadcast()
 			.create_track(
 				"video",
 				moq_net::track::Info::default()
diff --git a/rs/moq-relay/tests/drills.rs b/rs/moq-relay/tests/drills.rs
index 9baa6359d38..b22e68f8ecd 100644
--- a/rs/moq-relay/tests/drills.rs
+++ b/rs/moq-relay/tests/drills.rs
@@ -452,9 +452,13 @@ async fn cancel_under_backpressure_releases_the_reader(lane: Lane) {
 	let url = path.url.clone();
 
 	let publisher = moq_tokio::origin::spawn();
-	let broadcast = publisher.create_broadcast("live").expect("create broadcast");
-	broadcast.announce(Default::default()).expect("announce broadcast");
-	let mut track = broadcast.create_track(TRACK, timed()).expect("create track");
+	let broadcast = publisher
+		.route("live", moq_net::origin::RouteOptions::default())
+		.expect("create broadcast");
+	let mut track = broadcast
+		.broadcast()
+		.create_track(TRACK, timed())
+		.expect("create track");
 	let publish_session = kio::clock::timeout(
 		TIMEOUT,
 		client(&url)
@@ -584,9 +588,13 @@ async fn relay_killed_mid_group_aborts_then_resumes(lane: Lane) {
 	let url = path.url.clone();
 
 	let publisher = moq_tokio::origin::spawn();
-	let broadcast = publisher.create_broadcast("live").expect("create broadcast");
-	broadcast.announce(Default::default()).expect("announce broadcast");
-	let mut track = broadcast.create_track(TRACK, timed()).expect("create track");
+	let broadcast = publisher
+		.route("live", moq_net::origin::RouteOptions::default())
+		.expect("create broadcast");
+	let mut track = broadcast
+		.broadcast()
+		.create_track(TRACK, timed())
+		.expect("create track");
 	let mut publish_loop = client(&url).publish(publisher.consume()).expect("no connect url");
 
 	let subscriber = moq_tokio::origin::spawn();
@@ -707,9 +715,13 @@ async fn interrupted_publisher_republishes_new_content(lane: Lane) {
 	let mut announced = subscribed.routes();
 
 	let first = moq_tokio::origin::spawn();
-	let broadcast = first.create_broadcast("live").expect("create broadcast");
-	broadcast.announce(Default::default()).expect("announce broadcast");
-	let mut track = broadcast.create_track(TRACK, timed()).expect("create track");
+	let broadcast = first
+		.route("live", moq_net::origin::RouteOptions::default())
+		.expect("create broadcast");
+	let mut track = broadcast
+		.broadcast()
+		.create_track(TRACK, timed())
+		.expect("create track");
 	let first_session = kio::clock::timeout(
 		TIMEOUT,
 		client(&url)
@@ -745,9 +757,13 @@ async fn interrupted_publisher_republishes_new_content(lane: Lane) {
 
 	// Restore: the same name, a new publisher, different content.
 	let second = moq_tokio::origin::spawn();
-	let broadcast = second.create_broadcast("live").expect("re-create broadcast");
-	broadcast.announce(Default::default()).expect("announce broadcast");
-	let mut track = broadcast.create_track(TRACK, timed()).expect("re-create track");
+	let broadcast = second
+		.route("live", moq_net::origin::RouteOptions::default())
+		.expect("re-create broadcast");
+	let mut track = broadcast
+		.broadcast()
+		.create_track(TRACK, timed())
+		.expect("re-create track");
 	let second_session = kio::clock::timeout(
 		TIMEOUT,
 		client(&url)
@@ -1027,9 +1043,13 @@ async fn cross_cluster(lane: Lane, link: PeerLink) {
 	let subscribe_path = Path::shaped(lane, &edge, bursty(), seed.wrapping_add(2)).await;
 
 	let publisher = moq_tokio::origin::spawn();
-	let broadcast = publisher.create_broadcast("live").expect("create broadcast");
-	broadcast.announce(Default::default()).expect("announce broadcast");
-	let mut track = broadcast.create_track(TRACK, timed()).expect("create track");
+	let broadcast = publisher
+		.route("live", moq_net::origin::RouteOptions::default())
+		.expect("create broadcast");
+	let mut track = broadcast
+		.broadcast()
+		.create_track(TRACK, timed())
+		.expect("create track");
 	let url = publish_path.url.clone();
 	let publish_session = kio::clock::timeout(
 		TIMEOUT,
@@ -1422,9 +1442,11 @@ async fn subscriber_max_age_skips_bufferbloat(version: &str) {
 	)
 	.await;
 	let publisher = moq_tokio::origin::spawn();
-	let broadcast = publisher.create_broadcast("live").unwrap();
-	let mut track = broadcast.create_track(TRACK, timed()).unwrap();
-	broadcast.announce(Default::default()).unwrap();
+	let broadcast = publisher
+		.route("live", moq_net::origin::RouteOptions::hidden())
+		.unwrap();
+	let mut track = broadcast.broadcast().create_track(TRACK, timed()).unwrap();
+	broadcast.announce().unwrap();
 	let mut dial = dial();
 	dial.version = vec![version];
 	let publish_url = relay.url();
diff --git a/rs/moq-relay/tests/integration/auth_lifetime.rs b/rs/moq-relay/tests/integration/auth_lifetime.rs
index 6ca2551b5f2..6feab4c60f3 100644
--- a/rs/moq-relay/tests/integration/auth_lifetime.rs
+++ b/rs/moq-relay/tests/integration/auth_lifetime.rs
@@ -271,9 +271,13 @@ fn room_url(scheme: &str, port: u16) -> url::Url {
 /// round-trips. Returns both sessions so the caller can watch them close.
 async fn connect_and_round_trip(url: &url::Url) -> (moq_tokio::Connection, moq_tokio::Connection) {
 	let pub_origin = moq_tokio::origin::spawn();
-	let broadcast = pub_origin.create_broadcast("test").expect("create broadcast");
-	broadcast.announce(Default::default()).expect("create broadcast");
-	let track = broadcast.create_track("video", timed()).expect("create track");
+	let broadcast = pub_origin
+		.route("test", moq_net::origin::RouteOptions::default())
+		.expect("create broadcast");
+	let track = broadcast
+		.broadcast()
+		.create_track("video", timed())
+		.expect("create track");
 	let mut group = track.append_group().expect("append group");
 	group
 		.write_frame(moq_net::Timestamp::ZERO, b"hello".as_ref())
@@ -644,9 +648,13 @@ async fn a_moved_tier_retags_the_live_session() {
 
 	// A publisher whose track stays open across the move, and a subscriber to it.
 	let pub_origin = moq_tokio::origin::spawn();
-	let broadcast = pub_origin.create_broadcast("test").expect("create broadcast");
-	broadcast.announce(Default::default()).expect("announce broadcast");
-	let track = broadcast.create_track("video", timed()).expect("create track");
+	let broadcast = pub_origin
+		.route("test", moq_net::origin::RouteOptions::default())
+		.expect("create broadcast");
+	let track = broadcast
+		.broadcast()
+		.create_track("video", timed())
+		.expect("create track");
 	let pub_session = kio::clock::timeout(
 		TIMEOUT,
 		client()
@@ -786,9 +794,14 @@ async fn a_rechecked_grant_resizes_live_sessions() {
 		let pub_origin = moq_tokio::origin::spawn();
 		let mut tracks = Vec::new();
 		for path in ["alice/audio", "alice/video"] {
-			let broadcast = pub_origin.create_broadcast(path).expect("create broadcast");
-			let track = broadcast.create_track("media", timed()).expect("create track");
-			broadcast.announce(Default::default()).expect("announce broadcast");
+			let broadcast = pub_origin
+				.route(path, moq_net::origin::RouteOptions::hidden())
+				.expect("create broadcast");
+			let track = broadcast
+				.broadcast()
+				.create_track("media", timed())
+				.expect("create track");
+			broadcast.announce().expect("announce broadcast");
 			tracks.push((broadcast, track));
 		}
 		let pub_session = kio::clock::timeout(
@@ -983,9 +996,13 @@ async fn http_routes_hold_a_lease() {
 
 	// A publisher whose group stays open, so a fetch of it keeps streaming.
 	let pub_origin = moq_tokio::origin::spawn();
-	let broadcast = pub_origin.create_broadcast("test").expect("create broadcast");
-	broadcast.announce(Default::default()).expect("announce");
-	let track = broadcast.create_track("video", timed()).expect("create track");
+	let broadcast = pub_origin
+		.route("test", moq_net::origin::RouteOptions::default())
+		.expect("create broadcast");
+	let track = broadcast
+		.broadcast()
+		.create_track("video", timed())
+		.expect("create track");
 	let mut group = track.append_group().expect("append group");
 	group
 		.write_frame(moq_net::Timestamp::ZERO, b"hello".as_ref())
@@ -1379,8 +1396,9 @@ async fn mtls_route_source(mtls_peer: bool) -> moq_net::origin::Source {
 	config.tls.cert = Some(client_cert);
 	config.tls.key = Some(client_key);
 	let peer = moq_tokio::origin::spawn();
-	let _forwarded = peer.create_broadcast("forwarded").expect("create");
-	_forwarded.announce(Default::default()).expect("announce");
+	let _forwarded = peer
+		.route("forwarded", moq_net::origin::RouteOptions::default())
+		.expect("create");
 	let url: url::Url = format!("moql://127.0.0.1:{}/", addr.port()).parse().unwrap();
 	let _session = kio::clock::timeout(
 		TIMEOUT,
@@ -1853,12 +1871,12 @@ async fn in_band_tokens_widen_and_withdraw_live_prefixes() {
 			config.init(Default::default()).unwrap().with_reconnect(false)
 		};
 		let origin = moq_tokio::origin::spawn();
-		let a = origin.create_broadcast("a/cam").unwrap();
-		let a_track = a.create_track("video", timed()).unwrap();
-		a.announce(Default::default()).unwrap();
-		let b = origin.create_broadcast("b/cam").unwrap();
-		let b_track = b.create_track("video", timed()).unwrap();
-		b.announce(Default::default()).unwrap();
+		let a = origin.route("a/cam", moq_net::origin::RouteOptions::hidden()).unwrap();
+		let a_track = a.broadcast().create_track("video", timed()).unwrap();
+		a.announce().unwrap();
+		let b = origin.route("b/cam", moq_net::origin::RouteOptions::hidden()).unwrap();
+		let b_track = b.broadcast().create_track("video", timed()).unwrap();
+		b.announce().unwrap();
 		let publisher = kio::clock::timeout(
 			TIMEOUT,
 			client()
@@ -1974,10 +1992,16 @@ async fn request_token_lease_ends_before_the_connection_and_reopens_later() {
 		.unwrap();
 	let (token, _) = publisher.auth().add("shared").await.unwrap();
 	let first = origin
-		.publish("first", moq_net::origin::Route::default().with_auth(token.clone()))
+		.route(
+			"first",
+			moq_net::origin::RouteOptions::default().with_auth(token.clone()),
+		)
 		.unwrap();
 	let second = origin
-		.publish("second", moq_net::origin::Route::default().with_auth(token.clone()))
+		.route(
+			"second",
+			moq_net::origin::RouteOptions::default().with_auth(token.clone()),
+		)
 		.unwrap();
 	for path in ["first", "second"] {
 		kio::clock::timeout(TIMEOUT, read.follow(path, None).unwrap().available())
@@ -2019,7 +2043,7 @@ async fn request_token_lease_ends_before_the_connection_and_reopens_later() {
 	assert_eq!(ended[0].auth, attached[0].auth);
 	assert!(ended[0].auth.is_some());
 	let _later = origin
-		.publish("later", moq_net::origin::Route::default().with_auth(token))
+		.route("later", moq_net::origin::RouteOptions::default().with_auth(token))
 		.unwrap();
 	kio::clock::timeout(TIMEOUT, read.follow("later", None).unwrap().available())
 		.await
@@ -2061,14 +2085,12 @@ async fn relay_request_limits_distinguish_clients_and_peers() {
 				.established()
 				.await
 				.unwrap();
-			let first = origin.create_broadcast("one").unwrap();
-			first.announce(Default::default()).unwrap();
+			let _first = origin.route("one", moq_net::origin::RouteOptions::default()).unwrap();
 			kio::clock::timeout(TIMEOUT, next_update(&mut observed))
 				.await
 				.unwrap()
 				.unwrap();
-			let second = origin.create_broadcast("two").unwrap();
-			second.announce(Default::default()).unwrap();
+			let _second = origin.route("two", moq_net::origin::RouteOptions::default()).unwrap();
 			if peer {
 				let (route, active) = kio::clock::timeout(TIMEOUT, next_update(&mut observed))
 					.await
diff --git a/rs/moq-relay/tests/integration/bitrate_caps.rs b/rs/moq-relay/tests/integration/bitrate_caps.rs
index a37938144e5..fe76cb7864d 100644
--- a/rs/moq-relay/tests/integration/bitrate_caps.rs
+++ b/rs/moq-relay/tests/integration/bitrate_caps.rs
@@ -74,9 +74,11 @@ async fn transfer(
 	subscriber: moq_auth::Grant,
 ) -> Duration {
 	let origin = moq_tokio::origin::spawn();
-	let broadcast = origin.create_broadcast("test").expect("create broadcast");
-	broadcast.announce(Default::default()).expect("announce");
+	let broadcast = origin
+		.route("test", moq_net::origin::RouteOptions::default())
+		.expect("create broadcast");
 	let track = broadcast
+		.broadcast()
 		.create_track(
 			"video",
 			moq_net::track::Info::default().with_timescale(moq_net::Timescale::MILLI),
diff --git a/rs/moq-relay/tests/integration/cluster_drain.rs b/rs/moq-relay/tests/integration/cluster_drain.rs
index 1776c40515d..4b83d422d3e 100644
--- a/rs/moq-relay/tests/integration/cluster_drain.rs
+++ b/rs/moq-relay/tests/integration/cluster_drain.rs
@@ -109,26 +109,31 @@ impl Forwarder {
 }
 
 /// A relay with a plaintext TCP listener and an open auth policy, publishing `name`.
-async fn relay(name: &str) -> (Relay, SocketAddr, moq_net::origin::Publication) {
+async fn relay(name: &str) -> (Relay, SocketAddr, moq_net::origin::Route) {
 	let mut config = moq_relay::Config::default();
 	config.listen.tcp.bind = Some("127.0.0.1:0".parse().unwrap());
 	config.auth.public = vec![moq_auth::Pattern::all()];
 	config.drain_timeout = Some(DRAIN.into());
 	let relay = Relay::load(config).await.expect("load relay").with_signals(false);
 	let addr = relay.tcp_addr().expect("tcp listener");
-	let broadcast = relay.cluster().origin.create_broadcast(name).expect("create broadcast");
-	broadcast.announce(Default::default()).expect("announce");
+	let broadcast = relay
+		.cluster()
+		.origin
+		.route(name, moq_net::origin::RouteOptions::default())
+		.expect("create broadcast");
 	(relay, addr, broadcast)
 }
 
 /// A peer relay publishing `name` and dialing B through `forwarder`.
-async fn peer(name: &str, forwarder: &Forwarder) -> (cluster::Cluster, moq_net::origin::Publication) {
+async fn peer(name: &str, forwarder: &Forwarder) -> (cluster::Cluster, moq_net::origin::Route) {
 	let mut config = cluster::Config::default();
 	config.connect = vec![Peer::new(format!("tcp://127.0.0.1:{}/", forwarder.port))];
 	let cluster =
 		crate::spawn_cluster(cluster::Options::new(config)).with_connect(Default::default(), Default::default());
-	let broadcast = cluster.origin.create_broadcast(name).expect("create broadcast");
-	broadcast.announce(Default::default()).expect("announce");
+	let broadcast = cluster
+		.origin
+		.route(name, moq_net::origin::RouteOptions::default())
+		.expect("create broadcast");
 	let started = cluster.clone().start().await.expect("cluster start");
 	tokio::spawn(started.run());
 	(cluster, broadcast)
diff --git a/rs/moq-relay/tests/integration/cluster_fresh_port.rs b/rs/moq-relay/tests/integration/cluster_fresh_port.rs
index 70ac6615738..e4c8b02862b 100644
--- a/rs/moq-relay/tests/integration/cluster_fresh_port.rs
+++ b/rs/moq-relay/tests/integration/cluster_fresh_port.rs
@@ -43,8 +43,9 @@ where
 /// A peer announcing one broadcast.
 async fn spawn_peer() -> SocketAddr {
 	let origin = moq_tokio::origin::spawn();
-	let broadcast = origin.create_broadcast("peer").expect("create broadcast");
-	broadcast.announce(Default::default()).expect("announce");
+	let broadcast = origin
+		.route("peer", moq_net::origin::RouteOptions::default())
+		.expect("create broadcast");
 
 	let mut config = moq_tokio::listen::Config::default();
 	config.bind = Some("127.0.0.1:0".parse().expect("parse bind"));
diff --git a/rs/moq-relay/tests/integration/cluster_idle.rs b/rs/moq-relay/tests/integration/cluster_idle.rs
index 641f52264b6..b1f4822a5e0 100644
--- a/rs/moq-relay/tests/integration/cluster_idle.rs
+++ b/rs/moq-relay/tests/integration/cluster_idle.rs
@@ -52,8 +52,9 @@ async fn spawn_peer() -> (u16, tokio::runtime::Runtime) {
 	let (bound, port) = tokio::sync::oneshot::channel();
 	runtime.spawn(async move {
 		let origin = moq_tokio::origin::spawn();
-		let broadcast = origin.create_broadcast("peer").expect("create broadcast");
-		broadcast.announce(Default::default()).expect("announce");
+		let broadcast = origin
+			.route("peer", moq_net::origin::RouteOptions::default())
+			.expect("create broadcast");
 
 		let mut config = moq_tokio::listen::Config::default();
 		config.bind = Some("127.0.0.1:0".parse().expect("parse bind"));
diff --git a/rs/moq-relay/tests/integration/cluster_unknown.rs b/rs/moq-relay/tests/integration/cluster_unknown.rs
index 74449931f4e..813e6f068f2 100644
--- a/rs/moq-relay/tests/integration/cluster_unknown.rs
+++ b/rs/moq-relay/tests/integration/cluster_unknown.rs
@@ -159,7 +159,7 @@ fn client(version: Option<moq_net::Version>) -> moq_tokio::Client {
 }
 
 struct Publisher {
-	_broadcast: moq_net::origin::Publication,
+	_broadcast: moq_net::origin::Route,
 	_session: moq_tokio::Connection,
 	streamer: tokio::task::AbortHandle,
 }
@@ -167,8 +167,7 @@ struct Publisher {
 impl Drop for Publisher {
 	fn drop(&mut self) {
 		// The streaming task owns the track producer; stop it with the
-		// publisher so the broadcast actually ends (a live track producer
-		// would keep it announced).
+		// publisher so the track ends with the route.
 		self.streamer.abort();
 	}
 }
@@ -176,9 +175,13 @@ impl Drop for Publisher {
 async fn publish_version(port: u16, version: &str) -> Publisher {
 	let url: Url = format!("tcp://127.0.0.1:{port}").parse().expect("parse url");
 	let origin = moq_tokio::origin::spawn();
-	let broadcast = origin.create_broadcast(PATH).expect("create broadcast");
-	broadcast.announce(Default::default()).expect("create broadcast");
-	let track = broadcast.create_track("video", timed()).expect("create track");
+	let broadcast = origin
+		.route(PATH, moq_net::origin::RouteOptions::default())
+		.expect("create broadcast");
+	let track = broadcast
+		.broadcast()
+		.create_track("video", timed())
+		.expect("create track");
 
 	// Stream like a real publisher: a fresh group every 100ms, so a subscriber
 	// that attaches at any point receives one (and the test doesn't depend on
diff --git a/rs/moq-relay/tests/integration/connection.rs b/rs/moq-relay/tests/integration/connection.rs
index 889128047b5..ceee8a968cc 100644
--- a/rs/moq-relay/tests/integration/connection.rs
+++ b/rs/moq-relay/tests/integration/connection.rs
@@ -19,10 +19,12 @@ async fn largest_quic_sequence_reaches_the_subscriber() {
 		let auth = memory::public(&["**"], &[], &[]);
 		let cluster = memory::cluster();
 		let publisher = memory::origin();
-		let broadcast = publisher.create_broadcast("ladder").unwrap();
+		let broadcast = publisher
+			.route("ladder", moq_net::origin::RouteOptions::hidden())
+			.unwrap();
 		let info = moq_net::track::Info::default().with_timescale(moq_net::Timescale::MICRO);
-		let track = broadcast.create_track("data", info).unwrap();
-		broadcast.announce(Default::default()).unwrap();
+		let track = broadcast.broadcast().create_track("data", info).unwrap();
+		broadcast.announce().unwrap();
 		let _publisher = connect(
 			moq_net::Client::new().with_publisher(publisher.consume()),
 			version,
@@ -75,14 +77,15 @@ fn publish(
 	name: &str,
 ) -> (
 	moq_net::origin::Producer,
-	moq_net::origin::Publication,
+	moq_net::origin::Route,
 	moq_net::track::Producer,
 ) {
 	let origin = memory::origin();
-	let broadcast = origin.create_broadcast(name).expect("create broadcast");
-	broadcast.announce(Default::default()).expect("announce");
+	let broadcast = origin
+		.route(name, moq_net::origin::RouteOptions::default())
+		.expect("create broadcast");
 	let info = moq_net::track::Info::default().with_timescale(moq_net::Timescale::MILLI);
-	let track = broadcast.create_track("video", info).expect("create track");
+	let track = broadcast.broadcast().create_track("video", info).expect("create track");
 	let mut group = track.append_group().expect("append group");
 	group
 		.write_frame(moq_net::Timestamp::ZERO, name.as_bytes())
diff --git a/rs/moq-relay/tests/integration/embed.rs b/rs/moq-relay/tests/integration/embed.rs
index 5e36108e209..98580bc7f07 100644
--- a/rs/moq-relay/tests/integration/embed.rs
+++ b/rs/moq-relay/tests/integration/embed.rs
@@ -273,9 +273,13 @@ async fn embed_and_stop(mut config: Config) {
 		"authorization"
 	);
 
-	let broadcast = origin.create_broadcast("test").expect("create broadcast");
-	broadcast.announce(Default::default()).expect("announce");
-	let track = broadcast.create_track("video", timed()).expect("create track");
+	let broadcast = origin
+		.route("test", moq_net::origin::RouteOptions::default())
+		.expect("create broadcast");
+	let track = broadcast
+		.broadcast()
+		.create_track("video", timed())
+		.expect("create track");
 	let mut group = track.append_group().expect("append group");
 	group
 		.write_frame(moq_net::Timestamp::ZERO, b"hello".as_ref())
diff --git a/rs/moq-relay/tests/integration/goaway_cluster.rs b/rs/moq-relay/tests/integration/goaway_cluster.rs
index 816567946c7..fd70d041624 100644
--- a/rs/moq-relay/tests/integration/goaway_cluster.rs
+++ b/rs/moq-relay/tests/integration/goaway_cluster.rs
@@ -152,9 +152,13 @@ async fn cluster_continues_a_group_split_by_goaway_inner() {
 	let _ = rind_rustls::default_provider().unwrap().install_default();
 
 	let upstream_origin = moq_tokio::origin::spawn();
-	let broadcast = upstream_origin.create_broadcast("cam").expect("create broadcast");
-	broadcast.announce(Default::default()).expect("announce");
-	let track = broadcast.create_track("video", timed()).expect("create track");
+	let broadcast = upstream_origin
+		.route("cam", moq_net::origin::RouteOptions::default())
+		.expect("create broadcast");
+	let track = broadcast
+		.broadcast()
+		.create_track("video", timed())
+		.expect("create track");
 
 	let (port_a, mut accepted_a, _handle_a) = spawn_upstream(upstream_origin.clone()).await;
 	let (port_b, mut accepted_b, _handle_b) = spawn_upstream(upstream_origin.clone()).await;
@@ -221,7 +225,7 @@ async fn cluster_continues_a_group_split_by_goaway_inner() {
 			| moq_net::origin::RouteEvent::Update(update)
 			| moq_net::origin::RouteEvent::Restart(update)
 			| moq_net::origin::RouteEvent::Takeover { announce: update, .. } = event
-				&& update.route.cost != moq_net::origin::Cost::DRAIN
+				&& update.route.cost() != moq_net::origin::Cost::DRAIN
 			{
 				break;
 			}
@@ -292,9 +296,13 @@ async fn cluster_migrates_on_upstream_goaway_inner() {
 	kio::clock::timeout(TEST_TIMEOUT, async {
 		// ── the shared "live" broadcast both siblings can serve ─────────
 		let upstream_origin = moq_tokio::origin::spawn();
-		let broadcast = upstream_origin.create_broadcast("cam").expect("create broadcast");
-		broadcast.announce(Default::default()).expect("create broadcast");
-		let track = broadcast.create_track("video", timed()).expect("create track");
+		let broadcast = upstream_origin
+			.route("cam", moq_net::origin::RouteOptions::default())
+			.expect("create broadcast");
+		let track = broadcast
+			.broadcast()
+			.create_track("video", timed())
+			.expect("create track");
 
 		let (port_a, mut accepted_a, _handle_a) = spawn_upstream(upstream_origin.clone()).await;
 		let (port_b, mut accepted_b, _handle_b) = spawn_upstream(upstream_origin.clone()).await;
@@ -485,11 +493,13 @@ async fn cluster_diamond_goaway_seamless_failover_inner() {
 
 	// ── TOP: origin server serving the same broadcast to both mids ──────
 	let top_origin = moq_tokio::origin::spawn();
-	let broadcast = top_origin.create_broadcast("diamond").expect("create broadcast");
-	broadcast
-		.announce(moq_net::origin::Route::default())
+	let broadcast = top_origin
+		.route("diamond", moq_net::origin::RouteOptions::default())
 		.expect("create broadcast");
-	let track = broadcast.create_track("video", timed()).expect("create track");
+	let track = broadcast
+		.broadcast()
+		.create_track("video", timed())
+		.expect("create track");
 
 	let (top_port, mut top_accepted, _top_handle) = spawn_upstream(top_origin.clone()).await;
 	let top_url = format!("tcp://127.0.0.1:{top_port}/");
diff --git a/rs/moq-relay/tests/integration/hidden_cluster.rs b/rs/moq-relay/tests/integration/hidden_cluster.rs
index bb2e8bb64c1..604225be1d7 100644
--- a/rs/moq-relay/tests/integration/hidden_cluster.rs
+++ b/rs/moq-relay/tests/integration/hidden_cluster.rs
@@ -67,8 +67,10 @@ async fn old_peer_keeps_hidden_paths(version: moq_net::Version) {
 		cluster_config.connect = vec![Peer::new(format!("tcp://127.0.0.1:{port}/"))];
 		let cluster =
 			crate::spawn_cluster(cluster::Options::new(cluster_config)).with_connect(client_config, Default::default());
-		let node = cluster.origin.create_broadcast(".hidden/test").expect("create hidden");
-		node.announce(Default::default()).expect("announce hidden");
+		let _node = cluster
+			.origin
+			.route(".hidden/test", moq_net::origin::RouteOptions::default())
+			.expect("create hidden");
 		let cluster_run = tokio::spawn(cluster.clone().start().await.expect("cluster start").run());
 
 		loop {
diff --git a/rs/moq-relay/tests/integration/public_rules.rs b/rs/moq-relay/tests/integration/public_rules.rs
index d3d5cc73c5d..d0bf410f90c 100644
--- a/rs/moq-relay/tests/integration/public_rules.rs
+++ b/rs/moq-relay/tests/integration/public_rules.rs
@@ -70,9 +70,13 @@ fn url(port: u16, path: &str) -> url::Url {
 /// handles alive for as long as the broadcast should stay announced.
 async fn publish(url: url::Url, name: &str) -> Box<dyn std::any::Any> {
 	let origin = moq_tokio::origin::spawn();
-	let broadcast = origin.create_broadcast(name).expect("create broadcast");
-	broadcast.announce(Default::default()).expect("announce");
-	let track = broadcast.create_track("video", timed()).expect("create track");
+	let broadcast = origin
+		.route(name, moq_net::origin::RouteOptions::default())
+		.expect("create broadcast");
+	let track = broadcast
+		.broadcast()
+		.create_track("video", timed())
+		.expect("create track");
 	let mut group = track.append_group().expect("append group");
 	group
 		.write_frame(moq_net::Timestamp::ZERO, b"hello".as_ref())
diff --git a/rs/moq-relay/tests/integration/runtime_uring.rs b/rs/moq-relay/tests/integration/runtime_uring.rs
index 11a7dcff842..6aa98392bac 100644
--- a/rs/moq-relay/tests/integration/runtime_uring.rs
+++ b/rs/moq-relay/tests/integration/runtime_uring.rs
@@ -165,9 +165,13 @@ async fn uring_workers_serve_webtransport_and_raw_quic() {
 	let raw_url: url::Url = format!("moql://127.0.0.1:{port}/uring").parse().expect("parse url");
 
 	let origin = moq_tokio::origin::spawn();
-	let broadcast = origin.create_broadcast("test").expect("create broadcast");
-	broadcast.announce(Default::default()).expect("create broadcast");
-	let track = broadcast.create_track("video", timed()).expect("create track");
+	let broadcast = origin
+		.route("test", moq_net::origin::RouteOptions::default())
+		.expect("create broadcast");
+	let track = broadcast
+		.broadcast()
+		.create_track("video", timed())
+		.expect("create track");
 	let mut group = track.append_group().expect("append group");
 	group
 		.write_frame(moq_net::Timestamp::ZERO, b"hello".as_ref())
@@ -257,9 +261,13 @@ async fn uring_workers_serve_every_configured_version() {
 	ready.wait().await.expect("relay ready");
 
 	let origin = moq_tokio::origin::spawn();
-	let broadcast = origin.create_broadcast("test").expect("create broadcast");
-	broadcast.announce(Default::default()).expect("announce broadcast");
-	let track = broadcast.create_track("video", timed()).expect("create track");
+	let broadcast = origin
+		.route("test", moq_net::origin::RouteOptions::default())
+		.expect("create broadcast");
+	let track = broadcast
+		.broadcast()
+		.create_track("video", timed())
+		.expect("create track");
 	let mut group = track.append_group().expect("append group");
 	group
 		.write_frame(moq_net::Timestamp::ZERO, b"hello".as_ref())
@@ -686,9 +694,13 @@ async fn an_mtls_client_authenticates_without_a_token() {
 	// connecting proves nothing.
 	let url: url::Url = format!("moql://127.0.0.1:{port}/mtls").parse().expect("parse url");
 	let origin = moq_tokio::origin::spawn();
-	let broadcast = origin.create_broadcast("test").expect("create broadcast");
-	broadcast.announce(Default::default()).expect("create broadcast");
-	let track = broadcast.create_track("video", timed()).expect("create track");
+	let broadcast = origin
+		.route("test", moq_net::origin::RouteOptions::default())
+		.expect("create broadcast");
+	let track = broadcast
+		.broadcast()
+		.create_track("video", timed())
+		.expect("create track");
 	let mut group = track.append_group().expect("append group");
 	group
 		.write_frame(moq_net::Timestamp::ZERO, b"hello".as_ref())
@@ -767,9 +779,13 @@ async fn uring_workers_write_qlog_traces() {
 	// rather than a connection that only ever exchanged Initials.
 	let url: url::Url = format!("moql://127.0.0.1:{port}/qlog").parse().expect("parse url");
 	let origin = moq_tokio::origin::spawn();
-	let broadcast = origin.create_broadcast("test").expect("create broadcast");
-	broadcast.announce(Default::default()).expect("create broadcast");
-	let track = broadcast.create_track("video", timed()).expect("create track");
+	let broadcast = origin
+		.route("test", moq_net::origin::RouteOptions::default())
+		.expect("create broadcast");
+	let track = broadcast
+		.broadcast()
+		.create_track("video", timed())
+		.expect("create track");
 	let mut group = track.append_group().expect("append group");
 	group
 		.write_frame(moq_net::Timestamp::ZERO, b"hello".as_ref())
diff --git a/rs/moq-relay/tests/integration/runtime_workers.rs b/rs/moq-relay/tests/integration/runtime_workers.rs
index 509080ae6bc..2a96182fc7f 100644
--- a/rs/moq-relay/tests/integration/runtime_workers.rs
+++ b/rs/moq-relay/tests/integration/runtime_workers.rs
@@ -98,9 +98,13 @@ async fn workers_serve_quic_and_share_one_origin() {
 
 	// ── publisher ───────────────────────────────────────────────────
 	let origin = moq_tokio::origin::spawn();
-	let broadcast = origin.create_broadcast("test").expect("create broadcast");
-	broadcast.announce(Default::default()).expect("create broadcast");
-	let track = broadcast.create_track("video", timed()).expect("create track");
+	let broadcast = origin
+		.route("test", moq_net::origin::RouteOptions::default())
+		.expect("create broadcast");
+	let track = broadcast
+		.broadcast()
+		.create_track("video", timed())
+		.expect("create track");
 	let mut group = track.append_group().expect("append group");
 	group
 		.write_frame(moq_net::Timestamp::ZERO, b"hello".as_ref())
diff --git a/rs/moq-relay/tests/integration/shutdown_signal.rs b/rs/moq-relay/tests/integration/shutdown_signal.rs
index edaa614f129..5c5d3c962ff 100644
--- a/rs/moq-relay/tests/integration/shutdown_signal.rs
+++ b/rs/moq-relay/tests/integration/shutdown_signal.rs
@@ -437,8 +437,9 @@ async fn a_reconnecting_client_rides_out_a_restart_inner() {
 	let url: url::Url = format!("tcp://{addr}/").parse().expect("parse url");
 
 	let origin = moq_tokio::origin::spawn();
-	let broadcast = origin.create_broadcast("cam").expect("create broadcast");
-	broadcast.announce(Default::default()).expect("announce");
+	let _broadcast = origin
+		.route("cam", moq_net::origin::RouteOptions::default())
+		.expect("create broadcast");
 	let mut publisher = moq_tokio::connect::Config::default();
 	// Redials paced well inside the drain, under a window that ends long before it.
 	publisher.backoff.initial = Some((DRAIN_TIMEOUT / 15).into());
diff --git a/rs/moq-relay/tests/integration/smoke.rs b/rs/moq-relay/tests/integration/smoke.rs
index 2d71d3770a3..2201bb7339b 100644
--- a/rs/moq-relay/tests/integration/smoke.rs
+++ b/rs/moq-relay/tests/integration/smoke.rs
@@ -148,9 +148,13 @@ async fn relay_websocket_round_trip_uses_newest_version() {
 
 	// ── publisher ───────────────────────────────────────────────────
 	let pub_origin = moq_tokio::origin::spawn();
-	let broadcast = pub_origin.create_broadcast("test").expect("create broadcast");
-	broadcast.announce(Default::default()).expect("create broadcast");
-	let track = broadcast.create_track("video", timed()).expect("create track");
+	let broadcast = pub_origin
+		.route("test", moq_net::origin::RouteOptions::default())
+		.expect("create broadcast");
+	let track = broadcast
+		.broadcast()
+		.create_track("video", timed())
+		.expect("create track");
 	let mut group = track.append_group().expect("append group");
 	group
 		.write_frame(moq_net::Timestamp::ZERO, b"hello".as_ref())
@@ -287,9 +291,10 @@ async fn hidden_broadcasts_need_a_lite07_opt_in() {
 	let url: url::Url = format!("ws://127.0.0.1:{port}/hidden").parse().expect("parse url");
 
 	let pub_origin = moq_tokio::origin::spawn();
-	let hidden = pub_origin.create_broadcast(".x/y").expect("create hidden");
-	hidden.announce(Default::default()).expect("announce hidden");
-	let track = hidden.create_track("video", timed()).expect("create track");
+	let hidden = pub_origin
+		.route(".x/y", moq_net::origin::RouteOptions::default())
+		.expect("create hidden");
+	let track = hidden.broadcast().create_track("video", timed()).expect("create track");
 	let mut group = track.append_group().expect("append group");
 	group
 		.write_frame(moq_net::Timestamp::ZERO, b"hidden".as_ref())
@@ -319,8 +324,9 @@ async fn hidden_broadcasts_need_a_lite07_opt_in() {
 
 	// Announced after the hidden one, so any client that could see both lists the
 	// hidden one first (the relay drains its table in path order).
-	let visible = pub_origin.create_broadcast("visible").expect("create visible");
-	visible.announce(Default::default()).expect("announce visible");
+	let visible = pub_origin
+		.route("visible", moq_net::origin::RouteOptions::default())
+		.expect("create visible");
 	assert_eq!(announced_until(&mut opted, "visible").await, ["visible"]);
 
 	// A lite-07 client that did not opt in, and a lite-06 client that cannot even
@@ -494,9 +500,13 @@ async fn relay_websocket_root_path_upgrades() {
 
 	// ── publisher ───────────────────────────────────────────────────
 	let pub_origin = moq_tokio::origin::spawn();
-	let broadcast = pub_origin.create_broadcast("test").expect("create broadcast");
-	broadcast.announce(Default::default()).expect("create broadcast");
-	let track = broadcast.create_track("video", timed()).expect("create track");
+	let broadcast = pub_origin
+		.route("test", moq_net::origin::RouteOptions::default())
+		.expect("create broadcast");
+	let track = broadcast
+		.broadcast()
+		.create_track("video", timed())
+		.expect("create track");
 	let mut group = track.append_group().expect("append group");
 	group
 		.write_frame(moq_net::Timestamp::ZERO, b"hello".as_ref())
@@ -627,9 +637,13 @@ async fn internal_tcp_round_trip() {
 
 	// ── publisher ───────────────────────────────────────────────────
 	let pub_origin = moq_tokio::origin::spawn();
-	let broadcast = pub_origin.create_broadcast("test").expect("create broadcast");
-	broadcast.announce(Default::default()).expect("create broadcast");
-	let track = broadcast.create_track("video", timed()).expect("create track");
+	let broadcast = pub_origin
+		.route("test", moq_net::origin::RouteOptions::default())
+		.expect("create broadcast");
+	let track = broadcast
+		.broadcast()
+		.create_track("video", timed())
+		.expect("create track");
 	let mut group = track.append_group().expect("append group");
 	group
 		.write_frame(moq_net::Timestamp::ZERO, b"hello".as_ref())
@@ -730,9 +744,13 @@ async fn internal_unix_round_trip() {
 
 	// ── publisher ───────────────────────────────────────────────────
 	let pub_origin = moq_tokio::origin::spawn();
-	let broadcast = pub_origin.create_broadcast("test").expect("create broadcast");
-	broadcast.announce(Default::default()).expect("create broadcast");
-	let track = broadcast.create_track("video", timed()).expect("create track");
+	let broadcast = pub_origin
+		.route("test", moq_net::origin::RouteOptions::default())
+		.expect("create broadcast");
+	let track = broadcast
+		.broadcast()
+		.create_track("video", timed())
+		.expect("create track");
 	let mut group = track.append_group().expect("append group");
 	group
 		.write_frame(moq_net::Timestamp::ZERO, b"hello".as_ref())
@@ -814,9 +832,10 @@ fn path_versions() -> Vec<moq_net::Version> {
 /// to that root).
 async fn path_round_trip(version: moq_net::Version, pub_url: url::Url, sub_url: url::Url, broadcast: &str) -> String {
 	let pub_origin = moq_tokio::origin::spawn();
-	let bc = pub_origin.create_broadcast(broadcast).expect("create broadcast");
-	bc.announce(Default::default()).expect("create broadcast");
-	let track = bc.create_track("video", timed()).expect("create track");
+	let bc = pub_origin
+		.route(broadcast, moq_net::origin::RouteOptions::default())
+		.expect("create broadcast");
+	let track = bc.broadcast().create_track("video", timed()).expect("create track");
 	let mut group = track.append_group().expect("append group");
 	group
 		.write_frame(moq_net::Timestamp::ZERO, b"hello".as_ref())
diff --git a/rs/moq-relay/tests/integration/tenant_matrix.rs b/rs/moq-relay/tests/integration/tenant_matrix.rs
index ac4c3c8a9c6..45414539d36 100644
--- a/rs/moq-relay/tests/integration/tenant_matrix.rs
+++ b/rs/moq-relay/tests/integration/tenant_matrix.rs
@@ -212,9 +212,14 @@ impl Publisher {
 	}
 
 	fn publish(&mut self, name: &str) {
-		let broadcast = self.origin.create_broadcast(name).expect("create broadcast");
-		broadcast.announce(Default::default()).expect("announce");
-		let track = broadcast.create_track("video", timed()).expect("create track");
+		let broadcast = self
+			.origin
+			.route(name, moq_net::origin::RouteOptions::default())
+			.expect("create broadcast");
+		let track = broadcast
+			.broadcast()
+			.create_track("video", timed())
+			.expect("create track");
 		let mut group = track.append_group().expect("append group");
 		group
 			.write_frame(moq_net::Timestamp::ZERO, b"hello".as_ref())
diff --git a/rs/moq-relay/tests/integration/upstream_links.rs b/rs/moq-relay/tests/integration/upstream_links.rs
index c4b900ef3c3..71b97ec486a 100644
--- a/rs/moq-relay/tests/integration/upstream_links.rs
+++ b/rs/moq-relay/tests/integration/upstream_links.rs
@@ -144,7 +144,7 @@ async fn node(id: u64, connect: Vec<Peer>) -> Node {
 /// A broadcast writing a group every 50ms on `origin`, so a subscriber attaching
 /// at any point receives one. Dropping it ends the broadcast.
 struct Publisher {
-	_broadcast: moq_net::origin::Publication,
+	_route: moq_net::origin::Route,
 	writer: tokio::task::AbortHandle,
 }
 
@@ -155,8 +155,8 @@ impl Drop for Publisher {
 }
 
 fn publish(origin: &origin::Producer, path: &str) -> Publisher {
-	let broadcast = origin.publish(path, Default::default()).expect("publish");
-	let track = broadcast.create_track("video", timed()).expect("create track");
+	let route = origin.route(path, Default::default()).expect("publish");
+	let track = route.broadcast().create_track("video", timed()).expect("create track");
 	let writer = tokio::spawn(async move {
 		loop {
 			let Ok(mut group) = track.append_group() else { break };
@@ -167,10 +167,7 @@ fn publish(origin: &origin::Producer, path: &str) -> Publisher {
 		}
 	})
 	.abort_handle();
-	Publisher {
-		_broadcast: broadcast,
-		writer,
-	}
+	Publisher { _route: route, writer }
 }
 
 /// Subscribe to `path` through `origin`'s routes and read one frame.
@@ -214,7 +211,7 @@ fn routes(origin: &origin::Producer) -> BTreeMap<String, Vec<u64>> {
 		let origin::RouteEvent::Start(announce) = event else {
 			panic!("an initial set is only starts: got {event:?}");
 		};
-		let hops = announce.route.hops.iter().map(|hop| hop.id()).collect();
+		let hops = announce.route.hops().iter().map(|hop| hop.id()).collect();
 		routes.insert(announce.prefix.as_str().to_string(), hops);
 	}
 	routes
diff --git a/rs/moq-room/src/chat.rs b/rs/moq-room/src/chat.rs
index 7b0805e71a3..0c4244437da 100644
--- a/rs/moq-room/src/chat.rs
+++ b/rs/moq-room/src/chat.rs
@@ -275,9 +275,11 @@ mod tests {
 	#[tokio::test(start_paused = true)]
 	async fn a_warm_copy_starts_at_the_newest_window() {
 		let publisher = origin(1);
-		let broadcast = publisher.create_broadcast("room").unwrap();
-		let track = broadcast.create_track(TRACK, info()).unwrap();
-		broadcast.announce(Default::default()).unwrap();
+		let broadcast = publisher
+			.route("room", moq_net::origin::RouteOptions::hidden())
+			.unwrap();
+		let track = broadcast.broadcast().create_track(TRACK, info()).unwrap();
+		broadcast.announce().unwrap();
 		let mut demand = track.demand();
 		let mut chat = moq_json::window::Producer::<String>::new(
 			track,
diff --git a/rs/moq-room/src/room.rs b/rs/moq-room/src/room.rs
index 14f4a4f6bc8..d4768347d05 100644
--- a/rs/moq-room/src/room.rs
+++ b/rs/moq-room/src/room.rs
@@ -142,16 +142,16 @@ impl Room {
 #[cfg(test)]
 mod tests {
 	use super::*;
-	use moq_net::{Path, origin::Route};
+	use moq_net::Path;
 
 	fn origin() -> origin::Producer {
 		moq_tokio::origin::spawn()
 	}
 
-	fn publish(origin: &origin::Producer, path: &str) -> origin::Publication {
-		let broadcast = origin.create_broadcast(path).expect(path);
-		broadcast.announce(Route::default()).expect("announce");
-		broadcast
+	fn publish(origin: &origin::Producer, path: &str) -> origin::Route {
+		origin
+			.route(path, moq_net::origin::RouteOptions::default())
+			.expect(path)
 	}
 
 	#[tokio::test]
@@ -184,8 +184,10 @@ mod tests {
 		let origin = origin();
 		let mut room = Room::new(&origin.consume(), None);
 
-		let claim = origin.requests("bob/camera").expect("claim");
-		let (request, nothing) = tokio::join!(claim.requested_broadcast(), kio::clock::timeout(wait, room.next()));
+		let claim = origin
+			.route_prefix("bob/camera", moq_net::origin::RouteOptions::default())
+			.expect("claim");
+		let (request, nothing) = tokio::join!(claim.requested(), kio::clock::timeout(wait, room.next()));
 		assert!(nothing.is_err(), "nothing serves bob yet");
 		request.expect("requested").reject(moq_net::Error::NotFound);
 		// The refusal yields nothing.
diff --git a/rs/moq-rtc/src/client/mod.rs b/rs/moq-rtc/src/client/mod.rs
index e726dd9e9c3..8acb15a54ed 100644
--- a/rs/moq-rtc/src/client/mod.rs
+++ b/rs/moq-rtc/src/client/mod.rs
@@ -104,7 +104,9 @@ mod tests {
 		drop(listener);
 
 		let origin = moq_tokio::origin::spawn();
-		let broadcast = origin.create_broadcast("test").expect("create broadcast");
+		let broadcast = origin
+			.route("test", moq_net::origin::RouteOptions::hidden())
+			.expect("create broadcast");
 		let url = format!("http://user:pass@{address}/whep/test?jwt=secret")
 			.parse()
 			.expect("WHEP URL");
diff --git a/rs/moq-rtc/src/egress.rs b/rs/moq-rtc/src/egress.rs
index 25327f5dacf..41c37a219f3 100644
--- a/rs/moq-rtc/src/egress.rs
+++ b/rs/moq-rtc/src/egress.rs
@@ -621,7 +621,14 @@ mod tests {
 	#[test]
 	fn catalog_codecs_ignores_codecs_available_only_via_escaping_references() {
 		let origin = produce_origin();
-		let source = moq_mux::Source::new(origin.consume(), origin.create_broadcast("a/pub").unwrap().consume());
+		let source = moq_mux::Source::new(
+			origin.consume(),
+			origin
+				.route("a/pub", moq_net::origin::RouteOptions::hidden())
+				.unwrap()
+				.broadcast()
+				.consume(),
+		);
 		let mut catalog = Catalog::default();
 
 		let mut escaped_audio = AudioConfig::new(AudioCodec::Opus, 48_000, 2);
@@ -656,7 +663,14 @@ mod tests {
 	#[test]
 	fn picks_the_best_video_rendition_whatever_its_name() {
 		let origin = produce_origin();
-		let source = moq_mux::Source::new(origin.consume(), origin.create_broadcast("a/pub").unwrap().consume());
+		let source = moq_mux::Source::new(
+			origin.consume(),
+			origin
+				.route("a/pub", moq_net::origin::RouteOptions::hidden())
+				.unwrap()
+				.broadcast()
+				.consume(),
+		);
 		let mut catalog = Catalog::default();
 
 		let rendition = |height: u32| {
@@ -696,7 +710,14 @@ mod tests {
 	#[test]
 	fn picks_the_preferred_codec_whatever_the_peer_offers_first() {
 		let origin = produce_origin();
-		let source = moq_mux::Source::new(origin.consume(), origin.create_broadcast("a/pub").unwrap().consume());
+		let source = moq_mux::Source::new(
+			origin.consume(),
+			origin
+				.route("a/pub", moq_net::origin::RouteOptions::hidden())
+				.unwrap()
+				.broadcast()
+				.consume(),
+		);
 		let mut catalog = Catalog::default();
 
 		// An H.265 source beside its own H.264 compatibility transcode, which has the higher bitrate.
@@ -746,7 +767,14 @@ mod tests {
 	#[test]
 	fn picks_the_best_opus_rendition_whatever_its_name() {
 		let origin = produce_origin();
-		let source = moq_mux::Source::new(origin.consume(), origin.create_broadcast("a/pub").unwrap().consume());
+		let source = moq_mux::Source::new(
+			origin.consume(),
+			origin
+				.route("a/pub", moq_net::origin::RouteOptions::hidden())
+				.unwrap()
+				.broadcast()
+				.consume(),
+		);
 		let mut catalog = Catalog::default();
 
 		let opus = |bitrate: Option<u64>| {
@@ -899,8 +927,8 @@ mod tests {
 	#[tokio::test(start_paused = true)]
 	async fn a_moved_rendition_follows_its_new_track() {
 		let origin = produce_origin();
-		let live = origin.publish("live", Default::default()).unwrap();
-		let other = origin.publish("other", Default::default()).unwrap();
+		let live = origin.route("live", moq_net::origin::RouteOptions::default()).unwrap();
+		let other = origin.route("other", moq_net::origin::RouteOptions::default()).unwrap();
 		let mut catalog =
 			moq_mux::catalog::Producer::new(&mut live.broadcast().clone(), moq_mux::catalog::Config::default())
 				.unwrap();
@@ -1243,7 +1271,9 @@ mod tests {
 		assert_eq!(written(&mut writes).await.as_ref(), b"low-0");
 
 		// The better rendition lives in a broadcast whose request is never answered.
-		let _handler = origin.requests("missing").unwrap();
+		let _handler = origin
+			.route_prefix("missing", moq_net::origin::RouteOptions::default())
+			.unwrap();
 		let mut config = VideoConfig::new(VideoCodec::VP8);
 		config.container = hang::catalog::Container::Legacy;
 		config.coded_width = Some(1920);
diff --git a/rs/moq-rtc/src/ingest.rs b/rs/moq-rtc/src/ingest.rs
index b1a8ca841a1..15b3c1e0101 100644
--- a/rs/moq-rtc/src/ingest.rs
+++ b/rs/moq-rtc/src/ingest.rs
@@ -12,15 +12,28 @@ pub struct IngestSink {
 	broadcast: moq_net::broadcast::Producer,
 	catalog: moq_mux::catalog::Producer,
 	bridges: session::Bridges,
+	/// The route announcing the broadcast, when the sink owns it: held for the session's
+	/// life, linger included, and retracted when the session drops it.
+	_route: Option<moq_net::origin::Route>,
 }
 
 impl IngestSink {
+	/// Fill `broadcast`, whose announcement the caller owns.
 	pub fn new(mut broadcast: moq_net::broadcast::Producer, config: moq_mux::catalog::Config) -> Result<Self> {
 		let catalog = moq_mux::catalog::Producer::new(&mut broadcast, config)?;
 		Ok(Self {
 			broadcast,
 			catalog,
 			bridges: session::Bridges::new(),
+			_route: None,
+		})
+	}
+
+	/// Fill `route`'s broadcast, keeping the route for the session's life.
+	pub fn routed(route: moq_net::origin::Route, config: moq_mux::catalog::Config) -> Result<Self> {
+		Ok(Self {
+			_route: Some(route.clone()),
+			..Self::new(route.broadcast().clone(), config)?
 		})
 	}
 }
diff --git a/rs/moq-rtc/src/lib.rs b/rs/moq-rtc/src/lib.rs
index b7a9bec41c1..94ec1f5c32a 100644
--- a/rs/moq-rtc/src/lib.rs
+++ b/rs/moq-rtc/src/lib.rs
@@ -142,43 +142,46 @@ mod tests {
 			.expect("publish source packet");
 	}
 
-	/// Publish an Opus instance of `source` under `instance`, keeping its catalog so the test can
-	/// kill the instance.
-	fn publish_opus(
-		origin: &moq_net::origin::Producer,
-		instance: moq_net::Instance,
-	) -> (Box<dyn Bridge>, moq_mux::catalog::Producer) {
-		let broadcast = origin.create_broadcast("source").expect("create source broadcast");
-		broadcast
-			.announce(moq_net::origin::Route::default().with_instance(instance, 0))
-			.expect("announce source broadcast");
+	/// An Opus instance of `source`: its route, its bridge, and its catalog, kept so the test
+	/// can kill the instance.
+	type Opus = (moq_net::origin::Route, Box<dyn Bridge>, moq_mux::catalog::Producer);
+
+	/// Publish an Opus instance of `source` under `instance`.
+	fn publish_opus(origin: &moq_net::origin::Producer, instance: moq_net::Instance) -> Opus {
+		let route = origin
+			.route(
+				"source",
+				moq_net::origin::RouteOptions::default().with_instance(instance, 0),
+			)
+			.expect("publish source broadcast");
 		let catalog =
-			moq_mux::catalog::Producer::new(&mut broadcast.broadcast().clone(), moq_mux::catalog::Config::default())
+			moq_mux::catalog::Producer::new(&mut route.broadcast().clone(), moq_mux::catalog::Config::default())
 				.expect("create source catalog");
-		let bridge = crate::codec::opus::Bridge::new(broadcast.broadcast().clone(), catalog.clone(), 48_000, 2)
+		let bridge = crate::codec::opus::Bridge::new(route.broadcast().clone(), catalog.clone(), 48_000, 2)
 			.expect("create Opus bridge");
-		(Box::new(bridge), catalog)
+		(route, Box::new(bridge), catalog)
 	}
 
 	/// Publish a replacement instance of `source`, returning once the origin serves it.
-	async fn take_over(origin: &moq_net::origin::Producer) -> (Box<dyn Bridge>, moq_mux::catalog::Producer) {
+	async fn take_over(origin: &moq_net::origin::Producer) -> Opus {
 		let instance = moq_net::Instance::random();
 		let mut instances = origin.consume().follow("source", instance.clone()).unwrap();
-		let (mut new, catalog) = publish_opus(origin, instance);
+		let (route, mut new, catalog) = publish_opus(origin, instance);
 		push(&mut *new, 20_000, NEW_PACKET);
 		let started = kio::clock::timeout(TIMEOUT, instances.available())
 			.await
 			.expect("the replacement never took over")
 			.unwrap();
 		assert!(started.is_some());
-		(new, catalog)
+		(route, new, catalog)
 	}
 
 	/// Kill an instance the way a dropped publisher session does.
-	fn kill(bridge: Box<dyn Bridge>, catalog: moq_mux::catalog::Producer) {
+	fn kill((route, bridge, catalog): Opus) {
 		let err = moq_net::Error::Transport("connection lost".into());
 		bridge.abort(err.clone());
 		catalog.abort(err);
+		drop(route);
 	}
 
 	/// A WHEP viewer stays on the instance its session resolved: a publisher taking over the
@@ -187,7 +190,7 @@ mod tests {
 	#[tokio::test]
 	async fn a_whep_viewer_stays_on_its_instance_until_the_route_dies() {
 		let origin = moq_tokio::origin::spawn();
-		let (mut old, old_catalog) = publish_opus(&origin, moq_net::Instance::random());
+		let (old_route, mut old, old_catalog) = publish_opus(&origin, moq_net::Instance::random());
 		push(&mut *old, 20_000, OPUS_PACKET);
 
 		let server = Server::new(server::Config::default());
@@ -213,9 +216,9 @@ mod tests {
 
 		let output_origin = moq_tokio::origin::spawn();
 		let output = output_origin
-			.create_broadcast("output")
+			.route("output", moq_net::origin::RouteOptions::hidden())
 			.expect("create output broadcast");
-		let output_consumer = output.consume();
+		let output_consumer = output.broadcast().consume();
 		let client = Client::new(client::Config::default());
 		let url = format!("http://{address}/whep/source").parse().expect("WHEP URL");
 		let fill = output.broadcast().clone();
@@ -235,7 +238,7 @@ mod tests {
 			"the viewer left its instance"
 		);
 
-		kill(old, old_catalog);
+		kill((old_route, old, old_catalog));
 		let ended = kio::clock::timeout(TIMEOUT, session)
 			.await
 			.expect("the session outlived its route")
@@ -250,7 +253,7 @@ mod tests {
 	#[tokio::test]
 	async fn a_whip_push_stays_on_its_instance_until_the_route_dies() {
 		let origin = moq_tokio::origin::spawn();
-		let (mut old, old_catalog) = publish_opus(&origin, moq_net::Instance::random());
+		let (old_route, mut old, old_catalog) = publish_opus(&origin, moq_net::Instance::random());
 		push(&mut *old, 20_000, OPUS_PACKET);
 
 		let server = Server::new(server::Config::default());
@@ -301,7 +304,7 @@ mod tests {
 			"the push left its instance"
 		);
 
-		kill(old, old_catalog);
+		kill((old_route, old, old_catalog));
 		let pushed = kio::clock::timeout(TIMEOUT, pushed)
 			.await
 			.expect("the push outlived its route")
@@ -371,8 +374,9 @@ mod tests {
 		}
 
 		let origin = moq_tokio::origin::spawn();
-		let broadcast = origin.create_broadcast("source").unwrap();
-		broadcast.announce(moq_net::origin::Route::default()).unwrap();
+		let broadcast = origin
+			.route("source", moq_net::origin::RouteOptions::default())
+			.unwrap();
 		let catalog =
 			moq_mux::catalog::Producer::new(&mut broadcast.broadcast().clone(), moq_mux::catalog::Config::default())
 				.unwrap();
@@ -407,7 +411,7 @@ mod tests {
 	#[tokio::test]
 	async fn a_whip_publisher_past_its_cap_plus_burst_is_closed() {
 		let origin = moq_tokio::origin::spawn();
-		let (mut opus, _catalog) = publish_opus(&origin, moq_net::Instance::random());
+		let (_route, mut opus, _catalog) = publish_opus(&origin, moq_net::Instance::random());
 		// 8 kbps with a tenth of a second of burst allows 100 bytes up front.
 		let cap = crate::rate::Cap::new(moq_net::bandwidth::Rate::from_kbps(8)).with_burst(Duration::from_millis(100));
 		let (address, http, mut sessions) = serve_capped_whip(crate::rate::Limit::new(cap)).await;
@@ -434,11 +438,8 @@ mod tests {
 		let source_consumer = source_origin.consume();
 		let mut announcements = source_consumer.announced();
 		let source = source_origin
-			.create_broadcast("source")
+			.route("source", moq_net::origin::RouteOptions::default())
 			.expect("create source broadcast");
-		source
-			.announce(moq_net::origin::Route::default())
-			.expect("announce source broadcast");
 		let catalog =
 			moq_mux::catalog::Producer::new(&mut source.broadcast().clone(), moq_mux::catalog::Config::default())
 				.expect("create source catalog");
@@ -533,9 +534,9 @@ mod tests {
 
 		let output_origin = moq_tokio::origin::spawn();
 		let output = output_origin
-			.create_broadcast("output")
+			.route("output", moq_net::origin::RouteOptions::hidden())
 			.expect("create output broadcast");
-		let output_consumer = output.consume();
+		let output_consumer = output.broadcast().consume();
 		let whep = format!("http://user:pass@{address}/whep/ingested?jwt=secret")
 			.parse()
 			.expect("WHEP URL");
diff --git a/rs/moq-rtc/src/server/whep.rs b/rs/moq-rtc/src/server/whep.rs
index 5f0cdc9a224..501939c852b 100644
--- a/rs/moq-rtc/src/server/whep.rs
+++ b/rs/moq-rtc/src/server/whep.rs
@@ -293,10 +293,9 @@ mod tests {
 	async fn a_broadcast_resolves_through_a_lazy_client_session() {
 		let pub_origin = moq_tokio::origin::spawn();
 
-		let source = pub_origin.create_broadcast("cam").expect("create broadcast");
-		source
-			.announce(moq_net::origin::Route::default())
-			.expect("announce broadcast");
+		let source = pub_origin
+			.route("cam", moq_net::origin::RouteOptions::default())
+			.expect("create broadcast");
 		let catalog =
 			moq_mux::catalog::Producer::new(&mut source.broadcast().clone(), moq_mux::catalog::Config::default())
 				.expect("create catalog");
@@ -324,10 +323,9 @@ mod tests {
 	#[tokio::test]
 	async fn offers_ride_the_routers_scope_watch() {
 		let pub_origin = moq_tokio::origin::spawn();
-		let other = pub_origin.create_broadcast("other").expect("create broadcast");
-		other
-			.announce(moq_net::origin::Route::default())
-			.expect("announce broadcast");
+		let other = pub_origin
+			.route("other", moq_net::origin::RouteOptions::default())
+			.expect("create broadcast");
 		let (sub_origin, _connection, accept) = lazy_client(pub_origin).await;
 
 		let _router = super::router(crate::server::Server::new(Default::default()), sub_origin.consume());
diff --git a/rs/moq-rtc/src/server/whip.rs b/rs/moq-rtc/src/server/whip.rs
index 81eed0b097e..9d6341ff336 100644
--- a/rs/moq-rtc/src/server/whip.rs
+++ b/rs/moq-rtc/src/server/whip.rs
@@ -158,12 +158,12 @@ pub async fn accept(server: &Server, request: Request<'_>) -> Result<Response> {
 
 	// Create the broadcast hidden up front, so an out-of-scope offer is refused before
 	// any mux work. It announces only once negotiation succeeds (below).
-	let producer = publisher.create_broadcast(&broadcast)?;
-	let handle = producer.clone();
+	// The session's sink holds the route, so it stays announced until the session ends.
+	let route = publisher.route(&broadcast, moq_net::origin::RouteOptions::hidden())?;
 	let config = moq_mux::catalog::Config::default()
 		.with_max_age(server.config().max_age)
 		.with_bandwidth(server.config().bandwidth.clone());
-	let sink = Box::new(IngestSink::new(producer.broadcast().clone(), config)?);
+	let sink = Box::new(IngestSink::routed(route.clone(), config)?);
 
 	// Register a session on the shared media mux: known ICE credentials (so the
 	// demux routes this peer's STUN by ufrag), an inbox to read datagrams from,
@@ -183,10 +183,10 @@ pub async fn accept(server: &Server, request: Request<'_>) -> Result<Response> {
 	// Announce only once negotiation succeeded, so a failed offer leaves a live
 	// session's broadcast alone, but before returning the answer, so a fast
 	// subscriber doesn't see a 404 in the gap before the first RTP packet. Each
-	// offer is its own publisher instance, so a reconnect replaces a stale
-	// session's broadcast instead of resuming into it.
-	let instance = moq_net::Instance::random();
-	handle.announce(moq_net::origin::Route::default().with_instance(instance.clone(), 0))?;
+	// offer is its own route under a fresh instance, so a reconnect replaces a
+	// stale session's broadcast instead of resuming into it.
+	route.announce()?;
+	let instance = route.instance();
 
 	let resource_id = sdp::new_resource_id();
 	let socket = moq_ice::Socket::new(mux.socket(), mux.candidates().to_vec(), inbound)?;
diff --git a/rs/moq-rtmp/src/dial.rs b/rs/moq-rtmp/src/dial.rs
index acc98c9e4e6..02bdfeee304 100644
--- a/rs/moq-rtmp/src/dial.rs
+++ b/rs/moq-rtmp/src/dial.rs
@@ -344,7 +344,7 @@ impl<S: Stream> Client<S> {
 
 		// The stream key is the ingest credential (`rtmp://host/<app>/<key>`), so the
 		// app and broadcast path stand in for it.
-		tracing::info!(app = %self.app, %path, instance = %publisher.instance, "rtmp play accepted by remote");
+		tracing::info!(app = %self.app, %path, instance = %publisher.route.instance(), "rtmp play accepted by remote");
 
 		let result = self.pull_media(&mut publisher).await;
 		match result {
@@ -587,34 +587,27 @@ struct Publisher {
 	importer: FlvImport,
 	// Finished at a clean end, so the finished broadcast keeps serving the catalog.
 	catalog: moq_mux::catalog::Producer,
-	// Controls publication so an end can retract before the importer's fill clone drops.
-	broadcast: moq_net::origin::Publication,
-	// This pull's publisher instance, so pulling again replaces it rather than resuming into it.
-	instance: moq_net::Instance,
+	// Announces the path under this pull's fresh instance, so pulling again replaces it rather
+	// than resuming into it. Closing its broadcast retracts it before the importer's fill clone drops.
+	route: moq_net::origin::Route,
 	media_deadline: kio::clock::Instant,
 }
 
 impl Publisher {
 	fn new(origin: &origin::Producer, path: &str, config: moq_mux::catalog::Config) -> anyhow::Result<Self> {
-		let instance = moq_net::Instance::random();
-		let broadcast = origin
-			.publish(
-				path,
-				moq_net::origin::Route::default().with_instance(instance.clone(), 0),
-			)
+		let route = origin
+			.route(path, moq_net::origin::RouteOptions::default())
 			.map_err(|err| anyhow::anyhow!("broadcast '{path}' could not be published: {err}"))?;
-		let catalog = moq_mux::catalog::Producer::new(&mut broadcast.broadcast().clone(), config)?;
-		let handle = broadcast.clone();
-		let mut importer = FlvImport::new(broadcast.broadcast().clone(), catalog.reserve());
+		let catalog = moq_mux::catalog::Producer::new(&mut route.broadcast().clone(), config)?;
+		let mut importer = FlvImport::new(route.broadcast().clone(), catalog.reserve());
 
 		// Feed the FLV file header once up front; media tags follow per message.
 		importer.decode(&flv::file_header())?;
 		Ok(Self {
 			importer,
 			catalog,
-			instance,
 			media_deadline: kio::clock::Instant::now() + crate::server::PUBLISH_IDLE_TIMEOUT,
-			broadcast: handle,
+			route,
 		})
 	}
 
@@ -628,14 +621,14 @@ impl Publisher {
 	fn finish(mut self, linger: Duration) -> anyhow::Result<moq_mux::Linger<Self>> {
 		self.importer.finish()?;
 		self.catalog.finish()?;
-		Ok(moq_mux::Linger::new([self.broadcast.broadcast().clone()], self, linger))
+		Ok(moq_mux::Linger::new([self.route.broadcast().clone()], self, linger))
 	}
 
 	/// Flush any buffered media and finish the catalog, then end the broadcast so the origin unannounces it at once.
 	fn close(mut self) -> anyhow::Result<()> {
 		self.importer.finish()?;
 		self.catalog.finish()?;
-		self.broadcast.close();
+		self.route.broadcast().close();
 		Ok(())
 	}
 
@@ -646,7 +639,7 @@ impl Publisher {
 	fn abort(self, err: moq_net::Error) {
 		self.catalog.abort(err.clone());
 		self.importer.abort(err);
-		self.broadcast.close();
+		self.route.broadcast().close();
 	}
 }
 
@@ -753,15 +746,16 @@ mod tests {
 
 	/// A broadcast with one AVC keyframe at `live/cam0` and its tracks finished, with the
 	/// importer that keeps them listed and the catalog to finish it with.
-	fn source(origin: &origin::Producer) -> (moq_net::origin::Publication, moq_mux::catalog::Producer, FlvImport) {
+	fn source(origin: &origin::Producer) -> (moq_net::origin::Route, moq_mux::catalog::Producer, FlvImport) {
 		let mut vseq = vec![0x17, 0x00, 0x00, 0x00, 0x00];
 		vseq.extend_from_slice(&[0x01, 0x42, 0xc0, 0x1f, 0xff, 0xe1, 0x00, 0x04, 0x67, 0x42, 0xc0, 0x1f]);
 		vseq.extend_from_slice(&[0x01, 0x00, 0x04, 0x68, 0xce, 0x3c, 0x80]);
 		let mut vframe = vec![0x17, 0x01, 0x00, 0x00, 0x00];
 		vframe.extend_from_slice(&[0, 0, 0, 5, 0x65, 0x88, 0x84, 0x21, 0x00]);
 
-		let broadcast = origin.create_broadcast("live/cam0").unwrap();
-		broadcast.announce(Default::default()).unwrap();
+		let broadcast = origin
+			.route("live/cam0", moq_net::origin::RouteOptions::default())
+			.unwrap();
 		let catalog =
 			moq_mux::catalog::Producer::new(&mut broadcast.broadcast().clone(), moq_mux::catalog::Config::default())
 				.unwrap();
@@ -835,7 +829,7 @@ mod tests {
 
 			let start = kio::clock::now();
 			catalog.finish().unwrap();
-			broadcast.close();
+			broadcast.broadcast().close();
 			drop(importer);
 			let (lingering, done) = match push {
 				true => (server, client),
@@ -906,25 +900,25 @@ mod tests {
 			vseq.extend_from_slice(&[0x01, 0x00, 0x04, 0x68, 0xce, 0x3c, 0x80]);
 			let mut vframe = vec![0x17, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, idr.len() as u8];
 			vframe.extend_from_slice(idr);
-			let broadcast = origin.create_broadcast("live/cam0").unwrap();
-			broadcast
-				.announce(origin::Route::default().with_instance(instance.clone(), 0))
+			let route = origin
+				.route(
+					"live/cam0",
+					moq_net::origin::RouteOptions::default().with_instance(instance.clone(), 0),
+				)
 				.unwrap();
-			let catalog = moq_mux::catalog::Producer::new(
-				&mut broadcast.broadcast().clone(),
-				moq_mux::catalog::Config::default(),
-			)
-			.unwrap();
-			let mut importer = FlvImport::new(broadcast.broadcast().clone(), catalog.reserve());
+			let catalog =
+				moq_mux::catalog::Producer::new(&mut route.broadcast().clone(), moq_mux::catalog::Config::default())
+					.unwrap();
+			let mut importer = FlvImport::new(route.broadcast().clone(), catalog.reserve());
 			importer.decode(&flv::file_header()).unwrap();
 			importer.decode(&flv::tag(flv::TAG_VIDEO, 0, &vseq)).unwrap();
 			importer.decode(&flv::tag(flv::TAG_VIDEO, 0, &vframe)).unwrap();
-			(importer, catalog)
+			(route, importer, catalog)
 		};
 
 		let upstream = moq_tokio::origin::spawn();
 		let downstream = moq_tokio::origin::spawn();
-		let (mut old, old_catalog) = publish(&upstream, &moq_net::Instance::random(), OLD_IDR);
+		let (old_route, mut old, old_catalog) = publish(&upstream, &moq_net::Instance::random(), OLD_IDR);
 		let (client_io, server_io) = tokio::io::duplex(64 * 1024);
 		let ingest = downstream.clone();
 		let server = tokio::spawn(async move {
@@ -968,7 +962,7 @@ mod tests {
 
 		let instance = moq_net::Instance::random();
 		let mut instances = upstream.consume().follow("live/cam0", instance.clone()).unwrap();
-		let (_new, _new_catalog) = publish(&upstream, &instance, NEW_IDR);
+		let (_new_route, _new, _new_catalog) = publish(&upstream, &instance, NEW_IDR);
 		kio::clock::timeout(Duration::from_secs(5), instances.available())
 			.await
 			.expect("the new publisher takes over")
@@ -983,6 +977,7 @@ mod tests {
 
 		old.abort(moq_net::Error::Transport("connection lost".into()));
 		drop(old_catalog);
+		drop(old_route);
 		assert!(pushed.await.unwrap().is_err(), "the push ended cleanly");
 		server.abort();
 	}
@@ -1007,8 +1002,9 @@ mod tests {
 		vframe.extend_from_slice(&[0, 0, 0, 5, 0x65, 0x88, 0x84, 0x21, 0x00]);
 
 		let server_origin = moq_tokio::origin::spawn();
-		let broadcast = server_origin.create_broadcast("live/cam0").unwrap();
-		broadcast.announce(Default::default()).unwrap();
+		let broadcast = server_origin
+			.route("live/cam0", moq_net::origin::RouteOptions::default())
+			.unwrap();
 		let catalog =
 			moq_mux::catalog::Producer::new(&mut broadcast.broadcast().clone(), moq_mux::catalog::Config::default())
 				.unwrap();
diff --git a/rs/moq-rtmp/src/server.rs b/rs/moq-rtmp/src/server.rs
index 333a1c963c1..d61ddb4b68f 100644
--- a/rs/moq-rtmp/src/server.rs
+++ b/rs/moq-rtmp/src/server.rs
@@ -683,7 +683,7 @@ impl<S: Stream> Publish<S> {
 			.map_err(|e| anyhow::anyhow!("rtmp accept publish: {e:?}"))?;
 		self.work.extend(results);
 
-		tracing::info!(peer = %self.peer, %path, instance = %publisher.instance, "rtmp publish accepted");
+		tracing::info!(peer = %self.peer, %path, instance = %publisher.route.instance(), "rtmp publish accepted");
 
 		let result = pump(
 			&mut self.stream,
@@ -1502,7 +1502,7 @@ async fn run_handshake<S: Stream>(stream: &mut S, peer: SocketAddr) -> anyhow::R
 }
 
 /// An active publish: the moq-mux FLV importer, which owns the origin-created
-/// [`BroadcastProducer`](moq_net::origin::Publication) it publishes into.
+/// [`Route`](moq_net::origin::Route) it publishes into.
 /// [`Self::close`] or dropping it closes the broadcast and unannounces the path;
 /// [`Self::finish`] hands back the finished broadcast to linger on.
 struct Publisher {
@@ -1510,25 +1510,19 @@ struct Publisher {
 	// Finished at a clean end, so the finished broadcast keeps serving the catalog.
 	catalog: moq_mux::catalog::Producer,
 	metadata: crate::metadata::Dropped,
-	// Controls publication so an end can retract before the importer's fill clone drops.
-	broadcast: moq_net::origin::Publication,
-	// This connection's publisher instance, so an encoder reconnecting under the
-	// same key replaces this broadcast at once instead of resuming into it.
-	instance: moq_net::Instance,
+	// Announces the path under this connection's fresh instance, so an encoder reconnecting
+	// under the same key replaces this broadcast at once instead of resuming into it.
+	// Closing its broadcast retracts it before the importer's fill clone drops.
+	route: moq_net::origin::Route,
 }
 
 impl Publisher {
 	/// Open a broadcast at `path` under a fresh instance and prime the importer with
 	/// the FLV file header, so subsequent tags decode against an initialized demuxer.
 	fn new(origin: &origin::Producer, path: &str, config: moq_mux::catalog::Config) -> anyhow::Result<Self> {
-		let instance = moq_net::Instance::random();
-		let broadcast = origin.publish(
-			path,
-			moq_net::origin::Route::default().with_instance(instance.clone(), 0),
-		)?;
-		let catalog = moq_mux::catalog::Producer::new(&mut broadcast.broadcast().clone(), config)?;
-		let handle = broadcast.clone();
-		let mut importer = FlvImport::new(broadcast.broadcast().clone(), catalog.reserve());
+		let route = origin.route(path, moq_net::origin::RouteOptions::default())?;
+		let catalog = moq_mux::catalog::Producer::new(&mut route.broadcast().clone(), config)?;
+		let mut importer = FlvImport::new(route.broadcast().clone(), catalog.reserve());
 
 		// Feed the FLV file header once up front; media tags follow per message.
 		importer.decode(&flv::file_header())?;
@@ -1537,8 +1531,7 @@ impl Publisher {
 			importer,
 			catalog,
 			metadata: crate::metadata::Dropped::new(path),
-			broadcast: handle,
-			instance,
+			route,
 		})
 	}
 
@@ -1552,7 +1545,7 @@ impl Publisher {
 	fn finish(mut self, linger: Duration) -> anyhow::Result<moq_mux::Linger<Self>> {
 		self.importer.finish()?;
 		self.catalog.finish()?;
-		Ok(moq_mux::Linger::new([self.broadcast.broadcast().clone()], self, linger))
+		Ok(moq_mux::Linger::new([self.route.broadcast().clone()], self, linger))
 	}
 
 	/// Flush any buffered media, finish the catalog, close out the broadcast's open groups, and end
@@ -1560,7 +1553,7 @@ impl Publisher {
 	fn close(mut self) -> anyhow::Result<()> {
 		self.importer.finish()?;
 		self.catalog.finish()?;
-		self.broadcast.close();
+		self.route.broadcast().close();
 		Ok(())
 	}
 
@@ -1572,7 +1565,7 @@ impl Publisher {
 	fn abort(self, err: moq_net::Error) {
 		self.catalog.abort(err.clone());
 		self.importer.abort(err);
-		self.broadcast.close();
+		self.route.broadcast().close();
 	}
 }
 
@@ -2250,8 +2243,9 @@ mod tests {
 
 		// Publish the broadcast at `live/cam0` by feeding synthetic FLV to the importer.
 		let origin = moq_tokio::origin::spawn();
-		let broadcast = origin.create_broadcast("live/cam0").unwrap();
-		broadcast.announce(Default::default()).unwrap();
+		let broadcast = origin
+			.route("live/cam0", moq_net::origin::RouteOptions::default())
+			.unwrap();
 		let catalog =
 			moq_mux::catalog::Producer::new(&mut broadcast.broadcast().clone(), moq_mux::catalog::Config::default())
 				.unwrap();
@@ -2298,30 +2292,32 @@ mod tests {
 	}
 
 	/// Publish an AVC broadcast at `live/cam0` under `instance`, starting with a keyframe carrying
-	/// `idr`, and return its importer for more tags.
+	/// `idr`, and return its route and its importer for more tags.
 	fn publish_avc(
 		origin: &origin::Producer,
 		instance: moq_net::Instance,
 		idr: &[u8],
-	) -> (FlvImport, moq_mux::catalog::Producer) {
+	) -> (moq_net::origin::Route, FlvImport, moq_mux::catalog::Producer) {
 		let mut vseq = vec![0x17, 0x00, 0x00, 0x00, 0x00];
 		vseq.extend_from_slice(&[0x01, 0x42, 0xc0, 0x1f, 0xff, 0xe1, 0x00, 0x04, 0x67, 0x42, 0xc0, 0x1f]);
 		vseq.extend_from_slice(&[0x01, 0x00, 0x04, 0x68, 0xce, 0x3c, 0x80]);
 		let mut vframe = vec![0x17, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, idr.len() as u8];
 		vframe.extend_from_slice(idr);
 
-		let broadcast = origin.create_broadcast("live/cam0").unwrap();
-		broadcast
-			.announce(origin::Route::default().with_instance(instance, 0))
+		let route = origin
+			.route(
+				"live/cam0",
+				moq_net::origin::RouteOptions::default().with_instance(instance, 0),
+			)
 			.unwrap();
 		let catalog =
-			moq_mux::catalog::Producer::new(&mut broadcast.broadcast().clone(), moq_mux::catalog::Config::default())
+			moq_mux::catalog::Producer::new(&mut route.broadcast().clone(), moq_mux::catalog::Config::default())
 				.unwrap();
-		let mut importer = FlvImport::new(broadcast.broadcast().clone(), catalog.reserve());
+		let mut importer = FlvImport::new(route.broadcast().clone(), catalog.reserve());
 		importer.decode(&flv::file_header()).unwrap();
 		importer.decode(&flv::tag(flv::TAG_VIDEO, 0, &vseq)).unwrap();
 		importer.decode(&flv::tag(flv::TAG_VIDEO, 0, &vframe)).unwrap();
-		(importer, catalog)
+		(route, importer, catalog)
 	}
 
 	/// A play stays on the instance it resolved: a publisher taking over the path never reaches
@@ -2332,7 +2328,8 @@ mod tests {
 		const OLD_DELTA: &[u8] = &[0x41, 0x9a, 0x02, 0x03];
 		let origin = moq_tokio::origin::spawn();
 		let consumer = origin.consume();
-		let (mut old, old_catalog) = publish_avc(&origin, moq_net::Instance::random(), &[0x65, 0x88, 0x84, 0x21, 0x00]);
+		let (old_route, mut old, old_catalog) =
+			publish_avc(&origin, moq_net::Instance::random(), &[0x65, 0x88, 0x84, 0x21, 0x00]);
 
 		let mut server = Server::bind("127.0.0.1:0".parse().unwrap()).await.unwrap();
 		let addr = server.local_addr().unwrap();
@@ -2357,7 +2354,7 @@ mod tests {
 
 		let instance = moq_net::Instance::random();
 		let mut instances = consumer.follow("live/cam0", instance.clone()).unwrap();
-		let (_new, _new_catalog) = publish_avc(&origin, instance, &[0x65, 0x99, 0x99, 0x99, 0x99]);
+		let (_new_route, _new, _new_catalog) = publish_avc(&origin, instance, &[0x65, 0x99, 0x99, 0x99, 0x99]);
 		kio::clock::timeout(Duration::from_secs(5), instances.available())
 			.await
 			.expect("the new publisher takes over")
@@ -2373,6 +2370,7 @@ mod tests {
 
 		old.abort(moq_net::Error::Transport("connection lost".into()));
 		drop(old_catalog);
+		drop(old_route);
 		let played = kio::clock::timeout(Duration::from_secs(5), played)
 			.await
 			.expect("the play outlived its route")
@@ -2386,8 +2384,9 @@ mod tests {
 		const VP9_KEYFRAME_320X240: &[u8] = &[0x82, 0x49, 0x83, 0x42, 0x20, 0x13, 0xf0, 0x0e, 0xf0, 0x00];
 
 		let origin = moq_tokio::origin::spawn();
-		let broadcast = origin.create_broadcast("live/cam0").unwrap();
-		broadcast.announce(Default::default()).unwrap();
+		let broadcast = origin
+			.route("live/cam0", moq_net::origin::RouteOptions::default())
+			.unwrap();
 		let catalog =
 			moq_mux::catalog::Producer::new(&mut broadcast.broadcast().clone(), moq_mux::catalog::Config::default())
 				.unwrap();
@@ -2667,8 +2666,9 @@ mod tests {
 		let frames = multitrack_body(CODED_FRAMES, &[(0, nalu(0x88)), (1, nalu(0x99))]);
 
 		let origin = moq_tokio::origin::spawn();
-		let broadcast = origin.create_broadcast("live/cam0").unwrap();
-		broadcast.announce(Default::default()).unwrap();
+		let broadcast = origin
+			.route("live/cam0", moq_net::origin::RouteOptions::default())
+			.unwrap();
 		let catalog =
 			moq_mux::catalog::Producer::new(&mut broadcast.broadcast().clone(), moq_mux::catalog::Config::default())
 				.unwrap();
diff --git a/rs/moq-rtsp/README.md b/rs/moq-rtsp/README.md
index 90e83fa14ae..0aaa11a6500 100644
--- a/rs/moq-rtsp/README.md
+++ b/rs/moq-rtsp/README.md
@@ -26,13 +26,13 @@ instance.
 let client = moq_rtsp::Client::new("rtsp://admin:secret@192.168.1.64/stream1".parse()?)?;
 
 loop {
-	let route = moq_net::origin::Route::default().with_instance(moq_net::Instance::random(), 0);
-	let mut broadcast = origin.publish("camera", route)?;
-	let mut catalog = moq_mux::catalog::Producer::new(&mut broadcast, Default::default())?;
+	// Each route mints a fresh instance.
+	let route = origin.route("camera", moq_net::origin::RouteOptions::default())?;
+	let mut catalog = moq_mux::catalog::Producer::new(&mut route.broadcast().clone(), Default::default())?;
 
-	let end = client.pull(&broadcast, &catalog).await;
+	let end = client.pull(route.broadcast(), &catalog).await;
 	catalog.finish()?;
-	broadcast.close();
+	route.broadcast().close();
 	end?;
 }
 ```
diff --git a/rs/moq-rtsp/src/client.rs b/rs/moq-rtsp/src/client.rs
index 3a0a96c4e37..bb25c338e00 100644
--- a/rs/moq-rtsp/src/client.rs
+++ b/rs/moq-rtsp/src/client.rs
@@ -858,20 +858,20 @@ mod tests {
 			async move {
 				let mut ends = Vec::new();
 				for _ in 0..2 {
-					let instance = moq_net::Instance::random();
-					let route = moq_net::origin::Route::default().with_instance(instance.clone(), 0);
-					let broadcast = origin.publish("camera", route).unwrap();
+					let route = origin
+						.route("camera", moq_net::origin::RouteOptions::default())
+						.unwrap();
+					let broadcast = route.broadcast();
 					let mut catalog =
-						moq_mux::catalog::Producer::new(&mut broadcast.broadcast().clone(), Default::default())
-							.unwrap();
+						moq_mux::catalog::Producer::new(&mut broadcast.clone(), Default::default()).unwrap();
 					published_tx
-						.send((instance, broadcast.clone(), catalog.clone()))
+						.send((route.instance(), broadcast.clone(), catalog.clone()))
 						.unwrap();
 					// The first session to return ends the run; dropping the other's pull
 					// finishes its tracks.
 					let end = tokio::select! {
-						end = sd_client.pull(&broadcast, &catalog) => end,
-						end = hd_client.pull(&broadcast, &catalog) => end,
+						end = sd_client.pull(broadcast, &catalog) => end,
+						end = hd_client.pull(broadcast, &catalog) => end,
 					};
 					ends.push(end.unwrap());
 					catalog.finish().unwrap();
diff --git a/rs/moq-srt/src/server.rs b/rs/moq-srt/src/server.rs
index e65e628be61..024b53da722 100644
--- a/rs/moq-srt/src/server.rs
+++ b/rs/moq-srt/src/server.rs
@@ -910,10 +910,12 @@ mod tests {
 
 		let (origin, driver) = moq_net::origin::Producer::new(moq_net::origin::Config::default());
 		tokio::spawn(moq_net::time::run(driver));
-		let broadcast = origin.create_broadcast("marker").unwrap();
-		broadcast.announce(moq_net::origin::Route::default()).unwrap();
+		let route = origin
+			.route("marker", moq_net::origin::RouteOptions::default())
+			.unwrap();
+		let broadcast = route.broadcast();
 		let mut catalog = moq_mux::catalog::Producer::new(
-			&mut broadcast.broadcast().clone(),
+			&mut broadcast.clone(),
 			moq_mux::catalog::Config::default().with_catalog(moq_mux::catalog::hang::Catalog::<ts::Ext>::default()),
 		)
 		.unwrap();
@@ -1014,22 +1016,22 @@ mod tests {
 	/// One publisher instance of `live`: an announced broadcast under its own instance with one
 	/// Legacy AAC track, for the egress tests.
 	struct Instance {
-		_broadcast: moq_net::origin::Publication,
+		_route: moq_net::origin::Route,
 		catalog: moq_mux::catalog::Producer<moq_mux::container::ts::Ext>,
 		audio: moq_mux::container::Producer<moq_mux::catalog::hang::Container>,
 	}
 
 	impl Instance {
 		fn publish(origin: &moq_net::origin::Producer, track: &str) -> Self {
-			let route = moq_net::origin::Route::default();
-			let broadcast = origin.publish("live", route).unwrap();
+			let route = origin.route("live", moq_net::origin::RouteOptions::default()).unwrap();
 			let mut catalog = moq_mux::catalog::Producer::new(
-				&mut broadcast.broadcast().clone(),
+				&mut route.broadcast().clone(),
 				moq_mux::catalog::Config::default()
 					.with_catalog(moq_mux::catalog::hang::Catalog::<moq_mux::container::ts::Ext>::default()),
 			)
 			.unwrap();
-			let audio = broadcast
+			let audio = route
+				.broadcast()
 				.create_track(track, hang::container::track_info(hang::catalog::PRIORITY.audio))
 				.unwrap();
 			let mut config = hang::catalog::AudioConfig::new(hang::catalog::AAC { profile: 2 }, 48_000, 2);
@@ -1046,7 +1048,7 @@ mod tests {
 				moq_mux::catalog::hang::Container::Legacy(moq_mux::container::Kind::Audio),
 			);
 			Self {
-				_broadcast: broadcast,
+				_route: route,
 				catalog,
 				audio,
 			}
diff --git a/rs/moq-srt/src/ts.rs b/rs/moq-srt/src/ts.rs
index e2e6106d6f6..827288935ba 100644
--- a/rs/moq-srt/src/ts.rs
+++ b/rs/moq-srt/src/ts.rs
@@ -75,8 +75,8 @@ struct Instance {
 	import: ts::Import<ts::Ext>,
 	// Finished at a clean end, so the finished broadcast keeps serving the catalog.
 	catalog: moq_mux::catalog::Producer<ts::Ext>,
-	// Controls publication while the importer fills it, including finish or close at EOF.
-	broadcast: moq_net::origin::Publication,
+	// Keeps the path announced while the importer fills it, through the linger after a clean end.
+	route: moq_net::origin::Route,
 }
 
 impl Instance {
@@ -90,19 +90,15 @@ impl Instance {
 		config: moq_mux::catalog::Config,
 		program: Option<u16>,
 	) -> Result<(Self, moq_net::Instance)> {
-		let id = moq_net::Instance::random();
-		let broadcast = origin.publish(path, moq_net::origin::Route::default().with_instance(id.clone(), 0))?;
+		let route = origin.route(path, moq_net::origin::RouteOptions::default())?;
+		let id = route.instance();
 		let config = config.with_catalog(moq_mux::catalog::hang::Catalog::<ts::Ext>::default());
-		let catalog = moq_mux::catalog::Producer::new(&mut broadcast.broadcast().clone(), config)?;
-		let mut import = ts::Import::new(broadcast.broadcast().clone(), catalog.reserve());
+		let catalog = moq_mux::catalog::Producer::new(&mut route.broadcast().clone(), config)?;
+		let mut import = ts::Import::new(route.broadcast().clone(), catalog.reserve());
 		if let Some(program) = program {
 			import = import.with_program(program);
 		}
-		let instance = Self {
-			import,
-			catalog,
-			broadcast,
-		};
+		let instance = Self { import, catalog, route };
 		Ok((instance, id))
 	}
 
@@ -187,7 +183,7 @@ impl Publisher {
 					self.span.in_scope(|| self.log.finish(&instance.import.stats()));
 					let (next, id) = Instance::publish(origin, path, config.clone(), *program)?;
 					tracing::warn!(%path, step = %restart.step, instance = %id, "the source's clock stepped; republishing");
-					// The finished broadcast ends with its publication.
+					// The finished broadcast ends with its route.
 					*instance = next;
 					self.log = ts::stats::Log::default();
 					data = restart.remainder;
@@ -216,7 +212,7 @@ impl Publisher {
 		let finished = match &mut self.importer {
 			Importer::One(one) => {
 				one.instance.finish()?;
-				vec![one.instance.broadcast.broadcast().clone()]
+				vec![one.instance.route.broadcast().clone()]
 			}
 			Importer::All(programs) => programs.finish().map_err(moq_mux::Error::from)?,
 		};
@@ -232,9 +228,9 @@ impl Publisher {
 	pub fn abort(self, err: moq_net::Error) {
 		match self.importer {
 			Importer::One(one) => {
-				let Instance { import, broadcast, .. } = one.instance;
+				let Instance { import, route, .. } = one.instance;
 				import.abort(err);
-				broadcast.close();
+				route.broadcast().close();
 			}
 			Importer::All(programs) => programs.abort(err),
 		}
diff --git a/rs/moq-stats/benches/aggregate.rs b/rs/moq-stats/benches/aggregate.rs
index 9a93bb73883..2dc0e54c795 100644
--- a/rs/moq-stats/benches/aggregate.rs
+++ b/rs/moq-stats/benches/aggregate.rs
@@ -17,7 +17,7 @@
 use std::collections::BTreeMap;
 use std::time::{Duration, Instant};
 
-use moq_net::{Instance, origin};
+use moq_net::origin;
 use moq_stats::{Group, Traffic, aggregate, group_track};
 
 /// Broadcast paths each node reports.
@@ -39,20 +39,18 @@ struct Body {
 /// A hand-published node stats broadcast with one group track carrying
 /// default-tier egress.
 struct Node {
-	source: moq_net::origin::Publication,
-	instance: Instance,
+	source: moq_net::origin::Route,
 	group: moq_json::snapshot::Producer<Body>,
 	frame: Body,
 }
 
 impl Node {
 	fn new(origin: &origin::Producer, name: &str) -> Self {
-		let source = origin.create_broadcast(format!(".stats/node/{name}").as_str()).unwrap();
-		let instance = Instance::random();
-		source
-			.announce(origin::Route::default().with_instance(instance.clone(), 0))
+		let source = origin
+			.route(format!(".stats/node/{name}").as_str(), origin::RouteOptions::default())
 			.unwrap();
 		let track = source
+			.broadcast()
 			.create_track(
 				group_track(moq_net::Path::from_static("acme")),
 				moq_net::track::Info::default()
@@ -73,7 +71,6 @@ impl Node {
 		};
 		Self {
 			source,
-			instance,
 			group: moq_json::snapshot::Producer::new(track, config),
 			frame,
 		}
@@ -138,16 +135,14 @@ async fn measure(live: usize, departed: usize, grace: Duration, state: State) ->
 	}
 	if matches!(state, State::Resumed) {
 		for node in &mut nodes {
-			node.source.unannounce();
+			node.source.withdraw();
 			loop {
 				let frame = traffic.next().await.unwrap().unwrap();
 				if first(&frame).unwrap().active_subscriptions() == live as u64 - 1 {
 					break;
 				}
 			}
-			node.source
-				.announce(origin::Route::default().with_instance(node.instance.clone(), 0))
-				.unwrap();
+			node.source.announce().unwrap();
 			node.publish(1);
 			total += 1;
 			read_until(&mut traffic, total).await;
diff --git a/rs/moq-stats/benches/producer_tick.rs b/rs/moq-stats/benches/producer_tick.rs
index d582c25e36d..a0a8553f8ff 100644
--- a/rs/moq-stats/benches/producer_tick.rs
+++ b/rs/moq-stats/benches/producer_tick.rs
@@ -95,7 +95,7 @@ struct Relay {
 	driver: Driver,
 	_origin: origin::Producer,
 	_origin_driver: origin::Driver,
-	_publishers: Vec<origin::Publication>,
+	_publishers: Vec<origin::Route>,
 	_cursors: Vec<origin::Routes>,
 	_sessions: Vec<stats::Session>,
 	_held: Vec<moq_net::track::Subscriber>,
@@ -121,7 +121,7 @@ impl Relay {
 			.iter()
 			.map(|path| {
 				origin
-					.publish(path.as_str(), origin::Route::default())
+					.route(path.as_str(), moq_net::origin::RouteOptions::default())
 					.expect("publish path")
 			})
 			.collect();
diff --git a/rs/moq-stats/src/aggregate.rs b/rs/moq-stats/src/aggregate.rs
index efb25f95a34..4d55994184f 100644
--- a/rs/moq-stats/src/aggregate.rs
+++ b/rs/moq-stats/src/aggregate.rs
@@ -815,9 +815,13 @@ impl<S: Shape> Merged<S> {
 					moq_net::origin::RouteEvent::Start(update)
 					| moq_net::origin::RouteEvent::Update(update)
 					| moq_net::origin::RouteEvent::Takeover { announce: update, .. },
-				)) => changed |= self.apply_announce(update, true),
+				)) => {
+					let instance = update.route.instance().clone();
+					changed |= self.apply_announce(&update, instance, true)
+				}
 				Poll::Ready(Some(moq_net::origin::RouteEvent::End(update))) => {
-					changed |= self.apply_announce(update, false)
+					let instance = update.route.instance().clone();
+					changed |= self.apply_announce(&update, instance, false)
 				}
 				// Another instance: the one tracked at the path ends, then the new one
 				// starts, so its reader resolves afresh.
@@ -825,11 +829,10 @@ impl<S: Shape> Merged<S> {
 					// An announced prefix is a path beneath the root, so rooting it fits.
 					let absolute = self.announce.absolute(&update.prefix).ok();
 					if let Some(previous) = absolute.and_then(|absolute| self.last_announced.get(&absolute).cloned()) {
-						let mut ended = update.clone();
-						ended.route.instance = Some(previous);
-						changed |= self.apply_announce(ended, false);
+						changed |= self.apply_announce(&update, previous, false);
 					}
-					changed |= self.apply_announce(update, true);
+					let instance = update.route.instance().clone();
+					changed |= self.apply_announce(&update, instance, true);
 				}
 				Poll::Ready(None) => return Poll::Ready(Ok(None)),
 				Poll::Pending => break,
@@ -874,10 +877,16 @@ impl<S: Shape> Merged<S> {
 	/// Apply one announce update to the node set. Returns whether the merged view
 	/// changed (only a departure closing open pairs, or a gauge's contribution
 	/// leaving, does).
-	fn apply_announce(&mut self, update: moq_net::announce::Announce, active: bool) -> bool {
-		let path = update.prefix;
+	/// Fold `update` in under `instance`: the route's own, or the one a restart replaced.
+	fn apply_announce(
+		&mut self,
+		update: &moq_net::announce::Announce,
+		instance: moq_net::Instance,
+		active: bool,
+	) -> bool {
+		let path = &update.prefix;
 		// An announced prefix is a path beneath the root, so rooting it fits.
-		let Ok(absolute) = self.announce.absolute(&path) else {
+		let Ok(absolute) = self.announce.absolute(path) else {
 			return false;
 		};
 
@@ -889,10 +898,7 @@ impl<S: Shape> Merged<S> {
 		}
 		// Publisher replacement can race reader polling on another worker, so every
 		// reader pins the identity it contributes to, independent of announce order.
-		let key = (
-			absolute,
-			update.route.instance.expect("a delivered route has an instance"),
-		);
+		let key = (absolute, instance);
 
 		if !active {
 			// Unannounce: keep the cumulative counters, close the open pairs,
@@ -929,11 +935,11 @@ impl<S: Shape> Merged<S> {
 			Entry::Vacant(entry) => {
 				let instance = entry.key().1.clone();
 				entry.insert(Node {
-					reader: resolve(&self.origin, &path, instance.clone()),
+					reader: resolve(&self.origin, path, instance.clone()),
 					listing: None,
 					offered: false,
 					instance,
-					path,
+					path: path.clone(),
 					shape: S::default(),
 					departed: None,
 				});
@@ -1249,7 +1255,7 @@ mod tests {
 	#[allow(dead_code, reason = "held for their drop, never read")]
 	struct Feed {
 		announced: origin::Routes,
-		source: origin::Publication,
+		source: origin::Route,
 		consumer: broadcast::Consumer,
 		sub: track::Subscriber,
 		ctx: moq_net::stats::Session,
@@ -1267,9 +1273,10 @@ mod tests {
 		let egress = feed_origin.consume().with_stats(ctx.clone());
 
 		let mut announced = egress.routes();
-		let source = feed_origin.create_broadcast(path).expect("create_broadcast");
-		source.announce(origin::Route::default()).expect("announce");
-		let track = source.create_track("video", timed()).expect("create_track");
+		let source = feed_origin
+			.route(path, moq_net::origin::RouteOptions::default())
+			.expect("route");
+		let track = source.broadcast().create_track("video", timed()).expect("create_track");
 
 		let (_, active) = next_update(&mut announced).await.expect("announce");
 		assert!(active);
@@ -1333,7 +1340,7 @@ mod tests {
 	/// Dropping it unannounces the node.
 	#[allow(dead_code, reason = "held for their drop, never read")]
 	struct NodeBroadcast {
-		source: origin::Publication,
+		source: origin::Route,
 		group: moq_json::snapshot::Producer<GroupFrame>,
 		track: track::Producer,
 		frame: TrafficFrame,
@@ -1341,13 +1348,15 @@ mod tests {
 
 	impl NodeBroadcast {
 		fn new(origin: &origin::Producer, group: &str, node: &str) -> Self {
+			Self::with_instance(origin, group, node, format!("node-{node}").parse().unwrap())
+		}
+
+		fn with_instance(origin: &origin::Producer, group: &str, node: &str, instance: moq_net::Instance) -> Self {
 			let path = format!(".stats/node/{node}");
-			let source = origin.create_broadcast(path.as_str()).expect("create broadcast");
-			let instance = format!("node-{node}").parse().unwrap();
-			source
-				.announce(origin::Route::default().with_instance(instance, 0))
-				.expect("announce");
+			let options = origin::RouteOptions::default().with_instance(instance, 0);
+			let source = origin.route(path.as_str(), options).expect("announce");
 			let track = source
+				.broadcast()
 				.create_track(group_track(moq_net::Path::new(group).unwrap()), timed())
 				.expect("create track");
 			let config = moq_json::snapshot::Config::default().with_deltas(false);
@@ -1950,17 +1959,22 @@ mod tests {
 	/// totals track and no instance, so a new one at the same path is that node
 	/// restarting without telling the reader.
 	struct TotalsNode {
-		_source: origin::Publication,
+		_source: origin::Route,
 		totals: moq_json::snapshot::Producer<TotalsFrame>,
 	}
 
 	impl TotalsNode {
 		fn new(origin: &origin::Producer, node: &str) -> Self {
 			let source = origin
-				.create_broadcast(format!(".stats/node/{node}").as_str())
+				.route(
+					format!(".stats/node/{node}").as_str(),
+					moq_net::origin::RouteOptions::default(),
+				)
 				.expect("create broadcast");
-			source.announce(origin::Route::default()).expect("announce");
-			let track = source.create_track(totals_track(), timed()).expect("create track");
+			let track = source
+				.broadcast()
+				.create_track(totals_track(), timed())
+				.expect("create track");
 			let config = moq_json::snapshot::Config::default().with_deltas(false);
 			Self {
 				_source: source,
@@ -2012,11 +2026,12 @@ mod tests {
 		let instance: Instance = "a".parse().unwrap();
 		let mut merged = Merged::<Keyed<V>>::new(origin.consume(), &Config::new(), "p".into());
 		merged.apply_announce(
-			moq_net::announce::Announce {
+			&moq_net::announce::Announce {
 				prefix: path.clone(),
 				captures: None,
-				route: origin::Route::default().with_instance(instance.clone(), 0),
+				route: Default::default(),
 			},
+			instance.clone(),
 			true,
 		);
 		(merged, (path, instance))
@@ -2033,11 +2048,12 @@ mod tests {
 		};
 		let path = Path::from_static(".stats/node/b");
 		merged.apply_announce(
-			moq_net::announce::Announce {
+			&moq_net::announce::Announce {
 				prefix: path.clone(),
 				captures: None,
-				route: origin::Route::default().with_instance("b".parse().unwrap(), 0),
+				route: Default::default(),
 			},
+			"b".parse().unwrap(),
 			true,
 		);
 		let second = (path, "b".parse().unwrap());
@@ -2197,9 +2213,8 @@ mod tests {
 	#[tokio::test(start_paused = true)]
 	async fn traffic_resume_reopens_closed_pairs_without_going_down() {
 		let origin = produce_origin();
-		let mut node = NodeBroadcast::new(&origin, "acme", "a");
-		let route = origin::Route::default().with_instance("01900000-0000-7000-8000-000000000001".parse().unwrap(), 0);
-		node.source.announce(route.clone()).expect("announce instance");
+		let instance = "01900000-0000-7000-8000-000000000001".parse().unwrap();
+		let mut node = NodeBroadcast::with_instance(&origin, "acme", "a", instance);
 		let mut raw = Traffic::default();
 		raw.announces_started = 5;
 		raw.announces_ended = 3;
@@ -2215,7 +2230,7 @@ mod tests {
 		let mut traffic = traffic(&agg);
 		let grew = |before: &Traffic, after: &Traffic| !after.regressed(before);
 		read_until(&mut traffic, grew, |frame| frame.get("acme/room") == Some(&raw)).await;
-		node.source.unannounce();
+		node.source.withdraw();
 		let departed = raw.retire();
 		read_until(&mut traffic, grew, |frame| {
 			assert!(!frame["acme/room"].regressed(&raw));
@@ -2224,7 +2239,7 @@ mod tests {
 		.await;
 
 		// The same publisher instance returns with all three pairs still open.
-		node.source.announce(route).expect("reannounce instance");
+		node.source.announce().expect("reannounce instance");
 		let mut expected = raw;
 		expected.announces_started = 7;
 		expected.announces_ended = 5;
diff --git a/rs/moq-stats/src/consume.rs b/rs/moq-stats/src/consume.rs
index 90b7458953c..e1a13551c01 100644
--- a/rs/moq-stats/src/consume.rs
+++ b/rs/moq-stats/src/consume.rs
@@ -210,7 +210,7 @@ mod tests {
 		track: track::Producer,
 		sub: track::Subscriber,
 		_announced: origin::Routes,
-		_source: origin::Publication,
+		_source: origin::Route,
 		_ctx: moq_net::stats::Session,
 	}
 
@@ -235,9 +235,10 @@ mod tests {
 		let egress = feed_origin.consume().with_stats(ctx.clone());
 
 		let mut announced = egress.routes();
-		let source = feed_origin.create_broadcast(path).unwrap();
-		source.announce(origin::Route::default()).unwrap();
-		let track = source.clone().create_track("video", timed()).unwrap();
+		let source = feed_origin
+			.route(path, moq_net::origin::RouteOptions::default())
+			.unwrap();
+		let track = source.clone().broadcast().create_track("video", timed()).unwrap();
 
 		let (_, active) = next_update(&mut announced).await.expect("announce");
 		assert!(active);
diff --git a/rs/moq-stats/src/produce.rs b/rs/moq-stats/src/produce.rs
index 5069c1b23b2..3f695f5b6ba 100644
--- a/rs/moq-stats/src/produce.rs
+++ b/rs/moq-stats/src/produce.rs
@@ -627,7 +627,8 @@ impl<V: Serialize> Output<V> {
 
 /// The node's stats broadcast and its change-detection state.
 struct NodePublisher {
-	broadcast: origin::Publication,
+	/// The node's route, which owns its broadcast.
+	route: origin::Route,
 	/// Holds the broadcast's request queue open, so a subscriber asking for a
 	/// presence or prefix track parks until the next drain serves it instead
 	/// of being rejected `NotFound` on the spot.
@@ -1005,9 +1006,8 @@ impl NodePublisher {
 			.ok()?;
 		// A fresh instance per announcement: a restart is a new broadcast, so no relay
 		// resumes it from groups cached under the old one.
-		let route = origin::Route::default();
-		let broadcast = match task.origin.publish(&advertised, route) {
-			Ok(broadcast) => broadcast,
+		let route = match task.origin.route(&advertised, origin::RouteOptions::default()) {
+			Ok(route) => route,
 			Err(err) => {
 				tracing::warn!(advertised = %advertised, ?err, "stats: origin rejected stats broadcast");
 				return None;
@@ -1016,7 +1016,7 @@ impl NodePublisher {
 		tracing::debug!(advertised = %advertised, "stats: publishing broadcast");
 
 		let name = totals_track();
-		let totals = match Output::create(&broadcast, &name) {
+		let totals = match Output::create(route.broadcast(), &name) {
 			Ok(output) => TotalsTrack {
 				output,
 				sums: Cumulative::new(),
@@ -1029,7 +1029,7 @@ impl NodePublisher {
 
 		let mut groups = HashMap::new();
 		if task.depth == 0 {
-			match GroupTrack::create(&broadcast, &Path::empty()) {
+			match GroupTrack::create(route.broadcast(), &Path::empty()) {
 				Ok(track) => {
 					groups.insert(String::new(), track);
 				}
@@ -1040,10 +1040,10 @@ impl NodePublisher {
 			}
 		}
 
-		let dynamic = broadcast.requests();
+		let dynamic = route.broadcast().requests();
 
 		Some(Self {
-			broadcast,
+			route,
 			dynamic,
 			local: HashMap::new(),
 			totals,
@@ -1057,7 +1057,7 @@ impl NodePublisher {
 	/// and add them to the totals and every held presence and prefix track.
 	fn collect(&mut self, report: &Report, tick: u64, depth: usize) {
 		let Self {
-			broadcast,
+			route,
 			local,
 			totals,
 			presence,
@@ -1113,13 +1113,13 @@ impl NodePublisher {
 			let publisher = slots.publisher.observe(entry.publisher);
 			let subscriber = slots.subscriber.observe(entry.subscriber);
 			let key = group_key(&entry.path, depth);
-			if let Some(track) = Self::group(broadcast, groups, &key) {
+			if let Some(track) = Self::group(route.broadcast(), groups, &key) {
 				track.add_traffic(entry, publisher, subscriber);
 			}
 		}
 		for entry in &report.sessions {
 			let key = group_key(&entry.label, depth);
-			if let Some(track) = Self::group(broadcast, groups, &key) {
+			if let Some(track) = Self::group(route.broadcast(), groups, &key) {
 				track.add_sessions(&entry.label, &entry.tier, entry.presence, entry.closed);
 			}
 		}
@@ -1242,7 +1242,7 @@ impl NodePublisher {
 			return;
 		}
 		let name = presence_track(&label);
-		let output = match Output::adopt(&self.broadcast, &name, request) {
+		let output = match Output::adopt(self.route.broadcast(), &name, request) {
 			Ok(output) => output,
 			Err(err) => {
 				tracing::warn!(?err, name, "stats: failed to adopt presence track");
@@ -1276,7 +1276,7 @@ impl NodePublisher {
 			return;
 		}
 		let name = prefix_track(&path);
-		let output = match Output::adopt(&self.broadcast, &name, request) {
+		let output = match Output::adopt(self.route.broadcast(), &name, request) {
 			Ok(output) => output,
 			Err(err) => {
 				tracing::warn!(?err, name, "stats: failed to adopt prefix track");
@@ -1315,7 +1315,7 @@ impl Drop for NodePublisher {
 		for (_, track) in self.groups.drain() {
 			track.finish();
 		}
-		self.broadcast.close();
+		self.route.broadcast().close();
 	}
 }
 
@@ -1698,7 +1698,7 @@ mod tests {
 	#[allow(dead_code, reason = "held for their drop, never read")]
 	struct Feed {
 		announced: origin::Routes,
-		source: origin::Publication,
+		source: origin::Route,
 		consumer: broadcast::Consumer,
 		sub: Option<track::Subscriber>,
 	}
@@ -1723,9 +1723,10 @@ mod tests {
 		let egress = origin.consume().with_stats(ctx);
 
 		let mut announced = egress.routes();
-		let source = origin.create_broadcast(path).expect("create_broadcast");
-		source.announce(origin::Route::default()).expect("announce");
-		let producer = source.create_track("video", timed()).expect("create_track");
+		let source = origin
+			.route(path, moq_net::origin::RouteOptions::default())
+			.expect("route");
+		let producer = source.broadcast().create_track("video", timed()).expect("create_track");
 
 		let (_, active) = next_update(&mut announced).await.expect("announce");
 		assert!(active);
@@ -2177,9 +2178,9 @@ mod tests {
 					.tier(Tier::default())
 					.session(moq_net::Path::from_static("publisher")),
 			)
-			.publish("foo/bar", origin::Route::default())
+			.route("foo/bar", moq_net::origin::RouteOptions::default())
 			.expect("publish");
-		let mut video = source.create_track("video", timed()).expect("create_track");
+		let mut video = source.broadcast().create_track("video", timed()).expect("create_track");
 		let egress = data.consume().with_stats(
 			registry
 				.tier(Tier::default())
@@ -2256,12 +2257,12 @@ mod tests {
 	}
 
 	/// The announce events buffered so far in delivery order, as
-	/// `(path, active, instance)`. Every stats route carries an instance.
+	/// `(path, active, instance)`.
 	fn take_instances(events: &mut origin::Routes) -> Vec<(String, bool, Instance)> {
 		use futures::FutureExt;
 		let mut out = Vec::new();
 		while let Some(Some((update, active))) = next_update(events).now_or_never() {
-			let instance = update.route.instance.expect("a stats route carries an instance");
+			let instance = update.route.instance().clone();
 			out.push((update.prefix.as_str().to_string(), active, instance));
 		}
 		out
@@ -2628,9 +2629,9 @@ mod tests {
 					.tier(Tier::default())
 					.session(moq_net::Path::from_static("publisher")),
 			)
-			.publish("acme/live", origin::Route::default())
+			.route("acme/live", moq_net::origin::RouteOptions::default())
 			.expect("publish");
-		let video = source.create_track("video", timed()).expect("create_track");
+		let video = source.broadcast().create_track("video", timed()).expect("create_track");
 		let egress = data.consume().with_stats(
 			registry
 				.tier(Tier::default())
@@ -3176,7 +3177,7 @@ mod tests {
 			interval: Duration::from_secs(1),
 		})
 		.unwrap();
-		let stats = crate::Consumer::new(drain.node.broadcast.consume(), Default::default());
+		let stats = crate::Consumer::new(drain.node.route.broadcast().consume(), Default::default());
 
 		let _acme = registry
 			.tier(Tier::default())
diff --git a/rs/moq-tokio/examples/chat.rs b/rs/moq-tokio/examples/chat.rs
index b892cc85fbc..ff99cb49c9b 100644
--- a/rs/moq-tokio/examples/chat.rs
+++ b/rs/moq-tokio/examples/chat.rs
@@ -39,20 +39,20 @@ async fn run_session(origin: moq_net::origin::Producer) -> anyhow::Result<()> {
 
 // Produce a broadcast and publish it to the origin.
 async fn run_broadcast(origin: moq_net::origin::Producer) -> anyhow::Result<()> {
-	// Create a broadcast on the origin. A broadcast is a collection of tracks,
-	// but in this example we'll only create one. The live route announces it.
+	// Create a route on the origin, which announces a new broadcast. A broadcast is a
+	// collection of tracks, but in this example we'll only create one.
 	// NOTE: The path is empty because we're using the URL to scope the broadcast.
 	// If you put "alice" here, it would be published as "anon/chat-example/alice".
-	let broadcast = origin.create_broadcast("").context("failed to create broadcast")?;
-	broadcast
-		.announce(Default::default())
+	// Dropping the route withdraws the broadcast, so keep it for as long as it should be live.
+	let route = origin
+		.route("", moq_net::origin::RouteOptions::default())
 		.context("failed to announce broadcast")?;
 
 	// Create a track that we'll insert into the broadcast.
 	// A track is a series of groups representing a live stream.
 	// Frames are stamped with the wall clock, so the track declares a timescale.
 	let info = moq_tokio::moq_net::track::Info::default().with_timescale(moq_tokio::moq_net::Timescale::MILLI);
-	let mut track = broadcast.create_track("chat", info)?;
+	let mut track = route.broadcast().create_track("chat", info)?;
 
 	// Create a group.
 	// Each group is independent and the newest group(s) will be prioritized.
@@ -85,8 +85,8 @@ async fn run_broadcast(origin: moq_net::origin::Producer) -> anyhow::Result<()>
 	// Sleep before exiting and closing the broadcast.
 	kio::clock::sleep(tokio::time::Duration::from_secs(10)).await;
 
-	// End the broadcast. Dropping the producer does the same; closing is explicit.
-	broadcast.close();
+	// End the broadcast. Dropping the route withdraws it; closing ends it for good.
+	route.broadcast().close();
 
 	Ok(())
 }
diff --git a/rs/moq-tokio/examples/clock.rs b/rs/moq-tokio/examples/clock.rs
index dc2307b5b26..c5f4da8cf19 100644
--- a/rs/moq-tokio/examples/clock.rs
+++ b/rs/moq-tokio/examples/clock.rs
@@ -64,16 +64,14 @@ async fn main() -> anyhow::Result<()> {
 
 	match config.role {
 		Command::Publish => {
-			let broadcast = origin
-				.create_broadcast(&config.broadcast)
+			// Created hidden, so it is announced only once the track exists and a
+			// subscriber acting on the announcement finds it.
+			let route = origin
+				.route(&config.broadcast, moq_net::origin::RouteOptions::hidden())
 				.context("failed to create broadcast")?;
 			let info = moq_net::track::Info::default().with_timescale(moq_net::Timescale::MILLI);
-			let track = broadcast.create_track(track, info)?;
-			// Announced once the track exists, so a subscriber acting on the
-			// announcement finds it.
-			broadcast
-				.announce(Default::default())
-				.context("failed to announce broadcast")?;
+			let track = route.broadcast().create_track(track, info)?;
+			route.announce().context("failed to announce broadcast")?;
 			let clock = Publisher::new(track);
 
 			let reconnect = client.with_publisher(&origin).connect(url);
@@ -86,7 +84,7 @@ async fn main() -> anyhow::Result<()> {
 			};
 
 			// End the broadcast on exit.
-			broadcast.close();
+			route.broadcast().close();
 			result
 		}
 		Command::Subscribe => {
diff --git a/rs/moq-tokio/src/client.rs b/rs/moq-tokio/src/client.rs
index e38c0246269..63a3eeeeba4 100644
--- a/rs/moq-tokio/src/client.rs
+++ b/rs/moq-tokio/src/client.rs
@@ -1103,11 +1103,11 @@ mod tests {
 	#[tokio::test]
 	async fn broadcast_race_quic_wins() {
 		let pub_origin = crate::origin::spawn();
-		let broadcast = pub_origin.create_broadcast("test").expect("failed to create broadcast");
-		broadcast
-			.announce(Default::default())
+		let broadcast = pub_origin
+			.route("test", moq_net::origin::RouteOptions::default())
 			.expect("failed to create broadcast");
 		let track = broadcast
+			.broadcast()
 			.create_track("video", timed())
 			.expect("failed to create track");
 		let mut group = track.append_group().expect("failed to append group");
diff --git a/rs/moq-tokio/src/connection.rs b/rs/moq-tokio/src/connection.rs
index e7ceec5a7a8..c63cd4e0f2c 100644
--- a/rs/moq-tokio/src/connection.rs
+++ b/rs/moq-tokio/src/connection.rs
@@ -3387,9 +3387,8 @@ mod tests {
 
 		// Two relays of one fleet, serving the same live broadcast.
 		let origin = crate::origin::spawn();
-		let broadcast = origin.create_broadcast("cam").unwrap();
-		broadcast.announce(Default::default()).unwrap();
-		let track = broadcast.create_track("video", timed()).unwrap();
+		let broadcast = origin.route("cam", moq_net::origin::RouteOptions::default()).unwrap();
+		let track = broadcast.broadcast().create_track("video", timed()).unwrap();
 		let (addr_a, mut accepted_a, _task_a) = serve(origin.clone()).await;
 		let (addr_b, mut accepted_b, _task_b) = serve(origin.clone()).await;
 
@@ -3496,8 +3495,7 @@ mod tests {
 		session.drain().send(moq_net::goaway::Goaway::new()).unwrap();
 
 		// A broadcast announced after the GOAWAY still arrives: the drained session serves.
-		let late = origin.create_broadcast("late").unwrap();
-		late.announce(Default::default()).unwrap();
+		let _late = origin.route("late", moq_net::origin::RouteOptions::default()).unwrap();
 		kio::clock::timeout(WAIT, subscriber.consume().follow("late", None).unwrap().available())
 			.await
 			.expect("the drained session stopped serving")
@@ -3654,8 +3652,7 @@ mod tests {
 	async fn a_publication_waits_for_a_configured_token() {
 		let shared = shared();
 		let publish = crate::origin::spawn();
-		let broadcast = publish.create_broadcast("room").unwrap();
-		broadcast.announce(moq_net::origin::Route::default()).unwrap();
+		let _route = publish.route("room", moq_net::origin::RouteOptions::default()).unwrap();
 		let server_origin = crate::origin::spawn();
 
 		let config = crate::connect::Config {
diff --git a/rs/moq-tokio/src/origin.rs b/rs/moq-tokio/src/origin.rs
index 16e25f9b0c9..4a44f316071 100644
--- a/rs/moq-tokio/src/origin.rs
+++ b/rs/moq-tokio/src/origin.rs
@@ -54,14 +54,15 @@ mod tests {
 		let origin = spawn();
 		let mut announced = origin.consume().announced();
 
-		let broadcast = origin.create_broadcast("cam").expect("create broadcast");
-		broadcast.announce(Default::default()).expect("create broadcast");
+		let broadcast = origin
+			.route("cam", moq_net::origin::RouteOptions::default())
+			.expect("create broadcast");
 
 		let (update, active) = next_update(&mut announced).await.expect("announce");
 		assert_eq!(update.prefix.as_str(), "cam");
 		assert!(active);
 
-		broadcast.close();
+		broadcast.broadcast().close();
 		let (_, active) = next_update(&mut announced).await.expect("retraction");
 		assert!(!active);
 	}
diff --git a/rs/moq-tokio/src/server.rs b/rs/moq-tokio/src/server.rs
index 89ef9247fed..d15eb28f5c3 100644
--- a/rs/moq-tokio/src/server.rs
+++ b/rs/moq-tokio/src/server.rs
@@ -2839,9 +2839,13 @@ mod tests {
 		let _ = std::fs::remove_file(&path);
 
 		let origin = crate::origin::spawn();
-		let broadcast = origin.create_broadcast("test").expect("create broadcast");
-		broadcast.announce(Default::default()).expect("announce broadcast");
-		let track = broadcast.create_track("video", timed()).expect("create track");
+		let broadcast = origin
+			.route("test", moq_net::origin::RouteOptions::default())
+			.expect("create broadcast");
+		let track = broadcast
+			.broadcast()
+			.create_track("video", timed())
+			.expect("create track");
 		let mut group = track.append_group().expect("append group");
 		group
 			.write_frame(moq_net::Timestamp::ZERO, b"hello".as_ref())
diff --git a/rs/moq-tokio/src/webrtc/tests.rs b/rs/moq-tokio/src/webrtc/tests.rs
index f008f3ee033..9a96c99ab8b 100644
--- a/rs/moq-tokio/src/webrtc/tests.rs
+++ b/rs/moq-tokio/src/webrtc/tests.rs
@@ -16,9 +16,9 @@ fn protocol() -> &'static str {
 /// A one-frame broadcast named `test` and the handles that keep it alive.
 fn broadcast(payload: &[u8]) -> (moq_net::origin::Producer, impl Sized) {
 	let origin = crate::origin::spawn();
-	let broadcast = origin.create_broadcast("test").unwrap();
-	broadcast.announce(Default::default()).unwrap();
+	let broadcast = origin.route("test", moq_net::origin::RouteOptions::default()).unwrap();
 	let track = broadcast
+		.broadcast()
 		.create_track(
 			"video",
 			moq_net::track::Info::default().with_timescale(moq_net::Timescale::MILLI),
diff --git a/rs/moq-tokio/tests/integration/backend.rs b/rs/moq-tokio/tests/integration/backend.rs
index 6808fbba1f8..30ac910699c 100644
--- a/rs/moq-tokio/tests/integration/backend.rs
+++ b/rs/moq-tokio/tests/integration/backend.rs
@@ -114,11 +114,11 @@ async fn connect_test(config: ConnectTest<'_>) {
 
 	// ── publisher (server) ──────────────────────────────────────────
 	let pub_origin = moq_tokio::origin::spawn();
-	let broadcast = pub_origin.create_broadcast("test").expect("failed to create broadcast");
-	broadcast
-		.announce(Default::default())
+	let broadcast = pub_origin
+		.route("test", moq_net::origin::RouteOptions::default())
 		.expect("failed to create broadcast");
 	let track = broadcast
+		.broadcast()
 		.create_track("video", timed())
 		.expect("failed to create track");
 
@@ -640,9 +640,11 @@ async fn quic_client_close_drains_finished_track() {
 			.expect("client runtime");
 		runtime.block_on(async move {
 			let origin = moq_tokio::origin::spawn();
-			let broadcast = origin.create_broadcast("test").expect("failed to create broadcast");
-			broadcast.announce(Default::default()).expect("failed to announce");
+			let broadcast = origin
+				.route("test", moq_net::origin::RouteOptions::default())
+				.expect("failed to create broadcast");
 			let mut track = broadcast
+				.broadcast()
 				.create_track("video", timed())
 				.expect("failed to create track");
 
@@ -775,9 +777,11 @@ async fn quic_client_close_drains_migrated_predecessor() {
 			.expect("client runtime");
 		runtime.block_on(async move {
 			let origin = moq_tokio::origin::spawn();
-			let broadcast = origin.create_broadcast("test").expect("failed to create broadcast");
-			broadcast.announce(Default::default()).expect("failed to announce");
+			let broadcast = origin
+				.route("test", moq_net::origin::RouteOptions::default())
+				.expect("failed to create broadcast");
 			let mut track = broadcast
+				.broadcast()
 				.create_track("video", timed())
 				.expect("failed to create track");
 
@@ -916,10 +920,12 @@ async fn quic_client_close_keeps_predecessor_handover() {
 			.expect("client runtime");
 		runtime.block_on(async move {
 			let origin = moq_tokio::origin::spawn();
-			let broadcast = origin.create_broadcast("test").expect("failed to create broadcast");
-			broadcast.announce(Default::default()).expect("failed to announce");
+			let broadcast = origin
+				.route("test", moq_net::origin::RouteOptions::default())
+				.expect("failed to create broadcast");
 			// Never finished, so the predecessor serving it cannot drain.
 			let mut track = broadcast
+				.broadcast()
 				.create_track("video", timed())
 				.expect("failed to create track");
 
diff --git a/rs/moq-tokio/tests/integration/broadcast.rs b/rs/moq-tokio/tests/integration/broadcast.rs
index 0a8a3fe8479..80194a7b08c 100644
--- a/rs/moq-tokio/tests/integration/broadcast.rs
+++ b/rs/moq-tokio/tests/integration/broadcast.rs
@@ -8,7 +8,7 @@
 //! This covers raw QUIC (moqt://) and WebTransport (https://) transports,
 //! exercising every protocol version the library supports.
 
-use moq_tokio::moq_net::{self, Hop};
+use moq_tokio::moq_net;
 use std::time::Duration;
 
 /// A millisecond track with no publisher max age: the frames written here carry timestamps,
@@ -32,11 +32,11 @@ async fn broadcast_test(scheme: &str, client_version: Option<&str>, server_versi
 
 	// ── publisher (server) ──────────────────────────────────────────
 	let pub_origin = moq_tokio::origin::spawn();
-	let broadcast = pub_origin.create_broadcast("test").expect("failed to create broadcast");
-	broadcast
-		.announce(Default::default())
+	let broadcast = pub_origin
+		.route("test", moq_net::origin::RouteOptions::default())
 		.expect("failed to create broadcast");
 	let track = broadcast
+		.broadcast()
 		.create_track("video", timed())
 		.expect("failed to create track");
 
@@ -143,13 +143,13 @@ async fn lite05_timestamp_roundtrip(scheme: &str) {
 	use moq_tokio::moq_net::{Timescale, Timestamp};
 
 	let pub_origin = moq_tokio::origin::spawn();
-	let broadcast = pub_origin.create_broadcast("test").expect("failed to create broadcast");
-	broadcast
-		.announce(Default::default())
+	let broadcast = pub_origin
+		.route("test", moq_net::origin::RouteOptions::default())
 		.expect("failed to create broadcast");
 
 	// Track with an explicit microsecond timescale (the default is untimed).
 	let track = broadcast
+		.broadcast()
 		.create_track(
 			"video",
 			moq_net::track::Info::default().with_timescale(Timescale::MICRO),
@@ -261,11 +261,11 @@ async fn lite05_fetch_roundtrip(scheme: &str) {
 	use moq_tokio::moq_net::{Timescale, Timestamp};
 
 	let pub_origin = moq_tokio::origin::spawn();
-	let broadcast = pub_origin.create_broadcast("test").expect("failed to create broadcast");
-	broadcast
-		.announce(Default::default())
+	let broadcast = pub_origin
+		.route("test", moq_net::origin::RouteOptions::default())
 		.expect("failed to create broadcast");
 	let track = broadcast
+		.broadcast()
 		.create_track(
 			"video",
 			moq_net::track::Info::default().with_timescale(Timescale::MICRO),
@@ -377,11 +377,11 @@ async fn broadcast_moq_lite_05_fetch_webtransport() {
 /// refusal.
 async fn transport_fetch_roundtrip(version: &str) {
 	let pub_origin = moq_tokio::origin::spawn();
-	let broadcast = pub_origin.create_broadcast("test").expect("failed to create broadcast");
-	broadcast
-		.announce(Default::default())
-		.expect("failed to announce broadcast");
+	let broadcast = pub_origin
+		.route("test", moq_net::origin::RouteOptions::default())
+		.expect("failed to create broadcast");
 	let track = broadcast
+		.broadcast()
 		.create_track("video", timed())
 		.expect("failed to create track");
 	for sequence in 0..3u64 {
@@ -493,11 +493,11 @@ async fn lite05_fetch_during_subscribe(scheme: &str) {
 	use moq_tokio::moq_net::{Timescale, Timestamp};
 
 	let pub_origin = moq_tokio::origin::spawn();
-	let broadcast = pub_origin.create_broadcast("test").expect("failed to create broadcast");
-	broadcast
-		.announce(Default::default())
+	let broadcast = pub_origin
+		.route("test", moq_net::origin::RouteOptions::default())
 		.expect("failed to create broadcast");
 	let track = broadcast
+		.broadcast()
 		.create_track(
 			"video",
 			moq_net::track::Info::default()
@@ -619,9 +619,10 @@ async fn broadcast_moq_lite_05_untimed_track() {
 	use moq_tokio::moq_net::Timescale;
 
 	let pub_origin = moq_tokio::origin::spawn();
-	let broadcast = pub_origin.create_broadcast("test").expect("create broadcast");
-	broadcast.announce(Default::default()).expect("create broadcast");
-	let track = broadcast.create_track("video", None).expect("create track");
+	let broadcast = pub_origin
+		.route("test", moq_net::origin::RouteOptions::default())
+		.expect("create broadcast");
+	let track = broadcast.broadcast().create_track("video", None).expect("create track");
 
 	let mut group = track.append_group().expect("append group");
 	group.write_frame(None, b"hello".as_ref()).expect("write frame");
@@ -715,9 +716,13 @@ async fn broadcast_moq_lite_05_untimed_track() {
 #[tokio::test]
 async fn broadcast_moq_transport_22_current_group_join() {
 	let pub_origin = moq_tokio::origin::spawn();
-	let broadcast = pub_origin.create_broadcast("test").expect("create broadcast");
-	broadcast.announce(Default::default()).expect("announce");
-	let track = broadcast.create_track("video", timed()).expect("create track");
+	let broadcast = pub_origin
+		.route("test", moq_net::origin::RouteOptions::default())
+		.expect("create broadcast");
+	let track = broadcast
+		.broadcast()
+		.create_track("video", timed())
+		.expect("create track");
 
 	// The group is left open, so the subscriber joins part way through it: the two head
 	// frames are published before the SUBSCRIBE and the tail frame after.
@@ -851,8 +856,9 @@ async fn announce_lifecycle_test(version: &str) {
 	let pub_origin = moq_tokio::origin::spawn();
 
 	// Announced before the client connects, so it rides the initial set.
-	let first = pub_origin.create_broadcast("room/first").expect("create broadcast");
-	first.announce(Default::default()).expect("create broadcast");
+	let first = pub_origin
+		.route("room/first", moq_net::origin::RouteOptions::default())
+		.expect("create broadcast");
 
 	let mut server_config = moq_tokio::listen::Config::default();
 	server_config.bind = Some("[::]:0".parse().unwrap());
@@ -892,22 +898,24 @@ async fn announce_lifecycle_test(version: &str) {
 	assert!(active, "expected initial announce");
 
 	// A live announce after the initial set.
-	let second = pub_origin.create_broadcast("room/second").expect("create broadcast");
-	second.announce(Default::default()).expect("create broadcast");
+	let second = pub_origin
+		.route("room/second", moq_net::origin::RouteOptions::default())
+		.expect("create broadcast");
 	let (update, active) = next_announce(&mut announcements).await;
 	assert_eq!(update.prefix.as_str(), "room/second");
 	assert!(active, "expected live announce");
 
 	// Unannounce: retracted by announce id on the wire. Dropping the announcement
 	// retracts the route; the broadcast's own end is independent.
-	second.close();
+	second.broadcast().close();
 	let (update, active) = next_announce(&mut announcements).await;
 	assert_eq!(update.prefix.as_str(), "room/second");
 	assert!(!active, "expected retraction");
 
 	// Re-announce the same path: a fresh announce assigning a fresh id.
-	let _second = pub_origin.create_broadcast("room/second").expect("create broadcast");
-	_second.announce(Default::default()).expect("create broadcast");
+	let _second = pub_origin
+		.route("room/second", moq_net::origin::RouteOptions::default())
+		.expect("create broadcast");
 	let (update, active) = next_announce(&mut announcements).await;
 	assert_eq!(update.prefix.as_str(), "room/second");
 	assert!(active, "expected re-announce");
@@ -915,19 +923,21 @@ async fn announce_lifecycle_test(version: &str) {
 	// Replace the route at "first": retract the original (retiring its announce
 	// id on the wire), then announce the same path again (assigning a fresh id).
 	// Await the retraction first so the events cannot coalesce away.
-	first.close();
+	first.broadcast().close();
 	let (update, active) = next_announce(&mut announcements).await;
 	assert_eq!(update.prefix.as_str(), "room/first");
 	assert!(!active, "expected the replaced retraction");
-	let _replacement = pub_origin.create_broadcast("room/first").expect("create replacement");
-	_replacement.announce(Default::default()).expect("create replacement");
+	let _replacement = pub_origin
+		.route("room/first", moq_net::origin::RouteOptions::default())
+		.expect("create replacement");
 	let (update, active) = next_announce(&mut announcements).await;
 	assert_eq!(update.prefix.as_str(), "room/first");
 	assert!(active, "expected the replacement announce");
 
 	// A sentinel proves no stray event for "first" snuck in behind the replacement.
-	let _sentinel = pub_origin.create_broadcast("room/sentinel").expect("create broadcast");
-	_sentinel.announce(Default::default()).expect("create broadcast");
+	let _sentinel = pub_origin
+		.route("room/sentinel", moq_net::origin::RouteOptions::default())
+		.expect("create broadcast");
 	let (update, active) = next_announce(&mut announcements).await;
 	assert_eq!(update.prefix.as_str(), "room/sentinel");
 	assert!(active, "expected sentinel announce");
@@ -971,25 +981,20 @@ async fn read_payloads(sub: &mut moq_net::track::Subscriber, count: usize) -> Ve
 async fn broadcast_route_migration() {
 	use moq_net::Timestamp;
 
-	let publisher = Hop::new(0x42).unwrap();
 	// Replicas of one publisher instance, and the only version that carries it.
 	let instance = moq_net::Instance::random();
 	let lite_07: moq_net::Version = "moq-lite-07-wip".parse().unwrap();
 
 	// ── publisher A: the preferred route (cheaper) ──────────────────
 	let origin_a = moq_tokio::origin::spawn();
-	let mut hops_a = moq_net::Hops::new();
-	hops_a.push(publisher).unwrap();
-	let broadcast_a = origin_a.create_broadcast("test").expect("create broadcast");
-	broadcast_a
-		.announce(
-			moq_net::origin::Route::default()
-				.with_instance(instance.clone(), 0)
-				.with_hops(hops_a)
-				.with_cost(1),
-		)
-		.expect("announce");
-	let track_a = broadcast_a.create_track("video", timed()).expect("create track");
+	let options_a = moq_net::origin::RouteOptions::default()
+		.with_instance(instance.clone(), 0)
+		.with_cost(1);
+	let broadcast_a = origin_a.route("test", options_a).expect("announce");
+	let track_a = broadcast_a
+		.broadcast()
+		.create_track("video", timed())
+		.expect("create track");
 	for sequence in 0..2u64 {
 		let mut group = track_a
 			.create_group(moq_net::group::Info { sequence })
@@ -1000,21 +1005,16 @@ async fn broadcast_route_migration() {
 		group.finish().expect("finish group");
 	}
 
-	// ── publisher B: the standby, carrying an extra hop so A wins ───
+	// ── publisher B: the standby, pricier so A wins ─────────────────
 	let origin_b = moq_tokio::origin::spawn();
-	let mut hops_b = moq_net::Hops::new();
-	hops_b.push(publisher).unwrap();
-	hops_b.push(Hop::new(0x1234).unwrap()).unwrap();
-	let broadcast_b = origin_b.create_broadcast("test").expect("create broadcast");
-	broadcast_b
-		.announce(
-			moq_net::origin::Route::default()
-				.with_instance(instance.clone(), 0)
-				.with_hops(hops_b)
-				.with_cost(2),
-		)
-		.expect("announce");
-	let track_b = broadcast_b.create_track("video", timed()).expect("create track");
+	let options_b = moq_net::origin::RouteOptions::default()
+		.with_instance(instance.clone(), 0)
+		.with_cost(2);
+	let broadcast_b = origin_b.route("test", options_b).expect("announce");
+	let track_b = broadcast_b
+		.broadcast()
+		.create_track("video", timed())
+		.expect("create track");
 	// A clone to keep producing from the test body once the task owns the rest.
 	let standby_track = track_b.clone();
 	// B carries the continuation of the same content: groups 2 and 3.
@@ -1106,7 +1106,7 @@ async fn broadcast_route_migration() {
 		.expect("subscribe failed");
 	assert_eq!(read_payloads(&mut sub, 1).await, ["a1"]);
 
-	// Kill the serving session. Both routes name the same first hop, so the
+	// Kill the serving session. Both routes serve the same instance, so the
 	// broadcast re-splices through the standby at the group boundary and the
 	// SAME subscription carries B's continuation.
 	drop(session_a);
@@ -1179,9 +1179,13 @@ async fn rejoin_skips_a_stale_warm_cache(version: &str) {
 	};
 
 	let pub_origin = moq_tokio::origin::spawn();
-	let broadcast = pub_origin.create_broadcast("test").expect("create broadcast");
-	broadcast.announce(Default::default()).expect("announce");
-	let track = broadcast.create_track("audio", timed()).expect("create track");
+	let broadcast = pub_origin
+		.route("test", moq_net::origin::RouteOptions::default())
+		.expect("create broadcast");
+	let track = broadcast
+		.broadcast()
+		.create_track("audio", timed())
+		.expect("create track");
 	let live = track.clone();
 	for sequence in 0..4u64 {
 		write(&track, sequence, sequence * 20);
@@ -1299,9 +1303,13 @@ async fn broadcast_rejoin_replays_a_current_warm_cache() {
 
 async fn rejoin_replays_a_current_warm_cache(version: &str, open: bool) {
 	let pub_origin = moq_tokio::origin::spawn();
-	let broadcast = pub_origin.create_broadcast("test").expect("create broadcast");
-	broadcast.announce(Default::default()).expect("announce");
-	let track = broadcast.create_track("catalog.json", timed()).expect("create track");
+	let broadcast = pub_origin
+		.route("test", moq_net::origin::RouteOptions::default())
+		.expect("create broadcast");
+	let track = broadcast
+		.broadcast()
+		.create_track("catalog.json", timed())
+		.expect("create track");
 	let live = track.clone();
 	let mut group = live.append_group().expect("append group");
 	group
@@ -1408,9 +1416,9 @@ async fn rejoin_replays_a_current_warm_cache(version: &str, open: bool) {
 
 /// A publisher-side route update re-advertises downstream as a restart.
 ///
-/// The publisher re-prices its announced route with a longer chain; the
-/// subscriber observes the new chain as another active update for the same
-/// prefix, with no retraction and an uninterrupted subscription.
+/// The publisher re-prices its announced route; the subscriber observes the new
+/// cost as another active update for the same prefix, with no retraction and an
+/// uninterrupted subscription.
 async fn route_reannounce_test(version: Option<&str>) {
 	use moq_net::Timestamp;
 
@@ -1418,17 +1426,15 @@ async fn route_reannounce_test(version: Option<&str>) {
 
 	// ── publisher (server) ──────────────────────────────────────────
 	let origin = moq_tokio::origin::spawn();
-	// The original publisher: the first hop of every advertised chain. Keeping
-	// it stable across the update is what makes the restart an in-place route
-	// change rather than a broadcast replacement.
-	let publisher_hop = Hop::new(0x4444).unwrap();
-	let mut initial_hops = moq_net::Hops::new();
-	initial_hops.push(publisher_hop).unwrap();
-	let producer = origin.create_broadcast("test").expect("create broadcast");
-	producer
-		.announce(moq_net::origin::Route::default().with_hops(initial_hops))
+	// Re-pricing the same route in place keeps its instance, so the restart is
+	// an in-place route change rather than a broadcast replacement.
+	let producer = origin
+		.route("test", moq_net::origin::RouteOptions::default())
 		.expect("announce");
-	let track = producer.create_track("video", timed()).expect("create track");
+	let track = producer
+		.broadcast()
+		.create_track("video", timed())
+		.expect("create track");
 	{
 		let mut group = track
 			.create_group(moq_net::group::Info { sequence: 0 })
@@ -1492,24 +1498,15 @@ async fn route_reannounce_test(version: Option<&str>) {
 		.expect("subscribe failed");
 	assert_eq!(read_payloads(&mut sub, 1).await, ["g0"]);
 
-	// The publisher re-advertises: the same route, reached through a new
-	// intermediate relay.
-	let mut hops = moq_net::Hops::new();
-	hops.push(publisher_hop).unwrap();
-	hops.push(Hop::new(0x5555).unwrap()).unwrap();
-	producer
-		.announce(moq_net::origin::Route::default().with_hops(hops))
-		.expect("update route");
+	// The publisher re-advertises the same route at a new price.
+	producer.set_cost(5).expect("update route");
 
-	// The subscriber sees the new chain as another active update for the prefix...
+	// The subscriber sees the new price as another active update for the prefix...
 	let (update, active) = next_route(&mut announcements).await;
 	assert_eq!(update.prefix.as_str(), "test");
 	assert!(active, "a restart must not retract the route");
-	assert_ne!(initial.hops, update.route.hops, "route must change");
-	assert!(
-		update.route.hops.iter().any(|h| h.id() == 0x5555),
-		"the new chain must carry the added hop"
-	);
+	assert!(update.route.cost() > initial.cost(), "the new price must arrive");
+	assert_eq!(update.route.instance(), initial.instance(), "the same stream");
 	{
 		let mut group = track
 			.create_group(moq_net::group::Info { sequence: 1 })
@@ -1623,10 +1620,11 @@ async fn max_age_test(version: &str, published: Option<Duration>) -> Option<Dura
 
 	// ── publisher (server) ──────────────────────────────────────────
 	let pub_origin = moq_tokio::origin::spawn();
-	let broadcast = pub_origin.create_broadcast("test").expect("create broadcast");
-	broadcast.announce(Default::default()).expect("create broadcast");
+	let broadcast = pub_origin
+		.route("test", moq_net::origin::RouteOptions::default())
+		.expect("create broadcast");
 	let info = timed().with_max_age(published);
-	let track = broadcast.create_track("video", info).expect("create track");
+	let track = broadcast.broadcast().create_track("video", info).expect("create track");
 
 	let mut server_config = moq_tokio::listen::Config::default();
 	server_config.bind = Some("[::]:0".parse().unwrap());
@@ -1804,11 +1802,11 @@ async fn broadcast_webtransport_negotiate_client_all_server_transport_18() {
 async fn broadcast_websocket() {
 	// ── publisher (server) ──────────────────────────────────────────
 	let pub_origin = moq_tokio::origin::spawn();
-	let broadcast = pub_origin.create_broadcast("test").expect("failed to create broadcast");
-	broadcast
-		.announce(Default::default())
+	let broadcast = pub_origin
+		.route("test", moq_net::origin::RouteOptions::default())
 		.expect("failed to create broadcast");
 	let track = broadcast
+		.broadcast()
 		.create_track("video", timed())
 		.expect("failed to create track");
 
@@ -1922,11 +1920,11 @@ async fn broadcast_websocket() {
 async fn broadcast_websocket_fallback() {
 	// ── publisher (server) ──────────────────────────────────────────
 	let pub_origin = moq_tokio::origin::spawn();
-	let broadcast = pub_origin.create_broadcast("test").expect("failed to create broadcast");
-	broadcast
-		.announce(Default::default())
+	let broadcast = pub_origin
+		.route("test", moq_net::origin::RouteOptions::default())
 		.expect("failed to create broadcast");
 	let track = broadcast
+		.broadcast()
 		.create_track("video", timed())
 		.expect("failed to create track");
 
@@ -2051,11 +2049,11 @@ const NEWEST_LITE: &str = "moq-lite-06";
 #[tokio::test]
 async fn broadcast_websocket_uses_newest_version() {
 	let pub_origin = moq_tokio::origin::spawn();
-	let broadcast = pub_origin.create_broadcast("test").expect("failed to create broadcast");
-	broadcast
-		.announce(Default::default())
+	let broadcast = pub_origin
+		.route("test", moq_net::origin::RouteOptions::default())
 		.expect("failed to create broadcast");
 	let track = broadcast
+		.broadcast()
 		.create_track("video", timed())
 		.expect("failed to create track");
 	let mut group = track.append_group().expect("failed to append group");
@@ -2131,11 +2129,11 @@ async fn quic_driver_task_inherits_connection_span() {
 	let logs = crate::Logs::capture();
 
 	let pub_origin = moq_tokio::origin::spawn();
-	let broadcast = pub_origin.create_broadcast("test").expect("failed to create broadcast");
-	broadcast
-		.announce(Default::default())
+	let broadcast = pub_origin
+		.route("test", moq_net::origin::RouteOptions::default())
 		.expect("failed to create broadcast");
 	let track = broadcast
+		.broadcast()
 		.create_track("video", timed())
 		.expect("failed to create track");
 	let mut group = track.append_group().expect("failed to append group");
@@ -2255,9 +2253,13 @@ async fn quic_driver_task_inherits_connection_span() {
 #[tokio::test]
 async fn resubscribe_keeps_flowing_moq_lite_03() {
 	let pub_origin = moq_tokio::origin::spawn();
-	let broadcast = pub_origin.create_broadcast("test").expect("create broadcast");
-	broadcast.announce(Default::default()).expect("create broadcast");
-	let track = broadcast.create_track("video", timed()).expect("create track");
+	let broadcast = pub_origin
+		.route("test", moq_net::origin::RouteOptions::default())
+		.expect("create broadcast");
+	let track = broadcast
+		.broadcast()
+		.create_track("video", timed())
+		.expect("create track");
 
 	let mut group0 = track.append_group().expect("append group 0");
 	group0
@@ -2390,9 +2392,13 @@ fn active_viewers(registry: &moq_net::stats::Registry) -> u64 {
 #[tokio::test]
 async fn idle_subscription_releases_the_viewer_count() {
 	let pub_origin = moq_tokio::origin::spawn();
-	let broadcast = pub_origin.create_broadcast("test").expect("create broadcast");
-	broadcast.announce(Default::default()).expect("create broadcast");
-	let track = broadcast.create_track("video", timed()).expect("create track");
+	let broadcast = pub_origin
+		.route("test", moq_net::origin::RouteOptions::default())
+		.expect("create broadcast");
+	let track = broadcast
+		.broadcast()
+		.create_track("video", timed())
+		.expect("create track");
 
 	let mut group = track.append_group().expect("append group");
 	group
@@ -2669,8 +2675,9 @@ async fn a_dead_session_unannounces_while_the_reconnect_retries() {
 	let url: url::Url = format!("https://localhost:{}", addr.port()).parse().unwrap();
 
 	let pub_origin = moq_tokio::origin::spawn();
-	let _broadcast = pub_origin.create_broadcast("live").expect("create broadcast");
-	_broadcast.announce(Default::default()).expect("create broadcast");
+	let _broadcast = pub_origin
+		.route("live", moq_net::origin::RouteOptions::default())
+		.expect("create broadcast");
 
 	// Accept the first session and hand it back so the test can kill it. Later
 	// redials are left hanging (the server stops accepting), so the subscriber is
@@ -2729,12 +2736,10 @@ async fn announce_interest_unauthorized_keeps_session_alive() {
 	// ── publisher (server): only allowed to announce under "allowed" ──
 	let pub_origin = moq_tokio::origin::spawn();
 	let broadcast = pub_origin
-		.create_broadcast("allowed/test")
-		.expect("failed to create broadcast");
-	broadcast
-		.announce(Default::default())
+		.route("allowed/test", moq_net::origin::RouteOptions::default())
 		.expect("failed to create broadcast");
 	let track = broadcast
+		.broadcast()
 		.create_track("video", timed())
 		.expect("failed to create track");
 	let mut group = track.append_group().expect("failed to append group");
@@ -2825,9 +2830,13 @@ async fn wildcard_scope_test(version: &str, server_scope: &str) {
 		"room/bob/chat",
 		"lobby/alice/chat",
 	] {
-		let broadcast = pub_origin.create_broadcast(path).expect("create broadcast");
-		broadcast.announce(Default::default()).expect("announce");
-		let track = broadcast.create_track("data", timed()).expect("create track");
+		let broadcast = pub_origin
+			.route(path, moq_net::origin::RouteOptions::default())
+			.expect("create broadcast");
+		let track = broadcast
+			.broadcast()
+			.create_track("data", timed())
+			.expect("create track");
 		let mut group = track.append_group().expect("append group");
 		group
 			.write_frame(moq_net::Timestamp::ZERO, path.as_bytes())
@@ -3028,12 +3037,10 @@ async fn publish_only_client_to_subscribe_only_server() {
 	// ── publisher (client): only allowed to serve under "allowed" ──
 	let pub_origin = moq_tokio::origin::spawn();
 	let broadcast = pub_origin
-		.create_broadcast("allowed/test")
-		.expect("failed to create broadcast");
-	broadcast
-		.announce(Default::default())
+		.route("allowed/test", moq_net::origin::RouteOptions::default())
 		.expect("failed to create broadcast");
 	let track = broadcast
+		.broadcast()
 		.create_track("video", timed())
 		.expect("failed to create track");
 	let mut group = track.append_group().expect("failed to append group");
@@ -3108,11 +3115,11 @@ async fn goaway_test(scheme: &str, version: &str, expect_wire_timeout: bool) {
 
 	// ── publisher (server) ──────────────────────────────────────────
 	let pub_origin = moq_tokio::origin::spawn();
-	let broadcast = pub_origin.create_broadcast("test").expect("failed to create broadcast");
-	broadcast
-		.announce(Default::default())
+	let broadcast = pub_origin
+		.route("test", moq_net::origin::RouteOptions::default())
 		.expect("failed to create broadcast");
 	let track = broadcast
+		.broadcast()
 		.create_track("video", timed())
 		.expect("failed to create track");
 
diff --git a/rs/moq-tokio/tests/integration/datagram_delivery.rs b/rs/moq-tokio/tests/integration/datagram_delivery.rs
index 99e93d2b5f8..ce881e6dcc7 100644
--- a/rs/moq-tokio/tests/integration/datagram_delivery.rs
+++ b/rs/moq-tokio/tests/integration/datagram_delivery.rs
@@ -199,9 +199,11 @@ async fn measure(version: &str, cell: Cell) {
 	let version: moq_net::Version = version.parse().expect("version");
 
 	let publisher = moq_tokio::origin::spawn();
-	let broadcast = publisher.create_broadcast("room").expect("broadcast");
-	let mut datagrams = broadcast.create_datagrams("audio", timed()).unwrap();
-	broadcast.announce(Default::default()).expect("announce");
+	let broadcast = publisher
+		.route("room", moq_net::origin::RouteOptions::hidden())
+		.expect("broadcast");
+	let mut datagrams = broadcast.broadcast().create_datagrams("audio", timed()).unwrap();
+	broadcast.announce().expect("announce");
 
 	let mut config = moq_tokio::listen::Config::default();
 	config.bind = Some("127.0.0.1:0".parse().unwrap());
diff --git a/rs/moq-tokio/tests/integration/max_age.rs b/rs/moq-tokio/tests/integration/max_age.rs
index c1d89af853e..c47087d60c2 100644
--- a/rs/moq-tokio/tests/integration/max_age.rs
+++ b/rs/moq-tokio/tests/integration/max_age.rs
@@ -36,13 +36,17 @@ async fn relay(version: moq_net::Version, javascript: Option<bool>) -> anyhow::R
 		Ok::<_, anyhow::Error>(())
 	});
 	let publisher = moq_tokio::origin::spawn();
-	let broadcast = publisher.create_broadcast("age")?;
+	let broadcast = publisher.route("age", moq_net::origin::RouteOptions::hidden())?;
 	let tracks: Vec<_> = AGES
 		.into_iter()
 		.enumerate()
-		.map(|(i, age)| broadcast.create_track(i.to_string(), moq_net::track::Info::default().with_max_age(age)))
+		.map(|(i, age)| {
+			broadcast
+				.broadcast()
+				.create_track(i.to_string(), moq_net::track::Info::default().with_max_age(age))
+		})
 		.collect::<Result<_, _>>()?;
-	broadcast.announce(Default::default())?;
+	broadcast.announce()?;
 	let subscriber = moq_tokio::origin::spawn();
 	let consumer = subscriber.consume();
 	let mut announced = consumer.announced();
diff --git a/rs/moq-tokio/tests/integration/migrate.rs b/rs/moq-tokio/tests/integration/migrate.rs
index 3e3adedc620..aa53e31f36b 100644
--- a/rs/moq-tokio/tests/integration/migrate.rs
+++ b/rs/moq-tokio/tests/integration/migrate.rs
@@ -74,12 +74,16 @@ fn connect(origin: &moq_net::origin::Producer, port: u16, versions: Vec<moq_net:
 		.connect(format!("tcp://127.0.0.1:{port}/").parse::<url::Url>().unwrap())
 }
 
-/// Announce `name` on `origin` as `route`, and publish a group carrying its own sequence
-/// number every 20ms for the rest of the test.
-fn publish(origin: &moq_net::origin::Producer, name: &str, route: moq_net::origin::Route) {
-	let broadcast = origin.create_broadcast(name).expect("create broadcast");
-	broadcast.announce(route).expect("announce");
-	let track = broadcast.create_track("video", timed()).expect("create track");
+/// Announce `name` on `origin`, and publish a group carrying its own sequence number every
+/// 20ms for the rest of the test.
+fn publish(origin: &moq_net::origin::Producer, name: &str) {
+	let broadcast = origin
+		.route(name, moq_net::origin::RouteOptions::default())
+		.expect("announce");
+	let track = broadcast
+		.broadcast()
+		.create_track("video", timed())
+		.expect("create track");
 	tokio::spawn(async move {
 		let _broadcast = broadcast;
 		loop {
@@ -175,8 +179,8 @@ async fn a_migrated_session_closes_once_nothing_flows() {
 		.expect("the relay stopped");
 
 	// Each broadcast mints an instance the migration carries across sessions.
-	publish(&local, "up", moq_net::origin::Route::default());
-	publish(&origin, "down", moq_net::origin::Route::default());
+	publish(&local, "up");
+	publish(&origin, "down");
 	let mut upstream = view(&origin, "up");
 	let mut downstream = view(&local, "down");
 	let (mut up, mut down) = (Vec::new(), Vec::new());
@@ -213,7 +217,7 @@ async fn a_predecessor_serves_until_its_last_subscription_leaves() {
 		.expect("the client never connected")
 		.expect("the relay stopped");
 
-	publish(&origin, "down", moq_net::origin::Route::default());
+	publish(&origin, "down");
 	let mut downstream = view(&local, "down");
 	let mut down = Vec::new();
 	read(&mut downstream, GROUPS, &mut down).await;
diff --git a/rs/moq-tokio/tests/integration/receive_credit.rs b/rs/moq-tokio/tests/integration/receive_credit.rs
index e2a2d57a7fe..a98fc16e094 100644
--- a/rs/moq-tokio/tests/integration/receive_credit.rs
+++ b/rs/moq-tokio/tests/integration/receive_credit.rs
@@ -56,7 +56,7 @@ fn bufferbloat(bits_per_second: u64) -> moq_shaper::Profile {
 /// A server publishing broadcast `room`, and a client subscribed to its origin over a
 /// connection with the given transport settings.
 struct Setup {
-	broadcast: moq_net::origin::Publication,
+	broadcast: moq_net::origin::Route,
 	remote: moq_net::broadcast::Consumer,
 	/// The client's connection, for its credit stats.
 	conn: driver::connection::Connection,
@@ -81,8 +81,9 @@ async fn setup_through(
 	let version: moq_net::Version = version.parse().expect("version");
 
 	let publisher = moq_tokio::origin::spawn();
-	let broadcast = publisher.create_broadcast("room").expect("broadcast");
-	broadcast.announce(Default::default()).expect("announce");
+	let broadcast = publisher
+		.route("room", moq_net::origin::RouteOptions::default())
+		.expect("broadcast");
 
 	let mut config = moq_tokio::listen::Config::default();
 	config.bind = Some("127.0.0.1:0".parse().unwrap());
@@ -203,7 +204,7 @@ async fn subscribe(remote: &moq_net::broadcast::Consumer, name: &str, priority:
 impl Setup {
 	/// Subscribe to a new track at `priority`.
 	async fn subscribe(&self, name: &str, priority: i8) -> (moq_net::track::Producer, moq_net::track::Subscriber) {
-		let track = self.broadcast.create_track(name, timed()).unwrap();
+		let track = self.broadcast.broadcast().create_track(name, timed()).unwrap();
 		(track, subscribe(&self.remote, name, priority).await)
 	}
 
@@ -407,7 +408,7 @@ async fn lite_frame_past_the_window_gives_way() {
 /// A subscriber served on the raw driver with a connection window of [`WINDOW`], and a
 /// publisher dialing it whose connection can also send raw streams.
 struct Reversed {
-	broadcast: moq_net::origin::Publication,
+	broadcast: moq_net::origin::Route,
 	remote: moq_net::broadcast::Consumer,
 	/// The publisher's connection, for streams no session would send.
 	conn: driver::connection::Connection,
@@ -471,8 +472,9 @@ async fn reversed(version: &str) -> Reversed {
 	);
 
 	let publisher = moq_tokio::origin::spawn();
-	let broadcast = publisher.create_broadcast("room").expect("broadcast");
-	broadcast.announce(Default::default()).expect("announce");
+	let broadcast = publisher
+		.route("room", moq_net::origin::RouteOptions::default())
+		.expect("broadcast");
 	let subscriber = moq_tokio::origin::spawn();
 	let session = |conn: driver::connection::Connection| web::Session::raw(conn);
 	// A moq-lite client's driver sends its half of the handshake, so it runs meanwhile.
@@ -511,7 +513,7 @@ async fn reversed(version: &str) -> Reversed {
 impl Reversed {
 	/// Subscribe to a new track at `priority`.
 	async fn subscribe(&self, name: &str, priority: i8) -> (moq_net::track::Producer, moq_net::track::Subscriber) {
-		let track = self.broadcast.create_track(name, timed()).unwrap();
+		let track = self.broadcast.broadcast().create_track(name, timed()).unwrap();
 		(track, subscribe(&self.remote, name, priority).await)
 	}
 
@@ -628,7 +630,7 @@ async fn groups_waiting_for_track_info_give_way_first() {
 	read_partial(&mut partial, WINDOW / 4).await;
 
 	// Subscription 1, sent alongside a TRACK whose TRACK_INFO the publisher holds back.
-	let mut requests = setup.broadcast.requests();
+	let mut requests = setup.broadcast.broadcast().requests();
 	let every = Subscription::default()
 		.with_order(moq_net::track::Order::Ascending)
 		.with_range(0..)
@@ -998,6 +1000,7 @@ async fn measure(cell: Cell, profile: Option<moq_shaper::Profile>, bytes: usize)
 		// than expire at the publisher's default zero max age.
 		let track = setup
 			.broadcast
+			.broadcast()
 			.create_track(name.as_str(), timed().with_max_age(None))
 			.unwrap();
 		// Groups in flight fall behind the live edge, so a zero budget would skip them.
diff --git a/rs/moq-tokio/tests/integration/relay_fill.rs b/rs/moq-tokio/tests/integration/relay_fill.rs
index 12fe84fd356..693e4cbb61b 100644
--- a/rs/moq-tokio/tests/integration/relay_fill.rs
+++ b/rs/moq-tokio/tests/integration/relay_fill.rs
@@ -158,8 +158,8 @@ fn groups(range: std::ops::Range<u64>) -> BTreeMap<u64, String> {
 
 async fn relay(version: Version) -> anyhow::Result<()> {
 	let publisher = moq_tokio::origin::spawn();
-	let broadcast = publisher.create_broadcast("history")?;
-	let track = broadcast.create_track(
+	let broadcast = publisher.route("history", moq_net::origin::RouteOptions::hidden())?;
+	let track = broadcast.broadcast().create_track(
 		"video",
 		Info::default().with_timescale(Timescale::MILLI).with_max_age(None),
 	)?;
@@ -171,7 +171,7 @@ async fn relay(version: Version) -> anyhow::Result<()> {
 		)?;
 		group.finish()?;
 	}
-	broadcast.announce(Default::default())?;
+	broadcast.announce()?;
 	let (upstream, upstream_serve) = listen(version, true, move || publisher.clone()).await?;
 	let (sessions, viewers) = tokio::sync::mpsc::unbounded_channel();
 	let (downstream, downstream_serve) = listen(version, false, move || {
diff --git a/rs/moq-tokio/tests/integration/runtime.rs b/rs/moq-tokio/tests/integration/runtime.rs
index 58497ab6297..904287d710f 100644
--- a/rs/moq-tokio/tests/integration/runtime.rs
+++ b/rs/moq-tokio/tests/integration/runtime.rs
@@ -16,9 +16,11 @@ fn sessions_without_a_runtime() {
 	assert!(tokio::runtime::Handle::try_current().is_err());
 
 	let publisher = moq_tokio::origin::spawn();
-	let broadcast = publisher.create_broadcast("test").expect("failed to create broadcast");
-	broadcast.announce(Default::default()).expect("failed to announce");
+	let broadcast = publisher
+		.route("test", moq_net::origin::RouteOptions::default())
+		.expect("failed to create broadcast");
 	let track = broadcast
+		.broadcast()
 		.create_track(
 			"video",
 			moq_net::track::Info::default().with_timescale(moq_net::Timescale::MILLI),
diff --git a/rs/moq-tokio/tests/integration/sim.rs b/rs/moq-tokio/tests/integration/sim.rs
index e6ae5164165..75f65309a4f 100644
--- a/rs/moq-tokio/tests/integration/sim.rs
+++ b/rs/moq-tokio/tests/integration/sim.rs
@@ -157,8 +157,11 @@ async fn serve(network: &Network, version: Version, seed: u64) -> Arrivals {
 
 	let publisher = origin_producer(1);
 	let viewer = origin_producer(2);
-	let broadcast = publisher.create_broadcast("live").unwrap();
+	let broadcast = publisher
+		.route("live", moq_net::origin::RouteOptions::hidden())
+		.unwrap();
 	let source = broadcast
+		.broadcast()
 		.create_track(
 			"video",
 			track::Info::default()
@@ -166,7 +169,7 @@ async fn serve(network: &Network, version: Version, seed: u64) -> Arrivals {
 				.with_max_age(None),
 		)
 		.unwrap();
-	broadcast.announce(Default::default()).unwrap();
+	broadcast.announce().unwrap();
 
 	let accept = async {
 		let conn = server.accept().await.unwrap().accept().unwrap().await.unwrap();
diff --git a/rs/moq-tokio/tests/integration/subscription_end_integrity.rs b/rs/moq-tokio/tests/integration/subscription_end_integrity.rs
index cd7c084ce27..69fc24f3b8d 100644
--- a/rs/moq-tokio/tests/integration/subscription_end_integrity.rs
+++ b/rs/moq-tokio/tests/integration/subscription_end_integrity.rs
@@ -49,9 +49,13 @@ const STALL: Duration = Duration::from_millis(300);
 /// the subscriber read and the error its subscription ended with, if any.
 async fn round(drop_session: bool) -> (usize, Option<moq_net::Error>) {
 	let pub_origin = moq_tokio::origin::spawn();
-	let broadcast = pub_origin.create_broadcast("test").expect("create broadcast");
-	broadcast.announce(Default::default()).expect("announce");
-	let track = broadcast.create_track("video", timed()).expect("create track");
+	let broadcast = pub_origin
+		.route("test", moq_net::origin::RouteOptions::default())
+		.expect("create broadcast");
+	let track = broadcast
+		.broadcast()
+		.create_track("video", timed())
+		.expect("create track");
 
 	let mut server_config = moq_tokio::listen::Config::default();
 	server_config.bind = Some("127.0.0.1:0".parse().unwrap());
diff --git a/rs/moq-tokio/tests/integration/unannounce.rs b/rs/moq-tokio/tests/integration/unannounce.rs
index bb07235b85b..71c42e36635 100644
--- a/rs/moq-tokio/tests/integration/unannounce.rs
+++ b/rs/moq-tokio/tests/integration/unannounce.rs
@@ -10,14 +10,14 @@ use moq_tokio::moq_net;
 /// publisher's demand to go unused.
 async fn release(unannounce: bool, settle: bool) {
 	let origin = moq_tokio::origin::spawn();
-	let broadcast = origin.publish("a/b", moq_net::origin::Route::default()).unwrap();
-	let track = broadcast.create_track("t", None).unwrap();
+	let broadcast = origin.route("a/b", moq_net::origin::RouteOptions::default()).unwrap();
+	let track = broadcast.broadcast().create_track("t", None).unwrap();
 	let consumer = origin.consume().request("a/b", None).await.unwrap();
 	let sub = consumer.track("t").unwrap().subscribe(None).await.unwrap();
 	crate::wanted(track.demand()).await.unwrap();
 
 	if unannounce {
-		broadcast.unannounce();
+		broadcast.withdraw();
 		if settle {
 			kio::clock::sleep(Duration::from_secs(1)).await;
 		}
diff --git a/rs/moq-transcode/README.md b/rs/moq-transcode/README.md
index 5a12d6d1aa9..85dd8d270b0 100644
--- a/rs/moq-transcode/README.md
+++ b/rs/moq-transcode/README.md
@@ -46,10 +46,10 @@ let mut config = moq_transcode::Config::default();
 // renditions are referenced through its parent.
 config.source = Some(moq_net::path::Relative::new("."));
 
-let output = origin.create_broadcast(format!("{path}/transcode.hang"))?;
-output.announce(Default::default())?;
+// Dropping the route withdraws the derivative, so hold it while the transcoder runs.
+let route = origin.route(format!("{path}/transcode.hang"), RouteOptions::default())?;
 
-moq_transcode::run(source, output, config).await?;
+moq_transcode::run(source, route.broadcast().clone(), config).await?;
 ```
 
 Rung sizes measure the coded frame's short side: a 1080x1920 source produces
diff --git a/rs/moq-transcode/examples/transcode.rs b/rs/moq-transcode/examples/transcode.rs
index cfbf624f60d..780b8fdf4f1 100644
--- a/rs/moq-transcode/examples/transcode.rs
+++ b/rs/moq-transcode/examples/transcode.rs
@@ -74,11 +74,9 @@ async fn main() -> anyhow::Result<()> {
 	// publishes the rungs and nothing else.
 	config.source = source_path.relative(&output_path).filter(|rel| !rel.is_empty());
 
+	// Held until the transcoder ends: dropping the route withdraws the derivative.
 	let output = publish
-		.create_broadcast(&output_path)
-		.context("failed to create the derivative broadcast")?;
-	output
-		.announce(Default::default())
+		.route(&output_path, moq_net::origin::RouteOptions::default())
 		.context("failed to announce the derivative broadcast")?;
 	tracing::info!(source = %source_path, output = %output_path, "transcoding");
 
diff --git a/rs/moq-transcode/src/lib.rs b/rs/moq-transcode/src/lib.rs
index 7f19085f8a5..e631e8c8a5b 100644
--- a/rs/moq-transcode/src/lib.rs
+++ b/rs/moq-transcode/src/lib.rs
@@ -724,8 +724,10 @@ mod tests {
 		// the output must be minted through an origin: a standalone producer has no path, and
 		// `..` from it would escape, failing the catalog read below.
 		let origin = moq_tokio::origin::spawn();
-		let output = origin.create_broadcast("room/transcode").unwrap();
-		let consumer = output.consume();
+		let output = origin
+			.route("room/transcode", moq_net::origin::RouteOptions::hidden())
+			.unwrap();
+		let consumer = output.broadcast().consume();
 		let transcoder = tokio::spawn(run(source.broadcast.consume(), output.broadcast().clone(), config));
 
 		// The derivative catalog appears before anything is encoded, with the
diff --git a/rs/moq-uring/benches/session_lite.rs b/rs/moq-uring/benches/session_lite.rs
index 8f6e4bdfc1a..5b11bf9cad5 100644
--- a/rs/moq-uring/benches/session_lite.rs
+++ b/rs/moq-uring/benches/session_lite.rs
@@ -115,9 +115,13 @@ mod linux {
 				});
 			});
 
-			let broadcast = pub_origin.create_broadcast("bench").expect("create broadcast");
-			broadcast.announce(Default::default()).expect("create broadcast");
-			let track = broadcast.create_track("data", timed()).expect("create track");
+			let broadcast = pub_origin
+				.route("bench", moq_net::origin::RouteOptions::default())
+				.expect("create broadcast");
+			let track = broadcast
+				.broadcast()
+				.create_track("data", timed())
+				.expect("create track");
 
 			let certs = support::certs().expect("certificates");
 			let server_config = quic::server::Config::new(
diff --git a/rs/moq-uring/tests/integration/receive_credit.rs b/rs/moq-uring/tests/integration/receive_credit.rs
index 68fad55072e..4706e6f91cb 100644
--- a/rs/moq-uring/tests/integration/receive_credit.rs
+++ b/rs/moq-uring/tests/integration/receive_credit.rs
@@ -89,10 +89,11 @@ fn partial_frame_gives_way() {
 		});
 	});
 
-	let broadcast = pub_origin.create_broadcast("room").expect("create broadcast");
-	broadcast.announce(Default::default()).expect("announce");
-	let low = broadcast.create_track("low", timed()).expect("low track");
-	let high = broadcast.create_track("high", timed()).expect("high track");
+	let broadcast = pub_origin
+		.route("room", moq_net::origin::RouteOptions::default())
+		.expect("create broadcast");
+	let low = broadcast.broadcast().create_track("low", timed()).expect("low track");
+	let high = broadcast.broadcast().create_track("high", timed()).expect("high track");
 
 	let certs = support::certs().expect("certificates");
 	let server_config = quic::server::Config::new(
diff --git a/rs/moq-uring/tests/integration/session.rs b/rs/moq-uring/tests/integration/session.rs
index 6cbe0006258..8e3188bc642 100644
--- a/rs/moq-uring/tests/integration/session.rs
+++ b/rs/moq-uring/tests/integration/session.rs
@@ -56,9 +56,13 @@ fn lite_session_over_the_worker() {
 
 	// Content ready before anyone connects: one broadcast, one track, one
 	// finished group.
-	let broadcast = pub_origin.create_broadcast("test").expect("create broadcast");
-	broadcast.announce(Default::default()).expect("create broadcast");
-	let track = broadcast.create_track("data", timed()).expect("create track");
+	let broadcast = pub_origin
+		.route("test", moq_net::origin::RouteOptions::default())
+		.expect("create broadcast");
+	let track = broadcast
+		.broadcast()
+		.create_track("data", timed())
+		.expect("create track");
 	let mut group = track.append_group().expect("append group");
 	group
 		.write_frame(moq_net::Timestamp::ZERO, PAYLOAD)
@@ -189,9 +193,13 @@ fn two_lite_sessions_share_the_server_socket() {
 		});
 	});
 
-	let broadcast = pub_origin.create_broadcast("test").expect("create broadcast");
-	broadcast.announce(Default::default()).expect("create broadcast");
-	let track = broadcast.create_track("data", timed()).expect("create track");
+	let broadcast = pub_origin
+		.route("test", moq_net::origin::RouteOptions::default())
+		.expect("create broadcast");
+	let track = broadcast
+		.broadcast()
+		.create_track("data", timed())
+		.expect("create track");
 	let mut group = track.append_group().expect("append group");
 	group
 		.write_frame(moq_net::Timestamp::ZERO, PAYLOAD)
diff --git a/rs/moq-uring/tests/integration/web.rs b/rs/moq-uring/tests/integration/web.rs
index b8c5b2673ee..f03ce1e487e 100644
--- a/rs/moq-uring/tests/integration/web.rs
+++ b/rs/moq-uring/tests/integration/web.rs
@@ -423,9 +423,13 @@ fn lite_session_over_webtransport() {
 		rt.block_on(moq_net::time::run(pub_driver));
 	});
 
-	let broadcast = pub_origin.create_broadcast("test").expect("create broadcast");
-	broadcast.announce(Default::default()).expect("create broadcast");
-	let track = broadcast.create_track("data", timed()).expect("create track");
+	let broadcast = pub_origin
+		.route("test", moq_net::origin::RouteOptions::default())
+		.expect("create broadcast");
+	let track = broadcast
+		.broadcast()
+		.create_track("data", timed())
+		.expect("create track");
 	let mut group = track.append_group().expect("append group");
 	group
 		.write_frame(moq_net::Timestamp::ZERO, PAYLOAD)
diff --git a/rs/moq-video/src/decode/decoder.rs b/rs/moq-video/src/decode/decoder.rs
index d03151c89e4..0c922deb14c 100644
--- a/rs/moq-video/src/decode/decoder.rs
+++ b/rs/moq-video/src/decode/decoder.rs
@@ -657,11 +657,12 @@ mod tests {
 
 		let (origin, driver) = moq_net::origin::Producer::new(Default::default());
 		tokio::spawn(moq_net::time::run(driver));
-		let source = origin.publish("test", Default::default()).unwrap();
+		let source = origin.route("test", Default::default()).unwrap();
 		let mut source_catalog =
 			moq_mux::catalog::Producer::new(&mut source.broadcast().clone(), moq_mux::catalog::Config::default())
 				.unwrap();
 		let track = source
+			.broadcast()
 			.create_track("video", hang::container::track_info(hang::catalog::PRIORITY.video))
 			.unwrap();
 		let mut config = hang::catalog::VideoConfig::new(hang::catalog::H265 {
diff --git a/swift/MIGRATE.md b/swift/MIGRATE.md
index 2b03b4ca9c7..08d065383f9 100644
--- a/swift/MIGRATE.md
+++ b/swift/MIGRATE.md
@@ -25,6 +25,22 @@ while true {
 }
 ```
 
+### Publishing goes through one `Route`
+
+`OriginProducer.createBroadcast(path:)` is `route(path:hidden:cost:instance:epoch:)`, and `requests(prefix:)` is `routePrefix(prefix:hidden:cost:instance:epoch:)`. Both return a `Route`, which replaces `Publication`, `OriginRequests`, and `BroadcastPrepared`:
+
+- `Publication.broadcast` is `Route.broadcast`, which now throws on a prefix route.
+- `Publication.announce(route: AnnounceRoute(...))` is `announce()`, and re-pricing is `setCost(_:)`. `unannounce()` is `withdraw()`.
+- `OriginRequests.requestedBroadcast()` is `Route.requested()`, which returns `nil` once the origin closes. A prefix `Route` is the `AsyncSequence` of requests, and cancelling the iterating task still cancels the route.
+- `BroadcastRequest.prepare()` then `BroadcastPrepared.publish()` is `BroadcastRequest.route(hidden:cost:instance:epoch:)`: create it hidden to fill it first, then `announce()`.
+- `Route.instance` is the stream's instance, minted at creation and kept across `withdraw` and `announce`.
+
+`AnnounceRoute` is gone: pass its `cost`, `instance`, and `epoch`, plus `hidden`, as labeled arguments when creating the route. A route is visible at once unless `hidden: true`; set it and call `announce()` after filling the catalog to keep the old create-then-announce order. A stable `instance` is fixed for the route's lifetime: announcing another one is a new route.
+
+Hold the `Route` for as long as the broadcast should stay announced: releasing or cancelling it retracts it, while `BroadcastProducer.close()` still ends both. A `BroadcastProducer` alone no longer keeps it announced.
+
+`Route`, the received facts in `Announce.route`, is renamed `RouteInfo`; its fields are unchanged.
+
 ### Catalog renditions carry their warmup ([#7864](https://github.com/moq-dev/moq/pull/7864))
 
 `Media.Video` and `Media.Audio` gain `warmup`, the catalog's decoder warmup; it defaults to `nil`, so existing initializers still compile. `Media.TrackConsumer` and the audio and video consumers read it from the rendition and start that much earlier.
diff --git a/swift/README.md b/swift/README.md
index 0c3d296efb1..da49f00b8e1 100644
--- a/swift/README.md
+++ b/swift/README.md
@@ -57,9 +57,9 @@ try await session.closed()
 To publish through the auto-created origin:
 
 ```swift
-let publication = try session.publish.createBroadcast(path: "my-stream")
-// ... configure tracks on publication.broadcast ...
-try publication.announce() // unannounced broadcasts are invisible
+let route = try session.publish.route(path: "my-stream", hidden: true)
+// ... configure tracks on route.broadcast ...
+try route.announce() // hidden routes are invisible; hold the route while it should stay announced
 ```
 
 Cancelling the surrounding Swift `Task` propagates through to the underlying `cancel()` calls on each consumer. `session.shutdown()` requests a drain immediately; `try await session.closed()` waits for it and throws on delivery failure. `cancel(code: 0)` remains immediate.
diff --git a/swift/Sources/Moq/Aliases.swift b/swift/Sources/Moq/Aliases.swift
index cb47c30afb4..2a9bf07b2cd 100644
--- a/swift/Sources/Moq/Aliases.swift
+++ b/swift/Sources/Moq/Aliases.swift
@@ -51,13 +51,9 @@ public typealias VideoCodec = MoqFFI.MoqVideoCodec
 public typealias VideoEncoderKind = MoqFFI.MoqVideoEncoderKind
 /// A datagram payload with its own sequence and optional timestamp.
 public typealias Datagram = MoqFFI.MoqDatagram
-/// How a broadcast advertises its exact path: its static production `cost`,
-/// lower wins, an optional stable `instance` (`nil` keeps the one the broadcast
-/// minted), and the `epoch`, which only matters with a stable instance.
-public typealias AnnounceRoute = MoqFFI.MoqAnnounceRoute
-/// An observed path-prefix route: the `instance` of the stream it serves, relay
-/// hop ids (oldest first), and its static production and link cost, lower wins.
-public typealias Route = MoqFFI.MoqRoute
+/// The read-only facts on a received route: the `instance` of the stream it serves,
+/// relay hop ids (oldest first), and its static production and link cost, lower wins.
+public typealias RouteInfo = MoqFFI.MoqRouteInfo
 /// A route over a prefix: the origin-relative `prefix`, what each filter
 /// wildcard matched (`captures`, a required list, empty without wildcards), and the `route` serving it.
 /// Resolve a path with `OriginConsumer.request`.
diff --git a/swift/Sources/Moq/Broadcast.swift b/swift/Sources/Moq/Broadcast.swift
index db36dfc9449..30cf19f63b2 100644
--- a/swift/Sources/Moq/Broadcast.swift
+++ b/swift/Sources/Moq/Broadcast.swift
@@ -50,16 +50,16 @@ public final class BroadcastConsumer: Sendable {
 
 }
 
-/// Write side of a broadcast: open tracks and publish frames. Its `Publication`,
+/// Write side of a broadcast: open tracks and publish frames. Its `Route`,
 /// if any, announces it.
 ///
 /// Constructing one directly creates a standalone broadcast for local pub/sub.
-/// To publish at a path, use `OriginProducer.createBroadcast(path:)` instead.
+/// To publish at a path, use `OriginProducer.route(path:)` instead.
 public final class BroadcastProducer: Sendable {
     let ffi: MoqBroadcastProducer
 
     /// Create a standalone broadcast for local pub/sub. To publish at a path,
-    /// use `OriginProducer.createBroadcast(path:)`.
+    /// use `OriginProducer.route(path:)`.
     public init() throws {
         ffi = try MoqBroadcastProducer()
     }
diff --git a/swift/Sources/Moq/Origin.swift b/swift/Sources/Moq/Origin.swift
index 26f0e6f5af9..86f5f77e46f 100644
--- a/swift/Sources/Moq/Origin.swift
+++ b/swift/Sources/Moq/Origin.swift
@@ -1,7 +1,7 @@
 import MoqFFI
 
-/// The publish side of an origin: create broadcasts, serve them on demand,
-/// and announce them so subscribers can discover them.
+/// The publish side of an origin: create routes that own broadcasts or serve
+/// them on demand, so subscribers can discover them.
 public final class OriginProducer: Sendable {
     let ffi: MoqOriginProducer
 
@@ -20,28 +20,40 @@ public final class OriginProducer: Sendable {
         OriginConsumer(ffi.consume())
     }
 
-    /// Advertise `prefix` and serve the requests beneath it.
+    /// Create a route at exactly `path`, owning a new broadcast to fill.
+    ///
+    /// Visible at once unless `hidden`: a hidden route is invisible and unroutable, for this
+    /// origin's consumers and peers alike, until `Route.announce()`, so create it hidden to
+    /// fill the catalog first. It serves a fresh instance, kept across `withdraw` and
+    /// `announce`, unless `instance` names one, with `epoch` ordering its runs; `cost` prices
+    /// it, lower wins. Hold the route: releasing or cancelling it retracts it, and
+    /// `BroadcastProducer.close()` ends both.
+    public func route(
+        path: String, hidden: Bool = false, cost: UInt64 = 0, instance: String? = nil, epoch: UInt64 = 0
+    ) throws -> Route {
+        Route(
+            try ffi.route(
+                path: path,
+                options: MoqRouteOptions(hidden: hidden, cost: cost, instance: instance, epoch: epoch)))
+    }
+
+    /// Create a route over `prefix` that serves the requests beneath it.
     ///
     /// A route claims `prefix` and every path beneath it (`""` claims every path).
     /// A service that only serves some of them rejects the rest as they are
-    /// requested. Create, `requests` if tracks are served on demand, populate,
-    /// then `Publication.announce`.
-    public func requests(prefix: String) throws -> OriginRequests {
-        OriginRequests(try ffi.requests(prefix: prefix))
-    }
-
-    /// Create a broadcast at `path`, returning its publication.
-    ///
-    /// The broadcast is invisible and unroutable, for this origin's consumers
-    /// and peers alike, until `Publication.announce(route:)`. Announce it after
-    /// populating `Publication.broadcast`. `BroadcastProducer.close()` ends it for
-    /// good; releasing its last handle, the publication included, does the same.
-    public func createBroadcast(path: String) throws -> Publication {
-        Publication(try ffi.createBroadcast(path: path))
+    /// requested. Iterate the route, or call `requested()`, to answer each request; hold
+    /// it while it should stay advertised.
+    public func routePrefix(
+        prefix: String, hidden: Bool = false, cost: UInt64 = 0, instance: String? = nil, epoch: UInt64 = 0
+    ) throws -> Route {
+        Route(
+            try ffi.routePrefix(
+                prefix: prefix,
+                options: MoqRouteOptions(hidden: hidden, cost: cost, instance: instance, epoch: epoch)))
     }
 }
 
-/// A requested broadcast that has not been accepted yet.
+/// A requested broadcast that has not been answered yet.
 public final class BroadcastRequest: Sendable {
     let ffi: MoqBroadcastRequest
 
@@ -54,9 +66,16 @@ public final class BroadcastRequest: Sendable {
         get throws { try ffi.path() }
     }
 
-    /// Start answering as a new stream under a fresh instance, hidden until published.
-    public func prepare() throws -> BroadcastPrepared {
-        BroadcastPrepared(try ffi.prepare())
+    /// Answer with the path's own exact route, owning a new broadcast.
+    ///
+    /// It serves a fresh instance unless `instance` names one. Created visible, it announces
+    /// now and answers the waiting requesters; created `hidden`, they wait until
+    /// `Route.announce()`, so the job can fill its catalog first.
+    public func route(
+        hidden: Bool = false, cost: UInt64 = 0, instance: String? = nil, epoch: UInt64 = 0
+    ) throws -> Route {
+        Route(
+            try ffi.route(options: MoqRouteOptions(hidden: hidden, cost: cost, instance: instance, epoch: epoch)))
     }
 
     /// Serve held content under the prefix route's continuous sequence space, without an exact route.
@@ -70,75 +89,68 @@ public final class BroadcastRequest: Sendable {
     }
 }
 
-/// A claim answer being filled before its exact route is announced.
-public final class BroadcastPrepared: Sendable {
-    let ffi: MoqBroadcastPrepared
+/// A route on an origin: an exact route owning one broadcast, or a prefix route yielding
+/// the requests beneath it. Iterate a prefix route directly:
+/// `for try await request in route { ... }`; cancelling the consuming task cancels the route.
+///
+/// Releasing or cancelling it retracts the route, as does closing an exact route's
+/// broadcast; a `BroadcastProducer` alone does not keep it announced.
+public final class Route: AsyncSequence, Sendable {
+    /// The broadcast request emitted by this sequence.
+    public typealias Element = BroadcastRequest
 
-    /// The unannounced broadcast to fill before publishing; only `publish` announces it.
-    public let broadcast: BroadcastProducer
+    let ffi: MoqRoute
+    private let owned: BroadcastProducer?
 
-    init(_ ffi: MoqBroadcastPrepared) {
+    init(_ ffi: MoqRoute) {
         self.ffi = ffi
-        broadcast = BroadcastProducer(ffi.broadcast())
+        // A prefix route owns no broadcast.
+        owned = (try? ffi.broadcast()).map { BroadcastProducer($0) }
     }
 
-    /// Announce the filled broadcast and resolve every waiting requester.
-    public func publish() throws -> Publication {
-        Publication(try ffi.publish(), broadcast: broadcast)
+    /// The broadcast this exact route owns, the same one on every read. Throws on a prefix
+    /// route, which owns none.
+    public var broadcast: BroadcastProducer {
+        get throws {
+            if let owned { return owned }
+            return BroadcastProducer(try ffi.broadcast())
+        }
     }
-}
-
-/// A broadcast's announcement on an origin; releasing it keeps the route, closing the broadcast ends it.
-public final class Publication: Sendable {
-    let ffi: MoqPublication
 
-    /// The broadcast to fill, without announcement control.
-    public let broadcast: BroadcastProducer
+    /// The stream this route serves, minted at creation unless `instance` named one.
+    public var instance: String { ffi.instanceId() }
 
-    init(_ ffi: MoqPublication, broadcast: BroadcastProducer? = nil) {
-        self.ffi = ffi
-        self.broadcast = broadcast ?? BroadcastProducer(ffi.broadcast())
+    /// Make the route visible, or keep it so; throws `Closed` once its broadcast closed.
+    public func announce() throws {
+        try ffi.announce()
     }
 
-    /// Advertise the broadcast's exact path as a route, or re-price it; throws `Closed` once the broadcast closed.
-    public func announce(route: AnnounceRoute = AnnounceRoute()) throws {
-        try ffi.announce(route: route)
+    /// Hide the route, keeping its broadcast and instance: `announce()` brings the same stream back.
+    public func withdraw() throws {
+        try ffi.withdraw()
     }
 
-    /// Retract the advertisement, if any, keeping the tracks alive; throws `Closed` once the broadcast closed.
-    public func unannounce() throws {
-        try ffi.unannounce()
-    }
-}
-
-/// A stream of broadcasts requested by consumers. Iterate directly:
-/// `for try await request in requests { ... }`. Hold this while missing
-/// broadcasts should be served; cancelling the consuming task stops serving.
-public final class OriginRequests: AsyncSequence, Sendable {
-    /// The broadcast request emitted by this sequence.
-    public typealias Element = BroadcastRequest
-
-    let ffi: MoqOriginRequests
-
-    init(_ ffi: MoqOriginRequests) {
-        self.ffi = ffi
+    /// Re-price the route in place: lower wins among routes covering the same prefix.
+    public func setCost(_ cost: UInt64) throws {
+        try ffi.setCost(cost: cost)
     }
 
-    /// The next requested broadcast. Throws `Closed` once the origin closes.
-    public func requestedBroadcast() async throws -> BroadcastRequest {
-        BroadcastRequest(try await ffi.requestedBroadcast())
+    /// The next broadcast requested beneath this prefix route, or `nil` once the origin
+    /// closes, and at once on an exact route.
+    public func requested() async throws -> BroadcastRequest? {
+        try await ffi.requested().map { BroadcastRequest($0) }
     }
 
-    /// Cancel all current and future `requestedBroadcast()` calls and retract
-    /// the route.
+    /// Retract the route now: pending requests are rejected and later calls throw
+    /// `Cancelled`. An exact route's broadcast lives on until closed.
     public func cancel() {
         ffi.cancel()
     }
 
-    /// Create an iterator that cancels native waits when iteration ends.
+    /// Create an iterator that cancels the route when iteration is cancelled.
     public func makeAsyncIterator() -> AsyncThrowingStream<BroadcastRequest, Swift.Error>.Iterator {
         moqStream(cancel: { [ffi] in ffi.cancel() }) { [ffi] in
-            BroadcastRequest(try await ffi.requestedBroadcast())
+            try await ffi.requested().map { BroadcastRequest($0) }
         }.makeAsyncIterator()
     }
 }
diff --git a/swift/Tests/MoqTests/FfiBench.swift b/swift/Tests/MoqTests/FfiBench.swift
index 205c02660a4..09e86dfd7ad 100644
--- a/swift/Tests/MoqTests/FfiBench.swift
+++ b/swift/Tests/MoqTests/FfiBench.swift
@@ -71,7 +71,9 @@ final class FfiBench: XCTestCase {
     private func throughput(_ c: Case, _ budget: Double) async throws -> [Result] {
         let origin = OriginProducer(cacheCapacityBytes: 64 << 20)
         defer { withExtendedLifetime(origin) {} }
-        let broadcast = try origin.createBroadcast(path: "bench").broadcast
+        let route = try origin.route(path: "bench", hidden: true)
+        defer { withExtendedLifetime(route) {} }
+        let broadcast = try route.broadcast
         let tracks = try (0..<c.publishers).map {
             try broadcast.publishTrack(name: "\($0)", info: TrackInfo(timescale: 1_000_000))
         }
diff --git a/swift/Tests/MoqTests/SmokeTests.swift b/swift/Tests/MoqTests/SmokeTests.swift
index fbf8e2301e0..82a5b7f49e4 100644
--- a/swift/Tests/MoqTests/SmokeTests.swift
+++ b/swift/Tests/MoqTests/SmokeTests.swift
@@ -237,80 +237,94 @@ final class SmokeTests: XCTestCase {
     func testOriginProducerIsConstructible() throws {
         let origin = OriginProducer(cacheCapacityBytes: 4096)
         _ = origin.consume()
-        _ = try origin.requests(prefix: "")
+        let prefix = try origin.routePrefix(prefix: "")
+        XCTAssertThrowsError(try prefix.broadcast, "a prefix route owns no broadcast")
+        prefix.cancel()
     }
 
     func testBroadcastIsReachableOnlyWhileAnnounced() async throws {
         let origin = OriginProducer()
-        let publication = try origin.createBroadcast(path: "live")
-        _ = try publication.broadcast.publishTrack(name: "events")
+        let route = try origin.route(path: "live", hidden: true)
+        _ = try route.broadcast.publishTrack(name: "events")
         let consumer = origin.consume()
         do {
             _ = try await consumer.request(path: "live")
-            XCTFail("an unannounced broadcast must be unroutable")
+            XCTFail("a hidden route must be unroutable")
         } catch {}
 
-        try publication.announce()
+        try route.announce()
         let announced = try consumer.announced(prefix: "")
         guard case .present(let first) = try await nextRoute(announced) else {
             return XCTFail("expected an announcement")
         }
         XCTAssertEqual(first.prefix, "live")
+        XCTAssertEqual(first.route.instance, route.instance)
 
-        try publication.unannounce()
+        try route.withdraw()
         guard case .absent(let retracted) = try await nextRoute(announced) else {
             return XCTFail("expected a retraction")
         }
         XCTAssertEqual(retracted.prefix, "live")
         do {
             _ = try await consumer.request(path: "live")
-            XCTFail("an unannounced broadcast must be unroutable")
+            XCTFail("a withdrawn route must be unroutable")
         } catch {}
 
-        try publication.announce()
-        guard case .present = try await nextRoute(announced) else {
+        // Announcing again continues the same stream.
+        try route.announce()
+        guard case .present(let again) = try await nextRoute(announced) else {
             return XCTFail("expected a reannouncement")
         }
+        XCTAssertEqual(again.route.instance, route.instance)
         _ = try await consumer.request(path: "live")
+        route.cancel()
     }
 
-    /// Releasing a publication keeps its route; closing the broadcast ends it.
-    func testReleasingAPublicationKeepsItsRoute() async throws {
+    /// Cancelling a route retracts it while its broadcast lives on; closing the broadcast
+    /// ends the route too.
+    func testCancellingARouteRetractsIt() async throws {
         let origin = OriginProducer()
         let consumer = origin.consume()
-        var publication: Publication? = try origin.createBroadcast(path: "live")
-        let broadcast = try XCTUnwrap(publication?.broadcast)
-        XCTAssertTrue(broadcast === publication?.broadcast)
-        try publication?.announce()
-        publication = nil
+        let route = try origin.route(path: "live")
+        let broadcast = try route.broadcast
+        XCTAssertTrue(broadcast === (try route.broadcast))
         _ = try await consumer.request(path: "live")
 
-        try broadcast.close()
+        route.cancel()
         do {
             _ = try await consumer.request(path: "live")
-            XCTFail("a closed broadcast must be unroutable")
+            XCTFail("a cancelled route must be unroutable")
         } catch {}
+        _ = try broadcast.publishTrack(name: "events")
+        try broadcast.close()
+
+        let ended = try origin.route(path: "ended")
+        try ended.broadcast.close()
+        XCTAssertThrowsError(try ended.announce()) { error in
+            guard case MoqError.Closed = error else {
+                return XCTFail("expected Closed, got \(error)")
+            }
+        }
     }
 
-    /// A publication outliving its closed broadcast cannot touch the one replacing it.
-    func testStalePublicationLeavesItsReplacementAlone() async throws {
+    /// A route outliving its closed broadcast cannot touch the one replacing it.
+    func testStaleRouteLeavesItsReplacementAlone() async throws {
         let origin = OriginProducer()
-        let stale = try origin.createBroadcast(path: "live")
-        try stale.announce()
+        let stale = try origin.route(path: "live")
         try stale.broadcast.close()
 
-        let replacement = try origin.createBroadcast(path: "live")
-        try replacement.announce()
+        let replacement = try origin.route(path: "live")
         XCTAssertThrowsError(try stale.announce()) { error in
             guard case MoqError.Closed = error else {
                 return XCTFail("expected Closed, got \(error)")
             }
         }
-        XCTAssertThrowsError(try stale.unannounce()) { error in
+        XCTAssertThrowsError(try stale.setCost(1)) { error in
             guard case MoqError.Closed = error else {
                 return XCTFail("expected Closed, got \(error)")
             }
         }
+        try stale.withdraw()
         _ = try await origin.consume().request(path: "live")
         try replacement.broadcast.close()
     }
@@ -318,14 +332,14 @@ final class SmokeTests: XCTestCase {
     func testAnnouncedPatternCaptures() async throws {
         let origin = OriginProducer()
         let announced = try origin.consume().announced(prefix: "room", filter: "*/chat")
-        let chat = try origin.createBroadcast(path: "room/alice/chat")
-        try chat.announce()
+        let chat = try origin.route(path: "room/alice/chat")
 
         guard case .present(let update) = try await nextRoute(announced) else {
             return XCTFail("expected an announcement")
         }
         XCTAssertEqual(update.prefix, "room/alice/chat")
         XCTAssertEqual(update.captures, ["alice"])
+        chat.cancel()
     }
 
     func testNewInstanceRestartsFollowersButStaysListed() async throws {
@@ -333,67 +347,73 @@ final class SmokeTests: XCTestCase {
         let consumer = origin.consume()
         let announced = try consumer.announced(prefix: "")
         let following = try consumer.follow(path: "instance")
-        let publication = try origin.createBroadcast(path: "instance")
-
-        try publication.announce(route: AnnounceRoute())
+        let first = try origin.route(path: "instance")
         guard case .present(let present) = try await nextRoute(announced) else {
             return XCTFail("expected an announcement")
         }
         XCTAssertFalse(present.route.instance.isEmpty)
-        let first = try await following.available()
-        XCTAssertNotNil(first)
+        XCTAssertEqual(present.route.instance, first.instance)
+        let firstBroadcast = try await following.available()
+        XCTAssertNotNil(firstBroadcast)
 
-        try publication.announce(route: AnnounceRoute(instance: "camera", epoch: 1))
+        let second = try origin.route(path: "instance", instance: "camera", epoch: 1)
         let takeover = try await following.available()
         XCTAssertNotNil(takeover)
 
         // The takeover was not listed, so the next event is the path going absent.
-        try publication.unannounce()
+        try first.withdraw()
+        try second.withdraw()
         guard case .absent(let absent) = try await nextRoute(announced) else {
             return XCTFail("expected the path to go absent")
         }
         XCTAssertEqual(absent.route.instance, "camera")
 
-        XCTAssertThrowsError(try publication.announce(route: AnnounceRoute(instance: ""))) { error in
+        XCTAssertThrowsError(try origin.route(path: "refused", instance: "")) { error in
             guard case MoqError.InvalidInstance = error else {
                 return XCTFail("expected InvalidInstance, got \(error)")
             }
         }
+        first.cancel()
+        second.cancel()
         following.cancel()
     }
 
     func testFollowerReportsOfflineAndTheNextBroadcast() async throws {
         let origin = OriginProducer()
         let following = try origin.consume().follow(path: "offline")
-        let publication = try origin.createBroadcast(path: "offline")
+        let route = try origin.route(path: "offline")
 
-        try publication.announce(route: AnnounceRoute())
         let first = try await following.available()
         XCTAssertNotNil(first)
 
-        try publication.unannounce()
+        try route.withdraw()
         let offline = try await following.available()
         XCTAssertNil(offline)
 
-        try publication.announce(route: AnnounceRoute())
+        try route.announce()
         let returned = try await following.available()
         XCTAssertNotNil(returned)
+        route.cancel()
         following.cancel()
     }
 
     func testDynamicServesARequestUnderAPrefix() async throws {
         let origin = OriginProducer()
-        let dynamic = try origin.requests(prefix: "live")
+        let dynamic = try origin.routePrefix(prefix: "live")
         let pending = Task {
             try await origin.consume().request(path: "live/cam")
         }
-        let request = try await dynamic.requestedBroadcast()
+        let requested = try await dynamic.requested()
+        let request = try XCTUnwrap(requested)
         XCTAssertEqual(try request.path, "live/cam")
-        let prepared = try request.prepare()
-        let served = try prepared.publish()
-        XCTAssertTrue(served.broadcast === prepared.broadcast)
+        let served = try request.route(hidden: true)
+        XCTAssertNotEqual(served.instance, dynamic.instance)
+        let broadcast = try served.broadcast
+        XCTAssertTrue(broadcast === (try served.broadcast))
+        // Only announcing answers the requester.
+        try served.announce()
         _ = try await pending.value
-        try served.broadcast.close()
+        try broadcast.close()
         dynamic.cancel()
     }
 
@@ -778,15 +798,16 @@ final class SmokeTests: XCTestCase {
     /// as frames are read.
     func testAudioConsumerReportsItsPlayoutDelay() async throws {
         let origin = OriginProducer()
-        let publication = try origin.createBroadcast(path: "audio-delay")
-        let broadcast = publication.broadcast
+        let route = try origin.route(path: "audio-delay", hidden: true)
+        defer { route.cancel() }
+        let broadcast = try route.broadcast
         let audio = try Audio.Producer(
             catalog: Media.CatalogProducer(broadcast: broadcast),
             input: AudioEncoderInput(format: .f32, sampleRate: 48_000, channels: 1),
             output: AudioEncoderOutput(codec: AudioCodec.opus(), ),
             track: "mic"
         )
-        try publication.announce()
+        try route.announce()
 
         let consumer = try await origin.consume().request(path: "audio-delay")
         let catalogs = try await Media.CatalogConsumer.subscribe(broadcast: consumer)
@@ -828,8 +849,9 @@ final class SmokeTests: XCTestCase {
     /// demand and stays readable after its consumer is cancelled.
     func testDecodeVideoFrame() async throws {
         let origin = OriginProducer()
-        let publication = try origin.createBroadcast(path: "video-decode-frame")
-        let broadcast = publication.broadcast
+        let route = try origin.route(path: "video-decode-frame", hidden: true)
+        defer { route.cancel() }
+        let broadcast = try route.broadcast
         let video = try Video.Producer(
             catalog: Media.CatalogProducer(broadcast: broadcast),
             input: VideoEncoderInput(
@@ -837,7 +859,7 @@ final class SmokeTests: XCTestCase {
             output: VideoEncoderOutput(codec: .h264, kind: .software),
             track: "camera"
         )
-        try publication.announce()
+        try route.announce()
 
         // Seed the track so a subscriber joining below lands on encoded media.
         let rgba = Data(repeating: 0x80, count: 320 * 240 * 4)
diff --git a/test/audio-quality/clients/js/src/capture.test.ts b/test/audio-quality/clients/js/src/capture.test.ts
index 4a3e9901f64..85671d88bdf 100644
--- a/test/audio-quality/clients/js/src/capture.test.ts
+++ b/test/audio-quality/clients/js/src/capture.test.ts
@@ -74,10 +74,10 @@ test("arrival capture refuses an unsupported container", () => {
 
 test("the observer shares playback demand and closes without ending playback", async () => {
 	const origin = new Origin.Producer();
-	const publishedPublication = origin.createBroadcast(Path.from("tone.hang"));
-	const published = publishedPublication.broadcast;
+	const publishedRoute = origin.route(Path.from("tone.hang"), { hidden: true });
+	const published = publishedRoute.broadcast;
 	const track = published.createTrack("audio", { timescale: Time.Timescale.MILLI });
-	publishedPublication.announce();
+	publishedRoute.announce();
 	const source = new Broadcast({ origin, name: Path.from("tone.hang"), follow: false, catalogFormat: "manual" });
 	const capture = new Capture({
 		broadcast: new Signal(source),
@@ -117,10 +117,10 @@ test("at auto the observer asks for the decoder's 2 s budget, not the target", a
 	// A capture cut to the target would drop the frames later than it, which are what the target
 	// is measured from, so a trace recorded that way can never show the player falling short.
 	const origin = new Origin.Producer();
-	const publishedPublication = origin.createBroadcast(Path.from("tone.hang"));
-	const published = publishedPublication.broadcast;
+	const publishedRoute = origin.route(Path.from("tone.hang"), { hidden: true });
+	const published = publishedRoute.broadcast;
 	const track = published.createTrack("audio", { timescale: Time.Timescale.MILLI });
-	publishedPublication.announce();
+	publishedRoute.announce();
 	const source = new Broadcast({ origin, name: Path.from("tone.hang"), follow: false, catalogFormat: "manual" });
 	const capture = new Capture({
 		broadcast: new Signal(source),
@@ -147,10 +147,10 @@ test("at auto the observer asks for the decoder's 2 s budget, not the target", a
 /** Capture a legacy track, then end its first group with `end` once that group's reader is in flight. */
 async function captureGroupEnd(end: (group: Group.Producer) => void): Promise<string | undefined> {
 	const origin = new Origin.Producer();
-	const publishedPublication = origin.createBroadcast(Path.from("tone.hang"));
-	const published = publishedPublication.broadcast;
+	const publishedRoute = origin.route(Path.from("tone.hang"), { hidden: true });
+	const published = publishedRoute.broadcast;
 	const track = published.createTrack("audio", { timescale: Time.Timescale.MILLI });
-	publishedPublication.announce();
+	publishedRoute.announce();
 	const source = new Broadcast({ origin, name: Path.from("tone.hang"), follow: false, catalogFormat: "manual" });
 	const capture = new Capture({
 		broadcast: new Signal(source),
diff --git a/test/drain/drain.ts b/test/drain/drain.ts
index 544eb680015..2e25ff88e6b 100644
--- a/test/drain/drain.ts
+++ b/test/drain/drain.ts
@@ -109,11 +109,11 @@ await new Promise<void>((resolve, reject) => {
 
 // ── publisher on B ────────────────────────────────────────────────────────────
 const published = new Moq.Origin.Producer();
-const broadcastPublication = published.createBroadcast(path);
-const broadcast = broadcastPublication.broadcast;
+const broadcastRoute = published.route(path, { hidden: true });
+const broadcast = broadcastRoute.broadcast;
 const track = broadcast.createTrack(trackName, { timescale: Moq.Time.Timescale.MILLI });
 // The instance the publication mints is what says B's route serves the same stream as A's.
-broadcastPublication.announce();
+broadcastRoute.announce();
 const publisher = new Moq.Connection({
 	url: new URL(`http://127.0.0.1:${bPort}/`),
 	publish: published.consume(),
diff --git a/test/drill/mutations/relay-withdraws-lost-publisher.patch b/test/drill/mutations/relay-withdraws-lost-publisher.patch
index 44ddcff22ac..4dbf9ee93d5 100644
--- a/test/drill/mutations/relay-withdraws-lost-publisher.patch
+++ b/test/drill/mutations/relay-withdraws-lost-publisher.patch
@@ -9,7 +9,7 @@
 diff --git a/rs/moq-net/src/lite/subscriber.rs b/rs/moq-net/src/lite/subscriber.rs
 --- a/rs/moq-net/src/lite/subscriber.rs
 +++ b/rs/moq-net/src/lite/subscriber.rs
-@@ -6602,7 +6602,7 @@
+@@ -7730,7 +7730,7 @@ impl Announced {
  		let in_place = predecessor == Some(&path);
  		// An error means the prefix is outside our origin's scope, so don't serve it.
  		let predecessor = predecessor.and_then(|previous| match self.routes.get(previous)? {
@@ -17,8 +17,8 @@ diff --git a/rs/moq-net/src/lite/subscriber.rs b/rs/moq-net/src/lite/subscriber.
 +			Held::Attached(attached) => Some(&*attached.dynamic),
  			_ => None,
  		});
- 		match subscriber.origin.requests_route(&path, route.clone(), predecessor) {
-@@ -6680,7 +6680,7 @@
+ 		match subscriber.origin.forward(&path, route.clone(), predecessor) {
+@@ -7819,7 +7819,7 @@ impl Announced {
  		};
  		self.held.pop();
  		if let Held::Attached(entry) = held {
@@ -27,17 +27,17 @@ diff --git a/rs/moq-net/src/lite/subscriber.rs b/rs/moq-net/src/lite/subscriber.
  		}
  	}
  
-@@ -6781,7 +6781,8 @@
+@@ -7921,7 +7921,8 @@ struct AnnouncedRoute {
  	/// without recomputing the chain.
- 	route: crate::origin::Route,
+ 	route: crate::origin::RouteInfo,
  	/// Dropping it retracts the route and rejects its queued requests.
--	dynamic: crate::origin::Requests,
+-	dynamic: crate::origin::Route,
 +	// MUTATION: never dropped, so a route outlives the session that announced it.
-+	dynamic: std::mem::ManuallyDrop<crate::origin::Requests>,
++	dynamic: std::mem::ManuallyDrop<crate::origin::Route>,
  	/// Closes as the route goes, which closes every source it minted.
  	live: kio::Producer<()>,
  	/// Whether the GOAWAY drain already re-priced this route.
-@@ -6801,7 +6802,7 @@
+@@ -7941,7 +7942,7 @@ impl AnnouncedRoute {
  	) -> Self {
  		Self {
  			route,
diff --git a/test/interop/clients/cpp/main.cpp b/test/interop/clients/cpp/main.cpp
index 2b0b00ed70f..9cf7c4d19ef 100644
--- a/test/interop/clients/cpp/main.cpp
+++ b/test/interop/clients/cpp/main.cpp
@@ -194,9 +194,12 @@ int publish(
     const auto forever = Clock::now() + std::chrono::hours(24);
     auto session = connect(url, dial, forever);
 
-    // Hold the producer for the lifetime of the publish loop; close() unpublishes.
-    auto publication = ok(session->publish()->create_broadcast(path), "create_broadcast");
-    auto broadcast = publication->broadcast();
+    // Hold the route for the lifetime of the publish loop: it keeps the broadcast announced, and
+    // close() unpublishes. Hidden until the catalog is filled.
+    moq::RouteOptions hidden;
+    hidden.hidden = true;
+    auto route = ok(session->publish()->route(path, hidden), "route");
+    auto broadcast = ok(route->broadcast(), "route broadcast");
     auto catalog = ok(moq::MediaCatalogProducer::init(broadcast), "catalog producer");
     auto media = ok(
         moq::MediaTrackStreamProducer::video(broadcast, moq::MediaTarget::kNamed{}, {moq::VideoFormat::kAvc3, {}}),
@@ -214,7 +217,7 @@ int publish(
         ),
         "audio producer"
     );
-    ok(publication->announce({}), "announce");
+    ok(route->announce(), "announce");
     std::printf(
         "publishing \"%s\" (Annex-B H.264 from stdin + a %zu-channel tone) to %s\n", path.c_str(), tones.size(),
         url.c_str()
@@ -257,13 +260,13 @@ int publish(
         ok(broadcast->close(), "broadcast close");
         std::puts("finish ended");
         std::fflush(stdout);
-        auto health_publication = ok(session->publish()->create_broadcast(path + ".health"), "health broadcast");
-        auto health = health_publication->broadcast();
+        auto health_route = ok(session->publish()->route(path + ".health", hidden), "health route");
+        auto health = ok(health_route->broadcast(), "health broadcast");
         auto track = ok(health->publish_track("live", std::nullopt), "health track");
         const std::string payload = "session-alive";
         ok(track->write_frame({std::vector<uint8_t>(payload.begin(), payload.end()), std::nullopt}), "health write");
         ok(track->finish(), "health finish");
-        ok(health_publication->announce({}), "health announce");
+        ok(health_route->announce(), "health announce");
         // Only teardown waits on the FIFO; linger has already completed on its own clock.
         std::ifstream ack(finish_ack);
         std::string line;
diff --git a/test/interop/clients/go/main.go b/test/interop/clients/go/main.go
index e0df3ca7f2e..f559a96f2c2 100644
--- a/test/interop/clients/go/main.go
+++ b/test/interop/clients/go/main.go
@@ -143,12 +143,17 @@ func publish(ctx context.Context, url, broadcast string, opts dialOptions, timeo
 	}
 	defer client.Close()
 
-	// Hold the producer for the lifetime of the publish loop; Close unpublishes.
-	publication, err := client.CreateBroadcast(broadcast)
+	// Hold the route for the lifetime of the publish loop, hidden until the
+	// catalog is filled; Close on its broadcast unpublishes.
+	route, err := client.Route(broadcast, moq.RouteOptions{Hidden: true})
+	if err != nil {
+		return err
+	}
+	defer route.Cancel()
+	producer, err := route.Broadcast()
 	if err != nil {
 		return err
 	}
-	producer := publication.Broadcast()
 	defer producer.Close()
 
 	catalog, err := moqmedia.NewCatalogProducer(producer)
@@ -175,7 +180,7 @@ func publish(ctx context.Context, url, broadcast string, opts dialOptions, timeo
 	if err != nil {
 		return err
 	}
-	if err := publication.Announce(moq.AnnounceRoute{}); err != nil {
+	if err := route.Announce(); err != nil {
 		return err
 	}
 	fmt.Printf("publishing %q (Annex-B H.264 from stdin + a %v Hz tone) to %s\n", broadcast, tones, url)
@@ -236,11 +241,15 @@ func publish(ctx context.Context, url, broadcast string, opts dialOptions, timeo
 	if err := producer.Close(); err != nil {
 		return err
 	}
-	healthPublication, err := client.CreateBroadcast(broadcast + ".health")
+	healthRoute, err := client.Route(broadcast+".health", moq.RouteOptions{Hidden: true})
+	if err != nil {
+		return err
+	}
+	defer healthRoute.Cancel()
+	health, err := healthRoute.Broadcast()
 	if err != nil {
 		return err
 	}
-	health := healthPublication.Broadcast()
 	defer health.Close()
 	live, err := health.PublishTrack("live", nil)
 	if err != nil {
@@ -252,7 +261,7 @@ func publish(ctx context.Context, url, broadcast string, opts dialOptions, timeo
 	if err := live.Finish(); err != nil {
 		return err
 	}
-	if err := healthPublication.Announce(moq.AnnounceRoute{}); err != nil {
+	if err := healthRoute.Announce(); err != nil {
 		return err
 	}
 	ack, err := os.Open(finishAck)
diff --git a/test/interop/clients/js-native/claims.ts b/test/interop/clients/js-native/claims.ts
index ea1af63f5b5..0e6fe045ff7 100644
--- a/test/interop/clients/js-native/claims.ts
+++ b/test/interop/clients/js-native/claims.ts
@@ -20,7 +20,7 @@ function endpoint(address: string): URL {
 
 const published = new Moq.Origin.Producer();
 const received = new Moq.Origin.Producer();
-const claim = published.requests(Moq.Path.from(prefix));
+const claim = published.routePrefix(Moq.Path.from(prefix));
 const broadcasts = new Map<Moq.Path.Valid, Moq.Broadcast.Producer>();
 const serving = (async () => {
 	for await (const request of claim.requested()) {
diff --git a/test/interop/clients/js-native/hls.ts b/test/interop/clients/js-native/hls.ts
index e34bc8db351..b223ccb8595 100644
--- a/test/interop/clients/js-native/hls.ts
+++ b/test/interop/clients/js-native/hls.ts
@@ -49,7 +49,7 @@ const connection = await Moq.Connection.connect({
 	publish: origin.consume(),
 });
 try {
-	const publication = origin.createBroadcast(Moq.Path.from(path));
+	const publication = origin.route(Moq.Path.from(path), { hidden: true });
 	const broadcast = publication.broadcast;
 	const renditions: { video: Record<string, Catalog.VideoConfig>; audio: Record<string, Catalog.AudioConfig> } = {
 		video: {},
diff --git a/test/interop/clients/js-native/replace.ts b/test/interop/clients/js-native/replace.ts
index f354b7791ad..f29c751d464 100644
--- a/test/interop/clients/js-native/replace.ts
+++ b/test/interop/clients/js-native/replace.ts
@@ -21,7 +21,7 @@ function endpoint(address: string): URL {
 
 const published = new Moq.Origin.Producer();
 const received = [new Moq.Origin.Producer(), new Moq.Origin.Producer(), new Moq.Origin.Producer()];
-const claim = published.requests(Moq.Path.from(prefix));
+const claim = published.routePrefix(Moq.Path.from(prefix));
 const broadcast = new Moq.Broadcast.Producer();
 const path = Moq.Path.from(`${prefix}/entity`);
 let track = broadcast.createTrack("value", { maxAge: null });
diff --git a/test/interop/clients/js-native/server.ts b/test/interop/clients/js-native/server.ts
index 8c9e78f822e..36b56e236b7 100644
--- a/test/interop/clients/js-native/server.ts
+++ b/test/interop/clients/js-native/server.ts
@@ -17,17 +17,17 @@ const version = (0xff000000 + Number(name.split("-").at(-1))) as Ietf.IetfVersio
 const alpns = [`moqt-${Number(version) - 0xff000000}`];
 const extensions = Extensions.offered();
 const origin = new Moq.Origin.Producer();
-const broadcastPublication = origin.createBroadcast(Moq.Path.from("handover"));
-const broadcast = broadcastPublication.broadcast;
+const broadcastRoute = origin.route(Moq.Path.from("handover"), { hidden: true });
+const broadcast = broadcastRoute.broadcast;
 const video = broadcast.createTrack("video");
-broadcastPublication.announce();
-const markerPublication = origin.createBroadcast(Moq.Path.from("replacement"));
-const marker = markerPublication.broadcast;
+broadcastRoute.announce();
+const markerRoute = origin.route(Moq.Path.from("replacement"), { hidden: true });
+const marker = markerRoute.broadcast;
 const ready = marker.createTrack("ready");
 const markerGroup = ready.appendGroup();
 markerGroup.writeFrame({ payload: new Uint8Array([42]) });
 markerGroup.finish();
-markerPublication.announce();
+markerRoute.announce();
 
 type Socket = {
 	protocol: string;
diff --git a/test/interop/clients/js-native/tail.ts b/test/interop/clients/js-native/tail.ts
index e0ecb8c92b6..0b40c72c2f3 100644
--- a/test/interop/clients/js-native/tail.ts
+++ b/test/interop/clients/js-native/tail.ts
@@ -117,8 +117,8 @@ const connection = await Moq.Connection.connect({
 });
 try {
 	if (role === "publish") {
-		const broadcastPublication = origin.createBroadcast(Moq.Path.from(path));
-		const broadcast = broadcastPublication.broadcast;
+		const broadcastRoute = origin.route(Moq.Path.from(path), { hidden: true });
+		const broadcast = broadcastRoute.broadcast;
 		// `cached` and `late` read groups a newer one supersedes, which the default zero max age
 		// would leave stale.
 		const track = broadcast.createTrack("tail", { compress, maxAge: null, ...(status ? { priority: 2 } : {}) });
@@ -129,7 +129,7 @@ try {
 			head = track.appendGroup();
 			for (const payload of frames(0).slice(0, LATE_HEAD)) head.writeFrame({ payload });
 		}
-		broadcastPublication.announce();
+		broadcastRoute.announce();
 		const lines = createInterface({ input: process.stdin });
 		const commands = lines[Symbol.asyncIterator]();
 		if (head) {
diff --git a/test/interop/clients/js/open-gop/main.ts b/test/interop/clients/js/open-gop/main.ts
index f463c677ffc..ac5a2f4e58d 100644
--- a/test/interop/clients/js/open-gop/main.ts
+++ b/test/interop/clients/js/open-gop/main.ts
@@ -60,11 +60,9 @@ window.runRecovery = async (packets) => {
 	};
 	const origin = new Moq.Origin.Producer();
 	const name = Moq.Path.from("open-gop");
-	const publication = origin.createBroadcast(name);
-	publication.announce();
-	const producer = publication.broadcast;
+	const route = origin.route(name);
 	// Every group is written before the decoder reads from the first, so none may go stale.
-	const track = producer.createTrack("video", { timescale: Moq.Time.Timescale.MICRO, maxAge: null });
+	const track = route.broadcast.createTrack("video", { timescale: Moq.Time.Timescale.MICRO, maxAge: null });
 	let group: Moq.Group.Producer | undefined;
 	for (const packet of packets) {
 		if (group?.sequence !== BigInt(packet.group)) {
diff --git a/test/interop/clients/js/src/finish.ts b/test/interop/clients/js/src/finish.ts
index 7343a022d95..e20e7d6f5b5 100644
--- a/test/interop/clients/js/src/finish.ts
+++ b/test/interop/clients/js/src/finish.ts
@@ -70,8 +70,8 @@ export function finish(
 			state.result = await readFinish(origin, path, frames, Milli(timeout));
 			return;
 		}
-		const broadcastPublication = origin.createBroadcast(Moq.Path.from(path));
-		const broadcast = broadcastPublication.broadcast;
+		const broadcastRoute = origin.route(Moq.Path.from(path), { hidden: true });
+		const broadcast = broadcastRoute.broadcast;
 		const config: Catalog.VideoConfig = {
 			codec: "avc1.42001e",
 			codedWidth: Catalog.u53(320),
@@ -133,21 +133,21 @@ export function finish(
 			serving,
 		);
 		serving.close();
-		broadcastPublication.announce();
+		broadcastRoute.announce();
 		// Keep the finished broadcast up for the late readers, then take it offline.
 		state.lingerUs = LINGER * 1000;
 		state.ready = true;
 		await sleep(Nano.fromMilli(LINGER));
 		broadcast.close();
-		const healthPublication = origin.createBroadcast(Moq.Path.from(`${path}.health`));
-		const health = healthPublication.broadcast;
+		const healthRoute = origin.route(Moq.Path.from(`${path}.health`), { hidden: true });
+		const health = healthRoute.broadcast;
 		const healthTrack = health.createTrack("live");
 		const group = healthTrack.appendGroup();
 		group.writeFrame({ payload: new TextEncoder().encode("session-alive") });
 		group.finish();
 		healthTrack.finish();
 		healthTrack.close();
-		healthPublication.announce();
+		healthRoute.announce();
 		state.ended = true;
 		await ack;
 		health.close();
diff --git a/test/interop/clients/python/interop.py b/test/interop/clients/python/interop.py
index 1f95dba8d76..ad534b21fa7 100644
--- a/test/interop/clients/python/interop.py
+++ b/test/interop/clients/python/interop.py
@@ -109,9 +109,9 @@ async def publish(
     async with _client(url, version) as client:
         if grant:
             await _print_grant(client, timeout)
-        # Hold the producer for the lifetime of the publish loop.
-        publication = client.create_broadcast(broadcast)
-        producer = publication.broadcast
+        # Hold the route for the lifetime of the publish loop: dropping it retracts the broadcast.
+        route = client.route(broadcast, hidden=True)
+        producer = route.broadcast
         catalog = moq.media.CatalogProducer(producer)
         media = moq.media.TrackStreamProducer.video(
             producer, moq.media.VideoInit(format=moq.media.VideoFormat.AVC3, data=b"")
@@ -125,7 +125,7 @@ async def publish(
             ),
             track=AUDIO_TRACK,
         )
-        publication.announce()
+        route.announce()
         print(f"publishing {broadcast!r} (Annex-B H.264 from stdin + a {tones} Hz tone) to {url}")
 
         tone = asyncio.create_task(_publish_tone(audio, tones))
@@ -155,7 +155,7 @@ async def publish(
             print(f"finish ready linger_us={LINGER // timedelta(microseconds=1)}", flush=True)
             await asyncio.sleep(LINGER.total_seconds())
             producer.close()
-            health = client.create_broadcast(f"{broadcast}.health")
+            health = client.route(f"{broadcast}.health", hidden=True)
             live = health.broadcast.publish_track("live")
             live.write_frame(b"session-alive")
             live.finish()
diff --git a/test/interop/clients/rust/catalog.rs b/test/interop/clients/rust/catalog.rs
index d98f2eeed48..8376ea7e687 100644
--- a/test/interop/clients/rust/catalog.rs
+++ b/test/interop/clients/rust/catalog.rs
@@ -32,13 +32,15 @@ async fn main() -> anyhow::Result<()> {
 	let client = config.init(Default::default())?.with_reconnect(false);
 	let origin = moq_tokio::origin::spawn();
 
-	let broadcast = origin.create_broadcast(&args[2])?;
-	let track = broadcast.create_track(hang::Catalog::DEFAULT_NAME, hang::Catalog::default_track_info())?;
+	let route = origin.route(&args[2], moq_net::origin::RouteOptions::hidden())?;
+	let track = route
+		.broadcast()
+		.create_track(hang::Catalog::DEFAULT_NAME, hang::Catalog::default_track_info())?;
 	ensure!(track.info().compress, "hang catalogs are compressed");
 	let mut catalog = moq_json::snapshot::Producer::<hang::Catalog>::new(track, Default::default());
 	let value = hang::Catalog::from_slice(CATALOG.as_bytes())?;
 	catalog.update(moq_net::Timed::from(&value).at(moq_net::Timestamp::ZERO))?;
-	broadcast.announce(Default::default())?;
+	route.announce()?;
 
 	// A local reader sees the inflated snapshot, as a plain peer of the relay does. The group
 	// stays open for deltas, and this catalog never writes one.
@@ -61,7 +63,7 @@ async fn main() -> anyhow::Result<()> {
 		"readers did not acknowledge the catalog"
 	);
 	catalog.finish()?;
-	broadcast.close();
+	route.broadcast().close();
 	session.close().await?;
 	eprintln!("catalog acknowledged");
 	Ok(())
diff --git a/test/interop/clients/rust/control.rs b/test/interop/clients/rust/control.rs
index c99b47cd7a9..a2ab1aa10a4 100644
--- a/test/interop/clients/rust/control.rs
+++ b/test/interop/clients/rust/control.rs
@@ -11,14 +11,16 @@ async fn main() -> anyhow::Result<()> {
 	);
 	let version: moq_net::Version = args[2].parse().map_err(anyhow::Error::msg)?;
 	let origin = moq_tokio::origin::spawn();
-	let broadcast = origin.create_broadcast("control")?;
-	let track = broadcast.create_track("video", moq_net::track::Info::default().with_priority(2))?;
+	let route = origin.route("control", moq_net::origin::RouteOptions::hidden())?;
+	let track = route
+		.broadcast()
+		.create_track("video", moq_net::track::Info::default().with_priority(2))?;
 	let mut group = track.create_group(moq_net::group::Info { sequence: 4 })?;
 	for byte in [1, 2] {
 		group.write_frame(None, vec![byte])?;
 	}
 	group.finish()?;
-	broadcast.announce(Default::default())?;
+	route.announce()?;
 
 	let socket = moq_tokio::websocket::Listener::bind("127.0.0.1:0".parse()?).await?;
 	let url = format!("http://{}/", socket.local_addr()?);
diff --git a/test/interop/clients/rust/finish.rs b/test/interop/clients/rust/finish.rs
index 576fc541059..43a58afa242 100644
--- a/test/interop/clients/rust/finish.rs
+++ b/test/interop/clients/rust/finish.rs
@@ -77,11 +77,10 @@ async fn main() -> anyhow::Result<()> {
 		.await?;
 	let mut stdin = tokio::io::BufReader::new(tokio::io::stdin());
 	if args.role == "publish" {
-		let broadcast = origin.create_broadcast(&args.broadcast)?;
-		let mut catalog =
-			moq_mux::catalog::Producer::<()>::new(&mut broadcast.broadcast().clone(), Default::default())?;
+		let route = origin.route(&args.broadcast, moq_net::origin::RouteOptions::hidden())?;
+		let mut catalog = moq_mux::catalog::Producer::<()>::new(&mut route.broadcast().clone(), Default::default())?;
 		let mut media = moq_mux::import::TrackStream::video(
-			broadcast.reserve_track("video")?,
+			route.broadcast().reserve_track("video")?,
 			catalog.reserve(),
 			moq_mux::import::VideoInit::new(moq_mux::import::VideoFormat::Avc3, Vec::new()),
 		)?;
@@ -90,24 +89,29 @@ async fn main() -> anyhow::Result<()> {
 		media.decode(&data)?;
 		media.finish()?;
 		catalog.finish()?;
-		broadcast.announce(Default::default())?;
+		route.announce()?;
 		// Keep the finished broadcast up for the late readers, then take it offline.
-		let linger = moq_mux::Linger::new([broadcast.broadcast().clone()], (media, catalog), LINGER);
+		let linger = moq_mux::Linger::new([route.broadcast().clone()], (media, catalog, route), LINGER);
 		println!("finish ready linger_us={}", LINGER.as_micros());
 		linger.wait().await;
 		println!("finish ended");
-		let health = origin.create_broadcast(format!("{}.health", args.broadcast))?;
-		let mut track = health.create_track("live", moq_net::track::Info::default())?;
+		let health = origin.route(
+			format!("{}.health", args.broadcast),
+			moq_net::origin::RouteOptions::hidden(),
+		)?;
+		let mut track = health
+			.broadcast()
+			.create_track("live", moq_net::track::Info::default())?;
 		track.write_frame(None, b"session-alive".to_vec())?;
 		track.finish()?;
-		health.announce(Default::default())?;
+		health.announce()?;
 		let ack = args.finish_ack.context("publisher needs --finish-ack")?;
 		let mut complete = String::new();
 		tokio::io::BufReader::new(tokio::fs::File::open(ack).await?)
 			.read_line(&mut complete)
 			.await?;
 		ensure!(complete == "complete\n", "finish acknowledgement was not complete");
-		health.close();
+		health.broadcast().close();
 		println!("finish acknowledged");
 	} else {
 		ensure!(args.role == "subscribe" && args.finish, "expected finish subscriber");
diff --git a/test/interop/clients/rust/goaway.rs b/test/interop/clients/rust/goaway.rs
index 041c245c21e..b47fd39e609 100644
--- a/test/interop/clients/rust/goaway.rs
+++ b/test/interop/clients/rust/goaway.rs
@@ -32,9 +32,10 @@ async fn main() -> anyhow::Result<()> {
 	ensure!(args.len() == 3, "usage: interop-goaway VERSION node|bun");
 	let version: moq_net::Version = args[1].parse().map_err(anyhow::Error::msg)?;
 	let origin = moq_tokio::origin::spawn();
-	let broadcast = origin.create_broadcast("handover")?;
-	let mut track = broadcast.create_track("video", moq_net::track::Info::default())?;
-	broadcast.announce(moq_net::origin::Route::default())?;
+	let route = origin.route("handover", moq_net::origin::RouteOptions::default())?;
+	let mut track = route
+		.broadcast()
+		.create_track("video", moq_net::track::Info::default())?;
 	let (mut first, first_url) = endpoint(&origin, version).await?;
 	let (mut second, second_url) = endpoint(&origin, version).await?;
 	let script = concat!(
diff --git a/test/interop/clients/rust/hls.rs b/test/interop/clients/rust/hls.rs
index 96230a940ee..6812db78f46 100644
--- a/test/interop/clients/rust/hls.rs
+++ b/test/interop/clients/rust/hls.rs
@@ -74,8 +74,8 @@ async fn main() -> anyhow::Result<()> {
 	let origin = moq_tokio::origin::spawn();
 
 	if args[1] == "publish" {
-		let publication = origin.create_broadcast(path)?;
-		let mut broadcast = publication.broadcast().clone();
+		let route = origin.route(path, moq_net::origin::RouteOptions::hidden())?;
+		let mut broadcast = route.broadcast().clone();
 		let mut catalog = moq_mux::catalog::Producer::<()>::new(&mut broadcast, Default::default())?;
 		let track = broadcast.create_track("video", catalog.track_info(hang::catalog::PRIORITY.video))?;
 		let config = hang::catalog::VideoConfig::new(hang::catalog::VideoCodec::VP8);
@@ -94,7 +94,7 @@ async fn main() -> anyhow::Result<()> {
 			.connect(url)
 			.established()
 			.await?;
-		publication.announce(Default::default())?;
+		route.announce()?;
 		println!("hls ready");
 		let mut commands = tokio::io::BufReader::new(tokio::io::stdin()).lines();
 		ensure!(
diff --git a/test/interop/clients/rust/tail.rs b/test/interop/clients/rust/tail.rs
index b9f6aa2115d..d17f1e272e8 100644
--- a/test/interop/clients/rust/tail.rs
+++ b/test/interop/clients/rust/tail.rs
@@ -105,8 +105,8 @@ async fn main() -> anyhow::Result<()> {
 
 	match args[1].as_str() {
 		"publish" => {
-			let broadcast = origin.create_broadcast(&args[3])?;
-			let mut track = broadcast.create_track(
+			let route = origin.route(&args[3], moq_net::origin::RouteOptions::hidden())?;
+			let mut track = route.broadcast().create_track(
 				"tail",
 				moq_net::track::Info::default()
 					.with_timescale(moq_net::Timescale::MILLI)
@@ -115,7 +115,7 @@ async fn main() -> anyhow::Result<()> {
 					// zero max age would leave stale.
 					.with_max_age(None),
 			)?;
-			broadcast.announce(Default::default())?;
+			route.announce()?;
 			if cached {
 				write(&mut track, mode)?;
 			}
@@ -161,7 +161,7 @@ async fn main() -> anyhow::Result<()> {
 				commands.next_line().await?.as_deref() == Some("clean end"),
 				"reader did not acknowledge a clean end"
 			);
-			broadcast.close();
+			route.broadcast().close();
 			session.close().await?;
 			eprintln!("tail acknowledged");
 		}
diff --git a/test/interop/compat/client.ts b/test/interop/compat/client.ts
index 82fd9a594a6..c901d3123bd 100644
--- a/test/interop/compat/client.ts
+++ b/test/interop/compat/client.ts
@@ -307,8 +307,14 @@ if (command === "sign") {
 } else if (command === "publish") {
 	install();
 	const origin = new Moq.Origin.Producer();
-	const publication = origin.createBroadcast(Moq.Path.from(args[1]));
-	// Released packages return the fill producer directly; current ones return its publication.
+	const path = Moq.Path.from(args[1]);
+	// Released packages create with `createBroadcast`, which returns the fill producer directly or,
+	// later, its publication; current ones create a route that owns its broadcast.
+	type Released = { createBroadcast(path: Moq.Path.Valid): { announce(): void } };
+	const publication =
+		"route" in origin
+			? origin.route(path, { hidden: true })
+			: (origin as unknown as Released).createBroadcast(path);
 	const broadcast = ("broadcast" in publication ? publication.broadcast : publication) as Moq.Broadcast.Producer;
 	const track = broadcast.createTrack("data", { timescale: Moq.Time.Timescale.MICRO });
 	publication.announce();
diff --git a/test/interop/ietf-range-updates.ts b/test/interop/ietf-range-updates.ts
index 8815e6e0d05..0655d11e47c 100644
--- a/test/interop/ietf-range-updates.ts
+++ b/test/interop/ietf-range-updates.ts
@@ -16,7 +16,7 @@ const input: { draft: number; subscribe: number[]; updates: number[][] } = JSON.
 const version = (0xff000000 + input.draft) as IetfVersion;
 const pair = createMockTransportPair(`moqt-${input.draft}`);
 const origin = new OriginProducer();
-const publication = origin.createBroadcast(Path.from("room"));
+const publication = origin.route(Path.from("room"), { hidden: true });
 // The updates replay groups a newer one superseded, which the default zero max age would stale.
 const track = publication.broadcast.createTrack("video", { maxAge: null });
 publication.announce();
diff --git a/test/interop/sign.ts b/test/interop/sign.ts
index 5350943c000..9efa3a77e58 100644
--- a/test/interop/sign.ts
+++ b/test/interop/sign.ts
@@ -56,7 +56,7 @@ for (const { track, group, timescale, frames } of input.rust) {
 
 // Groups signed through the JS wrappers, tapped raw off the net broadcast.
 const inner = new Broadcast.Producer();
-const signed = new Signed.Producer(inner, key, path);
+const signed = new Signed.Producer(inner, key, { path, instance: Instance.random() });
 const producers = new Map<string, Track.Producer>();
 const taps = new Map<string, NetTrack.Subscriber>();
 const js: Group[] = [];
diff --git a/test/interop/track-status.ts b/test/interop/track-status.ts
index 32a8a8cb290..aa039738264 100644
--- a/test/interop/track-status.ts
+++ b/test/interop/track-status.ts
@@ -19,9 +19,8 @@ const version = (0xff000000 + input.draft) as IetfVersion;
 
 const pair = createMockTransportPair();
 const origin = new OriginProducer();
-const broadcastPublication = origin.createBroadcast(Path.from("room"));
-const broadcast = broadcastPublication.broadcast;
-broadcastPublication.announce();
+const broadcastRoute = origin.route(Path.from("room"));
+const broadcast = broadcastRoute.broadcast;
 const track = broadcast.createTrack("video", { timescale: Timescale.MILLI, maxAge: Milli(5000), priority: 2 });
 const group = track.createGroup(4n);
 group.writeFrame({ payload: new Uint8Array([1]), timestamp: Timestamp.fromMillis(0) });
diff --git a/test/interop/tracks.ts b/test/interop/tracks.ts
index a0ccec2deb6..da0776e06ca 100644
--- a/test/interop/tracks.ts
+++ b/test/interop/tracks.ts
@@ -23,9 +23,8 @@ const settle = () => new Promise((resolve) => setTimeout(resolve, 0));
 
 if (input.mode === "answer") {
 	const origin = new OriginProducer();
-	const broadcastPublication = origin.createBroadcast(Path.from("room"));
-	const broadcast = broadcastPublication.broadcast;
-	broadcastPublication.announce();
+	const broadcastRoute = origin.route(Path.from("room"));
+	const broadcast = broadcastRoute.broadcast;
 	broadcast.createTrack("a", { timescale: Timescale.MILLI, maxAge: Milli(3000), priority: 9, refresh: 4 });
 	broadcast.createTrack("b");
 
diff --git a/test/max-age/client.ts b/test/max-age/client.ts
index 25ec0c8fe40..be02aa65069 100644
--- a/test/max-age/client.ts
+++ b/test/max-age/client.ts
@@ -15,10 +15,10 @@ const origin = new Producer();
 // `null` is an explicit unlimited: an omitted max age is the zero authored default.
 const ages = [null, Milli(0), Milli(30_000)];
 if (mode === "publish") {
-	const broadcastPublication = origin.createBroadcast(Path.from("age"));
-	const broadcast = broadcastPublication.broadcast;
+	const broadcastRoute = origin.route(Path.from("age"), { hidden: true });
+	const broadcast = broadcastRoute.broadcast;
 	for (const [i, maxAge] of ages.entries()) broadcast.createTrack(String(i), { maxAge });
-	broadcastPublication.announce();
+	broadcastRoute.announce();
 }
 const url = new URL(address);
 const transport = new Session(url, {
diff --git a/test/p2p/src/main.ts b/test/p2p/src/main.ts
index 083fd0f65cd..6573c133491 100644
--- a/test/p2p/src/main.ts
+++ b/test/p2p/src/main.ts
@@ -50,9 +50,8 @@ window.checkTransport = async () => {
 	const publishing = new Moq.Origin.Producer();
 	const consuming = new Moq.Origin.Producer();
 	const path = Moq.Path.from("peer/data");
-	const broadcastPublication = publishing.createBroadcast(path);
-	const broadcast = broadcastPublication.broadcast;
-	broadcastPublication.announce();
+	const broadcastRoute = publishing.route(path);
+	const broadcast = broadcastRoute.broadcast;
 	const track = broadcast.createTrack("data", { timescale: Moq.Time.Timescale.MILLI });
 	let client: Awaited<ReturnType<typeof Moq.Connection.connect>> | undefined;
 	let server: Awaited<ReturnType<typeof Moq.Connection.accept>> | undefined;
diff --git a/test/receive-credit/sender.ts b/test/receive-credit/sender.ts
index 57bd392a66c..7e1427e9a76 100644
--- a/test/receive-credit/sender.ts
+++ b/test/receive-credit/sender.ts
@@ -36,13 +36,13 @@ const websocket = certificate === "websocket";
 if (!websocket) install();
 
 const origin = new Moq.Origin.Producer();
-const broadcastPublication = origin.createBroadcast(Moq.Path.from("room"));
-const broadcast = broadcastPublication.broadcast;
+const broadcastRoute = origin.route(Moq.Path.from("room"), { hidden: true });
+const broadcast = broadcastRoute.broadcast;
 // No publisher limit, so the open `low` group stays the receiver's to give up on rather than
 // going stale here once a newer group arrives.
 const low = broadcast.createTrack("low", { maxAge: null });
 const high = broadcast.createTrack("high", { maxAge: null });
-broadcastPublication.announce();
+broadcastRoute.announce();
 
 const session = await Moq.Connection.connect({
 	url: new URL(address),
diff --git a/test/relay-fill/relay.ts b/test/relay-fill/relay.ts
index 2d1c26b6d3a..a1b5123c682 100644
--- a/test/relay-fill/relay.ts
+++ b/test/relay-fill/relay.ts
@@ -38,7 +38,7 @@ const clock = new Manual();
 const installed = clock.install();
 // A session never announces a received broadcast to another, so the relay advertises it itself.
 const origin = new Producer();
-const route = origin.requests(path);
+const route = origin.routePrefix(path);
 
 async function dial(address: string, publish?: ReturnType<Producer["consume"]>) {
 	const url = new URL(address);
diff --git a/test/stream-limits/client.ts b/test/stream-limits/client.ts
index 75ee199991a..632ebdd33d4 100644
--- a/test/stream-limits/client.ts
+++ b/test/stream-limits/client.ts
@@ -16,7 +16,7 @@ const url = new URL(address);
 
 try {
 	if (mode === "publish") {
-		const publication = origin.createBroadcast(path);
+		const publication = origin.route(path, { hidden: true });
 		// One group per track, never finished, so every group the reader receives stays live.
 		for (let i = 0; i < count; i++) {
 			const group = publication.broadcast.createTrack(String(i)).appendGroup();
diff --git a/test/video/src/captions.ts b/test/video/src/captions.ts
index 0a46bf4fc7f..d365b2c8b4a 100644
--- a/test/video/src/captions.ts
+++ b/test/video/src/captions.ts
@@ -11,8 +11,8 @@ import { Source } from "../../../js/watch/src/text/source";
 /** Caption selection controls exercised by the browser harness. */
 export function captions() {
 	const origin = new Origin.Producer();
-	const producerPublication = origin.createBroadcast(Path.from("captions"));
-	const producer = producerPublication.broadcast;
+	const producerRoute = origin.route(Path.from("captions"), { hidden: true });
+	const producer = producerRoute.broadcast;
 	const textCatalog: NonNullable<Catalog.Root["text"]> = { renditions: {} };
 	const catalog: Catalog.Root = { text: textCatalog };
 	for (const [name, text] of [
@@ -25,7 +25,7 @@ export function captions() {
 		group.writeFrame({ payload: Legacy.encodeFrame(new TextEncoder().encode(text), Micro(1_000_000)) });
 		group.finish();
 	}
-	producerPublication.announce();
+	producerRoute.announce();
 	const broadcast = new Broadcast({ origin, name: Path.from("captions"), catalogFormat: "manual", catalog });
 	const target = new Signal<string | undefined>(undefined);
 	const source = new Source({ broadcast, target });
diff --git a/test/video/src/poster.ts b/test/video/src/poster.ts
index 370eb18a3ed..5a470095187 100644
--- a/test/video/src/poster.ts
+++ b/test/video/src/poster.ts
@@ -9,8 +9,8 @@ import { Player } from "@moq/watch";
 async function poster(audio: boolean, buffered: boolean) {
 	const origin = new Origin.Producer();
 	const name = Path.from("poster");
-	const producerPublication = origin.createBroadcast(name);
-	const producer = producerPublication.broadcast;
+	const producerRoute = origin.route(name, { hidden: true });
+	const producer = producerRoute.broadcast;
 	const track = producer.createTrack("video");
 	const group = track.appendGroup();
 	const audioTrack = audio ? producer.createTrack("audio") : undefined;
@@ -39,7 +39,7 @@ async function poster(audio: boolean, buffered: boolean) {
 			},
 		}),
 	};
-	producerPublication.announce();
+	producerRoute.announce();
 	const canvas = document.createElement("canvas");
 	document.body.append(canvas);
 	const enabled = new Signal(true);

From 89d59057819a403c0d78d8c3c4e3ede1991d82ba Mon Sep 17 00:00:00 2001
From: Luke Curley <kixelated@gmail.com>
Date: Thu, 5 Nov 2026 23:14:14 +0000
Subject: [PATCH 29/36] quest: unblock m0 and m1 (2026-11-05) (#7982)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: moq-bot <moq-bot@users.noreply.github.com>
---
 quest/m0/ci/README.md                         |  1 +
 quest/m0/ci/cachix-retire.md                  | 71 +++++++++++++++++++
 quest/m0/ci/mbx-r2-verify.md                  |  5 +-
 quest/m0/ci/nix-cache-verify.md               | 11 +--
 quest/m0/ci/publish-release-only.md           | 15 ++--
 quest/m0/test-flakes-2/p2p-data-channel.md    |  6 +-
 quest/m1/README.md                            |  2 -
 .../m1/audio-jitter-target/native-stretch.md  | 42 +++--------
 quest/m1/bench-publish.md                     |  4 +-
 quest/m1/cluster-routing/routes/README.md     |  4 +-
 quest/m1/moq-e2ee-remove.md                   | 14 +++-
 quest/m2/README.md                            |  3 +-
 quest/{m1 => m2}/crates-trusted-publisher.md  | 16 ++++-
 quest/m2/release-nix-cache.md                 | 59 ---------------
 quest/{m1 => m2}/release-rs-oidc.md           |  7 +-
 15 files changed, 145 insertions(+), 115 deletions(-)
 create mode 100644 quest/m0/ci/cachix-retire.md
 rename quest/{m1 => m2}/crates-trusted-publisher.md (77%)
 delete mode 100644 quest/m2/release-nix-cache.md
 rename quest/{m1 => m2}/release-rs-oidc.md (86%)

diff --git a/quest/m0/ci/README.md b/quest/m0/ci/README.md
index 48da9fd104c..ab5f523859b 100644
--- a/quest/m0/ci/README.md
+++ b/quest/m0/ci/README.md
@@ -180,6 +180,7 @@ The historical samples locate candidates; they are not controlled benchmarks.
 - [Verify the Nix runtime cache](/quest/m0/ci/nix-cache-verify.md) - hosted Cache uploads `main`'s relay and CLI, and Smoke's nix channel substitutes them
 - [Record hosted cargo-hakari evidence](/quest/m0/ci/hakari.md) - compare scheduled macOS and Windows cache hits and estimated compiler work saved before and after the workspace-hack
 - [Drop main from the publish Environment](/quest/m0/ci/publish-release-only.md) - the maintainer narrows `publish` to `release` and release tags once no job naming it runs as `main`
+- [Release tags push to nix.moq.dev, and Cachix stops taking writes](/quest/m0/ci/cachix-retire.md) - backport `release-nix.yml` and its Just module to `release`, drop `cachix.yml`, prove a tag substitutes from nix.moq.dev, then revoke the Cachix token (the cache stays for old tags)
 - [Measure the Linux cache effect of native media exclusions](/quest/m0/ci/hakari-followups.md) - scheduled Linux jobs measure cache reuse after unrelated tests stop compiling PipeWire and libclang
 - [A release merge opens no stale release PR](/quest/m0/ci/release-pr-after-release.md) - `just rs release` publishes before it proposes, so a merged release isn't re-proposed
 - [Build two queue entries at once if it helps](/quest/m0/ci/queue-concurrency.md) - a measured trial of `maximumEntriesToBuild: 2` against the serial lane's burst latency
diff --git a/quest/m0/ci/cachix-retire.md b/quest/m0/ci/cachix-retire.md
new file mode 100644
index 00000000000..238a1ee54a5
--- /dev/null
+++ b/quest/m0/ci/cachix-retire.md
@@ -0,0 +1,71 @@
+# [S] Release tags push to nix.moq.dev, and Cachix stops taking writes
+
+## Goal
+
+Tags cut from `release` push their Nix packages to nix.moq.dev through
+`release-nix.yml`, and a clean machine substitutes a tagged package from
+there. `release` no longer runs `cachix.yml`, and `CACHIX_AUTH_TOKEN` is
+deleted. Both nix.moq.dev bucket sizes hold under the CI bucket's 30-day
+expiry.
+
+## Plan
+
+Decided 2026-11-05 (maintainer, /quest-unblock): ✅ backport now and retire
+Cachix after the first `release` tag that proves nix.moq.dev, rather than
+waiting for the m2 cut to merge `main` into `release`. Not chosen: retiring it
+at the m2 cut with `CACHIX_AUTH_TOKEN` copied into `publish` meanwhile;
+retiring it at the m2 cut with the token left at repository scope. This
+absorbs [moq-dev/moq#7662](https://github.com/moq-dev/moq/pull/7662)'s m2
+"Release tags substitute from nix.moq.dev" quest, which it had split out
+behind the cut; the backport removes its only reason to wait.
+
+Decided 2026-11-05 (maintainer, /quest-unblock): ✅ revoke the token but keep
+the `kixelated` cache read-only. Older tags' flakes list only
+`kixelated.cachix.org`, so deleting the cache would make `nix run` on them
+build from source. Not chosen: copying the retained release paths to
+nix.moq.dev first (old flakes still only name Cachix); deleting the cache and
+accepting source builds.
+
+Today tags run `release`'s copies of the workflows. `release` still has
+`cachix.yml` and `cache.yml` and no `release-nix.yml`, so every tag so far,
+through `moq-relay-v0.17.12` and `moq-cli-v0.14.12` on 2026-11-03, pushed to
+Cachix and never reached nix.moq.dev. `cachix.yml` names `publish`, which does
+not hold `CACHIX_AUTH_TOKEN`, so it reads the repository copy. That copy is
+what [Keep pull-request CI read-only](/quest/m0/ci/read-only-secrets.md) would
+otherwise have to move.
+
+- Backport to `release`, in one PR the maintainer merges (agents never merge
+  into `release`): `main`'s `release-nix.yml`, the `infra/nix` Just module and
+  its entry in `infra/justfile` (`release` has neither, so `just infra nix
+  push` would fail), any local action it uses, the deletion of
+  `cachix.yml`, and `main`'s `cache.yml` in place of `release`'s, whose
+  dispatch-only `warm` job still runs `cachix push kixelated` with
+  `CACHIX_AUTH_TOKEN` and would fail once the token is gone. Match `release`'s own tag patterns (it still cuts `libmoq-v*`
+  where `main` cuts `moq-c-v*`) and the flake attributes `release` builds; the
+  `cache-write` Environment must admit those tags.
+- On the first `moq-relay-v*` or `moq-cli-v*` tag after the backport, record
+  its `release-nix.yml` pushes from all three legs, then
+  `nix run github:moq-dev/moq/<tag>#moq-relay --accept-flake-config`
+  substituting on a clean machine (`#moq` for a CLI tag), such as a fresh
+  container with only Nix installed.
+- Then the maintainer deletes `CACHIX_AUTH_TOKEN` (a repository secret, so
+  `Maintainer:`), and docs stop naming Cachix as a current cache.
+
+Public API: none. Wire: none.
+
+## Waiting
+
+- Maintainer: record both bucket sizes no earlier than 2026-11-24, a month
+  after the first `cache.yml` push to `nix-ci-moq-dev` on 2026-10-24, against
+  the 30-day expiry in `infra/nix/lifecycle.json`. Sizes need a
+  `wrangler login` to the Cloudflare account, which agents lack. A path
+  expires 30 days after upload even while CI still reads it, and `nix copy`
+  re-uploads it on the next merge. Look for Nightly jobs that fell back to
+  source builds once paths expired (`building '/nix/store/...uniffi-bindgen`
+  in a job log), and refresh on a schedule or switch to a closure-aware
+  collector (niks3) if they recur.
+
+## Related
+
+- [Verify the Nix runtime cache](/quest/m0/ci/nix-cache-verify.md) - the same cache's `main` evidence
+- [Drop main from the publish Environment](/quest/m0/ci/publish-release-only.md) - the other workflow backport to `release` decided in the 2026-11-05 audit
diff --git a/quest/m0/ci/mbx-r2-verify.md b/quest/m0/ci/mbx-r2-verify.md
index e81792c20a2..9ad7fc95641 100644
--- a/quest/m0/ci/mbx-r2-verify.md
+++ b/quest/m0/ci/mbx-r2-verify.md
@@ -78,7 +78,10 @@ compilation is "not looked up".
   [Windows job](https://github.com/moq-dev/moq/actions/runs/42050683248/job/127326015447)
   of run 42050683248 set up mbx 1.29.2, and its workspace build, against a
   manifest of 2,604 predictions, reported 846 hits, 224 misses, 168 not looked
-  up and 1,019 prefetched. Windows inheritance pays.
+  up and 1,019 prefetched. Its `Cargo.lock` differed from the previous
+  scheduled run's, so those hits point to an inherited manifest, but the
+  summary does not name the manifest identity it looked up; record that
+  identity from a later Windows job before relying on inheritance.
 - macOS: on 2026-10-28 the build did inherit, prefetching 732 predictions,
   yet hit only 13, with 1565 compilations not looked up. The install order is
   not the cause. Find out why the inherited predictions mostly miss, for
diff --git a/quest/m0/ci/nix-cache-verify.md b/quest/m0/ci/nix-cache-verify.md
index d86532056a9..3f67ea55449 100644
--- a/quest/m0/ci/nix-cache-verify.md
+++ b/quest/m0/ci/nix-cache-verify.md
@@ -30,10 +30,13 @@ credentials.
 Decided 2026-11-05 (maintainer, /quest-audit,
 [moq-dev/moq#7975](https://github.com/moq-dev/moq/pull/7975)): ✅ keep only
 this `main` evidence in m0 and move the release-tag proof, Cachix retirement,
-and bucket sizes to
-[Release tags substitute from nix.moq.dev](/quest/m2/release-nix-cache.md)
-behind the release cut. Not chosen: moving the whole quest to m2; merging
-`main` into `release` now.
+and bucket sizes to an m2 quest behind the release cut. Not chosen: moving the
+whole quest to m2; merging `main` into `release` now.
+
+Superseded the same day (maintainer, /quest-unblock): the release-tag proof,
+Cachix retirement, and bucket sizes moved to
+[Release tags push to nix.moq.dev](/quest/m0/ci/cachix-retire.md), which
+backports `release-nix.yml` to `release` now instead of waiting for the cut.
 
 Use the scheduled and push runs; never dispatch Nightly for this evidence.
 
diff --git a/quest/m0/ci/publish-release-only.md b/quest/m0/ci/publish-release-only.md
index 250364fd4e2..8995b044b34 100644
--- a/quest/m0/ci/publish-release-only.md
+++ b/quest/m0/ci/publish-release-only.md
@@ -23,10 +23,10 @@ The same PR dropped Cachix from `main` (decided 2026-11-02): Smoke's nix
 channel substitutes from `nix.moq.dev` and no longer pushes, so it names no
 Environment and `CACHIX_AUTH_TOKEN` needs no new home. The alternatives were
 moving the token into `cache-write`, or deleting Cachix everywhere now with a
-`release` backport. `release` keeps its Cachix workflows until the next cut
-merges `main` into it, and
-[Release tags substitute from nix.moq.dev](/quest/m2/release-nix-cache.md) deletes the Cachix
-cache and token once a release tag substitutes from `nix.moq.dev`.
+`release` backport. Changed 2026-11-05 (maintainer, /quest-unblock):
+[Release tags push to nix.moq.dev](/quest/m0/ci/cachix-retire.md) backports
+`release-nix.yml` and drops `cachix.yml` on `release` now, and deletes
+`CACHIX_AUTH_TOKEN` once a release tag substitutes from `nix.moq.dev`.
 
 Decided 2026-11-05 (maintainer, /quest-audit): `publish` still admits
 `main`, so this does not wait for the next cut.
@@ -44,8 +44,11 @@ What remains, in order:
 
 1. Open the backport PR against `release` (agent work).
 2. Once it merges, the maintainer drops `main` from `publish`'s deployment
-   policy and removes `DISCORD_WEBHOOK` and `CACHIX_AUTH_TOKEN` from
-   `publish`. Environment settings need the maintainer's admin access.
+   policy. Environment settings need the maintainer's admin access.
+   `publish` holds neither `DISCORD_WEBHOOK` (it lives in `alert`) nor
+   `CACHIX_AUTH_TOKEN` (a repository secret that
+   [Release tags push to nix.moq.dev](/quest/m0/ci/cachix-retire.md) revokes),
+   so there is nothing to remove from it.
 
 Decided 2026-11-04 (maintainer, /quest-unblock): ✅ cut the combined patch
 release on `release` soon, once [moq-dev/moq#7596](https://github.com/moq-dev/moq/pull/7596)'s
diff --git a/quest/m0/test-flakes-2/p2p-data-channel.md b/quest/m0/test-flakes-2/p2p-data-channel.md
index 7993d1d4c1d..a7d681550aa 100644
--- a/quest/m0/test-flakes-2/p2p-data-channel.md
+++ b/quest/m0/test-flakes-2/p2p-data-channel.md
@@ -19,8 +19,10 @@ channel error just before:
 ERROR:third_party/blink/renderer/modules/peerconnection/rtc_data_channel.cc:867] Send failedINVALID_STATE
 ```
 
-A send on a data channel that was not open (or already closing) failed, and
-the transfer then stalled instead of failing. It timed out once before, in
+The log names neither the channel's sender nor its timing against the
+stall, so this is a correlation to investigate, not a diagnosis: a send on a
+data channel that was not open (or already closing) failed, and the transfer
+stalled instead of failing. It timed out once before, in
 [41668668824](https://github.com/moq-dev/moq/actions/runs/41668668824), and
 passed locally then.
 
diff --git a/quest/m1/README.md b/quest/m1/README.md
index b2a24e9ed28..da9ea166324 100644
--- a/quest/m1/README.md
+++ b/quest/m1/README.md
@@ -174,8 +174,6 @@ quests that require them.
 - [TS fidelity and recovery](/quest/m1/ts-reliability/README.md) - both modes have explicit profiles, automated validation, loss tests, and a dedicated guide
 - [WebGPU on Safari](/quest/m1/webgpu-safari.md) - the WebGPU renderer is verified on Safari 26 for macOS and iOS
 - [Remove the moq-e2ee stub](/quest/m1/moq-e2ee-remove.md) - `rs/moq-e2ee` leaves the workspace and release config now that its final release points to moq-crypto
-- [crates.io trusts the workflow](/quest/m1/crates-trusted-publisher.md) - maintainer action: every published crate gets a trusted publisher for `release-rs.yml`
-- [Rust releases publish through OIDC](/quest/m1/release-rs-oidc.md) - release-plz publishes with trusted publishing and `CARGO_REGISTRY_TOKEN` is revoked
 - [Main is no slower than release](/quest/m1/release-perf/README.md) - every benchmark where main is slower than release is fixed or accepted with a reason, checked by a final paired run before the cut
 - [Calibrate the paired nightly benchmarks](/quest/m1/bench-ci.md) - A/A and deliberately slowed Nightly runs set the paired comparison's threshold, so its regression alerts can be trusted
 - [moq-json's table/deltas bench measures the same work every iteration](/quest/m1/bench-json-deltas.md) - the `table/deltas/1%` cases stop flipping between snapshot and delta timings, so their trend history is usable
diff --git a/quest/m1/audio-jitter-target/native-stretch.md b/quest/m1/audio-jitter-target/native-stretch.md
index fc024d27efa..69461a8e24b 100644
--- a/quest/m1/audio-jitter-target/native-stretch.md
+++ b/quest/m1/audio-jitter-target/native-stretch.md
@@ -88,39 +88,19 @@ nightlies on `main` read 160 to 280 ms. So the ceiling stays as it is,
 as `test/audio-quality/budgets.json`'s note budgets startup holds as measured,
 until the seven-nightly calibration below.
 
+Listened 2026-11-05 (maintainer, /quest-unblock): the stretch is inaudible
+in all four runs on `kixtop` at `main` `7e621623a8`, two minutes each of
+`say` speech from `LICENSE-APACHE` over Opus 128 kb/s, the relay at
+`test/audio-quality/relay.toml`, and the shaper's `bursty` profile, seed 7.
+The player's metrics confirm the stretch was active: media per render second
+was 1.0020 (fast, direct) and 1.0018 (fast, shaped) against a 1.002
+publisher, and 0.9981 and 0.9979 against 0.998; the shaped runs raised the
+target delay from 120 to 260 ms. Each direct run stalled once at startup,
+none in steady state. This settles the perceptual check; the calibration and
+bench waits below remain.
+
 ## Waiting
 
-- Maintainer: listen for the stretch on `kixtop` and record whether it is
-  audible. Recommend this check before claiming the perceptual goal;
-  automated amplitude tests cannot decide it.
-  Run it in `~/work/moq` on `kixtop`, with its speakers or headphones as
-  the default output, on `main`, where
-  [moq-dev/moq#7856](https://github.com/moq-dev/moq/pull/7856) landed. The
-  source is
-  macOS's `say` voice reading `LICENSE-APACHE`, about ten minutes of
-  continuous speech, so nothing is downloaded (an archive's speech file
-  returned 403):
-
-  ```bash
-  nix develop
-  mkdir -p .tmp/listen && say -v Samantha -o .tmp/listen/speech.aiff -f LICENSE-APACHE
-  # Terminal 1: the relay, and a shaper in front of it replaying the audio-quality `bursty` path.
-  cargo run -p moq-relay -- test/audio-quality/relay.toml &
-  cargo run -p moq-shaper -- --listen 127.0.0.1:4500 --target 127.0.0.1:4443 --seed 7 --profile bursty
-  # Terminal 2: publish 2 ms/s fast (accelerate); rerun with -readrate 0.998 for 2 ms/s slow (preemptive expand).
-  ffmpeg -hide_banner -v error -readrate 1.002 -stream_loop -1 -i .tmp/listen/speech.aiff \
-    -ac 2 -c:a libopus -b:a 128k -f mp4 -movflags cmaf+separate_moof+delay_moov+skip_trailer -frag_duration 1000 - |
-    cargo run -p moq-cli --features play -- --connect http://127.0.0.1:4443 --broadcast speech.hang import fmp4
-  # Terminal 3: two minutes direct (drift alone), then two through the shaper (the measured expansions).
-  cargo run -p moq-cli --features play -- --connect http://127.0.0.1:4443 --broadcast speech.hang \
-    play --video off --metrics .tmp/listen/drift.ndjson
-  cargo run -p moq-cli --features play -- --connect https://127.0.0.1:4500 \
-    --connect-tls-fingerprint "$(curl -s http://127.0.0.1:4443/certificate.sha256)" \
-    --broadcast speech.hang play --video off --metrics .tmp/listen/bursty.ndjson
-  ```
-
-  Record, for each of the four runs (fast/slow × direct/shaped), whether the
-  stretching is audible, and attach the `.ndjson` files.
 - moq-dev/moq: collect seven scheduled native nightly rows for this
   implementation, then apply the existing calibration rule. Keep the
   current provisional budgets until those artifacts exist.
diff --git a/quest/m1/bench-publish.md b/quest/m1/bench-publish.md
index 97026b1709d..8bd6259e384 100644
--- a/quest/m1/bench-publish.md
+++ b/quest/m1/bench-publish.md
@@ -50,9 +50,9 @@ crate, like CONTRIBUTING's bench-only backport. Otherwise skip it, say so in
 the PR, and moq-bench publishes at the cut.
 
 The first publish goes out by token, so add moq-bench to the
-[crates.io trusted publisher](/quest/m1/crates-trusted-publisher.md)
+[crates.io trusted publisher](/quest/m2/crates-trusted-publisher.md)
 `Waiting` list (done in this planning PR).
 
 ## Related
 
-- [crates.io trusts the workflow](/quest/m1/crates-trusted-publisher.md) - moq-bench needs a trusted publisher after its first publish
+- [crates.io trusts the workflow](/quest/m2/crates-trusted-publisher.md) - moq-bench needs a trusted publisher after its first publish
diff --git a/quest/m1/cluster-routing/routes/README.md b/quest/m1/cluster-routing/routes/README.md
index 72a12885f5e..c3369242f93 100644
--- a/quest/m1/cluster-routing/routes/README.md
+++ b/quest/m1/cluster-routing/routes/README.md
@@ -158,7 +158,9 @@ the bullets below are the contract it carries.
   losing one of two uplinks under one key
   (`scoped_delivery_through_two_uplinks_reaches_one_key`).
 - Decided 2026-11-04 (maintainer): a scoped peer's routing identities are
-  keyed by the route key the peer proves, from a shared key file
+  keyed by the route key the peer proves, so relays configured with the same
+  key file fail over as one; a scoped peer that proves no key, such as one on
+  qmux, gets a per-session key
   ([session integration](/quest/m1/cluster-routing/routes/session.md),
   [Scoped peers prove a route key](/quest/m1/cluster-routing/routes/proof.md)).
   The router takes the key from the caller (`Scope::qualify`).
diff --git a/quest/m1/moq-e2ee-remove.md b/quest/m1/moq-e2ee-remove.md
index e56d075fdff..1a8a05ceba0 100644
--- a/quest/m1/moq-e2ee-remove.md
+++ b/quest/m1/moq-e2ee-remove.md
@@ -4,15 +4,23 @@
 
 `rs/moq-e2ee` leaves the workspace, along with any release or version config
 that names it, so release-plz stops tracking a crate whose final release is
-out. moq-e2ee 0.0.21, the final no-code release pointing users to moq-crypto,
-is on crates.io (published 2026-11-03).
+out. moq-e2ee 0.0.22, the final no-code release pointing users to
+moq-crypto, is on crates.io.
 
 ## Plan
 
 Decided 2026-11-05 (maintainer, /quest-audit): ✅ retire the stub before
-[Rust releases publish through OIDC](/quest/m1/release-rs-oidc.md), so the
+[Rust releases publish through OIDC](/quest/m2/release-rs-oidc.md), so the
 crate never needs a trusted publisher.
 
+Published 2026-11-05 (maintainer, /quest-unblock, by an agent at the
+maintainer's request): moq-e2ee 0.0.22 from `main`'s stub, with only the
+version raised from 0.0.11 locally, since 0.0.21 on crates.io (2026-11-03) and
+on `release` is still the full implementation. A 0.0.x caret requirement never
+resolves to the next patch, so no dependent upgrades into the stub
+unasked. Not chosen: publishing it through the m2 cut; deleting the crate
+with no final release.
+
 - Delete `rs/moq-e2ee` (the workspace's `rs/*` glob picks it up) and its
   `Cargo.lock` entry.
 - Search release-plz, `version.json`, workflows, and docs for `moq-e2ee` and
diff --git a/quest/m2/README.md b/quest/m2/README.md
index a66a330cb67..764a707aea7 100644
--- a/quest/m2/README.md
+++ b/quest/m2/README.md
@@ -35,9 +35,10 @@ lite-07; bitrate enforcement is not part of this release.
 - [JS announced coalescing](/quest/m2/js-announced-coalesce.md) - `@moq/net`'s `Announced` keeps one pending event per path, like Rust
 - [An audio track's final flush joins its open group](/quest/m2/audio-flush-group.md) - a zero-`delay.max` subscriber gets the tail, not `Old`
 - [Release execution](/quest/m2/release/README.md) - publication, installed-artifact proof, cleanup, and downstream adoption after m1
-- [Release tags substitute from nix.moq.dev](/quest/m2/release-nix-cache.md) - the first tag after the cut substitutes on a clean machine, bucket sizes hold, and Cachix is retired
 - [Release pull requests read the R2 Rust cache](/quest/m2/mbx-r2-release-cache.md) - a release PR's `Check the cache` step reports effective read-only once the cut brings the cache to `release`
 - [Binary release publishers run on their tag](/quest/m2/release-tag-publishers.md) - brew, Go and Swift releases stop running through `workflow_run` on main, once the cut brings the workflows to `release`
+- [crates.io trusts the workflow](/quest/m2/crates-trusted-publisher.md) - maintainer action: the crates the cut first-publishes by token get a trusted publisher for `release-rs.yml`
+- [Rust releases publish through OIDC](/quest/m2/release-rs-oidc.md) - release-plz publishes with trusted publishing and `CARGO_REGISTRY_TOKEN` is revoked
 - [One policy for oversized container metadata](/quest/m2/import-metadata-policy.md) - fMP4 and MKV refuse or stream huge metadata by one documented rule
 - [Wire fuzz coverage](/quest/m2/wire-fuzz-coverage.md) - the cmsg walks in moq-sock and moq-uring have invariant fuzz targets, and the unsafe peer input reaches runs under Miri
 - [VA-API renderer tests](/quest/m2/vaapi-render-tests.md) - the VA-API renderer, decode, and transcode tests run in `just rs gpu` on AMD and Intel and fail instead of skipping, and hosted CI reports them ignored
diff --git a/quest/m1/crates-trusted-publisher.md b/quest/m2/crates-trusted-publisher.md
similarity index 77%
rename from quest/m1/crates-trusted-publisher.md
rename to quest/m2/crates-trusted-publisher.md
index 7c5828c6168..23d1e883246 100644
--- a/quest/m1/crates-trusted-publisher.md
+++ b/quest/m2/crates-trusted-publisher.md
@@ -4,12 +4,12 @@
 
 Every crate that `release-rs.yml` publishes has a crates.io trusted publisher
 for `moq-dev/moq`, workflow `release-rs.yml`, and environment `publish`, so
-[Rust releases publish through OIDC](/quest/m1/release-rs-oidc.md) can start.
+[Rust releases publish through OIDC](/quest/m2/release-rs-oidc.md) can start.
 Delete this quest once every crate has one.
 
 ## Waiting
 
-- Maintainer: after the next `main` to `release` cut publishes kio-macros, moq-c,
+- Maintainer: after [the cut](/quest/m2/release/cut.md) publishes kio-macros, moq-c,
   moq-congestion, moq-crypto, moq-ice, moq-quic, and moq-rtsp by token (and
   moq-bench, whenever [its first publish](/quest/m1/bench-publish.md) lands), add
   their trusted publishers the same way. Settings pages need a crates.io
@@ -17,6 +17,14 @@ Delete this quest once every crate has one.
 
 ## Plan
 
+Decided 2026-11-05 (maintainer left the choice to the agent, /quest-unblock):
+✅ move this quest and [Rust releases publish through OIDC](/quest/m2/release-rs-oidc.md)
+to m2 behind [the cut](/quest/m2/release/cut.md). The seven crates the cut
+first-publishes by token cannot get a trusted publisher before it, and the cut
+runs after m1, so neither quest could finish inside m1. Not chosen: keeping
+both in m1 and treating the cut as part of finishing m1.
+
+
 Moved from m2 to m1 on 2026-10-29 (maintainer): after
 [moq-dev/moq#7166](https://github.com/moq-dev/moq/pull/7166) moved publish
 secrets into the `publish` Environment, `CARGO_REGISTRY_TOKEN` is the
@@ -48,3 +56,7 @@ Decided 2026-11-05 (maintainer, /quest-audit): moq-e2ee, published but
 retired in favor of moq-crypto, gets no trusted publisher;
 [Remove the moq-e2ee stub](/quest/m1/moq-e2ee-remove.md) takes it out of the
 workspace instead.
+
+## Required
+
+- [Cut the release](/quest/m2/release/cut.md) - the cut first-publishes the seven crates by token
diff --git a/quest/m2/release-nix-cache.md b/quest/m2/release-nix-cache.md
deleted file mode 100644
index cd0cca0cc3c..00000000000
--- a/quest/m2/release-nix-cache.md
+++ /dev/null
@@ -1,59 +0,0 @@
-# [S] Release tags substitute from nix.moq.dev
-
-## Goal
-
-The first release tag cut from `main` substitutes from `nix.moq.dev` on a
-clean machine, both bucket sizes hold under the CI bucket's 30-day expiry, and
-Cachix is retired.
-
-## Plan
-
-Decided 2026-11-05 (maintainer, /quest-audit,
-[moq-dev/moq#7975](https://github.com/moq-dev/moq/pull/7975)): ✅ split from
-[Verify the Nix runtime cache](/quest/m0/ci/nix-cache-verify.md) and moved to
-m2 behind [the cut](/quest/m2/release/cut.md), which brings `main`'s
-`release-nix.yml` to `release` when it merges `main` into it. Not chosen:
-moving the whole verification quest; merging `main` into `release` now,
-which reverses the 2026-11-04 decision.
-
-Tags run `release`'s copies of the workflows. `release` still has
-`cachix.yml` and `cache.yml` and no `release-nix.yml`, so every tag so far,
-through `moq-relay-v0.17.9` and `moq-cli-v0.14.9` on 2026-10-28, pushed to
-Cachix and never reached `nix.moq.dev`;
-`gh run list --workflow release-nix.yml` stays empty until the cut.
-
-Once the cut lands:
-
-1. Record the first `moq-relay-v*` or `moq-cli-v*` tag's `release-nix.yml`
-   pushes from all three legs.
-2. Record `nix run github:moq-dev/moq/<tag>#moq-relay --accept-flake-config`
-   substituting on a clean machine (`#moq` for a CLI tag), such as a fresh
-   container with only Nix installed.
-3. Retire Cachix (decided 2026-10-29): that tag is the first release a
-   downstream user could fetch from `nix.moq.dev`. The cut also brings
-   `main`'s removal of `cachix.yml` to `release`.
-
-Public API: none. Wire: none.
-
-## Waiting
-
-- Maintainer: Record both bucket sizes no earlier than 2026-11-24, a month
-  after the first `cache.yml` push to `nix-ci-moq-dev` on 2026-10-24, against
-  the 30-day expiry in `infra/nix/lifecycle.json`. Sizes need a
-  `wrangler login` to the Cloudflare account, which agents lack. A path
-  expires 30 days after upload even while CI still reads it, and `nix copy`
-  re-uploads it on the next merge. Look for Nightly jobs that fell back to
-  source builds once paths expired (`building '/nix/store/...uniffi-bindgen`
-  in a job log), and refresh on a schedule or switch to a closure-aware
-  collector (niks3) if they recur.
-- Maintainer: After step 2, delete the `CACHIX_AUTH_TOKEN` secret and the
-  `kixelated` Cachix cache; the Cachix account is the maintainer's, and
-  deleting the cache is irreversible.
-
-## Required
-
-- [Cut and publish the prepared breaking release](/quest/m2/release/cut.md) - brings `release-nix.yml` to `release`, where tags run it
-
-## Related
-
-- [Verify the Nix runtime cache](/quest/m0/ci/nix-cache-verify.md) - the same cache's `main` evidence
diff --git a/quest/m1/release-rs-oidc.md b/quest/m2/release-rs-oidc.md
similarity index 86%
rename from quest/m1/release-rs-oidc.md
rename to quest/m2/release-rs-oidc.md
index 8992e5456a2..ac0b7ec9551 100644
--- a/quest/m1/release-rs-oidc.md
+++ b/quest/m2/release-rs-oidc.md
@@ -8,6 +8,11 @@ secret is removed and revoked.
 
 ## Plan
 
+Moved to m2 on 2026-11-05 (/quest-unblock), with
+[crates.io trusts the workflow](/quest/m2/crates-trusted-publisher.md), which
+waits on the cut's first publishes.
+
+
 Moved from m2 to m1 on 2026-10-29 (maintainer): after
 [moq-dev/moq#7166](https://github.com/moq-dev/moq/pull/7166) moved publish
 secrets into the `publish` Environment, `CARGO_REGISTRY_TOKEN` is the
@@ -30,4 +35,4 @@ authentication Action is needed.
 ## Required
 
 - [Remove the moq-e2ee stub](/quest/m1/moq-e2ee-remove.md) - release-plz stops tracking a retired crate that has no trusted publisher
-- [crates.io trusts the workflow](/quest/m1/crates-trusted-publisher.md) - every published crate has the trusted publisher configured
+- [crates.io trusts the workflow](/quest/m2/crates-trusted-publisher.md) - every published crate has the trusted publisher configured

From 597fe8bacdf2a0d17f77c95d5e3375e27c07b6bc Mon Sep 17 00:00:00 2001
From: Luke Curley <kixelated@gmail.com>
Date: Thu, 5 Nov 2026 23:18:24 +0000
Subject: [PATCH 30/36] fix(audio): replay only the retained audio a
 subscriber's max delay wants (#7656)

Co-authored-by: GPT-6.1 Sol <noreply@openai.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 doc/lib/js/publish.md                     |  4 +-
 doc/lib/rs/moq-audio.md                   |  4 +-
 js/net/src/ietf/subscriber.ts             | 12 ++--
 js/net/src/internal.ts                    |  5 ++
 js/net/src/lite/subscriber.test.ts        |  2 +-
 js/net/src/lite/subscriber.ts             |  6 +-
 js/net/src/track.ts                       | 32 ++++++---
 js/publish/src/audio/backlog.ts           | 14 +++-
 js/publish/src/audio/encoder.test.ts      | 84 +++++++++++++++++++++-
 js/publish/src/audio/encoder.ts           |  9 ++-
 quest/m0/interop-green/README.md          | 10 +--
 quest/m0/test-flakes-2/README.md          |  2 +-
 quest/m0/test-flakes-2/ietf22-fallback.md | 87 +++++++----------------
 rs/moq-audio/src/encode/backlog.rs        | 14 +++-
 rs/moq-audio/src/encode/capture.rs        | 23 +++---
 rs/moq-audio/src/encode/producer.rs       | 48 +++++++++++++
 16 files changed, 249 insertions(+), 107 deletions(-)

diff --git a/doc/lib/js/publish.md b/doc/lib/js/publish.md
index 5b4d8e84856..1225a30d59c 100644
--- a/doc/lib/js/publish.md
+++ b/doc/lib/js/publish.md
@@ -74,8 +74,8 @@ with a warning, since every viewer would refuse it.
 Video encodes while enabled, so its recent groups wait in the track's cache for
 a late subscription's `delay.max` or a fetch. The cache keeps an idle group for
 30 seconds whatever `maxAge` says; `maxAge` only bounds how far back a reader
-may reach into it. Audio keeps raw PCM while nobody listens, then encodes that
-history ahead of live audio when a subscriber arrives. Raw audio keeps up to
+may reach into it. Audio keeps raw PCM while nobody listens, then encodes the part of
+that history within the subscribers' max delay ahead of live audio when one arrives. Raw audio keeps up to
 `maxAge`, which for media defaults to 30 seconds (about 11.5 MB for 48 kHz
 stereo f32). With `maxAge: null`, which sets no publisher limit on the media, raw
 audio still keeps 30 seconds, since raw history needs a bound. The catalog and
diff --git a/doc/lib/rs/moq-audio.md b/doc/lib/rs/moq-audio.md
index 9d17eca0f06..a11d6b92068 100644
--- a/doc/lib/rs/moq-audio.md
+++ b/doc/lib/rs/moq-audio.md
@@ -35,8 +35,8 @@ position on that clock, so a reader that falls behind skips its own audio
 without stalling the mix.
 
 Without a subscriber the encoder keeps raw PCM
-up to the track's `max_age`, then encodes that history before continuing live when
-someone subscribes. With an unlimited `max_age` it keeps at most 30 seconds
+up to the track's `max_age`, then encodes the part of that history within the
+subscribers' max delay before continuing live when someone subscribes. With an unlimited `max_age` it keeps at most 30 seconds
 (about 11.5 MB for 48 kHz stereo f32). Set `encode::Capture::on_demand` to false
 to encode continuously instead. Stopping an encoder leaves the shared capture running, and the
 history it retained stays on the track until it is subscribed or expires; a device failure keeps
diff --git a/js/net/src/ietf/subscriber.ts b/js/net/src/ietf/subscriber.ts
index 1a5dc4918f3..bfa6103b42b 100644
--- a/js/net/src/ietf/subscriber.ts
+++ b/js/net/src/ietf/subscriber.ts
@@ -989,7 +989,7 @@ export class Subscriber {
 
 	#needsLive(producer: track.Producer, edge: bigint): boolean {
 		if (hooks.trackFinished(producer) || !hooks.subscribing(producer).peek()) return false;
-		const ranges = producer.subscription.peek()?.ranges ?? [];
+		const ranges = hooks.requested(producer).peek()?.ranges ?? [];
 		if (!bounded(ranges)) return true;
 		const end = wireSpan(ranges).end;
 		// A relative end resolves against Largest, or against the first group when none exists yet,
@@ -999,7 +999,7 @@ export class Subscriber {
 
 	async #historyOnly(producer: track.Producer, edge: bigint): Promise<void> {
 		while (this.#needsLive(producer, edge) && hooks.trackReleased(producer).peek() === undefined) {
-			await Signal.race(producer.subscription, hooks.subscribing(producer), hooks.trackReleased(producer));
+			await Signal.race(hooks.requested(producer), hooks.subscribing(producer), hooks.trackReleased(producer));
 		}
 	}
 
@@ -1078,7 +1078,7 @@ export class Subscriber {
 			const subscribing = hooks.subscribing(producer);
 			for (;;) {
 				if (hooks.trackReleased(producer).peek() !== undefined) return;
-				const subscription = producer.subscription.peek();
+				const subscription = hooks.requested(producer).peek();
 				if (!subscription) {
 					hooks.releaseTrack(producer);
 					return;
@@ -1089,7 +1089,7 @@ export class Subscriber {
 					continue;
 				}
 				await untilAborted(
-					Promise.resolve(Signal.race(producer.subscription, subscribing, hooks.trackReleased(producer))),
+					Promise.resolve(Signal.race(hooks.requested(producer), subscribing, hooks.trackReleased(producer))),
 					signal,
 				);
 			}
@@ -1375,14 +1375,14 @@ export class Subscriber {
 		for (;;) {
 			// With no subscriber left there is nothing to follow: the subscription is ending, or
 			// keeps what it last asked for until one returns, as on lite and in Rust.
-			const subscription = producer.subscription.peek();
+			const subscription = hooks.requested(producer).peek();
 			const wanted = toWire(subscription?.priority ?? 0);
 			const wantedMaxAge = this.#maxAge && subscription ? maxDelayOf(subscription) : undefined;
 			if (!subscription || (wanted === sent && wantedMaxAge === sentMaxAge) || unanswered.peek() > 0) {
 				const disposes: Dispose[] = [];
 				const wake = new Promise<void>((resolve) => {
 					disposes.push(
-						producer.subscription.changed(() => resolve()),
+						hooks.requested(producer).changed(() => resolve()),
 						unanswered.changed(() => resolve()),
 					);
 				});
diff --git a/js/net/src/internal.ts b/js/net/src/internal.ts
index 4d1c81d4587..eab7e905b34 100644
--- a/js/net/src/internal.ts
+++ b/js/net/src/internal.ts
@@ -644,6 +644,8 @@ export const hooks: {
 	fetchBudget: (subscriber: Subscriber, maxDelay: Milli | undefined) => void;
 	/** Whether a reader beyond one-shot fetches subscribes to this copy. */
 	subscribing: (producer: Producer) => Getter<boolean>;
+	/** The aggregate across every reader, one-shot fetches included: what the wire asks for. */
+	requested: (producer: Producer) => Getter<Subscription | undefined>;
 	/** Leave a wire copy serving its cache and fills without a live feed. */
 	cacheTrack: (producer: Producer) => void;
 	/** Fail subscriptions reaching beyond `edge`, keeping history readers and one-shot fetches. */
@@ -910,6 +912,9 @@ export const hooks: {
 	subscribing: () => {
 		throw new Error("track module not loaded");
 	},
+	requested: () => {
+		throw new Error("track.ts not loaded");
+	},
 	fetchBudget: () => {
 		throw new Error("track.ts not loaded");
 	},
diff --git a/js/net/src/lite/subscriber.test.ts b/js/net/src/lite/subscriber.test.ts
index b31106e1ae7..8f37fd964af 100644
--- a/js/net/src/lite/subscriber.test.ts
+++ b/js/net/src/lite/subscriber.test.ts
@@ -2352,7 +2352,7 @@ test.each(
 	const runResponses = internal.runResponses.bind(internal);
 	const responses = spyOn(internal, "runResponses").mockImplementation((stream, entry) => {
 		counters.push(
-			...[entry.track.subscription, entry.track.demand().wanted, hooks.producerLargest(entry.track)].map(
+			...[hooks.requested(entry.track), entry.track.demand().wanted, hooks.producerLargest(entry.track)].map(
 				countChanges,
 			),
 		);
diff --git a/js/net/src/lite/subscriber.ts b/js/net/src/lite/subscriber.ts
index afdd4067d43..b0a3061306e 100644
--- a/js/net/src/lite/subscriber.ts
+++ b/js/net/src/lite/subscriber.ts
@@ -2141,7 +2141,7 @@ export class Subscriber {
 	#covered(entry: SubscribeEntry): boolean {
 		// Without SUBSCRIBE_FINISH (older drafts) nothing says which groups are owed.
 		if (entry.end === undefined) return false;
-		const ranges = wireRanges(entry.track.subscription.peek()?.ranges ?? [{}]);
+		const ranges = wireRanges(hooks.requested(entry.track).peek()?.ranges ?? [{}]);
 		const end = min(entry.end, wireSpan(ranges).end ?? entry.end);
 		const floor = rangesStart(ranges);
 		// Lite-07 answers with SUBSCRIBE_OK once the track ends, unless nothing was asked below the
@@ -2218,10 +2218,10 @@ export class Subscriber {
 				wanted !== sentWanted
 					? wanted
 					: undefined;
-			const current = track.subscription.peek();
+			const current = hooks.requested(track).peek();
 			if (current === undefined || (refresh === undefined && this.#sameSubscription(current, lastSent))) {
 				// Each wake releases the quiet signals too, including when termination wins.
-				const next = await race([Signal.race(track.subscription, demand.wanted, edge), stopped]);
+				const next = await race([Signal.race(hooks.requested(track), demand.wanted, edge), stopped]);
 				if (next === null) return;
 				continue;
 			}
diff --git a/js/net/src/track.ts b/js/net/src/track.ts
index b38756d3f11..d497cc5ebd6 100644
--- a/js/net/src/track.ts
+++ b/js/net/src/track.ts
@@ -434,7 +434,7 @@ function smallest(a: Milli | null | undefined, b: Milli | null | undefined): Mil
 	return Milli(Math.min(a, b));
 }
 
-// Aggregate the preferences of every live subscriber, matching Rust's Subscription::poll_combined.
+// Aggregate the preferences of `states`, matching Rust's Subscription::poll_combined.
 function combineSubscriptions(states: Iterable<TrackState>): Subscription | undefined {
 	let combined: Subscription | undefined;
 	for (const state of states) {
@@ -494,9 +494,9 @@ export class Request {
 		return this.#producer.demand();
 	}
 
-	/** The aggregate subscription requested for this track. */
+	/** The aggregate subscription requested for this track, one-shot fetches included. */
 	get subscription(): Readonly<Subscription> {
-		return this.#producer.subscription.peek() ?? subscriptionDefaults();
+		return hooks.requested(this.#producer).peek() ?? subscriptionDefaults();
 	}
 
 	/** The subscriber's priority for this track. */
@@ -788,6 +788,9 @@ let reofferCached: (
 let reofferSequences: (producer: Producer, sink: TrackState, sequences: readonly bigint[]) => void;
 // Whether a group may still land on the producer's live feed; assigned in its static block.
 let mayLand: (producer: Producer, land: Land) => boolean;
+// Recompute the producer's aggregates now, for a sink that just became a fetch; assigned in its
+// static block.
+let resubscribe: (producer: Producer) => void;
 let owedRuns: (producer: Producer, start: bigint, end: bigint) => Iterable<Run & { folds?: number }>;
 let owedGroup: (producer: Producer, start: bigint, end: bigint) => { sequence: bigint; folds?: number } | undefined;
 let fillEdge: (producer: Producer) => bigint | undefined;
@@ -897,6 +900,10 @@ export class Producer {
 	// `max_sequence`, and where the next append lands.
 	#received = 0n;
 	#subscribing = new Signal(false);
+	// The aggregate across live subscribers only. A fetch's preferences judge just the group it
+	// asks for, so a publisher sizing what it serves (such as how much retained media to replay)
+	// must not see them. The wire's aggregate, `#state.update`, keeps them.
+	#live = new Signal<Subscription | undefined>(undefined);
 
 	// Recently written source groups, retained for replay to late subscribers and
 	// pruned once idle for longer than the cache window. Each entry tracks the mirror
@@ -979,6 +986,8 @@ export class Producer {
 
 	static {
 		hooks.subscribing = (producer) => producer.#subscribing;
+		hooks.requested = (producer) => producer.#state.update;
+		resubscribe = (producer) => producer.#updateSubscription();
 		hooks.cacheTrack = (producer) => {
 			producer.#subscribed = false;
 			producer.#served = undefined;
@@ -1175,12 +1184,9 @@ export class Producer {
 		return this.#state.outcome;
 	}
 
-	/**
-	 * The aggregate subscription across live subscribers, or `undefined` when there are none.
-	 * The wire layer watches this to emit SUBSCRIBE_UPDATE.
-	 */
+	/** The aggregate subscription across live subscribers, or `undefined` when there are none. */
 	get subscription(): Getter<Subscription | undefined> {
-		return this.#state.update;
+		return this.#live;
 	}
 
 	/**
@@ -1334,17 +1340,19 @@ export class Producer {
 		}
 	}
 
-	// Recompute from every live sink because an update or close can narrow as well as widen
-	// the aggregate. The wire layer observes this signal and emits SUBSCRIBE_UPDATE.
+	// Recompute from every sink because an update or close can narrow as well as widen the
+	// aggregates. The wire layer observes `#state.update` and emits SUBSCRIBE_UPDATE.
 	//
 	// The max delay is the subscribers' own, not clamped to the track's maxAge: the publisher
 	// applies its own, as each reader's budget does, so the demand asked upstream is the same
 	// before and after the info lands.
 	#updateSubscription(): void {
-		this.#subscribing.set([...this.#sinks].some((sink) => !sink.fetch && sink.closed.peek() === undefined));
+		const live = [...this.#sinks].filter((sink) => !sink.fetch);
+		this.#subscribing.set(live.some((sink) => sink.closed.peek() === undefined));
 		const combined = combineSubscriptions(this.#sinks);
 		this.#settle();
 		this.#state.update.set(combined);
+		this.#live.set(combineSubscriptions(live));
 		// The requested floor bounds what a pending tail owes.
 		this.#owe();
 	}
@@ -2931,6 +2939,8 @@ export class Subscriber {
 		hooks.fetchBudget = (subscriber, maxDelay) => {
 			subscriber.#fetchBudget = maxDelay ?? Number.POSITIVE_INFINITY;
 			subscriber.#state.fetch = true;
+			// The sink joined as a live subscriber; leave the live aggregate before anyone sees it.
+			if (subscriber.#state.producer) resubscribe(subscriber.#state.producer);
 			const update = subscriber.#state.update.peek();
 			if (update) subscriber.#state.update.set(update, true);
 		};
diff --git a/js/publish/src/audio/backlog.ts b/js/publish/src/audio/backlog.ts
index 6d59dfecf45..732747b8069 100644
--- a/js/publish/src/audio/backlog.ts
+++ b/js/publish/src/audio/backlog.ts
@@ -29,9 +29,17 @@ export class Backlog {
 		while (this.#samples > this.#limit) this.#evict();
 	}
 
-	/** Drop expired frames even when capture has stopped delivering samples. */
-	expire(now: Micro): void {
-		while (this.deadline !== undefined && this.deadline <= now) this.#evict();
+	/**
+	 * Drop expired frames even when capture has stopped delivering samples. A `budget` shorter than
+	 * the retention also drops what a subscriber that far behind the live edge would find stale.
+	 */
+	expire(now: Micro, budget: Micro = this.#retention): void {
+		const age = Math.min(budget, this.#retention);
+		for (;;) {
+			const first = this.#frames[this.#head];
+			if (!first || first.end + age > now) return;
+			this.#evict();
+		}
 	}
 
 	/** Whether frames were dropped unencoded since the last call, leaving a gap in the timeline. */
diff --git a/js/publish/src/audio/encoder.test.ts b/js/publish/src/audio/encoder.test.ts
index 578b318b146..d4002c4d2e5 100644
--- a/js/publish/src/audio/encoder.test.ts
+++ b/js/publish/src/audio/encoder.test.ts
@@ -1244,7 +1244,8 @@ test("a backlog encode refusal aborts its rendition when demand arrives", async
 		});
 		const net = broadcast.net.peek();
 		if (!net) throw new Error("expected network broadcast");
-		subscriber = net.track("audio").subscribe();
+		// A live-edge budget would leave the retained frame unencoded.
+		subscriber = net.track("audio").subscribe({ delay: { max: null } });
 		await settle();
 		expect(encoder.out.error.peek()).toBe(failure);
 		expect(subscriber.closed.peek()).toBe(failure);
@@ -1307,6 +1308,87 @@ test("default audio replays the last second after three seconds without a subscr
 	}
 });
 
+// Replayed groups reach the track as fresh arrivals, so only the encoder can tell they are old: a
+// live viewer rejoining after seconds idle would otherwise wade through all of them first.
+test("demand replays only the retained audio its max delay still wants", async () => {
+	using _webcodecs = installFakeWebCodecs();
+	const clock = new Manual();
+	const installed = clock.install();
+	const broadcast = new Broadcast({ origin: new Moq.Origin.Producer(), name: Moq.Path.from("rejoin.hang") });
+	const feed = new Feed();
+	const configuring = configured();
+	const encoder = new Encoder("audio", { broadcast, capture: fakeCapture(feed) as never });
+	let late: Moq.Track.Subscriber | undefined;
+	try {
+		await configuring;
+		await settle();
+		for (let index = 0; index < 150; index++) {
+			await feed.push({ timestamp: Micro(index * 20_000), channels: [new Float32Array(960)] });
+			await feed.drain();
+			await clock.advance(Nano.fromMilli(Milli(20)));
+		}
+		const net = broadcast.net.peek();
+		if (!net) throw new Error("expected network broadcast");
+		// At 3000 ms, a 130 ms budget still wants the frames ending after 2870 ms: 143 onward.
+		late = net.track("audio").subscribe({ delay: { max: Milli(130) } });
+		await settle();
+		expect(encoder.out.stats.peek().frames).toBe(7 - FakeAudioEncoder.LAG);
+		await feed.push({ timestamp: Micro(150 * 20_000), channels: [new Float32Array(960)] });
+		await feed.drain();
+		const group = await late.ordered().nextGroup();
+		const frame = await group?.readFrame();
+		if (!frame) throw new Error("expected a replayed frame");
+		expect(Moq.Varint.decode(frame.payload)[0]).toBe(143 * 20_000);
+	} finally {
+		late?.close();
+		encoder.close();
+		broadcast.close();
+		installed.close();
+	}
+});
+
+// A fetch's own budget judges only the group it asks for, so it must not narrow what the encoder
+// replays for the live subscribers that come later.
+test("a fetch alone replays the whole retention", async () => {
+	using _webcodecs = installFakeWebCodecs();
+	const clock = new Manual();
+	const installed = clock.install();
+	const broadcast = new Broadcast({ origin: new Moq.Origin.Producer(), name: Moq.Path.from("fetch.hang") });
+	const feed = new Feed();
+	const configuring = configured();
+	const encoder = new Encoder("audio", { broadcast, capture: fakeCapture(feed) as never });
+	let fetched: Moq.Group.Consumer | undefined;
+	try {
+		await configuring;
+		await settle();
+		const net = broadcast.net.peek();
+		if (!net) throw new Error("expected network broadcast");
+		// A first viewer leaves group 0 in the cache for the fetch to find.
+		const first = net.track("audio").subscribe({ delay: { max: null } });
+		await settle();
+		await feed.push({ timestamp: Micro(0), channels: [new Float32Array(960)] });
+		await feed.drain();
+		first.close();
+		await settle();
+		const encoded = encoder.out.stats.peek().frames;
+		for (let index = 1; index <= 150; index++) {
+			await clock.advance(Nano.fromMilli(Milli(20)));
+			await feed.push({ timestamp: Micro(index * 20_000), channels: [new Float32Array(960)] });
+			await feed.drain();
+		}
+		expect(encoder.out.stats.peek().frames).toBe(encoded);
+		// Held open, the fetched group keeps the fetch's demand alive while the encoder reacts.
+		fetched = await net.track("audio").fetchGroup(0n);
+		await settle();
+		expect(encoder.out.stats.peek().frames).toBe(encoded + 150);
+	} finally {
+		fetched?.close();
+		encoder.close();
+		broadcast.close();
+		installed.close();
+	}
+});
+
 // Replay catches up behind the live edge another rendition already reached; advertising that as
 // `delay` would buffer playback by the retention for the rest of the broadcast.
 test("replayed raw audio raises no catalog delay", async () => {
diff --git a/js/publish/src/audio/encoder.ts b/js/publish/src/audio/encoder.ts
index 61722066205..6f90cbc734a 100644
--- a/js/publish/src/audio/encoder.ts
+++ b/js/publish/src/audio/encoder.ts
@@ -220,6 +220,10 @@ export class Encoder {
 	// discontinuity and re-anchors on.
 	#pipeline: Pipeline | undefined;
 	#encoding = false;
+	// The demand's max delay, past which retained audio is stale to every subscriber, or undefined
+	// for the retention alone. Replayed groups land as fresh arrivals, so only this cut keeps a
+	// rejoining live viewer from receiving all the retained audio before the live edge.
+	#budget: Micro | undefined;
 
 	// The rendition's track and producer, kept across subscriber changes.
 	// `start` is the open group's first timestamp, undefined until a frame opens one.
@@ -487,6 +491,9 @@ export class Encoder {
 
 			const onDemand = effect.get(broadcast.in.onDemand) ?? true;
 			const demanded = !!track && effect.get(track.demand().wanted) !== undefined;
+			// Demand from fetches alone carries no subscription, so no budget beyond the retention.
+			const max = track && effect.get(track.subscription)?.delay?.max;
+			this.#budget = max === undefined || max === null ? undefined : Micro.fromMilli(max);
 			// Not gated on `enabled` or `muted`: a paused rendition takes no capture, but still encodes what it retained.
 			this.#encoding = !!format && !!track && !fatal && (!onDemand || demanded);
 			effect.set(this.#out.active, enabled && this.#encoding, false);
@@ -846,7 +853,7 @@ export class Encoder {
 				const pipeline: Pipeline = {
 					channelCount: config.numberOfChannels,
 					drain: () => {
-						backlog.expire(clock());
+						backlog.expire(clock(), this.#budget);
 						// Expired history is a real gap, unlike a loss of demand: end the epoch where the
 						// encoded audio stops, so its last frame isn't stretched across the gap.
 						if (backlog.takeEvicted()) cut();
diff --git a/quest/m0/interop-green/README.md b/quest/m0/interop-green/README.md
index f55a5bf7f22..c9b26c3579f 100644
--- a/quest/m0/interop-green/README.md
+++ b/quest/m0/interop-green/README.md
@@ -29,12 +29,12 @@ port-reservation lines are negative self-tests in
 `interop/relay-log.test.sh` and `lib/harness.test.sh` that pass.
 Already owned: the intermittent media-matrix timestamp-gap cells
 (`cpp -> js-native-node`, `go -> c`, browser `rust -> js` timeouts) belong to
-[test flakes](/quest/m0/test-flakes-2/README.md). So does
-the fallback audio stall, which hit on
-`moq-lite-07-wip` in
+[test flakes](/quest/m0/test-flakes-2/README.md). The fallback audio stall
+that hit on `moq-lite-07-wip` in
 [41495461904](https://github.com/moq-dev/moq/actions/runs/41495461904) and
-[41668668824](https://github.com/moq-dev/moq/actions/runs/41668668824); see
-[the IETF22 fallback quest](/quest/m0/test-flakes-2/ietf22-fallback.md).
+[41668668824](https://github.com/moq-dev/moq/actions/runs/41668668824) was a
+replay of retained audio past the viewer's max delay, fixed in
+[moq-dev/moq#7656](https://github.com/moq-dev/moq/pull/7656).
 
 Video passed its scheduled
 [run 41497602703](https://github.com/moq-dev/moq/actions/runs/41497602703).
diff --git a/quest/m0/test-flakes-2/README.md b/quest/m0/test-flakes-2/README.md
index 9b68a967706..ebde3f4b9e0 100644
--- a/quest/m0/test-flakes-2/README.md
+++ b/quest/m0/test-flakes-2/README.md
@@ -99,7 +99,7 @@ Public API: none. Wire: none.
 
 ## Required
 
-- [IETF22 fallback](/quest/m0/test-flakes-2/ietf22-fallback.md) - an IETF22 browser viewer follows a fallback within the media lane's bound, keeping its session and its audio
+- [Fallback playback](/quest/m0/test-flakes-2/ietf22-fallback.md) - a browser viewer follows a fallback within the media lane's bound without dropping its session
 - [moq-gst's interleaved restart test passes under load](/quest/m0/test-flakes-2/gst-reconnect-interleave.md) - `restarts_under_reconnects_interleave_on_one_pad` passes in loaded runs and the merge queue, its missed delivery and its stray `Eos` each fixed at the cause
 - [reload.test.ts's close-drain tests pass under load](/quest/m0/test-flakes-2/reload-close-drain.md) - the drain cases in `js/net`'s reload tests pass in loaded multi-file runs
 - [dispatch-query's terminate test survives load](/quest/m0/test-flakes-2/dispatch-query-terminate.md) - `test_terminating_the_run_stops_the_running_phase` passes reliably under host load, re-enabled once fixed
diff --git a/quest/m0/test-flakes-2/ietf22-fallback.md b/quest/m0/test-flakes-2/ietf22-fallback.md
index e7d5fc0b962..728c9cd16b7 100644
--- a/quest/m0/test-flakes-2/ietf22-fallback.md
+++ b/quest/m0/test-flakes-2/ietf22-fallback.md
@@ -1,72 +1,39 @@
-# [M] The IETF22 viewer follows a fallback without dropping or stalling
+# [S] The browser viewer follows a fallback without dropping its session
 
 ## Goal
 
 When the newest of two live publishers withdraws, a browser `@moq/watch`
-viewer on moq-transport-22 or moq-lite plays the still-live
-older run within the media lane's derived 1039 ms bound. It keeps its session, and its audio resumes
-with its video. Both failures are fixed at their cause once one recurs with
-enough evidence to reproduce it deterministically.
+viewer on moq-transport-22 or moq-lite keeps its session and plays the
+still-live older run within the media lane's derived 1039 ms bound. The
+session drop is fixed at its cause once it recurs with enough evidence to
+reproduce it deterministically.
 
 ## Waiting
 
-- moq-dev/moq: either failure recurs with enough evidence to isolate a
-  deterministic cause. Advance it by running `just test media --media-cases
-  replacement --media-engines chromium` with
-  `RUST_LOG=moq_net=debug,moq_relay=debug`, and read any failure here with its
-  relay and browser logs.
+- moq-dev/moq: the session drop recurs with relay debug logs and the viewer's
+  close reason. It has not recurred since
+  [moq-dev/moq#6548](https://github.com/moq-dev/moq/pull/6548)'s IETF22 fixes;
+  clean runs do not clear this wait. Advance it by running `just test media
+  --media-cases replacement --media-engines chromium` with
+  `RUST_LOG=moq_net=debug,moq_relay=debug` (inside the dev shell, under
+  `env -u MOQ_QUEST`).
 
 ## Plan
 
-Neither failure has a known cause or a reproduction yet, so no production or
-test change is justified until one recurs.
-
-Recurrence, added 2026-11-03 (maintainer, /quest-plan of the follow-ups from
-[moq-dev/moq#7667](https://github.com/moq-dev/moq/pull/7667)): Nightly's
-Firefox media job failed `live incumbent fallback plays` on two consecutive
-nights with the audio-stall symptom (`audioStalled:true, audioTimestamp:0`
-after the fallback), on `old-moq-lite-07-wip`:
-[2026-11-02](https://github.com/moq-dev/moq/actions/runs/41483654426/job/125408204778)
-and
-[2026-11-03](https://github.com/moq-dev/moq/actions/runs/41656613559/job/125988510133).
-[moq-dev/moq#7716](https://github.com/moq-dev/moq/pull/7716) found it
-separate from the Firefox tone problem. Scheduled Interop runs hit the same
-stall in Chromium, also on `old-moq-lite-07-wip`:
-[41495461904](https://github.com/moq-dev/moq/actions/runs/41495461904),
-[41668668824](https://github.com/moq-dev/moq/actions/runs/41668668824), and
-[41863118968](https://github.com/moq-dev/moq/actions/runs/41863118968). Read those jobs' artifacts first. If
-they isolate the cause, the Waiting item clears. If they don't, rerun the
-Waiting section's command with `--media-engines firefox` and the same
-`RUST_LOG` filter.
-
-Two failures were seen while landing
-[moq-dev/moq#6548](https://github.com/moq-dev/moq/pull/6548), on a host at
-load average 30 to 70:
-
-- **Session drop:** 1 in 9 runs before that PR's IETF22 fixes, 0 in 37 since.
-  After the fallback NAMESPACE, the viewer restarted its subscriptions. Then the
-  relay stopped its own SUBSCRIBE_NAMESPACE stream to the viewer, and the
-  session closed. The viewer reconnected and played the older run, but only
-  after the bound. Relay debug logging was off for that run, so it cannot say
-  whether the relay closed over a violation or the session closed cleanly. The
-  viewer's reconnect warning now names the close reason; start there.
-- **Audio stall:** 1 in 37 runs. The viewer painted the older run, and the
-  relay served the older run's audio groups for the whole window. The page's
-  audio stayed stalled past the bound, at the newest run's last timestamp, and
-  the session stayed up.
-
-Baseline: four focused replacement runs with Chromium 156.0.8078.4 and the
-relay debug filter above passed all three protocol versions, two on 2026-10-27
-at
-[767685e1ba](https://github.com/moq-dev/moq/commit/767685e1ba0dabfd921fe8439d7f55ccf65eeedb)
-and two on 2026-10-28 at
-[487759f62a](https://github.com/moq-dev/moq/commit/487759f62a9ef39d916fe5b92df06dcff83478ce).
-IETF22 replaced in 176, 186, 191, and 94 ms and fell back in 206, 209, 326,
-and 228 ms, with audio resumed in sync and the incumbent identity preserved.
-In the 2026-10-28 runs, the relay debug log showed one IETF22 viewer
-connection throughout, resubscribing to the incumbent epoch after the fallback
-NAMESPACE and closing only at teardown after grading. Neither failure
-recurred. None of these runs recreated the original host load of 30 to 70, so
-they are a baseline, not evidence that either failure is fixed.
+**Session drop:** seen 1 in 9 runs before
+[moq-dev/moq#6548](https://github.com/moq-dev/moq/pull/6548)'s IETF22 fixes
+(host load average 30 to 70), 0 in 37 since. After the fallback NAMESPACE, the
+viewer restarted its subscriptions. Then the relay stopped its own
+SUBSCRIBE_NAMESPACE stream to the viewer, and the session closed. The viewer
+reconnected and played the older run, but only after the bound. Relay debug
+logging was off for that run, so it cannot say whether the relay closed over a
+violation or the session closed cleanly. The viewer's reconnect warning now
+names the close reason; start there.
+
+The audio stall that shared this quest was fixed in
+[moq-dev/moq#7656](https://github.com/moq-dev/moq/pull/7656): on-demand audio
+encoders replayed all PCM retained while unsubscribed, ignoring the demand's
+max delay, so a rejoining live viewer drained seconds of stale groups before
+audio resumed.
 
 Public API: none expected. Wire: none expected.
diff --git a/rs/moq-audio/src/encode/backlog.rs b/rs/moq-audio/src/encode/backlog.rs
index 25d76492e76..f840671ee8d 100644
--- a/rs/moq-audio/src/encode/backlog.rs
+++ b/rs/moq-audio/src/encode/backlog.rs
@@ -46,7 +46,18 @@ impl Backlog {
 	}
 
 	pub fn expire(&mut self, now: Timestamp) {
-		while self.deadline().is_some_and(|deadline| deadline <= Duration::from(now)) {
+		self.expire_within(now, self.retention);
+	}
+
+	/// [`expire`](Self::expire), also dropping what a subscriber `budget` behind the live edge
+	/// would find stale.
+	pub fn expire_within(&mut self, now: Timestamp, budget: Duration) {
+		let age = budget.min(self.retention);
+		while self
+			.frames
+			.front()
+			.is_some_and(|first| Duration::from(first.end).saturating_add(age) <= Duration::from(now))
+		{
 			self.evict();
 		}
 	}
@@ -57,6 +68,7 @@ impl Backlog {
 		Duration::from(end).saturating_add(self.retention) <= Duration::from(now)
 	}
 
+	#[cfg(any(feature = "capture", test))]
 	pub fn deadline(&self) -> Option<Duration> {
 		Some(Duration::from(self.frames.front()?.end).saturating_add(self.retention))
 	}
diff --git a/rs/moq-audio/src/encode/capture.rs b/rs/moq-audio/src/encode/capture.rs
index 847f7708a8d..4784593ccbd 100644
--- a/rs/moq-audio/src/encode/capture.rs
+++ b/rs/moq-audio/src/encode/capture.rs
@@ -844,8 +844,11 @@ mod tests {
 		}
 	}
 
-	async fn subscribe(broadcast: &moq_net::broadcast::Consumer) -> Track<Wire> {
-		let subscriber = broadcast.track("audio").unwrap().subscribe(None).await.unwrap();
+	/// Subscribe with a `max` delay, which bounds how much retained history the encoder replays.
+	async fn subscribe(broadcast: &moq_net::broadcast::Consumer, max: Duration) -> Track<Wire> {
+		let subscription =
+			moq_net::track::Subscription::default().with_delay(moq_net::track::Delay::default().with_max(max));
+		let subscriber = broadcast.track("audio").unwrap().subscribe(subscription).await.unwrap();
 		Track::new(subscriber, Wire(Kind::Audio))
 	}
 
@@ -999,7 +1002,7 @@ mod tests {
 				mix(960);
 				let capture_task = tokio::task::spawn_local(capture.run());
 				let encode_task = tokio::spawn(driver.run());
-				let mut track = subscribe(&broadcast).await;
+				let mut track = subscribe(&broadcast, Duration::ZERO).await;
 				for (index, gap) in [false, true, false].into_iter().enumerate() {
 					let captured = epoch + Duration::from_millis([100, 200, 220][index]);
 					let value = (index + 1) as f32 / 8.0;
@@ -1109,7 +1112,7 @@ mod tests {
 				samples.try_push(Ok(block)).unwrap();
 				observer.read().await.unwrap();
 				tokio::task::yield_now().await;
-				let mut track = subscribe(&broadcast).await;
+				let mut track = subscribe(&broadcast, Duration::from_secs(30)).await;
 				let encoded = packet(&mut track).await;
 				assert_eq!(encoded.timestamp.as_micros(), 100_000);
 				control.stop();
@@ -1166,7 +1169,7 @@ mod tests {
 						// Past the track's 30 s max_age.
 						tokio::time::advance(Duration::from_secs(31)).await;
 					}
-					let mut track = subscribe(&broadcast).await;
+					let mut track = subscribe(&broadcast, Duration::from_secs(30)).await;
 					if expire {
 						// Only fresh capture after a restart reaches the subscriber.
 						control.start();
@@ -1224,7 +1227,7 @@ mod tests {
 					assert!(!control.is_finished());
 					control.start();
 					let track = if subscribe_late {
-						let mut track = subscribe(&broadcast).await;
+						let mut track = subscribe(&broadcast, Duration::from_secs(30)).await;
 						assert_eq!(packet(&mut track).await.timestamp.as_micros(), 100_000);
 						Some(track)
 					} else {
@@ -1270,7 +1273,7 @@ mod tests {
 				let mut observer = capture.consume();
 				let capture_task = tokio::task::spawn_local(capture.run());
 				let encode_task = tokio::spawn(driver.run());
-				let mut track = subscribe(&broadcast).await;
+				let mut track = subscribe(&broadcast, Duration::ZERO).await;
 				// The original consumer is still selected and encoding.
 				let mut block = Samples::plain(vec![0.25; 1920], false);
 				block.captured = Some(epoch + Duration::from_millis(100));
@@ -1305,7 +1308,7 @@ mod tests {
 					let mut observer = replacement.consume();
 					let capture_task = tokio::task::spawn_local(replacement.run());
 					let encode_task = tokio::spawn(driver.run());
-					let mut track = subscribe(&broadcast).await;
+					let mut track = subscribe(&broadcast, Duration::ZERO).await;
 					// The replacement starts at live capture, so let the driver select it first.
 					status(&mut control, Status::Live).await;
 					// Ten whole 10 ms resampler chunks plus a partial one.
@@ -1376,7 +1379,7 @@ mod tests {
 	#[tokio::test(start_paused = true)]
 	async fn dropping_an_unfinished_driver_cancels_its_track() {
 		let Fixture { driver, broadcast, .. } = fixture(false);
-		let mut track = subscribe(&broadcast).await;
+		let mut track = subscribe(&broadcast, Duration::ZERO).await;
 		drop(driver);
 		let error = track.read().await.unwrap_err();
 		assert!(format!("{error:?}").contains("Cancel"), "{error:?}");
@@ -1399,7 +1402,7 @@ mod tests {
 					let mut observer = capture.consume();
 					let capture_task = tokio::task::spawn_local(capture.run());
 					let encode_task = tokio::spawn(driver.run());
-					let mut track = subscribe(&broadcast).await;
+					let mut track = subscribe(&broadcast, Duration::ZERO).await;
 					let now = Instant::now();
 					let (captured, expected) = match placement {
 						0 => (Some(now - Duration::from_millis(40)), 960_000),
diff --git a/rs/moq-audio/src/encode/producer.rs b/rs/moq-audio/src/encode/producer.rs
index d49c6ccb120..e06b4881870 100644
--- a/rs/moq-audio/src/encode/producer.rs
+++ b/rs/moq-audio/src/encode/producer.rs
@@ -468,6 +468,11 @@ impl Producer {
 	#[cfg(any(feature = "capture", test))]
 	pub(crate) fn set_active(&mut self, active: bool, now: Timestamp) -> Result<(), Error> {
 		self.backlog.expire(now);
+		// Replayed groups land as fresh arrivals, so only this cut keeps a rejoining live
+		// subscriber from receiving all the retained audio before the live edge.
+		if active && let Some(budget) = self.track.track().subscription().and_then(|sub| sub.delay.max) {
+			self.backlog.expire_within(now, budget);
+		}
 		// Live input completes the partial frame within one codec frame, so only idle refreshes expire it.
 		if !active {
 			self.expire_partial(now)?;
@@ -884,6 +889,49 @@ mod tests {
 		producer.finish().unwrap();
 	}
 
+	/// Replayed groups reach the track as fresh arrivals, so only the encoder can tell they are old:
+	/// a live viewer rejoining after seconds idle would otherwise receive all of them first.
+	#[tokio::test(start_paused = true)]
+	async fn demand_replays_only_the_history_its_max_delay_wants() {
+		let input = Input::default();
+		let options = Options {
+			track: Some("audio".into()),
+			config: Config::from_input(super::super::Codec::Pcm, &input),
+			..Options::default()
+		};
+		let mut broadcast = moq_net::broadcast::Info::new().produce();
+		let consumer = broadcast.consume();
+		let catalog = moq_mux::catalog::Producer::new(&mut broadcast, moq_mux::catalog::Config::default()).unwrap();
+		let mut producer = Producer::new(&mut broadcast, catalog, input, &options).unwrap();
+		let at = |index: u64| Timestamp::from_micros(1_000_000 + index * 20_000).unwrap();
+		producer.set_active(false, at(0)).unwrap();
+		for index in 0..150 {
+			producer
+				.write(&pcm_frame(&vec![index as f32; 1920], at(index).as_micros() as u64))
+				.unwrap();
+		}
+		let track = consumer
+			.track("audio")
+			.unwrap()
+			.subscribe(
+				moq_net::track::Subscription::default()
+					.with_delay(moq_net::track::Delay::default().with_max(Duration::from_millis(130))),
+			)
+			.await
+			.unwrap();
+		let mut reader =
+			moq_mux::container::Consumer::new(track, moq_mux::container::legacy::Wire(moq_mux::container::Kind::Audio));
+		// One replay turn, read at once as a network subscriber is served: the group it wrote is
+		// the newest the track holds, so the subscriber's own budget cannot judge it stale.
+		producer.set_active(true, at(150)).unwrap();
+		// A 130 ms budget at frame 150 still wants the frames ending after it: 143 onward.
+		let Some(moq_mux::container::Read::Frame { frame, .. }) = reader.read().await.unwrap() else {
+			panic!("expected a replayed frame");
+		};
+		assert_eq!(frame.timestamp, at(143));
+		producer.finish().unwrap();
+	}
+
 	/// Replay catches up behind the live edge another track already reached; advertising that as
 	/// delay would buffer playback by the replayed history for the rest of the broadcast.
 	#[tokio::test(start_paused = true)]

From b67b1daf3d60b14168dc150d2ffddab224571534 Mon Sep 17 00:00:00 2001
From: Luke Curley <kixelated@gmail.com>
Date: Fri, 6 Nov 2026 00:23:27 +0000
Subject: [PATCH 31/36] bench: calibrate the paired Nightly comparison from A/A
 and slowed-bench runs (#7928)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: GPT-6.1 Sol <noreply@openai.com>
---
 .github/workflows/nightly.yml |   5 +-
 bench/README.md               |  26 +++-
 bench/compare.py              |   3 +-
 quest/m1/README.md            |   2 +-
 quest/m1/bench-ci.md          | 215 ++++++++++++++++++----------------
 5 files changed, 146 insertions(+), 105 deletions(-)

diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
index e66080f43de..40743a13da4 100644
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -120,12 +120,15 @@ jobs:
             artifact-path: target/bench/nightly/rust-bench
             benchmark: true
             paired: true
+          # Report-only until quest/m1/bench-ci.md fixes the build bias behind
+          # an A/A false alarm; the site still lists its confirmed regressions.
           - name: Rust shared bench targets
             recipe: gh nightly rust-shared
             artifact: bench-rust-shared
             artifact-path: target/bench/nightly/rust-shared
             benchmark: true
             paired: true
+            report-only: true
           - name: Relay session benchmarks
             recipe: gh nightly rust-relay
             artifact: bench-rust-relay
@@ -235,7 +238,7 @@ jobs:
       # After the upload, so the benchmark site still records tonight's history and
       # publishes the comparison that failed this job before the alert links to it.
       - name: Fail on paired regressions
-        if: ${{ matrix.paired && steps.workload.outcome == 'success' }}
+        if: ${{ matrix.paired && !matrix.report-only && steps.workload.outcome == 'success' }}
         run: nix develop --command just gh benchmark-report gate "${{ matrix.artifact-path }}"
 
   # gh-pages is the one Pages site, and each directory has one writer: this job owns
diff --git a/bench/README.md b/bench/README.md
index 25f0f1a07cb..bfd2e52b806 100644
--- a/bench/README.md
+++ b/bench/README.md
@@ -890,8 +890,8 @@ the table requires no new renderer or data branch. A source's `paired.json`, as
 
 ### Paired comparison
 
-Each Nightly's Rust bench groups (`rust-bench`, `rust-shared`, `rust-extra` and
-`rust-uring`) also build the previous scheduled Nightly's commit beside their
+Each Nightly's Rust bench groups (`rust-bench`, `rust-shared`, `rust-relay`,
+`rust-extra` and `rust-uring`) also build the previous scheduled Nightly's commit beside their
 own, on the same runner, so night-to-night runner variance drops out. Each
 built target runs once per side in the trend's quick mode, alternating which
 side goes first; the current side is the trend point. A case more than 10%
@@ -901,8 +901,21 @@ measurement, 30 samples). A case whose rounds are all slower with a median
 beyond 10% is a confirmed regression and fails its job after the upload, so the
 Alert workflow posts the failed Nightly. A target the base cannot build or run
 fails the job too, rather than passing uncompared; a bench target the base does
-not have yet is only reported as new. The threshold is a starting point until
-A/A runs on the hosted runner measure its noise floor.
+not have yet is only reported as new. `rust-shared` is report-only for now: its
+confirmed regressions show on the site but do not fail the job, until the
+build bias below is fixed.
+
+Runs on the hosted runner set these numbers. In four A/A runs of the
+`rust-shared`, `rust-extra` and `rust-uring` groups, and two of `rust-relay`,
+1 to 9% of cases crossed 10% either way in the screen, at most 17 of them
+slower in one group. The rounds rejected all but one:
+`wire_decode/padded/packets_64` at +12%, which read +2% in the next A/A run.
+A run whose base cut one case's work by a quarter failed with that case alone
+at +35%; its rounds also agreed, at medians of +9.3 to +9.7%, on `stats/tick`
+cases whose source was identical on both sides. Separate builds of the same
+source can measure up to 12% apart, so the threshold cannot go lower until
+that bias is fixed.
+`rust-bench` is not calibrated yet: its paired leg outlasts its hour.
 
 The table page shows tonight's comparison above the trend: confirmed
 regressions, targets not compared, cases faster in the screen, slowdowns the
@@ -923,6 +936,11 @@ Each run's evidence directory keeps both builds' estimates (`criterion` and
 `paired.json`. The base build streams its diagnostics and retains them in
 `base-build.log`, including when it fails.
 
+Each revision builds in its own Cargo target directory (`base` and `current`
+under `CARGO_TARGET_DIR`, default `target/bench`). For an A/B comparison, use
+`run.sh`'s `BENCH_BASE` mode or a target directory per source tree: two trees
+sharing one can leave a bench linked against the other tree's library.
+
 ### CodSpeed
 
 The CodSpeed workflow adds instruction counts for every `main` commit that
diff --git a/bench/compare.py b/bench/compare.py
index 9f5b66f6786..82d2c634010 100644
--- a/bench/compare.py
+++ b/bench/compare.py
@@ -157,7 +157,8 @@ def criterion_baseline(directory, discovery, benchmark):
 
 
 # A paired case beyond this change is flagged, and fails the nightly only when its rounds agree.
-# Loose until A/A runs on the hosted runner measure its noise floor.
+# Separate builds of unchanged code measured up to 12% apart in A/A runs, so lowering this
+# waits on fixing that bias (quest/m1/bench-ci.md).
 THRESHOLD_PCT = 10
 # Each alternating round costs seconds per case, so a noisy night confirms only its worst slowdowns.
 CONFIRMATIONS = 20
diff --git a/quest/m1/README.md b/quest/m1/README.md
index da9ea166324..33ae4dad45a 100644
--- a/quest/m1/README.md
+++ b/quest/m1/README.md
@@ -175,7 +175,7 @@ quests that require them.
 - [WebGPU on Safari](/quest/m1/webgpu-safari.md) - the WebGPU renderer is verified on Safari 26 for macOS and iOS
 - [Remove the moq-e2ee stub](/quest/m1/moq-e2ee-remove.md) - `rs/moq-e2ee` leaves the workspace and release config now that its final release points to moq-crypto
 - [Main is no slower than release](/quest/m1/release-perf/README.md) - every benchmark where main is slower than release is fixed or accepted with a reason, checked by a final paired run before the cut
-- [Calibrate the paired nightly benchmarks](/quest/m1/bench-ci.md) - A/A and deliberately slowed Nightly runs set the paired comparison's threshold, so its regression alerts can be trusted
+- [Calibrate the paired nightly benchmarks](/quest/m1/bench-ci.md) - `rust-bench` fits its hour and gets A/A runs, and separate builds of unchanged code stop measuring as a slowdown, so every paired regression alert can be trusted
 - [moq-json's table/deltas bench measures the same work every iteration](/quest/m1/bench-json-deltas.md) - the `table/deltas/1%` cases stop flipping between snapshot and delta timings, so their trend history is usable
 - [Publish moq-bench to crates.io](/quest/m1/bench-publish.md) - `cargo install moq-bench` installs one binary, with the host sampler as `moq-bench host`, first as 0.1.0
 - [Unbounded groups](/quest/m1/unbounded-groups/README.md) - groups and frames lose their size caps; a group keeps a 32 MB tail, and readers behind it replay through paced flights or refresh
diff --git a/quest/m1/bench-ci.md b/quest/m1/bench-ci.md
index 79a1e73bfb6..d929625a8b6 100644
--- a/quest/m1/bench-ci.md
+++ b/quest/m1/bench-ci.md
@@ -4,79 +4,126 @@
 
 The paired Rust Criterion comparison each Nightly runs (see
 [Paired comparison](/bench/README.md#paired-comparison)) fails only on real
-regressions: its threshold, confirmation budget, and round count come from A/A
-runs on the hosted ARM runners, and a deliberately slowed bench fails the job.
-
-## Waiting
-
-- Maintainer: dispatch the slowed-bench Nightly run below. Agents never
-  dispatch Nightly; the 2026-11-04 authorization covered the two A/A runs only.
-- Maintainer: authorize one more A/A Nightly run for the moq-net
-  (`bench-rust`) and `bench-rust-relay` groups, now that
-  [moq-dev/moq#7940](https://github.com/moq-dev/moq/pull/7940) lets moq-net's
-  benches run to completion.
-  Neither group produced a `paired.json` in either 2026-11-04 run, because
-  their benches panic. Check: both groups' `paired.json` exist in that run.
+regressions in every paired group: `rust-bench` finishes its paired leg within
+its hour and A/A runs on the hosted ARM runners hold its threshold,
+confirmation budget, and round count, and separate builds of unchanged code
+stop measuring as a stable slowdown, so `rust-shared`'s gate fails Nightly
+again.
 
 ## Plan
 
-A/A results, 2026-11-04 (/quest-unblock): runs
-[41921320690](https://github.com/moq-dev/moq/actions/runs/41921320690) and
-[41933525520](https://github.com/moq-dev/moq/actions/runs/41933525520) both
-produced `paired.json` for the shared, extra, and uring groups. The first was
-cancelled by Nightly's concurrency group after its bench artifacts uploaded.
-At a 10% threshold over 3 rounds, neither run confirmed a regression: every
-case the 20-case confirmation budget (`CONFIRMATIONS`) reached came back as
-noise. Single-pass crossings: shared 18 and 26 of 716, extra 10 and 15 of 460,
-uring 1 and 1 of 41, so the second run left 6 shared cases `unconfirmed`. |delta| p95 was
-3.7-8.3%, p99 10-23%. Tune the threshold for those groups from these.
-
-Decided 2026-11-04 (maintainer, /quest-unblock): ✅ authorize one-time agent
-dispatch of the two A/A Nightly runs on `main`, with `bench-base` set to each
-run's own commit. Not chosen: the maintainer dispatching them, or skipping.
-Nightly's concurrency group cancels an in-progress run, so the second is
-dispatched only after the first finishes.
-
-- A/A: dispatch Nightly on `main` with `bench-base` set to the run's own
-  commit, at least twice. Read each paired group's `paired.json` (the
-  `bench-rust*` artifacts, or `bench/paired.json` on the site): the spread of
-  screen deltas sets the screen threshold, and any confirmed regression in an
-  A/A run means the rounds or threshold are too loose.
-- Slowed bench: dispatch with `bench-base` on a branch commit that speeds up
-  one cheap bench (so tonight's `main` reads as slower), and check the job fails
-  with that case alone.
-- Tune `THRESHOLD_PCT`, `CONFIRMATIONS` (`bench/compare.py`) and the round count
-  (`BENCH_RUNTIME_ROUNDS`, default three) from what the runs show, and
-  update the README's numbers. Bimodal series (about 50% up and back across
-  nights) are the expected false positives; three alternating rounds pass one
-  only when all three land on the slow mode.
-- Check the paired legs' durations against their hour; the base build relies
-  on the mbx cache for the previous night's artifacts, and a cold one roughly
-  doubles each leg's build time.
-- Each revision in a paired comparison needs its own `CARGO_TARGET_DIR`.
-  `bench/run.sh` already splits them (`target/bench/current` and
-  `target/bench/base`); the stale artifacts while attributing
-  [moq-dev/moq#7141](https://github.com/moq-dev/moq/pull/7141), such as a bench
-  linked against the other tree's library, came from an ad-hoc A/B of two
-  source trees sharing one. Say so in `bench/README.md`'s paired section, so an
-  A/B outside `run.sh` uses its base mode or a target per tree (decided
-  2026-10-28).
-
-- Decide whether `bench/run.sh` pins glibc's malloc thresholds for every
-  Criterion target, as [moq-dev/moq#6727](https://github.com/moq-dev/moq/pull/6727)
-  did for `ts_schedule`: some small paired deltas may be the same heap mode flip.
+Decided 2026-11-05 (maintainer, after
+[moq-dev/moq#7928](https://github.com/moq-dev/moq/pull/7928)'s A/A runs):
+authorize one A/A Nightly dispatch for `rust-bench` once its paired leg fits
+its hour, for the agent that fixes its benches to dispatch straight after.
+Not chosen: asking again once it fits.
+
+Decided 2026-11-05 (maintainer, /quest-unblock): authorize two A/A Nightly
+runs and one slowed-bench run on `main` after
+[moq-dev/moq#7940](https://github.com/moq-dev/moq/pull/7940) merged,
+replacing the earlier one-run authorization. The two A/A runs below spent it;
+the slowed run was not needed, since every paired group runs the same gate
+step.
+
+Calibrated 2026-11-05 for the shared, supplemental (`rust-extra`), io_uring
+and `rust-relay` groups; `bench/README.md` records the numbers. Threshold 10%,
+20 confirmations, and 3 rounds stay as they were:
+
+- A/A runs [41921320690](https://github.com/moq-dev/moq/actions/runs/41921320690)
+  and [41933525520](https://github.com/moq-dev/moq/actions/runs/41933525520)
+  (the first cancelled by Nightly's concurrency group after its bench
+  artifacts uploaded) confirmed no regression. Screen crossings of 10% either
+  way: shared 18 and 26 of 716, supplemental 10 and 15 of 460, io_uring 1 and
+  1 of 41; at most 17 slower in one group, under the 20 confirmations. The
+  largest median among round sets that all agreed on a slowdown was +5.6%.
+- A/A runs [42102235726](https://github.com/moq-dev/moq/actions/runs/42102235726)
+  (`main` at `62ae716265`) and
+  [42119312487](https://github.com/moq-dev/moq/actions/runs/42119312487)
+  (`83d0bc46ba`), dispatched after
+  [moq-dev/moq#7940](https://github.com/moq-dev/moq/pull/7940) merged, each
+  verified with `head_sha` equal to `bench-base`. Crossings: shared 20 and 19
+  of 728, supplemental 7 and 8 of 514 and 532, io_uring 3 and 2 of 41, relay
+  15 and 37 of 410; at most 17 slower in one group. Relay confirmed nothing in
+  either run and is calibrated. The second run confirmed nothing. The first
+  failed the shared gate on `wire_decode/padded/packets_64`: screen +10.3%,
+  rounds +11.9, +12.9, +12.1%, with `padded/packets_1024` at +7.1%. The same
+  case read +2.1% in the second run and +5.4, -0.8 and +6.2% in the three
+  earlier runs.
+- Slowed-bench run
+  [41979277343](https://github.com/moq-dev/moq/actions/runs/41979277343)
+  compared `main` at `c150456928` against a base that collects 192 of
+  `pattern-algebra/collect-literal/256`'s 256 literals (branch
+  `bench-ci/slowed-base`, deleted). The shared job failed at its gate with
+  that case alone: screen +35.7%, rounds +34.6, +35.1, +35.2%. The
+  supplemental and io_uring groups passed.
+- In that run, the rounds rejected the three `stats/tick/*_10pct` cases the
+  screen flagged, but each one's rounds agreed on a slowdown, at medians of
+  +9.3 to +9.7%, and every `100pct` case screened +6 to +9%, although
+  `moq-stats` was source-identical on both sides. The same cases sat within 6%
+  either way in both earlier A/A runs. A local build of `producer_tick` at both
+  commits, in separate trees and target directories, gives byte-identical
+  `.text`, `.rodata` and `.data.rel.ro`.
+
+Find the source of that bias, then fix it in `bench/run.sh`. It moves between
+runs rather than following the source: an A/A run builds the same commit on
+both sides, yet `wire_decode/padded/packets_64` agreed on +12% in one run and
+not the next. A paired round reruns the same two binaries, so rounds cannot
+filter it. Rerun the rounds against one binary in both slots on the ARM
+runner to tell build differences from run placement. Lowering the threshold
+waits on that fix.
+
+`rust-bench` is not calibrated: its leg hit its 60-minute timeout in both
+runs, before uploading an artifact. Building both sides took 16 to 18
+minutes. The screen and rounds then ran past 40 minutes, because confirmation
+rounds reran benches whose untimed work dominates their wall time. A round
+side meant to take about 3 seconds took 2 minutes for
+`interests/covered/1000w_1000s` and 8 for
+`publisher_covered_before_start/wake/8192`: each builds its fixture in the
+`bench_function` closure outside `b.iter`, and Criterion calls that closure
+once per sample. `track_evict_fanout/512r/8` took about a minute, because its
+untimed reads run inside every iteration. Make those benches pay their setup
+once per benchmark, and bound the rounds by time if the leg still does not
+fit.
+
+A dispatch cancels any in-progress Nightly through its concurrency group, and
+the 07:00 UTC scheduled run can cancel a dispatch. Dispatch clear of that
+window, and verify that the run's `head_sha` equals `bench-base` before
+treating it as A/A evidence.
+
+Retain the earlier bias cases when reading `rust-bench`'s A/A results:
+[moq-dev/moq#7139](https://github.com/moq-dev/moq/pull/7139) found
+`moq-net/group_relay_frames/plain/*` (+23%) and
+`moq-net/origin/serve_idle/3000r` (+46%) agreed in every round despite equal
+callgrind instruction counts. `codec_messages/*/lite` (+31%, +68%) changed
+because a new bench group shifted LTO inlining.
+[moq-dev/moq#7253](https://github.com/moq-dev/moq/pull/7253) found
+`server_admission/workers=4/0` (+10%) had identical machine code apart from
+addresses. Include moq-quic's windowed `benches/streams.rs` cases too: an
+unchanged base varied 17 to 43% between back-to-back runs on a shared host
+([moq-dev/moq#6950](https://github.com/moq-dev/moq/pull/6950)).
+
+Decided 2026-11-05 (maintainer, after the A/A false alarm at +12.1%):
+`rust-shared`'s gate is report-only until the build bias is fixed, and the
+threshold stays at 10%; Nightly's `report-only` matrix flag skips its gate
+step. Restore the gate once an A/A run of the fixed harness confirms nothing.
+Not chosen: keeping the gate failing at 10% (the 2026-10-23 decision's
+default); raising the threshold to about 15%, which would hide real
+regressions of 10 to 15%.
+
+Decided 2026-11-05 (agent, recorded in
+[moq-dev/moq#7928](https://github.com/moq-dev/moq/pull/7928)): `bench/run.sh`
+does not pin glibc's malloc thresholds for every Criterion target. The largest
+A/A screen outliers (`moq-mux/containers`' `ts_si_*`, +35 to +49% in both A/A
+runs) were each rejected by rounds within a few percent, so a heap mode flip
+costs confirmation budget but no false alarm, and a harness-wide pin would
+shift every trend line and measure an allocator production does not run. A
+bench whose rounds show a mode flip pins its own heap, as `ts_schedule` does.
 
 Decided 2026-10-23 (maintainer), when the paired mode landed:
 
 - The gate fails Nightly from day one rather than reporting only until A/A
   runs: Nightly already alerts for unrelated legs, so a false paired alarm adds
   no new channel, and this quest tunes it.
-- Start at a 10% threshold, 20 confirmations per group, and 3 rounds; 10%
-  matches the trend table's floor, and three-round sign agreement filters
-  bimodal cases.
-- `rust-shared` splits out of `rust-bench`, restarting the `rust/shared/*`
-  trend history (three nights lost), since `rust-bench` paired would exceed
-  its hour unsplit.
 - A target the base cannot build or run fails the gate rather than passing
   uncompared; it clears by itself the next night.
 
@@ -84,40 +131,12 @@ Rejected hosts (decided 2026-10-22, maintainer): the merge queue runner, the
 moq.pro load nodes, and a dedicated bare-metal host; revisit the last only if
 A/A runs show the hosted noise floor hides regressions worth catching.
 
-Decided 2026-10-28 (maintainer), superseding the 2026-10-27 plan to wait for
-A/A: CodSpeed's CPU simulation runs now, on every `main` commit, as an extra
-signal beside this gate rather than a replacement (see
-[CodSpeed](/bench/README.md#codspeed)). It covers only the single-threaded
-benches without I/O, so this calibration still decides the paired gate.
-
-Observed 2026-10-28, before any A/A run: the last two scheduled Nightlies'
-gates failed with only slowdowns, and their rounds mostly agree within a few
-points. `22808bbb2` against `8810d7365` confirmed 5 (net
-retirement selection about +23%); `270395a33` against `22808bbb2` confirmed
-20 across three groups (net `codec_messages/encode/lite` +67.7%,
-`group_write_frames/batch32/*` about +45%). A one-signed, tightly agreeing
-result is either a real regression or a systematic bias between the base and
-head builds or run order, which noise would not produce; the A/A run tells
-them apart, and CodSpeed's counts for the cases it covers are a second
-opinion. If the A/A run also confirms regressions, fix that bias; if it is
-clean, bisect the reported cases and fix the regressions.
-
-The A/A calibration includes moq-quic's windowed `benches/streams.rs` cases:
-on a shared host the unchanged base alone varied 17 to 43% between
-back-to-back runs ([moq-dev/moq#6950](https://github.com/moq-dev/moq/pull/6950)).
-
-Confirmed regressions with no extra work behind them, found by
-[moq-dev/moq#7139](https://github.com/moq-dev/moq/pull/7139): every round of
-`moq-net/group_relay_frames/plain/*` (+23%) and `moq-net/origin/serve_idle/3000r`
-(+46%) agreed, yet callgrind counts the same instructions per frame read and per
-poll on both builds. A paired round reruns the same two binaries, so a code or
-heap layout shift between them reads as a stable regression that rounds cannot
-filter. `codec_messages/*/lite` (+31%, +68%) moved only because a new bench group
-in the same binary changed what LTO inlines.
-[moq-dev/moq#7253](https://github.com/moq-dev/moq/pull/7253) found a third:
-`server_admission/workers=4/0` (+10%) runs machine code identical apart from
-addresses on both builds of the 2026-10-27 pair. The other four 2026-10-27 cases
-were real, and were fixed or accepted there.
+Decided 2026-10-28 (maintainer): CodSpeed's CPU simulation runs on every
+`main` push that touches Rust, Cargo, or Nix files, as an extra signal beside
+this gate rather than a replacement
+(see [CodSpeed](/bench/README.md#codspeed)). It covers only the
+single-threaded benches without I/O, so this calibration still decides the
+paired gate.
 
 ## Related
 

From 5480d5109f59f52f1b98668fff5a90be454060f4 Mon Sep 17 00:00:00 2001
From: Luke Curley <kixelated@gmail.com>
Date: Fri, 6 Nov 2026 00:23:46 +0000
Subject: [PATCH 32/36] feat(ffi)!: expose socket endpoints and preserve IETF
 starts (#7883)

Co-authored-by: GPT-6.1 Sol <noreply@openai.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: pullfrog[bot] <226033991+pullfrog[bot]@users.noreply.github.com>
Co-authored-by: moq-bot <moq-bot@users.noreply.github.com>
---
 bench/README.md                               |    9 +
 c/moq/MIGRATE.md                              |    4 +
 cpp/moq/MIGRATE.md                            |    6 +
 dart/moq/MIGRATE.md                           |    6 +
 dart/moq/lib/socket.dart                      |   19 +
 dart/moq_ffi/lib/src/moq.dart                 | 1283 +++++++++++++++--
 doc/concept/socket.md                         |   17 +-
 doc/concept/standard.md                       |    2 +-
 doc/lib/py/index.md                           |   40 +
 go/wrapper/MIGRATE.md                         |    6 +
 go/wrapper/bridge.go                          |    7 +
 go/wrapper/internal/bridge/handles.go         |   13 +
 go/wrapper/publish.go                         |   13 +-
 go/wrapper/socket/socket.go                   |  160 ++
 js/net/MIGRATE.md                             |   10 +
 js/net/src/ietf/filter.test.ts                |   44 +-
 js/net/src/ietf/join.test.ts                  |   24 +-
 js/net/src/ietf/publisher.test.ts             |   49 +-
 js/net/src/ietf/publisher.ts                  |   26 +-
 js/net/src/ietf/subscribe.ts                  |   22 +-
 js/net/src/ietf/subscriber.test.ts            |  161 +++
 js/net/src/ietf/subscriber.ts                 |   39 +-
 kt/moq/MIGRATE.md                             |    6 +
 .../kotlin/dev/moq/socket/Socket.kt           |   16 +
 py/moq-rs/MIGRATE.md                          |    6 +
 py/moq-rs/README.md                           |   30 +
 py/moq-rs/benches/ffi.py                      |   62 +
 py/moq-rs/docs/index.md                       |   19 +
 py/moq-rs/moq/__init__.py                     |    1 +
 py/moq-rs/moq/publish.py                      |   18 +-
 py/moq-rs/moq/socket.py                       |  177 +++
 py/moq-rs/tests/test_socket.py                |  256 ++++
 quest/m0/test-flakes-2/README.md              |    1 +
 quest/m0/test-flakes-2/ietf-wider-fill.md     |   35 +
 quest/m1/socket/README.md                     |    1 -
 quest/m1/socket/carla.md                      |    1 -
 quest/m1/socket/py.md                         |   18 -
 rs/moq-cli/Cargo.toml                         |    4 +
 rs/moq-ffi/MIGRATE.md                         |    6 +
 rs/moq-ffi/src/lib.rs                         |    1 +
 rs/moq-ffi/src/producer.rs                    |   88 +-
 rs/moq-ffi/src/socket.rs                      |  439 ++++++
 rs/moq-ffi/src/test.rs                        |  248 ++++
 rs/moq-ffi/uniffi.toml                        |    1 +
 rs/moq-net/MIGRATE.md                         |   12 +
 rs/moq-net/src/ietf/publisher.rs              |  176 ++-
 rs/moq-net/src/ietf/subscriber.rs             |  278 +++-
 rs/moq-net/src/model/socket.rs                |   32 +-
 rs/moq-net/tests/integration/fetch_only.rs    |   30 +-
 rs/moq-net/tests/integration/socket.rs        |   58 +
 swift/MIGRATE.md                              |    6 +
 swift/Sources/Moq/Socket.swift                |  109 ++
 swift/Sources/Moq/Track.swift                 |   14 +-
 test/interop/README.md                        |    8 +
 test/interop/clients/python/sockets.py        |  102 ++
 test/interop/clients/rust/socket.rs           |  112 ++
 test/interop/interop.sh                       |   28 +-
 57 files changed, 4051 insertions(+), 308 deletions(-)
 create mode 100644 dart/moq/lib/socket.dart
 create mode 100644 go/wrapper/socket/socket.go
 create mode 100644 kt/moq/src/jvmAndAndroidMain/kotlin/dev/moq/socket/Socket.kt
 create mode 100644 py/moq-rs/moq/socket.py
 create mode 100644 py/moq-rs/tests/test_socket.py
 create mode 100644 quest/m0/test-flakes-2/ietf-wider-fill.md
 delete mode 100644 quest/m1/socket/py.md
 create mode 100644 rs/moq-ffi/src/socket.rs
 create mode 100644 swift/Sources/Moq/Socket.swift
 create mode 100644 test/interop/clients/python/sockets.py
 create mode 100644 test/interop/clients/rust/socket.rs

diff --git a/bench/README.md b/bench/README.md
index bfd2e52b806..122cf36296c 100644
--- a/bench/README.md
+++ b/bench/README.md
@@ -988,3 +988,12 @@ OOM kill does too, even inside a Quest scope: each worker watches `local.py`
 through a pidfd and stops once it exits. macOS has no pidfd, so there killing
 `local.py` with SIGKILL frees the lock while its workers keep measuring until
 their own gates exit, an accepted gap. Stop it with Ctrl-C or SIGTERM instead.
+
+### Python socket sessions
+
+The Python binding runner also sweeps both TCP and track sockets over 1, 4,
+and 16 accepting endpoints and 1, 4, and 16 concurrent sessions per endpoint.
+Each session sends a checked payload and finishes both halves. The
+`socket/<protocol>/endpoints=N/sessions=M` entries report complete sessions per
+second, including handshake, FFI calls, reads, and teardown. Run with
+`just py bench`; Nightly's binding lane runs the same sweep.
diff --git a/c/moq/MIGRATE.md b/c/moq/MIGRATE.md
index e12e9ed5a8d..4326d19c6d0 100644
--- a/c/moq/MIGRATE.md
+++ b/c/moq/MIGRATE.md
@@ -4,6 +4,10 @@ How to update your code for each breaking change, newest first.
 
 ## Unreleased
 
+### Socket sessions
+
+The generated socket endpoint, incoming dial, and stream handles now expose TCP group halves and reliably subscribed track halves beside origin. Regenerate bindings and rebuild the matching native library together. Existing callers need no migration. Socket endpoints require lite-07 or moq-transport on every hop; there is no wire change.
+
 ### Publishing goes through one `moq_route` handle
 
 `moq_origin_producer_create_broadcast(origin, path, &publication)` is `moq_origin_producer_route(origin, path, &options, &route)`, and `moq_origin_producer_requests(origin, prefix, &requests)` is `moq_origin_producer_route_prefix(origin, prefix, &options, &route)`; start `options` from `moq_route_options_default()`. A `moq_route` replaces `moq_publication`, `moq_origin_requests`, and `moq_broadcast_prepared`:
diff --git a/cpp/moq/MIGRATE.md b/cpp/moq/MIGRATE.md
index b915c08031a..7850dce4479 100644
--- a/cpp/moq/MIGRATE.md
+++ b/cpp/moq/MIGRATE.md
@@ -2,6 +2,12 @@
 
 ## Unreleased
 
+### Socket sessions
+
+The generated SocketEndpoint, SocketIncomingTcp, SocketIncomingTrack, SocketTcpStream, and SocketTrackStream handles now expose TCP group halves and reliably subscribed track halves beside origin. Regenerate bindings and rebuild the matching native library together. Existing callers need no migration. Socket endpoints require lite-07 or moq-transport on every hop; there is no wire change.
+
+`moq::GroupProducer::ready(size)` is a new async call that completes once a frame of `size` bytes fits a window ahead of the fastest reader. `co_await` it before each `write_frame` so the writer waits for its fastest reader instead of evicting it, though not for slower readers; a TCP socket stream's producer needs it to behave like TCP. Existing writers are unchanged.
+
 ### `Following::available()` reports the path going offline ([#7678](https://github.com/moq-dev/moq/pull/7678))
 
 `moq::Following::available()` resolves to a null `std::shared_ptr<moq::BroadcastConsumer>` once the path goes offline (or, for a follow pinned to an instance, once another instance takes it over), then the next broadcast when something serves the path again. The first call is never null. Check for null before using a later result, and treat it like the previous instance ending.
diff --git a/dart/moq/MIGRATE.md b/dart/moq/MIGRATE.md
index ea8860a333e..1a37f827737 100644
--- a/dart/moq/MIGRATE.md
+++ b/dart/moq/MIGRATE.md
@@ -4,6 +4,12 @@ How to update your code for each breaking change, newest first.
 
 ## Unreleased
 
+### Socket sessions
+
+package:moq/socket.dart now exposes TCP group halves and reliably subscribed track halves beside origin. Regenerate bindings and rebuild the matching native library together. Existing callers need no migration. Socket endpoints require lite-07 or moq-transport on every hop; there is no wire change.
+
+`GroupProducer.ready(size)` is a new `Future` that completes once a frame of `size` bytes fits a window ahead of the fastest reader. Await it before each `writeFrame` so the writer waits for its fastest reader instead of evicting it, though not for slower readers; a TCP socket stream's producer needs it to behave like TCP. Existing writers are unchanged.
+
 ### `Following.available()` returns null once the path goes offline
 
 `await following.available()` returns `BroadcastConsumer?`.
diff --git a/dart/moq/lib/socket.dart b/dart/moq/lib/socket.dart
new file mode 100644
index 00000000000..b815734f4da
--- /dev/null
+++ b/dart/moq/lib/socket.dart
@@ -0,0 +1,19 @@
+/// Point-to-point socket endpoints and sessions.
+library;
+
+import 'package:moq_ffi/moq_ffi.dart';
+
+/// Announces one hidden endpoint and dials or accepts sessions.
+typedef Endpoint = MoqSocketEndpoint;
+
+/// An incoming TCP dial, consumed by accepting or rejecting it.
+typedef IncomingTcp = MoqSocketIncomingTcp;
+
+/// An incoming track dial, consumed by accepting or rejecting it.
+typedef IncomingTrack = MoqSocketIncomingTrack;
+
+/// A TCP session with group producer and consumer halves.
+typedef TcpStream = MoqSocketTcpStream;
+
+/// A track session with producer and reliably subscribed consumer halves.
+typedef TrackStream = MoqSocketTrackStream;
diff --git a/dart/moq_ffi/lib/src/moq.dart b/dart/moq_ffi/lib/src/moq.dart
index 8dd3c33eb30..c3864781f9b 100644
--- a/dart/moq_ffi/lib/src/moq.dart
+++ b/dart/moq_ffi/lib/src/moq.dart
@@ -14302,6 +14302,7 @@ abstract class MoqGroupProducerInterface {
   void abort({required int errorCode});
   MoqGroupConsumer consume();
   void finish();
+  UniffiRustFuture<void> ready({required int size});
   int sequence();
   void writeFrame({required MoqFrame frame});
 }
@@ -14373,6 +14374,21 @@ class MoqGroupProducer implements MoqGroupProducerInterface {
     }, moqExceptionErrorHandler);
   }
 
+  UniffiRustFuture<void> ready({required int size}) {
+    return uniffiRustCallAsync(
+      () => uniffi_moq_ffi_fn_method_moqgroupproducer_ready(
+        uniffiClonePointer(),
+        FfiConverterUInt64.lower(size),
+      ),
+      ffi_moq_ffi_rust_future_poll_void,
+      ffi_moq_ffi_rust_future_complete_void,
+      ffi_moq_ffi_rust_future_cancel_void,
+      ffi_moq_ffi_rust_future_free_void,
+      (_) {},
+      moqExceptionErrorHandler,
+    );
+  }
+
   int sequence() {
     return rustCallWithLifter(
       (status) => uniffi_moq_ffi_fn_method_moqgroupproducer_sequence(
@@ -15496,37 +15512,698 @@ class MoqTokens implements MoqTokensInterface {
     );
   }
 
-  void set_({required List<String> tokens}) {
-    return rustCall((status) {
-      uniffi_moq_ffi_fn_method_moqtokens_set(
+  void set_({required List<String> tokens}) {
+    return rustCall((status) {
+      uniffi_moq_ffi_fn_method_moqtokens_set(
+        uniffiClonePointer(),
+        FfiConverterSequenceString.lower(tokens),
+        status,
+      );
+    }, moqExceptionErrorHandler);
+  }
+}
+
+class FfiConverterMoqTokens {
+  static MoqTokens lift(Pointer<Void> ptr) {
+    return MoqTokens.lift(ptr);
+  }
+
+  static Pointer<Void> lower(MoqTokens value) {
+    return value.uniffiClonePointer();
+  }
+
+  static int allocationSize(MoqTokens value) {
+    return 8;
+  }
+
+  static LiftRetVal<MoqTokens> read(Uint8List buf) {
+    final handle = buf.buffer.asByteData(buf.offsetInBytes).getInt64(0);
+    final pointer = Pointer<Void>.fromAddress(handle);
+    return LiftRetVal(MoqTokens.lift(pointer), 8);
+  }
+
+  static int write(MoqTokens value, Uint8List buf) {
+    final handle = lower(value);
+    buf.buffer.asByteData(buf.offsetInBytes).setInt64(0, handle.address);
+    return 8;
+  }
+}
+
+abstract class MoqSocketEndpointInterface {
+  UniffiRustFuture<MoqSocketIncomingTcp> acceptTcp();
+  UniffiRustFuture<MoqSocketIncomingTrack> acceptTrack();
+  void close();
+  UniffiRustFuture<MoqSocketTcpStream> dialTcp({required String peer});
+  UniffiRustFuture<MoqSocketTrackStream> dialTrack({
+    required String peer,
+    required MoqTrackInfo? info,
+  });
+  String id();
+  String prefix();
+}
+
+final _MoqSocketEndpointFinalizer = Finalizer<Pointer<Void>>((ptr) {
+  rustCall((status) => uniffi_moq_ffi_fn_free_moqsocketendpoint(ptr, status));
+});
+
+class MoqSocketEndpoint implements MoqSocketEndpointInterface {
+  late final Pointer<Void> _ptr;
+  bool _isDisposed = false;
+  MoqSocketEndpoint._(this._ptr) {
+    _MoqSocketEndpointFinalizer.attach(this, _ptr, detach: this);
+  }
+  MoqSocketEndpoint({
+    required MoqOriginProducer origin,
+    required String prefix,
+    required String id,
+  }) : _ptr = rustCall(
+         (status) => uniffi_moq_ffi_fn_constructor_moqsocketendpoint_new(
+           FfiConverterMoqOriginProducer.lower(origin),
+           FfiConverterString.lower(prefix),
+           FfiConverterString.lower(id),
+           status,
+         ),
+         moqExceptionErrorHandler,
+       ) {
+    _MoqSocketEndpointFinalizer.attach(this, _ptr, detach: this);
+  }
+  factory MoqSocketEndpoint.lift(Pointer<Void> ptr) {
+    return MoqSocketEndpoint._(ptr);
+  }
+  Pointer<Void> uniffiClonePointer() {
+    if (_isDisposed) {
+      throw StateError("Object has already been disposed");
+    }
+    return rustCall(
+      (status) => uniffi_moq_ffi_fn_clone_moqsocketendpoint(_ptr, status),
+    );
+  }
+
+  void dispose() {
+    if (_isDisposed) {
+      return;
+    }
+    final status = calloc<RustCallStatus>();
+    _isDisposed = true;
+    _MoqSocketEndpointFinalizer.detach(this);
+    try {
+      uniffi_moq_ffi_fn_free_moqsocketendpoint(_ptr, status);
+      checkCallStatus(NullRustCallStatusErrorHandler(), status);
+    } finally {
+      calloc.free(status);
+    }
+  }
+
+  UniffiRustFuture<MoqSocketIncomingTcp> acceptTcp() {
+    return uniffiRustCallAsync(
+      () => uniffi_moq_ffi_fn_method_moqsocketendpoint_accept_tcp(
+        uniffiClonePointer(),
+      ),
+      ffi_moq_ffi_rust_future_poll_u64,
+      ffi_moq_ffi_rust_future_complete_u64,
+      ffi_moq_ffi_rust_future_cancel_u64,
+      ffi_moq_ffi_rust_future_free_u64,
+      (ptr) =>
+          FfiConverterMoqSocketIncomingTcp.lift(Pointer<Void>.fromAddress(ptr)),
+      moqExceptionErrorHandler,
+    );
+  }
+
+  UniffiRustFuture<MoqSocketIncomingTrack> acceptTrack() {
+    return uniffiRustCallAsync(
+      () => uniffi_moq_ffi_fn_method_moqsocketendpoint_accept_track(
+        uniffiClonePointer(),
+      ),
+      ffi_moq_ffi_rust_future_poll_u64,
+      ffi_moq_ffi_rust_future_complete_u64,
+      ffi_moq_ffi_rust_future_cancel_u64,
+      ffi_moq_ffi_rust_future_free_u64,
+      (ptr) => FfiConverterMoqSocketIncomingTrack.lift(
+        Pointer<Void>.fromAddress(ptr),
+      ),
+      moqExceptionErrorHandler,
+    );
+  }
+
+  void close() {
+    return rustCall((status) {
+      uniffi_moq_ffi_fn_method_moqsocketendpoint_close(
+        uniffiClonePointer(),
+        status,
+      );
+    }, null);
+  }
+
+  UniffiRustFuture<MoqSocketTcpStream> dialTcp({required String peer}) {
+    return uniffiRustCallAsync(
+      () => uniffi_moq_ffi_fn_method_moqsocketendpoint_dial_tcp(
+        uniffiClonePointer(),
+        FfiConverterString.lower(peer),
+      ),
+      ffi_moq_ffi_rust_future_poll_u64,
+      ffi_moq_ffi_rust_future_complete_u64,
+      ffi_moq_ffi_rust_future_cancel_u64,
+      ffi_moq_ffi_rust_future_free_u64,
+      (ptr) =>
+          FfiConverterMoqSocketTcpStream.lift(Pointer<Void>.fromAddress(ptr)),
+      moqExceptionErrorHandler,
+    );
+  }
+
+  UniffiRustFuture<MoqSocketTrackStream> dialTrack({
+    required String peer,
+    required MoqTrackInfo? info,
+  }) {
+    return uniffiRustCallAsync(
+      () => uniffi_moq_ffi_fn_method_moqsocketendpoint_dial_track(
+        uniffiClonePointer(),
+        FfiConverterString.lower(peer),
+        FfiConverterOptionalMoqTrackInfo.lower(info),
+      ),
+      ffi_moq_ffi_rust_future_poll_u64,
+      ffi_moq_ffi_rust_future_complete_u64,
+      ffi_moq_ffi_rust_future_cancel_u64,
+      ffi_moq_ffi_rust_future_free_u64,
+      (ptr) =>
+          FfiConverterMoqSocketTrackStream.lift(Pointer<Void>.fromAddress(ptr)),
+      moqExceptionErrorHandler,
+    );
+  }
+
+  String id() {
+    return rustCallWithLifter(
+      (status) => uniffi_moq_ffi_fn_method_moqsocketendpoint_id(
+        uniffiClonePointer(),
+        status,
+      ),
+      FfiConverterString.lift,
+      null,
+    );
+  }
+
+  String prefix() {
+    return rustCallWithLifter(
+      (status) => uniffi_moq_ffi_fn_method_moqsocketendpoint_prefix(
+        uniffiClonePointer(),
+        status,
+      ),
+      FfiConverterString.lift,
+      null,
+    );
+  }
+}
+
+class FfiConverterMoqSocketEndpoint {
+  static MoqSocketEndpoint lift(Pointer<Void> ptr) {
+    return MoqSocketEndpoint.lift(ptr);
+  }
+
+  static Pointer<Void> lower(MoqSocketEndpoint value) {
+    return value.uniffiClonePointer();
+  }
+
+  static int allocationSize(MoqSocketEndpoint value) {
+    return 8;
+  }
+
+  static LiftRetVal<MoqSocketEndpoint> read(Uint8List buf) {
+    final handle = buf.buffer.asByteData(buf.offsetInBytes).getInt64(0);
+    final pointer = Pointer<Void>.fromAddress(handle);
+    return LiftRetVal(MoqSocketEndpoint.lift(pointer), 8);
+  }
+
+  static int write(MoqSocketEndpoint value, Uint8List buf) {
+    final handle = lower(value);
+    buf.buffer.asByteData(buf.offsetInBytes).setInt64(0, handle.address);
+    return 8;
+  }
+}
+
+abstract class MoqSocketIncomingTcpInterface {
+  UniffiRustFuture<MoqSocketTcpStream> accept();
+  String peer();
+  void reject();
+  String session();
+}
+
+final _MoqSocketIncomingTcpFinalizer = Finalizer<Pointer<Void>>((ptr) {
+  rustCall(
+    (status) => uniffi_moq_ffi_fn_free_moqsocketincomingtcp(ptr, status),
+  );
+});
+
+class MoqSocketIncomingTcp implements MoqSocketIncomingTcpInterface {
+  late final Pointer<Void> _ptr;
+  bool _isDisposed = false;
+  MoqSocketIncomingTcp._(this._ptr) {
+    _MoqSocketIncomingTcpFinalizer.attach(this, _ptr, detach: this);
+  }
+  factory MoqSocketIncomingTcp.lift(Pointer<Void> ptr) {
+    return MoqSocketIncomingTcp._(ptr);
+  }
+  Pointer<Void> uniffiClonePointer() {
+    if (_isDisposed) {
+      throw StateError("Object has already been disposed");
+    }
+    return rustCall(
+      (status) => uniffi_moq_ffi_fn_clone_moqsocketincomingtcp(_ptr, status),
+    );
+  }
+
+  void dispose() {
+    if (_isDisposed) {
+      return;
+    }
+    final status = calloc<RustCallStatus>();
+    _isDisposed = true;
+    _MoqSocketIncomingTcpFinalizer.detach(this);
+    try {
+      uniffi_moq_ffi_fn_free_moqsocketincomingtcp(_ptr, status);
+      checkCallStatus(NullRustCallStatusErrorHandler(), status);
+    } finally {
+      calloc.free(status);
+    }
+  }
+
+  UniffiRustFuture<MoqSocketTcpStream> accept() {
+    return uniffiRustCallAsync(
+      () => uniffi_moq_ffi_fn_method_moqsocketincomingtcp_accept(
+        uniffiClonePointer(),
+      ),
+      ffi_moq_ffi_rust_future_poll_u64,
+      ffi_moq_ffi_rust_future_complete_u64,
+      ffi_moq_ffi_rust_future_cancel_u64,
+      ffi_moq_ffi_rust_future_free_u64,
+      (ptr) =>
+          FfiConverterMoqSocketTcpStream.lift(Pointer<Void>.fromAddress(ptr)),
+      moqExceptionErrorHandler,
+    );
+  }
+
+  String peer() {
+    return rustCallWithLifter(
+      (status) => uniffi_moq_ffi_fn_method_moqsocketincomingtcp_peer(
+        uniffiClonePointer(),
+        status,
+      ),
+      FfiConverterString.lift,
+      null,
+    );
+  }
+
+  void reject() {
+    return rustCall((status) {
+      uniffi_moq_ffi_fn_method_moqsocketincomingtcp_reject(
+        uniffiClonePointer(),
+        status,
+      );
+    }, moqExceptionErrorHandler);
+  }
+
+  String session() {
+    return rustCallWithLifter(
+      (status) => uniffi_moq_ffi_fn_method_moqsocketincomingtcp_session(
+        uniffiClonePointer(),
+        status,
+      ),
+      FfiConverterString.lift,
+      null,
+    );
+  }
+}
+
+class FfiConverterMoqSocketIncomingTcp {
+  static MoqSocketIncomingTcp lift(Pointer<Void> ptr) {
+    return MoqSocketIncomingTcp.lift(ptr);
+  }
+
+  static Pointer<Void> lower(MoqSocketIncomingTcp value) {
+    return value.uniffiClonePointer();
+  }
+
+  static int allocationSize(MoqSocketIncomingTcp value) {
+    return 8;
+  }
+
+  static LiftRetVal<MoqSocketIncomingTcp> read(Uint8List buf) {
+    final handle = buf.buffer.asByteData(buf.offsetInBytes).getInt64(0);
+    final pointer = Pointer<Void>.fromAddress(handle);
+    return LiftRetVal(MoqSocketIncomingTcp.lift(pointer), 8);
+  }
+
+  static int write(MoqSocketIncomingTcp value, Uint8List buf) {
+    final handle = lower(value);
+    buf.buffer.asByteData(buf.offsetInBytes).setInt64(0, handle.address);
+    return 8;
+  }
+}
+
+abstract class MoqSocketIncomingTrackInterface {
+  UniffiRustFuture<MoqSocketTrackStream> accept({required MoqTrackInfo? info});
+  String peer();
+  void reject();
+  String session();
+}
+
+final _MoqSocketIncomingTrackFinalizer = Finalizer<Pointer<Void>>((ptr) {
+  rustCall(
+    (status) => uniffi_moq_ffi_fn_free_moqsocketincomingtrack(ptr, status),
+  );
+});
+
+class MoqSocketIncomingTrack implements MoqSocketIncomingTrackInterface {
+  late final Pointer<Void> _ptr;
+  bool _isDisposed = false;
+  MoqSocketIncomingTrack._(this._ptr) {
+    _MoqSocketIncomingTrackFinalizer.attach(this, _ptr, detach: this);
+  }
+  factory MoqSocketIncomingTrack.lift(Pointer<Void> ptr) {
+    return MoqSocketIncomingTrack._(ptr);
+  }
+  Pointer<Void> uniffiClonePointer() {
+    if (_isDisposed) {
+      throw StateError("Object has already been disposed");
+    }
+    return rustCall(
+      (status) => uniffi_moq_ffi_fn_clone_moqsocketincomingtrack(_ptr, status),
+    );
+  }
+
+  void dispose() {
+    if (_isDisposed) {
+      return;
+    }
+    final status = calloc<RustCallStatus>();
+    _isDisposed = true;
+    _MoqSocketIncomingTrackFinalizer.detach(this);
+    try {
+      uniffi_moq_ffi_fn_free_moqsocketincomingtrack(_ptr, status);
+      checkCallStatus(NullRustCallStatusErrorHandler(), status);
+    } finally {
+      calloc.free(status);
+    }
+  }
+
+  UniffiRustFuture<MoqSocketTrackStream> accept({required MoqTrackInfo? info}) {
+    return uniffiRustCallAsync(
+      () => uniffi_moq_ffi_fn_method_moqsocketincomingtrack_accept(
+        uniffiClonePointer(),
+        FfiConverterOptionalMoqTrackInfo.lower(info),
+      ),
+      ffi_moq_ffi_rust_future_poll_u64,
+      ffi_moq_ffi_rust_future_complete_u64,
+      ffi_moq_ffi_rust_future_cancel_u64,
+      ffi_moq_ffi_rust_future_free_u64,
+      (ptr) =>
+          FfiConverterMoqSocketTrackStream.lift(Pointer<Void>.fromAddress(ptr)),
+      moqExceptionErrorHandler,
+    );
+  }
+
+  String peer() {
+    return rustCallWithLifter(
+      (status) => uniffi_moq_ffi_fn_method_moqsocketincomingtrack_peer(
+        uniffiClonePointer(),
+        status,
+      ),
+      FfiConverterString.lift,
+      null,
+    );
+  }
+
+  void reject() {
+    return rustCall((status) {
+      uniffi_moq_ffi_fn_method_moqsocketincomingtrack_reject(
+        uniffiClonePointer(),
+        status,
+      );
+    }, moqExceptionErrorHandler);
+  }
+
+  String session() {
+    return rustCallWithLifter(
+      (status) => uniffi_moq_ffi_fn_method_moqsocketincomingtrack_session(
+        uniffiClonePointer(),
+        status,
+      ),
+      FfiConverterString.lift,
+      null,
+    );
+  }
+}
+
+class FfiConverterMoqSocketIncomingTrack {
+  static MoqSocketIncomingTrack lift(Pointer<Void> ptr) {
+    return MoqSocketIncomingTrack.lift(ptr);
+  }
+
+  static Pointer<Void> lower(MoqSocketIncomingTrack value) {
+    return value.uniffiClonePointer();
+  }
+
+  static int allocationSize(MoqSocketIncomingTrack value) {
+    return 8;
+  }
+
+  static LiftRetVal<MoqSocketIncomingTrack> read(Uint8List buf) {
+    final handle = buf.buffer.asByteData(buf.offsetInBytes).getInt64(0);
+    final pointer = Pointer<Void>.fromAddress(handle);
+    return LiftRetVal(MoqSocketIncomingTrack.lift(pointer), 8);
+  }
+
+  static int write(MoqSocketIncomingTrack value, Uint8List buf) {
+    final handle = lower(value);
+    buf.buffer.asByteData(buf.offsetInBytes).setInt64(0, handle.address);
+    return 8;
+  }
+}
+
+abstract class MoqSocketTcpStreamInterface {
+  MoqGroupConsumer consumer();
+  String peer();
+  MoqGroupProducer producer();
+  String session();
+}
+
+final _MoqSocketTcpStreamFinalizer = Finalizer<Pointer<Void>>((ptr) {
+  rustCall((status) => uniffi_moq_ffi_fn_free_moqsockettcpstream(ptr, status));
+});
+
+class MoqSocketTcpStream implements MoqSocketTcpStreamInterface {
+  late final Pointer<Void> _ptr;
+  bool _isDisposed = false;
+  MoqSocketTcpStream._(this._ptr) {
+    _MoqSocketTcpStreamFinalizer.attach(this, _ptr, detach: this);
+  }
+  factory MoqSocketTcpStream.lift(Pointer<Void> ptr) {
+    return MoqSocketTcpStream._(ptr);
+  }
+  Pointer<Void> uniffiClonePointer() {
+    if (_isDisposed) {
+      throw StateError("Object has already been disposed");
+    }
+    return rustCall(
+      (status) => uniffi_moq_ffi_fn_clone_moqsockettcpstream(_ptr, status),
+    );
+  }
+
+  void dispose() {
+    if (_isDisposed) {
+      return;
+    }
+    final status = calloc<RustCallStatus>();
+    _isDisposed = true;
+    _MoqSocketTcpStreamFinalizer.detach(this);
+    try {
+      uniffi_moq_ffi_fn_free_moqsockettcpstream(_ptr, status);
+      checkCallStatus(NullRustCallStatusErrorHandler(), status);
+    } finally {
+      calloc.free(status);
+    }
+  }
+
+  MoqGroupConsumer consumer() {
+    return rustCallWithLifter(
+      (status) => uniffi_moq_ffi_fn_method_moqsockettcpstream_consumer(
+        uniffiClonePointer(),
+        status,
+      ),
+      FfiConverterMoqGroupConsumer.lift,
+      null,
+    );
+  }
+
+  String peer() {
+    return rustCallWithLifter(
+      (status) => uniffi_moq_ffi_fn_method_moqsockettcpstream_peer(
+        uniffiClonePointer(),
+        status,
+      ),
+      FfiConverterString.lift,
+      null,
+    );
+  }
+
+  MoqGroupProducer producer() {
+    return rustCallWithLifter(
+      (status) => uniffi_moq_ffi_fn_method_moqsockettcpstream_producer(
+        uniffiClonePointer(),
+        status,
+      ),
+      FfiConverterMoqGroupProducer.lift,
+      null,
+    );
+  }
+
+  String session() {
+    return rustCallWithLifter(
+      (status) => uniffi_moq_ffi_fn_method_moqsockettcpstream_session(
+        uniffiClonePointer(),
+        status,
+      ),
+      FfiConverterString.lift,
+      null,
+    );
+  }
+}
+
+class FfiConverterMoqSocketTcpStream {
+  static MoqSocketTcpStream lift(Pointer<Void> ptr) {
+    return MoqSocketTcpStream.lift(ptr);
+  }
+
+  static Pointer<Void> lower(MoqSocketTcpStream value) {
+    return value.uniffiClonePointer();
+  }
+
+  static int allocationSize(MoqSocketTcpStream value) {
+    return 8;
+  }
+
+  static LiftRetVal<MoqSocketTcpStream> read(Uint8List buf) {
+    final handle = buf.buffer.asByteData(buf.offsetInBytes).getInt64(0);
+    final pointer = Pointer<Void>.fromAddress(handle);
+    return LiftRetVal(MoqSocketTcpStream.lift(pointer), 8);
+  }
+
+  static int write(MoqSocketTcpStream value, Uint8List buf) {
+    final handle = lower(value);
+    buf.buffer.asByteData(buf.offsetInBytes).setInt64(0, handle.address);
+    return 8;
+  }
+}
+
+abstract class MoqSocketTrackStreamInterface {
+  MoqTrackConsumer consumer();
+  String peer();
+  MoqTrackProducer producer();
+  String session();
+}
+
+final _MoqSocketTrackStreamFinalizer = Finalizer<Pointer<Void>>((ptr) {
+  rustCall(
+    (status) => uniffi_moq_ffi_fn_free_moqsockettrackstream(ptr, status),
+  );
+});
+
+class MoqSocketTrackStream implements MoqSocketTrackStreamInterface {
+  late final Pointer<Void> _ptr;
+  bool _isDisposed = false;
+  MoqSocketTrackStream._(this._ptr) {
+    _MoqSocketTrackStreamFinalizer.attach(this, _ptr, detach: this);
+  }
+  factory MoqSocketTrackStream.lift(Pointer<Void> ptr) {
+    return MoqSocketTrackStream._(ptr);
+  }
+  Pointer<Void> uniffiClonePointer() {
+    if (_isDisposed) {
+      throw StateError("Object has already been disposed");
+    }
+    return rustCall(
+      (status) => uniffi_moq_ffi_fn_clone_moqsockettrackstream(_ptr, status),
+    );
+  }
+
+  void dispose() {
+    if (_isDisposed) {
+      return;
+    }
+    final status = calloc<RustCallStatus>();
+    _isDisposed = true;
+    _MoqSocketTrackStreamFinalizer.detach(this);
+    try {
+      uniffi_moq_ffi_fn_free_moqsockettrackstream(_ptr, status);
+      checkCallStatus(NullRustCallStatusErrorHandler(), status);
+    } finally {
+      calloc.free(status);
+    }
+  }
+
+  MoqTrackConsumer consumer() {
+    return rustCallWithLifter(
+      (status) => uniffi_moq_ffi_fn_method_moqsockettrackstream_consumer(
+        uniffiClonePointer(),
+        status,
+      ),
+      FfiConverterMoqTrackConsumer.lift,
+      null,
+    );
+  }
+
+  String peer() {
+    return rustCallWithLifter(
+      (status) => uniffi_moq_ffi_fn_method_moqsockettrackstream_peer(
+        uniffiClonePointer(),
+        status,
+      ),
+      FfiConverterString.lift,
+      null,
+    );
+  }
+
+  MoqTrackProducer producer() {
+    return rustCallWithLifter(
+      (status) => uniffi_moq_ffi_fn_method_moqsockettrackstream_producer(
+        uniffiClonePointer(),
+        status,
+      ),
+      FfiConverterMoqTrackProducer.lift,
+      null,
+    );
+  }
+
+  String session() {
+    return rustCallWithLifter(
+      (status) => uniffi_moq_ffi_fn_method_moqsockettrackstream_session(
         uniffiClonePointer(),
-        FfiConverterSequenceString.lower(tokens),
         status,
-      );
-    }, moqExceptionErrorHandler);
+      ),
+      FfiConverterString.lift,
+      null,
+    );
   }
 }
 
-class FfiConverterMoqTokens {
-  static MoqTokens lift(Pointer<Void> ptr) {
-    return MoqTokens.lift(ptr);
+class FfiConverterMoqSocketTrackStream {
+  static MoqSocketTrackStream lift(Pointer<Void> ptr) {
+    return MoqSocketTrackStream.lift(ptr);
   }
 
-  static Pointer<Void> lower(MoqTokens value) {
+  static Pointer<Void> lower(MoqSocketTrackStream value) {
     return value.uniffiClonePointer();
   }
 
-  static int allocationSize(MoqTokens value) {
+  static int allocationSize(MoqSocketTrackStream value) {
     return 8;
   }
 
-  static LiftRetVal<MoqTokens> read(Uint8List buf) {
+  static LiftRetVal<MoqSocketTrackStream> read(Uint8List buf) {
     final handle = buf.buffer.asByteData(buf.offsetInBytes).getInt64(0);
     final pointer = Pointer<Void>.fromAddress(handle);
-    return LiftRetVal(MoqTokens.lift(pointer), 8);
+    return LiftRetVal(MoqSocketTrackStream.lift(pointer), 8);
   }
 
-  static int write(MoqTokens value, Uint8List buf) {
+  static int write(MoqSocketTrackStream value, Uint8List buf) {
     final handle = lower(value);
     buf.buffer.asByteData(buf.offsetInBytes).setInt64(0, handle.address);
     return 8;
@@ -21261,6 +21938,12 @@ external void uniffi_moq_ffi_fn_method_moqgroupproducer_finish(
   Pointer<RustCallStatus> uniffiStatus,
 );
 
+@Native<Pointer<Void> Function(Pointer<Void>, Uint64)>(assetId: _uniffiAssetId)
+external Pointer<Void> uniffi_moq_ffi_fn_method_moqgroupproducer_ready(
+  Pointer<Void> ptr,
+  int size,
+);
+
 @Native<Uint64 Function(Pointer<Void>, Pointer<RustCallStatus>)>(
   assetId: _uniffiAssetId,
 )
@@ -21523,32 +22206,268 @@ external RustBuffer uniffi_moq_ffi_fn_method_moqrequest_query(
   Pointer<RustCallStatus> uniffiStatus,
 );
 
-@Native<Pointer<Void> Function(Pointer<Void>, Uint16)>(assetId: _uniffiAssetId)
-external Pointer<Void> uniffi_moq_ffi_fn_method_moqrequest_reject(
-  Pointer<Void> ptr,
-  int code,
+@Native<Pointer<Void> Function(Pointer<Void>, Uint16)>(assetId: _uniffiAssetId)
+external Pointer<Void> uniffi_moq_ffi_fn_method_moqrequest_reject(
+  Pointer<Void> ptr,
+  int code,
+);
+
+@Native<RustBuffer Function(Pointer<Void>, Pointer<RustCallStatus>)>(
+  assetId: _uniffiAssetId,
+)
+external RustBuffer uniffi_moq_ffi_fn_method_moqrequest_transport(
+  Pointer<Void> ptr,
+  Pointer<RustCallStatus> uniffiStatus,
+);
+
+@Native<RustBuffer Function(Pointer<Void>, Pointer<RustCallStatus>)>(
+  assetId: _uniffiAssetId,
+)
+external RustBuffer uniffi_moq_ffi_fn_method_moqrequest_url(
+  Pointer<Void> ptr,
+  Pointer<RustCallStatus> uniffiStatus,
+);
+
+@Native<Pointer<Void> Function(Pointer<Void>, Pointer<RustCallStatus>)>(
+  assetId: _uniffiAssetId,
+)
+external Pointer<Void> uniffi_moq_ffi_fn_clone_moqserver(
+  Pointer<Void> handle,
+  Pointer<RustCallStatus> uniffiStatus,
+);
+
+@Native<Void Function(Pointer<Void>, Pointer<RustCallStatus>)>(
+  assetId: _uniffiAssetId,
+)
+external void uniffi_moq_ffi_fn_free_moqserver(
+  Pointer<Void> handle,
+  Pointer<RustCallStatus> uniffiStatus,
+);
+
+@Native<Pointer<Void> Function(RustBuffer, Pointer<RustCallStatus>)>(
+  assetId: _uniffiAssetId,
+)
+external Pointer<Void> uniffi_moq_ffi_fn_constructor_moqserver_new(
+  RustBuffer config,
+  Pointer<RustCallStatus> uniffiStatus,
+);
+
+@Native<Pointer<Void> Function(Pointer<Void>)>(assetId: _uniffiAssetId)
+external Pointer<Void> uniffi_moq_ffi_fn_method_moqserver_accept(
+  Pointer<Void> ptr,
+);
+
+@Native<Void Function(Pointer<Void>, Pointer<RustCallStatus>)>(
+  assetId: _uniffiAssetId,
+)
+external void uniffi_moq_ffi_fn_method_moqserver_cancel(
+  Pointer<Void> ptr,
+  Pointer<RustCallStatus> uniffiStatus,
+);
+
+@Native<RustBuffer Function(Pointer<Void>, Pointer<RustCallStatus>)>(
+  assetId: _uniffiAssetId,
+)
+external RustBuffer uniffi_moq_ffi_fn_method_moqserver_cert_fingerprints(
+  Pointer<Void> ptr,
+  Pointer<RustCallStatus> uniffiStatus,
+);
+
+@Native<Pointer<Void> Function(Pointer<Void>)>(assetId: _uniffiAssetId)
+external Pointer<Void> uniffi_moq_ffi_fn_method_moqserver_listen(
+  Pointer<Void> ptr,
+);
+
+@Native<Pointer<Void> Function(Pointer<Void>, Pointer<RustCallStatus>)>(
+  assetId: _uniffiAssetId,
+)
+external Pointer<Void> uniffi_moq_ffi_fn_clone_moqclient(
+  Pointer<Void> handle,
+  Pointer<RustCallStatus> uniffiStatus,
+);
+
+@Native<Void Function(Pointer<Void>, Pointer<RustCallStatus>)>(
+  assetId: _uniffiAssetId,
+)
+external void uniffi_moq_ffi_fn_free_moqclient(
+  Pointer<Void> handle,
+  Pointer<RustCallStatus> uniffiStatus,
+);
+
+@Native<Pointer<Void> Function(RustBuffer, Pointer<RustCallStatus>)>(
+  assetId: _uniffiAssetId,
+)
+external Pointer<Void> uniffi_moq_ffi_fn_constructor_moqclient_new(
+  RustBuffer config,
+  Pointer<RustCallStatus> uniffiStatus,
+);
+
+@Native<Void Function(Pointer<Void>, Pointer<RustCallStatus>)>(
+  assetId: _uniffiAssetId,
+)
+external void uniffi_moq_ffi_fn_method_moqclient_cancel(
+  Pointer<Void> ptr,
+  Pointer<RustCallStatus> uniffiStatus,
+);
+
+@Native<Pointer<Void> Function(Pointer<Void>, RustBuffer)>(
+  assetId: _uniffiAssetId,
+)
+external Pointer<Void> uniffi_moq_ffi_fn_method_moqclient_connect(
+  Pointer<Void> ptr,
+  RustBuffer url,
+);
+
+@Native<Pointer<Void> Function(Pointer<Void>, Pointer<RustCallStatus>)>(
+  assetId: _uniffiAssetId,
+)
+external Pointer<Void> uniffi_moq_ffi_fn_clone_moqsession(
+  Pointer<Void> handle,
+  Pointer<RustCallStatus> uniffiStatus,
+);
+
+@Native<Void Function(Pointer<Void>, Pointer<RustCallStatus>)>(
+  assetId: _uniffiAssetId,
+)
+external void uniffi_moq_ffi_fn_free_moqsession(
+  Pointer<Void> handle,
+  Pointer<RustCallStatus> uniffiStatus,
+);
+
+@Native<Pointer<Void> Function(Pointer<Void>, Pointer<RustCallStatus>)>(
+  assetId: _uniffiAssetId,
+)
+external Pointer<Void> uniffi_moq_ffi_fn_method_moqsession_allocator(
+  Pointer<Void> ptr,
+  Pointer<RustCallStatus> uniffiStatus,
+);
+
+@Native<Void Function(Pointer<Void>, Uint32, Pointer<RustCallStatus>)>(
+  assetId: _uniffiAssetId,
+)
+external void uniffi_moq_ffi_fn_method_moqsession_cancel(
+  Pointer<Void> ptr,
+  int code,
+  Pointer<RustCallStatus> uniffiStatus,
+);
+
+@Native<Pointer<Void> Function(Pointer<Void>)>(assetId: _uniffiAssetId)
+external Pointer<Void> uniffi_moq_ffi_fn_method_moqsession_closed(
+  Pointer<Void> ptr,
+);
+
+@Native<Pointer<Void> Function(Pointer<Void>, Pointer<RustCallStatus>)>(
+  assetId: _uniffiAssetId,
+)
+external Pointer<Void> uniffi_moq_ffi_fn_method_moqsession_consume(
+  Pointer<Void> ptr,
+  Pointer<RustCallStatus> uniffiStatus,
+);
+
+@Native<Pointer<Void> Function(Pointer<Void>, Pointer<RustCallStatus>)>(
+  assetId: _uniffiAssetId,
+)
+external Pointer<Void> uniffi_moq_ffi_fn_method_moqsession_grants(
+  Pointer<Void> ptr,
+  Pointer<RustCallStatus> uniffiStatus,
+);
+
+@Native<Pointer<Void> Function(Pointer<Void>, Pointer<RustCallStatus>)>(
+  assetId: _uniffiAssetId,
+)
+external Pointer<Void> uniffi_moq_ffi_fn_method_moqsession_publish(
+  Pointer<Void> ptr,
+  Pointer<RustCallStatus> uniffiStatus,
+);
+
+@Native<RustBuffer Function(Pointer<Void>, Pointer<RustCallStatus>)>(
+  assetId: _uniffiAssetId,
+)
+external RustBuffer uniffi_moq_ffi_fn_method_moqsession_recv_bandwidth(
+  Pointer<Void> ptr,
+  Pointer<RustCallStatus> uniffiStatus,
+);
+
+@Native<Void Function(Pointer<Void>, Pointer<RustCallStatus>)>(
+  assetId: _uniffiAssetId,
+)
+external void uniffi_moq_ffi_fn_method_moqsession_shutdown(
+  Pointer<Void> ptr,
+  Pointer<RustCallStatus> uniffiStatus,
+);
+
+@Native<RustBuffer Function(Pointer<Void>, Pointer<RustCallStatus>)>(
+  assetId: _uniffiAssetId,
+)
+external RustBuffer uniffi_moq_ffi_fn_method_moqsession_state(
+  Pointer<Void> ptr,
+  Pointer<RustCallStatus> uniffiStatus,
+);
+
+@Native<Pointer<Void> Function(Pointer<Void>, Uint64)>(assetId: _uniffiAssetId)
+external Pointer<Void> uniffi_moq_ffi_fn_method_moqsession_state_changed(
+  Pointer<Void> ptr,
+  int after,
+);
+
+@Native<RustBuffer Function(Pointer<Void>, Pointer<RustCallStatus>)>(
+  assetId: _uniffiAssetId,
+)
+external RustBuffer uniffi_moq_ffi_fn_method_moqsession_stats(
+  Pointer<Void> ptr,
+  Pointer<RustCallStatus> uniffiStatus,
+);
+
+@Native<RustBuffer Function(Pointer<Void>, Pointer<RustCallStatus>)>(
+  assetId: _uniffiAssetId,
+)
+external RustBuffer uniffi_moq_ffi_fn_method_moqsession_tokens(
+  Pointer<Void> ptr,
+  Pointer<RustCallStatus> uniffiStatus,
+);
+
+@Native<Pointer<Void> Function(Pointer<Void>, Pointer<RustCallStatus>)>(
+  assetId: _uniffiAssetId,
+)
+external Pointer<Void> uniffi_moq_ffi_fn_method_moqsession_viewers(
+  Pointer<Void> ptr,
+  Pointer<RustCallStatus> uniffiStatus,
+);
+
+@Native<Pointer<Void> Function(Pointer<Void>, Pointer<RustCallStatus>)>(
+  assetId: _uniffiAssetId,
+)
+external Pointer<Void> uniffi_moq_ffi_fn_clone_moqtokens(
+  Pointer<Void> handle,
+  Pointer<RustCallStatus> uniffiStatus,
 );
 
-@Native<RustBuffer Function(Pointer<Void>, Pointer<RustCallStatus>)>(
+@Native<Void Function(Pointer<Void>, Pointer<RustCallStatus>)>(
   assetId: _uniffiAssetId,
 )
-external RustBuffer uniffi_moq_ffi_fn_method_moqrequest_transport(
-  Pointer<Void> ptr,
+external void uniffi_moq_ffi_fn_free_moqtokens(
+  Pointer<Void> handle,
   Pointer<RustCallStatus> uniffiStatus,
 );
 
-@Native<RustBuffer Function(Pointer<Void>, Pointer<RustCallStatus>)>(
+@Native<Pointer<Void> Function(Pointer<Void>)>(assetId: _uniffiAssetId)
+external Pointer<Void> uniffi_moq_ffi_fn_method_moqtokens_answered(
+  Pointer<Void> ptr,
+);
+
+@Native<Void Function(Pointer<Void>, RustBuffer, Pointer<RustCallStatus>)>(
   assetId: _uniffiAssetId,
 )
-external RustBuffer uniffi_moq_ffi_fn_method_moqrequest_url(
+external void uniffi_moq_ffi_fn_method_moqtokens_set(
   Pointer<Void> ptr,
+  RustBuffer tokens,
   Pointer<RustCallStatus> uniffiStatus,
 );
 
 @Native<Pointer<Void> Function(Pointer<Void>, Pointer<RustCallStatus>)>(
   assetId: _uniffiAssetId,
 )
-external Pointer<Void> uniffi_moq_ffi_fn_clone_moqserver(
+external Pointer<Void> uniffi_moq_ffi_fn_clone_moqsocketendpoint(
   Pointer<Void> handle,
   Pointer<RustCallStatus> uniffiStatus,
 );
@@ -21556,49 +22475,81 @@ external Pointer<Void> uniffi_moq_ffi_fn_clone_moqserver(
 @Native<Void Function(Pointer<Void>, Pointer<RustCallStatus>)>(
   assetId: _uniffiAssetId,
 )
-external void uniffi_moq_ffi_fn_free_moqserver(
+external void uniffi_moq_ffi_fn_free_moqsocketendpoint(
   Pointer<Void> handle,
   Pointer<RustCallStatus> uniffiStatus,
 );
 
-@Native<Pointer<Void> Function(RustBuffer, Pointer<RustCallStatus>)>(
-  assetId: _uniffiAssetId,
-)
-external Pointer<Void> uniffi_moq_ffi_fn_constructor_moqserver_new(
-  RustBuffer config,
+@Native<
+  Pointer<Void> Function(
+    Pointer<Void>,
+    RustBuffer,
+    RustBuffer,
+    Pointer<RustCallStatus>,
+  )
+>(assetId: _uniffiAssetId)
+external Pointer<Void> uniffi_moq_ffi_fn_constructor_moqsocketendpoint_new(
+  Pointer<Void> origin,
+  RustBuffer prefix,
+  RustBuffer id,
   Pointer<RustCallStatus> uniffiStatus,
 );
 
 @Native<Pointer<Void> Function(Pointer<Void>)>(assetId: _uniffiAssetId)
-external Pointer<Void> uniffi_moq_ffi_fn_method_moqserver_accept(
+external Pointer<Void> uniffi_moq_ffi_fn_method_moqsocketendpoint_accept_tcp(
+  Pointer<Void> ptr,
+);
+
+@Native<Pointer<Void> Function(Pointer<Void>)>(assetId: _uniffiAssetId)
+external Pointer<Void> uniffi_moq_ffi_fn_method_moqsocketendpoint_accept_track(
   Pointer<Void> ptr,
 );
 
 @Native<Void Function(Pointer<Void>, Pointer<RustCallStatus>)>(
   assetId: _uniffiAssetId,
 )
-external void uniffi_moq_ffi_fn_method_moqserver_cancel(
+external void uniffi_moq_ffi_fn_method_moqsocketendpoint_close(
   Pointer<Void> ptr,
   Pointer<RustCallStatus> uniffiStatus,
 );
 
+@Native<Pointer<Void> Function(Pointer<Void>, RustBuffer)>(
+  assetId: _uniffiAssetId,
+)
+external Pointer<Void> uniffi_moq_ffi_fn_method_moqsocketendpoint_dial_tcp(
+  Pointer<Void> ptr,
+  RustBuffer peer,
+);
+
+@Native<Pointer<Void> Function(Pointer<Void>, RustBuffer, RustBuffer)>(
+  assetId: _uniffiAssetId,
+)
+external Pointer<Void> uniffi_moq_ffi_fn_method_moqsocketendpoint_dial_track(
+  Pointer<Void> ptr,
+  RustBuffer peer,
+  RustBuffer info,
+);
+
 @Native<RustBuffer Function(Pointer<Void>, Pointer<RustCallStatus>)>(
   assetId: _uniffiAssetId,
 )
-external RustBuffer uniffi_moq_ffi_fn_method_moqserver_cert_fingerprints(
+external RustBuffer uniffi_moq_ffi_fn_method_moqsocketendpoint_id(
   Pointer<Void> ptr,
   Pointer<RustCallStatus> uniffiStatus,
 );
 
-@Native<Pointer<Void> Function(Pointer<Void>)>(assetId: _uniffiAssetId)
-external Pointer<Void> uniffi_moq_ffi_fn_method_moqserver_listen(
+@Native<RustBuffer Function(Pointer<Void>, Pointer<RustCallStatus>)>(
+  assetId: _uniffiAssetId,
+)
+external RustBuffer uniffi_moq_ffi_fn_method_moqsocketendpoint_prefix(
   Pointer<Void> ptr,
+  Pointer<RustCallStatus> uniffiStatus,
 );
 
 @Native<Pointer<Void> Function(Pointer<Void>, Pointer<RustCallStatus>)>(
   assetId: _uniffiAssetId,
 )
-external Pointer<Void> uniffi_moq_ffi_fn_clone_moqclient(
+external Pointer<Void> uniffi_moq_ffi_fn_clone_moqsocketincomingtcp(
   Pointer<Void> handle,
   Pointer<RustCallStatus> uniffiStatus,
 );
@@ -21606,39 +22557,44 @@ external Pointer<Void> uniffi_moq_ffi_fn_clone_moqclient(
 @Native<Void Function(Pointer<Void>, Pointer<RustCallStatus>)>(
   assetId: _uniffiAssetId,
 )
-external void uniffi_moq_ffi_fn_free_moqclient(
+external void uniffi_moq_ffi_fn_free_moqsocketincomingtcp(
   Pointer<Void> handle,
   Pointer<RustCallStatus> uniffiStatus,
 );
 
-@Native<Pointer<Void> Function(RustBuffer, Pointer<RustCallStatus>)>(
+@Native<Pointer<Void> Function(Pointer<Void>)>(assetId: _uniffiAssetId)
+external Pointer<Void> uniffi_moq_ffi_fn_method_moqsocketincomingtcp_accept(
+  Pointer<Void> ptr,
+);
+
+@Native<RustBuffer Function(Pointer<Void>, Pointer<RustCallStatus>)>(
   assetId: _uniffiAssetId,
 )
-external Pointer<Void> uniffi_moq_ffi_fn_constructor_moqclient_new(
-  RustBuffer config,
+external RustBuffer uniffi_moq_ffi_fn_method_moqsocketincomingtcp_peer(
+  Pointer<Void> ptr,
   Pointer<RustCallStatus> uniffiStatus,
 );
 
 @Native<Void Function(Pointer<Void>, Pointer<RustCallStatus>)>(
   assetId: _uniffiAssetId,
 )
-external void uniffi_moq_ffi_fn_method_moqclient_cancel(
+external void uniffi_moq_ffi_fn_method_moqsocketincomingtcp_reject(
   Pointer<Void> ptr,
   Pointer<RustCallStatus> uniffiStatus,
 );
 
-@Native<Pointer<Void> Function(Pointer<Void>, RustBuffer)>(
+@Native<RustBuffer Function(Pointer<Void>, Pointer<RustCallStatus>)>(
   assetId: _uniffiAssetId,
 )
-external Pointer<Void> uniffi_moq_ffi_fn_method_moqclient_connect(
+external RustBuffer uniffi_moq_ffi_fn_method_moqsocketincomingtcp_session(
   Pointer<Void> ptr,
-  RustBuffer url,
+  Pointer<RustCallStatus> uniffiStatus,
 );
 
 @Native<Pointer<Void> Function(Pointer<Void>, Pointer<RustCallStatus>)>(
   assetId: _uniffiAssetId,
 )
-external Pointer<Void> uniffi_moq_ffi_fn_clone_moqsession(
+external Pointer<Void> uniffi_moq_ffi_fn_clone_moqsocketincomingtrack(
   Pointer<Void> handle,
   Pointer<RustCallStatus> uniffiStatus,
 );
@@ -21646,45 +22602,39 @@ external Pointer<Void> uniffi_moq_ffi_fn_clone_moqsession(
 @Native<Void Function(Pointer<Void>, Pointer<RustCallStatus>)>(
   assetId: _uniffiAssetId,
 )
-external void uniffi_moq_ffi_fn_free_moqsession(
+external void uniffi_moq_ffi_fn_free_moqsocketincomingtrack(
   Pointer<Void> handle,
   Pointer<RustCallStatus> uniffiStatus,
 );
 
-@Native<Pointer<Void> Function(Pointer<Void>, Pointer<RustCallStatus>)>(
+@Native<Pointer<Void> Function(Pointer<Void>, RustBuffer)>(
   assetId: _uniffiAssetId,
 )
-external Pointer<Void> uniffi_moq_ffi_fn_method_moqsession_allocator(
+external Pointer<Void> uniffi_moq_ffi_fn_method_moqsocketincomingtrack_accept(
   Pointer<Void> ptr,
-  Pointer<RustCallStatus> uniffiStatus,
+  RustBuffer info,
 );
 
-@Native<Void Function(Pointer<Void>, Uint32, Pointer<RustCallStatus>)>(
+@Native<RustBuffer Function(Pointer<Void>, Pointer<RustCallStatus>)>(
   assetId: _uniffiAssetId,
 )
-external void uniffi_moq_ffi_fn_method_moqsession_cancel(
+external RustBuffer uniffi_moq_ffi_fn_method_moqsocketincomingtrack_peer(
   Pointer<Void> ptr,
-  int code,
   Pointer<RustCallStatus> uniffiStatus,
 );
 
-@Native<Pointer<Void> Function(Pointer<Void>)>(assetId: _uniffiAssetId)
-external Pointer<Void> uniffi_moq_ffi_fn_method_moqsession_closed(
-  Pointer<Void> ptr,
-);
-
-@Native<Pointer<Void> Function(Pointer<Void>, Pointer<RustCallStatus>)>(
+@Native<Void Function(Pointer<Void>, Pointer<RustCallStatus>)>(
   assetId: _uniffiAssetId,
 )
-external Pointer<Void> uniffi_moq_ffi_fn_method_moqsession_consume(
+external void uniffi_moq_ffi_fn_method_moqsocketincomingtrack_reject(
   Pointer<Void> ptr,
   Pointer<RustCallStatus> uniffiStatus,
 );
 
-@Native<Pointer<Void> Function(Pointer<Void>, Pointer<RustCallStatus>)>(
+@Native<RustBuffer Function(Pointer<Void>, Pointer<RustCallStatus>)>(
   assetId: _uniffiAssetId,
 )
-external Pointer<Void> uniffi_moq_ffi_fn_method_moqsession_grants(
+external RustBuffer uniffi_moq_ffi_fn_method_moqsocketincomingtrack_session(
   Pointer<Void> ptr,
   Pointer<RustCallStatus> uniffiStatus,
 );
@@ -21692,23 +22642,23 @@ external Pointer<Void> uniffi_moq_ffi_fn_method_moqsession_grants(
 @Native<Pointer<Void> Function(Pointer<Void>, Pointer<RustCallStatus>)>(
   assetId: _uniffiAssetId,
 )
-external Pointer<Void> uniffi_moq_ffi_fn_method_moqsession_publish(
-  Pointer<Void> ptr,
+external Pointer<Void> uniffi_moq_ffi_fn_clone_moqsockettcpstream(
+  Pointer<Void> handle,
   Pointer<RustCallStatus> uniffiStatus,
 );
 
-@Native<RustBuffer Function(Pointer<Void>, Pointer<RustCallStatus>)>(
+@Native<Void Function(Pointer<Void>, Pointer<RustCallStatus>)>(
   assetId: _uniffiAssetId,
 )
-external RustBuffer uniffi_moq_ffi_fn_method_moqsession_recv_bandwidth(
-  Pointer<Void> ptr,
+external void uniffi_moq_ffi_fn_free_moqsockettcpstream(
+  Pointer<Void> handle,
   Pointer<RustCallStatus> uniffiStatus,
 );
 
-@Native<Void Function(Pointer<Void>, Pointer<RustCallStatus>)>(
+@Native<Pointer<Void> Function(Pointer<Void>, Pointer<RustCallStatus>)>(
   assetId: _uniffiAssetId,
 )
-external void uniffi_moq_ffi_fn_method_moqsession_shutdown(
+external Pointer<Void> uniffi_moq_ffi_fn_method_moqsockettcpstream_consumer(
   Pointer<Void> ptr,
   Pointer<RustCallStatus> uniffiStatus,
 );
@@ -21716,68 +22666,72 @@ external void uniffi_moq_ffi_fn_method_moqsession_shutdown(
 @Native<RustBuffer Function(Pointer<Void>, Pointer<RustCallStatus>)>(
   assetId: _uniffiAssetId,
 )
-external RustBuffer uniffi_moq_ffi_fn_method_moqsession_state(
+external RustBuffer uniffi_moq_ffi_fn_method_moqsockettcpstream_peer(
   Pointer<Void> ptr,
   Pointer<RustCallStatus> uniffiStatus,
 );
 
-@Native<Pointer<Void> Function(Pointer<Void>, Uint64)>(assetId: _uniffiAssetId)
-external Pointer<Void> uniffi_moq_ffi_fn_method_moqsession_state_changed(
+@Native<Pointer<Void> Function(Pointer<Void>, Pointer<RustCallStatus>)>(
+  assetId: _uniffiAssetId,
+)
+external Pointer<Void> uniffi_moq_ffi_fn_method_moqsockettcpstream_producer(
   Pointer<Void> ptr,
-  int after,
+  Pointer<RustCallStatus> uniffiStatus,
 );
 
 @Native<RustBuffer Function(Pointer<Void>, Pointer<RustCallStatus>)>(
   assetId: _uniffiAssetId,
 )
-external RustBuffer uniffi_moq_ffi_fn_method_moqsession_stats(
+external RustBuffer uniffi_moq_ffi_fn_method_moqsockettcpstream_session(
   Pointer<Void> ptr,
   Pointer<RustCallStatus> uniffiStatus,
 );
 
-@Native<RustBuffer Function(Pointer<Void>, Pointer<RustCallStatus>)>(
+@Native<Pointer<Void> Function(Pointer<Void>, Pointer<RustCallStatus>)>(
   assetId: _uniffiAssetId,
 )
-external RustBuffer uniffi_moq_ffi_fn_method_moqsession_tokens(
-  Pointer<Void> ptr,
+external Pointer<Void> uniffi_moq_ffi_fn_clone_moqsockettrackstream(
+  Pointer<Void> handle,
   Pointer<RustCallStatus> uniffiStatus,
 );
 
-@Native<Pointer<Void> Function(Pointer<Void>, Pointer<RustCallStatus>)>(
+@Native<Void Function(Pointer<Void>, Pointer<RustCallStatus>)>(
   assetId: _uniffiAssetId,
 )
-external Pointer<Void> uniffi_moq_ffi_fn_method_moqsession_viewers(
-  Pointer<Void> ptr,
+external void uniffi_moq_ffi_fn_free_moqsockettrackstream(
+  Pointer<Void> handle,
   Pointer<RustCallStatus> uniffiStatus,
 );
 
 @Native<Pointer<Void> Function(Pointer<Void>, Pointer<RustCallStatus>)>(
   assetId: _uniffiAssetId,
 )
-external Pointer<Void> uniffi_moq_ffi_fn_clone_moqtokens(
-  Pointer<Void> handle,
+external Pointer<Void> uniffi_moq_ffi_fn_method_moqsockettrackstream_consumer(
+  Pointer<Void> ptr,
   Pointer<RustCallStatus> uniffiStatus,
 );
 
-@Native<Void Function(Pointer<Void>, Pointer<RustCallStatus>)>(
+@Native<RustBuffer Function(Pointer<Void>, Pointer<RustCallStatus>)>(
   assetId: _uniffiAssetId,
 )
-external void uniffi_moq_ffi_fn_free_moqtokens(
-  Pointer<Void> handle,
+external RustBuffer uniffi_moq_ffi_fn_method_moqsockettrackstream_peer(
+  Pointer<Void> ptr,
   Pointer<RustCallStatus> uniffiStatus,
 );
 
-@Native<Pointer<Void> Function(Pointer<Void>)>(assetId: _uniffiAssetId)
-external Pointer<Void> uniffi_moq_ffi_fn_method_moqtokens_answered(
+@Native<Pointer<Void> Function(Pointer<Void>, Pointer<RustCallStatus>)>(
+  assetId: _uniffiAssetId,
+)
+external Pointer<Void> uniffi_moq_ffi_fn_method_moqsockettrackstream_producer(
   Pointer<Void> ptr,
+  Pointer<RustCallStatus> uniffiStatus,
 );
 
-@Native<Void Function(Pointer<Void>, RustBuffer, Pointer<RustCallStatus>)>(
+@Native<RustBuffer Function(Pointer<Void>, Pointer<RustCallStatus>)>(
   assetId: _uniffiAssetId,
 )
-external void uniffi_moq_ffi_fn_method_moqtokens_set(
+external RustBuffer uniffi_moq_ffi_fn_method_moqsockettrackstream_session(
   Pointer<Void> ptr,
-  RustBuffer tokens,
   Pointer<RustCallStatus> uniffiStatus,
 );
 
@@ -22871,6 +23825,9 @@ external int uniffi_moq_ffi_checksum_method_moqgroupproducer_consume();
 @Native<Uint16 Function()>(assetId: _uniffiAssetId)
 external int uniffi_moq_ffi_checksum_method_moqgroupproducer_finish();
 
+@Native<Uint16 Function()>(assetId: _uniffiAssetId)
+external int uniffi_moq_ffi_checksum_method_moqgroupproducer_ready();
+
 @Native<Uint16 Function()>(assetId: _uniffiAssetId)
 external int uniffi_moq_ffi_checksum_method_moqgroupproducer_sequence();
 
@@ -23015,6 +23972,75 @@ external int uniffi_moq_ffi_checksum_method_moqtokens_answered();
 @Native<Uint16 Function()>(assetId: _uniffiAssetId)
 external int uniffi_moq_ffi_checksum_method_moqtokens_set();
 
+@Native<Uint16 Function()>(assetId: _uniffiAssetId)
+external int uniffi_moq_ffi_checksum_method_moqsocketendpoint_accept_tcp();
+
+@Native<Uint16 Function()>(assetId: _uniffiAssetId)
+external int uniffi_moq_ffi_checksum_method_moqsocketendpoint_accept_track();
+
+@Native<Uint16 Function()>(assetId: _uniffiAssetId)
+external int uniffi_moq_ffi_checksum_method_moqsocketendpoint_close();
+
+@Native<Uint16 Function()>(assetId: _uniffiAssetId)
+external int uniffi_moq_ffi_checksum_method_moqsocketendpoint_dial_tcp();
+
+@Native<Uint16 Function()>(assetId: _uniffiAssetId)
+external int uniffi_moq_ffi_checksum_method_moqsocketendpoint_dial_track();
+
+@Native<Uint16 Function()>(assetId: _uniffiAssetId)
+external int uniffi_moq_ffi_checksum_method_moqsocketendpoint_id();
+
+@Native<Uint16 Function()>(assetId: _uniffiAssetId)
+external int uniffi_moq_ffi_checksum_method_moqsocketendpoint_prefix();
+
+@Native<Uint16 Function()>(assetId: _uniffiAssetId)
+external int uniffi_moq_ffi_checksum_method_moqsocketincomingtcp_accept();
+
+@Native<Uint16 Function()>(assetId: _uniffiAssetId)
+external int uniffi_moq_ffi_checksum_method_moqsocketincomingtcp_peer();
+
+@Native<Uint16 Function()>(assetId: _uniffiAssetId)
+external int uniffi_moq_ffi_checksum_method_moqsocketincomingtcp_reject();
+
+@Native<Uint16 Function()>(assetId: _uniffiAssetId)
+external int uniffi_moq_ffi_checksum_method_moqsocketincomingtcp_session();
+
+@Native<Uint16 Function()>(assetId: _uniffiAssetId)
+external int uniffi_moq_ffi_checksum_method_moqsocketincomingtrack_accept();
+
+@Native<Uint16 Function()>(assetId: _uniffiAssetId)
+external int uniffi_moq_ffi_checksum_method_moqsocketincomingtrack_peer();
+
+@Native<Uint16 Function()>(assetId: _uniffiAssetId)
+external int uniffi_moq_ffi_checksum_method_moqsocketincomingtrack_reject();
+
+@Native<Uint16 Function()>(assetId: _uniffiAssetId)
+external int uniffi_moq_ffi_checksum_method_moqsocketincomingtrack_session();
+
+@Native<Uint16 Function()>(assetId: _uniffiAssetId)
+external int uniffi_moq_ffi_checksum_method_moqsockettcpstream_consumer();
+
+@Native<Uint16 Function()>(assetId: _uniffiAssetId)
+external int uniffi_moq_ffi_checksum_method_moqsockettcpstream_peer();
+
+@Native<Uint16 Function()>(assetId: _uniffiAssetId)
+external int uniffi_moq_ffi_checksum_method_moqsockettcpstream_producer();
+
+@Native<Uint16 Function()>(assetId: _uniffiAssetId)
+external int uniffi_moq_ffi_checksum_method_moqsockettcpstream_session();
+
+@Native<Uint16 Function()>(assetId: _uniffiAssetId)
+external int uniffi_moq_ffi_checksum_method_moqsockettrackstream_consumer();
+
+@Native<Uint16 Function()>(assetId: _uniffiAssetId)
+external int uniffi_moq_ffi_checksum_method_moqsockettrackstream_peer();
+
+@Native<Uint16 Function()>(assetId: _uniffiAssetId)
+external int uniffi_moq_ffi_checksum_method_moqsockettrackstream_producer();
+
+@Native<Uint16 Function()>(assetId: _uniffiAssetId)
+external int uniffi_moq_ffi_checksum_method_moqsockettrackstream_session();
+
 @Native<Uint16 Function()>(assetId: _uniffiAssetId)
 external int uniffi_moq_ffi_checksum_method_moqvideoconsumer_cancel();
 
@@ -23151,6 +24177,9 @@ external int uniffi_moq_ffi_checksum_constructor_moqserver_new();
 @Native<Uint16 Function()>(assetId: _uniffiAssetId)
 external int uniffi_moq_ffi_checksum_constructor_moqclient_new();
 
+@Native<Uint16 Function()>(assetId: _uniffiAssetId)
+external int uniffi_moq_ffi_checksum_constructor_moqsocketendpoint_new();
+
 @Native<Uint16 Function()>(assetId: _uniffiAssetId)
 external int uniffi_moq_ffi_checksum_constructor_moqvideoconsumer_subscribe();
 
@@ -23683,6 +24712,9 @@ void _checkApiChecksums() {
   if (uniffi_moq_ffi_checksum_method_moqgroupproducer_finish() != 61241) {
     throw UniffiInternalError.panicked("UniFFI API checksum mismatch");
   }
+  if (uniffi_moq_ffi_checksum_method_moqgroupproducer_ready() != 10687) {
+    throw UniffiInternalError.panicked("UniFFI API checksum mismatch");
+  }
   if (uniffi_moq_ffi_checksum_method_moqgroupproducer_sequence() != 21067) {
     throw UniffiInternalError.panicked("UniFFI API checksum mismatch");
   }
@@ -23829,6 +24861,76 @@ void _checkApiChecksums() {
   if (uniffi_moq_ffi_checksum_method_moqtokens_set() != 20110) {
     throw UniffiInternalError.panicked("UniFFI API checksum mismatch");
   }
+  if (uniffi_moq_ffi_checksum_method_moqsocketendpoint_accept_tcp() != 55983) {
+    throw UniffiInternalError.panicked("UniFFI API checksum mismatch");
+  }
+  if (uniffi_moq_ffi_checksum_method_moqsocketendpoint_accept_track() != 3641) {
+    throw UniffiInternalError.panicked("UniFFI API checksum mismatch");
+  }
+  if (uniffi_moq_ffi_checksum_method_moqsocketendpoint_close() != 33296) {
+    throw UniffiInternalError.panicked("UniFFI API checksum mismatch");
+  }
+  if (uniffi_moq_ffi_checksum_method_moqsocketendpoint_dial_tcp() != 61959) {
+    throw UniffiInternalError.panicked("UniFFI API checksum mismatch");
+  }
+  if (uniffi_moq_ffi_checksum_method_moqsocketendpoint_dial_track() != 5972) {
+    throw UniffiInternalError.panicked("UniFFI API checksum mismatch");
+  }
+  if (uniffi_moq_ffi_checksum_method_moqsocketendpoint_id() != 2699) {
+    throw UniffiInternalError.panicked("UniFFI API checksum mismatch");
+  }
+  if (uniffi_moq_ffi_checksum_method_moqsocketendpoint_prefix() != 7033) {
+    throw UniffiInternalError.panicked("UniFFI API checksum mismatch");
+  }
+  if (uniffi_moq_ffi_checksum_method_moqsocketincomingtcp_accept() != 37027) {
+    throw UniffiInternalError.panicked("UniFFI API checksum mismatch");
+  }
+  if (uniffi_moq_ffi_checksum_method_moqsocketincomingtcp_peer() != 44709) {
+    throw UniffiInternalError.panicked("UniFFI API checksum mismatch");
+  }
+  if (uniffi_moq_ffi_checksum_method_moqsocketincomingtcp_reject() != 1335) {
+    throw UniffiInternalError.panicked("UniFFI API checksum mismatch");
+  }
+  if (uniffi_moq_ffi_checksum_method_moqsocketincomingtcp_session() != 25054) {
+    throw UniffiInternalError.panicked("UniFFI API checksum mismatch");
+  }
+  if (uniffi_moq_ffi_checksum_method_moqsocketincomingtrack_accept() != 43414) {
+    throw UniffiInternalError.panicked("UniFFI API checksum mismatch");
+  }
+  if (uniffi_moq_ffi_checksum_method_moqsocketincomingtrack_peer() != 60388) {
+    throw UniffiInternalError.panicked("UniFFI API checksum mismatch");
+  }
+  if (uniffi_moq_ffi_checksum_method_moqsocketincomingtrack_reject() != 3072) {
+    throw UniffiInternalError.panicked("UniFFI API checksum mismatch");
+  }
+  if (uniffi_moq_ffi_checksum_method_moqsocketincomingtrack_session() !=
+      36889) {
+    throw UniffiInternalError.panicked("UniFFI API checksum mismatch");
+  }
+  if (uniffi_moq_ffi_checksum_method_moqsockettcpstream_consumer() != 11536) {
+    throw UniffiInternalError.panicked("UniFFI API checksum mismatch");
+  }
+  if (uniffi_moq_ffi_checksum_method_moqsockettcpstream_peer() != 13339) {
+    throw UniffiInternalError.panicked("UniFFI API checksum mismatch");
+  }
+  if (uniffi_moq_ffi_checksum_method_moqsockettcpstream_producer() != 6563) {
+    throw UniffiInternalError.panicked("UniFFI API checksum mismatch");
+  }
+  if (uniffi_moq_ffi_checksum_method_moqsockettcpstream_session() != 61735) {
+    throw UniffiInternalError.panicked("UniFFI API checksum mismatch");
+  }
+  if (uniffi_moq_ffi_checksum_method_moqsockettrackstream_consumer() != 2651) {
+    throw UniffiInternalError.panicked("UniFFI API checksum mismatch");
+  }
+  if (uniffi_moq_ffi_checksum_method_moqsockettrackstream_peer() != 40311) {
+    throw UniffiInternalError.panicked("UniFFI API checksum mismatch");
+  }
+  if (uniffi_moq_ffi_checksum_method_moqsockettrackstream_producer() != 22232) {
+    throw UniffiInternalError.panicked("UniFFI API checksum mismatch");
+  }
+  if (uniffi_moq_ffi_checksum_method_moqsockettrackstream_session() != 30303) {
+    throw UniffiInternalError.panicked("UniFFI API checksum mismatch");
+  }
   if (uniffi_moq_ffi_checksum_method_moqvideoconsumer_cancel() != 21122) {
     throw UniffiInternalError.panicked("UniFFI API checksum mismatch");
   }
@@ -23976,6 +25078,9 @@ void _checkApiChecksums() {
   if (uniffi_moq_ffi_checksum_constructor_moqclient_new() != 48355) {
     throw UniffiInternalError.panicked("UniFFI API checksum mismatch");
   }
+  if (uniffi_moq_ffi_checksum_constructor_moqsocketendpoint_new() != 7442) {
+    throw UniffiInternalError.panicked("UniFFI API checksum mismatch");
+  }
   if (uniffi_moq_ffi_checksum_constructor_moqvideoconsumer_subscribe() !=
       7811) {
     throw UniffiInternalError.panicked("UniFFI API checksum mismatch");
diff --git a/doc/concept/socket.md b/doc/concept/socket.md
index 8073f8a1ca9..47533add9ad 100644
--- a/doc/concept/socket.md
+++ b/doc/concept/socket.md
@@ -107,9 +107,9 @@ track nobody serves. A dial that gives up resets `B`'s subscription in turn.
 ## Protocols
 
 Each side writes its own half and reads the peer's. A reader subscribes
-reliably and in order: oldest group first, with no delay budget, so it waits
-for a late group rather than skipping it. The protocol decides what a half
-holds.
+reliably and in order: from the half's first frame, oldest first, with no delay
+budget, so it waits for a late group rather than skipping it. The protocol
+decides what a half holds.
 
 ### `tcp`
 
@@ -119,6 +119,9 @@ exactly like one direction of a TCP connection:
 
 - A frame is a write. The reader reads the frames in the order they were
   written, with nothing skipped.
+- The reader joins the live group, which is the half's only one, from its
+  first frame. Over moq-transport, that is a `SUBSCRIBE` plus a joining `FETCH`
+  (or a fill) for the frames written before its answer.
 - Finishing the group is FIN: the reader reads to the end, then sees the end.
 - Resetting the group, or its track, is RST: the reader fails with the error.
 - A second group on a session track is a protocol error: the reader resets the
@@ -129,7 +132,7 @@ budget, no order, since the newest group is never stale.
 
 A session can last indefinitely: a group has no size cap, and each copy keeps
 only a bounded tail of it. A writer that waits for room before each write (in
-Rust, `group::Producer::ready`) runs at most a window ahead of the reader on
+Rust, `group::Producer::ready`; in the bindings, `GroupProducer.ready(size)`) runs at most a window ahead of the reader on
 every hop, so a slow reader slows the writer, as TCP backpressure does, and
 nothing is lost. A writer that doesn't wait sheds the front of its half, and a
 reader that falls behind it fails with an eviction error instead of skipping
@@ -149,7 +152,11 @@ a newer message never makes an older one stale. A reader that keeps up gets
 every message, but each
 hop's cache reclaims a message nobody read within its idle window (30 s by
 default), or under memory pressure, except the newest, so a reader that stalls
-longer can miss messages.
+longer can miss messages. Any message a hop reports it will never deliver is
+skipped the same way, rather than ending the session. Over moq-transport, the
+reader starts at group 0: a `SUBSCRIBE` with no filter, plus one range `FETCH`
+for the groups below the answer's largest, so a publisher that refuses that
+`FETCH` leaves a burst written before the answer missed.
 
 The reader's subscription starts reliable and in order, like `tcp`. An
 application may make it lossy for messages that go stale, such as positions or
diff --git a/doc/concept/standard.md b/doc/concept/standard.md
index 472e84e7dcb..b41ec2c525d 100644
--- a/doc/concept/standard.md
+++ b/doc/concept/standard.md
@@ -28,7 +28,7 @@ subset drops. What a peer actually observes against this implementation:
 - **Pull.** Subscribers ask. Single-track `PUBLISH` offers are declined, unless they answer our `SUBSCRIBE_TRACKS` (below); announce a namespace and serve the resulting subscriptions. Announcements go out unsolicited. A client asks only for the prefixes its readers watch, and a server or relay link for every prefix it may discover. We never hold two overlapping requests at a peer that did not declare solicit: a broader one replaces the narrower ones once they are closed. The solicit `SETUP` option makes us wait to be asked. Without it, a peer also gets each match as a `NAMESPACE` on its `SUBSCRIBE_NAMESPACE` stream, so it hears the namespace twice. We never send `PUBLISH`.
 - **We list no tracks by `PUBLISH`.** Rust and JavaScript refuse each `SUBSCRIBE_TRACKS` with `NOT_SUPPORTED`, and the session stays up. Our own peers list tracks over moq-lite instead.
 - **A Rust TRACKS listing sends `SUBSCRIBE_TRACKS` upstream, only on demand.** Listing a broadcast from a moq-transport peer sends `SUBSCRIBE_TRACKS` with `FORWARD=0` while someone lists it, never on connect, announce, or subscribe, so a peer that refuses, resets, or ignores it affects only that listing. Each listed track's paused `PUBLISH` is its upstream copy, which a reader resumes rather than subscribing again. Only a `PUBLISH_DONE` with `TRACK_ENDED` removes a listed track, and it lists as finished; any other end fails the listing, and readers list again. Our own moq-transport publishers refuse it, so a Rust listing of one fails.
-- **History is served one group at a time.** Our moq-transport publishers answer a `FETCH` only within one group, a draft-18 joining `FETCH` for the subscription's current group head, and a draft 20+ fill for the largest group's head. Whole-group fetches wait for an open group to finish. Both implementations accept and ignore `FILL_TIMEOUT`, including zero. A JavaScript subscription joins at the current group: on draft 18 it fetches the group's head with a Relative Joining `FETCH`, and from draft 20 asks for it with a fill. Subscribers still request ranges upstream, one per run of missing groups; a third-party publisher can answer those ranges and mark their gaps. A Rust copy resuming a draft-18 subscription joins live, so once the track has moved on, a read under a finite max age gives up the history it cached before rather than fetching it again. A Rust reader that only fetches learns the track from `TRACK_STATUS`, so a finished track stays fetchable; a refused `TRACK_STATUS` fails that reader's request, whatever the code, rather than falling back to a `SUBSCRIBE`.
+- **History is served one group at a time.** Our moq-transport publishers answer a `FETCH` only within one group, a draft-18 joining `FETCH` for the subscription's current group head, and a draft 20+ fill for the largest group's head. Whole-group fetches wait for an open group to finish. Both implementations accept and ignore `FILL_TIMEOUT`, including zero. An explicit absolute subscription start is served from that group on every supported draft, so a reader keeps its prefix even when its answer arrives late. A `SUBSCRIBE` without a Location Filter joins the live group rather than replaying history. A subscriber that wants the track from group 0 sends exactly that filterless `SUBSCRIBE`, the same on every draft, and fetches the groups below the answer's Largest Object with one range `FETCH`, which our publishers refuse once it spans more than one group. A live JavaScript subscription joins at the current group: on draft 18 it fetches the group's head with a Relative Joining `FETCH`, and from draft 20 asks for it with a fill. Subscribers still request ranges upstream, one per run of missing groups; a third-party publisher can answer those ranges and mark their gaps. A Rust reader that only fetches learns the track from `TRACK_STATUS`, so a finished track stays fetchable; a refused `TRACK_STATUS` fails that reader's request, whatever the code, rather than falling back to a `SUBSCRIBE`.
 - **A requester's FIN.** On draft 18 a requester finishing its stream cancels its request, except after `TRACK_STATUS`: nothing can follow it, so the FIN only ends the requester's input and the request is still answered. From draft 20 a FIN never cancels; a reset or `STOP_SENDING` does.
 - **Compression.** Rust peers exchange compressed tracks when both offer the [Flate extension](/draft/moq-flate). Other peers receive one shared inflated copy. A publisher that seals the compression declaration makes that fallback unavailable: an incompatible peer is refused, preserving the sealed metadata. JavaScript does not offer the IETF extension.
 - **Timing.** A track whose `SUBSCRIBE_OK` or `PUBLISH` declares no `TIMESCALE` is untimed. A `SUBSCRIBE` or `FETCH` with `INCLUDE_PROPERTIES=0` gets no `TIMESCALE` in its `SUBSCRIBE_OK` or `FETCH_OK`, so its objects go out unstamped. A Rust reader that never subscribed takes the units from `TRACK_STATUS`, and still asks for the properties whenever it subscribes to or fetches a timed track.
diff --git a/doc/lib/py/index.md b/doc/lib/py/index.md
index dcb3a3cc170..156063cd121 100644
--- a/doc/lib/py/index.md
+++ b/doc/lib/py/index.md
@@ -156,3 +156,43 @@ A catalog that needs a newer moq-hang draft than this build reads raises `Error.
 - API source: [py/moq-rs/moq](https://github.com/moq-dev/moq/tree/main/py/moq-rs/moq)
 - Source and examples: [`py/moq-rs`](https://github.com/moq-dev/moq/tree/main/py/moq-rs)
 - Raw bindings: [`moq-ffi`](https://pypi.org/project/moq-ffi/) on PyPI, for the unwrapped API
+
+## Socket sessions
+
+`moq.socket` connects endpoints through relays in either direction. Wire one
+origin to both session directions, then hold an endpoint while its sessions run:
+
+```python
+import asyncio, moq
+
+async def socket_client():
+    origin = moq.OriginProducer()
+    versions = ["moq-lite-07-wip"]
+    async with moq.Client("https://cdn.moq.dev/anon", versions=versions, publish=origin, consume=origin):
+        async with moq.socket.Endpoint(origin, "room", "client") as endpoint:
+            stream = await endpoint.dial_tcp("server")
+            stream.producer.write_frame(b"command")
+            stream.producer.finish()  # FIN; abort(error_code) sends RST instead.
+            async for frame in stream.consumer:
+                print(frame.payload)
+
+asyncio.run(socket_client())
+```
+
+Sockets need lite-07 or moq-transport on every hop, so the example opts into
+`moq-lite-07-wip`. No client offers it by default while its wire format is a
+work in progress, and the relay must accept it too.
+
+A server awaits `endpoint.accept_tcp()`, then calls `await incoming.accept()`
+or `incoming.reject()`. Accepting verifies that the claimed peer really dialed.
+`TcpStream` exposes group `producer` and `consumer` handles, plus `peer` and
+`session`. Keep the session id private. Its bounded cache reports eviction if a
+reader falls behind; it never skips bytes.
+
+Use `dial_track(peer, info=None)` and `accept_track()` for independent groups of
+messages. `TrackStream` exposes a track producer and a reliably subscribed,
+ascending consumer. Omitted `info` keeps messages without a publisher age limit;
+update the consumer's subscription to change delivery. The protocols have
+separate accept queues. Cancelling a dial or acceptance resets that dial;
+closing the endpoint resets all its sessions. See [Sockets](/concept/socket)
+for routing and authorization.
diff --git a/go/wrapper/MIGRATE.md b/go/wrapper/MIGRATE.md
index 1c2553c6d9c..c43be664ec9 100644
--- a/go/wrapper/MIGRATE.md
+++ b/go/wrapper/MIGRATE.md
@@ -4,6 +4,12 @@ How to update your code for each breaking change, newest first.
 
 ## Unreleased
 
+### Socket sessions
+
+moq.dev/moq/socket now exposes TCP group halves and reliably subscribed track halves beside origin. Regenerate bindings and rebuild the matching native library together. Existing callers need no migration. Socket endpoints require lite-07 or moq-transport on every hop; there is no wire change.
+
+`GroupProducer.Ready(ctx, size)` is new: it blocks until a frame of `size` bytes fits a window ahead of the fastest reader. Call it before each `WriteFrame` so the writer waits for its fastest reader instead of evicting it, though not for slower readers; a TCP socket stream's producer needs it to behave like TCP. Existing writers are unchanged.
+
 ### `Following.Available` reports the path going offline
 
 After the first call, `Available` returns `(nil, nil)` once the followed path goes offline, or, for a `Follow` pinned to an instance, once another instance takes it over.
diff --git a/go/wrapper/bridge.go b/go/wrapper/bridge.go
index 964965f008e..9d8769c457f 100644
--- a/go/wrapper/bridge.go
+++ b/go/wrapper/bridge.go
@@ -8,6 +8,13 @@ import (
 // Hand the layer subpackages the handles behind these types
 // without exporting them.
 func init() {
+	bridge.OriginProducer = func(v any) *ffi.MoqOriginProducer { return v.(*OriginProducer).inner }
+	bridge.WrapGroupProducer = func(v *ffi.MoqGroupProducer) any { return &GroupProducer{inner: v} }
+	bridge.WrapGroupConsumer = func(v *ffi.MoqGroupConsumer) any { return &GroupConsumer{inner: v} }
+	bridge.WrapTrackProducer = func(v *ffi.MoqTrackProducer) any { return &TrackProducer{inner: v} }
+	bridge.WrapTrackConsumer = func(v *ffi.MoqTrackConsumer) any { return &TrackConsumer{inner: v} }
+	bridge.TrackInfo = func(v any) (*ffi.MoqTrackInfo, error) { return trackInfoFFI(v.(*TrackInfo)) }
+
 	bridge.BroadcastConsumer = func(v any) *ffi.MoqBroadcastConsumer { return v.(*BroadcastConsumer).inner }
 	bridge.TrackRequest = func(v any) *ffi.MoqTrackRequest { return v.(*TrackRequest).inner }
 	bridge.Subscription = func(v any) (*ffi.MoqSubscription, error) { return subscriptionFFI(v.(*Subscription)) }
diff --git a/go/wrapper/internal/bridge/handles.go b/go/wrapper/internal/bridge/handles.go
index 48fc0f38573..68421803225 100644
--- a/go/wrapper/internal/bridge/handles.go
+++ b/go/wrapper/internal/bridge/handles.go
@@ -12,6 +12,19 @@ import (
 // moq, so they are set before a subpackage can call them. They take and return
 // `any` because this package cannot import moq's types without a cycle.
 var (
+	// OriginProducer returns the handle behind a *moq.OriginProducer.
+	OriginProducer func(any) *ffi.MoqOriginProducer
+	// WrapGroupProducer wraps a socket write half.
+	WrapGroupProducer func(*ffi.MoqGroupProducer) any
+	// WrapGroupConsumer wraps a socket read half.
+	WrapGroupConsumer func(*ffi.MoqGroupConsumer) any
+	// WrapTrackProducer wraps a socket write half.
+	WrapTrackProducer func(*ffi.MoqTrackProducer) any
+	// WrapTrackConsumer retains a socket's subscribed read half.
+	WrapTrackConsumer func(*ffi.MoqTrackConsumer) any
+	// TrackInfo converts a *moq.TrackInfo to the generated record.
+	TrackInfo func(any) (*ffi.MoqTrackInfo, error)
+
 	// BroadcastProducer returns the handle behind a *moq.BroadcastProducer.
 	BroadcastProducer func(any) *ffi.MoqBroadcastProducer
 	// TrackProducer returns the handle behind a *moq.TrackProducer.
diff --git a/go/wrapper/publish.go b/go/wrapper/publish.go
index 02c28eb680d..013ac28ad76 100644
--- a/go/wrapper/publish.go
+++ b/go/wrapper/publish.go
@@ -265,7 +265,18 @@ func (g *GroupProducer) Consume() (*GroupConsumer, error) {
 	return &GroupConsumer{inner: inner}, nil
 }
 
-// WriteFrame appends frame to the group.
+// Ready blocks until a frame of size bytes fits a window ahead of the fastest
+// reader. Call it before each WriteFrame so that reader paces the writer, as TCP
+// backpressure does, instead of the group shedding frames it has not taken, which
+// fails it with Evicted; slower readers are not waited on. It also waits until a reader holds
+// the group, and returns once the group is closed so the next write reports why.
+// It fails with Closed after Abort.
+func (g *GroupProducer) Ready(ctx context.Context, size uint64) error {
+	return g.inner.Ready(ctx, size)
+}
+
+// WriteFrame appends frame to the group. It never blocks: without Ready, a writer
+// that outpaces its readers sheds the front of the group instead.
 func (g *GroupProducer) WriteFrame(frame Frame) error {
 	return g.inner.WriteFrame(frame)
 }
diff --git a/go/wrapper/socket/socket.go b/go/wrapper/socket/socket.go
new file mode 100644
index 00000000000..4e259a77513
--- /dev/null
+++ b/go/wrapper/socket/socket.go
@@ -0,0 +1,160 @@
+// Package socket dials and accepts point-to-point sessions over hidden broadcasts.
+package socket
+
+import (
+	"context"
+	moq "moq.dev/moq"
+	ffi "moq.dev/moq-ffi/moq"
+	"moq.dev/moq/internal/bridge"
+)
+
+// Endpoint announces one hidden endpoint and accepts TCP and track dials separately.
+type Endpoint struct{ inner *ffi.MoqSocketEndpoint }
+
+// NewEndpoint announces id beneath prefix, using origin to find peers.
+func NewEndpoint(origin *moq.OriginProducer, prefix, id string) (*Endpoint, error) {
+	inner, err := ffi.NewMoqSocketEndpoint(bridge.OriginProducer(origin), prefix, id)
+	if err != nil {
+		return nil, err
+	}
+	return &Endpoint{inner: inner}, nil
+}
+
+// ID returns this endpoint's id.
+func (e *Endpoint) ID() string { return e.inner.Id() }
+
+// Prefix returns the shared endpoint prefix.
+func (e *Endpoint) Prefix() string { return e.inner.Prefix() }
+
+// Close retracts the endpoint and resets pending dials and sessions.
+func (e *Endpoint) Close() { e.inner.Close() }
+
+// DialTCP dials a new tcp session; cancelling resets only this dial.
+func (e *Endpoint) DialTCP(ctx context.Context, peer string) (*TCPStream, error) {
+	inner, err := bridge.CallHandle(ctx, nil, func(ctx context.Context) (*ffi.MoqSocketTcpStream, error) { return e.inner.DialTcp(ctx, peer) })
+	if err != nil {
+		return nil, err
+	}
+	return newTCPStream(inner), nil
+}
+
+// AcceptTCP starts listening for tcp and awaits the next dial.
+func (e *Endpoint) AcceptTCP(ctx context.Context) (*IncomingTCP, error) {
+	inner, err := bridge.CallHandle(ctx, nil, e.inner.AcceptTcp)
+	if err != nil {
+		return nil, err
+	}
+	return &IncomingTCP{inner: inner}, nil
+}
+
+// IncomingTCP is a tcp dial, consumed by accepting or rejecting it.
+type IncomingTCP struct{ inner *ffi.MoqSocketIncomingTcp }
+
+// Peer returns the claimed endpoint; accepting verifies return routability.
+func (i *IncomingTCP) Peer() string { return i.inner.Peer() }
+
+// Session returns the private session id.
+func (i *IncomingTCP) Session() string { return i.inner.Session() }
+
+// Reject refuses the dial as not found.
+func (i *IncomingTCP) Reject() error { return i.inner.Reject() }
+
+// Accept verifies return routability and accepts this dial.
+func (i *IncomingTCP) Accept(ctx context.Context) (*TCPStream, error) {
+	inner, err := bridge.CallHandle(ctx, nil, func(ctx context.Context) (*ffi.MoqSocketTcpStream, error) { return i.inner.Accept(ctx) })
+	if err != nil {
+		return nil, err
+	}
+	return newTCPStream(inner), nil
+}
+
+// TCPStream exposes a tcp session's two halves and identities.
+type TCPStream struct {
+	// Producer is this side's write half.
+	Producer *moq.GroupProducer
+	// Consumer is the peer's subscribed read half.
+	Consumer *moq.GroupConsumer
+	// Peer is the peer endpoint's id.
+	Peer string
+	// Session is the private session id.
+	Session string
+}
+
+func newTCPStream(inner *ffi.MoqSocketTcpStream) *TCPStream {
+	defer inner.Destroy()
+	return &TCPStream{
+		Producer: bridge.WrapGroupProducer(inner.Producer()).(*moq.GroupProducer),
+		Consumer: bridge.WrapGroupConsumer(inner.Consumer()).(*moq.GroupConsumer),
+		Peer:     inner.Peer(), Session: inner.Session(),
+	}
+}
+
+// DialTrack dials a new track session; cancelling resets only this dial.
+func (e *Endpoint) DialTrack(ctx context.Context, peer string, info *moq.TrackInfo) (*TrackStream, error) {
+	ffiInfo, err := bridge.TrackInfo(info)
+	if err != nil {
+		return nil, err
+	}
+	inner, err := bridge.CallHandle(ctx, nil, func(ctx context.Context) (*ffi.MoqSocketTrackStream, error) {
+		return e.inner.DialTrack(ctx, peer, ffiInfo)
+	})
+	if err != nil {
+		return nil, err
+	}
+	return newTrackStream(inner), nil
+}
+
+// AcceptTrack starts listening for track and awaits the next dial.
+func (e *Endpoint) AcceptTrack(ctx context.Context) (*IncomingTrack, error) {
+	inner, err := bridge.CallHandle(ctx, nil, e.inner.AcceptTrack)
+	if err != nil {
+		return nil, err
+	}
+	return &IncomingTrack{inner: inner}, nil
+}
+
+// IncomingTrack is a track dial, consumed by accepting or rejecting it.
+type IncomingTrack struct{ inner *ffi.MoqSocketIncomingTrack }
+
+// Peer returns the claimed endpoint; accepting verifies return routability.
+func (i *IncomingTrack) Peer() string { return i.inner.Peer() }
+
+// Session returns the private session id.
+func (i *IncomingTrack) Session() string { return i.inner.Session() }
+
+// Reject refuses the dial as not found.
+func (i *IncomingTrack) Reject() error { return i.inner.Reject() }
+
+// Accept verifies return routability and accepts this dial.
+func (i *IncomingTrack) Accept(ctx context.Context, info *moq.TrackInfo) (*TrackStream, error) {
+	ffiInfo, err := bridge.TrackInfo(info)
+	if err != nil {
+		return nil, err
+	}
+	inner, err := bridge.CallHandle(ctx, nil, func(ctx context.Context) (*ffi.MoqSocketTrackStream, error) { return i.inner.Accept(ctx, ffiInfo) })
+	if err != nil {
+		return nil, err
+	}
+	return newTrackStream(inner), nil
+}
+
+// TrackStream exposes a track session's two halves and identities.
+type TrackStream struct {
+	// Producer is this side's write half.
+	Producer *moq.TrackProducer
+	// Consumer is the peer's subscribed read half.
+	Consumer *moq.TrackConsumer
+	// Peer is the peer endpoint's id.
+	Peer string
+	// Session is the private session id.
+	Session string
+}
+
+func newTrackStream(inner *ffi.MoqSocketTrackStream) *TrackStream {
+	defer inner.Destroy()
+	return &TrackStream{
+		Producer: bridge.WrapTrackProducer(inner.Producer()).(*moq.TrackProducer),
+		Consumer: bridge.WrapTrackConsumer(inner.Consumer()).(*moq.TrackConsumer),
+		Peer:     inner.Peer(), Session: inner.Session(),
+	}
+}
diff --git a/js/net/MIGRATE.md b/js/net/MIGRATE.md
index 598de2f1853..11a84bfef70 100644
--- a/js/net/MIGRATE.md
+++ b/js/net/MIGRATE.md
@@ -4,6 +4,16 @@ How to update your code for each breaking change, newest first.
 
 ## Unreleased
 
+### Absolute IETF subscriptions keep their prefix
+
+Explicit group ranges now keep their requested start when the subscription answer
+arrives after its first data. IETF publishers honor absolute starts on all
+supported drafts instead of silently joining at the live edge. A start of group 0
+is a filterless SUBSCRIBE on every draft, and the groups below the answer's Largest
+Object come from one range FETCH. A `Subscribe` with an unfiltered filter now omits
+LOCATION\_FILTER, and a SUBSCRIBE without one still joins live. There is no API
+change.
+
 ### WebSocket receive windows match Rust
 
 The fallback now grants 4 MiB per connection and 1 MiB per stream, up from
diff --git a/js/net/src/ietf/filter.test.ts b/js/net/src/ietf/filter.test.ts
index 9280400cb86..be2a5d0dd1d 100644
--- a/js/net/src/ietf/filter.test.ts
+++ b/js/net/src/ietf/filter.test.ts
@@ -1,9 +1,10 @@
 import { expect, test } from "bun:test";
 import { Milli } from "@moq/clock";
 import { ProtocolViolation } from "../error.ts";
-import { Reader } from "../stream.ts";
+import * as Path from "../path.ts";
+import { Reader, Writer } from "../stream.ts";
 import * as Filter from "./filter.ts";
-import { joinFilter } from "./subscribe.ts";
+import { joinFilter, Subscribe } from "./subscribe.ts";
 import { Version } from "./version.ts";
 
 const OLD = Version.DRAFT_18;
@@ -24,6 +25,45 @@ test("a live join is Next Object, its head left to a joining FETCH or a StartGro
 	expect(draft22.fill).toEqual({ filter: { kind: "relative", groups: 1n }, rangeFilters: false });
 });
 
+test.each([OLD, FIELDS, NEW])("a session start of group 0 joins live with no filter on %s", (version) => {
+	// Its earlier groups come from a range FETCH, so no draft spells an absolute {0, 0}.
+	expect(joinFilter(version, 0n)).toEqual({ filter: { kind: "unfiltered" } });
+	expect(joinFilter(version, 3n)).toEqual({ filter: { kind: "absolute", startGroup: 3n, startObject: 0n } });
+});
+
+async function subscribeBytes(filter: Filter.Filter, version: typeof OLD | typeof FIELDS | typeof NEW) {
+	const chunks: Uint8Array[] = [];
+	const writer = new Writer(
+		new WritableStream<Uint8Array>({ write: (chunk) => void chunks.push(chunk.slice()) }),
+		version,
+	);
+	const msg = new Subscribe({
+		requestId: 0n,
+		trackNamespace: Path.from("live"),
+		trackName: "video",
+		subscriberPriority: 128,
+		filter,
+	});
+	await msg.encode(writer, version);
+	writer.close();
+	await writer.closed;
+	const encoded = new Uint8Array(chunks.reduce((n, c) => n + c.length, 0));
+	let offset = 0;
+	for (const chunk of chunks) {
+		encoded.set(chunk, offset);
+		offset += chunk.length;
+	}
+	return encoded;
+}
+
+test.each([OLD, FIELDS, NEW])("a filterless SUBSCRIBE omits LOCATION_FILTER on %s", async (version) => {
+	const filterless = await subscribeBytes({ kind: "unfiltered" }, version);
+	const next = await subscribeBytes({ kind: "nextObject" }, version);
+	expect(next.length).toBeGreaterThan(filterless.length);
+	const decoded = await Subscribe.decode(new Reader(undefined, filterless, version), version);
+	expect(decoded.filter).toEqual({ kind: "unfiltered" });
+});
+
 function roundTrip(filter: Filter.Filter, version: typeof OLD | typeof FIELDS | typeof NEW): Filter.Filter {
 	return Filter.decode(Filter.encode(filter, version), version);
 }
diff --git a/js/net/src/ietf/join.test.ts b/js/net/src/ietf/join.test.ts
index d33b3c2df0e..3474d61dbdc 100644
--- a/js/net/src/ietf/join.test.ts
+++ b/js/net/src/ietf/join.test.ts
@@ -58,14 +58,14 @@ async function nextStream(
 }
 
 /** A subscriber with one track, and the SUBSCRIBE it sent, still unanswered. */
-async function subscribed(version: IetfVersion = VERSION) {
+async function subscribed(version: IetfVersion = VERSION, subscription: Partial<track.Subscription> = {}) {
 	const pair = createMockTransportPair(ALPNS[version]);
 	const session = new NativeSession(pair.server, version, true);
 	const subscriber = new Subscriber({ session });
 	const consumer = subscriber
 		.consume(Path.from("room"))
 		.track("video")
-		.subscribe({ ...track.Subscription.default(), ranges: [{ start: { relative: 0n } }] });
+		.subscribe({ ...track.Subscription.default(), ranges: [{ start: { relative: 0n } }], ...subscription });
 	onTestFinished(() => {
 		consumer.close();
 		session.close();
@@ -86,8 +86,11 @@ async function subscribed(version: IetfVersion = VERSION) {
  * A draft-18 subscriber with one track answered with Largest `largest`, and the joining
  * FETCH it sent in response, still unanswered.
  */
-async function join(largest: MessageLocation | null = { groupId: GROUP, objectId: 1n }) {
-	const subscription = await subscribed();
+async function join(
+	largest: MessageLocation | null = { groupId: GROUP, objectId: 1n },
+	options: Partial<track.Subscription> = {},
+) {
+	const subscription = await subscribed(VERSION, options);
 	await subscription.answer(largest);
 
 	const fetching = await nextStream(subscription.client);
@@ -264,6 +267,19 @@ for (const outcome of ["a refused joining FETCH", "an empty joining FETCH"] as c
 	});
 }
 
+test("a reader in sequence order with no delay budget skips headless groups", async () => {
+	const { subscriber, consumer, fetching } = await join(undefined, { order: "ascending", delay: { max: null } });
+	await refuse(fetching);
+
+	// The joined group's head was refused, and the next group's stream starts mid-group.
+	await subscriber.handleGroup(...liveStream(GROUP, 2, ["t2"]));
+	await subscriber.handleGroup(...liveStream(GROUP + 1n, 1, ["m1"]));
+	await subscriber.handleGroup(...liveStream(GROUP + 2n, 0, ["n0"]));
+
+	const group = await timeout(Nano.fromMilli(Milli(1000)), consumer.ordered().nextGroup());
+	expect(group?.sequence).toBe(GROUP + 2n);
+});
+
 test("a tail parked on a refused joining FETCH is dropped", async () => {
 	const { subscriber, consumer, fetching } = await join();
 
diff --git a/js/net/src/ietf/publisher.test.ts b/js/net/src/ietf/publisher.test.ts
index a8520047281..256cee7b9f4 100644
--- a/js/net/src/ietf/publisher.test.ts
+++ b/js/net/src/ietf/publisher.test.ts
@@ -2444,6 +2444,51 @@ test("draft-22: an absolute subscribe is no join", async () => {
 	}
 });
 
+/**
+ * A filterless SUBSCRIBE without a fill joins the latest group, as a relay cache always served
+ * one; only an absolute start from group 0 replays the groups before it. Ascending order sends
+ * history first, so the first stream tells them apart.
+ */
+test.each(IETF_VERSIONS)("version %d: only an absolute start replays history", async (version) => {
+	// Bounded, since draft 20 spells an open {0, 0} as no filter at all.
+	const zero: Filter.Filter = { kind: "absolute", startGroup: 0n, startObject: 0n, endGroup: 1n };
+	for (const [filter, expected] of [
+		[{ kind: "unfiltered" }, [1n]],
+		[zero, [0n, 1n]],
+	] as const) {
+		const fx = fixture(version);
+		// Unlimited max age, so the first group is still served once its successor exists.
+		const track = fx.broadcast.createTrack("video", { timescale: Timescale.MILLI, maxAge: null });
+		writeGroup(track, 1);
+		writeGroup(track, 1);
+
+		const { client } = await runSubscribe(
+			fx,
+			new Subscribe({
+				requestId: 7n,
+				trackNamespace: Path.from("test"),
+				trackName: "video",
+				subscriberPriority: 0,
+				groupOrder: "ascending",
+				filter,
+			}),
+		);
+
+		try {
+			const served: bigint[] = [];
+			for (const _ of expected) {
+				const stream = await nextUni(fx.uni);
+				if (!stream) throw new Error(`${version} ${filter.kind}: missing group stream`);
+				served.push((await GroupMessage.decode(new Reader(stream, undefined, version), version)).groupId);
+			}
+			expect(served).toEqual([...expected]);
+		} finally {
+			fx.close();
+			client.close();
+		}
+	}
+});
+
 /**
  * The draft's own current-group join: a Next Object subscription for the live tail, plus a
  * StartGroup=1 fill for the head already published. The two must meet exactly, so the head
@@ -2618,8 +2663,8 @@ test("draft-22: a backwards range within one group serves nothing and ends the s
 	}
 });
 
-// Flaky in the workspace suite: the live group sometimes resets while read. Isolate its
-// clock and stream ordering before re-enabling.
+// Quarantined: the live group intermittently resets while read.
+// Investigation: quest/m0/test-flakes-2/ietf-wider-fill.md.
 test.skip.each(["ascending", "descending"] as const)("draft-22: a wider fill is refused in %s order", async (order) => {
 	const fx = fixture();
 	const track = fx.broadcast.createTrack("video", { timescale: Timescale.MILLI, maxAge: null });
diff --git a/js/net/src/ietf/publisher.ts b/js/net/src/ietf/publisher.ts
index 7e7d2c25fbc..607a4755356 100644
--- a/js/net/src/ietf/publisher.ts
+++ b/js/net/src/ietf/publisher.ts
@@ -485,7 +485,7 @@ export class Publisher {
 		const subscribe = (source: broadcast.Consumer) => {
 			// A range that resolves without the live edge has a fixed start, which is no join:
 			// bound the subscription before subscribing so the refresh ratio never judges it.
-			const fixed = subscribeRange(msg, {}, version);
+			const fixed = filterRange(msg.filter, {});
 			// Parked past a bounded window's end: the peer reads this stream's end as the track's.
 			return hooks.parked(
 				source.track(msg.trackName).subscribe({
@@ -685,7 +685,7 @@ export class Publisher {
 				msg.fill && msg.forward && Filter.isDraft20(version)
 					? fillRange(msg.fill, msg.filter, edge.largest)
 					: undefined;
-			const requested = subscribeRange(msg, edge, version);
+			const requested = filterRange(msg.filter, edge);
 			// A copy, since an update moves the cursor in place and must not move the bounds too.
 			const range = { ...afterFill(requested, fill, edge) };
 			// What the subscriber asked for, which only a narrowing changes: the fill's split
@@ -2869,31 +2869,13 @@ function liveEdge(track: TrackSubscriber): LiveEdge {
 	};
 }
 
-/**
- * Resolve a SUBSCRIBE's Location Filter into the range to serve.
- *
- * Draft-22 is honored whole. Earlier drafts honor only Largest Object, which a joining
- * FETCH pairs with to recover the group's head: their Filter Type tag has absolute forms
- * we never served, and starting to interpret them now would change what an existing peer
- * receives.
- */
-function subscribeRange(msg: Subscribe, edge: LiveEdge, version: IetfVersion): ServeRange {
-	if (!Filter.isDraft20(version) && msg.filter.kind !== "nextObject") {
-		if (msg.filter.kind !== "unfiltered") {
-			console.warn(`filter not supported before draft-22, ignoring: ${msg.filter.kind}`);
-		}
-		return {};
-	}
-
-	return filterRange(msg.filter, edge);
-}
-
 /** The Locations a single Location Filter selects, resolved against the live edge. */
 function filterRange(filter: Filter.Filter, edge: LiveEdge): ServeRange {
 	switch (filter.kind) {
 		// No restriction. moq-lite starts at the beginning of the latest group, which is the
 		// join point it is built around; a subscription passes objects as they are published,
-		// so an absent filter is not a request to replay history.
+		// so an absent filter is not a request to replay history. A subscriber that wants the
+		// track from its start fetches the groups before the live one.
 		case "unfiltered":
 			return {};
 		// `{Largest.Group, Largest.Object + 1}`. Everything below it, including the already
diff --git a/js/net/src/ietf/subscribe.ts b/js/net/src/ietf/subscribe.ts
index 41984268004..1e619f8be90 100644
--- a/js/net/src/ietf/subscribe.ts
+++ b/js/net/src/ietf/subscribe.ts
@@ -45,16 +45,25 @@ function decodeGroupOrder(value: number): Order {
 }
 
 /**
- * How this implementation joins a live track: at the current group, from its first object,
- * as the Rust subscriber does.
+ * Join at a known absolute start, or at the current group's first object as Rust does.
  *
- * The subscription itself starts at the next object (draft 18's Largest Object), and the
+ * A live subscription starts at the next object (draft 18's Largest Object), and the
  * group's head comes on a fetch stream. Draft 22 asks for it with a fill one group back from
  * the next, its current-group join (section 3.5); earlier drafts have no fill, so the
  * subscriber sends a Relative Joining FETCH once SUBSCRIBE_OK names Largest. Spelling the
  * filter keeps a peer from reading an absent one its own way.
+ *
+ * A start of group 0 is filterless on every draft, which our publishers serve from the start
+ * of the latest group; the copy's fills fetch the groups below it as one range FETCH. Draft 20
+ * has no absolute {0, 0} distinct from no filter, so no draft spells one.
  */
-export function joinFilter(version: IetfVersion): { filter: Filter.Filter; fill?: Filter.Fill } {
+export function joinFilter(version: IetfVersion, start?: bigint): { filter: Filter.Filter; fill?: Filter.Fill } {
+	if (start === 0n) return { filter: { kind: "unfiltered" } };
+	// Open-ended, since REQUEST_UPDATE carries no range here: a finite end would hold the
+	// subscription short when another reader later widens the track's demand.
+	if (start !== undefined) {
+		return { filter: { kind: "absolute", startGroup: start, startObject: 0n } };
+	}
 	const filter: Filter.Filter = { kind: "nextObject" };
 	if (!Filter.isDraft20(version)) return { filter };
 	return { filter, fill: { filter: { kind: "relative", groups: 1n }, rangeFilters: false } };
@@ -141,7 +150,10 @@ export class Subscribe {
 		params.maxAge = this.maxAge;
 		params.groupOrder = encodeGroupOrder(this.groupOrder);
 		params.forward = this.forward;
-		params.subscriptionFilter = this.filter;
+		// Unfiltered is the absent parameter, which a publisher reads as a live join.
+		if (this.filter.kind !== "unfiltered") {
+			params.subscriptionFilter = this.filter;
+		}
 
 		// FILL_PARAMETERS and INCLUDE_PROPERTIES arrived in draft-22. An older peer reads
 		// either as an unknown parameter, which is a protocol violation, so they are
diff --git a/js/net/src/ietf/subscriber.test.ts b/js/net/src/ietf/subscriber.test.ts
index 2a6b0ac0769..7d6ef74ce39 100644
--- a/js/net/src/ietf/subscriber.test.ts
+++ b/js/net/src/ietf/subscriber.test.ts
@@ -14,6 +14,7 @@ import * as track from "../track.ts";
 import * as demandUtil from "../util/demand.ts";
 import type * as Cluster from "./cluster.ts";
 import { Connection } from "./connection.ts";
+import { Fetch } from "./fetch.ts";
 import { type GroupFlags, Group as GroupMessage } from "./object.ts";
 import { Parameters } from "./parameters.ts";
 import type { Properties } from "./properties.ts";
@@ -1153,6 +1154,166 @@ test("early group waits for SUBSCRIBE_OK priority before track acceptance", asyn
 	track.close();
 });
 
+test.each([Version.DRAFT_18, Version.DRAFT_20, Version.DRAFT_22])(
+	"an absolute prefix survives an answer behind its first burst (%s)",
+	async (version) => {
+		const pair = createMockTransportPair(ALPN.DRAFT_18);
+		const subscriber = new Subscriber({ session: new NativeSession(pair.server, version, true) });
+		const consumer = subscriber
+			.consume(Path.from("room"))
+			.track("video")
+			.subscribe({
+				...track.Subscription.default(),
+				ranges: [{ start: { absolute: 1n } }],
+				order: "ascending",
+				delay: { max: null },
+			});
+		const peer = await nextStream(pair.client, version);
+		if (!peer) throw new Error("missing SUBSCRIBE stream");
+		try {
+			expect(await peer.reader.u53()).toBe(Subscribe.id);
+			expect((await Subscribe.decode(peer.reader, version)).filter).toEqual({
+				kind: "absolute",
+				startGroup: 1n,
+				startObject: 0n,
+			});
+			const arrivals = [1n, 2n].map((groupId) =>
+				subscriber.handleGroup(
+					new GroupMessage({
+						trackAlias: ALIAS,
+						groupId,
+						subGroupId: 0n,
+						publisherPriority: 0,
+						flags: groupFlags(true),
+					}),
+					new Reader(undefined, encodeObjects([0, 0]), version),
+				),
+			);
+			await peer.writer.u53(SubscribeOk.id);
+			await new SubscribeOk({ trackAlias: ALIAS, largest: { groupId: 2n, objectId: 1n } }).encode(
+				peer.writer,
+				version,
+			);
+			await Promise.all(arrivals);
+			const ordered = consumer.ordered();
+			try {
+				for (const sequence of [1n, 2n]) {
+					const group = await ordered.nextGroup();
+					expect(group?.sequence).toBe(sequence);
+					if (!group) throw new Error("missing prefix group");
+					expect(await group.readString()).toBe("object 0");
+					expect(await group.readString()).toBe("object 0");
+					expect(await group.readString()).toBeUndefined();
+				}
+			} finally {
+				ordered.close();
+			}
+		} finally {
+			peer.close();
+			consumer.close();
+		}
+	},
+);
+
+test.each([Version.DRAFT_18, Version.DRAFT_20, Version.DRAFT_22])(
+	"a start of group 0 joins live with no filter and fetches the groups below Largest (%s)",
+	async (version) => {
+		const pair = createMockTransportPair(ALPN.DRAFT_18);
+		const subscriber = new Subscriber({ session: new NativeSession(pair.server, version, true) });
+		const consumer = subscriber
+			.consume(Path.from("room"))
+			.track("video")
+			.subscribe({
+				...track.Subscription.default(),
+				ranges: [{ start: { absolute: 0n } }],
+				order: "ascending",
+				delay: { max: null },
+			});
+		const peer = await nextStream(pair.client, version);
+		if (!peer) throw new Error("missing SUBSCRIBE stream");
+		const ordered = consumer.ordered();
+		let fetch: Awaited<ReturnType<typeof nextStream>> | undefined;
+		try {
+			expect(await peer.reader.u53()).toBe(Subscribe.id);
+			const msg = await Subscribe.decode(peer.reader, version);
+			expect(msg.filter).toEqual({ kind: "unfiltered" });
+			expect(msg.fill).toBeUndefined();
+			await peer.writer.u53(SubscribeOk.id);
+			await new SubscribeOk({ trackAlias: ALIAS, largest: { groupId: 2n, objectId: 1n } }).encode(
+				peer.writer,
+				version,
+			);
+			// Our publisher serves the filterless join from the start of the latest group.
+			await subscriber.handleGroup(
+				new GroupMessage({
+					trackAlias: ALIAS,
+					groupId: 2n,
+					subGroupId: 0n,
+					publisherPriority: 0,
+					flags: groupFlags(true),
+				}),
+				new Reader(undefined, encodeObjects([0, 0]), version),
+			);
+			// The reader waits on group 0, which only a FETCH can bring.
+			void ordered.nextGroup().catch(() => {});
+			fetch = await nextStream(pair.client, version);
+			if (!fetch) throw new Error("missing FETCH stream");
+			expect(await fetch.reader.u53()).toBe(Fetch.id);
+			const { type } = await Fetch.decode(fetch.reader, version);
+			// One range for groups 0 and 1, below the live group 2.
+			if (type.kind === "standalone") {
+				expect(version).toBe(Version.DRAFT_18);
+				expect([type.start, type.end.group]).toEqual([{ group: 0n, object: 0n }, 1n]);
+			} else {
+				expect(type).toMatchObject({
+					kind: "filtered",
+					filter: { kind: "absolute", startGroup: 0n, startObject: 0n, endGroup: 1n },
+				});
+			}
+		} finally {
+			ordered.close();
+			fetch?.close();
+			peer.close();
+			consumer.close();
+		}
+	},
+);
+
+// SUBSCRIBE_UPDATE carries no range here, so a finite end would hold the upstream copy short
+// once another reader widens the track's demand.
+test("a bounded subscription asks upstream from its start without an end", async () => {
+	const version = Version.DRAFT_22;
+	const pair = createMockTransportPair(ALPN.DRAFT_18);
+	const subscriber = new Subscriber({ session: new NativeSession(pair.server, version, true) });
+	const consumer = subscriber
+		.consume(Path.from("room"))
+		.track("video")
+		.subscribe({
+			...track.Subscription.default(),
+			ranges: [{ start: { absolute: 4n }, end: { absolute: 10n } }],
+			order: "ascending",
+			delay: { max: null },
+		});
+	// The range reaches past the live edge TRACK_STATUS names, so it subscribes.
+	const status = await nextStream(pair.client, version);
+	if (!status) throw new Error("missing TRACK_STATUS stream");
+	expect(await status.reader.u53()).toBe(TrackStatusRequest.id);
+	await TrackStatusRequest.decode(status.reader, version);
+	await status.writer.u53(TrackStatusOk.id);
+	await new TrackStatusOk({ largest: { groupId: 5n, objectId: 0n } }).encode(status.writer, version);
+	const peer = await nextStream(pair.client, version);
+	if (!peer) throw new Error("missing SUBSCRIBE stream");
+	try {
+		expect(await peer.reader.u53()).toBe(Subscribe.id);
+		const { filter } = await Subscribe.decode(peer.reader, version);
+		expect(filter).toEqual({ kind: "absolute", startGroup: 4n, startObject: 0n, endGroup: undefined });
+	} finally {
+		peer.close();
+		status.close();
+		consumer.close();
+	}
+});
+
 /**
  * A group is the unit an application resyncs on, so one served from partway through is
  * unusable: the objects on the stream do not decode without the head the filter excluded,
diff --git a/js/net/src/ietf/subscriber.ts b/js/net/src/ietf/subscriber.ts
index bfa6103b42b..4379a2b5fce 100644
--- a/js/net/src/ietf/subscriber.ts
+++ b/js/net/src/ietf/subscriber.ts
@@ -1536,6 +1536,7 @@ export class Subscriber {
 		// that the stream is recorded, so settling this promise hands it back to be torn down.
 		if (cancelled.aborted) throw new Error("subscribe cancelled before it was sent");
 
+		const bounds = wireSpan(request.subscription.ranges ?? [{}]);
 		const msg = new Subscribe({
 			requestId,
 			trackNamespace: broadcast,
@@ -1545,10 +1546,10 @@ export class Subscriber {
 			maxAge: this.#maxAge ? maxDelayOf(request.subscription) : undefined,
 			// Fixed for the subscription's life: no REQUEST_UPDATE parameter carries it.
 			groupOrder: request.subscription.order,
-			// Joins at the current group, from its first object: the subscription delivers the
-			// objects after Largest, and the group's head before it comes on a fetch stream
-			// (see {@link Join}). Fixed for the subscription's life.
-			...joinFilter(version),
+			// A known start is absolute, except group 0, which joins live with no filter. A Next
+			// Object join recovers its head through a fetch stream (see {@link Join}). Fixed for
+			// the subscription's life.
+			...joinFilter(version, bounds.start),
 		});
 		if (msg.fill) {
 			// The fill names this request and can overtake SUBSCRIBE_OK, so it waits on it here.
@@ -1605,10 +1606,12 @@ export class Subscriber {
 		if (!known) state.requests = producer.requests();
 		const tail = new Tail();
 		const subscription: Subscription = { track: producer, tail, timescale: ok.properties.timescale, fetchIds: [] };
-		// The subscription starts after Largest, so the joining FETCH or the fill brings its
-		// group's head. With no Largest the track is empty and every group whole. A draft-22 fill
-		// is one of the subscription's own streams, so the Stream Count already waits for it.
-		if (ok.largest) {
+		// A live join starts at Largest's group: a filterless one from its first object, and Next
+		// Object after Largest, so the joining FETCH or the fill brings that group's head. With no
+		// Largest the track is empty and every group whole. A draft-22 fill is one of the
+		// subscription's own streams, so the Stream Count already waits for it.
+		const live = msg.filter.kind !== "absolute";
+		if (msg.filter.kind === "nextObject" && ok.largest) {
 			subscription.join = new Join(ok.largest.groupId, tail, { counted: msg.fill !== undefined });
 			const join = subscription.join;
 			this.#joins.set(producer, join);
@@ -1624,12 +1627,11 @@ export class Subscriber {
 			// no object, so a Next Object join served onward still starts at the group's first.
 			hooks.reportedGroup(producer, ok.largest.groupId);
 		}
-		// The live join starts at the publisher's edge, whatever floor the demand asked for.
-		// With no Largest it skips nothing, so every group is owed: a lower one's stream may
-		// still arrive after a higher one's.
+		// Absolute subscriptions keep their prefix even when the answer follows its first data. A
+		// live join's earlier start is left to the copy's fills, one range FETCH per run.
 		hooks.startTrack(producer, {
-			start: ok.largest ? ok.largest.groupId : 0n,
-			requested: wireSpan(request.subscription.ranges ?? [{}]).start,
+			start: live ? (ok.largest?.groupId ?? 0n) : (bounds.start ?? 0n),
+			requested: bounds.start,
 		});
 		staged?.commit();
 		state.fill?.(subscription);
@@ -1856,6 +1858,14 @@ export class Subscriber {
 			}
 			return producer;
 		};
+		// A group that will never arrive whole is dropped, so readers stop owing it.
+		const dropHeadless = () =>
+			hooks.dropTrackGroups(
+				track,
+				group.groupId,
+				group.groupId + 1n,
+				new StreamError(StreamCode.NotFound, { message: "the group's head was lost" }),
+			);
 		// After an END_OF_GROUP or END_OF_TRACK status only the stream's end may follow: an
 		// object past the group's final one makes the track malformed.
 		const last = async () => {
@@ -1919,6 +1929,7 @@ export class Subscriber {
 							console.debug(
 								`dropping a group with no head: alias=${group.trackAlias} group=${group.groupId} start=${start}`,
 							);
+							dropHeadless();
 							stream.stop(new Error("no head to stitch a mid-group stream onto"));
 							return;
 						}
@@ -1932,6 +1943,7 @@ export class Subscriber {
 						console.debug(
 							`dropping a group with no head: alias=${group.trackAlias} group=${group.groupId}`,
 						);
+						dropHeadless();
 						stream.stop(new Error("a group must start at object 0"));
 						return;
 					}
@@ -1992,6 +2004,7 @@ export class Subscriber {
 			// as the keyframe the group opens with.
 			if (producer === undefined && e instanceof ObjectIdGap && !group.flags.firstObject) {
 				console.debug(`dropping a group with no head: alias=${group.trackAlias} group=${group.groupId}`);
+				dropHeadless();
 				stream.stop(new Error("a group must start at object 0"));
 				return;
 			}
diff --git a/kt/moq/MIGRATE.md b/kt/moq/MIGRATE.md
index 73bb90e54be..04008a715c3 100644
--- a/kt/moq/MIGRATE.md
+++ b/kt/moq/MIGRATE.md
@@ -4,6 +4,12 @@ How to update your code for each breaking change, newest first.
 
 ## Unreleased
 
+### Socket sessions
+
+dev.moq.socket now exposes TCP group halves and reliably subscribed track halves beside origin. Regenerate bindings and rebuild the matching native library together. Existing callers need no migration. Socket endpoints require lite-07 or moq-transport on every hop; there is no wire change. Like broadcasts, endpoint `end()` forces shutdown while AutoCloseable `close()` releases the handle.
+
+`GroupProducer.ready(size)` is a new suspending call that waits until a frame of `size` bytes fits a window ahead of the fastest reader. Call it before each `writeFrame` so the writer waits for its fastest reader instead of evicting it, though not for slower readers; a TCP socket stream's producer needs it to behave like TCP. Existing writers are unchanged.
+
 ### `Following.available()` returns null once the path goes offline
 
 `following.available()` returns `BroadcastConsumer?`.
diff --git a/kt/moq/src/jvmAndAndroidMain/kotlin/dev/moq/socket/Socket.kt b/kt/moq/src/jvmAndAndroidMain/kotlin/dev/moq/socket/Socket.kt
new file mode 100644
index 00000000000..d8e911da89e
--- /dev/null
+++ b/kt/moq/src/jvmAndAndroidMain/kotlin/dev/moq/socket/Socket.kt
@@ -0,0 +1,16 @@
+package dev.moq.socket
+
+/** Announces one hidden endpoint and dials or accepts sessions. */
+typealias Endpoint = uniffi.moq.MoqSocketEndpoint
+
+/** An incoming TCP dial, consumed by accepting or rejecting it. */
+typealias IncomingTcp = uniffi.moq.MoqSocketIncomingTcp
+
+/** An incoming track dial, consumed by accepting or rejecting it. */
+typealias IncomingTrack = uniffi.moq.MoqSocketIncomingTrack
+
+/** A TCP session with group producer and consumer halves. */
+typealias TcpStream = uniffi.moq.MoqSocketTcpStream
+
+/** A track session with producer and reliably subscribed consumer halves. */
+typealias TrackStream = uniffi.moq.MoqSocketTrackStream
diff --git a/py/moq-rs/MIGRATE.md b/py/moq-rs/MIGRATE.md
index e4974c0906f..deb7664f508 100644
--- a/py/moq-rs/MIGRATE.md
+++ b/py/moq-rs/MIGRATE.md
@@ -4,6 +4,12 @@ How to update your code for each breaking change, newest first.
 
 ## Unreleased
 
+### Socket sessions
+
+moq.socket now exposes TCP group halves and reliably subscribed track halves beside origin. Regenerate bindings and rebuild the matching native library together. Existing callers need no migration. Socket endpoints require lite-07 or moq-transport on every hop; there is no wire change.
+
+`await GroupProducer.ready(size)` is new: it waits until a frame of `size` bytes fits a window ahead of the fastest reader. Await it before each `write_frame` so the writer waits for its fastest reader instead of evicting it, though not for slower readers; a `TcpStream` producer needs it to behave like TCP. Existing writers are unchanged.
+
 ### Announcements are a listing of present and absent paths
 
 `AnnounceConsumer` yields `AnnounceEventPresent` when a route starts covering a path and `AnnounceEventAbsent` when none covers it any more, each carrying an `Announce` as `announce`.
diff --git a/py/moq-rs/README.md b/py/moq-rs/README.md
index b09a547121e..bede3ee40b8 100644
--- a/py/moq-rs/README.md
+++ b/py/moq-rs/README.md
@@ -178,6 +178,7 @@ client = moq.Client(
   - Async iterator yielding `TrackRequest`
 - **`TrackProducer` / `GroupProducer`**. Write raw payloads with no codec parsing.
   - `.write_frame(payload, timestamp=None)` writes a payload with optional capture time.
+  - `await .ready(size)` (`GroupProducer`) waits until a frame of `size` bytes fits a window ahead of the fastest reader. Await it before each write for backpressure; a writer that doesn't sheds the front of the group instead.
   - `.create_group(sequence)` creates a sparse or replayed group at an explicit sequence.
   - `.finish()` ends at the live edge; the handle remains so `.abort(error_code)` can still run.
   - `.finish_at(final_sequence)` declares the first group that will never be produced while leaving lower groups writable.
@@ -248,6 +249,35 @@ same either way. Opaque bytes go on a plain `TrackProducer`.
 
 Every handle whose cleanup is `cancel()` is an async context manager, so exiting `async with` releases it: the consumers (`media.CatalogConsumer`, `media.TrackConsumer`, `media.GroupConsumer`, `TrackConsumer`, `audio.Consumer`, `video.Consumer`, `GroupConsumer`, `json.SnapshotConsumer`, `json.StreamConsumer`, `json.WindowConsumer`, `AnnounceConsumer`, `Following`) and the dynamic sources (`Route`, `BroadcastRequests`, `TrackRequests`).
 
+### Sockets
+
+`from moq import socket` exposes `socket.Endpoint(origin, prefix, id)`. Use the
+same origin as the session's publish and consume sides. Hold the endpoint while
+sessions run, or use it as an async context manager. It announces only
+`<prefix>/.socket/<id>`; keep each session id private.
+
+- `await endpoint.dial_tcp(peer)` and `await endpoint.accept_tcp()` use the TCP queue.
+- `await endpoint.dial_track(peer, info=None)` and `await endpoint.accept_track()` use the track queue.
+- An incoming dial has `peer` and `session`; `await incoming.accept()` verifies
+  return routability, and `incoming.reject()` refuses it. Track accepts also take `info=`.
+- `TcpStream` exposes `producer: GroupProducer`, `consumer: GroupConsumer`, `peer`,
+  and `session`. Write frames, finish for FIN, and abort for RST. Await
+  `producer.ready(len(payload))` before each write so a slow reader slows the
+  writer, as TCP backpressure does. A writer that doesn't wait sheds the front
+  of its half, and a reader that falls behind fails with eviction rather than
+  skipping bytes.
+- `TrackStream` exposes `producer: TrackProducer`, `consumer: TrackConsumer`, `peer`,
+  and `session`. Its subscription starts reliable and ascending, and omitted
+  `info` keeps messages without a publisher age limit. Hold or cancel the consumer
+  to retain or release that subscription. A message no hop will deliver, such as
+  one a cache reclaimed after 30 s unread or a refused fetch, is skipped rather
+  than ending the session.
+
+Cancelling a dial or its acceptance resets that dial. Cancelling an accept wait
+leaves the endpoint listening. `endpoint.close()` resets sessions and pending dials.
+The [socket convention](https://doc.moq.dev/concept/socket) needs lite-07 or
+moq-transport on every relay hop; this API does not add pre-07 capability detection.
+
 ### Origin (advanced)
 
 - **`OriginProducer(*, cache_capacity_bytes=None)`**. Manage broadcast announcements. Set `cache_capacity_bytes` to bound cached groups under this origin.
diff --git a/py/moq-rs/benches/ffi.py b/py/moq-rs/benches/ffi.py
index 120441b4228..3ddac852d18 100644
--- a/py/moq-rs/benches/ffi.py
+++ b/py/moq-rs/benches/ffi.py
@@ -108,8 +108,70 @@ def call(name: str, fn: Callable[[], object], results: list[dict]) -> None:
     results.append({"name": f"call/{name}", "unit": "ns", "value": (time.perf_counter() - start) * 1e9 / calls})
 
 
+async def sockets(results: list[dict]) -> None:
+    """Sweep listening endpoints and simultaneous sessions per endpoint separately."""
+    for protocol in ("tcp", "track"):
+        for endpoints in (1, 4, 16):
+            for sessions in (1, 4, 16):
+                origin = moq.OriginProducer()
+                client = moq.socket.Endpoint(origin, "bench", "client")
+                servers = [moq.socket.Endpoint(origin, "bench", f"server-{i}") for i in range(endpoints)]
+
+                async def drain(stream: moq.socket.TcpStream | moq.socket.TrackStream) -> None:
+                    if isinstance(stream, moq.socket.TcpStream):
+                        assert [frame.payload async for frame in stream.consumer] == [b"echo"]
+                    else:
+                        assert [[frame.payload async for frame in group] async for group in stream.consumer] == [
+                            [b"echo"]
+                        ]
+                    stream.producer.finish()
+
+                async def accept(server: moq.socket.Endpoint) -> None:
+                    readers = []
+                    for _ in range(sessions):
+                        incoming = await (server.accept_tcp() if protocol == "tcp" else server.accept_track())
+                        readers.append(asyncio.create_task(drain(await incoming.accept())))
+                    await asyncio.gather(*readers)
+
+                async def dial(server: moq.socket.Endpoint) -> None:
+                    stream = await (client.dial_tcp(server.id) if protocol == "tcp" else client.dial_track(server.id))
+                    stream.producer.write_frame(b"echo")
+                    stream.producer.finish()
+                    assert [item async for item in stream.consumer] == []
+
+                async def step() -> None:
+                    accepts = [asyncio.create_task(accept(server)) for server in servers]
+                    # Each accept reaches its first suspension before any dial can run.
+                    polled = asyncio.get_running_loop().create_future()
+                    asyncio.get_running_loop().call_soon(polled.set_result, None)
+                    await polled
+                    await asyncio.wait_for(
+                        asyncio.gather(*(dial(server) for server in servers for _ in range(sessions)), *accepts),
+                        ROUND_TIMEOUT,
+                    )
+
+                for _ in range(WARMUP):
+                    await step()
+                start, rounds = time.perf_counter(), 0
+                while time.perf_counter() - start < BUDGET:
+                    await step()
+                    rounds += 1
+                elapsed = time.perf_counter() - start
+                results.append(
+                    {
+                        "name": f"socket/{protocol}/endpoints={endpoints}/sessions={sessions}",
+                        "unit": "sessions/s",
+                        "value": rounds * endpoints * sessions / elapsed,
+                    }
+                )
+                client.close()
+                for server in servers:
+                    server.close()
+
+
 async def main() -> None:
     results: list[dict] = []
+    await sockets(results)
     for case in CASES:
         await throughput(case, results)
 
diff --git a/py/moq-rs/docs/index.md b/py/moq-rs/docs/index.md
index af3f45afdfd..ca99b9bde53 100644
--- a/py/moq-rs/docs/index.md
+++ b/py/moq-rs/docs/index.md
@@ -241,3 +241,22 @@ Rust side ([`moq-ffi`](https://crates.io/crates/moq-ffi)).
 
 self
 ```
+
+## Sockets
+
+`moq.socket` connects endpoints through relays, using the same origin for both
+publishing and consuming. See the [socket convention](https://doc.moq.dev/concept/socket).
+
+```{eval-rst}
+.. currentmodule:: moq.socket
+
+.. autosummary::
+   :toctree: api
+   :nosignatures:
+
+   Endpoint
+   IncomingTcp
+   IncomingTrack
+   TcpStream
+   TrackStream
+```
diff --git a/py/moq-rs/moq/__init__.py b/py/moq-rs/moq/__init__.py
index 713abae9278..76c391c65e4 100644
--- a/py/moq-rs/moq/__init__.py
+++ b/py/moq-rs/moq/__init__.py
@@ -9,6 +9,7 @@
 
 # Layer namespaces stay out of __all__; json would shadow the stdlib module.
 from . import json as json
+from . import socket as socket
 from . import video as video
 from .client import Client, CongestionControl, connect, qlog_supported, versions
 from .datagram import DatagramConsumer, DatagramProducer, DatagramRequest, DatagramRequests
diff --git a/py/moq-rs/moq/publish.py b/py/moq-rs/moq/publish.py
index 96cc160a038..ef3530a1799 100644
--- a/py/moq-rs/moq/publish.py
+++ b/py/moq-rs/moq/publish.py
@@ -50,8 +50,24 @@ def consume(self) -> GroupConsumer:
 
         return GroupConsumer(self._inner.consume())
 
+    async def ready(self, size: int) -> None:
+        """Wait until a frame of ``size`` bytes fits a window ahead of the fastest reader.
+
+        Await it before each :meth:`write_frame` so that reader paces the writer,
+        as TCP backpressure does, instead of the group shedding frames it has not
+        taken, which fails it with ``moq.Error.Evicted``; slower readers are not
+        waited on. It also
+        waits until a reader holds the group, and resolves once the group is closed
+        so the next write raises why. Raises ``moq.Error.Closed`` after :meth:`abort`.
+        """
+        await self._inner.ready(size)
+
     def write_frame(self, payload: bytes, timestamp: Timestamp | None = None) -> None:
-        """Write a frame with its presentation timestamp."""
+        """Write a frame with its presentation timestamp.
+
+        Never blocks: without :meth:`ready`, a writer that outpaces its readers
+        sheds the front of the group instead.
+        """
         self._inner.write_frame(Frame(payload, timestamp)._ffi())
 
     def finish(self) -> None:
diff --git a/py/moq-rs/moq/socket.py b/py/moq-rs/moq/socket.py
new file mode 100644
index 00000000000..505f60e1660
--- /dev/null
+++ b/py/moq-rs/moq/socket.py
@@ -0,0 +1,177 @@
+"""Point-to-point TCP and track sessions over hidden endpoint broadcasts."""
+
+from __future__ import annotations
+
+from moq_ffi import (
+    MoqSocketEndpoint,
+    MoqSocketIncomingTcp,
+    MoqSocketIncomingTrack,
+    MoqSocketTcpStream,
+    MoqSocketTrackStream,
+)
+
+from ._records import _track_info
+from .origin import OriginProducer
+from .publish import GroupProducer, TrackProducer
+from .subscribe import GroupConsumer, TrackConsumer
+from .types import TrackInfo
+
+__all__ = ["Endpoint", "IncomingTcp", "IncomingTrack", "TcpStream", "TrackStream"]
+
+
+class Endpoint:
+    """Announces one hidden endpoint and dials or accepts independent sessions.
+
+    Hold it while sessions run. Closing it resets pending dials and sessions.
+    Cancelling a dial cancels only that dial; cancelling an accept wait leaves
+    the endpoint listening. Usable as an async context manager.
+    """
+
+    def __init__(self, origin: OriginProducer, prefix: str, id: str) -> None:
+        self._inner = MoqSocketEndpoint(origin._inner, prefix, id)
+
+    @property
+    def id(self) -> str:
+        """This endpoint's id."""
+        return self._inner.id()
+
+    @property
+    def prefix(self) -> str:
+        """The prefix beneath which this endpoint finds peers."""
+        return self._inner.prefix()
+
+    async def __aenter__(self) -> Endpoint:
+        return self
+
+    async def __aexit__(self, *exc) -> None:
+        self.close()
+
+    def close(self) -> None:
+        """Retract the endpoint and reset its pending dials and sessions."""
+        self._inner.close()
+
+    async def dial_tcp(self, peer: str) -> TcpStream:
+        """Dial a new TCP session, waiting until the peer accepts it."""
+        return TcpStream(await self._inner.dial_tcp(peer))
+
+    async def accept_tcp(self) -> IncomingTcp:
+        """Start listening for TCP and return the next incoming TCP dial."""
+        return IncomingTcp(await self._inner.accept_tcp())
+
+    async def dial_track(self, peer: str, *, info: TrackInfo | None = None) -> TrackStream:
+        """Dial a track session; omitted info keeps messages without an age limit."""
+        return TrackStream(await self._inner.dial_track(peer, _track_info(info)))
+
+    async def accept_track(self) -> IncomingTrack:
+        """Start listening for tracks and return the next incoming track dial."""
+        return IncomingTrack(await self._inner.accept_track())
+
+
+class IncomingTcp:
+    """An incoming tcp dial, consumed by accepting or rejecting it."""
+
+    def __init__(self, inner: MoqSocketIncomingTcp) -> None:
+        self._inner = inner
+
+    @property
+    def peer(self) -> str:
+        """The claimed peer id; accepting verifies return routability."""
+        return self._inner.peer()
+
+    @property
+    def session(self) -> str:
+        """The random session id, which must stay private to its endpoints."""
+        return self._inner.session()
+
+    async def accept(self) -> TcpStream:
+        """Accept after verifying that the peer really dialed this session."""
+        return TcpStream(await self._inner.accept())
+
+    def reject(self) -> None:
+        """Refuse this dial as not found."""
+        self._inner.reject()
+
+
+class TcpStream:
+    """A tcp session's two halves and its peer and session identities."""
+
+    def __init__(self, inner: MoqSocketTcpStream) -> None:
+        self._producer = GroupProducer(inner.producer())
+        self._consumer = GroupConsumer(inner.consumer())
+        self._peer = inner.peer()
+        self._session = inner.session()
+
+    @property
+    def producer(self) -> GroupProducer:
+        """This side's write half."""
+        return self._producer
+
+    @property
+    def consumer(self) -> GroupConsumer:
+        """The peer's read half, retaining its reliable ascending subscription."""
+        return self._consumer
+
+    @property
+    def peer(self) -> str:
+        """The peer endpoint's id."""
+        return self._peer
+
+    @property
+    def session(self) -> str:
+        """The random session id, which must stay private to its endpoints."""
+        return self._session
+
+
+class IncomingTrack:
+    """An incoming track dial, consumed by accepting or rejecting it."""
+
+    def __init__(self, inner: MoqSocketIncomingTrack) -> None:
+        self._inner = inner
+
+    @property
+    def peer(self) -> str:
+        """The claimed peer id; accepting verifies return routability."""
+        return self._inner.peer()
+
+    @property
+    def session(self) -> str:
+        """The random session id, which must stay private to its endpoints."""
+        return self._inner.session()
+
+    async def accept(self, *, info: TrackInfo | None = None) -> TrackStream:
+        """Accept after verifying that the peer really dialed this session."""
+        return TrackStream(await self._inner.accept(_track_info(info)))
+
+    def reject(self) -> None:
+        """Refuse this dial as not found."""
+        self._inner.reject()
+
+
+class TrackStream:
+    """A track session's two halves and its peer and session identities."""
+
+    def __init__(self, inner: MoqSocketTrackStream) -> None:
+        self._producer = TrackProducer(inner.producer())
+        self._consumer = TrackConsumer(inner.consumer())
+        self._peer = inner.peer()
+        self._session = inner.session()
+
+    @property
+    def producer(self) -> TrackProducer:
+        """This side's write half."""
+        return self._producer
+
+    @property
+    def consumer(self) -> TrackConsumer:
+        """The peer's read half, retaining its reliable ascending subscription."""
+        return self._consumer
+
+    @property
+    def peer(self) -> str:
+        """The peer endpoint's id."""
+        return self._peer
+
+    @property
+    def session(self) -> str:
+        """The random session id, which must stay private to its endpoints."""
+        return self._session
diff --git a/py/moq-rs/tests/test_socket.py b/py/moq-rs/tests/test_socket.py
new file mode 100644
index 00000000000..3821ace915b
--- /dev/null
+++ b/py/moq-rs/tests/test_socket.py
@@ -0,0 +1,256 @@
+"""Socket lifetime and cancellation tests use explicit task barriers, without timers."""
+
+import asyncio
+import gc
+import subprocess
+import sys
+from collections.abc import Coroutine
+from typing import Any, TypeVar, cast
+
+import moq
+import pytest
+from moq import socket
+
+T = TypeVar("T")
+
+
+async def start(coro: Coroutine[Any, Any, T]) -> asyncio.Task[T]:
+    """Return after the coroutine has reached its first suspension."""
+    loop = asyncio.get_running_loop()
+    polled = loop.create_future()
+
+    async def run() -> T:
+        loop.call_soon(polled.set_result, None)
+        return await coro
+
+    task = asyncio.create_task(run())
+    await polled
+    return task
+
+
+def endpoints() -> tuple[socket.Endpoint, socket.Endpoint]:
+    origin = moq.OriginProducer()
+    return socket.Endpoint(origin, "room", "a"), socket.Endpoint(origin, "room", "b")
+
+
+async def tcp(a: socket.Endpoint, b: socket.Endpoint) -> tuple[socket.TcpStream, socket.TcpStream]:
+    incoming = await start(b.accept_tcp())
+    dial = await start(a.dial_tcp(b.id))
+    accepted = await (await incoming).accept()
+    return await dial, accepted
+
+
+async def test_tcp_halves_fin_and_peer_identity():
+    a, b = endpoints()
+    client, server = await tcp(a, b)
+    assert (a.id, a.prefix, client.peer, server.peer) == ("a", "room", "b", "a")
+    assert client.session == server.session
+    assert len(client.session) == 32
+    producer, reader, consumer = client.producer, client.consumer, server.consumer
+    # Releasing the stream cannot release either half kept by the application.
+    del client
+    gc.collect()
+    producer.write_frame(b"one")
+    producer.write_frame(b"")
+    producer.finish()
+    del producer
+    gc.collect()
+    assert [frame.payload async for frame in consumer] == [b"one", b""]
+    server.producer.finish()
+    assert await reader.read_frame() is None
+    a.close()
+    b.close()
+
+
+async def test_refusal_and_cancelled_wait_leave_endpoint_usable():
+    a, b = endpoints()
+    pending = await start(b.accept_tcp())
+    pending.cancel()
+    with pytest.raises(asyncio.CancelledError):
+        await pending
+    dial = await start(a.dial_tcp("b"))
+    incoming = await b.accept_tcp()
+    assert incoming.peer == "a"
+    incoming.reject()
+    with pytest.raises(moq.Error.NotFound):
+        await dial
+    with pytest.raises(moq.Error.Closed):
+        incoming.reject()
+    client, server = await tcp(a, b)
+    assert client.session == server.session
+    a.close()
+    b.close()
+
+
+async def test_cancelled_dial_releases_the_original_subscription():
+    a, b = endpoints()
+    incoming = await start(b.accept_tcp())
+    dial = await start(a.dial_tcp("b"))
+    offered = await incoming
+    dial.cancel()
+    with pytest.raises(asyncio.CancelledError):
+        await dial
+    with pytest.raises(moq.Error.Cancelled):
+        await offered.accept()
+    client, server = await tcp(a, b)
+    assert client.session == server.session
+    a.close()
+    b.close()
+
+
+async def test_tcp_rst_and_endpoint_close_are_errors():
+    a, b = endpoints()
+    client, server = await tcp(a, b)
+    client.producer.abort(17)
+    with pytest.raises(moq.Error.Protocol) as reset:
+        await server.consumer.read_frame()
+    assert reset.value.details.kind == moq.ProtocolKind.APP
+    assert reset.value.details.code == 64 + 17
+    client, server = await tcp(a, b)
+    a.close()
+    with pytest.raises(moq.Error.Cancelled):
+        await server.consumer.read_frame()
+    b.close()
+
+
+async def test_track_default_retains_ascending_messages_and_subscription():
+    a, b = endpoints()
+    incoming = await start(b.accept_track())
+    dial = await start(a.dial_track("b"))
+    server = await (await incoming).accept()
+    client = await dial
+    assert (client.peer, server.peer, client.session) == ("b", "a", server.session)
+    producer, reverse, consumer = client.producer, server.producer, server.consumer
+    del server
+    gc.collect()
+    assert consumer.info().max_age is None
+    for sequence, payload in ((1, b"later"), (0, b"first")):
+        group = producer.create_group(sequence)
+        group.write_frame(payload)
+        group.finish()
+    producer.finish()
+    assert [(group.sequence, [frame.payload async for frame in group]) async for group in consumer] == [
+        (0, [b"first"]),
+        (1, [b"later"]),
+    ]
+    reverse.finish()
+    assert await client.consumer.read_frame() is None
+    a.close()
+    b.close()
+
+
+async def test_accept_queues_are_separate_and_unaccepted_protocol_is_unsupported():
+    a, b = endpoints()
+    tcp_wait = await start(b.accept_tcp())
+    with pytest.raises(moq.Error.Unsupported):
+        await a.dial_track("b")
+    track_wait = await start(b.accept_track())
+    tcp_dial = await start(a.dial_tcp("b"))
+    track_dial = await start(a.dial_track("b"))
+    tcp_offer, track_offer = await tcp_wait, await track_wait
+    assert tcp_offer.session != track_offer.session
+    tcp_server = await tcp_offer.accept()
+    track_server = await track_offer.accept()
+    tcp_client, track_client = await tcp_dial, await track_dial
+    assert tcp_client.session == tcp_server.session
+    assert track_client.session == track_server.session
+    a.close()
+    b.close()
+
+
+def test_a_dial_waits_for_a_late_peer_without_a_deadline():
+    subprocess.run([sys.executable, __file__, "clock"], check=True)
+
+
+async def late_peer(clock):
+    origin = moq.OriginProducer()
+    async with socket.Endpoint(origin, "room", "a") as a:
+        dial = await start(a.dial_tcp("b"))
+        clock.advance(24 * 60 * 60)
+        async with socket.Endpoint(origin, "room", "b") as b:
+            incoming = await b.accept_tcp()
+            accepted = await incoming.accept()
+            connected = await dial
+            assert connected.session == accepted.session
+            connected.producer.finish()
+            accepted.producer.finish()
+            assert await connected.consumer.read_frame() is None
+            assert await accepted.consumer.read_frame() is None
+
+
+async def test_cancelling_acceptance_drops_the_original_dial_while_proving_routability():
+    origin = moq.OriginProducer()
+    endpoint = socket.Endpoint(origin, "room", "server")
+    forged = origin.route("room/.socket/forged", hidden=True)
+    returning = forged.broadcast.requests()
+    forged.announce()
+    incoming = await start(endpoint.accept_tcp())
+    broadcast = await origin.consume().request("room/.socket/server")
+    original = await start(broadcast.subscribe_track("tcp/forged/server/0123456789abcdef0123456789abcdef"))
+    offered = await incoming
+    accepting = await start(offered.accept())
+    # Proof that accept is parked on the return path, before cancelling it.
+    returned = await returning.requested_track()
+    assert returned.name.startswith("tcp/forged/server/")
+    accepting.cancel()
+    with pytest.raises(asyncio.CancelledError):
+        await accepting
+    with pytest.raises(moq.Error.Cancelled):
+        await original
+    endpoint.close()
+    forged.broadcast.close()
+
+
+async def test_dropping_the_endpoint_resets_a_live_session():
+    a, b = endpoints()
+    client, server = await tcp(a, b)
+    del a
+    gc.collect()
+    # Withdrawal and the session's cancellation can reach either reader first;
+    # the Rust contract guarantees a reset, with no clean EOF or promised cause.
+    reset = cast(type[Exception], moq.Error)
+    with pytest.raises(reset):
+        await server.consumer.read_frame()
+    with pytest.raises(reset):
+        await client.consumer.read_frame()
+    b.close()
+
+
+async def test_tcp_ready_paces_a_writer_behind_a_slow_reader():
+    a, b = endpoints()
+    client, server = await tcp(a, b)
+    mib, frames = 1024 * 1024, 48
+    written = read = 0
+    ahead = asyncio.Event()
+
+    async def write() -> None:
+        nonlocal written
+        for _ in range(frames):
+            await client.producer.ready(mib)
+            # Paced, the writer stays a window ahead of the reader, well short of the 32 MiB
+            # cache. Unpaced, it would shed frames the reader has not taken and evict it.
+            assert written - read < 32
+            client.producer.write_frame(bytes(mib))
+            written += 1
+            if written == 2:
+                ahead.set()
+        client.producer.finish()
+
+    writer = await start(write())
+    async for frame in server.consumer:
+        assert len(frame.payload) == mib
+        read += 1
+        if read == 1:
+            # Stall one frame in until the writer has run ahead of the reader.
+            await ahead.wait()
+    assert read == frames
+    await writer
+    server.producer.finish()
+    a.close()
+    b.close()
+
+
+if __name__ == "__main__":
+    from moq.testing import Clock
+
+    asyncio.run(late_peer(Clock()))
diff --git a/quest/m0/test-flakes-2/README.md b/quest/m0/test-flakes-2/README.md
index ebde3f4b9e0..0f3622170f7 100644
--- a/quest/m0/test-flakes-2/README.md
+++ b/quest/m0/test-flakes-2/README.md
@@ -100,6 +100,7 @@ Public API: none. Wire: none.
 ## Required
 
 - [Fallback playback](/quest/m0/test-flakes-2/ietf22-fallback.md) - a browser viewer follows a fallback within the media lane's bound without dropping its session
+- [The draft-22 wider-fill refusal test is deterministic](/quest/m0/test-flakes-2/ietf-wider-fill.md) - fix its intermittent live-group reset and re-enable both ordering cases without weakening their assertions
 - [moq-gst's interleaved restart test passes under load](/quest/m0/test-flakes-2/gst-reconnect-interleave.md) - `restarts_under_reconnects_interleave_on_one_pad` passes in loaded runs and the merge queue, its missed delivery and its stray `Eos` each fixed at the cause
 - [reload.test.ts's close-drain tests pass under load](/quest/m0/test-flakes-2/reload-close-drain.md) - the drain cases in `js/net`'s reload tests pass in loaded multi-file runs
 - [dispatch-query's terminate test survives load](/quest/m0/test-flakes-2/dispatch-query-terminate.md) - `test_terminating_the_run_stops_the_running_phase` passes reliably under host load, re-enabled once fixed
diff --git a/quest/m0/test-flakes-2/ietf-wider-fill.md b/quest/m0/test-flakes-2/ietf-wider-fill.md
new file mode 100644
index 00000000000..29023600e18
--- /dev/null
+++ b/quest/m0/test-flakes-2/ietf-wider-fill.md
@@ -0,0 +1,35 @@
+# [S] The draft-22 wider-fill refusal test is deterministic
+
+## Goal
+
+`draft-22: a wider fill is refused in %s order` in
+`js/net/src/ietf/publisher.test.ts` passes reliably in both ascending and
+descending order, alone and in the loaded suite. Find and fix why its live
+group intermittently resets while being read, then remove its quarantine
+without weakening the refusal or live-delivery assertions.
+
+## Plan
+
+Planned 2026-11-04 under the maintainer's rule to quarantine a known flaky
+test immediately and plan its investigation. This is one fixture's flake,
+so it is one child of this epic; m0 follows the epic's standing rule that a
+flake fails an entire merge batch.
+
+- The unchanged-main reproduction recorded in
+  [moq-dev/moq#7860](https://github.com/moq-dev/moq/pull/7860) failed 30/200
+  runs. [moq-dev/moq#7851](https://github.com/moq-dev/moq/pull/7851) already
+  quarantines the same named case. The socket work in
+  [moq-dev/moq#7883](https://github.com/moq-dev/moq/pull/7883) carries the
+  precise investigation reference; its absolute-start adapter correction
+  and controlled early-burst tests do not investigate this separate flake.
+- Start from the recorded reproduction and trace the live group's reset in
+  both orders. Establish whether fixture ownership, clock advancement,
+  stream ordering, or production behavior causes it before choosing a fix.
+  Control the responsible clock or event when the fixture is at fault;
+  fix the production source when it is not.
+- Restore the existing test in both orders with its assertions intact.
+  Neither retries, longer timeouts, nor disabling production behavior is a
+  fix. Record the original reproduction and loaded-suite results before
+  and after, including the commands and limits of that evidence.
+
+Public API: none expected. Wire: none.
diff --git a/quest/m1/socket/README.md b/quest/m1/socket/README.md
index 9c6cb7a616f..b35051f3fdf 100644
--- a/quest/m1/socket/README.md
+++ b/quest/m1/socket/README.md
@@ -189,7 +189,6 @@ announce-watch-request pairing remains in `rs/moq-boy`, `js/moq-boy`, or
 ## Required
 
 - [JS sockets](/quest/m1/socket/js.md) - the same surface in `@moq/net`, interoperating with Rust
-- [Python sockets](/quest/m1/socket/py.md) - moq-ffi and `py/moq-rs` bindings, interoperating with Rust
 - [moq-boy on sockets](/quest/m1/socket/boy.md) - viewers dial the emulator's endpoint and send commands and receive latency on their session
 - [CARLA on sockets](/quest/m1/socket/carla.md) - drivers dial the truck's endpoint and send control and receive acks on their session
 
diff --git a/quest/m1/socket/carla.md b/quest/m1/socket/carla.md
index 085c577d653..d605acc33cb 100644
--- a/quest/m1/socket/carla.md
+++ b/quest/m1/socket/carla.md
@@ -42,5 +42,4 @@ See the [epic](/quest/m1/socket/README.md) for the convention.
 
 ## Required
 
-- [Python sockets](/quest/m1/socket/py.md) - the truck's endpoint
 - [JS sockets](/quest/m1/socket/js.md) - the driver's dial
diff --git a/quest/m1/socket/py.md b/quest/m1/socket/py.md
deleted file mode 100644
index efc7e42eb6c..00000000000
--- a/quest/m1/socket/py.md
+++ /dev/null
@@ -1,18 +0,0 @@
-# [S] Python sockets
-
-## Goal
-
-moq-ffi exposes the socket `Endpoint`, `TcpStream`, and `TrackStream` beside
-origin, and `py/moq-rs` wraps them, so a Python endpoint accepts a Rust
-endpoint's dial and the reverse, in both protocols, carrying data both ways.
-
-## Plan
-
-Bind the Rust surface (`moq_net::socket`): `Endpoint::new`, `dial_tcp`,
-`accept_tcp`, `dial_track`, `accept_track`, an incoming dial's `accept` and
-`reject`, and each stream's `producer`, `consumer`, `peer`, and `session`
-(group handles for `TcpStream`, track handles for `TrackStream`), through
-moq-ffi the way origin's request
-and announce APIs are bound today (`rs/moq-ffi/src/origin.rs`,
-`py/moq-rs/moq/origin.py`). Add a Python/Rust interop test, and document the
-API wherever `py/moq-rs` documents origin.
diff --git a/rs/moq-cli/Cargo.toml b/rs/moq-cli/Cargo.toml
index 8ef89cc238b..cbcbdff05b3 100644
--- a/rs/moq-cli/Cargo.toml
+++ b/rs/moq-cli/Cargo.toml
@@ -209,5 +209,9 @@ path = "../../test/interop/clients/rust/hls.rs"
 name = "interop-audio"
 path = "../../test/interop/clients/rust/audio.rs"
 
+[[example]]
+name = "interop-socket"
+path = "../../test/interop/clients/rust/socket.rs"
+
 [lints]
 workspace = true
diff --git a/rs/moq-ffi/MIGRATE.md b/rs/moq-ffi/MIGRATE.md
index f6addc7a020..09a6cc2c73c 100644
--- a/rs/moq-ffi/MIGRATE.md
+++ b/rs/moq-ffi/MIGRATE.md
@@ -5,6 +5,12 @@ These are the UniFFI names; each language wrapper has its own `MIGRATE.md` in it
 
 ## Unreleased
 
+### Socket sessions
+
+MoqSocketEndpoint, MoqSocketIncomingTcp, MoqSocketIncomingTrack, MoqSocketTcpStream, and MoqSocketTrackStream now expose TCP group halves and reliably subscribed track halves beside origin. Regenerate bindings and rebuild the matching native library together. Existing callers need no migration. Socket endpoints require lite-07 or moq-transport on every hop; there is no wire change. Dropping an unfinished group producer now resets it with `Unroutable` instead of leaking Rust's programming-error `Dropped`; finished groups still end cleanly.
+
+`MoqGroupProducer::ready(size)` is a new async call that waits until a frame of `size` bytes fits a window ahead of the group's fastest reader. Await it before each `write_frame` so the writer waits for its fastest reader instead of evicting it, though not for slower readers; a TCP socket session needs it to behave like TCP. Existing writers are unchanged and still shed the group's front when they outpace their readers.
+
 ### Decoders refuse a disabled rendition ([#7942](https://github.com/moq-dev/moq/pull/7942))
 
 `MoqAudioConsumer::subscribe` and `MoqVideoConsumer::subscribe` fail with `MoqError::NotFound` when the rendition's `enabled` is false, instead of subscribing and waiting for a re-enable. Pick an enabled rendition from the latest catalog, and close a decoder whose rendition a newer catalog disables.
diff --git a/rs/moq-ffi/src/lib.rs b/rs/moq-ffi/src/lib.rs
index 2b68dd8e6e6..3eca58814ef 100644
--- a/rs/moq-ffi/src/lib.rs
+++ b/rs/moq-ffi/src/lib.rs
@@ -27,6 +27,7 @@ pub mod origin;
 pub mod producer;
 pub mod server;
 pub mod session;
+pub mod socket;
 #[cfg(feature = "video")]
 pub mod video;
 
diff --git a/rs/moq-ffi/src/producer.rs b/rs/moq-ffi/src/producer.rs
index a6a86b2d7c5..a6bc644d0d5 100644
--- a/rs/moq-ffi/src/producer.rs
+++ b/rs/moq-ffi/src/producer.rs
@@ -549,10 +549,7 @@ impl MoqFill {
 	pub fn accept(&self, sequence: u64) -> Result<Arc<MoqGroupProducer>, MoqError> {
 		let _guard = crate::ffi::enter();
 		let group = self.inner.accept(sequence, None)?;
-		Ok(Arc::new(MoqGroupProducer {
-			sequence: group.sequence,
-			inner: std::sync::Mutex::new(Some(group)),
-		}))
+		Ok(Arc::new(MoqGroupProducer::from_inner(group)))
 	}
 
 	/// Name groups `start` up to the exclusive `end` as never to be delivered.
@@ -698,6 +695,14 @@ impl Drop for MoqTrackProducer {
 }
 
 impl MoqTrackProducer {
+	/// Wrap a socket's track without a broadcast family.
+	pub(crate) fn from_socket(track: moq_net::track::Producer) -> Self {
+		Self {
+			inner: std::sync::Mutex::new(Some(track)),
+			keep: std::sync::Mutex::new(None),
+		}
+	}
+
 	/// Wrap `raw` as a child of the broadcast `children` belongs to.
 	fn child(raw: moq_net::track::Producer, children: &Children) -> Result<Arc<Self>, MoqError> {
 		children.adopt(Arc::new(Self {
@@ -780,10 +785,7 @@ impl MoqTrackProducer {
 		let mut guard = self.inner.lock().unwrap();
 		let raw = guard.as_mut().ok_or(MoqError::Closed)?;
 		let group = raw.append_group()?;
-		Ok(Arc::new(MoqGroupProducer {
-			sequence: group.sequence,
-			inner: std::sync::Mutex::new(Some(group)),
-		}))
+		Ok(Arc::new(MoqGroupProducer::from_inner(group)))
 	}
 
 	/// Create a group with an explicit sequence number.
@@ -795,10 +797,7 @@ impl MoqTrackProducer {
 		let mut guard = self.inner.lock().unwrap();
 		let raw = guard.as_mut().ok_or(MoqError::Closed)?;
 		let group = raw.create_group(moq_net::group::Info { sequence })?;
-		Ok(Arc::new(MoqGroupProducer {
-			sequence: group.sequence,
-			inner: std::sync::Mutex::new(Some(group)),
-		}))
+		Ok(Arc::new(MoqGroupProducer::from_inner(group)))
 	}
 
 	/// Write `frame` as a single-frame group.
@@ -873,7 +872,31 @@ impl MoqTrackProducer {
 #[derive(uniffi::Object)]
 pub struct MoqGroupProducer {
 	sequence: u64,
-	inner: std::sync::Mutex<Option<moq_net::group::Producer>>,
+	/// The group keeps one writer waker, so every [`ready`](Self::ready) call polls it with the
+	/// bridge's, which wakes them all. Every other call locks it through the bridge too, so a
+	/// wake it causes reaches a foreign continuation only after the lock is released.
+	inner: kio::Bridge<Option<moq_net::group::Producer>>,
+}
+
+impl Drop for MoqGroupProducer {
+	fn drop(&mut self) {
+		let _guard = crate::ffi::enter();
+		if let Some(group) = self.inner.get_mut().take()
+			&& group.poll_closed(&kio::Waiter::noop()).is_pending()
+		{
+			let _ = group.abort(moq_net::Error::Unroutable);
+		}
+	}
+}
+
+impl MoqGroupProducer {
+	/// Wrap `group`, for a track's writer or a socket's write half.
+	pub(crate) fn from_inner(group: moq_net::group::Producer) -> Self {
+		Self {
+			sequence: group.sequence,
+			inner: kio::Bridge::new(Some(group)),
+		}
+	}
 }
 
 #[uniffi::export]
@@ -886,7 +909,7 @@ impl MoqGroupProducer {
 	/// Create a consumer that reads frames from this group.
 	pub fn consume(&self) -> Result<Arc<MoqGroupConsumer>, MoqError> {
 		let _guard = crate::ffi::enter();
-		let guard = self.inner.lock().unwrap();
+		let guard = self.inner.lock();
 		let group = guard.as_ref().ok_or(MoqError::Closed)?;
 		Ok(Arc::new(MoqGroupConsumer::new(group.consume(), Background::default())))
 	}
@@ -899,18 +922,39 @@ impl MoqGroupProducer {
 	pub fn write_frame(&self, frame: MoqFrame) -> Result<(), MoqError> {
 		let _guard = crate::ffi::enter();
 		let timestamp = frame.timestamp.map(TryInto::try_into).transpose()?;
-		let mut guard = self.inner.lock().unwrap();
+		let mut guard = self.inner.lock();
 		let group = guard.as_mut().ok_or(MoqError::Closed)?;
 		group.write_frame(timestamp, frame.payload)?;
 		Ok(())
 	}
 
+	/// Wait until a frame of `size` bytes fits, so a writer runs no further ahead of its
+	/// fastest reader than the group's window.
+	///
+	/// Await this before each [`write_frame`](Self::write_frame) for backpressure: that reader
+	/// paces the writer instead of the group shedding frames it has not taken, which fails it
+	/// with `Evicted`; slower readers are not waited on. Writing without waiting never fails; the group
+	/// sheds its front instead. Resolves once a reader holds the group and the frame fits, at
+	/// once while a reader has taken every frame, and once the group is closed, so the next
+	/// write reports why. Fails with `Closed` after [`abort`](Self::abort).
+	pub async fn ready(&self, size: u64) -> Result<(), MoqError> {
+		let frame = moq_net::frame::Info { size, timestamp: None };
+		let mut park = kio::Park::default();
+		crate::ffi::run(kio::wait(|waiter| {
+			self.inner.poll(waiter, |group, cx| match group {
+				Some(group) => group.poll_ready(park.hold(cx), &frame).map(Ok),
+				None => Poll::Ready(Err(MoqError::Closed)),
+			})
+		}))
+		.await
+	}
+
 	/// Mark the group as complete. No more frames can be written.
 	///
 	/// The handle remains so a later [`abort`](Self::abort) can still run.
 	pub fn finish(&self) -> Result<(), MoqError> {
 		let _guard = crate::ffi::enter();
-		let mut guard = self.inner.lock().unwrap();
+		let mut guard = self.inner.lock();
 		let group = guard.as_mut().ok_or(MoqError::Closed)?;
 		group.finish()?;
 		Ok(())
@@ -919,8 +963,7 @@ impl MoqGroupProducer {
 	/// Abort this group with an application error code.
 	pub fn abort(&self, error_code: u16) -> Result<(), MoqError> {
 		let _guard = crate::ffi::enter();
-		let mut guard = self.inner.lock().unwrap();
-		let group = guard.take().ok_or(MoqError::Closed)?;
+		let group = self.inner.lock().take().ok_or(MoqError::Closed)?;
 		group.abort(moq_net::Error::App(error_code))?;
 		Ok(())
 	}
@@ -930,7 +973,7 @@ impl MoqGroupProducer {
 impl MoqGroupProducer {
 	/// Wait until a consumer wants this group.
 	pub(crate) async fn wanted(&self) -> Result<(), MoqError> {
-		let mut demand = self.inner.lock().unwrap().as_ref().ok_or(MoqError::Closed)?.demand();
+		let mut demand = self.inner.lock().as_ref().ok_or(MoqError::Closed)?.demand();
 		while !demand.wanted_changed().await? {}
 		Ok(())
 	}
@@ -946,14 +989,11 @@ mod metadata_tests {
 		let track = broadcast.create_track("test", moq_net::track::Info::default()).unwrap();
 		let group = track.append_group().unwrap();
 		let mut consumer = group.consume();
-		let binding = MoqGroupProducer {
-			sequence: group.sequence,
-			inner: std::sync::Mutex::new(Some(group)),
-		};
+		let binding = MoqGroupProducer::from_inner(group);
 		drop(binding);
 		assert!(matches!(
 			consumer.poll_read_frame(&moq_net::kio::Waiter::noop()),
-			std::task::Poll::Ready(Err(moq_net::Error::Dropped))
+			std::task::Poll::Ready(Err(moq_net::Error::Unroutable))
 		));
 	}
 
diff --git a/rs/moq-ffi/src/socket.rs b/rs/moq-ffi/src/socket.rs
new file mode 100644
index 00000000000..aead16417df
--- /dev/null
+++ b/rs/moq-ffi/src/socket.rs
@@ -0,0 +1,439 @@
+//! Point-to-point socket endpoints and their two protocol-specific streams.
+
+use std::sync::{Arc, Mutex};
+use std::task::{Poll, ready};
+
+use crate::consumer::{MoqGroupConsumer, MoqTrackConsumer};
+use crate::error::MoqError;
+use crate::ffi::{Background, Polled};
+use crate::origin::MoqOriginProducer;
+use crate::producer::{MoqGroupProducer, MoqTrackInfo, MoqTrackProducer};
+
+/// An endpoint announcing one hidden broadcast and accepting TCP and track dials separately.
+#[derive(uniffi::Object)]
+pub struct MoqSocketEndpoint {
+	inner: moq_net::socket::Endpoint,
+	driver: Background,
+}
+
+#[uniffi::export]
+impl MoqSocketEndpoint {
+	/// Announce `id` beneath `prefix`, using `origin` for publishing and finding peers.
+	#[uniffi::constructor]
+	pub fn new(origin: &MoqOriginProducer, prefix: String, id: String) -> Result<Arc<Self>, MoqError> {
+		let _guard = crate::ffi::enter();
+		let origin = origin.inner();
+		origin.driver.check()?;
+		let inner = moq_net::socket::Endpoint::new(origin, prefix, &id)?;
+		origin.driver.check()?;
+		Ok(Arc::new(Self {
+			inner,
+			driver: origin.driver.clone(),
+		}))
+	}
+
+	/// This endpoint's id.
+	pub fn id(&self) -> String {
+		self.inner.id().into()
+	}
+
+	/// The prefix beneath which this endpoint finds peers.
+	pub fn prefix(&self) -> String {
+		self.inner.prefix().to_string()
+	}
+
+	/// Retract the endpoint and reset its pending dials and sessions.
+	pub fn close(&self) {
+		let _guard = crate::ffi::enter();
+		self.inner.close();
+	}
+
+	/// Dial a new `tcp` session; cancelling this call resets only this dial.
+	pub async fn dial_tcp(&self, peer: String) -> Result<Arc<MoqSocketTcpStream>, MoqError> {
+		self.driver
+			.watch(async {
+				let stream = self.inner.dial_tcp(&peer)?.await?;
+				Ok(Arc::new(MoqSocketTcpStream::new(stream, self.driver.clone())))
+			})
+			.await
+	}
+
+	/// Start accepting `tcp` dials and await the next one, independently of the other protocol.
+	pub async fn accept_tcp(&self) -> Result<Arc<MoqSocketIncomingTcp>, MoqError> {
+		self.driver
+			.watch(async {
+				let inner = self.inner.accept_tcp().await?;
+				Ok(Arc::new(MoqSocketIncomingTcp {
+					peer: inner.peer().into(),
+					session: inner.session().into(),
+					inner: Mutex::new(Some(inner)),
+					driver: self.driver.clone(),
+				}))
+			})
+			.await
+	}
+
+	/// Dial a new `track` session; cancelling this call resets only this dial.
+	pub async fn dial_track(
+		&self,
+		peer: String,
+		info: Option<MoqTrackInfo>,
+	) -> Result<Arc<MoqSocketTrackStream>, MoqError> {
+		self.driver
+			.watch(async {
+				let stream = self
+					.inner
+					.dial_track(&peer, info.map(TryInto::try_into).transpose()?)?
+					.await?;
+				Ok(Arc::new(MoqSocketTrackStream::new(stream, self.driver.clone())))
+			})
+			.await
+	}
+
+	/// Start accepting `track` dials and await the next one, independently of the other protocol.
+	pub async fn accept_track(&self) -> Result<Arc<MoqSocketIncomingTrack>, MoqError> {
+		self.driver
+			.watch(async {
+				let inner = self.inner.accept_track().await?;
+				Ok(Arc::new(MoqSocketIncomingTrack {
+					peer: inner.peer().into(),
+					session: inner.session().into(),
+					inner: Mutex::new(Some(inner)),
+					driver: self.driver.clone(),
+				}))
+			})
+			.await
+	}
+}
+
+impl Drop for MoqSocketEndpoint {
+	fn drop(&mut self) {
+		self.close();
+	}
+}
+
+/// An incoming `tcp` dial, consumed by accepting or rejecting it.
+#[derive(uniffi::Object)]
+pub struct MoqSocketIncomingTcp {
+	inner: Mutex<Option<moq_net::socket::Incoming<moq_net::socket::TcpStream>>>,
+	peer: String,
+	session: String,
+	driver: Background,
+}
+
+#[uniffi::export]
+impl MoqSocketIncomingTcp {
+	/// The endpoint claiming this dial; accepting verifies it really dialed.
+	pub fn peer(&self) -> String {
+		self.peer.clone()
+	}
+	/// The random id of this session.
+	pub fn session(&self) -> String {
+		self.session.clone()
+	}
+	/// Verify return routability and accept; cancelling resets the dial.
+	pub async fn accept(&self) -> Result<Arc<MoqSocketTcpStream>, MoqError> {
+		self.driver.check()?;
+		let incoming = self.inner.lock().unwrap().take().ok_or(MoqError::Closed)?;
+		let accepting = Polled::new(incoming.accept()).supervised(self.driver.clone());
+		let stream = accepting
+			.wait(|inner, waiter| Poll::Ready(Ok(ready!(inner.poll_ok(waiter))?)))
+			.await?;
+		Ok(Arc::new(MoqSocketTcpStream::new(stream, self.driver.clone())))
+	}
+	/// Refuse the dial as not found.
+	pub fn reject(&self) -> Result<(), MoqError> {
+		let _guard = crate::ffi::enter();
+		self.driver.check()?;
+		self.inner.lock().unwrap().take().ok_or(MoqError::Closed)?.reject();
+		Ok(())
+	}
+}
+
+/// A `tcp` session exposing its existing producer and subscribed consumer handles.
+#[derive(uniffi::Object)]
+pub struct MoqSocketTcpStream {
+	producer: Arc<MoqGroupProducer>,
+	consumer: Arc<MoqGroupConsumer>,
+	peer: String,
+	session: String,
+}
+
+impl MoqSocketTcpStream {
+	fn new(inner: moq_net::socket::TcpStream, driver: Background) -> Self {
+		let peer = inner.peer().into();
+		let session = inner.session().into();
+		Self {
+			producer: Arc::new(MoqGroupProducer::from_inner(inner.producer)),
+			consumer: Arc::new(MoqGroupConsumer::new(inner.consumer, driver)),
+			peer,
+			session,
+		}
+	}
+}
+
+#[uniffi::export]
+impl MoqSocketTcpStream {
+	/// This side's write half.
+	pub fn producer(&self) -> Arc<MoqGroupProducer> {
+		self.producer.clone()
+	}
+	/// The peer's read half, retaining its reliable ascending subscription.
+	pub fn consumer(&self) -> Arc<MoqGroupConsumer> {
+		self.consumer.clone()
+	}
+	/// The peer endpoint's id.
+	pub fn peer(&self) -> String {
+		self.peer.clone()
+	}
+	/// The random id of this session.
+	pub fn session(&self) -> String {
+		self.session.clone()
+	}
+}
+
+/// An incoming `track` dial, consumed by accepting or rejecting it.
+#[derive(uniffi::Object)]
+pub struct MoqSocketIncomingTrack {
+	inner: Mutex<Option<moq_net::socket::Incoming<moq_net::socket::TrackStream>>>,
+	peer: String,
+	session: String,
+	driver: Background,
+}
+
+#[uniffi::export]
+impl MoqSocketIncomingTrack {
+	/// The endpoint claiming this dial; accepting verifies it really dialed.
+	pub fn peer(&self) -> String {
+		self.peer.clone()
+	}
+	/// The random id of this session.
+	pub fn session(&self) -> String {
+		self.session.clone()
+	}
+	/// Verify return routability and accept; cancelling resets the dial.
+	pub async fn accept(&self, info: Option<MoqTrackInfo>) -> Result<Arc<MoqSocketTrackStream>, MoqError> {
+		self.driver.check()?;
+		let info = info.map(TryInto::try_into).transpose()?;
+		let incoming = self.inner.lock().unwrap().take().ok_or(MoqError::Closed)?;
+		let accepting = Polled::new(incoming.accept(info)).supervised(self.driver.clone());
+		let stream = accepting
+			.wait(|inner, waiter| Poll::Ready(Ok(ready!(inner.poll_ok(waiter))?)))
+			.await?;
+		Ok(Arc::new(MoqSocketTrackStream::new(stream, self.driver.clone())))
+	}
+	/// Refuse the dial as not found.
+	pub fn reject(&self) -> Result<(), MoqError> {
+		let _guard = crate::ffi::enter();
+		self.driver.check()?;
+		self.inner.lock().unwrap().take().ok_or(MoqError::Closed)?.reject();
+		Ok(())
+	}
+}
+
+/// A `track` session exposing its existing producer and subscribed consumer handles.
+#[derive(uniffi::Object)]
+pub struct MoqSocketTrackStream {
+	producer: Arc<MoqTrackProducer>,
+	consumer: Arc<MoqTrackConsumer>,
+	peer: String,
+	session: String,
+}
+
+impl MoqSocketTrackStream {
+	fn new(inner: moq_net::socket::TrackStream, driver: Background) -> Self {
+		let peer = inner.peer().into();
+		let session = inner.session().into();
+		Self {
+			producer: Arc::new(MoqTrackProducer::from_socket(inner.producer)),
+			consumer: Arc::new(MoqTrackConsumer::new(inner.consumer, driver)),
+			peer,
+			session,
+		}
+	}
+}
+
+#[uniffi::export]
+impl MoqSocketTrackStream {
+	/// This side's write half.
+	pub fn producer(&self) -> Arc<MoqTrackProducer> {
+		self.producer.clone()
+	}
+	/// The peer's read half, retaining its reliable ascending subscription.
+	pub fn consumer(&self) -> Arc<MoqTrackConsumer> {
+		self.consumer.clone()
+	}
+	/// The peer endpoint's id.
+	pub fn peer(&self) -> String {
+		self.peer.clone()
+	}
+	/// The random id of this session.
+	pub fn session(&self) -> String {
+		self.session.clone()
+	}
+}
+
+#[cfg(test)]
+mod tests {
+	use super::*;
+	use crate::error::MoqProtocolKind;
+	use crate::media::MoqFrame;
+	use std::future::Future;
+	use std::pin::Pin;
+	use std::task::{Context, Waker};
+
+	fn pending(future: Pin<&mut impl Future>) {
+		assert!(future.poll(&mut Context::from_waker(Waker::noop())).is_pending());
+	}
+
+	fn endpoints() -> (Arc<MoqSocketEndpoint>, Arc<MoqSocketEndpoint>) {
+		let origin = MoqOriginProducer::new(Default::default());
+		let a = MoqSocketEndpoint::new(&origin, "room".into(), "a".into()).unwrap();
+		let b = MoqSocketEndpoint::new(&origin, "room".into(), "b".into()).unwrap();
+		(a, b)
+	}
+
+	fn frame(payload: &[u8]) -> MoqFrame {
+		MoqFrame {
+			payload: payload.into(),
+			timestamp: None,
+		}
+	}
+
+	async fn tcp(a: &MoqSocketEndpoint, b: &MoqSocketEndpoint) -> (Arc<MoqSocketTcpStream>, Arc<MoqSocketTcpStream>) {
+		let mut incoming = Box::pin(b.accept_tcp());
+		pending(incoming.as_mut());
+		let (dialed, accepted) = tokio::join!(a.dial_tcp(b.id()), async { incoming.await.unwrap().accept().await });
+		(dialed.unwrap(), accepted.unwrap())
+	}
+
+	#[tokio::test]
+	async fn tcp_halves_outlive_the_stream_and_preserve_fin() {
+		let (a, b) = endpoints();
+		let (client, server) = tcp(&a, &b).await;
+		assert_eq!((client.peer(), server.peer()), ("b".into(), "a".into()));
+		assert_eq!(client.session(), server.session());
+		let producer = client.producer();
+		let reader = client.consumer();
+		let consumer = server.consumer();
+		drop(client);
+		producer.write_frame(frame(b"one")).unwrap();
+		producer.write_frame(frame(b"two")).unwrap();
+		producer.finish().unwrap();
+		drop(producer);
+		assert_eq!(consumer.read_frame().await.unwrap().unwrap().payload, b"one");
+		assert_eq!(consumer.read_frame().await.unwrap().unwrap().payload, b"two");
+		assert!(consumer.read_frame().await.unwrap().is_none());
+		server.producer().finish().unwrap();
+		assert!(reader.read_frame().await.unwrap().is_none());
+	}
+
+	#[tokio::test]
+	async fn tcp_reset_is_not_fin_and_does_not_close_another_session() {
+		let (a, b) = endpoints();
+		let (client, server) = tcp(&a, &b).await;
+		let (other, peer) = tcp(&a, &b).await;
+		assert_ne!(client.session(), other.session());
+		client.producer().abort(42).unwrap();
+		let error = server.consumer().read_frame().await.err().unwrap();
+		assert!(matches!(error, MoqError::Protocol { details } if details.kind == MoqProtocolKind::App));
+		other.producer().write_frame(frame(b"independent")).unwrap();
+		other.producer().finish().unwrap();
+		assert_eq!(
+			peer.consumer().read_frame().await.unwrap().unwrap().payload,
+			b"independent"
+		);
+		assert!(peer.consumer().read_frame().await.unwrap().is_none());
+	}
+
+	#[tokio::test]
+	async fn dropping_an_unfinished_tcp_writer_resets_with_a_deliberate_cause() {
+		let (a, b) = endpoints();
+		let (client, server) = tcp(&a, &b).await;
+		let consumer = client.consumer();
+		// Keep the read half: dropping the write half must cause the reset itself.
+		drop(client);
+		let error = server.consumer().read_frame().await.err().unwrap();
+		assert!(matches!(error, MoqError::Protocol { details } if details.kind == MoqProtocolKind::Unroutable));
+		drop(consumer);
+	}
+
+	#[tokio::test]
+	async fn cancelled_accept_wait_leaves_the_queue_and_rejection_is_one_shot() {
+		let (a, b) = endpoints();
+		let mut abandoned = Box::pin(b.accept_tcp());
+		pending(abandoned.as_mut());
+		drop(abandoned);
+		let (dialed, ()) = tokio::join!(a.dial_tcp(b.id()), async {
+			let incoming = b.accept_tcp().await.unwrap();
+			assert_eq!(incoming.peer(), "a");
+			incoming.reject().unwrap();
+			assert!(matches!(incoming.reject(), Err(MoqError::Closed)));
+		});
+		assert!(matches!(dialed, Err(MoqError::NotFound)));
+		let _ = tcp(&a, &b).await;
+	}
+
+	#[tokio::test]
+	async fn cancelling_a_dial_resets_its_incoming_but_the_endpoint_can_dial_again() {
+		let (a, b) = endpoints();
+		let mut incoming = Box::pin(b.accept_tcp());
+		pending(incoming.as_mut());
+		let mut dial = Box::pin(a.dial_tcp(b.id()));
+		pending(dial.as_mut());
+		let incoming = tokio::select! {
+			incoming = incoming => incoming.unwrap(),
+			_ = &mut dial => panic!("dial resolved without acceptance"),
+		};
+		drop(dial);
+		assert!(incoming.accept().await.is_err());
+		let _ = tcp(&a, &b).await;
+	}
+
+	#[tokio::test]
+	async fn track_subscription_survives_stream_release_and_has_no_default_age_limit() {
+		let (a, b) = endpoints();
+		let mut incoming = Box::pin(b.accept_track());
+		pending(incoming.as_mut());
+		let (client, server) = tokio::join!(a.dial_track(b.id(), None), async {
+			incoming.await.unwrap().accept(None).await
+		});
+		let (client, server) = (client.unwrap(), server.unwrap());
+		assert_eq!(client.session(), server.session());
+		let producer = client.producer();
+		let reverse = server.producer();
+		let consumer = server.consumer();
+		drop(server);
+		assert!(consumer.info().max_age_unlimited);
+		// Create the later group first: the reliable ascending reader must wait for 0.
+		let later = producer.create_group(1).unwrap();
+		later.write_frame(frame(b"later")).unwrap();
+		later.finish().unwrap();
+		let first = producer.create_group(0).unwrap();
+		first.write_frame(frame(b"first")).unwrap();
+		first.finish().unwrap();
+		producer.finish().unwrap();
+		assert_eq!(consumer.read_frame().await.unwrap().unwrap().payload, b"first");
+		assert_eq!(consumer.read_frame().await.unwrap().unwrap().payload, b"later");
+		assert!(consumer.read_frame().await.unwrap().is_none());
+		reverse.finish().unwrap();
+		assert!(client.consumer().read_frame().await.unwrap().is_none());
+	}
+
+	#[tokio::test]
+	async fn protocols_are_independent_and_endpoint_close_wakes_both_queues() {
+		let (a, b) = endpoints();
+		let mut incoming = Box::pin(b.accept_tcp());
+		pending(incoming.as_mut());
+		tokio::select! {
+			result = a.dial_track(b.id(), None) => assert!(matches!(result, Err(MoqError::Unsupported))),
+			_ = &mut incoming => panic!("track dial arrived in the TCP queue"),
+		}
+		let mut tracks = Box::pin(b.accept_track());
+		pending(tracks.as_mut());
+		b.close();
+		assert!(matches!(incoming.await, Err(MoqError::Closed)));
+		assert!(matches!(tracks.await, Err(MoqError::Closed)));
+		assert!(matches!(b.dial_tcp(a.id()).await, Err(MoqError::Closed)));
+	}
+}
diff --git a/rs/moq-ffi/src/test.rs b/rs/moq-ffi/src/test.rs
index 3c30ea5b164..7f5c2e452cd 100644
--- a/rs/moq-ffi/src/test.rs
+++ b/rs/moq-ffi/src/test.rs
@@ -9330,3 +9330,251 @@ async fn datagram_cancel_releases_demand_and_wakes_reads() {
 	assert!(matches!(pending.await.unwrap(), Err(MoqError::Cancelled)));
 	assert_eq!(producer.priority_changed(Some(0)).await.unwrap(), None);
 }
+
+/// One MiB of frame, so a few dozen run past a group's 32 MiB cache.
+const MIB: usize = 1024 * 1024;
+
+/// Write `frames` MiB frames into a fresh group behind a reader that took only the first,
+/// waiting on `ready` before each later one when `paced`. Returns the writer's progress, its task, and
+/// the reader.
+async fn write_ahead_of_a_slow_reader(
+	frames: usize,
+	paced: bool,
+) -> (
+	Arc<std::sync::atomic::AtomicUsize>,
+	tokio::task::JoinHandle<Result<(), MoqError>>,
+	Arc<MoqGroupConsumer>,
+	Arc<MoqBroadcastProducer>,
+	Arc<MoqTrackProducer>,
+) {
+	let broadcast = MoqBroadcastProducer::new().unwrap();
+	let track = broadcast.publish_track("tcp".into(), None).unwrap();
+	let group = track.append_group().unwrap();
+	let reader = group.consume().unwrap();
+	let frame = || MoqFrame {
+		payload: vec![7; MIB],
+		timestamp: None,
+	};
+
+	// The reader holds the group and takes the first frame, then stalls.
+	group.write_frame(frame()).unwrap();
+	let first = kio::clock::timeout(TIMEOUT, reader.read_frame())
+		.await
+		.expect("no first frame")
+		.unwrap();
+	assert_eq!(first.map(|frame| frame.payload.len()), Some(MIB));
+
+	let written = Arc::new(std::sync::atomic::AtomicUsize::new(1));
+	let writer = {
+		let group = group.clone();
+		let written = written.clone();
+		tokio::spawn(async move {
+			for _ in 1..frames {
+				if paced {
+					group.ready(MIB as u64).await?;
+				}
+				group.write_frame(frame())?;
+				written.fetch_add(1, std::sync::atomic::Ordering::SeqCst);
+			}
+			group.finish()
+		})
+	};
+	(written, writer, reader, broadcast, track)
+}
+
+/// A writer awaiting `ready` stops a window ahead of a stalled reader instead of running
+/// past the cache, and the reader then takes every frame, as TCP backpressure would.
+#[tokio::test]
+async fn ready_paces_a_writer_behind_a_slow_reader() {
+	const FRAMES: usize = 48;
+	let (written, writer, reader, _broadcast, _track) = write_ahead_of_a_slow_reader(FRAMES, true).await;
+
+	// Let the writer run as far as it can while the reader stalls.
+	for _ in 0..50 {
+		ffi_caught_up().await;
+		kio::clock::sleep(Duration::from_millis(2)).await;
+	}
+	let ahead = written.load(std::sync::atomic::Ordering::SeqCst);
+	assert!(!writer.is_finished(), "the writer never waited");
+	assert!(
+		ahead > 1 && ahead < 32,
+		"{ahead} MiB written past a reader one frame in"
+	);
+
+	let mut read = 1;
+	while let Some(frame) = kio::clock::timeout(TIMEOUT, reader.read_frame())
+		.await
+		.expect("the read stalled")
+		.expect("a paced reader is never evicted")
+	{
+		assert_eq!(frame.payload.len(), MIB);
+		read += 1;
+	}
+	assert_eq!(read, FRAMES);
+	kio::clock::timeout(TIMEOUT, writer)
+		.await
+		.expect("the writer stalled")
+		.unwrap()
+		.unwrap();
+}
+
+/// Without `ready`, the same writer runs past the cache and the stalled reader is evicted.
+#[tokio::test]
+async fn an_unpaced_writer_evicts_a_slow_reader() {
+	let (_written, writer, reader, _broadcast, _track) = write_ahead_of_a_slow_reader(48, false).await;
+	kio::clock::timeout(TIMEOUT, writer)
+		.await
+		.expect("the writer stalled")
+		.unwrap()
+		.unwrap();
+	let failed = kio::clock::timeout(TIMEOUT, async {
+		loop {
+			match reader.read_frame().await {
+				Ok(Some(_)) => continue,
+				Ok(None) => return None,
+				Err(err) => return Some(err),
+			}
+		}
+	})
+	.await
+	.expect("the read stalled");
+	assert!(failed.is_some(), "the stalled reader kept every frame");
+}
+
+/// `ready` fails once the group is aborted through its handle.
+#[tokio::test]
+async fn ready_after_abort_is_closed() {
+	let broadcast = MoqBroadcastProducer::new().unwrap();
+	let track = broadcast.publish_track("tcp".into(), None).unwrap();
+	let group = track.append_group().unwrap();
+	group.abort(1).unwrap();
+	assert!(matches!(group.ready(1).await, Err(MoqError::Closed)));
+}
+
+/// Two calls waiting on the same group both wake once the reader drains, though the group
+/// keeps only one writer waker.
+#[tokio::test]
+async fn concurrent_ready_calls_all_wake() {
+	let broadcast = MoqBroadcastProducer::new().unwrap();
+	let track = broadcast.publish_track("tcp".into(), None).unwrap();
+	let group = track.append_group().unwrap();
+	let reader = group.consume().unwrap();
+	let frame = || MoqFrame {
+		payload: vec![7; MIB],
+		timestamp: None,
+	};
+	group.write_frame(frame()).unwrap();
+	assert!(
+		kio::clock::timeout(TIMEOUT, reader.read_frame())
+			.await
+			.unwrap()
+			.unwrap()
+			.is_some()
+	);
+	// Run the window full while the reader stalls one frame in.
+	for _ in 0..24 {
+		group.write_frame(frame()).unwrap();
+	}
+
+	let waits = [
+		spawn_parked(ready(group.clone())).await,
+		spawn_parked(ready(group.clone())).await,
+	];
+	assert!(waits.iter().all(|wait| !wait.is_finished()), "the window was not full");
+
+	while let Some(_frame) = kio::clock::timeout(TIMEOUT, reader.read_frame())
+		.await
+		.expect("the read stalled")
+		.unwrap()
+	{
+		if waits.iter().all(|wait| wait.is_finished()) {
+			break;
+		}
+		ffi_caught_up().await;
+	}
+	for wait in waits {
+		kio::clock::timeout(TIMEOUT, wait)
+			.await
+			.expect("a ready call was stranded")
+			.unwrap()
+			.unwrap();
+	}
+
+	async fn ready(group: Arc<MoqGroupProducer>) -> Result<(), MoqError> {
+		group.ready(MIB as u64).await
+	}
+}
+
+/// A call waiting for room ends with `Closed` once the group is aborted.
+#[tokio::test]
+async fn a_waiting_ready_ends_on_abort() {
+	let broadcast = MoqBroadcastProducer::new().unwrap();
+	let track = broadcast.publish_track("tcp".into(), None).unwrap();
+	let group = track.append_group().unwrap();
+	// No reader holds the group, so the call waits.
+	let wait = {
+		let group = group.clone();
+		spawn_parked(async move { group.ready(1).await }).await
+	};
+	assert!(!wait.is_finished());
+	group.abort(1).unwrap();
+	let result = kio::clock::timeout(TIMEOUT, wait)
+		.await
+		.expect("ready stranded")
+		.unwrap();
+	assert!(matches!(result, Err(MoqError::Closed)), "{result:?}");
+}
+
+/// UniFFI's waker runs the foreign continuation on the waking thread, and a binding may poll
+/// the woken call right there. A group call that wakes a parked `ready` must release the group
+/// first, or that inline poll deadlocks on it.
+#[tokio::test]
+async fn group_calls_wake_ready_after_unlocking() {
+	type Ready = std::pin::Pin<Box<dyn Future<Output = Result<(), MoqError>> + Send>>;
+
+	/// Polls its call inline on every wake, as an unconfined coroutine would.
+	struct Inline {
+		ready: std::sync::Mutex<Ready>,
+		result: std::sync::Mutex<Option<Result<(), MoqError>>>,
+	}
+	impl Inline {
+		fn park(group: &Arc<MoqGroupProducer>) -> Arc<Self> {
+			let group = group.clone();
+			let inline = Arc::new(Self {
+				ready: std::sync::Mutex::new(Box::pin(async move { group.ready(1).await })),
+				result: Default::default(),
+			});
+			inline.poll();
+			assert!(inline.result.lock().unwrap().is_none(), "no reader holds the group yet");
+			inline
+		}
+		fn poll(self: &Arc<Self>) {
+			// The call wakes itself while it ends; that wake has nothing left to poll.
+			let Ok(mut ready) = self.ready.try_lock() else { return };
+			let waker = std::task::Waker::from(self.clone());
+			if let std::task::Poll::Ready(result) = ready.as_mut().poll(&mut std::task::Context::from_waker(&waker)) {
+				*self.result.lock().unwrap() = Some(result);
+			}
+		}
+	}
+	impl std::task::Wake for Inline {
+		fn wake(self: Arc<Self>) {
+			self.poll();
+		}
+	}
+
+	let broadcast = MoqBroadcastProducer::new().unwrap();
+	let track = broadcast.publish_track("tcp".into(), None).unwrap();
+
+	let group = track.append_group().unwrap();
+	let parked = Inline::park(&group);
+	let _reader = group.consume().unwrap();
+	let result = parked.result.lock().unwrap().take();
+	assert!(matches!(result, Some(Ok(()))), "{result:?}");
+
+	let group = track.append_group().unwrap();
+	let parked = Inline::park(&group);
+	group.abort(1).unwrap();
+	let result = parked.result.lock().unwrap().take();
+	assert!(matches!(result, Some(Err(MoqError::Closed))), "{result:?}");
+}
diff --git a/rs/moq-ffi/uniffi.toml b/rs/moq-ffi/uniffi.toml
index ddaf3cc8ec6..08b5bd52d35 100644
--- a/rs/moq-ffi/uniffi.toml
+++ b/rs/moq-ffi/uniffi.toml
@@ -3,5 +3,6 @@
 # generated forced end is `end()` so it doesn't collide with it.
 [bindings.kotlin.rename]
 "MoqBroadcastProducer.close" = "end"
+"MoqSocketEndpoint.close" = "end"
 # See MoqRoute::instance_id: the C++ generator reserves `instance`, Kotlin does not.
 "MoqRoute.instance_id" = "instance"
diff --git a/rs/moq-net/MIGRATE.md b/rs/moq-net/MIGRATE.md
index 45e1fc292b1..13e37ae6884 100644
--- a/rs/moq-net/MIGRATE.md
+++ b/rs/moq-net/MIGRATE.md
@@ -4,6 +4,18 @@ How to update your code for each breaking change, newest first.
 
 ## Unreleased
 
+### Socket readers start at the beginning
+
+New `track` socket sessions subscribe from group 0, and `tcp` sessions join their
+half's only group from its first frame, so an acceptor's first burst is preserved
+when its subscription answer arrives after its writes. Existing
+callers need no migration; socket naming and the public API are unchanged.
+IETF subscribers and publishers also honor explicit starts on every supported
+draft, keeping a prefix written before the answer arrived. A start of group 0 is a
+filterless SUBSCRIBE on every draft, and the groups below the answer's Largest
+Object come from one range FETCH. A SUBSCRIBE that omits the filter still joins
+live, so third-party readers and relay caches see no change.
+
 ### Origins prove a route key ([#7937](https://github.com/moq-dev/moq/pull/7937))
 
 `origin::Config::route_key` takes an `origin::RouteKey`, which every lite-07 session on the origin proves to its peer in SETUP. Origins sharing a key fail over as one to a peer that scopes them; `None`, the default, proves nothing.
diff --git a/rs/moq-net/src/ietf/publisher.rs b/rs/moq-net/src/ietf/publisher.rs
index 0ed10727bfb..d5394ffbe45 100644
--- a/rs/moq-net/src/ietf/publisher.rs
+++ b/rs/moq-net/src/ietf/publisher.rs
@@ -1802,7 +1802,7 @@ impl SubscribeTrack {
 		// bound the subscription before subscribing so the ratio never judges it. From the
 		// start of its group, so a relay's copy holds the group's head for its other readers,
 		// as a live join would; the resolved range trims below.
-		let fixed: ServeRange = subscribe_range(msg.filter, LiveEdge::default(), publisher.version);
+		let fixed: ServeRange = filter_range(msg.filter, LiveEdge::default());
 		if let Some(start) = fixed.start {
 			ServeRange {
 				start: Some(Location { object: 0, ..start }),
@@ -1846,7 +1846,7 @@ impl SubscribeTrack {
 		// current-group join (Next Object plus a StartGroup=1 fill) cover the group with no gap
 		// and no overlap.
 		let edge = live_edge(track);
-		let mut range = subscribe_range(msg.filter, edge, publisher.version);
+		let mut range = filter_range(msg.filter, edge);
 		let fill = msg
 			.fill
 			.filter(|_| msg.forward && Filter::is_draft20(publisher.version))
@@ -11929,6 +11929,114 @@ mod serve_tests {
 		}
 	}
 
+	/// A filterless SUBSCRIBE without a fill joins the latest group, as a relay cache always
+	/// served one; only an absolute start from group 0 replays the groups before it.
+	#[kio::test]
+	async fn only_an_absolute_start_replays_history() {
+		// Bounded, since draft 20 spells an open {0, 0} as no filter at all.
+		let zero = Filter::Absolute {
+			start: Location::default(),
+			end: Some(EndLocation { group: 1, object: None }),
+		};
+		for version in [Version::Draft18, Version::Draft20, Version::Draft22] {
+			for (filter, history) in [(Filter::Unfiltered, 0), (zero, 1)] {
+				let mut h = serve(version);
+				for (sequence, payload) in [(0, b"history"), (1, b"latest!")] {
+					let mut group = h.track.create_group(group::Info { sequence }).unwrap();
+					group.write_frame(timestamp(), payload.as_slice()).unwrap();
+					group.finish().unwrap();
+				}
+
+				run_live(&mut h, subscribe(filter, None)).await;
+
+				assert_eq!(occurrences(&h.log, b"latest!"), 1, "{version} {filter:?}");
+				assert_eq!(occurrences(&h.log, b"history"), history, "{version} {filter:?}");
+				assert_eq!(occurrences(&h.log, FETCH_STREAM), 0, "{version} {filter:?}");
+			}
+		}
+	}
+
+	/// The same through a relay: once an earlier reader warmed the relay's copy from group 0,
+	/// a filterless SUBSCRIBE still joins the latest group, and only an absolute start from
+	/// group 0 replays the cached history.
+	#[cfg(feature = "async")]
+	#[kio::test]
+	async fn a_relay_copy_replays_history_only_to_an_absolute_start() {
+		const TIMEOUT: Duration = Duration::from_secs(5);
+		// Bounded, since draft 20 spells an open {0, 0} as no filter at all.
+		let zero = Filter::Absolute {
+			start: Location::default(),
+			end: Some(EndLocation { group: 1, object: None }),
+		};
+		for version in [Version::Draft18, Version::Draft20, Version::Draft22] {
+			for (filter, history) in [(Filter::Unfiltered, 0), (zero, 1)] {
+				let upstream = crate::origin::Config::new(crate::Hop::new(2).unwrap()).produce();
+				let broadcast = upstream.route("room", crate::origin::RouteOptions::default()).unwrap();
+				let track = broadcast
+					.broadcast()
+					.create_track("video", crate::track::Info::timed().with_max_age(None))
+					.unwrap();
+				for (sequence, payload) in [(0, b"history"), (1, b"latest!")] {
+					let mut group = track.create_group(group::Info { sequence }).unwrap();
+					group.write_frame(timestamp(), payload.as_slice()).unwrap();
+					group.finish().unwrap();
+				}
+				let (relay, _sessions) = crate::lite::ietf::test_hop(&upstream, "room", [false, false]).await;
+
+				// An earlier reader of the relay asked from group 0, so its copy holds both.
+				let warm = kio::clock::timeout(TIMEOUT, relay.consume().request("room", None))
+					.await
+					.expect("no broadcast")
+					.unwrap();
+				let mut reader = kio::clock::timeout(
+					TIMEOUT,
+					warm.track("video").unwrap().subscribe(
+						crate::track::Subscription::default()
+							.with_range(0..)
+							.with_order(crate::track::Order::Ascending)
+							.with_delay(crate::track::Delay::default().with_max(None)),
+					),
+				)
+				.await
+				.expect("no subscription")
+				.unwrap();
+				for expected in [0, 1] {
+					let group = kio::clock::timeout(TIMEOUT, reader.recv_group())
+						.await
+						.expect("no group")
+						.unwrap()
+						.expect("track finished");
+					assert_eq!(group.sequence, expected, "{version} {filter:?}");
+				}
+
+				let session = ScriptedSession::per_stream(vec![Vec::new()]);
+				let peer_setup = peer::PeerSetup::default();
+				peer_setup.set(peer::Peer::default());
+				let mut h = Serve {
+					publisher: Publisher::new(
+						crate::time::sim(),
+						crate::driver::Transport::new(session.clone()),
+						relay.consume(),
+						Control::new(false),
+						None,
+						peer_setup,
+						version,
+					),
+					log: session.log.clone(),
+					session,
+					track,
+					_origin: relay,
+					_broadcast: broadcast,
+				};
+				run_live(&mut h, subscribe(filter, None)).await;
+
+				assert_eq!(occurrences(&h.log, b"latest!"), 1, "{version} {filter:?}");
+				assert_eq!(occurrences(&h.log, b"history"), history, "{version} {filter:?}");
+				drop(reader);
+			}
+		}
+	}
+
 	/// A wider fill resets its promised stream and leaves the live subscription open.
 	#[kio::test]
 	async fn a_multi_group_fill_is_refused_without_ending_the_subscription() {
@@ -20028,27 +20136,13 @@ struct GroupSlice {
 	until: Option<u64>,
 }
 
-/// Resolve a SUBSCRIBE's Location Filter into the range to serve.
-///
-/// Next Object is honored on every draft so a joining FETCH owns the cached prefix.
-/// Other draft-18 filters retain their existing serving behavior.
-fn subscribe_range(filter: Filter, edge: LiveEdge, version: Version) -> ServeRange {
-	if !Filter::is_draft20(version) && filter != Filter::NextObject {
-		if !matches!(filter, Filter::NextObject | Filter::Unfiltered) {
-			tracing::warn!(?filter, "filter not supported before draft-22, ignoring");
-		}
-		return ServeRange::default();
-	}
-
-	filter_range(filter, edge)
-}
-
 /// The Locations a single Location Filter selects, resolved against the live edge.
 fn filter_range(filter: Filter, edge: LiveEdge) -> ServeRange {
 	match filter {
 		// No restriction. moq-lite starts at the beginning of the latest group, which is
 		// the join point it is built around; a subscription passes objects as they are
-		// published, so an absent filter is not a request to replay history.
+		// published, so an absent filter is not a request to replay history. A subscriber
+		// that wants the track from its start fetches the groups before the live one.
 		Filter::Unfiltered => ServeRange::default(),
 		// `{Largest.Group, Largest.Object + 1}`. Everything below it, including the
 		// already-published head of the current group, is outside the requested range,
@@ -20223,17 +20317,19 @@ mod range_tests {
 		assert_eq!(group.sequence, 9);
 	}
 
-	/// Earlier drafts never had their absolute filters served, so honoring one now would
-	/// change what an existing peer receives.
+	/// An absolute start and end retain their bounds on every draft.
 	#[test]
-	fn older_drafts_are_ignored() {
+	fn absolute_filters_keep_their_bounds() {
 		let msg = subscribe(Filter::Absolute {
 			start: Location { group: 4, object: 0 },
 			end: Some(EndLocation { group: 9, object: None }),
 		});
 		assert_eq!(
-			subscribe_range(msg.filter, EDGE, Version::Draft18),
-			ServeRange::default()
+			filter_range(msg.filter, EDGE),
+			ServeRange {
+				start: Some(Location { group: 4, object: 0 }),
+				end: Some(EndLocation { group: 9, object: None })
+			}
 		);
 	}
 
@@ -20242,9 +20338,22 @@ mod range_tests {
 	#[test]
 	fn an_unfiltered_subscription_stays_live() {
 		let msg = subscribe(Filter::Unfiltered);
+		assert_eq!(filter_range(msg.filter, EDGE), ServeRange::default());
+	}
+
+	/// An absolute start from group 0 is the request for history the absent filter is not.
+	#[test]
+	fn an_absolute_zero_start_includes_history() {
+		let msg = subscribe(Filter::Absolute {
+			start: Location::default(),
+			end: None,
+		});
 		assert_eq!(
-			subscribe_range(msg.filter, EDGE, Version::Draft22),
-			ServeRange::default()
+			filter_range(msg.filter, EDGE),
+			ServeRange {
+				start: Some(Location::default()),
+				end: None
+			}
 		);
 	}
 
@@ -20254,7 +20363,7 @@ mod range_tests {
 	fn next_object_starts_past_the_largest_object() {
 		let msg = subscribe(Filter::NextObject);
 		assert_eq!(
-			subscribe_range(msg.filter, EDGE, Version::Draft22),
+			filter_range(msg.filter, EDGE),
 			ServeRange {
 				start: Some(Location { group: 100, object: 5 }),
 				end: None,
@@ -20273,7 +20382,7 @@ mod range_tests {
 		};
 		let msg = subscribe(Filter::NextObject);
 		assert_eq!(
-			subscribe_range(msg.filter, edge, Version::Draft22),
+			filter_range(msg.filter, edge),
 			ServeRange {
 				start: Some(Location { group: 101, object: 0 }),
 				end: None,
@@ -20288,7 +20397,7 @@ mod range_tests {
 		for (groups, expected) in [(0, 101), (1, 100), (2, 99), (5, 96)] {
 			let msg = subscribe(Filter::Relative(groups));
 			assert_eq!(
-				subscribe_range(msg.filter, EDGE, Version::Draft22),
+				filter_range(msg.filter, EDGE),
 				ServeRange {
 					start: Some(Location {
 						group: expected,
@@ -20312,7 +20421,7 @@ mod range_tests {
 		};
 		let msg = subscribe(Filter::Relative(1));
 		assert_eq!(
-			subscribe_range(msg.filter, edge, Version::Draft22),
+			filter_range(msg.filter, edge),
 			ServeRange {
 				start: Some(Location { group: 0, object: 0 }),
 				end: None,
@@ -20325,7 +20434,7 @@ mod range_tests {
 	fn relative_saturates_at_the_start() {
 		let msg = subscribe(Filter::Relative(500));
 		assert_eq!(
-			subscribe_range(msg.filter, EDGE, Version::Draft22),
+			filter_range(msg.filter, EDGE),
 			ServeRange {
 				start: Some(Location { group: 0, object: 0 }),
 				end: None,
@@ -20337,10 +20446,7 @@ mod range_tests {
 	#[test]
 	fn relative_without_an_edge_stays_live() {
 		let msg = subscribe(Filter::Relative(3));
-		assert_eq!(
-			subscribe_range(msg.filter, LiveEdge::default(), Version::Draft22),
-			ServeRange::default()
-		);
+		assert_eq!(filter_range(msg.filter, LiveEdge::default()), ServeRange::default());
 	}
 
 	/// A group created but not yet written has no objects, so the largest sits in an
@@ -20478,7 +20584,7 @@ mod range_tests {
 			}),
 		});
 		assert_eq!(
-			subscribe_range(msg.filter, EDGE, Version::Draft22),
+			filter_range(msg.filter, EDGE),
 			ServeRange {
 				start: Some(Location { group: 4, object: 3 }),
 				end: Some(EndLocation {
diff --git a/rs/moq-net/src/ietf/subscriber.rs b/rs/moq-net/src/ietf/subscriber.rs
index 601aed8db01..71a51e3b941 100644
--- a/rs/moq-net/src/ietf/subscriber.rs
+++ b/rs/moq-net/src/ietf/subscriber.rs
@@ -3571,7 +3571,9 @@ struct SubscribeOnce {
 	deferred: bool,
 	start: Option<u64>,
 	join: Join,
-	/// A live join delivers nothing below the group SUBSCRIBE_OK names as Largest.
+	/// A live join delivers nothing below the group SUBSCRIBE_OK names as Largest; the
+	/// copy's fills fetch an earlier start's groups. An absolute start keeps its requested
+	/// prefix even if the answer arrives late.
 	live: bool,
 	/// A listed track's paused subscription, which this one resumes rather than open a
 	/// second one.
@@ -3772,9 +3774,7 @@ impl SubscribeOnce {
 					};
 					self.start = subscription.as_ref().and_then(|s| s.start());
 					self.join = subscribe_join(self.start, subscription.as_ref().and_then(|s| s.end()), this.version);
-					// Every draft-18 join is a live one, since its joining FETCH carries that
-					// group alone.
-					self.live = self.start.is_none() || self.join.fetch;
+					self.live = !matches!(self.join.filter, Filter::Absolute { .. });
 					self.subscription = subscription;
 					self.target = Some(target);
 
@@ -4367,6 +4367,16 @@ impl SubscribeOnce {
 				held.producer = Some(track.clone());
 				held.timescale = timescale;
 				held.fill_ok(largest);
+				// A group-0 start joins filterless with no fill for the Largest group's head,
+				// so a stream there that starts mid-group is a cut message: drop it, and the
+				// readers skip that group, rather than surface its tail as the whole group.
+				// Largest's object is inclusive, so even object 0 may already be gone.
+				if self.live
+					&& self.start == Some(0)
+					&& let Some(largest) = largest
+				{
+					held.headless_through = held.headless_through.max(Some(largest.group));
+				}
 			}
 		}
 		this.entry_info(&self.key, request_id, track.info());
@@ -6088,11 +6098,15 @@ impl OpenGroup {
 					// Without a fill, a relay preserves the subgroup's first Object ID and
 					// FIRST_OBJECT claim independently. Plain readers see only frame ordinals. A
 					// head that was owed and never came is the exception: the stream is the same
-					// unstitchable tail it is when it arrives before the fill settles, below.
+					// unstitchable tail it is when it arrives before the fill settles, below,
+					// unless it claims FIRST_OBJECT: a group may start past object 0.
 					if !fill.read().outstanding() {
 						let start = first.map_or(0, |first| first.id);
-						if start != 0 && (self.headless || fill.read().headless(sequence)) {
+						if start != 0 && !header.flags.first_object && (self.headless || fill.read().headless(sequence))
+						{
 							tracing::warn!(sequence, start, "no fill to stitch a mid-group stream onto");
+							// Never arriving whole, the group is dropped so readers stop owing it.
+							track.drop_groups(sequence..sequence + 1, crate::StreamError::NotFound);
 							return Poll::Ready(Err(Error::Unsupported));
 						}
 						return Poll::Ready(Ok(Opened::Group(create(track)?, start)));
@@ -6135,6 +6149,7 @@ impl OpenGroup {
 						(Some(start), Some((producer, _))) => Ok(Opened::Group(producer, start)),
 						(Some(start), None) => {
 							tracing::warn!(sequence, start, "no fill to stitch a mid-group stream onto");
+							track.drop_groups(sequence..sequence + 1, crate::StreamError::NotFound);
 							Err(Error::Unsupported)
 						}
 						(None, Some((producer, next))) => Ok(Opened::Group(producer, next)),
@@ -13944,19 +13959,25 @@ struct Join {
 /// to honor. It splits the group across two streams, the fill carrying the head and the
 /// subscription the tail, which `claim_fill` stitches back into one group producer.
 ///
-/// Earlier drafts have no fill parameter. Every subscription is a live join: Largest
-/// Object, followed by a joining FETCH relative at offset 0 for that group's head. An
-/// earlier start's missing groups are left to the copy's fills, one FETCH per run of them,
-/// and a later start skips the head locally. A join landing past a gap after a resumed
-/// copy's cache leaves those cached groups unjudgeable, so a finite budget gives them up
-/// rather than fetching them again. A bounded end has no joining-FETCH spelling
-/// either, so the join stays open and readers stop at their own end: refusing it would
-/// abort a resumed copy for every reader it serves.
+/// Earlier drafts have no fill parameter, so a live join uses Largest Object followed
+/// by a joining FETCH relative at offset 0 for that group's head.
+///
+/// A start of group 0 with no end is a filterless SUBSCRIBE on every draft, which our
+/// publishers serve from the start of the latest group, and the copy's fills fetch the
+/// groups below it as one range FETCH. Draft 20 has no absolute {0, 0} distinct from no
+/// filter, so no draft spells one.
 ///
-/// A start group we already know is absolute on draft-22 and needs no fill: the
-/// subscription's own range covers it, which is what our publisher serves from its cache.
+/// Any other known start group is absolute on every draft and needs no fill: the
+/// subscription's own range covers it, including a first burst that overtook its answer.
 fn subscribe_join(start: Option<u64>, end: Option<u64>, version: Version) -> Join {
-	if !Filter::is_draft20(version) {
+	if start == Some(0) && end.is_none() {
+		return Join {
+			filter: Filter::Unfiltered,
+			fill: None,
+			fetch: false,
+		};
+	}
+	if !Filter::is_draft20(version) && start.is_none() {
 		return Join {
 			filter: Filter::NextObject,
 			fill: None,
@@ -13976,12 +13997,6 @@ fn subscribe_join(start: Option<u64>, end: Option<u64>, version: Version) -> Joi
 			}),
 			fetch: false,
 		},
-		// An absolute {0, 0} with no end is defined as unfiltered, so it spells itself.
-		Some(0) if end.is_none() => Join {
-			filter: Filter::Unfiltered,
-			fill: None,
-			fetch: false,
-		},
 		Some(start) => Join {
 			filter: Filter::Absolute {
 				start: ietf::Location {
@@ -14076,28 +14091,28 @@ mod filter_tests {
 		);
 	}
 
-	/// The whole track has a spelling of its own: an absent filter is unrestricted.
+	/// The whole track joins live with no filter on every draft, and fetches what came before.
 	#[test]
 	fn the_whole_track_is_unfiltered() {
-		assert_eq!(
-			subscribe_join(Some(0), None, Version::Draft22),
-			Join {
-				filter: Filter::Unfiltered,
-				fill: None,
-				fetch: false,
-			}
-		);
+		for version in [Version::Draft18, Version::Draft20, Version::Draft22] {
+			assert_eq!(
+				subscribe_join(Some(0), None, version),
+				Join {
+					filter: Filter::Unfiltered,
+					fill: None,
+					fetch: false,
+				}
+			);
+		}
 	}
 
 	const JOINING_DRAFTS: [Version; 1] = [Version::Draft18];
 
-	/// Every draft-18 join is Largest Object plus a joining FETCH, whatever its start or
-	/// end, so the current group's head arrives on the fetch stream and the live tail on the
-	/// subscription.
+	/// A draft-18 live join gets its current group's head through a joining FETCH.
 	#[test]
-	fn older_drafts_always_join_live() {
+	fn older_drafts_join_live_without_an_absolute_start() {
 		for version in JOINING_DRAFTS {
-			for (start, end) in [(None, None), (Some(7), None), (Some(7), Some(10))] {
+			for (start, end) in [(None, None), (None, Some(10))] {
 				assert_eq!(
 					subscribe_join(start, end, version),
 					Join {
@@ -14197,7 +14212,7 @@ mod stitch_tests {
 	/// The subscription's own subgroup stream, starting at `start` because a strict
 	/// publisher delivers nothing before it: that head is the fill's job. Each object
 	/// carries the Timestamp of its Object ID.
-	fn tail_stream(sequence: u64, start: u64, payloads: &[&[u8]]) -> Vec<u8> {
+	pub(super) fn tail_stream(sequence: u64, start: u64, payloads: &[&[u8]]) -> Vec<u8> {
 		let mut buf = Vec::new();
 		ietf::GroupHeader {
 			track_alias: ALIAS,
@@ -15841,6 +15856,71 @@ mod stitch_tests {
 		assert!(matches!(group.read_frame().await, Err(Error::Cancel)));
 	}
 
+	/// A stream for a headless group that claims FIRST_OBJECT is whole even though its first
+	/// Object ID is past zero, so it is delivered rather than dropped as a cut tail.
+	#[kio::test]
+	async fn a_headless_group_claiming_its_first_object_is_delivered() {
+		let h = Harness::new(Fill::Done, vec![draft18_subgroup(SEQUENCE, true, 6, &[b"six"])]);
+		h.subscriber
+			.state
+			.lock()
+			.subscribes
+			.get_mut(&REQUEST)
+			.unwrap()
+			.headless_through = Some(SEQUENCE);
+		let mut consumer = h.track.subscribe(None);
+
+		let mut stream = h.stream().await;
+		h.subscriber.clone().recv_group(&mut stream).await.expect("group");
+		let (sequence, frames) = read_group(&mut consumer).await;
+		assert_eq!(sequence, SEQUENCE);
+		assert_eq!(frames.len(), 1);
+	}
+
+	/// A refused headless group is reported dropped, so a reader in sequence order, as a
+	/// `track` socket session reads, moves on to the next group rather than wait on it.
+	#[kio::test]
+	async fn a_refused_headless_group_does_not_stall_an_ordered_reader() {
+		let h = Harness::new(
+			Fill::Done,
+			vec![
+				tail_stream(SEQUENCE, 2, &[b"tail-2"]),
+				tail_stream(SEQUENCE + 1, 0, &[b"next-0"]),
+			],
+		);
+		// Subscribed before the answer, as the socket does.
+		let mut ordered = h
+			.track
+			.subscribe(Some(
+				track::Subscription::default()
+					.with_order(crate::track::Order::Ascending)
+					.with_delay(track::Delay::default().with_max(None)),
+			))
+			.with_range(0..)
+			.ordered();
+		h.track.received();
+		h.track.anchored_cached();
+		h.track.clone().start_at(SEQUENCE).unwrap();
+		h.subscriber
+			.state
+			.lock()
+			.subscribes
+			.get_mut(&REQUEST)
+			.unwrap()
+			.headless_through = Some(SEQUENCE);
+
+		h.dispatch_refused().await;
+
+		let mut next = h.stream().await;
+		h.subscriber.clone().recv_group(&mut next).await.expect("next group");
+		let group = match ordered.poll_next_group(&kio::Waiter::noop()) {
+			Poll::Ready(Ok(Some(group))) => group,
+			Poll::Ready(other) => panic!("no next group: {:?}", other.map(|group| group.map(|g| g.sequence))),
+			Poll::Pending => panic!("the ordered reader still waits on the refused group"),
+		};
+		assert_eq!(group.sequence, SEQUENCE + 1);
+	}
+
 	/// Widening updates replaced fills that failed to head this group and the next, and the
 	/// current fill has settled. A mid-group tail at or below the last failed group is still
 	/// headless, so it is dropped, while a whole group there stands alone.
@@ -17315,31 +17395,133 @@ mod joining_fetch_tests {
 		}
 	}
 
-	/// A start below, at, or past the Largest group joins that group alone: a group below it
-	/// is left to the copy's fills.
+	/// A known start stays absolute even below or past Largest, so it needs no live head fetch.
 	#[kio::test]
-	async fn a_join_from_any_start_fetches_only_the_largest_group() {
+	async fn an_absolute_start_never_becomes_a_largest_group_join() {
 		let largest = Some(ietf::Location { group: 9, object: 0 });
 		for version in JOINING_DRAFTS {
 			for start in [7, 9, 11] {
 				let run = JoinRun::start(version, Some(start), subscribe_ok(version, largest), fetch_ok(version)).await;
 
 				let messages = decode_messages(&run.session.log, version);
-				let fetch = messages.iter().find(|(id, _)| *id == ietf::Fetch::ID).expect("FETCH");
-				let body = &fetch.1;
-				let msg = crate::coding::decode_from(&mut &body[..], version, ietf::Fetch::decode_msg).unwrap();
+				let subscribe = messages
+					.iter()
+					.find(|(id, _)| *id == ietf::Subscribe::ID)
+					.expect("SUBSCRIBE");
+				let body = &subscribe.1;
+				let msg = crate::coding::decode_from(&mut &body[..], version, ietf::Subscribe::decode_msg).unwrap();
 				assert_eq!(
-					msg.fetch_type,
-					FetchType::RelativeJoining {
-						subscriber_request_id: RequestId(1),
-						group_offset: 0,
+					msg.filter,
+					Filter::Absolute {
+						start: ietf::Location {
+							group: start,
+							object: 0,
+						},
+						end: None,
 					},
 					"{version} from {start}"
 				);
+				assert!(msg.fill.is_none(), "{version} from {start}");
+				assert!(
+					!messages.iter().any(|(id, _)| *id == ietf::Fetch::ID),
+					"{version} from {start}: an absolute stream includes its head"
+				);
+			}
+		}
+	}
+
+	/// A start of group 0 joins live with no filter on every draft and sends no joining
+	/// FETCH: the whole latest group arrives on the subscription, and the copy's fills fetch
+	/// the groups below it once a reader misses them.
+	#[kio::test]
+	async fn a_zero_start_joins_unfiltered_without_a_joining_fetch() {
+		let largest = Some(ietf::Location { group: 9, object: 0 });
+		for version in [Version::Draft18, Version::Draft20, Version::Draft22] {
+			let run = JoinRun::start(version, Some(0), subscribe_ok(version, largest), fetch_ok(version)).await;
+
+			let messages = decode_messages(&run.session.log, version);
+			let subscribe = messages
+				.iter()
+				.find(|(id, _)| *id == ietf::Subscribe::ID)
+				.expect("SUBSCRIBE");
+			let msg = crate::coding::decode_from(&mut &subscribe.1[..], version, ietf::Subscribe::decode_msg).unwrap();
+			assert_eq!(msg.filter, Filter::Unfiltered, "{version}");
+			assert!(msg.fill.is_none(), "{version}");
+			assert!(
+				!messages.iter().any(|(id, _)| *id == ietf::Fetch::ID),
+				"{version}: no head to join"
+			);
+			assert!(!run.fill_outstanding(), "{version}");
+		}
+	}
+
+	/// A group-0 start fetches only the groups below Largest, so when the publisher is
+	/// already partway through the Largest group, that group's mid-group stream is a cut
+	/// message. It is marked headless, so the stream is dropped and readers skip the group
+	/// (`a_headless_tail_after_its_fill_was_replaced_is_dropped`), rather than reading its
+	/// tail as a whole group. Largest's object is inclusive, so a Largest at object 0 marks
+	/// the group too.
+	#[kio::test]
+	async fn a_zero_start_drops_the_largest_groups_cut_tail() {
+		for (object, headless) in [(2, Some(4)), (0, Some(4))] {
+			let largest = Some(ietf::Location { group: 4, object });
+			for version in [Version::Draft18, Version::Draft20, Version::Draft22] {
+				let run = JoinRun::start(version, Some(0), subscribe_ok(version, largest), fetch_ok(version)).await;
+				let state = run.subscriber.state.lock();
+				let held = state
+					.subscribes
+					.values()
+					.next()
+					.expect("the subscription is registered");
+				assert_eq!(held.headless_through, headless, "{version}: Largest object {object}");
 			}
 		}
 	}
 
+	/// A Largest at object 0 already sent that object, so the Largest group's stream starting
+	/// at object 1 without FIRST_OBJECT is a cut tail: it is refused and readers get the next
+	/// group instead.
+	#[kio::test]
+	async fn a_zero_start_drops_a_tail_cut_after_object_0() {
+		let version = Version::Draft22;
+		let largest = Some(ietf::Location { group: 4, object: 0 });
+		let session = ScriptedSession::per_stream(vec![
+			subscribe_ok(version, largest),
+			super::stitch_tests::tail_stream(4, 1, &[b"tail-1"]),
+			super::stitch_tests::tail_stream(5, 0, &[b"next-0"]),
+		]);
+		let run = JoinRun::subscribe(version, Some(0), session.clone(), Control::new(false)).await;
+		let track = {
+			let state = run.subscriber.state.lock();
+			let held = state
+				.subscribes
+				.values()
+				.next()
+				.expect("the subscription is registered");
+			held.producer.clone().expect("SUBSCRIBE_OK bound the track")
+		};
+		let mut consumer = track.subscribe(None);
+
+		let mut streams = Vec::new();
+		for _ in 0..2 {
+			let (_, recv) = session.open_bi(Default::default()).await.unwrap();
+			streams.push(Reader::new(crate::transport::boxed::RecvStream::new(recv), version));
+		}
+		let [tail, next] = &mut streams[..] else { unreachable!() };
+		// Accepted, the tail's stream would park unended, so it must be refused at once.
+		let refused = run.subscriber.clone().recv_group(tail).now_or_never();
+		assert!(matches!(refused, Some(Err(Error::Unsupported))), "{refused:?}");
+
+		// The next group's stream never ends, so read it while it is still ingesting.
+		let mut ingesting = run.subscriber.clone();
+		let ingest = ingesting.recv_group(next);
+		let group = futures::select_biased! {
+			group = consumer.recv_group().fuse() => group.expect("track aborted").expect("track finished"),
+			res = ingest.fuse() => panic!("the next group's stream ended: {res:?}"),
+		};
+		assert_eq!(group.sequence, 5, "the cut group was skipped");
+	}
+
 	/// A publisher that serves no FETCH refuses the joining FETCH. That costs the head of
 	/// the Largest group and nothing more, as a failed draft-22 fill does: the fill settles,
 	/// so a stream starting mid-group no longer waits on it, and the subscription keeps
diff --git a/rs/moq-net/src/model/socket.rs b/rs/moq-net/src/model/socket.rs
index 41428a77e03..e910eaef005 100644
--- a/rs/moq-net/src/model/socket.rs
+++ b/rs/moq-net/src/model/socket.rs
@@ -100,13 +100,6 @@ fn messages() -> track::Info {
 	track::Info::default().with_max_age(None)
 }
 
-/// What a session's reader asks for: every group, oldest first, however late it is.
-fn reliable() -> Subscription {
-	Subscription::default()
-		.with_order(Order::Ascending)
-		.with_delay(Delay::default().with_max(None))
-}
-
 mod sealed {
 	use super::*;
 
@@ -170,6 +163,21 @@ impl Protocol {
 			_ => None,
 		}
 	}
+
+	/// What a session's reader asks for: every message, oldest first, however late it is.
+	fn subscription(self) -> Subscription {
+		let reliable = Subscription::default()
+			.with_order(Order::Ascending)
+			.with_delay(Delay::default().with_max(None));
+		match self {
+			// The half's only group is the live one, so a live join reads it from its first
+			// frame, even one written before the answer: over moq-transport, a SUBSCRIBE
+			// plus a joining FETCH or fill for that group's head.
+			Self::Tcp => reliable,
+			// Starts at group 0, so a burst written before the answer is kept.
+			Self::Track => reliable.with_range(0..),
+		}
+	}
 }
 
 /// A session's stream: a [`TcpStream`] or a [`TrackStream`]. Names the protocol a dial,
@@ -271,6 +279,8 @@ impl sealed::Open for TcpStream {
 /// delay budget, so a late group is waited for rather than skipped. Each hop's cache
 /// still reclaims a group nobody read within its idle window (30 s by default), or under
 /// memory pressure, except the newest, so a reader that stalls longer can miss groups.
+/// Any group the track reports it will never deliver, such as one a moq-transport
+/// publisher refused to fetch, is skipped the same way rather than ending the session.
 /// Update its subscription, such as with a finite
 /// [`Delay`] or [`Order::Descending`], to make it lossy or newest first, and read it in
 /// group order with [`track::Subscriber::ordered`]. Groups are written with
@@ -825,13 +835,13 @@ enum Step {
 
 impl Step {
 	/// Advance until the peer serves its half, subscribing to `track` in its endpoint.
-	fn poll(&mut self, waiter: &kio::Waiter, track: &str) -> Poll<Result<(), Error>> {
+	fn poll(&mut self, waiter: &kio::Waiter, protocol: Protocol, track: &str) -> Poll<Result<(), Error>> {
 		loop {
 			match self {
 				Self::Resolving(following) => {
 					// Only the first call is made here, and it never reports the path offline.
 					let broadcast = ready!(following.poll_available(waiter))?.expect("the first call is never offline");
-					let subscribing = broadcast.track(track)?.subscribe(reliable()).into_inner();
+					let subscribing = broadcast.track(track)?.subscribe(protocol.subscription()).into_inner();
 					*self = Self::Subscribing(subscribing);
 				}
 				Self::Subscribing(subscribing) => {
@@ -954,7 +964,7 @@ impl<S: Stream> Dialing<S> {
 			}
 		}
 
-		ready!(self.step.poll(waiter, &self.name))?;
+		ready!(self.step.poll(waiter, S::PROTOCOL, &self.name))?;
 		// The peer serves its half only after asking for this side's, so a conforming peer
 		// asked already; wait for its request regardless.
 		let Some(Answer::Served(_)) = &self.answer else {
@@ -1026,7 +1036,7 @@ impl<S: Stream> Accepting<S> {
 		if self.demand.poll_state(waiter) != track::DemandState::Active {
 			return Poll::Ready(Err(Error::Cancel));
 		}
-		ready!(self.step.poll(waiter, &self.name))?;
+		ready!(self.step.poll(waiter, S::PROTOCOL, &self.name))?;
 
 		// Accepted outside the lock, since it wakes the dialer.
 		let request = self.request.take().ok_or(Error::Closed)?;
diff --git a/rs/moq-net/tests/integration/fetch_only.rs b/rs/moq-net/tests/integration/fetch_only.rs
index c8974aa6ab6..0b6a0e9933b 100644
--- a/rs/moq-net/tests/integration/fetch_only.rs
+++ b/rs/moq-net/tests/integration/fetch_only.rs
@@ -433,9 +433,8 @@ async fn history_through_fetched_copy(upstream: Version, version: Version) {
 }
 
 /// A history SUBSCRIBE reaching a relay's copy kept after a fetch is answered from the
-/// upstream's SUBSCRIBE_OK, never the edge the fetch learned, and reads its history. A
-/// draft-18 upstream has no bounded join, so the relay joins it live and serves the history
-/// from fills, keeping the copy for its other readers.
+/// upstream's SUBSCRIBE_OK, never the edge the fetch learned, and reads its requested
+/// history, keeping the copy for its other readers.
 #[kio::test]
 async fn a_relay_answers_a_history_subscribe_on_a_fetched_copy() {
 	for (upstream, version) in [
@@ -476,8 +475,7 @@ async fn a_relay_answers_a_live_subscribe_on_a_fetched_copy() {
 
 /// A copy kept after a fetch resumes a bounded subscription that ends at or below the
 /// upstream's new Largest Object, and reads it, though no group past its end arrives.
-/// A draft-18 join fills the missing run with one FETCH, which our publisher refuses
-/// until hole markers are supported. That refusal ends the read instead of hanging.
+/// Every supported draft serves the bounded absolute range on the subscription itself.
 #[kio::test]
 async fn a_resumed_bounded_subscription_reads_below_the_answered_edge() {
 	for version in ["moq-transport-18", "moq-transport-20", "moq-transport-22"] {
@@ -510,18 +508,13 @@ async fn a_resumed_bounded_subscription_reads_below_the_answered_edge() {
 				.await
 				.expect("subscribe timed out")
 				.expect("subscribe");
-			// Read in arrival order, whichever group lands first. A refused multi-group
-			// FETCH gives up the whole run; it never falls back to fetching each group.
+			// Read in arrival order, whichever group lands first.
 			let mut read = Vec::new();
 			while let Some(group) = next_frames(&mut sub).await {
 				read.push(group);
 			}
 			read.sort();
-			if version == "moq-transport-18".parse().unwrap() {
-				assert!(read.is_empty(), "the unsupported multi-group FETCH was refused");
-			} else {
-				assert_eq!(read, [frames(1), frames(2)]);
-			}
+			assert_eq!(read, [frames(1), frames(2)], "{version}");
 			assert!(track.subscription().is_some(), "the read never subscribed");
 
 			drop((sub, copy, remote, pair, track, broadcast, client, publisher));
@@ -534,9 +527,8 @@ async fn a_resumed_bounded_subscription_reads_below_the_answered_edge() {
 /// A copy that went idle holding a group resumes a bounded subscription of that group after
 /// the upstream moved on. With an unlimited max age every version reads it from the cache.
 /// Under a finite one the copy cannot judge a group below its live floor, so it reads the
-/// group only where the resumed feed starts where it asked, not at the answer's Largest.
-/// A draft-18 SUBSCRIBE has no such start: its live join puts the floor above the cached
-/// group, which the read gives up at once rather than waiting for a group that won't come.
+/// group because the resumed feed starts where it asked, not at the answer's Largest: an
+/// absolute start on every draft, draft 18 included.
 #[kio::test]
 async fn a_resumed_bounded_subscription_keeps_its_cached_start() {
 	let versions = moq_net::Versions::all();
@@ -580,14 +572,8 @@ async fn a_resumed_bounded_subscription_keeps_its_cached_start() {
 					.await
 					.expect("subscribe timed out")
 					.expect("subscribe");
-				let started = kio::clock::now();
 				let read = next_frames(&mut sub).await;
-				if max_age.is_some() && version == "moq-transport-18".parse().unwrap() {
-					assert_eq!(read, None, "{version}: the group below the live floor was given up");
-					assert_eq!(kio::clock::now(), started, "{version}: the read waited");
-				} else {
-					assert_eq!(read, Some(frames(0)), "{version}, max age {max_age:?}");
-				}
+				assert_eq!(read, Some(frames(0)), "{version}, max age {max_age:?}");
 
 				drop((sub, copy, remote, pair, track, broadcast, client, publisher));
 			})
diff --git a/rs/moq-net/tests/integration/socket.rs b/rs/moq-net/tests/integration/socket.rs
index 40cac69da67..03b6a92d353 100644
--- a/rs/moq-net/tests/integration/socket.rs
+++ b/rs/moq-net/tests/integration/socket.rs
@@ -864,6 +864,64 @@ async fn an_endpoint_not_accepting_resets_dials() {
 	assert!(dialed.is_err(), "a dial to an endpoint not accepting connected");
 }
 
+/// An acceptor can finish its initial burst before the dialer gets the answer.
+///
+/// Over moq-lite only: moq-net endpoints never speak moq-transport to each other, and
+/// over it the groups below the answer's Largest come from one range FETCH, which our
+/// own publishers refuse past a single group.
+#[kio::test]
+async fn the_first_burst_survives_a_late_subscribe_answer() {
+	let mut fixture = Fixture::new();
+	let alice = fixture.endpoint(LITE, "alice").await;
+	let bob = fixture.endpoint(LITE, "bob").await;
+	let dial = alice.dial_track("bob", None).unwrap();
+	let accept = async {
+		let stream = bob.accept_track().await.unwrap().accept(None).await.unwrap();
+		for payload in [b"one", b"two", b"six"] {
+			send(&stream.producer, payload);
+		}
+		stream.producer.finish().unwrap();
+		stream
+	};
+	let (dialed, accepted) = futures::join!(dial, accept);
+	let dialed = dialed.unwrap();
+	dialed.producer.finish().unwrap();
+	let mut reader = dialed.consumer.ordered();
+	for payload in [b"one", b"two", b"six"] {
+		assert_eq!(recv(&mut reader).await.unwrap().unwrap(), payload);
+	}
+	assert_eq!(recv(&mut reader).await.unwrap(), None);
+	assert_eq!(recv(&mut accepted.consumer.ordered()).await.unwrap(), None);
+}
+
+/// TCP must also recover every frame when FIN overtakes the subscription answer.
+#[kio::test]
+async fn the_first_tcp_writes_survive_a_late_subscribe_answer() {
+	for version in [LITE, IETF, "moq-transport-20", "moq-transport-22"] {
+		let mut fixture = Fixture::new();
+		let alice = fixture.endpoint(version, "alice").await;
+		let bob = fixture.endpoint(version, "bob").await;
+		let dial = alice.dial_tcp("bob").unwrap();
+		let accept = async {
+			let mut stream = bob.accept_tcp().await.unwrap().accept().await.unwrap();
+			for payload in [b"first".as_slice(), b"", b"last"] {
+				stream.producer.write_frame(None, payload).unwrap();
+			}
+			stream.producer.finish().unwrap();
+			stream
+		};
+		let (dialed, accepted) = futures::join!(dial, accept);
+		let mut dialed = dialed.unwrap();
+		let mut accepted = accepted;
+		for payload in [b"first".as_slice(), b"", b"last"] {
+			assert_eq!(read(&mut dialed.consumer).await.unwrap().unwrap(), payload, "{version}");
+		}
+		assert_eq!(read(&mut dialed.consumer).await.unwrap(), None);
+		dialed.producer.finish().unwrap();
+		assert_eq!(read(&mut accepted.consumer).await.unwrap(), None);
+	}
+}
+
 /// The moq-lite versions before hidden broadcasts.
 const OLDER: [&str; 2] = ["moq-lite-06", "moq-lite-03"];
 
diff --git a/swift/MIGRATE.md b/swift/MIGRATE.md
index 08d065383f9..606337b1b3d 100644
--- a/swift/MIGRATE.md
+++ b/swift/MIGRATE.md
@@ -4,6 +4,12 @@ How to update your code for each breaking change, newest first.
 
 ## Unreleased
 
+### Socket sessions
+
+Socket now exposes TCP group halves and reliably subscribed track halves beside origin. Regenerate bindings and rebuild the matching native library together. Existing callers need no migration. Socket endpoints require lite-07 or moq-transport on every hop; there is no wire change.
+
+`GroupProducer.ready(size:)` is a new `async throws` call that waits until a frame of `size` bytes fits a window ahead of the fastest reader. Await it before each `writeFrame` so the writer waits for its fastest reader instead of evicting it, though not for slower readers; a TCP socket stream's producer needs it to behave like TCP. Existing writers are unchanged.
+
 ### `Following.available()` returns nil once the path goes offline
 
 `try await following.available()` returns `BroadcastConsumer?`.
diff --git a/swift/Sources/Moq/Socket.swift b/swift/Sources/Moq/Socket.swift
new file mode 100644
index 00000000000..ce39e3456be
--- /dev/null
+++ b/swift/Sources/Moq/Socket.swift
@@ -0,0 +1,109 @@
+import MoqFFI
+
+/// Point-to-point sessions over hidden endpoint broadcasts.
+public enum Socket {}
+
+extension Socket {
+    /// Announces one endpoint and dials or accepts independent TCP and track sessions.
+    public final class Endpoint: Sendable {
+        let ffi: MoqSocketEndpoint
+
+        /// Announce `id` beneath `prefix`, using `origin` to find peers.
+        public init(origin: OriginProducer, prefix: String, id: String) throws {
+            ffi = try MoqSocketEndpoint(origin: origin.ffi, prefix: prefix, id: id)
+        }
+
+        /// This endpoint's id.
+        public var id: String { ffi.id() }
+        /// The shared endpoint prefix.
+        public var prefix: String { ffi.prefix() }
+        /// Retract the endpoint and reset its pending dials and sessions.
+        public func close() { ffi.close() }
+
+        /// Dial a new tcp session; cancelling resets this dial.
+        public func dialTcp(peer: String) async throws -> TcpStream {
+            TcpStream(try await ffi.dialTcp(peer: peer))
+        }
+        /// Await the next tcp dial, independently of the other protocol.
+        public func acceptTcp() async throws -> IncomingTcp {
+            IncomingTcp(try await ffi.acceptTcp())
+        }
+
+        /// Dial a new track session; cancelling resets this dial.
+        public func dialTrack(peer: String, info: TrackInfo? = nil) async throws -> TrackStream {
+            TrackStream(try await ffi.dialTrack(peer: peer, info: info))
+        }
+        /// Await the next track dial, independently of the other protocol.
+        public func acceptTrack() async throws -> IncomingTrack {
+            IncomingTrack(try await ffi.acceptTrack())
+        }
+    }
+
+    /// An incoming tcp dial, consumed by accepting or rejecting it.
+    public final class IncomingTcp: Sendable {
+        let ffi: MoqSocketIncomingTcp
+        init(_ ffi: MoqSocketIncomingTcp) { self.ffi = ffi }
+        /// The claimed peer; accepting verifies return routability.
+        public var peer: String { ffi.peer() }
+        /// The private session id.
+        public var session: String { ffi.session() }
+        /// Verify return routability and accept the dial.
+        public func accept() async throws -> TcpStream {
+            TcpStream(try await ffi.accept())
+        }
+        /// Refuse this dial as not found.
+        public func reject() throws { try ffi.reject() }
+    }
+
+    /// A tcp session's two halves and identities.
+    public final class TcpStream: Sendable {
+        /// This side's write half.
+        public let producer: GroupProducer
+        /// The peer's read half, retaining its subscription.
+        public let consumer: GroupConsumer
+        /// The peer endpoint's id.
+        public let peer: String
+        /// The private session id.
+        public let session: String
+        init(_ ffi: MoqSocketTcpStream) {
+            producer = GroupProducer(ffi.producer())
+            consumer = GroupConsumer(ffi.consumer())
+            peer = ffi.peer()
+            session = ffi.session()
+        }
+    }
+
+    /// An incoming track dial, consumed by accepting or rejecting it.
+    public final class IncomingTrack: Sendable {
+        let ffi: MoqSocketIncomingTrack
+        init(_ ffi: MoqSocketIncomingTrack) { self.ffi = ffi }
+        /// The claimed peer; accepting verifies return routability.
+        public var peer: String { ffi.peer() }
+        /// The private session id.
+        public var session: String { ffi.session() }
+        /// Verify return routability and accept the dial.
+        public func accept(info: TrackInfo? = nil) async throws -> TrackStream {
+            TrackStream(try await ffi.accept(info: info))
+        }
+        /// Refuse this dial as not found.
+        public func reject() throws { try ffi.reject() }
+    }
+
+    /// A track session's two halves and identities.
+    public final class TrackStream: Sendable {
+        /// This side's write half.
+        public let producer: TrackProducer
+        /// The peer's read half, retaining its subscription.
+        public let consumer: TrackConsumer
+        /// The peer endpoint's id.
+        public let peer: String
+        /// The private session id.
+        public let session: String
+        init(_ ffi: MoqSocketTrackStream) {
+            producer = TrackProducer(ffi.producer())
+            consumer = TrackConsumer(ffi.consumer())
+            peer = ffi.peer()
+            session = ffi.session()
+        }
+    }
+}
diff --git a/swift/Sources/Moq/Track.swift b/swift/Sources/Moq/Track.swift
index edcaa8def56..d2d58cda5c9 100644
--- a/swift/Sources/Moq/Track.swift
+++ b/swift/Sources/Moq/Track.swift
@@ -208,7 +208,19 @@ public final class GroupProducer: Sendable {
         GroupConsumer(try ffi.consume())
     }
 
-    /// Write a frame with a presentation timestamp, or untimed when nil.
+    /// Wait until a frame of `size` bytes fits a window ahead of the fastest reader.
+    ///
+    /// Await it before each `writeFrame` so that reader paces the writer, as TCP
+    /// backpressure does, instead of the group shedding frames it has not taken, which
+    /// fails it with `Evicted`; slower readers are not waited on. It also waits until a reader holds the
+    /// group, and returns once the group is closed so the next write throws why. Throws
+    /// `Closed` after `abort`.
+    public func ready(size: UInt64) async throws {
+        try await ffi.ready(size: size)
+    }
+
+    /// Write a frame with a presentation timestamp, or untimed when nil. Never blocks:
+    /// without `ready`, a writer that outpaces its readers sheds the group's front instead.
     public func writeFrame(_ payload: Data, timestamp: Timestamp? = nil) throws {
         try ffi.writeFrame(frame: Frame(payload: payload, timestamp: timestamp))
     }
diff --git a/test/interop/README.md b/test/interop/README.md
index ced348ff8e0..9c4d8e8060c 100644
--- a/test/interop/README.md
+++ b/test/interop/README.md
@@ -52,6 +52,14 @@ Rust CLI swap its channels' tones, and every subscriber must refuse every rendit
 as the wrong tone, not fail some other way. `interop.sh` is the one place the tones
 and each publisher's codecs are chosen.
 
+When Python is selected, the in-tree run also connects Python and Rust socket
+endpoints through the relay in both dial directions and both `tcp` and `track`
+protocols. Each direction checks exact frames, empty writes, ordered groups,
+and clean FIN. A stdin drain acknowledgement keeps Rust alive until Python has
+read its entire half. The lane runs only in the normal pass, pinned to lite-07:
+moq-net endpoints speak moq-lite to each other, never moq-transport. Older lite
+hops are outside this lane.
+
 The normal run also checks a finite raw track through the relay. Its publisher
 announces end 4 before writing four 256 KiB groups; the reader verifies every byte,
 exactly groups 0 through 3, and a clean end at 4. Rust-to-Rust always runs. Selecting
diff --git a/test/interop/clients/python/sockets.py b/test/interop/clients/python/sockets.py
new file mode 100644
index 00000000000..fc9a121e469
--- /dev/null
+++ b/test/interop/clients/python/sockets.py
@@ -0,0 +1,102 @@
+"""Python/Rust socket interop through a relay, in both directions and protocols."""
+
+import argparse
+import asyncio
+import contextlib
+from collections.abc import Coroutine
+from typing import Any, TypeVar
+
+import moq
+from moq import socket
+
+PAYLOADS = [b"first", b"", b"last"]
+T = TypeVar("T")
+
+
+async def start(coro: Coroutine[Any, Any, T]) -> asyncio.Task[T]:
+    """Enable an accept queue before another process can dial it."""
+    loop = asyncio.get_running_loop()
+    polled = loop.create_future()
+
+    async def run() -> T:
+        loop.call_soon(polled.set_result, None)
+        return await coro
+
+    task = asyncio.create_task(run())
+    await polled
+    return task
+
+
+async def exchange(stream: socket.TcpStream | socket.TrackStream) -> None:
+    assert stream.peer == "rust"
+    if isinstance(stream, socket.TcpStream):
+        for payload in PAYLOADS:
+            stream.producer.write_frame(payload)
+        stream.producer.finish()
+        assert [frame.payload async for frame in stream.consumer] == PAYLOADS
+    else:
+        assert stream.consumer.info().max_age is None
+        for _ in range(3):
+            group = stream.producer.append_group()
+            for payload in PAYLOADS:
+                group.write_frame(payload)
+            group.finish()
+        stream.producer.finish()
+        received = [(group.sequence, [frame.payload async for frame in group]) async for group in stream.consumer]
+        assert received == [(sequence, PAYLOADS) for sequence in range(3)], received
+
+
+async def main(args: argparse.Namespace) -> None:
+    origin = moq.OriginProducer()
+    async with moq.Client(
+        args.url, publish=origin, consume=origin, versions=[args.version], tls=moq.ClientTls(insecure=True)
+    ):
+        for protocol in ("tcp", "track"):
+            for role in ("dial", "accept"):
+                prefix = f"{args.prefix}/{protocol}/{role}"
+                async with socket.Endpoint(origin, prefix, "python") as endpoint:
+                    incoming = None
+                    if role == "dial":
+                        incoming = await start(endpoint.accept_tcp() if protocol == "tcp" else endpoint.accept_track())
+                    peer = await asyncio.create_subprocess_exec(
+                        args.rust,
+                        args.url,
+                        prefix,
+                        args.version,
+                        protocol,
+                        role,
+                        stdin=asyncio.subprocess.PIPE,
+                        stdout=asyncio.subprocess.PIPE,
+                    )
+                    assert peer.stdout is not None and peer.stdin is not None
+                    try:
+                        if incoming is not None:
+                            stream = await (await incoming).accept()
+                        else:
+                            assert await peer.stdout.readline() == b"listening\n"
+                            stream = await (
+                                endpoint.dial_tcp("rust") if protocol == "tcp" else endpoint.dial_track("rust")
+                            )
+                        await exchange(stream)
+                        assert await peer.stdout.readline() == b"drained\n"
+                        peer.stdin.write(b"drained\n")
+                        await peer.stdin.drain()
+                        assert await peer.wait() == 0
+                        print(f"socket {protocol}, Rust {role}: passed", flush=True)
+                    finally:
+                        if incoming is not None and not incoming.done():
+                            incoming.cancel()
+                            with contextlib.suppress(asyncio.CancelledError):
+                                await incoming
+                        if peer.returncode is None:
+                            peer.kill()
+                        await peer.wait()
+
+
+if __name__ == "__main__":
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("url")
+    parser.add_argument("prefix")
+    parser.add_argument("version")
+    parser.add_argument("rust")
+    asyncio.run(main(parser.parse_args()))
diff --git a/test/interop/clients/rust/socket.rs b/test/interop/clients/rust/socket.rs
new file mode 100644
index 00000000000..4f33ceae8ca
--- /dev/null
+++ b/test/interop/clients/rust/socket.rs
@@ -0,0 +1,112 @@
+//! Socket interop peer; stdin acknowledges that the other process drained its half.
+use anyhow::{Context, ensure};
+use moq_tokio::moq_net::{self, socket::Endpoint};
+use std::future::Future;
+use std::task::Poll;
+use tokio::io::AsyncBufReadExt;
+
+const PAYLOADS: [&[u8]; 3] = [b"first", b"", b"last"];
+
+async fn group(group: &mut moq_net::group::Consumer) -> anyhow::Result<()> {
+	for expected in PAYLOADS {
+		let frame = group.read_frame().await?.context("short group")?;
+		ensure!(frame.payload.as_ref() == expected, "wrong frame");
+		ensure!(frame.timestamp.is_none(), "unexpected timestamp");
+	}
+	ensure!(group.read_frame().await?.is_none(), "extra frame");
+	Ok(())
+}
+
+#[tokio::main(flavor = "current_thread")]
+async fn main() -> anyhow::Result<()> {
+	let args: Vec<_> = std::env::args().collect();
+	ensure!(
+		args.len() == 6,
+		"usage: interop-socket URL PREFIX VERSION tcp|track dial|accept"
+	);
+	let mut config = moq_tokio::connect::Config::default();
+	config.version.push(args[3].parse().map_err(anyhow::Error::msg)?);
+	config.websocket.enabled = Some(false);
+	let client = config.init(Default::default())?.with_reconnect(false);
+	let origin = moq_tokio::origin::spawn();
+	let endpoint = Endpoint::new(&origin, args[2].as_str(), "rust")?;
+	let session = client
+		.with_publisher(&origin)
+		.with_subscriber(origin.clone())
+		.connect(args[1].parse::<url::Url>()?)
+		.established()
+		.await?;
+	let dial = args[5] == "dial";
+	ensure!(dial || args[5] == "accept", "unknown role");
+	match args[4].as_str() {
+		"tcp" => {
+			let mut stream = if dial {
+				endpoint.dial_tcp("python")?.await?
+			} else {
+				let mut incoming = Box::pin(endpoint.accept_tcp());
+				std::future::poll_fn(|cx| {
+					assert!(incoming.as_mut().poll(cx).is_pending());
+					Poll::Ready(())
+				})
+				.await;
+				println!("listening");
+				incoming.await?.accept().await?
+			};
+			ensure!(stream.peer() == "python", "wrong peer");
+			for payload in PAYLOADS {
+				stream.producer.write_frame(None, payload)?;
+			}
+			stream.producer.finish()?;
+			group(&mut stream.consumer).await?;
+			println!("drained");
+			ack().await?;
+		}
+		"track" => {
+			let stream = if dial {
+				endpoint.dial_track("python", None)?.await?
+			} else {
+				let mut incoming = Box::pin(endpoint.accept_track());
+				std::future::poll_fn(|cx| {
+					assert!(incoming.as_mut().poll(cx).is_pending());
+					Poll::Ready(())
+				})
+				.await;
+				println!("listening");
+				incoming.await?.accept(None).await?
+			};
+			ensure!(stream.peer() == "python", "wrong peer");
+			ensure!(stream.consumer.info().max_age.is_none(), "track has an age limit");
+			let producer = stream.producer;
+			let mut consumer = stream.consumer.ordered();
+			for _ in 0..3 {
+				let mut group = producer.append_group()?;
+				for payload in PAYLOADS {
+					group.write_frame(None, payload)?;
+				}
+				group.finish()?;
+			}
+			producer.finish()?;
+			for sequence in 0..3 {
+				let mut next = consumer.next_group().await?.context("short track")?;
+				ensure!(next.sequence == sequence, "wrong group order");
+				group(&mut next).await?;
+			}
+			ensure!(consumer.next_group().await?.is_none(), "extra group");
+			println!("drained");
+			ack().await?;
+		}
+		_ => anyhow::bail!("unknown protocol"),
+	}
+	endpoint.close();
+	session.close().await?;
+	Ok(())
+}
+
+async fn ack() -> anyhow::Result<()> {
+	let mut lines = tokio::io::BufReader::new(tokio::io::stdin()).lines();
+	ensure!(
+		lines.next_line().await?.as_deref() == Some("drained"),
+		"peer did not drain"
+	);
+	Ok(())
+}
diff --git a/test/interop/interop.sh b/test/interop/interop.sh
index 6ca445e9897..4f5c0186925 100755
--- a/test/interop/interop.sh
+++ b/test/interop/interop.sh
@@ -498,6 +498,9 @@ plan_pass() {
         done
     fi
     [[ "$FINISH_ONLY" -eq 0 ]] || return 0
+    if needs python; then
+        [[ "$VERSION" != auto ]] || record "not run" case="Python Rust sockets" publisher=python subscriber=rust
+    fi
     for pub in rust js-native-node js-native-bun; do
         [[ "$pub" == rust ]] || needs "$pub" || continue
         for sub in rust js-native-node js-native-bun; do
@@ -631,7 +634,7 @@ build_relay_cli() {
         INTEROP_SUB_MOQ="$HARNESS_RUN/bin/moq-sub"
     fi
     if [[ "$build_examples" -eq 1 && "$MEDIA" -eq 0 ]]; then
-        local example args=() examples=(interop-tail interop-catalog interop-audio interop-hls interop-control interop-goaway interop-goaway-client interop-finish)
+        local example args=() examples=(interop-socket interop-tail interop-catalog interop-audio interop-hls interop-control interop-goaway interop-goaway-client interop-finish)
         for example in "${examples[@]}"; do args+=(--example "$example"); done
         (cd "$WORKSPACE" && cargo build --locked ${flag[@]+"${flag[@]}"} -p moq-cli "${args[@]}")
         for example in "${examples[@]}"; do
@@ -2493,6 +2496,24 @@ run_hls_grid() {
 }
 
 # This checkout's CLI FETCH and finite track tails in this pass, then the lite drop lanes.
+# Both roles and protocols share this lane; Python acknowledges Rust's drain before teardown.
+# Lite only: moq-net endpoints speak moq-lite to each other, never moq-transport.
+run_sockets() {
+    needs python || return 0
+    [[ "$VERSION" == auto ]] || return 0
+    local version=moq-lite-07-wip log="$LOGS/sockets.log" prefix="sockets-$$-$RANDOM"
+    if is_broken python || ! timeout -k 3 "$TIMEOUT" "$PY" "$CLIENTS/python/sockets.py" \
+        "$(token_url --publish "$prefix/**" --subscribe "$prefix/**")" "$prefix" "$version" \
+        "$EXAMPLES/interop-socket" >"$log" 2>&1; then
+        echo "  FAIL  Python/Rust sockets ($version): $log"
+        record fail case="Python Rust sockets" publisher=python subscriber=rust log="$log"
+        overall=1
+        return
+    fi
+    echo "  PASS  Python/Rust sockets ($version), both roles and protocols"
+    record pass case="Python Rust sockets" publisher=python subscriber=rust log="$log"
+}
+
 run_tails() {
     local runtime version transport
     echo "=== CLI FETCH close ==="
@@ -2589,7 +2610,10 @@ else
         [[ "$TAIL_ONLY" -eq 1 || "$FINISH_ONLY" -eq 1 ]] || run_matrix
         if [[ "$IN_TREE" -eq 1 ]]; then
             [[ "$TAIL_ONLY" -eq 1 ]] || run_finishes
-            [[ "$FINISH_ONLY" -eq 1 ]] || run_tails
+            if [[ "$FINISH_ONLY" -eq 0 ]]; then
+                run_tails
+                run_sockets
+            fi
         fi
     done
 fi

From e419224dca6e88e7fc5e810977741e7d12c245c6 Mon Sep 17 00:00:00 2001
From: Luke Curley <kixelated@gmail.com>
Date: Fri, 6 Nov 2026 00:29:57 +0000
Subject: [PATCH 33/36] fix(net): a replacement that fails before delivering
 never ends a live track (#7956)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: moq-bot <moq-bot@users.noreply.github.com>
Co-authored-by: quest fixer <quest-fixer@localhost>
---
 js/net/src/resume.test.ts              | 251 +++++++++++++++++++++
 js/net/src/resume.ts                   | 131 ++++++++++-
 quest/m1/README.md                     |   1 -
 quest/m1/route-swap-keeps-incumbent.md |  30 ---
 rs/moq-net/src/model/origin.rs         | 300 ++++++++++++++++++++++++-
 rs/moq-net/src/model/resume.rs         |  26 ++-
 rs/moq-net/src/model/track.rs          |  22 ++
 7 files changed, 707 insertions(+), 54 deletions(-)
 delete mode 100644 quest/m1/route-swap-keeps-incumbent.md

diff --git a/js/net/src/resume.test.ts b/js/net/src/resume.test.ts
index 69b340e5aad..edcb7d0fd9b 100644
--- a/js/net/src/resume.test.ts
+++ b/js/net/src/resume.test.ts
@@ -757,6 +757,257 @@ test("a replacement differing only in unchecked takes over", async () => {
 	close();
 });
 
+// Mirrors `a_replacement_aborted_after_its_answer_keeps_the_incumbent` in rs/moq-net/src/model/origin.rs.
+test("a replacement that answers and then aborts before its first group leaves the incumbent serving", async () => {
+	const { a, b, swap, active, close } = await setup();
+	const ta = copy(a);
+	const tb = copy(b);
+	const sub = active.track("seq").subscribe();
+	ta.write(0n);
+	expect(drain(sub)).toEqual([0n]);
+
+	await swap();
+	tb.producer.abort(new StreamError(StreamCode(64)));
+	await settle();
+	expect(sub.closed.peek()).toBeUndefined();
+
+	ta.write(1n);
+	await settle();
+	expect(drain(sub)).toEqual([1n]);
+
+	// The incumbent's clean end is the track's, not the replacement's error.
+	ta.producer.finish();
+	expect(await sub.recvGroup()).toBeUndefined();
+
+	sub.close();
+	close();
+});
+
+// Mirrors the Rust front: an incumbent that finished cleanly ends the track whoever serves it.
+test("a replacement that aborts before its first group after the incumbent finished ends the track cleanly", async () => {
+	const { a, b, swap, active, close } = await setup();
+	const ta = copy(a);
+	const tb = copy(b);
+	const sub = active.track("seq").subscribe();
+	ta.write(0n);
+	expect(drain(sub)).toEqual([0n]);
+
+	await swap();
+	ta.write(1n);
+	ta.producer.finish();
+	tb.producer.abort(new StreamError(StreamCode(64)));
+	await settle();
+	const groups: bigint[] = [];
+	for (let group = await sub.recvGroup(); group; group = await sub.recvGroup()) {
+		groups.push(group.sequence);
+		group.close();
+	}
+	expect(groups).toEqual([1n]);
+
+	sub.close();
+	close();
+});
+
+// Mirrors `readers_owed_nothing_below_the_incumbents_end_end_cleanly` in rs/moq-net/src/model/origin.rs:
+// a reader owed nothing below the incumbent's end, and one joining while the replacement has yet
+// to deliver, end cleanly once the incumbent finished and the replacement aborted.
+test("readers owed nothing below the incumbent's end end cleanly when the replacement aborts", async () => {
+	const { a, b, swap, active, close } = await setup();
+	const ta = copy(a);
+	const tb = copy(b);
+	const later = active.track("seq").subscribe({ ranges: [{ start: { absolute: 3n } }] });
+	ta.write(0n);
+	ta.write(1n);
+	await swap();
+	const joiner = active.track("seq").subscribe();
+	await settle();
+	ta.producer.finish();
+	tb.producer.abort(new StreamError(StreamCode(64)));
+	await settle();
+
+	expect(await later.recvGroup()).toBeUndefined();
+	const groups: bigint[] = [];
+	for (let group = await joiner.recvGroup(); group; group = await joiner.recvGroup()) {
+		groups.push(group.sequence);
+		group.close();
+	}
+	expect(groups).toEqual([1n]);
+
+	later.close();
+	joiner.close();
+	close();
+});
+
+// A reader arriving after the replacement answered reads the incumbent too, as the Rust front
+// serves it until the replacement delivers.
+test("a reader joining before the replacement delivers keeps the incumbent when the replacement aborts", async () => {
+	const { a, b, swap, active, close } = await setup();
+	const ta = copy(a);
+	const tb = copy(b);
+	const first = active.track("seq").subscribe();
+	ta.write(0n);
+	expect(drain(first)).toEqual([0n]);
+	await swap();
+	const joiner = active.track("seq").subscribe();
+	await settle();
+	tb.producer.abort(new StreamError(StreamCode(64)));
+	await settle();
+	ta.write(1n);
+	await settle();
+	expect(drain(joiner)).toContain(1n);
+	expect(joiner.closed.peek()).toBeUndefined();
+
+	first.close();
+	joiner.close();
+	close();
+});
+
+// The incumbent is the source that last delivered, however many replacements answered since.
+test("a reader joining after two undelivered replacements keeps the incumbent when both abort", async () => {
+	const { origin, a, b, swap, active, close } = await setup();
+	const c = new BroadcastProducer();
+	const ta = copy(a);
+	const tb = copy(b);
+	const tc = copy(c);
+	const first = active.track("seq").subscribe();
+	ta.write(0n);
+	expect(drain(first)).toEqual([0n]);
+	await swap();
+	const disposeC = serve(origin, c, 0n);
+	await settle();
+	await settle();
+	const joiner = active.track("seq").subscribe();
+	await settle();
+	tb.producer.abort(new StreamError(StreamCode(64)));
+	tc.producer.abort(new StreamError(StreamCode(64)));
+	await settle();
+	ta.write(1n);
+	await settle();
+	expect(drain(joiner)).toContain(1n);
+	expect(joiner.closed.peek()).toBeUndefined();
+
+	first.close();
+	joiner.close();
+	disposeC();
+	close();
+});
+
+// A fork joins like any reader arriving before the replacement delivers.
+test("a fork made before the replacement delivers keeps the incumbent when the replacement aborts", async () => {
+	const { a, b, swap, active, close } = await setup();
+	const ta = copy(a);
+	const tb = copy(b);
+	const sub = active.track("seq").subscribe();
+	ta.write(0n);
+	expect(drain(sub)).toEqual([0n]);
+	await swap();
+	const fork = sub.fork();
+	await settle();
+	tb.producer.abort(new StreamError(StreamCode(64)));
+	await settle();
+	ta.write(1n);
+	await settle();
+	expect(drain(fork)).toContain(1n);
+	expect(fork.closed.peek()).toBeUndefined();
+
+	sub.close();
+	fork.close();
+	close();
+});
+
+// Only an end some other copy settled cleanly excuses the serving copy's failure.
+test("a serving copy that declares an end and then aborts short of it keeps the error", async () => {
+	const { a, active, close } = await setup();
+	const ta = copy(a);
+	const sub = active.track("seq").subscribe();
+	ta.write(0n, 1, false);
+	ta.producer.finishAt({ group: 1n, frame: 0 });
+	const group = await sub.recvGroup();
+	group?.close();
+	ta.producer.abort(new StreamError(StreamCode(64)));
+	await settle();
+	await expect(sub.recvGroup()).rejects.toThrow("64");
+
+	sub.close();
+	close();
+});
+
+// Mirrors `a_replacement_aborted_after_its_answer_keeps_the_incumbent` for a reader awaiting only the end.
+test("waiting for the end of a track whose replacement aborts before its first group follows the incumbent", async () => {
+	const { a, b, swap, active, close } = await setup();
+	const ta = copy(a);
+	const tb = copy(b);
+	const sub = active.track("seq").subscribe();
+	ta.write(0n);
+	expect(drain(sub)).toEqual([0n]);
+
+	await swap();
+	const finished = sub.finished();
+	finished.catch(() => {});
+	tb.producer.abort(new StreamError(StreamCode(64)));
+	await settle();
+	ta.producer.finish();
+	await expect(finished).resolves.toEqual({ group: 1n, frame: 0 });
+
+	sub.close();
+	close();
+});
+
+// The Rust front judges the replacement by its copy, whatever each reader's window took from it:
+// one that held a group delivered, so its later abort is the track's verdict for every reader.
+test("a replacement that delivered is not undone by a reader whose window skipped its groups", async () => {
+	const { a, b, swap, active, close } = await setup();
+	const ta = copy(a);
+	const tb = copy(b);
+	const first = active.track("seq").subscribe();
+	const later = active.track("seq").subscribe({ ranges: [{ start: { absolute: 3n } }] });
+	ta.write(0n);
+	expect(drain(first)).toEqual([0n]);
+	expect(drain(later)).toEqual([]);
+
+	await swap();
+	tb.write(1n);
+	await settle();
+	expect(drain(first)).toEqual([1n]);
+	tb.producer.abort(new StreamError(StreamCode(64)));
+	await settle();
+	expect(() => drain(later)).toThrow("64");
+	ta.write(2n);
+	await settle();
+	expect(() => drain(first)).toThrow("64");
+
+	first.close();
+	later.close();
+	close();
+});
+
+test("a replacement that aborts before its first group after the front concludes leaves the incumbent serving", async () => {
+	const front = new Front();
+	const a = new BroadcastProducer();
+	const b = new BroadcastProducer();
+	const ta = copy(a);
+	const tb = copy(b);
+	front.serve(a.consume());
+	const sub = front.consumer.track("seq").subscribe();
+	ta.write(0n);
+	expect(drain(sub)).toEqual([0n]);
+
+	front.serve(b.consume());
+	await settle();
+	// No front is left to replace the replacement, but the incumbent still feeds the track.
+	front.conclude();
+	tb.producer.abort(new StreamError(StreamCode(64)));
+	await settle();
+	expect(sub.closed.peek()).toBeUndefined();
+
+	ta.write(1n);
+	await settle();
+	expect(drain(sub)).toEqual([1n]);
+	ta.producer.finish();
+	expect(await sub.recvGroup()).toBeUndefined();
+	sub.close();
+});
+
 test("waiting for the end of a track whose replacement was refused ends with the refusal", async () => {
 	const { a, b, swap, active, close } = await setup();
 	const old = a.createTrack("seq", { priority: 1 });
diff --git a/js/net/src/resume.ts b/js/net/src/resume.ts
index c4868c61f1e..94c6491819e 100644
--- a/js/net/src/resume.ts
+++ b/js/net/src/resume.ts
@@ -203,6 +203,12 @@ class Route {
 	concluded = false;
 	/** The front refused the replacement: the track ends with this once the serving copy runs out. */
 	refusal?: Error;
+	/**
+	 * The source serving before the replacements that have yet to deliver, held until a copy of
+	 * `source` delivers: a reader arriving meanwhile reads it too, as the readers before it do, so
+	 * a replacement failing first leaves it serving. The Rust front only swaps once one delivers.
+	 */
+	incumbent?: Source;
 	/** Bumped on every change above, waking parked reads. */
 	readonly changed = new Signal(0);
 	readonly readers = new Set<Reader>();
@@ -222,16 +228,36 @@ class Route {
 		// A refusal ends the track: no later source continues it, compatible or not.
 		if (this.concluded || this.refusal || this.source === source) return;
 		this.generation++;
+		// An undelivered source hands over the incumbent it held, not itself.
+		if (!this.incumbent) this.#hold(this.source);
 		this.source = source;
 		this.served = source;
 		this.#bump();
 		for (const reader of [...this.readers]) reader.sync();
 	}
 
+	/**
+	 * Serve `to` again in place of `from`, a replacement whose copy failed before delivering, even
+	 * past a refusal or a conclusion: `to` served before it, and concluding only stops a future
+	 * source taking over. Returns whether `to` serves again.
+	 */
+	revert(from: Source, to: Source): boolean {
+		// A concluded route serves nothing new, but the failed replacement was still its last.
+		if (this.source !== from && !(this.concluded && this.source === undefined)) return false;
+		this.generation++;
+		this.#hold(undefined);
+		this.source = to;
+		this.served = to;
+		this.#bump();
+		for (const reader of [...this.readers]) reader.sync();
+		return true;
+	}
+
 	/** Between routes: readers wait for the next one, keeping what they have. */
 	park(): void {
 		if (!this.source) return;
 		this.generation++;
+		this.#hold(undefined);
 		this.source = undefined;
 		this.#bump();
 	}
@@ -257,12 +283,27 @@ class Route {
 	conclude(): void {
 		if (this.concluded) return;
 		this.concluded = true;
+		this.#hold(undefined);
 		this.source = undefined;
 		this.#bump();
 	}
 
+	/** A copy of `source` delivered: it no longer needs the source it replaced. */
+	delivered(source: Source): void {
+		if (source === this.source) this.#hold(undefined);
+	}
+
+	#hold(incumbent: Source | undefined): void {
+		incumbent?.retain();
+		this.incumbent?.release();
+		this.incumbent = incumbent;
+	}
+
 	leave(reader: Reader): void {
-		if (this.readers.delete(reader) && this.readers.size === 0) this.idle();
+		if (!this.readers.delete(reader) || this.readers.size > 0) return;
+		// Nobody reads the track, so nothing is left to protect from the replacement.
+		this.#hold(undefined);
+		this.idle();
 	}
 }
 
@@ -361,6 +402,8 @@ class Reader implements ResumeSource {
 	#delivered = new Delivered();
 	/** Runs the serving copy gave up and the reader has yet to report; see {@link #tryDrop}. */
 	#drops: DropRun[] = [];
+	/** A copy that declared the track's end ran out cleanly at it, even if since let go. */
+	#settled = false;
 	/** Whether groups were ever asked for; until then the reader keeps no replaced copy. */
 	#groupsRead = false;
 	/** The groups handed out and still read, which other copies may back; see {@link #backs}. */
@@ -389,13 +432,15 @@ class Reader implements ResumeSource {
 		// concluded.
 		if (parent) {
 			this.#generation = parent.generation;
-			this.#add({
+			const copy: Copy = {
 				generation: parent.generation,
 				source: parent.source,
 				sub: parent.sub.fork(this.#wire({})),
 				replaced: false,
 				lease: 0,
-			});
+			};
+			this.#add(copy);
+			this.#joinIncumbent(copy);
 		}
 		// Subscribed to the serving copy at once, so groups it has now are the reader's even if
 		// the route changes before the first read, and to each copy after.
@@ -450,7 +495,7 @@ class Reader implements ResumeSource {
 			return;
 		}
 		const floor = this.#newest;
-		this.#add({
+		const serving: Copy = {
 			generation: route.generation,
 			source,
 			// The wire request carries the floor from the first message: some sessions read the
@@ -459,7 +504,36 @@ class Reader implements ResumeSource {
 			floor,
 			replaced: false,
 			lease: 0,
-		});
+		};
+		this.#add(serving);
+		this.#joinIncumbent(serving);
+	}
+
+	/**
+	 * Arriving before the serving copy delivered, read the source it replaced too, as the readers
+	 * before this one still do.
+	 */
+	#joinIncumbent(serving: Copy): void {
+		const route = this.route;
+		const incumbent = route.incumbent;
+		if (!incumbent || serving.source !== route.source) return;
+		if (hooks.latestSequence(serving.sub) !== undefined) {
+			route.delivered(serving.source);
+			return;
+		}
+		if (this.#copies.some((copy) => copy.source.from.closed === incumbent.from.closed)) return;
+		const floor = serving.floor;
+		this.#add(
+			{
+				generation: serving.generation - 1,
+				source: incumbent,
+				sub: subscribe(incumbent.wire, route.name, this.#wire({ floor })),
+				floor,
+				replaced: true,
+				lease: 0,
+			},
+			this.#copies.indexOf(serving),
+		);
 	}
 
 	/** Read `copy` as the newest one, or at `index`, recording the properties it commits. */
@@ -654,6 +728,7 @@ class Reader implements ResumeSource {
 	#observe(copy: Copy, sequence: bigint): void {
 		copy.delivered = true;
 		if (copy.replaced || copy.generation !== this.#generation) return;
+		this.route.delivered(copy.source);
 		const bound = max(this.#newest ?? -1n, sequence - 1n);
 		for (const replaced of this.#copies) {
 			if (replaced === copy || !replaced.replaced || replaced.until !== undefined) continue;
@@ -711,8 +786,10 @@ class Reader implements ResumeSource {
 				}
 				// Drained: the track ended as the copy did, which is not cleanly when its
 				// session went away short of the declared end.
-				if (recv.kind === "done") copy.done = copy.sub.closed.peek() ?? null;
-				else if (recv.kind === "error") copy.done = recv.error;
+				if (recv.kind === "done") {
+					copy.done = copy.sub.closed.peek() ?? null;
+					if (copy.done === null && hooks.subscriberEnd(copy.sub)) this.#settled = true;
+				} else if (recv.kind === "error") copy.done = recv.error;
 				break;
 			}
 		}
@@ -846,6 +923,23 @@ class Reader implements ResumeSource {
 		// serve it next. Once the track ended, a copy let go held nothing more.
 		if (serving ? ended === null : this.#ended) return this.#conclude() ? { kind: "done" } : { kind: "idle" };
 		if (ended instanceof Error) {
+			// A copy it replaced finished the track and the reader owes nothing below that end:
+			// the track ended cleanly whoever serves it now. Mirrors the Rust front. The failing
+			// copy's own end, or one whose copy failed short of it, never settled.
+			const end = this.#learnEnd();
+			const owed = max(this.#shell.cursor.peek().start, (this.#newest ?? -1n) + 1n);
+			const settled =
+				this.#settled ||
+				this.#copies.some(
+					(copy) =>
+						copy !== serving &&
+						hooks.subscriberEnd(copy.sub) !== undefined &&
+						hooks.peekLargest(copy.sub).ended &&
+						!(copy.sub.closed.peek() instanceof Error),
+				);
+			if (end && settled && !this.#declaredError && finalSequence(end) <= owed)
+				return this.#conclude() ? { kind: "done" } : { kind: "idle" };
+			if (serving && this.#revert(serving, ended)) return { kind: "idle" };
 			// A refusal from a route that still serves is the track's answer.
 			if (!routeFailed(ended)) return this.#fail(ended);
 			if (route.refusal) return this.#fail(route.refusal);
@@ -872,6 +966,26 @@ class Reader implements ResumeSource {
 		return { kind: "idle" };
 	}
 
+	/**
+	 * A replacement that failed before its copy held a group never ends the track while a copy it
+	 * replaced still feeds it: that copy serves again, and the failure is the replacement refusing
+	 * the track unless its route is going away. Judged by the copy, whatever this reader's window
+	 * took from it, as the Rust front does.
+	 */
+	#revert(serving: Copy, failed: Error): boolean {
+		if (hooks.latestSequence(serving.sub) !== undefined) return false;
+		const incumbent = this.#copies.findLast(
+			(copy) =>
+				copy.replaced &&
+				copy.source !== serving.source &&
+				copy.done === undefined &&
+				copy.sub.closed.peek() === undefined,
+		);
+		if (!incumbent || !this.route.revert(serving.source, incumbent.source)) return false;
+		if (!closing(failed)) this.route.refuse(failed);
+		return true;
+	}
+
 	#fail(error: Error): Recv & { kind: "error" } {
 		this.#shell.close(error);
 		return { kind: "error", error };
@@ -1213,7 +1327,8 @@ class Reader implements ResumeSource {
 			const failed = serving?.sub.closed.peek();
 			// A copy that failed is only the end of the track if no front replaces it, and a
 			// refused replacement leaves the refusal as the answer.
-			if (failed instanceof Error) {
+			if (serving && failed instanceof Error) {
+				if (this.#revert(serving, failed)) continue;
 				if (!routeFailed(failed)) throw failed;
 				if (this.route.refusal) throw this.route.refusal;
 				if (this.route.concluded) throw failed;
diff --git a/quest/m1/README.md b/quest/m1/README.md
index 33ae4dad45a..3fc57731bfc 100644
--- a/quest/m1/README.md
+++ b/quest/m1/README.md
@@ -180,7 +180,6 @@ quests that require them.
 - [Publish moq-bench to crates.io](/quest/m1/bench-publish.md) - `cargo install moq-bench` installs one binary, with the host sampler as `moq-bench host`, first as 0.1.0
 - [Unbounded groups](/quest/m1/unbounded-groups/README.md) - groups and frames lose their size caps; a group keeps a 32 MB tail, and readers behind it replay through paced flights or refresh
 - [Session policy lives in moq-net](/quest/m1/session-policy/README.md) - accept and connect deadlines, admission, window widening and reconnect live once in moq-net; moq-tokio and moq-relay's io_uring path call them
-- [A replacement that fails before delivering never ends a live track](/quest/m1/route-swap-keeps-incumbent.md) - a route change whose replacement aborts before its first group leaves readers on the source that was serving
 - [Rename moq-rtc to moq-webrtc](/quest/m1/webrtc-rename.md) - one published `moq-webrtc` crate holds the gateway, the ICE driver, and the data-channel transport
 - [Vendor and trim the WebRTC stack](/quest/m1/webrtc-vendor.md) - str0m, dimpl, `is`, and sctp-proto live in moq-webrtc with unused code removed, so moq-rtc can take rind
 - [MoQ on rind](/quest/m1/rind/README.md) - every MoQ crate takes its crypto from rind, a pure-Rust graviola fork, so no build compiles C crypto
diff --git a/quest/m1/route-swap-keeps-incumbent.md b/quest/m1/route-swap-keeps-incumbent.md
deleted file mode 100644
index cd6ea379a30..00000000000
--- a/quest/m1/route-swap-keeps-incumbent.md
+++ /dev/null
@@ -1,30 +0,0 @@
-# [M] A replacement that fails before delivering never ends a live track
-
-## Goal
-
-When a route change splices a replacement source under a front, and the
-replacement answers with metadata and then aborts before delivering any
-group, readers keep receiving from the source that was serving before. The
-track ends only when no source is left to serve it.
-
-Not in scope: the producer-replacement redesign
-([Resume as producer replacement](/quest/m2/resume-redesign.md)), which
-replaces this machinery later.
-
-## Plan
-
-Decided 2026-11-05 (maintainer, follow-up from
-[moq-dev/moq#7789](https://github.com/moq-dev/moq/pull/7789)): ✅ its own m1
-quest, fixed now. Not chosen: leaving it to the m2 redesign.
-
-#7789 fixed the case where the replacement aborts before the front reads its
-answer, which now counts as a refusal. The remaining race is an abort after
-the front's poll. `Front::track_info` (`rs/moq-net/src/model/front.rs`)
-clears `draining` on splice, so the later `track_ended` refusal has no
-incumbent to return to, and the track ends with the replacement's error.
-Main has it too. Recommended fix: keep the incumbent's copy until the
-replacement delivers its first group, then release it. Reproduce it first
-with a test beside #7789's
-`a_replacement_aborted_without_history_keeps_the_incumbent`
-(`rs/moq-net/src/model/origin.rs`), and check whether `js/net` has the same
-race.
diff --git a/rs/moq-net/src/model/origin.rs b/rs/moq-net/src/model/origin.rs
index 00ef399a985..7949c6ef0e0 100644
--- a/rs/moq-net/src/model/origin.rs
+++ b/rs/moq-net/src/model/origin.rs
@@ -3765,25 +3765,30 @@ struct InFlight {
 
 /// Keep the query's subscription on a copy following the readers' demand, and let it go
 /// with the last reader. Left behind, its first preferences would mask a later, lower
-/// aggregate from the copy's source: a shorter budget, or a demoted priority.
+/// aggregate from the copy's source: a shorter budget, or a demoted priority. With `copy`,
+/// a reader arriving subscribes it too.
 fn follow_demand(
 	held: &mut Option<kio::Pending<track::Subscribing>>,
+	copy: Option<&track::Consumer>,
 	accepted: Option<&mut track::Producer>,
 	weak: &track::TrackWeak,
 	routes: &super::resume::Producer,
 	waiter: &kio::Waiter,
 ) {
-	let Some(hold) = held.as_mut() else {
+	if held.is_none() && copy.is_none() {
 		return;
-	};
+	}
 	if let Some(accepted) = accepted {
 		while let Poll::Ready(Ok(_)) = accepted.poll_subscription_changed(waiter) {}
 	}
-	match weak.subscription() {
-		Some((subscription, subscribers)) => {
+	match (weak.subscription(), held.as_mut()) {
+		(Some((subscription, subscribers)), Some(hold)) => {
 			let _ = hold.update(routes.subscription(subscription, subscribers));
 		}
-		None => *held = None,
+		(Some((subscription, subscribers)), None) => {
+			*held = copy.map(|copy| copy.subscribe(routes.subscription(subscription, subscribers)));
+		}
+		(None, _) => *held = None,
 	}
 }
 
@@ -3889,7 +3894,7 @@ impl kio::Task for FrontServeRun {
 					Poll::Pending => {}
 				}
 			}
-			follow_demand(&mut io.held, io.accepted.as_mut(), &io.weak, &io.routes, waiter);
+			follow_demand(&mut io.held, None, io.accepted.as_mut(), &io.weak, &io.routes, waiter);
 			match io.weak.poll_unwanted(waiter) {
 				Poll::Pending => in_flight.push(io),
 				Poll::Ready(_) => io.release(),
@@ -4214,12 +4219,43 @@ impl FrontServe {
 			let waker = Waker::from(io.ready.clone());
 			let waiter = io.park.hold(&Context::from_waker(&waker));
 			let step = (|| {
-				if let Some(asked) = &mut io.query
-					&& let Poll::Ready(result) = asked.query.poll(waiter)
-				{
-					return Some(FrontStep::Info(name.clone(), asked.source, result));
+				if let Some(asked) = &mut io.query {
+					if asked.info.is_none()
+						&& let Poll::Ready(result) = asked.query.poll(waiter)
+					{
+						match result {
+							Ok(info) => asked.info = Some(info),
+							Err(err) => return Some(FrontStep::Info(name.clone(), asked.source, Err(err))),
+						}
+					}
+					// An awaited copy follows the readers, or it may never send the group
+					// they now want.
+					if asked.info.is_some() {
+						follow_demand(
+							&mut asked.sub,
+							Some(&asked.copy),
+							io.accepted.as_mut(),
+							&io.weak,
+							&io.routes,
+							waiter,
+						);
+					}
+					// While another copy may still deliver, a matching replacement answers only
+					// once it delivers or ends: one failing first refuses, and that copy keeps
+					// serving. Different metadata is refused at once.
+					if let Some(info) = &asked.info
+						&& (io
+							.copy
+							.as_ref()
+							.is_none_or(|(_, copy, _)| copy.poll_complete(waiter).is_ready())
+							|| io.accepted.as_ref().is_some_and(|accepted| accepted.info() != info)
+							|| asked.copy.poll_grouped(waiter).is_ready()
+							|| asked.copy.poll_complete(waiter).is_ready())
+					{
+						return Some(FrontStep::Info(name.clone(), asked.source, Ok(info.clone())));
+					}
 				}
-				follow_demand(&mut io.held, io.accepted.as_mut(), &io.weak, &io.routes, waiter);
+				follow_demand(&mut io.held, None, io.accepted.as_mut(), &io.weak, &io.routes, waiter);
 				// Settled once the copy closes: a group still open below a declared end is
 				// owed until then, and a session closing first means it never came.
 				if let Some((source, copy, _)) = &io.copy
@@ -4504,6 +4540,8 @@ impl kio::Task for FrontServe {
 							// Drop the copy so its source goes idle at once. A returning
 							// reader gets a fresh one, so nothing cached can be stale.
 							io.routes.park();
+							io.query = None;
+							io.staged = None;
 							io.copy = None;
 							io.held = None;
 						}
@@ -14168,6 +14206,244 @@ mod tests {
 		assert!(matches!(next_group(&mut subscription).await, Ok(None)));
 	}
 
+	/// The newcomer answers "video" with matching metadata, the front reads that answer,
+	/// and only then does the newcomer abort, before its first group: still a refusal, so
+	/// the incumbent keeps serving.
+	#[kio::test]
+	#[cfg(feature = "async")]
+	async fn a_replacement_aborted_after_its_answer_keeps_the_incumbent() {
+		let (producer, _server, _upstream, old, mut subscription) = remote_front().await;
+
+		let newcomer = producer
+			.route("room/alice", RouteOptions::hidden().with_instance(instance(), 0))
+			.unwrap();
+		let mut handler = newcomer.broadcast().requests();
+		newcomer.announce().unwrap();
+		let request = kio::clock::timeout(Duration::from_secs(1), handler.requested_track())
+			.await
+			.expect("the front asked the newcomer")
+			.expect("request");
+		let replacement = request.accept(crate::track::Info::timed());
+		for _ in 0..10 {
+			kio::clock::sim::yield_now().await;
+		}
+		replacement.abort(Error::App(7)).unwrap();
+		for _ in 0..10 {
+			kio::clock::sim::yield_now().await;
+		}
+
+		let mut group = old.append_group().unwrap();
+		group.write_frame(crate::Timestamp::ZERO, b"still".as_ref()).unwrap();
+		group.finish().unwrap();
+		let mut group = next_group(&mut subscription)
+			.await
+			.expect("the incumbent keeps serving")
+			.expect("track open");
+		assert_eq!(&group.read_frame().await.unwrap().unwrap().payload[..], b"still");
+
+		// The incumbent's clean end is the track's, not the newcomer's error.
+		old.finish().unwrap();
+		assert!(matches!(next_group(&mut subscription).await, Ok(None)));
+	}
+
+	/// The incumbent delivers its last group and finishes, and only then does the newcomer
+	/// abort before its first group: the incumbent's clean end is the track's.
+	#[kio::test]
+	#[cfg(feature = "async")]
+	async fn a_replacement_aborted_after_the_incumbent_finished_ends_the_track_cleanly() {
+		let (producer, _server, _upstream, old, mut subscription) = remote_front().await;
+
+		let newcomer = producer
+			.route("room/alice", RouteOptions::hidden().with_instance(instance(), 0))
+			.unwrap();
+		let mut handler = newcomer.broadcast().requests();
+		newcomer.announce().unwrap();
+		let request = kio::clock::timeout(Duration::from_secs(1), handler.requested_track())
+			.await
+			.expect("the front asked the newcomer")
+			.expect("request");
+		let replacement = request.accept(crate::track::Info::timed());
+		for _ in 0..10 {
+			kio::clock::sim::yield_now().await;
+		}
+		let mut group = old.append_group().unwrap();
+		group.write_frame(crate::Timestamp::ZERO, b"last".as_ref()).unwrap();
+		group.finish().unwrap();
+		old.finish().unwrap();
+		replacement.abort(Error::App(7)).unwrap();
+
+		let mut group = next_group(&mut subscription)
+			.await
+			.expect("the incumbent's last group")
+			.expect("track open");
+		assert_eq!(&group.read_frame().await.unwrap().unwrap().payload[..], b"last");
+		assert!(matches!(next_group(&mut subscription).await, Ok(None)));
+	}
+
+	/// The incumbent finishes and the newcomer aborts before its first group: a reader whose
+	/// range starts past the end, and one joining while the newcomer is awaited, end cleanly.
+	#[kio::test]
+	#[cfg(feature = "async")]
+	async fn readers_owed_nothing_below_the_incumbents_end_end_cleanly() {
+		let (producer, _server, _upstream, old, _subscription) = remote_front().await;
+		let resolved = producer.consume().request("room/alice", None).await.unwrap();
+		let video = resolved.track("video").unwrap();
+		let mut later = video
+			.subscribe(crate::track::Subscription {
+				ranges: vec![crate::track::Range {
+					start: crate::track::Anchor::Absolute(3),
+					end: None,
+				}],
+				..Default::default()
+			})
+			.await
+			.unwrap();
+		let mut group = old.append_group().unwrap();
+		group.write_frame(crate::Timestamp::ZERO, b"last".as_ref()).unwrap();
+		group.finish().unwrap();
+
+		let newcomer = producer
+			.route("room/alice", RouteOptions::hidden().with_instance(instance(), 0))
+			.unwrap();
+		let mut handler = newcomer.broadcast().requests();
+		newcomer.announce().unwrap();
+		let request = kio::clock::timeout(Duration::from_secs(1), handler.requested_track())
+			.await
+			.expect("the front asked the newcomer")
+			.expect("request");
+		let replacement = request.accept(crate::track::Info::timed());
+		for _ in 0..10 {
+			kio::clock::sim::yield_now().await;
+		}
+		let mut joiner = video.subscribe(None).await.unwrap();
+		for _ in 0..10 {
+			kio::clock::sim::yield_now().await;
+		}
+		old.finish().unwrap();
+		replacement.abort(Error::App(7)).unwrap();
+
+		assert!(matches!(next_group(&mut later).await, Ok(None)));
+		let mut group = next_group(&mut joiner)
+			.await
+			.expect("the incumbent's latest group")
+			.expect("track open");
+		assert_eq!(&group.read_frame().await.unwrap().unwrap().payload[..], b"last");
+		assert!(matches!(next_group(&mut joiner).await, Ok(None)));
+	}
+
+	/// While the front waits for the newcomer's first group, a reader changing its
+	/// preferences reaches the newcomer's copy, which may otherwise never send that group.
+	#[kio::test]
+	#[cfg(feature = "async")]
+	async fn an_awaited_replacement_follows_the_readers_demand() {
+		let (producer, _server, _upstream, _old, mut subscription) = remote_front().await;
+
+		let newcomer = producer
+			.route("room/alice", RouteOptions::hidden().with_instance(instance(), 0))
+			.unwrap();
+		let mut handler = newcomer.broadcast().requests();
+		newcomer.announce().unwrap();
+		let request = kio::clock::timeout(Duration::from_secs(1), handler.requested_track())
+			.await
+			.expect("the front asked the newcomer")
+			.expect("request");
+		let replacement = request.accept(crate::track::Info::timed());
+		for _ in 0..10 {
+			kio::clock::sim::yield_now().await;
+		}
+		assert_eq!(replacement.subscription().map(|wanted| wanted.priority), Some(0));
+
+		let preferences = crate::track::Subscription {
+			priority: 9,
+			..subscription.subscription()
+		};
+		subscription.update(preferences).unwrap();
+		for _ in 0..10 {
+			kio::clock::sim::yield_now().await;
+		}
+		assert_eq!(replacement.subscription().map(|wanted| wanted.priority), Some(9));
+	}
+
+	/// Before the incumbent delivered anything, the newcomer answers "video" with matching
+	/// metadata and then finishes without a group: a deliberate end of the broadcast's
+	/// track, so the track ends rather than the front waiting on a group that never comes.
+	#[kio::test]
+	#[cfg(feature = "async")]
+	async fn a_replacement_finished_without_a_group_ends_the_track() {
+		let producer = origin(1).produce();
+		let server = producer
+			.forward(
+				"room",
+				RouteInfo::default().with_instance(instance(), 0).with_hops(hops(&[10])),
+				None,
+			)
+			.unwrap();
+		let pending = producer.consume().request("room/alice", None);
+		let upstream = broadcast::Info::new().produce();
+		let _old = upstream.create_track("video", crate::track::Info::timed()).unwrap();
+		queued(&server).await.serve(&upstream);
+		let resolved = pending.await.expect("resolves");
+		let mut subscription = resolved.track("video").unwrap().subscribe(None).await.unwrap();
+
+		let newcomer = producer
+			.route("room/alice", RouteOptions::hidden().with_instance(instance(), 0))
+			.unwrap();
+		let mut handler = newcomer.broadcast().requests();
+		newcomer.announce().unwrap();
+		let request = kio::clock::timeout(Duration::from_secs(1), handler.requested_track())
+			.await
+			.expect("the front asked the newcomer")
+			.expect("request");
+		let replacement = request.accept(crate::track::Info::timed());
+		for _ in 0..10 {
+			kio::clock::sim::yield_now().await;
+		}
+		replacement.finish().unwrap();
+
+		assert!(matches!(next_group(&mut subscription).await, Ok(None)));
+		drop(replacement);
+	}
+
+	/// The newcomer is asked while only an info lookup wants "video", so its copy has no
+	/// subscription. A live reader joining while the front waits on its first group
+	/// subscribes it, or that group may never come.
+	#[kio::test]
+	#[cfg(feature = "async")]
+	async fn an_awaited_replacement_asked_without_readers_subscribes_when_one_joins() {
+		let (producer, _server, _upstream, _old, subscription) = remote_front().await;
+		let resolved = producer.consume().request("room/alice", None).await.unwrap();
+		let video = resolved.track("video").unwrap();
+		let _info = video.info();
+		drop(subscription);
+		for _ in 0..10 {
+			kio::clock::sim::yield_now().await;
+		}
+
+		let newcomer = producer
+			.route("room/alice", RouteOptions::hidden().with_instance(instance(), 0))
+			.unwrap();
+		let mut handler = newcomer.broadcast().requests();
+		newcomer.announce().unwrap();
+		let request = kio::clock::timeout(Duration::from_secs(1), handler.requested_track())
+			.await
+			.expect("the front asked the newcomer")
+			.expect("request");
+		let replacement = request.accept(crate::track::Info::timed());
+		for _ in 0..10 {
+			kio::clock::sim::yield_now().await;
+		}
+		assert!(replacement.subscription().is_none(), "nobody reads the track yet");
+
+		let _again = video.subscribe(None).await.unwrap();
+		for _ in 0..10 {
+			kio::clock::sim::yield_now().await;
+		}
+		assert!(
+			replacement.subscription().is_some(),
+			"the awaited copy never got the reader's demand"
+		);
+	}
+
 	/// The newcomer refuses "video", so the track drains the incumbent. The reader leaves
 	/// (the park drops the incumbent's copy), a third source that also lacks the track
 	/// takes over, and the reader returns: it gets an outcome rather than waiting on the
diff --git a/rs/moq-net/src/model/resume.rs b/rs/moq-net/src/model/resume.rs
index af8b259d25d..93d4973c8fe 100644
--- a/rs/moq-net/src/model/resume.rs
+++ b/rs/moq-net/src/model/resume.rs
@@ -337,11 +337,12 @@ impl Consumer {
 		waiter: &kio::Waiter,
 	) -> Poll<Option<Position>> {
 		loop {
-			let (generation, copy) = {
+			// One read, so a copy served just before the front concluded is the one polled.
+			let (generation, copy, end) = {
 				let route = self.state.read();
-				(route.generation, route.copy.clone())
+				let end = route.phase.terminal().then(|| route.phase.end().cloned());
+				(route.generation, route.copy.clone(), end)
 			};
-			let end = self.end();
 			// A replacement copy can start below what an earlier one reported.
 			match copy.map(|copy| copy.poll_largest_after(seen, bounds, waiter)) {
 				Some(Poll::Ready(Some(largest))) => return Poll::Ready(Some(largest)),
@@ -354,6 +355,25 @@ impl Consumer {
 		}
 	}
 
+	/// Ready once the serving copy holds a group. Stays pending once the front settled on a
+	/// last copy without one.
+	pub(super) fn poll_grouped(&self, waiter: &kio::Waiter) -> Poll<()> {
+		loop {
+			// One read, so a copy served just before the front concluded is the one polled.
+			let (generation, copy, terminal) = {
+				let route = self.state.read();
+				(route.generation, route.copy.clone(), route.phase.terminal())
+			};
+			if copy.is_some_and(|copy| copy.poll_grouped(waiter).is_ready()) {
+				return Poll::Ready(());
+			}
+			if terminal {
+				return Poll::Pending;
+			}
+			ready!(self.poll_changed(generation, waiter));
+		}
+	}
+
 	/// Subscribe to the logical track with the reader's own preferences.
 	pub(super) fn subscribe(&self, subscription: track::Preferences) -> Subscriber {
 		let mirrored = subscription.read().clone();
diff --git a/rs/moq-net/src/model/track.rs b/rs/moq-net/src/model/track.rs
index 6af2ddd2f15..1e869a15af6 100644
--- a/rs/moq-net/src/model/track.rs
+++ b/rs/moq-net/src/model/track.rs
@@ -5430,6 +5430,28 @@ impl Consumer {
 		self.with_state(|state| state?.read().max_sequence)
 	}
 
+	/// Ready once [`Self::latest_sequence`] is `Some`: the track holds a group. Stays pending
+	/// on a track that closed without one.
+	pub(super) fn poll_grouped(&self, waiter: &kio::Waiter) -> Poll<()> {
+		self.with_state(|state| {
+			let Some(state) = state else {
+				return Poll::Pending;
+			};
+			let routes = state.read().routes.clone();
+			if let Some(routes) = routes {
+				return routes.poll_grouped(waiter);
+			}
+			match state.poll(waiter, |state| match state.max_sequence {
+				Some(_) => Poll::Ready(()),
+				None => Poll::Pending,
+			}) {
+				Poll::Ready(Ok(())) => Poll::Ready(()),
+				Poll::Ready(Err(closed)) if closed.max_sequence.is_some() => Poll::Ready(()),
+				_ => Poll::Pending,
+			}
+		})
+	}
+
 	/// The first group the declared end excludes whole, or `None` while the track is open ended.
 	#[cfg_attr(not(feature = "async"), allow(dead_code, reason = "async-only"))]
 	pub(crate) fn final_sequence(&self) -> Option<u64> {

From 37f8305d43d8602de4dbe53808608a3d7d7f8a04 Mon Sep 17 00:00:00 2001
From: Luke Curley <kixelated@gmail.com>
Date: Fri, 6 Nov 2026 00:55:11 +0000
Subject: [PATCH 34/36] quest: re-cut milestones by kind of change and priority
 (#7988)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: quest fixer <quest-fixer@localhost>
---
 bench/README.md                               |   2 +-
 doc/concept/socket.md                         |   2 +-
 infra/README.md                               |   2 +-
 quest/README.md                               |  63 ++-
 quest/m0/ci/mbx-r2-verify.md                  |   2 +-
 quest/m0/ffi-shutdown-backport.md             |   4 +-
 quest/m1/README.md                            | 182 ++-----
 quest/m1/api-audit/README.md                  |   4 +-
 quest/m1/api-audit/route/README.md            |  10 +-
 quest/m1/audio-jitter-target/watch.md         |   2 +-
 quest/m1/bench-publish.md                     |   4 +-
 quest/m1/buffered-ascending.md                |   6 +-
 quest/m1/datagram-tracks/README.md            |  16 +-
 quest/m1/drop-set.md                          |   6 +-
 quest/m1/group-error-cache.md                 |   2 +-
 quest/m1/moq-e2ee-remove.md                   |   2 +-
 quest/m1/read-backfill.md                     |   4 +-
 quest/m1/receive-windows-evicted.md           |  10 +-
 quest/m1/release-perf/README.md               |  10 +-
 quest/m1/rind/README.md                       |   6 +-
 quest/m1/rind/rtc.md                          |   2 +-
 quest/m1/routing-guide.md                     |   4 +-
 quest/m1/session-policy/README.md             |   4 +-
 quest/m1/session-policy/connect.md            |   2 +-
 quest/m1/session-policy/tokio-handoff.md      |   4 +-
 quest/m1/session-policy/uring.md              |   4 +-
 quest/m1/socket/README.md                     |  18 +-
 quest/m1/socket/js.md                         |   2 +-
 quest/m1/ts-reliability/README.md             |   2 +-
 quest/{m2 => m1}/video-vaapi.md               |   2 +-
 quest/m1/webgpu-safari.md                     |   2 +-
 quest/m1/webrtc-vendor.md                     |  10 +-
 quest/m2/README.md                            | 486 +++++++-----------
 quest/{m1 => m2}/announce-takeover.md         |   6 +-
 quest/{m1 => m2}/cluster-routing/README.md    |  26 +-
 .../{m1 => m2}/cluster-routing/federation.md  |  12 +-
 .../cluster-routing/routes/README.md          |  30 +-
 .../cluster-routing/routes/acceptance.md      |   6 +-
 .../cluster-routing/routes/availability.md    |   6 +-
 quest/{m1 => m2}/cluster-routing/routes/js.md |   8 +-
 .../cluster-routing/routes/proof.md           |   4 +-
 .../cluster-routing/routes/session.md         |   4 +-
 quest/m2/cut-gate/README.md                   |  38 ++
 quest/{m1 => m2/cut-gate}/c/README.md         |  10 +-
 quest/{m1 => m2/cut-gate}/cut-audit/README.md |  20 +-
 .../{m1 => m2/cut-gate}/vendor-sync/README.md |  15 +-
 quest/{m1 => m2}/group-drops.md               |   0
 quest/{m1 => m2}/lite07-finalize.md           |  24 +-
 quest/m2/probe/README.md                      |   4 +-
 quest/m2/probe/browser-send-estimate.md       |   2 +-
 quest/m2/recut-held.md                        |  38 ++
 quest/{m1 => m2}/subscribe-ranges/README.md   |  12 +-
 quest/{m1 => m2}/subscribe-ranges/js-fills.md |   4 +-
 .../subscribe-ranges/lite07-fetch.md          |   0
 .../subscribe-ranges/start-bookkeeping.md     |   4 +-
 quest/{m1 => m2}/time-addressing/README.md    |  16 +-
 quest/{m1 => m2}/time-addressing/bindings.md  |   4 +-
 quest/{m1 => m2}/time-addressing/consumers.md |   4 +-
 quest/{m1 => m2}/time-addressing/e2ee.md      |   4 +-
 quest/{m1 => m2}/time-addressing/guide.md     |   6 +-
 quest/{m1 => m2}/time-addressing/ietf.md      |   4 +-
 quest/{m1 => m2}/time-addressing/js.md        |  10 +-
 quest/{m1 => m2}/time-addressing/lite07.md    |  10 +-
 quest/{m1 => m2}/time-addressing/model.md     |  10 +-
 quest/{m1 => m2}/unbounded-groups/README.md   |  14 +-
 .../{m1 => m2}/unbounded-groups/byte-holes.md |  12 +-
 .../unbounded-groups/compressed-stream.md     |   4 +-
 .../unbounded-groups/js-byte-holes.md         |  10 +-
 .../unbounded-groups/paced-batch-fills.md     |   0
 quest/{m1 => m2}/webrtc-rename.md             |   4 +-
 ...ublication-has-no-generation-so-a-flush.md |   0
 quest/m3/README.md                            | 243 ++++++---
 quest/{m2 => m3}/advertise-credit-timeout.md  |   2 +-
 quest/{m2 => m3}/announce-revoke-reset.md     |   0
 quest/{m2 => m3}/archive-dvr.md               |   2 +-
 quest/{m2 => m3}/audio-alsa-onset.md          |   0
 quest/{m2 => m3}/audio-decode-audiotoolbox.md |   4 +-
 quest/{m2 => m3}/audio-flush-group.md         |   0
 quest/{m2 => m3}/audio-lang.md                |   2 +-
 quest/{m2 => m3}/audio-latest-reach-back.md   |   0
 quest/{m2 => m3}/audio-only-play.md           |   0
 quest/{m2 => m3}/audit-ci.md                  |  15 +-
 quest/{m2 => m3}/audit-compile-time.md        |  17 +-
 quest/{m2 => m3}/audit-dead-code.md           |   9 +-
 quest/{m2 => m3}/audit-deps.md                |  13 +-
 quest/{m2 => m3}/audit-docs.md                |   9 +-
 quest/{m2 => m3}/audit-interop.md             |  15 +-
 quest/{m2 => m3}/audit-lints.md               |  13 +-
 quest/{m2 => m3}/audit-perf.md                |  17 +-
 quest/{m2 => m3}/audit-quests.md              |   9 +-
 quest/{m2 => m3}/audit-simplify.md            |  13 +-
 quest/{m2 => m3}/audit-size.md                |  17 +-
 quest/{m2 => m3}/audit-test-cost.md           |  11 +-
 quest/{m2 => m3}/audit-test-coverage.md       |  19 +-
 quest/{m2 => m3}/broadcast-fairness.md        |   0
 quest/{m2 => m3}/bun-check.md                 |   0
 quest/{m2 => m3}/c/README.md                  |  14 +-
 quest/{m2 => m3}/c/async-failure-contract.md  |   2 +-
 quest/{m2 => m3}/c/consumers.md               |  10 +-
 quest/{m2 => m3}/capture-alsa-link.md         |   6 +-
 quest/{m2 => m3}/capture-app-audio-macos.md   |   4 +-
 quest/{m2 => m3}/capture-linux.md             |   2 +-
 quest/{m2 => m3}/capture-windows.md           |   6 +-
 quest/{m2 => m3}/cli-packaging.md             |   6 +-
 quest/{m2 => m3}/cmsg-len-send.md             |   0
 .../{m2 => m3}/connection-panic-isolation.md  |   0
 quest/{m2 => m3}/cpal-alsa-runtime.md         |  10 +-
 quest/{m2 => m3}/cpp-ffi-reuse.md             |   0
 quest/{m2 => m3}/crates-trusted-publisher.md  |  10 +-
 quest/{m2 => m3}/crypto-key-load.md           |   2 +-
 quest/{m2 => m3}/dart-ios.md                  |   2 +-
 quest/{m2 => m3}/dash-reconfigure.md          |   2 +-
 quest/{m2 => m3}/drm/README.md                |   8 +-
 quest/{m2 => m3}/drm/bindings.md              |   4 +-
 quest/{m2 => m3}/drm/import.md                |   6 +-
 quest/{m2 => m3}/drm/mp4-atom.md              |   2 +-
 quest/{m2 => m3}/errqueue-truncation.md       |   2 +-
 quest/{m2 => m3}/fetch-synced.md              |   0
 quest/{m2 => m3}/ffi-exporter.md              |   6 +-
 quest/{m2 => m3}/ffi-future-size.md           |   2 +-
 quest/{m2 => m3}/fmp4-declared-clock.md       |   0
 quest/{m2 => m3}/follow-refused-retry.md      |   6 +-
 quest/{m2 => m3}/gapless-audio-switch.md      |   0
 quest/{m2 => m3}/go-ffi-platform-modules.md   |   2 +-
 quest/{m2 => m3}/go-module-proxy.md           |   2 +-
 .../{m2 => m3}/goaway-migration-followups.md  |   0
 quest/{m2 => m3}/gpu-ci.md                    |   4 +-
 quest/{m2 => m3}/gpu-health.md                |  12 +-
 quest/{m2 => m3}/gpu-release.md               |   6 +-
 quest/{m2 => m3}/headless-empty-tail.md       |   0
 quest/{m2 => m3}/hls-audio-languages.md       |   2 +-
 quest/{m2 => m3}/hls-rendition-source.md      |   0
 quest/{m2 => m3}/hls-stalled-segment.md       |   2 +-
 quest/{m2 => m3}/hls-trailing-gap.md          |   0
 quest/{m2 => m3}/ietf-absolute-join-race.md   |   4 +-
 quest/{m2 => m3}/ietf-fill-refill.md          |   2 +-
 quest/{m2 => m3}/ietf-finish.md               |   0
 quest/{m2 => m3}/ietf-join-pin-head.md        |   4 +-
 quest/{m2 => m3}/ietf-js-joining-fetch.md     |   2 +-
 quest/{m2 => m3}/ietf-request-lease.md        |   0
 quest/{m2 => m3}/import-lang-iso639.md        |   2 +-
 quest/{m2 => m3}/import-metadata-policy.md    |   0
 quest/{m2 => m3}/interop-shutdown-warnings.md |   0
 quest/{m2 => m3}/intra-refresh/README.md      |  12 +-
 .../intra-refresh/consumer-warmup.md          |   2 +-
 .../{m2 => m3}/intra-refresh/dual-decoder.md  |   4 +-
 .../intra-refresh/export-sync-flags.md        |   2 +-
 quest/{m2 => m3}/intra-refresh/h264-import.md |   2 +-
 quest/{m2 => m3}/intra-refresh/h265-import.md |   2 +-
 .../{m2 => m3}/intra-refresh/plan-boundary.md |   4 +-
 quest/{m2 => m3}/js-announced-coalesce.md     |   2 +-
 quest/{m2 => m3}/js-warmup-trim.md            |   0
 quest/{m2 => m3}/json-snapshot-resync.md      |   2 +-
 quest/{m2 => m3}/lite-tail-drop-count.md      |   0
 quest/{m2 => m3}/mbx-r2-release-cache.md      |   6 +-
 quest/{m2 => m3}/memory-bench-hang.md         |   0
 quest/{m2 => m3}/mesh/README.md               |  54 +-
 quest/{m2 => m3}/mesh/addr.md                 |   6 +-
 quest/{m2 => m3}/mesh/endpoint.md             |   8 +-
 quest/{m2 => m3}/mesh/guide.md                |   2 +-
 quest/{m2 => m3}/mesh/js-enroll.md            |   2 +-
 quest/{m2 => m3}/mesh/node.md                 |   2 +-
 quest/{m2 => m3}/mesh/overlay.md              |  12 +-
 quest/{m2 => m3}/mesh/status.md               |   4 +-
 quest/{m2 => m3}/mf-encode-adapter.md         |   4 +-
 quest/{m2 => m3}/mkv-flac-channel-mask.md     |   0
 quest/{m2 => m3}/mobile-capture-android.md    |   2 +-
 quest/{m2 => m3}/mobile-capture-ios.md        |   2 +-
 quest/{m2 => m3}/mobile-completion.md         |   6 +-
 quest/{m2 => m3}/mp4-repair-lock.md           |   0
 quest/{m2 => m3}/mux-source-cut.md            |   2 +-
 quest/{m2 => m3}/net-broadcast-requests.md    |   4 +-
 quest/{m2 => m3}/nixpkgs-cli.md               |   8 +-
 quest/{m2 => m3}/nixpkgs-relay.md             |   4 +-
 quest/{m2 => m3}/obs-decode-latest.md         |   2 +-
 quest/{m2 => m3}/obs-moq-video/README.md      |  28 +-
 quest/{m2 => m3}/obs-moq-video/adapter.md     |   0
 .../{m2 => m3}/obs-moq-video/linux-bundle.md  |   4 +-
 quest/{m2 => m3}/obs-moq-video/source.md      |   2 +-
 quest/{m2 => m3}/obs-moq-video/vpx-obs.md     |   4 +-
 quest/{m2 => m3}/obs-multitrack-check.md      |   0
 quest/{m2 => m3}/obs-studio/README.md         |   8 +-
 quest/{m2 => m3}/obs-studio/maintainers.md    |   2 +-
 quest/{m2 => m3}/one-port/README.md           |  24 +-
 quest/{m2 => m3}/one-port/rtc-feed.md         |   2 +-
 quest/{m2 => m3}/one-port/srt-demux.md        |   0
 quest/{m2 => m3}/opus-surround-export.md      |   2 +-
 quest/{m2 => m3}/pes-hold-open-gop.md         |   0
 quest/{m2 => m3}/plan-watch-worker.md         |   4 +-
 quest/{m2 => m3}/publish-cancel-classify.md   |   0
 quest/{m2 => m3}/publish-done-codes.md        |   0
 quest/{m2 => m3}/publish-support-probe.md     |   0
 quest/{m2 => m3}/pulseaudio-capture-period.md |   4 +-
 quest/{m2 => m3}/qos-publisher-timeliness.md  |   4 +-
 quest/{m2 => m3}/qos/README.md                |  12 +-
 quest/{m2 => m3}/qos/lag-histogram.md         |   6 +-
 quest/{m2 => m3}/quic-ack-hook.md             |   4 +-
 quest/{m2 => m3}/quic-emsgsize-classify.md    |   0
 quest/{m2 => m3}/quic-long-type.md            |   0
 quest/{m2 => m3}/quic-realtime/README.md      |  14 +-
 .../quic-realtime/moqsink-feedback.md         |   4 +-
 .../quic-realtime/uring-controller.md         |   0
 quest/{m2 => m3}/quic-sansio-driver.md        |   2 +-
 quest/{m2 => m3}/rate-websocket.md            |   2 +-
 quest/{m2 => m3}/readers-range-live.md        |   0
 quest/{m2 => m3}/relay-io-uring-package.md    |   2 +-
 quest/{m2 => m3}/relay-undialable-peers.md    |   2 +-
 quest/{m2 => m3}/release-rs-oidc.md           |   4 +-
 quest/{m2 => m3}/release-tag-publishers.md    |   6 +-
 quest/{m2 => m3}/release/README.md            |  42 +-
 quest/{m2 => m3}/release/api-review.md        |   8 +-
 quest/{m2 => m3}/release/assets-release.md    |   0
 quest/{m2 => m3}/release/c-publish.md         |  12 +-
 quest/{m2 => m3}/release/c-retire.md          |   8 +-
 quest/{m2 => m3}/release/cpp-release.md       |   2 +-
 quest/{m2 => m3}/release/cut.md               |  41 +-
 quest/{m2 => m3}/release/dart-publish.md      |   4 +-
 quest/{m2 => m3}/release/e2ee-retire.md       |   6 +-
 quest/{m2 => m3}/release/feature-flags.md     |  16 +-
 quest/{m2 => m3}/release/feature-review.md    |   8 +-
 .../release/libmoq-final-release.md           |   0
 quest/{m2 => m3}/release/libmoq-retire.md     |   2 +-
 quest/{m2 => m3}/release/migrate-audit.md     |   4 +-
 quest/{m2 => m3}/release/moq-sh-deploy.md     |   2 +-
 quest/{m2 => m3}/release/npm-first-publish.md |   4 +-
 quest/{m2 => m3}/release/qmux-js-retire.md    |   0
 .../release/relay-loader-adoption.md          |   0
 .../{m2 => m3}/release/runner-client-bump.md  |   2 +-
 .../release/smoke-bindings-rename.md          |   2 +-
 quest/{m2 => m3}/render-d3d11.md              |   2 +-
 quest/{m2 => m3}/rtc-pacing.md                |   4 +-
 quest/{m2 => m3}/rust2-exporter.md            |   2 +-
 quest/{m2 => m3}/session-outcome-records.md   |   0
 quest/{m2 => m3}/spawn-audit.md               |   0
 quest/{m2 => m3}/srt-rate-handle.md           |  10 +-
 quest/{m2 => m3}/stats/README.md              |  20 +-
 quest/{m2 => m3}/stats/feedback-media-test.md |   0
 quest/{m2 => m3}/stats/health-consumers.md    |   2 +-
 quest/{m2 => m3}/stats/preflight.md           |   8 +-
 quest/{m2 => m3}/stats/rust.md                |   8 +-
 quest/{m2 => m3}/stream/README.md             |   8 +-
 quest/{m2 => m3}/stream/bench.md              |   2 +-
 quest/{m2 => m3}/stream/js.md                 |   4 +-
 quest/{m2 => m3}/stream/rust.md               |   2 +-
 quest/{m2 => m3}/subscriber-fin-fold.md       |   0
 quest/{m2 => m3}/tls-link-alpn.md             |   0
 quest/{m2 => m3}/token-auth-followups.md      |   0
 quest/{m2 => m3}/ts-multi-program-restart.md  |   0
 quest/{m2 => m3}/uring-demux.md               |  12 +-
 quest/{m2 => m3}/vaapi-vulkan-import.md       |  18 +-
 quest/{m2 => m3}/video-quality/README.md      |  18 +-
 .../{m2 => m3}/video-quality/corpus-bucket.md |   0
 quest/{m2 => m3}/video-quality/gpu-runners.md |   2 +-
 quest/{m2 => m3}/video-quality/hardware.md    |  10 +-
 quest/{m2 => m3}/video-quality/harness.md     |  10 +-
 quest/{m2 => m3}/video-quality/moq-boy.md     |   2 +-
 quest/{m2 => m3}/video-quality/on-demand.md   |   6 +-
 quest/{m2 => m3}/vulkan-encode.md             |   4 +-
 quest/{m2 => m3}/watch-data-sync.md           |   4 +-
 quest/{m2 => m3}/watch-symlink-targets.md     |   0
 quest/{m2 => m3}/watch-worker.md              |   4 +-
 quest/{m2 => m3}/webcodecs-priming.md         |   8 +-
 quest/{m2 => m3}/webrtc/README.md             |  18 +-
 quest/{m2 => m3}/webrtc/clock.md              |   0
 quest/{m2 => m3}/webrtc/dtls-after-ice.md     |   2 +-
 quest/{m2 => m3}/webrtc/dtls-timeout.md       |   4 +-
 quest/{m2 => m3}/webrtc/sdp-bandwidth.md      |   0
 quest/{m2 => m3}/wire-stats/README.md         |   4 +-
 quest/{m2 => m3}/wire-stats/qmux.md           |   0
 quest/{m2 => m3}/wire-stats/srt.md            |   4 +-
 ...ipewire-dma-bufs-safely-into-the-vulkan.md |   2 +-
 quest/m4/README.md                            | 101 ++++
 quest/{m2 => m4}/aac-sbr-config.md            |   0
 quest/{m2 => m4}/aec-tests.md                 |   0
 quest/{m2 => m4}/announce-interest-memory.md  |   4 +-
 quest/{m2 => m4}/apple-sink-thread.md         |   0
 quest/{m2 => m4}/archive-store-bench.md       |   0
 quest/{m2 => m4}/ashpd-maintained.md          |   2 +-
 quest/{m2 => m4}/askama-maintained.md         |   4 +-
 quest/{m2 => m4}/audio-bufferbloat-av.md      |   2 +-
 quest/{m2 => m4}/audio-visqol.md              |   8 +-
 quest/{m2 => m4}/auth-drop-iroh.md            |   2 +-
 quest/{m2 => m4}/auth-drop-peer-grant.md      |   2 +-
 quest/{m2 => m4}/auth-session-index.md        |   0
 quest/{m2 => m4}/bench-base-paired.md         |   0
 quest/{m2 => m4}/bench-epoch-pin.md           |   0
 quest/{m2 => m4}/bench-hygiene.md             |   0
 quest/{m2 => m4}/bench-latency-resolution.md  |   0
 quest/{m2 => m4}/bench-sources.md             |   0
 quest/{m2 => m4}/bench-transport-sweep.md     |   4 +-
 quest/{m2 => m4}/bench-uring-pool.md          |   0
 quest/{m2 => m4}/browser-receive-credit.md    |   2 +-
 quest/{m2 => m4}/cache-fairness.md            |  10 +-
 quest/{m2 => m4}/capture-wgc.md               |   6 +-
 quest/{m2 => m4}/chromium-opus-timestamps.md  |   2 +-
 quest/{m2 => m4}/cli-catalog-updates.md       |   0
 quest/{m2 => m4}/crossbeam-pin-fence.md       |   0
 quest/{m2 => m4}/env-knobs.md                 |   0
 quest/{m2 => m4}/fill-wait-cancel-test.md     |   0
 quest/{m2 => m4}/fmp4-byte-chunk-perf.md      |   0
 quest/{m2 => m4}/format-gate-followups.md     |   0
 quest/{m2 => m4}/formatter-defaults.md        |   4 +-
 quest/{m2 => m4}/gpu-encoder-death-test.md    |   0
 quest/{m2 => m4}/hls-follow-once.md           |   0
 quest/{m2 => m4}/hls-player-test.md           |   0
 quest/{m2 => m4}/interop-bindings.md          |   2 +-
 quest/{m2 => m4}/js-fastest-reader.md         |   2 +-
 quest/{m2 => m4}/kio-tasks-waker-test.md      |   0
 quest/{m2 => m4}/kt-gradle-9.md               |   0
 quest/{m2 => m4}/kt-version-catalog.md        |   0
 quest/{m2 => m4}/lint-examples.md             |   0
 quest/{m2 => m4}/macos-browser-lane.md        |   6 +-
 quest/{m2 => m4}/moqsrc-av-sync.md            |   0
 quest/{m2 => m4}/moqsrc-reconnect-order.md    |   0
 quest/{m2 => m4}/mutants.md                   |   0
 quest/{m2 => m4}/mux-vr-ambisonic-fmp4.md     |   0
 quest/{m2 => m4}/net-test-subscriber.md       |   0
 quest/{m2 => m4}/nix-relay-peers-test.md      |   2 +-
 quest/{m2 => m4}/p2p/README.md                |  28 +-
 quest/{m2 => m4}/p2p/cli.md                   |   8 +-
 quest/{m2 => m4}/p2p/cost-scopes.md           |  10 +-
 quest/{m2 => m4}/p2p/harness.md               |   8 +-
 quest/{m2 => m4}/p2p/native-quic.md           |   8 +-
 quest/{m2 => m4}/p2p/signal.md                |   8 +-
 quest/{m2 => m4}/p2p/watch.md                 |  12 +-
 quest/{m2 => m4}/pcm-bulk-encode.md           |   0
 quest/{m2 => m4}/peer-grant-bound.md          |   6 +-
 quest/{m2 => m4}/perf/README.md               |  34 +-
 quest/{m2 => m4}/perf/cluster-route-memory.md |  10 +-
 quest/{m2 => m4}/perf/cursor-version-skip.md  |   0
 quest/{m2 => m4}/perf/hot-path-waste.md       |   2 +-
 quest/{m2 => m4}/perf/ingest-batch.md         |   0
 .../perf/kio-channel-contention/README.md     |  14 +-
 .../kio-channel-contention/log-adoption.md    |   4 +-
 .../relay-per-thread.md                       |   8 +-
 quest/{m2 => m4}/perf/kio-waiter-costs.md     |   2 +-
 quest/{m2 => m4}/perf/mesh-session-cost.md    |   0
 .../{m2 => m4}/perf/profile-lock-switches.md  |   4 +-
 quest/{m2 => m4}/perf/quic-lock-contention.md |   6 +-
 quest/{m2 => m4}/perf/relay-allocs.md         |   0
 quest/{m2 => m4}/perf/route-lock.md           |   2 +-
 quest/{m2 => m4}/perf/shard-default.md        |   4 +-
 quest/{m2 => m4}/perf/stream/README.md        |  14 +-
 quest/{m2 => m4}/perf/stream/ablation.md      |   4 +-
 quest/{m2 => m4}/perf/stream/codec.md         |   2 +-
 quest/{m2 => m4}/perf/stream/relay.md         |   4 +-
 quest/{m2 => m4}/perf/stream/ring.md          |   2 +-
 quest/{m2 => m4}/perf/ts-idle-jitter.md       |   0
 quest/{m2 => m4}/publish-firefox.md           |   8 +-
 quest/{m2 => m4}/py-test-timeouts.md          |   0
 quest/{m2 => m4}/qmux-02-subprotocols.md      |   2 +-
 quest/{m2 => m4}/quic-dev-dep-path.md         |   0
 quest/{m2 => m4}/quic-sim-mtu.md              |   2 +-
 quest/{m2 => m4}/quic-sim.md                  |   2 +-
 quest/{m2 => m4}/regrant-route-recheck.md     |   6 +-
 quest/{m2 => m4}/relay-capped-credit-test.md  |   0
 quest/{m2 => m4}/resume-redesign.md           |   6 +-
 quest/{m2 => m4}/route-wakes.md               |   4 +-
 quest/{m2 => m4}/scuffle-sps-bump.md          |   0
 quest/{m2 => m4}/shaper-socket.md             |   0
 quest/{m2 => m4}/shared-serve-js.md           |   4 +-
 quest/{m2 => m4}/shared-serve.md              |   6 +-
 quest/{m2 => m4}/sim-credit-open.md           |   0
 quest/{m2 => m4}/smoke-libressl.md            |   0
 quest/{m2 => m4}/sps-fuzz-h264-reader.md      |   0
 quest/{m2 => m4}/tenant-leak-checks.md        |   0
 quest/{m2 => m4}/test-inventory-followups.md  |   0
 quest/{m2 => m4}/track-info-docs.md           |   0
 .../{m2 => m4}/track-test-eviction-asserts.md |   0
 quest/{m2 => m4}/upstream-reports.md          |   4 +-
 quest/{m2 => m4}/uring-bench-followups.md     |   2 +-
 quest/{m2 => m4}/uring-lifecycle-tests.md     |   0
 quest/{m2 => m4}/usage-settings-once.md       |   2 +-
 quest/{m2 => m4}/usage-unknown-env.md         |   0
 quest/{m2 => m4}/vaapi-render-tests.md        |  14 +-
 quest/{m2 => m4}/watch-decode-gate.md         |   2 +-
 quest/{m2 => m4}/watch-test-waits.md          |   0
 quest/{m2 => m4}/wire-fuzz-coverage.md        |   0
 quest/{m2 => m4}/workflow-audit-followups.md  |   2 +-
 ...evc-and-av1-support-in-the-nvidia-codec.md |  10 +-
 ...te-35-ad-cue-signaling-carried-opaquely.md |   6 +-
 ...bandwidth-grant-in-moq-audio-instead-of.md |   0
 ...ve-sq-indirection-and-per-enter-ring-fd.md |   0
 ...tch-completion-wakeups-with-min-timeout.md |   0
 ...use-sendmsg-zc-for-large-udp-gso-trains.md |   4 +-
 ...fixed-file-slots-for-worker-udp-sockets.md |   0
 ...ter-tx-pool-buffers-for-zero-copy-sends.md |   6 +-
 quest/m5/README.md                            | 156 ++++++
 quest/{m3 => m5}/ac3-low-rate.md              |   0
 quest/{m3 => m5}/ada-gpu.md                   |   0
 quest/{m2 => m5}/announce-credit.md           |   6 +-
 quest/{m2 => m5}/announce-fanout-allocs.md    |   0
 quest/{m2 => m5}/archive-lookup-withdrawal.md |   2 +-
 quest/{m3 => m5}/archive-paced-replay.md      |   0
 quest/{m2 => m5}/archive-time-followups.md    |   4 +-
 quest/{m2 => m5}/audio-decode-mediacodec.md   |   2 +-
 .../audio-decode-mediafoundation.md           |   2 +-
 quest/{m2 => m5}/audio-encode-audiotoolbox.md |   6 +-
 quest/{m2 => m5}/audio-encode-mediacodec.md   |   4 +-
 .../audio-encode-mediafoundation.md           |   4 +-
 quest/{m3 => m5}/audio-filters.md             |   0
 quest/{m2 => m5}/audio-opus-backend.md        |   0
 quest/{m3 => m5}/audio-web.md                 |   4 +-
 quest/{m2 => m5}/auth-http-request-kind.md    |   2 +-
 quest/{m2 => m5}/auth-sign-caps.md            |   0
 quest/{m3 => m5}/auth-token-fetch.md          |   2 +-
 quest/{m3 => m5}/bun-lint-release.md          |   0
 quest/{m2 => m5}/c-origin-relay.md            |   4 +-
 quest/{m3 => m5}/captions-cea.md              |   0
 quest/{m2 => m5}/carla-bridge.md              |   4 +-
 quest/{m2 => m5}/catalog-republish-cost.md    |   2 +-
 quest/{m3 => m5}/cpp-conan.md                 |   8 +-
 quest/{m3 => m5}/cpp-vcpkg.md                 |   4 +-
 quest/{m3 => m5}/cut-through/README.md        |   8 +-
 quest/{m3 => m5}/cut-through/bench.md         |   4 +-
 quest/{m3 => m5}/cut-through/loss-delay.md    |   6 +-
 quest/{m2 => m5}/delivery-delay.md            |   4 +-
 quest/{m3 => m5}/drm-playback.md              |   2 +-
 quest/{m2 => m5}/e2ee/README.md               |  22 +-
 quest/{m2 => m5}/e2ee/browser.md              |   4 +-
 quest/{m2 => m5}/e2ee/cli.md                  |   6 +-
 quest/{m2 => m5}/e2ee/consumer.md             |   6 +-
 quest/{m2 => m5}/e2ee/interop.md              |   4 +-
 quest/{m2 => m5}/e2ee/js-undeclared-names.md  |   6 +-
 quest/{m2 => m5}/e2ee/rust-publish.md         |   8 +-
 quest/{m3 => m5}/emsg.md                      |   4 +-
 quest/{m3 => m5}/ffi-e2ee.md                  |   6 +-
 quest/{m2 => m5}/ffi-size-profile.md          |   0
 quest/{m3 => m5}/ffi-stream.md                |   6 +-
 quest/{m3 => m5}/flv-script.md                |   4 +-
 quest/{m3 => m5}/hidden-exemption.md          |   4 +-
 quest/{m3 => m5}/id3.md                       |   4 +-
 quest/{m3 => m5}/ietf-cluster-peers.md        |   4 +-
 quest/{m2 => m5}/ietf-hole-marker.md          |   0
 quest/{m3 => m5}/interop-runner-approval.md   |   0
 quest/{m2 => m5}/json-value-diff.md           |   4 +-
 quest/{m3 => m5}/ladder/README.md             |   6 +-
 quest/{m3 => m5}/ladder/controller.md         |   4 +-
 quest/{m3 => m5}/ladder/fetch.md              |   4 +-
 quest/{m2 => m5}/latency-ledger.md            |   6 +-
 quest/{m2 => m5}/link-quality.md              |   6 +-
 quest/{m3 => m5}/lite05-subscribe-end.md      |   0
 quest/{m3 => m5}/lite07-mesh.md               |   4 +-
 quest/{m3 => m5}/mesh-ice.md                  |  10 +-
 quest/{m3 => m5}/mesh-keys.md                 |   4 +-
 quest/{m3 => m5}/mkv-input-coalesce.md        |   0
 quest/{m3 => m5}/msf-publish-tracks.md        |   2 +-
 quest/{m3 => m5}/msfts-convergence.md         |   0
 quest/{m2 => m5}/native-compression-adopt.md  |   4 +-
 quest/{m2 => m5}/native-compression-flush.md  |   4 +-
 quest/{m2 => m5}/native-compression-sync.md   |   4 +-
 quest/{m2 => m5}/net-wrap/README.md           |  20 +-
 quest/{m2 => m5}/net-wrap/cli.md              |   6 +-
 quest/{m2 => m5}/net-wrap/e2ee.md             |  12 +-
 quest/{m2 => m5}/net-wrap/js.md               |  10 +-
 quest/{m2 => m5}/net-wrap/json.md             |   6 +-
 quest/{m2 => m5}/net-wrap/mux.md              |   6 +-
 quest/{m2 => m5}/net-wrap/traits.md           |   4 +-
 quest/{m3 => m5}/nvenc-av1.md                 |   8 +-
 quest/{m3 => m5}/nvenc-cuda-arrays.md         |   4 +-
 quest/{m2 => m5}/nvenc-pool.md                |   0
 quest/{m2 => m5}/obs-decode-linux.md          |   4 +-
 quest/{m2 => m5}/obs-decode-windows.md        |   2 +-
 quest/{m3 => m5}/obs-linux-gpu.md             |  10 +-
 quest/{m2 => m5}/obs-macos.md                 |   2 +-
 quest/{m2 => m5}/obs-windows.md               |   2 +-
 quest/{m2 => m5}/origin-front-parks.md        |   0
 quest/{m2 => m5}/performance-survey/README.md |  50 +-
 .../performance-survey/announced-snapshots.md |   2 +-
 .../browser-media-copies.md                   |   2 +-
 .../performance-survey/cache-metadata.md      |   6 +-
 .../performance-survey/gst-buffers.md         |   2 +-
 .../performance-survey/hls-serving.md         |   2 +-
 .../performance-survey/send-groups.md         |   2 +-
 .../performance-survey/session-selection.md   |   2 +-
 .../performance-survey/task-capacity.md       |   2 +-
 quest/{m3 => m5}/pipewire-camera-planes.md    |   2 +-
 quest/{m2 => m5}/qos-lag-dashboard.md         |   4 +-
 quest/{m2 => m5}/quic-bbr-study.md            |   0
 quest/{m3 => m5}/quic-careful-resume.md       |   0
 quest/{m2 => m5}/quic-deadline.md             |   6 +-
 quest/{m2 => m5}/quic-ecn-measure.md          |   4 +-
 quest/{m3 => m5}/quic-ecn.md                  |   4 +-
 quest/{m2 => m5}/quic-egress-profile.md       |  10 +-
 quest/{m2 => m5}/quic-io-boundary.md          |   8 +-
 quest/{m2 => m5}/quic-lb-forward-extras.md    |   0
 quest/{m2 => m5}/rate-grant.md                |   0
 quest/{m2 => m5}/receive-pool.md              |   8 +-
 quest/{m2 => m5}/recover-budget.md            |   2 +-
 quest/{m3 => m5}/relay-acme.md                |   2 +-
 quest/{m3 => m5}/request-token-surfaces.md    |   0
 quest/{m3 => m5}/rind-instant-acme.md         |   2 +-
 quest/{m2 => m5}/room-bench.md                |   2 +-
 quest/{m2 => m5}/route-health/README.md       |  16 +-
 quest/{m2 => m5}/route-health/idle-timeout.md |   0
 quest/{m2 => m5}/route-health/meta.md         |   2 +-
 quest/{m2 => m5}/route-health/recovery.md     |   4 +-
 quest/{m2 => m5}/route-health/selection.md    |   2 +-
 quest/{m2 => m5}/route-interest-prefixes.md   |   4 +-
 quest/{m3 => m5}/routing-cost-domains.md      |   6 +-
 quest/{m2 => m5}/rs2ts-browser-report.md      |   5 +-
 quest/{m2 => m5}/rs2ts-js.md                  |   2 +-
 quest/{m3 => m5}/rs2ts-model-ready.md         |   0
 quest/{m3 => m5}/rs2ts-model-subset.md        |   4 +-
 quest/{m2 => m5}/rs2ts-wasm2js.md             |   2 +-
 quest/{m3 => m5}/safari-webtransport.md       |   6 +-
 quest/{m2 => m5}/socket-old-hop-signal.md     |   6 +-
 quest/{m3 => m5}/stats-encoder-feedback.md    |  18 +-
 quest/{m3 => m5}/teleop-arbitration.md        |   4 +-
 quest/{m3 => m5}/teleop-mavlink.md            |   8 +-
 quest/{m3 => m5}/teleop-proof.md              |   6 +-
 quest/{m3 => m5}/teleop-robot.md              |  10 +-
 quest/{m3 => m5}/transcode-parallel-open.md   |   0
 quest/{m3 => m5}/unreal.md                    |   4 +-
 quest/{m3 => m5}/uring-cluster-dial.md        |   4 +-
 quest/{m2 => m5}/uring-transport-machines.md  |   5 +-
 quest/{m3 => m5}/video-codec-coverage.md      |   6 +-
 quest/{m3 => m5}/video-embedded.md            |   2 +-
 quest/{m3 => m5}/video-hardware-access.md     |   8 +-
 quest/{m3 => m5}/video-hardware.md            |  18 +-
 quest/{m3 => m5}/video-web.md                 |   0
 quest/{m3 => m5}/watch-webxr.md               |   0
 quest/{m2 => m5}/webgpu-hdr.md                |   0
 quest/{m3 => m5}/webkit-319818.md             |   0
 quest/{m3 => m5}/zero-copy-peer.md            |   0
 rs/moq-hls/tests/integration/conformance.rs   |   4 +-
 rs/moq-net/src/route/mod.rs                   |   2 +-
 rs/moq-net/tests/integration/mesh_withdraw.rs |   2 +-
 .../integration/routing_contracts/handoff.rs  |   2 +-
 .../integration/routing_contracts/mod.rs      |   2 +-
 .../integration/routing_contracts/model.rs    |   2 +-
 rs/moq-quic/README.md                         |   2 +-
 .../tests/integration/receive_credit.rs       |   2 +-
 rs/moq-video/src/capture/pipewire.rs          |   2 +-
 rs/moq-video/src/encode/encoder.rs            |   4 +-
 sh/gh/test-inventory.allow                    |  62 +--
 test/interop/README.md                        |   2 +-
 test/interop/interop.sh                       |   2 +-
 538 files changed, 2014 insertions(+), 1826 deletions(-)
 rename quest/{m2 => m1}/video-vaapi.md (98%)
 rename quest/{m1 => m2}/announce-takeover.md (98%)
 rename quest/{m1 => m2}/cluster-routing/README.md (91%)
 rename quest/{m1 => m2}/cluster-routing/federation.md (91%)
 rename quest/{m1 => m2}/cluster-routing/routes/README.md (97%)
 rename quest/{m1 => m2}/cluster-routing/routes/acceptance.md (96%)
 rename quest/{m1 => m2}/cluster-routing/routes/availability.md (85%)
 rename quest/{m1 => m2}/cluster-routing/routes/js.md (79%)
 rename quest/{m1 => m2}/cluster-routing/routes/proof.md (95%)
 rename quest/{m1 => m2}/cluster-routing/routes/session.md (98%)
 create mode 100644 quest/m2/cut-gate/README.md
 rename quest/{m1 => m2/cut-gate}/c/README.md (85%)
 rename quest/{m1 => m2/cut-gate}/cut-audit/README.md (80%)
 rename quest/{m1 => m2/cut-gate}/vendor-sync/README.md (90%)
 rename quest/{m1 => m2}/group-drops.md (100%)
 rename quest/{m1 => m2}/lite07-finalize.md (89%)
 create mode 100644 quest/m2/recut-held.md
 rename quest/{m1 => m2}/subscribe-ranges/README.md (94%)
 rename quest/{m1 => m2}/subscribe-ranges/js-fills.md (96%)
 rename quest/{m1 => m2}/subscribe-ranges/lite07-fetch.md (100%)
 rename quest/{m1 => m2}/subscribe-ranges/start-bookkeeping.md (95%)
 rename quest/{m1 => m2}/time-addressing/README.md (69%)
 rename quest/{m1 => m2}/time-addressing/bindings.md (88%)
 rename quest/{m1 => m2}/time-addressing/consumers.md (94%)
 rename quest/{m1 => m2}/time-addressing/e2ee.md (82%)
 rename quest/{m1 => m2}/time-addressing/guide.md (81%)
 rename quest/{m1 => m2}/time-addressing/ietf.md (95%)
 rename quest/{m1 => m2}/time-addressing/js.md (79%)
 rename quest/{m1 => m2}/time-addressing/lite07.md (90%)
 rename quest/{m1 => m2}/time-addressing/model.md (96%)
 rename quest/{m1 => m2}/unbounded-groups/README.md (96%)
 rename quest/{m1 => m2}/unbounded-groups/byte-holes.md (90%)
 rename quest/{m1 => m2}/unbounded-groups/compressed-stream.md (96%)
 rename quest/{m1 => m2}/unbounded-groups/js-byte-holes.md (87%)
 rename quest/{m1 => m2}/unbounded-groups/paced-batch-fills.md (100%)
 rename quest/{m1 => m2}/webrtc-rename.md (93%)
 rename quest/{m2 => m3}/3115-moqsink-the-publication-has-no-generation-so-a-flush.md (100%)
 rename quest/{m2 => m3}/advertise-credit-timeout.md (96%)
 rename quest/{m2 => m3}/announce-revoke-reset.md (100%)
 rename quest/{m2 => m3}/archive-dvr.md (95%)
 rename quest/{m2 => m3}/audio-alsa-onset.md (100%)
 rename quest/{m2 => m3}/audio-decode-audiotoolbox.md (93%)
 rename quest/{m2 => m3}/audio-flush-group.md (100%)
 rename quest/{m2 => m3}/audio-lang.md (97%)
 rename quest/{m2 => m3}/audio-latest-reach-back.md (100%)
 rename quest/{m2 => m3}/audio-only-play.md (100%)
 rename quest/{m2 => m3}/audit-ci.md (99%)
 rename quest/{m2 => m3}/audit-compile-time.md (97%)
 rename quest/{m2 => m3}/audit-dead-code.md (93%)
 rename quest/{m2 => m3}/audit-deps.md (96%)
 rename quest/{m2 => m3}/audit-docs.md (91%)
 rename quest/{m2 => m3}/audit-interop.md (95%)
 rename quest/{m2 => m3}/audit-lints.md (94%)
 rename quest/{m2 => m3}/audit-perf.md (95%)
 rename quest/{m2 => m3}/audit-quests.md (93%)
 rename quest/{m2 => m3}/audit-simplify.md (92%)
 rename quest/{m2 => m3}/audit-size.md (93%)
 rename quest/{m2 => m3}/audit-test-cost.md (95%)
 rename quest/{m2 => m3}/audit-test-coverage.md (92%)
 rename quest/{m2 => m3}/broadcast-fairness.md (100%)
 rename quest/{m2 => m3}/bun-check.md (100%)
 rename quest/{m2 => m3}/c/README.md (85%)
 rename quest/{m2 => m3}/c/async-failure-contract.md (97%)
 rename quest/{m2 => m3}/c/consumers.md (87%)
 rename quest/{m2 => m3}/capture-alsa-link.md (92%)
 rename quest/{m2 => m3}/capture-app-audio-macos.md (86%)
 rename quest/{m2 => m3}/capture-linux.md (97%)
 rename quest/{m2 => m3}/capture-windows.md (90%)
 rename quest/{m2 => m3}/cli-packaging.md (94%)
 rename quest/{m2 => m3}/cmsg-len-send.md (100%)
 rename quest/{m2 => m3}/connection-panic-isolation.md (100%)
 rename quest/{m2 => m3}/cpal-alsa-runtime.md (90%)
 rename quest/{m2 => m3}/cpp-ffi-reuse.md (100%)
 rename quest/{m2 => m3}/crates-trusted-publisher.md (91%)
 rename quest/{m2 => m3}/crypto-key-load.md (92%)
 rename quest/{m2 => m3}/dart-ios.md (96%)
 rename quest/{m2 => m3}/dash-reconfigure.md (96%)
 rename quest/{m2 => m3}/drm/README.md (86%)
 rename quest/{m2 => m3}/drm/bindings.md (81%)
 rename quest/{m2 => m3}/drm/import.md (94%)
 rename quest/{m2 => m3}/drm/mp4-atom.md (94%)
 rename quest/{m2 => m3}/errqueue-truncation.md (95%)
 rename quest/{m2 => m3}/fetch-synced.md (100%)
 rename quest/{m2 => m3}/ffi-exporter.md (97%)
 rename quest/{m2 => m3}/ffi-future-size.md (97%)
 rename quest/{m2 => m3}/fmp4-declared-clock.md (100%)
 rename quest/{m2 => m3}/follow-refused-retry.md (93%)
 rename quest/{m2 => m3}/gapless-audio-switch.md (100%)
 rename quest/{m2 => m3}/go-ffi-platform-modules.md (96%)
 rename quest/{m2 => m3}/go-module-proxy.md (97%)
 rename quest/{m2 => m3}/goaway-migration-followups.md (100%)
 rename quest/{m2 => m3}/gpu-ci.md (97%)
 rename quest/{m2 => m3}/gpu-health.md (95%)
 rename quest/{m2 => m3}/gpu-release.md (77%)
 rename quest/{m2 => m3}/headless-empty-tail.md (100%)
 rename quest/{m2 => m3}/hls-audio-languages.md (96%)
 rename quest/{m2 => m3}/hls-rendition-source.md (100%)
 rename quest/{m2 => m3}/hls-stalled-segment.md (96%)
 rename quest/{m2 => m3}/hls-trailing-gap.md (100%)
 rename quest/{m2 => m3}/ietf-absolute-join-race.md (91%)
 rename quest/{m2 => m3}/ietf-fill-refill.md (96%)
 rename quest/{m2 => m3}/ietf-finish.md (100%)
 rename quest/{m2 => m3}/ietf-join-pin-head.md (92%)
 rename quest/{m2 => m3}/ietf-js-joining-fetch.md (94%)
 rename quest/{m2 => m3}/ietf-request-lease.md (100%)
 rename quest/{m2 => m3}/import-lang-iso639.md (96%)
 rename quest/{m2 => m3}/import-metadata-policy.md (100%)
 rename quest/{m2 => m3}/interop-shutdown-warnings.md (100%)
 rename quest/{m2 => m3}/intra-refresh/README.md (89%)
 rename quest/{m2 => m3}/intra-refresh/consumer-warmup.md (97%)
 rename quest/{m2 => m3}/intra-refresh/dual-decoder.md (93%)
 rename quest/{m2 => m3}/intra-refresh/export-sync-flags.md (95%)
 rename quest/{m2 => m3}/intra-refresh/h264-import.md (97%)
 rename quest/{m2 => m3}/intra-refresh/h265-import.md (97%)
 rename quest/{m2 => m3}/intra-refresh/plan-boundary.md (95%)
 rename quest/{m2 => m3}/js-announced-coalesce.md (93%)
 rename quest/{m2 => m3}/js-warmup-trim.md (100%)
 rename quest/{m2 => m3}/json-snapshot-resync.md (96%)
 rename quest/{m2 => m3}/lite-tail-drop-count.md (100%)
 rename quest/{m2 => m3}/mbx-r2-release-cache.md (83%)
 rename quest/{m2 => m3}/memory-bench-hang.md (100%)
 rename quest/{m2 => m3}/mesh/README.md (76%)
 rename quest/{m2 => m3}/mesh/addr.md (92%)
 rename quest/{m2 => m3}/mesh/endpoint.md (88%)
 rename quest/{m2 => m3}/mesh/guide.md (92%)
 rename quest/{m2 => m3}/mesh/js-enroll.md (93%)
 rename quest/{m2 => m3}/mesh/node.md (95%)
 rename quest/{m2 => m3}/mesh/overlay.md (85%)
 rename quest/{m2 => m3}/mesh/status.md (90%)
 rename quest/{m2 => m3}/mf-encode-adapter.md (92%)
 rename quest/{m2 => m3}/mkv-flac-channel-mask.md (100%)
 rename quest/{m2 => m3}/mobile-capture-android.md (94%)
 rename quest/{m2 => m3}/mobile-capture-ios.md (96%)
 rename quest/{m2 => m3}/mobile-completion.md (86%)
 rename quest/{m2 => m3}/mp4-repair-lock.md (100%)
 rename quest/{m2 => m3}/mux-source-cut.md (96%)
 rename quest/{m2 => m3}/net-broadcast-requests.md (87%)
 rename quest/{m2 => m3}/nixpkgs-cli.md (85%)
 rename quest/{m2 => m3}/nixpkgs-relay.md (96%)
 rename quest/{m2 => m3}/obs-decode-latest.md (96%)
 rename quest/{m2 => m3}/obs-moq-video/README.md (83%)
 rename quest/{m2 => m3}/obs-moq-video/adapter.md (100%)
 rename quest/{m2 => m3}/obs-moq-video/linux-bundle.md (94%)
 rename quest/{m2 => m3}/obs-moq-video/source.md (98%)
 rename quest/{m2 => m3}/obs-moq-video/vpx-obs.md (89%)
 rename quest/{m2 => m3}/obs-multitrack-check.md (100%)
 rename quest/{m2 => m3}/obs-studio/README.md (82%)
 rename quest/{m2 => m3}/obs-studio/maintainers.md (91%)
 rename quest/{m2 => m3}/one-port/README.md (86%)
 rename quest/{m2 => m3}/one-port/rtc-feed.md (98%)
 rename quest/{m2 => m3}/one-port/srt-demux.md (100%)
 rename quest/{m2 => m3}/opus-surround-export.md (96%)
 rename quest/{m2 => m3}/pes-hold-open-gop.md (100%)
 rename quest/{m2 => m3}/plan-watch-worker.md (96%)
 rename quest/{m2 => m3}/publish-cancel-classify.md (100%)
 rename quest/{m2 => m3}/publish-done-codes.md (100%)
 rename quest/{m2 => m3}/publish-support-probe.md (100%)
 rename quest/{m2 => m3}/pulseaudio-capture-period.md (92%)
 rename quest/{m2 => m3}/qos-publisher-timeliness.md (95%)
 rename quest/{m2 => m3}/qos/README.md (88%)
 rename quest/{m2 => m3}/qos/lag-histogram.md (96%)
 rename quest/{m2 => m3}/quic-ack-hook.md (97%)
 rename quest/{m2 => m3}/quic-emsgsize-classify.md (100%)
 rename quest/{m2 => m3}/quic-long-type.md (100%)
 rename quest/{m2 => m3}/quic-realtime/README.md (96%)
 rename quest/{m2 => m3}/quic-realtime/moqsink-feedback.md (91%)
 rename quest/{m2 => m3}/quic-realtime/uring-controller.md (100%)
 rename quest/{m2 => m3}/quic-sansio-driver.md (97%)
 rename quest/{m2 => m3}/rate-websocket.md (97%)
 rename quest/{m2 => m3}/readers-range-live.md (100%)
 rename quest/{m2 => m3}/relay-io-uring-package.md (97%)
 rename quest/{m2 => m3}/relay-undialable-peers.md (96%)
 rename quest/{m2 => m3}/release-rs-oidc.md (92%)
 rename quest/{m2 => m3}/release-tag-publishers.md (87%)
 rename quest/{m2 => m3}/release/README.md (64%)
 rename quest/{m2 => m3}/release/api-review.md (84%)
 rename quest/{m2 => m3}/release/assets-release.md (100%)
 rename quest/{m2 => m3}/release/c-publish.md (72%)
 rename quest/{m2 => m3}/release/c-retire.md (88%)
 rename quest/{m2 => m3}/release/cpp-release.md (96%)
 rename quest/{m2 => m3}/release/cut.md (73%)
 rename quest/{m2 => m3}/release/dart-publish.md (91%)
 rename quest/{m2 => m3}/release/e2ee-retire.md (84%)
 rename quest/{m2 => m3}/release/feature-flags.md (84%)
 rename quest/{m2 => m3}/release/feature-review.md (85%)
 rename quest/{m2 => m3}/release/libmoq-final-release.md (100%)
 rename quest/{m2 => m3}/release/libmoq-retire.md (89%)
 rename quest/{m2 => m3}/release/migrate-audit.md (97%)
 rename quest/{m2 => m3}/release/moq-sh-deploy.md (94%)
 rename quest/{m2 => m3}/release/npm-first-publish.md (94%)
 rename quest/{m2 => m3}/release/qmux-js-retire.md (100%)
 rename quest/{m2 => m3}/release/relay-loader-adoption.md (100%)
 rename quest/{m2 => m3}/release/runner-client-bump.md (96%)
 rename quest/{m2 => m3}/release/smoke-bindings-rename.md (96%)
 rename quest/{m2 => m3}/render-d3d11.md (95%)
 rename quest/{m2 => m3}/rtc-pacing.md (96%)
 rename quest/{m2 => m3}/rust2-exporter.md (92%)
 rename quest/{m2 => m3}/session-outcome-records.md (100%)
 rename quest/{m2 => m3}/spawn-audit.md (100%)
 rename quest/{m2 => m3}/srt-rate-handle.md (90%)
 rename quest/{m2 => m3}/stats/README.md (92%)
 rename quest/{m2 => m3}/stats/feedback-media-test.md (100%)
 rename quest/{m2 => m3}/stats/health-consumers.md (92%)
 rename quest/{m2 => m3}/stats/preflight.md (90%)
 rename quest/{m2 => m3}/stats/rust.md (93%)
 rename quest/{m2 => m3}/stream/README.md (92%)
 rename quest/{m2 => m3}/stream/bench.md (88%)
 rename quest/{m2 => m3}/stream/js.md (74%)
 rename quest/{m2 => m3}/stream/rust.md (96%)
 rename quest/{m2 => m3}/subscriber-fin-fold.md (100%)
 rename quest/{m2 => m3}/tls-link-alpn.md (100%)
 rename quest/{m2 => m3}/token-auth-followups.md (100%)
 rename quest/{m2 => m3}/ts-multi-program-restart.md (100%)
 rename quest/{m2 => m3}/uring-demux.md (86%)
 rename quest/{m2 => m3}/vaapi-vulkan-import.md (87%)
 rename quest/{m2 => m3}/video-quality/README.md (87%)
 rename quest/{m2 => m3}/video-quality/corpus-bucket.md (100%)
 rename quest/{m2 => m3}/video-quality/gpu-runners.md (98%)
 rename quest/{m2 => m3}/video-quality/hardware.md (80%)
 rename quest/{m2 => m3}/video-quality/harness.md (90%)
 rename quest/{m2 => m3}/video-quality/moq-boy.md (96%)
 rename quest/{m2 => m3}/video-quality/on-demand.md (90%)
 rename quest/{m2 => m3}/vulkan-encode.md (96%)
 rename quest/{m2 => m3}/watch-data-sync.md (91%)
 rename quest/{m2 => m3}/watch-symlink-targets.md (100%)
 rename quest/{m2 => m3}/watch-worker.md (91%)
 rename quest/{m2 => m3}/webcodecs-priming.md (94%)
 rename quest/{m2 => m3}/webrtc/README.md (86%)
 rename quest/{m2 => m3}/webrtc/clock.md (100%)
 rename quest/{m2 => m3}/webrtc/dtls-after-ice.md (95%)
 rename quest/{m2 => m3}/webrtc/dtls-timeout.md (93%)
 rename quest/{m2 => m3}/webrtc/sdp-bandwidth.md (100%)
 rename quest/{m2 => m3}/wire-stats/README.md (96%)
 rename quest/{m2 => m3}/wire-stats/qmux.md (100%)
 rename quest/{m2 => m3}/wire-stats/srt.md (91%)
 rename quest/{m2 => m4}/2819-moq-video-carry-pipewire-dma-bufs-safely-into-the-vulkan.md (96%)
 create mode 100644 quest/m4/README.md
 rename quest/{m2 => m4}/aac-sbr-config.md (100%)
 rename quest/{m2 => m4}/aec-tests.md (100%)
 rename quest/{m2 => m4}/announce-interest-memory.md (93%)
 rename quest/{m2 => m4}/apple-sink-thread.md (100%)
 rename quest/{m2 => m4}/archive-store-bench.md (100%)
 rename quest/{m2 => m4}/ashpd-maintained.md (91%)
 rename quest/{m2 => m4}/askama-maintained.md (85%)
 rename quest/{m2 => m4}/audio-bufferbloat-av.md (97%)
 rename quest/{m2 => m4}/audio-visqol.md (88%)
 rename quest/{m2 => m4}/auth-drop-iroh.md (95%)
 rename quest/{m2 => m4}/auth-drop-peer-grant.md (92%)
 rename quest/{m2 => m4}/auth-session-index.md (100%)
 rename quest/{m2 => m4}/bench-base-paired.md (100%)
 rename quest/{m2 => m4}/bench-epoch-pin.md (100%)
 rename quest/{m2 => m4}/bench-hygiene.md (100%)
 rename quest/{m2 => m4}/bench-latency-resolution.md (100%)
 rename quest/{m2 => m4}/bench-sources.md (100%)
 rename quest/{m2 => m4}/bench-transport-sweep.md (89%)
 rename quest/{m2 => m4}/bench-uring-pool.md (100%)
 rename quest/{m2 => m4}/browser-receive-credit.md (94%)
 rename quest/{m2 => m4}/cache-fairness.md (88%)
 rename quest/{m2 => m4}/capture-wgc.md (86%)
 rename quest/{m2 => m4}/chromium-opus-timestamps.md (99%)
 rename quest/{m2 => m4}/cli-catalog-updates.md (100%)
 rename quest/{m2 => m4}/crossbeam-pin-fence.md (100%)
 rename quest/{m2 => m4}/env-knobs.md (100%)
 rename quest/{m2 => m4}/fill-wait-cancel-test.md (100%)
 rename quest/{m2 => m4}/fmp4-byte-chunk-perf.md (100%)
 rename quest/{m2 => m4}/format-gate-followups.md (100%)
 rename quest/{m2 => m4}/formatter-defaults.md (96%)
 rename quest/{m2 => m4}/gpu-encoder-death-test.md (100%)
 rename quest/{m2 => m4}/hls-follow-once.md (100%)
 rename quest/{m2 => m4}/hls-player-test.md (100%)
 rename quest/{m2 => m4}/interop-bindings.md (96%)
 rename quest/{m2 => m4}/js-fastest-reader.md (91%)
 rename quest/{m2 => m4}/kio-tasks-waker-test.md (100%)
 rename quest/{m2 => m4}/kt-gradle-9.md (100%)
 rename quest/{m2 => m4}/kt-version-catalog.md (100%)
 rename quest/{m2 => m4}/lint-examples.md (100%)
 rename quest/{m2 => m4}/macos-browser-lane.md (90%)
 rename quest/{m2 => m4}/moqsrc-av-sync.md (100%)
 rename quest/{m2 => m4}/moqsrc-reconnect-order.md (100%)
 rename quest/{m2 => m4}/mutants.md (100%)
 rename quest/{m2 => m4}/mux-vr-ambisonic-fmp4.md (100%)
 rename quest/{m2 => m4}/net-test-subscriber.md (100%)
 rename quest/{m2 => m4}/nix-relay-peers-test.md (95%)
 rename quest/{m2 => m4}/p2p/README.md (90%)
 rename quest/{m2 => m4}/p2p/cli.md (88%)
 rename quest/{m2 => m4}/p2p/cost-scopes.md (90%)
 rename quest/{m2 => m4}/p2p/harness.md (90%)
 rename quest/{m2 => m4}/p2p/native-quic.md (94%)
 rename quest/{m2 => m4}/p2p/signal.md (95%)
 rename quest/{m2 => m4}/p2p/watch.md (79%)
 rename quest/{m2 => m4}/pcm-bulk-encode.md (100%)
 rename quest/{m2 => m4}/peer-grant-bound.md (94%)
 rename quest/{m2 => m4}/perf/README.md (83%)
 rename quest/{m2 => m4}/perf/cluster-route-memory.md (88%)
 rename quest/{m2 => m4}/perf/cursor-version-skip.md (100%)
 rename quest/{m2 => m4}/perf/hot-path-waste.md (97%)
 rename quest/{m2 => m4}/perf/ingest-batch.md (100%)
 rename quest/{m2 => m4}/perf/kio-channel-contention/README.md (98%)
 rename quest/{m2 => m4}/perf/kio-channel-contention/log-adoption.md (93%)
 rename quest/{m2 => m4}/perf/kio-channel-contention/relay-per-thread.md (87%)
 rename quest/{m2 => m4}/perf/kio-waiter-costs.md (97%)
 rename quest/{m2 => m4}/perf/mesh-session-cost.md (100%)
 rename quest/{m2 => m4}/perf/profile-lock-switches.md (93%)
 rename quest/{m2 => m4}/perf/quic-lock-contention.md (94%)
 rename quest/{m2 => m4}/perf/relay-allocs.md (100%)
 rename quest/{m2 => m4}/perf/route-lock.md (90%)
 rename quest/{m2 => m4}/perf/shard-default.md (96%)
 rename quest/{m2 => m4}/perf/stream/README.md (95%)
 rename quest/{m2 => m4}/perf/stream/ablation.md (90%)
 rename quest/{m2 => m4}/perf/stream/codec.md (97%)
 rename quest/{m2 => m4}/perf/stream/relay.md (94%)
 rename quest/{m2 => m4}/perf/stream/ring.md (96%)
 rename quest/{m2 => m4}/perf/ts-idle-jitter.md (100%)
 rename quest/{m2 => m4}/publish-firefox.md (90%)
 rename quest/{m2 => m4}/py-test-timeouts.md (100%)
 rename quest/{m2 => m4}/qmux-02-subprotocols.md (96%)
 rename quest/{m2 => m4}/quic-dev-dep-path.md (100%)
 rename quest/{m2 => m4}/quic-sim-mtu.md (96%)
 rename quest/{m2 => m4}/quic-sim.md (96%)
 rename quest/{m2 => m4}/regrant-route-recheck.md (93%)
 rename quest/{m2 => m4}/relay-capped-credit-test.md (100%)
 rename quest/{m2 => m4}/resume-redesign.md (96%)
 rename quest/{m2 => m4}/route-wakes.md (97%)
 rename quest/{m2 => m4}/scuffle-sps-bump.md (100%)
 rename quest/{m2 => m4}/shaper-socket.md (100%)
 rename quest/{m2 => m4}/shared-serve-js.md (86%)
 rename quest/{m2 => m4}/shared-serve.md (93%)
 rename quest/{m2 => m4}/sim-credit-open.md (100%)
 rename quest/{m2 => m4}/smoke-libressl.md (100%)
 rename quest/{m2 => m4}/sps-fuzz-h264-reader.md (100%)
 rename quest/{m2 => m4}/tenant-leak-checks.md (100%)
 rename quest/{m2 => m4}/test-inventory-followups.md (100%)
 rename quest/{m2 => m4}/track-info-docs.md (100%)
 rename quest/{m2 => m4}/track-test-eviction-asserts.md (100%)
 rename quest/{m2 => m4}/upstream-reports.md (95%)
 rename quest/{m2 => m4}/uring-bench-followups.md (98%)
 rename quest/{m2 => m4}/uring-lifecycle-tests.md (100%)
 rename quest/{m2 => m4}/usage-settings-once.md (95%)
 rename quest/{m2 => m4}/usage-unknown-env.md (100%)
 rename quest/{m2 => m4}/vaapi-render-tests.md (83%)
 rename quest/{m2 => m4}/watch-decode-gate.md (94%)
 rename quest/{m2 => m4}/watch-test-waits.md (100%)
 rename quest/{m2 => m4}/wire-fuzz-coverage.md (100%)
 rename quest/{m2 => m4}/workflow-audit-followups.md (96%)
 rename quest/{m3 => m5}/2147-moq-video-10-bit-hevc-and-av1-support-in-the-nvidia-codec.md (81%)
 rename quest/{m3 => m5}/2279-hang-typed-scte-35-ad-cue-signaling-carried-opaquely.md (92%)
 rename quest/{m2 => m5}/2848-follow-the-bandwidth-grant-in-moq-audio-instead-of.md (100%)
 rename quest/{m2 => m5}/3199-moq-uring-remove-sq-indirection-and-per-enter-ring-fd.md (100%)
 rename quest/{m2 => m5}/3200-moq-uring-batch-completion-wakeups-with-min-timeout.md (100%)
 rename quest/{m3 => m5}/3201-moq-uring-use-sendmsg-zc-for-large-udp-gso-trains.md (95%)
 rename quest/{m3 => m5}/3202-moq-uring-use-fixed-file-slots-for-worker-udp-sockets.md (100%)
 rename quest/{m3 => m5}/3204-moq-uring-register-tx-pool-buffers-for-zero-copy-sends.md (93%)
 create mode 100644 quest/m5/README.md
 rename quest/{m3 => m5}/ac3-low-rate.md (100%)
 rename quest/{m3 => m5}/ada-gpu.md (100%)
 rename quest/{m2 => m5}/announce-credit.md (95%)
 rename quest/{m2 => m5}/announce-fanout-allocs.md (100%)
 rename quest/{m2 => m5}/archive-lookup-withdrawal.md (96%)
 rename quest/{m3 => m5}/archive-paced-replay.md (100%)
 rename quest/{m2 => m5}/archive-time-followups.md (95%)
 rename quest/{m2 => m5}/audio-decode-mediacodec.md (95%)
 rename quest/{m2 => m5}/audio-decode-mediafoundation.md (94%)
 rename quest/{m2 => m5}/audio-encode-audiotoolbox.md (91%)
 rename quest/{m2 => m5}/audio-encode-mediacodec.md (90%)
 rename quest/{m2 => m5}/audio-encode-mediafoundation.md (87%)
 rename quest/{m3 => m5}/audio-filters.md (100%)
 rename quest/{m2 => m5}/audio-opus-backend.md (100%)
 rename quest/{m3 => m5}/audio-web.md (92%)
 rename quest/{m2 => m5}/auth-http-request-kind.md (94%)
 rename quest/{m2 => m5}/auth-sign-caps.md (100%)
 rename quest/{m3 => m5}/auth-token-fetch.md (94%)
 rename quest/{m3 => m5}/bun-lint-release.md (100%)
 rename quest/{m2 => m5}/c-origin-relay.md (87%)
 rename quest/{m3 => m5}/captions-cea.md (100%)
 rename quest/{m2 => m5}/carla-bridge.md (95%)
 rename quest/{m2 => m5}/catalog-republish-cost.md (93%)
 rename quest/{m3 => m5}/cpp-conan.md (81%)
 rename quest/{m3 => m5}/cpp-vcpkg.md (91%)
 rename quest/{m3 => m5}/cut-through/README.md (94%)
 rename quest/{m3 => m5}/cut-through/bench.md (95%)
 rename quest/{m3 => m5}/cut-through/loss-delay.md (91%)
 rename quest/{m2 => m5}/delivery-delay.md (92%)
 rename quest/{m3 => m5}/drm-playback.md (93%)
 rename quest/{m2 => m5}/e2ee/README.md (95%)
 rename quest/{m2 => m5}/e2ee/browser.md (93%)
 rename quest/{m2 => m5}/e2ee/cli.md (92%)
 rename quest/{m2 => m5}/e2ee/consumer.md (88%)
 rename quest/{m2 => m5}/e2ee/interop.md (91%)
 rename quest/{m2 => m5}/e2ee/js-undeclared-names.md (90%)
 rename quest/{m2 => m5}/e2ee/rust-publish.md (88%)
 rename quest/{m3 => m5}/emsg.md (96%)
 rename quest/{m3 => m5}/ffi-e2ee.md (83%)
 rename quest/{m2 => m5}/ffi-size-profile.md (100%)
 rename quest/{m3 => m5}/ffi-stream.md (85%)
 rename quest/{m3 => m5}/flv-script.md (92%)
 rename quest/{m3 => m5}/hidden-exemption.md (88%)
 rename quest/{m3 => m5}/id3.md (93%)
 rename quest/{m3 => m5}/ietf-cluster-peers.md (94%)
 rename quest/{m2 => m5}/ietf-hole-marker.md (100%)
 rename quest/{m3 => m5}/interop-runner-approval.md (100%)
 rename quest/{m2 => m5}/json-value-diff.md (96%)
 rename quest/{m3 => m5}/ladder/README.md (95%)
 rename quest/{m3 => m5}/ladder/controller.md (96%)
 rename quest/{m3 => m5}/ladder/fetch.md (92%)
 rename quest/{m2 => m5}/latency-ledger.md (93%)
 rename quest/{m2 => m5}/link-quality.md (89%)
 rename quest/{m3 => m5}/lite05-subscribe-end.md (100%)
 rename quest/{m3 => m5}/lite07-mesh.md (87%)
 rename quest/{m3 => m5}/mesh-ice.md (62%)
 rename quest/{m3 => m5}/mesh-keys.md (87%)
 rename quest/{m3 => m5}/mkv-input-coalesce.md (100%)
 rename quest/{m3 => m5}/msf-publish-tracks.md (93%)
 rename quest/{m3 => m5}/msfts-convergence.md (100%)
 rename quest/{m2 => m5}/native-compression-adopt.md (95%)
 rename quest/{m2 => m5}/native-compression-flush.md (95%)
 rename quest/{m2 => m5}/native-compression-sync.md (94%)
 rename quest/{m2 => m5}/net-wrap/README.md (87%)
 rename quest/{m2 => m5}/net-wrap/cli.md (77%)
 rename quest/{m2 => m5}/net-wrap/e2ee.md (94%)
 rename quest/{m2 => m5}/net-wrap/js.md (84%)
 rename quest/{m2 => m5}/net-wrap/json.md (88%)
 rename quest/{m2 => m5}/net-wrap/mux.md (90%)
 rename quest/{m2 => m5}/net-wrap/traits.md (95%)
 rename quest/{m3 => m5}/nvenc-av1.md (81%)
 rename quest/{m3 => m5}/nvenc-cuda-arrays.md (95%)
 rename quest/{m2 => m5}/nvenc-pool.md (100%)
 rename quest/{m2 => m5}/obs-decode-linux.md (92%)
 rename quest/{m2 => m5}/obs-decode-windows.md (95%)
 rename quest/{m3 => m5}/obs-linux-gpu.md (87%)
 rename quest/{m2 => m5}/obs-macos.md (95%)
 rename quest/{m2 => m5}/obs-windows.md (96%)
 rename quest/{m2 => m5}/origin-front-parks.md (100%)
 rename quest/{m2 => m5}/performance-survey/README.md (89%)
 rename quest/{m2 => m5}/performance-survey/announced-snapshots.md (96%)
 rename quest/{m2 => m5}/performance-survey/browser-media-copies.md (96%)
 rename quest/{m2 => m5}/performance-survey/cache-metadata.md (89%)
 rename quest/{m2 => m5}/performance-survey/gst-buffers.md (95%)
 rename quest/{m2 => m5}/performance-survey/hls-serving.md (96%)
 rename quest/{m2 => m5}/performance-survey/send-groups.md (95%)
 rename quest/{m2 => m5}/performance-survey/session-selection.md (95%)
 rename quest/{m2 => m5}/performance-survey/task-capacity.md (97%)
 rename quest/{m3 => m5}/pipewire-camera-planes.md (95%)
 rename quest/{m2 => m5}/qos-lag-dashboard.md (93%)
 rename quest/{m2 => m5}/quic-bbr-study.md (100%)
 rename quest/{m3 => m5}/quic-careful-resume.md (100%)
 rename quest/{m2 => m5}/quic-deadline.md (96%)
 rename quest/{m2 => m5}/quic-ecn-measure.md (95%)
 rename quest/{m3 => m5}/quic-ecn.md (93%)
 rename quest/{m2 => m5}/quic-egress-profile.md (96%)
 rename quest/{m2 => m5}/quic-io-boundary.md (91%)
 rename quest/{m2 => m5}/quic-lb-forward-extras.md (100%)
 rename quest/{m2 => m5}/rate-grant.md (100%)
 rename quest/{m2 => m5}/receive-pool.md (94%)
 rename quest/{m2 => m5}/recover-budget.md (95%)
 rename quest/{m3 => m5}/relay-acme.md (94%)
 rename quest/{m3 => m5}/request-token-surfaces.md (100%)
 rename quest/{m3 => m5}/rind-instant-acme.md (88%)
 rename quest/{m2 => m5}/room-bench.md (94%)
 rename quest/{m2 => m5}/route-health/README.md (93%)
 rename quest/{m2 => m5}/route-health/idle-timeout.md (100%)
 rename quest/{m2 => m5}/route-health/meta.md (98%)
 rename quest/{m2 => m5}/route-health/recovery.md (97%)
 rename quest/{m2 => m5}/route-health/selection.md (97%)
 rename quest/{m2 => m5}/route-interest-prefixes.md (91%)
 rename quest/{m3 => m5}/routing-cost-domains.md (95%)
 rename quest/{m2 => m5}/rs2ts-browser-report.md (84%)
 rename quest/{m2 => m5}/rs2ts-js.md (96%)
 rename quest/{m3 => m5}/rs2ts-model-ready.md (100%)
 rename quest/{m3 => m5}/rs2ts-model-subset.md (91%)
 rename quest/{m2 => m5}/rs2ts-wasm2js.md (98%)
 rename quest/{m3 => m5}/safari-webtransport.md (92%)
 rename quest/{m2 => m5}/socket-old-hop-signal.md (96%)
 rename quest/{m3 => m5}/stats-encoder-feedback.md (89%)
 rename quest/{m3 => m5}/teleop-arbitration.md (93%)
 rename quest/{m3 => m5}/teleop-mavlink.md (94%)
 rename quest/{m3 => m5}/teleop-proof.md (88%)
 rename quest/{m3 => m5}/teleop-robot.md (95%)
 rename quest/{m3 => m5}/transcode-parallel-open.md (100%)
 rename quest/{m3 => m5}/unreal.md (91%)
 rename quest/{m3 => m5}/uring-cluster-dial.md (87%)
 rename quest/{m2 => m5}/uring-transport-machines.md (85%)
 rename quest/{m3 => m5}/video-codec-coverage.md (87%)
 rename quest/{m3 => m5}/video-embedded.md (95%)
 rename quest/{m3 => m5}/video-hardware-access.md (84%)
 rename quest/{m3 => m5}/video-hardware.md (88%)
 rename quest/{m3 => m5}/video-web.md (100%)
 rename quest/{m3 => m5}/watch-webxr.md (100%)
 rename quest/{m2 => m5}/webgpu-hdr.md (100%)
 rename quest/{m3 => m5}/webkit-319818.md (100%)
 rename quest/{m3 => m5}/zero-copy-peer.md (100%)

diff --git a/bench/README.md b/bench/README.md
index 122cf36296c..8d01957feaa 100644
--- a/bench/README.md
+++ b/bench/README.md
@@ -203,7 +203,7 @@ also run during timing. Every timed round reads and checks all payload bytes,
 returns lease credit, and fills each stream again. Throughput counts delivered
 payload once. Nightly's supplemental Rust benchmark leg records the series and
 keeps the memory output with its raw results. The broader MoQ session transport
-and version sweep remains in [its quest](/quest/m2/bench-transport-sweep.md).
+and version sweep remains in [its quest](/quest/m4/bench-transport-sweep.md).
 
 Compare one multi-threaded Tokio runtime with the same number of independent
 Tokio/epoll and io\_uring workers:
diff --git a/doc/concept/socket.md b/doc/concept/socket.md
index 47533add9ad..f9f609c8692 100644
--- a/doc/concept/socket.md
+++ b/doc/concept/socket.md
@@ -137,7 +137,7 @@ every hop, so a slow reader slows the writer, as TCP backpressure does, and
 nothing is lost. A writer that doesn't wait sheds the front of its half, and a
 reader that falls behind it fails with an eviction error instead of skipping
 data. Pacing reaches across native QUIC and qmux hops; see
-[unbounded groups](https://github.com/moq-dev/moq/tree/main/quest/m1/unbounded-groups)
+[unbounded groups](https://github.com/moq-dev/moq/tree/main/quest/m2/unbounded-groups)
 for what remains, such as browsers, which read without pacing.
 
 Use `tcp` for a byte stream or a log of records that must all arrive in order,
diff --git a/infra/README.md b/infra/README.md
index 0451046f908..b5c9e6ea4eb 100644
--- a/infra/README.md
+++ b/infra/README.md
@@ -42,7 +42,7 @@ which can update an existing worker but not create one or change its route.
 So the first deploy, and any change to the custom domain, runs by hand under a
 maintainer's `wrangler login`. Whether Editor alone passes wrangler's
 custom-domain check on every deploy is unproven until the first `release`
-run; [the deploy quest](../quest/m2/release/moq-sh-deploy.md) tracks it.
+run; [the deploy quest](../quest/m3/release/moq-sh-deploy.md) tracks it.
 
 ## Write credentials
 
diff --git a/quest/README.md b/quest/README.md
index e5e084f463b..93025fa18e8 100644
--- a/quest/README.md
+++ b/quest/README.md
@@ -7,23 +7,42 @@ grouped into milestones ordered by priority.
 
 ## Plan
 
-m0 holds urgent fixes and release-line maintenance. m1 is everything that
-lands before the next cut of `main` into `release`, breaking or not:
-clustering stability first, the in-tree QUIC stack, and planned public API and
-format breaks with their correctness and validation.
-m2 holds independently shippable capabilities and optimizations, plus the
-publication and adoption steps that follow m1. m3 holds external conditions
-and speculative work. A milestone is a priority horizon; m0 maintenance does
-not make unrelated infrastructure a gate for the main-to-release cut.
-
-Milestones shift up after each major release (decided 2026-10-19): m0 is the
-current release line, m1 the next major, m2 the one after, and m3 stays the
-deferred bucket. The [release cut](/quest/m2/release/cut.md) recurs and
-performs the shift. The hygiene audits at the end of each milestone recur
-once per major release: each run adds its successor to the end of the next
-milestone.
-
-The [release execution](/quest/m2/release/README.md) starts after m1 is ready.
+m0 holds urgent work of any type: release-line maintenance, broken CI and
+Nightly, and any fix that cannot wait for its milestone, breaking or not.
+m1 holds this cycle's additive work: improvements and fixes that need no
+semver-breaking release, so each ships with the next cut or as a `release`
+patch when backported. m2 is the next breaking release: every change that
+would need one if it landed right after the cut, plus the
+[cut gate](/quest/m2/cut-gate/README.md). The cut waits on m2 alone. m3 and m4
+are later work split by priority: m3 holds what a named consumer waits on,
+release execution, and bug fixes in shipped code; m4 holds tests, tooling,
+benchmarks, optimizations, and features nobody waits on yet. m5 holds work
+gated on the outside world, or speculative work with no named consumer.
+
+A change is breaking when a published consumer or a deployed peer must adapt
+to it: the public Rust, JS, or bindings API, a frozen wire version, the hang
+catalog JSON, a stored or exported container format, or CLI flags, config
+keys, and environment variables. The test is whether it would need a breaking
+release if it landed right after the cut, so a change to lite-07-wip or to a
+`main`-only API the cut would publish counts. A non-urgent fix that breaks
+joins m2; when a non-breaking fix exists, the fix joins m1 and the break m2.
+An epic joins the milestone its outcome needs, children included.
+
+Decided 2026-11-05 (maintainer, milestone re-cut): milestones split by kind of
+change for the current cycle and by priority after it. This replaces m1 as
+"everything before the cut, breaking or not" (2026-10-20). Grouping by kind
+could bury urgent breaking work behind additive work, so urgency still wins:
+urgent work of either kind joins m0.
+
+Milestones shift after each cut (decided 2026-10-19, rule replaced
+2026-11-05). The [release cut](/quest/m3/release/cut.md) recurs and performs
+the shift: remaining release-execution quests move to m0, m3's quests split
+by kind into m1 and m2, m4's move to m3, m4 starts empty, and m5 stays the
+deferred bucket. The cut PR also re-creates the cut gate in m2. The hygiene
+audits recur once per major release in m3, behind the cut, so the shift
+brings each into m1.
+
+The [release execution](/quest/m3/release/README.md) starts once m2 is done.
 It publishes artifacts before downstream adoption and rollout can complete.
 Critical fixes continue to reach the existing release through backports.
 
@@ -35,7 +54,9 @@ planning PR's review is the check.
 
 ## Required
 
-- [m0: immediate priorities](/quest/m0/README.md) - urgent correctness fixes and maintenance of the current release
-- [m1: next wave](/quest/m1/README.md) - everything before the next release cut, breaking or not, with its required correctness and validation
-- [m2: later work](/quest/m2/README.md) - byte streams and mesh libraries first, then release execution, deferred features, optimization, and design studies
-- [m3: deferred](/quest/m3/README.md) - gated on the outside world (hardware, a partner, a consumer, a provider's offer, or an upstream release), or speculative with no named consumer
+- [m0: immediate priorities](/quest/m0/README.md) - urgent work of any kind, and maintenance of the current release
+- [m1: additive work](/quest/m1/README.md) - this cycle's improvements and fixes that need no breaking release; each ships with the next cut or as a backported patch
+- [m2: the next breaking release](/quest/m2/README.md) - every change that would need a breaking release if it landed after the cut, plus the cut gate; the cut waits on m2 alone
+- [m3: later work, higher priority](/quest/m3/README.md) - byte streams and mesh libraries first, release execution, what a named consumer needs, and bug fixes in shipped code
+- [m4: later work, lower priority](/quest/m4/README.md) - tests, tooling, benchmarks, optimizations, and features nobody waits on yet
+- [m5: deferred](/quest/m5/README.md) - gated on the outside world (hardware, a partner, a consumer, a provider's offer, or an upstream release), or speculative with no named consumer
diff --git a/quest/m0/ci/mbx-r2-verify.md b/quest/m0/ci/mbx-r2-verify.md
index 9ad7fc95641..457d80806ca 100644
--- a/quest/m0/ci/mbx-r2-verify.md
+++ b/quest/m0/ci/mbx-r2-verify.md
@@ -25,7 +25,7 @@ nightly.yml --branch main --event schedule`), never a dispatch on a branch.
 ## Plan
 
 Decided 2026-11-05 (maintainer, /quest-audit): ✅ the release pull request
-check moved to [m2](/quest/m2/mbx-r2-release-cache.md) behind the cut, since
+check moved to [m3](/quest/m3/mbx-r2-release-cache.md) (m2 before the milestone re-cut) behind the cut, since
 `release` gets the platform Rust cache only when the cut merges `main` into
 it; the Nightly checks stay here. Not chosen: moving this whole quest; merging
 `main` into `release` now, which reverses the 2026-11-04 decision.
diff --git a/quest/m0/ffi-shutdown-backport.md b/quest/m0/ffi-shutdown-backport.md
index 7acdbbeddb6..062d391faf1 100644
--- a/quest/m0/ffi-shutdown-backport.md
+++ b/quest/m0/ffi-shutdown-backport.md
@@ -29,7 +29,7 @@ patch cut on `release`, which the maintainer cuts.
 Dart: pub.dev publishes `moq` only from a `moq-dart-v*` tag, and only
 `moq-dart-v0.1.0` exists. Pushing `moq-dart-v0.1.1` at `release`'s head
 publishes 0.1.1 and exercises the unproven path in
-[A Dart tag publishes unattended](/quest/m2/release/dart-publish.md). Decided
+[A Dart tag publishes unattended](/quest/m3/release/dart-publish.md). Decided
 2026-10-30 (maintainer): push it during the combined cut, not before.
 
 Decided 2026-11-04 (maintainer, /quest-unblock): ✅ cut the combined patch
@@ -43,4 +43,4 @@ Public API: none. Wire: none.
 
 ## Related
 
-- [A Dart tag publishes unattended](/quest/m2/release/dart-publish.md) - proves the `moq-dart-v*` tag path this publish uses
+- [A Dart tag publishes unattended](/quest/m3/release/dart-publish.md) - proves the `moq-dart-v*` tag path this publish uses
diff --git a/quest/m1/README.md b/quest/m1/README.md
index 3fc57731bfc..e8bbbfac793 100644
--- a/quest/m1/README.md
+++ b/quest/m1/README.md
@@ -1,170 +1,47 @@
-# m1: clustering stability and the next release
+# m1: additive work for this cycle
 
 ## Goal
 
-Everything that lands before `main` is next cut into `release`: stable
-clustered routing and recovery, the switch to moq-quic, the planned public
-API and format changes, and the non-breaking fixes and checks queued ahead of
-the cut. Complete this milestone before cutting main into release.
+Improvements, fixes, and checks that need no semver-breaking release: each
+lands on `main` and ships with the next cut, or as a `release` patch when it
+is backported. Breaking work for the same cut lives in m2.
 
 ## Plan
 
-Decided with the maintainer on 2026-10-15: clustering stability and the
-in-tree QUIC stack first. Decided 2026-10-20 (maintainer): m1 is everything
-before the cut, not only breaking work, so ready non-breaking quests stay
-here instead of moving out; the cut is what ships them.
-
-- Preserve epoch correctness, routing recovery, outbound federation, and
-  claim continuity on lite-07. Catalogs, long-lived readers,
-  and late joiners obey the same identity contract.
-- Keep IETF passthrough, the API audit, the broad clock conversion,
-  archive replay/DVR correctness, and the TS fidelity
-  expansion in m1. Keep their correctness, interoperability, memory, and
-  performance evidence with them.
-- Defer P2P, watch-worker planning and implementation, AMD Vulkan encode and
-  Intel VA-API/Vulkan import, and QoS lag and prefix stats to m2 with their
-  prerequisites. Their possible API breaks do not make them prerequisites of
-  this cut. Existing playback and A/V clock validation remain here.
-  Same-epoch importers were dropped (maintainer, 2026-10-19): a redundant
-  ingest pair runs on distinct epochs.
-- Finalized lite-07 is preferred by first-party Rust and JS clients, with
-  older-version negotiation fallback. Servers accept it by default. Never
-  reuse a published identifier for an incompatible wire change; deferred
-  features use the appropriate subsequent wip/version if they need one.
-- The next cut makes no new AMD/Intel GPU-input support promise. The later
-  multi-vendor release needs both hardware proofs before publication.
-- Package publication, downstream adoption, and production rollout follow
-  the cut under [release execution](/quest/m2/release/README.md).
-
-Existing upgrade and identity guides carry migrations; feature docs change
-inline. Keep generic proofs here and deployments and their operational
-acceptance with the downstream operator.
-
-Keep one owner per shared code area and order prerequisites before consumers
-(re-ranked in the 2026-10-20 audit: auth before cluster routing, and every
-lite-07 prerequisite before those quests).
-Decided 2026-10-25 (maintainer): the hand-written `moq-c` ships at this cut
-with parity to moq-ffi for every m1 binding feature, so each binding quest
-lands its C half there; the generated C line moves after the cut.
-The moq-transport passthrough fields remain crate-private: no public moq-net
-item exists only for moq-transport (maintainer, 2026-10-23).
-
-Added 2026-10-16: refresh, a breaking `Demand` change, so it lands before
-the cut.
-
-Added 2026-10-22 (maintainer, from an external API audit): small breaks
-that would otherwise force another breaking release (the FFI encoder config,
-FromStr, dead items, `SessionClosed`, unprefixed C++), the hang draft's
-warmup rule for the shipping dual decoder, the binding migration guide fixes,
-and the API-diff tooling. Public routes now wait on cluster routing.
-
-Added 2026-10-20 (maintainer): the probe target, native probing, and the
-native rung disable moved up from the [m2 probe epic](/quest/m2/probe/README.md),
-so Rust, FFI, and OBS publishers recover a stopped rendition in this release;
-padding and the browser's rung disable stay in m2, with only padding's
-lite-07 stream type here.
-
-Added 2026-10-22 (maintainer, clustering audit): three interim fixes for
-announce churn on today's hop-list mesh, shipping with the next cut from
-`main` (not backported to `release`), so deployments get relief before the
-route layer ships; and stats groups as
-tracks, so per-group stats stop costing cluster announces.
-
-Added 2026-10-22 (maintainer, security audit of the relay, auth, stats,
-ACME, and WebRTC): a clean close misreported as a revocation, injectable
-metric tiers, an unbudgeted ACME renewal, unbounded mDNS work per WebRTC
-offer, and an undocumented stats linger cut. The audit's `server_name`
-finding was already fixed by moq-dev/moq#6509.
-
-Added 2026-10-23 (maintainer, from a linger audit): broadcasts lose their
-finished state and retention moves to moq-mux, a break in every binding, so
-it lands before the cut.
-
-Added 2026-10-23 (maintainer, from a moq-quic audit): moq-quic and its drivers
-are unreleased, so their API is reshaped before the cut publishes it, and the
-audit's receive-memory, priority, and lease bugs rank ahead of that reshape.
-
-Added 2026-10-23 (maintainer, pre-cut triage): breaks that would otherwise
-force another major (`announce="never"`, the unused OBS outputs, binding
-durations, and the remaining web-transport-trait adapters) land before the
-cut, as do the small hostile-input and container fixes from the 2026-10-22
-security audit, and the stuck-window scan.
-
-Added 2026-10-24 (maintainer, from a moq-hls audit): import and export
-hardening (URL redaction, ranged responses, redirect bases, sequence
-arithmetic, DASH init readiness, dot-only names) and ffprobe segment
-conformance; the audit's segment-finalization redesign is folded into
-Catalog HLS field.
-
-Added 2026-10-24 (maintainer-requested pre-cut audit of main): remote
-crashes and amplification in media and RTMP parsing, lite announce bounds,
-JS track terminal causes, browser element teardown, and smaller Rust/JS
-divergences, under one epic; its redesign proposals went to m2.
-
-Decided 2026-10-26 (maintainer): every MoQ crate takes its crypto from
-[rind](/quest/m1/rind/README.md), a pure-Rust graviola fork, so the cut ships
-no C crypto. This supersedes the same day's move of pure-Rust crypto to m3.
-Dropping the `rsa` crate from moq-auth's production graph stays in m1.
-
-Added 2026-10-25 (maintainer): the studio's
-GPU encode and source import quests are in m1 so
-moq-video's GPU encode and import API changes, mainly encoders taking a GPU
-surface and zero-copy texture import, land before the cut.
-
-Added 2026-10-27 (maintainer, from an external security audit): relay and
-wire boundary fixes, importer streaming, moq-c handle wrap, browser input
-checks, and CI tool pins, under one epic; its credential leaks went to m0.
-
-Added 2026-11-01 (maintainer): datagram tracks, so lite-07 freezes with
-datagrams as their own track kind instead of single-frame groups.
-
-Added 2026-11-01 (maintainer, follow-up planning): byte-stream ladders, so
-the binding API for `lower` breaks before the cut, `moq export` ending
-with its broadcast, and a relay answering a SUBSCRIBE on a fetched copy.
-
-Added 2026-10-27 (maintainer, from an external release-to-main audit): the
-bindings' silent `max_delay` default change and the upgrade notes that
-contradict the code. Its other findings already had owners or contradicted
-settled decisions (archives break in place; OBS video-only output stays
-removed).
-
-Added 2026-11-01 (maintainer, follow-ups from the 2026-11-01 /quest-afk run):
-the shared pacer's overshoot under 2 Mbit/s with the BBR3 retune it needs,
-since BBR3 is the default controller the cut ships; a truncated MKV that
-left its tracks open; and, under release performance, a bisect of the relay's
-per-frame CPU growth since #5926.
-
-Added 2026-11-04 (maintainer): the relay reports the native sessions its
-drain deadline force-closes while still open, apart from those only finishing
-their end report, so an embedder's drain alert pages on real cuts.
-
-Decided 2026-11-05 (maintainer, /quest-audit): blockers rank above the
-quests that require them.
-
-- ✅ Move the blockers up: Drop set and Subscribe ranges rank just above
-  Address groups by timestamp, and the API audit just above Cluster routing.
-- Not chosen: moving the dependents down; leaving the order as it was.
+Decided 2026-11-05 (maintainer, milestone re-cut): m1 is the additive half
+of what was "everything before the cut" (2026-10-20). A quest stays here when
+it would need no breaking release if it landed right after the cut; the rest
+moved to [m2](/quest/m2/README.md), and m1's earlier decision log moved with
+them, since it is the cut's. The cut no longer waits on m1: what lands before
+it ships with it, and the rest ships at a later cut or as a `release` patch.
+
+Placements decided in the re-cut: read-backfill (a JS fix that matches Rust),
+buffered-ascending (lite-07 already carries the order field), webrtc-vendor
+(internal, though it requires the m2 rename), and the crates.io trusted
+publisher and OIDC quests (setup after the cut's first publishes) are
+additive. [video-vaapi](/quest/m1/video-vaapi.md) moved up from later work
+because a downstream iGPU transcode trial needs it now.
+
+Held here by open claims: a quest's branch is its path, so a claimed quest
+cannot move until its PR merges, and an epic moves with its children. These
+breaking epics and quests stay in m1 for now and are listed in m2's
+`Required`, so the cut still waits on them: api-audit, datagram-tracks, drop-set, rind, session-policy, and
+stream-credit. The [re-cut follow-up](/quest/m2/recut-held.md)
+moves what remains of them once their claims merge. release-perf, held for
+the same reason, gates the cut through the
+[cut gate](/quest/m2/cut-gate/README.md).
 
 ## Required
 
 - [Drop set](/quest/m1/drop-set.md) - each cursor judges missing groups against its own budget, so a narrow reader drops promptly and a widening re-offers groups already reported dropped on lite-07
-- [Subscribe ranges](/quest/m1/subscribe-ranges/README.md) - a lite-07 SUBSCRIBE asks for past and live ranges with absolute or relative ends, in either order, and replaces FETCH for multi-group reads (single-group FETCH stays); merged ranges never starve a subscriber; relays fill misses by range, including over moq-transport
-- [Address groups by timestamp](/quest/m1/time-addressing/README.md) - group start timestamps replace sequence numbers in the moq-net API and lite-07 wire, while old subscribers, old publishers, and published JS clients keep working
-- [Pre-cut audit findings](/quest/m1/cut-audit/README.md) - fix the crashes, hostile-input costs, and correctness bugs the 2026-10-24 audit of main found
-- [Vendored code has every upstream fix it needs](/quest/m1/vendor-sync/README.md) - quinn, libv4l-rs, nvidia-video-codec-sdk, rust-media-libs, cros-codecs, and UniFFI generator fixes are ported or planned, once per release cycle
 - [Media fuzz findings](/quest/m1/fuzz-findings/README.md) - the nightly media fuzz targets run clean: mp4-atom, MKV block, TS step, SPS overflow, and catalog encoder bugs they found are fixed
 - [A smaller, safer API than release](/quest/m1/api-audit/README.md) - every surface added since release has a consumer or is gone, overlapping operations are collapsed, names mirror across Rust, JS, and the bindings, and every break says how to migrate
-- [Cluster routing](/quest/m1/cluster-routing/README.md) - prove shared routing contracts, implement per-origin routes, and connect outbound local clusters
 - [Routing guide](/quest/m1/routing-guide.md) - concepts and practical outbound federation setup
-- [moq-c at parity](/quest/m1/c/README.md) - the hand-written `moq-c` ships at the cut with every m1 binding feature moq-ffi gains
-- [A job's exact route continues its claim's readers](/quest/m1/announce-takeover.md) - a job's route inherits its claim's instance, replacing the ANNOUNCE_TAKEOVER predecessor design
 - [A reader on a failed copy continues on the held re-offer](/quest/m1/copy-recover.md) - a live reader keeps a group whose copy fails by continuing on the same track's re-offer at the same frame
 - [Group errors are cached by kind](/quest/m1/group-error-cache.md) - permanent group errors bind every reader, retryable ones are kept only for a bounded time, and a live SUBSCRIBE_DROP or FETCH answered `Old` no longer caches it for good
-- [A group a subscriber gives up on is always reported](/quest/m1/group-drops.md) - the wire names every abandoned group and the drop signal is public, so readers count losses instead of stalling
 - [The overcommitted receive-window cells run again](/quest/m1/receive-windows-evicted.md) - `benchmark_receive_windows` measures its 256-stream and 4 MiB-frame cells again, reporting delivered frames and evictions instead of stalling
 - [Datagram tracks](/quest/m1/datagram-tracks/README.md) - a track is datagrams or streams; datagram tracks have their own request and sequence, no ranges, no cache, and map to object ID 0 on moq-transport
 - [Stream credit by priority](/quest/m1/stream-credit/README.md) - every stream opens through one priority entry point, and a higher-priority group takes over or resets a lower one when credit runs out
-- [Finalize moq-lite-07](/quest/m1/lite07-finalize.md) - when the maintainer cuts it, lite-07 negotiates as `moq-lite-07` and the next release ships it
 - [Sockets](/quest/m1/socket/README.md) - a generic dial/accept `Socket` in moq-net, Rust, JS, and Python, with tracks as streams; moq-boy and CARLA move onto it
 - [Audio jitter target](/quest/m1/audio-jitter-target/README.md) - the playout target is default in both languages; time-stretched browser playback without steady-state underruns and a native trace replay remain
 - [Container reads drop backfill](/quest/m1/read-backfill.md) - the JS container consumer drops groups below its read cursor like Rust
@@ -178,8 +55,11 @@ quests that require them.
 - [Calibrate the paired nightly benchmarks](/quest/m1/bench-ci.md) - `rust-bench` fits its hour and gets A/A runs, and separate builds of unchanged code stop measuring as a slowdown, so every paired regression alert can be trusted
 - [moq-json's table/deltas bench measures the same work every iteration](/quest/m1/bench-json-deltas.md) - the `table/deltas/1%` cases stop flipping between snapshot and delta timings, so their trend history is usable
 - [Publish moq-bench to crates.io](/quest/m1/bench-publish.md) - `cargo install moq-bench` installs one binary, with the host sampler as `moq-bench host`, first as 0.1.0
-- [Unbounded groups](/quest/m1/unbounded-groups/README.md) - groups and frames lose their size caps; a group keeps a 32 MB tail, and readers behind it replay through paced flights or refresh
 - [Session policy lives in moq-net](/quest/m1/session-policy/README.md) - accept and connect deadlines, admission, window widening and reconnect live once in moq-net; moq-tokio and moq-relay's io_uring path call them
-- [Rename moq-rtc to moq-webrtc](/quest/m1/webrtc-rename.md) - one published `moq-webrtc` crate holds the gateway, the ICE driver, and the data-channel transport
 - [Vendor and trim the WebRTC stack](/quest/m1/webrtc-vendor.md) - str0m, dimpl, `is`, and sctp-proto live in moq-webrtc with unused code removed, so moq-rtc can take rind
 - [MoQ on rind](/quest/m1/rind/README.md) - every MoQ crate takes its crypto from rind, a pure-Rust graviola fork, so no build compiles C crypto
+- [VAAPI encode and decode](/quest/m1/video-vaapi.md) - H.265 encode and decode, pre-generated bindings, and pooled resize surfaces, including the moq-dev/vaapi release that carries them
+
+## Related
+
+- [A busy js/net serve yields](https://github.com/moq-dev/moq/pull/5289) - js/net's serve loop leaves the browser its event loop under a fast publisher, if it does not already
diff --git a/quest/m1/api-audit/README.md b/quest/m1/api-audit/README.md
index 5bc24033622..ba3863d96f1 100644
--- a/quest/m1/api-audit/README.md
+++ b/quest/m1/api-audit/README.md
@@ -9,7 +9,7 @@ Names mirror across Rust, JS, and the bindings. Every break says how
 to migrate.
 
 Non-goals: redesigning independently scoped surfaces
-([subscribe ranges](/quest/m1/subscribe-ranges/README.md),
+([subscribe ranges](/quest/m2/subscribe-ranges/README.md),
 [archives](/doc/concept/archives.md),
 [compressed tracks](/doc/concept/compression.md),
 and `Sync`'s per-track clock handles), and inherited debt that a later quest
@@ -32,7 +32,7 @@ Rules every child follows:
 
 - Removal beats addition. A surface with no consumer in the repository,
   moq.pro, or moq.dev goes private or away. A consumer planned in a quest
-  counts only when that quest is in m1.
+  counts only when that quest is in m1 or m2.
 - Inherited debt is fixed here only when it is cheap or sits on a surface
   this release breaks anyway. Otherwise it joins the later quest that
   reshapes it (the ordered track reader joins rust2's
diff --git a/quest/m1/api-audit/route/README.md b/quest/m1/api-audit/route/README.md
index d070f5b8149..8b01bb75f62 100644
--- a/quest/m1/api-audit/route/README.md
+++ b/quest/m1/api-audit/route/README.md
@@ -17,8 +17,8 @@ kinds. Rust, JS, moq-ffi, moq-c and the wrappers
 mirror it.
 
 Non-goals: the route layer's wire messages and federation
-([Routes and announces](/quest/m1/cluster-routing/routes/README.md)), lite-07
-takeover ([announce takeover](/quest/m1/announce-takeover.md)), and any
+([Routes and announces](/quest/m2/cluster-routing/routes/README.md)), lite-07
+takeover ([announce takeover](/quest/m2/announce-takeover.md)), and any
 moq-transport instance ([moq-transport carries no epoch](https://github.com/moq-dev/moq/pull/7239)).
 
 ## Plan
@@ -144,7 +144,7 @@ supersede the epoch-minting, pairing and run-uniqueness answers above:
   predecessor-ID plan.
   The predecessor design then landed on main in
   [moq-dev/moq#6994](https://github.com/moq-dev/moq/pull/6994). On
-  2026-10-31 the maintainer kept identity: [announce takeover](/quest/m1/announce-takeover.md)
+  2026-10-31 the maintainer kept identity: [announce takeover](/quest/m2/announce-takeover.md)
   now also removes that work, so only one continuity rule remains.
 
 Third round, 2026-11-01, answering
@@ -171,5 +171,5 @@ stale, including `doc/concept/identity.md`.
 
 ## Related
 
-- [A job's exact route continues its claim's readers](/quest/m1/announce-takeover.md) - a job's route inherits its claim's instance, so lite-07 readers keep the first subscribe
-- [Routes and announces](/quest/m1/cluster-routing/routes/README.md) - the wire route layer; instances take over its epochless deletion
+- [A job's exact route continues its claim's readers](/quest/m2/announce-takeover.md) - a job's route inherits its claim's instance, so lite-07 readers keep the first subscribe
+- [Routes and announces](/quest/m2/cluster-routing/routes/README.md) - the wire route layer; instances take over its epochless deletion
diff --git a/quest/m1/audio-jitter-target/watch.md b/quest/m1/audio-jitter-target/watch.md
index 729e0e0a2e9..cbf9b8a41bb 100644
--- a/quest/m1/audio-jitter-target/watch.md
+++ b/quest/m1/audio-jitter-target/watch.md
@@ -178,4 +178,4 @@ latency, Bluetooth included, is part of the lip sync.
 
 - [Capped budgets](/quest/m1/audio-jitter-target/capped-budgets.md) - re-measures the AAC browser budgets after the publisher change, no gate on this proof
 - [Native stretch](/quest/m1/audio-jitter-target/native-stretch.md) - the native time-stretch sharing one NetEq algorithm and its test vectors with this one
-- [Watch worker](/quest/m2/watch-worker.md) - moves the worklet this stretch changes
+- [Watch worker](/quest/m3/watch-worker.md) - moves the worklet this stretch changes
diff --git a/quest/m1/bench-publish.md b/quest/m1/bench-publish.md
index 8bd6259e384..3b850e5a941 100644
--- a/quest/m1/bench-publish.md
+++ b/quest/m1/bench-publish.md
@@ -50,9 +50,9 @@ crate, like CONTRIBUTING's bench-only backport. Otherwise skip it, say so in
 the PR, and moq-bench publishes at the cut.
 
 The first publish goes out by token, so add moq-bench to the
-[crates.io trusted publisher](/quest/m2/crates-trusted-publisher.md)
+[crates.io trusted publisher](/quest/m3/crates-trusted-publisher.md)
 `Waiting` list (done in this planning PR).
 
 ## Related
 
-- [crates.io trusts the workflow](/quest/m2/crates-trusted-publisher.md) - moq-bench needs a trusted publisher after its first publish
+- [crates.io trusts the workflow](/quest/m3/crates-trusted-publisher.md) - moq-bench needs a trusted publisher after its first publish
diff --git a/quest/m1/buffered-ascending.md b/quest/m1/buffered-ascending.md
index 70cc5eb9a58..38e3a4211cf 100644
--- a/quest/m1/buffered-ascending.md
+++ b/quest/m1/buffered-ascending.md
@@ -38,7 +38,7 @@ Decided 2026-10-23 by the maintainer:
   max-delay release rules go. Not chosen: delete the hold outright; keep
   #6549's rules unchanged.
 - ✅ The hold stays audio-only. Video's startup hold is the poster quest's.
-- ✅ Placed in m1, requiring [Finalize moq-lite-07](/quest/m1/lite07-finalize.md):
+- ✅ Placed in m1, requiring [Finalize moq-lite-07](/quest/m2/lite07-finalize.md):
   lite-06 and earlier serve an ascending request newest-first, so this is a
   no-op on default sessions until lite-07 negotiates by default. `release`
   has no `order` field, so it ships in the next minor, not a 0.6.x patch.
@@ -77,9 +77,9 @@ keeps waiting on lite-07 for the head-hold simplification.
 
 ## Required
 
-- [Finalize moq-lite-07](/quest/m1/lite07-finalize.md) - an ascending request is served newest-first until lite-07 negotiates by default
+- [Finalize moq-lite-07](/quest/m2/lite07-finalize.md) - an ascending request is served newest-first until lite-07 negotiates by default
 
 ## Related
 
 - [Container reads drop backfill](/quest/m1/read-backfill.md) - the JS consumer stops delivering groups below its cursor
-- [Subscribe ranges](/quest/m1/subscribe-ranges/README.md) - owns the wire's `Group Order` and the ordered cursor's floor
+- [Subscribe ranges](/quest/m2/subscribe-ranges/README.md) - owns the wire's `Group Order` and the ordered cursor's floor
diff --git a/quest/m1/datagram-tracks/README.md b/quest/m1/datagram-tracks/README.md
index e6da124a255..def636b5d50 100644
--- a/quest/m1/datagram-tracks/README.md
+++ b/quest/m1/datagram-tracks/README.md
@@ -22,7 +22,7 @@ Decided 2026-11-01 (maintainer, in `/quest-plan`):
 
 - **Datagrams are a track-level decision.** ✅ A track is datagrams or
   streams, never a mix. This reverses the
-  [subscribe-ranges](/quest/m1/subscribe-ranges/README.md) decision of
+  [subscribe-ranges](/quest/m2/subscribe-ranges/README.md) decision of
   2026-10-20 that any single-frame group may go as a datagram, including a
   copy of a streamed one. With no mixing, the stream/datagram dedup rule, the
   ordering of a datagram among its group's streams, NOT_FETCHABLE, and every
@@ -39,7 +39,7 @@ Decided 2026-11-01 (maintainer, in `/quest-plan`):
   the group sequence space. On moq-transport it maps to a group ID with
   object ID 0.
   - This exempts datagrams from
-    [lite-07 by start](/quest/m1/time-addressing/lite07.md): they keep a
+    [lite-07 by start](/quest/m2/time-addressing/lite07.md): they keep a
     sequence, while stream tracks address groups by start.
   - The timestamp stays, as it does for every frame.
 - **Discovery.** ✅ The application knows which kind a track is, through its
@@ -93,7 +93,7 @@ Decided 2026-11-01 (maintainer, in `/quest-plan`):
   - Reason: a stream handler need not answer a name it doesn't serve, and
     the bindings' rejection carries only an application error.
 - **Version.** ✅ lite-07, before it is finalized.
-  [Finalize moq-lite-07](/quest/m1/lite07-finalize.md) requires this epic.
+  [Finalize moq-lite-07](/quest/m2/lite07-finalize.md) requires this epic.
   lite-01..06 keep today's group datagrams.
 
 Decided by the Rust child ([moq-dev/moq#7752](https://github.com/moq-dev/moq/pull/7752)),
@@ -109,7 +109,7 @@ not the maintainer, so open to revisiting:
   while compression would cost every datagram an Inflated Size and a decoder.
 - **Timestamp on a `Timescale` 0 track.** The datagram carries none, and its
   Sequence stands in for its time. Why: it mirrors the
-  [model](/quest/m1/time-addressing/model.md)'s rule that a scale-less frame's
+  [model](/quest/m2/time-addressing/model.md)'s rule that a scale-less frame's
   timestamp is its group's key, since a datagram's address is its sequence.
   Until that model lands, Rust's datagram writes take `Option<Timestamp>` like
   frame writes do (`None` on an untimed track), and the model quest converts
@@ -125,7 +125,7 @@ datagram track on lite-07, direct and through a relay.
 
 ## Related
 
-- [Subscribe ranges](/quest/m1/subscribe-ranges/README.md) - ranges no longer cover datagrams
-- [Address groups by timestamp](/quest/m1/time-addressing/README.md) - stream tracks address by start; datagram tracks keep a sequence
-- [Wrapper traits over moq-net](/quest/m2/net-wrap/README.md) - the traits mirror the separate datagram types
-- [moq-lite session tails count drops](/quest/m2/lite-tail-drop-count.md) - datagram holes matter only on lite-05/06
+- [Subscribe ranges](/quest/m2/subscribe-ranges/README.md) - ranges no longer cover datagrams
+- [Address groups by timestamp](/quest/m2/time-addressing/README.md) - stream tracks address by start; datagram tracks keep a sequence
+- [Wrapper traits over moq-net](/quest/m5/net-wrap/README.md) - the traits mirror the separate datagram types
+- [moq-lite session tails count drops](/quest/m3/lite-tail-drop-count.md) - datagram holes matter only on lite-05/06
diff --git a/quest/m1/drop-set.md b/quest/m1/drop-set.md
index ce08026076d..c250763b2dc 100644
--- a/quest/m1/drop-set.md
+++ b/quest/m1/drop-set.md
@@ -17,7 +17,7 @@ narrower budget is served after a widening, as a cold relay would.
 Decided 2026-10-27 (maintainer): this runs after the range count cost work,
 which finished in [moq-dev/moq#7542](https://github.com/moq-dev/moq/pull/7542),
 since both edit `given_up` in `rs/moq-net/src/model/track/miss.rs`, and before
-[Rust groups by start](/quest/m1/time-addressing/model.md), which requires it
+[Rust groups by start](/quest/m2/time-addressing/model.md), which requires it
 because runs keyed by group sequence convert mechanically to starts.
 
 Decided by the maintainer on 2026-10-19, splitting this from the widened
@@ -190,7 +190,7 @@ A cursor judges an unknown missing sequence (never a stale run its record
 still holds as reported, which only a widening settles) as it would a
 group never received: locally against its own budget (`TrackState::drifted`),
 and otherwise as a cache miss, which the relay fills upstream by range
-([Subscribe ranges](/quest/m1/subscribe-ranges/README.md)), so no reader
+([Subscribe ranges](/quest/m2/subscribe-ranges/README.md)), so no reader
 waits indefinitely on forgotten state. Extend `track_subscriber_churn` in
 `rs/moq-net/benches/track.rs` with a fragmented set up to pool capacity,
 swept over subscriber count, shared runs, runs per cursor record, and run
@@ -318,4 +318,4 @@ start can carry the budget it was resolved under.
 
 ## Related
 
-- [Subscribe ranges](/quest/m1/subscribe-ranges/README.md) - fills the cache miss an evicted run leaves
+- [Subscribe ranges](/quest/m2/subscribe-ranges/README.md) - fills the cache miss an evicted run leaves
diff --git a/quest/m1/group-error-cache.md b/quest/m1/group-error-cache.md
index 08b7284d10c..691f801a927 100644
--- a/quest/m1/group-error-cache.md
+++ b/quest/m1/group-error-cache.md
@@ -83,4 +83,4 @@ mirror, if a caller outside moq-net needs it; otherwise none. Wire: none.
 
 ## Related
 
-- [A group a subscriber gives up on is always reported](/quest/m1/group-drops.md) - reports what a subscriber gives up; this decides how long the track remembers it
+- [A group a subscriber gives up on is always reported](/quest/m2/group-drops.md) - reports what a subscriber gives up; this decides how long the track remembers it
diff --git a/quest/m1/moq-e2ee-remove.md b/quest/m1/moq-e2ee-remove.md
index 1a8a05ceba0..28dd27a4c90 100644
--- a/quest/m1/moq-e2ee-remove.md
+++ b/quest/m1/moq-e2ee-remove.md
@@ -10,7 +10,7 @@ moq-crypto, is on crates.io.
 ## Plan
 
 Decided 2026-11-05 (maintainer, /quest-audit): ✅ retire the stub before
-[Rust releases publish through OIDC](/quest/m2/release-rs-oidc.md), so the
+[Rust releases publish through OIDC](/quest/m3/release-rs-oidc.md), so the
 crate never needs a trusted publisher.
 
 Published 2026-11-05 (maintainer, /quest-unblock, by an agent at the
diff --git a/quest/m1/read-backfill.md b/quest/m1/read-backfill.md
index 7a090cd1472..cbd22136c40 100644
--- a/quest/m1/read-backfill.md
+++ b/quest/m1/read-backfill.md
@@ -27,7 +27,7 @@ delivers a group that arrives below the cursor as a late backfill; Rust
   after the live edge; a cursor set from the first arrival would lose valid
   startup media (`consumer.outoforder.test.ts` covers that order). The floor
   is instead the lowest group of the subscription's requested ranges
-  ([Subscribe ranges](/quest/m1/subscribe-ranges/README.md)): given for an
+  ([Subscribe ranges](/quest/m2/subscribe-ranges/README.md)): given for an
   absolute start, and for a relative start the start the publisher resolved
   for this request. Every sequence in range arrives or is named by
   SUBSCRIBE_DROP, so the read never waits on a group that won't come.
@@ -55,7 +55,7 @@ delivers a group that arrives below the cursor as a late backfill; Rust
 
 Decided 2026-10-27 (maintainer): this waits only on the resolved start in
 SUBSCRIBE_OK and JS ranges, not the whole
-[Subscribe ranges](/quest/m1/subscribe-ranges/README.md) epic. Both have
+[Subscribe ranges](/quest/m2/subscribe-ranges/README.md) epic. Both have
 landed: the resolved start, and JS ranges in
 [moq-dev/moq#7696](https://github.com/moq-dev/moq/pull/7696). A range that a
 SUBSCRIBE_UPDATE adds gets its start from SUBSCRIBE_STARTED
diff --git a/quest/m1/receive-windows-evicted.md b/quest/m1/receive-windows-evicted.md
index 95702b3a105..366ead9ee98 100644
--- a/quest/m1/receive-windows-evicted.md
+++ b/quest/m1/receive-windows-evicted.md
@@ -8,7 +8,7 @@ overcommitted cells again, and Nightly's `Rust benchmark tests` job
 (`gh nightly rust-test`) still passes. Those cells are 256 streams,
 4 MiB frames, and 4 MiB frames with a following stream window. Until
 then, the benchmark skips them and prints each one with
-`quest/m1/group-drops.md` as the reason.
+`quest/m2/group-drops.md` as the reason.
 
 Every cell keeps the workload it offers. A cell whose incomplete units
 fit the connection window fails on any eviction. A cell that
@@ -20,7 +20,7 @@ alongside throughput and latency, instead of failing.
 Moved to m1 2026-11-04 with the maintainer, after
 [moq-dev/moq#7838](https://github.com/moq-dev/moq/pull/7838) landed the
 fitting cells: what remains waits on
-[group-drops](/quest/m1/group-drops.md), an m1 quest, and with the
+[group-drops](/quest/m2/group-drops.md), an m2 quest, and with the
 overcommitted cells skipped the benchmark no longer fails Nightly, so this
 no longer holds the m0
 [Nightly passes on main](/quest/m0/nightly/README.md) epic open. It replaces
@@ -37,7 +37,7 @@ Overload policy, decided 2026-11-04 (maintainer):
 
 Silent loss, decided 2026-11-04 (maintainer):
 
-- ✅ Fix it at the source in `quest/m1/group-drops.md`, planned in
+- ✅ Fix it at the source in `quest/m2/group-drops.md`, planned in
   [moq-dev/moq#7890](https://github.com/moq-dev/moq/pull/7890). There,
   the wire always names an abandoned group, and `track::Subscriber`'s
   drop signal becomes public.
@@ -84,7 +84,7 @@ What remains:
   `Cell::fits` partition in `benchmark_receive_windows`), and run the full
   sweep through `quest gate`.
 - Retain the stream/frame/window axes and the actual offered workload
-  for [Receive pool](/quest/m2/receive-pool.md).
+  for [Receive pool](/quest/m5/receive-pool.md).
 - Repro: `just rs test -p moq-tokio --test integration --release -E
   'test(benchmark_receive_windows)' --run-ignored only --success-output
   immediate`.
@@ -99,4 +99,4 @@ Public API: none. Wire: none.
 
 ## Required
 
-- [A group a subscriber gives up on is always reported](/quest/m1/group-drops.md) - the public drop signal the reader needs to return a dropped group's permit
+- [A group a subscriber gives up on is always reported](/quest/m2/group-drops.md) - the public drop signal the reader needs to return a dropped group's permit
diff --git a/quest/m1/release-perf/README.md b/quest/m1/release-perf/README.md
index 9268aa4ec94..c5536c5c5e5 100644
--- a/quest/m1/release-perf/README.md
+++ b/quest/m1/release-perf/README.md
@@ -10,7 +10,7 @@ and the reason is written here.
 This epic's own work: once its children have landed, re-pair the relay
 `fanout` workload against `release` and confirm main's relay CPU is no higher
 in every round. The sparse rows are accepted (2026-10-30). The browser frame path
-needs no repeat; the [performance audit](/quest/m2/audit-perf.md) now pairs
+needs no repeat; the [performance audit](/quest/m3/audit-perf.md) now pairs
 every later cut with `release`.
 
 ## Plan
@@ -181,7 +181,7 @@ Accepted, flat per operation:
 - e2ee `protect` is 1.5x release on grouped frames and 1.21x on datagrams. The
   crypto is unchanged; the rest is the per-group model cost accepted above.
   Both branches expand the AES-GCM key on every frame, about a quarter of
-  `protect`, which the [performance audit](/quest/m2/audit-perf.md) owns.
+  `protect`, which the [performance audit](/quest/m3/audit-perf.md) owns.
 - gst `moqsink/eos` is +12% instructions per event, from
   [#5512](https://github.com/moq-dev/moq/pull/5512) and the gstreamer-rs 0.25
   bump in [#6169](https://github.com/moq-dev/moq/pull/6169).
@@ -194,7 +194,7 @@ Accepted, flat per operation:
   frame) and the IETF `/fetch` delivery rows also reappear unchanged.
 - The TS export still grows with track count (1.50x at `1x1` to 2.24x at
   `16x64`). The T-STD schedule scans and sorts every queued unit per PCR slot,
-  which the [performance audit](/quest/m2/audit-perf.md) owns.
+  which the [performance audit](/quest/m3/audit-perf.md) owns.
 
 Noise: `frame_recv/upfront/size=262144/streams=64` is 3 to 4x in wall time at
 0.96x instructions. Its 1.6M page faults (against 192k) are glibc returning
@@ -220,7 +220,7 @@ Decided 2026-10-25 (maintainer), in
   the cut; [moq-dev/moq#6921](https://github.com/moq-dev/moq/pull/6921)
   flattened it.
 - The TS schedule's growth is left to the
-  [performance audit](/quest/m2/audit-perf.md); it does not block the cut.
+  [performance audit](/quest/m3/audit-perf.md); it does not block the cut.
 - Now that the sparse fix has landed, re-run the relay fanout pairing on a
   quiet host, recording `/proc/loadavg`, with
   `BENCH_ARTIFACTS=<scratch> just bench origin/release` (it also re-checks
@@ -356,5 +356,5 @@ live read is accepted, per delivered group through the session (see the
 
 ## Related
 
-- [Performance audit](/quest/m2/audit-perf.md) - compares nightly to nightly; this epic compares main to release
+- [Performance audit](/quest/m3/audit-perf.md) - compares nightly to nightly; this epic compares main to release
 - [Calibrate the paired nightly benchmarks](/quest/m1/bench-ci.md) - noise floor of the paired nightly-to-nightly comparison on one runner
diff --git a/quest/m1/rind/README.md b/quest/m1/rind/README.md
index 10f64ab8fe5..9b5b6b0e7a3 100644
--- a/quest/m1/rind/README.md
+++ b/quest/m1/rind/README.md
@@ -36,8 +36,8 @@ instead, so every crate drops C, not just the relay.
   and aws-lc-rs do, so their aarch64 builds keep running, and every area
   that runs in moq-cli or moq-relay switches only once that rind release
   ships. This keeps
-  [cli-packaging](/quest/m2/cli-packaging.md)'s Pi 4 V4L2 publishing and
-  [embedded video](/quest/m3/video-embedded.md) on those boards.
+  [cli-packaging](/quest/m3/cli-packaging.md)'s Pi 4 V4L2 publishing and
+  [embedded video](/quest/m5/video-embedded.md) on those boards.
 - x86_64 CPUs without AVX2, BMI2, ADX, or AES-NI get the same treatment
   (maintainer, 2026-11-01): rind picks slower paths for them at startup, and
   the same areas wait on that release too.
@@ -48,7 +48,7 @@ instead, so every crate drops C, not just the relay.
   uses, so most areas switch on rind 0.1.2 (published 2026-11-01), which runs on
   CPUs without the crypto extensions (e2ee, which no binary links, switched
   on 0.1.0). Relay ACME, the one area that waited on `rind-instant-acme`, is
-  removed for now instead (maintainer, 2026-11-03), and returns on rind in m3.
+  removed for now instead (maintainer, 2026-11-03), and returns on rind in m5.
   aws-lc-rs stays in the workspace until
   the last area lands, which is when this epic removes it.
 - Split per area, each landing once rind covers it. Docs a change makes stale
diff --git a/quest/m1/rind/rtc.md b/quest/m1/rind/rtc.md
index fc4c19d0670..3e694b8b923 100644
--- a/quest/m1/rind/rtc.md
+++ b/quest/m1/rind/rtc.md
@@ -16,7 +16,7 @@ and reqwest switches to its no-provider feature. The existing browser
 interop tests prove the switch.
 
 Decided 2026-10-30 (maintainer): the stack is vendored into moq-webrtc
-([epic](/quest/m2/webrtc/README.md)) with DTLS 1.2 only, so this quest
+([epic](/quest/m3/webrtc/README.md)) with DTLS 1.2 only, so this quest
 changes the vendored crypto provider directly and offers no DTLS 1.3.
 
 Decided 2026-10-31 (maintainer): the vendored crates are private modules, so
diff --git a/quest/m1/routing-guide.md b/quest/m1/routing-guide.md
index 6fb1d57211d..ecadd8aa997 100644
--- a/quest/m1/routing-guide.md
+++ b/quest/m1/routing-guide.md
@@ -23,10 +23,10 @@ link-cost policy outside the basic setup.
 
 Use generic public examples and validate CLI/config examples against the
 implemented help. Cross-link `doc/bin/relay/cluster.md` and identity guidance
-without duplicating reference material. Route health adds its section in m2.
+without duplicating reference material. Route health adds its section in m5.
 
 Public API/wire: documentation only, reflecting completed implementations.
 
 ## Required
 
-- [Outbound federation](/quest/m1/cluster-routing/federation.md) - tested operator configuration
+- [Outbound federation](/quest/m2/cluster-routing/federation.md) - tested operator configuration
diff --git a/quest/m1/session-policy/README.md b/quest/m1/session-policy/README.md
index 3a8b93ac898..05865ae6f61 100644
--- a/quest/m1/session-policy/README.md
+++ b/quest/m1/session-policy/README.md
@@ -20,7 +20,7 @@ maintainer asked what that means for io_uring and how much of moq-tokio belongs
 in moq-net, and decided:
 
 - ✅ **Move the policy first**, then give moq-tokio thin handoffs; the
-  [WebRTC rename](/quest/m1/webrtc-rename.md) waits on
+  [WebRTC rename](/quest/m2/webrtc-rename.md) waits on
   [moq-tokio becomes a thin shell](/quest/m1/session-policy/tokio-handoff.md)
   (#7804 closed unmerged).
   Not chosen: a moq-tokio handoff now with the move later; moq-webrtc calling
@@ -57,7 +57,7 @@ Research (2026-11-04, `origin/main` at e6be13d5f8):
 - Widening on admit needs a transport hook: moq-net's `transport::poll`
   session exposes only `receive_window()`, while tokio QUIC, qmux and uring's
   `web::Session` all have `set_limits`. Add a trait method whose default
-  reports unsupported, the same move [QUIC deadline](/quest/m2/quic-deadline.md)
+  reports unsupported, the same move [QUIC deadline](/quest/m5/quic-deadline.md)
   plans for per-stream deadlines.
 - moq-net stays poll-first and spawns nothing
   ([libraries spawn nothing](https://github.com/moq-dev/moq/pull/6849)):
diff --git a/quest/m1/session-policy/connect.md b/quest/m1/session-policy/connect.md
index aab876ced54..716a18d992e 100644
--- a/quest/m1/session-policy/connect.md
+++ b/quest/m1/session-policy/connect.md
@@ -24,7 +24,7 @@ reconnect moves too, not just the deadline.
   `connection.rs` tests to the moq-net machines on kio's simulator, so the same
   timings are asserted without tokio.
 - This also gives a future io_uring client
-  ([uring-cluster-dial](/quest/m3/uring-cluster-dial.md)) the policy to reuse
+  ([uring-cluster-dial](/quest/m5/uring-cluster-dial.md)) the policy to reuse
   rather than copy.
 
 Public API: breaking in moq-net's `Client` and new reconnect types; moq-tokio's
diff --git a/quest/m1/session-policy/tokio-handoff.md b/quest/m1/session-policy/tokio-handoff.md
index 493082e47c8..3a9310bb17a 100644
--- a/quest/m1/session-policy/tokio-handoff.md
+++ b/quest/m1/session-policy/tokio-handoff.md
@@ -8,14 +8,14 @@ handoffs for transports established elsewhere: `accept_with(transport, link)`
 on the listener and `connect_with(transport)` on the client, which run the
 moq-net accept or connect policy over an already-connected session and return
 the usual request or session. moq-tokio's own `webrtc` module goes through
-them, so the [WebRTC rename](/quest/m1/webrtc-rename.md) moves it into
+them, so the [WebRTC rename](/quest/m2/webrtc-rename.md) moves it into
 moq-webrtc without reaching into moq-tokio's internals.
 
 ## Plan
 
 Part of [Session policy lives in moq-net](/quest/m1/session-policy/README.md);
 see it for the decisions and research. This is what the
-[WebRTC rename](/quest/m1/webrtc-rename.md) waits on
+[WebRTC rename](/quest/m2/webrtc-rename.md) waits on
 ([moq-dev/moq#7804](https://github.com/moq-dev/moq/pull/7804), which first
 asked, closed unmerged): the maintainer decided on
 2026-11-04 to move the policy first, so the handoff is a few lines over
diff --git a/quest/m1/session-policy/uring.md b/quest/m1/session-policy/uring.md
index 2963e8b48cc..1a67830d0ff 100644
--- a/quest/m1/session-policy/uring.md
+++ b/quest/m1/session-policy/uring.md
@@ -25,7 +25,7 @@ see it for the decisions and research.
   runs on the worker handle, with admission hopping to the shared runtime
   through `Lifecycle::shared`, so one `Connection::run` serves every runtime.
   Use one listen-config mapping at all three sites.
-- Do this before [the io_uring packaging work](/quest/m2/relay-io-uring-package.md)
+- Do this before [the io_uring packaging work](/quest/m3/relay-io-uring-package.md)
   publishes the duplicated path.
 - The relay's existing drain, admission and handshake-deadline tests must
   pass on both runtimes.
@@ -38,4 +38,4 @@ Public API: none. Wire: none.
 
 ## Related
 
-- [io_uring relay package](/quest/m2/relay-io-uring-package.md) - ships the path this unifies
+- [io_uring relay package](/quest/m3/relay-io-uring-package.md) - ships the path this unifies
diff --git a/quest/m1/socket/README.md b/quest/m1/socket/README.md
index b35051f3fdf..7fb41850115 100644
--- a/quest/m1/socket/README.md
+++ b/quest/m1/socket/README.md
@@ -5,16 +5,16 @@
 `moq-net` gains a generic dial/accept primitive. An `Endpoint` announces one
 hidden broadcast, dials other endpoints, and accepts their dials, and each
 connection is a session between the two ends: a reliable, ordered byte pipe
-each way (`tcp`), or a track of messages each way (`track`). moq-boy, CARLA, [byte streams](/quest/m2/stream/README.md), and the
-mesh [Endpoint](/quest/m2/mesh/endpoint.md) all build on it instead of each
+each way (`tcp`), or a track of messages each way (`track`). moq-boy, CARLA, [byte streams](/quest/m3/stream/README.md), and the
+mesh [Endpoint](/quest/m3/mesh/endpoint.md) all build on it instead of each
 hand-rolling the announce, watch, and request loop. Rust, JS, and Python
 (through moq-ffi) expose the same surface and interoperate.
 
 Non-goals: a wire change to moq-lite (a socket is a path and track convention
 over existing announce and subscribe streams); session caps, leases, or idle
 timeouts, which stay application logic (boy's 60 s idle, CARLA's one-driver
-lease and 1 s watchdog); signing and encryption, which the m2
-[mesh](/quest/m2/mesh/README.md) owns by making endpoint ids public keys.
+lease and 1 s watchdog); signing and encryption, which the m3
+[mesh](/quest/m3/mesh/README.md) owns by making endpoint ids public keys.
 
 ## Plan
 
@@ -81,10 +81,10 @@ pipe below; the second round above adds the acceptor to the session name:
   16 MiB past its reader on each hop, and a reader that falls off the tail
   fails with `Evicted` rather than skipping data. Where pacing doesn't reach
   yet, that `Evicted` is the failure mode, never silent loss: browsers and JS
-  read unpaced ([JS fastest-reader pacing](/quest/m2/js-fastest-reader.md)),
+  read unpaced ([JS fastest-reader pacing](/quest/m4/js-fastest-reader.md)),
   and a session past its paused-credit cap (about two paused group streams at
   the client defaults) reads and sheds instead of pausing. That remaining
-  pacing work stays in the [unbounded groups](/quest/m1/unbounded-groups/README.md)
+  pacing work stays in the [unbounded groups](/quest/m2/unbounded-groups/README.md)
   epic, which this depends on for lossless `tcp` in those cases.
 
 Implementation choices in
@@ -180,7 +180,7 @@ replacement arc), still standing:
 Later, not built now: a multiplexed `quic` protocol, `quic/<dialer>/<acceptor>/<S>` on
 the same endpoint with no new announcement, which brings back several groups
 or streams per session; and signed or encrypted sessions with ids as public
-keys, in the m2 [mesh](/quest/m2/mesh/README.md).
+keys, in the m3 [mesh](/quest/m3/mesh/README.md).
 
 This epic owns removing the hand-rolled loops: after the ports, no
 announce-watch-request pairing remains in `rs/moq-boy`, `js/moq-boy`, or
@@ -194,5 +194,5 @@ announce-watch-request pairing remains in `rs/moq-boy`, `js/moq-boy`, or
 
 ## Related
 
-- [Byte streams](/quest/m2/stream/README.md) - TCP over sockets, one session per connection
-- [Endpoint API](/quest/m2/mesh/endpoint.md) - the mesh's `connect`/`accept`, a socket endpoint plus signing
+- [Byte streams](/quest/m3/stream/README.md) - TCP over sockets, one session per connection
+- [Endpoint API](/quest/m3/mesh/endpoint.md) - the mesh's `connect`/`accept`, a socket endpoint plus signing
diff --git a/quest/m1/socket/js.md b/quest/m1/socket/js.md
index 47b5454ddfc..16671a7e8b2 100644
--- a/quest/m1/socket/js.md
+++ b/quest/m1/socket/js.md
@@ -21,7 +21,7 @@ Both carry `peer` and `session`, and no message methods of their own. Session
 tracks are `<protocol>/<dialer>/<acceptor>/<session>` in both endpoints, served only on
 request so no listing names them; an unknown or unaccepted protocol is reset
 as unsupported. JS reads without fastest-reader pacing until
-[JS fastest-reader pacing](/quest/m2/js-fastest-reader.md), so a JS `tcp`
+[JS fastest-reader pacing](/quest/m4/js-fastest-reader.md), so a JS `tcp`
 reader that falls a group tail behind fails with an eviction error; say so in
 the docs. As in Rust, dials and accepts fail as unsupported while the
 endpoint's connection is moq-lite before 07, which never carries its hidden
diff --git a/quest/m1/ts-reliability/README.md b/quest/m1/ts-reliability/README.md
index 3557b6a4e99..49d55df2f2d 100644
--- a/quest/m1/ts-reliability/README.md
+++ b/quest/m1/ts-reliability/README.md
@@ -139,4 +139,4 @@ catalog linger (#5305).
 
 ## Related
 
-- [MSFTS mapping](/quest/m3/msfts-convergence.md) - document the exact equivalence and differences between the carriage modes
+- [MSFTS mapping](/quest/m5/msfts-convergence.md) - document the exact equivalence and differences between the carriage modes
diff --git a/quest/m2/video-vaapi.md b/quest/m1/video-vaapi.md
similarity index 98%
rename from quest/m2/video-vaapi.md
rename to quest/m1/video-vaapi.md
index 9420f1d99d0..e501d00777f 100644
--- a/quest/m2/video-vaapi.md
+++ b/quest/m1/video-vaapi.md
@@ -62,4 +62,4 @@ already falls back cleanly, since `Encoder::new` returns `Err` and
 
 ## Related
 
-- [VA-API encodes an external Vulkan image](/quest/m2/vaapi-vulkan-import.md) - explicit-sync DMA-BUF input and render-node selection by device, H.264 only
+- [VA-API encodes an external Vulkan image](/quest/m3/vaapi-vulkan-import.md) - explicit-sync DMA-BUF input and render-node selection by device, H.264 only
diff --git a/quest/m1/webgpu-safari.md b/quest/m1/webgpu-safari.md
index 124df479ea0..81f421b2812 100644
--- a/quest/m1/webgpu-safari.md
+++ b/quest/m1/webgpu-safari.md
@@ -87,4 +87,4 @@ Public API: possibly a new `out.error` name. Wire: none.
 
 ## Related
 
-- [WebGPU HDR](/quest/m2/webgpu-hdr.md) - builds on the same renderer
+- [WebGPU HDR](/quest/m5/webgpu-hdr.md) - builds on the same renderer
diff --git a/quest/m1/webrtc-vendor.md b/quest/m1/webrtc-vendor.md
index 2908aea189a..7f4abd186d5 100644
--- a/quest/m1/webrtc-vendor.md
+++ b/quest/m1/webrtc-vendor.md
@@ -6,18 +6,18 @@ moq-webrtc builds str0m, dimpl, `is`, and sctp-proto from private in-tree module
 
 ## Plan
 
-Decided 2026-10-30 with the maintainer (planning interview); see the [epic](/quest/m2/webrtc/README.md) for what goes and why.
+Decided 2026-10-30 with the maintainer (planning interview); see the [epic](/quest/m3/webrtc/README.md) for what goes and why.
 
-Milestone: ✅ m1 (moved from m2, maintainer, 2026-11-03). Not chosen: keep it in m2, or send [moq-rtc on rind](/quest/m1/rind/rtc.md) back to m2. m1's [moq-rtc on rind](/quest/m1/rind/rtc.md) requires this, so it sits at the m1 top level. It stays a child of the m2 [WebRTC epic](/quest/m2/webrtc/README.md).
+Milestone: ✅ m1 (moved from m2, maintainer, 2026-11-03). Not chosen: keep it in m2, or send [moq-rtc on rind](/quest/m1/rind/rtc.md) back to m2. m1's [moq-rtc on rind](/quest/m1/rind/rtc.md) requires this, so it sits at the m1 top level. It stays a child of the m3 [WebRTC epic](/quest/m3/webrtc/README.md).
 
 - Vendor str0m and str0m-proto at the main-branch revision moq-dev/rind's `rind-str0m` targeted (`dc317173`, on dimpl 0.9 with str0m's pluggable crypto provider), with the dimpl, `is`, and sctp-proto versions it depends on (maintainer, 2026-10-31), so [moq-rtc on rind](/quest/m1/rind/rtc.md) can port rind's provider code unchanged. Commit them unchanged first so later diffs show only our changes, then trim.
 - Remove: str0m's `bwe/`, leaky pacer, H.266, RED, DTMF, G.7xx and comfort noise, VLA and simulcast layers, RTCP XR and app feedback, stats, `_internal_test_exports`, the crypto backends other than the one rind will replace (keep the provider trait until [moq-rtc on rind](/quest/m1/rind/rtc.md)); dimpl's `dtls13/` and `auto.rs`. Keep upstream's tests for what remains.
-- Keep dimpl's typed `TimeoutError::Handshake` through the vendored `dtls.rs`, which str0m flattens into `CryptoError::Other(String)`, and replace moq-ice's text match for it with a typed match if [the typed DTLS timeout](/quest/m2/webrtc/dtls-timeout.md) has landed.
+- Keep dimpl's typed `TimeoutError::Handshake` through the vendored `dtls.rs`, which str0m flattens into `CryptoError::Other(String)`, and replace moq-ice's text match for it with a typed match if [the typed DTLS timeout](/quest/m3/webrtc/dtls-timeout.md) has landed.
 - Keep the license files and record each upstream version in the module docs.
 - Drop the crates.io dependencies on str0m and friends from the workspace once nothing uses them.
 
-Public API: none beyond what [rename](/quest/m1/webrtc-rename.md) changed. Wire: unchanged; the same DTLS 1.2 suites and SRTP profiles are offered.
+Public API: none beyond what [rename](/quest/m2/webrtc-rename.md) changed. Wire: unchanged; the same DTLS 1.2 suites and SRTP profiles are offered.
 
 ## Required
 
-- [Rename moq-rtc to moq-webrtc](/quest/m1/webrtc-rename.md) - the crate the stack is vendored into
+- [Rename moq-rtc to moq-webrtc](/quest/m2/webrtc-rename.md) - the crate the stack is vendored into
diff --git a/quest/m2/README.md b/quest/m2/README.md
index 764a707aea7..88d6f5f7f1c 100644
--- a/quest/m2/README.md
+++ b/quest/m2/README.md
@@ -1,315 +1,189 @@
-# m2: later work
+# m2: the next breaking release
 
 ## Goal
 
-Independently shippable features, internal optimizations, and broad tooling
-follow the clustering and API release. Publication and downstream adoption
-also live here because they necessarily follow m1; they are not abandoned.
+Every change that would need a semver-breaking release if it landed right
+after the next cut of `main` into `release`, plus the [cut
+gate](/quest/m2/cut-gate/README.md). The cut waits on this milestone alone;
+complete it before cutting main into release.
 
 ## Plan
 
-Decided 2026-10-13: a feature does not block the breaking release merely
-because it was in the next-wave backlog. Keep existing behavior correct in
-m1, and defer new capabilities without changing their intended outcome.
-Dependencies on m1 remain explicit. An implementation that discovers a new
-necessary API break brings that decision to the maintainer before proceeding.
-
-Decided 2026-11-03 (maintainer, Kixel's quest audit): [byte streams](/quest/m2/stream/README.md)
-and the [mesh libraries](/quest/m2/mesh/README.md) rank first in m2, ahead
-of [release execution](/quest/m2/release/README.md). Kixel's daemon builds on
-them from `main` through a git submodule, so it needs them merged, not
-released. They stay out of m1 so the cut does not wait on them; each starts
-as soon as its m1 prerequisites (sockets, fastest-reader pacing, outbound
-federation) land.
-
-Rate-grant work targets the next unpublished lite version after finalized
-lite-07; bitrate enforcement is not part of this release.
+Decided 2026-11-05 (maintainer, milestone re-cut): m2 holds the breaking half
+of what was "everything before the cut" (2026-10-20). Breaking covers every
+published surface, as the root [questline](/quest/README.md) defines: the
+public Rust, JS, and bindings API, a frozen wire version, the hang catalog
+JSON, a stored or exported container format, and CLI flags, config keys, and
+environment variables. A change to lite-07-wip or to a `main`-only API the
+cut would publish counts, because it could not land after the cut without
+another breaking release. A non-urgent fix that breaks joins m2; an urgent
+one joins m0. Placed in the re-cut: group-drops (its shape is open, but
+naming abandoned groups on the wire lands on lite-07-wip) and the whole
+unbounded-groups epic, whose additive compressed-stream child rides with it.
+
+The cut gates that break nothing (main no slower than release, vendored
+fixes, the pre-cut audit re-run, and moq-c parity) live under the recurring
+[cut gate](/quest/m2/cut-gate/README.md), decided the same day.
+
+Held by open claims: the m1 epics and quests marked below stay where they
+are until their claims merge, and the [probe epic](/quest/m2/probe/README.md)
+stays here while its padding claim is open, so the cut waits on it until the
+[re-cut follow-up](/quest/m2/recut-held.md) moves it to m3.
+
+Carried from m1's Plan before the re-cut, where "m1" means the whole pre-cut
+milestone, now m1 and m2:
+
+Decided with the maintainer on 2026-10-15: clustering stability and the
+in-tree QUIC stack first. Decided 2026-10-20 (maintainer): m1 is everything
+before the cut, not only breaking work, so ready non-breaking quests stay
+here instead of moving out; the cut is what ships them.
+
+- Preserve epoch correctness, routing recovery, outbound federation, and
+  claim continuity on lite-07. Catalogs, long-lived readers,
+  and late joiners obey the same identity contract.
+- Keep IETF passthrough, the API audit, the broad clock conversion,
+  archive replay/DVR correctness, and the TS fidelity
+  expansion in m1. Keep their correctness, interoperability, memory, and
+  performance evidence with them.
+- Defer P2P, watch-worker planning and implementation, AMD Vulkan encode and
+  Intel VA-API/Vulkan import, and QoS lag and prefix stats to m2 with their
+  prerequisites. Their possible API breaks do not make them prerequisites of
+  this cut. Existing playback and A/V clock validation remain here.
+  Same-epoch importers were dropped (maintainer, 2026-10-19): a redundant
+  ingest pair runs on distinct epochs.
+- Finalized lite-07 is preferred by first-party Rust and JS clients, with
+  older-version negotiation fallback. Servers accept it by default. Never
+  reuse a published identifier for an incompatible wire change; deferred
+  features use the appropriate subsequent wip/version if they need one.
+- The next cut makes no new AMD/Intel GPU-input support promise. The later
+  multi-vendor release needs both hardware proofs before publication.
+- Package publication, downstream adoption, and production rollout follow
+  the cut under [release execution](/quest/m3/release/README.md).
+
+Existing upgrade and identity guides carry migrations; feature docs change
+inline. Keep generic proofs here and deployments and their operational
+acceptance with the downstream operator.
+
+Keep one owner per shared code area and order prerequisites before consumers
+(re-ranked in the 2026-10-20 audit: auth before cluster routing, and every
+lite-07 prerequisite before those quests).
+Decided 2026-10-25 (maintainer): the hand-written `moq-c` ships at this cut
+with parity to moq-ffi for every m1 binding feature, so each binding quest
+lands its C half there; the generated C line moves after the cut.
+The moq-transport passthrough fields remain crate-private: no public moq-net
+item exists only for moq-transport (maintainer, 2026-10-23).
+
+Added 2026-10-16: refresh, a breaking `Demand` change, so it lands before
+the cut.
+
+Added 2026-10-22 (maintainer, from an external API audit): small breaks
+that would otherwise force another breaking release (the FFI encoder config,
+FromStr, dead items, `SessionClosed`, unprefixed C++), the hang draft's
+warmup rule for the shipping dual decoder, the binding migration guide fixes,
+and the API-diff tooling. Public routes now wait on cluster routing.
+
+Added 2026-10-20 (maintainer): the probe target, native probing, and the
+native rung disable moved up from the [m2 probe epic](/quest/m2/probe/README.md),
+so Rust, FFI, and OBS publishers recover a stopped rendition in this release;
+padding and the browser's rung disable stay in m2, with only padding's
+lite-07 stream type here.
+
+Added 2026-10-22 (maintainer, clustering audit): three interim fixes for
+announce churn on today's hop-list mesh, shipping with the next cut from
+`main` (not backported to `release`), so deployments get relief before the
+route layer ships; and stats groups as
+tracks, so per-group stats stop costing cluster announces.
+
+Added 2026-10-22 (maintainer, security audit of the relay, auth, stats,
+ACME, and WebRTC): a clean close misreported as a revocation, injectable
+metric tiers, an unbudgeted ACME renewal, unbounded mDNS work per WebRTC
+offer, and an undocumented stats linger cut. The audit's `server_name`
+finding was already fixed by moq-dev/moq#6509.
+
+Added 2026-10-23 (maintainer, from a linger audit): broadcasts lose their
+finished state and retention moves to moq-mux, a break in every binding, so
+it lands before the cut.
+
+Added 2026-10-23 (maintainer, from a moq-quic audit): moq-quic and its drivers
+are unreleased, so their API is reshaped before the cut publishes it, and the
+audit's receive-memory, priority, and lease bugs rank ahead of that reshape.
+
+Added 2026-10-23 (maintainer, pre-cut triage): breaks that would otherwise
+force another major (`announce="never"`, the unused OBS outputs, binding
+durations, and the remaining web-transport-trait adapters) land before the
+cut, as do the small hostile-input and container fixes from the 2026-10-22
+security audit, and the stuck-window scan.
+
+Added 2026-10-24 (maintainer, from a moq-hls audit): import and export
+hardening (URL redaction, ranged responses, redirect bases, sequence
+arithmetic, DASH init readiness, dot-only names) and ffprobe segment
+conformance; the audit's segment-finalization redesign is folded into
+Catalog HLS field.
+
+Added 2026-10-24 (maintainer-requested pre-cut audit of main): remote
+crashes and amplification in media and RTMP parsing, lite announce bounds,
+JS track terminal causes, browser element teardown, and smaller Rust/JS
+divergences, under one epic; its redesign proposals went to m2.
+
+Changed 2026-10-26 (maintainer): pure-Rust crypto moved to m3 until upstream
+graviola and ACME releases make it cheap, so the cut ships on aws-lc-rs.
+Dropping the `rsa` crate from moq-auth's production graph stays in m1.
+
+Added 2026-10-25 (maintainer): the studio's
+GPU encode and source import quests are in m1 so
+moq-video's GPU encode and import API changes, mainly encoders taking a GPU
+surface and zero-copy texture import, land before the cut.
+
+Added 2026-10-27 (maintainer, from an external security audit): relay and
+wire boundary fixes, importer streaming, moq-c handle wrap, browser input
+checks, and CI tool pins, under one epic; its credential leaks went to m0.
+
+Added 2026-11-01 (maintainer): datagram tracks, so lite-07 freezes with
+datagrams as their own track kind instead of single-frame groups.
+
+Added 2026-11-01 (maintainer, follow-up planning): byte-stream ladders, so
+the binding API for `lower` breaks before the cut, `moq export` ending
+with its broadcast, and a relay answering a SUBSCRIBE on a fetched copy.
+
+Added 2026-10-27 (maintainer, from an external release-to-main audit): the
+bindings' silent `max_delay` default change and the upgrade notes that
+contradict the code. Its other findings already had owners or contradicted
+settled decisions (archives break in place; OBS video-only output stays
+removed).
+
+Added 2026-11-01 (maintainer, follow-ups from the 2026-11-01 /quest-afk run):
+the shared pacer's overshoot under 2 Mbit/s with the BBR3 retune it needs,
+since BBR3 is the default controller the cut ships; a truncated MKV that
+left its tracks open; and, under release performance, a bisect of the relay's
+per-frame CPU growth since #5926.
+
+Added 2026-11-04 (maintainer): the relay reports the native sessions its
+drain deadline force-closes while still open, apart from those only finishing
+their end report, so an embedder's drain alert pages on real cuts.
+
+Decided 2026-11-05 (maintainer, /quest-audit): blockers rank above the
+quests that require them.
+
+- ✅ Move the blockers up: Drop set and Subscribe ranges rank just above
+  Address groups by timestamp, and the API audit just above Cluster routing.
+- Not chosen: moving the dependents down; leaving the order as it was.
 
 ## Required
 
-- [Byte streams](/quest/m2/stream/README.md) - TCP connections ride MoQ losslessly through relays, proxied per hop rather than as IP packets
-- [Mesh libraries](/quest/m2/mesh/README.md) - an `Endpoint` reaches any enrolled node by endpoint ID over relays or a sparse direct overlay, with address hints and a `.status` track; the mesh binary and UI live in Kixel
-- [`@moq/net` broadcasts expose their requests](/quest/m2/net-broadcast-requests.md) - a JS broadcast serves tracks it never created, on demand, like Rust
-- [`@moq/crypto` loads a stored signing key](/quest/m2/crypto-key-load.md) - one device key proves mesh identity and signs broadcasts
-- [Announce credit](/quest/m2/announce-credit.md) - a subscriber bounds an Announce Stream's routes with credit at the wire, so a path flood never closes a session
-- [JS announced coalescing](/quest/m2/js-announced-coalesce.md) - `@moq/net`'s `Announced` keeps one pending event per path, like Rust
-- [An audio track's final flush joins its open group](/quest/m2/audio-flush-group.md) - a zero-`delay.max` subscriber gets the tail, not `Old`
-- [Release execution](/quest/m2/release/README.md) - publication, installed-artifact proof, cleanup, and downstream adoption after m1
-- [Release pull requests read the R2 Rust cache](/quest/m2/mbx-r2-release-cache.md) - a release PR's `Check the cache` step reports effective read-only once the cut brings the cache to `release`
-- [Binary release publishers run on their tag](/quest/m2/release-tag-publishers.md) - brew, Go and Swift releases stop running through `workflow_run` on main, once the cut brings the workflows to `release`
-- [crates.io trusts the workflow](/quest/m2/crates-trusted-publisher.md) - maintainer action: the crates the cut first-publishes by token get a trusted publisher for `release-rs.yml`
-- [Rust releases publish through OIDC](/quest/m2/release-rs-oidc.md) - release-plz publishes with trusted publishing and `CARGO_REGISTRY_TOKEN` is revoked
-- [One policy for oversized container metadata](/quest/m2/import-metadata-policy.md) - fMP4 and MKV refuse or stream huge metadata by one documented rule
-- [Wire fuzz coverage](/quest/m2/wire-fuzz-coverage.md) - the cmsg walks in moq-sock and moq-uring have invariant fuzz targets, and the unsafe peer input reaches runs under Miri
-- [VA-API renderer tests](/quest/m2/vaapi-render-tests.md) - the VA-API renderer, decode, and transcode tests run in `just rs gpu` on AMD and Intel and fail instead of skipping, and hosted CI reports them ignored
-- [One Ruff pin and Swift formatting on aarch64-linux](/quest/m2/format-gate-followups.md) - only the dev shell pins Ruff, and aarch64-linux checks Swift formatting once nixpkgs builds `swiftc` there
-- [Weekly mutation testing on critical modules](/quest/m2/mutants.md) - cargo-mutants runs weekly on moq-auth and moq-net's permission, resume, and expiry code
-- [Video quality](/quest/m2/video-quality/README.md) - a nightly VMAF harness grades every encoder backend and on-demand GoP pops against floors, and moq-boy's encode is fixed under it
-- [P2P](/quest/m2/p2p/README.md) - application-selected peer sessions use shared priorities, routing, and same-epoch handover
-- [moq-auth drops the unused peer grant API](/quest/m2/auth-drop-peer-grant.md) - P2P trusts its peers, so `PeerGrant` and its `KeySet` methods go
-- [rust2's exporter is ready for moq](/quest/m2/rust2-exporter.md) - waiting on moq-dev/rust2's exporter to generate every language moq ships
-- [Switch to rust2's exporter](/quest/m2/ffi-exporter.md) - moq's bindings come from rust2-ffi, moq-ffi shrinks to its remainder, and moq's UniFFI generator code is deleted
-- [Generated C bindings](/quest/m2/c/README.md) - C generated from moq-ffi ships as `moq-c` at a later cut's shared minor and replaces the hand-written crate
-- [A C origin can discover eagerly, like a relay](/quest/m2/c-origin-relay.md) - the C API puts an origin in relay mode, so forwarding a client session's routes needs no local announce watcher
-- [A runtime-free QUIC driver](/quest/m2/quic-sansio-driver.md) - a caller's own loop moves UDP datagrams and polls moq sessions over moq-quic, for rust2's bindings
-- [Benchmark sources](/quest/m2/bench-sources.md) - every measuring nightly benchmark feeds the regression table, and none is a smoke run
-- [QoS](/quest/m2/qos/README.md) - the relay's egress `lag` histogram and `dropped` counters on the stats totals and prefix tracks
-- [HLS and DASH browser playback](/quest/m2/hls-player-test.md) - hls.js and dash.js play, reload, switch, and survive reconfiguration nightly
-- [The DASH manifest keeps segments across a reconfigure](/quest/m2/dash-reconfigure.md) - a same-codec reconfigure keeps the old instance's segments listed in DASH, as HLS does
-- [Broadcast fairness](/quest/m2/broadcast-fairness.md) - broadcasts share a cluster link fairly, so one tenant's priority never starves another's
-- [Cache fair share](/quest/m2/cache-fairness.md) - one tenant cannot crowd another out of the relay's shared group cache
-- [Peer grant bound](/quest/m2/peer-grant-bound.md) - a peer's AUTH_OK costs near-linear time in its bytes on every input shape, in Rust and in a browser
-- [A regrant re-checks only the routes it can change](/quest/m2/regrant-route-recheck.md) - an `AUTH_OK` no longer costs routes times grant members on every lite announce stream
-- [Plan: watch worker](/quest/m2/plan-watch-worker.md) - prototype an invisible page worker against app-spawned workers, and land the jank harness that decides
-- [Watch worker](/quest/m2/watch-worker.md) - watch playback runs in a worker onto an OffscreenCanvas, so main-thread jank never stalls video or audio
-- [Vulkan Video encode on AMD](/quest/m2/vulkan-encode.md) - H.264 and H.265 from an external Vulkan image on RADV, hand-rolled on ash, proven on an RX 9070
-- [VA-API encodes an external Vulkan image](/quest/m2/vaapi-vulkan-import.md) - an explicit-sync DMA-BUF reaches Intel's encoder, proven on Arrow Lake
-- [C++ FFI reuse](/quest/m2/cpp-ffi-reuse.md) - C++ packages link the shared default-feature FFI build once it is proven compatible
-- [Upstream reports](/quest/m2/upstream-reports.md) - report the faad, retina, and mr-boxington bugs found before the cut
-
-- [Native compression flush](/quest/m2/native-compression-flush.md) - report the per-frame nonfinal flush requirement in existing browser discussions
-- [Native synchronous codecs](/quest/m2/native-compression-sync.md) - report the stateful small-frame synchronous API requirement
-- [Native browser codecs](/quest/m2/native-compression-adopt.md) - adopt native operations when timing, frame and resource contracts hold
-
-- [moq-net's library tests pass under cargo test](/quest/m2/net-test-subscriber.md) - two moq-net tests stop each installing a global tracing subscriber, so plain `cargo test -p moq-net --lib` passes
-
-- [OBS native codecs](/quest/m2/obs-moq-video/README.md) - replace FFmpeg video and audio decoding with moq-video and moq-audio, deliver GPU frames, and use native audio/video encoders
-- [MoQ in obs-studio](/quest/m2/obs-studio/README.md) - a native MoQ output and service merged into obs-studio, once its maintainers agree; the plugin carries it until then
-- [AudioToolbox decode](/quest/m2/audio-decode-audiotoolbox.md) - macOS and iOS decode HE-AAC, multichannel AAC, and what else the framework offers
-- [AudioToolbox encode](/quest/m2/audio-encode-audiotoolbox.md) - macOS and iOS encode AAC-LC
-- [GPU CI](/quest/m2/gpu-ci.md) - NVIDIA tests gate the merge queue on a self-hosted GPU runner VM, and `just rs nvidia` runs them locally instead of skipping
-- [Vendor-free CARLA bridge](/quest/m2/carla-bridge.md) - the CARLA demo's GPU bridge lets moq-video pick the encoder, and its stand-in test runs on AMD as well as NVIDIA
-- [Probe](/quest/m2/probe/README.md) - a session probes up to the bitrate it wants to send or receive, so a stopped simulcast rendition resumes and a viewer up-switches; the browser pads where native sessions retransmit
-- [Media stats](/quest/m2/stats/README.md) - publishers announce a stats track in the catalog, viewers answer a soliciting catalog through a per-catalog `.echo` broadcast, and one model turns both into a health verdict and a preflight report
-- [Perf](/quest/m2/perf/README.md) - eliminate measured hot-path costs across moq-uring, kio, and the moq-net model
-- [Wire stats](/quest/m2/wire-stats/README.md) - `Presence` counts each root's transport bytes on the wire, `wire_tx` and `wire_rx`, from QUIC, WebSocket, and embedder gateway sources
-- [Session outcome records](/quest/m2/session-outcome-records.md) - relay stats publish each refusal and abnormal session end as a record per label, bounded under a flood, beside the counters
-- [Performance survey follow-ups](/quest/m2/performance-survey/README.md) - benchmark the source audit's transport, browser, media and serving risks before optimizing
-- [Transport x version benches](/quest/m2/bench-transport-sweep.md) - the session benches sweep transports as well as versions
-- [Shared group serving and ingest](/quest/m2/shared-serve.md) - Rust's moq-lite and moq-transport sessions serve and ingest groups through one poll machine each, with only wire encoding per protocol
-- [Shared group serving and ingest in JS](/quest/m2/shared-serve-js.md) - the same split in js/net, following the Rust seam
-- [Paired bench BASE](/quest/m2/bench-base-paired.md) - `just bench <base>` uses the nightly's paired comparison and the old one is deleted
-- [Audio renditions carry a language](/quest/m2/audio-lang.md) - audio renditions have an optional BCP-47 `lang`, and watch auto-picks within one language
-- [fMP4 and TS imports publish BCP-47 languages](/quest/m2/import-lang-iso639.md) - ISO 639-2 codes become `en`-style tags on audio and text
-- [HLS carries every audio language](/quest/m2/hls-audio-languages.md) - every `EXT-X-MEDIA` audio entry imports with its `LANGUAGE`, and exports write it back
-- [Receive pool](/quest/m2/receive-pool.md) - one byte budget per worker covers every connection's receive credit and the cache, billing each frame once
-- [Front parking](/quest/m2/origin-front-parks.md) - an unroutable request waits on a front instead of re-asking on every route-table move
-- [A refused follower asks a replacement handler](/quest/m2/follow-refused-retry.md) - a same-instance handler swap with identical route details re-asks a refused `Following`, while listeners still see no change
-- [Route wakes](/quest/m2/route-wakes.md) - a route change wakes only the fronts it can move, so pool churn stops scaling with served paths
-- [A route stream's interest is a set of prefixes](/quest/m2/route-interest-prefixes.md) - one Announce Stream covers several subtrees, with floors and certification proved over the set
-- [A socket dial learns its peer is behind an older hop](/quest/m2/socket-old-hop-signal.md) - a relay finds the dialed endpoint behind its older moq-lite session and marks that path, so the dial fails `Unsupported` while one to an absent peer still waits
-- [Fewer allocations in announce fan-out](/quest/m2/announce-fanout-allocs.md) - a deep path costs no more allocations per subscriber than a shallow one
-- [moq-room scales to large rooms](/quest/m2/room-bench.md) - a benchmark measures `Room` with large participant counts, and polling narrows only if it shows a slope
-- [Route health](/quest/m2/route-health/README.md) - epoch-only active/passive track recovery over metadata-only subscriptions
-- [Wrapper traits over moq-net](/quest/m2/net-wrap/README.md) - moq-net exports producer and consumer traits, and every writer and reader above it takes them, so a wrapper such as e2ee passes through unchanged
-- [E2EE](/quest/m2/e2ee/README.md) - TypeScript and Rust peers interoperate over encrypted broadcasts no relay can decrypt
-- [Content protection](/quest/m2/drm/README.md) - Common Encryption CMAF publishes unchanged, signalled in the hang `drm` section and MSF `contentProtections`, with license URLs from Rust, the CLI, and every binding
-- [iOS capture](/quest/m2/mobile-capture-ios.md) - Rust captures the camera and screen on iOS, setting the catalog rotation
-- [Android capture](/quest/m2/mobile-capture-android.md) - Rust captures through NDK/JNI on Android, reusing the existing codecs and setting the catalog rotation
-- [Latest readers use Range::live()](/quest/m2/readers-range-live.md) - after #6278, readers start at the live edge without waiting on `largest()`
-- [Audio outlives video](/quest/m2/audio-bufferbloat-av.md) - under bufferbloat audio stays within budget while video may skip, rendered frames stay in sync, and native audio rows are enforced
-- [ViSQOL grading](/quest/m2/audio-visqol.md) - the nightly scores played audio against a reference clip and fails below measured floors
-- [PulseAudio capture periods](/quest/m2/pulseaudio-capture-period.md) - capture on cpal's PulseAudio host arrives in short periods, not the server's 2 s default fragment, proven on the null sink's monitor
-- [Bindings size profile](/quest/m2/ffi-size-profile.md) - a benchmark decides whether the moq-ffi builds ship at opt-level "s", which halves the dylib
-- [Value merge-patch diff](/quest/m2/json-value-diff.md) - benchmarks decide between moq-json's generic serializer diff, a ported `Value` diff, and compression alone
-- [Measure what a catalog republish costs per rendition edit](/quest/m2/catalog-republish-cost.md) - bench whole-catalog re-serialization across track counts, then decide deltas or a bound
-- [A JSON snapshot consumer resyncs after a bad frame](/quest/m2/json-snapshot-resync.md) - a decode failure drops the group with a typed error, so `@moq/room` and moq-boy resume at the next snapshot
-- [Go module proxy](/quest/m2/go-module-proxy.md) - `moq.dev/moq-ffi` ships from a static GOPROXY we host, so its staticlibs stop growing git history by ~61 MiB per release
-- [Go per-platform lib modules](/quest/m2/go-ffi-platform-modules.md) - a Go build downloads only the host's staticlib, and `go mod vendor` works
-- [Dart on iOS](/quest/m2/dart-ios.md) - prove the shipped iOS native asset actually loads on a device, which no CI can
-- [Mobile completion](/quest/m2/mobile-completion.md) - verify the Swift and Kotlin bindings over Rust-owned capture
-- [Browser publishing paths under test](/quest/m2/publish-firefox.md) - the media harness publishes from Firefox in Nightly and passes, covering the `<video>` capture fallback Chromium never takes
-- [Bindings in the interop matrix](/quest/m2/interop-bindings.md) - Kotlin, Swift, and Dart publish and subscribe against every other interop client
-- [WebGPU HDR](/quest/m2/webgpu-hdr.md) - HDR renditions play as HDR where the browser and display can show it, and tone-map to SDR elsewhere
-- [Resume as producer replacement](/quest/m2/resume-redesign.md) - route changes replace the writer of one track state, deleting the per-reader resume path in Rust and JS
-- [Migrated sessions close once their replacement synced](/quest/m2/goaway-migration-followups.md) - moq-tokio holds the early close for the replacement's announce sync, and the JS `Connection` closes early too
-- [moq-transport requests end through one lease](/quest/m2/ietf-request-lease.md) - every IETF request ends through one polled lease, and the two 18k-line files split by mechanism
-- [A moq-transport group head fills its hole in place](/quest/m2/ietf-fill-refill.md) - fills and joining FETCHes write into the tail's group, deleting the `Fill` handoff
-- [moq-transport hole markers](/quest/m2/ietf-hole-marker.md) - a negotiated extension names a SUBSCRIBE's holes, so our publishers answer multi-group FETCH from caches that know every group; built when an IETF client wants it
-- [Announce interest streams share one route table](/quest/m2/announce-interest-memory.md) - per-stream announce cost follows what is in flight, not every route
-- [A parked read of a resumed group reads its budget without re-syncing](/quest/m2/recover-budget.md) - measure, then drop the per-frame reader sync
-- [One port](/quest/m2/one-port/README.md) - one UDP port carries QUIC, SRT, and WebRTC media through an embedder hook, and one TCP port carries HTTP, RTMP, and RTMPS
-- [WebSocket caps](/quest/m2/rate-websocket.md) - paced reads and writes over bounded socket buffers hold WebSocket to the same caps
-- [Publishers learn their cap](/quest/m2/rate-grant.md) - the AUTH grant carries the caps and publishers clamp their encoder to them
-- [moq-rtc pacing](/quest/m2/rtc-pacing.md) - a capped WHEP viewer never receives more than its cap plus burst, NACK resends included
-- [SRT rate handle](/quest/m2/srt-rate-handle.md) - a per-connection cap paces SRT pulls, retransmits included, and closes SRT publishers past it
-- [One port on the io_uring workers](/quest/m2/uring-demux.md) - `moq-uring`'s workers host the UDP demux, so a ring relay keeps WebRTC media and SRT on its QUIC port
-- [Synced data playback](/quest/m2/watch-data-sync.md) - js/watch releases JSON and binary payloads on the media playhead, and a slow data track holds media back
-- [Watch decode gate](/quest/m2/watch-decode-gate.md) - video lookahead stays encoded until it is near presentation, like audio
-- [moqsrc A/V sync](/quest/m2/moqsrc-av-sync.md) - a nightly test measures A/V skew from `moqsrc` through clock-synced sinks
-- [WebCodecs audio priming](/quest/m2/webcodecs-priming.md) - `@moq/publish` measures each browser's `AudioEncoder` priming and corrects AAC timestamps and Opus pre-skip, so audio decodes at its capture timestamp
-- [macOS browser lane](/quest/m2/macos-browser-lane.md) - nightly CI runs the priming browser test in Chrome and Safari, which have the AAC encoders Linux lacks
-- [fMP4 ambisonic layout](/quest/m2/mux-vr-ambisonic-fmp4.md) - fMP4 Opus import fills `ambisonic` from the `dOps` mapping table
-- [Linux decoded frames](/quest/m2/obs-decode-linux.md) - present supported native decoded surfaces with visible CPU fallback
-- [Windows decoded frames](/quest/m2/obs-decode-windows.md) - present decoded D3D11 surfaces in OBS without CPU readback
-- [macOS GPU input](/quest/m2/obs-macos.md) - feed the encoder from the OBS compositor without CPU readback
-- [Windows GPU input](/quest/m2/obs-windows.md) - import or blit OBS D3D11 textures with explicit synchronization
-- [WASM-to-JS evaluation](/quest/m2/rs2ts-wasm2js.md) - try the Rust implementation as JS-only browser output and compare source-translator alternatives if needed
-- [JS-only @moq/net](/quest/m2/rs2ts-js.md) - adopt the selected Rust-to-JS route after browser parity and measured tradeoffs are accepted
-- [Per-stream and per-datagram deadlines](/quest/m2/quic-deadline.md) - hopeless retransmits
-  become resets, a tail loss probe fires early while there is still time, and
-  datagrams past their subscription's max delay are dropped instead of sent late
-- [Measure ECN on the backbone](/quest/m2/quic-ecn-measure.md) - a written
-  verdict on marking versus dropping, and whether Linode and OVH keep marks
-- [poll_acked on moq-net's send stream](/quest/m2/quic-ack-hook.md) - the
-  backend-neutral hook on moq-net's own transport trait that awaits an
-  acknowledged stream offset, implemented by the moq-tokio and moq-uring adapters
-- [Delivery delay](/quest/m2/delivery-delay.md) - a per-frame
-  delivery-delay histogram from `poll_acked`, so viewer jitter is visible
-- [#3199](/quest/m2/3199-moq-uring-remove-sq-indirection-and-per-enter-ring-fd.md) - moq-uring: remove SQ indirection and per-enter ring fd lookup, if a profile shows the win
-- [#3200](/quest/m2/3200-moq-uring-batch-completion-wakeups-with-min-timeout.md) - moq-uring: batch completion wakeups with MIN_TIMEOUT
-- [Browser media report](/quest/m2/rs2ts-browser-report.md) - compare Rust-backed and handwritten @moq/net through full media workloads, supplementing the pre-adoption comparisons
-- [Link quality](/quest/m2/link-quality.md) - a radio link's cost follows its measured quality without flapping routes
-- [Relay io_uring packages](/quest/m2/relay-io-uring-package.md) - Linux relay packages ship io_uring once the ring is on par with tokio
-- [io_uring thread check](/quest/m2/uring-transport-machines.md) - the relay fanout bench measures `moq_uring::transport::Local`'s per-call thread check after the transport is boxed, removing it only if it shows
-- [io_uring quiescence on a quiet host](/quest/m2/uring-bench-followups.md) - quiet-host acceptance numbers and a nightly `worker_turns` QUIC request-reply series
-- [Opus implementation](/quest/m2/audio-opus-backend.md) - compare Opus codec quality, CPU, build cost, and the loss recovery each backend offers
-- [Latency ledger](/quest/m2/latency-ledger.md) - a viewer reports its share of playback delay stage by stage: jitter buffer and device
-- [Media Foundation decode](/quest/m2/audio-decode-mediafoundation.md) - Windows decodes HE-AAC, multichannel AAC, and what else the MFTs offer
-- [Media Foundation encode](/quest/m2/audio-encode-mediafoundation.md) - Windows encodes AAC-LC
-- [MediaCodec decode](/quest/m2/audio-decode-mediacodec.md) - Android decodes HE-AAC, multichannel AAC, and what else the device offers
-- [MediaCodec encode](/quest/m2/audio-encode-mediacodec.md) - Android encodes AAC-LC
-- [#2848](/quest/m2/2848-follow-the-bandwidth-grant-in-moq-audio-instead-of.md) - the Opus producer follows its bandwidth grant through the settled `moq_mux::rate::Control`
-- [NVENC buffer pool](/quest/m2/nvenc-pool.md) - NVENC reuses input and output buffers instead of allocating per frame, if a benchmark shows it wins
-- [Direct3D11 render import](/quest/m2/render-d3d11.md) - Windows presents without downloading every frame to system memory
-- [Media Foundation encodes on the texture's adapter](/quest/m2/mf-encode-adapter.md) - Windows machines with two GPUs keep an exported texture on the GPU route into a hardware encoder
-- [Intra-refresh GOPs](/quest/m2/intra-refresh/README.md) - video with periodic intra refresh imports and plays back cleanly with one group per sweep and a catalog `warmup`
-- [#2819](/quest/m2/2819-moq-video-carry-pipewire-dma-bufs-safely-into-the-vulkan.md) - moq-video: validate PipeWire DMA-BUFs into the Vulkan renderer on hardware
-- [#3115](/quest/m2/3115-moqsink-the-publication-has-no-generation-so-a-flush.md) - moqsink: a flushing restart after EOS opens a new publication generation
-- [QUIC I/O boundary](/quest/m2/quic-io-boundary.md) - moq-uring receives from the buffer ring and transmits into caller-owned buffers with no copy, once a profile says where
-- [BBR media study](/quest/m2/quic-bbr-study.md) - whether Google's growth recognition and precautionary probe stop help media, measured on a shaped media harness
-- [Realtime uplink congestion control](/quest/m2/quic-realtime/README.md) - native publishers pick `Realtime`, a receive-ts delay-based controller that keeps the uplink queue near empty for teleoperation
-- [Windows.Graphics.Capture](/quest/m2/capture-wgc.md) - the WGC display and window backend verified on real Windows hardware
-- [Windows capture parity](/quest/m2/capture-windows.md) - system and per-app audio and a settled app-capture policy
-- [Linux capture parity](/quest/m2/capture-linux.md) - Wayland window/system-audio capture, per-app audio, and explicit display-selection and app-capture limits
-- [Per-app audio on macOS](/quest/m2/capture-app-audio-macos.md) - one application's audio through ScreenCaptureKit
-- [cpal loads libasound at runtime](/quest/m2/cpal-alsa-runtime.md) - condition: a cpal release whose Linux build carries no load-time libasound requirement
-- [Audio capture without ALSA link](/quest/m2/capture-alsa-link.md) - moq-audio capture and playback build on Linux without linking libasound, and capture becomes a default feature
-- [The moq CLI can publish a changing catalog](/quest/m2/cli-catalog-updates.md) - catalog updates mid-stream, so recovery replays need no hand-built clients
-- [Ship capture and playback](/quest/m2/cli-packaging.md) - a released moq binary can capture and play, which no distribution currently enables
-- [moq-relay in nixpkgs](/quest/m2/nixpkgs-relay.md) - `nix-shell -p moq-relay` installs the released relay from upstream nixpkgs, auto-updated from our tags
-- [moq-cli in nixpkgs](/quest/m2/nixpkgs-cli.md) - the released `moq` CLI with its full release feature set joins nixpkgs as `moq-cli`
-- [Egress profile](/quest/m2/quic-egress-profile.md) - measure relay send-path syscalls, pacing bursts, and allocations before optimizing any of them
-- [VAAPI encode and decode](/quest/m2/video-vaapi.md) - H.265 encode and decode, pre-generated bindings, and pooled resize surfaces, including the moq-dev/vaapi release that carries them
-- [GPU capacity and health](/quest/m2/gpu-health.md) - moq-video reports each device's sessions, memory, utilization, and health on NVIDIA, AMD, and Intel alike
-- [A release carries multi-vendor GPU input](/quest/m2/gpu-release.md) - `release` carries the GPU surface validated on AMD and Intel; health follows separately
-- [The remaining library spawns](/quest/m2/spawn-audit.md) - every async spawn left in a library crate becomes a polled `kio::Tasks` child or is listed with why it stays
-- [The relay over QUIC on the sim](/quest/m2/quic-sim.md) - the relay and moq-tokio's `Client` and `Server` run over `moq-quic` on the seeded sim
-- [moq-shaper's own socket never passes for path loss](/quest/m2/shaper-socket.md) - relay-sized buffers and its own socket drops reported beside path drops
-
-- [DVR rewind](/quest/m2/archive-dvr.md) - follow-on capability after the release contract is stable
-- [Archive lookups cancel when abandoned](/quest/m2/archive-lookup-withdrawal.md) - a public withdrawal signal on `Fill` stops a time lookup's store read once its readers leave
-
-- [Demo dashboard shows viewer lag](/quest/m2/qos-lag-dashboard.md) - follow-on capability after the release contract is stable
-
-- [Publisher timeliness at relay ingest](/quest/m2/qos-publisher-timeliness.md) - follow-on capability after the release contract is stable
-
-- [Auth session caps cost O(1)](/quest/m2/auth-session-index.md) - per-token and per-remote counts and a time-ordered expiry queue replace the scans, after #7211
-- [The relay refuses a cluster peer it cannot dial](/quest/m2/relay-undialable-peers.md) - moq-tokio reports the schemes it can dial, and the relay refuses an undialable peer at startup instead of retrying forever
-- [Drop moq-auth's iroh transport](/quest/m2/auth-drop-iroh.md) - the next breaking moq-auth release drops `Transport::Iroh` and the JS `"iroh"` value
-- [moq-transport finish interop](/quest/m2/ietf-finish.md) - the interop `finish` case runs on every even moq-transport draft instead of being skipped
-- [JS joining FETCH](/quest/m2/ietf-js-joining-fetch.md) - the JS publisher answers a joining FETCH that arrives after a quick finish, mirroring the Rust bound
-- [An Absolute join never races an older-history FETCH](/quest/m2/ietf-absolute-join-race.md) - reproduce #7680's suspected collision on main, then fix it or keep the test and delete
-- [Relays and moq-tokio offer versioned qmux-02 first](/quest/m2/qmux-02-subprotocols.md) - one shared qmux version list prefers 02, so JS clients negotiate it
-- [A passing interop run stops publishers cleanly](/quest/m2/interop-shutdown-warnings.md) - no lingering publisher or unfinished-producer warning in a green interop run
-- [Smoke tests make their certificates without a system OpenSSL config](/quest/m2/smoke-libressl.md) - moxygen and Cloudflare smoke pass `-config`, as the conformance runner does
-- [ashpd uses maintained D-Bus crates](/quest/m2/ashpd-maintained.md) - wait for a stable zbus 6 port, then remove the portal dependency exceptions
-- [Askama uses a maintained TOML parser](/quest/m2/askama-maintained.md) - wait for a stable parser migration, then remove the generator dependency exception
-- [Dependency and alternatives audit](/quest/m2/audit-deps.md) - every dependency earns its weight, preferring fewer, and the rest are current, deduplicated, and the best maintained option
-- [Dead code and API surface audit](/quest/m2/audit-dead-code.md) - repeat the removal audit before the next major release
-- [Typecheck with bun check](/quest/m2/bun-check.md) - workspace packages typecheck through bun once nixpkgs ships bun 1.4.4
-- [Adopt formatter defaults after evaluating Bun](/quest/m2/formatter-defaults.md) - every language uses its formatter's defaults, YAML and Markdown are formatted, and remark is gone in one coordinated migration
-- [Test coverage audit](/quest/m2/audit-test-coverage.md) - repeat the coverage audit against the m1 baselines after the next release ships
-- [Documentation audit](/quest/m2/audit-docs.md) - repeat the docs audit after the release ships, against the m1 baselines
-- [Test cost audit](/quest/m2/audit-test-cost.md) - the slowest, flakiest, and least valuable tests are deleted by default, or else fixed or planned, once the release ships
-
-- [Quest tree audit](/quest/m2/audit-quests.md) - repeat the whole-tree audit after the release ships, against the m1 baseline
-- [CI workflow audit](/quest/m2/audit-ci.md) - repeat the per-workflow and per-job review after the release ships, against the m1 baselines
-- [Performance audit](/quest/m2/audit-perf.md) - benchmarks that regressed since the m1 run are explained, fixed, or planned, and unbenched hot paths get coverage
-- [Simplification audit](/quest/m2/audit-simplify.md) - repeat the simplification audit, starting with the m1 leftovers, after the release ships
-- [Upstream unknown-env option in usage-rs](/quest/m2/usage-unknown-env.md) - jdx/usage refuses unknown prefixed env vars, replacing the moq-tokio helper
-- [Upstream single-declaration settings in usage-rs](/quest/m2/usage-settings-once.md) - waiting on approval to post, then jdx/usage builds the registry from Cli fields
-- [Artifact size audit](/quest/m2/audit-size.md) - repeat the shipping, native, and browser attribution after the release ships
-- [Compile time audit](/quest/m2/audit-compile-time.md) - build-time hotspots are measured against the m1 baselines, starting with the transport share now that moq-net compiles once, and the worst are removed, made cheaper, or planned
-- [Lint override and deprecation audit](/quest/m2/audit-lints.md) - repeat the suppression and deprecation audit after the release ships, starting with clippy on the macOS and Windows targets
-- [Archive reads against a real store](/quest/m2/archive-store-bench.md) - LIST/GET counts and latency over track count
-- [Branch checks lint examples](/quest/m2/lint-examples.md) - `just check` runs clippy on the selected crates' examples, and PR CI builds the C++, Go, and Python interop clients
-- [Drop kio's epoch fence](/quest/m2/crossbeam-pin-fence.md) - waiting on crossbeam#1352, then the `Read::drop` fence goes
-- [A cancelled miss stops waiting](/quest/m2/fill-wait-cancel-test.md) - a test proves a relay miss waiting on its own fill ends when no reader wants it
-- [No MOQ_* knobs outside the binaries](/quest/m2/env-knobs.md) - test, bench, and library knobs leave the `MOQ_*` prefix
-- [Clean ALSA playback onset](/quest/m2/audio-alsa-onset.md) - no onset restarts or clicks over PulseAudio
-- [Interop audit](/quest/m2/audit-interop.md) - our interop runner entries match what we ship, and every red interop cell with a moq.dev side is fixed, reported, or noted as down or unsupported
-- [moq-hls exposes each rendition's bound source](/quest/m2/hls-rendition-source.md) - playlists and segments report the source path and instance they read, so a cache can key on the source
-- [The HLS server follows each path once](/quest/m2/hls-follow-once.md) - `Following` reports synced absence, so moq-hls resolves with one follow
-- [moq-bench pins the instances it measures](/quest/m2/bench-epoch-pin.md) - pooled requests pin their announced epoch, so a takeover is not counted as the same broadcast
-- [moq-bench reports sub-millisecond latency](/quest/m2/bench-latency-resolution.md) - steady-window latency resolves finer than 1 ms
-- [Benchmark series stay meaningful](/quest/m2/bench-hygiene.md) - a warm `burst` variant, stale series pruned, and slow-group `bytes` kept out of series names
-- [The memory bench finishes at 1 MiB frames](/quest/m2/memory-bench-hang.md) - the allocation mode's park at `size=1048576` is root-caused and fixed
-- [Audio's Latest start reaches back](/quest/m2/audio-latest-reach-back.md) - moq_audio's start covers min plus warmup like other consumers
-- [moq-lite tails count drops](/quest/m2/lite-tail-drop-count.md) - SUBSCRIBE_DROP accounting replaces the session-tail grace from lite-05
-- [Re-run the SPS fuzzer on h264-reader](/quest/m2/sps-fuzz-h264-reader.md) - the H.264 SPS overflow is rechecked on the new parser
-- [Drop the H.265 SPS pre-walk once scuffle is fixed](/quest/m2/scuffle-sps-bump.md) - waiting on ScuffleCloud/scuffle#653 and #654 releases, then bump and drop the walk
-- [Audio track changes are gapless](/quest/m2/gapless-audio-switch.md) - no silence beyond a frame on audio format or rendition changes, enforced by media QA
-- [PCM encodes in one pass](/quest/m2/pcm-bulk-encode.md) - the PCM encoder converts a frame in bulk instead of one sample at a time
-- [We own our WebRTC stack](/quest/m2/webrtc/README.md) - moq-rtc becomes moq-webrtc with moq-ice, the data-channel transport, and a vendored, trimmed str0m/dimpl/is/sctp-proto
-- [PUBLISH_DONE says why](/quest/m2/publish-done-codes.md) - GOING_AWAY, TOO_FAR_BEHIND, and EXPIRED round-trip as stream codes
-- [A revoked announce resets instead of FINning](/quest/m2/announce-revoke-reset.md) - a PUBLISH_NAMESPACE revoked after its OK resets with INTERNAL_ERROR, per draft-22 §6.4.2.3
-- [moq repair refuses a live recording](/quest/m2/mp4-repair-lock.md) - the recorder's advisory lock keeps `moq repair mp4` off a file still being written
-- [The error-queue reader decodes truncated control data](/quest/m2/errqueue-truncation.md) - `MSG_ERRQUEUE` keeps what fit on `MSG_CTRUNC`, like the receive paths
-- [The QUIC driver tells an MTU probe from an oversized send](/quest/m2/quic-emsgsize-classify.md) - a non-probe `EMSGSIZE` is logged and counted instead of dropped silently
-- [moq-quic's internal dev-dependencies are path-only](/quest/m2/quic-dev-dep-path.md) - moq-congestion is a path dev-dependency
-- [moq-mux's AAC config reports SBR](/quest/m2/aac-sbr-config.md) - moq-audio reads backward-compatible SBR from the config
-- [fMP4 decode times from the declared reorder depth](/quest/m2/fmp4-declared-clock.md) - `DeclaredClock` replaces the sub-GOP cadence cap, as in TS, FLV, and MKV
-- [An ended HLS playlist has no trailing gap](/quest/m2/hls-trailing-gap.md) - no zero-duration `EXT-X-GAP` before `EXT-X-ENDLIST`
-- [moq-video's Apple Sink encodes on its own thread](/quest/m2/apple-sink-thread.md) - macOS and iOS ladders never encode on a tokio worker
-- [/fetch answers from the announce sync](/quest/m2/fetch-synced.md) - a missing broadcast gets a 404 once announcements are synced, not after 30 s
-- [An advertisement stuck on a zero-credit peer gives up](/quest/m2/advertise-credit-timeout.md) - A Rust moq-transport publisher whose PUBLISH_NAMESPACE or namespace update cannot leave because the peer grants no send credit gives up on it within a bounded time, as it already does on a silent answer: it resets the request and frees its state
-- [aec::Processor's edge cases are tested](/quest/m2/aec-tests.md) - moq-audio tests cover `aec::Processor` at the extremes of its accepted input
-- [A failed archive time lookup fails the subscription](/quest/m2/archive-time-followups.md) - when an `archive::Consumer` cannot answer a `Time(pts)` lookup because a store GET fails or an object does not decode, the subscription fails with a typed error naming the lookup failure instead of silently falling back to the cache
-- [moq-sock's control buffer is sized for the send options too](/quest/m2/cmsg-len-send.md) - `cmsg::LEN` in moq-sock is derived from, or checked at compile time against, both the receive options and the send options
-- [A panic inside moq-tokio's connection internals fails callers instead of panicking them](/quest/m2/connection-panic-isolation.md) - after a moq-tokio QUIC connection driver panics, every client-side caller gets the connection's terminal error instead of panicking in its own task, and the certificate reload watcher and qmux driver tasks are supervised
-- [No large future in the FFI layers can overflow a runtime or foreign thread's stack](/quest/m2/ffi-future-size.md) - every future moq-c and moq-ffi spawn or block on is below a size bound that a lint enforces, so unoptimized builds stay inside the runtime thread stack
-- [A browser test covers GPU encoder death and a broadcast rename](/quest/m2/gpu-encoder-death-test.md) - A real-browser test makes `@moq/publish`'s video encoder fail mid-stream
-- [An empty tail stream for a headless moq-transport group creates no group](/quest/m2/headless-empty-tail.md) - when a moq-transport subscription's fill for the Largest Group fails, an empty subgroup stream for that headless group is dropped instead of creating an empty group that reads as complete
-- [A recording stalled on an open group reports what it waits for](/quest/m2/hls-stalled-segment.md) - when a moq-hls recording waits on a listed segment whose group a still connected publisher never closes, the wait is visible
-- [A kept draft-18 join pins its head group](/quest/m2/ietf-join-pin-head.md) - on draft 18, a joining FETCH that our publisher keeps open after a quick finish is answered even if the publisher drops its `track::Producer` right after `finish()`
-- [The JS player keeps a track's start when decoding from its first packet](/quest/m2/js-warmup-trim.md) - `@moq/watch` trims an audio track's catalog `warmup` only on a mid-stream join, as moq-audio does
-- [kio::Tasks tolerates a removed task's waker firing into its reused slot](/quest/m2/kio-tasks-waker-test.md) - A unit test in `rs/kio/src/task.rs` shows that when a task taken out with `Tasks::remove` wakes after another task was `insert`ed into its slot, the new occupant is polled at most once spuriously, still finishes on its own wake (handed back through `poll_each`), and its `TaskKey` still removes it
-- [moqsrc reconnects correctly whatever order events arrive in](/quest/m2/moqsrc-reconnect-order.md) - A moq-gst test reconnects `moqsrc` while a rendition pad is blocked downstream, delivering the reconnect's events
-- [A library recorder gets the takeover cut](/quest/m2/mux-source-cut.md) - A recorder built directly with `moq_hls::export::Broadcaster::new` ends a replaced instance's recording at what it listed when another publisher takes the broadcast over, exactly as one built through `Server::broadcaster` does
-- [The relay NixOS module's peer list is tested](/quest/m2/nix-relay-peers-test.md) - `nix flake check` evaluates the moq-relay NixOS module with no, one, and several `cluster.rootUrl` peers and refuses an empty list, asserting the `MOQ_CLUSTER_CONNECT` value each produces
-- [The OBS source joins audio at the live edge](/quest/m2/obs-decode-latest.md) - the OBS MoQ source's audio decoder starts at the newest cached group instead of replaying the track's backlog, so a reconnect or rendition change plays live audio at once
-- [OBS simulcast layers reach moq-watch from a live OBS, including the dock's Go Live](/quest/m2/obs-multitrack-check.md) - A live OBS 32.2.2 run, recorded in the PR, shows the `WHIPSimulcastTotalLayers` profile setting attaching two or more scaled video encoders to `moq_output`, each published as its own rendition and watched in `<moq-watch>`, both through the obs-websocket recipe in `doc/bin/obs.md` and through the MoQ dock's Go Live, which honors the profile's layer count instead of creating a single encoder
-- [Opus export never writes a channel mapping it can't stand behind](/quest/m2/opus-surround-export.md) - exporting a catalog Opus rendition with 3 to 8 channels and no description writes a `dOps` with the Vorbis family 1 mapping table, as the TS importer assumes, instead of an invalid family 0 `dOps`
-- [Open-GOP MPEG-2 export trims leading B-pictures in zero-stuffed CBR streams](/quest/m2/pes-hold-open-gop.md) - A TS export starting or resuming inside an open GOP of MPEG-2 video drops the orphaned leading B-pictures even when their PES ends on zero stuffing, as CBR encoders emit, without ever trimming part of a reference picture whose start code straddles two PES packets
-- [A multi-program TS import survives a source switch](/quest/m2/ts-multi-program-restart.md) - `--program all` restarts each affected program on an unannounced source switch, as a single-program import does after moq-dev/moq#7780, instead of ending the whole import
-- [The lite publisher tells transport faults from cancels](/quest/m2/publish-cancel-classify.md) - `rs/moq-net`'s lite publisher no longer counts every `Error::Transport` as a clean cancel
-- [moq-quic's sim pair fails a test that sends an oversized packet](/quest/m2/quic-sim-mtu.md) - A moq-quic test whose endpoint sends a datagram larger than the simulated path MTU fails, instead of the `Pair` silently dropping it
-- [A stalled reader within budget gets no Old resets through a relay](/quest/m2/relay-capped-credit-test.md) - A test proves that a subscriber which stalls before its first read, behind a relay over a transport with capped stream credit, receives no `Old` stream resets for groups still within its max-delay budget, and reads them in order once it resumes
-- [In-memory transports refuse a request without stream credit](/quest/m2/sim-credit-open.md) - moq-net's in-memory test transports model the peer's bidirectional stream credit, and `poll_open_request` returns `Ok(None)`
-- [The tenant matrix's HTTP checks assert exact refusals](/quest/m2/tenant-leak-checks.md) - the relay tenant matrix's HTTP check asserts a definite outcome for each cross-tenant request, so it cannot pass by timing out or by an unexpected status
-- [The test inventory follows every branch selection](/quest/m2/test-inventory-followups.md) - `sh/gh/test-inventory.py` judges every check by the dispatcher branch its caller actually selects, including the cargo-fuzz caller check, the recipe-runs-tests check
-- [tls:// sessions report their negotiated ALPN](/quest/m2/tls-link-alpn.md) - A session accepted on a `tls://` listener reports the negotiated moq ALPN in `Link::alpn`, as raw QUIC, WebTransport, and WebSocket sessions already do, so admission and logs see the protocol on every transport
-- [PUBLISH token renewal is consistent across pause and forward, and the multi-token cost is profiled](/quest/m2/token-auth-followups.md) - on a moq-transport session, a REQUEST_UPDATE carrying an AUTHORIZATION TOKEN on a PUBLISH gets the same answer whether the PUBLISH is paused or forwarding
-- [HTTP auth servers see which request named a token](/quest/m2/auth-http-request-kind.md) - the HTTP auth contract forwards `auth::Request`'s `kind()` and `path()`
-- [moq-uring's handle lifecycle tests cover the newly spawned queue and a woken close watcher](/quest/m2/uring-lifecycle-tests.md) - two regressions cover the shutdown paths moq-dev/moq#7309 added
-- [Watch tests wait for the change they expect](/quest/m2/watch-test-waits.md) - `js/watch` tests wait for the signal or state they assert on instead of a fixed number of event-loop yields, so they neither flake under load nor pass before the change happens
-- [JS eviction tests prove the eviction happened](/quest/m2/track-test-eviction-asserts.md) - `track.test.ts`'s eviction tests fail with eviction off
-- [Nightly runs zizmor's online workflow audits](/quest/m2/workflow-audit-followups.md) - nightly runs zizmor's online audits
-- [moq auth sign mints capped tokens](/quest/m2/auth-sign-caps.md) - CLI flags for the bitrate caps
-- [QUIC-LB forwarding reads the cluster's peers and reports its counts](/quest/m2/quic-lb-forward-extras.md) - a cluster-API peer map and forward counters
-- [An audio-only broadcast that can't play hides its play button](/quest/m2/audio-only-play.md) - center-play follows the audio-only rule, proven by a browser test
-- [moq-quic's long header type is one variant](/quest/m2/quic-long-type.md) - collapse LongType after the 0-RTT removal
-- [One predicate for the lite close wait](/quest/m2/subscriber-fin-fold.md) - fold waits_for_subscriber_fin into has_track_stream
-- [Browsers expose WebTransport receive credit](/quest/m2/browser-receive-credit.md) - condition: the page can tell how much credit an unread stream holds
-- [JS fastest-reader pacing](/quest/m2/js-fastest-reader.md) - `@moq/net` paces upstream groups by the fastest reader, once browsers allow it
-- [fMP4 import at 1-byte chunks is no slower than before](/quest/m2/fmp4-byte-chunk-perf.md) - bisect and fix or accept the ~19% slowdown at 1-byte chunks
-- [The relay bench reports io_uring pool size and RSS](/quest/m2/bench-uring-pool.md) - pool growth regressions show up in normal bench runs
-- [MKV imports ffmpeg's multichannel FLAC](/quest/m2/mkv-flac-channel-mask.md) - a channel-mask-only Vorbis comment is accepted, so default ffmpeg multichannel FLAC needs no remux
-- [The bindings' TrackInfo docs list its real fields](/quest/m2/track-info-docs.md) - Swift, Kotlin and Dart stop naming ordering and latency budget on `TrackInfo`
-- [Kotlin dependencies live in a Gradle version catalog](/quest/m2/kt-version-catalog.md) - one catalog entry per library, so a Dependabot bump can't drag another along
-- [The dev shell builds Kotlin with Gradle 9](/quest/m2/kt-gradle-9.md) - `gradle_9` in the dev shell, so the Android target builds there
-- [The publish support panel lists only codecs publishing accepts](/quest/m2/publish-support-probe.md) - the settings panel runs the publisher's Annex B encoder probe
-- [A hung Python test fails instead of hanging the suite](/quest/m2/py-test-timeouts.md) - one pytest-timeout bound covers every `py/` test
-- [Chromium's Opus encoder stamps chunks from their input](/quest/m2/chromium-opus-timestamps.md) - waiting on Chromium; unlocks native `usedtx` for push-to-talk
-- [TLS reload follows symlinked certificate files](/quest/m2/watch-symlink-targets.md) - in-place rewrites of symlink targets in other directories reload roots, served chains, and client certificates
+- [Drop set](/quest/m1/drop-set.md) - each cursor judges missing groups against its own budget, so a narrow reader drops promptly and a widening re-offers groups already reported dropped on lite-07 (held in m1 by an open claim)
+- [Subscribe ranges](/quest/m2/subscribe-ranges/README.md) - a lite-07 SUBSCRIBE asks for past and live ranges with absolute or relative ends, in either order, and replaces FETCH for multi-group reads (single-group FETCH stays); merged ranges never starve a subscriber; relays fill misses by range, including over moq-transport
+- [Address groups by timestamp](/quest/m2/time-addressing/README.md) - group start timestamps replace sequence numbers in the moq-net API and lite-07 wire, while old subscribers, old publishers, and published JS clients keep working
+- [A smaller, safer API than release](/quest/m1/api-audit/README.md) - every surface added since release has a consumer or is gone, overlapping operations are collapsed, names mirror across Rust, JS, and the bindings, and every break says how to migrate (held in m1 by an open claim)
+- [Cluster routing](/quest/m2/cluster-routing/README.md) - prove shared routing contracts, implement per-origin routes, and connect outbound local clusters
+- [A job's exact route continues its claim's readers](/quest/m2/announce-takeover.md) - a job's route inherits its claim's instance, replacing the ANNOUNCE_TAKEOVER predecessor design
+- [A group a subscriber gives up on is always reported](/quest/m2/group-drops.md) - the wire names every abandoned group and the drop signal is public, so readers count losses instead of stalling
+- [Datagram tracks](/quest/m1/datagram-tracks/README.md) - a track is datagrams or streams; datagram tracks have their own request and sequence, no ranges, no cache, and map to object ID 0 on moq-transport (held in m1 by an open claim)
+- [Stream credit by priority](/quest/m1/stream-credit/README.md) - every stream opens through one priority entry point, and a higher-priority group takes over or resets a lower one when credit runs out (held in m1 by an open claim)
+- [Finalize moq-lite-07](/quest/m2/lite07-finalize.md) - when the maintainer cuts it, lite-07 negotiates as `moq-lite-07` and the next release ships it
+- [Unbounded groups](/quest/m2/unbounded-groups/README.md) - groups and frames lose their size caps; a group keeps a 32 MB tail, and readers behind it replay through paced flights or refresh
+- [Session policy lives in moq-net](/quest/m1/session-policy/README.md) - accept and connect deadlines, admission, window widening and reconnect live once in moq-net; moq-tokio and moq-relay's io_uring path call them (held in m1 by an open claim)
+- [Rename moq-rtc to moq-webrtc](/quest/m2/webrtc-rename.md) - one published `moq-webrtc` crate holds the gateway, the ICE driver, and the data-channel transport
+- [MoQ on rind](/quest/m1/rind/README.md) - every MoQ crate takes its crypto from rind, a pure-Rust graviola fork, so no build compiles C crypto (held in m1 by an open claim)
+- [Cut readiness](/quest/m2/cut-gate/README.md) - the checks the cut needs that break nothing: main no slower than release, vendored fixes ported, the pre-cut audit re-run, and moq-c at parity
+- [Probe](/quest/m2/probe/README.md) - a session probes up to the bitrate it wants to send or receive, so a stopped simulcast rendition resumes and a viewer up-switches; the browser pads where native sessions retransmit (held in m2 by an open claim; moves to m3)
+- [Finish the milestone re-cut](/quest/m2/recut-held.md) - claim-held epics move to the milestone their kind and priority give them once their claims merge
diff --git a/quest/m1/announce-takeover.md b/quest/m2/announce-takeover.md
similarity index 98%
rename from quest/m1/announce-takeover.md
rename to quest/m2/announce-takeover.md
index 21374432811..710e5ae1799 100644
--- a/quest/m1/announce-takeover.md
+++ b/quest/m2/announce-takeover.md
@@ -133,8 +133,8 @@ broadcast "identity" was renamed `instance` on 2026-11-01 (maintainer, in
 IDENTITY is now the instance.
 
 - Reword "takeover" as an event or operation, in terms of instance
-  continuity, in [moq-bench pins the instances it measures](/quest/m2/bench-epoch-pin.md)
-  (Goal and Plan) and [the HLS server follows each path once](/quest/m2/hls-follow-once.md)
+  continuity, in [moq-bench pins the instances it measures](/quest/m4/bench-epoch-pin.md)
+  (Goal and Plan) and [the HLS server follows each path once](/quest/m4/hls-follow-once.md)
   (Goal and Tests).
 - Rewrite the EPOCH references in `drafts/draft-lcurley-moq-cluster.md` and
   `drafts/draft-lcurley-moq-epoch.md` in terms of the instance.
@@ -154,4 +154,4 @@ beyond [Instance and epoch](https://github.com/moq-dev/moq/pull/7489)'s fields.
 
 - [Claim answer epochs](https://github.com/moq-dev/moq/pull/5678) - why a restarted job must never be stitched to its predecessor
 - [Retired requests](https://github.com/moq-dev/moq/pull/5294) - replacements never substitute content into held handles
-- [Routes and announces](/quest/m1/cluster-routing/routes/README.md) - the route layer whose ANNOUNCE_START layout carries the instance
+- [Routes and announces](/quest/m2/cluster-routing/routes/README.md) - the route layer whose ANNOUNCE_START layout carries the instance
diff --git a/quest/m1/cluster-routing/README.md b/quest/m2/cluster-routing/README.md
similarity index 91%
rename from quest/m1/cluster-routing/README.md
rename to quest/m2/cluster-routing/README.md
index 21329a1909b..7c315622dc2 100644
--- a/quest/m1/cluster-routing/README.md
+++ b/quest/m2/cluster-routing/README.md
@@ -10,7 +10,7 @@ copies cannot revive a claim after its withdrawal is known.
 
 Reliability, federation, and P2P are independently shippable milestones of
 this architecture. Active/passive delivery health is a separate
-[route-health line](/quest/m2/route-health/README.md), shared by endpoints
+[route-health line](/quest/m5/route-health/README.md), shared by endpoints
 and relays, and applies only to broadcasts with epochs.
 
 ## Plan
@@ -57,7 +57,7 @@ Decided with the maintainer, 2026-10-13:
   2026-10-14; own identities included 2026-10-26, since they are no longer
   proven.) The issuer-qualified subject key was dropped 2026-11-02
   (maintainer); since 2026-11-04 a scoped peer's identities are keyed by the
-  route key it proves ([Route session integration](/quest/m1/cluster-routing/routes/session.md)).
+  route key it proves ([Route session integration](/quest/m2/cluster-routing/routes/session.md)).
 - Matching explicit epochs authorize resume. Epochless changes retain
   Restart and fresh resolution; neither node identity nor a healthy
   alternate grants permission to splice content.
@@ -79,7 +79,7 @@ Decided with the maintainer, 2026-10-13:
   sent routes learned from other connections. Relays default on;
   applications choose per P2P connection (on for redundancy, off for
   conference offload). Browser tabs stay off until the
-  [Rust-to-TypeScript](/quest/m2/rs2ts-js.md) port. Applications
+  [Rust-to-TypeScript](/quest/m5/rs2ts-js.md) port. Applications
   explicitly select P2P connections; discovery does not dial everyone.
 - Each CDN broadcast enters a local network once by configuration: local
   peers outrank a backup uplink, and origin aggregation joins the rest.
@@ -90,7 +90,7 @@ Decided with the maintainer, 2026-10-13:
 
 The handoff proof showed a complete neighbor snapshot does not prove its
 claims are current; receivers merge origin-versioned views by floor instead.
-The routing contract is recorded in [Routes and announces](/quest/m1/cluster-routing/routes/README.md)
+The routing contract is recorded in [Routes and announces](/quest/m2/cluster-routing/routes/README.md)
 with deterministic counterexamples: path-only subscriptions that reselect
 origins at every hop loop and deadlock, so forwarded requests name their
 identity; feasibility makes transit priorities depend on arrival order;
@@ -113,7 +113,7 @@ The 300 ms update hold alone is no longer the baseline. Keep regression
 coverage for announcement churn, idle work, active continuity, and retained
 state separately; fewer control bytes does not prove cheaper runtime work.
 
-The earlier simulator estimates remain in [Routes and announces](/quest/m1/cluster-routing/routes/README.md).
+The earlier simulator estimates remain in [Routes and announces](/quest/m2/cluster-routing/routes/README.md).
 They do not prove the handoff correct; its fixtures do. Preserve public synthetic
 fixtures and controlled-time regressions, including residual stale revival,
 not only results from deployment tooling. Do not claim per-origin aggregation
@@ -122,7 +122,7 @@ reduces origin count when every application publishes one broadcast.
 Non-goals: measured RTT/loss pricing by default, cache-dependent route prices,
 TURN, browser transit, full link-state topology, or cross-operator economic
 exchange rates. Basic federation does not wait for
-[routing cost domains](/quest/m3/routing-cost-domains.md).
+[routing cost domains](/quest/m5/routing-cost-domains.md).
 
 Each implementation updates the docs it makes stale. The separate
 [routing guide](/quest/m1/routing-guide.md) explains the combined design and
@@ -130,13 +130,13 @@ setup after the capabilities land.
 
 ## Required
 
-- [Routes and announces](/quest/m1/cluster-routing/routes/README.md) - implement the proven route layer with Rust/JS parity and tiered-cluster acceptance
-- [Outbound federation](/quest/m1/cluster-routing/federation.md) - an outbound-only local relay exchanges authorized broadcasts with the CDN and survives partition/healing
+- [Routes and announces](/quest/m2/cluster-routing/routes/README.md) - implement the proven route layer with Rust/JS parity and tiered-cluster acceptance
+- [Outbound federation](/quest/m2/cluster-routing/federation.md) - an outbound-only local relay exchanges authorized broadcasts with the CDN and survives partition/healing
 
 ## Related
 
-- [Route health](/quest/m2/route-health/README.md) - epoch-only active/passive delivery monitoring and automatic recovery
-- [P2P](/quest/m2/p2p/README.md) - application-selected peer sessions feed the shared routing model
-- [Routing guide](/quest/m1/routing-guide.md) - concept page and federation setup; P2P extends it in m2
-- [Route wakes](/quest/m2/route-wakes.md) - local work follows affected fronts rather than the whole covered table
-- [Link quality](/quest/m2/link-quality.md) - optional measured link cost, distinct from delivery-health failover
+- [Route health](/quest/m5/route-health/README.md) - epoch-only active/passive delivery monitoring and automatic recovery
+- [P2P](/quest/m4/p2p/README.md) - application-selected peer sessions feed the shared routing model
+- [Routing guide](/quest/m1/routing-guide.md) - concept page and federation setup; P2P extends it in m4
+- [Route wakes](/quest/m4/route-wakes.md) - local work follows affected fronts rather than the whole covered table
+- [Link quality](/quest/m5/link-quality.md) - optional measured link cost, distinct from delivery-health failover
diff --git a/quest/m1/cluster-routing/federation.md b/quest/m2/cluster-routing/federation.md
similarity index 91%
rename from quest/m1/cluster-routing/federation.md
rename to quest/m2/cluster-routing/federation.md
index 03ff65e0b22..118ea5ebf64 100644
--- a/quest/m1/cluster-routing/federation.md
+++ b/quest/m2/cluster-routing/federation.md
@@ -18,11 +18,11 @@ Use authenticated, namespace-scoped admission: the CDN scopes the local
 relay's connection to a path prefix, and identities it sends, its own and its
 local publishers', are qualified, so a forger or a misconfigured uplink only
 affects its own scope (decided 2026-10-14; see [Routes and
-announces](/quest/m1/cluster-routing/routes/README.md)). Decided 2026-11-04
+announces](/quest/m2/cluster-routing/routes/README.md)). Decided 2026-11-04
 (maintainer): those identities are keyed by the route key the peer proves,
 read from a key file the local relay's uplinks share ([Route session
-integration](/quest/m1/cluster-routing/routes/session.md), [Scoped peers prove
-a route key](/quest/m1/cluster-routing/routes/proof.md)). Without a key, a
+integration](/quest/m2/cluster-routing/routes/session.md), [Scoped peers prove
+a route key](/quest/m2/cluster-routing/routes/proof.md)). Without a key, a
 scoped forger declaring a victim's id captures claims outside its scope
 (`forged_identity_hijacks_claims_outside_the_forgers_scope`). The scope itself
 (`hash(scope, id)`) was rejected 2026-10-15, and the grant's issuer-qualified
@@ -64,10 +64,10 @@ Rust/JS parity. Run `just check`, `just test interop --all`, and `just drafts ch
 
 ## Required
 
-- [Routes and announces](/quest/m1/cluster-routing/routes/README.md) - identity, scoped claims, reachability, and export policy
+- [Routes and announces](/quest/m2/cluster-routing/routes/README.md) - identity, scoped claims, reachability, and export policy
 
 ## Related
 
-- [Scoped peers prove a route key](/quest/m1/cluster-routing/routes/proof.md) - the key this connection's identities are qualified under
-- [Route health](/quest/m2/route-health/README.md) - epoch-only detection of stalled delivery on still-open links
+- [Route health](/quest/m5/route-health/README.md) - epoch-only detection of stalled delivery on still-open links
+- [Scoped peers prove a route key](/quest/m2/cluster-routing/routes/proof.md) - the key this connection's identities are qualified under
 - [Routing guide](/quest/m1/routing-guide.md) - runnable operator setup after integration
diff --git a/quest/m1/cluster-routing/routes/README.md b/quest/m2/cluster-routing/routes/README.md
similarity index 97%
rename from quest/m1/cluster-routing/routes/README.md
rename to quest/m2/cluster-routing/routes/README.md
index c3369242f93..a73b38b918b 100644
--- a/quest/m1/cluster-routing/routes/README.md
+++ b/quest/m2/cluster-routing/routes/README.md
@@ -13,14 +13,14 @@ claim whose withdrawal is already known.
 
 ## Plan
 
-1. ✅ Decided 2026-11-05 (maintainer, /quest-plan): **The draft describes the target before the code switches.** A hop-less ANNOUNCE cannot run before the router drives sessions; the quest's own Plan says so. So the draft now specifies the whole lite-07 route wire, while main's lite-07 session keeps sending hop-based ANNOUNCEs until [Route session integration](https://github.com/moq-dev/moq/blob/main/quest/m1/cluster-routing/routes/session.md) lands. lite-07 is unpublished `-wip`, off by default, and the epic lands in one release before the cut. The other option was to put only the new message sections in the draft and leave ANNOUNCE hop-based. I rejected it because ANNOUNCE_FLOOR's "for that route" and the Route ID would then be undefined in the draft.
+1. ✅ Decided 2026-11-05 (maintainer, /quest-plan): **The draft describes the target before the code switches.** A hop-less ANNOUNCE cannot run before the router drives sessions; the quest's own Plan says so. So the draft now specifies the whole lite-07 route wire, while main's lite-07 session keeps sending hop-based ANNOUNCEs until [Route session integration](https://github.com/moq-dev/moq/blob/main/quest/m2/cluster-routing/routes/session.md) lands. lite-07 is unpublished `-wip`, off by default, and the epic lands in one release before the cut. The other option was to put only the new message sections in the draft and leave ANNOUNCE hop-based. I rejected it because ANNOUNCE_FLOOR's "for that route" and the Route ID would then be undefined in the draft.
 2. ✅ Decided 2026-11-05 (maintainer, /quest-plan): **The request field is `Node ID (i)`, with 0 meaning "the publisher selects".** It is added to every request that resolves a path: TRACK, TRACKS, SUBSCRIBE, FETCH, and DATAGRAMS. Node ID 0 is reserved everywhere.
 3. ✅ Decided 2026-11-05 (maintainer, /quest-plan): **ROUTE_REQUEST names a Node ID, not a Route ID.** A request can then never race a ROUTE_END into a protocol violation.
 4. ~~A held ROUTE_UPDATE carries a seqno and down-only bit of 0.~~ Superseded by item 14: a held route is its own message and carries no seqno or bit.
 5. ✅ Decided 2026-11-05 (maintainer, /quest-plan): **Floor regions have no order, and a repeated region is a violation.** A sorted order would need Rust's `Path` ordering reproduced exactly in JS. Decoding into a map rejects duplicates at the same cost. Superseded the same day by item 10, which removes regions.
 6. ✅ Decided 2026-11-05 (maintainer, /quest-plan): **The Hop setup parameter and ANNOUNCE_OK's Hop ID are dropped from lite-07.** Their only roles were path-vector exclusion and the implicit trailing hop. ANNOUNCE_OK reserves no body for a route-key proof: [moq-dev/moq#7937](https://github.com/moq-dev/moq/pull/7937), accepted the same day, proves the route key once per session in SETUP. The live hop-based codec still switches in session integration, as choice 1 requires.
 7. ✅ Decided 2026-11-05 (maintainer, /quest-plan): **An echo naming a Route ID that was never ended, or was already echoed, is a violation at the publisher.** The publisher can check this from its live and unacknowledged ids alone, with no growing state.
-8. ✅ Decided 2026-11-05 (maintainer, /quest-plan): **ANNOUNCE_TAKEOVER keeps its shape, with a Route ID in place of hops, and its predecessor must be under the same route.** [quest/m1/announce-takeover.md](https://github.com/moq-dev/moq/blob/main/quest/m1/announce-takeover.md) deletes the message, so this keeps the change minimal.
+8. ✅ Decided 2026-11-05 (maintainer, /quest-plan): **ANNOUNCE_TAKEOVER keeps its shape, with a Route ID in place of hops, and its predecessor must be under the same route.** [quest/m2/announce-takeover.md](https://github.com/moq-dev/moq/blob/main/quest/m2/announce-takeover.md) deletes the message, so this keeps the change minimal.
 9. ✅ Decided 2026-11-05 (maintainer, /quest-plan): **Unknown announce types stay skipped by length on lite-06+**, as before. An unknown reply type is refused.
 10. ✅ Decided 2026-11-05 (maintainer, /quest-plan): **ANNOUNCE_FLOOR is a marker, not a region list:** `{Route ID, Revision}`. It closes a batch and certifies the stream's claims for that route across the whole requested prefix as the origin's at that Revision. A publisher that cannot vouch for the whole requested prefix at one Revision still closes the batch, with a floor that certifies nothing, encoded per item 13. Regions, the replacing list, and the 65,535-byte overflow go away. Accepted cost: a relay with partial knowledge of an origin certifies nothing for that route, so a receiver lets its stale claims go only on ROUTE_END. Rejected: one region per message; a multipart atomic list.
 11. ✅ Decided 2026-11-05 (maintainer, /quest-plan): **Clamped claims collapse to the best one.** When several of a route's claims cover a request's prefix (`live` at cost 10 and `live/a` at cost 1, request `live/a/x`), the publisher presents only the most specific, and when it is withdrawn moves the presented claim to the next covering one with ANNOUNCE_UPDATE or ANNOUNCE_RESTART instead of ending it. No wire change; one live claim per prefix per route holds, and a receiver merges claims at the prefix each stream presents them. Rejected: carrying each claim's ancestor depth.
@@ -40,7 +40,7 @@ fixtures still run only on the reference model in
 `rs/moq-net/tests/integration/routing_contracts/`. Nothing drives the router
 on the wire yet. The children below carry the rest, in order, and land in
 one release: lite-07 carries the route layer as a whole
-([lite-07 finalize](/quest/m1/lite07-finalize.md) waits on this epic). This
+([lite-07 finalize](/quest/m2/lite07-finalize.md) waits on this epic). This
 README holds the routing contract every child implements.
 
 Decided 2026-11-03 (maintainer, on
@@ -57,14 +57,14 @@ Settled by the core, for review:
   region, or rebuild them all if a lost floor is newer than a kept one, a
   collection whose replay is bounded like any other. The core and the proof
   keep per-region floors internally; the wire carries only item 10's
-  whole-interest marker, which [session integration](/quest/m1/cluster-routing/routes/session.md)
+  whole-interest marker, which [session integration](/quest/m2/cluster-routing/routes/session.md)
   projects the view onto.
 - A rotated identity ends the old one with ROUTE_END on every stream rather
   than closing sessions, since the own identity is no longer proven per
   session.
 
 Keep the 2026-10-01 two-layer direction, reconciled with the maintainer's
-2026-10-13 [decisions](/quest/m1/cluster-routing/README.md) and the routing
+2026-10-13 [decisions](/quest/m2/cluster-routing/README.md) and the routing
 contract below. The routing contract's remaining model fixtures live in
 `rs/moq-net/tests/integration/routing_contracts/` and run against a small reference model;
 port each topology to the implementation as acceptance, then delete the model.
@@ -161,8 +161,8 @@ the bullets below are the contract it carries.
   keyed by the route key the peer proves, so relays configured with the same
   key file fail over as one; a scoped peer that proves no key, such as one on
   qmux, gets a per-session key
-  ([session integration](/quest/m1/cluster-routing/routes/session.md),
-  [Scoped peers prove a route key](/quest/m1/cluster-routing/routes/proof.md)).
+  ([session integration](/quest/m2/cluster-routing/routes/session.md),
+  [Scoped peers prove a route key](/quest/m2/cluster-routing/routes/proof.md)).
   The router takes the key from the caller (`Scope::qualify`).
 - Decided 2026-10-14: qualified keys carry a marker every relay recognizes,
   and a scoped connection forwarding an already qualified identity has that
@@ -532,14 +532,14 @@ benchmarks.
 
 ## Required
 
-- [Scoped peers prove a route key](/quest/m1/cluster-routing/routes/proof.md) - records the session proof decision and implementation
-- [Route session integration](/quest/m1/cluster-routing/routes/session.md) - one router per origin node drives the origin and every lite-07 announce stream
-- [Announcement availability](/quest/m1/cluster-routing/routes/availability.md) - announcements report availability, and a let-go is offline rather than END, in Rust and JS
-- [js/net route layer](/quest/m1/cluster-routing/routes/js.md) - `js/net` encodes, decodes, and resolves the route layer
-- [Route layer acceptance](/quest/m1/cluster-routing/routes/acceptance.md) - forwarding fixtures ported and the model deleted, incident fixtures, end-to-end checks, and benchmarks
+- [Scoped peers prove a route key](/quest/m2/cluster-routing/routes/proof.md) - records the session proof decision and implementation
+- [Route session integration](/quest/m2/cluster-routing/routes/session.md) - one router per origin node drives the origin and every lite-07 announce stream
+- [Announcement availability](/quest/m2/cluster-routing/routes/availability.md) - announcements report availability, and a let-go is offline rather than END, in Rust and JS
+- [js/net route layer](/quest/m2/cluster-routing/routes/js.md) - `js/net` encodes, decodes, and resolves the route layer
+- [Route layer acceptance](/quest/m2/cluster-routing/routes/acceptance.md) - forwarding fixtures ported and the model deleted, incident fixtures, end-to-end checks, and benchmarks
 
 ## Related
 
-- [Route wakes](/quest/m2/route-wakes.md) - index work follows the settled source-selection model
-- [Route health](/quest/m2/route-health/README.md) - epoch-only progress observation and local delivery failover
-- [A route stream's interest is a set of prefixes](/quest/m2/route-interest-prefixes.md) - m2: one stream's interest covers several prefixes
+- [Route wakes](/quest/m4/route-wakes.md) - index work follows the settled source-selection model
+- [Route health](/quest/m5/route-health/README.md) - epoch-only progress observation and local delivery failover
+- [A route stream's interest is a set of prefixes](/quest/m5/route-interest-prefixes.md) - m5: one stream's interest covers several prefixes
diff --git a/quest/m1/cluster-routing/routes/acceptance.md b/quest/m2/cluster-routing/routes/acceptance.md
similarity index 96%
rename from quest/m1/cluster-routing/routes/acceptance.md
rename to quest/m2/cluster-routing/routes/acceptance.md
index b4eda63a89f..c792a7450c4 100644
--- a/quest/m1/cluster-routing/routes/acceptance.md
+++ b/quest/m2/cluster-routing/routes/acceptance.md
@@ -84,9 +84,9 @@ regressions. Bound pending requests and freshness state under same-clock churn.
 
 ## Required
 
-- [Route session integration](/quest/m1/cluster-routing/routes/session.md) - the implementation under test
-- [js/net route layer](/quest/m1/cluster-routing/routes/js.md) - the JS side of the interop checks
+- [Route session integration](/quest/m2/cluster-routing/routes/session.md) - the implementation under test
+- [js/net route layer](/quest/m2/cluster-routing/routes/js.md) - the JS side of the interop checks
 
 ## Related
 
-- [Routes and announces](/quest/m1/cluster-routing/routes/README.md) - the contract and its fixtures
+- [Routes and announces](/quest/m2/cluster-routing/routes/README.md) - the contract and its fixtures
diff --git a/quest/m1/cluster-routing/routes/availability.md b/quest/m2/cluster-routing/routes/availability.md
similarity index 85%
rename from quest/m1/cluster-routing/routes/availability.md
rename to quest/m2/cluster-routing/routes/availability.md
index 30c4e8d0382..07d86b25b54 100644
--- a/quest/m1/cluster-routing/routes/availability.md
+++ b/quest/m2/cluster-routing/routes/availability.md
@@ -19,12 +19,12 @@ ends them. Bindings mirror Rust.
 - Build on [Listing and follow](https://github.com/moq-dev/moq/pull/7678)'s
   listing and its offline report rather than adding event kinds beside it.
 - JS gets the API shape here, fed by what `js/net` knows today; the
-  [js/net route layer](/quest/m1/cluster-routing/routes/js.md) feeds it from the wire.
+  [js/net route layer](/quest/m2/cluster-routing/routes/js.md) feeds it from the wire.
 
 ## Required
 
-- [Route session integration](/quest/m1/cluster-routing/routes/session.md) - the router whose held and let-go states this reports
+- [Route session integration](/quest/m2/cluster-routing/routes/session.md) - the router whose held and let-go states this reports
 
 ## Related
 
-- [Routes and announces](/quest/m1/cluster-routing/routes/README.md) - the handoff contract's held and let-go states
+- [Routes and announces](/quest/m2/cluster-routing/routes/README.md) - the handoff contract's held and let-go states
diff --git a/quest/m1/cluster-routing/routes/js.md b/quest/m2/cluster-routing/routes/js.md
similarity index 79%
rename from quest/m1/cluster-routing/routes/js.md
rename to quest/m2/cluster-routing/routes/js.md
index ddc67171a1c..0426fdc7758 100644
--- a/quest/m1/cluster-routing/routes/js.md
+++ b/quest/m2/cluster-routing/routes/js.md
@@ -7,7 +7,7 @@ ROUTE and ANNOUNCE_FLOOR, merges announcements by floor as the contract
 says, echoes every ROUTE_END, and pins each request to the identity it
 selected. Browsers stay non-transit: a tab advertises its own identity and
 publications only, with `proxy` off, until the
-[Rust-to-TypeScript](/quest/m2/rs2ts-js.md) port; P2P reuses this model
+[Rust-to-TypeScript](/quest/m5/rs2ts-js.md) port; P2P reuses this model
 rather than adding a browser forwarding engine.
 
 ## Plan
@@ -16,13 +16,13 @@ Decided 2026-10-27 (maintainer), from
 [moq-dev/moq#6947](https://github.com/moq-dev/moq/pull/6947): in `js/net`'s
 `origin.ts` a detached request stays on its own route instead of following
 the cheapest one; fix it with the route-selection rework here.
-- Feed the availability API from [Announcement availability](/quest/m1/cluster-routing/routes/availability.md).
+- Feed the availability API from [Announcement availability](/quest/m2/cluster-routing/routes/availability.md).
 - Rust/JS interop covers the route messages, the floor marker, and the echo.
 
 ## Required
 
-- [Announcement availability](/quest/m1/cluster-routing/routes/availability.md) - the API this feeds
+- [Announcement availability](/quest/m2/cluster-routing/routes/availability.md) - the API this feeds
 
 ## Related
 
-- [Routes and announces](/quest/m1/cluster-routing/routes/README.md) - the contract
+- [Routes and announces](/quest/m2/cluster-routing/routes/README.md) - the contract
diff --git a/quest/m1/cluster-routing/routes/proof.md b/quest/m2/cluster-routing/routes/proof.md
similarity index 95%
rename from quest/m1/cluster-routing/routes/proof.md
rename to quest/m2/cluster-routing/routes/proof.md
index c585f4ea172..87f26a4f37d 100644
--- a/quest/m1/cluster-routing/routes/proof.md
+++ b/quest/m2/cluster-routing/routes/proof.md
@@ -7,7 +7,7 @@ every identity a scoped, proven peer sends, its own included, under
 H(domain, proven key, id). Relays sharing a key file fail over as one;
 unscoped peers stay bare and unproven scoped peers get a per-session key.
 Proof production and verification are implemented by this PR; filing belongs
-to [Route session integration](/quest/m1/cluster-routing/routes/session.md).
+to [Route session integration](/quest/m2/cluster-routing/routes/session.md).
 
 ## Plan
 
@@ -46,4 +46,4 @@ signature. No ANNOUNCE_OK proof body is needed by this draft or implementation;
 
 ## Related
 
-- [Route session integration](/quest/m1/cluster-routing/routes/session.md) - files identities under the proven key
+- [Route session integration](/quest/m2/cluster-routing/routes/session.md) - files identities under the proven key
diff --git a/quest/m1/cluster-routing/routes/session.md b/quest/m2/cluster-routing/routes/session.md
similarity index 98%
rename from quest/m1/cluster-routing/routes/session.md
rename to quest/m2/cluster-routing/routes/session.md
index fcbae7fba94..53002f8076c 100644
--- a/quest/m1/cluster-routing/routes/session.md
+++ b/quest/m2/cluster-routing/routes/session.md
@@ -148,5 +148,5 @@ admission.
 
 ## Related
 
-- [Routes and announces](/quest/m1/cluster-routing/routes/README.md) - the contract
-- [Route wakes](/quest/m2/route-wakes.md) - index work follows the settled source-selection model
+- [Routes and announces](/quest/m2/cluster-routing/routes/README.md) - the contract
+- [Route wakes](/quest/m4/route-wakes.md) - index work follows the settled source-selection model
diff --git a/quest/m2/cut-gate/README.md b/quest/m2/cut-gate/README.md
new file mode 100644
index 00000000000..3efa252b501
--- /dev/null
+++ b/quest/m2/cut-gate/README.md
@@ -0,0 +1,38 @@
+# [S] Cut readiness
+
+## Goal
+
+Before each cut of `main` into `release`, the checks the cut needs that break
+nothing have passed: `main` is no slower than `release`, vendored code has
+the upstream fixes it needs, the pre-cut audit's findings are fixed, and the
+hand-written `moq-c` is at parity with moq-ffi. This epic's own work, once
+every entry under `Required` has merged: confirm the children's results still
+hold on the release candidate commit and record that commit in the
+[release cut](/quest/m3/release/cut.md)'s Plan.
+
+## Plan
+
+Decided 2026-11-05 (maintainer, milestone re-cut): the cut waits on m2 alone,
+so the checks that gate it without breaking anything live under one recurring
+gate in m2 instead of in m1, where the cut no longer looks.
+
+Recurs once per release cycle, always in m2. It does not re-create itself:
+m2 holds it and the cut requires m2, so a copy made before the cut would
+block that cut forever. The release cut's PR re-creates it at this path while
+it shifts the milestones, after removing this path from every `Required`. The
+new gate keeps this Goal and this paragraph, gets a fresh "main is no slower
+than release" child with its Goal and no measurements yet, and takes the
+[vendor sync](/quest/m2/cut-gate/vendor-sync/README.md) questline that this
+run re-created in m3. The pre-cut audit is a one-time child and does not
+recur. Only `/quest-delete` ends the recurrence.
+
+Held by an open claim at the re-cut: [release-perf](/quest/m1/release-perf/README.md)
+stays in m1 until its claim merges, so this gate lists it as a blocker; the
+[re-cut follow-up](/quest/m2/recut-held.md) moves what remains of it here.
+
+## Required
+
+- [Pre-cut audit findings](/quest/m2/cut-gate/cut-audit/README.md) - fix the crashes, hostile-input costs, and correctness bugs the 2026-10-24 audit of main found
+- [Vendored code has every upstream fix it needs](/quest/m2/cut-gate/vendor-sync/README.md) - quinn, libv4l-rs, nvidia-video-codec-sdk, rust-media-libs, cros-codecs, and UniFFI generator fixes are ported or planned, once per release cycle
+- [Main is no slower than release](/quest/m1/release-perf/README.md) - every benchmark where main is slower than release is fixed or accepted with a reason (held in m1 by an open claim)
+- [moq-c at parity](/quest/m2/cut-gate/c/README.md) - the hand-written `moq-c` ships at the cut with every binding feature moq-ffi gains
diff --git a/quest/m1/c/README.md b/quest/m2/cut-gate/c/README.md
similarity index 85%
rename from quest/m1/c/README.md
rename to quest/m2/cut-gate/c/README.md
index bc87069b587..0d4a3133999 100644
--- a/quest/m1/c/README.md
+++ b/quest/m2/cut-gate/c/README.md
@@ -3,7 +3,7 @@
 ## Goal
 
 The hand-written `moq-c` crate (`rs/moq-c`, `moq.h`) ships at this cut at the
-shared 0.22 minor with every binding feature moq-ffi gains in m1, so a C user
+shared 0.22 minor with every binding feature moq-ffi gains in m1 or m2, so a C user
 can do whatever a Python, Swift, Kotlin, Go, Dart, or C++ user can. The C
 interop client and every `doc/lib/c` sample build and run against the built
 release archive before the cut.
@@ -11,7 +11,7 @@ release archive before the cut.
 ## Plan
 
 Decided 2026-10-25 (maintainer): the hand-written crate ships at this cut and
-the [generated C line](/quest/m2/c/README.md) moves after it, waiting on the
+the [generated C line](/quest/m3/c/README.md) moves after it, waiting on the
 switch to rust2's UniFFI fork. The generated package (`c/moq`) builds in CI,
 but it publishes only after the cut. C users break
 twice (to 0.22 at this cut, then to the generated package at a later cut);
@@ -21,12 +21,12 @@ published package (CONTRIBUTING.md's [Versions](/CONTRIBUTING.md#versions),
 then 0.8 line of its own.
 
 - moq-c is not frozen: it takes the same breaks as moq-ffi and the other
-  bindings. Every m1 quest or PR that changes the binding API changes
+  bindings. Every m1 or m2 quest or PR that changes the binding API changes
   `rs/moq-c` in the same PR, with its Impact migration note and `doc/lib/c`
   update; none waits on the generated package.
-- Before the cut, diff the moq-ffi exports against `moq.h` and add any m1
+- Before the cut, diff the moq-ffi exports against `moq.h` and add any m1 or m2
   binding feature still missing, so parity is checked rather than assumed.
 - `rs/moq-c` publishes through release-plz like the other crates; confirm the
   release produces the C archive the samples are checked against.
 
-Public API: moq-c gains each m1 binding feature. Wire: none.
+Public API: moq-c gains each m1 or m2 binding feature. Wire: none.
diff --git a/quest/m1/cut-audit/README.md b/quest/m2/cut-gate/cut-audit/README.md
similarity index 80%
rename from quest/m1/cut-audit/README.md
rename to quest/m2/cut-gate/cut-audit/README.md
index dca7f048b3e..304e8fd5ad9 100644
--- a/quest/m1/cut-audit/README.md
+++ b/quest/m2/cut-gate/cut-audit/README.md
@@ -6,7 +6,7 @@ Resolve the bugs and hostile-input costs found by the 2026-10-24 pre-cut
 audit of main before main is promoted to release. This epic's own work, once
 every child has merged: re-run the reproductions the children record against
 the release candidate and hand the result to the
-[release cut](/quest/m2/release/cut.md).
+[release cut](/quest/m3/release/cut.md).
 
 ## Plan
 
@@ -36,24 +36,24 @@ Churn context: main landed about 2,400 commits in the 30 days before the
 audit, 823 of them fixes, concentrated in `rs/moq-net` (`model/track.rs` 85
 fix commits, `ietf/subscriber.rs` 69, `ietf/publisher.rs` 53,
 `lite/subscriber.rs` 51, `model/resume.rs` 46) and `js/net`. The audit's
-redesign proposals for the churning mechanisms are in m2, since each is
+redesign proposals for the churning mechanisms are in m3 and m4, since each is
 internal and can ship after the cut:
-[resume as producer replacement](/quest/m2/resume-redesign.md),
-[moq-transport request leases](/quest/m2/ietf-request-lease.md),
-[group heads filled in place](/quest/m2/ietf-fill-refill.md),
+[resume as producer replacement](/quest/m4/resume-redesign.md),
+[moq-transport request leases](/quest/m3/ietf-request-lease.md),
+[group heads filled in place](/quest/m3/ietf-fill-refill.md),
 moqsrc pad actors and publish rendition identity (both since landed). The
 [one relay serve path](/quest/m1/session-policy/uring.md) proposal moved into
 m1 on 2026-11-04, as part of moving session policy into moq-net before the
 cut. Other redesign evidence went into the quests that already own the
 mechanism:
-[subscribe ranges](/quest/m1/subscribe-ranges/README.md),
+[subscribe ranges](/quest/m2/subscribe-ranges/README.md),
 [drop set](/quest/m1/drop-set.md),
-[per-origin routes](/quest/m1/cluster-routing/routes/README.md),
+[per-origin routes](/quest/m2/cluster-routing/routes/README.md),
 drafts 14-17 removal (since landed), and
 [buffered playback](/quest/m1/buffered-ascending.md). The audit recommends
-leaving JS-only redesigns of `js/net` to [rs2ts](/quest/m2/rs2ts-js.md).
+leaving JS-only redesigns of `js/net` to [rs2ts](/quest/m5/rs2ts-js.md).
 
 ## Related
 
-- [Announce interest streams share one route table](/quest/m2/announce-interest-memory.md) - the audit's inherited announce memory finding
-- [A parked read of a resumed group reads its budget without re-syncing](/quest/m2/recover-budget.md) - measure-first resume cost
+- [Announce interest streams share one route table](/quest/m4/announce-interest-memory.md) - the audit's inherited announce memory finding
+- [A parked read of a resumed group reads its budget without re-syncing](/quest/m5/recover-budget.md) - measure-first resume cost
diff --git a/quest/m1/vendor-sync/README.md b/quest/m2/cut-gate/vendor-sync/README.md
similarity index 90%
rename from quest/m1/vendor-sync/README.md
rename to quest/m2/cut-gate/vendor-sync/README.md
index a825e7007fe..4210ed05715 100644
--- a/quest/m1/vendor-sync/README.md
+++ b/quest/m2/cut-gate/vendor-sync/README.md
@@ -38,13 +38,14 @@ This README's own work, once every child has merged:
    vendored commit. Code whose upstream is gone or frozen (moq-tokio's
    `quic::web`, from moq-dev/noq) is listed in the README it lives in and
    gets no child.
-2. Re-create the questline at `/quest/m2/vendor-sync/`, linked from
-   `/quest/m2/README.md`'s `Required`. Every child keeps its Goal and carries
+2. Re-create the questline at `/quest/m3/vendor-sync/`, linked from
+   `/quest/m3/README.md`'s `Required`. Every child keeps its Goal and carries
    forward its last checked commit and what this run learned (what to check
    first, what was ruled out). Each child requires
-   [the release cut](/quest/m2/release/cut.md), which removes itself from
-   every `Required` and shifts m2 into m1, so the next run becomes ready in the
-   new m1, once per release cycle.
+   [the release cut](/quest/m3/release/cut.md), which removes itself from
+   every `Required` and moves the questline under the re-created
+   [cut gate](/quest/m2/cut-gate/README.md) in m2, so the next run becomes
+   ready there, once per release cycle (rule replaced 2026-11-05).
 3. Drop a child whose code was deleted or whose upstream stopped mattering,
    saying why in the PR.
 
@@ -70,7 +71,7 @@ Until the exporter switch, mirror any generator fixes into rust2's maintenance
 fork too and add them to the exporter quest's carried-over list, so the new
 generators retain them. rust2's fork is maintenance-only since 2026-11-02.
 Drop the UniFFI child once
-[the exporter switch](/quest/m2/ffi-exporter.md) lands.
+[the exporter switch](/quest/m3/ffi-exporter.md) lands.
 
 Out of scope: forks moq no longer consumes (moq-dev/quiche, moq-dev/noq,
 kixelated/cros-codecs, kixelated/openh264-rs, kixelated/fflate) and the
@@ -92,4 +93,4 @@ cros-codecs `a050c6cde530e563197ee9e3e72ab01f48a0c41f`.
 
 ## Related
 
-- [Dependency audit](/quest/m2/audit-deps.md) - covers crates cargo-deny can see
+- [Dependency audit](/quest/m3/audit-deps.md) - covers crates cargo-deny can see
diff --git a/quest/m1/group-drops.md b/quest/m2/group-drops.md
similarity index 100%
rename from quest/m1/group-drops.md
rename to quest/m2/group-drops.md
diff --git a/quest/m1/lite07-finalize.md b/quest/m2/lite07-finalize.md
similarity index 89%
rename from quest/m1/lite07-finalize.md
rename to quest/m2/lite07-finalize.md
index 509dac6eadc..c8099055a51 100644
--- a/quest/m1/lite07-finalize.md
+++ b/quest/m2/lite07-finalize.md
@@ -13,7 +13,7 @@ then roll lite-07 out without a wip wire changing under it.
 Decided 2026-10-05 by the maintainer: finalizing lite-07 is upstream work
 with its own quest. Until now nothing upstream owned it, while downstream
 rollouts waited on it and the
-[mesh condition](/quest/m3/lite07-mesh.md) here waited on moq.pro. This quest
+[mesh condition](/quest/m5/lite07-mesh.md) here waited on moq.pro. This quest
 waits on nothing outside the repository; the rollouts and the mesh condition
 follow it.
 
@@ -24,12 +24,12 @@ until the maintainer calls the cut. This quest is the mechanical rename and
 checks done at that call; the Required list is the work already known to land
 first, not a closed freeze set.
 
-The route layer of [Cluster routing](/quest/m1/cluster-routing/README.md)
+The route layer of [Cluster routing](/quest/m2/cluster-routing/README.md)
 (ROUTE_START/UPDATE/END, path-less ANNOUNCE, the hop list dropped) lands in
 lite-07, decided 2026-10-05. That removes lite-07's `Hop Base`/`Hop Keep`
 announce compression along with the hop list, and moq.pro's lite-07 rollout
 has to plan for a lite-07 without hop lists. Only
-[Routes and announces](/quest/m1/cluster-routing/routes/README.md) gates the cut,
+[Routes and announces](/quest/m2/cluster-routing/routes/README.md) gates the cut,
 not the later federation/P2P integrations. Decided 2026-10-13: routes now
 owns the tier/partition correctness tests, so they run before the cut. Peer
 grants and metadata-only subscriptions do not gate it: neither is clustering
@@ -39,7 +39,7 @@ gates the cut, and lite-07 routing identities stay declared and unverified
 (2026-11-02: peer grants are dropped and no key proof is planned). Reversed
 2026-11-04 (maintainer, /quest-unblock): a peer proves a route key before the
 cut, which landed as lite-07's Route Key Setup Parameter; its routes are filed
-under it in [Routes and announces](/quest/m1/cluster-routing/routes/README.md). Decided 2026-10-26
+under it in [Routes and announces](/quest/m2/cluster-routing/routes/README.md). Decided 2026-10-26
 (maintainer): receivers do not stamp per-session identities either, since
 that splits one origin into several identities across a relay mesh.
 
@@ -82,11 +82,11 @@ only on lite-07. Lite-07 now defines the padding datagram type and both receiver
 discard it.
 The `Time(pts)` range end rides in the subscribe-ranges children already Required.
 
-Decided 2026-10-27 (maintainer): of [Subscribe ranges](/quest/m1/subscribe-ranges/README.md),
+Decided 2026-10-27 (maintainer): of [Subscribe ranges](/quest/m2/subscribe-ranges/README.md),
 only the children that change the lite-07 wire gate the cut:
 Lite-07 ranges ([moq-dev/moq#7872](https://github.com/moq-dev/moq/pull/7872)),
 JS ranges ([moq-dev/moq#7696](https://github.com/moq-dev/moq/pull/7696)), and
-[Lite-07 FETCH is single-group only](/quest/m1/subscribe-ranges/lite07-fetch.md). The
+[Lite-07 FETCH is single-group only](/quest/m2/subscribe-ranges/lite07-fetch.md). The
 fill path, fetch as a range, and the start bookkeeping change no wire.
 
 Decided 2026-10-25 (maintainer): addressing groups by timestamp gates the
@@ -109,15 +109,15 @@ timestamp bound in [#6168](https://github.com/moq-dev/moq/pull/6168).
 
 ## Required
 
-- [Routes and announces](/quest/m1/cluster-routing/routes/README.md) - lite-07 carries the route layer: ROUTE per origin node and path-less ANNOUNCE, with the hop list gone
+- [Routes and announces](/quest/m2/cluster-routing/routes/README.md) - lite-07 carries the route layer: ROUTE per origin node and path-less ANNOUNCE, with the hop list gone
 - [Drop set](/quest/m1/drop-set.md) - lite-07's SUBSCRIBE_DROP carries `Max Age`, so a widening re-offers groups reported dropped
-- [Lite-07 FETCH is single-group only](/quest/m1/subscribe-ranges/lite07-fetch.md) - lite-07 FETCH reads one group or a slice of one, and SUBSCRIBE ranges of whole groups
-- [Lite-07 by start](/quest/m1/time-addressing/lite07.md) - lite-07 carries group starts, previous-start links, GROUP_END, and time bounds instead of sequence numbers
-- [@moq/net by start](/quest/m1/time-addressing/js.md) - JS speaks the same lite-07 wire
-- [A job's exact route continues its claim's readers](/quest/m1/announce-takeover.md) - the job's route inherits the claim's instance, with no new wire message
+- [Lite-07 FETCH is single-group only](/quest/m2/subscribe-ranges/lite07-fetch.md) - lite-07 FETCH reads one group or a slice of one, and SUBSCRIBE ranges of whole groups
+- [Lite-07 by start](/quest/m2/time-addressing/lite07.md) - lite-07 carries group starts, previous-start links, GROUP_END, and time bounds instead of sequence numbers
+- [@moq/net by start](/quest/m2/time-addressing/js.md) - JS speaks the same lite-07 wire
+- [A job's exact route continues its claim's readers](/quest/m2/announce-takeover.md) - the job's route inherits the claim's instance, with no new wire message
 - [Takeover](/quest/m1/stream-credit/takeover.md) - lite-07 lets a group stream take over for another group
 - [Datagram tracks](/quest/m1/datagram-tracks/README.md) - lite-07 subscribes to datagram tracks through their own request, and datagrams carry their own sequence
 
 ## Related
 
-- [The moq.pro mesh runs lite-07](/quest/m3/lite07-mesh.md) - the deployment condition that follows this
+- [The moq.pro mesh runs lite-07](/quest/m5/lite07-mesh.md) - the deployment condition that follows this
diff --git a/quest/m2/probe/README.md b/quest/m2/probe/README.md
index eb92d3c2b75..88931d6bae5 100644
--- a/quest/m2/probe/README.md
+++ b/quest/m2/probe/README.md
@@ -106,5 +106,5 @@ This README's own work, once the children land:
 
 ## Related
 
-- [BBR media study](/quest/m2/quic-bbr-study.md) - preserving an estimate and discovering spare capacity are separate problems
-- [Realtime uplink congestion control](/quest/m2/quic-realtime/README.md) - a delay-based alternative to BBR3 on native uplinks; it must implement native probing to ship (decided 2026-10-25)
+- [BBR media study](/quest/m5/quic-bbr-study.md) - preserving an estimate and discovering spare capacity are separate problems
+- [Realtime uplink congestion control](/quest/m3/quic-realtime/README.md) - a delay-based alternative to BBR3 on native uplinks; it must implement native probing to ship (decided 2026-10-25)
diff --git a/quest/m2/probe/browser-send-estimate.md b/quest/m2/probe/browser-send-estimate.md
index 0a71de3a50e..38fa0cb6687 100644
--- a/quest/m2/probe/browser-send-estimate.md
+++ b/quest/m2/probe/browser-send-estimate.md
@@ -19,4 +19,4 @@ Public API: none expected (the estimate's source is internal). Wire: none; PROBE
 
 ## Related
 
-- [Media stats](/quest/m2/stats/README.md) - its JS stats also read PROBE because `getStats()` is missing
+- [Media stats](/quest/m3/stats/README.md) - its JS stats also read PROBE because `getStats()` is missing
diff --git a/quest/m2/recut-held.md b/quest/m2/recut-held.md
new file mode 100644
index 00000000000..296a3e42c25
--- /dev/null
+++ b/quest/m2/recut-held.md
@@ -0,0 +1,38 @@
+# [XS] Finish the milestone re-cut
+
+## Goal
+
+The epics that open claims held in place during the 2026-11-05 milestone
+re-cut sit where the re-cut's rules put them. What remains of api-audit,
+datagram-tracks, drop-set, rind,
+session-policy, and stream-credit moves from m1 to m2; what remains of release-perf moves under
+the [cut gate](/quest/m2/cut-gate/README.md); and the
+probe epic moves from m2 to m3. The "held" notes in the m1, m2, and cut gate
+READMEs are removed, along with each held entry's extra link from m2's or
+the gate's `Required`.
+
+## Plan
+
+`quest mv` refuses to move a claimed quest, since its branch is its path, and
+a child must stay listed by its own epic, so each epic waited for its claimed
+children. Move each epic with `quest mv` once nothing in it is claimed; an
+epic whose claim finished all its work is already gone. Before moving,
+re-check what remains against the root [questline](/quest/README.md)'s rules:
+an epic with no breaking work left stays in m1, and one with no gating work
+left leaves the cut gate for m1. If a child is claimed again before this runs,
+leave its epic in place and keep this quest for it.
+Drop-set is a single quest, not an epic, so it has no `Required` entry here:
+when this runs, move it if it still exists and nothing claims it.
+
+Prose that names a held epic's milestone becomes stale when it moves; update
+it in the same PR: datagram tracks in [net-wrap](/quest/m5/net-wrap/README.md), and the browser
+padding probes in [lite07-finalize](/quest/m2/lite07-finalize.md).
+
+## Required
+
+- [Datagram answer race](/quest/m1/datagram-tracks/answer-race.md) - claim held datagram-tracks
+- [IETF datagram tracks](/quest/m1/datagram-tracks/ietf.md) - claim held datagram-tracks
+- [rind CPU error](/quest/m1/rind/cpu-error.md) - claim held rind
+- [Connect policy](/quest/m1/session-policy/connect.md) - claim held session-policy
+- [Release on leave](/quest/m1/stream-credit/release-on-leave.md) - claim held stream-credit
+- [Probe padding](/quest/m2/probe/padding.md) - claim held probe
diff --git a/quest/m1/subscribe-ranges/README.md b/quest/m2/subscribe-ranges/README.md
similarity index 94%
rename from quest/m1/subscribe-ranges/README.md
rename to quest/m2/subscribe-ranges/README.md
index d2229b41ee0..5fa1803948b 100644
--- a/quest/m1/subscribe-ranges/README.md
+++ b/quest/m2/subscribe-ranges/README.md
@@ -48,7 +48,7 @@ relay bounds a sparse FETCH only if the model can request ranges:
   our publishers answer only a one-group FETCH or fill and refuse wider ones
   (maintainer, 2026-10-28,
   [moq-dev/moq#7204](https://github.com/moq-dev/moq/pull/7204)), until
-  [hole markers](/quest/m2/ietf-hole-marker.md) let a cache that knows every
+  [hole markers](/quest/m5/ietf-hole-marker.md) let a cache that knows every
   group answer a range. A FETCH of the track's newest live group is refused
   unless its range ends below that group's live edge
   ([moq-dev/moq#7944](https://github.com/moq-dev/moq/pull/7944),
@@ -82,7 +82,7 @@ relay bounds a sparse FETCH only if the model can request ranges:
   forwards it upstream unchanged. An untimed track refuses a time end, and a
   moq-transport bridge resolves it locally or refuses it, since moq-transport
   has no time filter. It is part of lite-07 and must land before
-  [lite-07 finalizes](/quest/m1/lite07-finalize.md), which this line gates. This amends the 09-29
+  [lite-07 finalizes](/quest/m2/lite07-finalize.md), which this line gates. This amends the 09-29
   premise that ranges are group-only because a group's timestamp isn't always
   known: timed tracks know it, and untimed ones refuse. The cache half landed in its own PR after #5929.
   A datagram was judged on its own (maintainer, 2026-10-20). Superseded
@@ -102,10 +102,10 @@ every sequence delivered or dropped.
 
 ## Required
 
-- [JS head fills and time lookups](/quest/m1/subscribe-ranges/js-fills.md) - JS readers fill a cached group's missing head before handing it out, and look a time start up through `Fill.time`
-- [Lite-07 FETCH is single-group only](/quest/m1/subscribe-ranges/lite07-fetch.md) - lite-07 FETCH reads one group or a slice of one, and SUBSCRIBE ranges of whole groups, in Rust, JS, and the draft, with JS multi-group fills moving onto the subscription
-- [Delete the old start bookkeeping](/quest/m1/subscribe-ranges/start-bookkeeping.md) - what each lite cursor is owed and dropped lives in the model, and `TrackRun` only translates it per version
+- [JS head fills and time lookups](/quest/m2/subscribe-ranges/js-fills.md) - JS readers fill a cached group's missing head before handing it out, and look a time start up through `Fill.time`
+- [Lite-07 FETCH is single-group only](/quest/m2/subscribe-ranges/lite07-fetch.md) - lite-07 FETCH reads one group or a slice of one, and SUBSCRIBE ranges of whole groups, in Rust, JS, and the draft, with JS multi-group fills moving onto the subscription
+- [Delete the old start bookkeeping](/quest/m2/subscribe-ranges/start-bookkeeping.md) - what each lite cursor is owed and dropped lives in the model, and `TrackRun` only translates it per version
 
 ## Related
 
-- [Rust groups by start](/quest/m1/time-addressing/model.md) - the cut reworks `Absolute(group)` ends and sequence-range drops onto times
+- [Rust groups by start](/quest/m2/time-addressing/model.md) - the cut reworks `Absolute(group)` ends and sequence-range drops onto times
diff --git a/quest/m1/subscribe-ranges/js-fills.md b/quest/m2/subscribe-ranges/js-fills.md
similarity index 96%
rename from quest/m1/subscribe-ranges/js-fills.md
rename to quest/m2/subscribe-ranges/js-fills.md
index 130693fe2a4..c9ec518b99e 100644
--- a/quest/m1/subscribe-ranges/js-fills.md
+++ b/quest/m2/subscribe-ranges/js-fills.md
@@ -68,11 +68,11 @@ which also redefine the stale-drop judgment it relies on. Not chosen:
 splitting the `Fill.time` lookup off to start now.
 
 Decided 2026-11-05 (maintainer, /quest-audit): ✅ this also waits for
-[Lite-07 FETCH is single-group only](/quest/m1/subscribe-ranges/lite07-fetch.md),
+[Lite-07 FETCH is single-group only](/quest/m2/subscribe-ranges/lite07-fetch.md),
 which moves JS multi-group fills in the same `#runFills` onto the
 subscription.
 
 ## Required
 
 - [Drop set](/quest/m1/drop-set.md) - redefines the JS stale-drop judgment and fill code this rewrites
-- [Lite-07 FETCH is single-group only](/quest/m1/subscribe-ranges/lite07-fetch.md) - moves JS multi-group fills onto the subscription in the same `#runFills`
+- [Lite-07 FETCH is single-group only](/quest/m2/subscribe-ranges/lite07-fetch.md) - moves JS multi-group fills onto the subscription in the same `#runFills`
diff --git a/quest/m1/subscribe-ranges/lite07-fetch.md b/quest/m2/subscribe-ranges/lite07-fetch.md
similarity index 100%
rename from quest/m1/subscribe-ranges/lite07-fetch.md
rename to quest/m2/subscribe-ranges/lite07-fetch.md
diff --git a/quest/m1/subscribe-ranges/start-bookkeeping.md b/quest/m2/subscribe-ranges/start-bookkeeping.md
similarity index 95%
rename from quest/m1/subscribe-ranges/start-bookkeeping.md
rename to quest/m2/subscribe-ranges/start-bookkeeping.md
index 65a8275c00e..4701a4cd0e5 100644
--- a/quest/m1/subscribe-ranges/start-bookkeeping.md
+++ b/quest/m2/subscribe-ranges/start-bookkeeping.md
@@ -27,10 +27,10 @@ PR, becomes a `Required` link to [Drop set](/quest/m1/drop-set.md), since
 `lite/publisher.rs`).
 
 
-Moved out of the [Subscribe ranges](/quest/m1/subscribe-ranges/README.md)
+Moved out of the [Subscribe ranges](/quest/m2/subscribe-ranges/README.md)
 README's own work, where the 2026-10-24 pre-cut audit put it. Decided
 2026-10-27 (maintainer): a child quest of its own, since
-[Rust groups by start](/quest/m1/time-addressing/model.md) requires it before
+[Rust groups by start](/quest/m2/time-addressing/model.md) requires it before
 the cut moves this state onto times, while the rest of the README waits on
 every child.
 
diff --git a/quest/m1/time-addressing/README.md b/quest/m2/time-addressing/README.md
similarity index 69%
rename from quest/m1/time-addressing/README.md
rename to quest/m2/time-addressing/README.md
index d358f3f110a..a3bc0b72e75 100644
--- a/quest/m1/time-addressing/README.md
+++ b/quest/m2/time-addressing/README.md
@@ -11,11 +11,11 @@ compatibility.
 
 ## Required
 
-- [Rust groups by start](/quest/m1/time-addressing/model.md) - the moq-net model and API address groups by start, and legacy wires carry the start ticks as the group ID
-- [Lite-07 by start](/quest/m1/time-addressing/lite07.md) - lite-07 carries starts, previous-start links, GROUP_END, and time bounds instead of sequence numbers
-- [moq-transport IDs verbatim](/quest/m1/time-addressing/ietf.md) - group IDs pass through as keys, Prior Group ID Gap signals drops best-effort, END_OF_GROUP marks a whole group, and our Timestamp property goes
-- [@moq/net by start](/quest/m1/time-addressing/js.md) - JS matches Rust's model, wire, and legacy mapping
-- [Consumers by start](/quest/m1/time-addressing/consumers.md) - hang drops duration and discontinuity markers, and every consumer that numbered groups uses starts
-- [Bindings by start](/quest/m1/time-addressing/bindings.md) - moq-ffi, moq-c, and every binding expose starts, with migration docs
-- [E2EE nonce](/quest/m1/time-addressing/e2ee.md) - the nonce binds the start instead of the sequence
-- [Guide](/quest/m1/time-addressing/guide.md) - a page explaining seek by time, group ends, restarts, strictly increasing starts, and how legacy peers see group IDs
+- [Rust groups by start](/quest/m2/time-addressing/model.md) - the moq-net model and API address groups by start, and legacy wires carry the start ticks as the group ID
+- [Lite-07 by start](/quest/m2/time-addressing/lite07.md) - lite-07 carries starts, previous-start links, GROUP_END, and time bounds instead of sequence numbers
+- [moq-transport IDs verbatim](/quest/m2/time-addressing/ietf.md) - group IDs pass through as keys, Prior Group ID Gap signals drops best-effort, END_OF_GROUP marks a whole group, and our Timestamp property goes
+- [@moq/net by start](/quest/m2/time-addressing/js.md) - JS matches Rust's model, wire, and legacy mapping
+- [Consumers by start](/quest/m2/time-addressing/consumers.md) - hang drops duration and discontinuity markers, and every consumer that numbered groups uses starts
+- [Bindings by start](/quest/m2/time-addressing/bindings.md) - moq-ffi, moq-c, and every binding expose starts, with migration docs
+- [E2EE nonce](/quest/m2/time-addressing/e2ee.md) - the nonce binds the start instead of the sequence
+- [Guide](/quest/m2/time-addressing/guide.md) - a page explaining seek by time, group ends, restarts, strictly increasing starts, and how legacy peers see group IDs
diff --git a/quest/m1/time-addressing/bindings.md b/quest/m2/time-addressing/bindings.md
similarity index 88%
rename from quest/m1/time-addressing/bindings.md
rename to quest/m2/time-addressing/bindings.md
index 9a702667fa6..3734a4ec2cf 100644
--- a/quest/m1/time-addressing/bindings.md
+++ b/quest/m2/time-addressing/bindings.md
@@ -15,10 +15,10 @@ keep their optional timestamp"): every read and write carries a timestamp.
 Reads drop the `Option` that exact timestamps keeps for untimed, producer
 arguments take a required one, and nothing is wall-clock stamped. A
 scale-less track's frames carry their group's key. See
-[the model](/quest/m1/time-addressing/model.md).
+[the model](/quest/m2/time-addressing/model.md).
 
 Public API: breaking in every binding. Wire: none.
 
 ## Required
 
-- [Rust groups by start](/quest/m1/time-addressing/model.md) - the API these wrap
+- [Rust groups by start](/quest/m2/time-addressing/model.md) - the API these wrap
diff --git a/quest/m1/time-addressing/consumers.md b/quest/m2/time-addressing/consumers.md
similarity index 94%
rename from quest/m1/time-addressing/consumers.md
rename to quest/m2/time-addressing/consumers.md
index 71de05c780e..1a604c5cbce 100644
--- a/quest/m1/time-addressing/consumers.md
+++ b/quest/m2/time-addressing/consumers.md
@@ -42,5 +42,5 @@ discontinuity marker groups.
 
 ## Required
 
-- [Rust groups by start](/quest/m1/time-addressing/model.md) - the Rust API these consume
-- [@moq/net by start](/quest/m1/time-addressing/js.md) - the JS API these consume
+- [Rust groups by start](/quest/m2/time-addressing/model.md) - the Rust API these consume
+- [@moq/net by start](/quest/m2/time-addressing/js.md) - the JS API these consume
diff --git a/quest/m1/time-addressing/e2ee.md b/quest/m2/time-addressing/e2ee.md
similarity index 82%
rename from quest/m1/time-addressing/e2ee.md
rename to quest/m2/time-addressing/e2ee.md
index 9a2337a2259..777c366993f 100644
--- a/quest/m1/time-addressing/e2ee.md
+++ b/quest/m2/time-addressing/e2ee.md
@@ -17,5 +17,5 @@ Public API: none. Wire: the E2EE nonce input changes.
 
 ## Required
 
-- [Rust groups by start](/quest/m1/time-addressing/model.md) - the start the nonce binds
-- [@moq/net by start](/quest/m1/time-addressing/js.md) - the JS start the JS half binds
+- [Rust groups by start](/quest/m2/time-addressing/model.md) - the start the nonce binds
+- [@moq/net by start](/quest/m2/time-addressing/js.md) - the JS start the JS half binds
diff --git a/quest/m1/time-addressing/guide.md b/quest/m2/time-addressing/guide.md
similarity index 81%
rename from quest/m1/time-addressing/guide.md
rename to quest/m2/time-addressing/guide.md
index 69263938804..42a8e074f95 100644
--- a/quest/m1/time-addressing/guide.md
+++ b/quest/m2/time-addressing/guide.md
@@ -12,8 +12,8 @@ authors can follow it without reading the drafts.
 ## Plan
 
 Decided 2026-10-25 (maintainer): a separate page, not only inline doc
-updates. Write it against the design [the model](/quest/m1/time-addressing/model.md)
-and [lite-07](/quest/m1/time-addressing/lite07.md) quests record, including
+updates. Write it against the design [the model](/quest/m2/time-addressing/model.md)
+and [lite-07](/quest/m2/time-addressing/lite07.md) quests record, including
 that a released relay fills a hole with one FETCH per ID, so a mixed-version
 deployment upgrades its relays together. Link it from
 `doc/concept/moq-lite.md` and from the identity and recovery guide
@@ -21,4 +21,4 @@ deployment upgrades its relays together. Link it from
 
 ## Required
 
-- [Lite-07 by start](/quest/m1/time-addressing/lite07.md) - the wire this page describes
+- [Lite-07 by start](/quest/m2/time-addressing/lite07.md) - the wire this page describes
diff --git a/quest/m1/time-addressing/ietf.md b/quest/m2/time-addressing/ietf.md
similarity index 95%
rename from quest/m1/time-addressing/ietf.md
rename to quest/m2/time-addressing/ietf.md
index 572cfec285e..39037488e57 100644
--- a/quest/m1/time-addressing/ietf.md
+++ b/quest/m2/time-addressing/ietf.md
@@ -16,7 +16,7 @@ the 2026-10-25 plan that carried each object's PTS in TIMESTAMP (0x10) with
 TIMESCALE (0x08):
 
 - **The Group ID is the key**, verbatim on ingest and egress
-  ([the model](/quest/m1/time-addressing/model.md) owns that mapping). A
+  ([the model](/quest/m2/time-addressing/model.md) owns that mapping). A
   moq-transport track is in whatever unit its IDs are in; nothing infers
   time from its objects.
 - **No Timestamp property from us.** moq-net stops sending TIMESTAMP on
@@ -50,4 +50,4 @@ gains Prior Group ID Gap and END_OF_GROUP on whole groups.
 
 ## Required
 
-- [Rust groups by start](/quest/m1/time-addressing/model.md) - the model whose keys and gaps these carry
+- [Rust groups by start](/quest/m2/time-addressing/model.md) - the model whose keys and gaps these carry
diff --git a/quest/m1/time-addressing/js.md b/quest/m2/time-addressing/js.md
similarity index 79%
rename from quest/m1/time-addressing/js.md
rename to quest/m2/time-addressing/js.md
index acc66b04a4e..3dd4d1a2875 100644
--- a/quest/m1/time-addressing/js.md
+++ b/quest/m2/time-addressing/js.md
@@ -7,8 +7,8 @@ model, lite-07 wire, and legacy mapping, with the same names.
 
 ## Plan
 
-Mirror [the model](/quest/m1/time-addressing/model.md) and
-[the lite-07 wire](/quest/m1/time-addressing/lite07.md), including strictly
+Mirror [the model](/quest/m2/time-addressing/model.md) and
+[the lite-07 wire](/quest/m2/time-addressing/lite07.md), including strictly
 increasing starts, the three group ends, reach from a group's own end, and
 `Relative(n)` counting groups. The gap machinery that assumes `sequence + 1`
 (`delivered.ts`, `ledger.ts`, `track.ts`, `resume.ts`) follows
@@ -22,7 +22,7 @@ copies fill. JS ranges
 2026-10-27 decision required first, merged.
 
 Decided 2026-11-05 (maintainer, /quest-audit): ✅ this waits for
-[Lite-07 FETCH is single-group only](/quest/m1/subscribe-ranges/lite07-fetch.md),
+[Lite-07 FETCH is single-group only](/quest/m2/subscribe-ranges/lite07-fetch.md),
 which moves JS multi-group fills (`js/net/src/lite/subscriber.ts`
 `#runFills`) onto the subscription this rekeys.
 
@@ -30,5 +30,5 @@ Public API: breaking, mirroring Rust's. Wire: as the lite-07 quest.
 
 ## Required
 
-- [Lite-07 by start](/quest/m1/time-addressing/lite07.md) - the wire this speaks
-- [Lite-07 FETCH is single-group only](/quest/m1/subscribe-ranges/lite07-fetch.md) - moves the JS fills this rekeys onto the subscription
+- [Lite-07 by start](/quest/m2/time-addressing/lite07.md) - the wire this speaks
+- [Lite-07 FETCH is single-group only](/quest/m2/subscribe-ranges/lite07-fetch.md) - moves the JS fills this rekeys onto the subscription
diff --git a/quest/m1/time-addressing/lite07.md b/quest/m2/time-addressing/lite07.md
similarity index 90%
rename from quest/m1/time-addressing/lite07.md
rename to quest/m2/time-addressing/lite07.md
index 2451a045541..9f61909bb84 100644
--- a/quest/m1/time-addressing/lite07.md
+++ b/quest/m2/time-addressing/lite07.md
@@ -30,7 +30,7 @@ Decided 2026-10-25 (maintainer), from the spike:
 - `Timescale` 0 stays and means scale-less: keys and frame timestamps are
   bare numbers, and a scale-less frame carries its group's key (decided
   2026-11-03, maintainer: ingested legacy tracks with bare keys still cross
-  lite-07; see [the model](/quest/m1/time-addressing/model.md)). FRAME and
+  lite-07; see [the model](/quest/m2/time-addressing/model.md)). FRAME and
   datagrams always carry a timestamp. The untimed cases of
   TIMESTAMP_MISMATCH, Time anchors, and arrival-age-only expiry become the
   scale-less cases. The rule that a Group's frame
@@ -49,15 +49,15 @@ lite-07 changelog) and `doc/concept/moq-lite.md`, and run `just drafts check`
 and `just test interop --all`.
 
 Decided 2026-11-05 (maintainer, /quest-audit): ✅ this waits for
-[Lite-07 FETCH is single-group only](/quest/m1/subscribe-ranges/lite07-fetch.md),
+[Lite-07 FETCH is single-group only](/quest/m2/subscribe-ranges/lite07-fetch.md),
 which rewrites the same lite-07 draft sections (`Range`, Positions,
 SUBSCRIBE anchors).
 
-Public API: none beyond [the model](/quest/m1/time-addressing/model.md).
+Public API: none beyond [the model](/quest/m2/time-addressing/model.md).
 Wire: lite-07-wip GROUP, GROUP_END, SUBSCRIBE, SUBSCRIBE_UPDATE,
 SUBSCRIBE_OK, SUBSCRIBE_STARTED, SUBSCRIBE_FINISH, and SUBSCRIBE_DROP change.
 
 ## Required
 
-- [Rust groups by start](/quest/m1/time-addressing/model.md) - the model this wire carries
-- [Lite-07 FETCH is single-group only](/quest/m1/subscribe-ranges/lite07-fetch.md) - rewrites the same lite-07 draft sections first
+- [Rust groups by start](/quest/m2/time-addressing/model.md) - the model this wire carries
+- [Lite-07 FETCH is single-group only](/quest/m2/subscribe-ranges/lite07-fetch.md) - rewrites the same lite-07 draft sections first
diff --git a/quest/m1/time-addressing/model.md b/quest/m2/time-addressing/model.md
similarity index 96%
rename from quest/m1/time-addressing/model.md
rename to quest/m2/time-addressing/model.md
index 8db9afdfccc..d1f818bb25d 100644
--- a/quest/m1/time-addressing/model.md
+++ b/quest/m2/time-addressing/model.md
@@ -7,7 +7,7 @@ model carry no group sequence numbers, a reader seeks or starts from a time,
 and no producer remembers group numbers. Lite-01..06 and moq-transport peers
 keep working through a group ID equal to the start in the track's timescale,
 and lite-07-wip carries that same value until
-[the lite-07 wire](/quest/m1/time-addressing/lite07.md) replaces it.
+[the lite-07 wire](/quest/m2/time-addressing/lite07.md) replaces it.
 
 ## Plan
 
@@ -56,7 +56,7 @@ a producer would need per-track memory of its last number.
   subscribe-ranges children that put sequence ranges into the model and the
   wire, Lite-07 ranges ([moq-dev/moq#7872](https://github.com/moq-dev/moq/pull/7872),
   merged 2026-11-05) and
-  [Delete the old start bookkeeping](/quest/m1/subscribe-ranges/start-bookkeeping.md),
+  [Delete the old start bookkeeping](/quest/m2/subscribe-ranges/start-bookkeeping.md),
   not the whole epic. [Drop set](/quest/m1/drop-set.md) lands first too: its
   runs keyed by group sequence convert mechanically to starts.
 - **Old relays** (decided 2026-10-26, maintainer): a released relay fills a
@@ -150,8 +150,8 @@ moq-transport-18, direct and through a relay, against a contiguous baseline
 
 Update `doc/concept`, the lite draft's legacy mapping, and the
 Rust half of every consumer the API change breaks to compile;
-[consumers](/quest/m1/time-addressing/consumers.md) and
-[bindings](/quest/m1/time-addressing/bindings.md) own the behavior changes.
+[consumers](/quest/m2/time-addressing/consumers.md) and
+[bindings](/quest/m2/time-addressing/bindings.md) own the behavior changes.
 Test the legacy mapping both ways on every wire, with the
 resume model (`rs/moq-net/src/model/resume_model.rs`,
 `js/net/src/resume.model.test.ts`) as the oracle for resume.
@@ -165,5 +165,5 @@ Wire: no format change; legacy and lite-07-wip group IDs become start ticks.
 
 ## Required
 
-- [Delete the old start bookkeeping](/quest/m1/subscribe-ranges/start-bookkeeping.md) - the lite cursor state lives in the model before the cut rekeys it
+- [Delete the old start bookkeeping](/quest/m2/subscribe-ranges/start-bookkeeping.md) - the lite cursor state lives in the model before the cut rekeys it
 - [Drop set](/quest/m1/drop-set.md) - its dropped and expired runs convert mechanically from sequences to starts
diff --git a/quest/m1/unbounded-groups/README.md b/quest/m2/unbounded-groups/README.md
similarity index 96%
rename from quest/m1/unbounded-groups/README.md
rename to quest/m2/unbounded-groups/README.md
index 20cc1c0d66f..f834d61ce5e 100644
--- a/quest/m1/unbounded-groups/README.md
+++ b/quest/m2/unbounded-groups/README.md
@@ -33,7 +33,7 @@ flights:
   prefix is transferred once per flight. Carrying the inflater's state from the
   cached copy, and keeping refresh or `Evicted` for compressed groups, were
   rejected.
-- Paced batch fills are [their own quest](/quest/m1/unbounded-groups/paced-batch-fills.md).
+- Paced batch fills are [their own quest](/quest/m2/unbounded-groups/paced-batch-fills.md).
 - No cap on concurrent flights per group: memory is bounded by each flight's
   tail and pool debt, and the cost of more flights is upstream transfer.
   Revisit with relay evidence.
@@ -133,7 +133,7 @@ Decided 2026-10-16 (maintainer interview):
   (d854bf98b1), ahead of Front eviction, including `log::Writer::evict`
   advancing the base (`rs/kio/src/log.rs`). A ring buffer was rejected: an
   uncapped group has no size to give it. Numbers are in #6782 and the
-  [kio contention epic](/quest/m2/perf/kio-channel-contention/README.md).
+  [kio contention epic](/quest/m4/perf/kio-channel-contention/README.md).
   Accepted 2026-11-03 (maintainer), from the lock profiles in
   [moq-dev/moq#7742](https://github.com/moq-dev/moq/pull/7742): no
   lock-contention regression attributable to #6782. The pre-epoch run on
@@ -151,7 +151,7 @@ Decided 2026-10-16 (maintainer interview):
 - The byte offset goes on the current lite wip version (lite-07-wip today);
   the lite-07 cut does not wait on it. Decided 2026-10-27 (maintainer): wire
   quests target whichever wip is current when they land, so
-  [Byte holes](/quest/m1/unbounded-groups/byte-holes.md) waits only on Front
+  [Byte holes](/quest/m2/unbounded-groups/byte-holes.md) waits only on Front
   eviction and Flights. If lite-07 is cut first, lite-07 peers start flights
   only at frame boundaries, over lite-07's transport frame offsets, which
   allow a fill to start without the shed prefix (decided 2026-10-25,
@@ -178,7 +178,7 @@ the model layer (maintainer, 2026-10-30).
 
 ## Required
 
-- [Paced batch fills](/quest/m1/unbounded-groups/paced-batch-fills.md) - fills that write a batch of groups stop evicting their own earlier groups before the reader takes them
-- [Byte holes](/quest/m1/unbounded-groups/byte-holes.md) - segments inside a frame shed like front frames and flights start at `(frame, byte)` on the current lite wip; the frame cap goes
-- [JS byte holes](/quest/m1/unbounded-groups/js-byte-holes.md) - `@moq/net` mirrors the byte-offset wire and continues a frame cut off mid-way
-- [Compressed frames have no size cap and inflate as a bounded stream](/quest/m1/unbounded-groups/compressed-stream.md) - A compressed frame of any size publishes and is received in Rust and `@moq/net`, like a plain one
+- [Paced batch fills](/quest/m2/unbounded-groups/paced-batch-fills.md) - fills that write a batch of groups stop evicting their own earlier groups before the reader takes them
+- [Byte holes](/quest/m2/unbounded-groups/byte-holes.md) - segments inside a frame shed like front frames and flights start at `(frame, byte)` on the current lite wip; the frame cap goes
+- [JS byte holes](/quest/m2/unbounded-groups/js-byte-holes.md) - `@moq/net` mirrors the byte-offset wire and continues a frame cut off mid-way
+- [Compressed frames have no size cap and inflate as a bounded stream](/quest/m2/unbounded-groups/compressed-stream.md) - A compressed frame of any size publishes and is received in Rust and `@moq/net`, like a plain one
diff --git a/quest/m1/unbounded-groups/byte-holes.md b/quest/m2/unbounded-groups/byte-holes.md
similarity index 90%
rename from quest/m1/unbounded-groups/byte-holes.md
rename to quest/m2/unbounded-groups/byte-holes.md
index a428aaff5ba..a6ee9ba579a 100644
--- a/quest/m1/unbounded-groups/byte-holes.md
+++ b/quest/m2/unbounded-groups/byte-holes.md
@@ -10,20 +10,20 @@ are shed like front frames, and a flight
 
 ## Plan
 
-See the [epic](/quest/m1/unbounded-groups/README.md) for the decisions.
+See the [epic](/quest/m2/unbounded-groups/README.md) for the decisions.
 Decided 2026-10-27 (maintainer): the byte offset targets the current lite wip
 version (lite-07-wip today); the lite-07 cut does not wait on it. This follows
-[lite-07's freeze policy](/quest/m1/lite07-finalize.md): wire quests target
+[lite-07's freeze policy](/quest/m2/lite07-finalize.md): wire quests target
 whichever wip is current when they land, and its Required list is not a
 closed freeze set. If lite-07 is cut first, the offset goes on the next wip
 and lite-07 peers start flights only at frame boundaries, like older lite
 versions. Decided 2026-10-28 (maintainer): shed frames are served again only
-by flights, so this waits on Flights and stays in m1.
+by flights, so this waits on Flights and stays in m2 with its epic.
 
 Decided 2026-11-05 (maintainer, /quest-audit): ✅ the byte offset rides
 FETCH's frame start plus the group header, not a SUBSCRIBE range end.
 SUBSCRIBE ranges are whole groups since 2026-11-03
-([Lite-07 FETCH is single-group only](/quest/m1/subscribe-ranges/lite07-fetch.md),
+([Lite-07 FETCH is single-group only](/quest/m2/subscribe-ranges/lite07-fetch.md),
 [moq-dev/moq#7675](https://github.com/moq-dev/moq/pull/7675)), and flights
 ride lite FETCH since [moq-dev/moq#7944](https://github.com/moq-dev/moq/pull/7944).
 This waits for that quest.
@@ -59,7 +59,7 @@ This waits for that quest.
   kept its segments internal. JS already has its chunked read
   (`nextFrame` and `readChunk`, from
   [moq-dev/moq#7411](https://github.com/moq-dev/moq/pull/7411)); its wire
-  half is in [JS byte holes](/quest/m1/unbounded-groups/js-byte-holes.md).
+  half is in [JS byte holes](/quest/m2/unbounded-groups/js-byte-holes.md).
 - Test a frame several times the 32 MB tail through a relay chain: a late
   joiner reads it whole through a flight, and memory stays near 32 MB per
   copy.
@@ -71,4 +71,4 @@ header.
 
 ## Required
 
-- [Lite-07 FETCH is single-group only](/quest/m1/subscribe-ranges/lite07-fetch.md) - SUBSCRIBE ranges become whole groups, so the offset goes on FETCH
+- [Lite-07 FETCH is single-group only](/quest/m2/subscribe-ranges/lite07-fetch.md) - SUBSCRIBE ranges become whole groups, so the offset goes on FETCH
diff --git a/quest/m1/unbounded-groups/compressed-stream.md b/quest/m2/unbounded-groups/compressed-stream.md
similarity index 96%
rename from quest/m1/unbounded-groups/compressed-stream.md
rename to quest/m2/unbounded-groups/compressed-stream.md
index a2cde9929e1..edc30c9cef8 100644
--- a/quest/m1/unbounded-groups/compressed-stream.md
+++ b/quest/m2/unbounded-groups/compressed-stream.md
@@ -39,7 +39,7 @@ Decided 2026-10-31 (user, /quest-plan of the follow-ups from the 2026-10-31
   `write_frames` (`group.rs:1719`, `:1798`) check only the plain payload
   against 32 MB, so an incompressible frame near the cap encodes to a slice
   every receiver refuses. With no compressed cap, there is nothing to
-  mismatch; [Byte holes](/quest/m1/unbounded-groups/byte-holes.md) removes
+  mismatch; [Byte holes](/quest/m2/unbounded-groups/byte-holes.md) removes
   the plain cap.
 - The lite draft's FRAME text ("a receiver MUST check it against its limits
   before inflating") stays; add that a receiver may inflate incrementally and
@@ -55,4 +55,4 @@ JSON preflight). Wire: none.
 
 ## Required
 
-- [Byte holes](/quest/m1/unbounded-groups/byte-holes.md) - Rust frames past 32 MB at all
+- [Byte holes](/quest/m2/unbounded-groups/byte-holes.md) - Rust frames past 32 MB at all
diff --git a/quest/m1/unbounded-groups/js-byte-holes.md b/quest/m2/unbounded-groups/js-byte-holes.md
similarity index 87%
rename from quest/m1/unbounded-groups/js-byte-holes.md
rename to quest/m2/unbounded-groups/js-byte-holes.md
index 3c7742d899f..407ccf2d433 100644
--- a/quest/m1/unbounded-groups/js-byte-holes.md
+++ b/quest/m2/unbounded-groups/js-byte-holes.md
@@ -10,7 +10,7 @@ from the byte it reached instead of failing.
 
 Decided 2026-10-27 (maintainer): split out of the JS unbounded groups
 quest. This half mirrors
-[Byte holes](/quest/m1/unbounded-groups/byte-holes.md).
+[Byte holes](/quest/m2/unbounded-groups/byte-holes.md).
 
 Decided 2026-10-31 (maintainer, on
 [moq-dev/moq#7411](https://github.com/moq-dev/moq/pull/7411)): chunked frame
@@ -31,13 +31,13 @@ moq-transport. What is left here is the wire:
 - Test a frame several times the cache window through a Rust relay, read
   as chunks, plus Rust/JS interop of a mid-frame refill. Run
   `just test interop --all`.
-- If [JS-only @moq/net from Rust](/quest/m2/rs2ts-js.md) is adopted first,
+- If [JS-only @moq/net from Rust](/quest/m5/rs2ts-js.md) is adopted first,
   this shrinks to exposing its byte-offset recovery.
 
 Decided 2026-11-05 (maintainer, /quest-audit): ✅ the byte offset rides
 FETCH's frame start plus the group header, not a SUBSCRIBE range end.
 SUBSCRIBE ranges are whole groups since 2026-11-03
-([Lite-07 FETCH is single-group only](/quest/m1/subscribe-ranges/lite07-fetch.md),
+([Lite-07 FETCH is single-group only](/quest/m2/subscribe-ranges/lite07-fetch.md),
 [moq-dev/moq#7675](https://github.com/moq-dev/moq/pull/7675)), and flights
 ride lite FETCH since [moq-dev/moq#7944](https://github.com/moq-dev/moq/pull/7944).
 This waits for that quest.
@@ -47,5 +47,5 @@ Byte holes defines it.
 
 ## Required
 
-- [Byte holes](/quest/m1/unbounded-groups/byte-holes.md) - the Rust contract and the lite wire this mirrors
-- [Lite-07 FETCH is single-group only](/quest/m1/subscribe-ranges/lite07-fetch.md) - SUBSCRIBE ranges become whole groups, so the offset goes on FETCH
+- [Byte holes](/quest/m2/unbounded-groups/byte-holes.md) - the Rust contract and the lite wire this mirrors
+- [Lite-07 FETCH is single-group only](/quest/m2/subscribe-ranges/lite07-fetch.md) - SUBSCRIBE ranges become whole groups, so the offset goes on FETCH
diff --git a/quest/m1/unbounded-groups/paced-batch-fills.md b/quest/m2/unbounded-groups/paced-batch-fills.md
similarity index 100%
rename from quest/m1/unbounded-groups/paced-batch-fills.md
rename to quest/m2/unbounded-groups/paced-batch-fills.md
diff --git a/quest/m1/webrtc-rename.md b/quest/m2/webrtc-rename.md
similarity index 93%
rename from quest/m1/webrtc-rename.md
rename to quest/m2/webrtc-rename.md
index a129f356c80..42b0379b35d 100644
--- a/quest/m1/webrtc-rename.md
+++ b/quest/m2/webrtc-rename.md
@@ -6,9 +6,9 @@ The published `moq-webrtc` crate holds what `moq-rtc`, `moq-ice`, and moq-tokio'
 
 ## Plan
 
-Decided 2026-10-30 with the maintainer (planning interview); see the [epic](/quest/m2/webrtc/README.md).
+Decided 2026-10-30 with the maintainer (planning interview); see the [epic](/quest/m3/webrtc/README.md).
 
-Milestone: ✅ m1 (moved from m2, maintainer, 2026-11-03). Not chosen: keep it in m2, or send [moq-rtc on rind](/quest/m1/rind/rtc.md) back to m2. [Vendor and trim the WebRTC stack](/quest/m1/webrtc-vendor.md) requires this, and m1's rind epic requires the vendoring, so this sits at the m1 top level. It stays a child of the m2 [WebRTC epic](/quest/m2/webrtc/README.md).
+Milestone: ✅ m1 (moved from m2, maintainer, 2026-11-03). Not chosen: keep it in m2, or send [moq-rtc on rind](/quest/m1/rind/rtc.md) back to m2. [Vendor and trim the WebRTC stack](/quest/m1/webrtc-vendor.md) requires this, and m1's rind epic requires the vendoring, so this sits at the m2 top level. It stays a child of the m3 [WebRTC epic](/quest/m3/webrtc/README.md).
 
 - Move `rs/moq-rtc` to `rs/moq-webrtc` and merge `rs/moq-ice` in as a module. Keep the gateway's `server` feature; add a feature for the data-channel transport so WHIP/WHEP-only builds skip SCTP.
 - Move moq-tokio's `webrtc` module (`rs/moq-tokio/src/webrtc.rs`, host gathering, `.local` resolution) into moq-webrtc, built on moq-tokio's public session types. Its connect and accept go through moq-tokio's `connect_with`/`accept_with` handoffs, which run moq-net's session policy over the established data channel.
diff --git a/quest/m2/3115-moqsink-the-publication-has-no-generation-so-a-flush.md b/quest/m3/3115-moqsink-the-publication-has-no-generation-so-a-flush.md
similarity index 100%
rename from quest/m2/3115-moqsink-the-publication-has-no-generation-so-a-flush.md
rename to quest/m3/3115-moqsink-the-publication-has-no-generation-so-a-flush.md
diff --git a/quest/m3/README.md b/quest/m3/README.md
index 3a5233a004e..14548b8c020 100644
--- a/quest/m3/README.md
+++ b/quest/m3/README.md
@@ -1,88 +1,173 @@
-# m3: deferred
+# m3: later work, higher priority
 
 ## Goal
 
-Work that waits on something besides priority: either a first step outside
-this repository (hardware nobody on the team has, a partner or customer who
-asks for it, a hosting provider's offer, or an upstream release), or a
-speculative feature or study with no named consumer yet.
+Work that follows the next breaking release and has someone waiting on it:
+byte streams and the mesh libraries first, then release execution after the
+cut, quests a named consumer needs, including downstream deployments, and bug fixes in
+shipped code. Breaking and additive work mix here; the cut after m2's sorts
+them by kind.
 
 ## Plan
 
-A quest gated on the outside world has a condition quest beside it, as the
-root [questline](/quest/README.md) describes. A speculative feature or study
-with no consumer needs no condition quest: it parks here rather than in m2
-until a consumer appears, and is deleted when it goes stale; git history keeps
-it. Decided in the 2026-10-05 audit: both kinds live here, and the m2 quests
-deferred for having no named consumer moved here. The 2026-10-08 audit folded
-m4's upstream waits in here and moved m2 work with no consumer.
+Decided 2026-11-05 (maintainer, milestone re-cut): the old m2 ("later work")
+split in half by priority into m3 and m4. A quest joined m3 when a named
+consumer or user-facing need waits on it, when it is release execution or a
+bug fix in shipped code, or when an m0 to m3 quest requires it. A downstream
+deployment's plans count as a consumer: work its near-term plans need joins
+m3, work only its urgent plans need joins m1 or m2 by kind, and work only its
+later plans need joins m4. The recurring hygiene audits live here behind the
+cut, so the shift after the cut brings each into m1, as before.
+
+Decided 2026-10-13: a feature does not block the breaking release merely
+because it was in the next-wave backlog. Keep existing behavior correct in
+m2, and defer new capabilities without changing their intended outcome.
+Dependencies on m1 and m2 remain explicit. An implementation that discovers
+a new necessary API break brings that decision to the maintainer before
+proceeding.
+
+Decided 2026-11-03 (maintainer, Kixel's quest audit): [byte streams](/quest/m3/stream/README.md)
+and the [mesh libraries](/quest/m3/mesh/README.md) rank first here, ahead
+of [release execution](/quest/m3/release/README.md). Kixel's daemon builds on
+them from `main` through a git submodule, so it needs them merged, not
+released. They stay out of m1 and m2 so the cut does not wait on them; each
+starts as soon as its prerequisites (sockets, fastest-reader pacing, outbound
+federation) land.
 
 ## Required
 
-- [Mesh over ICE](/quest/m3/mesh-ice.md) - mesh nodes on different networks connect directly through the P2P line's ICE pairs, once a mesh user needs it
-- [Video validation hardware is on hand](/quest/m3/video-hardware-access.md) - the machines the validation runs on, including a Raspberry Pi 4/5 for embedded presenting
-- [Video hardware validation](/quest/m3/video-hardware.md) - run the encode, capture, and zero-copy paths that were never run on real machines, including PipeWire on KDE, the camera portal, and a Pi
-- [An Ada NVIDIA GPU is available](/quest/m3/ada-gpu.md) - the hardware AV1 NVENC is verified on
-- [NVENC AV1](/quest/m3/nvenc-av1.md) - AV1 encode through NVENC, once an Ada-generation GPU is available
-- [#2147](/quest/m3/2147-moq-video-10-bit-hevc-and-av1-support-in-the-nvidia-codec.md) - NVIDIA Main10 encode, once a 10-bit source exists in the pipeline
-- [NVDEC and NVENC share CUDA arrays](/quest/m3/nvenc-cuda-arrays.md) - SDK 13.1 application-owned CUDA arrays drop the per-frame device copy, on driver 610+
-- [Embedded video](/quest/m3/video-embedded.md) - verify a Pi 4/5 presents through the existing Vulkan and CPU paths, adding EGL import only if that fails
-- [Multi-plane PipeWire cameras](/quest/m3/pipewire-camera-planes.md) - I420 and NV12 cameras that deliver one memory block per plane capture
-- [Video codec coverage](/quest/m3/video-codec-coverage.md) - prioritize remaining native AV1 and portable decoder gaps once a consumer asks
-- [A physical-NIC peer for the zero-copy sweep](/quest/m3/zero-copy-peer.md) - the rig the zero-copy sweep runs on
-- [#3201: moq-uring: use SENDMSG_ZC for large UDP GSO trains](/quest/m3/3201-moq-uring-use-sendmsg-zc-for-large-udp-gso-trains.md) - complete the prerequisite issue first
-- [#3204](/quest/m3/3204-moq-uring-register-tx-pool-buffers-for-zero-copy-sends.md) - moq-uring: register TX-pool buffers for zero-copy sends
-- [Cluster dials on the ring](/quest/m3/uring-cluster-dial.md) - measure whether an io_uring relay's outbound cluster links belong on its workers
-- [#3202](/quest/m3/3202-moq-uring-use-fixed-file-slots-for-worker-udp-sockets.md) - moq-uring: fixed-file slots for worker UDP sockets, if its own benchmark measures a win
-- [L4S on the backbone](/quest/m3/quic-ecn.md) - an ECT(1) option in `moq-quic`, an `ecn` config knob, and a dualpi2 measurement, if the ECN measurement says marks survive
-- [Careful resume on reconnect](/quest/m3/quic-careful-resume.md) - a Rust redial starts at the previous connection's rate
-- [Cut-through](/quest/m3/cut-through/README.md) - a bufferbloat bench decides whether a relay should forward bytes behind a QUIC stream hole; the build is re-planned if it says go
-- [Byte streams in moq-ffi](/quest/m3/ffi-stream.md) - Swift and Kotlin dial and accept byte streams, for moq.pro's T3 Code mobile client
-- [E2EE in moq-ffi](/quest/m3/ffi-e2ee.md) - Swift and Kotlin publish and consume protected broadcasts, for the same client
-- [Unreal prototype](/quest/m3/unreal.md) - a UE5 module on the C++ package with exceptions disabled, rendering a subscribed broadcast to a texture
-- [vcpkg registry](/quest/m3/cpp-vcpkg.md) - a registry we own serves the prebuilt package to `vcpkg` manifests, once a consumer asks
-- [Conan remote](/quest/m3/cpp-conan.md) - a remote we own serves the same tarball to `conan install`
-- [Linux OBS GPU input](/quest/m3/obs-linux-gpu.md) - publish OBS compositor frames without CPU readback on a validated Linux graphics/encoder combination
-- [Routing cost domains](/quest/m3/routing-cost-domains.md) - design operator boundaries and policy without adding incomparable costs
-- [Request tokens beyond Rust](/quest/m3/request-token-surfaces.md) - a JS, moq-ffi, or moq-cli request-token API, built only for the surface a consumer names
-- [Token on FETCH](/quest/m3/auth-token-fetch.md) - our TRACK_STATUS and FETCH carry the request token, once a consumer asks
-- [moq-transport cluster peers](/quest/m3/ietf-cluster-peers.md) - the cluster draft carries the route layer, so moq-transport relays peer again, once a moq-transport relay operator asks
-- [The moq.pro mesh runs lite-07](/quest/m3/lite07-mesh.md) - the deployment that makes the exemption dead code
-- [Drop the hidden cluster exemption](/quest/m3/hidden-exemption.md) - relays stop forcing hidden broadcasts on cluster peers once every peer opts in on the wire
-- [Robot teleoperation primitive](/quest/m3/teleop-robot.md) - a `moq-robot` crate for video down and control up, once a robotics consumer appears
-- [Operator arbitration](/quest/m3/teleop-arbitration.md) - one operator holds control at a time
-- [MAVLink bridge](/quest/m3/teleop-mavlink.md) - a `moq-mavlink` gateway
-  replacing the VPN plus two unmanaged UDP flows, with QGroundControl and
-  friends unchanged
-- [SITL proof and browser ground station](/quest/m3/teleop-proof.md) - ArduPilot
-  SITL and a synthetic camera flown from a browser ground station, reproducible
-  in five minutes
-- [Ladder](/quest/m3/ladder/README.md) - a transcode ladder adapts to the uplink it publishes over, instead of encoding every live rung at its ceiling
-- [fMP4 emsg](/quest/m3/emsg.md) - settles the shared framing and missing-data semantics before this section adopts them
-- [ID3 catalog section](/quest/m3/id3.md) - timed ID3 as a first-class container-neutral catalog section
-- [FLV script tags](/quest/m3/flv-script.md) - onMetaData and AMF data messages survive RTMP and FLV import
-- [Half and quarter rate AC-3](/quest/m3/ac3-low-rate.md) - bsid 9 and 10 AC-3 parse through TS and FLV instead of being refused
-- [MSF feedback tracks](/quest/m3/msf-publish-tracks.md) - `--report` and `--echo` work under `--catalog-format msf` through `publishTracks`, once a consumer asks
-- [MSFTS convergence](/quest/m3/msfts-convergence.md) - the demultiplexed TS lane converges on MSFTS where they differ, once an MSFTS implementer engages
-- [#2279](/quest/m3/2279-hang-typed-scte-35-ad-cue-signaling-carried-opaquely.md) - hang: SCTE-35 cues arrive immediately on an independent metadata track, optionally associated with a rendition
-- [CEA-608/708](/quest/m3/captions-cea.md) - captions carried inside video SEI become a real text rendition at import
-- [WebXR playback](/quest/m3/watch-webxr.md) - `<moq-watch>` renders equirectangular and stereo renditions through WebXR layers on a headset
-- [Protected playback in the browser](/quest/m3/drm-playback.md) - `<moq-watch>` plays CENC renditions through MSE and EME, once a consumer asks
-- [Paced replay](/quest/m3/archive-paced-replay.md) - an archive consumer pushes stored groups to live subscribers on one shared clock, so any live player plays it
-- [Encoder feedback](/quest/m3/stats-encoder-feedback.md) - a Rust encoder
-  reads its viewers' feedback and adapts its bitrate
-- [Interop runner withdraws before disconnecting](/quest/m3/interop-runner-approval.md) - condition: a released moq-tokio and @moq/net carry close() withdrawals; then the runner's moq.dev clients switch to close()
-- [Safari ships the WebKit 319818 fix](/quest/m3/webkit-319818.md) - the Safari release the gate admits
-- [Safari WebTransport](/quest/m3/safari-webtransport.md) - WebKit browsers return to WebTransport once WebKit 319818 ships fixed
-- [moq-video in the browser](/quest/m3/video-web.md) - getUserMedia, getDisplayMedia, WebCodecs, and VideoFrame import into wgpu, for moq-dev/studio's web studio
-- [moq-audio in the browser](/quest/m3/audio-web.md) - AudioWorklet capture and playback and WebCodecs Opus and AAC, for the web studio's audio
-- [moq-audio filter chain](/quest/m3/audio-filters.md) - per-source suppression, gate, compressor, limiter, ducking, and plugins, which moq-dev/studio configures
-- [Mesh keys](/quest/m3/mesh-keys.md) - parked: encrypted and HMAC-authenticated mesh broadcasts through a wrapped `.keys` track
-- [rust2-ts reaches moq-net's model](/quest/m3/rs2ts-model-ready.md) - rust2's translator is ready to translate the model
-- [Keep moq-net's model in rust2-ts's subset](/quest/m3/rs2ts-model-subset.md) - safe twins for the model's internal `unsafe`, `dyn Expiry` as an enum, once rust2-ts reaches the model
-- [Wait for a stable bun lint](/quest/m3/bun-lint-release.md) - condition: `bun lint` ships in a stable Bun that nixpkgs carries
-- [Rust and JS end a lite-05 track the same way after an inclusive SUBSCRIBE_END](/quest/m3/lite05-subscribe-end.md) - after a legacy inclusive SUBSCRIBE_END, Rust and JS both end the track instead of Rust sending a FIN and JS only releasing
-- [Byte-at-a-time MKV input imports as fast as chunked input](/quest/m3/mkv-input-coalesce.md) - the MKV importer fed one byte at a time is no slower than before moq-dev/moq#7234
-- [A transcode ladder probes an unseen source shape without stalling its other rungs](/quest/m3/transcode-parallel-open.md) - a source changing to an unseen size opens the new encoders without stalling the ladder's other rungs
-- [rind-instant-acme is on crates.io](/quest/m3/rind-instant-acme.md) - waiting on instant-acme 0.9 and rind publishing its adapter
-- [Relay ACME on instant-acme](/quest/m3/relay-acme.md) - moq-relay's ACME returns on instant-acme and rind, once a user needs it
+- [Byte streams](/quest/m3/stream/README.md) - TCP connections ride MoQ losslessly through relays, proxied per hop rather than as IP packets
+- [Mesh libraries](/quest/m3/mesh/README.md) - an `Endpoint` reaches any enrolled node by endpoint ID over relays or a sparse direct overlay, with address hints and a `.status` track; the mesh binary and UI live in Kixel
+- [`@moq/net` broadcasts expose their requests](/quest/m3/net-broadcast-requests.md) - a JS broadcast serves tracks it never created, on demand, like Rust
+- [`@moq/crypto` loads a stored signing key](/quest/m3/crypto-key-load.md) - one device key proves mesh identity and signs broadcasts
+- [JS announced coalescing](/quest/m3/js-announced-coalesce.md) - `@moq/net`'s `Announced` keeps one pending event per path, like Rust
+- [An audio track's final flush joins its open group](/quest/m3/audio-flush-group.md) - a zero-`delay.max` subscriber gets the tail, not `Old`
+- [Release execution](/quest/m3/release/README.md) - publication, installed-artifact proof, cleanup, and downstream adoption after m2
+- [Release pull requests read the R2 Rust cache](/quest/m3/mbx-r2-release-cache.md) - after the cut brings the platform Rust cache to `release`
+- [Binary release publishers run on their tag](/quest/m3/release-tag-publishers.md) - after the cut brings the workflows to `release`
+- [crates.io trusts the workflow](/quest/m3/crates-trusted-publisher.md) - maintainer action: the crates the cut first-publishes by token get a trusted publisher for `release-rs.yml`
+- [Rust releases publish through OIDC](/quest/m3/release-rs-oidc.md) - release-plz publishes with trusted publishing and `CARGO_REGISTRY_TOKEN` is revoked
+- [One policy for oversized container metadata](/quest/m3/import-metadata-policy.md) - fMP4 and MKV refuse or stream huge metadata by one documented rule
+- [Video quality](/quest/m3/video-quality/README.md) - a nightly VMAF harness grades every encoder backend and on-demand GoP pops against floors, and moq-boy's encode is fixed under it
+- [rust2's exporter is ready for moq](/quest/m3/rust2-exporter.md) - waiting on moq-dev/rust2's exporter to generate every language moq ships
+- [Switch to rust2's exporter](/quest/m3/ffi-exporter.md) - moq's bindings come from rust2-ffi, moq-ffi shrinks to its remainder, and moq's UniFFI generator code is deleted
+- [Generated C bindings](/quest/m3/c/README.md) - C generated from moq-ffi ships as `moq-c` 0.8.0 and replaces the hand-written crate
+- [A runtime-free QUIC driver](/quest/m3/quic-sansio-driver.md) - a caller's own loop moves UDP datagrams and polls moq sessions over moq-quic, for rust2's bindings
+- [QoS](/quest/m3/qos/README.md) - the relay's egress `lag` histogram and `dropped` counters on the stats totals and prefix tracks
+- [The DASH manifest keeps segments across a reconfigure](/quest/m3/dash-reconfigure.md) - a same-codec reconfigure keeps the old instance's segments listed in DASH, as HLS does
+- [Broadcast fairness](/quest/m3/broadcast-fairness.md) - broadcasts share a cluster link fairly, so one tenant's priority never starves another's
+- [Plan: watch worker](/quest/m3/plan-watch-worker.md) - prototype an invisible page worker against app-spawned workers, and land the jank harness that decides
+- [Watch worker](/quest/m3/watch-worker.md) - watch playback runs in a worker onto an OffscreenCanvas, so main-thread jank never stalls video or audio
+- [Vulkan Video encode on AMD](/quest/m3/vulkan-encode.md) - H.264 and H.265 from an external Vulkan image on RADV, hand-rolled on ash, proven on an RX 9070
+- [VA-API encodes an external Vulkan image](/quest/m3/vaapi-vulkan-import.md) - an explicit-sync DMA-BUF reaches Intel's encoder, proven on Arrow Lake
+- [C++ FFI reuse](/quest/m3/cpp-ffi-reuse.md) - C++ packages link the shared default-feature FFI build once it is proven compatible
+- [OBS native codecs](/quest/m3/obs-moq-video/README.md) - replace FFmpeg video and audio decoding with moq-video and moq-audio, deliver GPU frames, and use native audio/video encoders
+- [MoQ in obs-studio](/quest/m3/obs-studio/README.md) - a native MoQ output and service merged into obs-studio, once its maintainers agree; the plugin carries it until then
+- [AudioToolbox decode](/quest/m3/audio-decode-audiotoolbox.md) - macOS and iOS decode HE-AAC, multichannel AAC, and what else the framework offers
+- [GPU CI](/quest/m3/gpu-ci.md) - NVIDIA tests gate the merge queue on a self-hosted GPU runner VM, and `just rs nvidia` runs them locally instead of skipping
+- [Media stats](/quest/m3/stats/README.md) - publishers announce a stats track in the catalog, viewers answer a soliciting catalog through a per-catalog `.echo` broadcast, and one model turns both into a health verdict and a preflight report
+- [Wire stats](/quest/m3/wire-stats/README.md) - `Presence` counts each root's transport bytes on the wire, `wire_tx` and `wire_rx`, from QUIC, WebSocket, and embedder gateway sources
+- [Session outcome records](/quest/m3/session-outcome-records.md) - relay stats publish each refusal and abnormal session end as a record per label, bounded under a flood, beside the counters
+- [Audio renditions carry a language](/quest/m3/audio-lang.md) - audio renditions have an optional BCP-47 `lang`, and watch auto-picks within one language
+- [fMP4 and TS imports publish BCP-47 languages](/quest/m3/import-lang-iso639.md) - ISO 639-2 codes become `en`-style tags on audio and text
+- [HLS carries every audio language](/quest/m3/hls-audio-languages.md) - every `EXT-X-MEDIA` audio entry imports with its `LANGUAGE`, and exports write it back
+- [A refused follower asks a replacement handler](/quest/m3/follow-refused-retry.md) - a same-instance handler swap with identical route details re-asks a refused `Following`, while listeners still see no change
+- [Content protection](/quest/m3/drm/README.md) - Common Encryption CMAF publishes unchanged, signalled in the hang `drm` section and MSF `contentProtections`, with license URLs from Rust, the CLI, and every binding
+- [iOS capture](/quest/m3/mobile-capture-ios.md) - Rust captures the camera and screen on iOS, setting the catalog rotation
+- [Android capture](/quest/m3/mobile-capture-android.md) - Rust captures through NDK/JNI on Android, reusing the existing codecs and setting the catalog rotation
+- [Latest readers use Range::live()](/quest/m3/readers-range-live.md) - after #6278, readers start at the live edge without waiting on `largest()`
+- [PulseAudio capture periods](/quest/m3/pulseaudio-capture-period.md) - capture on cpal's PulseAudio host arrives in short periods, not the server's 2 s default fragment, proven on the null sink's monitor
+- [A JSON snapshot consumer resyncs after a bad frame](/quest/m3/json-snapshot-resync.md) - a decode failure drops the group with a typed error, so `@moq/room` and moq-boy resume at the next snapshot
+- [Go module proxy](/quest/m3/go-module-proxy.md) - `moq.dev/moq-ffi` ships from a static GOPROXY we host, so its staticlibs stop growing git history by ~61 MiB per release
+- [Go per-platform lib modules](/quest/m3/go-ffi-platform-modules.md) - a Go build downloads only the host's staticlib, and `go mod vendor` works
+- [Dart on iOS](/quest/m3/dart-ios.md) - prove the shipped iOS native asset actually loads on a device, which no CI can
+- [Mobile completion](/quest/m3/mobile-completion.md) - verify the Swift and Kotlin bindings over Rust-owned capture
+- [Migrated sessions close once their replacement synced](/quest/m3/goaway-migration-followups.md) - moq-tokio holds the early close for the replacement's announce sync, and the JS `Connection` closes early too
+- [moq-transport requests end through one lease](/quest/m3/ietf-request-lease.md) - every IETF request ends through one polled lease, and the two 18k-line files split by mechanism
+- [A moq-transport group head fills its hole in place](/quest/m3/ietf-fill-refill.md) - fills and joining FETCHes write into the tail's group, deleting the `Fill` handoff
+- [One port](/quest/m3/one-port/README.md) - one UDP port carries QUIC, SRT, and WebRTC media through an embedder hook, and one TCP port carries HTTP, RTMP, and RTMPS
+- [WebSocket caps](/quest/m3/rate-websocket.md) - paced reads and writes over bounded socket buffers hold WebSocket to the same caps
+- [moq-rtc pacing](/quest/m3/rtc-pacing.md) - a capped WHEP viewer never receives more than its cap plus burst, NACK resends included
+- [SRT rate handle](/quest/m3/srt-rate-handle.md) - a per-connection cap paces SRT pulls, retransmits included, and closes SRT publishers past it
+- [One port on the io_uring workers](/quest/m3/uring-demux.md) - `moq-uring`'s workers host the UDP demux, so a ring relay keeps WebRTC media and SRT on its QUIC port
+- [Synced data playback](/quest/m3/watch-data-sync.md) - js/watch releases JSON and binary payloads on the media playhead, and a slow data track holds media back
+- [WebCodecs audio priming](/quest/m3/webcodecs-priming.md) - `@moq/publish` measures each browser's `AudioEncoder` priming and corrects AAC timestamps and Opus pre-skip, so audio decodes at its capture timestamp
+- [poll_acked on moq-net's send stream](/quest/m3/quic-ack-hook.md) - the
+  backend-neutral hook on moq-net's own transport trait that awaits an
+  acknowledged stream offset, implemented by the moq-tokio and moq-uring adapters
+- [Relay io_uring packages](/quest/m3/relay-io-uring-package.md) - Linux relay packages ship io_uring once the ring is on par with tokio
+- [Direct3D11 render import](/quest/m3/render-d3d11.md) - Windows presents without downloading every frame to system memory
+- [Media Foundation encodes on the texture's adapter](/quest/m3/mf-encode-adapter.md) - Windows machines with two GPUs keep an exported texture on the GPU route into a hardware encoder
+- [Intra-refresh GOPs](/quest/m3/intra-refresh/README.md) - video with periodic intra refresh imports and plays back cleanly with one group per sweep and a catalog `warmup`
+- [#3115](/quest/m3/3115-moqsink-the-publication-has-no-generation-so-a-flush.md) - moqsink: a flushing restart after EOS opens a new publication generation
+- [Realtime uplink congestion control](/quest/m3/quic-realtime/README.md) - native publishers pick `Realtime`, a receive-ts delay-based controller that keeps the uplink queue near empty for teleoperation
+- [Windows capture parity](/quest/m3/capture-windows.md) - system and per-app audio and a settled app-capture policy
+- [Linux capture parity](/quest/m3/capture-linux.md) - Wayland window/system-audio capture, per-app audio, and explicit display-selection and app-capture limits
+- [Per-app audio on macOS](/quest/m3/capture-app-audio-macos.md) - one application's audio through ScreenCaptureKit
+- [cpal loads libasound at runtime](/quest/m3/cpal-alsa-runtime.md) - condition: a cpal release whose Linux build carries no load-time libasound requirement
+- [Audio capture without ALSA link](/quest/m3/capture-alsa-link.md) - moq-audio capture and playback build on Linux without linking libasound, and capture becomes a default feature
+- [Ship capture and playback](/quest/m3/cli-packaging.md) - a released moq binary can capture and play, which no distribution currently enables
+- [moq-relay in nixpkgs](/quest/m3/nixpkgs-relay.md) - `nix-shell -p moq-relay` installs the released relay from upstream nixpkgs, auto-updated from our tags
+- [moq-cli in nixpkgs](/quest/m3/nixpkgs-cli.md) - the released `moq` CLI with its full release feature set joins nixpkgs as `moq-cli`
+- [GPU capacity and health](/quest/m3/gpu-health.md) - moq-video reports each device's sessions, memory, utilization, and health on NVIDIA, AMD, and Intel alike
+- [A release carries multi-vendor GPU input](/quest/m3/gpu-release.md) - `release` carries the GPU surface validated on AMD and Intel; health follows separately
+- [The remaining library spawns](/quest/m3/spawn-audit.md) - every async spawn left in a library crate becomes a polled `kio::Tasks` child or is listed with why it stays
+- [DVR rewind](/quest/m3/archive-dvr.md) - follow-on capability after the release contract is stable
+- [Publisher timeliness at relay ingest](/quest/m3/qos-publisher-timeliness.md) - follow-on capability after the release contract is stable
+- [The relay refuses a cluster peer it cannot dial](/quest/m3/relay-undialable-peers.md) - moq-tokio reports the schemes it can dial, and the relay refuses an undialable peer at startup instead of retrying forever
+- [moq-transport finish interop](/quest/m3/ietf-finish.md) - the interop `finish` case runs on every even moq-transport draft instead of being skipped
+- [JS joining FETCH](/quest/m3/ietf-js-joining-fetch.md) - the JS publisher answers a joining FETCH that arrives after a quick finish, mirroring the Rust bound
+- [An Absolute join never races an older-history FETCH](/quest/m3/ietf-absolute-join-race.md) - reproduce #7680's suspected collision on main, then fix it or keep the test and delete
+- [A passing interop run stops publishers cleanly](/quest/m3/interop-shutdown-warnings.md) - no lingering publisher or unfinished-producer warning in a green interop run
+- [Dependency and alternatives audit](/quest/m3/audit-deps.md) - every dependency earns its weight, preferring fewer, and the rest are current, deduplicated, and the best maintained option
+- [Dead code and API surface audit](/quest/m3/audit-dead-code.md) - repeat the removal audit before the next major release
+- [Typecheck with bun check](/quest/m3/bun-check.md) - workspace packages typecheck through bun once nixpkgs ships bun 1.4.4
+- [Test coverage audit](/quest/m3/audit-test-coverage.md) - repeat the coverage audit against the m1 baselines after the next release ships
+- [Documentation audit](/quest/m3/audit-docs.md) - repeat the docs audit after the release ships, against the m1 baselines
+- [Test cost audit](/quest/m3/audit-test-cost.md) - the slowest, flakiest, and least valuable tests are deleted by default, or else fixed or planned, once the release ships
+- [Quest tree audit](/quest/m3/audit-quests.md) - repeat the whole-tree audit after the release ships, against the m1 baseline
+- [CI workflow audit](/quest/m3/audit-ci.md) - repeat the per-workflow and per-job review after the release ships, against the m1 baselines
+- [Performance audit](/quest/m3/audit-perf.md) - benchmarks that regressed since the m1 run are explained, fixed, or planned, and unbenched hot paths get coverage
+- [Simplification audit](/quest/m3/audit-simplify.md) - repeat the simplification audit, starting with the m1 leftovers, after the release ships
+- [Artifact size audit](/quest/m3/audit-size.md) - repeat the shipping, native, and browser attribution after the release ships
+- [Compile time audit](/quest/m3/audit-compile-time.md) - build-time hotspots are measured against the m1 baselines, starting with the transport share now that moq-net compiles once, and the worst are removed, made cheaper, or planned
+- [Lint override and deprecation audit](/quest/m3/audit-lints.md) - repeat the suppression and deprecation audit after the release ships, starting with clippy on the macOS and Windows targets
+- [Clean ALSA playback onset](/quest/m3/audio-alsa-onset.md) - no onset restarts or clicks over PulseAudio
+- [Interop audit](/quest/m3/audit-interop.md) - our interop runner entries match what we ship, and every red interop cell with a moq.dev side is fixed, reported, or noted as down or unsupported
+- [moq-hls exposes each rendition's bound source](/quest/m3/hls-rendition-source.md) - playlists and segments report the source path and instance they read, so a cache can key on the source
+- [The memory bench finishes at 1 MiB frames](/quest/m3/memory-bench-hang.md) - the allocation mode's park at `size=1048576` is root-caused and fixed
+- [Audio's Latest start reaches back](/quest/m3/audio-latest-reach-back.md) - moq_audio's start covers min plus warmup like other consumers
+- [moq-lite tails count drops](/quest/m3/lite-tail-drop-count.md) - SUBSCRIBE_DROP accounting replaces the session-tail grace from lite-05
+- [Audio track changes are gapless](/quest/m3/gapless-audio-switch.md) - no silence beyond a frame on audio format or rendition changes, enforced by media QA
+- [We own our WebRTC stack](/quest/m3/webrtc/README.md) - moq-rtc becomes moq-webrtc with moq-ice, the data-channel transport, and a vendored, trimmed str0m/dimpl/is/sctp-proto
+- [PUBLISH_DONE says why](/quest/m3/publish-done-codes.md) - GOING_AWAY, TOO_FAR_BEHIND, and EXPIRED round-trip as stream codes
+- [A revoked announce resets instead of FINning](/quest/m3/announce-revoke-reset.md) - a PUBLISH_NAMESPACE revoked after its OK resets with INTERNAL_ERROR, per draft-22 §6.4.2.3
+- [moq repair refuses a live recording](/quest/m3/mp4-repair-lock.md) - the recorder's advisory lock keeps `moq repair mp4` off a file still being written
+- [The error-queue reader decodes truncated control data](/quest/m3/errqueue-truncation.md) - `MSG_ERRQUEUE` keeps what fit on `MSG_CTRUNC`, like the receive paths
+- [The QUIC driver tells an MTU probe from an oversized send](/quest/m3/quic-emsgsize-classify.md) - a non-probe `EMSGSIZE` is logged and counted instead of dropped silently
+- [fMP4 decode times from the declared reorder depth](/quest/m3/fmp4-declared-clock.md) - `DeclaredClock` replaces the sub-GOP cadence cap, as in TS, FLV, and MKV
+- [An ended HLS playlist has no trailing gap](/quest/m3/hls-trailing-gap.md) - no zero-duration `EXT-X-GAP` before `EXT-X-ENDLIST`
+- [/fetch answers from the announce sync](/quest/m3/fetch-synced.md) - a missing broadcast gets a 404 once announcements are synced, not after 30 s
+- [An advertisement stuck on a zero-credit peer gives up](/quest/m3/advertise-credit-timeout.md) - A Rust moq-transport publisher whose PUBLISH_NAMESPACE or namespace update cannot leave because the peer grants no send credit gives up on it within a bounded time, as it already does on a silent answer: it resets the request and frees its state
+- [moq-sock's control buffer is sized for the send options too](/quest/m3/cmsg-len-send.md) - `cmsg::LEN` in moq-sock is derived from, or checked at compile time against, both the receive options and the send options
+- [A panic inside moq-tokio's connection internals fails callers instead of panicking them](/quest/m3/connection-panic-isolation.md) - after a moq-tokio QUIC connection driver panics, every client-side caller gets the connection's terminal error instead of panicking in its own task, and the certificate reload watcher and qmux driver tasks are supervised
+- [No large future in the FFI layers can overflow a runtime or foreign thread's stack](/quest/m3/ffi-future-size.md) - every future moq-c and moq-ffi spawn or block on is below a size bound that a lint enforces, so unoptimized builds stay inside the runtime thread stack
+- [An empty tail stream for a headless moq-transport group creates no group](/quest/m3/headless-empty-tail.md) - when a moq-transport subscription's fill for the Largest Group fails, an empty subgroup stream for that headless group is dropped instead of creating an empty group that reads as complete
+- [A recording stalled on an open group reports what it waits for](/quest/m3/hls-stalled-segment.md) - when a moq-hls recording waits on a listed segment whose group a still connected publisher never closes, the wait is visible
+- [A kept draft-18 join pins its head group](/quest/m3/ietf-join-pin-head.md) - on draft 18, a joining FETCH that our publisher keeps open after a quick finish is answered even if the publisher drops its `track::Producer` right after `finish()`
+- [The JS player keeps a track's start when decoding from its first packet](/quest/m3/js-warmup-trim.md) - `@moq/watch` trims an audio track's catalog `warmup` only on a mid-stream join, as moq-audio does
+- [A library recorder gets the takeover cut](/quest/m3/mux-source-cut.md) - A recorder built directly with `moq_hls::export::Broadcaster::new` ends a replaced instance's recording at what it listed when another publisher takes the broadcast over, exactly as one built through `Server::broadcaster` does
+- [The OBS source joins audio at the live edge](/quest/m3/obs-decode-latest.md) - the OBS MoQ source's audio decoder starts at the newest cached group instead of replaying the track's backlog, so a reconnect or rendition change plays live audio at once
+- [OBS simulcast layers reach moq-watch from a live OBS, including the dock's Go Live](/quest/m3/obs-multitrack-check.md) - A live OBS 32.2.2 run, recorded in the PR, shows the `WHIPSimulcastTotalLayers` profile setting attaching two or more scaled video encoders to `moq_output`, each published as its own rendition and watched in `<moq-watch>`, both through the obs-websocket recipe in `doc/bin/obs.md` and through the MoQ dock's Go Live, which honors the profile's layer count instead of creating a single encoder
+- [Opus export never writes a channel mapping it can't stand behind](/quest/m3/opus-surround-export.md) - exporting a catalog Opus rendition with 3 to 8 channels and no description writes a `dOps` with the Vorbis family 1 mapping table, as the TS importer assumes, instead of an invalid family 0 `dOps`
+- [Open-GOP MPEG-2 export trims leading B-pictures in zero-stuffed CBR streams](/quest/m3/pes-hold-open-gop.md) - A TS export starting or resuming inside an open GOP of MPEG-2 video drops the orphaned leading B-pictures even when their PES ends on zero stuffing, as CBR encoders emit, without ever trimming part of a reference picture whose start code straddles two PES packets
+- [A multi-program TS import survives a source switch](/quest/m3/ts-multi-program-restart.md) - `--program all` restarts each affected program on an unannounced source switch, as a single-program import does after moq-dev/moq#7780, instead of ending the whole import
+- [The lite publisher tells transport faults from cancels](/quest/m3/publish-cancel-classify.md) - `rs/moq-net`'s lite publisher no longer counts every `Error::Transport` as a clean cancel
+- [tls:// sessions report their negotiated ALPN](/quest/m3/tls-link-alpn.md) - A session accepted on a `tls://` listener reports the negotiated moq ALPN in `Link::alpn`, as raw QUIC, WebTransport, and WebSocket sessions already do, so admission and logs see the protocol on every transport
+- [PUBLISH token renewal is consistent across pause and forward, and the multi-token cost is profiled](/quest/m3/token-auth-followups.md) - on a moq-transport session, a REQUEST_UPDATE carrying an AUTHORIZATION TOKEN on a PUBLISH gets the same answer whether the PUBLISH is paused or forwarding
+- [An audio-only broadcast that can't play hides its play button](/quest/m3/audio-only-play.md) - center-play follows the audio-only rule, proven by a browser test
+- [moq-quic's long header type is one variant](/quest/m3/quic-long-type.md) - collapse LongType after the 0-RTT removal
+- [One predicate for the lite close wait](/quest/m3/subscriber-fin-fold.md) - fold waits_for_subscriber_fin into has_track_stream
+- [MKV imports ffmpeg's multichannel FLAC](/quest/m3/mkv-flac-channel-mask.md) - a channel-mask-only Vorbis comment is accepted, so default ffmpeg multichannel FLAC needs no remux
+- [The publish support panel lists only codecs publishing accepts](/quest/m3/publish-support-probe.md) - the settings panel runs the publisher's Annex B encoder probe
+- [TLS reload follows symlinked certificate files](/quest/m3/watch-symlink-targets.md) - in-place rewrites of symlink targets in other directories reload roots, served chains, and client certificates
diff --git a/quest/m2/advertise-credit-timeout.md b/quest/m3/advertise-credit-timeout.md
similarity index 96%
rename from quest/m2/advertise-credit-timeout.md
rename to quest/m3/advertise-credit-timeout.md
index 03455ee9f22..fa852968b8e 100644
--- a/quest/m2/advertise-credit-timeout.md
+++ b/quest/m3/advertise-credit-timeout.md
@@ -38,4 +38,4 @@ Public API: none. Wire: none.
 
 ## Related
 
-- [One request lease](/quest/m2/ietf-request-lease.md) - other request lifetimes on the same streams
+- [One request lease](/quest/m3/ietf-request-lease.md) - other request lifetimes on the same streams
diff --git a/quest/m2/announce-revoke-reset.md b/quest/m3/announce-revoke-reset.md
similarity index 100%
rename from quest/m2/announce-revoke-reset.md
rename to quest/m3/announce-revoke-reset.md
diff --git a/quest/m2/archive-dvr.md b/quest/m3/archive-dvr.md
similarity index 95%
rename from quest/m2/archive-dvr.md
rename to quest/m3/archive-dvr.md
index 052c62f5e7d..39ea9748a9e 100644
--- a/quest/m2/archive-dvr.md
+++ b/quest/m3/archive-dvr.md
@@ -30,4 +30,4 @@ over missing groups, and return to live.
 
 ## Required
 
-- [Subscribe ranges](/quest/m1/subscribe-ranges/README.md) - the `Time(pts)` range a seek sends
+- [Subscribe ranges](/quest/m2/subscribe-ranges/README.md) - the `Time(pts)` range a seek sends
diff --git a/quest/m2/audio-alsa-onset.md b/quest/m3/audio-alsa-onset.md
similarity index 100%
rename from quest/m2/audio-alsa-onset.md
rename to quest/m3/audio-alsa-onset.md
diff --git a/quest/m2/audio-decode-audiotoolbox.md b/quest/m3/audio-decode-audiotoolbox.md
similarity index 93%
rename from quest/m2/audio-decode-audiotoolbox.md
rename to quest/m3/audio-decode-audiotoolbox.md
index df09f5c2b3b..d359e586bee 100644
--- a/quest/m2/audio-decode-audiotoolbox.md
+++ b/quest/m3/audio-decode-audiotoolbox.md
@@ -37,5 +37,5 @@ alongside the `objc2-core-audio-types` the crate already carries.
 
 ## Related
 
-- [Media Foundation decode](/quest/m2/audio-decode-mediafoundation.md) - the same shape on Windows
-- [MediaCodec decode](/quest/m2/audio-decode-mediacodec.md) - the same shape on Android
+- [Media Foundation decode](/quest/m5/audio-decode-mediafoundation.md) - the same shape on Windows
+- [MediaCodec decode](/quest/m5/audio-decode-mediacodec.md) - the same shape on Android
diff --git a/quest/m2/audio-flush-group.md b/quest/m3/audio-flush-group.md
similarity index 100%
rename from quest/m2/audio-flush-group.md
rename to quest/m3/audio-flush-group.md
diff --git a/quest/m2/audio-lang.md b/quest/m3/audio-lang.md
similarity index 97%
rename from quest/m2/audio-lang.md
rename to quest/m3/audio-lang.md
index acd4bdeaed7..ee758da8688 100644
--- a/quest/m2/audio-lang.md
+++ b/quest/m3/audio-lang.md
@@ -48,4 +48,4 @@ audio.
 
 ## Related
 
-- [Gapless audio switch](/quest/m2/gapless-audio-switch.md) - a language switch is a rendition switch and inherits its gap
+- [Gapless audio switch](/quest/m3/gapless-audio-switch.md) - a language switch is a rendition switch and inherits its gap
diff --git a/quest/m2/audio-latest-reach-back.md b/quest/m3/audio-latest-reach-back.md
similarity index 100%
rename from quest/m2/audio-latest-reach-back.md
rename to quest/m3/audio-latest-reach-back.md
diff --git a/quest/m2/audio-only-play.md b/quest/m3/audio-only-play.md
similarity index 100%
rename from quest/m2/audio-only-play.md
rename to quest/m3/audio-only-play.md
diff --git a/quest/m2/audit-ci.md b/quest/m3/audit-ci.md
similarity index 99%
rename from quest/m2/audit-ci.md
rename to quest/m3/audit-ci.md
index 922370449cf..b7cb3c44cbd 100644
--- a/quest/m2/audit-ci.md
+++ b/quest/m3/audit-ci.md
@@ -5,18 +5,17 @@
 Every CI workflow and job earns its place: its results reach someone (a gate,
 a Discord alert, or a published report) at a cost proportional to that signal.
 Each one that doesn't is deleted by default, or else made cheaper or moved. Individual tests stay with
-the [test cost audit](/quest/m2/audit-test-cost.md), and runner and cache
+the [test cost audit](/quest/m3/audit-test-cost.md), and runner and cache
 infrastructure with [CI cost and latency](/quest/m0/ci/README.md).
 
 ## Plan
 
 Recurs once per major release (decided 2026-10-20). The PR that finishes
-this run also adds the next one with the same file name at the end of the next
-milestone's `Required` (m0 to m1, m1 to m2), never m3, the deferred bucket
-that does not shift with releases. The successor keeps the Goal and this
+this run also adds the next one with the same file name at the end of m3's `Required`, which the shift after the next cut
+brings into m1. The successor keeps the Goal and this
 paragraph; the rest of its Plan is rewritten with what this run learned: the
-per-workflow table, baselines, and what to check first. A successor placed in m2 lists the
-[release cut](/quest/m2/release/cut.md) under `Required`, so it waits for the
+per-workflow table, baselines, and what to check first. The successor also lists the
+[release cut](/quest/m3/release/cut.md) under `Required`, so it waits for the
 release in flight to ship. The parent milestone lists this quest under
 `Required`. Only `/quest-delete` ends the recurrence. Fixes land in the run's
 PR, one commit each, rather than as follow-ups. Only a change that needs a
@@ -88,7 +87,7 @@ verdicts:
 - The earlier finite-track failures before draft 22 (`Error: old`, a JS
   `RESET_STREAM`) retain their split ownership: [moq-dev/moq#7306](https://github.com/moq-dev/moq/pull/7306)
   fixes the Rust publisher, including the removed WASM harness's quick-finish
-  case; [JS joining FETCH](/quest/m2/ietf-js-joining-fetch.md) owns the JS half.
+  case; [JS joining FETCH](/quest/m3/ietf-js-joining-fetch.md) owns the JS half.
 - Visibility gaps retained with existing owners: Rust benchmark tests and
   shipping sizes are measured but not on Pages yet;
   [moq-dev/moq#7510](https://github.com/moq-dev/moq/pull/7510) publishes both.
@@ -443,4 +442,4 @@ all other rows are retained, with exceptions/owners stated below and above.
 
 ## Required
 
-- [Release cut](/quest/m2/release/cut.md) - the release in flight ships before this run starts
+- [Release cut](/quest/m3/release/cut.md) - the release in flight ships before this run starts
diff --git a/quest/m2/audit-compile-time.md b/quest/m3/audit-compile-time.md
similarity index 97%
rename from quest/m2/audit-compile-time.md
rename to quest/m3/audit-compile-time.md
index 203f8bd6320..b637863a823 100644
--- a/quest/m2/audit-compile-time.md
+++ b/quest/m3/audit-compile-time.md
@@ -9,11 +9,10 @@ planned.
 ## Plan
 
 Recurs once per major release (decided 2026-10-19). The PR that finishes
-this run also adds the next one with the same file name at the end of the next
-milestone's `Required` (m0 to m1, m1 to m2). The successor keeps the Goal
+this run also adds the next one with the same file name at the end of m3's `Required`, which the shift after the next cut
+brings into m1. The successor keeps the Goal
 and this paragraph; the rest of its Plan is rewritten with what this run
-learned: baselines, results, and what to check first. A successor placed in m2
-also lists the [release cut](/quest/m2/release/cut.md) under `Required`, so it
+learned: baselines, results, and what to check first. The successor also lists the [release cut](/quest/m3/release/cut.md) under `Required`, so it
 waits for the release in flight to ship. Only `/quest-delete` ends the
 recurrence. Fixes land in the run's PR, one commit each, rather than as follow-ups.
 Only a change that needs a maintainer decision (public API, scope) or is
@@ -27,8 +26,8 @@ cheaper instead. Removing a public API or a user-facing feature stays a
 follow-up.
 
 Scope: this audit owns per-crate build cost in one build (dev, release, and
-incremental). The [CI workflow audit](/quest/m2/audit-ci.md) owns job-level CI
-cost and caching; the [dependency audit](/quest/m2/audit-deps.md) owns
+incremental). The [CI workflow audit](/quest/m3/audit-ci.md) owns job-level CI
+cost and caching; the [dependency audit](/quest/m3/audit-deps.md) owns
 deduplicating and upgrading dependencies.
 
 What to check first:
@@ -54,8 +53,8 @@ What to check first:
   count. Treat a shift in those rows across it as the hack's, not the code's.
   Keep feature-unification and cross-job cache work with the
   [hakari quest](/quest/m0/ci/hakari.md), and test work with the
-  [test cost audit](/quest/m2/audit-test-cost.md). Dependency and manifest
-  removal belongs to the [dependency audit](/quest/m2/audit-deps.md).
+  [test cost audit](/quest/m3/audit-test-cost.md). Dependency and manifest
+  removal belongs to the [dependency audit](/quest/m3/audit-deps.md).
 - Transport-session duplication is fixed by
   [moq-dev/moq#6176](https://github.com/moq-dev/moq/pull/6176). At this run's
   source, moq-tokio emits 556,292 lines and the old transport-row definition
@@ -333,4 +332,4 @@ line to `rs/moq-net/src/lib.rs` after a no-op catch-up build. Sample
 
 ## Required
 
-- [Release cut](/quest/m2/release/cut.md) - the release in flight ships before this run starts
+- [Release cut](/quest/m3/release/cut.md) - the release in flight ships before this run starts
diff --git a/quest/m2/audit-dead-code.md b/quest/m3/audit-dead-code.md
similarity index 93%
rename from quest/m2/audit-dead-code.md
rename to quest/m3/audit-dead-code.md
index 2d040a72f8d..412e5bbe9ea 100644
--- a/quest/m2/audit-dead-code.md
+++ b/quest/m3/audit-dead-code.md
@@ -8,11 +8,10 @@ are planned for deletion when removal breaks a public API.
 ## Plan
 
 Recurs once per major release (decided 2026-10-19). The PR that finishes
-this run also adds the next one with the same file name at the end of the next
-milestone's `Required` (m0 to m1, m1 to m2). The successor keeps the Goal
+this run also adds the next one with the same file name at the end of m3's `Required`, which the shift after the next cut
+brings into m1. The successor keeps the Goal
 and this paragraph; the rest of its Plan is rewritten with what this run
-learned: baselines, results, and what to check first. A successor placed in m2
-also lists the [release cut](/quest/m2/release/cut.md) under `Required`, so it
+learned: baselines, results, and what to check first. The successor also lists the [release cut](/quest/m3/release/cut.md) under `Required`, so it
 waits for the release in flight to ship. Only `/quest-delete` ends the
 recurrence. Fixes land in the run's PR, one commit each, rather than as follow-ups.
 Only a change that needs a maintainer decision (public API, scope) or is
@@ -84,4 +83,4 @@ From the 2026-10-25 run:
 
 ## Required
 
-- [Release cut](/quest/m2/release/cut.md) - the release in flight ships before the next audit starts
+- [Release cut](/quest/m3/release/cut.md) - the release in flight ships before the next audit starts
diff --git a/quest/m2/audit-deps.md b/quest/m3/audit-deps.md
similarity index 96%
rename from quest/m2/audit-deps.md
rename to quest/m3/audit-deps.md
index 164e3eec827..917e4e49fd2 100644
--- a/quest/m2/audit-deps.md
+++ b/quest/m3/audit-deps.md
@@ -11,11 +11,10 @@ that a maintained library covers is planned for replacement.
 ## Plan
 
 Recurs once per major release (decided 2026-10-19). The PR that finishes
-this run also adds the next one with the same file name at the end of the next
-milestone's `Required` (m0 to m1, m1 to m2). The successor keeps the Goal
+this run also adds the next one with the same file name at the end of m3's `Required`, which the shift after the next cut
+brings into m1. The successor keeps the Goal
 and this paragraph; the rest of its Plan is rewritten with what this run
-learned: baselines, results, and what to check first. A successor placed in m2
-also lists the [release cut](/quest/m2/release/cut.md) under `Required`, so it
+learned: baselines, results, and what to check first. The successor also lists the [release cut](/quest/m3/release/cut.md) under `Required`, so it
 waits for the release in flight to ship. Only `/quest-delete` ends the
 recurrence. Fixes land in the run's PR, one commit each, rather than as follow-ups.
 Only a change that needs a maintainer decision (public API, scope) or is
@@ -214,7 +213,7 @@ standalone build, not incremental workspace savings.
   allocator would recreate stats_alloc's instrumentation. Their own units
   cost 0.05/0.03 s; cpu-time also needs libc/platform bindings.
 - `unsafe-libopus`: a nontrivial codec with active moq-audio consumers,
-  not a helper. The [Opus backend](/quest/m2/audio-opus-backend.md) comparison
+  not a helper. The [Opus backend](/quest/m5/audio-opus-backend.md) comparison
   still owns whether a different backend is better; deleting Opus is a
   user-facing feature decision.
 - `moq-gst` keeps its Rust 1.92 floor for GStreamer 0.25, above the
@@ -222,7 +221,7 @@ standalone build, not incremental workspace savings.
 - The QUIC/UDP, RTMP, V4L2, NVIDIA, VA-API, UniFFI and LibAV forks all have
   current transport, gateway, device, binding or codec consumers. Their
   removal would drop behavior or recreate nontrivial platform code;
-  upstream porting stays with [vendor-sync](/quest/m1/vendor-sync/README.md).
+  upstream porting stays with [vendor-sync](/quest/m2/cut-gate/vendor-sync/README.md).
   OpenH264 and device integrations remain opt-in where already gated.
 - Error/primitive derives remain shared infrastructure: `thiserror` is the
   workspace convention; `derive_more` handles existing enum conversions,
@@ -255,4 +254,4 @@ When TypeScript 7.1 is stable, re-check whether the DOM includes
 
 ## Required
 
-- [Release cut](/quest/m2/release/cut.md) - the breaking release ships before the next run
+- [Release cut](/quest/m3/release/cut.md) - the breaking release ships before the next run
diff --git a/quest/m2/audit-docs.md b/quest/m3/audit-docs.md
similarity index 91%
rename from quest/m2/audit-docs.md
rename to quest/m3/audit-docs.md
index c76c714d3c2..7363e2e0648 100644
--- a/quest/m2/audit-docs.md
+++ b/quest/m3/audit-docs.md
@@ -8,11 +8,10 @@ undocumented exported symbols are fixed or planned.
 ## Plan
 
 Recurs once per major release (decided 2026-10-19). The PR that finishes
-this run also adds the next one with the same file name at the end of the next
-milestone's `Required` (m0 to m1, m1 to m2). The successor keeps the Goal
+this run also adds the next one with the same file name at the end of m3's `Required`, which the shift after the next cut
+brings into m1. The successor keeps the Goal
 and this paragraph; the rest of its Plan is rewritten with what this run
-learned: baselines, results, and what to check first. A successor placed in m2
-also lists the [release cut](/quest/m2/release/cut.md) under `Required`, so it
+learned: baselines, results, and what to check first. The successor also lists the [release cut](/quest/m3/release/cut.md) under `Required`, so it
 waits for the release in flight to ship. Only `/quest-delete` ends the
 recurrence. Fixes land in the run's PR, one commit each, rather than as follow-ups.
 Only a change that needs a maintainer decision (public API, scope) or is
@@ -64,4 +63,4 @@ freshest. Baselines:
 
 ## Required
 
-- [Release cut](/quest/m2/release/cut.md) - the release in flight ships before this run starts
+- [Release cut](/quest/m3/release/cut.md) - the release in flight ships before this run starts
diff --git a/quest/m2/audit-interop.md b/quest/m3/audit-interop.md
similarity index 95%
rename from quest/m2/audit-interop.md
rename to quest/m3/audit-interop.md
index d16ddae4d68..e5d188a98c8 100644
--- a/quest/m2/audit-interop.md
+++ b/quest/m3/audit-interop.md
@@ -13,11 +13,10 @@ feature outside the moq-net API).
 ## Plan
 
 Recurs once per major release (decided 2026-10-21). The PR that finishes
-this run also adds the next one with the same file name at the end of the next
-milestone's `Required` (m0 to m1, m1 to m2). The successor keeps the Goal
+this run also adds the next one with the same file name at the end of m3's `Required`, which the shift after the next cut
+brings into m1. The successor keeps the Goal
 and this paragraph; the rest of its Plan is rewritten with what this run
-learned: baselines, results, and what to check first. A successor placed in m2
-also lists the [release cut](/quest/m2/release/cut.md) under `Required`, so it
+learned: baselines, results, and what to check first. The successor also lists the [release cut](/quest/m3/release/cut.md) under `Required`, so it
 waits for the release in flight to ship. Only `/quest-delete` ends the
 recurrence. Fixes land in the run's PR, one commit each, rather than as follow-ups.
 Only a change that needs a maintainer decision (public API, scope) or is
@@ -61,7 +60,7 @@ red cells were already fixed on `main` and wait for the cut, so confirm
 each turned green:
 
 - The runner's clients bumped to the cut, including the API port the
-  [runner client bump](/quest/m2/release/runner-client-bump.md) describes.
+  [runner client bump](/quest/m3/release/runner-client-bump.md) describes.
   The JS client's `moqt://` dials (m0 fix) then reach every relay serving
   WebTransport on that port; a raw-QUIC-only relay stays unsupported, since
   JS has no raw QUIC. The JS client's red5 WebTransport cells still time out
@@ -179,7 +178,7 @@ as read by [moq-dev/moq#7050](https://github.com/moq-dev/moq/pull/7050) and
 
 ## Required
 
-- [Release cut](/quest/m2/release/cut.md) - waits for the release in flight to ship
+- [Release cut](/quest/m3/release/cut.md) - waits for the release in flight to ship
 
 From the 2026-10-25 run: the runner's moq-dev-js `announce-subscribe` case times
 out against imquic on both 0.4.4 and the [moq-dev/moq#6769](https://github.com/moq-dev/moq/pull/6769)
@@ -189,5 +188,5 @@ cells of the 2026-10-31 nightly. Classify it.
 
 ## Related
 
-- [Runner client bump](/quest/m2/release/runner-client-bump.md) - the runner's Rust client moves to the cut and its API
-- [Runner teardown](/quest/m3/interop-runner-approval.md) - the runner's moq.dev clients move to the withdrawing `close()` once it ships
+- [Runner client bump](/quest/m3/release/runner-client-bump.md) - the runner's Rust client moves to the cut and its API
+- [Runner teardown](/quest/m5/interop-runner-approval.md) - the runner's moq.dev clients move to the withdrawing `close()` once it ships
diff --git a/quest/m2/audit-lints.md b/quest/m3/audit-lints.md
similarity index 94%
rename from quest/m2/audit-lints.md
rename to quest/m3/audit-lints.md
index d53ddf45833..298a4d2cf20 100644
--- a/quest/m2/audit-lints.md
+++ b/quest/m3/audit-lints.md
@@ -11,11 +11,10 @@ migration window has passed.
 ## Plan
 
 Recurs once per major release (decided 2026-10-20). The PR that finishes
-this run also adds the next one with the same file name at the end of the next
-milestone's `Required` (m0 to m1, m1 to m2). The successor keeps the Goal
+this run also adds the next one with the same file name at the end of m3's `Required`, which the shift after the next cut
+brings into m1. The successor keeps the Goal
 and this paragraph; the rest of its Plan is rewritten with what this run
-learned: baselines, results, and what to check first. A successor placed in m2
-also lists the [release cut](/quest/m2/release/cut.md) under `Required`, so it
+learned: baselines, results, and what to check first. The successor also lists the [release cut](/quest/m3/release/cut.md) under `Required`, so it
 waits for the release in flight to ship. Only `/quest-delete` ends the
 recurrence. Fixes land in the run's PR, one commit each, rather than as follow-ups.
 Only a change that needs a maintainer decision (public API, scope) or is
@@ -26,7 +25,7 @@ Scope is every language (decided 2026-10-20): clippy and rustc overrides,
 `clippy.toml`, `biome-ignore`, `@ts-expect-error`, `noqa` and
 `type: ignore`, Kotlin `@Suppress`, and the equivalents in Go, Swift, Dart,
 and C/C++. `dead_code` and `unused` suppressions belong to the [dead code
-audit](/quest/m2/audit-dead-code.md); skip them here. Generated or vendored
+audit](/quest/m3/audit-dead-code.md); skip them here. Generated or vendored
 bindings (`moq-nvenc`, `moq-v4l/src/sys`, `moq-rtmp/src/rml`, and the
 untracked UniFFI output) keep their blanket allows unless the generator can
 emit clean code. Shell `shellcheck disable` comments stay out of scope.
@@ -60,7 +59,7 @@ Python wrapper. This run only reviews what those gates can't see.
   `-mmacosx-version-min`), and the platform lane's features plus
   `moq-video/render`. That found every stale suppression the m1 run fixed.
 - Windows clippy still reports dead code the [dead code
-  audit](/quest/m2/audit-dead-code.md) owns: `capture::pump::Read::Idle`
+  audit](/quest/m3/audit-dead-code.md) owns: `capture::pump::Read::Idle`
   (only X11 holds a capture idle) and `I420::from_bgra`, whose cfg and doc
   still name Windows Desktop Duplication though only PipeWire calls it.
 - Swift: the nightly macOS platform job builds the wrapper and tests with
@@ -146,4 +145,4 @@ output.
 
 ## Required
 
-- [Release cut](/quest/m2/release/cut.md) - the release in flight ships before this run starts
+- [Release cut](/quest/m3/release/cut.md) - the release in flight ships before this run starts
diff --git a/quest/m2/audit-perf.md b/quest/m3/audit-perf.md
similarity index 95%
rename from quest/m2/audit-perf.md
rename to quest/m3/audit-perf.md
index 9a4ac34bfb9..999059804d9 100644
--- a/quest/m2/audit-perf.md
+++ b/quest/m3/audit-perf.md
@@ -11,12 +11,11 @@ for.
 ## Plan
 
 Recurs once per major release (decided 2026-10-19). The PR that finishes
-this run also adds the next one with the same file name at the end of the next
-milestone's `Required` (m0 to m1, m1 to m2). The successor keeps the Goal,
+this run also adds the next one with the same file name at the end of m3's `Required`, which the shift after the next cut
+brings into m1. The successor keeps the Goal,
 this paragraph, and the release baseline section; the rest of its Plan is
 rewritten with what this run learned: baselines, results, and what to check
-first. A successor placed in m2
-also lists the [release cut](/quest/m2/release/cut.md) under `Required`, so it
+first. The successor also lists the [release cut](/quest/m3/release/cut.md) under `Required`, so it
 waits for the release in flight to ship. Only `/quest-delete` ends the
 recurrence. Fixes land in the run's PR, one commit each, rather than as follow-ups.
 Only a change that needs a maintainer decision (public API, scope) or is
@@ -160,17 +159,17 @@ wall-clock bisect blames the wrong commit. Count instructions instead:
 Each needs a bench, swept over both axes where it fans out, or its own
 follow-up quest. The m1 run added none of these:
 
-1. [HLS request fan-out](/quest/m2/performance-survey/hls-serving.md) owns
+1. [HLS request fan-out](/quest/m5/performance-survey/hls-serving.md) owns
    repeated segment fetch/remux and playlist rendering, swept over viewers,
    renditions and window segments.
 2. LOC and CMAF wire containers in moq-mux: `containers` and `export` only use
    `Container::Legacy`; sweep container x frame size x frames.
-3. [Browser media copies](/quest/m2/performance-survey/browser-media-copies.md)
+3. [Browser media copies](/quest/m5/performance-survey/browser-media-copies.md)
    owns CMAF sample copies and LOC encode allocation. Generic `js/msf` and
    `js/flate` benchmark coverage remains here.
 4. moq-quic loss recovery and real congestion controllers: every bench pins
    `Unlimited`; sweep controller x flight x loss x streams.
-5. [Announcement snapshots](/quest/m2/performance-survey/announced-snapshots.md)
+5. [Announcement snapshots](/quest/m5/performance-survey/announced-snapshots.md)
    owns HTTP snapshot/rendering costs across routes and pollers.
 6. JWT verification is covered: `moq-auth`'s `verify` bench runs nightly in
    `rust-extra` (see [bench/README.md](/bench/README.md#auth-verification)).
@@ -184,7 +183,7 @@ follow-up quest. The m1 run added none of these:
    do not count that transfer as another mandatory copy. Sweep publishers
    x renditions, channels and frame duration in a browser.
 
-The [2026-10-22 source survey](/quest/m2/performance-survey/README.md) owns
+The [2026-10-22 source survey](/quest/m5/performance-survey/README.md) owns
 the extracted items above and additional algorithmic hypotheses, with paired
 benchmarks required before optimization. This audit still owns nightly
 regression attribution and the remaining coverage. Its fragmented-MKV child
@@ -202,4 +201,4 @@ duplicate it.
 
 ## Required
 
-- [Cut and publish the prepared breaking release](/quest/m2/release/cut.md) - the release in flight ships before this run starts
+- [Cut and publish the prepared breaking release](/quest/m3/release/cut.md) - the release in flight ships before this run starts
diff --git a/quest/m2/audit-quests.md b/quest/m3/audit-quests.md
similarity index 93%
rename from quest/m2/audit-quests.md
rename to quest/m3/audit-quests.md
index 23d97f0a9bc..8ded49f7555 100644
--- a/quest/m2/audit-quests.md
+++ b/quest/m3/audit-quests.md
@@ -8,11 +8,10 @@ conflicting, and misranked quests are fixed.
 ## Plan
 
 Recurs once per major release (decided 2026-10-19). The PR that finishes
-this run also adds the next one with the same file name at the end of the next
-milestone's `Required` (m0 to m1, m1 to m2). The successor keeps the Goal
+this run also adds the next one with the same file name at the end of m3's `Required`, which the shift after the next cut
+brings into m1. The successor keeps the Goal
 and this paragraph; the rest of its Plan is rewritten with what this run
-learned: baselines, results, and what to check first. A successor placed in m2
-also lists the [release cut](/quest/m2/release/cut.md) under `Required`, so it
+learned: baselines, results, and what to check first. The successor also lists the [release cut](/quest/m3/release/cut.md) under `Required`, so it
 waits for the release in flight to ship. Only `/quest-delete` ends the
 recurrence. Fixes land in the run's PR, one commit each, rather than as follow-ups.
 Only a change that needs a maintainer decision (public API, scope) or is
@@ -81,4 +80,4 @@ Check first next run:
 
 ## Required
 
-- [Release cut](/quest/m2/release/cut.md) - the release in flight ships before this run starts
+- [Release cut](/quest/m3/release/cut.md) - the release in flight ships before this run starts
diff --git a/quest/m2/audit-simplify.md b/quest/m3/audit-simplify.md
similarity index 92%
rename from quest/m2/audit-simplify.md
rename to quest/m3/audit-simplify.md
index f6c7b88d8dd..f378f92414e 100644
--- a/quest/m2/audit-simplify.md
+++ b/quest/m3/audit-simplify.md
@@ -10,11 +10,10 @@ removed. The result is net simpler, even where that means less scope.
 ## Plan
 
 Recurs once per major release (decided 2026-10-19). The PR that finishes
-this run also adds the next one with the same file name at the end of the next
-milestone's `Required` (m0 to m1, m1 to m2). The successor keeps the Goal
+this run also adds the next one with the same file name at the end of m3's `Required`, which the shift after the next cut
+brings into m1. The successor keeps the Goal
 and this paragraph; the rest of its Plan is rewritten with what this run
-learned: baselines, results, and what to check first. A successor placed in m2
-also lists the [release cut](/quest/m2/release/cut.md) under `Required`, so it
+learned: baselines, results, and what to check first. The successor also lists the [release cut](/quest/m3/release/cut.md) under `Required`, so it
 waits for the release in flight to ship. Only `/quest-delete` ends the
 recurrence. Fixes land in the run's PR, one commit each, rather than as follow-ups.
 Only a change that needs a maintainer decision (public API, scope) or is
@@ -23,7 +22,7 @@ follow-up through `/quest-plan`.
 
 Narrowing a feature or reshaping an API is the maintainer's call, so those
 are proposals with a recommendation, filed as follow-ups. Unlike the [dead
-code audit](/quest/m2/audit-dead-code.md), this targets code that is used but
+code audit](/quest/m3/audit-dead-code.md), this targets code that is used but
 overbuilt.
 
 ### Check first
@@ -59,7 +58,7 @@ New from m1:
 
 Proposals from m0 are settled. The moq-video raw-frame publisher and the
 shared `Background` would each have had moq-ffi as their only user once the
-[generated C bindings](/quest/m2/c/README.md) retire moq-c's hand-written
+[generated C bindings](/quest/m3/c/README.md) retire moq-c's hand-written
 copies, so both were dropped. The Go wrapper's missing `bridge.CallHandle` was
 in the generated binding, not the wrapper: uniffi-bindgen-go
 `v0.10.0-kixelated.2` destroys a result whose context was cancelled as it
@@ -105,4 +104,4 @@ modules at the end of m1: `ietf/publisher.rs` 17,182 lines,
 
 ## Required
 
-- [Release cut](/quest/m2/release/cut.md) - wait for the release in flight to ship
+- [Release cut](/quest/m3/release/cut.md) - wait for the release in flight to ship
diff --git a/quest/m2/audit-size.md b/quest/m3/audit-size.md
similarity index 93%
rename from quest/m2/audit-size.md
rename to quest/m3/audit-size.md
index 0eef6e28e69..a79bdd9a38c 100644
--- a/quest/m2/audit-size.md
+++ b/quest/m3/audit-size.md
@@ -8,11 +8,10 @@ previous run is explained, fixed, or planned.
 ## Plan
 
 Recurs once per major release (decided 2026-10-19). The PR that finishes
-this run also adds the next one with the same file name at the end of the next
-milestone's `Required` (m0 to m1, m1 to m2). The successor keeps the Goal
+this run also adds the next one with the same file name at the end of m3's `Required`, which the shift after the next cut
+brings into m1. The successor keeps the Goal
 and this paragraph; the rest of its Plan is rewritten with what this run
-learned: baselines, results, and what to check first. A successor placed in m2
-also lists the [release cut](/quest/m2/release/cut.md) under `Required`, so it
+learned: baselines, results, and what to check first. The successor also lists the [release cut](/quest/m3/release/cut.md) under `Required`, so it
 waits for the release in flight to ship. Only `/quest-delete` ends the
 recurrence. Fixes land in the run's PR, one commit each, rather than as follow-ups.
 Only a change that needs a maintainer decision (public API, scope) or is
@@ -135,7 +134,7 @@ attribution, not a compressed-byte decomposition. Cross-crate inlining,
 compiler-generated code, and metadata account for other bytes.
 [moq-dev/moq#7400](https://github.com/moq-dev/moq/pull/7400), merged after
 these measurements, addresses the catalog serialization duplication lead. The [bindings size profile
-quest](/quest/m2/ffi-size-profile.md) requires codec/crypto and FFI throughput
+quest](/quest/m5/ffi-size-profile.md) requires codec/crypto and FFI throughput
 measurements before adopting opt-level s; no compiler profile was changed.
 
 The Swift source tarball grows in `Generated.swift`, from 684,643 to 704,105
@@ -150,10 +149,10 @@ moq's WASM build was removed on 2026-10-31, so there is no WASM row to repeat.
 
 ## Required
 
-- [Release cut](/quest/m2/release/cut.md)
+- [Release cut](/quest/m3/release/cut.md)
 
 ## Related
 
-- [FFI size profile](/quest/m2/ffi-size-profile.md)
-- [Native synchronous codecs](/quest/m2/native-compression-sync.md)
-- [Native browser codecs](/quest/m2/native-compression-adopt.md)
+- [FFI size profile](/quest/m5/ffi-size-profile.md)
+- [Native synchronous codecs](/quest/m5/native-compression-sync.md)
+- [Native browser codecs](/quest/m5/native-compression-adopt.md)
diff --git a/quest/m2/audit-test-cost.md b/quest/m3/audit-test-cost.md
similarity index 95%
rename from quest/m2/audit-test-cost.md
rename to quest/m3/audit-test-cost.md
index 0e0abbb188b..3ebd0f1fd1c 100644
--- a/quest/m2/audit-test-cost.md
+++ b/quest/m3/audit-test-cost.md
@@ -5,16 +5,15 @@
 The slowest, flakiest, and least valuable tests are deleted by default, and
 the ones that earn their keep are sped up, fixed, or moved to nightly, so the
 suite costs what it earns. Workflows and jobs belong to the
-[CI workflow audit](/quest/m2/audit-ci.md).
+[CI workflow audit](/quest/m3/audit-ci.md).
 
 ## Plan
 
 Recurs once per major release (decided 2026-10-19). The PR that finishes
-this run also adds the next one with the same file name at the end of the next
-milestone's `Required` (m0 to m1, m1 to m2). The successor keeps the Goal
+this run also adds the next one with the same file name at the end of m3's `Required`, which the shift after the next cut
+brings into m1. The successor keeps the Goal
 and this paragraph; the rest of its Plan is rewritten with what this run
-learned: baselines, results, and what to check first. A successor placed in m2
-also lists the [release cut](/quest/m2/release/cut.md) under `Required`, so it
+learned: baselines, results, and what to check first. The successor also lists the [release cut](/quest/m3/release/cut.md) under `Required`, so it
 waits for the release in flight to ship. Only `/quest-delete` ends the
 recurrence. Fixes land in the run's PR, one commit each, rather than as follow-ups.
 Only a change that needs a maintainer decision (public API, scope) or is
@@ -120,4 +119,4 @@ Check first:
 
 ## Required
 
-- [Cut and publish the prepared breaking release](/quest/m2/release/cut.md) - the release in flight ships before this run starts
+- [Cut and publish the prepared breaking release](/quest/m3/release/cut.md) - the release in flight ships before this run starts
diff --git a/quest/m2/audit-test-coverage.md b/quest/m3/audit-test-coverage.md
similarity index 92%
rename from quest/m2/audit-test-coverage.md
rename to quest/m3/audit-test-coverage.md
index 1655070b927..ba40fcdcccb 100644
--- a/quest/m2/audit-test-coverage.md
+++ b/quest/m3/audit-test-coverage.md
@@ -8,11 +8,10 @@ test runs in CI.
 ## Plan
 
 Recurs once per major release (decided 2026-10-19). The PR that finishes
-this run also adds the next one with the same file name at the end of the next
-milestone's `Required` (m0 to m1, m1 to m2). The successor keeps the Goal
+this run also adds the next one with the same file name at the end of m3's `Required`, which the shift after the next cut
+brings into m1. The successor keeps the Goal
 and this paragraph; the rest of its Plan is rewritten with what this run
-learned: baselines, results, and what to check first. A successor placed in m2
-also lists the [release cut](/quest/m2/release/cut.md) under `Required`, so it
+learned: baselines, results, and what to check first. The successor also lists the [release cut](/quest/m3/release/cut.md) under `Required`, so it
 waits for the release in flight to ship. Only `/quest-delete` ends the
 recurrence. Fixes land in the run's PR, one commit each, rather than as follow-ups.
 Only a change that needs a maintainer decision (public API, scope) or is
@@ -110,7 +109,7 @@ land after this baseline, so the next report should show moq-mux's
   two seconds ahead. Playback now asks PulseAudio for 20 ms periods, and the
   tests wait until the device's clock moves. Watch that the first nightly
   after this run is green, and keep any new device test behind the same wait.
-  Capture likely shares the buffer default: [PulseAudio capture periods](/quest/m2/pulseaudio-capture-period.md).
+  Capture likely shares the buffer default: [PulseAudio capture periods](/quest/m3/pulseaudio-capture-period.md).
 - The binding facades were the largest untested public surface:
   `moq_mux::import::Track` had decoded only Avc3, Hvc1, VP8, and the audio
   codecs other than MP3; `TrackStream` (the FFI raw-stream producer) had
@@ -119,9 +118,9 @@ land after this baseline, so the next report should show moq-mux's
   claimed `finish` drops the trailing access unit, which it does not.
 - `just rs gpu` could not load a Vulkan loader inside the Nix shell on a
   non-NixOS host. AMD and Intel now run through the flake's Mesa; NVIDIA
-  stays with [GPU CI](/quest/m2/gpu-ci.md).
+  stays with [GPU CI](/quest/m3/gpu-ci.md).
 - The VA-API renderer import tests have no caller: the m0 run mapped them to
-  GPU CI, which covers only NVIDIA. [VA-API renderer tests](/quest/m2/vaapi-render-tests.md)
+  GPU CI, which covers only NVIDIA. [VA-API renderer tests](/quest/m4/vaapi-render-tests.md)
   owns them now.
 - Every `#[ignore]` has a reason, and each one's caller is a recipe or a
   quest. Several reasons name neither (the WGC, MediaCodec, and NVIDIA
@@ -138,10 +137,10 @@ land after this baseline, so the next report should show moq-mux's
   `rust-test` benchmark group. A red leg hides everything after it.
 - Public functions never executed, by the scan above, starting with moq-c,
   moq-ffi, and moq-mux's import facades.
-- Whether [Bindings in the interop matrix](/quest/m2/interop-bindings.md)
-  and [GPU CI](/quest/m2/gpu-ci.md) landed, before re-auditing the tests they
+- Whether [Bindings in the interop matrix](/quest/m4/interop-bindings.md)
+  and [GPU CI](/quest/m3/gpu-ci.md) landed, before re-auditing the tests they
   own.
 
 ## Required
 
-- [Release cut](/quest/m2/release/cut.md) - the release in flight ships before this run starts
+- [Release cut](/quest/m3/release/cut.md) - the release in flight ships before this run starts
diff --git a/quest/m2/broadcast-fairness.md b/quest/m3/broadcast-fairness.md
similarity index 100%
rename from quest/m2/broadcast-fairness.md
rename to quest/m3/broadcast-fairness.md
diff --git a/quest/m2/bun-check.md b/quest/m3/bun-check.md
similarity index 100%
rename from quest/m2/bun-check.md
rename to quest/m3/bun-check.md
diff --git a/quest/m2/c/README.md b/quest/m3/c/README.md
similarity index 85%
rename from quest/m2/c/README.md
rename to quest/m3/c/README.md
index 963e4372658..b64669c313c 100644
--- a/quest/m2/c/README.md
+++ b/quest/m3/c/README.md
@@ -12,7 +12,7 @@ scope; they already sit on moq-ffi through the generated C++.
 
 Decided 2026-10-25 (maintainer): this line ships after the cut, once moq builds
 its bindings from rust2's UniFFI fork. The hand-written crate ships at the cut
-with [parity](/quest/m1/c/README.md) instead. The generator fix for the C name
+with [parity](/quest/m2/cut-gate/c/README.md) instead. The generator fix for the C name
 clash landed in rust2's fork
 ([moq-dev/rust2#66](https://github.com/moq-dev/rust2/pull/66)), not in a
 `kixelated/uniffi-bindgen-cpp` release, and reaches moq with the switch.
@@ -42,16 +42,16 @@ The `moq-c` package (`c/moq`, `just c check`) builds the generated header and
 its probe in CI, so drift fails loud. moq-ffi's record
 `MoqAudioEncoderFinished` was renamed from `MoqAudioEncoderFinish` so moq's
 current generator emits the header;
-[the switch](/quest/m2/ffi-exporter.md) reverts that rename. No `c-v*` tag ships
+[the switch](/quest/m3/ffi-exporter.md) reverts that rename. No `c-v*` tag ships
 before the cut.
 
 The line owns the pre-publication check: every `doc/lib/c` sample and the C
 interop client build and run against the built release archive.
-[Published archive proof](/quest/m2/release/c-publish.md) repeats it after
-publication; [old-crate retirement](/quest/m2/release/c-retire.md) follows.
+[Published archive proof](/quest/m3/release/c-publish.md) repeats it after
+publication; [old-crate retirement](/quest/m3/release/c-retire.md) follows.
 
 ## Required
 
-- [Switch to rust2's exporter](/quest/m2/ffi-exporter.md) - the C ABI comes from rust2's exporter instead of a UniFFI generator
-- [C consumers](/quest/m2/c/consumers.md) - the C interop client and `doc/lib/c` samples move onto the generated API
-- [Async failure contract](/quest/m2/c/async-failure-contract.md) - every generated async call returns a task and calls back exactly once, cancelled when its task was freed first
+- [Switch to rust2's exporter](/quest/m3/ffi-exporter.md) - the C ABI comes from rust2's exporter instead of a UniFFI generator
+- [C consumers](/quest/m3/c/consumers.md) - the C interop client and `doc/lib/c` samples move onto the generated API
+- [Async failure contract](/quest/m3/c/async-failure-contract.md) - every generated async call returns a task and calls back exactly once, cancelled when its task was freed first
diff --git a/quest/m2/c/async-failure-contract.md b/quest/m3/c/async-failure-contract.md
similarity index 97%
rename from quest/m2/c/async-failure-contract.md
rename to quest/m3/c/async-failure-contract.md
index 6b12b14f901..bb736057a9f 100644
--- a/quest/m2/c/async-failure-contract.md
+++ b/quest/m3/c/async-failure-contract.md
@@ -4,7 +4,7 @@
 
 Every async call in the generated C API has a callback contract a C caller can rely on for freeing `user_data`: the call returns a task, never NULL, and its callback runs exactly once, with the result or, when the task was freed first, with `cancelled` set.
 
-[moq-dev/rust2#169](https://github.com/moq-dev/rust2/pull/169) implements it in rust2's C generator. Waiting on [Switch to rust2's exporter](/quest/m2/ffi-exporter.md) to move the C generator pin: `c/moq` adopts the new callback shape then, along with the CamelCase names, and `c/moq/test/probe.c`'s callbacks take `cancelled` and release `user_data` there. Delete this quest with that PR.
+[moq-dev/rust2#169](https://github.com/moq-dev/rust2/pull/169) implements it in rust2's C generator. Waiting on [Switch to rust2's exporter](/quest/m3/ffi-exporter.md) to move the C generator pin: `c/moq` adopts the new callback shape then, along with the CamelCase names, and `c/moq/test/probe.c`'s callbacks take `cancelled` and release `user_data` there. Delete this quest with that PR.
 
 Decided 2026-11-02 (maintainer, /quest-unblock): moq switches to rust2's exporter, not the UniFFI fork, so this contract must hold for the exporter's C ABI futures; rust2#169's fork implementation is the reference.
 
diff --git a/quest/m2/c/consumers.md b/quest/m3/c/consumers.md
similarity index 87%
rename from quest/m2/c/consumers.md
rename to quest/m3/c/consumers.md
index 2ade0c5d38b..3bdf1f7cbec 100644
--- a/quest/m2/c/consumers.md
+++ b/quest/m3/c/consumers.md
@@ -6,7 +6,7 @@ The C interop client (`test/interop/clients/c`) and the `doc/lib/c` samples use
 the generated `moq-c` API and pass `just test interop --all` and the doc-sample
 build. Nothing in the repository calls the hand-written ABI any more except
 the smoke client (`test/smoke/clients/c`), which
-[Published generated C](/quest/m2/release/c-publish.md) moves.
+[Published generated C](/quest/m3/release/c-publish.md) moves.
 
 ## Plan
 
@@ -21,7 +21,7 @@ the smoke client (`test/smoke/clients/c`), which
   callbacks on the host's own loop through `moq_set_dispatcher`.
 
 Waits for the cut and the generator switch (found when first started,
-2026-10-28; decided 2026-10-31). Until the cut, [moq-c parity](/quest/m1/c/README.md) ships the
+2026-10-28; decided 2026-10-31). Until the cut, [moq-c parity](/quest/m2/cut-gate/c/README.md) ships the
 hand-written crate at 0.22 and proves it with this interop client and the current
 `doc/lib/c`, and `doc/` describes only what ships, so either half landing first
 drops the shipping crate's proof and documents an unpublished API. The switch
@@ -34,10 +34,10 @@ C++ interop client already drives the same moq-ffi surface both ways.
 
 `test/smoke/clients/c` checks the published archive with the hand-written ABI,
 so it can move only once the generated archive publishes, after this quest;
-[Published generated C](/quest/m2/release/c-publish.md) owns that move
+[Published generated C](/quest/m3/release/c-publish.md) owns that move
 (decided 2026-10-31).
 
 ## Required
 
-- [Breaking release cut](/quest/m2/release/cut.md) - the hand-written crate ships at 0.22 with this client and these docs as its proof
-- [Switch to rust2's exporter](/quest/m2/ffi-exporter.md) - the generated C type names settle before consumers are written against them
+- [Breaking release cut](/quest/m3/release/cut.md) - the hand-written crate ships at 0.22 with this client and these docs as its proof
+- [Switch to rust2's exporter](/quest/m3/ffi-exporter.md) - the generated C type names settle before consumers are written against them
diff --git a/quest/m2/capture-alsa-link.md b/quest/m3/capture-alsa-link.md
similarity index 92%
rename from quest/m2/capture-alsa-link.md
rename to quest/m3/capture-alsa-link.md
index bf40a90c4d1..aa2d78fb920 100644
--- a/quest/m2/capture-alsa-link.md
+++ b/quest/m3/capture-alsa-link.md
@@ -20,7 +20,7 @@ still links and starts driverless.
 `capture` and `playback` pull cpal with ALSA always linked; the host flags
 alone no longer activate it. cpal cannot load ALSA at runtime in-tree (no
 release offers it, and the in-tree routes are hacks), so this waits on
-[the cpal release](/quest/m2/cpal-alsa-runtime.md). Once it ships, bump cpal,
+[the cpal release](/quest/m3/cpal-alsa-runtime.md). Once it ships, bump cpal,
 enable whatever it needs, and update the moq-audio and moq-cli feature
 comments that call libasound a build-time link.
 
@@ -41,8 +41,8 @@ covers it. Keep the platform jobs. Update the Cargo feature comments and
 
 ## Required
 
-- [cpal loads libasound at runtime](/quest/m2/cpal-alsa-runtime.md) - condition: a cpal release whose Linux build carries no load-time libasound requirement
+- [cpal loads libasound at runtime](/quest/m3/cpal-alsa-runtime.md) - condition: a cpal release whose Linux build carries no load-time libasound requirement
 
 ## Related
 
-- [Ship capture and playback](/quest/m2/cli-packaging.md) - the shippable capture milestone this work supports
+- [Ship capture and playback](/quest/m3/cli-packaging.md) - the shippable capture milestone this work supports
diff --git a/quest/m2/capture-app-audio-macos.md b/quest/m3/capture-app-audio-macos.md
similarity index 86%
rename from quest/m2/capture-app-audio-macos.md
rename to quest/m3/capture-app-audio-macos.md
index 4195fb855da..295ea43a591 100644
--- a/quest/m2/capture-app-audio-macos.md
+++ b/quest/m3/capture-app-audio-macos.md
@@ -18,5 +18,5 @@ desktop audio through its display filter.
 
 ## Related
 
-- [Linux capture parity](/quest/m2/capture-linux.md) - per-app audio through PipeWire nodes
-- [Windows capture parity](/quest/m2/capture-windows.md) - per-app audio through WASAPI process loopback
+- [Linux capture parity](/quest/m3/capture-linux.md) - per-app audio through PipeWire nodes
+- [Windows capture parity](/quest/m3/capture-windows.md) - per-app audio through WASAPI process loopback
diff --git a/quest/m2/capture-linux.md b/quest/m3/capture-linux.md
similarity index 97%
rename from quest/m2/capture-linux.md
rename to quest/m3/capture-linux.md
index 47bd6313e60..2d8d9ca3fe6 100644
--- a/quest/m2/capture-linux.md
+++ b/quest/m3/capture-linux.md
@@ -43,5 +43,5 @@ unimplemented, because xdg-desktop-portal owns source selection:
 
 ## Related
 
-- [Windows capture parity](/quest/m2/capture-windows.md) - the same gaps,
+- [Windows capture parity](/quest/m3/capture-windows.md) - the same gaps,
   through Windows.Graphics.Capture and WASAPI
diff --git a/quest/m2/capture-windows.md b/quest/m3/capture-windows.md
similarity index 90%
rename from quest/m2/capture-windows.md
rename to quest/m3/capture-windows.md
index 7680587411f..49232d45db0 100644
--- a/quest/m2/capture-windows.md
+++ b/quest/m3/capture-windows.md
@@ -4,7 +4,7 @@
 
 App capture and system audio work on Windows. Display and window capture,
 including the cursor, move to
-[Windows.Graphics.Capture](/quest/m2/capture-wgc.md).
+[Windows.Graphics.Capture](/quest/m4/capture-wgc.md).
 
 ## Plan
 
@@ -31,6 +31,6 @@ window-only decision still stands after that backend lands.
 
 ## Related
 
-- [Windows.Graphics.Capture](/quest/m2/capture-wgc.md) - display and window capture with the cursor, which this quest no longer owns
-- [Linux capture parity](/quest/m2/capture-linux.md) - the same gaps, through
+- [Windows.Graphics.Capture](/quest/m4/capture-wgc.md) - display and window capture with the cursor, which this quest no longer owns
+- [Linux capture parity](/quest/m3/capture-linux.md) - the same gaps, through
   the portal and PipeWire
diff --git a/quest/m2/cli-packaging.md b/quest/m3/cli-packaging.md
similarity index 94%
rename from quest/m2/cli-packaging.md
rename to quest/m3/cli-packaging.md
index 793dd3f2e75..fa6fdc34cf4 100644
--- a/quest/m2/cli-packaging.md
+++ b/quest/m3/cli-packaging.md
@@ -28,7 +28,7 @@ builds with it. `doc/bin/cli.md` tells source builders to pass
 The individual sub-features stay, so a self-compiler can still pick a subset.
 `vaapi` and `nvidia` load their driver libraries at runtime (dlopen), so they
 belong in `release`. The microphone pulls ALSA through cpal, which is why
-`release` waits on [ALSA without a load-time link](/quest/m2/capture-alsa-link.md);
+`release` waits on [ALSA without a load-time link](/quest/m3/capture-alsa-link.md);
 `play` pulls winit plus a GPU stack. macOS and Windows use OS frameworks and
 add nothing.
 
@@ -54,7 +54,7 @@ encodes through rkmpp in a vendor kernel, not V4L2, so it stays on the
 
 `pipewire` stays out of `release` (decided 2026-10-06, reaffirmed
 2026-10-26): it needs libpipewire-0.3 to load, the same load-time requirement
-[ALSA](/quest/m2/capture-alsa-link.md) removes. It joins once it loads lazily.
+[ALSA](/quest/m3/capture-alsa-link.md) removes. It joins once it loads lazily.
 
 Decided in the 2026-09-30 audit: the v4l2 encode quest folded in here, since
 its remaining work was one release feature flag and a doc note.
@@ -65,4 +65,4 @@ and `moq-audio/capture` explicitly, and `release` enables `capture`.
 
 ## Required
 
-- [Audio capture without runtime system libraries](/quest/m2/capture-alsa-link.md) - the microphone path must start without system audio libraries before every distribution can ship it
+- [Audio capture without runtime system libraries](/quest/m3/capture-alsa-link.md) - the microphone path must start without system audio libraries before every distribution can ship it
diff --git a/quest/m2/cmsg-len-send.md b/quest/m3/cmsg-len-send.md
similarity index 100%
rename from quest/m2/cmsg-len-send.md
rename to quest/m3/cmsg-len-send.md
diff --git a/quest/m2/connection-panic-isolation.md b/quest/m3/connection-panic-isolation.md
similarity index 100%
rename from quest/m2/connection-panic-isolation.md
rename to quest/m3/connection-panic-isolation.md
diff --git a/quest/m2/cpal-alsa-runtime.md b/quest/m3/cpal-alsa-runtime.md
similarity index 90%
rename from quest/m2/cpal-alsa-runtime.md
rename to quest/m3/cpal-alsa-runtime.md
index b0869e69b28..e98cfaeedf8 100644
--- a/quest/m2/cpal-alsa-runtime.md
+++ b/quest/m3/cpal-alsa-runtime.md
@@ -17,13 +17,13 @@ release is out, delete this quest.
   `pulseaudio` on) and confirm `readelf -d` lists no `libasound.so.2` under
   `NEEDED`. A clean `readelf` is not enough on its own: the binary must also
   start, list devices, and play on a host without libasound, as
-  [capture-alsa-link](/quest/m2/capture-alsa-link.md) verifies.
+  [capture-alsa-link](/quest/m3/capture-alsa-link.md) verifies.
 
 ## Plan
 
 Decided 2026-10-08: the capture chain (this quest,
-[capture-alsa-link](/quest/m2/capture-alsa-link.md), and
-[Ship capture and playback](/quest/m2/cli-packaging.md)) moves to m2 and parks
+[capture-alsa-link](/quest/m3/capture-alsa-link.md), and
+[Ship capture and playback](/quest/m3/cli-packaging.md)) moves to m2 and parks
 until cpal ships runtime ALSA loading. Nothing is posted upstream and no fork
 is taken meanwhile.
 
@@ -36,7 +36,7 @@ pkg-config and offers no runtime-loading mode. No upstream issue or PR asks
 for either.
 
 Two upstream shapes, either of which unblocks
-[Audio capture without runtime system libraries](/quest/m2/capture-alsa-link.md):
+[Audio capture without runtime system libraries](/quest/m3/capture-alsa-link.md):
 
 - **Runtime loading.** An `alsa-sys` feature that resolves the `snd_*`
   symbols through dlopen (bindgen can emit such a wrapper), forwarded by
@@ -64,4 +64,4 @@ calls a symbol the shim misses.
 
 ## Related
 
-- [Ship capture and playback](/quest/m2/cli-packaging.md) - needs the microphone path to start without libasound
+- [Ship capture and playback](/quest/m3/cli-packaging.md) - needs the microphone path to start without libasound
diff --git a/quest/m2/cpp-ffi-reuse.md b/quest/m3/cpp-ffi-reuse.md
similarity index 100%
rename from quest/m2/cpp-ffi-reuse.md
rename to quest/m3/cpp-ffi-reuse.md
diff --git a/quest/m2/crates-trusted-publisher.md b/quest/m3/crates-trusted-publisher.md
similarity index 91%
rename from quest/m2/crates-trusted-publisher.md
rename to quest/m3/crates-trusted-publisher.md
index 23d1e883246..24b9b133146 100644
--- a/quest/m2/crates-trusted-publisher.md
+++ b/quest/m3/crates-trusted-publisher.md
@@ -4,12 +4,12 @@
 
 Every crate that `release-rs.yml` publishes has a crates.io trusted publisher
 for `moq-dev/moq`, workflow `release-rs.yml`, and environment `publish`, so
-[Rust releases publish through OIDC](/quest/m2/release-rs-oidc.md) can start.
+[Rust releases publish through OIDC](/quest/m3/release-rs-oidc.md) can start.
 Delete this quest once every crate has one.
 
 ## Waiting
 
-- Maintainer: after [the cut](/quest/m2/release/cut.md) publishes kio-macros, moq-c,
+- Maintainer: after [the cut](/quest/m3/release/cut.md) publishes kio-macros, moq-c,
   moq-congestion, moq-crypto, moq-ice, moq-quic, and moq-rtsp by token (and
   moq-bench, whenever [its first publish](/quest/m1/bench-publish.md) lands), add
   their trusted publishers the same way. Settings pages need a crates.io
@@ -18,8 +18,8 @@ Delete this quest once every crate has one.
 ## Plan
 
 Decided 2026-11-05 (maintainer left the choice to the agent, /quest-unblock):
-✅ move this quest and [Rust releases publish through OIDC](/quest/m2/release-rs-oidc.md)
-to m2 behind [the cut](/quest/m2/release/cut.md). The seven crates the cut
+✅ move this quest and [Rust releases publish through OIDC](/quest/m3/release-rs-oidc.md)
+to m2 behind [the cut](/quest/m3/release/cut.md). The seven crates the cut
 first-publishes by token cannot get a trusted publisher before it, and the cut
 runs after m1, so neither quest could finish inside m1. Not chosen: keeping
 both in m1 and treating the cut as part of finishing m1.
@@ -59,4 +59,4 @@ workspace instead.
 
 ## Required
 
-- [Cut the release](/quest/m2/release/cut.md) - the cut first-publishes the seven crates by token
+- [Cut the release](/quest/m3/release/cut.md) - the cut first-publishes the seven crates by token
diff --git a/quest/m2/crypto-key-load.md b/quest/m3/crypto-key-load.md
similarity index 92%
rename from quest/m2/crypto-key-load.md
rename to quest/m3/crypto-key-load.md
index 95b3fffea15..2010f01f0f6 100644
--- a/quest/m2/crypto-key-load.md
+++ b/quest/m3/crypto-key-load.md
@@ -15,4 +15,4 @@ Planned 2026-11-03 (maintainer) from Kixel's `@kixel/mesh`
 had to carry its own Ed25519 and z-base-32 code because `SecretKey` cannot
 load a stored key and its `sign` is internal. Keep generated keys working,
 keep the browser path non-extractable, and test that a key loaded from bytes
-signs what Rust verifies. Ranked at the top of m2 beside the mesh libraries.
+signs what Rust verifies. Ranked at the top of m3 beside the mesh libraries.
diff --git a/quest/m2/dart-ios.md b/quest/m3/dart-ios.md
similarity index 96%
rename from quest/m2/dart-ios.md
rename to quest/m3/dart-ios.md
index 92f3e220dce..b160d14f2bf 100644
--- a/quest/m2/dart-ios.md
+++ b/quest/m3/dart-ios.md
@@ -38,4 +38,4 @@ and drop the three iOS targets from `release-dart-ffi.yml` rather than paying
 
 ## Related
 
-- [Dart publish](/quest/m2/release/dart-publish.md) - the packages are already on pub.dev, and `moq_ffi` is tagged `platform:ios`, so this verdict now corrects a published claim rather than gating one
+- [Dart publish](/quest/m3/release/dart-publish.md) - the packages are already on pub.dev, and `moq_ffi` is tagged `platform:ios`, so this verdict now corrects a published claim rather than gating one
diff --git a/quest/m2/dash-reconfigure.md b/quest/m3/dash-reconfigure.md
similarity index 96%
rename from quest/m2/dash-reconfigure.md
rename to quest/m3/dash-reconfigure.md
index 3b345ebfde3..72cc36c818f 100644
--- a/quest/m2/dash-reconfigure.md
+++ b/quest/m3/dash-reconfigure.md
@@ -38,4 +38,4 @@ Public API: none. Wire: none.
 
 ## Related
 
-- [HLS and DASH browser playback](/quest/m2/hls-player-test.md) - dash.js survives reconfiguration nightly
+- [HLS and DASH browser playback](/quest/m4/hls-player-test.md) - dash.js survives reconfiguration nightly
diff --git a/quest/m2/drm/README.md b/quest/m3/drm/README.md
similarity index 86%
rename from quest/m2/drm/README.md
rename to quest/m3/drm/README.md
index 9e6526aca2d..b3521a0576f 100644
--- a/quest/m2/drm/README.md
+++ b/quest/m3/drm/README.md
@@ -14,10 +14,10 @@ Decided with the maintainer on 2026-11-03:
 
 - The hang catalog gets a root `drm` section, and the MSF catalog renders it into CMSF's fields, since MSF is always rendered from hang. A license URL needs a home that the hang catalog also carries.
 - mp4-atom gains the protection boxes upstream, rather than moq-mux splicing a raw sample entry back into the init it encodes.
-- `<moq-watch>` hides protected renditions as unplayable. WebCodecs cannot decrypt, and browser playback through MSE and EME is [deferred](/quest/m3/drm-playback.md).
+- `<moq-watch>` hides protected renditions as unplayable. WebCodecs cannot decrypt, and browser playback through MSE and EME is [deferred](/quest/m5/drm-playback.md).
 
 ## Required
 
-- [mp4-atom protection boxes](/quest/m2/drm/mp4-atom.md) - mp4-atom round-trips `encv`/`enca`, `sinf`, and `pssh`, released and bumped here
-- [Protected CMAF import](/quest/m2/drm/import.md) - `moq publish import fmp4 --cmaf` passes CENC media through, signalled in hang `drm` and MSF `contentProtections`, with license URLs from Rust and the CLI
-- [Protected CMAF in the bindings](/quest/m2/drm/bindings.md) - moq-ffi and every wrapper set license URLs on import and read each rendition's `drm` entries
+- [mp4-atom protection boxes](/quest/m3/drm/mp4-atom.md) - mp4-atom round-trips `encv`/`enca`, `sinf`, and `pssh`, released and bumped here
+- [Protected CMAF import](/quest/m3/drm/import.md) - `moq publish import fmp4 --cmaf` passes CENC media through, signalled in hang `drm` and MSF `contentProtections`, with license URLs from Rust and the CLI
+- [Protected CMAF in the bindings](/quest/m3/drm/bindings.md) - moq-ffi and every wrapper set license URLs on import and read each rendition's `drm` entries
diff --git a/quest/m2/drm/bindings.md b/quest/m3/drm/bindings.md
similarity index 81%
rename from quest/m2/drm/bindings.md
rename to quest/m3/drm/bindings.md
index 9cdd1855496..0549ab9d090 100644
--- a/quest/m2/drm/bindings.md
+++ b/quest/m3/drm/bindings.md
@@ -11,8 +11,8 @@ Every binding publishes and reads protected CMAF with the same reach as Rust:
 ## Plan
 
 Decided with the maintainer on 2026-11-03: license URLs reach the bindings too, not only Rust and the CLI.
-Mirror the Rust config shape and names [the import](/quest/m2/drm/import.md) lands.
+Mirror the Rust config shape and names [the import](/quest/m3/drm/import.md) lands.
 
 ## Required
 
-- [Protected CMAF import](/quest/m2/drm/import.md) - the Rust config and the hang `drm` section the bindings expose
+- [Protected CMAF import](/quest/m3/drm/import.md) - the Rust config and the hang `drm` section the bindings expose
diff --git a/quest/m2/drm/import.md b/quest/m3/drm/import.md
similarity index 94%
rename from quest/m2/drm/import.md
rename to quest/m3/drm/import.md
index 57fac2622fb..04f99a48145 100644
--- a/quest/m2/drm/import.md
+++ b/quest/m3/drm/import.md
@@ -12,14 +12,14 @@
 
 ## Plan
 
-Start from the reporter's prototype ([michaelstuurman/moq@fcf90470d](https://github.com/michaelstuurman/moq/commit/fcf90470d91bd3a868aea20448cf3e5bc4b54978)), on the typed boxes from [mp4-atom](/quest/m2/drm/mp4-atom.md) instead of its entry swap.
+Start from the reporter's prototype ([michaelstuurman/moq@fcf90470d](https://github.com/michaelstuurman/moq/commit/fcf90470d91bd3a868aea20448cf3e5bc4b54978)), on the typed boxes from [mp4-atom](/quest/m3/drm/mp4-atom.md) instead of its entry swap.
 
 ### Catalog
 
 - The section is hang's own, mirroring CMSF section 4.1 entries 1:1 so rendering MSF is a straight mapping. Renaming CMSF's members to hang's style is welcome (maintainer, 2026-11-03); propose the names in the PR.
 - Each entry is one DRM system, one scheme, and one default KID. A CMSF entry names a single DRM system, and listing several KIDs in one entry would lose which key a track uses, so video and audio under separate keys get separate entries.
 - Scheme, default KID, system ID, and `pssh` come from each init's `schm`, `tenc`, and `pssh`. Tracks with the same system, scheme, and key share an entry.
-- License and certificate URLs are not in the media, so the publisher supplies them per DRM system through the importer's Rust config and a `moq publish` flag (maintainer, 2026-11-03: Rust, CLI, and [bindings](/quest/m2/drm/bindings.md)). A URL for a system the media does not carry is refused.
+- License and certificate URLs are not in the media, so the publisher supplies them per DRM system through the importer's Rust config and a `moq publish` flag (maintainer, 2026-11-03: Rust, CLI, and [bindings](/quest/m3/drm/bindings.md)). A URL for a system the media does not carry is refused.
 - A rendition's codec string names the codec `frma` wraps (`avc1...`, `mp4a...`), as MSE and EME expect.
 - Leave out CMSF's authorization URL (section 4.1.1.4.4), which the draft gives no member name. Check `robustness`'s member name against the current draft.
 
@@ -44,7 +44,7 @@ Update `js/hang`'s catalog types, `drafts/draft-lcurley-moq-hang.md`, the catalo
 
 ## Required
 
-- [mp4-atom protection boxes](/quest/m2/drm/mp4-atom.md) - the typed `encv`, `sinf`, and `pssh` atoms this builds on
+- [mp4-atom protection boxes](/quest/m3/drm/mp4-atom.md) - the typed `encv`, `sinf`, and `pssh` atoms this builds on
 
 ## Closes
 
diff --git a/quest/m2/drm/mp4-atom.md b/quest/m3/drm/mp4-atom.md
similarity index 94%
rename from quest/m2/drm/mp4-atom.md
rename to quest/m3/drm/mp4-atom.md
index b5c04a040a5..d0cabe6c56e 100644
--- a/quest/m2/drm/mp4-atom.md
+++ b/quest/m3/drm/mp4-atom.md
@@ -12,7 +12,7 @@ An encrypted init then round-trips byte-for-byte through `mp4_atom::Moov`.
 ## Plan
 
 0.17.0 has `senc`, `saio`, and `saiz` but none of these.
-They are what let [the import](/quest/m2/drm/import.md) keep the encrypted entry and the `pssh` boxes in the per-track init, without the prototype's encode-unwrapped-then-swap step (decided 2026-11-03).
+They are what let [the import](/quest/m3/drm/import.md) keep the encrypted entry and the `pssh` boxes in the per-track init, without the prototype's encode-unwrapped-then-swap step (decided 2026-11-03).
 Parse `moof`'s `pssh` too, even though key rotation stays out of scope, so the importer can refuse it rather than silently drop it.
 
 Cover `tenc` versions 0 and 1, since `cbcs` uses version 1's crypt and skip byte blocks and a constant IV.
diff --git a/quest/m2/errqueue-truncation.md b/quest/m3/errqueue-truncation.md
similarity index 95%
rename from quest/m2/errqueue-truncation.md
rename to quest/m3/errqueue-truncation.md
index be37cb65e4d..845930e90ca 100644
--- a/quest/m2/errqueue-truncation.md
+++ b/quest/m3/errqueue-truncation.md
@@ -14,4 +14,4 @@ Public API: none. Wire: none.
 
 ## Related
 
-- [Wire fuzz coverage](/quest/m2/wire-fuzz-coverage.md) - fuzzes the cmsg walks this path shares
+- [Wire fuzz coverage](/quest/m4/wire-fuzz-coverage.md) - fuzzes the cmsg walks this path shares
diff --git a/quest/m2/fetch-synced.md b/quest/m3/fetch-synced.md
similarity index 100%
rename from quest/m2/fetch-synced.md
rename to quest/m3/fetch-synced.md
diff --git a/quest/m2/ffi-exporter.md b/quest/m3/ffi-exporter.md
similarity index 97%
rename from quest/m2/ffi-exporter.md
rename to quest/m3/ffi-exporter.md
index cc1aab51b83..3aa884c5098 100644
--- a/quest/m2/ffi-exporter.md
+++ b/quest/m3/ffi-exporter.md
@@ -21,7 +21,7 @@ crates.io would commit permanent names to code already slated for
 retirement, and switching moq to it would be churn on the way to the
 exporter. Until the switch, moq keeps building from its pinned
 `kixelated/uniffi-*` forks, checked each release cycle by
-[the vendor sync](/quest/m1/vendor-sync/README.md).
+[the vendor sync](/quest/m2/cut-gate/vendor-sync/README.md).
 Not chosen: publish the fork and switch to it first; decide later.
 
 Carried over from the fork plan, where they still apply to the exporter's
@@ -111,7 +111,7 @@ which publishes `rust2-uniffi`, `rust2-uniffi-core`, `rust2-uniffi-macros`, and
   into the maintenance fork. The exporter's generators must retain these
   behaviors too, rechecking each against their design before the switch.
 - Update the quests that name a `kixelated/uniffi-*` fork
-  ([Generated C bindings](/quest/m2/c/README.md)) to point at rust2, then
+  ([Generated C bindings](/quest/m3/c/README.md)) to point at rust2, then
   archive the three forks.
 - Cancelled Go results (2026-10-31, from
   [moq-dev/moq#7397](https://github.com/moq-dev/moq/pull/7397), open): the
@@ -131,7 +131,7 @@ none.
 
 ## Required
 
-- [rust2's exporter is ready for moq](/quest/m2/rust2-exporter.md) - the exporter generates every language moq ships and moq can pin it
+- [rust2's exporter is ready for moq](/quest/m3/rust2-exporter.md) - the exporter generates every language moq ships and moq can pin it
 
 ## Related
 
diff --git a/quest/m2/ffi-future-size.md b/quest/m3/ffi-future-size.md
similarity index 97%
rename from quest/m2/ffi-future-size.md
rename to quest/m3/ffi-future-size.md
index b13a498a869..bbea0865467 100644
--- a/quest/m2/ffi-future-size.md
+++ b/quest/m3/ffi-future-size.md
@@ -30,6 +30,6 @@ futures in the FFI layers may sit just under the edge the same way.
   `accept_on_a_foreign_thread` in `rs/moq-ffi/src/server.rs` uses
   512 KiB) and record the margin.
 - If the lint proves useful, consider it workspace-wide in
-  [audit lints](/quest/m2/audit-lints.md) instead.
+  [audit lints](/quest/m3/audit-lints.md) instead.
 
 Public API: none. Wire: none.
diff --git a/quest/m2/fmp4-declared-clock.md b/quest/m3/fmp4-declared-clock.md
similarity index 100%
rename from quest/m2/fmp4-declared-clock.md
rename to quest/m3/fmp4-declared-clock.md
diff --git a/quest/m2/follow-refused-retry.md b/quest/m3/follow-refused-retry.md
similarity index 93%
rename from quest/m2/follow-refused-retry.md
rename to quest/m3/follow-refused-retry.md
index 2b69a13bcf1..ca2a23ab2fb 100644
--- a/quest/m2/follow-refused-retry.md
+++ b/quest/m3/follow-refused-retry.md
@@ -45,7 +45,7 @@ Build on `Following` as
 [moq-dev/moq#7678](https://github.com/moq-dev/moq/pull/7678) left it,
 which reports the path going offline beside its `refused` flag. If the
 path watch changes under
-[front parking](/quest/m2/origin-front-parks.md), use its replacement.
+[front parking](/quest/m5/origin-front-parks.md), use its replacement.
 
 Tests: a refused follower asks the replacement after an overlapping
 identical-route handler swap; an announcement listener sees no event for
@@ -57,5 +57,5 @@ Public API: none. Wire: none.
 
 ## Related
 
-- [Front parking](/quest/m2/origin-front-parks.md) - the same refusal wait for `request`
-- [The HLS server follows each path once](/quest/m2/hls-follow-once.md) - another `Following` addition
+- [Front parking](/quest/m5/origin-front-parks.md) - the same refusal wait for `request`
+- [The HLS server follows each path once](/quest/m4/hls-follow-once.md) - another `Following` addition
diff --git a/quest/m2/gapless-audio-switch.md b/quest/m3/gapless-audio-switch.md
similarity index 100%
rename from quest/m2/gapless-audio-switch.md
rename to quest/m3/gapless-audio-switch.md
diff --git a/quest/m2/go-ffi-platform-modules.md b/quest/m3/go-ffi-platform-modules.md
similarity index 96%
rename from quest/m2/go-ffi-platform-modules.md
rename to quest/m3/go-ffi-platform-modules.md
index 95f431b0431..613ef4191e5 100644
--- a/quest/m2/go-ffi-platform-modules.md
+++ b/quest/m3/go-ffi-platform-modules.md
@@ -32,4 +32,4 @@ static GOPROXY layout:
 
 ## Required
 
-- [Go module proxy](/quest/m2/go-module-proxy.md) - only our proxy can add modules under `moq.dev/moq-ffi` without another git mirror
+- [Go module proxy](/quest/m3/go-module-proxy.md) - only our proxy can add modules under `moq.dev/moq-ffi` without another git mirror
diff --git a/quest/m2/go-module-proxy.md b/quest/m3/go-module-proxy.md
similarity index 97%
rename from quest/m2/go-module-proxy.md
rename to quest/m3/go-module-proxy.md
index ec403aaccf4..f13f6fa6e96 100644
--- a/quest/m2/go-module-proxy.md
+++ b/quest/m3/go-module-proxy.md
@@ -54,4 +54,4 @@ and proxy.golang.org caches it like any other module.
 - Decided: the `moq.dev/moq` wrapper is pure Go and stays on its git mirror.
 - Update `go/ffi/README.md`, `doc/lib/go`, and the `infra/README.md` table.
 - Keep the per-platform split out of this quest; it lands in
-  [Go per-platform lib modules](/quest/m2/go-ffi-platform-modules.md).
+  [Go per-platform lib modules](/quest/m3/go-ffi-platform-modules.md).
diff --git a/quest/m2/goaway-migration-followups.md b/quest/m3/goaway-migration-followups.md
similarity index 100%
rename from quest/m2/goaway-migration-followups.md
rename to quest/m3/goaway-migration-followups.md
diff --git a/quest/m2/gpu-ci.md b/quest/m3/gpu-ci.md
similarity index 97%
rename from quest/m2/gpu-ci.md
rename to quest/m3/gpu-ci.md
index 47db9a5718f..a3395cd81c8 100644
--- a/quest/m2/gpu-ci.md
+++ b/quest/m3/gpu-ci.md
@@ -69,5 +69,5 @@ Public API: none. Wire: none.
 
 ## Related
 
-- [Video hardware validation](/quest/m3/video-hardware.md) - hardware paths nothing runs yet
-- [Video quality hardware rows](/quest/m2/video-quality/hardware.md) - the nightly quality job that also needs this runner's GPU
+- [Video hardware validation](/quest/m5/video-hardware.md) - hardware paths nothing runs yet
+- [Video quality hardware rows](/quest/m3/video-quality/hardware.md) - the nightly quality job that also needs this runner's GPU
diff --git a/quest/m2/gpu-health.md b/quest/m3/gpu-health.md
similarity index 95%
rename from quest/m2/gpu-health.md
rename to quest/m3/gpu-health.md
index 5f1e563a4c4..c61f1a855d9 100644
--- a/quest/m2/gpu-health.md
+++ b/quest/m3/gpu-health.md
@@ -18,14 +18,14 @@ Those are the caller's.
 
 Decided 2026-10-05 in moq.pro's quest audit: vendor-neutral now, not
 NVIDIA-scoped. Reason: the external GPU surface (#4975),
-[Vulkan encode](/quest/m2/vulkan-encode.md), and
-[VA-API import](/quest/m2/vaapi-vulkan-import.md) make AMD and Intel encode
+[Vulkan encode](/quest/m3/vulkan-encode.md), and
+[VA-API import](/quest/m3/vaapi-vulkan-import.md) make AMD and Intel encode
 first-class, so an NVML-shaped API would be rewritten once they land.
 moq.pro's transcode admission and its benchmarks assume NVML today; they
 adopt this instead.
 
 Decided 2026-10-05: one device identity wherever a render node exists, the
-render node's `dev_t`, shared with [VA-API import](/quest/m2/vaapi-vulkan-import.md).
+render node's `dev_t`, shared with [VA-API import](/quest/m3/vaapi-vulkan-import.md).
 NVIDIA's device UUID maps to its node through `VK_EXT_physical_device_drm`.
 The external GPU surface (#4975) carries that identity as
 `frame::vulkan::Device { device_uuid, driver_uuid, render_node: Option<u64> }`.
@@ -103,7 +103,7 @@ Other guidance:
 - A snapshot call, not a callback; cheap enough to poll about once a second.
 - The snapshot is additive and keys by the surface's identity. Publish it
   after the vendor implementations it reports are validated. It does not gate
-  [the multi-vendor release](/quest/m2/gpu-release.md) or the next cut.
+  [the multi-vendor release](/quest/m3/gpu-release.md) or the next cut.
 
 ✅ Decided 2026-10-16, support floor: ship per vendor with every value
 optional. NVIDIA's device-wide adapter lands with the values every vendor has
@@ -130,5 +130,5 @@ Public API: a device capacity and health snapshot in moq-video. Wire: none.
 
 ## Related
 
-- [VA-API encodes an external Vulkan image](/quest/m2/vaapi-vulkan-import.md) - picks a render node by the same `dev_t`
-- [Vulkan Video encode on AMD](/quest/m2/vulkan-encode.md) - the AMD backend whose sessions this counts
+- [VA-API encodes an external Vulkan image](/quest/m3/vaapi-vulkan-import.md) - picks a render node by the same `dev_t`
+- [Vulkan Video encode on AMD](/quest/m3/vulkan-encode.md) - the AMD backend whose sessions this counts
diff --git a/quest/m2/gpu-release.md b/quest/m3/gpu-release.md
similarity index 77%
rename from quest/m2/gpu-release.md
rename to quest/m3/gpu-release.md
index 1110f689a3d..d0e2260f4bf 100644
--- a/quest/m2/gpu-release.md
+++ b/quest/m3/gpu-release.md
@@ -15,9 +15,9 @@ GPU capacity and health reporting remains a separate additive follow-up.
 
 ## Required
 
-- [Vulkan Video encode on AMD](/quest/m2/vulkan-encode.md) - AMD proof
-- [VA-API Vulkan import](/quest/m2/vaapi-vulkan-import.md) - Intel proof
+- [Vulkan Video encode on AMD](/quest/m3/vulkan-encode.md) - AMD proof
+- [VA-API Vulkan import](/quest/m3/vaapi-vulkan-import.md) - Intel proof
 
 ## Related
 
-- [GPU health](/quest/m2/gpu-health.md) - later reporting, not a surface release gate
+- [GPU health](/quest/m3/gpu-health.md) - later reporting, not a surface release gate
diff --git a/quest/m2/headless-empty-tail.md b/quest/m3/headless-empty-tail.md
similarity index 100%
rename from quest/m2/headless-empty-tail.md
rename to quest/m3/headless-empty-tail.md
diff --git a/quest/m2/hls-audio-languages.md b/quest/m3/hls-audio-languages.md
similarity index 96%
rename from quest/m2/hls-audio-languages.md
rename to quest/m3/hls-audio-languages.md
index 3a794725327..5d83f1c458e 100644
--- a/quest/m2/hls-audio-languages.md
+++ b/quest/m3/hls-audio-languages.md
@@ -35,4 +35,4 @@ audio renditions in the catalog, and audio `lang` and `label` now set from
 
 ## Required
 
-- [Audio renditions carry a language](/quest/m2/audio-lang.md) - adds the audio `lang` field this fills in
+- [Audio renditions carry a language](/quest/m3/audio-lang.md) - adds the audio `lang` field this fills in
diff --git a/quest/m2/hls-rendition-source.md b/quest/m3/hls-rendition-source.md
similarity index 100%
rename from quest/m2/hls-rendition-source.md
rename to quest/m3/hls-rendition-source.md
diff --git a/quest/m2/hls-stalled-segment.md b/quest/m3/hls-stalled-segment.md
similarity index 96%
rename from quest/m2/hls-stalled-segment.md
rename to quest/m3/hls-stalled-segment.md
index 9e5c3154a47..e34c3befd77 100644
--- a/quest/m2/hls-stalled-segment.md
+++ b/quest/m3/hls-stalled-segment.md
@@ -37,4 +37,4 @@ Wire: none.
 
 ## Related
 
-- [A library recorder gets the takeover cut](/quest/m2/mux-source-cut.md) - the other [moq-dev/moq#7399](https://github.com/moq-dev/moq/pull/7399) follow-up
+- [A library recorder gets the takeover cut](/quest/m3/mux-source-cut.md) - the other [moq-dev/moq#7399](https://github.com/moq-dev/moq/pull/7399) follow-up
diff --git a/quest/m2/hls-trailing-gap.md b/quest/m3/hls-trailing-gap.md
similarity index 100%
rename from quest/m2/hls-trailing-gap.md
rename to quest/m3/hls-trailing-gap.md
diff --git a/quest/m2/ietf-absolute-join-race.md b/quest/m3/ietf-absolute-join-race.md
similarity index 91%
rename from quest/m2/ietf-absolute-join-race.md
rename to quest/m3/ietf-absolute-join-race.md
index b8377aa941b..87ebea66f40 100644
--- a/quest/m2/ietf-absolute-join-race.md
+++ b/quest/m3/ietf-absolute-join-race.md
@@ -22,7 +22,7 @@ reproduce first.
   that interleaves an older-history FETCH with an Absolute join on drafts
   18, 20, and 22. If the test passes, delete the quest with the test kept as
   coverage.
-- Check [the fill redesign](/quest/m2/ietf-fill-refill.md) first. It deletes
+- Check [the fill redesign](/quest/m3/ietf-fill-refill.md) first. It deletes
   the `Fill` handoff and may make this moot. If it lands first, rerun the
   test against it.
 
@@ -30,4 +30,4 @@ Public API: none expected. Wire: none.
 
 ## Related
 
-- [A moq-transport group head fills its hole in place](/quest/m2/ietf-fill-refill.md) - the fill redesign that may remove the race
+- [A moq-transport group head fills its hole in place](/quest/m3/ietf-fill-refill.md) - the fill redesign that may remove the race
diff --git a/quest/m2/ietf-fill-refill.md b/quest/m3/ietf-fill-refill.md
similarity index 96%
rename from quest/m2/ietf-fill-refill.md
rename to quest/m3/ietf-fill-refill.md
index 21d8ca786e2..a9bc94c21f2 100644
--- a/quest/m2/ietf-fill-refill.md
+++ b/quest/m3/ietf-fill-refill.md
@@ -40,4 +40,4 @@ Public API: none. Wire: none.
 
 ## Required
 
-- [moq-transport requests end through one lease](/quest/m2/ietf-request-lease.md) - restructures the same files first
+- [moq-transport requests end through one lease](/quest/m3/ietf-request-lease.md) - restructures the same files first
diff --git a/quest/m2/ietf-finish.md b/quest/m3/ietf-finish.md
similarity index 100%
rename from quest/m2/ietf-finish.md
rename to quest/m3/ietf-finish.md
diff --git a/quest/m2/ietf-join-pin-head.md b/quest/m3/ietf-join-pin-head.md
similarity index 92%
rename from quest/m2/ietf-join-pin-head.md
rename to quest/m3/ietf-join-pin-head.md
index 8bb40c2f405..bc4bcd4f6d8 100644
--- a/quest/m2/ietf-join-pin-head.md
+++ b/quest/m3/ietf-join-pin-head.md
@@ -27,10 +27,10 @@ and the late FETCH gets a loud refusal (accepted by its quest's Plan).
 - Test: finish then drop the producer, then a late joining FETCH on draft
   18 still gets the head.
 - Rerun the draft-18 interop `tail` and `finish` cells with the Rust
-  publisher, as [IETF finish](/quest/m2/ietf-finish.md) asks.
+  publisher, as [IETF finish](/quest/m3/ietf-finish.md) asks.
 
 Public API: none. Wire: none.
 
 ## Related
 
-- [IETF finish](/quest/m2/ietf-finish.md) - owns the interop cells
+- [IETF finish](/quest/m3/ietf-finish.md) - owns the interop cells
diff --git a/quest/m2/ietf-js-joining-fetch.md b/quest/m3/ietf-js-joining-fetch.md
similarity index 94%
rename from quest/m2/ietf-js-joining-fetch.md
rename to quest/m3/ietf-js-joining-fetch.md
index 18d9ed2a675..ca44c9eef4d 100644
--- a/quest/m2/ietf-js-joining-fetch.md
+++ b/quest/m3/ietf-js-joining-fetch.md
@@ -12,7 +12,7 @@ SUBSCRIBE_OK.
 
 Decided 2026-10-25 (maintainer): honoring Largest Object and serving the
 head moved into JavaScript FETCH in m1, which landed; only this part stays
-in m2. A FETCH that resolves before PUBLISH_DONE already finishes its head.
+in later work (m3). A FETCH that resolves before PUBLISH_DONE already finishes its head.
 
 In the tail test the track is finished before SUBSCRIBE_OK goes out, so
 PUBLISH_DONE follows at once and the FETCH arrives to no subscription. Keep a
diff --git a/quest/m2/ietf-request-lease.md b/quest/m3/ietf-request-lease.md
similarity index 100%
rename from quest/m2/ietf-request-lease.md
rename to quest/m3/ietf-request-lease.md
diff --git a/quest/m2/import-lang-iso639.md b/quest/m3/import-lang-iso639.md
similarity index 96%
rename from quest/m2/import-lang-iso639.md
rename to quest/m3/import-lang-iso639.md
index acb165a861b..0209637b50e 100644
--- a/quest/m2/import-lang-iso639.md
+++ b/quest/m3/import-lang-iso639.md
@@ -37,4 +37,4 @@ were unset.
 
 ## Required
 
-- [Audio renditions carry a language](/quest/m2/audio-lang.md) - adds the audio `lang` field this fills in
+- [Audio renditions carry a language](/quest/m3/audio-lang.md) - adds the audio `lang` field this fills in
diff --git a/quest/m2/import-metadata-policy.md b/quest/m3/import-metadata-policy.md
similarity index 100%
rename from quest/m2/import-metadata-policy.md
rename to quest/m3/import-metadata-policy.md
diff --git a/quest/m2/interop-shutdown-warnings.md b/quest/m3/interop-shutdown-warnings.md
similarity index 100%
rename from quest/m2/interop-shutdown-warnings.md
rename to quest/m3/interop-shutdown-warnings.md
diff --git a/quest/m2/intra-refresh/README.md b/quest/m3/intra-refresh/README.md
similarity index 89%
rename from quest/m2/intra-refresh/README.md
rename to quest/m3/intra-refresh/README.md
index c921a1a8932..fdbf4afb17b 100644
--- a/quest/m2/intra-refresh/README.md
+++ b/quest/m3/intra-refresh/README.md
@@ -49,9 +49,9 @@ make these presentation guarantees true even when sweep lengths change.
 
 ## Required
 
-- [Dual decoder](/quest/m2/intra-refresh/dual-decoder.md) - js/watch's two decoders open on an H.264 recovery point in Firefox and Safari, as they now do in Chromium
-- [Plan: recovery boundaries](/quest/m2/intra-refresh/plan-boundary.md) - settle publication ordering for a later, longer sweep
-- [Consumer warmup](/quest/m2/intra-refresh/consumer-warmup.md) - the transcoder decodes the groups covering `warmup` as history before each group, except at a true IDR
-- [H.264 import](/quest/m2/intra-refresh/h264-import.md) - the splitter keeps `recovery_frame_cnt` and import publishes `warmup` from it
-- [H.265 import](/quest/m2/intra-refresh/h265-import.md) - the splitter reads the recovery-point SEI so an HEVC intra-refresh stream forms groups and publishes `warmup`
-- [Export sync flags](/quest/m2/intra-refresh/export-sync-flags.md) - fmp4, MKV, and HLS stop advertising a refresh group start as a sync sample
+- [Dual decoder](/quest/m3/intra-refresh/dual-decoder.md) - js/watch's two decoders open on an H.264 recovery point in Firefox and Safari, as they now do in Chromium
+- [Plan: recovery boundaries](/quest/m3/intra-refresh/plan-boundary.md) - settle publication ordering for a later, longer sweep
+- [Consumer warmup](/quest/m3/intra-refresh/consumer-warmup.md) - the transcoder decodes the groups covering `warmup` as history before each group, except at a true IDR
+- [H.264 import](/quest/m3/intra-refresh/h264-import.md) - the splitter keeps `recovery_frame_cnt` and import publishes `warmup` from it
+- [H.265 import](/quest/m3/intra-refresh/h265-import.md) - the splitter reads the recovery-point SEI so an HEVC intra-refresh stream forms groups and publishes `warmup`
+- [Export sync flags](/quest/m3/intra-refresh/export-sync-flags.md) - fmp4, MKV, and HLS stop advertising a refresh group start as a sync sample
diff --git a/quest/m2/intra-refresh/consumer-warmup.md b/quest/m3/intra-refresh/consumer-warmup.md
similarity index 97%
rename from quest/m2/intra-refresh/consumer-warmup.md
rename to quest/m3/intra-refresh/consumer-warmup.md
index 06643233e09..659ce5be31b 100644
--- a/quest/m2/intra-refresh/consumer-warmup.md
+++ b/quest/m3/intra-refresh/consumer-warmup.md
@@ -54,4 +54,4 @@ The fix is history rather than a withhold rule:
 
 ## Required
 
-- [Plan: recovery boundaries](/quest/m2/intra-refresh/plan-boundary.md) - K derives from `warmup`, which must be a safe upper bound
+- [Plan: recovery boundaries](/quest/m3/intra-refresh/plan-boundary.md) - K derives from `warmup`, which must be a safe upper bound
diff --git a/quest/m2/intra-refresh/dual-decoder.md b/quest/m3/intra-refresh/dual-decoder.md
similarity index 93%
rename from quest/m2/intra-refresh/dual-decoder.md
rename to quest/m3/intra-refresh/dual-decoder.md
index cb551299000..c0f5a1dac58 100644
--- a/quest/m2/intra-refresh/dual-decoder.md
+++ b/quest/m3/intra-refresh/dual-decoder.md
@@ -34,5 +34,5 @@ What remains is checking the other engines.
 
 ## Related
 
-- [H.264 import](/quest/m2/intra-refresh/h264-import.md) - publishes the real `warmup` for an end-to-end x264 check
-- [Consumer warmup](/quest/m2/intra-refresh/consumer-warmup.md) - the transcoder decodes history so it never encodes stripes
+- [H.264 import](/quest/m3/intra-refresh/h264-import.md) - publishes the real `warmup` for an end-to-end x264 check
+- [Consumer warmup](/quest/m3/intra-refresh/consumer-warmup.md) - the transcoder decodes history so it never encodes stripes
diff --git a/quest/m2/intra-refresh/export-sync-flags.md b/quest/m3/intra-refresh/export-sync-flags.md
similarity index 95%
rename from quest/m2/intra-refresh/export-sync-flags.md
rename to quest/m3/intra-refresh/export-sync-flags.md
index 4870003014e..1561fd9c2a1 100644
--- a/quest/m2/intra-refresh/export-sync-flags.md
+++ b/quest/m3/intra-refresh/export-sync-flags.md
@@ -27,4 +27,4 @@ Audio `warmup` is Opus pre-roll and changes no export flag.
 
 ## Required
 
-- [Consumer warmup](/quest/m2/intra-refresh/consumer-warmup.md) - the IDR check this reuses
+- [Consumer warmup](/quest/m3/intra-refresh/consumer-warmup.md) - the IDR check this reuses
diff --git a/quest/m2/intra-refresh/h264-import.md b/quest/m3/intra-refresh/h264-import.md
similarity index 97%
rename from quest/m2/intra-refresh/h264-import.md
rename to quest/m3/intra-refresh/h264-import.md
index 621d7a61eb0..1318a5b4c68 100644
--- a/quest/m2/intra-refresh/h264-import.md
+++ b/quest/m3/intra-refresh/h264-import.md
@@ -48,4 +48,4 @@ follows the hang draft, which rounds up
 
 ## Required
 
-- [Plan: recovery boundaries](/quest/m2/intra-refresh/plan-boundary.md) - resolve the later-mutated warmup contract before implementing it
+- [Plan: recovery boundaries](/quest/m3/intra-refresh/plan-boundary.md) - resolve the later-mutated warmup contract before implementing it
diff --git a/quest/m2/intra-refresh/h265-import.md b/quest/m3/intra-refresh/h265-import.md
similarity index 97%
rename from quest/m2/intra-refresh/h265-import.md
rename to quest/m3/intra-refresh/h265-import.md
index 3ab09fd2f03..58e44ef32c4 100644
--- a/quest/m2/intra-refresh/h265-import.md
+++ b/quest/m3/intra-refresh/h265-import.md
@@ -39,4 +39,4 @@ that machinery in parallel.
 
 ## Required
 
-- [H.264 import](/quest/m2/intra-refresh/h264-import.md) - the shared measurement and catalog mutation, built on catalog warmup
+- [H.264 import](/quest/m3/intra-refresh/h264-import.md) - the shared measurement and catalog mutation, built on catalog warmup
diff --git a/quest/m2/intra-refresh/plan-boundary.md b/quest/m3/intra-refresh/plan-boundary.md
similarity index 95%
rename from quest/m2/intra-refresh/plan-boundary.md
rename to quest/m3/intra-refresh/plan-boundary.md
index 1d27b9840b6..8b71cc1ceeb 100644
--- a/quest/m2/intra-refresh/plan-boundary.md
+++ b/quest/m3/intra-refresh/plan-boundary.md
@@ -45,5 +45,5 @@ reference-decode comparisons for continuous playback and each recovery case.
 
 ## Related
 
-- [H.264 import](/quest/m2/intra-refresh/h264-import.md) - publishes recovery information
-- [Consumer warmup](/quest/m2/intra-refresh/consumer-warmup.md) - uses it to size the transcoder's decode history
+- [H.264 import](/quest/m3/intra-refresh/h264-import.md) - publishes recovery information
+- [Consumer warmup](/quest/m3/intra-refresh/consumer-warmup.md) - uses it to size the transcoder's decode history
diff --git a/quest/m2/js-announced-coalesce.md b/quest/m3/js-announced-coalesce.md
similarity index 93%
rename from quest/m2/js-announced-coalesce.md
rename to quest/m3/js-announced-coalesce.md
index 9556608b1c1..723bdd04f25 100644
--- a/quest/m2/js-announced-coalesce.md
+++ b/quest/m3/js-announced-coalesce.md
@@ -22,4 +22,4 @@ still delivered.
 
 ## Related
 
-- [Announce credit](/quest/m2/announce-credit.md) - bounds how many paths there can be
+- [Announce credit](/quest/m5/announce-credit.md) - bounds how many paths there can be
diff --git a/quest/m2/js-warmup-trim.md b/quest/m3/js-warmup-trim.md
similarity index 100%
rename from quest/m2/js-warmup-trim.md
rename to quest/m3/js-warmup-trim.md
diff --git a/quest/m2/json-snapshot-resync.md b/quest/m3/json-snapshot-resync.md
similarity index 96%
rename from quest/m2/json-snapshot-resync.md
rename to quest/m3/json-snapshot-resync.md
index 9869ae3502c..6a7c5dafd5a 100644
--- a/quest/m2/json-snapshot-resync.md
+++ b/quest/m3/json-snapshot-resync.md
@@ -37,4 +37,4 @@ Public API: a new decode error in `@moq/json` and `moq-json`. Wire: none.
 
 ## Related
 
-- [Benchmark a Value merge-patch diff for moq-json](/quest/m2/json-value-diff.md) - may replace the Rust diff this consumer applies
+- [Benchmark a Value merge-patch diff for moq-json](/quest/m5/json-value-diff.md) - may replace the Rust diff this consumer applies
diff --git a/quest/m2/lite-tail-drop-count.md b/quest/m3/lite-tail-drop-count.md
similarity index 100%
rename from quest/m2/lite-tail-drop-count.md
rename to quest/m3/lite-tail-drop-count.md
diff --git a/quest/m2/mbx-r2-release-cache.md b/quest/m3/mbx-r2-release-cache.md
similarity index 83%
rename from quest/m2/mbx-r2-release-cache.md
rename to quest/m3/mbx-r2-release-cache.md
index 557988a0185..39063ee2f88 100644
--- a/quest/m2/mbx-r2-release-cache.md
+++ b/quest/m3/mbx-r2-release-cache.md
@@ -11,8 +11,8 @@ carries the platform Rust cache, which its `platform.yml` still lacks on
 ## Plan
 
 Decided 2026-11-05 (maintainer, /quest-audit): ✅ split from
-[Verify the R2 Rust cache](/quest/m0/ci/mbx-r2-verify.md) and moved to m2
-behind [the cut](/quest/m2/release/cut.md), which brings `main`'s platform
+[Verify the R2 Rust cache](/quest/m0/ci/mbx-r2-verify.md) and moved to m2 (m3 since the milestone re-cut)
+behind [the cut](/quest/m3/release/cut.md), which brings `main`'s platform
 Rust cache to `release` when it merges `main` into it. Not chosen: moving
 the whole R2 verification quest; merging `main` into `release` now, which
 reverses the 2026-11-04 decision.
@@ -24,4 +24,4 @@ Public API: none. Wire: none.
 
 ## Required
 
-- [Cut and publish the prepared breaking release](/quest/m2/release/cut.md) - brings the platform Rust cache to `release`
+- [Cut and publish the prepared breaking release](/quest/m3/release/cut.md) - brings the platform Rust cache to `release`
diff --git a/quest/m2/memory-bench-hang.md b/quest/m3/memory-bench-hang.md
similarity index 100%
rename from quest/m2/memory-bench-hang.md
rename to quest/m3/memory-bench-hang.md
diff --git a/quest/m2/mesh/README.md b/quest/m3/mesh/README.md
similarity index 76%
rename from quest/m2/mesh/README.md
rename to quest/m3/mesh/README.md
index 54f91ed6266..199dabeba4f 100644
--- a/quest/m2/mesh/README.md
+++ b/quest/m3/mesh/README.md
@@ -16,10 +16,10 @@ it: Kixel builds a `kixel` daemon on these libraries, and any other binary
 can do the same.
 
 Non-goals: a mesh daemon or CLI here (`moq mesh` is not added to moq-cli),
-MagicDNS, agent protocols, a graph UI, internet P2P or NAT traversal in m2
-(remote traffic always crosses a relay; [mesh over ICE](/quest/m3/mesh-ice.md)
-is parked in m3), TUN devices or IP routing, encryption (parked in
-[mesh keys](/quest/m3/mesh-keys.md)), a member list that a compromised
+MagicDNS, agent protocols, a graph UI, internet P2P or NAT traversal in m3
+(remote traffic always crosses a relay; [mesh over ICE](/quest/m5/mesh-ice.md)
+is parked in m5), TUN devices or IP routing, encryption (parked in
+[mesh keys](/quest/m5/mesh-keys.md)), a member list that a compromised
 coordinator cannot extend, and Windows.
 
 ## Plan
@@ -36,17 +36,17 @@ moq library, media included, can point at one.
 
 Decided 2026-10-25 with the maintainer (planning interview), still in force:
 
-- Traffic is app-level [byte streams](/quest/m2/stream/README.md) and named
+- Traffic is app-level [byte streams](/quest/m3/stream/README.md) and named
   tracks, never IP packets.
 - The coordinator contract is generic and lives here: enrollment issues a
   relay URL and a token, and self-hosters run it with `moq auth`. A hosted
   service implements the same contract with its own accounts and billing.
 - Direct paths only to addresses a node can already dial: `[cluster.lan]`
-  mDNS, plus [address hints](/quest/m2/mesh/addr.md) published on mesh
-  tracks. No ICE, STUN, or hole punching; the [P2P](/quest/m2/p2p/README.md)
+  mDNS, plus [address hints](/quest/m3/mesh/addr.md) published on mesh
+  tracks. No ICE, STUN, or hole punching; the [P2P](/quest/m4/p2p/README.md)
   line is separate.
 - An endpoint ID is a persistent Ed25519 device key, iroh-style. It is not
-  the [routing identity](/quest/m1/cluster-routing/routes/README.md), which each
+  the [routing identity](/quest/m2/cluster-routing/routes/README.md), which each
   process declares fresh.
 - Addressing is announcement: each node publishes under `mesh/<id>/...`, and
   reaching an ID is subscribing there. There is no separate directory.
@@ -60,13 +60,13 @@ Decided 2026-10-25 with the maintainer (planning interview), still in force:
 - Protection is per broadcast, with levels that nest: identity (the token
   only), authentication (per-frame Ed25519 signatures, the default), and
   later encryption (signed plus moq-crypto's e2ee, waiting on
-  [mesh keys](/quest/m3/mesh-keys.md)).
+  [mesh keys](/quest/m5/mesh-keys.md)).
 - Enrollment is automated, with no human in the loop (decided 2026-10-30): a
   device presents an enrollment key the owner created and then refreshes by
   proving its key. A hosted coordinator may put its own sign-in in front of
   minting that key.
 - The API is iroh-shaped (not wire-compatible with iroh).
-- It builds on [outbound federation](/quest/m1/cluster-routing/federation.md):
+- It builds on [outbound federation](/quest/m2/cluster-routing/federation.md):
   a node's local relay dials its relays as `upstream` links and ranks LAN
   peers above them.
 
@@ -75,15 +75,15 @@ Decided 2026-10-31 with the maintainer (moq.pro's mesh planning interview):
 - mDNS alone is not enough. It fails in Docker bridge and overlay networks,
   cloud VPCs, across subnets and VLANs, on isolated Wi-Fi, and for a macOS
   launchd agent denied Local Network access, so nodes publish
-  [address hints](/quest/m2/mesh/addr.md).
-- Direct links form a deterministic [sparse overlay](/quest/m2/mesh/overlay.md)
+  [address hints](/quest/m3/mesh/addr.md).
+- Direct links form a deterministic [sparse overlay](/quest/m3/mesh/overlay.md)
   computed locally from the member list, with an optional per-node degree
   cap. Every node keeps its relay uplink, which carries traffic across an
   overlay partition.
 - `.status` carries each link's RTT, and an application embedding `Endpoint`
-  publishes it too ([status track](/quest/m2/mesh/status.md)).
+  publishes it too ([status track](/quest/m3/mesh/status.md)).
 
-This epic owns the end-to-end test: three [mesh relay nodes](/quest/m2/mesh/node.md),
+This epic owns the end-to-end test: three [mesh relay nodes](/quest/m3/mesh/node.md),
 two in network namespaces sharing a LAN segment and a third behind a relay
 only, enrolled through `moq auth`; an `Endpoint` on each dials the others'
 services, taking the LAN path between the first two and the relay path to
@@ -91,19 +91,19 @@ the third, and survives a relay restart.
 
 ## Required
 
-- [Outbound federation](/quest/m1/cluster-routing/federation.md) - a local relay dials its relays and prefers LAN peers
-- [Byte streams](/quest/m2/stream/README.md) - lossless TCP-level streams over MoQ
-- [Endpoint API](/quest/m2/mesh/endpoint.md) - an iroh-shaped `Endpoint` that connects to an endpoint ID and service and accepts byte streams
-- [Mesh relay node](/quest/m2/mesh/node.md) - a relay node enrolls into a mesh, dials its relays, and admits only enrolled LAN peers
-- [Address hints](/quest/m2/mesh/addr.md) - nodes publish their addresses on mesh tracks and dial each other directly where mDNS cannot find them
-- [Sparse overlay](/quest/m2/mesh/overlay.md) - each node keeps about log N deterministic direct links, forwards for the rest, and falls back to relays across a partition
-- [JS mesh enrollment client](/quest/m2/mesh/js-enroll.md) - `@moq/auth` enrolls and refreshes from JS like `moq_auth::mesh::Client`
-- [Status track](/quest/m2/mesh/status.md) - a signed `.status` track per node with its links and per-link RTTs
-- [Mesh library guide](/quest/m2/mesh/guide.md) - the doc.moq.dev page for the libraries, the contract, and porting from iroh
+- [Outbound federation](/quest/m2/cluster-routing/federation.md) - a local relay dials its relays and prefers LAN peers
+- [Byte streams](/quest/m3/stream/README.md) - lossless TCP-level streams over MoQ
+- [Endpoint API](/quest/m3/mesh/endpoint.md) - an iroh-shaped `Endpoint` that connects to an endpoint ID and service and accepts byte streams
+- [Mesh relay node](/quest/m3/mesh/node.md) - a relay node enrolls into a mesh, dials its relays, and admits only enrolled LAN peers
+- [Address hints](/quest/m3/mesh/addr.md) - nodes publish their addresses on mesh tracks and dial each other directly where mDNS cannot find them
+- [Sparse overlay](/quest/m3/mesh/overlay.md) - each node keeps about log N deterministic direct links, forwards for the rest, and falls back to relays across a partition
+- [JS mesh enrollment client](/quest/m3/mesh/js-enroll.md) - `@moq/auth` enrolls and refreshes from JS like `moq_auth::mesh::Client`
+- [Status track](/quest/m3/mesh/status.md) - a signed `.status` track per node with its links and per-link RTTs
+- [Mesh library guide](/quest/m3/mesh/guide.md) - the doc.moq.dev page for the libraries, the contract, and porting from iroh
 
 ## Related
 
-- [P2P](/quest/m2/p2p/README.md) - internet peer sessions, which the m2 mesh does not use
-- [Mesh over ICE](/quest/m3/mesh-ice.md) - deferred direct paths between mesh nodes on different networks
-- [End-to-end encryption](/quest/m2/e2ee/README.md) - the AEAD the encryption level will reuse
-- [Teleoperation](/quest/m3/teleop-robot.md) - robot track shapes that could ride the mesh
+- [P2P](/quest/m4/p2p/README.md) - internet peer sessions, which the m3 mesh does not use
+- [Mesh over ICE](/quest/m5/mesh-ice.md) - deferred direct paths between mesh nodes on different networks
+- [End-to-end encryption](/quest/m5/e2ee/README.md) - the AEAD the encryption level will reuse
+- [Teleoperation](/quest/m5/teleop-robot.md) - robot track shapes that could ride the mesh
diff --git a/quest/m2/mesh/addr.md b/quest/m3/mesh/addr.md
similarity index 92%
rename from quest/m2/mesh/addr.md
rename to quest/m3/mesh/addr.md
index 8b3fbd4cd1f..90a42323fbc 100644
--- a/quest/m2/mesh/addr.md
+++ b/quest/m3/mesh/addr.md
@@ -34,15 +34,15 @@ peers do. Amend that sentence of the docs with the mesh exception.
   fails the fingerprint pin, so it costs one failed dial, not a wrong peer.
 - Bound and back off failed dials per peer, so a fleet of unreachable hints
   does not become a dial storm; record the bound chosen.
-- The [sparse overlay](/quest/m2/mesh/overlay.md) decides which reachable
+- The [sparse overlay](/quest/m3/mesh/overlay.md) decides which reachable
   peers to keep; until it lands, dial every hinted peer.
 
 Tests: namespaces with multicast off take the direct path; a forged hint
 (signed by another key) is never dialed; a colliding private address fails the
 pin and falls back to the relay; a peer that stops answering is backed off.
-Update `doc/bin/relay/cluster.md` and the [guide](/quest/m2/mesh/guide.md)
+Update `doc/bin/relay/cluster.md` and the [guide](/quest/m3/mesh/guide.md)
 if it exists.
 
 ## Required
 
-- [Mesh relay node](/quest/m2/mesh/node.md) - the enrolled relay node that publishes and dials the hints
+- [Mesh relay node](/quest/m3/mesh/node.md) - the enrolled relay node that publishes and dials the hints
diff --git a/quest/m2/mesh/endpoint.md b/quest/m3/mesh/endpoint.md
similarity index 88%
rename from quest/m2/mesh/endpoint.md
rename to quest/m3/mesh/endpoint.md
index 97073c5085e..279bf016102 100644
--- a/quest/m2/mesh/endpoint.md
+++ b/quest/m3/mesh/endpoint.md
@@ -25,7 +25,7 @@ Decided 2026-10-25 (maintainer): iroh-shaped, not drop-in compatible; tickets,
   which the socket's answer check proves and the grant pins (publish
   `.socket/<id>` only). Update `moq auth`'s mesh grant and
   `doc/bin/relay/auth.md` to match.
-- Streams are [byte streams](/quest/m2/stream/rust.md) at the protection
+- Streams are [byte streams](/quest/m3/stream/rust.md) at the protection
   level the service declares: identity reads `moq-net` directly, and
   authentication, the mesh default, reads through `moq_crypto::sign` against the
   `PublicKey` parsed from the peer's endpoint id, which names the endpoint
@@ -33,9 +33,9 @@ Decided 2026-10-25 (maintainer): iroh-shaped, not drop-in compatible; tickets,
 - The secret key comes from `moq_crypto::sign::SecretKey::load_or_generate`.
 - A mesh daemon (Kixel's, outside this repository, decided 2026-11-02) is
   built on this API, so a process either embeds an `Endpoint` or talks to a
-  local [mesh relay node](/quest/m2/mesh/node.md).
-- Write a short porting note into the [guide](/quest/m2/mesh/guide.md).
+  local [mesh relay node](/quest/m3/mesh/node.md).
+- Write a short porting note into the [guide](/quest/m3/mesh/guide.md).
 
 ## Required
 
-- [Rust byte streams](/quest/m2/stream/rust.md) - the stream this API returns
+- [Rust byte streams](/quest/m3/stream/rust.md) - the stream this API returns
diff --git a/quest/m2/mesh/guide.md b/quest/m3/mesh/guide.md
similarity index 92%
rename from quest/m2/mesh/guide.md
rename to quest/m3/mesh/guide.md
index 32558e029ad..e83d9898445 100644
--- a/quest/m2/mesh/guide.md
+++ b/quest/m3/mesh/guide.md
@@ -18,4 +18,4 @@ libraries.
 
 ## Required
 
-- [Endpoint API](/quest/m2/mesh/endpoint.md) - the API the page centers on
+- [Endpoint API](/quest/m3/mesh/endpoint.md) - the API the page centers on
diff --git a/quest/m2/mesh/js-enroll.md b/quest/m3/mesh/js-enroll.md
similarity index 93%
rename from quest/m2/mesh/js-enroll.md
rename to quest/m3/mesh/js-enroll.md
index bd19062406a..1347a2fdde1 100644
--- a/quest/m2/mesh/js-enroll.md
+++ b/quest/m3/mesh/js-enroll.md
@@ -20,4 +20,4 @@ size, and every reply field checked. Test against `moq auth serve` the way
 
 ## Required
 
-- [`@moq/crypto` loads a stored signing key](/quest/m2/crypto-key-load.md) - the endpoint key this proves
+- [`@moq/crypto` loads a stored signing key](/quest/m3/crypto-key-load.md) - the endpoint key this proves
diff --git a/quest/m2/mesh/node.md b/quest/m3/mesh/node.md
similarity index 95%
rename from quest/m2/mesh/node.md
rename to quest/m3/mesh/node.md
index be945e3d124..ccc3b88c3dc 100644
--- a/quest/m2/mesh/node.md
+++ b/quest/m3/mesh/node.md
@@ -31,4 +31,4 @@ a LAN peer without an enrollment, and survive a relay restart. Update
 
 ## Required
 
-- [Outbound federation](/quest/m1/cluster-routing/federation.md) - upstream links and LAN preference
+- [Outbound federation](/quest/m2/cluster-routing/federation.md) - upstream links and LAN preference
diff --git a/quest/m2/mesh/overlay.md b/quest/m3/mesh/overlay.md
similarity index 85%
rename from quest/m2/mesh/overlay.md
rename to quest/m3/mesh/overlay.md
index a0f9df63c74..7407dfd699a 100644
--- a/quest/m2/mesh/overlay.md
+++ b/quest/m3/mesh/overlay.md
@@ -19,7 +19,7 @@ it; the coordinator is only the member list (announcements under `mesh/**`)
 and the fallback path.
 
 - Ring: order the reachable peers (found through mDNS or
-  [address hints](/quest/m2/mesh/addr.md)) by a hash of their endpoint ID, and
+  [address hints](/quest/m3/mesh/addr.md)) by a hash of their endpoint ID, and
   link to the first peer at or after distance 2^k for each k. Accept incoming
   links from peers whose ring picks this node. A target that cannot be dialed
   is replaced by the next peer on the ring.
@@ -27,7 +27,7 @@ and the fallback path.
   unset by default; the ring alone decides when it is unset. Over the cap,
   drop the longest fingers first. Small meshes come out close to full mesh on
   their own.
-- Forwarding and route choice are [cluster routing](/quest/m1/cluster-routing/README.md)'s:
+- Forwarding and route choice are [cluster routing](/quest/m2/cluster-routing/README.md)'s:
   overlay links join relay nodes as LAN-cost links, and relay
   uplinks stay `upstream` links costed above them. Nothing routes outside the
   shared priority/cost rules.
@@ -39,13 +39,13 @@ follows the ring (and never exceeds the cap when set); every pair connects
 without crossing the relay; killing a node heals the overlay; splitting the
 segment sends cross-half traffic through the relay and healing restores the
 direct path. Report the link counts and hop counts the test measures.
-Update `doc/bin/relay/cluster.md` and the [guide](/quest/m2/mesh/guide.md) if it exists.
+Update `doc/bin/relay/cluster.md` and the [guide](/quest/m3/mesh/guide.md) if it exists.
 
 ## Required
 
-- [Mesh relay node](/quest/m2/mesh/node.md) - the enrolled relay node that dials the overlay
+- [Mesh relay node](/quest/m3/mesh/node.md) - the enrolled relay node that dials the overlay
 
 ## Related
 
-- [Address hints](/quest/m2/mesh/addr.md) - a second source of reachable peers
-- [Link quality](/quest/m2/link-quality.md) - measured link cost a fading overlay link could use
+- [Address hints](/quest/m3/mesh/addr.md) - a second source of reachable peers
+- [Link quality](/quest/m5/link-quality.md) - measured link cost a fading overlay link could use
diff --git a/quest/m2/mesh/status.md b/quest/m3/mesh/status.md
similarity index 90%
rename from quest/m2/mesh/status.md
rename to quest/m3/mesh/status.md
index ec8429e922f..8587d20ac74 100644
--- a/quest/m2/mesh/status.md
+++ b/quest/m3/mesh/status.md
@@ -30,5 +30,5 @@ another key is rejected by a subscriber.
 
 ## Required
 
-- [Endpoint API](/quest/m2/mesh/endpoint.md) - the application node whose links the track describes
-- [Mesh relay node](/quest/m2/mesh/node.md) - the relay node whose links the track describes
+- [Endpoint API](/quest/m3/mesh/endpoint.md) - the application node whose links the track describes
+- [Mesh relay node](/quest/m3/mesh/node.md) - the relay node whose links the track describes
diff --git a/quest/m2/mf-encode-adapter.md b/quest/m3/mf-encode-adapter.md
similarity index 92%
rename from quest/m2/mf-encode-adapter.md
rename to quest/m3/mf-encode-adapter.md
index b05262c47cc..7a009cd2db6 100644
--- a/quest/m2/mf-encode-adapter.md
+++ b/quest/m3/mf-encode-adapter.md
@@ -22,12 +22,12 @@ fails at setup, as it does today.
 Decided 2026-10-26 (maintainer): m2, beside Direct3D11 import. It changes no
 public API, so it does not need to land before the cut, and it needs a
 Windows machine with two GPUs to prove: an ignored hardware test plus an
-entry in [Hardware validation](/quest/m3/video-hardware.md) if CI cannot run
+entry in [Hardware validation](/quest/m5/video-hardware.md) if CI cannot run
 it.
 
 Public API: none. Wire: none.
 
 ## Related
 
-- [Direct3D11 render import](/quest/m2/render-d3d11.md) - the other Windows half of keeping rendered pictures on the GPU
+- [Direct3D11 render import](/quest/m3/render-d3d11.md) - the other Windows half of keeping rendered pictures on the GPU
 - [Studio](https://github.com/moq-dev/studio) - moq-dev/studio, the app whose program this encodes
diff --git a/quest/m2/mkv-flac-channel-mask.md b/quest/m3/mkv-flac-channel-mask.md
similarity index 100%
rename from quest/m2/mkv-flac-channel-mask.md
rename to quest/m3/mkv-flac-channel-mask.md
diff --git a/quest/m2/mobile-capture-android.md b/quest/m3/mobile-capture-android.md
similarity index 94%
rename from quest/m2/mobile-capture-android.md
rename to quest/m3/mobile-capture-android.md
index 96f87cae204..feec51d4a18 100644
--- a/quest/m2/mobile-capture-android.md
+++ b/quest/m3/mobile-capture-android.md
@@ -25,5 +25,5 @@ Deferred to m2; mobile capture does not gate the next breaking cut.
 
 ## Related
 
-- [iOS capture](/quest/m2/mobile-capture-ios.md) - the other half of mobile, which
+- [iOS capture](/quest/m3/mobile-capture-ios.md) - the other half of mobile, which
   reuses an existing backend rather than adding one
diff --git a/quest/m2/mobile-capture-ios.md b/quest/m3/mobile-capture-ios.md
similarity index 96%
rename from quest/m2/mobile-capture-ios.md
rename to quest/m3/mobile-capture-ios.md
index 5d13181a55b..be09d915a6d 100644
--- a/quest/m2/mobile-capture-ios.md
+++ b/quest/m3/mobile-capture-ios.md
@@ -34,5 +34,5 @@ Deferred to m2; mobile capture does not gate the next breaking cut.
 
 ## Related
 
-- [Android capture](/quest/m2/mobile-capture-android.md) - the other half of
+- [Android capture](/quest/m3/mobile-capture-android.md) - the other half of
   mobile, and a much larger one
diff --git a/quest/m2/mobile-completion.md b/quest/m3/mobile-completion.md
similarity index 86%
rename from quest/m2/mobile-completion.md
rename to quest/m3/mobile-completion.md
index a6c776e0126..833eda26943 100644
--- a/quest/m2/mobile-completion.md
+++ b/quest/m3/mobile-completion.md
@@ -27,6 +27,6 @@ quests; mobile completion does not gate the next breaking cut.
 
 ## Required
 
-- [Dart on iOS](/quest/m2/dart-ios.md) - the Dart iOS asset proof
-- [iOS capture](/quest/m2/mobile-capture-ios.md) - deliver the selected iOS capture path
-- [Android capture](/quest/m2/mobile-capture-android.md) - deliver the selected Android capture and codec path
+- [Dart on iOS](/quest/m3/dart-ios.md) - the Dart iOS asset proof
+- [iOS capture](/quest/m3/mobile-capture-ios.md) - deliver the selected iOS capture path
+- [Android capture](/quest/m3/mobile-capture-android.md) - deliver the selected Android capture and codec path
diff --git a/quest/m2/mp4-repair-lock.md b/quest/m3/mp4-repair-lock.md
similarity index 100%
rename from quest/m2/mp4-repair-lock.md
rename to quest/m3/mp4-repair-lock.md
diff --git a/quest/m2/mux-source-cut.md b/quest/m3/mux-source-cut.md
similarity index 96%
rename from quest/m2/mux-source-cut.md
rename to quest/m3/mux-source-cut.md
index 1ad448d6acd..d7bce453a03 100644
--- a/quest/m2/mux-source-cut.md
+++ b/quest/m3/mux-source-cut.md
@@ -40,4 +40,4 @@ none.
 
 ## Related
 
-- [A recording stalled on an open group reports what it waits for](/quest/m2/hls-stalled-segment.md) - the other [moq-dev/moq#7399](https://github.com/moq-dev/moq/pull/7399) follow-up
+- [A recording stalled on an open group reports what it waits for](/quest/m3/hls-stalled-segment.md) - the other [moq-dev/moq#7399](https://github.com/moq-dev/moq/pull/7399) follow-up
diff --git a/quest/m2/net-broadcast-requests.md b/quest/m3/net-broadcast-requests.md
similarity index 87%
rename from quest/m2/net-broadcast-requests.md
rename to quest/m3/net-broadcast-requests.md
index 950d5ea6664..7af45f167b7 100644
--- a/quest/m2/net-broadcast-requests.md
+++ b/quest/m3/net-broadcast-requests.md
@@ -10,12 +10,12 @@ front from one broadcast, on demand, the way Rust does.
 ## Plan
 
 Split 2026-11-03 (maintainer) from
-[JS undeclared track names](/quest/m2/e2ee/js-undeclared-names.md), which
+[JS undeclared track names](/quest/m5/e2ee/js-undeclared-names.md), which
 keeps the `@moq/crypto` half and now requires this. Kixel's T3 host needs
 only the plaintext half: without it, one environment broadcast would need a
 track per thread created up front, so T3 claims a broadcast per entity
 instead and can collapse to one once this lands. Today the request pull
 (`requested()` in `js/net/src/broadcast.ts`) is reachable only by wire
 layers, and only the origin has a public `requests()`; keep the internal
-wire path on the new handler. Ranked at the top of m2 beside the mesh
+wire path on the new handler. Ranked at the top of m3 beside the mesh
 libraries, which Kixel builds on from `main`.
diff --git a/quest/m2/nixpkgs-cli.md b/quest/m3/nixpkgs-cli.md
similarity index 85%
rename from quest/m2/nixpkgs-cli.md
rename to quest/m3/nixpkgs-cli.md
index 6140babebb9..8348f19638d 100644
--- a/quest/m2/nixpkgs-cli.md
+++ b/quest/m3/nixpkgs-cli.md
@@ -16,10 +16,10 @@ Decided 2026-11-05 (maintainer, /quest-plan):
   - ✅ Wait for cli-packaging
 - The maintainer added "moq-cli only when we're happy with the feature set"
   and left the bar to the planner. Decided: the bar is
-  [Ship capture and playback](/quest/m2/cli-packaging.md) merged, since that
+  [Ship capture and playback](/quest/m3/cli-packaging.md) merged, since that
   is when every distribution builds with `--features release`.
 
-Follow [moq-relay in nixpkgs](/quest/m2/nixpkgs-relay.md)'s process: prepare
+Follow [moq-relay in nixpkgs](/quest/m3/nixpkgs-relay.md)'s process: prepare
 a branch on kixelated/nixpkgs with `Assisted-by:` trailers, then wait for the
 maintainer to review and open the PR. The maintainer-list entry already exists
 by then.
@@ -34,5 +34,5 @@ their driver libraries, so make them findable at runtime (for example
 
 ## Required
 
-- [Ship capture and playback](/quest/m2/cli-packaging.md) - the `release` feature set that the nixpkgs package builds
-- [moq-relay in nixpkgs](/quest/m2/nixpkgs-relay.md) - kixelated's maintainer entry and the package conventions
+- [Ship capture and playback](/quest/m3/cli-packaging.md) - the `release` feature set that the nixpkgs package builds
+- [moq-relay in nixpkgs](/quest/m3/nixpkgs-relay.md) - kixelated's maintainer entry and the package conventions
diff --git a/quest/m2/nixpkgs-relay.md b/quest/m3/nixpkgs-relay.md
similarity index 96%
rename from quest/m2/nixpkgs-relay.md
rename to quest/m3/nixpkgs-relay.md
index ef0ae3a3c46..0e0062a6c82 100644
--- a/quest/m2/nixpkgs-relay.md
+++ b/quest/m3/nixpkgs-relay.md
@@ -11,7 +11,7 @@ nixpkgs-unstable.
 Out of scope: upstreaming the `services.moq-relay` NixOS module, moq-gst,
 and moq-bench. Our flake, overlay, and nix.moq.dev cache stay as they are for
 `main` and `release` builds. The CLI follows in
-[moq-cli in nixpkgs](/quest/m2/nixpkgs-cli.md).
+[moq-cli in nixpkgs](/quest/m3/nixpkgs-cli.md).
 
 ## Plan
 
@@ -61,4 +61,4 @@ CLI.
 
 ## Related
 
-- [moq-cli in nixpkgs](/quest/m2/nixpkgs-cli.md) - the CLI follows once its release feature set lands
+- [moq-cli in nixpkgs](/quest/m3/nixpkgs-cli.md) - the CLI follows once its release feature set lands
diff --git a/quest/m2/obs-decode-latest.md b/quest/m3/obs-decode-latest.md
similarity index 96%
rename from quest/m2/obs-decode-latest.md
rename to quest/m3/obs-decode-latest.md
index f91eebdea07..2d5af02d934 100644
--- a/quest/m2/obs-decode-latest.md
+++ b/quest/m3/obs-decode-latest.md
@@ -27,7 +27,7 @@ Decided 2026-10-31 (user, /quest-plan of the follow-ups from the 2026-10-31
   `go/wrapper/types.go:15,81`: no wrapper API accepts them
   (`audio.DecoderOutput`/`video.DecoderOutput` are the real inputs). Their
   migration note is gathered by the
-  [migration audit](/quest/m2/release/migrate-audit.md).
+  [migration audit](/quest/m3/release/migrate-audit.md).
 - If cheap, an e2e check that an audio decoder with `Latest` starts at the
   newest group, beside [moq-dev/moq#7288](https://github.com/moq-dev/moq/pull/7288)'s `video_decode_start`.
 
diff --git a/quest/m2/obs-moq-video/README.md b/quest/m3/obs-moq-video/README.md
similarity index 83%
rename from quest/m2/obs-moq-video/README.md
rename to quest/m3/obs-moq-video/README.md
index a045f3aea08..9c7c2438b9b 100644
--- a/quest/m2/obs-moq-video/README.md
+++ b/quest/m3/obs-moq-video/README.md
@@ -12,7 +12,7 @@ Attempt GPU delivery immediately on macOS decode; other platforms keep the CPU p
 
 Initial video decoding covers H.264, HEVC, and AV1 where moq-video has an available backend. Unsupported codecs produce an actionable error; do not retain an FFmpeg fallback. VP8/VP9 return through their own follow-up quest. Audio playback covers Opus, AAC-LC, and PCM.
 
-Publishing remains opt-in, with one **Use MoQ encoders** choice for video and audio. Keep the existing OBS encoder mode. Internal OBS encoder adapters call moq-video/moq-audio, preserving OBS's A/V handling and the existing encoded MoQ output. The combined choice is enabled only when both adapters are present. Start with H.264, supported HEVC, and Opus; defer AV1/AAC encoding and PCM publishing UI. Keep bitrate separate from **Low latency**, **Balanced** (default), and **Quality** presets. Presets describe supported buffering/compression controls, not an end-to-end delay promise. The line PR must call out the video default changes #4099 made: NVENC P4 to P1, and openh264 medium to low complexity. Known gap: VAAPI reports Low latency whatever was asked, and V4L2 and MediaCodec report unconfirmed; no quest owns measuring and mapping presets for them. Media Foundation is owned by [Windows GPU input](/quest/m2/obs-windows.md).
+Publishing remains opt-in, with one **Use MoQ encoders** choice for video and audio. Keep the existing OBS encoder mode. Internal OBS encoder adapters call moq-video/moq-audio, preserving OBS's A/V handling and the existing encoded MoQ output. The combined choice is enabled only when both adapters are present. Start with H.264, supported HEVC, and Opus; defer AV1/AAC encoding and PCM publishing UI. Keep bitrate separate from **Low latency**, **Balanced** (default), and **Quality** presets. Presets describe supported buffering/compression controls, not an end-to-end delay promise. The line PR must call out the video default changes #4099 made: NVENC P4 to P1, and openh264 medium to low complexity. Known gap: VAAPI reports Low latency whatever was asked, and V4L2 and MediaCodec report unconfirmed; no quest owns measuring and mapping presets for them. Media Foundation is owned by [Windows GPU input](/quest/m5/obs-windows.md).
 
 The quests separate portable decoding, audio, and publishing so each can land and be validated independently. moq-ffi's decoded frames own their surface and convert to CPU pixels only on request (#4094); a surface decode exposes the platform surface as a borrowed view, which each platform GPU quest extends to its own surface type.
 
@@ -20,19 +20,19 @@ Decided in the 2026-09-30 audit: the Windows and Linux GPU decode paths and the
 
 ## Required
 
-- [Video source replacement](/quest/m2/obs-moq-video/source.md) - remove the FFmpeg video decode and attempt macOS GPU delivery immediately, with a working CPU fallback on other platforms
-- [Linux bundle](/quest/m2/obs-moq-video/linux-bundle.md) - attach a portable Linux x86_64 tarball to every obs-moq release once FFmpeg is gone
-- [Video publishing](/quest/m2/obs-moq-video/adapter.md) - back an internal OBS video encoder with moq-video and expose the combined opt-in mode
-- [VP8/VP9 in OBS](/quest/m2/obs-moq-video/vpx-obs.md) - play VP8 and VP9 through moq-video's libvpx backend on every OBS platform
+- [Video source replacement](/quest/m3/obs-moq-video/source.md) - remove the FFmpeg video decode and attempt macOS GPU delivery immediately, with a working CPU fallback on other platforms
+- [Linux bundle](/quest/m3/obs-moq-video/linux-bundle.md) - attach a portable Linux x86_64 tarball to every obs-moq release once FFmpeg is gone
+- [Video publishing](/quest/m3/obs-moq-video/adapter.md) - back an internal OBS video encoder with moq-video and expose the combined opt-in mode
+- [VP8/VP9 in OBS](/quest/m3/obs-moq-video/vpx-obs.md) - play VP8 and VP9 through moq-video's libvpx backend on every OBS platform
 
 ## Related
 
-- [Linux GPU decode](/quest/m2/obs-decode-linux.md) - present hardware-decoded frames without CPU readback; needs physical-hardware proof
-- [Windows GPU decode](/quest/m2/obs-decode-windows.md) - present D3D11 decoded textures without CPU readback; needs physical-hardware proof
-- [macOS GPU input](/quest/m2/obs-macos.md) - feed compositor frames to VideoToolbox without a CPU round trip; needs physical-hardware proof
-- [Windows GPU input](/quest/m2/obs-windows.md) - feed D3D11 compositor frames to the encoder without CPU staging; needs physical-hardware proof
-- [Video hardware validation](/quest/m3/video-hardware.md) - physical hardware evidence is required for each claimed GPU path
-- [AudioToolbox decode](/quest/m2/audio-decode-audiotoolbox.md) - HE-AAC and multichannel AAC reach the OBS source on macOS through moq-ffi
-- [AudioToolbox encode](/quest/m2/audio-encode-audiotoolbox.md) - native AAC encode reaches the OBS encoder adapter on macOS through moq-ffi
-- [Linux GPU input](/quest/m3/obs-linux-gpu.md) - allocation-export feasibility and its dependent implementation are deferred
-- [VAAPI encode and decode](/quest/m2/video-vaapi.md) - owns Linux backend decode/import capabilities; reconcile its older dependency assumptions against current code
+- [Linux GPU decode](/quest/m5/obs-decode-linux.md) - present hardware-decoded frames without CPU readback; needs physical-hardware proof
+- [Windows GPU decode](/quest/m5/obs-decode-windows.md) - present D3D11 decoded textures without CPU readback; needs physical-hardware proof
+- [macOS GPU input](/quest/m5/obs-macos.md) - feed compositor frames to VideoToolbox without a CPU round trip; needs physical-hardware proof
+- [Windows GPU input](/quest/m5/obs-windows.md) - feed D3D11 compositor frames to the encoder without CPU staging; needs physical-hardware proof
+- [Video hardware validation](/quest/m5/video-hardware.md) - physical hardware evidence is required for each claimed GPU path
+- [AudioToolbox decode](/quest/m3/audio-decode-audiotoolbox.md) - HE-AAC and multichannel AAC reach the OBS source on macOS through moq-ffi
+- [AudioToolbox encode](/quest/m5/audio-encode-audiotoolbox.md) - native AAC encode reaches the OBS encoder adapter on macOS through moq-ffi
+- [Linux GPU input](/quest/m5/obs-linux-gpu.md) - allocation-export feasibility and its dependent implementation are deferred
+- [VAAPI encode and decode](/quest/m1/video-vaapi.md) - owns Linux backend decode/import capabilities; reconcile its older dependency assumptions against current code
diff --git a/quest/m2/obs-moq-video/adapter.md b/quest/m3/obs-moq-video/adapter.md
similarity index 100%
rename from quest/m2/obs-moq-video/adapter.md
rename to quest/m3/obs-moq-video/adapter.md
diff --git a/quest/m2/obs-moq-video/linux-bundle.md b/quest/m3/obs-moq-video/linux-bundle.md
similarity index 94%
rename from quest/m2/obs-moq-video/linux-bundle.md
rename to quest/m3/obs-moq-video/linux-bundle.md
index 3f4e464014b..a8865433178 100644
--- a/quest/m2/obs-moq-video/linux-bundle.md
+++ b/quest/m3/obs-moq-video/linux-bundle.md
@@ -14,8 +14,8 @@ Every `obs-moq-v*` release attaches a Linux x86_64 tarball that loads into a sto
 
 ## Required
 
-- [Video source replacement](/quest/m2/obs-moq-video/source.md) - removes the FFmpeg video linkage that makes a Linux binary non-portable
+- [Video source replacement](/quest/m3/obs-moq-video/source.md) - removes the FFmpeg video linkage that makes a Linux binary non-portable
 
 ## Related
 
-- [Linux decoded frames](/quest/m2/obs-decode-linux.md) - native surface delivery lands on top of the portable CPU path this bundle ships
+- [Linux decoded frames](/quest/m5/obs-decode-linux.md) - native surface delivery lands on top of the portable CPU path this bundle ships
diff --git a/quest/m2/obs-moq-video/source.md b/quest/m3/obs-moq-video/source.md
similarity index 98%
rename from quest/m2/obs-moq-video/source.md
rename to quest/m3/obs-moq-video/source.md
index 99afe770f14..0d345ccad10 100644
--- a/quest/m2/obs-moq-video/source.md
+++ b/quest/m3/obs-moq-video/source.md
@@ -23,4 +23,4 @@ both. The replacement keeps that behavior, covered with reordered video.
 
 ## Related
 
-- [VP8/VP9 in OBS](/quest/m2/obs-moq-video/vpx-obs.md) - restores deferred codec coverage once this lands
+- [VP8/VP9 in OBS](/quest/m3/obs-moq-video/vpx-obs.md) - restores deferred codec coverage once this lands
diff --git a/quest/m2/obs-moq-video/vpx-obs.md b/quest/m3/obs-moq-video/vpx-obs.md
similarity index 89%
rename from quest/m2/obs-moq-video/vpx-obs.md
rename to quest/m3/obs-moq-video/vpx-obs.md
index c259ee3c386..c241306b890 100644
--- a/quest/m2/obs-moq-video/vpx-obs.md
+++ b/quest/m3/obs-moq-video/vpx-obs.md
@@ -12,8 +12,8 @@ The OBS MoQ source plays VP8 and VP9 (8-bit 4:2:0) on every platform it ships fo
 
 ## Required
 
-- [Video source replacement](/quest/m2/obs-moq-video/source.md) - the source decodes through moq-video first
+- [Video source replacement](/quest/m3/obs-moq-video/source.md) - the source decodes through moq-video first
 
 ## Related
 
-- [Codec coverage](/quest/m3/video-codec-coverage.md) - hardware VP8/VP9 decode belongs to that review
+- [Codec coverage](/quest/m5/video-codec-coverage.md) - hardware VP8/VP9 decode belongs to that review
diff --git a/quest/m2/obs-multitrack-check.md b/quest/m3/obs-multitrack-check.md
similarity index 100%
rename from quest/m2/obs-multitrack-check.md
rename to quest/m3/obs-multitrack-check.md
diff --git a/quest/m2/obs-studio/README.md b/quest/m3/obs-studio/README.md
similarity index 82%
rename from quest/m2/obs-studio/README.md
rename to quest/m3/obs-studio/README.md
index 99ee2751026..ed00b59b446 100644
--- a/quest/m2/obs-studio/README.md
+++ b/quest/m3/obs-studio/README.md
@@ -12,7 +12,7 @@ keeps shipping.
 This README holds the port and merge work: carry the plugin's output and
 service into obs-studio's tree in the shape its maintainers ask for, then
 land it upstream. Shape it around their answer to
-[the condition](/quest/m2/obs-studio/maintainers.md), not ahead of it.
+[the condition](/quest/m3/obs-studio/maintainers.md), not ahead of it.
 
 Agents may prepare the proposal and the code, but never post to obs-studio
 (issues, PRs, comments, forums) without the maintainer's explicit approval
@@ -28,9 +28,9 @@ Open, for when the port starts:
 
 ## Required
 
-- [obs-studio maintainers agree](/quest/m2/obs-studio/maintainers.md) - condition: agreement in principle to a native MoQ output and service
+- [obs-studio maintainers agree](/quest/m3/obs-studio/maintainers.md) - condition: agreement in principle to a native MoQ output and service
 
 ## Related
 
-- [First C++ package release](/quest/m2/release/cpp-release.md) - the published C++ package the port would build on
-- [OBS native codecs](/quest/m2/obs-moq-video/README.md) - the plugin's codec work, which stays plugin-side
+- [First C++ package release](/quest/m3/release/cpp-release.md) - the published C++ package the port would build on
+- [OBS native codecs](/quest/m3/obs-moq-video/README.md) - the plugin's codec work, which stays plugin-side
diff --git a/quest/m2/obs-studio/maintainers.md b/quest/m3/obs-studio/maintainers.md
similarity index 91%
rename from quest/m2/obs-studio/maintainers.md
rename to quest/m3/obs-studio/maintainers.md
index c48b0d61b94..ed97963a108 100644
--- a/quest/m2/obs-studio/maintainers.md
+++ b/quest/m3/obs-studio/maintainers.md
@@ -14,6 +14,6 @@ this quest and every `Required` entry that links it.
 
 To check: ask the maintainer whether obs-studio has agreed, and record any
 constraints they set (dependency policy, scope, review owners) in the
-[questline](/quest/m2/obs-studio/README.md) before deleting this quest. To
+[questline](/quest/m3/obs-studio/README.md) before deleting this quest. To
 advance: offer the maintainer a drafted proposal covering what the output
 does, how it builds, and who maintains it.
diff --git a/quest/m2/one-port/README.md b/quest/m3/one-port/README.md
similarity index 86%
rename from quest/m2/one-port/README.md
rename to quest/m3/one-port/README.md
index 091ce16bcb0..c3190f00d06 100644
--- a/quest/m2/one-port/README.md
+++ b/quest/m3/one-port/README.md
@@ -15,27 +15,27 @@ relay binary has never spoken. An operator opens 443 twice and is done; a client
 a network that permits only 443 reaches every protocol.
 
 The demux is a `moq-sock` primitive over the tokio backends.
-[`moq-uring`'s workers](/quest/m2/uring-demux.md) host it later; that is not
+[`moq-uring`'s workers](/quest/m3/uring-demux.md) host it later; that is not
 a blocker for this line.
 
 ## Plan
 
 Deferred to m2 in the 2026-09-30 audit: the consumer is moq.pro's edge, and
 STUN's only consumer is P2P, deferred to m2. SRT is not blocked upstream:
-[SRT demux](/quest/m2/one-port/srt-demux.md) decided on 2026-09-30 to drive
+[SRT demux](/quest/m3/one-port/srt-demux.md) decided on 2026-09-30 to drive
 sans-io `srt-protocol` directly instead of waiting on a socket abstraction in
 srt-tokio.
 
 Decided 2026-10-05, from moq.pro's audit: `moq-rtc` taking a fed socket
-([rtc-feed](/quest/m2/one-port/rtc-feed.md)) joins this line, and
-[the io_uring demux](/quest/m2/uring-demux.md) is planned beside it, all in
+([rtc-feed](/quest/m3/one-port/rtc-feed.md)) joins this line, and
+[the io_uring demux](/quest/m3/uring-demux.md) is planned beside it, all in
 m2 rather than m3, since moq.pro's edge cutover and its uring rollout wait on
 them.
 
 The UDP demux has landed: `moq_sock::demux` classifies, and the tokio QUIC
 listener's socket diverts the WebRTC media path inline in its receive to a
 `moq_tokio::quic::demux::WebRtc` feed, which `moq_relay::Relay::webrtc`
-hands an embedder. [Native pairs](/quest/m2/p2p/native-quic.md) reuse the
+hands an embedder. [Native pairs](/quest/m4/p2p/native-quic.md) reuse the
 classifier. QUIC shard steering landed in #5638; reuse its filter rather than
 recreating that completed work.
 
@@ -78,14 +78,14 @@ class into that stack's bounded feed, shared by every shard. Sends go
 straight to the shared socket, so every stack answers from the same address
 and port. `moq-rtc`'s `Mux` already demuxes STUN by ufrag
 internally and takes a fed socket in
-[WebRTC on the shared socket](/quest/m2/one-port/rtc-feed.md). SRT skips `srt-tokio`,
+[WebRTC on the shared socket](/quest/m3/one-port/rtc-feed.md). SRT skips `srt-tokio`,
 which accepts a `tokio::net::UdpSocket` but no abstraction, and feeds
-datagrams to sans-io `srt-protocol` as [SRT demux](/quest/m2/one-port/srt-demux.md)
+datagrams to sans-io `srt-protocol` as [SRT demux](/quest/m3/one-port/srt-demux.md)
 decided.
 
 ### STUN
 
-Decided 2026-10-08: the public STUN responder is left to P2P (m2), its
+Decided 2026-10-08: the public STUN responder is left to P2P (m4), its
 only consumer. Here, a Binding request carrying USERNAME is an ICE check
 and goes to WebRTC, as does every Binding response, since the WebRTC agent
 runs full ICE and only it sends requests from this port. Any other STUN is
@@ -95,10 +95,10 @@ so the shared port never answers public Binding requests.
 
 ## Required
 
-- [WebRTC on the shared socket](/quest/m2/one-port/rtc-feed.md) - `moq-rtc` serves WHIP and WHEP media from the WebRTC hook and pins ICE tuples
-- [SRT on the shared socket](/quest/m2/one-port/srt-demux.md) - moq-srt drives `srt-protocol` on demuxed packets and the flow table pins its 4-tuples
+- [WebRTC on the shared socket](/quest/m3/one-port/rtc-feed.md) - `moq-rtc` serves WHIP and WHEP media from the WebRTC hook and pins ICE tuples
+- [SRT on the shared socket](/quest/m3/one-port/srt-demux.md) - moq-srt drives `srt-protocol` on demuxed packets and the flow table pins its 4-tuples
 
 ## Related
 
-- [One port on the io_uring workers](/quest/m2/uring-demux.md) - the io_uring workers host the UDP demux
-- [Stream transports](/quest/m2/perf/stream/README.md) - the io_uring workers that would host the TCP acceptor later
+- [One port on the io_uring workers](/quest/m3/uring-demux.md) - the io_uring workers host the UDP demux
+- [Stream transports](/quest/m4/perf/stream/README.md) - the io_uring workers that would host the TCP acceptor later
diff --git a/quest/m2/one-port/rtc-feed.md b/quest/m3/one-port/rtc-feed.md
similarity index 98%
rename from quest/m2/one-port/rtc-feed.md
rename to quest/m3/one-port/rtc-feed.md
index cc1f30e0aec..a6c34505cc3 100644
--- a/quest/m2/one-port/rtc-feed.md
+++ b/quest/m3/one-port/rtc-feed.md
@@ -56,7 +56,7 @@ public IPv4 address, so the `Transmit` impl owns the IPv4-mapped conversion
 matches.
 When ICE selects a pair, the remote address goes out on `pinned`, so the
 demux routes that tuple to WebRTC before any SRT test (see the
-[questline README](/quest/m2/one-port/README.md)). A pin also has to be
+[questline README](/quest/m3/one-port/README.md)). A pin also has to be
 released when its session ends or ICE moves to another pair: either an
 unpin message or idle expiry in the flow table, as SRT's pins have.
 
diff --git a/quest/m2/one-port/srt-demux.md b/quest/m3/one-port/srt-demux.md
similarity index 100%
rename from quest/m2/one-port/srt-demux.md
rename to quest/m3/one-port/srt-demux.md
diff --git a/quest/m2/opus-surround-export.md b/quest/m3/opus-surround-export.md
similarity index 96%
rename from quest/m2/opus-surround-export.md
rename to quest/m3/opus-surround-export.md
index 3050a79e4c0..c570307ad56 100644
--- a/quest/m2/opus-surround-export.md
+++ b/quest/m3/opus-surround-export.md
@@ -25,7 +25,7 @@ and [moq-dev/moq#7308](https://github.com/moq-dev/moq/pull/7308).
   a plain table, so it imports as plain channels or fails as an invalid
   table. [moq-dev/moq#7336](https://github.com/moq-dev/moq/pull/7336) refuses family 3 in fMP4 only. Refuse it in `parse` itself
   (recommended, since no consumer can render a demixing matrix today), or
-  carry it as `ambisonic` if [VR and ambisonic fMP4](/quest/m2/mux-vr-ambisonic-fmp4.md)
+  carry it as `ambisonic` if [VR and ambisonic fMP4](/quest/m4/mux-vr-ambisonic-fmp4.md)
   wants it.
 
 Cover both with unit tests beside [moq-dev/moq#7336](https://github.com/moq-dev/moq/pull/7336)'s
diff --git a/quest/m2/pes-hold-open-gop.md b/quest/m3/pes-hold-open-gop.md
similarity index 100%
rename from quest/m2/pes-hold-open-gop.md
rename to quest/m3/pes-hold-open-gop.md
diff --git a/quest/m2/plan-watch-worker.md b/quest/m3/plan-watch-worker.md
similarity index 96%
rename from quest/m2/plan-watch-worker.md
rename to quest/m3/plan-watch-worker.md
index b11b2aaaff9..8b096afee96 100644
--- a/quest/m2/plan-watch-worker.md
+++ b/quest/m3/plan-watch-worker.md
@@ -3,7 +3,7 @@
 ## Goal
 
 A measured decision on how `@moq/watch` moves its heavy lifting off the main
-thread, recorded by rewriting [Watch worker](/quest/m2/watch-worker.md). The
+thread, recorded by rewriting [Watch worker](/quest/m3/watch-worker.md). The
 jank harness and the N-player sweep that decided it land and run nightly; the
 prototypes themselves are discarded.
 
@@ -71,4 +71,4 @@ follow-up wires the capture worklet to the encoder worker with a
 
 ## Related
 
-- [Watch worker](/quest/m2/watch-worker.md) - the implementation this rewrites
+- [Watch worker](/quest/m3/watch-worker.md) - the implementation this rewrites
diff --git a/quest/m2/publish-cancel-classify.md b/quest/m3/publish-cancel-classify.md
similarity index 100%
rename from quest/m2/publish-cancel-classify.md
rename to quest/m3/publish-cancel-classify.md
diff --git a/quest/m2/publish-done-codes.md b/quest/m3/publish-done-codes.md
similarity index 100%
rename from quest/m2/publish-done-codes.md
rename to quest/m3/publish-done-codes.md
diff --git a/quest/m2/publish-support-probe.md b/quest/m3/publish-support-probe.md
similarity index 100%
rename from quest/m2/publish-support-probe.md
rename to quest/m3/publish-support-probe.md
diff --git a/quest/m2/pulseaudio-capture-period.md b/quest/m3/pulseaudio-capture-period.md
similarity index 92%
rename from quest/m2/pulseaudio-capture-period.md
rename to quest/m3/pulseaudio-capture-period.md
index dbe3099e026..9b243402926 100644
--- a/quest/m2/pulseaudio-capture-period.md
+++ b/quest/m3/pulseaudio-capture-period.md
@@ -9,7 +9,7 @@ proves it against the private null sink's monitor source.
 
 ## Plan
 
-Found by the m1 [coverage audit](/quest/m2/audit-test-coverage.md). Playback
+Found by the m1 [coverage audit](/quest/m3/audit-test-coverage.md). Playback
 on that host asked for `BufferSize::Default`, which cpal's PulseAudio host
 maps to the server's default buffer attributes: a 2 s `tlength`, 3.96 s end
 to end. The audit fixed playback (`playback::device::buffer_size` asks for
@@ -29,4 +29,4 @@ needs both halves within its delay window, so this matters for `aec` too.
 
 ## Related
 
-- [A cpal release loads libasound at runtime](/quest/m2/cpal-alsa-runtime.md) - would make the PulseAudio host the default on hosts without libasound
+- [A cpal release loads libasound at runtime](/quest/m3/cpal-alsa-runtime.md) - would make the PulseAudio host the default on hosts without libasound
diff --git a/quest/m2/qos-publisher-timeliness.md b/quest/m3/qos-publisher-timeliness.md
similarity index 95%
rename from quest/m2/qos-publisher-timeliness.md
rename to quest/m3/qos-publisher-timeliness.md
index f6f4d340215..2ae1a252d45 100644
--- a/quest/m2/qos-publisher-timeliness.md
+++ b/quest/m3/qos-publisher-timeliness.md
@@ -11,7 +11,7 @@ cooperation.
 ## Plan
 
 This is the ingress mirror of the egress `lag` histogram ([viewer lag
-histogram](/quest/m2/qos/lag-histogram.md), which lands first so this reuses
+histogram](/quest/m3/qos/lag-histogram.md), which lands first so this reuses
 its histogram type, decided 2026-10-08) and needs no acknowledgments: the relay is the receiver, and a frame is measured
 when its last byte arrives, because a partial frame is not useful.
 
@@ -54,4 +54,4 @@ excluded.
 
 ## Required
 
-- [Viewer lag histogram](/quest/m2/qos/lag-histogram.md) - the egress histogram whose type and edges this reuses
+- [Viewer lag histogram](/quest/m3/qos/lag-histogram.md) - the egress histogram whose type and edges this reuses
diff --git a/quest/m2/qos/README.md b/quest/m3/qos/README.md
similarity index 88%
rename from quest/m2/qos/README.md
rename to quest/m3/qos/README.md
index c9982455d8b..5e977bfbe2f 100644
--- a/quest/m2/qos/README.md
+++ b/quest/m3/qos/README.md
@@ -5,7 +5,7 @@
 Publish the relay QoS lag and dropped-counter API after the next release.
 The histogram lands on totals and prefix tracks beside the existing maps.
 Publisher timeliness, client media health, and dashboard presentation remain
-separate additive work in m2.
+separate additive work in m3 and m5.
 
 ## Plan
 
@@ -25,7 +25,7 @@ hang stats and `.echo` feedback tracks, planned in their own line on `main`.
 
 Only the lag counters land here. Client health is
 [graded in hang](/doc/concept/stats.md#health), and preflight is
-[preflight](/quest/m2/stats/preflight.md) in the media stats line. The
+[preflight](/quest/m3/stats/preflight.md) in the media stats line. The
 moq.pro (downstream) dashboard work, including the health badge and the
 connection-health drill-down, consumes both.
 
@@ -44,7 +44,7 @@ Rejected: the histogram first, which would make prefix tracks carry the lag
 histogram and dropped counters across.
 
 Decided (2026-10-08): the egress histogram is its own quest,
-[viewer lag histogram](/quest/m2/qos/lag-histogram.md), since every other
+[viewer lag histogram](/quest/m3/qos/lag-histogram.md), since every other
 child reads it. The line's PR, #4133, closed without landing (2026-10-09).
 Its port, #6791, closed unmerged on 2026-10-26 to wait for the ACK hook,
 since `lag` and `dropped` are measured per acknowledged frame; its branch is
@@ -57,13 +57,13 @@ on `main`.
 
 ## Required
 
-- [Viewer lag histogram](/quest/m2/qos/lag-histogram.md) - the egress `lag`
+- [Viewer lag histogram](/quest/m3/qos/lag-histogram.md) - the egress `lag`
   histogram and `dropped` counters land on the stats totals and prefix
   tracks
 
 ## Related
 
-- [Media stats](/quest/m2/stats/README.md) - publishers and viewers report
+- [Media stats](/quest/m3/stats/README.md) - publishers and viewers report
   their own media, transport, and playback health, the media half of a verdict
-- [Loss delay](/quest/m3/cut-through/loss-delay.md) - an ingress counter of
+- [Loss delay](/quest/m5/cut-through/loss-delay.md) - an ingress counter of
   bytes a loss held back by at least one RTT, on the same rows
diff --git a/quest/m2/qos/lag-histogram.md b/quest/m3/qos/lag-histogram.md
similarity index 96%
rename from quest/m2/qos/lag-histogram.md
rename to quest/m3/qos/lag-histogram.md
index ac25bbbaba1..43a00984215 100644
--- a/quest/m2/qos/lag-histogram.md
+++ b/quest/m3/qos/lag-histogram.md
@@ -32,11 +32,11 @@ Decided 2026-10-26 (maintainer, on #6791), each with its reason:
   behind, and every unsubscribe, rendition switch, or session close charges
   the open group's whole content to `dropped`, so a healthy audience with
   churn reads a dropped baseline. The frontier instead moves at every
-  acknowledged frame end through [poll_acked](/quest/m2/quic-ack-hook.md), so
+  acknowledged frame end through [poll_acked](/quest/m3/quic-ack-hook.md), so
   the sampler reads a frontier at most one frame stale. `dropped` counts only
   the frames written after the newest acknowledged one. This folds in the
   frontier half of the former starvation-frames quest; the delivery-delay
-  histogram stays in [its own quest](/quest/m2/delivery-delay.md). Its sketch,
+  histogram stays in [its own quest](/quest/m5/delivery-delay.md). Its sketch,
   to adjust as the code dictates: the group stream's writer counts the bytes
   it writes, each frame end records its offset and timestamp, and one waiter
   per stream polls the oldest pending offset, interleaved with later writes so
@@ -100,5 +100,5 @@ Update `doc/concept/stats.md` and the stats section of
 
 ## Required
 
-- [poll_acked on moq-net's send stream](/quest/m2/quic-ack-hook.md) - the
+- [poll_acked on moq-net's send stream](/quest/m3/quic-ack-hook.md) - the
   per-frame acknowledgement the frontier moves on
diff --git a/quest/m2/quic-ack-hook.md b/quest/m3/quic-ack-hook.md
similarity index 97%
rename from quest/m2/quic-ack-hook.md
rename to quest/m3/quic-ack-hook.md
index 08ff75546ea..c3f8397df69 100644
--- a/quest/m2/quic-ack-hook.md
+++ b/quest/m3/quic-ack-hook.md
@@ -95,5 +95,5 @@ close.
 
 
 Decided in the 2026-09-30 audit: moved to m2 with its consumers, the
-[viewer lag histogram](/quest/m2/qos/lag-histogram.md) and the
-[delivery-delay histogram](/quest/m2/delivery-delay.md).
+[viewer lag histogram](/quest/m3/qos/lag-histogram.md) and the
+[delivery-delay histogram](/quest/m5/delivery-delay.md).
diff --git a/quest/m2/quic-emsgsize-classify.md b/quest/m3/quic-emsgsize-classify.md
similarity index 100%
rename from quest/m2/quic-emsgsize-classify.md
rename to quest/m3/quic-emsgsize-classify.md
diff --git a/quest/m2/quic-long-type.md b/quest/m3/quic-long-type.md
similarity index 100%
rename from quest/m2/quic-long-type.md
rename to quest/m3/quic-long-type.md
diff --git a/quest/m2/quic-realtime/README.md b/quest/m3/quic-realtime/README.md
similarity index 96%
rename from quest/m2/quic-realtime/README.md
rename to quest/m3/quic-realtime/README.md
index 9c94ab36e30..d0adb1d96c1 100644
--- a/quest/m2/quic-realtime/README.md
+++ b/quest/m3/quic-realtime/README.md
@@ -173,17 +173,17 @@ The winner's target rate already reaches moq-cli and moq-ffi encoders
 through `bandwidth_estimate` → `estimated_send_rate` → `set_bitrate`.
 `moqsink` only exposes a read-only `estimated-send-rate` and never retunes
 the upstream encoder, so a GStreamer pipeline at a fixed bitrate still queues
-when capacity drops; [its own quest](/quest/m2/quic-realtime/moqsink-feedback.md)
+when capacity drops; [its own quest](/quest/m3/quic-realtime/moqsink-feedback.md)
 owns that feedback.
 
 ## Required
 
-- [io_uring runs an application's controller](/quest/m2/quic-realtime/uring-controller.md) - moq-uring takes a controller factory, so the winner installs the same way on both runtimes
-- [moqsink encoder feedback](/quest/m2/quic-realtime/moqsink-feedback.md) - GStreamer publishers retune their encoder to the target rate
+- [io_uring runs an application's controller](/quest/m3/quic-realtime/uring-controller.md) - moq-uring takes a controller factory, so the winner installs the same way on both runtimes
+- [moqsink encoder feedback](/quest/m3/quic-realtime/moqsink-feedback.md) - GStreamer publishers retune their encoder to the target rate
 
 ## Related
 
-- [Per-stream and per-datagram deadlines](/quest/m2/quic-deadline.md) - also consumes the forward-delay estimate
-- [BBR media study](/quest/m2/quic-bbr-study.md) - BBR3 behavior under media, the baseline here
-- [Measure ECN on the backbone](/quest/m2/quic-ecn-measure.md) - decides whether SCReAMv2's L4S path is worth porting
-- [QUIC on the sim](/quest/m2/quic-sim.md) - deterministic successor to the moq-shaper harness once it lands
+- [Per-stream and per-datagram deadlines](/quest/m5/quic-deadline.md) - also consumes the forward-delay estimate
+- [BBR media study](/quest/m5/quic-bbr-study.md) - BBR3 behavior under media, the baseline here
+- [Measure ECN on the backbone](/quest/m5/quic-ecn-measure.md) - decides whether SCReAMv2's L4S path is worth porting
+- [QUIC on the sim](/quest/m4/quic-sim.md) - deterministic successor to the moq-shaper harness once it lands
diff --git a/quest/m2/quic-realtime/moqsink-feedback.md b/quest/m3/quic-realtime/moqsink-feedback.md
similarity index 91%
rename from quest/m2/quic-realtime/moqsink-feedback.md
rename to quest/m3/quic-realtime/moqsink-feedback.md
index e563cdafce9..27eafcd79f3 100644
--- a/quest/m2/quic-realtime/moqsink-feedback.md
+++ b/quest/m3/quic-realtime/moqsink-feedback.md
@@ -27,5 +27,5 @@ latency win once `Realtime` lands.
 
 ## Related
 
-- [Realtime uplink congestion control](/quest/m2/quic-realtime/README.md) - the controller whose rate this follows
-- [Opus follows its grant](/quest/m2/2848-follow-the-bandwidth-grant-in-moq-audio-instead-of.md) - the same feedback for moq-audio
+- [Realtime uplink congestion control](/quest/m3/quic-realtime/README.md) - the controller whose rate this follows
+- [Opus follows its grant](/quest/m5/2848-follow-the-bandwidth-grant-in-moq-audio-instead-of.md) - the same feedback for moq-audio
diff --git a/quest/m2/quic-realtime/uring-controller.md b/quest/m3/quic-realtime/uring-controller.md
similarity index 100%
rename from quest/m2/quic-realtime/uring-controller.md
rename to quest/m3/quic-realtime/uring-controller.md
diff --git a/quest/m2/quic-sansio-driver.md b/quest/m3/quic-sansio-driver.md
similarity index 97%
rename from quest/m2/quic-sansio-driver.md
rename to quest/m3/quic-sansio-driver.md
index 21f53f8779d..617c5dc1ba6 100644
--- a/quest/m2/quic-sansio-driver.md
+++ b/quest/m3/quic-sansio-driver.md
@@ -28,7 +28,7 @@ Decided with the maintainer on 2026-10-28, from
   destination, until none is left. The driver makes no calls back into the caller, and
   hands out owned bytes, since a binding can't lend a mutable buffer across a C ABI. A
   transmit into a caller's buffer, such as a GSO batch, can follow on
-  [the QUIC I/O boundary](/quest/m2/quic-io-boundary.md).
+  [the QUIC I/O boundary](/quest/m5/quic-io-boundary.md).
 
 Open, for whoever starts it:
 
diff --git a/quest/m2/rate-websocket.md b/quest/m3/rate-websocket.md
similarity index 97%
rename from quest/m2/rate-websocket.md
rename to quest/m3/rate-websocket.md
index 503b327685e..86d9506ba59 100644
--- a/quest/m2/rate-websocket.md
+++ b/quest/m3/rate-websocket.md
@@ -11,7 +11,7 @@ a request has no connection to meter.
 
 Token claims and HTTP grants carry optional caps as `moq_auth::Rate`
 (`publish_rate`, `subscribe_rate`, bits per second), which QUIC sessions
-enforce, and [the grant](/quest/m2/rate-grant.md) carries them in band. This
+enforce, and [the grant](/quest/m5/rate-grant.md) carries them in band. This
 quest reuses that type. A transport without enforcement must not silently
 discard a cap, so WebSocket admission keeps refusing caps until this wrapper
 enforces them through a `Pacer` (`rs/moq-relay/src/auth/caps.rs`).
diff --git a/quest/m2/readers-range-live.md b/quest/m3/readers-range-live.md
similarity index 100%
rename from quest/m2/readers-range-live.md
rename to quest/m3/readers-range-live.md
diff --git a/quest/m2/relay-io-uring-package.md b/quest/m3/relay-io-uring-package.md
similarity index 97%
rename from quest/m2/relay-io-uring-package.md
rename to quest/m3/relay-io-uring-package.md
index 533e4520ee8..7ed518050cb 100644
--- a/quest/m2/relay-io-uring-package.md
+++ b/quest/m3/relay-io-uring-package.md
@@ -46,5 +46,5 @@ Public API: none. Wire: none.
 
 ## Required
 
+- [One port on the io_uring workers](/quest/m3/uring-demux.md) - a one-port config is served on the ring too
 - [The io_uring relay path uses moq-net's policy](/quest/m1/session-policy/uring.md) - the ring serves through the shared accept policy before it ships
-- [One port on the io_uring workers](/quest/m2/uring-demux.md) - a one-port config is served on the ring too
diff --git a/quest/m2/relay-undialable-peers.md b/quest/m3/relay-undialable-peers.md
similarity index 96%
rename from quest/m2/relay-undialable-peers.md
rename to quest/m3/relay-undialable-peers.md
index 2b89bd63295..009f7d1503f 100644
--- a/quest/m2/relay-undialable-peers.md
+++ b/quest/m3/relay-undialable-peers.md
@@ -37,4 +37,4 @@ Public API: additive in moq-tokio. Wire: none.
 
 ## Related
 
-- [Drop moq-auth's iroh transport](/quest/m2/auth-drop-iroh.md) - the other iroh leftover
+- [Drop moq-auth's iroh transport](/quest/m4/auth-drop-iroh.md) - the other iroh leftover
diff --git a/quest/m2/release-rs-oidc.md b/quest/m3/release-rs-oidc.md
similarity index 92%
rename from quest/m2/release-rs-oidc.md
rename to quest/m3/release-rs-oidc.md
index ac0b7ec9551..49aa3e242bc 100644
--- a/quest/m2/release-rs-oidc.md
+++ b/quest/m3/release-rs-oidc.md
@@ -9,7 +9,7 @@ secret is removed and revoked.
 ## Plan
 
 Moved to m2 on 2026-11-05 (/quest-unblock), with
-[crates.io trusts the workflow](/quest/m2/crates-trusted-publisher.md), which
+[crates.io trusts the workflow](/quest/m3/crates-trusted-publisher.md), which
 waits on the cut's first publishes.
 
 
@@ -35,4 +35,4 @@ authentication Action is needed.
 ## Required
 
 - [Remove the moq-e2ee stub](/quest/m1/moq-e2ee-remove.md) - release-plz stops tracking a retired crate that has no trusted publisher
-- [crates.io trusts the workflow](/quest/m2/crates-trusted-publisher.md) - every published crate has the trusted publisher configured
+- [crates.io trusts the workflow](/quest/m3/crates-trusted-publisher.md) - every published crate has the trusted publisher configured
diff --git a/quest/m2/release-tag-publishers.md b/quest/m3/release-tag-publishers.md
similarity index 87%
rename from quest/m2/release-tag-publishers.md
rename to quest/m3/release-tag-publishers.md
index db56ae8a3f1..489788eda0b 100644
--- a/quest/m2/release-tag-publishers.md
+++ b/quest/m3/release-tag-publishers.md
@@ -12,8 +12,8 @@ Planned 2026-11-02 (maintainer, follow-up planning after the 2026-11-02 /quest-c
 the `bot` Environment today, which admits `main`; moving them needs `bot` to
 admit the binary release tags, a maintainer action to list in the PR.
 
-Decided 2026-11-05 (maintainer, /quest-audit): ✅ moved from m0 to m2 behind
-[the cut](/quest/m2/release/cut.md), since tags run `release`'s copies of the
+Decided 2026-11-05 (maintainer, /quest-audit): ✅ moved from m0 to m2 (m3 since the milestone re-cut) behind
+[the cut](/quest/m3/release/cut.md), since tags run `release`'s copies of the
 workflows and `release` gets `main`'s only when the cut merges it. Not
 chosen: moving all four release-gated m0 CI quests, including
 [Drop main from the publish Environment](/quest/m0/ci/publish-release-only.md),
@@ -22,5 +22,5 @@ which reverses the 2026-11-04 decision.
 
 ## Required
 
-- [Cut and publish the prepared breaking release](/quest/m2/release/cut.md) - brings `main`'s workflows to `release`, where tags run them
+- [Cut and publish the prepared breaking release](/quest/m3/release/cut.md) - brings `main`'s workflows to `release`, where tags run them
 - [Release credentials off main](/quest/m0/ci/publish-release-only.md) - the same move for the `publish` jobs lands first
diff --git a/quest/m2/release/README.md b/quest/m3/release/README.md
similarity index 64%
rename from quest/m2/release/README.md
rename to quest/m3/release/README.md
index eb86d124fd8..e5184edc1c0 100644
--- a/quest/m2/release/README.md
+++ b/quest/m3/release/README.md
@@ -2,14 +2,14 @@
 
 ## Goal
 
-Once m1 is complete, publish the prepared Rust crates, JavaScript packages,
+Once m2 is complete, publish the prepared Rust crates, JavaScript packages,
 and language bindings from release, verify installed artifacts, and complete
 publication-dependent cleanup and downstream adoption.
 
 ## Plan
 
 Decided 2026-10-13: readiness, publication, adoption, and rollout are distinct
-stages. This epic is not a prerequisite of m1. Follow CONTRIBUTING.md: merge
+stages. This epic is not a prerequisite of m2. Follow CONTRIBUTING.md: merge
 release into main before the breaking cut, preserving published versions and
 release-only fixes, then merge main into release without squashing. Version
 bumps and tags happen at this cut, not in the milestone-planning PR.
@@ -27,22 +27,22 @@ production stability proven merely because upstream artifacts published.
 
 ## Required
 
-- [Migration audit](/quest/m2/release/migrate-audit.md) - the cut writes a MIGRATE.md entry for every break, stating the net published-to-final change
-- [API shape review](/quest/m2/release/api-review.md) - every new or changed public API reviewed for a better shape before the cut
-- [Feature review](/quest/m2/release/feature-review.md) - every major work line since the last release judged end to end before the cut
-- [Cargo feature review](/quest/m2/release/feature-flags.md) - defaults stay lean and every remaining feature is scoped to the crate that owns it, before the cut
-- [Claim new npm names](/quest/m2/release/npm-first-publish.md) - a maintainer claims `@moq/clock`, `libav`, and `video` on npm and JSR with trusted publishing, before the cut publishes them
-- [Cut and publish](/quest/m2/release/cut.md) - independently executable after m1; release-triggered publication
-- [Published assets](/quest/m2/release/assets-release.md) - npm carries hostable worklets
-- [C++ publication](/quest/m2/release/cpp-release.md) - archives and matching OBS plugin publish and install
-- [Generated C publication](/quest/m2/release/c-publish.md) - released archives run the C samples and interop client
-- [Dart publication](/quest/m2/release/dart-publish.md) - the wrapper and native artifacts install from the registry
-- [Final libmoq stub](/quest/m2/release/libmoq-final-release.md) - publish the migration notice before removing its source
-- [Retire libmoq](/quest/m2/release/libmoq-retire.md) - cleanup only after that publication
-- [Retire the moq-e2ee stub](/quest/m2/release/e2ee-retire.md) - delete `rs/moq-e2ee` once the cut publishes it as the final release
-- [Retire hand-written C](/quest/m2/release/c-retire.md) - delete the hand-written crate once generated C publishes
-- [Retire the web-transport JS qmux](/quest/m2/release/qmux-js-retire.md) - once `@moq/qmux` publishes from `js/qmux`, deprecate `@moq/web-socket-stream` and stop the second publisher
-- [moq.sh deployment](/quest/m2/release/moq-sh-deploy.md) - verify its release-triggered publication
-- [Runner client bump](/quest/m2/release/runner-client-bump.md) - the upstream interop runner's Rust client moves to the published moq-tokio, so it stops stamping every object
-- [Smoke clients use request and follow](/quest/m2/release/smoke-bindings-rename.md) - condition: a binding release ships the renames; then the native smoke clients move to them
-- [Relay loader adoption](/quest/m2/release/relay-loader-adoption.md) - once their pins carry it, embedding consumers load relay config through `Config::merge` and refuse obsolete spellings
+- [Migration audit](/quest/m3/release/migrate-audit.md) - the cut writes a MIGRATE.md entry for every break, stating the net published-to-final change
+- [API shape review](/quest/m3/release/api-review.md) - every new or changed public API reviewed for a better shape before the cut
+- [Feature review](/quest/m3/release/feature-review.md) - every major work line since the last release judged end to end before the cut
+- [Cargo feature review](/quest/m3/release/feature-flags.md) - defaults stay lean and every remaining feature is scoped to the crate that owns it, before the cut
+- [Claim new npm names](/quest/m3/release/npm-first-publish.md) - a maintainer claims `@moq/clock`, `libav`, and `video` on npm and JSR with trusted publishing, before the cut publishes them
+- [Cut and publish](/quest/m3/release/cut.md) - independently executable after m2; release-triggered publication
+- [Published assets](/quest/m3/release/assets-release.md) - npm carries hostable worklets
+- [C++ publication](/quest/m3/release/cpp-release.md) - archives and matching OBS plugin publish and install
+- [Generated C publication](/quest/m3/release/c-publish.md) - released archives run the C samples and interop client
+- [Dart publication](/quest/m3/release/dart-publish.md) - the wrapper and native artifacts install from the registry
+- [Final libmoq stub](/quest/m3/release/libmoq-final-release.md) - publish the migration notice before removing its source
+- [Retire libmoq](/quest/m3/release/libmoq-retire.md) - cleanup only after that publication
+- [Retire the moq-e2ee stub](/quest/m3/release/e2ee-retire.md) - delete `rs/moq-e2ee` once the cut publishes it as the final release
+- [Retire hand-written C](/quest/m3/release/c-retire.md) - delete the hand-written crate once generated C publishes
+- [Retire the web-transport JS qmux](/quest/m3/release/qmux-js-retire.md) - once `@moq/qmux` publishes from `js/qmux`, deprecate `@moq/web-socket-stream` and stop the second publisher
+- [moq.sh deployment](/quest/m3/release/moq-sh-deploy.md) - verify its release-triggered publication
+- [Runner client bump](/quest/m3/release/runner-client-bump.md) - the upstream interop runner's Rust client moves to the published moq-tokio, so it stops stamping every object
+- [Smoke clients use request and follow](/quest/m3/release/smoke-bindings-rename.md) - condition: a binding release ships the renames; then the native smoke clients move to them
+- [Relay loader adoption](/quest/m3/release/relay-loader-adoption.md) - once their pins carry it, embedding consumers load relay config through `Config::merge` and refuse obsolete spellings
diff --git a/quest/m2/release/api-review.md b/quest/m3/release/api-review.md
similarity index 84%
rename from quest/m2/release/api-review.md
rename to quest/m3/release/api-review.md
index 157bb6b4338..6ab00ec24d2 100644
--- a/quest/m2/release/api-review.md
+++ b/quest/m3/release/api-review.md
@@ -9,13 +9,13 @@ the maintainer approves is a quest that lands before the cut.
 ## Plan
 
 Recurs once per major release (decided 2026-10-19). The [release
-cut](/quest/m2/release/cut.md) re-creates this quest for the next release when
+cut](/quest/m3/release/cut.md) re-creates this quest for the next release when
 it shifts the milestones, so the PR finishing this run adds no successor.
 Record what this run learned (inventory method, findings, what to check first)
 in the cut's PR notes or a follow-up quest, so the next run starts from it.
 Only `/quest-delete` ends the recurrence.
 
-Starts once m1 lands, so the APIs it reviews are the ones that ship; the cut
+Starts once m2 lands, so the APIs it reviews are the ones that ship; the cut
 waits for it. API shape is the maintainer's call (decided 2026-10-19), so this
 run changes no code. Inventory the diff against the last published version
 by running `just api-diff`
@@ -24,10 +24,10 @@ hand diff the surfaces it cannot see. For each export that is awkward, judge it
 against AGENTS.md's Public API rules: names mirrored across languages, no
 callbacks or 4+ args, misuse unrepresentable, private until a consumer needs
 it. Propose 2-3 shapes with a recommendation, ask the maintainer, and file
-each approved change as a quest in m1, which holds the cut until it lands.
+each approved change as a quest in m2, which holds the cut until it lands.
 Model items only the built-in sessions use stay private
 ([moq-dev/moq#6747](https://github.com/moq-dev/moq/pull/6747)); this review judges the shape of what ships.
 
 ## Required
 
-- [Breaking release readiness](/quest/m1/README.md) - the release's code is final before it is reviewed
+- [Breaking release readiness](/quest/m2/README.md) - the release's code is final before it is reviewed
diff --git a/quest/m2/release/assets-release.md b/quest/m3/release/assets-release.md
similarity index 100%
rename from quest/m2/release/assets-release.md
rename to quest/m3/release/assets-release.md
diff --git a/quest/m2/release/c-publish.md b/quest/m3/release/c-publish.md
similarity index 72%
rename from quest/m2/release/c-publish.md
rename to quest/m3/release/c-publish.md
index 20347715707..40557e496ac 100644
--- a/quest/m2/release/c-publish.md
+++ b/quest/m3/release/c-publish.md
@@ -12,20 +12,20 @@ archive instead of the hand-written one.
 The generated C line proves the same cases with the built archive before
 publication. This quest proves registry/release delivery after publication
 and records the artifact versions and results. The hand-written `moq-c` 0.7
-ships at the m1 cut (decided 2026-10-25), so the generated 0.8 supersedes a
+ships at the next cut (decided 2026-10-25), so the generated 0.8 supersedes a
 published package; its source stays until
-[c-retire](/quest/m2/release/c-retire.md).
+[c-retire](/quest/m3/release/c-retire.md).
 
 The smoke client moves here rather than with
-[C consumers](/quest/m2/c/consumers.md) because it checks a published archive,
+[C consumers](/quest/m3/c/consumers.md) because it checks a published archive,
 and the generated one publishes only after that quest (decided 2026-10-31).
 The move also takes the client off `moq_origin_announced_broadcast` onto the
 generated `request`/`follow`, so
-[Smoke clients use request and follow](/quest/m2/release/smoke-bindings-rename.md)
+[Smoke clients use request and follow](/quest/m3/release/smoke-bindings-rename.md)
 leaves the C client to this quest.
 
 ## Required
 
-- [Breaking release cut](/quest/m2/release/cut.md) - prepared code reaches release before artifact publication and installed proof
+- [Breaking release cut](/quest/m3/release/cut.md) - prepared code reaches release before artifact publication and installed proof
 
-- [Generated C bindings](/quest/m2/c/README.md) - package and consumers pass before publication
+- [Generated C bindings](/quest/m3/c/README.md) - package and consumers pass before publication
diff --git a/quest/m2/release/c-retire.md b/quest/m3/release/c-retire.md
similarity index 88%
rename from quest/m2/release/c-retire.md
rename to quest/m3/release/c-retire.md
index d81dbf830bb..2315eecb94a 100644
--- a/quest/m2/release/c-retire.md
+++ b/quest/m3/release/c-retire.md
@@ -28,14 +28,14 @@ served it are deleted once the generated `moq-c` publishes. The generated
   (decided 2026-10-28, from [moq-dev/moq#7132](https://github.com/moq-dev/moq/pull/7132)),
   rather than deleting every `nightly-size-history` artifact.
 - The code-free `rs/libmoq` stub left under the old name is
-  [Retire the libmoq stub](/quest/m2/release/libmoq-retire.md)'s, separately.
+  [Retire the libmoq stub](/quest/m3/release/libmoq-retire.md)'s, separately.
 
 ## Required
 
-- [Generated C publication](/quest/m2/release/c-publish.md) - the replacement is available and verified, and the smoke client checks it
+- [Generated C publication](/quest/m3/release/c-publish.md) - the replacement is available and verified, and the smoke client checks it
 
-- [C consumers](/quest/m2/c/consumers.md) - the interop client and `doc/lib/c` samples no longer call the hand-written ABI
+- [C consumers](/quest/m3/c/consumers.md) - the interop client and `doc/lib/c` samples no longer call the hand-written ABI
 
 ## Related
 
-- [Retire the libmoq stub](/quest/m2/release/libmoq-retire.md) - deletes the `rs/libmoq` stub under the old name
+- [Retire the libmoq stub](/quest/m3/release/libmoq-retire.md) - deletes the `rs/libmoq` stub under the old name
diff --git a/quest/m2/release/cpp-release.md b/quest/m3/release/cpp-release.md
similarity index 96%
rename from quest/m2/release/cpp-release.md
rename to quest/m3/release/cpp-release.md
index 23fe95f1a4a..a35fb3b390d 100644
--- a/quest/m2/release/cpp-release.md
+++ b/quest/m3/release/cpp-release.md
@@ -34,4 +34,4 @@ published downloads.
 
 ## Required
 
-- [Breaking release cut](/quest/m2/release/cut.md) - prepared code reaches release before artifact publication and installed proof
+- [Breaking release cut](/quest/m3/release/cut.md) - prepared code reaches release before artifact publication and installed proof
diff --git a/quest/m2/release/cut.md b/quest/m3/release/cut.md
similarity index 73%
rename from quest/m2/release/cut.md
rename to quest/m3/release/cut.md
index 8da4e5a0fa4..b3784f15211 100644
--- a/quest/m2/release/cut.md
+++ b/quest/m3/release/cut.md
@@ -39,18 +39,23 @@ cached groups on drafts 14 to 22. ✅ No backport (maintainer, 2026-11-04;
 [moq-dev/moq#7815](https://github.com/moq-dev/moq/pull/7815)), so check
 both fixes reach release.
 
-Recurs once per major release (decided 2026-10-19). The PR that finishes the
-cut shifts the milestones up, as the root [questline](/quest/README.md)
-describes. This epic's remaining publication and adoption quests move to m0,
-the rest of m2 moves to m1, and every link to a moved path is rewritten. That
-PR also removes this path from every `Required`, which releases the audits
-waiting on it. It then re-creates this quest, the [API shape
-review](/quest/m2/release/api-review.md), the [feature
-review](/quest/m2/release/feature-review.md), and the [Cargo feature
-review](/quest/m2/release/feature-flags.md) at the same paths under a fresh
-release epic in m2. Each keeps its Goal and recurrence paragraph and requires
-the new `/quest/m1/README.md`, and the cut also requires all three reviews. Only
-`/quest-delete` ends the recurrence.
+Recurs once per major release (decided 2026-10-19; shift rule replaced
+2026-11-05). The PR that finishes the cut shifts the milestones, as the root
+[questline](/quest/README.md) describes: this epic's remaining publication
+and adoption quests move to m0, m3's other quests split by kind into m1
+(additive) and m2 (breaking), m4's move to m3, m5 stays, and every link to a
+moved path is rewritten. A recurring cut-gate child that its last run
+re-created in m3, such as the [vendor
+sync](/quest/m2/cut-gate/vendor-sync/README.md), moves under the re-created
+gate instead. That PR also removes this path from every `Required`, which
+releases the audits waiting on it. It then re-creates the [cut
+gate](/quest/m2/cut-gate/README.md) in m2 as that gate's Plan describes, and
+this quest, the [API shape review](/quest/m3/release/api-review.md), the
+[feature review](/quest/m3/release/feature-review.md), and the [Cargo feature
+review](/quest/m3/release/feature-flags.md) at the same paths under a fresh
+release epic in m3. Each keeps its Goal and recurrence paragraph and requires
+the new `/quest/m2/README.md`, and the cut also requires all three reviews.
+Only `/quest-delete` ends the recurrence.
 
 From the 2026-10-25 pre-cut run:
 
@@ -83,9 +88,9 @@ repeat these checks after the documented release-to-main merge.
 
 ## Required
 
-- [Breaking release readiness](/quest/m1/README.md) - code, protocol and package proofs
-- [Migration audit](/quest/m2/release/migrate-audit.md) - every break on the cut PR has its MIGRATE.md entry
-- [API shape review](/quest/m2/release/api-review.md) - every new or changed public API was reviewed for a better shape, and approved changes landed
-- [Feature review](/quest/m2/release/feature-review.md) - every major work line since the last release was judged end to end, and its follow-ups landed
-- [Cargo feature review](/quest/m2/release/feature-flags.md) - every Cargo feature was judged against the feature rules, and approved changes landed
-- [Claim new npm names](/quest/m2/release/npm-first-publish.md) - trusted publishing can publish every new `@moq/*` package
+- [Breaking release readiness](/quest/m2/README.md) - code, protocol and package proofs
+- [Migration audit](/quest/m3/release/migrate-audit.md) - every break on the cut PR has its MIGRATE.md entry
+- [API shape review](/quest/m3/release/api-review.md) - every new or changed public API was reviewed for a better shape, and approved changes landed
+- [Feature review](/quest/m3/release/feature-review.md) - every major work line since the last release was judged end to end, and its follow-ups landed
+- [Cargo feature review](/quest/m3/release/feature-flags.md) - every Cargo feature was judged against the feature rules, and approved changes landed
+- [Claim new npm names](/quest/m3/release/npm-first-publish.md) - trusted publishing can publish every new `@moq/*` package
diff --git a/quest/m2/release/dart-publish.md b/quest/m3/release/dart-publish.md
similarity index 91%
rename from quest/m2/release/dart-publish.md
rename to quest/m3/release/dart-publish.md
index 23fb5f21536..ee3654ee79a 100644
--- a/quest/m2/release/dart-publish.md
+++ b/quest/m3/release/dart-publish.md
@@ -28,9 +28,9 @@ Public API: none. Wire: none.
 
 ## Required
 
-- [Breaking release cut](/quest/m2/release/cut.md) - prepared code reaches release before artifact publication and installed proof
+- [Breaking release cut](/quest/m3/release/cut.md) - prepared code reaches release before artifact publication and installed proof
 
 
 ## Related
 
-- [Dart on iOS](/quest/m2/dart-ios.md) - pub.dev already tags `moq_ffi` for iOS, which nobody has run
+- [Dart on iOS](/quest/m3/dart-ios.md) - pub.dev already tags `moq_ffi` for iOS, which nobody has run
diff --git a/quest/m2/release/e2ee-retire.md b/quest/m3/release/e2ee-retire.md
similarity index 84%
rename from quest/m2/release/e2ee-retire.md
rename to quest/m3/release/e2ee-retire.md
index 4e97bd34e83..d44a09b95db 100644
--- a/quest/m2/release/e2ee-retire.md
+++ b/quest/m3/release/e2ee-retire.md
@@ -10,10 +10,10 @@ crates.io for anyone still resolving the old name.
 
 Decided 2026-11-03 (maintainer, /quest-plan of the follow-ups from
 [moq-dev/moq#7702](https://github.com/moq-dev/moq/pull/7702)): milestone m2,
-mirroring [Retire libmoq](/quest/m2/release/libmoq-retire.md).
+mirroring [Retire libmoq](/quest/m3/release/libmoq-retire.md).
 
 - #7702 leaves `rs/moq-e2ee` as a code-free stub, and
-  [the cut](/quest/m2/release/cut.md) publishes it at a version above
+  [the cut](/quest/m3/release/cut.md) publishes it at a version above
   crates.io's 0.0.20. Check with `curl -s
   https://crates.io/api/v1/crates/moq-e2ee | jq -r .crate.max_version` that
   the stub's version is the newest.
@@ -26,4 +26,4 @@ mirroring [Retire libmoq](/quest/m2/release/libmoq-retire.md).
 
 ## Required
 
-- [Cut and publish](/quest/m2/release/cut.md) - publishes the stub as moq-e2ee's final release
+- [Cut and publish](/quest/m3/release/cut.md) - publishes the stub as moq-e2ee's final release
diff --git a/quest/m2/release/feature-flags.md b/quest/m3/release/feature-flags.md
similarity index 84%
rename from quest/m2/release/feature-flags.md
rename to quest/m3/release/feature-flags.md
index a3bfd007266..6f18f7c8c28 100644
--- a/quest/m2/release/feature-flags.md
+++ b/quest/m3/release/feature-flags.md
@@ -14,18 +14,18 @@ quest that lands before the cut.
 ## Plan
 
 Recurs once per major release (decided 2026-10-26). The [release
-cut](/quest/m2/release/cut.md) re-creates this quest for the next release when
+cut](/quest/m3/release/cut.md) re-creates this quest for the next release when
 it shifts the milestones, so the PR finishing this run adds no successor.
 Record what this run learned (inventory method, findings, what to check
 first) in the cut's PR notes or a follow-up quest, so the next run starts from
 it. Only `/quest-delete` ends the recurrence.
 
-Starts once m1 lands, so the features it reviews are the ones that ship; the
+Starts once m2 lands, so the features it reviews are the ones that ship; the
 cut waits for it. Feature changes break downstream builds, which is why this
 runs before the cut rather than with the post-release audits. Like the [API
-shape review](/quest/m2/release/api-review.md), this run changes no code
+shape review](/quest/m3/release/api-review.md), this run changes no code
 (decided 2026-10-26): it proposes each change with a recommendation, asks the
-maintainer, and files each approved change as a quest in m1, which holds the
+maintainer, and files each approved change as a quest in m2, which holds the
 cut until it lands.
 
 Judge every feature against the `# Features` rules in `rs/AGENTS.md`, and
@@ -50,15 +50,15 @@ What to check first (seeded 2026-10-26):
   `azure` directly; moq-archive, which owns storage, has no features. Also
   check moq-cli's other defaults (`cluster-lan`, `quic`, `websocket`, `nvidia`)
   against the rules. Distributions building with `release` is
-  [Ship capture and playback](/quest/m2/cli-packaging.md)'s work, not this
+  [Ship capture and playback](/quest/m3/cli-packaging.md)'s work, not this
   review's.
 - The crates with the most features at seeding: moq-cli (21), moq-tokio (17),
   moq-relay (14), moq-native (13), and moq-video (11).
 
-Related: the [compile time audit](/quest/m2/audit-compile-time.md) owns
-per-crate build cost, and the [dependency audit](/quest/m2/audit-deps.md) owns
+Related: the [compile time audit](/quest/m3/audit-compile-time.md) owns
+per-crate build cost, and the [dependency audit](/quest/m3/audit-deps.md) owns
 which dependencies exist.
 
 ## Required
 
-- [Breaking release readiness](/quest/m1/README.md) - the release's features are final before they are reviewed
+- [Breaking release readiness](/quest/m2/README.md) - the release's features are final before they are reviewed
diff --git a/quest/m2/release/feature-review.md b/quest/m3/release/feature-review.md
similarity index 85%
rename from quest/m2/release/feature-review.md
rename to quest/m3/release/feature-review.md
index 462a86b3f1a..6253a06ad57 100644
--- a/quest/m2/release/feature-review.md
+++ b/quest/m3/release/feature-review.md
@@ -11,20 +11,20 @@ the cut, or a recorded decision to ship it as is.
 ## Plan
 
 Recurs once per major release (decided 2026-10-19). The [release
-cut](/quest/m2/release/cut.md) re-creates this quest for the next release when
+cut](/quest/m3/release/cut.md) re-creates this quest for the next release when
 it shifts the milestones, so the PR finishing this run adds no successor.
 Record what this run learned (inventory method, findings, what to check first)
 in the cut's PR notes or a follow-up quest, so the next run starts from it.
 Only `/quest-delete` ends the recurrence.
 
-Starts once m1 lands; the cut waits for it. Inventory the work lines from the
+Starts once m2 lands; the cut waits for it. Inventory the work lines from the
 epics and quests deleted since the last release and from `git log` by area.
 Judge each one adversarially (AGENTS.md) and challenge its premise, not only
 its execution: is the feature worth supporting at all, and would a simpler
 mechanism the stack already has deliver most of it? Then look for simpler
 designs, code that can be deleted, tests that cost more than they catch, and
 claims without evidence.
-File follow-ups through `/quest-plan` into m1, or ask the maintainer to
+File follow-ups through `/quest-plan` into m1 or m2, or ask the maintainer to
 ship as is.
 
 The first run must cover the MPEG-TS work (decided 2026-10-19 instead of a
@@ -35,4 +35,4 @@ epochs dropped active-active publishers.
 
 ## Required
 
-- [Breaking release readiness](/quest/m1/README.md) - the release's code is final before it is reviewed
+- [Breaking release readiness](/quest/m2/README.md) - the release's code is final before it is reviewed
diff --git a/quest/m2/release/libmoq-final-release.md b/quest/m3/release/libmoq-final-release.md
similarity index 100%
rename from quest/m2/release/libmoq-final-release.md
rename to quest/m3/release/libmoq-final-release.md
diff --git a/quest/m2/release/libmoq-retire.md b/quest/m3/release/libmoq-retire.md
similarity index 89%
rename from quest/m2/release/libmoq-retire.md
rename to quest/m3/release/libmoq-retire.md
index 3bd2dbb29aa..5b35874910b 100644
--- a/quest/m2/release/libmoq-retire.md
+++ b/quest/m3/release/libmoq-retire.md
@@ -15,4 +15,4 @@ for anyone still resolving the old name.
 
 ## Required
 
-- [The final libmoq release is the stub](/quest/m2/release/libmoq-final-release.md) - the published crate points at `moq-c` before the source goes
+- [The final libmoq release is the stub](/quest/m3/release/libmoq-final-release.md) - the published crate points at `moq-c` before the source goes
diff --git a/quest/m2/release/migrate-audit.md b/quest/m3/release/migrate-audit.md
similarity index 97%
rename from quest/m2/release/migrate-audit.md
rename to quest/m3/release/migrate-audit.md
index 2ecbf1f5c45..65eebaf2d2d 100644
--- a/quest/m2/release/migrate-audit.md
+++ b/quest/m3/release/migrate-audit.md
@@ -56,7 +56,7 @@ m1 quest on 2026-10-22.
   otherwise the migration note says how to share the type instead.
 - Compile-check the code in every `MIGRATE.md` section the cut ships against
   the candidate. Nothing else builds it.
-- Required by the cut, after m1's breaking work has landed.
+- Required by the cut, after m2's breaking work has landed.
 - Start from the candidates [moq-dev/moq#6477](https://github.com/moq-dev/moq/pull/6477)
   listed as breaks matching no name in `MIGRATE.md` (about 15 Rust crates,
   `@moq/hang`, `@moq/net`, `@moq/watch`, and moq-ffi): confirm each, and add
@@ -71,4 +71,4 @@ m1 quest on 2026-10-22.
 
 ## Required
 
-- [Breaking release readiness](/quest/m1/README.md) - all breaking work and the MIGRATE.md convention have landed
+- [Breaking release readiness](/quest/m2/README.md) - all breaking work and the MIGRATE.md convention have landed
diff --git a/quest/m2/release/moq-sh-deploy.md b/quest/m3/release/moq-sh-deploy.md
similarity index 94%
rename from quest/m2/release/moq-sh-deploy.md
rename to quest/m3/release/moq-sh-deploy.md
index 064f7ac91c0..f72830d799f 100644
--- a/quest/m2/release/moq-sh-deploy.md
+++ b/quest/m3/release/moq-sh-deploy.md
@@ -25,4 +25,4 @@ Zone > Workers Routes > Edit on `moq.sh` to the token, then rerun it.
 
 ## Required
 
-- [Breaking release cut](/quest/m2/release/cut.md) - prepared code reaches release before artifact publication and installed proof
+- [Breaking release cut](/quest/m3/release/cut.md) - prepared code reaches release before artifact publication and installed proof
diff --git a/quest/m2/release/npm-first-publish.md b/quest/m3/release/npm-first-publish.md
similarity index 94%
rename from quest/m2/release/npm-first-publish.md
rename to quest/m3/release/npm-first-publish.md
index 20f0c252dbc..701d87d44c2 100644
--- a/quest/m2/release/npm-first-publish.md
+++ b/quest/m3/release/npm-first-publish.md
@@ -40,11 +40,11 @@ published to npm yet` install failure on every run (noted 2026-11-03 from
 it clears with the same publication.
 
 `@moq/p2p` is out of scope: it is private with no release script, so the cut
-does not publish it. [Watch opts in](/quest/m2/p2p/watch.md) owns its first
+does not publish it. [Watch opts in](/quest/m4/p2p/watch.md) owns its first
 publication, including claiming its names.
 
 Public API: none. Wire: none.
 
 ## Related
 
-- [Dart publication](/quest/m2/release/dart-publish.md) - the same trusted-publishing check for pub.dev
+- [Dart publication](/quest/m3/release/dart-publish.md) - the same trusted-publishing check for pub.dev
diff --git a/quest/m2/release/qmux-js-retire.md b/quest/m3/release/qmux-js-retire.md
similarity index 100%
rename from quest/m2/release/qmux-js-retire.md
rename to quest/m3/release/qmux-js-retire.md
diff --git a/quest/m2/release/relay-loader-adoption.md b/quest/m3/release/relay-loader-adoption.md
similarity index 100%
rename from quest/m2/release/relay-loader-adoption.md
rename to quest/m3/release/relay-loader-adoption.md
diff --git a/quest/m2/release/runner-client-bump.md b/quest/m3/release/runner-client-bump.md
similarity index 96%
rename from quest/m2/release/runner-client-bump.md
rename to quest/m3/release/runner-client-bump.md
index 8924989598e..16faea6b5d0 100644
--- a/quest/m2/release/runner-client-bump.md
+++ b/quest/m3/release/runner-client-bump.md
@@ -28,7 +28,7 @@ max age, announcement events are `Start`, `Update`, `Restart`, and `End`,
 and `track::Producer::used` is gone. Through moq-relay, the first
 subscription under `data-subgroup-basic`'s dynamic claim then fails
 `unroutable`: the accepted cold-start reset that
-[announce takeover](/quest/m1/announce-takeover.md) removes, so check
+[announce takeover](/quest/m2/announce-takeover.md) removes, so check
 whether that has landed before calling it a client bug. The JS client's
 announcement check also moves from `"retracted"` to `"end"` when it takes
 the cut. Its `data-subgroup-basic` subscriber also stalls there: on `main`,
diff --git a/quest/m2/release/smoke-bindings-rename.md b/quest/m3/release/smoke-bindings-rename.md
similarity index 96%
rename from quest/m2/release/smoke-bindings-rename.md
rename to quest/m3/release/smoke-bindings-rename.md
index ded82927bb2..72349666cd0 100644
--- a/quest/m2/release/smoke-bindings-rename.md
+++ b/quest/m3/release/smoke-bindings-rename.md
@@ -33,7 +33,7 @@ the same release. Today's call sites: `test/smoke/clients/swift/Sources/smoke/ma
 
 The C smoke client is out of scope: it uses the hand-written `moq-c`, which
 keeps `moq_origin_announced_broadcast`, and
-[Published generated C](/quest/m2/release/c-publish.md) moves it onto the
+[Published generated C](/quest/m3/release/c-publish.md) moves it onto the
 generated API, which already names them `request` and `follow`.
 
 Public API: none. Wire: none.
diff --git a/quest/m2/render-d3d11.md b/quest/m3/render-d3d11.md
similarity index 95%
rename from quest/m2/render-d3d11.md
rename to quest/m3/render-d3d11.md
index 34bb81723f5..0f0ac3ed09d 100644
--- a/quest/m2/render-d3d11.md
+++ b/quest/m3/render-d3d11.md
@@ -31,5 +31,5 @@ common case.
 
 ## Related
 
-- [Video hardware validation](/quest/m3/video-hardware.md) - needs the same
+- [Video hardware validation](/quest/m5/video-hardware.md) - needs the same
   Windows machine
diff --git a/quest/m2/rtc-pacing.md b/quest/m3/rtc-pacing.md
similarity index 96%
rename from quest/m2/rtc-pacing.md
rename to quest/m3/rtc-pacing.md
index 201aac9ae93..7fe0a8574c2 100644
--- a/quest/m2/rtc-pacing.md
+++ b/quest/m3/rtc-pacing.md
@@ -32,7 +32,7 @@ WHEP enforcement needs it and nobody owned it.
   credit the viewer's next group would have used. str0m fulfils NACKs from
   its video send buffer (`rs/moq-rtc/src/session.rs`), so charging needs a
   hook on that path. Decided 2026-10-30 (maintainer): add it to the vendored str0m
-  ([WebRTC epic](/quest/m2/webrtc/README.md)) rather than upstream.
+  ([WebRTC epic](/quest/m3/webrtc/README.md)) rather than upstream.
 - Decided 2026-10-30 (maintainer): the pacer is moq-congestion's, made public and
   extended with payload credit here, so moq-quic and moq-webrtc share one
   pacer; the vendored str0m's leaky pacer is deleted.
@@ -67,4 +67,4 @@ its argument list rather than adding a fifth argument. Wire: none.
 
 ## Related
 
-- [SRT rate handle](/quest/m2/srt-rate-handle.md) - the same pacing and retransmit charging on SRT
+- [SRT rate handle](/quest/m3/srt-rate-handle.md) - the same pacing and retransmit charging on SRT
diff --git a/quest/m2/rust2-exporter.md b/quest/m3/rust2-exporter.md
similarity index 92%
rename from quest/m2/rust2-exporter.md
rename to quest/m3/rust2-exporter.md
index fe250c569b9..4bed640444f 100644
--- a/quest/m2/rust2-exporter.md
+++ b/quest/m3/rust2-exporter.md
@@ -3,7 +3,7 @@
 ## Goal
 
 rust2's exporter generates every language moq ships from moq's crates, so
-[the switch](/quest/m2/ffi-exporter.md) can start. Delete this quest once the
+[the switch](/quest/m3/ffi-exporter.md) can start. Delete this quest once the
 condition holds, so the switch resurfaces.
 
 ## Waiting
diff --git a/quest/m2/session-outcome-records.md b/quest/m3/session-outcome-records.md
similarity index 100%
rename from quest/m2/session-outcome-records.md
rename to quest/m3/session-outcome-records.md
diff --git a/quest/m2/spawn-audit.md b/quest/m3/spawn-audit.md
similarity index 100%
rename from quest/m2/spawn-audit.md
rename to quest/m3/spawn-audit.md
diff --git a/quest/m2/srt-rate-handle.md b/quest/m3/srt-rate-handle.md
similarity index 90%
rename from quest/m2/srt-rate-handle.md
rename to quest/m3/srt-rate-handle.md
index 359b966fed6..205c2351b58 100644
--- a/quest/m2/srt-rate-handle.md
+++ b/quest/m3/srt-rate-handle.md
@@ -23,7 +23,7 @@ Decided 2026-10-20 (maintainer): planned upstream now, because moq.pro's SRT
 enforcement needs it and nobody owned it.
 
 - Target the shared-socket integration that drives `srt-protocol` directly
-  ([SRT on the shared socket](/quest/m2/one-port/srt-demux.md)). One port
+  ([SRT on the shared socket](/quest/m3/one-port/srt-demux.md)). One port
   retires `srt-tokio` socket handling, so do not fork that backend to add
   this.
 - Pull: pace the TS packets each frame muxes into, charging their media
@@ -31,7 +31,7 @@ enforcement needs it and nobody owned it.
   is released gradually instead of waiting forever or exceeding cap plus
   burst. Decide drops only before a group starts: past cap plus burst, skip
   to the next group; dropping 188-byte TS packets would leave partial
-  frames. As in [moq-rtc pacing](/quest/m2/rtc-pacing.md), a group (or
+  frames. As in [moq-rtc pacing](/quest/m3/rtc-pacing.md), a group (or
   frame) larger than the burst is paced through to its end.
   Retransmissions draw from the same bucket, and one with no credit left is
   skipped, which needs the hook `srt-protocol`'s sender exposes when driven
@@ -56,9 +56,9 @@ Wire: none.
 
 ## Required
 
-- [SRT on the shared socket](/quest/m2/one-port/srt-demux.md) - the direct `srt-protocol` integration this hooks into
+- [SRT on the shared socket](/quest/m3/one-port/srt-demux.md) - the direct `srt-protocol` integration this hooks into
 
 ## Related
 
-- [moq-rtc pacing](/quest/m2/rtc-pacing.md) - the same pacing and retransmit charging on WHEP
-- [moq-srt wire source](/quest/m2/wire-stats/srt.md) - per-connection byte counts from the same socket
+- [moq-rtc pacing](/quest/m3/rtc-pacing.md) - the same pacing and retransmit charging on WHEP
+- [moq-srt wire source](/quest/m3/wire-stats/srt.md) - per-connection byte counts from the same socket
diff --git a/quest/m2/stats/README.md b/quest/m3/stats/README.md
similarity index 92%
rename from quest/m2/stats/README.md
rename to quest/m3/stats/README.md
index afa9fd4240c..a7b70679777 100644
--- a/quest/m2/stats/README.md
+++ b/quest/m3/stats/README.md
@@ -99,7 +99,7 @@ kind.
   Gauges are carried but never summed.
 - **On main.** Every change is additive: optional sections on
   `#[non_exhaustive]` catalog types, and new types. The line left the
-  [QoS](/quest/m2/qos/README.md) line, which keeps the relay's moq-stats
+  [QoS](/quest/m3/qos/README.md) line, which keeps the relay's moq-stats
   changes.
 - **No `@moq/stats` package.** Media types live in `@moq/hang`, and the
   demo dashboard's relay-stats reader stays where it is.
@@ -108,30 +108,30 @@ kind.
   `drafts/draft-lcurley-moq-hang.md` specs the wire.
 
 Decided in the 2026-09-30 audit: a Rust encoder adapting its bitrate to viewer
-feedback moved to [encoder feedback](/quest/m3/stats-encoder-feedback.md) (m3),
+feedback moved to [encoder feedback](/quest/m5/stats-encoder-feedback.md) (m5),
 along with its open questions. This line publishes, reads, and classifies the
 reports; no encoder acts on them here.
 
 Decided 2026-10-05 (moq.pro audit): the client health model and preflight
 media checks moq.pro planned against the pre-#4510 `.stats` broadcast are
 generic, so they join this line as [client health](/doc/concept/stats.md#health)
-and [preflight](/quest/m2/stats/preflight.md). moq.pro keeps the per-project
+and [preflight](/quest/m3/stats/preflight.md). moq.pro keeps the per-project
 connection view and the dashboard flow.
 
 ## Required
 
-- [Rust reporters](/quest/m2/stats/rust.md) - the player and gateways
+- [Rust reporters](/quest/m3/stats/rust.md) - the player and gateways
   publish stats and feedback, as the CLI remuxes and capture do
-- [Preflight](/quest/m2/stats/preflight.md) - a bounded test run over a
+- [Preflight](/quest/m3/stats/preflight.md) - a bounded test run over a
   broadcast reports which media layer is broken and why
-- [Client health in use](/quest/m2/stats/health-consumers.md) - a per-connection media counter, consumers of the grade, and re-measured limits
-- [The media test checks browser feedback](/quest/m2/stats/feedback-media-test.md) - a browser publishes feedback and Rust reads it back with `moq export echo`
+- [Client health in use](/quest/m3/stats/health-consumers.md) - a per-connection media counter, consumers of the grade, and re-measured limits
+- [The media test checks browser feedback](/quest/m3/stats/feedback-media-test.md) - a browser publishes feedback and Rust reads it back with `moq export echo`
 
 ## Related
 
-- [QoS](/quest/m2/qos/README.md) - the relay's delivery counters; the
+- [QoS](/quest/m3/qos/README.md) - the relay's delivery counters; the
   combined per-broadcast verdict reading both lives downstream
-- [Encoder feedback](/quest/m3/stats-encoder-feedback.md) - a Rust encoder
+- [Encoder feedback](/quest/m5/stats-encoder-feedback.md) - a Rust encoder
   adapts its bitrate to what its viewers report
-- [Latency ledger](/quest/m2/latency-ledger.md) - adds the viewer's latency
+- [Latency ledger](/quest/m5/latency-ledger.md) - adds the viewer's latency
   stages to the same feedback snapshot
diff --git a/quest/m2/stats/feedback-media-test.md b/quest/m3/stats/feedback-media-test.md
similarity index 100%
rename from quest/m2/stats/feedback-media-test.md
rename to quest/m3/stats/feedback-media-test.md
diff --git a/quest/m2/stats/health-consumers.md b/quest/m3/stats/health-consumers.md
similarity index 92%
rename from quest/m2/stats/health-consumers.md
rename to quest/m3/stats/health-consumers.md
index 7ac2ae86095..06a8b40ba70 100644
--- a/quest/m2/stats/health-consumers.md
+++ b/quest/m3/stats/health-consumers.md
@@ -13,7 +13,7 @@ grade's limits are re-measured against browser reporters.
 - Add a media counter to the per-connection `Transport` stats
   (`rs/hang/src/stats.rs` and the JS mirror). `health.rs` says the grade holds
   only for a connection's sole broadcast until then.
-- Consumers: preflight is planned in [Preflight](/quest/m2/stats/preflight.md);
+- Consumers: preflight is planned in [Preflight](/quest/m3/stats/preflight.md);
   add the demo dashboard and a `moq` CLI sink.
 - Re-measure the thresholds in `rs/hang/src/health.rs` against the numbers
   the browser reporters publish (`<moq-publish stats>` and
diff --git a/quest/m2/stats/preflight.md b/quest/m3/stats/preflight.md
similarity index 90%
rename from quest/m2/stats/preflight.md
rename to quest/m3/stats/preflight.md
index bde9d16cb78..36533dc358c 100644
--- a/quest/m2/stats/preflight.md
+++ b/quest/m3/stats/preflight.md
@@ -38,7 +38,7 @@ Guidance, to be settled while building:
   failure.
 
 Prove, end to end, a clean report for a healthy publisher built on
-[Rust reporters](/quest/m2/stats/rust.md); a publisher outliving the window;
+[Rust reporters](/quest/m3/stats/rust.md); a publisher outliving the window;
 an intra-refresh source (no IDR keyframes) passing the sync point checks; and
 deterministic failures for an invalid catalog, an unsupported codec, a
 missing first sync point, excessive A/V skew, and a media timestamp jump.
@@ -49,9 +49,9 @@ Public API: a preflight check and its report type, and a CLI sink. Wire: none.
 
 ## Required
 
-- [Rust reporters](/quest/m2/stats/rust.md) - a publisher with a stats track for the end-to-end proof
+- [Rust reporters](/quest/m3/stats/rust.md) - a publisher with a stats track for the end-to-end proof
 
 ## Related
 
-- [Publisher timeliness](/quest/m2/qos-publisher-timeliness.md) - the relay's view of the same timestamp lateness and monotonicity
-- [Intra-refresh](/quest/m2/intra-refresh/README.md) - a stream without IDR keyframes, which the sync point checks must not fail
+- [Publisher timeliness](/quest/m3/qos-publisher-timeliness.md) - the relay's view of the same timestamp lateness and monotonicity
+- [Intra-refresh](/quest/m3/intra-refresh/README.md) - a stream without IDR keyframes, which the sync point checks must not fail
diff --git a/quest/m2/stats/rust.md b/quest/m3/stats/rust.md
similarity index 93%
rename from quest/m2/stats/rust.md
rename to quest/m3/stats/rust.md
index b24203cd5dd..d928e61802a 100644
--- a/quest/m2/stats/rust.md
+++ b/quest/m3/stats/rust.md
@@ -52,11 +52,11 @@
   publisher that solicits feedback. It asserts the encoder's frame count and
   that the player's newest arrival advances.
 - Decided 2026-10-08: no E2EE refusal here. The CLI has no encrypted
-  broadcast yet, so [Encrypted native CLI](/quest/m2/e2ee/cli.md) refuses `--report` and
+  broadcast yet, so [Encrypted native CLI](/quest/m5/e2ee/cli.md) refuses `--report` and
   `--echo` when it adds one: they would publish rendition IDs and per-track
   counters in plaintext beside it.
 - Decided 2026-10-22 (maintainer): the publisher's solicit option moved here
-  from [encoder feedback](/quest/m3/stats-encoder-feedback.md), which keeps
+  from [encoder feedback](/quest/m5/stats-encoder-feedback.md), which keeps
   only the adaptation loop and reuses `--echo-path`.
 - `export --echo` counts no drops in `late`: `Received::report`
   (`rs/moq-mux/src/stats.rs`) fills only frames, bytes, and arrival while the
@@ -65,5 +65,5 @@
 
 ## Related
 
-- [Encrypted native CLI](/quest/m2/e2ee/cli.md) - refuses stats and feedback on an encrypted broadcast
-- [Encoder feedback](/quest/m3/stats-encoder-feedback.md) - the adaptation loop that reads what `--echo-path` solicits
+- [Encrypted native CLI](/quest/m5/e2ee/cli.md) - refuses stats and feedback on an encrypted broadcast
+- [Encoder feedback](/quest/m5/stats-encoder-feedback.md) - the adaptation loop that reads what `--echo-path` solicits
diff --git a/quest/m2/stream/README.md b/quest/m3/stream/README.md
similarity index 92%
rename from quest/m2/stream/README.md
rename to quest/m3/stream/README.md
index 8665a92df9b..f10a6ab4b1a 100644
--- a/quest/m2/stream/README.md
+++ b/quest/m3/stream/README.md
@@ -37,7 +37,7 @@ Decided 2026-10-25 with the maintainer (mesh planning interview):
 - Connection setup is generic: a listener accepts connections a dialer
   announces under a path prefix, and the API names peers by path. Endpoint
   identity, signing, and service names belong to the
-  [mesh](/quest/m2/mesh/README.md), which builds on this.
+  [mesh](/quest/m3/mesh/README.md), which builds on this.
 
 Amended 2026-11-01 with the maintainer (socket planning interview),
 2026-11-03 when sockets became endpoints, and 2026-11-04 when the socket's
@@ -58,6 +58,6 @@ the window.
 
 ## Required
 
-- [Rust byte streams](/quest/m2/stream/rust.md) - a duplex `AsyncRead`/`AsyncWrite` stream, a listener and a dialer, and `moq` CLI forwarding
-- [JS byte streams](/quest/m2/stream/js.md) - the same surface in `@moq/net`
-- [Stream benchmark](/quest/m2/stream/bench.md) - throughput and latency against raw TCP through a relay chain, with and without loss
+- [Rust byte streams](/quest/m3/stream/rust.md) - a duplex `AsyncRead`/`AsyncWrite` stream, a listener and a dialer, and `moq` CLI forwarding
+- [JS byte streams](/quest/m3/stream/js.md) - the same surface in `@moq/net`
+- [Stream benchmark](/quest/m3/stream/bench.md) - throughput and latency against raw TCP through a relay chain, with and without loss
diff --git a/quest/m2/stream/bench.md b/quest/m3/stream/bench.md
similarity index 88%
rename from quest/m2/stream/bench.md
rename to quest/m3/stream/bench.md
index 0469ffff790..ab61793b75c 100644
--- a/quest/m2/stream/bench.md
+++ b/quest/m3/stream/bench.md
@@ -15,4 +15,4 @@ gate here; the result informs the docs and the mesh guide.
 
 ## Required
 
-- [Rust byte streams](/quest/m2/stream/rust.md) - the stream under test
+- [Rust byte streams](/quest/m3/stream/rust.md) - the stream under test
diff --git a/quest/m2/stream/js.md b/quest/m3/stream/js.md
similarity index 74%
rename from quest/m2/stream/js.md
rename to quest/m3/stream/js.md
index 976639a3ec8..c729b1c5e3b 100644
--- a/quest/m2/stream/js.md
+++ b/quest/m3/stream/js.md
@@ -8,10 +8,10 @@ side in both directions.
 
 ## Plan
 
-Mirror the [Rust surface](/quest/m2/stream/rust.md) on `@moq/net`'s socket. Add
+Mirror the [Rust surface](/quest/m3/stream/rust.md) on `@moq/net`'s socket. Add
 the Rust/JS pair to `just test interop`.
 
 ## Required
 
 - [JS sockets](/quest/m1/socket/js.md) - the socket each stream is a bi track on
-- [Rust byte streams](/quest/m2/stream/rust.md) - the reference surface
+- [Rust byte streams](/quest/m3/stream/rust.md) - the reference surface
diff --git a/quest/m2/stream/rust.md b/quest/m3/stream/rust.md
similarity index 96%
rename from quest/m2/stream/rust.md
rename to quest/m3/stream/rust.md
index 1ddeda66fce..6a882c2af2d 100644
--- a/quest/m2/stream/rust.md
+++ b/quest/m3/stream/rust.md
@@ -11,7 +11,7 @@ unmodified client and server talk through a relay.
 
 ## Plan
 
-See the [epic](/quest/m2/stream/README.md) for the mapping: a socket endpoint
+See the [epic](/quest/m3/stream/README.md) for the mapping: a socket endpoint
 per forwarded service, a session per connection with one group each way, a
 frame per TCP read, no fill handler.
 
diff --git a/quest/m2/subscriber-fin-fold.md b/quest/m3/subscriber-fin-fold.md
similarity index 100%
rename from quest/m2/subscriber-fin-fold.md
rename to quest/m3/subscriber-fin-fold.md
diff --git a/quest/m2/tls-link-alpn.md b/quest/m3/tls-link-alpn.md
similarity index 100%
rename from quest/m2/tls-link-alpn.md
rename to quest/m3/tls-link-alpn.md
diff --git a/quest/m2/token-auth-followups.md b/quest/m3/token-auth-followups.md
similarity index 100%
rename from quest/m2/token-auth-followups.md
rename to quest/m3/token-auth-followups.md
diff --git a/quest/m2/ts-multi-program-restart.md b/quest/m3/ts-multi-program-restart.md
similarity index 100%
rename from quest/m2/ts-multi-program-restart.md
rename to quest/m3/ts-multi-program-restart.md
diff --git a/quest/m2/uring-demux.md b/quest/m3/uring-demux.md
similarity index 86%
rename from quest/m2/uring-demux.md
rename to quest/m3/uring-demux.md
index f58d10f8b32..f156d05cbb6 100644
--- a/quest/m2/uring-demux.md
+++ b/quest/m3/uring-demux.md
@@ -10,7 +10,7 @@ and WebRTC media and SRT reaching their tokio stacks from the same socket.
 
 Decided 2026-10-05: the uring workers host the demux. Rejected: keeping
 non-QUIC traffic on a separate tokio socket or port on uring nodes, which
-reverses the [one-port line](/quest/m2/one-port/README.md)'s point.
+reverses the [one-port line](/quest/m3/one-port/README.md)'s point.
 
 Decided 2026-10-05: it ranks in m2 below the bitrate caps, not right after
 one-port. The uring rollout is a performance change and the caps are a
@@ -18,7 +18,7 @@ customer feature, and moq.pro already ranks one-port above its uring
 rollout.
 
 Decided 2026-10-08: the UDP demux shrinks to QUIC plus the WebRTC hook, and
-the public STUN responder belongs to the deferred m2 P2P line, so the ring carries no
+the public STUN responder belongs to the deferred m4 P2P line, so the ring carries no
 STUN responder class either. An ICE Binding request is WebRTC traffic and
 follows that class.
 
@@ -32,7 +32,7 @@ of the other classes (`moq-rtc`, `moq-srt`) run on
 tokio, so non-QUIC datagrams cross to them on a `Send` channel, and their
 replies come back through a remote-send path into the owning worker's ring,
 which is what a fed `moq-rtc` takes as its `Transmit`
-([WebRTC on the shared socket](/quest/m2/one-port/rtc-feed.md)). A flow
+([WebRTC on the shared socket](/quest/m3/one-port/rtc-feed.md)). A flow
 pinned on one shard keeps landing there because reuseport steers only QUIC by
 connection ID.
 
@@ -50,9 +50,9 @@ off on the ring, from shard steering.
 
 ## Required
 
-- [WebRTC on the shared socket](/quest/m2/one-port/rtc-feed.md) - the fed RTC socket and transmit contract the ring integrates
-- [SRT on the shared socket](/quest/m2/one-port/srt-demux.md) - the SRT state machines fed through the shared demux
+- [WebRTC on the shared socket](/quest/m3/one-port/rtc-feed.md) - the fed RTC socket and transmit contract the ring integrates
+- [SRT on the shared socket](/quest/m3/one-port/srt-demux.md) - the SRT state machines fed through the shared demux
 
 ## Related
 
-- [Stream transports](/quest/m2/perf/stream/README.md) - the TCP half of moving the relay onto the ring
+- [Stream transports](/quest/m4/perf/stream/README.md) - the TCP half of moving the relay onto the ring
diff --git a/quest/m2/vaapi-vulkan-import.md b/quest/m3/vaapi-vulkan-import.md
similarity index 87%
rename from quest/m2/vaapi-vulkan-import.md
rename to quest/m3/vaapi-vulkan-import.md
index 38e41d74dfe..7caf67364ed 100644
--- a/quest/m2/vaapi-vulkan-import.md
+++ b/quest/m3/vaapi-vulkan-import.md
@@ -7,7 +7,7 @@ DMA-BUF with a DRM format modifier, from a producer that synchronizes
 explicitly through a timeline, encodes through VA-API on Intel (iHD) without a
 CPU round trip. An ignored hardware test proves it on an Arrow Lake iGPU, and
 `Kind::Auto` picks VA-API for a surface on an Intel device, through the same
-seam as [Vulkan encode](/quest/m2/vulkan-encode.md): `encode::Config::input`
+seam as [Vulkan encode](/quest/m3/vulkan-encode.md): `encode::Config::input`
 and a VA-API candidate with `vulkan: true` in
 `rs/moq-video/src/encode/backend/mod.rs`.
 
@@ -19,7 +19,7 @@ the same type reaches CUDA, Vulkan Video, and VA-API.
 Decided 2026-10-05 in a `/quest-plan` interview (paper trail in the PR that
 added this quest): Intel uses VA-API, since ANV on Arrow Lake has no Vulkan
 encode on Mesa 26.0.8 (it is in 26.2 behind `ANV_DEBUG`). H.264 is enough for
-the proof; H.265 on VA-API belongs to [VAAPI encode and decode](/quest/m2/video-vaapi.md).
+the proof; H.265 on VA-API belongs to [VAAPI encode and decode](/quest/m1/video-vaapi.md).
 
 Today the VA-API encoder takes a `Surface::DmaBuf` and waits for the producer
 through an implicit-fence poll with a 500 ms timeout (`DMA_BUF_FENCE_TIMEOUT`
@@ -46,7 +46,7 @@ sync_file import, so an explicit-sync producer races it.
   encode on one node per DMA-BUF. Decided 2026-10-05: the producer puts the
   render node's `dev_t` in the surface, read from
   its own `VK_EXT_physical_device_drm`, and VA-API opens that node. It is
-  the one device identity [GPU health](/quest/m2/gpu-health.md) keys by too.
+  the one device identity [GPU health](/quest/m3/gpu-health.md) keys by too.
   It landed in #4975 as `frame::vulkan::Device { device_uuid, driver_uuid,
   render_node: Option<u64> }`. VA-API refuses a surface with no
   `render_node`, since it has no other way to pick a node.
@@ -63,14 +63,14 @@ encodes H.264 at two sizes; the output decodes, and the slots recycle. On
 the two-node host, also check that a surface carrying `renderD129`'s
 `dev_t`, or `MOQ_VAAPI_DEVICE` naming it, opens that node rather than the
 first render node: the second-node check moved here from
-[Video hardware validation](/quest/m3/video-hardware.md) (2026-10-06 audit).
+[Video hardware validation](/quest/m5/video-hardware.md) (2026-10-06 audit).
 
 Public API: none; the surface landed in #4975. Wire: none.
 
 ## Related
 
-- [Vulkan Video encode on AMD](/quest/m2/vulkan-encode.md) - the AMD half of the same proof
-- [VAAPI encode and decode](/quest/m2/video-vaapi.md) - H.265 encode on the same backend
-- [GPU capacity and health](/quest/m2/gpu-health.md) - reports per device keyed by the same render node `dev_t`
-- [Linux OBS GPU input](/quest/m3/obs-linux-gpu.md) - a DMA-BUF producer that needs the same explicit sync
-- [Video hardware validation](/quest/m3/video-hardware.md) - VA-API so far ran only on Meteor Lake
+- [Vulkan Video encode on AMD](/quest/m3/vulkan-encode.md) - the AMD half of the same proof
+- [VAAPI encode and decode](/quest/m1/video-vaapi.md) - H.265 encode on the same backend
+- [GPU capacity and health](/quest/m3/gpu-health.md) - reports per device keyed by the same render node `dev_t`
+- [Linux OBS GPU input](/quest/m5/obs-linux-gpu.md) - a DMA-BUF producer that needs the same explicit sync
+- [Video hardware validation](/quest/m5/video-hardware.md) - VA-API so far ran only on Meteor Lake
diff --git a/quest/m2/video-quality/README.md b/quest/m3/video-quality/README.md
similarity index 87%
rename from quest/m2/video-quality/README.md
rename to quest/m3/video-quality/README.md
index 9f044f4b9b2..99cd9ab06c5 100644
--- a/quest/m2/video-quality/README.md
+++ b/quest/m3/video-quality/README.md
@@ -13,7 +13,7 @@ recipe in `rs/moq-video/examples/encode-presets.rs`. moq-boy's encoding looks
 bad, and nobody knows how each backend or GPU compares on the same input.
 
 Non-goals: per-viewer adaptation and live bitrate control, which belong to the
-[ladder](/quest/m3/ladder/README.md); browser playback quality, which belongs to
+[ladder](/quest/m5/ladder/README.md); browser playback quality, which belongs to
 `just test media`.
 
 ## Plan
@@ -28,9 +28,9 @@ Decided in planning (2026-10-28):
   fetched fails the run instead of being skipped (✅ "Manifest + R2" over "Private
   repo (moq.pro)" and "Synthetic + open only").
 - Gating: each row (host, backend, clip, rung) gets a VMAF floor and a pop
-  ceiling measured from nightlies, the way [ViSQOL](/quest/m2/audio-visqol.md)
+  ceiling measured from nightlies, the way [ViSQOL](/quest/m4/audio-visqol.md)
   keeps `budgets.json`. Scores also feed the [benchmark
-  table](/quest/m2/bench-sources.md) for trends (✅ "Floors + trend" over
+  table](/quest/m4/bench-sources.md) for trends (✅ "Floors + trend" over
   "Trend only" and "Golden diff", which is brittle across drivers).
 - Milestone m2, ranked right after release execution (✅ "Near the top"
   over "Next to GPU CI" and "Next to audio ViSQOL"). Rate control under
@@ -71,9 +71,9 @@ Decided in planning (2026-10-28):
 
 ## Required
 
-- [Harness](/quest/m2/video-quality/harness.md) - `just test video-quality` scores OpenH264 rows with per-frame VMAF and boundary pops against floors, nightly
-- [On-demand pops](/quest/m2/video-quality/on-demand.md) - cold starts, resubscribes, and fetch-encoded groups spliced with live ones stay under the pop ceiling
-- [moq-boy quality](/quest/m2/video-quality/moq-boy.md) - moq-boy's encode is measured on generated clips and fixed
-- [Corpus buckets](/quest/m2/video-quality/corpus-bucket.md) - R2 serves open clips publicly and private clips, from a separate bucket, to a read-only CI secret
-- [GPU runners](/quest/m2/video-quality/gpu-runners.md) - `nixos2` and the desktop host self-hosted runners for the nightly job
-- [Hardware rows](/quest/m2/video-quality/hardware.md) - NVENC and VA-API rows from three GPU hosts gate the nightly and compare side by side
+- [Harness](/quest/m3/video-quality/harness.md) - `just test video-quality` scores OpenH264 rows with per-frame VMAF and boundary pops against floors, nightly
+- [On-demand pops](/quest/m3/video-quality/on-demand.md) - cold starts, resubscribes, and fetch-encoded groups spliced with live ones stay under the pop ceiling
+- [moq-boy quality](/quest/m3/video-quality/moq-boy.md) - moq-boy's encode is measured on generated clips and fixed
+- [Corpus buckets](/quest/m3/video-quality/corpus-bucket.md) - R2 serves open clips publicly and private clips, from a separate bucket, to a read-only CI secret
+- [GPU runners](/quest/m3/video-quality/gpu-runners.md) - `nixos2` and the desktop host self-hosted runners for the nightly job
+- [Hardware rows](/quest/m3/video-quality/hardware.md) - NVENC and VA-API rows from three GPU hosts gate the nightly and compare side by side
diff --git a/quest/m2/video-quality/corpus-bucket.md b/quest/m3/video-quality/corpus-bucket.md
similarity index 100%
rename from quest/m2/video-quality/corpus-bucket.md
rename to quest/m3/video-quality/corpus-bucket.md
diff --git a/quest/m2/video-quality/gpu-runners.md b/quest/m3/video-quality/gpu-runners.md
similarity index 98%
rename from quest/m2/video-quality/gpu-runners.md
rename to quest/m3/video-quality/gpu-runners.md
index 69d2f728691..c0b4bf66bdd 100644
--- a/quest/m2/video-quality/gpu-runners.md
+++ b/quest/m3/video-quality/gpu-runners.md
@@ -6,7 +6,7 @@
 Lake, AMD RX 9070) each host a self-hosted moq-dev/moq runner. Each runner is
 labeled by its GPUs and has the device nodes and driver libraries the
 encoders need. `nixos` (RTX 3070 Ti) gets the same through [GPU
-CI](/quest/m2/gpu-ci.md).
+CI](/quest/m3/gpu-ci.md).
 
 This is host setup outside this repository. Check it with
 `gh api repos/moq-dev/moq/actions/runners`, which should list each runner
diff --git a/quest/m2/video-quality/hardware.md b/quest/m3/video-quality/hardware.md
similarity index 80%
rename from quest/m2/video-quality/hardware.md
rename to quest/m3/video-quality/hardware.md
index b2db39d50f0..356e7ae7ed4 100644
--- a/quest/m2/video-quality/hardware.md
+++ b/quest/m3/video-quality/hardware.md
@@ -11,7 +11,7 @@ prints the same table locally on any GPU host.
 
 ## Plan
 
-Decisions are recorded in the [epic](/quest/m2/video-quality/README.md):
+Decisions are recorded in the [epic](/quest/m3/video-quality/README.md):
 every row gets floors, and an offline host fails its job. Local runs write
 their table to `.tmp/` and upload nothing.
 
@@ -24,13 +24,13 @@ their table to `.tmp/` and upload nothing.
 - Select the backend explicitly per row. moq-transcode's default prefers
   hardware, so a missing driver must fail the row, not fall back to
   OpenH264.
-- When [Vulkan Video encode on AMD](/quest/m2/vulkan-encode.md) lands, its
+- When [Vulkan Video encode on AMD](/quest/m3/vulkan-encode.md) lands, its
   backend joins the desktop's rows.
 
 Public API: none. Wire: none.
 
 ## Required
 
-- [Harness](/quest/m2/video-quality/harness.md) - the scorer and row format
-- [GPU CI](/quest/m2/gpu-ci.md) - `nixos`'s runner gains its GPU
-- [GPU runners](/quest/m2/video-quality/gpu-runners.md) - `nixos2` and the desktop host runners
+- [Harness](/quest/m3/video-quality/harness.md) - the scorer and row format
+- [GPU CI](/quest/m3/gpu-ci.md) - `nixos`'s runner gains its GPU
+- [GPU runners](/quest/m3/video-quality/gpu-runners.md) - `nixos2` and the desktop host runners
diff --git a/quest/m2/video-quality/harness.md b/quest/m3/video-quality/harness.md
similarity index 90%
rename from quest/m2/video-quality/harness.md
rename to quest/m3/video-quality/harness.md
index 70e778917b7..0ecf9fdacc4 100644
--- a/quest/m2/video-quality/harness.md
+++ b/quest/m3/video-quality/harness.md
@@ -10,7 +10,7 @@ scores reach the benchmark table.
 
 ## Plan
 
-Decisions are recorded in the [epic](/quest/m2/video-quality/README.md).
+Decisions are recorded in the [epic](/quest/m3/video-quality/README.md).
 
 - Layout: `test/video-quality/`, mirroring `test/audio-quality/`, with
   per-row floors and ceilings in a budgets file measured from nightlies by the
@@ -43,7 +43,7 @@ Decisions are recorded in the [epic](/quest/m2/video-quality/README.md).
 - Corpus manifest: synthetic clips generated at run time (cheap, always
   available), open clips such as Blender open movies (CC-BY) with each license
   checked before listing, and private clips from the
-  [bucket](/quest/m2/video-quality/corpus-bucket.md). Cover screen content,
+  [bucket](/quest/m3/video-quality/corpus-bucket.md). Cover screen content,
   talking head, high motion, and fades. Keep clips short: nightly CPU time
   is a budget.
 - A run selects clips by name. A selected clip that cannot be fetched, or
@@ -55,9 +55,9 @@ Public API: none. Wire: none.
 
 ## Required
 
-- [Corpus bucket](/quest/m2/video-quality/corpus-bucket.md) - where open and private clips live
+- [Corpus bucket](/quest/m3/video-quality/corpus-bucket.md) - where open and private clips live
 
 ## Related
 
-- [Audio ViSQOL](/quest/m2/audio-visqol.md) - the same floor rule for audio
-- [Benchmark sources](/quest/m2/bench-sources.md) - the history format the scores join
+- [Audio ViSQOL](/quest/m4/audio-visqol.md) - the same floor rule for audio
+- [Benchmark sources](/quest/m4/bench-sources.md) - the history format the scores join
diff --git a/quest/m2/video-quality/moq-boy.md b/quest/m3/video-quality/moq-boy.md
similarity index 96%
rename from quest/m2/video-quality/moq-boy.md
rename to quest/m3/video-quality/moq-boy.md
index 33a1bd0f3c0..8f1e3009e43 100644
--- a/quest/m2/video-quality/moq-boy.md
+++ b/quest/m3/video-quality/moq-boy.md
@@ -39,4 +39,4 @@ Public API: possibly, see above. Wire: none.
 
 ## Required
 
-- [Harness](/quest/m2/video-quality/harness.md) - the scorer this fix is measured with
+- [Harness](/quest/m3/video-quality/harness.md) - the scorer this fix is measured with
diff --git a/quest/m2/video-quality/on-demand.md b/quest/m3/video-quality/on-demand.md
similarity index 90%
rename from quest/m2/video-quality/on-demand.md
rename to quest/m3/video-quality/on-demand.md
index 8394aea5b18..d26951fa2fd 100644
--- a/quest/m2/video-quality/on-demand.md
+++ b/quest/m3/video-quality/on-demand.md
@@ -24,7 +24,7 @@ Where rate control starts cold today:
 - A color-space change reopens the encoder.
 - moq-video's own capture publisher also starts its encoder on demand.
 
-Scenarios, each a transcode row in the [harness](/quest/m2/video-quality/harness.md):
+Scenarios, each a transcode row in the [harness](/quest/m3/video-quality/harness.md):
 
 - Steady live rung from the first frame, as the baseline.
 - Subscribe mid-clip, unsubscribe, resubscribe.
@@ -45,8 +45,8 @@ Public API: none expected. Wire: none.
 
 ## Required
 
-- [Harness](/quest/m2/video-quality/harness.md) - the scorer and pop metric
+- [Harness](/quest/m3/video-quality/harness.md) - the scorer and pop metric
 
 ## Related
 
-- [Ladder fetch](/quest/m3/ladder/fetch.md) - later makes fetch encode at the controller's target; keep the same fetch encoder ownership
+- [Ladder fetch](/quest/m5/ladder/fetch.md) - later makes fetch encode at the controller's target; keep the same fetch encoder ownership
diff --git a/quest/m2/vulkan-encode.md b/quest/m3/vulkan-encode.md
similarity index 96%
rename from quest/m2/vulkan-encode.md
rename to quest/m3/vulkan-encode.md
index 7c4b01f34d8..27fae9a14ce 100644
--- a/quest/m2/vulkan-encode.md
+++ b/quest/m3/vulkan-encode.md
@@ -75,5 +75,5 @@ Public API: a new encoder backend and feature. Wire: none.
 
 ## Related
 
-- [VA-API encodes an external Vulkan image](/quest/m2/vaapi-vulkan-import.md) - the Intel half of the same proof
-- [Intra-refresh GOPs](/quest/m2/intra-refresh/README.md) - import and playback of intra-refresh video, which this encoder does not produce
+- [VA-API encodes an external Vulkan image](/quest/m3/vaapi-vulkan-import.md) - the Intel half of the same proof
+- [Intra-refresh GOPs](/quest/m3/intra-refresh/README.md) - import and playback of intra-refresh video, which this encoder does not produce
diff --git a/quest/m2/watch-data-sync.md b/quest/m3/watch-data-sync.md
similarity index 91%
rename from quest/m2/watch-data-sync.md
rename to quest/m3/watch-data-sync.md
index c5f207c6953..388cbf2fb28 100644
--- a/quest/m2/watch-data-sync.md
+++ b/quest/m3/watch-data-sync.md
@@ -21,11 +21,11 @@ releases it.
   they arrive. Since 2026-10-05 a track is all timed or all untimed (the untimed
   model, [#4822](https://github.com/moq-dev/moq/pull/4822)), so no stream mixes the two.
 - This replaces the sync code a web frontend writes today to hold KLV or
-  MAVLink telemetry back to the video playhead. In m2 rather than m1, since
+  MAVLink telemetry back to the video playhead. In m3 rather than m1, since
   that workaround exists.
 - Decided 2026-10-08: the A/V clock and the watch worker land first, since
   they change what `Sync` waits on and where it runs.
 
 ## Required
 
-- [Watch worker](/quest/m2/watch-worker.md) - moves `Sync` into a worker, where the reader registers
+- [Watch worker](/quest/m3/watch-worker.md) - moves `Sync` into a worker, where the reader registers
diff --git a/quest/m2/watch-symlink-targets.md b/quest/m3/watch-symlink-targets.md
similarity index 100%
rename from quest/m2/watch-symlink-targets.md
rename to quest/m3/watch-symlink-targets.md
diff --git a/quest/m2/watch-worker.md b/quest/m3/watch-worker.md
similarity index 91%
rename from quest/m2/watch-worker.md
rename to quest/m3/watch-worker.md
index 08e74f12a6b..c859678d3b6 100644
--- a/quest/m2/watch-worker.md
+++ b/quest/m3/watch-worker.md
@@ -11,7 +11,7 @@ instead of falling back to the main thread.
 
 ## Plan
 
-[Plan: watch worker](/quest/m2/plan-watch-worker.md) picks between an
+[Plan: watch worker](/quest/m3/plan-watch-worker.md) picks between an
 invisible page-wide worker with on-demand signal handles and
 application-spawned workers, and rewrites this quest with the result. Until
 then, the settled constraints in that quest apply here too.
@@ -30,7 +30,7 @@ Gate on the plan's jank harness and N-player sweep, both nightly.
 
 ## Required
 
-- [Plan: watch worker](/quest/m2/plan-watch-worker.md) - picks the worker model and rewrites this quest
+- [Plan: watch worker](/quest/m3/plan-watch-worker.md) - picks the worker model and rewrites this quest
 
 ## Related
 
diff --git a/quest/m2/webcodecs-priming.md b/quest/m3/webcodecs-priming.md
similarity index 94%
rename from quest/m2/webcodecs-priming.md
rename to quest/m3/webcodecs-priming.md
index 050390794bd..75ba8569738 100644
--- a/quest/m2/webcodecs-priming.md
+++ b/quest/m3/webcodecs-priming.md
@@ -60,13 +60,13 @@ Decided 2026-11-04 (maintainer, /quest-plan):
   Chromium and Firefox; there, AAC skips through the existing capability probe.
   The mocked `AudioEncoder` in `js/publish/src/audio/encoder.test.ts`, given a
   stated delay, covers the AAC stamping and the Opus mismatch error. The
-  [macOS browser lane](/quest/m2/macos-browser-lane.md) proves AAC in real
+  [macOS browser lane](/quest/m4/macos-browser-lane.md) proves AAC in real
   browser encoders.
 - Public API: none expected. An Opus catalog may now carry a `description`
   where the browser emitted none. Wire: none.
 
 ## Related
 
-- [moq-audio in the browser](/quest/m3/audio-web.md) - its WebCodecs backend's `delay()` reuses this measurement
-- [AudioToolbox encode](/quest/m2/audio-encode-audiotoolbox.md) - the native AAC encoder's delay, folded the same way
-- [Chromium's Opus encoder stamps chunks from their input](/quest/m2/chromium-opus-timestamps.md) - another WebCodecs `AudioEncoder` timestamp bug
+- [moq-audio in the browser](/quest/m5/audio-web.md) - its WebCodecs backend's `delay()` reuses this measurement
+- [AudioToolbox encode](/quest/m5/audio-encode-audiotoolbox.md) - the native AAC encoder's delay, folded the same way
+- [Chromium's Opus encoder stamps chunks from their input](/quest/m4/chromium-opus-timestamps.md) - another WebCodecs `AudioEncoder` timestamp bug
diff --git a/quest/m2/webrtc/README.md b/quest/m3/webrtc/README.md
similarity index 86%
rename from quest/m2/webrtc/README.md
rename to quest/m3/webrtc/README.md
index 4c24979304e..fe056582f6c 100644
--- a/quest/m2/webrtc/README.md
+++ b/quest/m3/webrtc/README.md
@@ -8,26 +8,26 @@ Non-goals: TURN; DTLS 1.3; replacing a vendored layer before there's a reason to
 
 ## Plan
 
-Decided 2026-10-30 with the maintainer (planning interview), after the str0m workarounds piled up: one `b=` line per SDP media section ([moq-dev/moq#7373](https://github.com/moq-dev/moq/pull/7373)), DTLS retransmits running out before ICE connects ([moq-dev/moq#7379](https://github.com/moq-dev/moq/pull/7379)), no hook to charge or serve NACK resends ([rtc-pacing](/quest/m2/rtc-pacing.md)), and `std::time::Instant` in a `kio::clock` workspace. No upstream reports were approved; vendoring replaces them.
+Decided 2026-10-30 with the maintainer (planning interview), after the str0m workarounds piled up: one `b=` line per SDP media section ([moq-dev/moq#7373](https://github.com/moq-dev/moq/pull/7373)), DTLS retransmits running out before ICE connects ([moq-dev/moq#7379](https://github.com/moq-dev/moq/pull/7379)), no hook to charge or serve NACK resends ([rtc-pacing](/quest/m3/rtc-pacing.md)), and `std::time::Instant` in a `kio::clock` workspace. No upstream reports were approved; vendoring replaces them.
 
 - **Vendor, then replace.** Copy the upstream crates in, trim them, and fix them in-tree. Replacing a layer with our own (SDP, RTP/RTCP, SRTP, SCTP) is a later child once a concrete need appears; none is planned yet.
 - **One crate.** `moq-ice` merges into it, since its only users are `moq-rtc` and moq-tokio's data-channel transport. moq-tokio's `webrtc` feature moves into `moq-webrtc` as well, which breaks the cycle (`moq-webrtc` depends on moq-tokio; moq-tokio would otherwise need ICE and SCTP). The vendored crates become private modules, not separate published crates, keeping their MIT/Apache-2.0 notices (str0m's `packet/` carries webrtc-rs's Apache notice).
-- **What goes** (from the 2026-10-30 inventory: we use frame mode, full ICE, and DTLS 1.2, and never enable str0m's BWE, pacer, or stats): GCC bandwidth estimation (8k lines; GCC is ported into `moq-congestion` as `moq_congestion::gcc`), the leaky pacer (replaced by moq-congestion's pacer, made public by [rtc-pacing](/quest/m2/rtc-pacing.md)), H.266, RED, DTMF, G.7xx and comfort noise, VLA and simulcast layers, RTCP XR and app feedback, stats, internal test exports, and dimpl's DTLS 1.3 and version auto-selection. Roughly 17k of str0m's 72k lines and 11k of dimpl's 33k.
+- **What goes** (from the 2026-10-30 inventory: we use frame mode, full ICE, and DTLS 1.2, and never enable str0m's BWE, pacer, or stats): GCC bandwidth estimation (8k lines; GCC is ported into `moq-congestion` as `moq_congestion::gcc`), the leaky pacer (replaced by moq-congestion's pacer, made public by [rtc-pacing](/quest/m3/rtc-pacing.md)), H.266, RED, DTMF, G.7xx and comfort noise, VLA and simulcast layers, RTCP XR and app feedback, stats, internal test exports, and dimpl's DTLS 1.3 and version auto-selection. Roughly 17k of str0m's 72k lines and 11k of dimpl's 33k.
 - **DTLS 1.2 only.** Every browser negotiates 1.2 today. [moq-rtc on rind](/quest/m1/rind/rtc.md) narrows to 1.2 to match.
-- **SCTP stays**, for browser data channels in [P2P](/quest/m2/p2p/README.md), but compiles only with the data-channel feature, so WHIP/WHEP builds carry none of it. Vendored, it can later be simplified or put on moq-congestion.
+- **SCTP stays**, for browser data channels in [P2P](/quest/m4/p2p/README.md), but compiles only with the data-channel feature, so WHIP/WHEP builds carry none of it. Vendored, it can later be simplified or put on moq-congestion.
 - **Upstream fixes:** after vendoring, nobody merges upstream automatically. Record the vendored upstream versions in the crate docs; the release-cut audit checks the upstream changelogs for security fixes (malformed SRTP/RTCP input, for example) and ports them.
 - Docs a change makes stale (crate names, `doc/lib/rs`, `doc/setup/upgrade.md`, other quests naming `moq-rtc` or `moq-ice`) change in the PR that makes them stale.
 
 ## Required
 
-- [Rename moq-rtc to moq-webrtc](/quest/m1/webrtc-rename.md) - one crate holds the gateway, the ICE driver, and the data-channel transport
+- [Rename moq-rtc to moq-webrtc](/quest/m2/webrtc-rename.md) - one crate holds the gateway, the ICE driver, and the data-channel transport
 - [Vendor and trim the stack](/quest/m1/webrtc-vendor.md) - str0m, dimpl, `is`, and sctp-proto live in moq-webrtc with unused code removed
-- [A typed DTLS handshake timeout error](/quest/m2/webrtc/dtls-timeout.md) - callers match a DTLS handshake timeout by variant, and session end treats it like an ICE timeout
-- [Several bandwidth lines per media section](/quest/m2/webrtc/sdp-bandwidth.md) - answers carry both `b=TIAS` and `b=AS` without splicing
-- [DTLS waits for ICE](/quest/m2/webrtc/dtls-after-ice.md) - DTLS flights start once ICE nominates a pair, so a late ICE path can't exhaust them
-- [The stack takes kio clock time](/quest/m2/webrtc/clock.md) - the vendored code takes `kio::clock::Instant`, so sim tests drive it directly
+- [A typed DTLS handshake timeout error](/quest/m3/webrtc/dtls-timeout.md) - callers match a DTLS handshake timeout by variant, and session end treats it like an ICE timeout
+- [Several bandwidth lines per media section](/quest/m3/webrtc/sdp-bandwidth.md) - answers carry both `b=TIAS` and `b=AS` without splicing
+- [DTLS waits for ICE](/quest/m3/webrtc/dtls-after-ice.md) - DTLS flights start once ICE nominates a pair, so a late ICE path can't exhaust them
+- [The stack takes kio clock time](/quest/m3/webrtc/clock.md) - the vendored code takes `kio::clock::Instant`, so sim tests drive it directly
 
 ## Related
 
-- [moq-rtc paces WHEP viewers](/quest/m2/rtc-pacing.md) - adds the NACK hook and the shared pacer on the vendored stack
+- [moq-rtc paces WHEP viewers](/quest/m3/rtc-pacing.md) - adds the NACK hook and the shared pacer on the vendored stack
 - [moq-rtc on rind](/quest/m1/rind/rtc.md) - the vendored DTLS and SRTP take rind's crypto
diff --git a/quest/m2/webrtc/clock.md b/quest/m3/webrtc/clock.md
similarity index 100%
rename from quest/m2/webrtc/clock.md
rename to quest/m3/webrtc/clock.md
diff --git a/quest/m2/webrtc/dtls-after-ice.md b/quest/m3/webrtc/dtls-after-ice.md
similarity index 95%
rename from quest/m2/webrtc/dtls-after-ice.md
rename to quest/m3/webrtc/dtls-after-ice.md
index af3d8fc1816..fc634dcaeba 100644
--- a/quest/m2/webrtc/dtls-after-ice.md
+++ b/quest/m3/webrtc/dtls-after-ice.md
@@ -6,7 +6,7 @@ DTLS sends its first flight only once ICE has nominated a pair, so a peer whose
 
 ## Plan
 
-Decided 2026-10-30 with the maintainer (planning interview). Today DTLS starts before ICE connects and dimpl gives up after 1+2+4+8+16 s with jitter (`dimpl/src/config.rs:90-92`), racing moq-ice's 30 s deadline; [moq-dev/moq#7379](https://github.com/moq-dev/moq/pull/7379) papered over the race by reporting an early DTLS failure as a timeout. Hold DTLS activation (around str0m's `lib.rs:1493`) until nomination, then remove #7379's remapping if nothing else needs it. Test on the paused clock: ICE nominating at 29 s still completes DTLS. Added 2026-10-31 from [moq-dev/moq#7379](https://github.com/moq-dev/moq/pull/7379): also test that a DTLS failure after ICE has connected still reports a DTLS error (`moq_ice::Error::Rtc`, or the [typed handshake timeout](/quest/m2/webrtc/dtls-timeout.md)), not `Timeout` (moq-rtc's `IceTimeout`), so the remapping (or its removal) only ever changes a failure before nomination.
+Decided 2026-10-30 with the maintainer (planning interview). Today DTLS starts before ICE connects and dimpl gives up after 1+2+4+8+16 s with jitter (`dimpl/src/config.rs:90-92`), racing moq-ice's 30 s deadline; [moq-dev/moq#7379](https://github.com/moq-dev/moq/pull/7379) papered over the race by reporting an early DTLS failure as a timeout. Hold DTLS activation (around str0m's `lib.rs:1493`) until nomination, then remove #7379's remapping if nothing else needs it. Test on the paused clock: ICE nominating at 29 s still completes DTLS. Added 2026-10-31 from [moq-dev/moq#7379](https://github.com/moq-dev/moq/pull/7379): also test that a DTLS failure after ICE has connected still reports a DTLS error (`moq_ice::Error::Rtc`, or the [typed handshake timeout](/quest/m3/webrtc/dtls-timeout.md)), not `Timeout` (moq-rtc's `IceTimeout`), so the remapping (or its removal) only ever changes a failure before nomination.
 
 Public API: none. Wire: none.
 
diff --git a/quest/m2/webrtc/dtls-timeout.md b/quest/m3/webrtc/dtls-timeout.md
similarity index 93%
rename from quest/m2/webrtc/dtls-timeout.md
rename to quest/m3/webrtc/dtls-timeout.md
index c1f6ea213fe..8a83c145d9e 100644
--- a/quest/m2/webrtc/dtls-timeout.md
+++ b/quest/m3/webrtc/dtls-timeout.md
@@ -4,7 +4,7 @@
 
 A DTLS handshake that times out after ICE connects surfaces as its own error
 variant in `moq-ice` and `moq-rtc` (or `moq-webrtc`, after the
-[rename](/quest/m1/webrtc-rename.md)), so callers match it instead of the text
+[rename](/quest/m2/webrtc-rename.md)), so callers match it instead of the text
 `rtc error: DTLS error: timeout: handshake` inside `Error::Rtc(String)`.
 Session-end handling and logging treat it like an ICE timeout: `session::end`
 logs it at debug as abandoned-session churn, not as a warning.
@@ -36,4 +36,4 @@ Public API: additive variants on non-exhaustive error enums. Wire: none.
 ## Related
 
 - [Vendor and trim the WebRTC stack](/quest/m1/webrtc-vendor.md) - replaces this quest's text match with dimpl's typed timeout
-- [DTLS waits for ICE](/quest/m2/webrtc/dtls-after-ice.md) - after it, every DTLS handshake timeout comes after nomination, which is the case this types
+- [DTLS waits for ICE](/quest/m3/webrtc/dtls-after-ice.md) - after it, every DTLS handshake timeout comes after nomination, which is the case this types
diff --git a/quest/m2/webrtc/sdp-bandwidth.md b/quest/m3/webrtc/sdp-bandwidth.md
similarity index 100%
rename from quest/m2/webrtc/sdp-bandwidth.md
rename to quest/m3/webrtc/sdp-bandwidth.md
diff --git a/quest/m2/wire-stats/README.md b/quest/m3/wire-stats/README.md
similarity index 96%
rename from quest/m2/wire-stats/README.md
rename to quest/m3/wire-stats/README.md
index 4857a763351..63d743742bc 100644
--- a/quest/m2/wire-stats/README.md
+++ b/quest/m3/wire-stats/README.md
@@ -73,7 +73,7 @@ receive-side limitations.
 
 ## Required
 
-- [qmux byte counters](/quest/m2/wire-stats/qmux.md) - a WebSocket session
+- [qmux byte counters](/quest/m3/wire-stats/qmux.md) - a WebSocket session
   reports its TCP bytes
-- [moq-srt wire source](/quest/m2/wire-stats/srt.md) - an SRT connection
+- [moq-srt wire source](/quest/m3/wire-stats/srt.md) - an SRT connection
   reports its wire bytes
diff --git a/quest/m2/wire-stats/qmux.md b/quest/m3/wire-stats/qmux.md
similarity index 100%
rename from quest/m2/wire-stats/qmux.md
rename to quest/m3/wire-stats/qmux.md
diff --git a/quest/m2/wire-stats/srt.md b/quest/m3/wire-stats/srt.md
similarity index 91%
rename from quest/m2/wire-stats/srt.md
rename to quest/m3/wire-stats/srt.md
index 66949797d98..1c3a1c9affb 100644
--- a/quest/m2/wire-stats/srt.md
+++ b/quest/m3/wire-stats/srt.md
@@ -20,11 +20,11 @@ the same definition as QUIC's `udp_tx`.
   with `stats::Session::wire` on a session from `stats::Handle::session`.
 - Read `srt-tokio`'s statistics now rather than waiting on one port
   (decided 2026-10-20, maintainer, because the source needs no socket ownership
-  change). When [SRT on the shared socket](/quest/m2/one-port/srt-demux.md)
+  change). When [SRT on the shared socket](/quest/m3/one-port/srt-demux.md)
   replaces `srt-tokio`, it reads the same `SocketStatistics` from
   `srt-protocol` and keeps this source.
 - Test: an SRT pull's reported tx covers at least the TS payload it sent.
 
 ## Related
 
-- [SRT on the shared socket](/quest/m2/one-port/srt-demux.md) - carries this source over when it replaces `srt-tokio`
+- [SRT on the shared socket](/quest/m3/one-port/srt-demux.md) - carries this source over when it replaces `srt-tokio`
diff --git a/quest/m2/2819-moq-video-carry-pipewire-dma-bufs-safely-into-the-vulkan.md b/quest/m4/2819-moq-video-carry-pipewire-dma-bufs-safely-into-the-vulkan.md
similarity index 96%
rename from quest/m2/2819-moq-video-carry-pipewire-dma-bufs-safely-into-the-vulkan.md
rename to quest/m4/2819-moq-video-carry-pipewire-dma-bufs-safely-into-the-vulkan.md
index 5751bbe96f2..e880bbd4ebd 100644
--- a/quest/m2/2819-moq-video-carry-pipewire-dma-bufs-safely-into-the-vulkan.md
+++ b/quest/m4/2819-moq-video-carry-pipewire-dma-bufs-safely-into-the-vulkan.md
@@ -36,4 +36,4 @@ Refs #2481, #1837.
 
 ## Related
 
-- [Capture multi-plane PipeWire cameras](/quest/m3/pipewire-camera-planes.md) - separate memory blocks from a camera, the capture offer rather than this import
+- [Capture multi-plane PipeWire cameras](/quest/m5/pipewire-camera-planes.md) - separate memory blocks from a camera, the capture offer rather than this import
diff --git a/quest/m4/README.md b/quest/m4/README.md
new file mode 100644
index 00000000000..e08d6a59b2c
--- /dev/null
+++ b/quest/m4/README.md
@@ -0,0 +1,101 @@
+# m4: later work, lower priority
+
+## Goal
+
+Work that follows the next breaking release with nobody waiting on it yet:
+tests, tooling, benchmarks, optimizations, conditions on outside parties that
+only later work needs, and features only a downstream deployment's later
+plans need.
+
+## Plan
+
+Decided 2026-11-05 (maintainer, milestone re-cut): the lower half of the old
+m2 ("later work"), as [m3](/quest/m3/README.md) describes. After each cut
+m4's quests move to m3 and m4 starts empty. A quest here that gains a
+consumer moves to m3; one that loses its last reason moves to m5 or is
+deleted.
+
+## Required
+
+- [Wire fuzz coverage](/quest/m4/wire-fuzz-coverage.md) - the cmsg walks in moq-sock and moq-uring have invariant fuzz targets, and the unsafe peer input reaches runs under Miri
+- [VA-API renderer tests](/quest/m4/vaapi-render-tests.md) - the VA-API renderer, decode, and transcode tests run in `just rs gpu` on AMD and Intel and fail instead of skipping, and hosted CI reports them ignored
+- [One Ruff pin and Swift formatting on aarch64-linux](/quest/m4/format-gate-followups.md) - only the dev shell pins Ruff, and aarch64-linux checks Swift formatting once nixpkgs builds `swiftc` there
+- [Weekly mutation testing on critical modules](/quest/m4/mutants.md) - cargo-mutants runs weekly on moq-auth and moq-net's permission, resume, and expiry code
+- [P2P](/quest/m4/p2p/README.md) - application-selected peer sessions use shared priorities, routing, and same-epoch handover
+- [moq-auth drops the unused peer grant API](/quest/m4/auth-drop-peer-grant.md) - P2P trusts its peers, so `PeerGrant` and its `KeySet` methods go
+- [Benchmark sources](/quest/m4/bench-sources.md) - every measuring nightly benchmark feeds the regression table, and none is a smoke run
+- [HLS and DASH browser playback](/quest/m4/hls-player-test.md) - hls.js and dash.js play, reload, switch, and survive reconfiguration nightly
+- [Cache fair share](/quest/m4/cache-fairness.md) - one tenant cannot crowd another out of the relay's shared group cache
+- [Peer grant bound](/quest/m4/peer-grant-bound.md) - a peer's AUTH_OK costs near-linear time in its bytes on every input shape, in Rust and in a browser
+- [A regrant re-checks only the routes it can change](/quest/m4/regrant-route-recheck.md) - an `AUTH_OK` no longer costs routes times grant members on every lite announce stream
+- [Upstream reports](/quest/m4/upstream-reports.md) - report the faad, retina, and mr-boxington bugs found before the cut
+- [moq-net's library tests pass under cargo test](/quest/m4/net-test-subscriber.md) - two moq-net tests stop each installing a global tracing subscriber, so plain `cargo test -p moq-net --lib` passes
+- [Perf](/quest/m4/perf/README.md) - eliminate measured hot-path costs across moq-uring, kio, and the moq-net model
+- [Transport x version benches](/quest/m4/bench-transport-sweep.md) - the session benches sweep transports as well as versions
+- [Shared group serving and ingest](/quest/m4/shared-serve.md) - Rust's moq-lite and moq-transport sessions serve and ingest groups through one poll machine each, with only wire encoding per protocol
+- [Shared group serving and ingest in JS](/quest/m4/shared-serve-js.md) - the same split in js/net, following the Rust seam
+- [Paired bench BASE](/quest/m4/bench-base-paired.md) - `just bench <base>` uses the nightly's paired comparison and the old one is deleted
+- [Route wakes](/quest/m4/route-wakes.md) - a route change wakes only the fronts it can move, so pool churn stops scaling with served paths
+- [Audio outlives video](/quest/m4/audio-bufferbloat-av.md) - under bufferbloat audio stays within budget while video may skip, rendered frames stay in sync, and native audio rows are enforced
+- [ViSQOL grading](/quest/m4/audio-visqol.md) - the nightly scores played audio against a reference clip and fails below measured floors
+- [Browser publishing paths under test](/quest/m4/publish-firefox.md) - the media harness publishes from Firefox in Nightly and passes, covering the `<video>` capture fallback Chromium never takes
+- [Bindings in the interop matrix](/quest/m4/interop-bindings.md) - Kotlin, Swift, and Dart publish and subscribe against every other interop client
+- [Resume as producer replacement](/quest/m4/resume-redesign.md) - route changes replace the writer of one track state, deleting the per-reader resume path in Rust and JS
+- [Announce interest streams share one route table](/quest/m4/announce-interest-memory.md) - per-stream announce cost follows what is in flight, not every route
+- [Watch decode gate](/quest/m4/watch-decode-gate.md) - video lookahead stays encoded until it is near presentation, like audio
+- [moqsrc A/V sync](/quest/m4/moqsrc-av-sync.md) - a nightly test measures A/V skew from `moqsrc` through clock-synced sinks
+- [macOS browser lane](/quest/m4/macos-browser-lane.md) - nightly CI runs the priming browser test in Chrome and Safari, which have the AAC encoders Linux lacks
+- [fMP4 ambisonic layout](/quest/m4/mux-vr-ambisonic-fmp4.md) - fMP4 Opus import fills `ambisonic` from the `dOps` mapping table
+- [io_uring quiescence on a quiet host](/quest/m4/uring-bench-followups.md) - quiet-host acceptance numbers and a nightly `worker_turns` QUIC request-reply series
+- [#2819](/quest/m4/2819-moq-video-carry-pipewire-dma-bufs-safely-into-the-vulkan.md) - moq-video: validate PipeWire DMA-BUFs into the Vulkan renderer on hardware
+- [Windows.Graphics.Capture](/quest/m4/capture-wgc.md) - the WGC display and window backend verified on real Windows hardware
+- [The moq CLI can publish a changing catalog](/quest/m4/cli-catalog-updates.md) - catalog updates mid-stream, so recovery replays need no hand-built clients
+- [The relay over QUIC on the sim](/quest/m4/quic-sim.md) - the relay and moq-tokio's `Client` and `Server` run over `moq-quic` on the seeded sim
+- [moq-shaper's own socket never passes for path loss](/quest/m4/shaper-socket.md) - relay-sized buffers and its own socket drops reported beside path drops
+- [Auth session caps cost O(1)](/quest/m4/auth-session-index.md) - per-token and per-remote counts and a time-ordered expiry queue replace the scans, after #7211
+- [Drop moq-auth's iroh transport](/quest/m4/auth-drop-iroh.md) - the next breaking moq-auth release drops `Transport::Iroh` and the JS `"iroh"` value
+- [Relays and moq-tokio offer versioned qmux-02 first](/quest/m4/qmux-02-subprotocols.md) - one shared qmux version list prefers 02, so JS clients negotiate it
+- [Smoke tests make their certificates without a system OpenSSL config](/quest/m4/smoke-libressl.md) - moxygen and Cloudflare smoke pass `-config`, as the conformance runner does
+- [ashpd uses maintained D-Bus crates](/quest/m4/ashpd-maintained.md) - wait for a stable zbus 6 port, then remove the portal dependency exceptions
+- [Askama uses a maintained TOML parser](/quest/m4/askama-maintained.md) - wait for a stable parser migration, then remove the generator dependency exception
+- [Adopt formatter defaults after evaluating Bun](/quest/m4/formatter-defaults.md) - every language uses its formatter's defaults, YAML and Markdown are formatted, and remark is gone in one coordinated migration
+- [Upstream unknown-env option in usage-rs](/quest/m4/usage-unknown-env.md) - jdx/usage refuses unknown prefixed env vars, replacing the moq-tokio helper
+- [Upstream single-declaration settings in usage-rs](/quest/m4/usage-settings-once.md) - waiting on approval to post, then jdx/usage builds the registry from Cli fields
+- [Archive reads against a real store](/quest/m4/archive-store-bench.md) - LIST/GET counts and latency over track count
+- [Branch checks lint examples](/quest/m4/lint-examples.md) - `just check` runs clippy on the selected crates' examples, and PR CI builds the C++, Go, and Python interop clients
+- [Drop kio's epoch fence](/quest/m4/crossbeam-pin-fence.md) - waiting on crossbeam#1352, then the `Read::drop` fence goes
+- [A cancelled miss stops waiting](/quest/m4/fill-wait-cancel-test.md) - a test proves a relay miss waiting on its own fill ends when no reader wants it
+- [No MOQ_* knobs outside the binaries](/quest/m4/env-knobs.md) - test, bench, and library knobs leave the `MOQ_*` prefix
+- [The HLS server follows each path once](/quest/m4/hls-follow-once.md) - `Following` reports synced absence, so moq-hls resolves with one follow
+- [moq-bench pins the instances it measures](/quest/m4/bench-epoch-pin.md) - pooled requests pin their announced epoch, so a takeover is not counted as the same broadcast
+- [moq-bench reports sub-millisecond latency](/quest/m4/bench-latency-resolution.md) - steady-window latency resolves finer than 1 ms
+- [Benchmark series stay meaningful](/quest/m4/bench-hygiene.md) - a warm `burst` variant, stale series pruned, and slow-group `bytes` kept out of series names
+- [Re-run the SPS fuzzer on h264-reader](/quest/m4/sps-fuzz-h264-reader.md) - the H.264 SPS overflow is rechecked on the new parser
+- [Drop the H.265 SPS pre-walk once scuffle is fixed](/quest/m4/scuffle-sps-bump.md) - waiting on ScuffleCloud/scuffle#653 and #654 releases, then bump and drop the walk
+- [PCM encodes in one pass](/quest/m4/pcm-bulk-encode.md) - the PCM encoder converts a frame in bulk instead of one sample at a time
+- [moq-quic's internal dev-dependencies are path-only](/quest/m4/quic-dev-dep-path.md) - moq-congestion is a path dev-dependency
+- [moq-mux's AAC config reports SBR](/quest/m4/aac-sbr-config.md) - moq-audio reads backward-compatible SBR from the config
+- [moq-video's Apple Sink encodes on its own thread](/quest/m4/apple-sink-thread.md) - macOS and iOS ladders never encode on a tokio worker
+- [aec::Processor's edge cases are tested](/quest/m4/aec-tests.md) - moq-audio tests cover `aec::Processor` at the extremes of its accepted input
+- [A browser test covers GPU encoder death and a broadcast rename](/quest/m4/gpu-encoder-death-test.md) - A real-browser test makes `@moq/publish`'s video encoder fail mid-stream
+- [kio::Tasks tolerates a removed task's waker firing into its reused slot](/quest/m4/kio-tasks-waker-test.md) - A unit test in `rs/kio/src/task.rs` shows that when a task taken out with `Tasks::remove` wakes after another task was `insert`ed into its slot, the new occupant is polled at most once spuriously, still finishes on its own wake (handed back through `poll_each`), and its `TaskKey` still removes it
+- [moqsrc reconnects correctly whatever order events arrive in](/quest/m4/moqsrc-reconnect-order.md) - A moq-gst test reconnects `moqsrc` while a rendition pad is blocked downstream, delivering the reconnect's events
+- [The relay NixOS module's peer list is tested](/quest/m4/nix-relay-peers-test.md) - `nix flake check` evaluates the moq-relay NixOS module with no, one, and several `cluster.rootUrl` peers and refuses an empty list, asserting the `MOQ_CLUSTER_CONNECT` value each produces
+- [moq-quic's sim pair fails a test that sends an oversized packet](/quest/m4/quic-sim-mtu.md) - A moq-quic test whose endpoint sends a datagram larger than the simulated path MTU fails, instead of the `Pair` silently dropping it
+- [A stalled reader within budget gets no Old resets through a relay](/quest/m4/relay-capped-credit-test.md) - A test proves that a subscriber which stalls before its first read, behind a relay over a transport with capped stream credit, receives no `Old` stream resets for groups still within its max-delay budget, and reads them in order once it resumes
+- [In-memory transports refuse a request without stream credit](/quest/m4/sim-credit-open.md) - moq-net's in-memory test transports model the peer's bidirectional stream credit, and `poll_open_request` returns `Ok(None)`
+- [The tenant matrix's HTTP checks assert exact refusals](/quest/m4/tenant-leak-checks.md) - the relay tenant matrix's HTTP check asserts a definite outcome for each cross-tenant request, so it cannot pass by timing out or by an unexpected status
+- [The test inventory follows every branch selection](/quest/m4/test-inventory-followups.md) - `sh/gh/test-inventory.py` judges every check by the dispatcher branch its caller actually selects, including the cargo-fuzz caller check, the recipe-runs-tests check
+- [moq-uring's handle lifecycle tests cover the newly spawned queue and a woken close watcher](/quest/m4/uring-lifecycle-tests.md) - two regressions cover the shutdown paths moq-dev/moq#7309 added
+- [Watch tests wait for the change they expect](/quest/m4/watch-test-waits.md) - `js/watch` tests wait for the signal or state they assert on instead of a fixed number of event-loop yields, so they neither flake under load nor pass before the change happens
+- [JS eviction tests prove the eviction happened](/quest/m4/track-test-eviction-asserts.md) - `track.test.ts`'s eviction tests fail with eviction off
+- [Nightly runs zizmor's online workflow audits](/quest/m4/workflow-audit-followups.md) - nightly runs zizmor's online audits
+- [Browsers expose WebTransport receive credit](/quest/m4/browser-receive-credit.md) - condition: the page can tell how much credit an unread stream holds
+- [JS fastest-reader pacing](/quest/m4/js-fastest-reader.md) - `@moq/net` paces upstream groups by the fastest reader, once browsers allow it
+- [fMP4 import at 1-byte chunks is no slower than before](/quest/m4/fmp4-byte-chunk-perf.md) - bisect and fix or accept the ~19% slowdown at 1-byte chunks
+- [The relay bench reports io_uring pool size and RSS](/quest/m4/bench-uring-pool.md) - pool growth regressions show up in normal bench runs
+- [The bindings' TrackInfo docs list its real fields](/quest/m4/track-info-docs.md) - Swift, Kotlin and Dart stop naming ordering and latency budget on `TrackInfo`
+- [Kotlin dependencies live in a Gradle version catalog](/quest/m4/kt-version-catalog.md) - one catalog entry per library, so a Dependabot bump can't drag another along
+- [The dev shell builds Kotlin with Gradle 9](/quest/m4/kt-gradle-9.md) - `gradle_9` in the dev shell, so the Android target builds there
+- [A hung Python test fails instead of hanging the suite](/quest/m4/py-test-timeouts.md) - one pytest-timeout bound covers every `py/` test
+- [Chromium's Opus encoder stamps chunks from their input](/quest/m4/chromium-opus-timestamps.md) - waiting on Chromium; unlocks native `usedtx` for push-to-talk
diff --git a/quest/m2/aac-sbr-config.md b/quest/m4/aac-sbr-config.md
similarity index 100%
rename from quest/m2/aac-sbr-config.md
rename to quest/m4/aac-sbr-config.md
diff --git a/quest/m2/aec-tests.md b/quest/m4/aec-tests.md
similarity index 100%
rename from quest/m2/aec-tests.md
rename to quest/m4/aec-tests.md
diff --git a/quest/m2/announce-interest-memory.md b/quest/m4/announce-interest-memory.md
similarity index 93%
rename from quest/m2/announce-interest-memory.md
rename to quest/m4/announce-interest-memory.md
index 83673f3ac08..c4830f52ba6 100644
--- a/quest/m2/announce-interest-memory.md
+++ b/quest/m4/announce-interest-memory.md
@@ -35,5 +35,5 @@ Public API: none. Wire: none.
 
 ## Related
 
-- [Announced snapshots](/quest/m2/performance-survey/announced-snapshots.md) - the HTTP listing's copy of the same table
-- [Cluster routing](/quest/m1/cluster-routing/README.md) - reshapes the route table this walks
+- [Announced snapshots](/quest/m5/performance-survey/announced-snapshots.md) - the HTTP listing's copy of the same table
+- [Cluster routing](/quest/m2/cluster-routing/README.md) - reshapes the route table this walks
diff --git a/quest/m2/apple-sink-thread.md b/quest/m4/apple-sink-thread.md
similarity index 100%
rename from quest/m2/apple-sink-thread.md
rename to quest/m4/apple-sink-thread.md
diff --git a/quest/m2/archive-store-bench.md b/quest/m4/archive-store-bench.md
similarity index 100%
rename from quest/m2/archive-store-bench.md
rename to quest/m4/archive-store-bench.md
diff --git a/quest/m2/ashpd-maintained.md b/quest/m4/ashpd-maintained.md
similarity index 91%
rename from quest/m2/ashpd-maintained.md
rename to quest/m4/ashpd-maintained.md
index bd40d5d8276..91a6d9b33f2 100644
--- a/quest/m2/ashpd-maintained.md
+++ b/quest/m4/ashpd-maintained.md
@@ -20,4 +20,4 @@ adding a local fork.
 
 ## Related
 
-- [Dependency audit](/quest/m2/audit-deps.md) - recheck the rest of the dependency graph
+- [Dependency audit](/quest/m3/audit-deps.md) - recheck the rest of the dependency graph
diff --git a/quest/m2/askama-maintained.md b/quest/m4/askama-maintained.md
similarity index 85%
rename from quest/m2/askama-maintained.md
rename to quest/m4/askama-maintained.md
index 3b095495bf9..6d06a63a2bd 100644
--- a/quest/m2/askama-maintained.md
+++ b/quest/m4/askama-maintained.md
@@ -16,5 +16,5 @@ its template syntax. Verify binding generation after the upgrade.
 
 ## Related
 
-- [Dependency audit](/quest/m2/audit-deps.md) - recheck the rest of the dependency graph
-- [Switch to rust2's exporter](/quest/m2/ffi-exporter.md) - askama reaches the lock only through `uniffi_bindgen`, which that switch deletes
+- [Dependency audit](/quest/m3/audit-deps.md) - recheck the rest of the dependency graph
+- [Switch to rust2's exporter](/quest/m3/ffi-exporter.md) - askama reaches the lock only through `uniffi_bindgen`, which that switch deletes
diff --git a/quest/m2/audio-bufferbloat-av.md b/quest/m4/audio-bufferbloat-av.md
similarity index 97%
rename from quest/m2/audio-bufferbloat-av.md
rename to quest/m4/audio-bufferbloat-av.md
index 12caea622a3..7a0dbcf66aa 100644
--- a/quest/m2/audio-bufferbloat-av.md
+++ b/quest/m4/audio-bufferbloat-av.md
@@ -55,4 +55,4 @@ Public API: none. Wire: none.
 ## Related
 
 - [Audio jitter target](/quest/m1/audio-jitter-target/README.md) - the estimator whose budgets these rows extend
-- [ViSQOL grading](/quest/m2/audio-visqol.md) - adds a quality score to the same harness
+- [ViSQOL grading](/quest/m4/audio-visqol.md) - adds a quality score to the same harness
diff --git a/quest/m2/audio-visqol.md b/quest/m4/audio-visqol.md
similarity index 88%
rename from quest/m2/audio-visqol.md
rename to quest/m4/audio-visqol.md
index 28cc7a902cc..92a734fb869 100644
--- a/quest/m2/audio-visqol.md
+++ b/quest/m4/audio-visqol.md
@@ -23,7 +23,7 @@ Decided in planning (2026-10-20):
 - Per-row floors live in `budgets.json` and are enforced like the existing
   ceilings, measured from nightlies by the same rule. Native `pulse` floors
   stay report-only until [Audio outlives
-  video](/quest/m2/audio-bufferbloat-av.md) makes those rows enforceable.
+  video](/quest/m4/audio-bufferbloat-av.md) makes those rows enforceable.
 
 Recommendations:
 
@@ -43,6 +43,6 @@ Public API: none. Wire: none.
 
 ## Related
 
-- [Audio outlives video](/quest/m2/audio-bufferbloat-av.md) - the other extension of the same harness
-- [Opus backends](/quest/m2/audio-opus-backend.md) - a quality score is the evidence an implementation comparison needs
-- [Opus bandwidth grant](/quest/m2/2848-follow-the-bandwidth-grant-in-moq-audio-instead-of.md) - bitrate changes this score should track
+- [Audio outlives video](/quest/m4/audio-bufferbloat-av.md) - the other extension of the same harness
+- [Opus backends](/quest/m5/audio-opus-backend.md) - a quality score is the evidence an implementation comparison needs
+- [Opus bandwidth grant](/quest/m5/2848-follow-the-bandwidth-grant-in-moq-audio-instead-of.md) - bitrate changes this score should track
diff --git a/quest/m2/auth-drop-iroh.md b/quest/m4/auth-drop-iroh.md
similarity index 95%
rename from quest/m2/auth-drop-iroh.md
rename to quest/m4/auth-drop-iroh.md
index 9de43fbdf5c..348c45d0f68 100644
--- a/quest/m2/auth-drop-iroh.md
+++ b/quest/m4/auth-drop-iroh.md
@@ -27,4 +27,4 @@ the auth JSON contract loses the `iroh` transport value.
 
 ## Related
 
-- [The relay refuses a cluster peer it cannot dial](/quest/m2/relay-undialable-peers.md) - the other iroh leftover
+- [The relay refuses a cluster peer it cannot dial](/quest/m3/relay-undialable-peers.md) - the other iroh leftover
diff --git a/quest/m2/auth-drop-peer-grant.md b/quest/m4/auth-drop-peer-grant.md
similarity index 92%
rename from quest/m2/auth-drop-peer-grant.md
rename to quest/m4/auth-drop-peer-grant.md
index 63e971e1372..f0b002d7752 100644
--- a/quest/m2/auth-drop-peer-grant.md
+++ b/quest/m4/auth-drop-peer-grant.md
@@ -12,7 +12,7 @@ docs that mention them. No other crate uses them.
 
 Planned 2026-11-02 (maintainer, /quest-unblock): P2P trusts its peers, so
 relay-issued, key-bound peer grants are dropped until a real use case asks for
-per-peer scopes ([Signaling and policy](/quest/m2/p2p/signal.md) records why).
+per-peer scopes ([Signaling and policy](/quest/m4/p2p/signal.md) records why).
 The landed API has no consumer left. git history keeps it if a use case
 returns.
 
diff --git a/quest/m2/auth-session-index.md b/quest/m4/auth-session-index.md
similarity index 100%
rename from quest/m2/auth-session-index.md
rename to quest/m4/auth-session-index.md
diff --git a/quest/m2/bench-base-paired.md b/quest/m4/bench-base-paired.md
similarity index 100%
rename from quest/m2/bench-base-paired.md
rename to quest/m4/bench-base-paired.md
diff --git a/quest/m2/bench-epoch-pin.md b/quest/m4/bench-epoch-pin.md
similarity index 100%
rename from quest/m2/bench-epoch-pin.md
rename to quest/m4/bench-epoch-pin.md
diff --git a/quest/m2/bench-hygiene.md b/quest/m4/bench-hygiene.md
similarity index 100%
rename from quest/m2/bench-hygiene.md
rename to quest/m4/bench-hygiene.md
diff --git a/quest/m2/bench-latency-resolution.md b/quest/m4/bench-latency-resolution.md
similarity index 100%
rename from quest/m2/bench-latency-resolution.md
rename to quest/m4/bench-latency-resolution.md
diff --git a/quest/m2/bench-sources.md b/quest/m4/bench-sources.md
similarity index 100%
rename from quest/m2/bench-sources.md
rename to quest/m4/bench-sources.md
diff --git a/quest/m2/bench-transport-sweep.md b/quest/m4/bench-transport-sweep.md
similarity index 89%
rename from quest/m2/bench-transport-sweep.md
rename to quest/m4/bench-transport-sweep.md
index cf5f4ad0703..e732aa0f98b 100644
--- a/quest/m2/bench-transport-sweep.md
+++ b/quest/m4/bench-transport-sweep.md
@@ -23,5 +23,5 @@ Public API: none. Wire: none.
 
 ## Related
 
-- [Benchmark sources](/quest/m2/bench-sources.md) - feeds these series into the regression table
-- [QUIC on the sim](/quest/m2/quic-sim.md) - an in-memory QUIC link the sweep could reuse
+- [Benchmark sources](/quest/m4/bench-sources.md) - feeds these series into the regression table
+- [QUIC on the sim](/quest/m4/quic-sim.md) - an in-memory QUIC link the sweep could reuse
diff --git a/quest/m2/bench-uring-pool.md b/quest/m4/bench-uring-pool.md
similarity index 100%
rename from quest/m2/bench-uring-pool.md
rename to quest/m4/bench-uring-pool.md
diff --git a/quest/m2/browser-receive-credit.md b/quest/m4/browser-receive-credit.md
similarity index 94%
rename from quest/m2/browser-receive-credit.md
rename to quest/m4/browser-receive-credit.md
index 2f2c2a1fb06..1b50be79f38 100644
--- a/quest/m2/browser-receive-credit.md
+++ b/quest/m4/browser-receive-credit.md
@@ -3,7 +3,7 @@
 ## Goal
 
 WebTransport tells the page how much receive credit a stream it has stopped
-reading still holds, so [JS fastest-reader pacing](/quest/m2/js-fastest-reader.md)
+reading still holds, so [JS fastest-reader pacing](/quest/m4/js-fastest-reader.md)
 can pause groups safely. Delete this quest once the condition holds.
 
 ## Waiting
diff --git a/quest/m2/cache-fairness.md b/quest/m4/cache-fairness.md
similarity index 88%
rename from quest/m2/cache-fairness.md
rename to quest/m4/cache-fairness.md
index 14095ac3c41..0b6244fed00 100644
--- a/quest/m2/cache-fairness.md
+++ b/quest/m4/cache-fairness.md
@@ -32,7 +32,7 @@ limits (`rs/moq-relay/src/limits.rs`) bound each session, not a tenant's
 total across sessions.
 
 Decided 2026-10-28 (maintainer): measure first, then propose. Waits for
-[unbounded groups](/quest/m1/unbounded-groups/README.md), which bounds each
+[unbounded groups](/quest/m2/unbounded-groups/README.md), which bounds each
 group copy at a 32 MB tail and lets front eviction shed a live latest group, so
 the measurement runs against the final eviction rules. Show with a test
 whether a heavy tenant (many sessions and tracks, or a stopped publisher)
@@ -43,16 +43,16 @@ share, before building.
 
 Open, for the design: what keys a tenant, such as the grant root, which
 exists today. Pick the same key as
-[broadcast fairness](/quest/m2/broadcast-fairness.md)'s tenant keying.
+[broadcast fairness](/quest/m3/broadcast-fairness.md)'s tenant keying.
 
 Public API: likely a relay cache setting if per-tenant shares need a knob.
 Wire: none.
 
 ## Required
 
-- [Unbounded groups](/quest/m1/unbounded-groups/README.md) - each group copy holds a 32 MB tail and front eviction can shed a live latest group
+- [Unbounded groups](/quest/m2/unbounded-groups/README.md) - each group copy holds a 32 MB tail and front eviction can shed a live latest group
 
 ## Related
 
-- [Broadcast fairness](/quest/m2/broadcast-fairness.md) - the same tenant fair share on cluster links
-- [Receive pool](/quest/m2/receive-pool.md) - one per-worker budget covering receive credit and the cache
+- [Broadcast fairness](/quest/m3/broadcast-fairness.md) - the same tenant fair share on cluster links
+- [Receive pool](/quest/m5/receive-pool.md) - one per-worker budget covering receive credit and the cache
diff --git a/quest/m2/capture-wgc.md b/quest/m4/capture-wgc.md
similarity index 86%
rename from quest/m2/capture-wgc.md
rename to quest/m4/capture-wgc.md
index 5a25173cb09..f5be091f5a5 100644
--- a/quest/m2/capture-wgc.md
+++ b/quest/m4/capture-wgc.md
@@ -8,7 +8,7 @@ Windows CI has no desktop, so only the notification, pacing, startup, and
 selector logic run there. Fix any bug the matrix turns up.
 
 Out of scope: application capture and system audio, which stay in
-[Windows capture parity](/quest/m2/capture-windows.md).
+[Windows capture parity](/quest/m3/capture-windows.md).
 
 ## Plan
 
@@ -30,5 +30,5 @@ one monitor.
 
 ## Related
 
-- [Windows capture parity](/quest/m2/capture-windows.md) - app capture and system audio, which WGC does not answer
-- [Direct3D11 render import](/quest/m2/render-d3d11.md) - the other end of keeping Windows frames on the GPU
+- [Windows capture parity](/quest/m3/capture-windows.md) - app capture and system audio, which WGC does not answer
+- [Direct3D11 render import](/quest/m3/render-d3d11.md) - the other end of keeping Windows frames on the GPU
diff --git a/quest/m2/chromium-opus-timestamps.md b/quest/m4/chromium-opus-timestamps.md
similarity index 99%
rename from quest/m2/chromium-opus-timestamps.md
rename to quest/m4/chromium-opus-timestamps.md
index 653f724faa7..45975da2420 100644
--- a/quest/m2/chromium-opus-timestamps.md
+++ b/quest/m4/chromium-opus-timestamps.md
@@ -26,7 +26,7 @@ and closed by the maintainer for that reason.
 
 Decided 2026-11-04 (maintainer): file the Chromium bug
 ([chromium#581458361](https://issues.chromium.org/issues/581458361), Blink>Media>WebCodecs,
-submitted by the maintainer) and no spec issue; track it here in m2, since
+submitted by the maintainer) and no spec issue; track it here in m4, since
 push-to-talk works around it by gating silence before the encoder and stamping
 chunks from its own inputs, so nothing depends on this.
 
diff --git a/quest/m2/cli-catalog-updates.md b/quest/m4/cli-catalog-updates.md
similarity index 100%
rename from quest/m2/cli-catalog-updates.md
rename to quest/m4/cli-catalog-updates.md
diff --git a/quest/m2/crossbeam-pin-fence.md b/quest/m4/crossbeam-pin-fence.md
similarity index 100%
rename from quest/m2/crossbeam-pin-fence.md
rename to quest/m4/crossbeam-pin-fence.md
diff --git a/quest/m2/env-knobs.md b/quest/m4/env-knobs.md
similarity index 100%
rename from quest/m2/env-knobs.md
rename to quest/m4/env-knobs.md
diff --git a/quest/m2/fill-wait-cancel-test.md b/quest/m4/fill-wait-cancel-test.md
similarity index 100%
rename from quest/m2/fill-wait-cancel-test.md
rename to quest/m4/fill-wait-cancel-test.md
diff --git a/quest/m2/fmp4-byte-chunk-perf.md b/quest/m4/fmp4-byte-chunk-perf.md
similarity index 100%
rename from quest/m2/fmp4-byte-chunk-perf.md
rename to quest/m4/fmp4-byte-chunk-perf.md
diff --git a/quest/m2/format-gate-followups.md b/quest/m4/format-gate-followups.md
similarity index 100%
rename from quest/m2/format-gate-followups.md
rename to quest/m4/format-gate-followups.md
diff --git a/quest/m2/formatter-defaults.md b/quest/m4/formatter-defaults.md
similarity index 96%
rename from quest/m2/formatter-defaults.md
rename to quest/m4/formatter-defaults.md
index 9a091ccfc78..af3fcaa64e5 100644
--- a/quest/m2/formatter-defaults.md
+++ b/quest/m4/formatter-defaults.md
@@ -61,9 +61,9 @@ Decided with the maintainer on 2026-11-03:
 
 ## Required
 
-- [Wait for a stable bun lint](/quest/m3/bun-lint-release.md) - `bun lint`
+- [Wait for a stable bun lint](/quest/m5/bun-lint-release.md) - `bun lint`
   ships in a stable Bun that nixpkgs carries
 
 ## Related
 
-- [Typecheck with bun check](/quest/m2/bun-check.md) - the same Bun toolchain
+- [Typecheck with bun check](/quest/m3/bun-check.md) - the same Bun toolchain
diff --git a/quest/m2/gpu-encoder-death-test.md b/quest/m4/gpu-encoder-death-test.md
similarity index 100%
rename from quest/m2/gpu-encoder-death-test.md
rename to quest/m4/gpu-encoder-death-test.md
diff --git a/quest/m2/hls-follow-once.md b/quest/m4/hls-follow-once.md
similarity index 100%
rename from quest/m2/hls-follow-once.md
rename to quest/m4/hls-follow-once.md
diff --git a/quest/m2/hls-player-test.md b/quest/m4/hls-player-test.md
similarity index 100%
rename from quest/m2/hls-player-test.md
rename to quest/m4/hls-player-test.md
diff --git a/quest/m2/interop-bindings.md b/quest/m4/interop-bindings.md
similarity index 96%
rename from quest/m2/interop-bindings.md
rename to quest/m4/interop-bindings.md
index a579d278412..a052fc13318 100644
--- a/quest/m2/interop-bindings.md
+++ b/quest/m4/interop-bindings.md
@@ -36,4 +36,4 @@ Public API: none. Wire: none.
 
 ## Related
 
-- [Mobile completion](/quest/m2/mobile-completion.md) - the Swift and Kotlin bindings over Rust-owned capture
+- [Mobile completion](/quest/m3/mobile-completion.md) - the Swift and Kotlin bindings over Rust-owned capture
diff --git a/quest/m2/js-fastest-reader.md b/quest/m4/js-fastest-reader.md
similarity index 91%
rename from quest/m2/js-fastest-reader.md
rename to quest/m4/js-fastest-reader.md
index 9bf95ffa795..5e14a7c15f3 100644
--- a/quest/m2/js-fastest-reader.md
+++ b/quest/m4/js-fastest-reader.md
@@ -16,4 +16,4 @@ follows the browser, so one design covers both.
 
 ## Required
 
-- [Browsers expose WebTransport receive credit](/quest/m2/browser-receive-credit.md) - the page can tell how much credit an unread stream holds
+- [Browsers expose WebTransport receive credit](/quest/m4/browser-receive-credit.md) - the page can tell how much credit an unread stream holds
diff --git a/quest/m2/kio-tasks-waker-test.md b/quest/m4/kio-tasks-waker-test.md
similarity index 100%
rename from quest/m2/kio-tasks-waker-test.md
rename to quest/m4/kio-tasks-waker-test.md
diff --git a/quest/m2/kt-gradle-9.md b/quest/m4/kt-gradle-9.md
similarity index 100%
rename from quest/m2/kt-gradle-9.md
rename to quest/m4/kt-gradle-9.md
diff --git a/quest/m2/kt-version-catalog.md b/quest/m4/kt-version-catalog.md
similarity index 100%
rename from quest/m2/kt-version-catalog.md
rename to quest/m4/kt-version-catalog.md
diff --git a/quest/m2/lint-examples.md b/quest/m4/lint-examples.md
similarity index 100%
rename from quest/m2/lint-examples.md
rename to quest/m4/lint-examples.md
diff --git a/quest/m2/macos-browser-lane.md b/quest/m4/macos-browser-lane.md
similarity index 90%
rename from quest/m2/macos-browser-lane.md
rename to quest/m4/macos-browser-lane.md
index e24d4805da4..685d4208e6a 100644
--- a/quest/m2/macos-browser-lane.md
+++ b/quest/m4/macos-browser-lane.md
@@ -26,15 +26,15 @@ samples. Playwright's WebKit is not Safari, so it does not count.
   remote automation). If the page only needs to navigate and read a result,
   speak raw WebDriver rather than add a client dependency.
 - Build the Safari driving so the
-  [Safari WebTransport](/quest/m3/safari-webtransport.md) quest's Safari
+  [Safari WebTransport](/quest/m5/safari-webtransport.md) quest's Safari
   publisher can join this lane later.
 - Show that the lane fails with the fix's timestamp shift reverted. Record
   each browser's measured delay in the PR.
 
 ## Required
 
-- [js/publish corrects WebCodecs audio encoder priming](/quest/m2/webcodecs-priming.md) - the test this lane runs, which passes only once the fix lands
+- [js/publish corrects WebCodecs audio encoder priming](/quest/m3/webcodecs-priming.md) - the test this lane runs, which passes only once the fix lands
 
 ## Related
 
-- [Browser publishing paths under test](/quest/m2/publish-firefox.md) - the Linux Firefox lane this one parallels
+- [Browser publishing paths under test](/quest/m4/publish-firefox.md) - the Linux Firefox lane this one parallels
diff --git a/quest/m2/moqsrc-av-sync.md b/quest/m4/moqsrc-av-sync.md
similarity index 100%
rename from quest/m2/moqsrc-av-sync.md
rename to quest/m4/moqsrc-av-sync.md
diff --git a/quest/m2/moqsrc-reconnect-order.md b/quest/m4/moqsrc-reconnect-order.md
similarity index 100%
rename from quest/m2/moqsrc-reconnect-order.md
rename to quest/m4/moqsrc-reconnect-order.md
diff --git a/quest/m2/mutants.md b/quest/m4/mutants.md
similarity index 100%
rename from quest/m2/mutants.md
rename to quest/m4/mutants.md
diff --git a/quest/m2/mux-vr-ambisonic-fmp4.md b/quest/m4/mux-vr-ambisonic-fmp4.md
similarity index 100%
rename from quest/m2/mux-vr-ambisonic-fmp4.md
rename to quest/m4/mux-vr-ambisonic-fmp4.md
diff --git a/quest/m2/net-test-subscriber.md b/quest/m4/net-test-subscriber.md
similarity index 100%
rename from quest/m2/net-test-subscriber.md
rename to quest/m4/net-test-subscriber.md
diff --git a/quest/m2/nix-relay-peers-test.md b/quest/m4/nix-relay-peers-test.md
similarity index 95%
rename from quest/m2/nix-relay-peers-test.md
rename to quest/m4/nix-relay-peers-test.md
index 38c9b3af44d..f9884520cea 100644
--- a/quest/m2/nix-relay-peers-test.md
+++ b/quest/m4/nix-relay-peers-test.md
@@ -26,7 +26,7 @@ recommended.
   leave it out and say so.
 
 The string-to-list break needs a `MIGRATE.md` line; the
-[migration audit](/quest/m2/release/migrate-audit.md) handles it, not this
+[migration audit](/quest/m3/release/migrate-audit.md) handles it, not this
 quest.
 
 Public API: none. Wire: none.
diff --git a/quest/m2/p2p/README.md b/quest/m4/p2p/README.md
similarity index 90%
rename from quest/m2/p2p/README.md
rename to quest/m4/p2p/README.md
index 9df550b173c..ab012abe793 100644
--- a/quest/m2/p2p/README.md
+++ b/quest/m4/p2p/README.md
@@ -59,12 +59,12 @@ demand after a same-epoch handoff, except bounded overlap while validating a
 replacement. If a peer dies, drains, or was never reachable, the shared
 origin selects the best remaining eligible route. This is ordinary transport
 fallback; nothing TURN-shaped is built. Still-open delivery stalls
-are handled by [Route health](/quest/m2/route-health/README.md), only with a
+are handled by [Route health](/quest/m5/route-health/README.md), only with a
 matching explicit epoch. Epochless source changes restart instead of resume.
 
 The relay is the nearest STUN server a client can name, but this line takes
 ICE servers from the application and works with any. Decided 2026-10-08: the
-public STUN responder moved out of the [one-port](/quest/m2/one-port/README.md)
+public STUN responder moved out of the [one-port](/quest/m3/one-port/README.md)
 UDP demux into this line, since P2P is its only consumer. Decided 2026-10-13:
 [Relay STUN](/doc/bin/relay/config.md#stun) runs on its own configured port,
 off by default, and used only when the application lists it.
@@ -105,7 +105,7 @@ SCTP retransmits it. Decided 2026-10-08: the channel is always ordered, and
 unordered qmux was dropped. Receiver reassembly would exist only in the Rust
 qmux, so it could cover native pairs alone, and a native pair runs QUIC,
 whose streams are independent. The
-[harness](/quest/m2/p2p/harness.md) reports the stall so the cost stays
+[harness](/quest/m4/p2p/harness.md) reports the stall so the cost stays
 visible.
 
 Channel-per-stream is not planned. moq opens a stream per group, so it churns
@@ -114,7 +114,7 @@ channel, and has no reset code without a side channel.
 
 ### Routes and migration
 
-Routing is the [cluster routing line](/quest/m1/cluster-routing/README.md)'s:
+Routing is the [cluster routing line](/quest/m2/cluster-routing/README.md)'s:
 every session speaks per-node ROUTEs and path-less ANNOUNCEs, and the
 application priority followed by total cost picks the direct link or relay.
 
@@ -136,11 +136,11 @@ Decided 2026-10-13: priority then total cost selects among authorized routes;
 a direct connection does not always win. A watching tab never re-serves what
 it receives. Offloading a room of watchers is a local relay's job
 (`moq-cli --p2p` is the small one), which keeps warm and cold costs and cache-aware routing out of the
-protocol. [Peer route policy](/quest/m2/p2p/cost-scopes.md) sets the cost
+protocol. [Peer route policy](/quest/m4/p2p/cost-scopes.md) sets the cost
 knobs and defaults.
 
 Target the public `@moq/net` interface regardless of whether its
-[backend](/quest/m2/rs2ts-js.md) is handwritten or built from Rust.
+[backend](/quest/m5/rs2ts-js.md) is handwritten or built from Rust.
 Backend choice does not change the policy that watching tabs never re-serve.
 
 ### Risks
@@ -161,14 +161,14 @@ Extractor declaration checks, which analyze only published packages since
 
 ## Required
 
-- [Signaling and policy](/quest/m2/p2p/signal.md) - opted-in peers find each other under the prefix, the application picks who to dial, and the roster-size gate decides whether STUN is used
-- [Native pairs over ICE and QUIC](/quest/m2/p2p/native-quic.md) - two native peers connect through ICE, then `moq-quic` over the nominated path with fingerprints pinned from the offer
-- [moq-cli joins](/quest/m2/p2p/cli.md) - `--p2p` publishes a roster entry, dials native peers over ICE and QUIC, and serves browsers as a transit hop
-- [Peer route policy](/quest/m2/p2p/cost-scopes.md) - application priorities and total cost choose eligible routes, with epoch-aware handover
-- [Watch opts in](/quest/m2/p2p/watch.md) - one attribute turns it on in the demo and the watcher migrates to the best eligible route
-- [Harness](/quest/m2/p2p/harness.md) - the Playwright harness and the numbers behind every mapping decision
+- [Signaling and policy](/quest/m4/p2p/signal.md) - opted-in peers find each other under the prefix, the application picks who to dial, and the roster-size gate decides whether STUN is used
+- [Native pairs over ICE and QUIC](/quest/m4/p2p/native-quic.md) - two native peers connect through ICE, then `moq-quic` over the nominated path with fingerprints pinned from the offer
+- [moq-cli joins](/quest/m4/p2p/cli.md) - `--p2p` publishes a roster entry, dials native peers over ICE and QUIC, and serves browsers as a transit hop
+- [Peer route policy](/quest/m4/p2p/cost-scopes.md) - application priorities and total cost choose eligible routes, with epoch-aware handover
+- [Watch opts in](/quest/m4/p2p/watch.md) - one attribute turns it on in the demo and the watcher migrates to the best eligible route
+- [Harness](/quest/m4/p2p/harness.md) - the Playwright harness and the numbers behind every mapping decision
 
 ## Related
 
-- [Route health](/quest/m2/route-health/README.md) - epoch-only active/passive delivery recovery on selected connections
-- [E2EE](/quest/m2/e2ee/README.md) - what a peer would need if the token scope stopped being the trust boundary
+- [Route health](/quest/m5/route-health/README.md) - epoch-only active/passive delivery recovery on selected connections
+- [E2EE](/quest/m5/e2ee/README.md) - what a peer would need if the token scope stopped being the trust boundary
diff --git a/quest/m2/p2p/cli.md b/quest/m4/p2p/cli.md
similarity index 88%
rename from quest/m2/p2p/cli.md
rename to quest/m4/p2p/cli.md
index 2ad8969a151..a965979e7ce 100644
--- a/quest/m2/p2p/cli.md
+++ b/quest/m4/p2p/cli.md
@@ -4,7 +4,7 @@
 
 `moq-cli --p2p` publishes a roster entry on its relay session, advertises how
 it can be reached, dials other native peers over
-[ICE and QUIC](/quest/m2/p2p/native-quic.md), and accepts browsers over data channels as a transit hop between
+[ICE and QUIC](/quest/m4/p2p/native-quic.md), and accepts browsers over data channels as a transit hop between
 them and the relay. Its policy knobs mirror `@moq/p2p`.
 
 ## Plan
@@ -19,7 +19,7 @@ surface and per-connection priority/cost mirroring the application API; settle
 its concrete CLI shape before coding and update all invocations against --help.
 
 The roster entry mirrors the `info.json` schema from
-[signaling](/quest/m2/p2p/signal.md): the listener's LAN addresses as
+[signaling](/quest/m4/p2p/signal.md): the listener's LAN addresses as
 WebTransport URLs, ordered the way `mdns::Peer::urls` orders them, with the
 listener's certificate fingerprint. Use signaling's ordered-list shape and
 dialing order, confirmed in the quest audit, so multi-interface listeners
@@ -41,5 +41,5 @@ Docs: a "P2P" section in `doc/bin/cli.md` beside the LAN cluster one.
 
 ## Required
 
-- [Native pairs over ICE and QUIC](/quest/m2/p2p/native-quic.md) - the native-to-native path
-- [Signaling and policy](/quest/m2/p2p/signal.md) - the roster and offer schema this mirrors
+- [Native pairs over ICE and QUIC](/quest/m4/p2p/native-quic.md) - the native-to-native path
+- [Signaling and policy](/quest/m4/p2p/signal.md) - the roster and offer schema this mirrors
diff --git a/quest/m2/p2p/cost-scopes.md b/quest/m4/p2p/cost-scopes.md
similarity index 90%
rename from quest/m2/p2p/cost-scopes.md
rename to quest/m4/p2p/cost-scopes.md
index d6d1abfd6d3..1f777dc1e04 100644
--- a/quest/m2/p2p/cost-scopes.md
+++ b/quest/m4/p2p/cost-scopes.md
@@ -28,7 +28,7 @@ Decided 2026-10-13, replacing the unconditional direct-first policy:
   trusted, decided 2026-11-02 (maintainer, /quest-unblock)); switching between
   its CDN and direct copies resumes only across a matching explicit epoch.
   Which roster peer serves an announcement is the application's selection in
-  [Signaling and policy](/quest/m2/p2p/signal.md).
+  [Signaling and policy](/quest/m4/p2p/signal.md).
 - Matching explicit epochs permit shared logical-track resume. Different or
   missing epochs require Restart and fresh resolution. Keep CDN control and
   discovery while releasing its unused media demand after P2P handover.
@@ -47,10 +47,10 @@ in Peers and native configuration. Wire: none beyond shared routing and existing
 
 ## Required
 
-- [Routes and announces](/quest/m1/cluster-routing/routes/README.md) - route identities and route ordering
-- [Signaling and policy](/quest/m2/p2p/signal.md) - explicit application peer selection
-- [moq-cli joins](/quest/m2/p2p/cli.md) - matching native controls
+- [Routes and announces](/quest/m2/cluster-routing/routes/README.md) - route identities and route ordering
+- [Signaling and policy](/quest/m4/p2p/signal.md) - explicit application peer selection
+- [moq-cli joins](/quest/m4/p2p/cli.md) - matching native controls
 
 ## Related
 
-- [Route health](/quest/m2/route-health/README.md) - automatic epoch-only stalled-delivery recovery
+- [Route health](/quest/m5/route-health/README.md) - automatic epoch-only stalled-delivery recovery
diff --git a/quest/m2/p2p/harness.md b/quest/m4/p2p/harness.md
similarity index 90%
rename from quest/m2/p2p/harness.md
rename to quest/m4/p2p/harness.md
index 1e741419672..d24556b7935 100644
--- a/quest/m2/p2p/harness.md
+++ b/quest/m4/p2p/harness.md
@@ -33,8 +33,8 @@ full-mesh selection, roster churn, pending negotiations and cancellation.
 Report connection counts, signaling bytes, wakes, CPU and retained state;
 the STUN roster gate alone does not bound pairing. Verify the CDN control
 session survives peer handover while unused CDN payload demand stops.
-Real CDN/P2P route-health cases extend this harness from the m2
-[Route health](/quest/m2/route-health/README.md) line, not here.
+Real CDN/P2P route-health cases extend this harness from the m5
+[Route health](/quest/m5/route-health/README.md) line, not here.
 
 Metrics: sustained throughput ceiling, per-frame latency p50 and p99 from the
 timestamp `moq-bench` stamps into each keyframe (same host, so one clock),
@@ -49,5 +49,5 @@ points.
 
 ## Required
 
-- [moq-cli joins](/quest/m2/p2p/cli.md)
-- [Signaling and policy](/quest/m2/p2p/signal.md)
+- [moq-cli joins](/quest/m4/p2p/cli.md)
+- [Signaling and policy](/quest/m4/p2p/signal.md)
diff --git a/quest/m2/p2p/native-quic.md b/quest/m4/p2p/native-quic.md
similarity index 94%
rename from quest/m2/p2p/native-quic.md
rename to quest/m4/p2p/native-quic.md
index 3ad34b16e62..b8baaac4a31 100644
--- a/quest/m2/p2p/native-quic.md
+++ b/quest/m4/p2p/native-quic.md
@@ -23,7 +23,7 @@ Decided with the maintainer on 2026-10-13:
   are private to the data channel transport today, so move them into
   `moq-ice` rather than export them from `moq-tokio`. Decided 2026-10-30 (maintainer): `moq-ice`,
   the data-channel transport, and a vendored `is` all move into
-  `moq-webrtc` ([rename](/quest/m1/webrtc-rename.md)); take them from there.
+  `moq-webrtc` ([rename](/quest/m2/webrtc-rename.md)); take them from there.
 - QUIC is `moq-quic`, fed datagrams from the nominated pair.
 - Authentication: each side generates a self-signed certificate and sends
   its SHA-256 fingerprint in its offer or answer, as DTLS fingerprints ride
@@ -36,7 +36,7 @@ Decided with the maintainer on 2026-10-13:
   socket needs its own small policy over the same classifier.
 
 Roles are deterministic: the ICE controlling side is the QUIC client, so a
-simultaneous dial resolves the same way [signaling](/quest/m2/p2p/signal.md)
+simultaneous dial resolves the same way [signaling](/quest/m4/p2p/signal.md)
 resolves offers (the lower id wins). The offer and answer carry ICE
 credentials, the fingerprint, and candidates on the pair's `signal` track;
 settle the field names with signaling's schema, and add a roster field
@@ -60,9 +60,9 @@ independent QUIC streams here, so unordered reassembly would serve nobody.
 
 Tests: unit tests drive two agents and two `moq-quic` endpoints in memory
 with mocked time, covering nomination, a wrong fingerprint refused, and a
-consent-check failure closing the session. The [harness](/quest/m2/p2p/harness.md)
+consent-check failure closing the session. The [harness](/quest/m4/p2p/harness.md)
 covers LAN and NAT pairs between two `moq-cli --p2p` nodes.
 
 ## Required
 
-- [Signaling and policy](/quest/m2/p2p/signal.md) - the offer schema and roster this extends
+- [Signaling and policy](/quest/m4/p2p/signal.md) - the offer schema and roster this extends
diff --git a/quest/m2/p2p/signal.md b/quest/m4/p2p/signal.md
similarity index 95%
rename from quest/m2/p2p/signal.md
rename to quest/m4/p2p/signal.md
index b94cf7bd43d..e2db53633ce 100644
--- a/quest/m2/p2p/signal.md
+++ b/quest/m4/p2p/signal.md
@@ -12,7 +12,7 @@ size above which new negotiations stop using them. No new relay behavior.
 
 `Peers` in `@moq/p2p` takes the shared origin, a reconnect-safe handle to the
 relay connection's auth, and the policy knobs from the
-[questline README](/quest/m2/p2p/README.md): `enabled`, `prefix`,
+[questline README](/quest/m4/p2p/README.md): `enabled`, `prefix`,
 `iceServers`, `max`, `meta`, plus application-owned selection and per-connection
 priority/cost. Decided 2026-10-13: only explicitly selected peers are dialed;
 there is no default dial-all. Prefer a selected set/handle to a callback,
@@ -25,7 +25,7 @@ roster `<id>` (also the perfect-negotiation tiebreak) is its public key, like an
 iroh endpoint id. Nothing proves the key yet: peers are trusted (see Trust).
 Which roster peer serves an announce is the application's explicit selection;
 moq maps nothing automatically. The route-layer node id stays declared and
-unverified ([routes](/quest/m1/cluster-routing/routes/README.md)); if a use case
+unverified ([routes](/quest/m2/cluster-routing/routes/README.md)); if a use case
 needs provable identity or signing, moq-lite-07's route identity becomes a
 public key, independent of P2P. P2P identity planning and peer grants were
 dropped until a real use case asks for them. Switching between a CDN and a
@@ -35,10 +35,10 @@ Roster: each peer publishes `<prefix><id>` with an `info.json` snapshot track:
 the moq ALPNs it accepts, `webrtc: true`, the application's `meta`,
 and for native peers an optional WebTransport entry with an ordered list of
 URLs and the listener's certificate fingerprint, plus the field
-[native pairs](/quest/m2/p2p/native-quic.md) add for ICE+QUIC.
+[native pairs](/quest/m4/p2p/native-quic.md) add for ICE+QUIC.
 Decided in the quest audit: use a list so a native peer can advertise its
 reachable interfaces without choosing one for every browser. This quest
-owns the schema shared with [moq-cli](/quest/m2/p2p/cli.md).
+owns the schema shared with [moq-cli](/quest/m4/p2p/cli.md).
 
 Pairing follows explicit selection: pair broadcasts exist only for selected
 pairs. The application may still choose a full mesh, so measure that cost
diff --git a/quest/m2/p2p/watch.md b/quest/m4/p2p/watch.md
similarity index 79%
rename from quest/m2/p2p/watch.md
rename to quest/m4/p2p/watch.md
index 9399469c70d..467e16a4fc1 100644
--- a/quest/m2/p2p/watch.md
+++ b/quest/m4/p2p/watch.md
@@ -13,15 +13,15 @@ Publish `@moq/p2p` with its first application consumer in this quest. It is
 currently private and has no release script; the `test/p2p` harness uses its
 workspace source. Before its first workflow publish, a maintainer claims
 `@moq/p2p` on npm and JSR with a placeholder and attaches the `moq-dev/moq`
-trusted publisher, as [Claim new npm names](/quest/m2/release/npm-first-publish.md)
+trusted publisher, as [Claim new npm names](/quest/m3/release/npm-first-publish.md)
 does for the cut's packages.
 
 `moq-watch` and `moq-publish` gain a `p2p` attribute that constructs
 `Peers` on the shared connection's origin and its relay auth handle (see
-[Signaling and policy](/quest/m2/p2p/signal.md)), with the demo's ICE servers
+[Signaling and policy](/quest/m4/p2p/signal.md)), with the demo's ICE servers
 and a `max` from the page; `demo/web` exposes the toggle and an explicit application
 peer-selection policy. Enabling discovery alone must not dial every peer. The route pick is the
-origin's, under the rule from [Peer route policy](/quest/m2/p2p/cost-scopes.md):
+origin's, under the rule from [Peer route policy](/quest/m4/p2p/cost-scopes.md):
 application priority then total cost selects among eligible connections.
 The CDN session remains, but unused CDN payload demand is released. Same-epoch
 handover resumes; epochless source changes restart. A direct link need not win.
@@ -31,6 +31,6 @@ directly, and watcher tabs pulling from a `moq-cli --p2p` hop.
 
 ## Required
 
-- [Signaling and policy](/quest/m2/p2p/signal.md)
-- [moq-cli joins](/quest/m2/p2p/cli.md) - the native hop the second topology shows
-- [Peer route policy](/quest/m2/p2p/cost-scopes.md)
+- [Signaling and policy](/quest/m4/p2p/signal.md)
+- [moq-cli joins](/quest/m4/p2p/cli.md) - the native hop the second topology shows
+- [Peer route policy](/quest/m4/p2p/cost-scopes.md)
diff --git a/quest/m2/pcm-bulk-encode.md b/quest/m4/pcm-bulk-encode.md
similarity index 100%
rename from quest/m2/pcm-bulk-encode.md
rename to quest/m4/pcm-bulk-encode.md
diff --git a/quest/m2/peer-grant-bound.md b/quest/m4/peer-grant-bound.md
similarity index 94%
rename from quest/m2/peer-grant-bound.md
rename to quest/m4/peer-grant-bound.md
index db47bc0a0ef..d38d99bf979 100644
--- a/quest/m2/peer-grant-bound.md
+++ b/quest/m4/peer-grant-bound.md
@@ -7,7 +7,7 @@ in Rust and JS, including a regrant compared against the previous grant.
 Measure JS in a browser, not node or bun.
 
 Re-matching live routes after a regrant is out of scope; it is
-[its own quest](/quest/m2/regrant-route-recheck.md).
+[its own quest](/quest/m4/regrant-route-recheck.md).
 
 ## Plan
 
@@ -58,5 +58,5 @@ before and after.
 
 ## Related
 
-- [A regrant re-checks only the routes it can change](/quest/m2/regrant-route-recheck.md) - the route fan-out after a regrant, which this leaves alone; whichever lands second adapts to the other
-- [Fair share across broadcasts](/quest/m2/broadcast-fairness.md) - the other per-session CPU and bandwidth fairness concern
+- [A regrant re-checks only the routes it can change](/quest/m4/regrant-route-recheck.md) - the route fan-out after a regrant, which this leaves alone; whichever lands second adapts to the other
+- [Fair share across broadcasts](/quest/m3/broadcast-fairness.md) - the other per-session CPU and bandwidth fairness concern
diff --git a/quest/m2/perf/README.md b/quest/m4/perf/README.md
similarity index 83%
rename from quest/m2/perf/README.md
rename to quest/m4/perf/README.md
index a432fb77dd4..4832a17c49d 100644
--- a/quest/m2/perf/README.md
+++ b/quest/m4/perf/README.md
@@ -31,7 +31,7 @@ hot-path survey, so quests don't re-litigate them:
   one `origin::Producer` spans all workers, so a subscriber on worker B reads
   `kio::Lock` state written on worker A. These quests shrink that cost
   in place; they do not attempt per-worker model sharding, unless the
-  [kio channel contention](/quest/m2/perf/kio-channel-contention/README.md)
+  [kio channel contention](/quest/m4/perf/kio-channel-contention/README.md)
   spikes measure a win (decided 2026-10-14).
 - The batched write/read machinery (`frame::Buffer`, `write_frames`,
   the egress `Prefetch`) already exists in moq-net; egress is amortized,
@@ -66,11 +66,11 @@ delivered frame by about 5%; video's 1.5% drop was within noise. The remaining
 
 Decided 2026-10-14: kio channel contention ranks first. Its 215% lock wait on
 the default tokio runtime is the largest measured cost, and the lock-wait
-recipe it needs has shipped. It stays in m2, since m1 defers general
+recipe it needs has shipped. It stays in later work (m4), since the release defers general
 optimization.
 
 Decided 2026-10-22: the WebSocket and TCP stream transports join this line
-as the [Stream transports](/quest/m2/perf/stream/README.md) epic, ranked
+as the [Stream transports](/quest/m4/perf/stream/README.md) epic, ranked
 second, and the io_uring TCP line moves in from m3. io_uring pays far more
 for TCP than for UDP, so it no longer waits on fleet demand.
 
@@ -81,17 +81,17 @@ revisions on the same host and worker count, and profiles with
 
 ## Required
 
-- [kio channel contention](/quest/m2/perf/kio-channel-contention/README.md) - workers spend less time blocked on kio channel-state mutexes (up to 215% of worker CPU on chat at 16 tokio workers), via a version counter, per-thread spikes, and an append-only log
-- [Stream transports](/quest/m2/perf/stream/README.md) - qmux drives its own WebSocket and TCP sockets in one task, measured end to end, then serves them from the io_uring workers
-- [Relay allocations](/quest/m2/perf/relay-allocs.md) - fewer allocations per delivered frame, starting with per-stream session clones
-- [QUIC lock contention](/quest/m2/perf/quic-lock-contention.md) - a measured verdict on the tokio driver's connection-wide mutex and per-packet endpoint-to-connection hop, with levers built only on evidence
-- [Ingest batch](/quest/m2/perf/ingest-batch.md) - relay ingest pays one lock, wake, and clock read per burst of whole frames instead of per frame
-- [kio waiter costs](/quest/m2/perf/kio-waiter-costs.md) - long-lived waiters stop being rebuilt every poll, IETF fetch keeps one close watch per stream, and a short `kio::log` costs less
-- [Shard by default](/quest/m2/perf/shard-default.md) - a saturating shard sweep decides whether an unset `runtime.workers` runs one worker per core on Linux
-- [Mesh session cost](/quest/m2/perf/mesh-session-cost.md) - moq-net's per-session announce, route sync, and scope work drops, swept over sessions and announces
-- [Cluster route memory](/quest/m2/perf/cluster-route-memory.md) - a full-mesh cluster's ~3.7 KB per route per broadcast shrinks, and the in-memory hop is profiled
-- [Lock profiles find why switch records stop alternating](/quest/m2/perf/profile-lock-switches.md) - refusals stay strict and get a root cause, and lost records are sized and counted
-- [Small hot-path waste](/quest/m2/perf/hot-path-waste.md) - one track-name copy per lite subscription, no full-history `#drift` walk, and one header buffer per JS object
-- [Track-state reads skip when nothing changed](/quest/m2/perf/cursor-version-skip.md) - `Cursor::sync`, `probe` and `GroupExpiry` skip unchanged reads, then group reads move onto a Watch
-- [An idle TS export with a delay costs what one without does](/quest/m2/perf/ts-idle-jitter.md) - the jitter scan and memcmp stop leading the idle poll
-- [Fanout takes the route lock less](/quest/m2/perf/route-lock.md) - fewer than 41 route-lock acquisitions per fanout round
+- [kio channel contention](/quest/m4/perf/kio-channel-contention/README.md) - workers spend less time blocked on kio channel-state mutexes (up to 215% of worker CPU on chat at 16 tokio workers), via a version counter, per-thread spikes, and an append-only log
+- [Stream transports](/quest/m4/perf/stream/README.md) - qmux drives its own WebSocket and TCP sockets in one task, measured end to end, then serves them from the io_uring workers
+- [Relay allocations](/quest/m4/perf/relay-allocs.md) - fewer allocations per delivered frame, starting with per-stream session clones
+- [QUIC lock contention](/quest/m4/perf/quic-lock-contention.md) - a measured verdict on the tokio driver's connection-wide mutex and per-packet endpoint-to-connection hop, with levers built only on evidence
+- [Ingest batch](/quest/m4/perf/ingest-batch.md) - relay ingest pays one lock, wake, and clock read per burst of whole frames instead of per frame
+- [kio waiter costs](/quest/m4/perf/kio-waiter-costs.md) - long-lived waiters stop being rebuilt every poll, IETF fetch keeps one close watch per stream, and a short `kio::log` costs less
+- [Shard by default](/quest/m4/perf/shard-default.md) - a saturating shard sweep decides whether an unset `runtime.workers` runs one worker per core on Linux
+- [Mesh session cost](/quest/m4/perf/mesh-session-cost.md) - moq-net's per-session announce, route sync, and scope work drops, swept over sessions and announces
+- [Cluster route memory](/quest/m4/perf/cluster-route-memory.md) - a full-mesh cluster's ~3.7 KB per route per broadcast shrinks, and the in-memory hop is profiled
+- [Lock profiles find why switch records stop alternating](/quest/m4/perf/profile-lock-switches.md) - refusals stay strict and get a root cause, and lost records are sized and counted
+- [Small hot-path waste](/quest/m4/perf/hot-path-waste.md) - one track-name copy per lite subscription, no full-history `#drift` walk, and one header buffer per JS object
+- [Track-state reads skip when nothing changed](/quest/m4/perf/cursor-version-skip.md) - `Cursor::sync`, `probe` and `GroupExpiry` skip unchanged reads, then group reads move onto a Watch
+- [An idle TS export with a delay costs what one without does](/quest/m4/perf/ts-idle-jitter.md) - the jitter scan and memcmp stop leading the idle poll
+- [Fanout takes the route lock less](/quest/m4/perf/route-lock.md) - fewer than 41 route-lock acquisitions per fanout round
diff --git a/quest/m2/perf/cluster-route-memory.md b/quest/m4/perf/cluster-route-memory.md
similarity index 88%
rename from quest/m2/perf/cluster-route-memory.md
rename to quest/m4/perf/cluster-route-memory.md
index 83338f68e1b..0884261309e 100644
--- a/quest/m2/perf/cluster-route-memory.md
+++ b/quest/m4/perf/cluster-route-memory.md
@@ -13,13 +13,13 @@ From [moq-dev/moq#7534](https://github.com/moq-dev/moq/pull/7534) (the relay-per
 
 Decided 2026-11-01 (maintainer, follow-up planning after the 2026-11-01 /quest-afk run): m2, in the perf epic, one quest for the spikes' measurement follow-ups.
 
-- **Route memory.** #7534 meshed W origins over moq-lite-06 `memory` sessions, as dialed cluster peers do. Announce heap per broadcast went from 4.9 KB with one origin to 45 KB at 4 workers and 886 KB at 16 (240 routes, about 3.7 KB each), and allocations from 64 to 14,600; 10,000 broadcasts at 16 would hold about 9 GB. Real full-mesh relay clusters pay the same per route. Measure it on a relay cluster with the counting allocator (#7534's `rs/moq-relay/examples/spike_announce.rs` is in its prototype commit [`ddd8b04`](https://github.com/moq-dev/moq/commit/ddd8b042ab82c7a4d53957e31fe35942957b7dfb), not on `main`), break the 3.7 KB down by structure (origin route entry, per-session announce state, hop lists, cursors), and shrink what's duplicated per route. Check against [cluster routing](/quest/m1/cluster-routing/README.md)'s per-origin routes first, since they change what a route holds.
-- **Hop cost.** About 140 thousand user instructions per one-frame group across one in-memory hop; fanout's 64 subscribers spread over 15 hops raised user instructions 19%, while chat amortized it. Take a `cpu` profile of one hop and attribute it before fixing; a per-reader part belongs to [mesh session cost](/quest/m2/perf/mesh-session-cost.md), which owns the per-reader group cost.
-- **`bench-profile lock`**: moved to [its own quest](/quest/m2/perf/profile-lock-switches.md) on 2026-11-03 (maintainer, /quest-plan of the follow-ups from [moq-dev/moq#7742](https://github.com/moq-dev/moq/pull/7742)), which keeps refusing nonalternating switch records and finds their cause instead of tolerating them.
+- **Route memory.** #7534 meshed W origins over moq-lite-06 `memory` sessions, as dialed cluster peers do. Announce heap per broadcast went from 4.9 KB with one origin to 45 KB at 4 workers and 886 KB at 16 (240 routes, about 3.7 KB each), and allocations from 64 to 14,600; 10,000 broadcasts at 16 would hold about 9 GB. Real full-mesh relay clusters pay the same per route. Measure it on a relay cluster with the counting allocator (#7534's `rs/moq-relay/examples/spike_announce.rs` is in its prototype commit [`ddd8b04`](https://github.com/moq-dev/moq/commit/ddd8b042ab82c7a4d53957e31fe35942957b7dfb), not on `main`), break the 3.7 KB down by structure (origin route entry, per-session announce state, hop lists, cursors), and shrink what's duplicated per route. Check against [cluster routing](/quest/m2/cluster-routing/README.md)'s per-origin routes first, since they change what a route holds.
+- **Hop cost.** About 140 thousand user instructions per one-frame group across one in-memory hop; fanout's 64 subscribers spread over 15 hops raised user instructions 19%, while chat amortized it. Take a `cpu` profile of one hop and attribute it before fixing; a per-reader part belongs to [mesh session cost](/quest/m4/perf/mesh-session-cost.md), which owns the per-reader group cost.
+- **`bench-profile lock`**: moved to [its own quest](/quest/m4/perf/profile-lock-switches.md) on 2026-11-03 (maintainer, /quest-plan of the follow-ups from [moq-dev/moq#7742](https://github.com/moq-dev/moq/pull/7742)), which keeps refusing nonalternating switch records and finds their cause instead of tolerating them.
 
 Public API: none expected. Wire: none.
 
 ## Related
 
-- [kio channel contention](/quest/m2/perf/kio-channel-contention/README.md) - the epic both spikes reported to
-- [Announce interest streams share one route table](/quest/m2/announce-interest-memory.md) - the same per-stream announce state, from a subscriber's side
+- [kio channel contention](/quest/m4/perf/kio-channel-contention/README.md) - the epic both spikes reported to
+- [Announce interest streams share one route table](/quest/m4/announce-interest-memory.md) - the same per-stream announce state, from a subscriber's side
diff --git a/quest/m2/perf/cursor-version-skip.md b/quest/m4/perf/cursor-version-skip.md
similarity index 100%
rename from quest/m2/perf/cursor-version-skip.md
rename to quest/m4/perf/cursor-version-skip.md
diff --git a/quest/m2/perf/hot-path-waste.md b/quest/m4/perf/hot-path-waste.md
similarity index 97%
rename from quest/m2/perf/hot-path-waste.md
rename to quest/m4/perf/hot-path-waste.md
index 35f911a195a..0570b3fa944 100644
--- a/quest/m2/perf/hot-path-waste.md
+++ b/quest/m4/perf/hot-path-waste.md
@@ -22,4 +22,4 @@ Public API: none. Wire: none.
 
 ## Related
 
-- [Performance audit](/quest/m2/audit-perf.md) - finds the next round of these
+- [Performance audit](/quest/m3/audit-perf.md) - finds the next round of these
diff --git a/quest/m2/perf/ingest-batch.md b/quest/m4/perf/ingest-batch.md
similarity index 100%
rename from quest/m2/perf/ingest-batch.md
rename to quest/m4/perf/ingest-batch.md
diff --git a/quest/m2/perf/kio-channel-contention/README.md b/quest/m4/perf/kio-channel-contention/README.md
similarity index 98%
rename from quest/m2/perf/kio-channel-contention/README.md
rename to quest/m4/perf/kio-channel-contention/README.md
index 6e2f59d9168..fe20fbf04e9 100644
--- a/quest/m2/perf/kio-channel-contention/README.md
+++ b/quest/m4/perf/kio-channel-contention/README.md
@@ -112,7 +112,7 @@ Decided (maintainer, 2026-10-14):
   an append-only log primitive with front eviction
   (Append-only log (`kio::log`)), which
   much of moq-net could adopt
-  ([Log adoption](/quest/m2/perf/kio-channel-contention/log-adoption.md)).
+  ([Log adoption](/quest/m4/perf/kio-channel-contention/log-adoption.md)).
 - Rejected, so later sessions don't re-propose them:
   - Left-right (two copies, writer swaps the active one): before reusing the
     old copy the writer must see every reader leave it, an O(consumers) scan
@@ -137,7 +137,7 @@ Decided (maintainer, 2026-10-14, per-thread follow-up):
 
 - Per-worker sharding is no longer ruled out; two spikes decide. Both run on
   the thread-per-core workers (`--runtime-workers`, the default once
-  [Shard by default](/quest/m2/perf/shard-default.md) lands) and link workers over an
+  [Shard by default](/quest/m4/perf/shard-default.md) lands) and link workers over an
   in-memory transport (`moq_net::transport::memory`),
   never real QUIC. The replica spike replicates the data plane and shares
   announcements; the cluster spike shares nothing (both results below). A
@@ -220,7 +220,7 @@ landing the end-state storage once. So the log moved to m1, ahead of Front
 eviction, scoped to `GroupState`'s frames with the above as its expected
 win, and no longer waits on the spikes: they change how much it wins, not
 the storage Front eviction needs. `TrackState` arrival order moved to
-[Log adoption](/quest/m2/perf/kio-channel-contention/log-adoption.md), which
+[Log adoption](/quest/m4/perf/kio-channel-contention/log-adoption.md), which
 waited on them until both reported (below).
 A 2026-10-22 staging CDN chat profile (default tokio runtime, `f57c0aad`,
 DWARF stacks, 36% incomplete) put waiter registration at 1.97% self-time, the
@@ -433,7 +433,7 @@ The heap repeats across runs and grows with W squared: per worker it is
 a full mesh re-announces every route to every peer (not checked route by
 route). At 16 workers a relay with 10,000 broadcasts would hold about 9 GB of
 announce state that a shared origin holds in 49 MB.
-[Cluster route memory](/quest/m2/perf/cluster-route-memory.md) breaks that
+[Cluster route memory](/quest/m4/perf/cluster-route-memory.md) breaks that
 per-route state down and shrinks it, profiles the hop's group cost, and
 fixes the `bench-profile lock` failures both spikes hit.
 
@@ -454,7 +454,7 @@ Decided (maintainer, 2026-11-01, cluster spike):
   route it learned to every other peer, and hop chains prevent loops. How
   routes from outside the relay (other relays' peer links) reach every
   worker without re-announce is for the planning to settle.
-  [Routes and announces](/quest/m1/cluster-routing/routes/README.md) plans a
+  [Routes and announces](/quest/m2/cluster-routing/routes/README.md) plans a
   per-connection `proxy` preference (decided 2026-10-14, relays default on)
   that decides whether a connection is sent routes learned from other
   connections; a worker link with it off is this condition.
@@ -470,5 +470,5 @@ Decided (maintainer, 2026-11-01, cluster spike):
 
 ## Required
 
-- [Plan relay-per-thread on a worker mesh that never re-announces](/quest/m2/perf/kio-channel-contention/relay-per-thread.md) - measure no-re-announce, weigh it against per-track replicas, and decide whether log adoption waits on it
-- [Log adoption](/quest/m2/perf/kio-channel-contention/log-adoption.md) - the rest of moq-net's log-shaped state moves onto the log where it measures as a win
+- [Plan relay-per-thread on a worker mesh that never re-announces](/quest/m4/perf/kio-channel-contention/relay-per-thread.md) - measure no-re-announce, weigh it against per-track replicas, and decide whether log adoption waits on it
+- [Log adoption](/quest/m4/perf/kio-channel-contention/log-adoption.md) - the rest of moq-net's log-shaped state moves onto the log where it measures as a win
diff --git a/quest/m2/perf/kio-channel-contention/log-adoption.md b/quest/m4/perf/kio-channel-contention/log-adoption.md
similarity index 93%
rename from quest/m2/perf/kio-channel-contention/log-adoption.md
rename to quest/m4/perf/kio-channel-contention/log-adoption.md
index 365dd10817c..8a312564dad 100644
--- a/quest/m2/perf/kio-channel-contention/log-adoption.md
+++ b/quest/m4/perf/kio-channel-contention/log-adoption.md
@@ -19,13 +19,13 @@ stays on its mutex.
   per-thread sessions every consumer of a replica is on one thread, so its
   mutex is uncontended and a lock-free multi-reader log only pays off if the
   shared model survives. The replica spike (2026-11-01, in the
-  [epic](/quest/m2/perf/kio-channel-contention/README.md)) does not settle
+  [epic](/quest/m4/perf/kio-channel-contention/README.md)) does not settle
   it: replicas lose on low fan-out, so shared tracks would stay, and the
   shared track it keeps is still the most contended channel, with one reader
   per worker. Nor does the cluster spike (2026-11-01, same epic): a relay
   per thread took every channel's lock wait to zero, but its win is
   conditional on a worker mesh that never re-announces peer routes, which
-  [its plan](/quest/m2/perf/kio-channel-contention/relay-per-thread.md)
+  [its plan](/quest/m4/perf/kio-channel-contention/relay-per-thread.md)
   weighs, deciding whether adoption waits on it. If relay-per-thread lands, adoption is likely abandoned;
   until then the shared model stays.
 - Audit moq-net (and moq-relay's `critical.rs`) for other state that is
diff --git a/quest/m2/perf/kio-channel-contention/relay-per-thread.md b/quest/m4/perf/kio-channel-contention/relay-per-thread.md
similarity index 87%
rename from quest/m2/perf/kio-channel-contention/relay-per-thread.md
rename to quest/m4/perf/kio-channel-contention/relay-per-thread.md
index eaebd12b350..07a00d1a129 100644
--- a/quest/m2/perf/kio-channel-contention/relay-per-thread.md
+++ b/quest/m4/perf/kio-channel-contention/relay-per-thread.md
@@ -7,7 +7,7 @@ one cluster per worker thread linked by a mesh that never re-announces peer
 routes to peers. It weighs that design against the replica spike's
 per-track replicas, sets how routes from outside the relay reach every
 worker, measures announce state and propagation with no-re-announce, and
-decides whether [Log adoption](/quest/m2/perf/kio-channel-contention/log-adoption.md)
+decides whether [Log adoption](/quest/m4/perf/kio-channel-contention/log-adoption.md)
 waits on it.
 
 ## Plan
@@ -27,7 +27,7 @@ routes. The epic README holds both spikes' numbers.
   announce delay at 1 to 16 workers (the cluster spike's `spike_announce`
   table), plus the data-plane shapes (chat, fanout, video-heavy).
 - Settle how other relays' routes reach every worker without re-announce,
-  for example through [Routes and announces](/quest/m1/cluster-routing/routes/README.md)'
+  for example through [Routes and announces](/quest/m2/cluster-routing/routes/README.md)'
   per-connection `proxy` preference turned off on worker links.
 - Compare against the replica spike
   ([moq-dev/moq#7533](https://github.com/moq-dev/moq/pull/7533)): replicate
@@ -41,5 +41,5 @@ Public API: none (a plan). Wire: none.
 
 ## Related
 
-- [Cluster route memory](/quest/m2/perf/cluster-route-memory.md) - shrinks the per-route state a full mesh multiplies
-- [Shard by default](/quest/m2/perf/shard-default.md) - the thread-per-core workers this runs on
+- [Cluster route memory](/quest/m4/perf/cluster-route-memory.md) - shrinks the per-route state a full mesh multiplies
+- [Shard by default](/quest/m4/perf/shard-default.md) - the thread-per-core workers this runs on
diff --git a/quest/m2/perf/kio-waiter-costs.md b/quest/m4/perf/kio-waiter-costs.md
similarity index 97%
rename from quest/m2/perf/kio-waiter-costs.md
rename to quest/m4/perf/kio-waiter-costs.md
index 9945f393eda..a2c062a7959 100644
--- a/quest/m2/perf/kio-waiter-costs.md
+++ b/quest/m4/perf/kio-waiter-costs.md
@@ -24,4 +24,4 @@ Public API: none expected. Wire: none.
 
 ## Related
 
-- [kio channel contention](/quest/m2/perf/kio-channel-contention/README.md) - the append-only log design that would pay `kio::log`'s cost per stream
+- [kio channel contention](/quest/m4/perf/kio-channel-contention/README.md) - the append-only log design that would pay `kio::log`'s cost per stream
diff --git a/quest/m2/perf/mesh-session-cost.md b/quest/m4/perf/mesh-session-cost.md
similarity index 100%
rename from quest/m2/perf/mesh-session-cost.md
rename to quest/m4/perf/mesh-session-cost.md
diff --git a/quest/m2/perf/profile-lock-switches.md b/quest/m4/perf/profile-lock-switches.md
similarity index 93%
rename from quest/m2/perf/profile-lock-switches.md
rename to quest/m4/perf/profile-lock-switches.md
index a3e1c3ee5c8..f2c87d0894b 100644
--- a/quest/m2/perf/profile-lock-switches.md
+++ b/quest/m4/perf/profile-lock-switches.md
@@ -13,7 +13,7 @@ number lost is reported beside the result.
 Decided 2026-11-03 (maintainer, /quest-plan of the follow-ups from
 [moq-dev/moq#7742](https://github.com/moq-dev/moq/pull/7742)): milestone m2,
 in the perf epic. The `bench-profile lock` bullet moves here from
-[cluster route memory](/quest/m2/perf/cluster-route-memory.md), since it has
+[cluster route memory](/quest/m4/perf/cluster-route-memory.md), since it has
 nothing to do with route memory.
 
 - Decision prompt (maintainer, 2026-11-03): cluster-route-memory said to
@@ -28,7 +28,7 @@ nothing to do with route memory.
     other agent was running, so outside load is not an established cause.
   - [moq-dev/moq#7533](https://github.com/moq-dev/moq/pull/7533) could not
     record base chat at 16 workers.
-  - The [kio channel contention](/quest/m2/perf/kio-channel-contention/README.md)
+  - The [kio channel contention](/quest/m4/perf/kio-channel-contention/README.md)
     notes, and the log lock profile quest #7742 deleted, also record
     refusals.
 - Check: the refusal is at `bench/profile.py:131`, with its test at
diff --git a/quest/m2/perf/quic-lock-contention.md b/quest/m4/perf/quic-lock-contention.md
similarity index 94%
rename from quest/m2/perf/quic-lock-contention.md
rename to quest/m4/perf/quic-lock-contention.md
index 532ca883581..140b6f1b39b 100644
--- a/quest/m2/perf/quic-lock-contention.md
+++ b/quest/m4/perf/quic-lock-contention.md
@@ -40,7 +40,7 @@ Levers, only where the profile shows a cost:
   by the stream's flow-control window so backpressure is unchanged, and the
   connection task moves it into moq-quic under its own lock.
 - Dispatch a whole GRO batch per connection in one message, coordinated
-  with [the I/O boundary redesign](/quest/m2/quic-io-boundary.md), whose
+  with [the I/O boundary redesign](/quest/m5/quic-io-boundary.md), whose
   "one `handle` call takes a whole GRO batch" is the state-machine half.
 - Stream handles that carry a slab key instead of a `StreamId`, removing
   moq-quic's per-stream lookups (the driver's own maps are already gone,
@@ -64,5 +64,5 @@ staging queue and batch dispatch should need none.
 
 ## Related
 
-- [Relay egress profile](/quest/m2/quic-egress-profile.md) - the transmit side of the same path
-- [Relay allocations](/quest/m2/perf/relay-allocs.md) - the allocation profile of the same workload
+- [Relay egress profile](/quest/m5/quic-egress-profile.md) - the transmit side of the same path
+- [Relay allocations](/quest/m4/perf/relay-allocs.md) - the allocation profile of the same workload
diff --git a/quest/m2/perf/relay-allocs.md b/quest/m4/perf/relay-allocs.md
similarity index 100%
rename from quest/m2/perf/relay-allocs.md
rename to quest/m4/perf/relay-allocs.md
diff --git a/quest/m2/perf/route-lock.md b/quest/m4/perf/route-lock.md
similarity index 90%
rename from quest/m2/perf/route-lock.md
rename to quest/m4/perf/route-lock.md
index 2c5a66f467f..9f11250e7a3 100644
--- a/quest/m2/perf/route-lock.md
+++ b/quest/m4/perf/route-lock.md
@@ -11,4 +11,4 @@ lock's share of mutex wait falls.
 Planned 2026-11-01 (maintainer, follow-up planning after the 2026-11-01 /quest-complete run). Profile with `just bench-profile lock fanout`, and remove each acquisition
 that reads state already held. Also make `bench/profile.py lock` accept
 `tokio-rt-worker` threads, which #7493 flagged. `GroupExpiry::is_expired` is
-covered by [track-state reads](/quest/m2/perf/cursor-version-skip.md).
+covered by [track-state reads](/quest/m4/perf/cursor-version-skip.md).
diff --git a/quest/m2/perf/shard-default.md b/quest/m4/perf/shard-default.md
similarity index 96%
rename from quest/m2/perf/shard-default.md
rename to quest/m4/perf/shard-default.md
index 36147ec0581..a291a85498a 100644
--- a/quest/m2/perf/shard-default.md
+++ b/quest/m4/perf/shard-default.md
@@ -61,5 +61,5 @@ Update `doc/bin/relay/` for the default change.
 
 ## Related
 
-- [kio channel contention](/quest/m2/perf/kio-channel-contention/README.md) - its per-thread spikes run on the workers
-- [Performance survey](/quest/m2/performance-survey/README.md) - paired benchmark evidence and memory/settings controls
+- [kio channel contention](/quest/m4/perf/kio-channel-contention/README.md) - its per-thread spikes run on the workers
+- [Performance survey](/quest/m5/performance-survey/README.md) - paired benchmark evidence and memory/settings controls
diff --git a/quest/m2/perf/stream/README.md b/quest/m4/perf/stream/README.md
similarity index 95%
rename from quest/m2/perf/stream/README.md
rename to quest/m4/perf/stream/README.md
index 7da2ad43912..8e1dcb38003 100644
--- a/quest/m2/perf/stream/README.md
+++ b/quest/m4/perf/stream/README.md
@@ -96,7 +96,7 @@ Against the base, every case runs fewer: tcp 13-18%, tls 6-14%, ws 17-21%, and w
 1-13%, the smaller numbers at 16000 B where TLS dominates. Syscalls per message
 (strace, 16 sessions, 1024 B) stayed at about 2.55 on every transport.
 Instructions undercount tungstenite's zero-fill (`rep stos` is one instruction),
-so the [codec](/quest/m2/perf/stream/codec.md) gate must re-profile CPU time. Two
+so the [codec](/quest/m4/perf/stream/codec.md) gate must re-profile CPU time. Two
 paired relay runs (`chat` and `fanout` on `ws`, `wss`, `tcp`, `tls`) were
 inconclusive: the QUIC control, untouched by the driver, moved -8% to +25%, and
 most cases changed sign between runs. Only `tls` `fanout` rose in all six pairs
@@ -127,7 +127,7 @@ Decisions (2026-10-22), each with its reason:
   right. The before/after is still recorded.
 - **The ablation reuses the bench harness** rather than building a second
   one.
-- **Ranked second in m2/perf**, after kio channel contention, which is the
+- **Ranked second in m4/perf**, after kio channel contention, which is the
   largest cost measured so far.
 
 Decided 2026-10-31 (maintainer), in
@@ -145,11 +145,11 @@ Decided 2026-10-31 (maintainer), in
 
 ## Required
 
-- [Ring TCP ablation](/quest/m2/perf/stream/ablation.md) - measured ring TCP against tokio TCP under the qmux workload picks the mechanisms the port uses
-- [Ring TCP](/quest/m2/perf/stream/ring.md) - moq-uring serves TCP, and hyper (therefore axum) runs on it
-- [Relay listeners on the workers](/quest/m2/perf/stream/relay.md) - the relay's WebSocket, qmux TCP, and HTTP listeners run on the io_uring workers
-- [Codec](/quest/m2/perf/stream/codec.md) - qmux frames WebSocket itself and tungstenite leaves the tree, if the bench says it pays
+- [Ring TCP ablation](/quest/m4/perf/stream/ablation.md) - measured ring TCP against tokio TCP under the qmux workload picks the mechanisms the port uses
+- [Ring TCP](/quest/m4/perf/stream/ring.md) - moq-uring serves TCP, and hyper (therefore axum) runs on it
+- [Relay listeners on the workers](/quest/m4/perf/stream/relay.md) - the relay's WebSocket, qmux TCP, and HTTP listeners run on the io_uring workers
+- [Codec](/quest/m4/perf/stream/codec.md) - qmux frames WebSocket itself and tungstenite leaves the tree, if the bench says it pays
 
 ## Related
 
-- [WebSocket rate caps](/quest/m2/rate-websocket.md) - its IO wrapper sits under the protocol, on the socket the driver now owns
+- [WebSocket rate caps](/quest/m3/rate-websocket.md) - its IO wrapper sits under the protocol, on the socket the driver now owns
diff --git a/quest/m2/perf/stream/ablation.md b/quest/m4/perf/stream/ablation.md
similarity index 90%
rename from quest/m2/perf/stream/ablation.md
rename to quest/m4/perf/stream/ablation.md
index 701f6f3a10e..d2264b08ff8 100644
--- a/quest/m2/perf/stream/ablation.md
+++ b/quest/m4/perf/stream/ablation.md
@@ -4,7 +4,7 @@
 
 A written-down number comparing ring TCP against tokio TCP under the relay's
 actual stream workload, on the same hardware. It picks which ring mechanisms
-the [port](/quest/m2/perf/stream/ring.md) uses and records the expected win.
+the [port](/quest/m4/perf/stream/ring.md) uses and records the expected win.
 
 ## Plan
 
@@ -29,4 +29,4 @@ Vary at least:
 Record CPU per message, CPU per Gbps, syscalls per message, ring submissions
 and completions, and latency, in the same machine-readable form the UDP matrix
 uses. Attribute the gain (or its absence) to specific mechanisms, and record
-the result in the [epic](/quest/m2/perf/stream/README.md) README.
+the result in the [epic](/quest/m4/perf/stream/README.md) README.
diff --git a/quest/m2/perf/stream/codec.md b/quest/m4/perf/stream/codec.md
similarity index 97%
rename from quest/m2/perf/stream/codec.md
rename to quest/m4/perf/stream/codec.md
index 5455f8c631f..54f79ceb181 100644
--- a/quest/m2/perf/stream/codec.md
+++ b/quest/m4/perf/stream/codec.md
@@ -4,7 +4,7 @@
 
 qmux implements the RFC 6455 subset it uses, and tungstenite and
 tokio-tungstenite leave the dependency tree, but only if the stream
-transport bench (see the [epic](/quest/m2/perf/stream/README.md)) attributes a
+transport bench (see the [epic](/quest/m4/perf/stream/README.md)) attributes a
 material share of WebSocket CPU to tungstenite now that qmux's `Driver`
 owns the socket. If the bench shows no such share, delete this quest.
 
diff --git a/quest/m2/perf/stream/relay.md b/quest/m4/perf/stream/relay.md
similarity index 94%
rename from quest/m2/perf/stream/relay.md
rename to quest/m4/perf/stream/relay.md
index bf6e8e2c204..4612177b5e7 100644
--- a/quest/m2/perf/stream/relay.md
+++ b/quest/m4/perf/stream/relay.md
@@ -15,7 +15,7 @@ relay serves `listen`'s `tcp`/`unix` listeners beside it from the shared tokio
 runtime, through `init_streams` (`rs/moq-relay/src/relay.rs`). Move the TCP
 listeners onto the workers: each worker binds its own listener in the
 reuseport group and runs the router from
-[ring TCP](/quest/m2/perf/stream/ring.md) on it. A Unix socket has no reuseport
+[ring TCP](/quest/m4/perf/stream/ring.md) on it. A Unix socket has no reuseport
 group, so a `unix` listener keeps its one shared acceptor; the integration
 test covers it too.
 
@@ -41,5 +41,5 @@ worker.
 
 ## Required
 
-- [Ring TCP](/quest/m2/perf/stream/ring.md) - the module and adapters this
+- [Ring TCP](/quest/m4/perf/stream/ring.md) - the module and adapters this
   serves from
diff --git a/quest/m2/perf/stream/ring.md b/quest/m4/perf/stream/ring.md
similarity index 96%
rename from quest/m2/perf/stream/ring.md
rename to quest/m4/perf/stream/ring.md
index b4235004404..acb2c2d78c5 100644
--- a/quest/m2/perf/stream/ring.md
+++ b/quest/m4/perf/stream/ring.md
@@ -33,4 +33,4 @@ existing suite does.
 
 ## Required
 
-- [Ring TCP ablation](/quest/m2/perf/stream/ablation.md) - picks the mechanisms before the worker implementation starts
+- [Ring TCP ablation](/quest/m4/perf/stream/ablation.md) - picks the mechanisms before the worker implementation starts
diff --git a/quest/m2/perf/ts-idle-jitter.md b/quest/m4/perf/ts-idle-jitter.md
similarity index 100%
rename from quest/m2/perf/ts-idle-jitter.md
rename to quest/m4/perf/ts-idle-jitter.md
diff --git a/quest/m2/publish-firefox.md b/quest/m4/publish-firefox.md
similarity index 90%
rename from quest/m2/publish-firefox.md
rename to quest/m4/publish-firefox.md
index 08e17c74f60..caaabe4d7a5 100644
--- a/quest/m2/publish-firefox.md
+++ b/quest/m4/publish-firefox.md
@@ -13,7 +13,7 @@ production takes, and the fixture must take that path. Firefox 157 in
 Playwright 1.64 has no `MediaStreamTrackProcessor`, in a worker or on the
 window, and cannot transfer a `MediaStreamTrack`, so it always takes the
 `<video>` fallback. Chromium has no worker processor either, so no Playwright
-engine on Linux reaches the worker path; its coverage moved to the m3 Safari
+engine on Linux reaches the worker path; its coverage moved to the m5 Safari
 quest (decided 2026-10-30, see Related).
 
 What remains before the lane joins Nightly's `media-firefox` job:
@@ -33,9 +33,9 @@ What remains before the lane joins Nightly's `media-firefox` job:
   `.github/workflows/nightly.yml`.
 
 Playwright WebKit stays out, since Playwright's WebKit is not Safari. The
-[macOS browser lane](/quest/m2/macos-browser-lane.md) adds Chrome and Safari on
-macOS, and the m3 Safari work publishes from Safari there.
+[macOS browser lane](/quest/m4/macos-browser-lane.md) adds Chrome and Safari on
+macOS, and the m5 Safari work publishes from Safari there.
 
 ## Related
 
-- [Safari WebTransport](/quest/m3/safari-webtransport.md) - the later Safari lane, the only engine with the worker capture path
+- [Safari WebTransport](/quest/m5/safari-webtransport.md) - the later Safari lane, the only engine with the worker capture path
diff --git a/quest/m2/py-test-timeouts.md b/quest/m4/py-test-timeouts.md
similarity index 100%
rename from quest/m2/py-test-timeouts.md
rename to quest/m4/py-test-timeouts.md
diff --git a/quest/m2/qmux-02-subprotocols.md b/quest/m4/qmux-02-subprotocols.md
similarity index 96%
rename from quest/m2/qmux-02-subprotocols.md
rename to quest/m4/qmux-02-subprotocols.md
index 297ca86d5ca..aeaade9ede4 100644
--- a/quest/m2/qmux-02-subprotocols.md
+++ b/quest/m4/qmux-02-subprotocols.md
@@ -36,4 +36,4 @@ support it.
 
 ## Related
 
-- [Retire the web-transport JS qmux](/quest/m2/release/qmux-js-retire.md) - the old JS qmux publisher
+- [Retire the web-transport JS qmux](/quest/m3/release/qmux-js-retire.md) - the old JS qmux publisher
diff --git a/quest/m2/quic-dev-dep-path.md b/quest/m4/quic-dev-dep-path.md
similarity index 100%
rename from quest/m2/quic-dev-dep-path.md
rename to quest/m4/quic-dev-dep-path.md
diff --git a/quest/m2/quic-sim-mtu.md b/quest/m4/quic-sim-mtu.md
similarity index 96%
rename from quest/m2/quic-sim-mtu.md
rename to quest/m4/quic-sim-mtu.md
index 73ceca0041f..3bbe6299f44 100644
--- a/quest/m2/quic-sim-mtu.md
+++ b/quest/m4/quic-sim-mtu.md
@@ -35,4 +35,4 @@ Public API: none (test harness only). Wire: none.
 
 ## Related
 
-- [QUIC on the sim](/quest/m2/quic-sim.md) - reuses this `Pair` for MoQ sessions
+- [QUIC on the sim](/quest/m4/quic-sim.md) - reuses this `Pair` for MoQ sessions
diff --git a/quest/m2/quic-sim.md b/quest/m4/quic-sim.md
similarity index 96%
rename from quest/m2/quic-sim.md
rename to quest/m4/quic-sim.md
index e8b871edf95..1efe4d0ae12 100644
--- a/quest/m2/quic-sim.md
+++ b/quest/m4/quic-sim.md
@@ -40,4 +40,4 @@ queue is not evidence about congestion loss.
 
 ## Related
 
-- [Per-stream and per-datagram deadlines](/quest/m2/quic-deadline.md) - a consumer
+- [Per-stream and per-datagram deadlines](/quest/m5/quic-deadline.md) - a consumer
diff --git a/quest/m2/regrant-route-recheck.md b/quest/m4/regrant-route-recheck.md
similarity index 93%
rename from quest/m2/regrant-route-recheck.md
rename to quest/m4/regrant-route-recheck.md
index 65f0aa3b131..a9b64b4e29f 100644
--- a/quest/m2/regrant-route-recheck.md
+++ b/quest/m4/regrant-route-recheck.md
@@ -11,7 +11,7 @@ Found by [moq-dev/moq#7536](https://github.com/moq-dev/moq/pull/7536), which swe
 - filters every live route through `permitted` (a match against every member of the new permit) to find what the new grant revokes, and
 - when the grant grew, takes a fresh `origin.announced()` snapshot of every route under its prefix and matches each one it doesn't hold.
 
-So one `AUTH_OK` costs routes × members per stream, times K announce streams, a product none of [peer grant bound](/quest/m2/peer-grant-bound.md)'s options remove.
+So one `AUTH_OK` costs routes × members per stream, times K announce streams, a product none of [peer grant bound](/quest/m4/peer-grant-bound.md)'s options remove.
 
 Decided 2026-11-01 (maintainer, follow-up planning after the 2026-11-01 /quest-afk run): m2, its own quest beside the grant-algebra bound.
 
@@ -24,5 +24,5 @@ Public API: none. Wire: none.
 
 ## Related
 
-- [Bound peer grant processing by design](/quest/m2/peer-grant-bound.md) - may change the received-grant type this compares against; whichever lands second adapts
-- [Announce interest streams share one route table](/quest/m2/announce-interest-memory.md) - the per-stream route state that this walk reads
+- [Bound peer grant processing by design](/quest/m4/peer-grant-bound.md) - may change the received-grant type this compares against; whichever lands second adapts
+- [Announce interest streams share one route table](/quest/m4/announce-interest-memory.md) - the per-stream route state that this walk reads
diff --git a/quest/m2/relay-capped-credit-test.md b/quest/m4/relay-capped-credit-test.md
similarity index 100%
rename from quest/m2/relay-capped-credit-test.md
rename to quest/m4/relay-capped-credit-test.md
diff --git a/quest/m2/resume-redesign.md b/quest/m4/resume-redesign.md
similarity index 96%
rename from quest/m2/resume-redesign.md
rename to quest/m4/resume-redesign.md
index bccb84bb3ef..aca9318536d 100644
--- a/quest/m2/resume-redesign.md
+++ b/quest/m4/resume-redesign.md
@@ -73,7 +73,7 @@ b9398f7459, 68c73349a3). Session copies under a front must stop caching for
 themselves and only feed the logical track.
 
 Land it in Rust first, then mirror `js/net` unless
-[JS-only @moq/net](/quest/m2/rs2ts-js.md) has replaced it. Extend
+[JS-only @moq/net](/quest/m5/rs2ts-js.md) has replaced it. Extend
 `benches/origin.rs` with the reader times flap sweep before starting, to
 measure the change.
 
@@ -90,8 +90,8 @@ serving copy's upstream closed, followed by a read.
 
 ## Required
 
-- [Release cut](/quest/m2/release/cut.md) - wait for the release in flight to ship
+- [Release cut](/quest/m3/release/cut.md) - wait for the release in flight to ship
 
 ## Related
 
-- [Recover reads its budget without a sync](/quest/m2/recover-budget.md) - a per-frame cost this deletes
+- [Recover reads its budget without a sync](/quest/m5/recover-budget.md) - a per-frame cost this deletes
diff --git a/quest/m2/route-wakes.md b/quest/m4/route-wakes.md
similarity index 97%
rename from quest/m2/route-wakes.md
rename to quest/m4/route-wakes.md
index 3d4e23abeb1..98e8a571462 100644
--- a/quest/m2/route-wakes.md
+++ b/quest/m4/route-wakes.md
@@ -82,5 +82,5 @@ Public API: none. Wire: none.
 
 ## Related
 
-- [Routes and announces](/quest/m1/cluster-routing/routes/README.md) - the identity and selection views the index serves
-- [Front parking](/quest/m2/origin-front-parks.md) - replaces the `routed_broadcast` watch loop this wakes
+- [Routes and announces](/quest/m2/cluster-routing/routes/README.md) - the identity and selection views the index serves
+- [Front parking](/quest/m5/origin-front-parks.md) - replaces the `routed_broadcast` watch loop this wakes
diff --git a/quest/m2/scuffle-sps-bump.md b/quest/m4/scuffle-sps-bump.md
similarity index 100%
rename from quest/m2/scuffle-sps-bump.md
rename to quest/m4/scuffle-sps-bump.md
diff --git a/quest/m2/shaper-socket.md b/quest/m4/shaper-socket.md
similarity index 100%
rename from quest/m2/shaper-socket.md
rename to quest/m4/shaper-socket.md
diff --git a/quest/m2/shared-serve-js.md b/quest/m4/shared-serve-js.md
similarity index 86%
rename from quest/m2/shared-serve-js.md
rename to quest/m4/shared-serve-js.md
index 23ae8a0b6d2..361a1c05236 100644
--- a/quest/m2/shared-serve-js.md
+++ b/quest/m4/shared-serve-js.md
@@ -5,7 +5,7 @@
 In `js/net`, the moq-lite (`js/net/src/lite/`) and moq-transport
 (`js/net/src/ietf/`) sessions share one group serving path and one group
 ingest path, mirroring the Rust split from
-[Shared group serving and ingest](/quest/m2/shared-serve.md). Each wire plugs
+[Shared group serving and ingest](/quest/m4/shared-serve.md). Each wire plugs
 in only its own header and object or frame encoding. Behavior, wire, and
 public API are unchanged.
 
@@ -23,4 +23,4 @@ Public API: none. Wire: none.
 
 ## Required
 
-- [Shared group serving and ingest](/quest/m2/shared-serve.md) - the Rust seam this mirrors
+- [Shared group serving and ingest](/quest/m4/shared-serve.md) - the Rust seam this mirrors
diff --git a/quest/m2/shared-serve.md b/quest/m4/shared-serve.md
similarity index 93%
rename from quest/m2/shared-serve.md
rename to quest/m4/shared-serve.md
index f6e064893a7..42b682554f0 100644
--- a/quest/m2/shared-serve.md
+++ b/quest/m4/shared-serve.md
@@ -12,7 +12,7 @@ as `poll_given_up`, which is identical in `lite/publisher.rs` and
 `ietf/publisher.rs`.
 
 Non-goals: request lifecycles, announce handling, FETCH, and JS. JS is
-[its own quest](/quest/m2/shared-serve-js.md).
+[its own quest](/quest/m4/shared-serve-js.md).
 
 ## Plan
 
@@ -60,5 +60,5 @@ Public API: none. Wire: none.
 
 ## Related
 
-- [Shared group serving and ingest in JS](/quest/m2/shared-serve-js.md) - the JS mirror
-- [Perf](/quest/m2/perf/README.md) - hot-path work in the same machines
+- [Shared group serving and ingest in JS](/quest/m4/shared-serve-js.md) - the JS mirror
+- [Perf](/quest/m4/perf/README.md) - hot-path work in the same machines
diff --git a/quest/m2/sim-credit-open.md b/quest/m4/sim-credit-open.md
similarity index 100%
rename from quest/m2/sim-credit-open.md
rename to quest/m4/sim-credit-open.md
diff --git a/quest/m2/smoke-libressl.md b/quest/m4/smoke-libressl.md
similarity index 100%
rename from quest/m2/smoke-libressl.md
rename to quest/m4/smoke-libressl.md
diff --git a/quest/m2/sps-fuzz-h264-reader.md b/quest/m4/sps-fuzz-h264-reader.md
similarity index 100%
rename from quest/m2/sps-fuzz-h264-reader.md
rename to quest/m4/sps-fuzz-h264-reader.md
diff --git a/quest/m2/tenant-leak-checks.md b/quest/m4/tenant-leak-checks.md
similarity index 100%
rename from quest/m2/tenant-leak-checks.md
rename to quest/m4/tenant-leak-checks.md
diff --git a/quest/m2/test-inventory-followups.md b/quest/m4/test-inventory-followups.md
similarity index 100%
rename from quest/m2/test-inventory-followups.md
rename to quest/m4/test-inventory-followups.md
diff --git a/quest/m2/track-info-docs.md b/quest/m4/track-info-docs.md
similarity index 100%
rename from quest/m2/track-info-docs.md
rename to quest/m4/track-info-docs.md
diff --git a/quest/m2/track-test-eviction-asserts.md b/quest/m4/track-test-eviction-asserts.md
similarity index 100%
rename from quest/m2/track-test-eviction-asserts.md
rename to quest/m4/track-test-eviction-asserts.md
diff --git a/quest/m2/upstream-reports.md b/quest/m4/upstream-reports.md
similarity index 95%
rename from quest/m2/upstream-reports.md
rename to quest/m4/upstream-reports.md
index 787f3e85494..4a0328a525f 100644
--- a/quest/m2/upstream-reports.md
+++ b/quest/m4/upstream-reports.md
@@ -52,8 +52,8 @@ Approved to file (search for an existing report first):
 Not to be filed:
 
 - **str0m/dimpl:** the DTLS retry budget runs out before ICE picks a
-  path, found in #7379. The [WebRTC epic](/quest/m2/webrtc/README.md)
+  path, found in #7379. The [WebRTC epic](/quest/m3/webrtc/README.md)
   vendors str0m instead of reporting upstream, and
-  [DTLS waits for ICE](/quest/m2/webrtc/dtls-after-ice.md) fixes it there.
+  [DTLS waits for ICE](/quest/m3/webrtc/dtls-after-ice.md) fixes it there.
 
 Public API: none. Wire: none.
diff --git a/quest/m2/uring-bench-followups.md b/quest/m4/uring-bench-followups.md
similarity index 98%
rename from quest/m2/uring-bench-followups.md
rename to quest/m4/uring-bench-followups.md
index 4f56b2d56c6..ca2c57a1fe2 100644
--- a/quest/m2/uring-bench-followups.md
+++ b/quest/m4/uring-bench-followups.md
@@ -10,7 +10,7 @@ Follow-ups of [moq-dev/moq#7530](https://github.com/moq-dev/moq/pull/7530), whic
 
 Decided 2026-11-01 (maintainer, follow-up planning after the 2026-11-01 /quest-afk run): m2, one quest for both.
 
-- **Quiet re-run.** Record `/proc/loadavg` and run `just bench-runtime` for fanout and fanout-heavy, base against [moq-dev/moq#7530](https://github.com/moq-dev/moq/pull/7530), alternating. [moq-dev/moq#7533](https://github.com/moq-dev/moq/pull/7533) and [moq-dev/moq#7534](https://github.com/moq-dev/moq/pull/7534) saw the load generator's p99 sit near 1.4 s in every run, a startup artifact inside the throughput window, so check whether a quiet host alone fixes p99 or the generator's latency window needs to exclude startup first. Record the result in the [perf epic](/quest/m2/perf/README.md).
+- **Quiet re-run.** Record `/proc/loadavg` and run `just bench-runtime` for fanout and fanout-heavy, base against [moq-dev/moq#7530](https://github.com/moq-dev/moq/pull/7530), alternating. [moq-dev/moq#7533](https://github.com/moq-dev/moq/pull/7533) and [moq-dev/moq#7534](https://github.com/moq-dev/moq/pull/7534) saw the load generator's p99 sit near 1.4 s in every run, a startup artifact inside the throughput window, so check whether a quiet host alone fixes p99 or the generator's latency window needs to exclude startup first. Record the result in the [perf epic](/quest/m4/perf/README.md).
 The QUIC request-reply benchmark is now part of `worker_turns` in
 [moq-dev/moq#7530](https://github.com/moq-dev/moq/pull/7530). The nightly
 `rust-shared` group retains its timing series and turn/enter counter deltas in
diff --git a/quest/m2/uring-lifecycle-tests.md b/quest/m4/uring-lifecycle-tests.md
similarity index 100%
rename from quest/m2/uring-lifecycle-tests.md
rename to quest/m4/uring-lifecycle-tests.md
diff --git a/quest/m2/usage-settings-once.md b/quest/m4/usage-settings-once.md
similarity index 95%
rename from quest/m2/usage-settings-once.md
rename to quest/m4/usage-settings-once.md
index 853fffe7333..6034e0c96de 100644
--- a/quest/m2/usage-settings-once.md
+++ b/quest/m4/usage-settings-once.md
@@ -27,4 +27,4 @@ closing jdx/usage#1608).
 
 ## Related
 
-- [Upstream unknown-env option in usage-rs](/quest/m2/usage-unknown-env.md) - another jdx/usage ask; file both together if both are approved
+- [Upstream unknown-env option in usage-rs](/quest/m4/usage-unknown-env.md) - another jdx/usage ask; file both together if both are approved
diff --git a/quest/m2/usage-unknown-env.md b/quest/m4/usage-unknown-env.md
similarity index 100%
rename from quest/m2/usage-unknown-env.md
rename to quest/m4/usage-unknown-env.md
diff --git a/quest/m2/vaapi-render-tests.md b/quest/m4/vaapi-render-tests.md
similarity index 83%
rename from quest/m2/vaapi-render-tests.md
rename to quest/m4/vaapi-render-tests.md
index 4cfd598d698..428637ada0f 100644
--- a/quest/m2/vaapi-render-tests.md
+++ b/quest/m4/vaapi-render-tests.md
@@ -16,8 +16,8 @@ return early without a device today (`vaapi_h264_round_trip` and
 
 ## Plan
 
-Found by the m1 [coverage audit](/quest/m2/audit-test-coverage.md): no recipe
-or quest named these tests. The m0 run mapped them to [GPU CI](/quest/m2/gpu-ci.md),
+Found by the m1 [coverage audit](/quest/m3/audit-test-coverage.md): no recipe
+or quest named these tests. The m0 run mapped them to [GPU CI](/quest/m3/gpu-ci.md),
 which covers only NVIDIA.
 
 - `just rs gpu` already drives AMD and Intel through the flake's Mesa
@@ -32,17 +32,17 @@ which covers only NVIDIA.
   vendor) stays a skip that names it, outside the recipe's selection.
 - `packed_dmabuf_renders_through_vulkan` needs a PipeWire desktop as well;
   if the recipe cannot provide one, leave it to
-  [Video hardware validation](/quest/m3/video-hardware.md) and say so in its
+  [Video hardware validation](/quest/m5/video-hardware.md) and say so in its
   reason.
 - Added 2026-10-27 (maintainer) from the coverage audit: convert the
   early-return VA-API decode and transcode tests to
-  `#[ignore = "requires ..."]`, as [GPU CI](/quest/m2/gpu-ci.md) does for
+  `#[ignore = "requires ..."]`, as [GPU CI](/quest/m3/gpu-ci.md) does for
   NVIDIA's `hw_available`, so hosted CI reports them ignored and this
   recipe's filter selects them.
 - No hosted runner has these GPUs, so this stays a local recipe until a
-  GPU runner exists ([GPU CI](/quest/m2/gpu-ci.md) owns that decision).
+  GPU runner exists ([GPU CI](/quest/m3/gpu-ci.md) owns that decision).
 
 ## Related
 
-- [GPU CI](/quest/m2/gpu-ci.md) - the NVIDIA half of `just rs gpu`
-- [VA-API encodes an external Vulkan image](/quest/m2/vaapi-vulkan-import.md) - the encode side of the same VA-API surfaces
+- [GPU CI](/quest/m3/gpu-ci.md) - the NVIDIA half of `just rs gpu`
+- [VA-API encodes an external Vulkan image](/quest/m3/vaapi-vulkan-import.md) - the encode side of the same VA-API surfaces
diff --git a/quest/m2/watch-decode-gate.md b/quest/m4/watch-decode-gate.md
similarity index 94%
rename from quest/m2/watch-decode-gate.md
rename to quest/m4/watch-decode-gate.md
index 3fdb50d2d5d..8a73f039154 100644
--- a/quest/m2/watch-decode-gate.md
+++ b/quest/m4/watch-decode-gate.md
@@ -25,4 +25,4 @@ Public API: none. Wire: none.
 
 ## Required
 
-- [Watch worker](/quest/m2/watch-worker.md) - moves decode and `Sync` into a worker
+- [Watch worker](/quest/m3/watch-worker.md) - moves decode and `Sync` into a worker
diff --git a/quest/m2/watch-test-waits.md b/quest/m4/watch-test-waits.md
similarity index 100%
rename from quest/m2/watch-test-waits.md
rename to quest/m4/watch-test-waits.md
diff --git a/quest/m2/wire-fuzz-coverage.md b/quest/m4/wire-fuzz-coverage.md
similarity index 100%
rename from quest/m2/wire-fuzz-coverage.md
rename to quest/m4/wire-fuzz-coverage.md
diff --git a/quest/m2/workflow-audit-followups.md b/quest/m4/workflow-audit-followups.md
similarity index 96%
rename from quest/m2/workflow-audit-followups.md
rename to quest/m4/workflow-audit-followups.md
index e4c079ff079..a4f23bf41f9 100644
--- a/quest/m2/workflow-audit-followups.md
+++ b/quest/m4/workflow-audit-followups.md
@@ -29,7 +29,7 @@ caught by hand. actionlint 1.7.12 (the pinned dev shell's) already fails
 `just gh check` on both main and `release` for a duplicated key in a
 workflow job and in a local action's `action.yml` (checked 2026-10-31), so
 the gate would have refused them. The rest of the tracked YAML is not
-workflow code; the [formatter migration](/quest/m2/formatter-defaults.md) will
+workflow code; the [formatter migration](/quest/m4/formatter-defaults.md) will
 parse it.
 
 Public API: none. Wire: none.
diff --git a/quest/m3/2147-moq-video-10-bit-hevc-and-av1-support-in-the-nvidia-codec.md b/quest/m5/2147-moq-video-10-bit-hevc-and-av1-support-in-the-nvidia-codec.md
similarity index 81%
rename from quest/m3/2147-moq-video-10-bit-hevc-and-av1-support-in-the-nvidia-codec.md
rename to quest/m5/2147-moq-video-10-bit-hevc-and-av1-support-in-the-nvidia-codec.md
index ec39d036533..ddc97dd085a 100644
--- a/quest/m3/2147-moq-video-10-bit-hevc-and-av1-support-in-the-nvidia-codec.md
+++ b/quest/m5/2147-moq-video-10-bit-hevc-and-av1-support-in-the-nvidia-codec.md
@@ -9,7 +9,7 @@ catalog AV1 types already exist; do not reimplement them.
 ## Plan
 
 Decided in the 2026-09-30 audit: AV1 encoding split out to
-[NVENC AV1](/quest/m3/nvenc-av1.md), because it needs an Ada GPU and the only
+[NVENC AV1](/quest/m5/nvenc-av1.md), because it needs an Ada GPU and the only
 GPU CI host is an RTX 3070 Ti. Main10 stays here since that host can verify it.
 
 Decided 2026-10-08: moved to m3. No 10-bit encode pipeline or consumer
@@ -26,13 +26,13 @@ planned. Keep the NVIDIA backend optional and loaded at runtime.
 
 Validate decoded pixels, bit depth, profile, resource lifetime, drain, and
 refusal on unsupported devices. Wire fixtures and contract tests into CI, and
-run the hardware tests on the [GPU CI](/quest/m2/gpu-ci.md) host.
+run the hardware tests on the [GPU CI](/quest/m3/gpu-ci.md) host.
 
 Public API: additive capabilities on the extension points settled on main. Wire: existing
 codec signaling, with cross-language fixtures for any metadata change.
 
 ## Related
 
-- [GPU CI](/quest/m2/gpu-ci.md) - nightly NVIDIA hardware tests that would verify Main10
-- [NVENC AV1](/quest/m3/nvenc-av1.md) - the AV1 half of #2147, hardware-gated
-- [Codec coverage study](/quest/m3/video-codec-coverage.md) - measure optional software and other native backends separately
+- [GPU CI](/quest/m3/gpu-ci.md) - nightly NVIDIA hardware tests that would verify Main10
+- [NVENC AV1](/quest/m5/nvenc-av1.md) - the AV1 half of #2147, hardware-gated
+- [Codec coverage study](/quest/m5/video-codec-coverage.md) - measure optional software and other native backends separately
diff --git a/quest/m3/2279-hang-typed-scte-35-ad-cue-signaling-carried-opaquely.md b/quest/m5/2279-hang-typed-scte-35-ad-cue-signaling-carried-opaquely.md
similarity index 92%
rename from quest/m3/2279-hang-typed-scte-35-ad-cue-signaling-carried-opaquely.md
rename to quest/m5/2279-hang-typed-scte-35-ad-cue-signaling-carried-opaquely.md
index 2b587cfe77d..d29549d880e 100644
--- a/quest/m3/2279-hang-typed-scte-35-ad-cue-signaling-carried-opaquely.md
+++ b/quest/m5/2279-hang-typed-scte-35-ad-cue-signaling-carried-opaquely.md
@@ -11,7 +11,7 @@ exporter understands. Server-side ad insertion is a separate future quest.
 
 Deferred in the 2026-09-30 audit and moved to m3 in the 2026-10-05 audit: no named consumer for timed metadata.
 
-Use the shared event contract [emsg](/quest/m3/emsg.md) settles. Deliver cues immediately, including when splice_time is in the
+Use the shared event contract [emsg](/quest/m5/emsg.md) settles. Deliver cues immediately, including when splice_time is in the
 future; consumers need advance notification. Metadata group sequences are
 independent of media GOPs.
 
@@ -41,8 +41,8 @@ be in it the day it ships. Cross-package sync: `rs/hang`, `js/hang`,
 
 ## Required
 
-- [fMP4 emsg](/quest/m3/emsg.md) - settles the shared timed-metadata contract this builds on, which needs maintainer agreement first
+- [fMP4 emsg](/quest/m5/emsg.md) - settles the shared timed-metadata contract this builds on, which needs maintainer agreement first
 
 ## Related
 
-- [ID3 catalog section](/quest/m3/id3.md) - the other typed timed-metadata section, same rule
+- [ID3 catalog section](/quest/m5/id3.md) - the other typed timed-metadata section, same rule
diff --git a/quest/m2/2848-follow-the-bandwidth-grant-in-moq-audio-instead-of.md b/quest/m5/2848-follow-the-bandwidth-grant-in-moq-audio-instead-of.md
similarity index 100%
rename from quest/m2/2848-follow-the-bandwidth-grant-in-moq-audio-instead-of.md
rename to quest/m5/2848-follow-the-bandwidth-grant-in-moq-audio-instead-of.md
diff --git a/quest/m2/3199-moq-uring-remove-sq-indirection-and-per-enter-ring-fd.md b/quest/m5/3199-moq-uring-remove-sq-indirection-and-per-enter-ring-fd.md
similarity index 100%
rename from quest/m2/3199-moq-uring-remove-sq-indirection-and-per-enter-ring-fd.md
rename to quest/m5/3199-moq-uring-remove-sq-indirection-and-per-enter-ring-fd.md
diff --git a/quest/m2/3200-moq-uring-batch-completion-wakeups-with-min-timeout.md b/quest/m5/3200-moq-uring-batch-completion-wakeups-with-min-timeout.md
similarity index 100%
rename from quest/m2/3200-moq-uring-batch-completion-wakeups-with-min-timeout.md
rename to quest/m5/3200-moq-uring-batch-completion-wakeups-with-min-timeout.md
diff --git a/quest/m3/3201-moq-uring-use-sendmsg-zc-for-large-udp-gso-trains.md b/quest/m5/3201-moq-uring-use-sendmsg-zc-for-large-udp-gso-trains.md
similarity index 95%
rename from quest/m3/3201-moq-uring-use-sendmsg-zc-for-large-udp-gso-trains.md
rename to quest/m5/3201-moq-uring-use-sendmsg-zc-for-large-udp-gso-trains.md
index 4e0dfe42a9d..5bfae37c6e0 100644
--- a/quest/m3/3201-moq-uring-use-sendmsg-zc-for-large-udp-gso-trains.md
+++ b/quest/m5/3201-moq-uring-use-sendmsg-zc-for-large-udp-gso-trains.md
@@ -41,5 +41,5 @@ ships in no package.
 
 ## Required
 
-- [QUIC I/O boundary](/quest/m2/quic-io-boundary.md) - owns the transmit contract zero-copy sends build on
-- [A physical-NIC peer for the zero-copy sweep](/quest/m3/zero-copy-peer.md) - loopback only measures the forced copy
+- [QUIC I/O boundary](/quest/m5/quic-io-boundary.md) - owns the transmit contract zero-copy sends build on
+- [A physical-NIC peer for the zero-copy sweep](/quest/m5/zero-copy-peer.md) - loopback only measures the forced copy
diff --git a/quest/m3/3202-moq-uring-use-fixed-file-slots-for-worker-udp-sockets.md b/quest/m5/3202-moq-uring-use-fixed-file-slots-for-worker-udp-sockets.md
similarity index 100%
rename from quest/m3/3202-moq-uring-use-fixed-file-slots-for-worker-udp-sockets.md
rename to quest/m5/3202-moq-uring-use-fixed-file-slots-for-worker-udp-sockets.md
diff --git a/quest/m3/3204-moq-uring-register-tx-pool-buffers-for-zero-copy-sends.md b/quest/m5/3204-moq-uring-register-tx-pool-buffers-for-zero-copy-sends.md
similarity index 93%
rename from quest/m3/3204-moq-uring-register-tx-pool-buffers-for-zero-copy-sends.md
rename to quest/m5/3204-moq-uring-register-tx-pool-buffers-for-zero-copy-sends.md
index 3eb7626e221..2dd0d44b55f 100644
--- a/quest/m3/3204-moq-uring-register-tx-pool-buffers-for-zero-copy-sends.md
+++ b/quest/m5/3204-moq-uring-register-tx-pool-buffers-for-zero-copy-sends.md
@@ -19,7 +19,7 @@ disabled later attempts on that ring. #3224 also filled the SQE `buf_index`
 with a raw-SQE adapter because the `io-uring` crate did not expose it for
 this opcode; check the current crate first.
 
-The TX pool grows lazily, but its buffers are `Vec<u8>` handed out and returned by lease (`rs/moq-uring/src/udp.rs`), not permanently stable allocations; only the receive pool owns `Box<[u8]>`. Registration needs stable storage, so it follows the allocation and lease contract [the I/O boundary](/quest/m2/quic-io-boundary.md) settles. If zero-copy send wins, registering those allocations lets send SQEs reference fixed buffers and can reduce repeated page accounting on the large-train path.
+The TX pool grows lazily, but its buffers are `Vec<u8>` handed out and returned by lease (`rs/moq-uring/src/udp.rs`), not permanently stable allocations; only the receive pool owns `Box<[u8]>`. Registration needs stable storage, so it follows the allocation and lease contract [the I/O boundary](/quest/m5/quic-io-boundary.md) settles. If zero-copy send wins, registering those allocations lets send SQEs reference fixed buffers and can reduce repeated page accounting on the large-train path.
 
 #### Proposal
 
@@ -40,5 +40,5 @@ experiment it builds on moved to m3 too.
 
 ## Required
 
-- [QUIC I/O boundary](/quest/m2/quic-io-boundary.md) - owns the transmit contract; this quest owns registering its buffers
-- [#3201](/quest/m3/3201-moq-uring-use-sendmsg-zc-for-large-udp-gso-trains.md) - the zero-copy send experiment this extends
+- [QUIC I/O boundary](/quest/m5/quic-io-boundary.md) - owns the transmit contract; this quest owns registering its buffers
+- [#3201](/quest/m5/3201-moq-uring-use-sendmsg-zc-for-large-udp-gso-trains.md) - the zero-copy send experiment this extends
diff --git a/quest/m5/README.md b/quest/m5/README.md
new file mode 100644
index 00000000000..f9af65133f8
--- /dev/null
+++ b/quest/m5/README.md
@@ -0,0 +1,156 @@
+# m5: deferred
+
+## Goal
+
+Work that waits on something besides priority: either a first step outside
+this repository (hardware nobody on the team has, a partner or customer who
+asks for it, a hosting provider's offer, or an upstream release), or a
+speculative feature or study with no named consumer yet.
+
+## Plan
+
+A quest gated on the outside world has a condition quest beside it, as the
+root [questline](/quest/README.md) describes. A speculative feature or study
+with no consumer needs no condition quest: it parks here rather than in m3 or m4
+until a consumer appears, and is deleted when it goes stale; git history keeps
+it. Decided in the 2026-10-05 audit: both kinds live here, and the m2 quests
+deferred for having no named consumer moved here. The 2026-10-08 audit folded
+m4's upstream waits in here and moved m2 work with no consumer.
+
+Decided 2026-11-05 (maintainer, milestone re-cut): this milestone was m3 and
+is now m5, after m3 and m4 took the two halves of the old m2. The old m2's
+features, studies, and optimizations with no named consumer moved here, per
+the rule above, unless an m0 to m4 quest requires them. It stays the deferred
+bucket when milestones shift after a cut.
+
+Rate-grant work targets the next unpublished lite version after finalized
+lite-07; bitrate enforcement is not part of the next release.
+
+## Required
+
+- [Mesh over ICE](/quest/m5/mesh-ice.md) - mesh nodes on different networks connect directly through the P2P line's ICE pairs, once a mesh user needs it
+- [Video validation hardware is on hand](/quest/m5/video-hardware-access.md) - the machines the validation runs on, including a Raspberry Pi 4/5 for embedded presenting
+- [Video hardware validation](/quest/m5/video-hardware.md) - run the encode, capture, and zero-copy paths that were never run on real machines, including PipeWire on KDE, the camera portal, and a Pi
+- [An Ada NVIDIA GPU is available](/quest/m5/ada-gpu.md) - the hardware AV1 NVENC is verified on
+- [NVENC AV1](/quest/m5/nvenc-av1.md) - AV1 encode through NVENC, once an Ada-generation GPU is available
+- [#2147](/quest/m5/2147-moq-video-10-bit-hevc-and-av1-support-in-the-nvidia-codec.md) - NVIDIA Main10 encode, once a 10-bit source exists in the pipeline
+- [NVDEC and NVENC share CUDA arrays](/quest/m5/nvenc-cuda-arrays.md) - SDK 13.1 application-owned CUDA arrays drop the per-frame device copy, on driver 610+
+- [Embedded video](/quest/m5/video-embedded.md) - verify a Pi 4/5 presents through the existing Vulkan and CPU paths, adding EGL import only if that fails
+- [Multi-plane PipeWire cameras](/quest/m5/pipewire-camera-planes.md) - I420 and NV12 cameras that deliver one memory block per plane capture
+- [Video codec coverage](/quest/m5/video-codec-coverage.md) - prioritize remaining native AV1 and portable decoder gaps once a consumer asks
+- [A physical-NIC peer for the zero-copy sweep](/quest/m5/zero-copy-peer.md) - the rig the zero-copy sweep runs on
+- [#3201: moq-uring: use SENDMSG_ZC for large UDP GSO trains](/quest/m5/3201-moq-uring-use-sendmsg-zc-for-large-udp-gso-trains.md) - complete the prerequisite issue first
+- [#3204](/quest/m5/3204-moq-uring-register-tx-pool-buffers-for-zero-copy-sends.md) - moq-uring: register TX-pool buffers for zero-copy sends
+- [Cluster dials on the ring](/quest/m5/uring-cluster-dial.md) - measure whether an io_uring relay's outbound cluster links belong on its workers
+- [#3202](/quest/m5/3202-moq-uring-use-fixed-file-slots-for-worker-udp-sockets.md) - moq-uring: fixed-file slots for worker UDP sockets, if its own benchmark measures a win
+- [L4S on the backbone](/quest/m5/quic-ecn.md) - an ECT(1) option in `moq-quic`, an `ecn` config knob, and a dualpi2 measurement, if the ECN measurement says marks survive
+- [Careful resume on reconnect](/quest/m5/quic-careful-resume.md) - a Rust redial starts at the previous connection's rate
+- [Cut-through](/quest/m5/cut-through/README.md) - a bufferbloat bench decides whether a relay should forward bytes behind a QUIC stream hole; the build is re-planned if it says go
+- [Byte streams in moq-ffi](/quest/m5/ffi-stream.md) - Swift and Kotlin dial and accept byte streams, for moq.pro's T3 Code mobile client
+- [E2EE in moq-ffi](/quest/m5/ffi-e2ee.md) - Swift and Kotlin publish and consume protected broadcasts, for the same client
+- [Unreal prototype](/quest/m5/unreal.md) - a UE5 module on the C++ package with exceptions disabled, rendering a subscribed broadcast to a texture
+- [vcpkg registry](/quest/m5/cpp-vcpkg.md) - a registry we own serves the prebuilt package to `vcpkg` manifests, once a consumer asks
+- [Conan remote](/quest/m5/cpp-conan.md) - a remote we own serves the same tarball to `conan install`
+- [Linux OBS GPU input](/quest/m5/obs-linux-gpu.md) - publish OBS compositor frames without CPU readback on a validated Linux graphics/encoder combination
+- [Routing cost domains](/quest/m5/routing-cost-domains.md) - design operator boundaries and policy without adding incomparable costs
+- [Request tokens beyond Rust](/quest/m5/request-token-surfaces.md) - a JS, moq-ffi, or moq-cli request-token API, built only for the surface a consumer names
+- [Token on FETCH](/quest/m5/auth-token-fetch.md) - our TRACK_STATUS and FETCH carry the request token, once a consumer asks
+- [moq-transport cluster peers](/quest/m5/ietf-cluster-peers.md) - the cluster draft carries the route layer, so moq-transport relays peer again, once a moq-transport relay operator asks
+- [The moq.pro mesh runs lite-07](/quest/m5/lite07-mesh.md) - the deployment that makes the exemption dead code
+- [Drop the hidden cluster exemption](/quest/m5/hidden-exemption.md) - relays stop forcing hidden broadcasts on cluster peers once every peer opts in on the wire
+- [Robot teleoperation primitive](/quest/m5/teleop-robot.md) - a `moq-robot` crate for video down and control up, once a robotics consumer appears
+- [Operator arbitration](/quest/m5/teleop-arbitration.md) - one operator holds control at a time
+- [MAVLink bridge](/quest/m5/teleop-mavlink.md) - a `moq-mavlink` gateway
+  replacing the VPN plus two unmanaged UDP flows, with QGroundControl and
+  friends unchanged
+- [SITL proof and browser ground station](/quest/m5/teleop-proof.md) - ArduPilot
+  SITL and a synthetic camera flown from a browser ground station, reproducible
+  in five minutes
+- [Ladder](/quest/m5/ladder/README.md) - a transcode ladder adapts to the uplink it publishes over, instead of encoding every live rung at its ceiling
+- [fMP4 emsg](/quest/m5/emsg.md) - settles the shared framing and missing-data semantics before this section adopts them
+- [ID3 catalog section](/quest/m5/id3.md) - timed ID3 as a first-class container-neutral catalog section
+- [FLV script tags](/quest/m5/flv-script.md) - onMetaData and AMF data messages survive RTMP and FLV import
+- [Half and quarter rate AC-3](/quest/m5/ac3-low-rate.md) - bsid 9 and 10 AC-3 parse through TS and FLV instead of being refused
+- [MSF feedback tracks](/quest/m5/msf-publish-tracks.md) - `--report` and `--echo` work under `--catalog-format msf` through `publishTracks`, once a consumer asks
+- [MSFTS convergence](/quest/m5/msfts-convergence.md) - the demultiplexed TS lane converges on MSFTS where they differ, once an MSFTS implementer engages
+- [#2279](/quest/m5/2279-hang-typed-scte-35-ad-cue-signaling-carried-opaquely.md) - hang: SCTE-35 cues arrive immediately on an independent metadata track, optionally associated with a rendition
+- [CEA-608/708](/quest/m5/captions-cea.md) - captions carried inside video SEI become a real text rendition at import
+- [WebXR playback](/quest/m5/watch-webxr.md) - `<moq-watch>` renders equirectangular and stereo renditions through WebXR layers on a headset
+- [Protected playback in the browser](/quest/m5/drm-playback.md) - `<moq-watch>` plays CENC renditions through MSE and EME, once a consumer asks
+- [Paced replay](/quest/m5/archive-paced-replay.md) - an archive consumer pushes stored groups to live subscribers on one shared clock, so any live player plays it
+- [Encoder feedback](/quest/m5/stats-encoder-feedback.md) - a Rust encoder
+  reads its viewers' feedback and adapts its bitrate
+- [Interop runner withdraws before disconnecting](/quest/m5/interop-runner-approval.md) - condition: a released moq-tokio and @moq/net carry close() withdrawals; then the runner's moq.dev clients switch to close()
+- [Safari ships the WebKit 319818 fix](/quest/m5/webkit-319818.md) - the Safari release the gate admits
+- [Safari WebTransport](/quest/m5/safari-webtransport.md) - WebKit browsers return to WebTransport once WebKit 319818 ships fixed
+- [moq-video in the browser](/quest/m5/video-web.md) - getUserMedia, getDisplayMedia, WebCodecs, and VideoFrame import into wgpu, for moq-dev/studio's web studio
+- [moq-audio in the browser](/quest/m5/audio-web.md) - AudioWorklet capture and playback and WebCodecs Opus and AAC, for the web studio's audio
+- [moq-audio filter chain](/quest/m5/audio-filters.md) - per-source suppression, gate, compressor, limiter, ducking, and plugins, which moq-dev/studio configures
+- [Mesh keys](/quest/m5/mesh-keys.md) - parked: encrypted and HMAC-authenticated mesh broadcasts through a wrapped `.keys` track
+- [rust2-ts reaches moq-net's model](/quest/m5/rs2ts-model-ready.md) - rust2's translator is ready to translate the model
+- [Keep moq-net's model in rust2-ts's subset](/quest/m5/rs2ts-model-subset.md) - safe twins for the model's internal `unsafe`, `dyn Expiry` as an enum, once rust2-ts reaches the model
+- [Wait for a stable bun lint](/quest/m5/bun-lint-release.md) - condition: `bun lint` ships in a stable Bun that nixpkgs carries
+- [Rust and JS end a lite-05 track the same way after an inclusive SUBSCRIBE_END](/quest/m5/lite05-subscribe-end.md) - after a legacy inclusive SUBSCRIBE_END, Rust and JS both end the track instead of Rust sending a FIN and JS only releasing
+- [Byte-at-a-time MKV input imports as fast as chunked input](/quest/m5/mkv-input-coalesce.md) - the MKV importer fed one byte at a time is no slower than before moq-dev/moq#7234
+- [A transcode ladder probes an unseen source shape without stalling its other rungs](/quest/m5/transcode-parallel-open.md) - a source changing to an unseen size opens the new encoders without stalling the ladder's other rungs
+- [rind-instant-acme is on crates.io](/quest/m5/rind-instant-acme.md) - waiting on instant-acme 0.9 and rind publishing its adapter
+- [Relay ACME on instant-acme](/quest/m5/relay-acme.md) - moq-relay's ACME returns on instant-acme and rind, once a user needs it
+- [Announce credit](/quest/m5/announce-credit.md) - a subscriber bounds an Announce Stream's routes with credit at the wire, so a path flood never closes a session
+- [A C origin can discover eagerly, like a relay](/quest/m5/c-origin-relay.md) - the C API puts an origin in relay mode, so forwarding a client session's routes needs no local announce watcher
+- [Native compression flush](/quest/m5/native-compression-flush.md) - report the per-frame nonfinal flush requirement in existing browser discussions
+- [Native synchronous codecs](/quest/m5/native-compression-sync.md) - report the stateful small-frame synchronous API requirement
+- [Native browser codecs](/quest/m5/native-compression-adopt.md) - adopt native operations when timing, frame and resource contracts hold
+- [AudioToolbox encode](/quest/m5/audio-encode-audiotoolbox.md) - macOS and iOS encode AAC-LC
+- [Vendor-free CARLA bridge](/quest/m5/carla-bridge.md) - the CARLA demo's GPU bridge lets moq-video pick the encoder, and its stand-in test runs on AMD as well as NVIDIA
+- [Performance survey follow-ups](/quest/m5/performance-survey/README.md) - benchmark the source audit's transport, browser, media and serving risks before optimizing
+- [Receive pool](/quest/m5/receive-pool.md) - one byte budget per worker covers every connection's receive credit and the cache, billing each frame once
+- [Front parking](/quest/m5/origin-front-parks.md) - an unroutable request waits on a front instead of re-asking on every route-table move
+- [A route stream's interest is a set of prefixes](/quest/m5/route-interest-prefixes.md) - one Announce Stream covers several subtrees, with floors and certification proved over the set
+- [A socket dial learns its peer is behind an older hop](/quest/m5/socket-old-hop-signal.md) - a relay finds the dialed endpoint behind its older moq-lite session and marks that path, so the dial fails `Unsupported` while one to an absent peer still waits
+- [Fewer allocations in announce fan-out](/quest/m5/announce-fanout-allocs.md) - a deep path costs no more allocations per subscriber than a shallow one
+- [moq-room scales to large rooms](/quest/m5/room-bench.md) - a benchmark measures `Room` with large participant counts, and polling narrows only if it shows a slope
+- [Route health](/quest/m5/route-health/README.md) - epoch-only active/passive track recovery over metadata-only subscriptions
+- [Wrapper traits over moq-net](/quest/m5/net-wrap/README.md) - moq-net exports producer and consumer traits, and every writer and reader above it takes them, so a wrapper such as e2ee passes through unchanged
+- [E2EE](/quest/m5/e2ee/README.md) - TypeScript and Rust peers interoperate over encrypted broadcasts no relay can decrypt
+- [Bindings size profile](/quest/m5/ffi-size-profile.md) - a benchmark decides whether the moq-ffi builds ship at opt-level "s", which halves the dylib
+- [Value merge-patch diff](/quest/m5/json-value-diff.md) - benchmarks decide between moq-json's generic serializer diff, a ported `Value` diff, and compression alone
+- [Measure what a catalog republish costs per rendition edit](/quest/m5/catalog-republish-cost.md) - bench whole-catalog re-serialization across track counts, then decide deltas or a bound
+- [WebGPU HDR](/quest/m5/webgpu-hdr.md) - HDR renditions play as HDR where the browser and display can show it, and tone-map to SDR elsewhere
+- [moq-transport hole markers](/quest/m5/ietf-hole-marker.md) - a negotiated extension names a SUBSCRIBE's holes, so our publishers answer multi-group FETCH from caches that know every group; built when an IETF client wants it
+- [A parked read of a resumed group reads its budget without re-syncing](/quest/m5/recover-budget.md) - measure, then drop the per-frame reader sync
+- [Publishers learn their cap](/quest/m5/rate-grant.md) - the AUTH grant carries the caps and publishers clamp their encoder to them
+- [Linux decoded frames](/quest/m5/obs-decode-linux.md) - present supported native decoded surfaces with visible CPU fallback
+- [Windows decoded frames](/quest/m5/obs-decode-windows.md) - present decoded D3D11 surfaces in OBS without CPU readback
+- [macOS GPU input](/quest/m5/obs-macos.md) - feed the encoder from the OBS compositor without CPU readback
+- [Windows GPU input](/quest/m5/obs-windows.md) - import or blit OBS D3D11 textures with explicit synchronization
+- [WASM-to-JS evaluation](/quest/m5/rs2ts-wasm2js.md) - try the Rust implementation as JS-only browser output and compare source-translator alternatives if needed
+- [JS-only @moq/net](/quest/m5/rs2ts-js.md) - adopt the selected Rust-to-JS route after browser parity and measured tradeoffs are accepted
+- [Per-stream and per-datagram deadlines](/quest/m5/quic-deadline.md) - hopeless retransmits
+  become resets, a tail loss probe fires early while there is still time, and
+  datagrams past their subscription's max delay are dropped instead of sent late
+- [Measure ECN on the backbone](/quest/m5/quic-ecn-measure.md) - a written
+  verdict on marking versus dropping, and whether Linode and OVH keep marks
+- [Delivery delay](/quest/m5/delivery-delay.md) - a per-frame
+  delivery-delay histogram from `poll_acked`, so viewer jitter is visible
+- [#3199](/quest/m5/3199-moq-uring-remove-sq-indirection-and-per-enter-ring-fd.md) - moq-uring: remove SQ indirection and per-enter ring fd lookup, if a profile shows the win
+- [#3200](/quest/m5/3200-moq-uring-batch-completion-wakeups-with-min-timeout.md) - moq-uring: batch completion wakeups with MIN_TIMEOUT
+- [Browser media report](/quest/m5/rs2ts-browser-report.md) - compare Rust-backed and handwritten @moq/net through full media workloads, supplementing the pre-adoption comparisons
+- [Link quality](/quest/m5/link-quality.md) - a radio link's cost follows its measured quality without flapping routes
+- [io_uring thread check](/quest/m5/uring-transport-machines.md) - the relay fanout bench measures `moq_uring::transport::Local`'s per-call thread check after the transport is boxed, removing it only if it shows
+- [Opus implementation](/quest/m5/audio-opus-backend.md) - compare Opus codec quality, CPU, build cost, and the loss recovery each backend offers
+- [Latency ledger](/quest/m5/latency-ledger.md) - a viewer reports its share of playback delay stage by stage: jitter buffer and device
+- [Media Foundation decode](/quest/m5/audio-decode-mediafoundation.md) - Windows decodes HE-AAC, multichannel AAC, and what else the MFTs offer
+- [Media Foundation encode](/quest/m5/audio-encode-mediafoundation.md) - Windows encodes AAC-LC
+- [MediaCodec decode](/quest/m5/audio-decode-mediacodec.md) - Android decodes HE-AAC, multichannel AAC, and what else the device offers
+- [MediaCodec encode](/quest/m5/audio-encode-mediacodec.md) - Android encodes AAC-LC
+- [#2848](/quest/m5/2848-follow-the-bandwidth-grant-in-moq-audio-instead-of.md) - the Opus producer follows its bandwidth grant through the settled `moq_mux::rate::Control`
+- [NVENC buffer pool](/quest/m5/nvenc-pool.md) - NVENC reuses input and output buffers instead of allocating per frame, if a benchmark shows it wins
+- [QUIC I/O boundary](/quest/m5/quic-io-boundary.md) - moq-uring receives from the buffer ring and transmits into caller-owned buffers with no copy, once a profile says where
+- [BBR media study](/quest/m5/quic-bbr-study.md) - whether Google's growth recognition and precautionary probe stop help media, measured on a shaped media harness
+- [Egress profile](/quest/m5/quic-egress-profile.md) - measure relay send-path syscalls, pacing bursts, and allocations before optimizing any of them
+- [Archive lookups cancel when abandoned](/quest/m5/archive-lookup-withdrawal.md) - a public withdrawal signal on `Fill` stops a time lookup's store read once its readers leave
+- [Demo dashboard shows viewer lag](/quest/m5/qos-lag-dashboard.md) - follow-on capability after the release contract is stable
+- [A failed archive time lookup fails the subscription](/quest/m5/archive-time-followups.md) - when an `archive::Consumer` cannot answer a `Time(pts)` lookup because a store GET fails or an object does not decode, the subscription fails with a typed error naming the lookup failure instead of silently falling back to the cache
+- [HTTP auth servers see which request named a token](/quest/m5/auth-http-request-kind.md) - the HTTP auth contract forwards `auth::Request`'s `kind()` and `path()`
+- [moq auth sign mints capped tokens](/quest/m5/auth-sign-caps.md) - CLI flags for the bitrate caps
+- [QUIC-LB forwarding reads the cluster's peers and reports its counts](/quest/m5/quic-lb-forward-extras.md) - a cluster-API peer map and forward counters
diff --git a/quest/m3/ac3-low-rate.md b/quest/m5/ac3-low-rate.md
similarity index 100%
rename from quest/m3/ac3-low-rate.md
rename to quest/m5/ac3-low-rate.md
diff --git a/quest/m3/ada-gpu.md b/quest/m5/ada-gpu.md
similarity index 100%
rename from quest/m3/ada-gpu.md
rename to quest/m5/ada-gpu.md
diff --git a/quest/m2/announce-credit.md b/quest/m5/announce-credit.md
similarity index 95%
rename from quest/m2/announce-credit.md
rename to quest/m5/announce-credit.md
index 5a9b46aeca8..00f8e6ffe8d 100644
--- a/quest/m2/announce-credit.md
+++ b/quest/m5/announce-credit.md
@@ -66,6 +66,6 @@ flowing and the session stays open; an older version still closes at the cap.
 
 ## Related
 
-- [Announce interest memory](/quest/m2/announce-interest-memory.md) - per-stream memory proportional to what is in flight, which credit bounds
-- [JS announced coalescing](/quest/m2/js-announced-coalesce.md) - the JS consumer-side queue that is still unbounded
-- [Publishers learn their bitrate cap](/quest/m2/rate-grant.md) - the other wire change targeting the next lite version
+- [Announce interest memory](/quest/m4/announce-interest-memory.md) - per-stream memory proportional to what is in flight, which credit bounds
+- [JS announced coalescing](/quest/m3/js-announced-coalesce.md) - the JS consumer-side queue that is still unbounded
+- [Publishers learn their bitrate cap](/quest/m5/rate-grant.md) - the other wire change targeting the next lite version
diff --git a/quest/m2/announce-fanout-allocs.md b/quest/m5/announce-fanout-allocs.md
similarity index 100%
rename from quest/m2/announce-fanout-allocs.md
rename to quest/m5/announce-fanout-allocs.md
diff --git a/quest/m2/archive-lookup-withdrawal.md b/quest/m5/archive-lookup-withdrawal.md
similarity index 96%
rename from quest/m2/archive-lookup-withdrawal.md
rename to quest/m5/archive-lookup-withdrawal.md
index 7eb0a04dbf4..7125533fd30 100644
--- a/quest/m2/archive-lookup-withdrawal.md
+++ b/quest/m5/archive-lookup-withdrawal.md
@@ -19,4 +19,4 @@ Public API: a public withdrawal signal on `moq_net::track::Fill`. Wire: none.
 
 ## Related
 
-- [A failed archive time lookup fails the subscription](/quest/m2/archive-time-followups.md) - a lookup refusal on `Fill`, the other half of a lookup's lifecycle; whichever lands second shares its `Fill` surface
+- [A failed archive time lookup fails the subscription](/quest/m5/archive-time-followups.md) - a lookup refusal on `Fill`, the other half of a lookup's lifecycle; whichever lands second shares its `Fill` surface
diff --git a/quest/m3/archive-paced-replay.md b/quest/m5/archive-paced-replay.md
similarity index 100%
rename from quest/m3/archive-paced-replay.md
rename to quest/m5/archive-paced-replay.md
diff --git a/quest/m2/archive-time-followups.md b/quest/m5/archive-time-followups.md
similarity index 95%
rename from quest/m2/archive-time-followups.md
rename to quest/m5/archive-time-followups.md
index 54297f65a1b..9a3c9e764e6 100644
--- a/quest/m2/archive-time-followups.md
+++ b/quest/m5/archive-time-followups.md
@@ -48,5 +48,5 @@ Public API: `track::Fill` gains a lookup refusal; moq-ffi `MoqFill` gains
 
 ## Related
 
-- [Archive lookup withdrawal](/quest/m2/archive-lookup-withdrawal.md) - the other [moq-dev/moq#7310](https://github.com/moq-dev/moq/pull/7310) follow-up, a public withdrawal signal on `Fill`
-- [DVR rewind](/quest/m2/archive-dvr.md) - the consumer of time seeks
+- [Archive lookup withdrawal](/quest/m5/archive-lookup-withdrawal.md) - the other [moq-dev/moq#7310](https://github.com/moq-dev/moq/pull/7310) follow-up, a public withdrawal signal on `Fill`
+- [DVR rewind](/quest/m3/archive-dvr.md) - the consumer of time seeks
diff --git a/quest/m2/audio-decode-mediacodec.md b/quest/m5/audio-decode-mediacodec.md
similarity index 95%
rename from quest/m2/audio-decode-mediacodec.md
rename to quest/m5/audio-decode-mediacodec.md
index 0a02983f5d3..4578ceef909 100644
--- a/quest/m2/audio-decode-mediacodec.md
+++ b/quest/m5/audio-decode-mediacodec.md
@@ -30,4 +30,4 @@ behind a new optional audio `mediacodec` feature and the decode seam, on `target
 
 ## Related
 
-- [Android capture](/quest/m2/mobile-capture-android.md) - the video MediaCodec family this sits beside
+- [Android capture](/quest/m3/mobile-capture-android.md) - the video MediaCodec family this sits beside
diff --git a/quest/m2/audio-decode-mediafoundation.md b/quest/m5/audio-decode-mediafoundation.md
similarity index 94%
rename from quest/m2/audio-decode-mediafoundation.md
rename to quest/m5/audio-decode-mediafoundation.md
index e480e5b00ce..dee9a050786 100644
--- a/quest/m2/audio-decode-mediafoundation.md
+++ b/quest/m5/audio-decode-mediafoundation.md
@@ -24,4 +24,4 @@ ones. Behind the decode seam as the first candidate on `target_os =
 
 ## Related
 
-- [Windows decoded frames](/quest/m2/obs-decode-windows.md) - the OBS Windows line this feeds
+- [Windows decoded frames](/quest/m5/obs-decode-windows.md) - the OBS Windows line this feeds
diff --git a/quest/m2/audio-encode-audiotoolbox.md b/quest/m5/audio-encode-audiotoolbox.md
similarity index 91%
rename from quest/m2/audio-encode-audiotoolbox.md
rename to quest/m5/audio-encode-audiotoolbox.md
index 9fed1bfcdbf..1535945569b 100644
--- a/quest/m2/audio-encode-audiotoolbox.md
+++ b/quest/m5/audio-encode-audiotoolbox.md
@@ -35,9 +35,9 @@ the encode seam as the platform candidate on macOS and iOS.
 
 ## Required
 
-- [AudioToolbox decode](/quest/m2/audio-decode-audiotoolbox.md) - the round-trip regression decodes through it
+- [AudioToolbox decode](/quest/m3/audio-decode-audiotoolbox.md) - the round-trip regression decodes through it
 
 ## Related
 
-- [MediaCodec AAC encode](/quest/m2/audio-encode-mediacodec.md) - the same encode seam on Android
-- [Media Foundation AAC encode](/quest/m2/audio-encode-mediafoundation.md) - the same encode seam on Windows
+- [MediaCodec AAC encode](/quest/m5/audio-encode-mediacodec.md) - the same encode seam on Android
+- [Media Foundation AAC encode](/quest/m5/audio-encode-mediafoundation.md) - the same encode seam on Windows
diff --git a/quest/m2/audio-encode-mediacodec.md b/quest/m5/audio-encode-mediacodec.md
similarity index 90%
rename from quest/m2/audio-encode-mediacodec.md
rename to quest/m5/audio-encode-mediacodec.md
index 10cf79e8af9..5ef9c74bb0f 100644
--- a/quest/m2/audio-encode-mediacodec.md
+++ b/quest/m5/audio-encode-mediacodec.md
@@ -25,5 +25,5 @@ behind the `mediacodec` feature and the encode seam.
 
 ## Required
 
-- [MediaCodec decode](/quest/m2/audio-decode-mediacodec.md) - the round-trip regression decodes through it
-- [AudioToolbox encode](/quest/m2/audio-encode-audiotoolbox.md) - owns the shared flush and zero-or-more packet encoder contract
+- [MediaCodec decode](/quest/m5/audio-decode-mediacodec.md) - the round-trip regression decodes through it
+- [AudioToolbox encode](/quest/m5/audio-encode-audiotoolbox.md) - owns the shared flush and zero-or-more packet encoder contract
diff --git a/quest/m2/audio-encode-mediafoundation.md b/quest/m5/audio-encode-mediafoundation.md
similarity index 87%
rename from quest/m2/audio-encode-mediafoundation.md
rename to quest/m5/audio-encode-mediafoundation.md
index fdddf6ec253..d0bb8cf4578 100644
--- a/quest/m2/audio-encode-mediafoundation.md
+++ b/quest/m5/audio-encode-mediafoundation.md
@@ -20,6 +20,6 @@ behind the encode seam on Windows.
 
 ## Required
 
-- [AudioToolbox encode](/quest/m2/audio-encode-audiotoolbox.md) - changes `Encoder::encode` to a zero-or-more packet return with a flush, which this backend implements
-- [Media Foundation decode](/quest/m2/audio-decode-mediafoundation.md) - the round-trip regression decodes through it
+- [AudioToolbox encode](/quest/m5/audio-encode-audiotoolbox.md) - changes `Encoder::encode` to a zero-or-more packet return with a flush, which this backend implements
+- [Media Foundation decode](/quest/m5/audio-decode-mediafoundation.md) - the round-trip regression decodes through it
 
diff --git a/quest/m3/audio-filters.md b/quest/m5/audio-filters.md
similarity index 100%
rename from quest/m3/audio-filters.md
rename to quest/m5/audio-filters.md
diff --git a/quest/m2/audio-opus-backend.md b/quest/m5/audio-opus-backend.md
similarity index 100%
rename from quest/m2/audio-opus-backend.md
rename to quest/m5/audio-opus-backend.md
diff --git a/quest/m3/audio-web.md b/quest/m5/audio-web.md
similarity index 92%
rename from quest/m3/audio-web.md
rename to quest/m5/audio-web.md
index 5e0d2e2fbf6..915d7d547dd 100644
--- a/quest/m3/audio-web.md
+++ b/quest/m5/audio-web.md
@@ -33,8 +33,8 @@ The encode and decode seams become asynchronous.
 
 ## Required
 
-- [moq-video in the browser](/quest/m3/video-web.md) - the restored wasm32 target and browser runtime this builds on
+- [moq-video in the browser](/quest/m5/video-web.md) - the restored wasm32 target and browser runtime this builds on
 
 ## Related
 
-- [WebCodecs audio priming](/quest/m2/webcodecs-priming.md) - measures each browser `AudioEncoder`'s priming; the WebCodecs backend's `delay()` reuses it
+- [WebCodecs audio priming](/quest/m3/webcodecs-priming.md) - measures each browser `AudioEncoder`'s priming; the WebCodecs backend's `delay()` reuses it
diff --git a/quest/m2/auth-http-request-kind.md b/quest/m5/auth-http-request-kind.md
similarity index 94%
rename from quest/m2/auth-http-request-kind.md
rename to quest/m5/auth-http-request-kind.md
index ebc27df77e2..13d76e6e910 100644
--- a/quest/m2/auth-http-request-kind.md
+++ b/quest/m5/auth-http-request-kind.md
@@ -31,4 +31,4 @@ Public API: additive (HTTP auth contract fields). Wire: none.
 
 ## Related
 
-- [Token auth follow-ups](/quest/m2/token-auth-followups.md) - the rest of #7211's follow-ups
+- [Token auth follow-ups](/quest/m3/token-auth-followups.md) - the rest of #7211's follow-ups
diff --git a/quest/m2/auth-sign-caps.md b/quest/m5/auth-sign-caps.md
similarity index 100%
rename from quest/m2/auth-sign-caps.md
rename to quest/m5/auth-sign-caps.md
diff --git a/quest/m3/auth-token-fetch.md b/quest/m5/auth-token-fetch.md
similarity index 94%
rename from quest/m3/auth-token-fetch.md
rename to quest/m5/auth-token-fetch.md
index 1a77e9fe06f..140b4b221ad 100644
--- a/quest/m3/auth-token-fetch.md
+++ b/quest/m5/auth-token-fetch.md
@@ -14,7 +14,7 @@ The incoming half, a token admitting TRACK_STATUS and FETCH, landed with
 [moq-dev/moq#7211](https://github.com/moq-dev/moq/pull/7211), which honors a
 token on any request type. This quest keeps only the outgoing half.
 
-Decided 2026-10-20 (maintainer): stays in m3 with the other request-token
+Decided 2026-10-20 (maintainer): stays in m5 with the other request-token
 surfaces until a consumer asks. Outgoing tokens wait for `add()` with
 automatic naming, so this lands with or after that. A joining FETCH keeps
 following its subscription's authorization and carries no token of its own.
diff --git a/quest/m3/bun-lint-release.md b/quest/m5/bun-lint-release.md
similarity index 100%
rename from quest/m3/bun-lint-release.md
rename to quest/m5/bun-lint-release.md
diff --git a/quest/m2/c-origin-relay.md b/quest/m5/c-origin-relay.md
similarity index 87%
rename from quest/m2/c-origin-relay.md
rename to quest/m5/c-origin-relay.md
index 1fbf9e18586..4966c5106e8 100644
--- a/quest/m2/c-origin-relay.md
+++ b/quest/m5/c-origin-relay.md
@@ -21,7 +21,7 @@ may (`relays()`). `moq_origin_create` (`rs/moq-c/src/api.rs`) always makes a
 local one. Expose the choice in C, by a create option or a setter mirroring
 `with_link`, following whatever moq-ffi exposes if it has gained the same
 by then, and document it in `moq.h` and `doc/lib/c`. If the
-[generated C line](/quest/m2/c/README.md) has replaced the hand-written crate
+[generated C line](/quest/m3/c/README.md) has replaced the hand-written crate
 before this starts, add it to moq-ffi instead so every binding gets it.
 Test a C origin forwarding a client session's routes with no announce
 watcher.
@@ -31,4 +31,4 @@ replaced it. Wire: none.
 
 ## Related
 
-- [moq-c at parity](/quest/m1/c/README.md) - the hand-written crate's m1 parity work, which this does not block
+- [moq-c at parity](/quest/m2/cut-gate/c/README.md) - the hand-written crate's pre-cut parity work, which this does not block
diff --git a/quest/m3/captions-cea.md b/quest/m5/captions-cea.md
similarity index 100%
rename from quest/m3/captions-cea.md
rename to quest/m5/captions-cea.md
diff --git a/quest/m2/carla-bridge.md b/quest/m5/carla-bridge.md
similarity index 95%
rename from quest/m2/carla-bridge.md
rename to quest/m5/carla-bridge.md
index e40d3255027..496a2c14a88 100644
--- a/quest/m2/carla-bridge.md
+++ b/quest/m5/carla-bridge.md
@@ -55,8 +55,8 @@ probe opens the camera's own backend with a CPU picture.
 
 ## Required
 
-- [Vulkan Video encode on AMD](/quest/m2/vulkan-encode.md) - the AMD encoder this exercises
+- [Vulkan Video encode on AMD](/quest/m3/vulkan-encode.md) - the AMD encoder this exercises
 
 ## Related
 
-- [GPU CI](/quest/m2/gpu-ci.md) - gates NVIDIA correctness on hardware in the merge queue
+- [GPU CI](/quest/m3/gpu-ci.md) - gates NVIDIA correctness on hardware in the merge queue
diff --git a/quest/m2/catalog-republish-cost.md b/quest/m5/catalog-republish-cost.md
similarity index 93%
rename from quest/m2/catalog-republish-cost.md
rename to quest/m5/catalog-republish-cost.md
index 8bbf9a3e013..2eebbd6e53d 100644
--- a/quest/m2/catalog-republish-cost.md
+++ b/quest/m5/catalog-republish-cost.md
@@ -26,4 +26,4 @@ Public API: none for the measurement. Wire: none.
 
 ## Related
 
-- [Benchmark a Value merge-patch diff for moq-json](/quest/m2/json-value-diff.md) - the delta machinery a catalog diff would reuse
+- [Benchmark a Value merge-patch diff for moq-json](/quest/m5/json-value-diff.md) - the delta machinery a catalog diff would reuse
diff --git a/quest/m3/cpp-conan.md b/quest/m5/cpp-conan.md
similarity index 81%
rename from quest/m3/cpp-conan.md
rename to quest/m5/cpp-conan.md
index de1a36cf1ed..cb0a232b480 100644
--- a/quest/m3/cpp-conan.md
+++ b/quest/m5/cpp-conan.md
@@ -9,8 +9,8 @@ Windows, macOS, and Linux.
 
 ## Plan
 
-In m3 until a Conan consumer asks; the release tarball covers C++ consumers
-first. The vcpkg registry, which this reuses, is parked in m3 too (decided
+In m5 until a Conan consumer asks; the release tarball covers C++ consumers
+first. The vcpkg registry, which this reuses, is parked in m5 too (decided
 2026-10-08), so it lands before this does.
 
 - A `moq-cpp` recipe, named after the package, on a moq-dev remote
@@ -28,5 +28,5 @@ first. The vcpkg registry, which this reuses, is parked in m3 too (decided
 
 ## Required
 
-- [First C++ package release](/quest/m2/release/cpp-release.md) - the tarballs the recipe packages
-- [vcpkg registry](/quest/m3/cpp-vcpkg.md) - the release manifest and bump automation this reuses
+- [First C++ package release](/quest/m3/release/cpp-release.md) - the tarballs the recipe packages
+- [vcpkg registry](/quest/m5/cpp-vcpkg.md) - the release manifest and bump automation this reuses
diff --git a/quest/m3/cpp-vcpkg.md b/quest/m5/cpp-vcpkg.md
similarity index 91%
rename from quest/m3/cpp-vcpkg.md
rename to quest/m5/cpp-vcpkg.md
index 23d329c3f00..ba905c8cd69 100644
--- a/quest/m3/cpp-vcpkg.md
+++ b/quest/m5/cpp-vcpkg.md
@@ -28,8 +28,8 @@ CI on Windows, macOS, and Linux.
 
 ## Required
 
-- [First C++ package release](/quest/m2/release/cpp-release.md) - the tarballs the port fetches
+- [First C++ package release](/quest/m3/release/cpp-release.md) - the tarballs the port fetches
 
 ## Related
 
-- [Conan remote](/quest/m3/cpp-conan.md) - the same tarball through Conan
+- [Conan remote](/quest/m5/cpp-conan.md) - the same tarball through Conan
diff --git a/quest/m3/cut-through/README.md b/quest/m5/cut-through/README.md
similarity index 94%
rename from quest/m3/cut-through/README.md
rename to quest/m5/cut-through/README.md
index 22799559b76..2dd9f446c08 100644
--- a/quest/m3/cut-through/README.md
+++ b/quest/m5/cut-through/README.md
@@ -30,7 +30,7 @@ design decisions below stay as the starting point for that re-plan.
 
 Decided 2026-09-30:
 
-- Measure first; the [bench](/quest/m3/cut-through/bench.md) gates any build.
+- Measure first; the [bench](/quest/m5/cut-through/bench.md) gates any build.
 - The gain is roughly the time the relay would spend bursting the held bytes
   downstream after the hole fills: small when the egress hop has headroom,
   larger for a big I-frame on a tight hop. The bench sweeps exactly that.
@@ -70,10 +70,10 @@ stats field, which its quest documents inline.
 
 ## Required
 
-- [Loss delay](/quest/m3/cut-through/loss-delay.md) - relays report, per broadcast, the ingress bytes a loss held back by at least one RTT
-- [Bench](/quest/m3/cut-through/bench.md) - a congested relay hop swept over ingress rate, queue depth, frame size, and egress headroom, measuring the post-hole drain time, with a go or no-go verdict
+- [Loss delay](/quest/m5/cut-through/loss-delay.md) - relays report, per broadcast, the ingress bytes a loss held back by at least one RTT
+- [Bench](/quest/m5/cut-through/bench.md) - a congested relay hop swept over ingress rate, queue depth, frame size, and egress headroom, measuring the post-hole drain time, with a go or no-go verdict
 
 ## Related
 
-- [QoS](/quest/m2/qos/README.md) - the loss-delay counter follows its per-broadcast ingress row conventions
+- [QoS](/quest/m3/qos/README.md) - the loss-delay counter follows its per-broadcast ingress row conventions
 - [Frame slot accounting](https://github.com/moq-dev/moq/pull/5239) - landed: the cache charges frame slot growth, which covers the in-flight frames a cut-through build would hold
diff --git a/quest/m3/cut-through/bench.md b/quest/m5/cut-through/bench.md
similarity index 95%
rename from quest/m3/cut-through/bench.md
rename to quest/m5/cut-through/bench.md
index 2fbc05e5ad7..1460de3464a 100644
--- a/quest/m3/cut-through/bench.md
+++ b/quest/m5/cut-through/bench.md
@@ -5,7 +5,7 @@
 A nightly bench measures how long a frame takes to complete at the viewer when
 the publisher's hop to the relay loses packets, and how much of that a
 cut-through relay could win back. It ends with a written go or no-go for the
-rest of the [cut-through line](/quest/m3/cut-through/README.md).
+rest of the [cut-through line](/quest/m5/cut-through/README.md).
 
 ## Plan
 
@@ -41,7 +41,7 @@ partly measure its own assumptions.
 - Take publisher and subscriber counts as parameters, so a relay build
   reuses the rig for its fan-out sweep.
 - Record the loss-delay counter from the same runs, if
-  [Loss delay](/quest/m3/cut-through/loss-delay.md) has landed, so production
+  [Loss delay](/quest/m5/cut-through/loss-delay.md) has landed, so production
   numbers can be read against the lab.
 - It runs on wall-clock time, so it is a nightly bench, not a unit test. Wire it
   into the nightly workflow.
diff --git a/quest/m3/cut-through/loss-delay.md b/quest/m5/cut-through/loss-delay.md
similarity index 91%
rename from quest/m3/cut-through/loss-delay.md
rename to quest/m5/cut-through/loss-delay.md
index 2b2ca92d01d..ab4377e4ffc 100644
--- a/quest/m3/cut-through/loss-delay.md
+++ b/quest/m5/cut-through/loss-delay.md
@@ -12,7 +12,7 @@ production number that sizes the cut-through opportunity.
 
 Decided 2026-09-30: one monotonic byte counter, no hold-time histogram, on the
 ingress (`Role::Subscriber`) rows next to
-[publisher timeliness](/quest/m2/qos-publisher-timeliness.md)'s fields.
+[publisher timeliness](/quest/m3/qos-publisher-timeliness.md)'s fields.
 Independent of the bench.
 
 - `moq-quic` counts per receive stream. The assembler stamps each chunk buffered past
@@ -26,7 +26,7 @@ Independent of the bench.
   `transport::poll::RecvStream` gains an accessor returning `Option` (`None`
   when the backend cannot see it), following the module's `Stats`
   convention. The moq-tokio and moq-uring adapters implement it, as
-  [poll_acked](/quest/m2/quic-ack-hook.md) does.
+  [poll_acked](/quest/m3/quic-ack-hook.md) does.
 - The lite and IETF subscribers read the count at each frame boundary and when
   the group stream ends, adding the delta to the broadcast's ingress row, so a
   long group does not leave the row stale. Nothing on the per-byte path.
@@ -41,4 +41,4 @@ missing fields.
 
 ## Related
 
-- [QoS](/quest/m2/qos/README.md) - the per-broadcast ingress conventions this follows
+- [QoS](/quest/m3/qos/README.md) - the per-broadcast ingress conventions this follows
diff --git a/quest/m2/delivery-delay.md b/quest/m5/delivery-delay.md
similarity index 92%
rename from quest/m2/delivery-delay.md
rename to quest/m5/delivery-delay.md
index c7323c60595..d069025357b 100644
--- a/quest/m2/delivery-delay.md
+++ b/quest/m5/delivery-delay.md
@@ -14,7 +14,7 @@ Decided 2026-10-26 (maintainer, on
 [moq-dev/moq#6791](https://github.com/moq-dev/moq/pull/6791)): this quest's
 frontier half, moving the acknowledged frontier at every frame end and
 counting `dropped` per frame, moved into the
-[viewer lag histogram](/quest/m2/qos/lag-histogram.md), which no longer
+[viewer lag histogram](/quest/m3/qos/lag-histogram.md), which no longer
 lands at group granularity. That quest already awaits each frame's
 acknowledgement through `poll_acked`; this one adds the delay it observes.
 
@@ -33,5 +33,5 @@ Public API: an additive `Traffic` field. Wire: an additive stats JSON field.
 
 ## Required
 
-- [Viewer lag histogram](/quest/m2/qos/lag-histogram.md) - the per-frame
+- [Viewer lag histogram](/quest/m3/qos/lag-histogram.md) - the per-frame
   acknowledgement tracking and histogram type this reuses
diff --git a/quest/m3/drm-playback.md b/quest/m5/drm-playback.md
similarity index 93%
rename from quest/m3/drm-playback.md
rename to quest/m5/drm-playback.md
index a936a6cac46..5e17bf3e58d 100644
--- a/quest/m3/drm-playback.md
+++ b/quest/m5/drm-playback.md
@@ -19,4 +19,4 @@ Open:
 
 ## Required
 
-- [Protected CMAF import](/quest/m2/drm/import.md) - the hang `drm` section this reads, and the renditions it stops hiding
+- [Protected CMAF import](/quest/m3/drm/import.md) - the hang `drm` section this reads, and the renditions it stops hiding
diff --git a/quest/m2/e2ee/README.md b/quest/m5/e2ee/README.md
similarity index 95%
rename from quest/m2/e2ee/README.md
rename to quest/m5/e2ee/README.md
index 1309eb370e2..9258d7d0cf8 100644
--- a/quest/m2/e2ee/README.md
+++ b/quest/m5/e2ee/README.md
@@ -34,8 +34,8 @@ The Rust and TypeScript cores expose the same surface, and nothing else:
 - `Credential { context, kid, secret }` accepts the application-owned secret. The application generates and distributes it over its authenticated channel; the library does not mint a secret it cannot return. `credential.path(semantic)` derives the epoch-free opaque broadcast name. Credential is cheap to clone, never serializes the secret, and redacts it from `Debug`.
 - A core produces only under an epoch it minted itself (decided 2026-10-08). Only `credential.produce()` mints a producing generation, and it takes no epoch: it mints a fresh UUIDv7 and returns a `generation::Producer` owning `epoch()` for the route and `name(semantic)` for opaque track names. `credential.consume(epoch)` binds a discovered epoch as a consume-only `generation::Consumer` with `name(semantic)`. The two are separate types, so producing under a discovered or shared epoch does not compile (names decided 2026-10-11 in [#5313](https://github.com/moq-dev/moq/pull/5313)). Clones of a producing generation share publisher claims so reopening a track cannot reset its nonce counters.
 - Applications only handle semantic track names (maintainer, 2026-10-17). `broadcast::Producer` wraps a `moq-net` broadcast under a producing generation and `broadcast::Consumer` wraps one under a consuming generation; each derives the physical name, so only the CDN sees physical names. `generation` no longer opens tracks itself. The broadcast wrappers merged in [#5876](https://github.com/moq-dev/moq/pull/5876).
-- The wrappers implement the [moq-net traits](/quest/m2/net-wrap/README.md) at the broadcast, track, group, and frame levels, datagrams included (decided 2026-10-20, maintainer, because one encrypted broadcast then works with every writer and reader). moq-mux, moq-json, hang, and the CLI publish and consume an encrypted broadcast unchanged, under semantic names, and every AEAD call still has the canonical physical name and transport identity. The e2ee mux bridge ([#5822](https://github.com/moq-dev/moq/pull/5822)) is closed and superseded.
-- Errors are the draft's typed codes plus the transport's. Nothing catalog-, hang-, or MSF-shaped lives here: a catalog is a track under a derived name. The catalog owner sets logical `track::Info.compress`; the [e2ee wrapper](/quest/m2/net-wrap/e2ee.md) compresses before AEAD and authenticates the logical compression metadata.
+- The wrappers implement the [moq-net traits](/quest/m5/net-wrap/README.md) at the broadcast, track, group, and frame levels, datagrams included (decided 2026-10-20, maintainer, because one encrypted broadcast then works with every writer and reader). moq-mux, moq-json, hang, and the CLI publish and consume an encrypted broadcast unchanged, under semantic names, and every AEAD call still has the canonical physical name and transport identity. The e2ee mux bridge ([#5822](https://github.com/moq-dev/moq/pull/5822)) is closed and superseded.
+- Errors are the draft's typed codes plus the transport's. Nothing catalog-, hang-, or MSF-shaped lives here: a catalog is a track under a derived name. The catalog owner sets logical `track::Info.compress`; the [e2ee wrapper](/quest/m5/net-wrap/e2ee.md) compresses before AEAD and authenticates the logical compression metadata.
 - Stateless `seal`/`open` primitives with caller-chosen identities, HKDF labels and info builders, raw key bytes, and process-global claims are not public. The vectors are tested inside each core.
 
 ### Application and platform shape
@@ -46,7 +46,7 @@ The Rust and TypeScript cores expose the same surface, and nothing else:
 
 ### Dynamic names
 
-Physical names are reversible (decided with the maintainer on 2026-10-24 in [#6623](https://github.com/moq-dev/moq/pull/6623)). A physical track name is a 12-byte nonce, the first 12 bytes of an HMAC-SHA-256 of the semantic name padded to a multiple of 16 bytes, followed by the AES-128-GCM encryption of that padded name under that nonce, with both keys derived from the generation (the draft's Key Derivation section). It needs only HMAC-SHA-256 and AES-128-GCM, so it runs on aws-lc-rs, graviola, and WebCrypto with no new dependency (maintainer, 2026-10-24, over AES-GCM-SIV, which graviola lacks). A publisher opens a requested name and recomputes its nonce to recover its semantic name, so the e2ee `requests()` answers undeclared names through the [moq-net traits](/quest/m2/net-wrap/README.md) unchanged, and a name that does not open is answered as missing with no state kept. Equal names under one generation still share one physical name, so relays dedupe and cache them, and names stay unlinkable across epochs. AEAD keys bind the semantic name. The cost is that a relay learns each name's length rounded up to 16 bytes: every name up to 15 bytes looks alike, and a longer one leaks its length to within 16 bytes (maintainer, 2026-10-24, over power-of-two buckets that leak less but can double a long name). Broadcast paths stay one-way: e2ee wraps no origin, so nothing requests an undeclared protected broadcast.
+Physical names are reversible (decided with the maintainer on 2026-10-24 in [#6623](https://github.com/moq-dev/moq/pull/6623)). A physical track name is a 12-byte nonce, the first 12 bytes of an HMAC-SHA-256 of the semantic name padded to a multiple of 16 bytes, followed by the AES-128-GCM encryption of that padded name under that nonce, with both keys derived from the generation (the draft's Key Derivation section). It needs only HMAC-SHA-256 and AES-128-GCM, so it runs on aws-lc-rs, graviola, and WebCrypto with no new dependency (maintainer, 2026-10-24, over AES-GCM-SIV, which graviola lacks). A publisher opens a requested name and recomputes its nonce to recover its semantic name, so the e2ee `requests()` answers undeclared names through the [moq-net traits](/quest/m5/net-wrap/README.md) unchanged, and a name that does not open is answered as missing with no state kept. Equal names under one generation still share one physical name, so relays dedupe and cache them, and names stay unlinkable across epochs. AEAD keys bind the semantic name. The cost is that a relay learns each name's length rounded up to 16 bytes: every name up to 15 bytes looks alike, and a longer one leaks its length to within 16 bytes (maintainer, 2026-10-24, over power-of-two buckets that leak less but can double a long name). Broadcast paths stay one-way: e2ee wraps no origin, so nothing requests an undeclared protected broadcast.
 
 Rejected:
 
@@ -55,7 +55,7 @@ Rejected:
 - Requests that carry an encrypted semantic name beside a one-way name: it needs a moq-lite and moq-transport field that every relay forwards, and a moq-net `track(name)` signature change that breaks the trait mirror. The relay forwards one coalesced subscriber's field, so a relay-authorized party without the secret could race a bad one and get the name refused for everyone. Its field leaks the same rounded length.
 - One-way names for declared tracks and reversible ones for dynamic tracks: one semantic name would have two physical names, so it would not always mean the same content, and a subscriber cannot know which one the publisher serves.
 
-The broadcast wrappers merged in [#5876](https://github.com/moq-dev/moq/pull/5876) with `reserve_track`, which still serves declared names; [rust-publish](/quest/m2/e2ee/rust-publish.md) needs nothing more (maintainer, 2026-10-19).
+The broadcast wrappers merged in [#5876](https://github.com/moq-dev/moq/pull/5876) with `reserve_track`, which still serves declared names; [rust-publish](/quest/m5/e2ee/rust-publish.md) needs nothing more (maintainer, 2026-10-19).
 
 Noted 2026-10-31 from [moq-dev/moq#7307](https://github.com/moq-dev/moq/pull/7307):
 
@@ -75,20 +75,20 @@ Extractor declaration checks, which analyze only published packages since
 
 ## Required
 
-- [JS undeclared track names](/quest/m2/e2ee/js-undeclared-names.md) -
+- [JS undeclared track names](/quest/m5/e2ee/js-undeclared-names.md) -
   `@moq/net` exposes a broadcast request handler and `@moq/crypto` serves
   undeclared names through it
-- [Rust protected publisher seams](/quest/m2/e2ee/rust-publish.md) - Rust
+- [Rust protected publisher seams](/quest/m5/e2ee/rust-publish.md) - Rust
   publishers emit encrypted catalogs and no plaintext semantic catalog in
   E2EE mode, through the moq-net traits
-- [Encrypted consumer shape](/quest/m2/e2ee/consumer.md) - one consumer shape, the producer's mirror, shared by browser and CLI (moq-ffi is out of scope for this epic)
-- [Encrypted browser components](/quest/m2/e2ee/browser.md) - browser publish
+- [Encrypted consumer shape](/quest/m5/e2ee/consumer.md) - one consumer shape, the producer's mirror, shared by browser and CLI (moq-ffi is out of scope for this epic)
+- [Encrypted browser components](/quest/m5/e2ee/browser.md) - browser publish
   and watch components handle encrypted audio and video without leaking
   credentials into browser-owned surfaces
-- [Encrypted native CLI](/quest/m2/e2ee/cli.md) - the native CLI publishes and
+- [Encrypted native CLI](/quest/m5/e2ee/cli.md) - the native CLI publishes and
   plays encrypted media without exposing credentials through process metadata
   or logs
-- [Cross-language encrypted proof](/quest/m2/e2ee/interop.md) - browser
+- [Cross-language encrypted proof](/quest/m5/e2ee/interop.md) - browser
   TypeScript and native Rust exchange encrypted media both ways, with relays
   forwarding and metering blind
 
@@ -98,4 +98,4 @@ Extractor declaration checks, which analyze only published packages since
 
 ## Related
 
-- [Wrapper traits over moq-net](/quest/m2/net-wrap/README.md) - the traits the e2ee wrappers implement, so every writer and reader takes an encrypted broadcast
+- [Wrapper traits over moq-net](/quest/m5/net-wrap/README.md) - the traits the e2ee wrappers implement, so every writer and reader takes an encrypted broadcast
diff --git a/quest/m2/e2ee/browser.md b/quest/m5/e2ee/browser.md
similarity index 93%
rename from quest/m2/e2ee/browser.md
rename to quest/m5/e2ee/browser.md
index 27e4edec344..15796a2b16e 100644
--- a/quest/m2/e2ee/browser.md
+++ b/quest/m5/e2ee/browser.md
@@ -8,7 +8,7 @@ Existing plaintext operation remains the default; an explicit application creden
 
 ## Plan
 
-- Hand `@moq/publish` and `@moq/watch` an encrypted broadcast through the [`@moq/net` interfaces](/quest/m2/net-wrap/js.md), keeping codec selection, synchronization, and rendering in the post-decryption pipelines.
+- Hand `@moq/publish` and `@moq/watch` an encrypted broadcast through the [`@moq/net` interfaces](/quest/m5/net-wrap/js.md), keeping codec selection, synchronization, and rendering in the post-decryption pipelines.
 - Accept keys through a programmatic property/API only, never an HTML attribute, URL, persistent browser storage, analytics event, or log. Clear owned secret bytes when the component is replaced or disconnected; do not make extractability a hidden requirement.
 - Derive the invariant opaque broadcast path from the semantic name and
   resolve that path, taking the selected epoch from its route. On a wire
@@ -22,4 +22,4 @@ Existing plaintext operation remains the default; an explicit application creden
 
 ## Required
 
-- [Encrypted consumer shape](/quest/m2/e2ee/consumer.md) - watch uses the shared consumer instead of its own decryption
+- [Encrypted consumer shape](/quest/m5/e2ee/consumer.md) - watch uses the shared consumer instead of its own decryption
diff --git a/quest/m2/e2ee/cli.md b/quest/m5/e2ee/cli.md
similarity index 92%
rename from quest/m2/e2ee/cli.md
rename to quest/m5/e2ee/cli.md
index 6a1c8050512..42b9ce3b986 100644
--- a/quest/m2/e2ee/cli.md
+++ b/quest/m5/e2ee/cli.md
@@ -11,7 +11,7 @@ Existing plaintext commands remain the default; an explicit application credenti
 Make `moq-crypto` publishable with this CLI consumer; the crate currently sets
 `publish = false` while it is workspace-only.
 
-- Hand the [trait-generic CLI paths](/quest/m2/net-wrap/cli.md) an encrypted broadcast for publication and playback. Keep codec, capture, playback, and synchronization logic outside the crypto layer.
+- Hand the [trait-generic CLI paths](/quest/m5/net-wrap/cli.md) an encrypted broadcast for publication and playback. Keep codec, capture, playback, and synchronization logic outside the crypto layer.
 - Accept the credential through a dedicated file descriptor, otherwise-unused stdin, or a permission-checked file (`0600` on Unix), never a command argument or environment variable. Redact errors and tracing, zeroize owned secret bytes, and document shell-safe invocation.
 - Follow the approved protected naming contract for mux, video, audio,
   timeline, and catalog construction. Take the semantic broadcast name from
@@ -27,5 +27,5 @@ Make `moq-crypto` publishable with this CLI consumer; the crate currently sets
 
 ## Required
 
-- [Rust protected publisher seams](/quest/m2/e2ee/rust-publish.md) - prevents native convenience publishers from leaking semantic names or catalogs
-- [Encrypted consumer shape](/quest/m2/e2ee/consumer.md) - playback uses the shared consumer instead of its own decryption
+- [Rust protected publisher seams](/quest/m5/e2ee/rust-publish.md) - prevents native convenience publishers from leaking semantic names or catalogs
+- [Encrypted consumer shape](/quest/m5/e2ee/consumer.md) - playback uses the shared consumer instead of its own decryption
diff --git a/quest/m2/e2ee/consumer.md b/quest/m5/e2ee/consumer.md
similarity index 88%
rename from quest/m2/e2ee/consumer.md
rename to quest/m5/e2ee/consumer.md
index 11a2164bee0..df007830528 100644
--- a/quest/m2/e2ee/consumer.md
+++ b/quest/m5/e2ee/consumer.md
@@ -10,7 +10,7 @@ reinvent decryption and physical-name mapping.
 
 Decided 2026-10-20 (maintainer): the shape is the moq-net consumer traits.
 `moq_crypto::e2ee::broadcast::Consumer` and its track and group consumers implement
-them ([net-wrap](/quest/m2/net-wrap/README.md)), so a Rust player, the CLI,
+them ([net-wrap](/quest/m5/net-wrap/README.md)), so a Rust player, the CLI,
 and `@moq/watch` open an encrypted broadcast as they open any other,
 because every reader already takes the traits. Kept in m2 (decided
 2026-10-17).
@@ -34,5 +34,5 @@ Wire: none.
 
 ## Required
 
-- [Wrapper traits over moq-net](/quest/m2/net-wrap/README.md) - Rust and JS readers take the traits the e2ee consumer implements
-- [Rust protected publisher seams](/quest/m2/e2ee/rust-publish.md) - the producer this mirrors
+- [Wrapper traits over moq-net](/quest/m5/net-wrap/README.md) - Rust and JS readers take the traits the e2ee consumer implements
+- [Rust protected publisher seams](/quest/m5/e2ee/rust-publish.md) - the producer this mirrors
diff --git a/quest/m2/e2ee/interop.md b/quest/m5/e2ee/interop.md
similarity index 91%
rename from quest/m2/e2ee/interop.md
rename to quest/m5/e2ee/interop.md
index 838a2d028e5..ebb73428029 100644
--- a/quest/m2/e2ee/interop.md
+++ b/quest/m5/e2ee/interop.md
@@ -15,5 +15,5 @@ Ordinary relays forward, cache, and meter the proof without receiving a content
 
 ## Required
 
-- [Encrypted browser components](/quest/m2/e2ee/browser.md) - supplies the browser publisher and subscriber
-- [Encrypted native CLI](/quest/m2/e2ee/cli.md) - supplies the Rust publisher and subscriber
+- [Encrypted browser components](/quest/m5/e2ee/browser.md) - supplies the browser publisher and subscriber
+- [Encrypted native CLI](/quest/m5/e2ee/cli.md) - supplies the Rust publisher and subscriber
diff --git a/quest/m2/e2ee/js-undeclared-names.md b/quest/m5/e2ee/js-undeclared-names.md
similarity index 90%
rename from quest/m2/e2ee/js-undeclared-names.md
rename to quest/m5/e2ee/js-undeclared-names.md
index c5b1fdfc2ea..e2be23f53dc 100644
--- a/quest/m2/e2ee/js-undeclared-names.md
+++ b/quest/m5/e2ee/js-undeclared-names.md
@@ -13,7 +13,7 @@ broadcast the same way.
 Decided with the maintainer on 2026-10-24:
 
 - One quest, both halves; amended 2026-11-03 (maintainer): the `@moq/net`
-  half moved to [its own quest](/quest/m2/net-broadcast-requests.md), which
+  half moved to [its own quest](/quest/m3/net-broadcast-requests.md), which
   plaintext users (Kixel's T3 host) need first, and this keeps the
   `@moq/crypto` half.
 - `@moq/crypto` mirrors the Rust handler exactly: it opens each request's
@@ -34,5 +34,5 @@ Public API: a request handler on `@moq/crypto`'s broadcast producer. Wire: none.
 
 ## Required
 
-- [`@moq/net` broadcasts expose their requests](/quest/m2/net-broadcast-requests.md) - the public handler this wraps; split out 2026-11-03 so plaintext users get it first
-- [JS mirror](/quest/m2/net-wrap/js.md) - the `@moq/net` interfaces the `@moq/crypto` wrappers implement
+- [`@moq/net` broadcasts expose their requests](/quest/m3/net-broadcast-requests.md) - the public handler this wraps; split out 2026-11-03 so plaintext users get it first
+- [JS mirror](/quest/m5/net-wrap/js.md) - the `@moq/net` interfaces the `@moq/crypto` wrappers implement
diff --git a/quest/m2/e2ee/rust-publish.md b/quest/m5/e2ee/rust-publish.md
similarity index 88%
rename from quest/m2/e2ee/rust-publish.md
rename to quest/m5/e2ee/rust-publish.md
index f6191bc983c..693ae75e25d 100644
--- a/quest/m2/e2ee/rust-publish.md
+++ b/quest/m5/e2ee/rust-publish.md
@@ -14,7 +14,7 @@ Publishers use `Credential::produce()` and its `generation::Producer`; the
 producing/consuming split landed separately in #5313.
 
 Decided 2026-10-20 (maintainer): the e2ee wrappers implement the
-[moq-net traits](/quest/m2/net-wrap/README.md), and moq-mux and the
+[moq-net traits](/quest/m5/net-wrap/README.md), and moq-mux and the
 moq-video and moq-audio encoders take them, so mux, video, audio, and
 timeline publishers already publish into an encrypted
 broadcast under semantic names with no change here. This quest keeps only
@@ -28,7 +28,7 @@ in advance, so it never needed the undeclared-name handler (maintainer,
 - Encrypt the single Hang `catalog.json` left by the
   [m1 compression migration](https://github.com/moq-dev/moq/pull/7046), and encrypt or
   suppress the MSF catalog. Set logical `compress` on protected catalog
-  tracks; the [e2ee wrapper](/quest/m2/net-wrap/e2ee.md) compresses before
+  tracks; the [e2ee wrapper](/quest/m5/net-wrap/e2ee.md) compresses before
   encryption. Retain ordinary plaintext publication unchanged outside E2EE mode.
 - Cover every current Rust importer and capture path so a convenience API
   cannot emit a plaintext semantic catalog.
@@ -41,5 +41,5 @@ Public API: none. Wire: none.
 
 ## Required
 
-- [moq-crypto's e2ee implements the traits](/quest/m2/net-wrap/e2ee.md) - the encrypted broadcast moq-mux publishes into
-- [moq-mux takes the traits](/quest/m2/net-wrap/mux.md) - the mux and capture publishers this relies on to stay unchanged
+- [moq-crypto's e2ee implements the traits](/quest/m5/net-wrap/e2ee.md) - the encrypted broadcast moq-mux publishes into
+- [moq-mux takes the traits](/quest/m5/net-wrap/mux.md) - the mux and capture publishers this relies on to stay unchanged
diff --git a/quest/m3/emsg.md b/quest/m5/emsg.md
similarity index 96%
rename from quest/m3/emsg.md
rename to quest/m5/emsg.md
index 76cce2c1874..fa6eae92737 100644
--- a/quest/m3/emsg.md
+++ b/quest/m5/emsg.md
@@ -57,6 +57,6 @@ byte-identical.
 
 ## Related
 
-- [ID3 catalog section](/quest/m3/id3.md) - gives one payload type carried here a
+- [ID3 catalog section](/quest/m5/id3.md) - gives one payload type carried here a
   typed contract
-- [FLV script tags](/quest/m3/flv-script.md) - likewise
+- [FLV script tags](/quest/m5/flv-script.md) - likewise
diff --git a/quest/m3/ffi-e2ee.md b/quest/m5/ffi-e2ee.md
similarity index 83%
rename from quest/m3/ffi-e2ee.md
rename to quest/m5/ffi-e2ee.md
index 8c2efecbbd7..4181c2c45c2 100644
--- a/quest/m3/ffi-e2ee.md
+++ b/quest/m5/ffi-e2ee.md
@@ -10,7 +10,7 @@ and typed authentication failures as Rust and JS.
 ## Plan
 
 Decided 2026-10-28 with the maintainer (moq.pro T3 planning interview): this
-is the quest the [encrypted consumer](/quest/m2/e2ee/consumer.md) defers FFI
+is the quest the [encrypted consumer](/quest/m5/e2ee/consumer.md) defers FFI
 to, adding both halves. The named consumer is moq.pro's
 [T3 Code over MoQ](https://github.com/moq-dev/moq.pro/blob/main/quest/m3/t3/README.md)
 mobile app, which receives its credential in a pairing link.
@@ -22,5 +22,5 @@ the reverse to the interop suite.
 
 ## Required
 
-- [Rust protected publisher seams](/quest/m2/e2ee/rust-publish.md) - the producer these bindings wrap
-- [Encrypted consumer shape](/quest/m2/e2ee/consumer.md) - the consumer these bindings wrap
+- [Rust protected publisher seams](/quest/m5/e2ee/rust-publish.md) - the producer these bindings wrap
+- [Encrypted consumer shape](/quest/m5/e2ee/consumer.md) - the consumer these bindings wrap
diff --git a/quest/m2/ffi-size-profile.md b/quest/m5/ffi-size-profile.md
similarity index 100%
rename from quest/m2/ffi-size-profile.md
rename to quest/m5/ffi-size-profile.md
diff --git a/quest/m3/ffi-stream.md b/quest/m5/ffi-stream.md
similarity index 85%
rename from quest/m3/ffi-stream.md
rename to quest/m5/ffi-stream.md
index a4f5691f108..02d4bb02700 100644
--- a/quest/m3/ffi-stream.md
+++ b/quest/m5/ffi-stream.md
@@ -17,7 +17,7 @@ line, whose React Native app reaches its host through a native module over
 these bindings instead of the WebSocket fallback, so a lossy mobile link keeps
 QUIC's per-stream recovery.
 
-Wrap the [Rust surface](/quest/m2/stream/rust.md) in `moq-ffi` with the same
+Wrap the [Rust surface](/quest/m3/stream/rust.md) in `moq-ffi` with the same
 path layout and priority knob, and surface it through the generated Swift and
 Kotlin packages. Use an async read and write shape that matches how the
 bindings already expose frames; report the choice. Add a Kotlin or Swift
@@ -25,5 +25,5 @@ binding test against a JS peer to the interop suite.
 
 ## Required
 
-- [Rust byte streams](/quest/m2/stream/rust.md) - the surface these bindings wrap
-- [JS byte streams](/quest/m2/stream/js.md) - the peer the interop test runs against
+- [Rust byte streams](/quest/m3/stream/rust.md) - the surface these bindings wrap
+- [JS byte streams](/quest/m3/stream/js.md) - the peer the interop test runs against
diff --git a/quest/m3/flv-script.md b/quest/m5/flv-script.md
similarity index 92%
rename from quest/m3/flv-script.md
rename to quest/m5/flv-script.md
index 0d5058e6a17..f9d46d3e423 100644
--- a/quest/m3/flv-script.md
+++ b/quest/m5/flv-script.md
@@ -16,7 +16,7 @@ need carriage; logging their loss does not implement this quest.
 Carry raw tag payloads without decoding AMF into a fixed vocabulary. Publish
 when received on independently sequenced metadata groups, with event time on
 the broadcast clock and source placement per the contract
-[emsg](/quest/m3/emsg.md) settles. Tags before media
+[emsg](/quest/m5/emsg.md) settles. Tags before media
 are delivered immediately and retain explicit pre-media placement; audio-only
 and script-only input do not require a dummy video rendition.
 Where `onMetaData` duplicates something the catalog already models (dimensions,
@@ -29,4 +29,4 @@ media tag, and a byte-identical round trip.
 
 ## Required
 
-- [fMP4 emsg](/quest/m3/emsg.md) - settles the shared timed-metadata contract this builds on, which needs maintainer agreement first
+- [fMP4 emsg](/quest/m5/emsg.md) - settles the shared timed-metadata contract this builds on, which needs maintainer agreement first
diff --git a/quest/m3/hidden-exemption.md b/quest/m5/hidden-exemption.md
similarity index 88%
rename from quest/m3/hidden-exemption.md
rename to quest/m5/hidden-exemption.md
index 39d91f15ef1..0ec15457bd8 100644
--- a/quest/m3/hidden-exemption.md
+++ b/quest/m5/hidden-exemption.md
@@ -9,7 +9,7 @@ for peers that predate it.
 
 ## Plan
 
-In m3 because it waits on a deployment, not on code; it comes back once
+In m5 because it waits on a deployment, not on code; it comes back once
 the mesh runs lite-07.
 
 - Remove the exemption, the `with_hidden(token.peer)` in `Cluster::scope`
@@ -23,4 +23,4 @@ the mesh runs lite-07.
 
 ## Required
 
-- [The moq.pro mesh runs lite-07](/quest/m3/lite07-mesh.md) - every peer opts in on the wire
+- [The moq.pro mesh runs lite-07](/quest/m5/lite07-mesh.md) - every peer opts in on the wire
diff --git a/quest/m3/id3.md b/quest/m5/id3.md
similarity index 93%
rename from quest/m3/id3.md
rename to quest/m5/id3.md
index 3524a574b8e..bc703934b30 100644
--- a/quest/m3/id3.md
+++ b/quest/m5/id3.md
@@ -13,7 +13,7 @@ stream.
 Deferred in the 2026-09-30 audit and moved to m3 in the 2026-10-05 audit: no named consumer for timed metadata.
 
 Define the catalog section and frame contract for complete ID3 tags on the
-shared event contract [emsg](/quest/m3/emsg.md) settles. Publish tags when
+shared event contract [emsg](/quest/m5/emsg.md) settles. Publish tags when
 received on independently sequenced groups, with their presentation time on
 the broadcast clock and an optional association to the program's rendition.
 ID3-only programs need no artificial media owner. Carry original tag bytes,
@@ -39,4 +39,4 @@ generic.
 
 ## Required
 
-- [fMP4 emsg](/quest/m3/emsg.md) - settles the shared timed-metadata contract this builds on, which needs maintainer agreement first
+- [fMP4 emsg](/quest/m5/emsg.md) - settles the shared timed-metadata contract this builds on, which needs maintainer agreement first
diff --git a/quest/m3/ietf-cluster-peers.md b/quest/m5/ietf-cluster-peers.md
similarity index 94%
rename from quest/m3/ietf-cluster-peers.md
rename to quest/m5/ietf-cluster-peers.md
index d6d77366505..7381dbbbf3b 100644
--- a/quest/m3/ietf-cluster-peers.md
+++ b/quest/m5/ietf-cluster-peers.md
@@ -8,7 +8,7 @@ A moq-transport relay joins a cluster as a peer through an extended
 ## Plan
 
 The extension must carry what a lite cluster link carries by then: the route
-layer of the [cluster routing line](/quest/m1/cluster-routing/README.md)
+layer of the [cluster routing line](/quest/m2/cluster-routing/README.md)
 (per-node ROUTEs with seqno and metric, path-less announces, the down-only
 bit) and its selection.
 
@@ -42,4 +42,4 @@ Wire: extends `draft-lcurley-moq-cluster`, updated in the same PR.
 
 ## Required
 
-- [Cluster routing](/quest/m1/cluster-routing/README.md) - settles what a cluster link carries
+- [Cluster routing](/quest/m2/cluster-routing/README.md) - settles what a cluster link carries
diff --git a/quest/m2/ietf-hole-marker.md b/quest/m5/ietf-hole-marker.md
similarity index 100%
rename from quest/m2/ietf-hole-marker.md
rename to quest/m5/ietf-hole-marker.md
diff --git a/quest/m3/interop-runner-approval.md b/quest/m5/interop-runner-approval.md
similarity index 100%
rename from quest/m3/interop-runner-approval.md
rename to quest/m5/interop-runner-approval.md
diff --git a/quest/m2/json-value-diff.md b/quest/m5/json-value-diff.md
similarity index 96%
rename from quest/m2/json-value-diff.md
rename to quest/m5/json-value-diff.md
index c20721a0fc0..9a08b3abb98 100644
--- a/quest/m2/json-value-diff.md
+++ b/quest/m5/json-value-diff.md
@@ -56,5 +56,5 @@ Context:
 
 ## Related
 
-- [Compile time audit](/quest/m2/audit-compile-time.md)
-- [Artifact size audit](/quest/m2/audit-size.md)
+- [Compile time audit](/quest/m3/audit-compile-time.md)
+- [Artifact size audit](/quest/m3/audit-size.md)
diff --git a/quest/m3/ladder/README.md b/quest/m5/ladder/README.md
similarity index 95%
rename from quest/m3/ladder/README.md
rename to quest/m5/ladder/README.md
index 024bdbec998..ff470703c15 100644
--- a/quest/m3/ladder/README.md
+++ b/quest/m5/ladder/README.md
@@ -74,11 +74,11 @@ encoders on every target change.
 
 ## Required
 
-- [Controller](/quest/m3/ladder/controller.md) - one controller owns every
+- [Controller](/quest/m5/ladder/controller.md) - one controller owns every
   rung's share, target, enabled state, and send order
-- [Fetch and catalog](/quest/m3/ladder/fetch.md) - uncached FETCH encodes at
+- [Fetch and catalog](/quest/m5/ladder/fetch.md) - uncached FETCH encodes at
   the shared applied target, and rung state survives a source catalog refresh
 
 ## Related
 
-- [#2848](/quest/m2/2848-follow-the-bandwidth-grant-in-moq-audio-instead-of.md) - the other sender that reserves but never follows its grant
+- [#2848](/quest/m5/2848-follow-the-bandwidth-grant-in-moq-audio-instead-of.md) - the other sender that reserves but never follows its grant
diff --git a/quest/m3/ladder/controller.md b/quest/m5/ladder/controller.md
similarity index 96%
rename from quest/m3/ladder/controller.md
rename to quest/m5/ladder/controller.md
index c1d26cd668e..a0db6b03ab5 100644
--- a/quest/m3/ladder/controller.md
+++ b/quest/m5/ladder/controller.md
@@ -18,7 +18,7 @@ today's fixed-rate behavior exactly and never publishes congestion-induced
 `enabled` state, which is what keeps this additive.
 
 The controller subdivides that estimate across the ladder and applies the
-band boundary from the [questline](/quest/m3/ladder/README.md), including the
+band boundary from the [questline](/quest/m5/ladder/README.md), including the
 lowest rung's `max / 3` case. `moq_transcode::Ladder` is ascending: `new`
 sorts by configured maximum (`rs/moq-transcode/src/ladder.rs`) and
 `rungs()` is lowest first, so the next lower rendition the
@@ -67,4 +67,4 @@ priority where the subscriber's order wins, and a custom ladder order.
 
 ## Related
 
-- [Encoder feedback](/quest/m3/stats-encoder-feedback.md) - viewer stalls for `moq import`; its `moq transcode --echo` leg, split out if revived, feeds this controller
+- [Encoder feedback](/quest/m5/stats-encoder-feedback.md) - viewer stalls for `moq import`; its `moq transcode --echo` leg, split out if revived, feeds this controller
diff --git a/quest/m3/ladder/fetch.md b/quest/m5/ladder/fetch.md
similarity index 92%
rename from quest/m3/ladder/fetch.md
rename to quest/m5/ladder/fetch.md
index fdd9e90adb3..3fdc63ae06f 100644
--- a/quest/m3/ladder/fetch.md
+++ b/quest/m5/ladder/fetch.md
@@ -33,9 +33,9 @@ intact.
 
 ## Required
 
-- [Controller](/quest/m3/ladder/controller.md) - there is no shared applied
+- [Controller](/quest/m5/ladder/controller.md) - there is no shared applied
   target to read until the controller owns one
 
 ## Related
 
-- [On-demand pops](/quest/m2/video-quality/on-demand.md) - grades and fixes cold-start pops in the same fetch encoder this quest retargets
+- [On-demand pops](/quest/m3/video-quality/on-demand.md) - grades and fixes cold-start pops in the same fetch encoder this quest retargets
diff --git a/quest/m2/latency-ledger.md b/quest/m5/latency-ledger.md
similarity index 93%
rename from quest/m2/latency-ledger.md
rename to quest/m5/latency-ledger.md
index a9b15b73e79..65d6bb999bd 100644
--- a/quest/m2/latency-ledger.md
+++ b/quest/m5/latency-ledger.md
@@ -48,9 +48,9 @@ probes, which was the right trade to get it running. This quest promotes them.
 
 ## Required
 
-- [Rust reporters](/quest/m2/stats/rust.md) - `moq play --echo` publishes the feedback snapshot these stages join
+- [Rust reporters](/quest/m3/stats/rust.md) - `moq play --echo` publishes the feedback snapshot these stages join
 
 ## Related
 
-- [QoS](/quest/m2/qos/README.md) - relay-side health, the same idea from the other end
-- [Media stats](/quest/m2/stats/README.md) - the hang stats and `.echo` snapshots these stages join
+- [QoS](/quest/m3/qos/README.md) - relay-side health, the same idea from the other end
+- [Media stats](/quest/m3/stats/README.md) - the hang stats and `.echo` snapshots these stages join
diff --git a/quest/m2/link-quality.md b/quest/m5/link-quality.md
similarity index 89%
rename from quest/m2/link-quality.md
rename to quest/m5/link-quality.md
index 014e99c80ce..984f9967105 100644
--- a/quest/m2/link-quality.md
+++ b/quest/m5/link-quality.md
@@ -14,7 +14,7 @@ Decided 2026-10-01: the wire carries one additive metric and each node
 computes its own link costs.
 
 Decided 2026-10-08: m2, and Related rather than Required for the
-[cluster routing line](/quest/m1/cluster-routing/README.md): static costs are
+[cluster routing line](/quest/m2/cluster-routing/README.md): static costs are
 the default and measured cost is opt-in, so the line ships without it.
 
 - Derive the cost from what QUIC already measures (smoothed RTT, loss); an
@@ -28,7 +28,7 @@ the default and measured cost is opt-in, so the line ships without it.
   opt-in on links the operator chooses.
 - A lossy-link fixture over the mock transport with mocked time.
 
-[Route health](/quest/m2/route-health/README.md) is separate: it detects
+[Route health](/quest/m5/route-health/README.md) is separate: it detects
 stalled epoch-bound track delivery using metadata-only standby observations,
 without repricing the whole network from local health evidence.
 
@@ -37,4 +37,4 @@ Wire: none.
 
 ## Required
 
-- [Routes and announces](/quest/m1/cluster-routing/routes/README.md) - a cost change costs one ROUTE per origin there, instead of a re-announce per broadcast
+- [Routes and announces](/quest/m2/cluster-routing/routes/README.md) - a cost change costs one ROUTE per origin there, instead of a re-announce per broadcast
diff --git a/quest/m3/lite05-subscribe-end.md b/quest/m5/lite05-subscribe-end.md
similarity index 100%
rename from quest/m3/lite05-subscribe-end.md
rename to quest/m5/lite05-subscribe-end.md
diff --git a/quest/m3/lite07-mesh.md b/quest/m5/lite07-mesh.md
similarity index 87%
rename from quest/m3/lite07-mesh.md
rename to quest/m5/lite07-mesh.md
index 9320b6618b8..4376c667229 100644
--- a/quest/m3/lite07-mesh.md
+++ b/quest/m5/lite07-mesh.md
@@ -10,10 +10,10 @@ this quest and every `Required` entry that links it.
 
 ## Plan
 
-moq.pro's lite-07 rollout waits on [Finalize moq-lite-07](/quest/m1/lite07-finalize.md), so this
+moq.pro's lite-07 rollout waits on [Finalize moq-lite-07](/quest/m2/lite07-finalize.md), so this
 condition cannot clear before a release carries the final version.
 
-Decided 2026-10-05: [Cluster routing](/quest/m1/cluster-routing/README.md)'s
+Decided 2026-10-05: [Cluster routing](/quest/m2/cluster-routing/README.md)'s
 route layer lands in lite-07, so the final lite-07 carries ROUTE and
 path-less ANNOUNCE instead of hop lists, and loses the `Hop Base`/`Hop Keep`
 announce compression. moq.pro's rollout must plan for that wire.
diff --git a/quest/m3/mesh-ice.md b/quest/m5/mesh-ice.md
similarity index 62%
rename from quest/m3/mesh-ice.md
rename to quest/m5/mesh-ice.md
index 2fa149dffb6..4d219957b3c 100644
--- a/quest/m3/mesh-ice.md
+++ b/quest/m5/mesh-ice.md
@@ -3,20 +3,20 @@
 ## Goal
 
 Mesh nodes on different networks that cannot dial each other's addresses
-connect directly through the [P2P](/quest/m2/p2p/README.md) line's native
+connect directly through the [P2P](/quest/m4/p2p/README.md) line's native
 QUIC-over-ICE pairs, with the relay as rendezvous and fallback, and the
-direct link joins the [sparse overlay](/quest/m2/mesh/overlay.md) as an
+direct link joins the [sparse overlay](/quest/m3/mesh/overlay.md) as an
 ordinary link.
 
 ## Plan
 
 Parked 2026-10-31 (maintainer, moq.pro mesh planning interview): remote mesh
-traffic is meant to cross relays, so hole punching waits in m3 until a mesh
+traffic is meant to cross relays, so hole punching waits in m5 until a mesh
 user needs it. Reuse the P2P line's ICE, signaling under the mesh's own
 prefix, and operator-supplied ICE servers; no TURN, since the relay already
 carries the fallback route.
 
 ## Required
 
-- [Native pairs over ICE and QUIC](/quest/m2/p2p/native-quic.md) - the transport this reuses
-- [Sparse overlay](/quest/m2/mesh/overlay.md) - the overlay the direct link joins
+- [Native pairs over ICE and QUIC](/quest/m4/p2p/native-quic.md) - the transport this reuses
+- [Sparse overlay](/quest/m3/mesh/overlay.md) - the overlay the direct link joins
diff --git a/quest/m3/mesh-keys.md b/quest/m5/mesh-keys.md
similarity index 87%
rename from quest/m3/mesh-keys.md
rename to quest/m5/mesh-keys.md
index 1f39d52bc5f..a24ce8ca614 100644
--- a/quest/m3/mesh-keys.md
+++ b/quest/m5/mesh-keys.md
@@ -19,5 +19,5 @@ Revisit when a mesh user needs confidentiality from relays.
 
 ## Related
 
-- [Mesh](/quest/m2/mesh/README.md) - the protection levels this completes
-- [End-to-end encryption](/quest/m2/e2ee/README.md) - the AEAD and its key contract
+- [Mesh](/quest/m3/mesh/README.md) - the protection levels this completes
+- [End-to-end encryption](/quest/m5/e2ee/README.md) - the AEAD and its key contract
diff --git a/quest/m3/mkv-input-coalesce.md b/quest/m5/mkv-input-coalesce.md
similarity index 100%
rename from quest/m3/mkv-input-coalesce.md
rename to quest/m5/mkv-input-coalesce.md
diff --git a/quest/m3/msf-publish-tracks.md b/quest/m5/msf-publish-tracks.md
similarity index 93%
rename from quest/m3/msf-publish-tracks.md
rename to quest/m5/msf-publish-tracks.md
index a87c2a5d3ec..22624c59df0 100644
--- a/quest/m3/msf-publish-tracks.md
+++ b/quest/m5/msf-publish-tracks.md
@@ -12,7 +12,7 @@ consumer asks.
 Raised in [#5360](https://github.com/moq-dev/moq/issues/5360). Until then the
 [media stats schema](/doc/concept/stats.md#media-reports) leaves both sections out of
 the MSF catalog. `moq export --echo` refuses `--catalog-format msf`, and the
-[Rust reporters](/quest/m2/stats/rust.md) quest's `moq play --echo` will
+[Rust reporters](/quest/m3/stats/rust.md) quest's `moq play --echo` will
 (decided 2026-10-12).
 
 Open: how the entry names the hang payload, since MSF fixes its packaging
diff --git a/quest/m3/msfts-convergence.md b/quest/m5/msfts-convergence.md
similarity index 100%
rename from quest/m3/msfts-convergence.md
rename to quest/m5/msfts-convergence.md
diff --git a/quest/m2/native-compression-adopt.md b/quest/m5/native-compression-adopt.md
similarity index 95%
rename from quest/m2/native-compression-adopt.md
rename to quest/m5/native-compression-adopt.md
index 942d426832c..9561defb393 100644
--- a/quest/m2/native-compression-adopt.md
+++ b/quest/m5/native-compression-adopt.md
@@ -42,5 +42,5 @@ main-thread blocking through workers, or a new preparation API.
 
 ## Related
 
-- [Frame flush report](/quest/m2/native-compression-flush.md) - the native nonfinal encoder flush gap
-- [Synchronous codec report](/quest/m2/native-compression-sync.md) - the stateful synchronous API gap
+- [Frame flush report](/quest/m5/native-compression-flush.md) - the native nonfinal encoder flush gap
+- [Synchronous codec report](/quest/m5/native-compression-sync.md) - the stateful synchronous API gap
diff --git a/quest/m2/native-compression-flush.md b/quest/m5/native-compression-flush.md
similarity index 95%
rename from quest/m2/native-compression-flush.md
rename to quest/m5/native-compression-flush.md
index 564ff405774..c2cec1ab79d 100644
--- a/quest/m2/native-compression-flush.md
+++ b/quest/m5/native-compression-flush.md
@@ -42,5 +42,5 @@ No public API, wire or new documentation page in this reporting work.
 
 ## Related
 
-- [Synchronous codecs](/quest/m2/native-compression-sync.md) - stateful synchronous calls are a separate API requirement
-- [Native adoption](/quest/m2/native-compression-adopt.md) - replace bundled code only when the native contract fits
+- [Synchronous codecs](/quest/m5/native-compression-sync.md) - stateful synchronous calls are a separate API requirement
+- [Native adoption](/quest/m5/native-compression-adopt.md) - replace bundled code only when the native contract fits
diff --git a/quest/m2/native-compression-sync.md b/quest/m5/native-compression-sync.md
similarity index 94%
rename from quest/m2/native-compression-sync.md
rename to quest/m5/native-compression-sync.md
index 001829a4327..a5c05a3eefd 100644
--- a/quest/m2/native-compression-sync.md
+++ b/quest/m5/native-compression-sync.md
@@ -39,5 +39,5 @@ No public API, wire or new documentation page in this reporting work.
 
 ## Related
 
-- [Frame flush](/quest/m2/native-compression-flush.md) - nonfinal output while retaining the dictionary
-- [Native adoption](/quest/m2/native-compression-adopt.md) - use native operations after verifying the existing contract
+- [Frame flush](/quest/m5/native-compression-flush.md) - nonfinal output while retaining the dictionary
+- [Native adoption](/quest/m5/native-compression-adopt.md) - use native operations after verifying the existing contract
diff --git a/quest/m2/net-wrap/README.md b/quest/m5/net-wrap/README.md
similarity index 87%
rename from quest/m2/net-wrap/README.md
rename to quest/m5/net-wrap/README.md
index b857528b020..be5fc435e1e 100644
--- a/quest/m2/net-wrap/README.md
+++ b/quest/m5/net-wrap/README.md
@@ -15,7 +15,7 @@ Compression is not a wrapper: it moves into moq-net as a track flag
 moq-flate, so moq-flate is out of scope.
 
 Non-goals:
-- A runtime seam: libraries poll and spawn nothing ([the remaining library spawns](/quest/m2/spawn-audit.md)).
+- A runtime seam: libraries poll and spawn nothing ([the remaining library spawns](/quest/m3/spawn-audit.md)).
 - The transport seam: custom transports implement moq-net's `transport::poll` traits, including both native WebTransport backends.
 
 ## Plan
@@ -56,7 +56,7 @@ and its trait-versus-bridge comparison:
 - **Scope is every writer and reader above moq-net:** moq-mux (with the
   moq-video and moq-audio encoders built on it), moq-json, moq-stats, hang,
   and the CLI paths, plus the JS packages that need it.
-- **Ships in m2 with e2ee**, not in m1's breaking release: it is a public
+- **Ships in m5 with e2ee**, not in m2's breaking release: it is a public
   API break, and e2ee is its first consumer.
 
 Today moq-net has no model traits (only `Consume<T>` in
@@ -66,18 +66,18 @@ snapshot, stream, and window `Producer::new(track::Producer)` and
 `Consumer::new(track::Subscriber)`.
 
 Open: the trait names. Bring options with a recommendation in the
-[moq-net traits](/quest/m2/net-wrap/traits.md) PR; the methods are fixed
+[moq-net traits](/quest/m5/net-wrap/traits.md) PR; the methods are fixed
 above.
 
 ## Required
 
-- [moq-net traits](/quest/m2/net-wrap/traits.md) - moq-net exports producer and consumer traits at every level, implemented by its own types
-- [moq-crypto's e2ee implements the traits](/quest/m2/net-wrap/e2ee.md) - the e2ee broadcast, track, and group wrappers implement the traits, proving them before the adopters land
-- [moq-json, moq-stats, and hang take the traits](/quest/m2/net-wrap/json.md) - json snapshots, streams, windows, the stats producer, and hang's tracks write and read through the traits
-- [moq-mux takes the traits](/quest/m2/net-wrap/mux.md) - importers, catalog, container, timeline, json tracks, `Source`, TS export, and the moq-video and moq-audio encoders are generic over the traits
-- [CLI paths take the traits](/quest/m2/net-wrap/cli.md) - the CLI's publish and play paths hand moq-mux any broadcast that implements them
-- [JS mirror](/quest/m2/net-wrap/js.md) - `@moq/net` exports the same interfaces, taken by `@moq/hang`, `@moq/publish`, and `@moq/watch`, and implemented by `@moq/crypto`
+- [moq-net traits](/quest/m5/net-wrap/traits.md) - moq-net exports producer and consumer traits at every level, implemented by its own types
+- [moq-crypto's e2ee implements the traits](/quest/m5/net-wrap/e2ee.md) - the e2ee broadcast, track, and group wrappers implement the traits, proving them before the adopters land
+- [moq-json, moq-stats, and hang take the traits](/quest/m5/net-wrap/json.md) - json snapshots, streams, windows, the stats producer, and hang's tracks write and read through the traits
+- [moq-mux takes the traits](/quest/m5/net-wrap/mux.md) - importers, catalog, container, timeline, json tracks, `Source`, TS export, and the moq-video and moq-audio encoders are generic over the traits
+- [CLI paths take the traits](/quest/m5/net-wrap/cli.md) - the CLI's publish and play paths hand moq-mux any broadcast that implements them
+- [JS mirror](/quest/m5/net-wrap/js.md) - `@moq/net` exports the same interfaces, taken by `@moq/hang`, `@moq/publish`, and `@moq/watch`, and implemented by `@moq/crypto`
 
 ## Related
 
-- [E2EE](/quest/m2/e2ee/README.md) - the first wrapper, which publishes and consumes through these traits
+- [E2EE](/quest/m5/e2ee/README.md) - the first wrapper, which publishes and consumes through these traits
diff --git a/quest/m2/net-wrap/cli.md b/quest/m5/net-wrap/cli.md
similarity index 77%
rename from quest/m2/net-wrap/cli.md
rename to quest/m5/net-wrap/cli.md
index 6253c00cf9c..33df4847c30 100644
--- a/quest/m2/net-wrap/cli.md
+++ b/quest/m5/net-wrap/cli.md
@@ -3,8 +3,8 @@
 ## Goal
 
 `moq-cli`'s publish and play paths hand moq-mux a broadcast through the
-[moq-net traits](/quest/m2/net-wrap/traits.md), so the
-[encrypted CLI](/quest/m2/e2ee/cli.md) only swaps in an encrypted broadcast
+[moq-net traits](/quest/m5/net-wrap/traits.md), so the
+[encrypted CLI](/quest/m5/e2ee/cli.md) only swaps in an encrypted broadcast
 and adds no crypto to the import, capture, export, or playback code.
 
 ## Plan
@@ -19,4 +19,4 @@ Public API: none outside moq-cli. Wire: none.
 
 ## Required
 
-- [moq-mux takes the traits](/quest/m2/net-wrap/mux.md) - the CLI drives moq-mux
+- [moq-mux takes the traits](/quest/m5/net-wrap/mux.md) - the CLI drives moq-mux
diff --git a/quest/m2/net-wrap/e2ee.md b/quest/m5/net-wrap/e2ee.md
similarity index 94%
rename from quest/m2/net-wrap/e2ee.md
rename to quest/m5/net-wrap/e2ee.md
index 35046297d52..642c380f1d4 100644
--- a/quest/m2/net-wrap/e2ee.md
+++ b/quest/m5/net-wrap/e2ee.md
@@ -3,7 +3,7 @@
 ## Goal
 
 moq-crypto's e2ee broadcast, track, and group wrappers implement the
-[moq-net traits](/quest/m2/net-wrap/traits.md), so anything generic over them
+[moq-net traits](/quest/m5/net-wrap/traits.md), so anything generic over them
 publishes or consumes an encrypted broadcast unchanged, under semantic track
 names.
 
@@ -42,10 +42,10 @@ the reverse (decided 2026-10-20, maintainer):
   the same group and pool limits as a plain frame, and an inflate that
   differs from it is an error, as moq-net's compression contract requires.
   This keeps
-  [rust-publish](/quest/m2/e2ee/rust-publish.md)'s rule that protected
+  [rust-publish](/quest/m5/e2ee/rust-publish.md)'s rule that protected
   catalogs compress before encryption, and needs moq-net to expose its group
   codec to the wrapper. `@moq/crypto` does the same in
-  [JS](/quest/m2/net-wrap/js.md).
+  [JS](/quest/m5/net-wrap/js.md).
 - The subscriber's wrapper learns the logical flag from authenticated E2EE
   metadata, never from the physical track (decided 2026-10-20, maintainer):
   the physical track's `compress` is always false, so it can't signal it.
@@ -53,7 +53,7 @@ the reverse (decided 2026-10-20, maintainer):
   authentication fails the track loudly. Not the encrypted catalog: the
   catalog track is itself compressed, so a subscriber would need the flag
   before it could inflate the catalog that carries it. The
-  [E2EE epic](/quest/m2/e2ee/README.md) also keeps catalog formats out of
+  [E2EE epic](/quest/m5/e2ee/README.md) also keeps catalog formats out of
   moq-crypto, and the [compression migration](https://github.com/moq-dev/moq/pull/7046) dropped hang's
   `compression` field. The subscriber needs the flag before inflating,
   without changing moq-net's `track(name)`; propose the encoding in the PR.
@@ -91,7 +91,7 @@ the reverse (decided 2026-10-20, maintainer):
   refusal; moq-crypto's claims already resume).
 - Test the wrappers against the questline's pass-through test cases. The
   moq-json round trip through an encrypted track waits for
-  [moq-json to take the traits](/quest/m2/net-wrap/json.md).
+  [moq-json to take the traits](/quest/m5/net-wrap/json.md).
 
 Public API: the moq-crypto wrapper signatures change to moq-net's. Wire:
 `draft-lcurley-moq-e2ee.md` gains the authenticated logical `compress` flag
@@ -99,4 +99,4 @@ and each compressed object's authenticated inflated size.
 
 ## Required
 
-- [moq-net traits](/quest/m2/net-wrap/traits.md) - the traits this implements
+- [moq-net traits](/quest/m5/net-wrap/traits.md) - the traits this implements
diff --git a/quest/m2/net-wrap/js.md b/quest/m5/net-wrap/js.md
similarity index 84%
rename from quest/m2/net-wrap/js.md
rename to quest/m5/net-wrap/js.md
index 86bdb461508..3a655fc66ec 100644
--- a/quest/m2/net-wrap/js.md
+++ b/quest/m5/net-wrap/js.md
@@ -10,7 +10,7 @@ its own decryption path.
 
 ## Plan
 
-- Mirror the [Rust traits](/quest/m2/net-wrap/traits.md) one to one, per the
+- Mirror the [Rust traits](/quest/m5/net-wrap/traits.md) one to one, per the
   cross-language naming rule. TypeScript's structural types make the default
   free; there is no dispatch question.
 - Take the interfaces only where a wrapper must pass through, as needed:
@@ -21,7 +21,7 @@ its own decryption path.
   `@moq/net`'s. Like moq-crypto, it compresses a `compress` track before
   encryption, publishes the physical track uncompressed, and carries the
   logical flag in the same authenticated E2EE metadata
-  ([e2ee](/quest/m2/net-wrap/e2ee.md)).
+  ([e2ee](/quest/m5/net-wrap/e2ee.md)).
 - Demand and preference cross the wrapper: a publisher with no viewer
   through an encrypted track stays idle.
 - Test publish and watch round trips through a pass-through wrapper and
@@ -29,10 +29,10 @@ its own decryption path.
 
 Public API: new `@moq/net` interfaces; `@moq/crypto` wrapper signatures change.
 Wire: the `draft-lcurley-moq-e2ee.md` compress flag from
-[e2ee](/quest/m2/net-wrap/e2ee.md).
+[e2ee](/quest/m5/net-wrap/e2ee.md).
 
 ## Required
 
-- [moq-net traits](/quest/m2/net-wrap/traits.md) - the names and methods this mirrors
+- [moq-net traits](/quest/m5/net-wrap/traits.md) - the names and methods this mirrors
 
-- [moq-crypto's e2ee implements the traits](/quest/m2/net-wrap/e2ee.md) - owns the authenticated logical compression encoding this mirrors
+- [moq-crypto's e2ee implements the traits](/quest/m5/net-wrap/e2ee.md) - owns the authenticated logical compression encoding this mirrors
diff --git a/quest/m2/net-wrap/json.md b/quest/m5/net-wrap/json.md
similarity index 88%
rename from quest/m2/net-wrap/json.md
rename to quest/m5/net-wrap/json.md
index 1381100d68a..22ed8ddce23 100644
--- a/quest/m2/net-wrap/json.md
+++ b/quest/m5/net-wrap/json.md
@@ -5,7 +5,7 @@
 moq-json's snapshot, stream, and window producers and consumers, the
 moq-stats producer and consumer, and hang's catalog, container, stats, echo,
 and timeline tracks are generic over the
-[moq-net traits](/quest/m2/net-wrap/traits.md), defaulting to moq-net's
+[moq-net traits](/quest/m5/net-wrap/traits.md), defaulting to moq-net's
 types, so each publishes into and reads from a wrapped track unchanged.
 
 ## Plan
@@ -31,5 +31,5 @@ moq-stats, and hang. Wire: none.
 
 ## Required
 
-- [moq-net traits](/quest/m2/net-wrap/traits.md) - the traits these take
-- [moq-crypto's e2ee implements the traits](/quest/m2/net-wrap/e2ee.md) - the encrypted track the snapshot round trip runs through
+- [moq-net traits](/quest/m5/net-wrap/traits.md) - the traits these take
+- [moq-crypto's e2ee implements the traits](/quest/m5/net-wrap/e2ee.md) - the encrypted track the snapshot round trip runs through
diff --git a/quest/m2/net-wrap/mux.md b/quest/m5/net-wrap/mux.md
similarity index 90%
rename from quest/m2/net-wrap/mux.md
rename to quest/m5/net-wrap/mux.md
index cb78d5d14d8..f49a7f76cc3 100644
--- a/quest/m2/net-wrap/mux.md
+++ b/quest/m5/net-wrap/mux.md
@@ -3,7 +3,7 @@
 ## Goal
 
 moq-mux writes and reads through the
-[moq-net traits](/quest/m2/net-wrap/traits.md), defaulting to moq-net's
+[moq-net traits](/quest/m5/net-wrap/traits.md), defaulting to moq-net's
 types: the importers, catalog, container producers and consumers, timeline,
 json tracks, `Source`, and TS export. The moq-video and moq-audio
 encode producers built on moq-mux take them too. Handed an encrypted
@@ -31,11 +31,11 @@ exporter reads one, without knowing.
   bench flat before and after.
 - Test an import and export round trip (fMP4 and TS) through the moq-net
   pass-through test wrapper, plus one through moq-crypto's wrappers once
-  [they implement the traits](/quest/m2/net-wrap/e2ee.md).
+  [they implement the traits](/quest/m5/net-wrap/e2ee.md).
 
 Public API: generic type parameters with moq-net defaults across moq-mux.
 Wire: none.
 
 ## Required
 
-- [moq-json, moq-stats, and hang take the traits](/quest/m2/net-wrap/json.md) - moq-mux writes catalogs and json tracks through them
+- [moq-json, moq-stats, and hang take the traits](/quest/m5/net-wrap/json.md) - moq-mux writes catalogs and json tracks through them
diff --git a/quest/m2/net-wrap/traits.md b/quest/m5/net-wrap/traits.md
similarity index 95%
rename from quest/m2/net-wrap/traits.md
rename to quest/m5/net-wrap/traits.md
index c1132c289ee..0b1258599f2 100644
--- a/quest/m2/net-wrap/traits.md
+++ b/quest/m5/net-wrap/traits.md
@@ -9,7 +9,7 @@ moq-net's types by default and against a wrapper's types when handed one.
 
 ## Plan
 
-See the [questline](/quest/m2/net-wrap/README.md) for the decisions: generics
+See the [questline](/quest/m5/net-wrap/README.md) for the decisions: generics
 with moq-net's types as the default, no `Send` bounds beyond moq-net's own, and
 the methods exactly as moq-net has them today.
 
@@ -70,4 +70,4 @@ they wait for the breaking release cut.
 
 ## Required
 
-- [Breaking release cut](/quest/m2/release/cut.md) - the traits land after the cut that ships m1's breaks
+- [Breaking release cut](/quest/m3/release/cut.md) - the traits land after the cut that ships m2's breaks
diff --git a/quest/m3/nvenc-av1.md b/quest/m5/nvenc-av1.md
similarity index 81%
rename from quest/m3/nvenc-av1.md
rename to quest/m5/nvenc-av1.md
index 362200a56f7..af42494840e 100644
--- a/quest/m3/nvenc-av1.md
+++ b/quest/m5/nvenc-av1.md
@@ -8,7 +8,7 @@ transcode, and refuses it elsewhere.
 
 ## Plan
 
-Split from the Main10 quest in the 2026-09-30 audit. It sits in m3 because it
+Split from the Main10 quest in the 2026-09-30 audit. It sits in m5 because it
 is hardware-gated: AV1 NVENC needs an Ada GPU, and the only GPU CI host is an
 RTX 3070 Ti. An Ada GPU on a CI host, or a consumer asking for AV1 encode,
 brings it back.
@@ -23,9 +23,9 @@ Public API: additive. Wire: existing AV1 codec signaling.
 
 ## Required
 
-- [An Ada NVIDIA GPU is available](/quest/m3/ada-gpu.md) - the hardware to verify on
+- [An Ada NVIDIA GPU is available](/quest/m5/ada-gpu.md) - the hardware to verify on
 
 ## Related
 
-- [Main10](/quest/m3/2147-moq-video-10-bit-hevc-and-av1-support-in-the-nvidia-codec.md) - the other half of #2147
-- [GPU CI](/quest/m2/gpu-ci.md) - the current runner lacks AV1 NVENC
+- [Main10](/quest/m5/2147-moq-video-10-bit-hevc-and-av1-support-in-the-nvidia-codec.md) - the other half of #2147
+- [GPU CI](/quest/m3/gpu-ci.md) - the current runner lacks AV1 NVENC
diff --git a/quest/m3/nvenc-cuda-arrays.md b/quest/m5/nvenc-cuda-arrays.md
similarity index 95%
rename from quest/m3/nvenc-cuda-arrays.md
rename to quest/m5/nvenc-cuda-arrays.md
index c3e5a4a1e55..f1e0ce192a0 100644
--- a/quest/m3/nvenc-cuda-arrays.md
+++ b/quest/m5/nvenc-cuda-arrays.md
@@ -20,5 +20,5 @@ Public API: possibly a CUDA-array frame variant in moq-video's GPU frame types.
 
 ## Related
 
-- [NVENC reuses its input and output buffers](/quest/m2/nvenc-pool.md) - per-frame allocation on the encode side, distinct from this copy
-- [GPU CI](/quest/m2/gpu-ci.md) - the NVIDIA host this would validate on once its driver is new enough
+- [NVENC reuses its input and output buffers](/quest/m5/nvenc-pool.md) - per-frame allocation on the encode side, distinct from this copy
+- [GPU CI](/quest/m3/gpu-ci.md) - the NVIDIA host this would validate on once its driver is new enough
diff --git a/quest/m2/nvenc-pool.md b/quest/m5/nvenc-pool.md
similarity index 100%
rename from quest/m2/nvenc-pool.md
rename to quest/m5/nvenc-pool.md
diff --git a/quest/m2/obs-decode-linux.md b/quest/m5/obs-decode-linux.md
similarity index 92%
rename from quest/m2/obs-decode-linux.md
rename to quest/m5/obs-decode-linux.md
index 87ecf901471..dd6c627e3c5 100644
--- a/quest/m2/obs-decode-linux.md
+++ b/quest/m5/obs-decode-linux.md
@@ -13,8 +13,8 @@ At least one supported Linux hardware decoder delivers frames to OBS without CPU
 
 ## Required
 
-- [Video source replacement](/quest/m2/obs-moq-video/source.md) - native frame contract and fallback lifecycle
+- [Video source replacement](/quest/m3/obs-moq-video/source.md) - native frame contract and fallback lifecycle
 
 ## Related
 
-- [VAAPI encode and decode](/quest/m2/video-vaapi.md) - owns remaining VAAPI decode and native surface gaps; avoid a duplicate backend implementation
+- [VAAPI encode and decode](/quest/m1/video-vaapi.md) - owns remaining VAAPI decode and native surface gaps; avoid a duplicate backend implementation
diff --git a/quest/m2/obs-decode-windows.md b/quest/m5/obs-decode-windows.md
similarity index 95%
rename from quest/m2/obs-decode-windows.md
rename to quest/m5/obs-decode-windows.md
index 1c71633ba50..5b41fdba334 100644
--- a/quest/m2/obs-decode-windows.md
+++ b/quest/m5/obs-decode-windows.md
@@ -12,4 +12,4 @@ Supported Windows hardware decoders deliver GPU frames to the OBS source without
 
 ## Required
 
-- [Video source replacement](/quest/m2/obs-moq-video/source.md) - shared native frame ownership, source rendering, and CPU fallback
+- [Video source replacement](/quest/m3/obs-moq-video/source.md) - shared native frame ownership, source rendering, and CPU fallback
diff --git a/quest/m3/obs-linux-gpu.md b/quest/m5/obs-linux-gpu.md
similarity index 87%
rename from quest/m3/obs-linux-gpu.md
rename to quest/m5/obs-linux-gpu.md
index 3e36215094b..e5901d4ed37 100644
--- a/quest/m3/obs-linux-gpu.md
+++ b/quest/m5/obs-linux-gpu.md
@@ -6,7 +6,7 @@ A supported Linux OBS graphics/encoder combination publishes composited video wi
 
 ## Plan
 
-In m3 until the OBS encoder ships and a Linux user reports CPU readback as
+In m5 until the OBS encoder ships and a Linux user reports CPU readback as
 the bottleneck.
 
 - Start with an API feasibility probe. OBS exposes DMA-BUF import in `graphics.h`; that is not proof its compositor textures can be exported. Determine whether EGL/GL allocation export is available, or whether an upstream OBS hook or an encoder-owned exportable render target is required.
@@ -18,10 +18,10 @@ the bottleneck.
 
 ## Required
 
-- [Encoder adapter](/quest/m2/obs-moq-video/adapter.md) - frame ownership, queue policy, packet output, and comparison baseline
+- [Encoder adapter](/quest/m3/obs-moq-video/adapter.md) - frame ownership, queue policy, packet output, and comparison baseline
 
 ## Related
 
-- [Video hardware validation](/quest/m3/video-hardware.md) - native input and encoder acceptance need hardware evidence
-- [VA-API encodes an external Vulkan image](/quest/m2/vaapi-vulkan-import.md) - explicit sync for an external DMA-BUF, and the public `DmaBuf` constructor from #4975
-- [VAAPI encode and decode](/quest/m2/video-vaapi.md) - H.265 and checked-in bindings. The DMA-BUF encoder import this quest needs is already on main (moq-vaapi 0.1.1).
+- [Video hardware validation](/quest/m5/video-hardware.md) - native input and encoder acceptance need hardware evidence
+- [VA-API encodes an external Vulkan image](/quest/m3/vaapi-vulkan-import.md) - explicit sync for an external DMA-BUF, and the public `DmaBuf` constructor from #4975
+- [VAAPI encode and decode](/quest/m1/video-vaapi.md) - H.265 and checked-in bindings. The DMA-BUF encoder import this quest needs is already on main (moq-vaapi 0.1.1).
diff --git a/quest/m2/obs-macos.md b/quest/m5/obs-macos.md
similarity index 95%
rename from quest/m2/obs-macos.md
rename to quest/m5/obs-macos.md
index 7b7576f915b..b9ff0483bfe 100644
--- a/quest/m2/obs-macos.md
+++ b/quest/m5/obs-macos.md
@@ -13,4 +13,4 @@ An OBS compositor frame reaches moq-video's VideoToolbox encoder without a GPU-t
 
 ## Required
 
-- [Encoder adapter](/quest/m2/obs-moq-video/adapter.md) - frame ownership, queue policy, packet output, and comparison baseline
+- [Encoder adapter](/quest/m3/obs-moq-video/adapter.md) - frame ownership, queue policy, packet output, and comparison baseline
diff --git a/quest/m2/obs-windows.md b/quest/m5/obs-windows.md
similarity index 96%
rename from quest/m2/obs-windows.md
rename to quest/m5/obs-windows.md
index f3f5f6f656e..ac09644bf4c 100644
--- a/quest/m2/obs-windows.md
+++ b/quest/m5/obs-windows.md
@@ -20,4 +20,4 @@ The moq-video OBS encoder consumes compositor output through D3D11 without CPU s
 
 ## Required
 
-- [Encoder adapter](/quest/m2/obs-moq-video/adapter.md) - frame ownership, queue policy, packet output, and comparison baseline
+- [Encoder adapter](/quest/m3/obs-moq-video/adapter.md) - frame ownership, queue policy, packet output, and comparison baseline
diff --git a/quest/m2/origin-front-parks.md b/quest/m5/origin-front-parks.md
similarity index 100%
rename from quest/m2/origin-front-parks.md
rename to quest/m5/origin-front-parks.md
diff --git a/quest/m2/performance-survey/README.md b/quest/m5/performance-survey/README.md
similarity index 89%
rename from quest/m2/performance-survey/README.md
rename to quest/m5/performance-survey/README.md
index 76fac586cb5..e3c036db42a 100644
--- a/quest/m2/performance-survey/README.md
+++ b/quest/m5/performance-survey/README.md
@@ -17,7 +17,7 @@ Requested on 2026-10-22: an extensive performance audit and quests requiring
 benchmarks to validate findings. Audited main
 [`1d43c096e044`](https://github.com/moq-dev/moq/commit/1d43c096e04431bfc87d807ce47a546df8017475).
 These are source-supported hypotheses, not new measured regressions or
-promised speedups. General optimization stays in m2 under the existing
+promised speedups. General optimization stays in m4 under the existing
 milestone policy. Do not change API, wire, scheduling policy, or retention
 contracts just to improve a number; bring a necessary contract change to the
 maintainer with the measurement first. No new user guide is needed for this
@@ -146,16 +146,16 @@ The `js/replay` nightly series and the browser smoke's `replay.json` protect it.
   receive, provided buffers, GRO/GSO, deferred/cooperative task running,
   coalesced futex wakes and per-worker CID-steered sockets. Measure these
   with existing ablations before adding another mechanism.
-- [Ring submission setup](/quest/m2/3199-moq-uring-remove-sq-indirection-and-per-enter-ring-fd.md)
-  and [completion batching](/quest/m2/3200-moq-uring-batch-completion-wakeups-with-min-timeout.md)
+- [Ring submission setup](/quest/m5/3199-moq-uring-remove-sq-indirection-and-per-enter-ring-fd.md)
+  and [completion batching](/quest/m5/3200-moq-uring-batch-completion-wakeups-with-min-timeout.md)
   already own the small ring experiments. Batching must preserve deadlines
   and latency tails, not merely reduce syscalls.
-- [Zero-copy sends](/quest/m3/3201-moq-uring-use-sendmsg-zc-for-large-udp-gso-trains.md)
+- [Zero-copy sends](/quest/m5/3201-moq-uring-use-sendmsg-zc-for-large-udp-gso-trains.md)
   need physical-NIC evidence: the previous loopback prototype lost 6-9%
   while exercising copy fallback. Deferred completion ownership, pinned
   memory and CQ pressure are costs to measure, not free benefits.
-  [QUIC I/O ownership](/quest/m2/quic-io-boundary.md) owns the buffer seam.
-- Extend [worker defaults](/quest/m2/perf/shard-default.md) with NUMA, SMT,
+  [QUIC I/O ownership](/quest/m5/quic-io-boundary.md) owns the buffer seam.
+- Extend [worker defaults](/quest/m4/perf/shard-default.md) with NUMA, SMT,
   NIC queues and CPU quotas. Application CID steering does not establish
   matching NIC/softirq locality; see the Linux
   [network scaling guide](https://docs.kernel.org/networking/scaling.html).
@@ -164,7 +164,7 @@ The `js/replay` nightly series and the browser smoke's `replay.json` protect it.
   queues. It is not evidence of a drop-in optimization for this UDP path.
   Confirm transport, hardware and minimum-kernel support before a future trial.
 - NAPI busy polling and registered wait arguments were explicitly dropped in
-  [Perf](/quest/m2/perf/README.md). Do not reopen them without new profiling
+  [Perf](/quest/m4/perf/README.md). Do not reopen them without new profiling
   evidence. SQPOLL, huge pages and blanket page locking likewise have no
   demonstrated need here; they can exchange CPU or reclaimable memory for
   lower latency. Incremental provided-buffer consumption is deliberately
@@ -176,8 +176,8 @@ The `js/replay` nightly series and the browser smoke's `replay.json` protect it.
   against release comparison for this cut, including the sparse read slope;
   it already fixed or accepted resume duplicates, idle GC, stats drain, FETCH
   fan-out, JS frame regressions, and paired comparison correctness. The
-  [performance audit](/quest/m2/audit-perf.md) repeats it before later cuts.
-- [Perf](/quest/m2/perf/README.md) owns measured channel contention, relay
+  [performance audit](/quest/m3/audit-perf.md) repeats it before later cuts.
+- [Perf](/quest/m4/perf/README.md) owns measured channel contention, relay
   allocations, ingest batching, worker quiescence and runtime selection.
 - The 2026-10-22 release audit bounded the media
   reorder queues in [moq-dev/moq#6453](https://github.com/moq-dev/moq/pull/6453)
@@ -191,32 +191,32 @@ The `js/replay` nightly series and the browser smoke's `replay.json` protect it.
 - [Binding bytes](https://github.com/moq-dev/rust2/blob/main/quest/m1/ffi-bytes.md),
   [foreign polling](https://github.com/moq-dev/rust2/blob/main/quest/m1/ffi-poll-protocol.md),
   [Kotlin calls](https://github.com/moq-dev/rust2/blob/main/quest/m1/kt-ffi-calls.md),
-  [NVENC pooling](/quest/m2/nvenc-pool.md), and
-  [watch worker planning](/quest/m2/plan-watch-worker.md) retain their scopes.
-- [Route wakes](/quest/m2/route-wakes.md) and
-  [front parking](/quest/m2/origin-front-parks.md) own discovery scans/wakes.
-- The [recurring audit](/quest/m2/audit-perf.md) retains real congestion-
+  [NVENC pooling](/quest/m5/nvenc-pool.md), and
+  [watch worker planning](/quest/m3/plan-watch-worker.md) retain their scopes.
+- [Route wakes](/quest/m4/route-wakes.md) and
+  [front parking](/quest/m5/origin-front-parks.md) own discovery scans/wakes.
+- The [recurring audit](/quest/m3/audit-perf.md) retains real congestion-
   controller/loss-recovery coverage, broader importer/container coverage,
   and publish Fanout/audio-ring profiling. QUIC protocol microbenchmarks use
   `Unlimited`; their numbers cannot establish controller performance. Expand
   reassembly flight/reordering coverage there before proposing another index.
-  [BBR study](/quest/m2/quic-bbr-study.md) owns controller behavior.
+  [BBR study](/quest/m5/quic-bbr-study.md) owns controller behavior.
 - The archive consumer replaced the timeline reader; benchmark it when
   revisiting archive reads.
 
 ## Required
 
-- [Task capacity after bursts](/quest/m2/performance-survey/task-capacity.md) - memory a task set keeps after peak occupancy subsides
-- [QUIC send-group capacity](/quest/m2/performance-survey/send-groups.md) - memory the scheduler's send-group slab keeps after subscription churn
-- [Cache metadata](/quest/m2/performance-survey/cache-metadata.md) - bookkeeping capacity after cached groups expire
-- [HLS request fan-out](/quest/m2/performance-survey/hls-serving.md) - repeated fetch, remux and playlist construction per viewer
-- [Announcement snapshots](/quest/m2/performance-survey/announced-snapshots.md) - HTTP polling cost versus result size and unrelated routes
-- [Selective session operations](/quest/m2/performance-survey/session-selection.md) - exact-ID lookups and registry lock hold time
-- [Browser media copies](/quest/m2/performance-survey/browser-media-copies.md) - CMAF sample and LOC framing copies versus retention
-- [GStreamer ingest buffers](/quest/m2/performance-survey/gst-buffers.md) - copy avoidance versus upstream pool retention
+- [Task capacity after bursts](/quest/m5/performance-survey/task-capacity.md) - memory a task set keeps after peak occupancy subsides
+- [QUIC send-group capacity](/quest/m5/performance-survey/send-groups.md) - memory the scheduler's send-group slab keeps after subscription churn
+- [Cache metadata](/quest/m5/performance-survey/cache-metadata.md) - bookkeeping capacity after cached groups expire
+- [HLS request fan-out](/quest/m5/performance-survey/hls-serving.md) - repeated fetch, remux and playlist construction per viewer
+- [Announcement snapshots](/quest/m5/performance-survey/announced-snapshots.md) - HTTP polling cost versus result size and unrelated routes
+- [Selective session operations](/quest/m5/performance-survey/session-selection.md) - exact-ID lookups and registry lock hold time
+- [Browser media copies](/quest/m5/performance-survey/browser-media-copies.md) - CMAF sample and LOC framing copies versus retention
+- [GStreamer ingest buffers](/quest/m5/performance-survey/gst-buffers.md) - copy avoidance versus upstream pool retention
 
 ## Related
 
-- [Performance audit](/quest/m2/audit-perf.md) - nightly regression attribution and remaining coverage
-- [Benchmark sources](/quest/m2/bench-sources.md) - publishing existing measurements to the trend table
+- [Performance audit](/quest/m3/audit-perf.md) - nightly regression attribution and remaining coverage
+- [Benchmark sources](/quest/m4/bench-sources.md) - publishing existing measurements to the trend table
 - [Calibrate the paired nightly benchmarks](/quest/m1/bench-ci.md) - noise floor of the paired nightly regression report
diff --git a/quest/m2/performance-survey/announced-snapshots.md b/quest/m5/performance-survey/announced-snapshots.md
similarity index 96%
rename from quest/m2/performance-survey/announced-snapshots.md
rename to quest/m5/performance-survey/announced-snapshots.md
index 98b65e34254..0f66435d203 100644
--- a/quest/m2/performance-survey/announced-snapshots.md
+++ b/quest/m5/performance-survey/announced-snapshots.md
@@ -26,7 +26,7 @@ intermediate allocations over a second route index unless measurements earn it.
 This takes the recurring audit's HTTP announcement item; discovery wake/index
 quests retain ownership of the underlying routing machinery.
 
-Follow the [survey's benchmark contract](/quest/m2/performance-survey/README.md):
+Follow the [survey's benchmark contract](/quest/m5/performance-survey/README.md):
 measure the baseline before optimizing, retain paired evidence, verify equivalent
 work, schedule coverage nightly, and accept a measured no-win. Expected public
 API and wire impact: none; report the actual impact in the implementation PR.
diff --git a/quest/m2/performance-survey/browser-media-copies.md b/quest/m5/performance-survey/browser-media-copies.md
similarity index 96%
rename from quest/m2/performance-survey/browser-media-copies.md
rename to quest/m5/performance-survey/browser-media-copies.md
index 66825c2f03a..01cc76a2c53 100644
--- a/quest/m2/performance-survey/browser-media-copies.md
+++ b/quest/m5/performance-survey/browser-media-copies.md
@@ -28,7 +28,7 @@ This extracts the recurring audit's sample-copy item; missing generic
 `js/msf`/`js/flate` coverage remains with that audit. CMAF parsing is already
 bounded by [moq-dev/moq#6378](https://github.com/moq-dev/moq/pull/6378).
 
-Follow the [survey's benchmark contract](/quest/m2/performance-survey/README.md):
+Follow the [survey's benchmark contract](/quest/m5/performance-survey/README.md):
 measure the baseline before optimizing, retain paired evidence, verify equivalent
 work, schedule coverage nightly, and accept a measured no-win. Expected public
 API and wire impact: none; report the actual impact in the implementation PR.
diff --git a/quest/m2/performance-survey/cache-metadata.md b/quest/m5/performance-survey/cache-metadata.md
similarity index 89%
rename from quest/m2/performance-survey/cache-metadata.md
rename to quest/m5/performance-survey/cache-metadata.md
index f46aecb3829..fab00711038 100644
--- a/quest/m2/performance-survey/cache-metadata.md
+++ b/quest/m5/performance-survey/cache-metadata.md
@@ -23,16 +23,16 @@ Correct the accounting explanation with the chosen implementation.
 Front eviction ([moq-dev/moq#6993](https://github.com/moq-dev/moq/pull/6993))
 kept the group's `kio::log` representation and sheds by advancing its base. Land the benchmark now, but any shrink of the
 `arrival`/`evict` deques waits on
-[log adoption](/quest/m2/perf/kio-channel-contention/log-adoption.md)'s verdict,
+[log adoption](/quest/m4/perf/kio-channel-contention/log-adoption.md)'s verdict,
 since that quest may move `TrackState` arrival order onto the kio log.
 Idle GC clock and lock work was settled by
 [moq-dev/moq#6291](https://github.com/moq-dev/moq/pull/6291); this owns
 retained queue backing.
 
-Follow the [survey benchmark contract](/quest/m2/performance-survey/README.md):
+Follow the [survey benchmark contract](/quest/m5/performance-survey/README.md):
 baseline first, paired evidence, equivalent work and nightly coverage. A
 measured no-win is valid. No API or wire change is expected; report actual impact.
 
 ## Related
 
-- [Log adoption](/quest/m2/perf/kio-channel-contention/log-adoption.md) - may replace the `arrival` deque this quest would shrink
+- [Log adoption](/quest/m4/perf/kio-channel-contention/log-adoption.md) - may replace the `arrival` deque this quest would shrink
diff --git a/quest/m2/performance-survey/gst-buffers.md b/quest/m5/performance-survey/gst-buffers.md
similarity index 95%
rename from quest/m2/performance-survey/gst-buffers.md
rename to quest/m5/performance-survey/gst-buffers.md
index d9c8e951e69..d9078a118c1 100644
--- a/quest/m2/performance-survey/gst-buffers.md
+++ b/quest/m5/performance-survey/gst-buffers.md
@@ -25,7 +25,7 @@ Send/lifetime properties hold. Do not claim a win from removing memcpy alone,
 or introduce an unbounded pool to make the experiment pass. Retaining the
 current copy with a benchmark explaining why is a complete outcome.
 
-Follow the [survey's benchmark contract](/quest/m2/performance-survey/README.md):
+Follow the [survey's benchmark contract](/quest/m5/performance-survey/README.md):
 measure the baseline before optimizing, retain paired evidence, verify equivalent
 work, schedule coverage nightly, and accept a measured no-win. Expected public
 API and wire impact: none; report the actual impact in the implementation PR.
diff --git a/quest/m2/performance-survey/hls-serving.md b/quest/m5/performance-survey/hls-serving.md
similarity index 96%
rename from quest/m2/performance-survey/hls-serving.md
rename to quest/m5/performance-survey/hls-serving.md
index ed7b9bb8f2d..73e46af4528 100644
--- a/quest/m2/performance-survey/hls-serving.md
+++ b/quest/m5/performance-survey/hls-serving.md
@@ -26,7 +26,7 @@ never let a reused row number cross epochs or cache one viewer's credentials
 in another's playlist. The archive/HLS contract quests retain policy decisions.
 This takes ownership of the recurring audit's HLS serving coverage item.
 
-Follow the [survey's benchmark contract](/quest/m2/performance-survey/README.md):
+Follow the [survey's benchmark contract](/quest/m5/performance-survey/README.md):
 measure the baseline before optimizing, retain paired evidence, verify equivalent
 work, schedule coverage nightly, and accept a measured no-win. Expected public
 API and wire impact: none; report the actual impact in the implementation PR.
diff --git a/quest/m2/performance-survey/send-groups.md b/quest/m5/performance-survey/send-groups.md
similarity index 95%
rename from quest/m2/performance-survey/send-groups.md
rename to quest/m5/performance-survey/send-groups.md
index 906b3c529c8..b5c7b9075d4 100644
--- a/quest/m2/performance-survey/send-groups.md
+++ b/quest/m5/performance-survey/send-groups.md
@@ -12,7 +12,7 @@ retained bytes per peak subscription are acceptable.
 Decided 2026-11-03 (maintainer, /quest-plan of the follow-ups from
 [moq-dev/moq#7740](https://github.com/moq-dev/moq/pull/7740)): milestone m2,
 in the performance survey, with the same "measure before reclaiming" policy
-as [task capacity](/quest/m2/performance-survey/task-capacity.md).
+as [task capacity](/quest/m5/performance-survey/task-capacity.md).
 
 - `rs/moq-quic/src/connection/streams/schedule.rs`: `groups:
   Slab<Group<K, D>>` (around line 177) grows in `open_group`, and
diff --git a/quest/m2/performance-survey/session-selection.md b/quest/m5/performance-survey/session-selection.md
similarity index 95%
rename from quest/m2/performance-survey/session-selection.md
rename to quest/m5/performance-survey/session-selection.md
index 39397275dfc..c01aca15059 100644
--- a/quest/m2/performance-survey/session-selection.md
+++ b/quest/m5/performance-survey/session-selection.md
@@ -24,7 +24,7 @@ scales with output; do not add secondary indexes for it without independent
 measurement. Existing relay auth-refresh benches do not measure this
 administrative selection path.
 
-Follow the [survey's benchmark contract](/quest/m2/performance-survey/README.md):
+Follow the [survey's benchmark contract](/quest/m5/performance-survey/README.md):
 measure the baseline before optimizing, retain paired evidence, verify equivalent
 work, schedule coverage nightly, and accept a measured no-win. Expected public
 API and wire impact: none; report the actual impact in the implementation PR.
diff --git a/quest/m2/performance-survey/task-capacity.md b/quest/m5/performance-survey/task-capacity.md
similarity index 97%
rename from quest/m2/performance-survey/task-capacity.md
rename to quest/m5/performance-survey/task-capacity.md
index 0a7b081ffbb..4663498fc1b 100644
--- a/quest/m2/performance-survey/task-capacity.md
+++ b/quest/m5/performance-survey/task-capacity.md
@@ -51,7 +51,7 @@ concurrent wakeups, coalescing, snapshot fairness and the rotation order
 The io_uring worker now uses `Tasks::poll_passes`, so its bounded wake chains
 repeat that indexed snapshot within one turn.
 
-Follow the [survey's benchmark contract](/quest/m2/performance-survey/README.md):
+Follow the [survey's benchmark contract](/quest/m5/performance-survey/README.md):
 measure the baseline before optimizing, retain paired evidence, verify
 equivalent work, schedule coverage nightly, and accept a measured no-win.
 Expected public API and wire impact: none.
diff --git a/quest/m3/pipewire-camera-planes.md b/quest/m5/pipewire-camera-planes.md
similarity index 95%
rename from quest/m3/pipewire-camera-planes.md
rename to quest/m5/pipewire-camera-planes.md
index c8cda797532..805babdbe18 100644
--- a/quest/m3/pipewire-camera-planes.md
+++ b/quest/m5/pipewire-camera-planes.md
@@ -12,4 +12,4 @@ Unit-test the offer, a multi-block NV12 buffer, and a multi-block I420 buffer, w
 
 ## Related
 
-- [PipeWire DMA-BUFs into Vulkan](/quest/m2/2819-moq-video-carry-pipewire-dma-bufs-safely-into-the-vulkan.md) - the hardware validation of the DMA-BUF path
+- [PipeWire DMA-BUFs into Vulkan](/quest/m4/2819-moq-video-carry-pipewire-dma-bufs-safely-into-the-vulkan.md) - the hardware validation of the DMA-BUF path
diff --git a/quest/m2/qos-lag-dashboard.md b/quest/m5/qos-lag-dashboard.md
similarity index 93%
rename from quest/m2/qos-lag-dashboard.md
rename to quest/m5/qos-lag-dashboard.md
index bbaa331ee1b..2b256114406 100644
--- a/quest/m2/qos-lag-dashboard.md
+++ b/quest/m5/qos-lag-dashboard.md
@@ -11,7 +11,7 @@ and per node like the existing counters.
 
 - Read both from the stats totals and prefix tracks
   (`<path>/prefix.json`) rather than the group tracks' per-path rows they sit on today (decided in the
-  2026-10-06 audit; the rows stay for existing readers, 2026-10-12); [viewer lag histogram](/quest/m2/qos/lag-histogram.md)
+  2026-10-06 audit; the rows stay for existing readers, 2026-10-12); [viewer lag histogram](/quest/m3/qos/lag-histogram.md)
   lands them on the egress side of its per-group totals and prefix tracks
   (decided 2026-10-08). `lag` is a cumulative byte count per bucket keyed
   by its upper edge (`"50ms"` to `"5s"`, then `"inf"`, empty buckets
@@ -36,4 +36,4 @@ Public API: none. Wire: none.
 
 ## Required
 
-- [Viewer lag histogram](/quest/m2/qos/lag-histogram.md) - the `lag` histogram and `dropped` counters the dashboard reads
+- [Viewer lag histogram](/quest/m3/qos/lag-histogram.md) - the `lag` histogram and `dropped` counters the dashboard reads
diff --git a/quest/m2/quic-bbr-study.md b/quest/m5/quic-bbr-study.md
similarity index 100%
rename from quest/m2/quic-bbr-study.md
rename to quest/m5/quic-bbr-study.md
diff --git a/quest/m3/quic-careful-resume.md b/quest/m5/quic-careful-resume.md
similarity index 100%
rename from quest/m3/quic-careful-resume.md
rename to quest/m5/quic-careful-resume.md
diff --git a/quest/m2/quic-deadline.md b/quest/m5/quic-deadline.md
similarity index 96%
rename from quest/m2/quic-deadline.md
rename to quest/m5/quic-deadline.md
index d737070d76f..af050e879c7 100644
--- a/quest/m2/quic-deadline.md
+++ b/quest/m5/quic-deadline.md
@@ -24,7 +24,7 @@ Implement in `moq-quic`.
   deadline, estimate the arrival instant as now plus the forward one-way
   delay. Start with `min_rtt / 2`, corrected by the peer's reported ACK delay.
   Measure whether receive-time differences (`moq_congestion::Acked::received`,
-  from the [realtime epic](/quest/m2/quic-realtime/README.md)) improve that
+  from the [realtime epic](/quest/m3/quic-realtime/README.md)) improve that
   estimate, accounting for clock offset, drift, and uncertainty. They do not
   alone measure absolute one-way delay. If the estimate is past the deadline,
   reset the stream with a dedicated error code and drop its retransmit ranges,
@@ -36,7 +36,7 @@ Implement in `moq-quic`.
   the congestion window; the probe is a scheduling choice, not extra credit.
 - moq-net cannot call `moq-quic` directly, so the deadline crosses its own
   `transport::poll::SendStream` trait, the way
-  [the ACK hook](/quest/m2/quic-ack-hook.md) does: a method whose default
+  [the ACK hook](/quest/m3/quic-ack-hook.md) does: a method whose default
   reports unsupported, implemented by the moq-tokio and moq-uring adapters
   over `moq-quic`. A backend without it sends as today.
 - moq-net: the per-group `GroupServe` machine in the lite and IETF
@@ -91,4 +91,4 @@ reset moq-net already sends.
 
 ## Related
 
-- [ACK hook](/quest/m2/quic-ack-hook.md) - the same pattern for a moq-net method backed by `moq-quic`
+- [ACK hook](/quest/m3/quic-ack-hook.md) - the same pattern for a moq-net method backed by `moq-quic`
diff --git a/quest/m2/quic-ecn-measure.md b/quest/m5/quic-ecn-measure.md
similarity index 95%
rename from quest/m2/quic-ecn-measure.md
rename to quest/m5/quic-ecn-measure.md
index e5b45bf3323..02c83a529b8 100644
--- a/quest/m2/quic-ecn-measure.md
+++ b/quest/m5/quic-ecn-measure.md
@@ -6,7 +6,7 @@ A written verdict on classic ECN between relays: whether a marking
 bottleneck reduces the rate before its queue overflows instead of after,
 with the numbers, and whether Linode's and OVH's networks preserve ECT(0)
 and CE between relays. No code lands; the verdict is recorded in
-[L4S on the backbone](/quest/m3/quic-ecn.md), which acts on it.
+[L4S on the backbone](/quest/m5/quic-ecn.md), which acts on it.
 
 ## Plan
 
@@ -40,7 +40,7 @@ help.
   the marking response is only a lab result.
 
 Decided in the 2026-09-30 audit: moved to m2 with its only consumer,
-[L4S on the backbone](/quest/m3/quic-ecn.md).
+[L4S on the backbone](/quest/m5/quic-ecn.md).
 
 Decided in the 2026-10-06 audit: no code lands here, and `moq-quic` already
 carries the classic CE response, so the study runs today. L4S on the
diff --git a/quest/m3/quic-ecn.md b/quest/m5/quic-ecn.md
similarity index 93%
rename from quest/m3/quic-ecn.md
rename to quest/m5/quic-ecn.md
index 3f75a3ca52f..1ccd99d2fee 100644
--- a/quest/m3/quic-ecn.md
+++ b/quest/m5/quic-ecn.md
@@ -26,7 +26,7 @@ both `off` and `ect1` need a `moq-quic` change.
   default (today's behavior on tokio), and `doc/bin/relay/config.md`
   documents it in the same PR.
 - Measure on the netem bottleneck from the
-  [ECN study](/quest/m2/quic-ecn-measure.md) with `dualpi2` marking against
+  [ECN study](/quest/m5/quic-ecn-measure.md) with `dualpi2` marking against
   the same bottleneck dropping: queueing delay, goodput, loss. The study's
   provider verdict decides whether the result matters outside the lab;
   if neither Linode nor OVH preserves the marks, L4S stays off and the
@@ -37,5 +37,5 @@ both `off` and `ect1` need a `moq-quic` change.
 
 ## Required
 
-- [Measure ECN on the backbone](/quest/m2/quic-ecn-measure.md) - the
+- [Measure ECN on the backbone](/quest/m5/quic-ecn-measure.md) - the
   provider verdict this quest acts on
diff --git a/quest/m2/quic-egress-profile.md b/quest/m5/quic-egress-profile.md
similarity index 96%
rename from quest/m2/quic-egress-profile.md
rename to quest/m5/quic-egress-profile.md
index b16bda86a55..710bb85a5ab 100644
--- a/quest/m2/quic-egress-profile.md
+++ b/quest/m5/quic-egress-profile.md
@@ -15,7 +15,7 @@ questions about the same egress path and share one profile.
 
 Decided 2026-10-30 (maintainer): the profile also covers moq-quic's
 ingress and egress (`just bench-profile cpu` on `io-uring-workers`), since
-[quic-io-boundary](/quest/m2/quic-io-boundary.md) waits on it to rank its
+[quic-io-boundary](/quest/m5/quic-io-boundary.md) waits on it to rank its
 candidates.
 
 Measure first, on the chat and fanout shapes with many connections, tokio
@@ -112,7 +112,7 @@ Then, only where the profile shows a cost:
   submits every train in one ring enter, needs any of it.
 - A `BufFactory`-style seam on `SendBuffer` in `moq-quic` that takes buffers
   from a pool sized from the send window and returns them on ACK. Design it
-  with [the I/O boundary redesign](/quest/m2/quic-io-boundary.md), which
+  with [the I/O boundary redesign](/quest/m5/quic-io-boundary.md), which
   reworks the same transmit buffers.
 - `SCM_TXTIME` stamps, one per train, at the time the pacer would have
   released it (the next-send time `moq-congestion`'s trait exposes), tested under both `etf` and `fq`. The socket is shared across
@@ -127,8 +127,8 @@ hosts need.
 
 ## Related
 
-- [QUIC I/O boundary](/quest/m2/quic-io-boundary.md) - redesigns the transmit buffers the pool lever would feed
-- [#3201](/quest/m3/3201-moq-uring-use-sendmsg-zc-for-large-udp-gso-trains.md) -
+- [QUIC I/O boundary](/quest/m5/quic-io-boundary.md) - redesigns the transmit buffers the pool lever would feed
+- [#3201](/quest/m5/3201-moq-uring-use-sendmsg-zc-for-large-udp-gso-trains.md) -
   zero-copy on the same trains
-- [#3204](/quest/m3/3204-moq-uring-register-tx-pool-buffers-for-zero-copy-sends.md) -
+- [#3204](/quest/m5/3204-moq-uring-register-tx-pool-buffers-for-zero-copy-sends.md) -
   the UDP-side pool the same buffers could feed
diff --git a/quest/m2/quic-io-boundary.md b/quest/m5/quic-io-boundary.md
similarity index 91%
rename from quest/m2/quic-io-boundary.md
rename to quest/m5/quic-io-boundary.md
index 1afb9f14522..39b57980b6f 100644
--- a/quest/m2/quic-io-boundary.md
+++ b/quest/m5/quic-io-boundary.md
@@ -6,7 +6,7 @@
 buffer ring and transmit into caller-owned buffers, with no copy between the
 kernel and the crypto. This quest owns the transmit contract; registering
 those buffers with the ring is
-[#3204](/quest/m3/3204-moq-uring-register-tx-pool-buffers-for-zero-copy-sends.md)'s. The API may break; it is in-tree.
+[#3204](/quest/m5/3204-moq-uring-register-tx-pool-buffers-for-zero-copy-sends.md)'s. The API may break; it is in-tree.
 
 ## Plan
 
@@ -49,9 +49,9 @@ including a stalled reader:
   skip this copy.
 
 Decided 2026-10-08: `SENDMSG_ZC`
-([#3201](/quest/m3/3201-moq-uring-use-sendmsg-zc-for-large-udp-gso-trains.md))
+([#3201](/quest/m5/3201-moq-uring-use-sendmsg-zc-for-large-udp-gso-trains.md))
 and registered TX buffers
-([#3204](/quest/m3/3204-moq-uring-register-tx-pool-buffers-for-zero-copy-sends.md))
+([#3204](/quest/m5/3204-moq-uring-register-tx-pool-buffers-for-zero-copy-sends.md))
 Require this quest and build on its transmit contract, so the contract is
 settled once; registering buffers stays with #3204, which measures whether
 it pays. Report relay CPU per Gbps before and after on
@@ -59,4 +59,4 @@ the same workloads.
 
 ## Required
 
-- [Relay egress profile](/quest/m2/quic-egress-profile.md) - its moq-quic profile ranks this quest's candidates, and its send-buffer pool shares the `SendBuffer` seam
+- [Relay egress profile](/quest/m5/quic-egress-profile.md) - its moq-quic profile ranks this quest's candidates, and its send-buffer pool shares the `SendBuffer` seam
diff --git a/quest/m2/quic-lb-forward-extras.md b/quest/m5/quic-lb-forward-extras.md
similarity index 100%
rename from quest/m2/quic-lb-forward-extras.md
rename to quest/m5/quic-lb-forward-extras.md
diff --git a/quest/m2/rate-grant.md b/quest/m5/rate-grant.md
similarity index 100%
rename from quest/m2/rate-grant.md
rename to quest/m5/rate-grant.md
diff --git a/quest/m2/receive-pool.md b/quest/m5/receive-pool.md
similarity index 94%
rename from quest/m2/receive-pool.md
rename to quest/m5/receive-pool.md
index 633aa1aefa3..ebf6c2f818d 100644
--- a/quest/m2/receive-pool.md
+++ b/quest/m5/receive-pool.md
@@ -15,7 +15,7 @@ reserves memory it never uses or sizes the window below what one peer's largest
 unit needs.
 
 Non-goals: revoking credit already granted, cross-peer eviction, and zero-copy
-send buffers (see [registered TX buffers](/quest/m3/3204-moq-uring-register-tx-pool-buffers-for-zero-copy-sends.md)).
+send buffers (see [registered TX buffers](/quest/m5/3204-moq-uring-register-tx-pool-buffers-for-zero-copy-sends.md)).
 
 ## Plan
 
@@ -73,9 +73,9 @@ harness. Report peak resident bytes against the budget, evictions, and throughpu
 
 ## Related
 
-- [Unbounded groups](/quest/m1/unbounded-groups/README.md) - drops the frame cap that
+- [Unbounded groups](/quest/m2/unbounded-groups/README.md) - drops the frame cap that
   sets half of `MIN_RECEIVE_WINDOW`
-- [Perf](/quest/m2/perf/README.md) - the per-worker hot paths this budget must not add
+- [Perf](/quest/m4/perf/README.md) - the per-worker hot paths this budget must not add
   contention to
-- [Broadcast fairness](/quest/m2/broadcast-fairness.md) - the receive rank's
+- [Broadcast fairness](/quest/m3/broadcast-fairness.md) - the receive rank's
   fairness domains
diff --git a/quest/m2/recover-budget.md b/quest/m5/recover-budget.md
similarity index 95%
rename from quest/m2/recover-budget.md
rename to quest/m5/recover-budget.md
index 7b6621ecf7f..53a2b8102ae 100644
--- a/quest/m2/recover-budget.md
+++ b/quest/m5/recover-budget.md
@@ -28,4 +28,4 @@ Public API: none. Wire: none.
 
 ## Related
 
-- [Resume as producer replacement](/quest/m2/resume-redesign.md) - deletes this path entirely
+- [Resume as producer replacement](/quest/m4/resume-redesign.md) - deletes this path entirely
diff --git a/quest/m3/relay-acme.md b/quest/m5/relay-acme.md
similarity index 94%
rename from quest/m3/relay-acme.md
rename to quest/m5/relay-acme.md
index 734d24bad8f..a26ac66336c 100644
--- a/quest/m3/relay-acme.md
+++ b/quest/m5/relay-acme.md
@@ -28,4 +28,4 @@ Wire: none.
 
 ## Required
 
-- [rind-instant-acme is on crates.io](/quest/m3/rind-instant-acme.md) - the adapter this uses, waiting on instant-acme 0.9
+- [rind-instant-acme is on crates.io](/quest/m5/rind-instant-acme.md) - the adapter this uses, waiting on instant-acme 0.9
diff --git a/quest/m3/request-token-surfaces.md b/quest/m5/request-token-surfaces.md
similarity index 100%
rename from quest/m3/request-token-surfaces.md
rename to quest/m5/request-token-surfaces.md
diff --git a/quest/m3/rind-instant-acme.md b/quest/m5/rind-instant-acme.md
similarity index 88%
rename from quest/m3/rind-instant-acme.md
rename to quest/m5/rind-instant-acme.md
index d4ac278331f..1fe3102b1d3 100644
--- a/quest/m3/rind-instant-acme.md
+++ b/quest/m5/rind-instant-acme.md
@@ -11,5 +11,5 @@ only waits; delete it once that holds.
 ## Plan
 
 rind's adapter waits on instant-acme's 0.9 release, which carries the
-pluggable `CryptoProvider`. Only [relay ACME](/quest/m3/relay-acme.md) needs
+pluggable `CryptoProvider`. Only [relay ACME](/quest/m5/relay-acme.md) needs
 it (maintainer, 2026-10-31).
diff --git a/quest/m2/room-bench.md b/quest/m5/room-bench.md
similarity index 94%
rename from quest/m2/room-bench.md
rename to quest/m5/room-bench.md
index dd91824a281..a962f228c94 100644
--- a/quest/m2/room-bench.md
+++ b/quest/m5/room-bench.md
@@ -17,6 +17,6 @@ today. Benchmark first, as
 [moq-dev/moq#7340](https://github.com/moq-dev/moq/pull/7340) did for the
 lite subscriber's prefixes, and fix
 only if it shows a slope. Wire the benchmark into the existing bench lanes
-([Benchmark sources](/quest/m2/bench-sources.md)).
+([Benchmark sources](/quest/m4/bench-sources.md)).
 
 Public API: none. Wire: none.
diff --git a/quest/m2/route-health/README.md b/quest/m5/route-health/README.md
similarity index 93%
rename from quest/m2/route-health/README.md
rename to quest/m5/route-health/README.md
index 4e6b89efd16..32294f7c871 100644
--- a/quest/m2/route-health/README.md
+++ b/quest/m5/route-health/README.md
@@ -13,7 +13,7 @@ and keep their existing Restart behavior.
 
 Decided with the maintainer, 2026-10-13:
 
-- Ranked in m2, after clustering stability, federation, and P2P. Health
+- Ranked in m2 (m5 since the 2026-11-05 re-cut), after clustering stability, federation, and P2P. Health
   design had to reproduce a stall that transport failure and ordinary
   reconnect do not recover, or the line would be abandoned. It did
   ([moq-dev/moq#7096](https://github.com/moq-dev/moq/pull/7096)):
@@ -105,7 +105,7 @@ third route, simultaneous relay decisions,
 loss/reordering, cancelled demand, and stale/replayed progress. Wire these into
 CI. Report actual media overlap, control traffic, wakes, switches, and memory
 across tracks, candidate connections, and downstream readers. Extend the
-[P2P harness](/quest/m2/p2p/harness.md) with real browser/native cases:
+[P2P harness](/quest/m4/p2p/harness.md) with real browser/native cases:
 metadata-only standby, stalled payload with advancing control, same-epoch
 promotion with bounded overlap, no failback while the working route
 delivers, and epochless exclusion.
@@ -113,13 +113,13 @@ Add a route-health section to the routing concept page.
 
 ## Required
 
-- [Metadata subscriptions](/quest/m2/route-health/meta.md) - the current lite wip and the shared model observe frames without payload in Rust and JS
-- [Track route selection](/quest/m2/route-health/selection.md) - share broadcast identity/candidates while tracks choose sources independently
-- [Automatic recovery](/quest/m2/route-health/recovery.md) - epoch-only promotion in endpoints and relays, staying on the working route
-- [Revisit the relay's default QUIC idle timeout](/quest/m2/route-health/idle-timeout.md) - keep or change the 10 s default, with the reason recorded
+- [Metadata subscriptions](/quest/m5/route-health/meta.md) - the current lite wip and the shared model observe frames without payload in Rust and JS
+- [Track route selection](/quest/m5/route-health/selection.md) - share broadcast identity/candidates while tracks choose sources independently
+- [Automatic recovery](/quest/m5/route-health/recovery.md) - epoch-only promotion in endpoints and relays, staying on the working route
+- [Revisit the relay's default QUIC idle timeout](/quest/m5/route-health/idle-timeout.md) - keep or change the 10 s default, with the reason recorded
 
 ## Related
 
-- [Cluster routing](/quest/m1/cluster-routing/README.md) - reachability and advertisement freshness, distinct from delivery health
-- [Link quality](/quest/m2/link-quality.md) - optional metric repricing, not this local delivery-health decision
+- [Cluster routing](/quest/m2/cluster-routing/README.md) - reachability and advertisement freshness, distinct from delivery health
+- [Link quality](/quest/m5/link-quality.md) - optional metric repricing, not this local delivery-health decision
 - [Routing guide](/quest/m1/routing-guide.md) - priorities, health, and epoch-only continuity explained together
diff --git a/quest/m2/route-health/idle-timeout.md b/quest/m5/route-health/idle-timeout.md
similarity index 100%
rename from quest/m2/route-health/idle-timeout.md
rename to quest/m5/route-health/idle-timeout.md
diff --git a/quest/m2/route-health/meta.md b/quest/m5/route-health/meta.md
similarity index 98%
rename from quest/m2/route-health/meta.md
rename to quest/m5/route-health/meta.md
index 7f4fb91eec3..0fc2879ded8 100644
--- a/quest/m2/route-health/meta.md
+++ b/quest/m5/route-health/meta.md
@@ -65,4 +65,4 @@ a mode marker in each group stream header, and payload-less metadata FRAMEs.
 
 ## Required
 
-- [Subscribe ranges](/quest/m1/subscribe-ranges/README.md) - final subscription range shape this extends
+- [Subscribe ranges](/quest/m2/subscribe-ranges/README.md) - final subscription range shape this extends
diff --git a/quest/m2/route-health/recovery.md b/quest/m5/route-health/recovery.md
similarity index 97%
rename from quest/m2/route-health/recovery.md
rename to quest/m5/route-health/recovery.md
index 2cc8bddc820..e6621a76c25 100644
--- a/quest/m2/route-health/recovery.md
+++ b/quest/m5/route-health/recovery.md
@@ -84,5 +84,5 @@ Planned 2026-11-02 (maintainer, follow-up planning after the 2026-11-02 /quest-c
 
 ## Required
 
-- [Metadata subscriptions](/quest/m2/route-health/meta.md) - progress-only standby and safe promotion
-- [Track route selection](/quest/m2/route-health/selection.md) - independent copies and shared resume
+- [Metadata subscriptions](/quest/m5/route-health/meta.md) - progress-only standby and safe promotion
+- [Track route selection](/quest/m5/route-health/selection.md) - independent copies and shared resume
diff --git a/quest/m2/route-health/selection.md b/quest/m5/route-health/selection.md
similarity index 97%
rename from quest/m2/route-health/selection.md
rename to quest/m5/route-health/selection.md
index 974379a1a89..56191f0cd0f 100644
--- a/quest/m2/route-health/selection.md
+++ b/quest/m5/route-health/selection.md
@@ -42,4 +42,4 @@ report any required surface change. No independent wire extension planned.
 
 ## Required
 
-- [Routes and announces](/quest/m1/cluster-routing/routes/README.md) - shared candidate and identity model
+- [Routes and announces](/quest/m2/cluster-routing/routes/README.md) - shared candidate and identity model
diff --git a/quest/m2/route-interest-prefixes.md b/quest/m5/route-interest-prefixes.md
similarity index 91%
rename from quest/m2/route-interest-prefixes.md
rename to quest/m5/route-interest-prefixes.md
index 7607934fe9c..f2442f270f9 100644
--- a/quest/m2/route-interest-prefixes.md
+++ b/quest/m5/route-interest-prefixes.md
@@ -16,7 +16,7 @@ Decided 2026-11-03 (maintainer, follow-up planning after the 2026-11-03 /quest-a
 - m1
 - ✅ m2
 
-Split out of [Routes and announces](/quest/m1/cluster-routing/routes/README.md) by
+Split out of [Routes and announces](/quest/m2/cluster-routing/routes/README.md) by
 [moq-dev/moq#7676](https://github.com/moq-dev/moq/pull/7676), which lands
 the route layer's core with a single interest prefix per stream (its
 regions are suffixes of that prefix) and leaves this as a separate m2 quest.
@@ -33,4 +33,4 @@ interest and what ANNOUNCE_FLOOR certifies on the next unpublished lite version.
 
 ## Related
 
-- [Routes and announces](/quest/m1/cluster-routing/routes/README.md) - the single-prefix route layer this extends
+- [Routes and announces](/quest/m2/cluster-routing/routes/README.md) - the single-prefix route layer this extends
diff --git a/quest/m3/routing-cost-domains.md b/quest/m5/routing-cost-domains.md
similarity index 95%
rename from quest/m3/routing-cost-domains.md
rename to quest/m5/routing-cost-domains.md
index 157c90811b0..822f772906a 100644
--- a/quest/m3/routing-cost-domains.md
+++ b/quest/m5/routing-cost-domains.md
@@ -4,7 +4,7 @@
 
 Settle how independently operated MoQ networks exchange reachability without
 adding incomparable costs, at the boundaries between operators on the one node id space
-[Cluster routing](/quest/m1/cluster-routing/README.md) routes over. Cost inside
+[Cluster routing](/quest/m2/cluster-routing/README.md) routes over. Cost inside
 one operator's network is cluster-routing's. This includes whether a boundary
 may fold a large customer cluster's nodes into one advertised node, and how
 that keeps loop safety. Produce a
@@ -16,7 +16,7 @@ performance failover is authorized by this work.
 ## Plan
 
 Decided 2026-10-13: basic outbound local-cluster federation is required and
-belongs to [Outbound federation](/quest/m1/cluster-routing/federation.md),
+belongs to [Outbound federation](/quest/m2/cluster-routing/federation.md),
 not this quest. Identity, namespace admission, local connection priorities,
 and export policy are settled with cluster routing. This quest stays parked
 for economic cost translation and origin aggregation until those have a
@@ -75,7 +75,7 @@ quests. Open wire/API choices belong to this design exercise.
 
 ## Required
 
-- [Cluster routing](/quest/m1/cluster-routing/README.md) - the route layer this designs policy on
+- [Cluster routing](/quest/m2/cluster-routing/README.md) - the route layer this designs policy on
 
 ## Related
 
diff --git a/quest/m2/rs2ts-browser-report.md b/quest/m5/rs2ts-browser-report.md
similarity index 84%
rename from quest/m2/rs2ts-browser-report.md
rename to quest/m5/rs2ts-browser-report.md
index ebe487ad8cf..79b70be0ce3 100644
--- a/quest/m2/rs2ts-browser-report.md
+++ b/quest/m5/rs2ts-browser-report.md
@@ -8,7 +8,8 @@ including bundle size, CPU, and first-frame latency.
 
 ## Plan
 
-Decided 2026-10-12: this broader media report remains in m2. It supplements
+Decided 2026-10-12: this broader media report remains in m2 (m5 since the
+2026-11-05 re-cut). It supplements
 the focused browser comparison required before each backend adoption; it
 cannot replace or postpone that decision evidence. Measure whichever backend
 is deployed and name the exact revisions and build inputs.
@@ -23,4 +24,4 @@ Public API: none. Wire: none.
 
 ## Required
 
-- [JS-only @moq/net](/quest/m2/rs2ts-js.md) - the adopted implementation and retained baseline
+- [JS-only @moq/net](/quest/m5/rs2ts-js.md) - the adopted implementation and retained baseline
diff --git a/quest/m2/rs2ts-js.md b/quest/m5/rs2ts-js.md
similarity index 96%
rename from quest/m2/rs2ts-js.md
rename to quest/m5/rs2ts-js.md
index 62d3de2220d..bfba7dd61f8 100644
--- a/quest/m2/rs2ts-js.md
+++ b/quest/m5/rs2ts-js.md
@@ -36,4 +36,4 @@ unpublished package removals. Wire: none.
 
 ## Required
 
-- [WASM-to-JS evaluation](/quest/m2/rs2ts-wasm2js.md) - the selected route, evidence, and any additional prerequisites
+- [WASM-to-JS evaluation](/quest/m5/rs2ts-wasm2js.md) - the selected route, evidence, and any additional prerequisites
diff --git a/quest/m3/rs2ts-model-ready.md b/quest/m5/rs2ts-model-ready.md
similarity index 100%
rename from quest/m3/rs2ts-model-ready.md
rename to quest/m5/rs2ts-model-ready.md
diff --git a/quest/m3/rs2ts-model-subset.md b/quest/m5/rs2ts-model-subset.md
similarity index 91%
rename from quest/m3/rs2ts-model-subset.md
rename to quest/m5/rs2ts-model-subset.md
index 3c0acf07c4e..91b56526523 100644
--- a/quest/m3/rs2ts-model-subset.md
+++ b/quest/m5/rs2ts-model-subset.md
@@ -4,7 +4,7 @@
 
 moq-net's model, and the kio (clock included) and moq-pattern code it calls, stay inside the
 subset [rust2-ts](https://github.com/moq-dev/rust2/blob/main/ts/README.md) translates,
-so the [source-translator route](/quest/m2/rs2ts-wasm2js.md) can be measured on the model
+so the [source-translator route](/quest/m5/rs2ts-wasm2js.md) can be measured on the model
 with no hand-written stand-ins for moq's own logic.
 
 ## Plan
@@ -29,4 +29,4 @@ Public API: none.
 
 ## Required
 
-- [rust2-ts reaches moq-net's model](/quest/m3/rs2ts-model-ready.md) - the translator is ready for the model
+- [rust2-ts reaches moq-net's model](/quest/m5/rs2ts-model-ready.md) - the translator is ready for the model
diff --git a/quest/m2/rs2ts-wasm2js.md b/quest/m5/rs2ts-wasm2js.md
similarity index 98%
rename from quest/m2/rs2ts-wasm2js.md
rename to quest/m5/rs2ts-wasm2js.md
index 08d171fe7e1..c61dde4fa87 100644
--- a/quest/m2/rs2ts-wasm2js.md
+++ b/quest/m5/rs2ts-wasm2js.md
@@ -6,7 +6,7 @@ A reproducible report evaluates JS-only output from the production Rust
 browser implementation and settles the next route with the maintainer.
 Try Binaryen wasm2js first; source translation is an alternative if its
 measured cost is justified. The report updates the
-[JS-only adoption quest](/quest/m2/rs2ts-js.md), rather than shipping an
+[JS-only adoption quest](/quest/m5/rs2ts-js.md), rather than shipping an
 unvalidated replacement or treating WASM as the final destination.
 
 ## Plan
diff --git a/quest/m3/safari-webtransport.md b/quest/m5/safari-webtransport.md
similarity index 92%
rename from quest/m3/safari-webtransport.md
rename to quest/m5/safari-webtransport.md
index 46fbf98e85d..04c018e981c 100644
--- a/quest/m3/safari-webtransport.md
+++ b/quest/m5/safari-webtransport.md
@@ -24,7 +24,7 @@ tracking since PR #3345 and closes with this.
   and Firefox as controls.
 - Cover the worker capture path in `js/publish/src/video/processor.ts` from a
   Safari publisher in the media harness (moved here from
-  [the Firefox publishing quest](/quest/m2/publish-firefox.md) on 2026-10-30):
+  [the Firefox publishing quest](/quest/m4/publish-firefox.md) on 2026-10-30):
   frame transfer, source replacement, cancellation with a read pending, and
   that every `VideoFrame` is closed. Neither Firefox 157 nor Chromium 156 in
   Playwright has a worker `MediaStreamTrackProcessor` or transfers a
@@ -38,7 +38,7 @@ tracking since PR #3345 and closes with this.
 
 ## Required
 
-- [Safari ships the WebKit 319818 fix](/quest/m3/webkit-319818.md) - the release to gate on
+- [Safari ships the WebKit 319818 fix](/quest/m5/webkit-319818.md) - the release to gate on
 
 ## Closes
 
@@ -46,4 +46,4 @@ tracking since PR #3345 and closes with this.
 
 ## Related
 
-- [macOS browser lane](/quest/m2/macos-browser-lane.md) - the nightly lane that drives Safari through safaridriver; the Safari publisher joins it
+- [macOS browser lane](/quest/m4/macos-browser-lane.md) - the nightly lane that drives Safari through safaridriver; the Safari publisher joins it
diff --git a/quest/m2/socket-old-hop-signal.md b/quest/m5/socket-old-hop-signal.md
similarity index 96%
rename from quest/m2/socket-old-hop-signal.md
rename to quest/m5/socket-old-hop-signal.md
index 21504ceb311..af62fd91140 100644
--- a/quest/m2/socket-old-hop-signal.md
+++ b/quest/m5/socket-old-hop-signal.md
@@ -59,7 +59,7 @@ Recommended design, to settle in this quest:
   relay (for example, cluster links forwarding narrow interest under
   `.socket`), and how markers cross cluster links.
 - **Where the marker rides.** Its own announce-stream message, or a flag on
-  the [route layer](/quest/m1/cluster-routing/routes/README.md)'s messages if
+  the [route layer](/quest/m2/cluster-routing/routes/README.md)'s messages if
   that layer has landed. Choose whichever leaves the draft simpler.
 - **Not chosen:** routing the dial once the probe finds the endpoint. The
   peer can't tell that its relay probes, so it keeps failing its own dials
@@ -69,7 +69,7 @@ Versions and compatibility:
 
 - The signal goes in whichever moq-lite wip is current when this lands
   (lite-07-wip before its cut, per the
-  [freeze policy](/quest/m1/lite07-finalize.md), otherwise the next wip),
+  [freeze policy](/quest/m2/lite07-finalize.md), otherwise the next wip),
   with its draft text in the same PR.
 - A dialer whose relay doesn't send it, or whose own session predates it,
   waits as it does today. Published versions are unchanged.
@@ -95,4 +95,4 @@ Wire: a new per-path marker on the current moq-lite wip.
 ## Related
 
 - [Sockets](/quest/m1/socket/README.md) - the dial and accept this reports on, and #7888's first-hop check
-- [Routes and announces](/quest/m1/cluster-routing/routes/README.md) - the route layer a marker may ride, and how interest crosses cluster links
+- [Routes and announces](/quest/m2/cluster-routing/routes/README.md) - the route layer a marker may ride, and how interest crosses cluster links
diff --git a/quest/m3/stats-encoder-feedback.md b/quest/m5/stats-encoder-feedback.md
similarity index 89%
rename from quest/m3/stats-encoder-feedback.md
rename to quest/m5/stats-encoder-feedback.md
index 4915201e015..29c7ee76404 100644
--- a/quest/m3/stats-encoder-feedback.md
+++ b/quest/m5/stats-encoder-feedback.md
@@ -10,11 +10,11 @@ it already follows. Keyframe requests stay out.
 
 ## Plan
 
-Deferred in the 2026-09-30 audit and moved to m3 in the 2026-10-05 audit: no named consumer; the media stats it
-reads land first in m2.
+Deferred in the 2026-09-30 audit and moved to the deferred milestone (now m5) in the 2026-10-05 audit: no named consumer; the media stats it
+reads land first in m3.
 
 Decided 2026-10-08: parked, and the transcode leg is out. The
-[ladder controller](/quest/m3/ladder/controller.md) owns every
+[ladder controller](/quest/m5/ladder/controller.md) owns every
 `moq-transcode` rung's target, so `moq transcode --echo` feeds the folded
 stall signal to that controller rather than to `rate::Control`; split it
 into its own quest requiring the controller if this is revived. This quest
@@ -56,7 +56,7 @@ covers the encode producers and `moq import --echo-path`, which need no ladder.
   only). It follows this signal only once the grant quest lands; until then
   the loop drives video.
 - `moq import --echo-path <path>`, which already sets the catalog's `echo`
-  section ([Rust stats](/quest/m2/stats/rust.md)), also wires the handle.
+  section ([Rust stats](/quest/m3/stats/rust.md)), also wires the handle.
 - Test: the CLI publishes to a relay, and two `moq play --echo` viewers
   report under the echo path, one of them throttled through the impairment
   profile. The target bitrate drops within two intervals of the throttled
@@ -69,7 +69,7 @@ covers the encode producers and `moq import --echo-path`, which need no ladder.
   moq-video README.
 
 Open, to settle before starting (moved from the
-[media stats](/quest/m2/stats/README.md) line):
+[media stats](/quest/m3/stats/README.md) line):
 
 - **Referenced-rendition feedback.** A derivative catalog (a `moq-transcode`
   passthrough) collects feedback for a source rendition it lists, but owns
@@ -87,13 +87,13 @@ Open, to settle before starting (moved from the
 
 ## Required
 
-- [Rust reporters](/quest/m2/stats/rust.md) - the viewers that report and
+- [Rust reporters](/quest/m3/stats/rust.md) - the viewers that report and
   the CLI it wires
 
 ## Related
 
-- [Ladder controller](/quest/m3/ladder/controller.md) - owns the rung targets a split-out transcode leg would feed
-- [Audio follows the grant](/quest/m2/2848-follow-the-bandwidth-grant-in-moq-audio-instead-of.md) -
+- [Ladder controller](/quest/m5/ladder/controller.md) - owns the rung targets a split-out transcode leg would feed
+- [Audio follows the grant](/quest/m5/2848-follow-the-bandwidth-grant-in-moq-audio-instead-of.md) -
   the audio rate follow this signal would feed
-- [Ladder](/quest/m3/ladder/README.md) - the transcode ladder, which today
+- [Ladder](/quest/m5/ladder/README.md) - the transcode ladder, which today
   encodes every rung at a fixed rate with no bandwidth input
diff --git a/quest/m3/teleop-arbitration.md b/quest/m5/teleop-arbitration.md
similarity index 93%
rename from quest/m3/teleop-arbitration.md
rename to quest/m5/teleop-arbitration.md
index 4edb2fac288..f6e47033c64 100644
--- a/quest/m3/teleop-arbitration.md
+++ b/quest/m5/teleop-arbitration.md
@@ -8,7 +8,7 @@ assumed.
 
 ## Plan
 
-Decided 2026-10-08: parked in m3 with [robot](/quest/m3/teleop-robot.md),
+Decided 2026-10-08: parked in m5 with [robot](/quest/m5/teleop-robot.md),
 which it builds on.
 
 `moq-boy` merges every viewer's input, which is right for crowd control and
@@ -42,4 +42,4 @@ not attempt.
 
 ## Required
 
-- [Robot teleoperation primitive](/quest/m3/teleop-robot.md)
+- [Robot teleoperation primitive](/quest/m5/teleop-robot.md)
diff --git a/quest/m3/teleop-mavlink.md b/quest/m5/teleop-mavlink.md
similarity index 94%
rename from quest/m3/teleop-mavlink.md
rename to quest/m5/teleop-mavlink.md
index 2ba206ede85..95b6811b753 100644
--- a/quest/m3/teleop-mavlink.md
+++ b/quest/m5/teleop-mavlink.md
@@ -8,7 +8,7 @@ and MAVProxy connect unchanged.
 
 ## Plan
 
-Parked in m3 until a real ArduPilot user or partner asks (2026-09-30 audit).
+Parked in m5 until a real ArduPilot user or partner asks (2026-09-30 audit).
 
 Decided 2026-10-08: the lossy class is a snapshot track per key with a
 bounded key set, since one snapshot track carries only one latest value.
@@ -71,7 +71,7 @@ up to `MAX_DELTA_FRAMES` merge patches into one ordered group, so an earlier
 The reliable class is one bounded ordered group on a plain track: commands,
 ACKs, mission, parameter and file transfer are stop-and-wait exchanges carried
 in one ordered group. Note the scope in
-[robot](/quest/m3/teleop-robot.md): that is gap-free for a live reader, not
+[robot](/quest/m5/teleop-robot.md): that is gap-free for a live reader, not
 recoverable after a lag or a reconnect, so these MAVLink services keep relying
 on their own retransmission across a link drop.
 
@@ -89,5 +89,5 @@ small, real contribution and its own future quest.
 
 ## Required
 
-- [Robot teleoperation primitive](/quest/m3/teleop-robot.md)
-- [Operator arbitration](/quest/m3/teleop-arbitration.md)
+- [Robot teleoperation primitive](/quest/m5/teleop-robot.md)
+- [Operator arbitration](/quest/m5/teleop-arbitration.md)
diff --git a/quest/m3/teleop-proof.md b/quest/m5/teleop-proof.md
similarity index 88%
rename from quest/m3/teleop-proof.md
rename to quest/m5/teleop-proof.md
index 053d2292aa4..2b36f410164 100644
--- a/quest/m3/teleop-proof.md
+++ b/quest/m5/teleop-proof.md
@@ -8,7 +8,7 @@ five minutes.
 
 ## Plan
 
-Parked in m3 until a real ArduPilot user or partner asks (2026-09-30 audit).
+Parked in m5 until a real ArduPilot user or partner asks (2026-09-30 audit).
 
 The browser client subscribes video and telemetry and publishes control, the
 shape Blue Robotics' Cockpit proves is viable. It is the demo and the
@@ -33,8 +33,8 @@ the maintenance.
 
 ## Required
 
-- [MAVLink bridge](/quest/m3/teleop-mavlink.md) - the gateway the vehicle side runs
+- [MAVLink bridge](/quest/m5/teleop-mavlink.md) - the gateway the vehicle side runs
 
 ## Related
 
-- [Robot teleoperation primitive](/quest/m3/teleop-robot.md) - the Rust types the zod schema mirrors
+- [Robot teleoperation primitive](/quest/m5/teleop-robot.md) - the Rust types the zod schema mirrors
diff --git a/quest/m3/teleop-robot.md b/quest/m5/teleop-robot.md
similarity index 95%
rename from quest/m3/teleop-robot.md
rename to quest/m5/teleop-robot.md
index 025f7101e75..23b7c46705b 100644
--- a/quest/m3/teleop-robot.md
+++ b/quest/m5/teleop-robot.md
@@ -8,8 +8,8 @@ the gate for the rest of the questline.
 
 ## Plan
 
-Decided 2026-10-08: parked in m3. No teleoperation consumer needs the crate
-yet; telemetry beside video needs [data sync](/quest/m2/watch-data-sync.md),
+Decided 2026-10-08: parked in m5. No teleoperation consumer needs the crate
+yet; telemetry beside video needs [data sync](/quest/m3/watch-data-sync.md),
 not this primitive.
 
 ### Direction
@@ -45,7 +45,7 @@ that might exceed the budget before encoding, leaving the log intact and
 writable (`rs/moq-json/src/stream/mod.rs`). It never rolls its one group;
 when its budget is spent the publisher opens a new track. A link drop or
 reconnect loses what was in flight.
-Those caps hold until [Unbounded groups](/quest/m1/unbounded-groups/README.md)
+Those caps hold until [Unbounded groups](/quest/m2/unbounded-groups/README.md)
 lands; after it, a lagging reader boards a flight if the publisher serves
 replay, and otherwise refreshes or sees `Evicted`.
 So the contract is ordered, gap-free delivery for a live reader within one
@@ -124,5 +124,5 @@ control then it is the wrong abstraction.
 
 ## Related
 
-- [Unbounded groups](/quest/m1/unbounded-groups/README.md) - removes the group caps that bound the reliable class's one log
-- [arbitration](/quest/m3/teleop-arbitration.md) - which controller is obeyed
+- [Unbounded groups](/quest/m2/unbounded-groups/README.md) - removes the group caps that bound the reliable class's one log
+- [arbitration](/quest/m5/teleop-arbitration.md) - which controller is obeyed
diff --git a/quest/m3/transcode-parallel-open.md b/quest/m5/transcode-parallel-open.md
similarity index 100%
rename from quest/m3/transcode-parallel-open.md
rename to quest/m5/transcode-parallel-open.md
diff --git a/quest/m3/unreal.md b/quest/m5/unreal.md
similarity index 91%
rename from quest/m3/unreal.md
rename to quest/m5/unreal.md
index ade838b2be1..35df677bfc1 100644
--- a/quest/m3/unreal.md
+++ b/quest/m5/unreal.md
@@ -10,7 +10,7 @@ editor stability across a play-stop-play cycle.
 
 ## Plan
 
-In m3 until an Unreal consumer asks; the C++ package it links already exists.
+In m5 until an Unreal consumer asks; the C++ package it links already exists.
 
 - Consume the release tarball through the module's `Build.cs`
   (`PublicAdditionalLibraries`, include paths); Unreal's build does not use
@@ -28,4 +28,4 @@ In m3 until an Unreal consumer asks; the C++ package it links already exists.
 
 ## Required
 
-- [First C++ package release](/quest/m2/release/cpp-release.md) - the tarball the module links
+- [First C++ package release](/quest/m3/release/cpp-release.md) - the tarball the module links
diff --git a/quest/m3/uring-cluster-dial.md b/quest/m5/uring-cluster-dial.md
similarity index 87%
rename from quest/m3/uring-cluster-dial.md
rename to quest/m5/uring-cluster-dial.md
index 0234f2084d6..8f4fc4b0d6f 100644
--- a/quest/m3/uring-cluster-dial.md
+++ b/quest/m5/uring-cluster-dial.md
@@ -23,11 +23,11 @@ tokio, swept over links and subscribers.
 Decided 2026-10-22 (maintainer), from the io_uring audit: cluster dials
 stay measure-gated. WebRTC data channels stay on tokio. TCP and
 WebSocket move onto the workers through
-[Stream transports](/quest/m2/perf/stream/README.md), which its own
+[Stream transports](/quest/m4/perf/stream/README.md), which its own
 decision exempts from a gate.
 
 Public API: none until the port. Wire: none.
 
 ## Related
 
-- [Stream transports](/quest/m2/perf/stream/README.md) - the TCP and WebSocket half, ported in m2
+- [Stream transports](/quest/m4/perf/stream/README.md) - the TCP and WebSocket half, ported in m4
diff --git a/quest/m2/uring-transport-machines.md b/quest/m5/uring-transport-machines.md
similarity index 85%
rename from quest/m2/uring-transport-machines.md
rename to quest/m5/uring-transport-machines.md
index f35208644e1..263ca7c21aa 100644
--- a/quest/m2/uring-transport-machines.md
+++ b/quest/m5/uring-transport-machines.md
@@ -13,7 +13,8 @@ single bound.
 #5821 serves moq-transport on the ring by wrapping its transport in
 `moq_uring::transport::Local` (renamed from `Pinned`), which checks the
 thread on every call because the ietf path requires `Boxable`. Decided with
-#5821 (maintainer): ship `Local` public now. Kept in m2 (decided 2026-10-17).
+#5821 (maintainer): ship `Local` public now. Kept in later work (decided 2026-10-17; m5
+since the 2026-11-05 re-cut).
 
 Decided 2026-10-22 (maintainer): rescoped from converting moq-transport to
 named state machines to measuring the check after
@@ -26,4 +27,4 @@ Public API: none unless the check goes, which removes
 
 ## Related
 
-- [Relay io_uring packages](/quest/m2/relay-io-uring-package.md) - not blocked on this; `Local` already gives parity, and only its cost is measured here
+- [Relay io_uring packages](/quest/m3/relay-io-uring-package.md) - not blocked on this; `Local` already gives parity, and only its cost is measured here
diff --git a/quest/m3/video-codec-coverage.md b/quest/m5/video-codec-coverage.md
similarity index 87%
rename from quest/m3/video-codec-coverage.md
rename to quest/m5/video-codec-coverage.md
index bd6d1c51153..9867f75936d 100644
--- a/quest/m3/video-codec-coverage.md
+++ b/quest/m5/video-codec-coverage.md
@@ -31,6 +31,6 @@ Decided 2026-10-08: moved to m3. No consumer has asked for a missing codec.
 
 ## Related
 
-- [NVIDIA formats](/quest/m3/2147-moq-video-10-bit-hevc-and-av1-support-in-the-nvidia-codec.md) - 10-bit HEVC scope; AV1 encode moved to [NVENC AV1](/quest/m3/nvenc-av1.md)
-- [VAAPI](/quest/m2/video-vaapi.md) - existing Linux codec expansion
-- [VP8/VP9 in OBS](/quest/m2/obs-moq-video/vpx-obs.md) - the software decoder reaching the OBS source
+- [NVIDIA formats](/quest/m5/2147-moq-video-10-bit-hevc-and-av1-support-in-the-nvidia-codec.md) - 10-bit HEVC scope; AV1 encode moved to [NVENC AV1](/quest/m5/nvenc-av1.md)
+- [VAAPI](/quest/m1/video-vaapi.md) - existing Linux codec expansion
+- [VP8/VP9 in OBS](/quest/m3/obs-moq-video/vpx-obs.md) - the software decoder reaching the OBS source
diff --git a/quest/m3/video-embedded.md b/quest/m5/video-embedded.md
similarity index 95%
rename from quest/m3/video-embedded.md
rename to quest/m5/video-embedded.md
index 19c3a2b0628..2adae19ecd5 100644
--- a/quest/m3/video-embedded.md
+++ b/quest/m5/video-embedded.md
@@ -31,4 +31,4 @@ libcamera source composes with what already exists, because
 
 ## Required
 
-- [Video validation hardware is on hand](/quest/m3/video-hardware-access.md) - the Pi to validate on
+- [Video validation hardware is on hand](/quest/m5/video-hardware-access.md) - the Pi to validate on
diff --git a/quest/m3/video-hardware-access.md b/quest/m5/video-hardware-access.md
similarity index 84%
rename from quest/m3/video-hardware-access.md
rename to quest/m5/video-hardware-access.md
index d5aa119eb8e..a220234d56f 100644
--- a/quest/m3/video-hardware-access.md
+++ b/quest/m5/video-hardware-access.md
@@ -6,7 +6,7 @@ Someone with the hardware can run the video validation: a Windows machine
 with MJPEG and YUY2 cameras, an Apple Silicon Mac, a live camera per platform, a KDE/Wayland desktop
 with an Intel or AMD GPU, a sandbox that can show the camera portal dialog,
 and a Raspberry Pi 4 or 5 whose CSI camera appears as a PipeWire node, which
-also validates the [embedded video path](/quest/m3/video-embedded.md).
+also validates the [embedded video path](/quest/m5/video-embedded.md).
 
 This quest tracks a condition outside the repository. When it holds, delete
 this quest and every `Required` entry that links it.
@@ -17,8 +17,8 @@ Check by asking the maintainer which machines are available. As of
 2026-10-05 only part is on hand. The maintainer's desktop has an Intel Arrow
 Lake iGPU (iHD 26.1.2, `renderD128`) and an AMD RX 9070 (RADV, Mesa 26.0.8,
 `renderD129`), so it has a second render node; that check moved to
-[VA-API external images](/quest/m2/vaapi-vulkan-import.md). The
-[multi-vendor GPU quests](/quest/m2/gpu-release.md) test on it.
+[VA-API external images](/quest/m3/vaapi-vulkan-import.md). The
+[multi-vendor GPU quests](/quest/m3/gpu-release.md) test on it.
 
 Checked 2026-10-08 on that desktop: `vainfo` lists only `VAEntrypointEncSlice`
 on the iGPU (H.264, HEVC, HEVC Main10, AV1), no `EncSliceLP`, so the
@@ -31,5 +31,5 @@ Decided 2026-10-08: the embedded-device condition folds in here, since a Pi
 Record the device, OS image, and driver when one is on hand.
 
 The validation can start with whatever subset is available; split the rest
-out of [Video hardware validation](/quest/m3/video-hardware.md) when that
+out of [Video hardware validation](/quest/m5/video-hardware.md) when that
 happens.
diff --git a/quest/m3/video-hardware.md b/quest/m5/video-hardware.md
similarity index 88%
rename from quest/m3/video-hardware.md
rename to quest/m5/video-hardware.md
index 91fd3a222e8..658b74634fe 100644
--- a/quest/m3/video-hardware.md
+++ b/quest/m5/video-hardware.md
@@ -8,15 +8,15 @@ real hardware get run on it, and what breaks gets fixed.
 ## Plan
 
 Every item here is blocked on a physical machine rather than on code, which is
-why they sit together and why they sit in m3. Decided in the 2026-09-30 audit:
+why they sit together and why they sit in m5. Decided in the 2026-09-30 audit:
 the KDE DMA-BUF capture and PipeWire camera validations fold in here, and the
 V4L2 `VIDIOC_EXPBUF` source is dropped with the export itself (see
-[#2819](/quest/m2/2819-moq-video-carry-pipewire-dma-bufs-safely-into-the-vulkan.md)).
+[#2819](/quest/m4/2819-moq-video-carry-pipewire-dma-bufs-safely-into-the-vulkan.md)).
 
 Decided 2026-10-08: the VAAPI low-power entrypoint check is dropped. Neither
 Meteor Lake nor the Arrow Lake test host exposes `EncSliceLP`, so no machine
 on hand reaches that fallback. A render node other than the first is checked
-by [VA-API external images](/quest/m2/vaapi-vulkan-import.md).
+by [VA-API external images](/quest/m3/vaapi-vulkan-import.md).
 
 - **Windows Media Foundation capture**: the camera opens while capture is
   enabled and closes when it is disabled, so the LED is off whenever capture
@@ -66,7 +66,7 @@ arrived, and whether the producer used one memory block or one per plane.
 No new capture API, and no libcamera source.
 
 A separate-plane producer belongs to
-[multi-plane cameras](/quest/m3/pipewire-camera-planes.md); if that is why a
+[multi-plane cameras](/quest/m5/pipewire-camera-planes.md); if that is why a
 Pi produces nothing, write it down and stop. `doc/lib/rs/moq-video.md` says
 both paths are reachable; correct that sentence if one cannot capture.
 
@@ -82,7 +82,7 @@ runner hosts (found by the m0 coverage audit):
 - WGC conversion and encode: `wgc_conversion_crops_odd_edges_and_preserves_color`,
   `wgc_conversion_workload`, and
   `wgc_nv12_encodes_with_matching_color_on_gpu_and_software`. The `wgc_*`
-  capture tests belong to [Windows.Graphics.Capture](/quest/m2/capture-wgc.md).
+  capture tests belong to [Windows.Graphics.Capture](/quest/m4/capture-wgc.md).
 - Media Foundation encode: `mediafoundation_cpu_rgba` and
   `mediafoundation_camera_texture`.
 
@@ -95,10 +95,10 @@ is not a bug any amount of review finds.
 
 ## Required
 
-- [Video validation hardware is on hand](/quest/m3/video-hardware-access.md) - the machines to run it on
+- [Video validation hardware is on hand](/quest/m5/video-hardware-access.md) - the machines to run it on
 
 ## Related
 
-- [#2819](/quest/m2/2819-moq-video-carry-pipewire-dma-bufs-safely-into-the-vulkan.md) - the DMA-BUF import validation this capture feeds
-- [Capture multi-plane PipeWire cameras](/quest/m3/pipewire-camera-planes.md) - separate-plane I420 and NV12, when the Pi pass finds them
-- [Embedded video path](/quest/m3/video-embedded.md) - presenting on a Pi, which is a different gap
+- [#2819](/quest/m4/2819-moq-video-carry-pipewire-dma-bufs-safely-into-the-vulkan.md) - the DMA-BUF import validation this capture feeds
+- [Capture multi-plane PipeWire cameras](/quest/m5/pipewire-camera-planes.md) - separate-plane I420 and NV12, when the Pi pass finds them
+- [Embedded video path](/quest/m5/video-embedded.md) - presenting on a Pi, which is a different gap
diff --git a/quest/m3/video-web.md b/quest/m5/video-web.md
similarity index 100%
rename from quest/m3/video-web.md
rename to quest/m5/video-web.md
diff --git a/quest/m3/watch-webxr.md b/quest/m5/watch-webxr.md
similarity index 100%
rename from quest/m3/watch-webxr.md
rename to quest/m5/watch-webxr.md
diff --git a/quest/m2/webgpu-hdr.md b/quest/m5/webgpu-hdr.md
similarity index 100%
rename from quest/m2/webgpu-hdr.md
rename to quest/m5/webgpu-hdr.md
diff --git a/quest/m3/webkit-319818.md b/quest/m5/webkit-319818.md
similarity index 100%
rename from quest/m3/webkit-319818.md
rename to quest/m5/webkit-319818.md
diff --git a/quest/m3/zero-copy-peer.md b/quest/m5/zero-copy-peer.md
similarity index 100%
rename from quest/m3/zero-copy-peer.md
rename to quest/m5/zero-copy-peer.md
diff --git a/rs/moq-hls/tests/integration/conformance.rs b/rs/moq-hls/tests/integration/conformance.rs
index 3a3962d05a6..897b9589763 100644
--- a/rs/moq-hls/tests/integration/conformance.rs
+++ b/rs/moq-hls/tests/integration/conformance.rs
@@ -581,7 +581,7 @@ impl Seen {
 	/// The segments of `name` the DASH manifest may never list: the trailing ones of an instance a
 	/// reconfigure retired, after the last of its segments a timeline did list. The manifest lists
 	/// only the current instance, and a retired one keeps listing what it had read before the
-	/// reconfigure reached the export (/quest/m2/dash-reconfigure.md).
+	/// reconfigure reached the export (/quest/m3/dash-reconfigure.md).
 	fn retired(&self, name: &str) -> BTreeSet<u64> {
 		let timed: Vec<&Bytes> = self
 			.timelines
@@ -740,7 +740,7 @@ impl Seen {
 				.collect();
 			let recording = recorded.segments.get(name).cloned().unwrap_or_default();
 			// Except that the manifest lists only the current instance, so the last segment of one
-			// a reconfigure retires may never be listed (/quest/m2/dash-reconfigure.md).
+			// a reconfigure retires may never be listed (/quest/m3/dash-reconfigure.md).
 			let retired = self.retired(name);
 			let missing: Vec<u64> = recording
 				.iter()
diff --git a/rs/moq-net/src/route/mod.rs b/rs/moq-net/src/route/mod.rs
index 3029687e5b2..64ee72f116c 100644
--- a/rs/moq-net/src/route/mod.rs
+++ b/rs/moq-net/src/route/mod.rs
@@ -5,7 +5,7 @@
 //! asks, and only the identity's own node advances its seqno. Each origin
 //! versions its own claims with a revision, and a node merges every neighbor's
 //! certified view claim by claim, so no stale copy revives a withdrawal it
-//! already knows. See `quest/m1/cluster-routing/routes/README.md` for the contract.
+//! already knows. See `quest/m2/cluster-routing/routes/README.md` for the contract.
 //!
 //! The router does no I/O: the caller feeds it what each neighbor sent and
 //! drains [`Out`] messages and reader [`Event`]s. Neighbor keys `N` and claim
diff --git a/rs/moq-net/tests/integration/mesh_withdraw.rs b/rs/moq-net/tests/integration/mesh_withdraw.rs
index 273abe197f2..6151abcd41c 100644
--- a/rs/moq-net/tests/integration/mesh_withdraw.rs
+++ b/rs/moq-net/tests/integration/mesh_withdraw.rs
@@ -469,7 +469,7 @@ async fn late_better_path_updates_in_place() {
 
 // Residual counterexamples on `main`, with the hold and the retraction
 // quarantine. Each pins what the cluster does today, so a change either way
-// fails here. Routes and announces (quest/m1/cluster-routing/routes/README.md) must
+// fails here. Routes and announces (quest/m2/cluster-routing/routes/README.md) must
 // bring each to a single retraction everywhere.
 
 /// A ring of six relays with links under 150 ms. Relay 3 hears the withdrawal
diff --git a/rs/moq-net/tests/integration/routing_contracts/handoff.rs b/rs/moq-net/tests/integration/routing_contracts/handoff.rs
index aebb1b455b4..c63b9c308cf 100644
--- a/rs/moq-net/tests/integration/routing_contracts/handoff.rs
+++ b/rs/moq-net/tests/integration/routing_contracts/handoff.rs
@@ -6,7 +6,7 @@
 //! view complete as of a revision for the region they cover. Receivers merge
 //! every neighbor's view claim by claim, keeping whichever knowledge is newer,
 //! and keep showing an origin's claims while any route to it is usable or
-//! recovering. See `quest/m1/cluster-routing/routes/README.md`.
+//! recovering. See `quest/m2/cluster-routing/routes/README.md`.
 
 use std::collections::BTreeSet;
 
diff --git a/rs/moq-net/tests/integration/routing_contracts/mod.rs b/rs/moq-net/tests/integration/routing_contracts/mod.rs
index 5c341e1366d..4b837f36eec 100644
--- a/rs/moq-net/tests/integration/routing_contracts/mod.rs
+++ b/rs/moq-net/tests/integration/routing_contracts/mod.rs
@@ -1,6 +1,6 @@
 //! Deterministic counterexamples for the per-origin routing contract.
 //!
-//! Each fixture runs one scenario from `quest/m1/cluster-routing/routes/README.md`
+//! Each fixture runs one scenario from `quest/m2/cluster-routing/routes/README.md`
 //! against [`model`], under the rule that fails and the rule that holds. The
 //! model is a reference for the contract, not the relay: when lite-07's route
 //! layer lands, these topologies become its acceptance tests. Failover fixtures
diff --git a/rs/moq-net/tests/integration/routing_contracts/model.rs b/rs/moq-net/tests/integration/routing_contracts/model.rs
index 2d094da842e..d34022ca63f 100644
--- a/rs/moq-net/tests/integration/routing_contracts/model.rs
+++ b/rs/moq-net/tests/integration/routing_contracts/model.rs
@@ -1,7 +1,7 @@
 //! A reference model of the proposed per-origin route layer, small enough to read.
 //!
 //! It is not the implementation. It exists so the routing contract in
-//! `quest/m1/cluster-routing/routes/README.md` has deterministic counterexamples before
+//! `quest/m2/cluster-routing/routes/README.md` has deterministic counterexamples before
 //! the lite-07 wire is fixed: every rule the contract depends on is a switch
 //! here, and each fixture runs a scenario under the rule that fails and the rule
 //! that holds.
diff --git a/rs/moq-quic/README.md b/rs/moq-quic/README.md
index c71a17f3973..00b3598f815 100644
--- a/rs/moq-quic/README.md
+++ b/rs/moq-quic/README.md
@@ -29,7 +29,7 @@ Ported since the fork point:
 - [`aea1e538`](https://github.com/quinn-rs/quinn/commit/aea1e5384927258887119fa1dc4fe3f23f1182c7) ([quinn#2981](https://github.com/quinn-rs/quinn/pull/2981), and [`77a51bdc`](https://github.com/quinn-rs/quinn/commit/77a51bdc5dc8b63bfba30429ab79fbb142bc8e2a) on `0.11.x`): send an MTU probe only on a validated path. A probe is built after the anti-amplification check, so a server probed a migrated peer address beyond three times what it had received from it, spending the budget its `PATH_CHALLENGE` needed.
 
 Dependency bumps are not ported. The `0.11.x` accept refactors are already covered by this fork's split acceptance and CID routing.
-[`2697de1e`](https://github.com/quinn-rs/quinn/commit/2697de1e1314cb9f98502b7323acd5bdd836b582)'s batched datagram API is not carried: the current WebTransport reader consumes one at a time, and the [planned driver lock profile](../../quest/m2/perf/quic-lock-contention.md) measures contention before adding batching.
+[`2697de1e`](https://github.com/quinn-rs/quinn/commit/2697de1e1314cb9f98502b7323acd5bdd836b582)'s batched datagram API is not carried: the current WebTransport reader consumes one at a time, and the [planned driver lock profile](../../quest/m4/perf/quic-lock-contention.md) measures contention before adding batching.
 
 Checked through quinn `main` at [`aea1e538`](https://github.com/quinn-rs/quinn/commit/aea1e5384927258887119fa1dc4fe3f23f1182c7), and the `0.11.x` branch through [`77a51bdc`](https://github.com/quinn-rs/quinn/commit/77a51bdc5dc8b63bfba30429ab79fbb142bc8e2a) (2026-11-03); start the next sync there.
 
diff --git a/rs/moq-tokio/tests/integration/receive_credit.rs b/rs/moq-tokio/tests/integration/receive_credit.rs
index a98fc16e094..307319cb151 100644
--- a/rs/moq-tokio/tests/integration/receive_credit.rs
+++ b/rs/moq-tokio/tests/integration/receive_credit.rs
@@ -940,7 +940,7 @@ const SEGMENT: usize = 1 << 20;
 /// Why cells whose incomplete units overcommit the window are skipped: the quest that makes
 /// `track::Subscriber` report each group it abandons, which their readers need to return its
 /// in-flight credit.
-const OVERCOMMITTED: &str = "waits on quest/m1/group-drops.md";
+const OVERCOMMITTED: &str = "waits on quest/m2/group-drops.md";
 
 /// One benchmark configuration.
 #[derive(Clone, Copy)]
diff --git a/rs/moq-video/src/capture/pipewire.rs b/rs/moq-video/src/capture/pipewire.rs
index d7313c7bab6..7ee53e22598 100644
--- a/rs/moq-video/src/capture/pipewire.rs
+++ b/rs/moq-video/src/capture/pipewire.rs
@@ -2249,7 +2249,7 @@ mod tests {
 	/// needs a desktop session, PipeWire, and a human clicking the picker dialog:
 	/// `cargo test -p moq-video --features pipewire portal_capture -- --ignored`.
 	#[tokio::test]
-	#[ignore = "needs a desktop portal and a human at the picker; see quest/m3/video-hardware.md"]
+	#[ignore = "needs a desktop portal and a human at the picker; see quest/m5/video-hardware.md"]
 	async fn portal_captures_frames() {
 		let mut stream = match open(&Config::default(), &portal::Selection::new(portal::Kind::Screen)).await {
 			Ok(stream) => stream,
diff --git a/rs/moq-video/src/encode/encoder.rs b/rs/moq-video/src/encode/encoder.rs
index cfc7d6b5ef4..4f10f06c8cd 100644
--- a/rs/moq-video/src/encode/encoder.rs
+++ b/rs/moq-video/src/encode/encoder.rs
@@ -1002,7 +1002,7 @@ mod tests {
 	/// which GPU-less CI runners lack. Run with `--ignored`.
 	#[cfg(target_os = "windows")]
 	#[test]
-	#[ignore = "needs a Media Foundation hardware encoder; see quest/m3/video-hardware.md"]
+	#[ignore = "needs a Media Foundation hardware encoder; see quest/m5/video-hardware.md"]
 	fn mediafoundation_cpu_rgba() {
 		let config = Config {
 			kind: Kind::Named("mediafoundation".into()),
@@ -1045,7 +1045,7 @@ mod tests {
 	/// a GPU. Run with `--ignored`.
 	#[cfg(all(target_os = "windows", feature = "capture"))]
 	#[tokio::test]
-	#[ignore = "needs a Windows camera and GPU; see quest/m3/video-hardware.md"]
+	#[ignore = "needs a Windows camera and GPU; see quest/m5/video-hardware.md"]
 	async fn mediafoundation_camera_texture() {
 		let mut camera = crate::capture::open(&crate::capture::Config::default())
 			.await
diff --git a/sh/gh/test-inventory.allow b/sh/gh/test-inventory.allow
index 8562a330974..033ae5389de 100644
--- a/sh/gh/test-inventory.allow
+++ b/sh/gh/test-inventory.allow
@@ -7,35 +7,35 @@ ignore moq-ffi::test::datagrams_cross_a_default_connection /quest/m0/test-flakes
 ignore moq-gst::source::imp::session_tests::restarts_under_reconnects_interleave_on_one_pad /quest/m0/test-flakes-2/gst-reconnect-interleave.md
 
 # Need a GPU, a desktop, or a device that no CI runner has.
-ignore moq-carla-bridge::gpu_video_reaches_the_worker /quest/m2/carla-bridge.md
-recipe carla::bridge-gpu /quest/m2/carla-bridge.md
-recipe rs::gpu /quest/m2/gpu-ci.md
-ignore moq-video::encode::backend::vaapi::hardware_tests::vaapi_1080p_ladder_stays_on_the_gpu /quest/m2/video-vaapi.md
-ignore moq-video::frame::vulkan::tests::vulkan_gpu_device /quest/m2/gpu-ci.md
-ignore moq-video::frame::vulkan::tests::vulkan_cuda_slot_reuse_and_teardown /quest/m2/gpu-ci.md
-ignore moq-video::frame::cuda::tests::vulkan_cuda_auto_external_encode /quest/m2/gpu-ci.md
-ignore moq-video::frame::cuda::tests::vulkan_cuda_convert_resize_encode /quest/m2/gpu-ci.md
-ignore moq-video::frame::cuda::tests::vulkan_cuda_three_view_workload /quest/m2/gpu-ci.md
-ignore moq-video::render::export::vulkan::tests::nvenc_encodes_the_export_in_place /quest/m2/gpu-ci.md
-ignore moq-video::render::export::vulkan::tests::vulkan_export_round_trips /quest/m2/gpu-ci.md
-ignore moq-video::render::renderer::tests::decoded_frames_reach_the_gpu_without_a_download /quest/m2/vaapi-render-tests.md
-ignore moq-video::render::renderer::tests::packed_dmabuf_renders_through_vulkan /quest/m2/vaapi-render-tests.md
-ignore moq-video::render::renderer::tests::recycled_decoder_surfaces_draw_the_latest_picture /quest/m2/vaapi-render-tests.md
-ignore moq-video::render::renderer::tests::the_i420_dmabuf_import_matches_the_cpu_path /quest/m2/vaapi-render-tests.md
-ignore moq-video::render::renderer::tests::the_nv12_dmabuf_import_matches_the_cpu_path /quest/m2/vaapi-render-tests.md
-ignore moq-video::capture::wgc::native::tests::wgc_displays_reopen_with_cursor_on_and_off /quest/m2/capture-wgc.md
-ignore moq-video::capture::wgc::native::tests::wgc_minimized_window_is_rejected_before_the_first_frame /quest/m2/capture-wgc.md
-ignore moq-video::capture::wgc::native::tests::wgc_window_reopens_with_cursor_on_and_off /quest/m2/capture-wgc.md
-ignore moq-video::capture::pipewire::camera::tests::pipewire_camera_captures_frames /quest/m3/video-hardware.md
-ignore moq-video::capture::pipewire::tests::portal_captures_frames /quest/m3/video-hardware.md
-ignore moq-video::decode::decoder::tests::mediafoundation_resized_texture_reencodes_in_place /quest/m3/video-hardware.md
-ignore moq-video::encode::encoder::tests::mediafoundation_camera_texture /quest/m3/video-hardware.md
-ignore moq-video::encode::encoder::tests::mediafoundation_cpu_rgba /quest/m3/video-hardware.md
-ignore moq-video::encode::encoder::tests::wgc_nv12_encodes_with_matching_color_on_gpu_and_software /quest/m3/video-hardware.md
-ignore moq-video::frame::d3d11::tests::wgc_conversion_crops_odd_edges_and_preserves_color /quest/m3/video-hardware.md
-ignore moq-video::frame::d3d11::tests::wgc_conversion_workload /quest/m3/video-hardware.md
-ignore moq-video::frame::tests::d3d11_resize_defaults_to_the_gpu /quest/m3/video-hardware.md
-ignore moq-video::frame::tests::d3d11_resize_matches_cpu /quest/m3/video-hardware.md
-ignore moq-video::render::export::dx12::tests::exports_an_nv12_texture /quest/m3/video-hardware.md
-ignore moq-video::render::export::dx12::tests::media_foundation_encodes_the_export_in_place /quest/m3/video-hardware.md
+ignore moq-carla-bridge::gpu_video_reaches_the_worker /quest/m5/carla-bridge.md
+recipe carla::bridge-gpu /quest/m5/carla-bridge.md
+recipe rs::gpu /quest/m3/gpu-ci.md
+ignore moq-video::encode::backend::vaapi::hardware_tests::vaapi_1080p_ladder_stays_on_the_gpu /quest/m1/video-vaapi.md
+ignore moq-video::frame::vulkan::tests::vulkan_gpu_device /quest/m3/gpu-ci.md
+ignore moq-video::frame::vulkan::tests::vulkan_cuda_slot_reuse_and_teardown /quest/m3/gpu-ci.md
+ignore moq-video::frame::cuda::tests::vulkan_cuda_auto_external_encode /quest/m3/gpu-ci.md
+ignore moq-video::frame::cuda::tests::vulkan_cuda_convert_resize_encode /quest/m3/gpu-ci.md
+ignore moq-video::frame::cuda::tests::vulkan_cuda_three_view_workload /quest/m3/gpu-ci.md
+ignore moq-video::render::export::vulkan::tests::nvenc_encodes_the_export_in_place /quest/m3/gpu-ci.md
+ignore moq-video::render::export::vulkan::tests::vulkan_export_round_trips /quest/m3/gpu-ci.md
+ignore moq-video::render::renderer::tests::decoded_frames_reach_the_gpu_without_a_download /quest/m4/vaapi-render-tests.md
+ignore moq-video::render::renderer::tests::packed_dmabuf_renders_through_vulkan /quest/m4/vaapi-render-tests.md
+ignore moq-video::render::renderer::tests::recycled_decoder_surfaces_draw_the_latest_picture /quest/m4/vaapi-render-tests.md
+ignore moq-video::render::renderer::tests::the_i420_dmabuf_import_matches_the_cpu_path /quest/m4/vaapi-render-tests.md
+ignore moq-video::render::renderer::tests::the_nv12_dmabuf_import_matches_the_cpu_path /quest/m4/vaapi-render-tests.md
+ignore moq-video::capture::wgc::native::tests::wgc_displays_reopen_with_cursor_on_and_off /quest/m4/capture-wgc.md
+ignore moq-video::capture::wgc::native::tests::wgc_minimized_window_is_rejected_before_the_first_frame /quest/m4/capture-wgc.md
+ignore moq-video::capture::wgc::native::tests::wgc_window_reopens_with_cursor_on_and_off /quest/m4/capture-wgc.md
+ignore moq-video::capture::pipewire::camera::tests::pipewire_camera_captures_frames /quest/m5/video-hardware.md
+ignore moq-video::capture::pipewire::tests::portal_captures_frames /quest/m5/video-hardware.md
+ignore moq-video::decode::decoder::tests::mediafoundation_resized_texture_reencodes_in_place /quest/m5/video-hardware.md
+ignore moq-video::encode::encoder::tests::mediafoundation_camera_texture /quest/m5/video-hardware.md
+ignore moq-video::encode::encoder::tests::mediafoundation_cpu_rgba /quest/m5/video-hardware.md
+ignore moq-video::encode::encoder::tests::wgc_nv12_encodes_with_matching_color_on_gpu_and_software /quest/m5/video-hardware.md
+ignore moq-video::frame::d3d11::tests::wgc_conversion_crops_odd_edges_and_preserves_color /quest/m5/video-hardware.md
+ignore moq-video::frame::d3d11::tests::wgc_conversion_workload /quest/m5/video-hardware.md
+ignore moq-video::frame::tests::d3d11_resize_defaults_to_the_gpu /quest/m5/video-hardware.md
+ignore moq-video::frame::tests::d3d11_resize_matches_cpu /quest/m5/video-hardware.md
+ignore moq-video::render::export::dx12::tests::exports_an_nv12_texture /quest/m5/video-hardware.md
+ignore moq-video::render::export::dx12::tests::media_foundation_encodes_the_export_in_place /quest/m5/video-hardware.md
 
diff --git a/test/interop/README.md b/test/interop/README.md
index 9c4d8e8060c..2d0596d428d 100644
--- a/test/interop/README.md
+++ b/test/interop/README.md
@@ -115,7 +115,7 @@ broadcast, since an announcement means online/offline, so it has no end,
 withdrawal, or session to report. It joins once the broadcast has finished and
 requires exactly ten nonempty video buffers; its cell passes with the end check
 marked N/A. A pinned moq-transport pass records the case as skipped until
-[`quest/m2/ietf-finish.md`](../../quest/m2/ietf-finish.md) makes it pass.
+[`quest/m3/ietf-finish.md`](../../quest/m3/ietf-finish.md) makes it pass.
 
 Every client closes its session on the way out: publishers stop when their input
 ends (the browser on SIGTERM), and subscribers close once they have their frame.
diff --git a/test/interop/interop.sh b/test/interop/interop.sh
index 4f5c0186925..08bc6baa5da 100755
--- a/test/interop/interop.sh
+++ b/test/interop/interop.sh
@@ -1753,7 +1753,7 @@ run_finishes() {
     if [[ "$VERSION" == moq-transport-* ]]; then
         for pub in "${PUB_LIST[@]}"; do
             for sub in "${SUB_LIST[@]}"; do
-                record skip case=finish publisher="$pub" subscriber="$sub" detail="moq-transport finish: quest/m2/ietf-finish.md"
+                record skip case=finish publisher="$pub" subscriber="$sub" detail="moq-transport finish: quest/m3/ietf-finish.md"
             done
         done
         return

From b891adb031fc99ecadceb3f4f855d0cecef73ea4 Mon Sep 17 00:00:00 2001
From: Luke Curley <kixelated@gmail.com>
Date: Fri, 6 Nov 2026 01:38:52 +0000
Subject: [PATCH 35/36] feat(net)!: add JavaScript socket endpoints and bound
 track requests by their lifetime (#7884)

Co-authored-by: GPT-6.1 Sol <noreply@openai.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 doc/lib/js/net.md                            |  45 ++
 js/net/MIGRATE.md                            |  24 +-
 js/net/api/index.api.md                      |  40 +-
 js/net/bench/socket.ts                       |  85 +++
 js/net/src/broadcast.test.ts                 |   2 +
 js/net/src/broadcast.ts                      |  32 +-
 js/net/src/connection/reload.test.ts         |   3 +-
 js/net/src/ietf/join.test.ts                 |  19 +
 js/net/src/ietf/publisher.ts                 |   2 +-
 js/net/src/ietf/request_stream.test.ts       |   4 +-
 js/net/src/ietf/subscriber.test.ts           |  10 +-
 js/net/src/ietf/subscriber.ts                |  26 +-
 js/net/src/index.ts                          |   2 +
 js/net/src/internal.ts                       |  41 +
 js/net/src/lite/connection.ts                |   9 +
 js/net/src/lite/subscriber.test.ts           |  70 +-
 js/net/src/lite/subscriber.ts                |  39 +-
 js/net/src/origin.ts                         |  14 +
 js/net/src/request-deadline.test.ts          | 130 +++-
 js/net/src/resume.test.ts                    |  30 +
 js/net/src/resume.ts                         |  25 +-
 js/net/src/socket.test.ts                    | 764 +++++++++++++++++++
 js/net/src/socket.ts                         | 620 +++++++++++++++
 js/net/src/track.ts                          |  49 +-
 js/net/src/util/deadline.ts                  |  28 +-
 js/net/src/util/demand.ts                    |  14 +-
 py/moq-rs/README.md                          |   2 +-
 quest/m0/test-flakes-2/reload-close-drain.md |   6 +
 quest/m1/socket/README.md                    |   1 -
 quest/m1/socket/boy.md                       |   4 -
 quest/m1/socket/carla.md                     |   4 -
 quest/m1/socket/js.md                        |  30 -
 quest/m3/stream/js.md                        |   1 -
 rs/moq-cli/Cargo.toml                        |   4 +
 sh/gh/nightly.sh                             |   2 +-
 test/interop/README.md                       |   6 +
 test/interop/clients/js-native/socket.ts     | 105 +++
 test/interop/clients/rust/socket-js.rs       | 186 +++++
 test/interop/interop.sh                      |  24 +-
 test/interop/socket.sh                       |  91 +++
 40 files changed, 2414 insertions(+), 179 deletions(-)
 create mode 100644 js/net/bench/socket.ts
 create mode 100644 js/net/src/socket.test.ts
 create mode 100644 js/net/src/socket.ts
 delete mode 100644 quest/m1/socket/js.md
 create mode 100644 test/interop/clients/js-native/socket.ts
 create mode 100644 test/interop/clients/rust/socket-js.rs
 create mode 100644 test/interop/socket.sh

diff --git a/doc/lib/js/net.md b/doc/lib/js/net.md
index 41521578862..f8e77240783 100644
--- a/doc/lib/js/net.md
+++ b/doc/lib/js/net.md
@@ -89,3 +89,48 @@ frame.finish();
 const reader = await consumer.nextFrame();
 for (let chunk = await reader?.readChunk(); chunk; chunk = await reader?.readChunk()) save(chunk);
 ```
+
+## Sockets
+
+Use `Moq.socket.Endpoint` for [point-to-point sessions](/concept/socket), with the same
+origin publishing and consuming through the relay. Each endpoint announces one hidden
+broadcast; accepting verifies that the named peer actually dialed this session.
+Every hop needs moq-lite-07 or moq-transport. Lite-07 currently requires explicitly
+offering `moq-lite-07-wip`; older moq-lite hops do not carry these hidden endpoints. While
+the endpoint's own client connection is moq-lite before 07, its dials and accepts fail as
+unsupported instead of waiting. A dialer can't tell a peer behind such a hop from one not
+online yet, so its dial waits as for any absent peer.
+
+```ts
+const connection = await Moq.Connection.connect({
+    url, versions: ["moq-lite-07-wip"],
+    publish: origin.consume(), consume: origin,
+});
+const endpoint = new Moq.socket.Endpoint(origin, Moq.Path.from("game"), "viewer");
+const session = await endpoint.dialTcp("server", { signal: abort.signal });
+session.producer.writeFrame({ payload: new TextEncoder().encode("hello") });
+session.producer.finish(); // FIN in this direction; the peer may still reply.
+for (let frame = await session.consumer.readFrame(); frame; frame = await session.consumer.readFrame()) {
+    receive(frame.payload);
+}
+endpoint.close();
+connection.close();
+```
+
+A server takes `await endpoint.acceptTcp()`, then accepts or rejects that incoming dial.
+The incoming peer and session are unverified claims; `accept()` can fail if the original
+dial has closed. A pending dial waits for acceptance until it is cancelled or the endpoint
+or session closes, with no acceptance timeout.
+TCP and track dials have independent accept queues. For independent messages, use
+`dialTrack` / `acceptTrack`: the stream exposes a track producer and an already subscribed
+consumer in ascending order until updated. It skips groups that never arrive whole,
+including refused, dropped, or evicted groups; a cut group is never a complete message.
+TCP joins its one group live, recovering the head with a joining FETCH or fill over
+moq-transport. Both stream types expose `peer` and
+`session`; read and write through their producer and consumer handles.
+
+JS TCP currently reads without fastest-reader pacing. A reader that falls behind the
+group's bounded tail fails with an eviction error, so keeping up is required for lossless
+delivery. Finishing a producer is FIN; aborting, closing the endpoint, or releasing a TCP
+reader early resets the session. Close endpoints explicitly, and use `AbortSignal` to
+cancel pending dials and accepts. Keep session ids secret.
diff --git a/js/net/MIGRATE.md b/js/net/MIGRATE.md
index 11a84bfef70..5d288408d44 100644
--- a/js/net/MIGRATE.md
+++ b/js/net/MIGRATE.md
@@ -4,6 +4,28 @@ How to update your code for each breaking change, newest first.
 
 ## Unreleased
 
+### Track requests wait for their answer instead of timing out
+
+A subscription, `info()`, or `fetchGroup()` the publisher hasn't answered no longer fails
+with `StreamCode.ControlTimeout` after ten seconds, since the publisher's application may
+hold its answer, as Rust allows. It waits until the last subscriber closes, the fetch's
+`signal` aborts, the broadcast or session closes, or the publisher refuses it.
+Waiting for stream credit also lasts until cancellation. To give up sooner, close
+the subscriber or abort the fetch on a timer of your own. `info({ signal })` accepts
+the same cancellation signal. Announcement discovery keeps waiting while it is wanted;
+IETF advertisements retain their answer budget.
+
+### Socket endpoints are available
+
+The additive `socket` namespace exports `Endpoint`, `TcpStream`, and `TrackStream`.
+Use `dialTcp` / `acceptTcp` or `dialTrack` / `acceptTrack` on endpoints sharing a prefix;
+cancel pending operations with an `AbortSignal`, and explicitly close endpoints when done.
+Track readers skip groups that are refused, dropped, or evicted instead of waiting forever.
+TCP readers join their one group live, recovering its head with a joining FETCH or fill
+over moq-transport. The existing wire is unchanged. Every hop must support moq-lite-07 (currently an
+explicit `moq-lite-07-wip` offer) or moq-transport; while the endpoint's own client
+connection is moq-lite before 07, its dials and accepts fail as unsupported.
+
 ### Absolute IETF subscriptions keep their prefix
 
 Explicit group ranges now keep their requested start when the subscription answer
@@ -94,7 +116,7 @@ The route metadata interface `Origin.Route` is now the read-only `Origin.RouteIn
 
 ### Opens wait their turn for stream credit ([#7894](https://github.com/moq-dev/moq/pull/7894))
 
-`NoStreamCredit` is removed: a request no longer fails when the peer grants no more streams. Every open waits for credit, and returning credit goes to the open with the highest `sendOrder`. A request's 10s deadline runs only while none of its streams waits to open.
+`NoStreamCredit` is removed: a request no longer fails when the peer grants no more streams. Every open waits for credit, and returning credit goes to the open with the highest `sendOrder`. Request opens leave the queue when their caller cancels.
 `OpenOptions.timeout` and `OpenOptions.waitUntilAvailable` are removed; drop them. `Writer.tryOpen` still gives up on `cancel`, and its `sendOrder` may be a function, read again while the open waits.
 
 ### Relative group anchors are `bigint`
diff --git a/js/net/api/index.api.md b/js/net/api/index.api.md
index d121e0b669d..ac001343255 100644
--- a/js/net/api/index.api.md
+++ b/js/net/api/index.api.md
@@ -665,7 +665,7 @@ export namespace Track {
 	};
 	export class Consumer {
 		fetchGroup(sequence: bigint, options?: Track.FetchGroupOptions): Promise<Group.Consumer>;
-		info(): Promise<Track.Info>;
+		info(options?: Track.InfoOptions): Promise<Track.Info>;
 		readonly name: string;
 		subscribe(options?: Track.Subscription): Track.Subscriber;
 	}
@@ -713,6 +713,9 @@ export namespace Track {
 	export interface InfoInit extends Partial<Omit<Track.Info, "maxAge">> {
 		maxAge?: Milli | null;
 	}
+	export interface InfoOptions {
+		signal?: AbortSignal;
+	}
 	export type Order = "ascending" | "descending";
 	export class Ordered {
 		close(abort?: Error): void;
@@ -817,4 +820,39 @@ export namespace Varint {
 	export function encodeTo(dst: ArrayBuffer, v: number | bigint): Uint8Array;
 	export function size(v: number): number;
 }
+
+export namespace socket {
+	export class Endpoint {
+		constructor(origin: Origin.Producer, prefix: Path.Valid, id: string);
+		acceptTcp(options?: socket.Options): Promise<socket.Incoming<socket.TcpStream>>;
+		acceptTrack(options?: socket.Options): Promise<socket.Incoming<socket.TrackStream>>;
+		close(): void;
+		get closed(): Signals.GetPromise<Error | null>;
+		dialTcp(peer: string, options?: socket.Options): Promise<socket.TcpStream>;
+		dialTrack(peer: string, info?: Track.InfoInit, options?: socket.Options): Promise<socket.TrackStream>;
+		readonly id: string;
+		readonly prefix: Path.Valid;
+	}
+	export class Incoming<S extends socket.TcpStream | socket.TrackStream> {
+		accept(...args: S extends socket.TcpStream ? [options?: socket.Options] : [info?: Track.InfoInit, options?: socket.Options]): Promise<S>;
+		readonly peer: string;
+		reject(): void;
+		readonly session: string;
+	}
+	export interface Options {
+		signal?: AbortSignal;
+	}
+	export class TcpStream {
+		readonly consumer: Group.Consumer;
+		readonly peer: string;
+		readonly producer: Group.Producer;
+		readonly session: string;
+	}
+	export class TrackStream {
+		readonly consumer: Track.Subscriber;
+		readonly peer: string;
+		readonly producer: Track.Producer;
+		readonly session: string;
+	}
+}
 ```
diff --git a/js/net/bench/socket.ts b/js/net/bench/socket.ts
new file mode 100644
index 00000000000..fef5e678251
--- /dev/null
+++ b/js/net/bench/socket.ts
@@ -0,0 +1,85 @@
+/** Per-session socket handshake, frame delivery and teardown swept over endpoints x sessions per endpoint. */
+import { yieldNow } from "@moq/clock";
+import { accept } from "../src/connection/accept.ts";
+import { connect } from "../src/connection/connect.ts";
+import { Origin, Path, socket } from "../src/index.ts";
+import * as Lite from "../src/lite/index.ts";
+import { createMockTransportPair } from "../src/mock.ts";
+
+console.debug = () => {};
+console.log("mode,protocol,endpoints,sessions_per_endpoint,open_us,frame_us,close_us");
+for (const mode of ["local", "lite07"] as const)
+	for (const protocol of ["tcp", "track"] as const)
+		for (const endpoints of [1, 8, 32])
+			for (const sessions of [1, 8, 32]) {
+				const samples: number[][] = [];
+				for (let round = 0; round < 4; round++) {
+					const origin = new Origin.Producer();
+					const remote = mode === "local" ? origin : new Origin.Producer();
+					const pair = mode === "lite07" ? createMockTransportPair(Lite.ALPN_07_WIP) : undefined;
+					const connections = pair
+						? await Promise.all([
+								connect({
+									url: new URL("https://localhost/bench"),
+									transport: pair.client,
+									publish: origin.consume(),
+									consume: origin,
+								}),
+								accept({
+									url: new URL("https://localhost/bench"),
+									transport: pair.server,
+									publish: remote.consume(),
+									consume: remote,
+								}),
+							])
+						: [];
+					const dialer = new socket.Endpoint(origin, Path.from("bench"), "dialer");
+					const peers = Array.from(
+						{ length: endpoints },
+						(_, i) => new socket.Endpoint(remote, Path.from("bench"), `peer-${i}`),
+					);
+					const start = performance.now();
+					const pairs = await Promise.all(
+						peers.flatMap((peer) =>
+							Array.from({ length: sessions }, async () => {
+								const incoming = protocol === "tcp" ? peer.acceptTcp() : peer.acceptTrack();
+								const dialing =
+									protocol === "tcp" ? dialer.dialTcp(peer.id) : dialer.dialTrack(peer.id);
+								return Promise.all([dialing, (await incoming).accept()]);
+							}),
+						),
+					);
+					const opened = performance.now();
+					await Promise.all(
+						pairs.map(async ([local, remote]) => {
+							local.producer.writeFrame({ payload: new Uint8Array(1024) });
+							const frame =
+								remote instanceof socket.TcpStream
+									? await remote.consumer.readFrame()
+									: await remote.consumer.ordered().readFrame();
+							if (frame?.payload.length !== 1024) throw new Error("missing socket payload");
+						}),
+					);
+					const received = performance.now();
+					dialer.close();
+					for (const peer of peers) peer.close();
+					origin.close();
+					remote.close();
+					for (const connection of connections) connection.abort();
+					await yieldNow();
+					const closed = performance.now();
+					if (round)
+						samples.push(
+							[opened - start, received - opened, closed - received].map(
+								(ms) => (ms * 1000) / pairs.length,
+							),
+						);
+				}
+				const median = [0, 1, 2].map((i) =>
+					samples
+						.map((sample) => sample[i])
+						.sort((a, b) => a - b)[1]
+						.toFixed(2),
+				);
+				console.log(`${mode},${protocol},${endpoints},${sessions},${median.join(",")}`);
+			}
diff --git a/js/net/src/broadcast.test.ts b/js/net/src/broadcast.test.ts
index bf6adef6fe5..0215b901ad0 100644
--- a/js/net/src/broadcast.test.ts
+++ b/js/net/src/broadcast.test.ts
@@ -236,6 +236,7 @@ test("held info lookups keep a request until the last one lets go", async () =>
 	const opened = wireOf(broadcast).resolveTrackInfo("media", first.signal);
 	const request = await pulled;
 	if (!request) throw new Error("expected request");
+	expect(hooks.requestWanted(request).peek()).toBe(true);
 	const producer = request.accept();
 	const second = new AbortController();
 	await wireOf(broadcast).resolveTrackInfo("media", second.signal);
@@ -246,6 +247,7 @@ test("held info lookups keep a request until the last one lets go", async () =>
 	expect(producer.closed.peek()).toBeUndefined();
 
 	second.abort();
+	expect(hooks.requestWanted(request).peek()).toBe(false);
 	expect(producer.closed.peek()).toBeDefined();
 	broadcast.close();
 });
diff --git a/js/net/src/broadcast.ts b/js/net/src/broadcast.ts
index bb2eb8337d9..e562959b4de 100644
--- a/js/net/src/broadcast.ts
+++ b/js/net/src/broadcast.ts
@@ -21,7 +21,7 @@ let stampProducer: (producer: Producer, path: Path.Valid) => void;
 
 // Info lookups pending or held on a track.
 class Lookups {
-	pending = 0;
+	pending = new Signal(0);
 	// Whether a lookup opened the request, so the last lookup to end closes it unless subscribed.
 	opened = false;
 }
@@ -220,7 +220,7 @@ function logical(state: BroadcastState, name: string): { producer: track.Produce
 	});
 
 	state.requested.mutate((requested) => {
-		requested.push(hooks.makeRequest({ name, producer, pending: state.pending }));
+		requested.push(hooks.makeRequest({ name, producer, pending: state.pending, lookups }));
 	});
 
 	return { producer, requested: true };
@@ -230,21 +230,21 @@ function subscribe(state: BroadcastState, name: string, options?: track.Subscrip
 	return logical(state, name).producer.subscribe(options);
 }
 
-// A lookup is held until `hold` aborts, which also abandons it before the answer. A request a lookup opened is let go once it is answered and nobody holds or subscribes
-// to it; closing it sooner would hand its handler a closed producer.
+// A lookup holds a request until `hold` aborts, even before the answer. An unanswered
+// request stays open for its handler; after acceptance nobody holding it releases it.
 async function resolveTrackInfo(state: BroadcastState, name: string, hold?: AbortSignal): Promise<track.Info> {
 	hold?.throwIfAborted();
 	const { producer, requested } = logical(state, name);
 	const lookups = state.lookups.get(producer);
 	if (!lookups) return producer.info();
 	if (requested) lookups.opened = true;
-	lookups.pending++;
+	lookups.pending.update((pending) => pending + 1);
 
 	const info = producer.info();
 	let answered = false;
 	let ended = false;
 	const release = () => {
-		if (lookups.opened && lookups.pending === 0 && producer.demand().wanted.peek() === undefined)
+		if (lookups.opened && lookups.pending.peek() === 0 && producer.demand().wanted.peek() === undefined)
 			hooks.releaseTrack(producer);
 	};
 	info.then(
@@ -256,7 +256,7 @@ async function resolveTrackInfo(state: BroadcastState, name: string, hold?: Abor
 	);
 	const end = () => {
 		ended = true;
-		lookups.pending--;
+		lookups.pending.update((pending) => pending - 1);
 		if (answered) release();
 	};
 
@@ -393,6 +393,20 @@ export class Producer {
 	}
 
 	static {
+		hooks.reserveUnlistedTrack = (broadcast, name) => {
+			const state = broadcast.#state;
+			if (state.closed.peek() !== undefined) throw new Error("broadcast is closed");
+			if (lookup(state, name)) throw new Error("duplicate reserved track");
+			const producer = new track.Producer(name);
+			const lookups = new Lookups();
+			state.lookups.set(producer, lookups);
+			state.requests.set(name, producer);
+			void hooks.trackReleased(producer).then(() => {
+				if (state.requests.get(name) === producer) state.requests.delete(name);
+			});
+			return hooks.makeRequest({ name, producer, pending: state.pending, lookups });
+		};
+
 		hooks.onClosed = (producer, fn) => {
 			const closers = producer.#state.closers;
 			closers.add(fn);
@@ -434,9 +448,7 @@ export class Producer {
 		const request = takeQueued(this.#state, name);
 		if (request) {
 			const producer = request.accept(info);
-			// The application owns it now: a lookup that opened the request must not close it.
-			const lookups = this.#state.lookups.get(producer);
-			if (lookups) lookups.opened = false;
+			hooks.keepRequest(request);
 			this.#state.requests.delete(name);
 			adopt(this.#state, producer, track.authoredInfo(info));
 			return producer;
diff --git a/js/net/src/connection/reload.test.ts b/js/net/src/connection/reload.test.ts
index 066835bc2f6..4b36caa5dcd 100644
--- a/js/net/src/connection/reload.test.ts
+++ b/js/net/src/connection/reload.test.ts
@@ -941,7 +941,8 @@ test("a retired GOAWAY predecessor still closes by its handover cap", async () =
 
 // A publication only a token's grant covers keeps that grant while the session drains, so
 // closing the loop ends the tokens after the drain rather than cutting the final group.
-test("closing the loop keeps the tokens until the session drains", async () => {
+// Quarantined pending quest/m0/test-flakes-2/reload-close-drain.md.
+test.skip("closing the loop keeps the tokens until the session drains", async () => {
 	const original = globalThis.WebTransport;
 	const clock = new Manual();
 	const installed = clock.install();
diff --git a/js/net/src/ietf/join.test.ts b/js/net/src/ietf/join.test.ts
index 3474d61dbdc..04cd354f07c 100644
--- a/js/net/src/ietf/join.test.ts
+++ b/js/net/src/ietf/join.test.ts
@@ -280,6 +280,25 @@ test("a reader in sequence order with no delay budget skips headless groups", as
 	expect(group?.sequence).toBe(GROUP + 2n);
 });
 
+for (const version of VERSIONS) {
+	for (const objectId of [0n, 2n]) {
+		test(`draft ${version}: a group-0 reader skips the Largest group's cut tail after object ${objectId}`, async () => {
+			const { subscriber, consumer, answer } = await subscribed(version, {
+				order: "ascending",
+				delay: { max: null },
+				ranges: [{ start: { absolute: 0n } }],
+			});
+			await answer({ groupId: 0n, objectId });
+			// Largest is inclusive, including object 0: its following tail is no whole message.
+			await subscriber.handleGroup(...liveStream(0n, Number(objectId) + 1, ["cut"], version));
+			await subscriber.handleGroup(...liveStream(1n, 0, ["whole"], version));
+			const group = await consumer.ordered().nextGroup();
+			expect(group?.sequence).toBe(1n);
+			expect(await frames(group)).toEqual(["whole"]);
+		});
+	}
+}
+
 test("a tail parked on a refused joining FETCH is dropped", async () => {
 	const { subscriber, consumer, fetching } = await join();
 
diff --git a/js/net/src/ietf/publisher.ts b/js/net/src/ietf/publisher.ts
index 607a4755356..7bb17df7053 100644
--- a/js/net/src/ietf/publisher.ts
+++ b/js/net/src/ietf/publisher.ts
@@ -1840,7 +1840,7 @@ export class Publisher {
 		// leaving this one namespace unadvertised.
 		let request: RequestStream | undefined;
 		try {
-			const deadline = new Deadline();
+			const deadline = new Deadline(Milli(ADVERTISE_TIMEOUT_MS));
 			const answer = await deadline.wait(
 				(async (): Promise<Answer> => {
 					const opened = await RequestStream.open(this.#session, deadline, { quic: this.#quic });
diff --git a/js/net/src/ietf/request_stream.test.ts b/js/net/src/ietf/request_stream.test.ts
index ed9a9a486b6..aab85a684cb 100644
--- a/js/net/src/ietf/request_stream.test.ts
+++ b/js/net/src/ietf/request_stream.test.ts
@@ -178,7 +178,7 @@ test("a request's deadline ends it through the request, so later ends do nothing
 		});
 		const aborts = spyOn(stream, "abort");
 		const session = { version: Version.DRAFT_18, client: true, openBi: () => stream } as unknown as Session;
-		const deadline = new Deadline();
+		const deadline = new Deadline(Milli(REQUEST_TIMEOUT_MS));
 		const request = await RequestStream.open(session, deadline);
 		const answer = deadline.wait(new Promise<never>(() => {})).catch((e: unknown) => e);
 		await clock.advance(Nano.fromMilli(Milli(REQUEST_TIMEOUT_MS)));
@@ -213,7 +213,7 @@ test("a request waiting for stream credit outlasts its deadline, which runs from
 			client: true,
 			openBi: () => opening.promise,
 		} as unknown as Session;
-		const deadline = new Deadline();
+		const deadline = new Deadline(Milli(REQUEST_TIMEOUT_MS));
 		const send = mock((request: RequestStream) => request.writer.u8(1));
 		const sending = RequestStream.open(session, deadline).then(send);
 		let failure: unknown;
diff --git a/js/net/src/ietf/subscriber.test.ts b/js/net/src/ietf/subscriber.test.ts
index 7d6ef74ce39..4da2efa57b8 100644
--- a/js/net/src/ietf/subscriber.test.ts
+++ b/js/net/src/ietf/subscriber.test.ts
@@ -972,7 +972,7 @@ test("SUBSCRIBE_OK's largest is known before any group arrives", async () => {
 	track.close();
 });
 
-test.each(["acceptance", "timeout"])("returning demand preserves pending setup until %s", async (outcome) => {
+test.each(["acceptance", "refusal"])("returning demand preserves pending setup until %s", async (outcome) => {
 	const clock = new Manual();
 	const installed = clock.install();
 	const pair = createMockTransportPair(ALPN.DRAFT_18);
@@ -1046,9 +1046,13 @@ test.each(["acceptance", "timeout"])("returning demand preserves pending setup u
 		expect(await info).toMatchObject({ priority: 127 - 128 });
 		expect(returned.closed.peek()).toBeUndefined();
 	} else {
-		await clock.advance(Nano.fromMilli(Milli(4_000)));
+		// No answer budget: an hour later the same setup still waits for the publisher.
+		await clock.advance(Nano.fromMilli(Milli(3_600_000)));
+		expect(returned.closed.peek()).toBeUndefined();
+		await peer.writer.u53(RequestError.id);
+		await new RequestError({ errorCode: 0x10, reasonPhrase: "not here" }).encode(peer.writer, VERSION);
 		expect(await info).toBeInstanceOf(Error);
-		expect(((await info) as Error).message).toContain("request timed out after 10000ms");
+		expect(((await info) as Error).message).toContain("not here");
 	}
 	expect(opening).toHaveBeenCalledTimes(1);
 });
diff --git a/js/net/src/ietf/subscriber.ts b/js/net/src/ietf/subscriber.ts
index 4379a2b5fce..7dd400a79e4 100644
--- a/js/net/src/ietf/subscriber.ts
+++ b/js/net/src/ietf/subscriber.ts
@@ -34,7 +34,7 @@ import type * as track from "../track.ts";
 import { untilAborted } from "../util/abort.ts";
 import { closeUnwanted } from "../util/announce.ts";
 import { Deadline } from "../util/deadline.ts";
-import { abandoned as demandAbandoned, isAbandoned, unwanted } from "../util/demand.ts";
+import { abandoned as demandAbandoned, isAbandoned, unrequested, unwanted } from "../util/demand.ts";
 import { LIMITS, type Limits, SlotMap, Slots } from "../util/limits.ts";
 import { min } from "../util/sequence.ts";
 import { bounded, wireSpan } from "../window.ts";
@@ -94,8 +94,8 @@ type Subscription = {
 };
 
 // Out-parameter for #openSubscribe: lets the caller observe partial progress
-// (stream opened, trackAlias registered) so it can clean up on timeout even
-// before the setup promise settles.
+// (stream opened, trackAlias registered) so it can clean up a failed or abandoned setup
+// even before the setup promise settles.
 type SubscribeSetupState = {
 	stream?: RequestStream;
 	// The accepted subscription, which a registered alias names.
@@ -104,7 +104,7 @@ type SubscribeSetupState = {
 	requests?: Requests;
 	/**
 	 * Aborts once the caller has given up. An open still waiting leaves the line, and setup
-	 * checks it once the stream exists so a request opened after the timeout still unwinds:
+	 * checks it once the stream exists so a request opened after cancellation still unwinds:
 	 * nothing else settles setup if the peer has gone quiet, and the cleanup that fired first
 	 * saw no stream to tear down.
 	 */
@@ -786,9 +786,9 @@ export class Subscriber {
 
 		// Keep the request pending until SUBSCRIBE_OK supplies immutable track metadata.
 		// Group streams already wait on the alias, so early data stays behind this response.
-		// Open the stream and wait for SUBSCRIBE_OK under a timeout. State
-		// flows back via `state` so the timeout path can clean up the stream
-		// and any registration if setup eventually finishes.
+		// Wait for SUBSCRIBE_OK while the track is wanted, since the publisher may hold its
+		// answer. State lets cancellation clean up streams and registration even if setup
+		// finishes later.
 		const state: SubscribeSetupState = { cancel: new AbortController() };
 		const deadline = new Deadline();
 		const setup = this.#openSubscribe(state, broadcast, request, requestId, deadline, known?.producer);
@@ -810,7 +810,7 @@ export class Subscriber {
 		let maxAge: number | undefined;
 		const abandoned = new Error("subscribe abandoned before it was accepted");
 		try {
-			// Returning demand keeps the same setup and its original deadline.
+			// Returning demand keeps the same setup.
 			const accepted = deadline.wait(setup);
 			for (;;) {
 				const result = await untilAborted(race([accepted, waitAbandoned()]), valid);
@@ -838,8 +838,7 @@ export class Subscriber {
 			);
 			// Runs now for whatever is already open, and again if `setup` settles late.
 			// Retirement is repeated because a late SUBSCRIBE_OK can register an alias after
-			// the first pass. The request ends once: a deadline failure already reset it through
-			// the same stream, so a second end here does nothing.
+			// the first pass. The request ends once, so repeated cleanup does nothing.
 			const cleanup = () => {
 				state.cancel.abort(e);
 
@@ -865,8 +864,7 @@ export class Subscriber {
 
 			// Tear down what is already open rather than waiting on `setup`. A peer that
 			// opened the stream and then went quiet never settles it, and deferring would
-			// leave the request outstanding for the life of the session -- which is the
-			// timeout case, not a rare one.
+			// leave the request outstanding for the life of the session.
 			cleanup();
 			setup.then(cleanup, cleanup);
 			return;
@@ -1051,7 +1049,7 @@ export class Subscriber {
 			const ok = await untilAborted(
 				race([
 					deadline.wait(setup()),
-					demandAbandoned(request.demand()).then((): never => {
+					unrequested(request).then((): never => {
 						throw new Error("history read abandoned");
 					}),
 				]),
@@ -1511,7 +1509,7 @@ export class Subscriber {
 
 	// Opens the subscribe stream, sends SUBSCRIBE, and reads the response.
 	// `state` is populated as soon as the stream opens and again when the
-	// trackAlias is registered, so the caller can clean both up on timeout
+	// trackAlias is registered, so the caller can clean both up once it gives up,
 	// even before this promise settles.
 	async #openSubscribe(
 		state: SubscribeSetupState,
diff --git a/js/net/src/index.ts b/js/net/src/index.ts
index f22234d3edc..b87a202a8be 100644
--- a/js/net/src/index.ts
+++ b/js/net/src/index.ts
@@ -32,6 +32,8 @@ export * as Instance from "./instance.ts";
 export * as Origin from "./origin.ts";
 /** Broadcast path utilities with delimiter-aware prefix matching. Path patterns are re-exported from `@moq/pattern`. */
 export * as Path from "./path.ts";
+/** Point-to-point TCP and track sessions through an origin. */
+export * as socket from "./socket.ts";
 /** Presentation timestamps and their timescales; duration units live in `@moq/clock`. */
 export * as Time from "./time.ts";
 /** A value paired with the timestamp it was captured at, absent when untimed. */
diff --git a/js/net/src/internal.ts b/js/net/src/internal.ts
index eab7e905b34..1f068aa70e5 100644
--- a/js/net/src/internal.ts
+++ b/js/net/src/internal.ts
@@ -14,6 +14,7 @@ import { toStreamCode } from "./error.ts";
 import type { Frame, FrameConsumer, Consumer as GroupConsumer, Producer as GroupProducer } from "./group.ts";
 import { isAnonymous, type RouteInfo } from "./hop.ts";
 import type * as Instance from "./instance.ts";
+import type { Consumer as OriginConsumer, Producer as OriginProducer } from "./origin.ts";
 import * as Path from "./path.ts";
 import type { Timestamp } from "./time.ts";
 import type {
@@ -33,6 +34,9 @@ import * as Varint from "./varint.ts";
 import type { Resolved, Window } from "./window.ts";
 import type { Advertised, Advertisements } from "./wire.ts";
 
+/** The hidden broadcast segment reserved for socket endpoints. */
+export const SOCKET = ".socket";
+
 /** What a null {@link Delay.max} goes out as: the largest value every peer can read, as Rust sends for `None`. */
 export const NO_MAX_DELAY = Milli(Varint.MAX_U53);
 
@@ -336,6 +340,8 @@ export interface Land {
  * buffer of its own. Implemented by `resume.ts`, the counterpart of the Rust `Inner::Resume`.
  */
 export interface ResumeSource {
+	/** Observe a serving copy's abort, including delivery failures a resumable reader waits past. */
+	watchError(fn: (error: Error) => void): Dispose;
 	/** Re-evaluate a live-edge join at the serving copy. */
 	join(): void;
 	/**
@@ -403,6 +409,8 @@ export interface TrackRequestOptions {
 	producer: Producer;
 	/** Requests not yet accepted or rejected by the publisher. */
 	pending: Set<Request>;
+	/** Metadata-only readers holding this request, if its broadcast supports them. */
+	lookups?: { pending: Getter<number>; opened: boolean };
 }
 
 /**
@@ -732,6 +740,21 @@ export const hooks: {
 	evictGroup: (group: GroupConsumer) => boolean;
 	/** Call `fn` synchronously when an open broadcast closes, from any handle. */
 	onClosed: (producer: BroadcastProducer, fn: () => void) => Dispose;
+	/** Reserve an on-demand track without listing it or enabling a request handler. */
+	reserveUnlistedTrack: (producer: BroadcastProducer, name: string) => Request;
+	/** Whether a subscriber or a metadata lookup still holds a requested track. */
+	requestWanted: (request: Request) => Getter<boolean>;
+	/** Transfer a metadata-opened request to its session's producer lifetime. */
+	keepRequest: (request: Request) => void;
+	/** Observe the peer's reset without waiting for routed delivery recovery. */
+	watchSubscriberError: (subscriber: Subscriber, fn: (error: Error) => void) => Dispose;
+	/**
+	 * Count a session withholding the origin's hidden broadcasts from its peer, such as a
+	 * moq-lite client before 07, whose peer can't ask for them, until disposed.
+	 */
+	withholdHidden: (origin: OriginConsumer) => Dispose;
+	/** How many sessions withhold the origin's hidden broadcasts from their peer. */
+	hiddenWithheld: (origin: OriginProducer) => Getter<number>;
 	/** Name a broadcast handle by the path an origin created or resolved it at. */
 	stampPath: (target: BroadcastProducer | BroadcastConsumer, path: Path.Valid) => void;
 	/** Name the instance of the route an origin resolved a broadcast handle through. */
@@ -1014,6 +1037,24 @@ export const hooks: {
 	onClosed: () => {
 		throw new Error("broadcast.ts not loaded");
 	},
+	reserveUnlistedTrack: () => {
+		throw new Error("broadcast.ts not loaded");
+	},
+	requestWanted: () => {
+		throw new Error("track.ts not loaded");
+	},
+	keepRequest: () => {
+		throw new Error("track.ts not loaded");
+	},
+	watchSubscriberError: () => {
+		throw new Error("track.ts not loaded");
+	},
+	withholdHidden: () => {
+		throw new Error("origin.ts not loaded");
+	},
+	hiddenWithheld: () => {
+		throw new Error("origin.ts not loaded");
+	},
 	stampPath: () => {
 		throw new Error("broadcast.ts not loaded");
 	},
diff --git a/js/net/src/lite/connection.ts b/js/net/src/lite/connection.ts
index 9c4ae23b308..3150fd24f98 100644
--- a/js/net/src/lite/connection.ts
+++ b/js/net/src/lite/connection.ts
@@ -10,6 +10,7 @@ import { type Transport, transportOf } from "../connection/transport.ts";
 import { closeError, error, fromClose, ProtocolViolation, StreamCode, sessionCause } from "../error.ts";
 import { type Hop, randomHop } from "../hop.ts";
 import { IMPLEMENTATION } from "../implementation.ts";
+import { hooks } from "../internal.ts";
 import type { Consumer as OriginConsumer } from "../origin.ts";
 import * as Path from "../path.ts";
 import { type Reader, Readers, Stream, Writer } from "../stream.ts";
@@ -37,6 +38,7 @@ import {
 	hasDatagrams,
 	hasDatagramTracks,
 	hasGoaway,
+	hasHidden,
 	hasPadding,
 	hasProbeRtt,
 	hasRouteKey,
@@ -215,6 +217,13 @@ export class Connection implements Established {
 		// finds this session still active.
 		const leave = () => this.#auth.close();
 		void quic.closed.then(leave, leave);
+		// Before lite-07 the peer can't ask for hidden routes, so a client publishes none of
+		// them, and a socket endpoint behind it is unreachable. A server leaves it to the
+		// client, whose origin holds that endpoint.
+		if (client && publish && !hasHidden(version)) {
+			const withholding = hooks.withholdHidden(publish);
+			void quic.closed.then(withholding, withholding);
+		}
 		this.#auth.violated.subscribe((err) => {
 			if (!err) return;
 			closeViolation(this.#quic, err);
diff --git a/js/net/src/lite/subscriber.test.ts b/js/net/src/lite/subscriber.test.ts
index 8f37fd964af..3dbc4bc20e2 100644
--- a/js/net/src/lite/subscriber.test.ts
+++ b/js/net/src/lite/subscriber.test.ts
@@ -42,7 +42,7 @@ import {
 	SubscribeStart,
 	SubscribeUpdate,
 } from "./subscribe.ts";
-import { Minted, SUBSCRIBE_SETUP_TIMEOUT_MS, Subscriber } from "./subscriber.ts";
+import { Minted, Subscriber } from "./subscriber.ts";
 import { Track, TrackInfo } from "./track.ts";
 import { Version, versionName } from "./version.ts";
 
@@ -1182,13 +1182,14 @@ test.each([
 	await stuck.aborted;
 });
 
-// A setup that outlived its deadline is over: its TRACK stream is reset, along with the SUBSCRIBE
-// sent beside it, and the subscription is not registered again.
+// An unanswered setup waits as long as it is wanted. Once its last subscriber leaves it is over: its
+// TRACK stream is reset along with the SUBSCRIBE sent beside it,
+// and the subscription is not registered again.
 test.each([
 	["lite-05 subscribe waiting on the TRACK_INFO", Version.DRAFT_05],
 	["lite-06 subscribe waiting on the TRACK_INFO", Version.DRAFT_06],
 	["lite-07 subscribe waiting on the TRACK_INFO", Version.DRAFT_07],
-] as const)("a %s that times out leaves nothing behind", async (_, version) => {
+] as const)("a %s abandoned before its answer leaves nothing behind", async (_, version) => {
 	const clock = new Manual();
 	const installed = clock.install();
 	const warn = spyOn(console, "warn").mockImplementation(() => {});
@@ -1199,8 +1200,9 @@ test.each([
 		await opened(0);
 		await streams[0].reading;
 
-		await clock.advance(Nano.fromMilli(Milli(SUBSCRIBE_SETUP_TIMEOUT_MS)));
-		await track.closed;
+		await clock.advance(Nano.fromMilli(Milli(3_600_000)));
+		expect(track.closed.peek()).toBeUndefined();
+		track.close();
 
 		await streams[0].aborted;
 		await streams[1].aborted;
@@ -1235,13 +1237,10 @@ test("a lite subscribe waiting on a stream slot for the SUBSCRIBE outlasts the d
 		const track = subscriber.consume(Path.from("room")).track("video").subscribe();
 		await opened(0);
 		await streams[0].reading;
-		// TRACK_INFO lands halfway, so the SUBSCRIBE open's own deadline is still ahead when the
-		// setup deadline fires.
-		await clock.advance(Nano.fromMilli(Milli(SUBSCRIBE_SETUP_TIMEOUT_MS / 2)));
 		await answerTrackInfo(streams[0]);
 		await opened(1);
 
-		await clock.advance(Nano.fromMilli(Milli(3 * SUBSCRIBE_SETUP_TIMEOUT_MS)));
+		await clock.advance(Nano.fromMilli(Milli(3_600_000)));
 		expect(track.closed.peek()).toBeUndefined();
 
 		streams[1].release();
@@ -1310,9 +1309,9 @@ test("a lite subscribe whose readers leave while it waits for a stream gives up
 	}
 });
 
-// A SUBSCRIBE write blocked on flow control may never let the setup settle, so the deadline
+// A SUBSCRIBE write blocked on flow control may never let the setup settle, so abandonment
 // lets go of the held TRACK stream without waiting for it.
-test("a lite subscribe whose SUBSCRIBE write stalls past the deadline closes its TRACK stream", async () => {
+test("a lite subscribe abandoned while its SUBSCRIBE write stalls closes its TRACK stream", async () => {
 	const clock = new Manual();
 	const installed = clock.install();
 	const warn = spyOn(console, "warn").mockImplementation(() => {});
@@ -1325,9 +1324,10 @@ test("a lite subscribe whose SUBSCRIBE write stalls past the deadline closes its
 		await answerTrackInfo(streams[0]);
 		await (await opened(1)).writing;
 
-		await clock.advance(Nano.fromMilli(Milli(SUBSCRIBE_SETUP_TIMEOUT_MS)));
-		await track.closed;
-		await streams[0].aborted;
+		await clock.advance(Nano.fromMilli(Milli(3_600_000)));
+		expect(track.closed.peek()).toBeUndefined();
+		track.close();
+		await streams[0].finished;
 	} finally {
 		subscriber.close();
 		warn.mockRestore();
@@ -2881,36 +2881,40 @@ test("announce init is the initial set", async () => {
 	subscriber.close();
 });
 
-// The FETCH shares the TRACK's deadline, which only runs while neither stream waits to open:
-// waiting for credit is waiting its turn, so only an unanswered request fails.
-test.each(["answer", "credit"] as const)("FETCH shares the TRACK deadline while waiting for %s", async (stage) => {
+// A FETCH waits for its answer, or a slot a transport queued it for, until its caller leaves.
+test.each(["answer", "credit"] as const)("FETCH waiting for %s ends with its caller", async (stage) => {
 	const clock = new Manual();
 	const installed = clock.install();
 	const { quic, streams, opened } = fakeSession(stage === "credit" ? [1] : []);
 	const subscriber = new Subscriber(quic, Version.DRAFT_07, HopSchema.parse(1n));
+	const cancel = new AbortController();
 	let failure: unknown;
-	const fetch = subscriber.fetchGroup(Path.from("room"), "video", 0n).catch((err: unknown) => {
-		failure = err;
-	});
+	const fetch = subscriber
+		.fetchGroup(Path.from("room"), "video", 0n, { signal: cancel.signal })
+		.catch((err: unknown) => {
+			failure = err;
+		});
 	try {
 		await opened(0);
 		await streams[0].reading;
-		await clock.advance(Nano.fromMilli(Milli(5_000)));
 		await answerTrackInfo(streams[0], Version.DRAFT_07);
 		await opened(1);
-		if (stage === "credit") {
-			await clock.advance(Nano.fromMilli(Milli(30_000)));
-			expect(failure).toBeUndefined();
-			streams[1].release();
-		}
-		await streams[1].reading;
-		// Opened alongside the TRACK, the FETCH shares its budget; one that waited for credit
-		// gets a whole budget from its open.
-		await clock.advance(Nano.fromMilli(Milli(stage === "credit" ? 9_999 : 4_999)));
+		if (stage === "answer") await streams[1].reading;
+		await clock.advance(Nano.fromMilli(Milli(3_600_000)));
 		expect(failure).toBeUndefined();
-		await clock.advance(Nano.fromMilli(Milli(1)));
+		const reason = new Error("left");
+		cancel.abort(reason);
 		await fetch;
-		expect((failure as StreamError).code).toBe(StreamCode.ControlTimeout);
+		expect(failure).toBe(reason);
+		// Credit granted once the caller has left can't send the FETCH.
+		await clock.advance(Nano.zero);
+		if (stage === "credit") streams[1].release();
+		if (stage === "credit") {
+			await drainReactions();
+			expect(streams[1].written).toEqual([]);
+		} else {
+			await streams[1].aborted;
+		}
 	} finally {
 		subscriber.close();
 		installed.close();
diff --git a/js/net/src/lite/subscriber.ts b/js/net/src/lite/subscriber.ts
index b0a3061306e..5f0a319b5d1 100644
--- a/js/net/src/lite/subscriber.ts
+++ b/js/net/src/lite/subscriber.ts
@@ -33,7 +33,7 @@ import * as Time from "../time.ts";
 import type * as track from "../track.ts";
 import { untilAborted } from "../util/abort.ts";
 import { closeUnwanted } from "../util/announce.ts";
-import { Deadline, REQUEST_TIMEOUT_MS } from "../util/deadline.ts";
+import { Deadline } from "../util/deadline.ts";
 import { abandoned, isAbandoned, unwanted } from "../util/demand.ts";
 import { LIMITS, type Limits, SlotMap, Slots } from "../util/limits.ts";
 import { min, UNBOUNDED } from "../util/sequence.ts";
@@ -97,15 +97,12 @@ import {
 const listingBudget = new Budget();
 const datagramBudget = new Budget();
 
-// Request streams refuse exhausted peer credit, with one deadline covering create and answer.
-export const SUBSCRIBE_SETUP_TIMEOUT_MS = REQUEST_TIMEOUT_MS;
-
 // Wire ceiling (2^62-1). A draining session stamps it on every live route so any other
 // candidate outranks it, while the route stays selectable as the last path. Matches Rust
 // Cost::DRAIN: cost is the whole mechanism, not a separate state.
 const DRAIN_COST: Cost = 2n ** 62n - 1n;
 
-// What a subscription has set up so far, so a revocation (or a timeout) can reach it at
+// What a subscription has set up so far, so a revocation (or abandonment) can reach it at
 // any stage.
 interface SubscribeSetup {
 	consumer?: broadcast.Consumer;
@@ -113,7 +110,7 @@ interface SubscribeSetup {
 	stream?: Stream;
 	track?: Stream;
 	producer?: track.Producer;
-	// Ends a setup still running once the deadline passed or the grant was revoked.
+	// Ends a setup still running once it failed, nobody wants it, or the grant was revoked.
 	cancel: AbortController;
 	// Set once our grant stops covering the broadcast.
 	revoked?: Error;
@@ -1184,10 +1181,10 @@ export class Subscriber {
 
 		console.debug(`subscribe start: id=${id} broadcast=${broadcast} track=${request.name}`);
 
-		// Open the stream under a timeout. The stream handles flow back via `state`
-		// so the timeout path can close them if they finish opening after the deadline,
-		// and `cancel` ends a setup still running once the deadline passed, resetting
-		// its TRACK stream so a peer that never answers can't hold one per attempt.
+		// The publisher's application may hold its answer, so the setup waits for it until the
+		// last subscriber leaves, the broadcast goes, or the session ends. The stream handles
+		// flow back via `state` so a failed setup can close them even if they open later, and
+		// `cancel` ends a setup still running, resetting its TRACK stream.
 		const retire = this.#retirer(state, valid);
 		valid?.addEventListener("abort", retire);
 		if (valid?.aborted) retire();
@@ -1206,6 +1203,7 @@ export class Subscriber {
 				left.abort(
 					new StreamError(StreamCode.Cancel, { message: "subscribe abandoned before it was accepted" }),
 				);
+				state.cancel.abort(left.signal.reason);
 			} else {
 				unwatch = Signal.race(demand.wanted, hooks.demandReleased(demand)).changed(watch);
 			}
@@ -1218,9 +1216,8 @@ export class Subscriber {
 			console.debug(`subscribe ok: id=${id} broadcast=${broadcast} track=${request.name}`);
 		} catch (err) {
 			closeViolation(this.#quic, err);
-			// The setup outlived its deadline waiting for the first response: a control
-			// timeout, not content that arrived late. A revocation or the readers leaving says
-			// so instead.
+			// Local abandonment commits without yielding after the demand check. A revocation
+			// says so instead.
 			const e = state.revoked ?? (left.signal.aborted ? left.signal.reason : await sessionCause(this.#quic, err));
 			state.cancel.abort(e);
 			valid?.removeEventListener("abort", retire);
@@ -1228,9 +1225,9 @@ export class Subscriber {
 			this.#subscribes.delete(id);
 			console.warn(`subscribe error: id=${id} broadcast=${broadcast} track=${request.name} error=${reason(e)}`);
 			// Close the streams open now, since a write blocked on flow control may never let
-			// setup settle, and any that open after the timeout once it does. Cover both
-			// branches: setup may resolve late, or it may reject (e.g. encode/decode failure)
-			// after a stream is open.
+			// setup settle, and any that open later once it does. Cover both branches: setup
+			// may resolve late, or it may reject (e.g. encode/decode failure) after a stream
+			// is open.
 			const leave = () => {
 				state.stream?.abort(e);
 				state.track?.close();
@@ -1389,7 +1386,7 @@ export class Subscriber {
 	// Open the subscribe stream and accept the request (so the application's track.Subscriber
 	// resolves and incoming groups have a producer to write into) with the track's immutable
 	// properties. `state.stream` is populated as soon as it opens, and `state.track` once
-	// answered, so the caller can clean them up on timeout even before this promise settles.
+	// answered, so the caller can clean them up once it gives up, even before this promise settles.
 	//
 	// On lite-05+ the properties come from a TRACK stream, held open until the SUBSCRIBE is
 	// answered, and the SUBSCRIBE goes out alongside it rather than a round trip after: it is
@@ -1452,7 +1449,7 @@ export class Subscriber {
 			// Either failing fails the subscription: a reset TRACK rejects the request, so the
 			// origin can try another route, and the caller resets the SUBSCRIBE.
 			const [answered, stream] = await Promise.all([info, sending]);
-			// The deadline passed as TRACK_INFO landed: the request is already rejected, so don't
+			// The setup ended as TRACK_INFO landed: the request is already rejected, so don't
 			// accept it again.
 			state.cancel.signal.throwIfAborted();
 			const model = this.#toModelInfo(answered.info);
@@ -1757,9 +1754,9 @@ export class Subscriber {
 			void group.closed.then(() => disposeGrant?.());
 			if (this.#denied(broadcast)) throw refused;
 
-			// Lite has no FETCH_OK, so a publisher that never answers would hold the setup forever.
-			// Subscriber.close() closing the group releases every caller at any stage, and resets
-			// the streams the setup opened.
+			// Lite has no FETCH_OK, and the publisher's application may hold its answer. Every
+			// caller leaving, or Subscriber.close() closing the group, releases the setup at any
+			// stage and resets the streams it opened.
 			const deadline = new Deadline();
 			const setup = deadline.wait(
 				this.#fetchSetup(broadcast, consumed, track, sequence, priority, group, deadline, maxDelay),
diff --git a/js/net/src/origin.ts b/js/net/src/origin.ts
index 963a6e40ff4..7fc4a48be2b 100644
--- a/js/net/src/origin.ts
+++ b/js/net/src/origin.ts
@@ -620,6 +620,9 @@ class OriginState {
 	// retain their old broadcast without participating in routing or same-instance failover.
 	retained = new WeakSet<RequestSlot>();
 
+	// The sessions withholding hidden broadcasts from their peer; see `hooks.withholdHidden`.
+	withheld = new Signal(0);
+
 	// How many sessions are attached, and how many of those support broadcast discovery.
 	// What backs the public `discovery` getter.
 	sessions = new Signal({ total: 0, discovery: 0 });
@@ -1332,6 +1335,7 @@ export class Producer implements Table {
 	#reader = makeConsumer(this.#state, this.#scope);
 
 	static {
+		hooks.hiddenWithheld = (origin) => origin.#state.withheld;
 		exactRoute = (producer, path, options, request) => producer.#exact(path, options, request);
 	}
 
@@ -2022,6 +2026,16 @@ export class Consumer implements Reader {
 
 	static {
 		makeConsumer = (state, scope) => new Consumer(state, scope);
+		hooks.withholdHidden = (origin) => {
+			const withheld = origin.#state.withheld;
+			withheld.update((count) => count + 1);
+			let held = true;
+			return () => {
+				if (!held) return;
+				held = false;
+				withheld.update((count) => count - 1);
+			};
+		};
 	}
 
 	/** Settles once the origin closes; see {@link Producer.closed}. */
diff --git a/js/net/src/request-deadline.test.ts b/js/net/src/request-deadline.test.ts
index 6052ddb6cd4..a377e4d3948 100644
--- a/js/net/src/request-deadline.test.ts
+++ b/js/net/src/request-deadline.test.ts
@@ -1,6 +1,6 @@
 import { expect, test } from "bun:test";
 import { Manual, Milli, Nano } from "@moq/clock";
-import { SessionCode, SessionError, StreamCode, StreamError } from "./error.ts";
+import { SessionCode, SessionError } from "./error.ts";
 import { HopSchema } from "./hop.ts";
 import { NativeSession } from "./ietf/session.ts";
 import { Subscriber as IetfSubscriber } from "./ietf/subscriber.ts";
@@ -14,6 +14,7 @@ function limited(mode: "queue" | "open") {
 	const slot = Promise.withResolvers<void>();
 	const created = Promise.withResolvers<void>();
 	const aborted = Promise.withResolvers<unknown>();
+	const writing = Promise.withResolvers<void>();
 	const written: Uint8Array[] = [];
 	const options: unknown[] = [];
 	const stream = () => ({
@@ -22,6 +23,7 @@ function limited(mode: "queue" | "open") {
 			abort: aborted.resolve,
 			write: (bytes) => {
 				written.push(new Uint8Array(bytes));
+				writing.resolve();
 			},
 		}),
 	});
@@ -37,17 +39,20 @@ function limited(mode: "queue" | "open") {
 		quic,
 		created: created.promise,
 		aborted: aborted.promise,
+		writing: writing.promise,
 		written,
 		options,
 		release: () => slot.resolve(),
 	};
 }
 
-// Waiting for stream credit is waiting its turn, so it never fails a request: the deadline
-// runs only once the request's streams are open, for an answer that never comes.
+const HOUR = Nano.fromMilli(Milli(3_600_000));
+
+// A publisher may hold its answer, so a request waits until its caller leaves, as in Rust.
+// Cancellation resets opened streams and gives up queued opens without spending their credit.
 for (const protocol of ["lite", "ietf"] as const) {
 	for (const mode of ["queue", "open"] as const) {
-		test(`${protocol}: ${mode} has one fatal request deadline from its open`, async () => {
+		test(`${protocol}: ${mode} subscribe waits until its subscriber leaves`, async () => {
 			const clock = new Manual();
 			const installed = clock.install();
 			const transport = limited(mode);
@@ -60,26 +65,19 @@ for (const protocol of ["lite", "ietf"] as const) {
 			try {
 				await transport.created;
 				await clock.advance(Nano.zero);
+				await clock.advance(HOUR);
+				expect(track.closed.peek()).toBeUndefined();
+				track.close();
 				if (mode === "queue") {
-					await clock.advance(Nano.fromMilli(Milli(30_000)));
-					expect(track.closed.peek()).toBeUndefined();
-					expect(transport.written).toEqual([]);
 					transport.release();
 					await clock.advance(Nano.zero);
-					expect(transport.written).not.toEqual([]);
+					expect(transport.written).toEqual([]);
+				} else {
+					await transport.aborted;
 				}
-				await clock.advance(Nano.fromMilli(Milli(9_999)));
-				expect(track.closed.peek()).toBeUndefined();
-				await clock.advance(Nano.fromMilli(Milli(1)));
-				const failure = await track.closed;
-				expect(failure).toBeInstanceOf(StreamError);
-				expect((failure as StreamError).code).toBe(StreamCode.ControlTimeout);
-				await transport.aborted;
-				// A lite subscription opens its SUBSCRIBE alongside its TRACK, under the one deadline.
+				// A lite subscription opens its SUBSCRIBE alongside its TRACK.
 				const opened = protocol === "lite" ? 2 : 1;
 				expect(transport.options).toEqual(Array.from({ length: opened }, () => ({ waitUntilAvailable: true })));
-				await clock.advance(Nano.fromMilli(Milli(30_000)));
-				expect(transport.options).toHaveLength(opened);
 			} finally {
 				track.close();
 				broadcast.close();
@@ -90,38 +88,79 @@ for (const protocol of ["lite", "ietf"] as const) {
 	}
 }
 
+for (const protocol of ["lite", "ietf"] as const) {
+	test(`${protocol}: an unanswered track info waits until its caller leaves`, async () => {
+		const clock = new Manual();
+		const installed = clock.install();
+		const transport = limited("open");
+		const subscriber =
+			protocol === "lite"
+				? new LiteSubscriber(transport.quic, Lite.DRAFT_07, HopSchema.parse(1n))
+				: new IetfSubscriber({ session: new NativeSession(transport.quic, Ietf.DRAFT_18, true) });
+		const broadcast = subscriber.consume(Path.from("room"));
+		const cancel = new AbortController();
+		let failure: unknown;
+		const info = broadcast
+			.track("video")
+			.info({ signal: cancel.signal })
+			.catch((err: unknown) => {
+				failure = err;
+			});
+		try {
+			await transport.created;
+			await clock.advance(HOUR);
+			expect(failure).toBeUndefined();
+			const left = new Error("left");
+			cancel.abort(left);
+			await info;
+			expect(failure).toBe(left);
+			await transport.aborted;
+		} finally {
+			broadcast.close();
+			if (subscriber instanceof LiteSubscriber) subscriber.close();
+			installed.close();
+		}
+	});
+}
+
 for (const operation of ["info", "fetch"] as const) {
 	for (const mode of ["queue", "open"] as const) {
-		test(`lite standalone ${operation}: ${mode} has a fatal deadline from its open`, async () => {
+		test(`lite standalone ${operation}: ${mode} waits until its caller leaves`, async () => {
 			const clock = new Manual();
 			const installed = clock.install();
 			const transport = limited(mode);
 			const subscriber = new LiteSubscriber(transport.quic, Lite.DRAFT_07, HopSchema.parse(1n));
+			const cancel = new AbortController();
 			let failure: unknown;
 			const request = (
 				operation === "info"
-					? subscriber.resolveTrackInfo(Path.from("room"), "video")
-					: subscriber.fetchGroup(Path.from("room"), "video", 0n)
+					? subscriber.resolveTrackInfo(Path.from("room"), "video", undefined, cancel.signal)
+					: subscriber.fetchGroup(Path.from("room"), "video", 0n, { signal: cancel.signal })
 			).catch((err: unknown) => {
 				failure = err;
 			});
 			try {
 				await transport.created;
 				await clock.advance(Nano.zero);
+				await clock.advance(HOUR);
+				expect(failure).toBeUndefined();
+				const left = new Error("left");
+				cancel.abort(left);
+				await request;
+				expect(failure).toBe(left);
+				// Credit granted once the caller has left can't send the request.
+				await clock.advance(Nano.zero);
 				if (mode === "queue") {
-					await clock.advance(Nano.fromMilli(Milli(30_000)));
-					expect(failure).toBeUndefined();
 					transport.release();
 					await clock.advance(Nano.zero);
+					expect(transport.written).toEqual([]);
+				} else {
+					await transport.aborted;
 				}
-				await clock.advance(Nano.fromMilli(Milli(10_000)));
-				await request;
-				expect((failure as StreamError).code).toBe(StreamCode.ControlTimeout);
-				// A fetch opens its FETCH stream alongside the TRACK stream, under the same deadline.
-				expect(transport.options).toHaveLength(operation === "info" ? 1 : 2);
-				// The FETCH stream opens at its group's send order.
-				expect(transport.options[0]).toEqual({ waitUntilAvailable: true });
-				for (const open of transport.options) expect(open).toMatchObject({ waitUntilAvailable: true });
+				// A fetch opens its FETCH stream alongside the TRACK stream.
+				const opened = transport.options as { sendOrder?: number; waitUntilAvailable: boolean }[];
+				expect(opened).toHaveLength(operation === "info" ? 1 : 2);
+				for (const open of opened) expect(open.waitUntilAvailable).toBe(true);
 			} finally {
 				subscriber.close();
 				installed.close();
@@ -162,6 +201,35 @@ for (const protocol of ["lite", "ietf"] as const) {
 	}
 }
 
+for (const protocol of ["lite", "ietf"] as const) {
+	test(`${protocol}: credit granted as the subscriber leaves cannot send a late request`, async () => {
+		const clock = new Manual();
+		const installed = clock.install();
+		const transport = limited("queue");
+		const subscriber =
+			protocol === "lite"
+				? new LiteSubscriber(transport.quic, Lite.DRAFT_07, HopSchema.parse(1n))
+				: new IetfSubscriber({ session: new NativeSession(transport.quic, Ietf.DRAFT_18, true) });
+		const broadcast = subscriber.consume(Path.from("room"));
+		const track = broadcast.track("video").subscribe();
+		try {
+			await transport.created;
+			track.close();
+			transport.release();
+			await clock.advance(Nano.zero);
+			expect(transport.written).toEqual([]);
+			const next = broadcast.track("next").subscribe();
+			await transport.writing;
+			next.close();
+		} finally {
+			track.close();
+			broadcast.close();
+			if (subscriber instanceof LiteSubscriber) subscriber.close();
+			installed.close();
+		}
+	});
+}
+
 for (const protocol of ["lite", "ietf"] as const) {
 	test(`${protocol}: a create the closed session fails reports the session`, async () => {
 		const quic = {
diff --git a/js/net/src/resume.test.ts b/js/net/src/resume.test.ts
index edcb7d0fd9b..1d2eeaf38a4 100644
--- a/js/net/src/resume.test.ts
+++ b/js/net/src/resume.test.ts
@@ -3413,3 +3413,33 @@ test("a route whose IETF session closed before subscribing moves the track to th
 	front.consumer.close();
 	b.close();
 });
+
+test("routed metadata receives a refusal without polling a group cursor", async () => {
+	const clock = new Manual();
+	const installed = clock.install();
+	const origin = new Producer();
+	try {
+		origin.route(Path.from("missing-track"));
+		for (const request of [origin.request(Path.from("missing-track")), origin.follow(Path.from("missing-track"))]) {
+			const broadcast = request.active.peek();
+			if (!broadcast) throw new Error("local broadcast missing");
+			const subscriber = broadcast.track("absent").subscribe();
+			let outcome: unknown;
+			void subscriber.info().then(
+				() => {
+					outcome = "accepted";
+				},
+				(error) => {
+					outcome = error;
+				},
+			);
+			await clock.advance(Nano.zero);
+			expect(outcome).toBeInstanceOf(NotFound);
+			subscriber.close();
+			request.close();
+		}
+	} finally {
+		origin.close();
+		installed.close();
+	}
+});
diff --git a/js/net/src/resume.ts b/js/net/src/resume.ts
index 94c6491819e..a7d3cf908a8 100644
--- a/js/net/src/resume.ts
+++ b/js/net/src/resume.ts
@@ -549,7 +549,11 @@ class Reader implements ResumeSource {
 				record(info, source);
 				shell.commit(info);
 			},
-			() => {},
+			() => {
+				// A terminal refusal before metadata is the subscription's answer too. An info
+				// reader never polls the group cursor that would otherwise propagate it.
+				if (this.#shell.info() === undefined) this.#end((copy) => copy.sub.closed.peek());
+			},
 		);
 		copy.sub.finished().then(
 			// A copy already let go says nothing more about the track.
@@ -1346,6 +1350,25 @@ class Reader implements ResumeSource {
 		}
 	}
 
+	watchError(fn: (error: Error) => void): Dispose {
+		let stop: Dispose = () => {};
+		const check = () => {
+			stop();
+			stop = () => {};
+			this.sync();
+			const copy = this.#serving();
+			if (copy) stop = hooks.watchSubscriberError(copy.sub, fn);
+			const changed = this.route.changed.changed(check);
+			const previous = stop;
+			stop = () => {
+				previous();
+				changed();
+			};
+		};
+		check();
+		return () => stop();
+	}
+
 	bufferedLargest(): track.Position | undefined {
 		this.sync();
 		const serving = this.#serving();
diff --git a/js/net/src/socket.test.ts b/js/net/src/socket.test.ts
new file mode 100644
index 00000000000..968b839aff5
--- /dev/null
+++ b/js/net/src/socket.test.ts
@@ -0,0 +1,764 @@
+import { afterEach, expect, test } from "bun:test";
+import { Manual, Milli, Nano, Second } from "@moq/clock";
+import { type Consumer as BroadcastConsumer, Producer as BroadcastProducer } from "./broadcast.ts";
+import { accept as acceptConnection } from "./connection/accept.ts";
+import { connect } from "./connection/connect.ts";
+import { NotFound, ProtocolViolation, StreamCode, StreamError } from "./error.ts";
+import * as Ietf from "./ietf/index.ts";
+import { Origin, Path, socket } from "./index.ts";
+import { hooks } from "./internal.ts";
+import * as Lite from "./lite/index.ts";
+import { createMockTransportPair } from "./mock.ts";
+import type * as Track from "./track.ts";
+import { wireOf } from "./wire.ts";
+
+const origins = new Set<Origin.Producer>();
+const clocks: { close(): void }[] = [];
+afterEach(() => {
+	for (const origin of origins) origin.close();
+	origins.clear();
+	for (const clock of clocks.reverse()) clock.close();
+	clocks.length = 0;
+});
+function time() {
+	const clock = new Manual();
+	clocks.push(clock.install());
+	return clock;
+}
+const bytes = (value: number) => ({ payload: new Uint8Array([value]) });
+function setup() {
+	const origin = new Origin.Producer();
+	origins.add(origin);
+	const a = new socket.Endpoint(origin, Path.from("room"), "alice");
+	const b = new socket.Endpoint(origin, Path.from("room"), "bob");
+	return { origin, a, b };
+}
+async function tcp() {
+	const state = setup();
+	const incoming = state.b.acceptTcp();
+	const dialing = state.a.dialTcp("bob");
+	const remote = await (await incoming).accept();
+	return { ...state, local: await dialing, remote };
+}
+async function track() {
+	const state = setup();
+	const incoming = state.b.acceptTrack();
+	const dialing = state.a.dialTrack("bob");
+	const remote = await (await incoming).accept();
+	return { ...state, local: await dialing, remote };
+}
+async function broadcast(origin: Origin.Producer, id: string): Promise<BroadcastConsumer> {
+	const request = origin.request(Path.from("room/.socket", id));
+	const active = request.active.peek();
+	if (!active) throw new Error("endpoint not routed locally");
+	return active;
+}
+async function raw(origin: Origin.Producer, id: string, name: string): Promise<Track.Subscriber> {
+	return (await broadcast(origin, id)).track(name).subscribe({ order: "ascending", delay: { max: null } });
+}
+
+test("socket namespace exposes endpoint and both stream roles", () => {
+	expect(socket.Endpoint).toBeFunction();
+	expect(socket.TcpStream).toBeFunction();
+	expect(socket.TrackStream).toBeFunction();
+});
+
+test("TCP carries ordered frames in both directions, with independent FIN", async () => {
+	const { a, b, local, remote } = await tcp();
+	expect(local.peer).toBe("bob");
+	expect(remote.peer).toBe("alice");
+	expect(local.session).toBe(remote.session);
+	expect(local.session).toMatch(/^[0-9a-f]{32}$/);
+	for (let i = 0; i < 3; i++) local.producer.writeFrame(bytes(i));
+	local.producer.finish();
+	for (let i = 0; i < 3; i++) expect((await remote.consumer.readFrame())?.payload).toEqual(bytes(i).payload);
+	expect(await remote.consumer.readFrame()).toBeUndefined();
+	remote.producer.writeFrame(bytes(9));
+	remote.producer.finish();
+	expect((await local.consumer.readFrame())?.payload).toEqual(bytes(9).payload);
+	expect(await local.consumer.readFrame()).toBeUndefined();
+	a.close();
+	b.close();
+});
+
+test("a peer route replaced between metadata and opening cannot inherit a socket session", async () => {
+	const clock = time();
+	const { origin, a } = setup();
+	const peer = new BroadcastProducer();
+	const keep = peer.consume();
+	const routes: { close(): void }[] = [];
+	const tasks: Promise<void>[] = [];
+	const advertise = (front: BroadcastConsumer) => {
+		const route = wireOf(origin).receive(Path.from("room/.socket/remote"));
+		routes.push(route);
+		tasks.push(
+			(async () => {
+				try {
+					for await (const request of route.requested()) request.serve(front.clone());
+				} catch {
+					/* Closing the route ends its request loop. */
+				}
+			})(),
+		);
+		return route;
+	};
+	const first = advertise(keep);
+	const requested = wireOf(peer).requested();
+	let outcome: unknown;
+	const dialing = a.dialTrack("remote").then(
+		(value) => {
+			outcome = value;
+		},
+		(error) => {
+			outcome = error;
+		},
+	);
+	let returning: Track.Subscriber | undefined;
+	const replacement = new BroadcastProducer();
+	const replacementKeep = replacement.consume();
+	try {
+		const request = await requested;
+		if (!request) throw new Error("missing dial");
+		returning = await raw(origin, "alice", request.name);
+		await returning.info();
+		request.accept({ maxAge: null });
+		// Both route changes happen before the info promise's continuation opens the session.
+		first.close();
+		advertise(replacementKeep);
+		await clock.advance(Nano.zero);
+		expect(outcome).toBeInstanceOf(Error);
+	} finally {
+		a.close();
+		for (const route of routes) route.close();
+		returning?.close();
+		keep.close();
+		replacementKeep.close();
+		peer.close();
+		replacement.close();
+		await Promise.all(tasks);
+		await dialing;
+	}
+});
+
+test("track halves start reliable and ascending, preserve old messages and accept independent info", async () => {
+	const { local, remote } = await track();
+	expect((await local.producer.info()).maxAge).toBeUndefined();
+	expect(remote.consumer.subscription.peek()?.order).toBe("ascending");
+	expect(remote.consumer.subscription.peek()?.delay?.max).toBe(Milli(Number.MAX_SAFE_INTEGER));
+	for (let i = 0; i < 3; i++) local.producer.writeFrame(bytes(i));
+	local.producer.finish();
+	const reader = remote.consumer.ordered();
+	for (let i = 0; i < 3; i++) {
+		const frame = await reader.readFrame();
+		expect(frame?.group).toBe(BigInt(i));
+		expect(frame?.payload).toEqual(bytes(i).payload);
+	}
+	expect(await reader.readFrame()).toBeUndefined();
+	remote.producer.writeFrame(bytes(7));
+	remote.producer.finish();
+	expect((await local.consumer.ordered().readFrame())?.payload).toEqual(bytes(7).payload);
+});
+
+test("a track session skips dropped groups and keeps the next message", async () => {
+	const clock = time();
+	const { local, remote } = await track();
+	const reader = remote.consumer.ordered();
+	const reading = reader.readFrame();
+	hooks.dropTrackGroups(local.producer, 0n, 1n, new NotFound("message unavailable"));
+	const group = local.producer.createGroup(1n);
+	group.writeFrame(bytes(7));
+	group.finish();
+	local.producer.finish();
+	await clock.advance(Nano.zero);
+	const frame = await reading;
+	expect(frame?.group).toBe(1n);
+	expect(frame?.payload).toEqual(bytes(7).payload);
+	expect(await reader.readFrame()).toBeUndefined();
+});
+
+test("each protocol has its own accept queue and sessions never reuse an identity", async () => {
+	const { a, b } = setup();
+	const nextTrack = b.acceptTrack();
+	const nextTcp = b.acceptTcp();
+	const dialingTcp = a.dialTcp("bob");
+	const dialingTrack = a.dialTrack("bob");
+	const [incomingTrack, incomingTcp] = await Promise.all([nextTrack, nextTcp]);
+	expect(incomingTcp.session).not.toBe(incomingTrack.session);
+	const [remoteTrack, remoteTcp, localTrack, localTcp] = await Promise.all([
+		incomingTrack.accept(),
+		incomingTcp.accept(),
+		dialingTrack,
+		dialingTcp,
+	]);
+	localTrack.producer.writeFrame(bytes(1));
+	localTcp.producer.writeFrame(bytes(2));
+	expect((await remoteTrack.consumer.ordered().readFrame())?.payload).toEqual(bytes(1).payload);
+	expect((await remoteTcp.consumer.readFrame())?.payload).toEqual(bytes(2).payload);
+});
+
+test("finished track sessions release their unlisted producers after both halves end", async () => {
+	const clock = time();
+	const { local, remote } = await track();
+	const localReader = local.consumer.ordered();
+	const remoteReader = remote.consumer.ordered();
+	local.producer.writeFrame(bytes(1));
+	remote.producer.writeFrame(bytes(2));
+	local.producer.finish();
+	remote.producer.finish();
+	expect((await localReader.readFrame())?.payload).toEqual(bytes(2).payload);
+	expect((await remoteReader.readFrame())?.payload).toEqual(bytes(1).payload);
+	expect(await localReader.readFrame()).toBeUndefined();
+	expect(await remoteReader.readFrame()).toBeUndefined();
+	await clock.advance(Nano.zero);
+	expect(hooks.trackReleased(local.producer).peek()).toBeNull();
+	expect(hooks.trackReleased(remote.producer).peek()).toBeNull();
+});
+
+for (const protocol of ["tcp", "track"] as const) {
+	test(`late ${protocol} reads retain return-routability checks after the original dial closes`, async () => {
+		const clock = time();
+		const { origin, a, b, local, remote } = await (protocol === "tcp" ? tcp() : track());
+		const next = protocol === "tcp" ? b.acceptTcp() : b.acceptTrack();
+		void next.catch(() => {});
+		const reset = new StreamError(StreamCode(70));
+		const oldReader = local instanceof socket.TcpStream ? local.consumer : local.consumer.ordered();
+		remote.producer.abort(reset);
+		await expect(oldReader.readFrame()).rejects.toBeInstanceOf(Error);
+		const source = await broadcast(origin, "bob");
+		let outcome: unknown;
+		const fetched = source
+			.track(`${protocol}/alice/bob/${local.session}`)
+			.fetchGroup(0n)
+			.then(
+				(value) => {
+					outcome = value;
+				},
+				(error) => {
+					outcome = error;
+				},
+			);
+		try {
+			await clock.advance(Nano.zero);
+			const unverified = await next;
+			expect(unverified.session).toBe(local.session);
+			// A late query has the old name, but the original dial no longer answers.
+			// Verification must fail before a new producer can publish under that identity.
+			await expect(unverified.accept()).rejects.toBeInstanceOf(NotFound);
+			await fetched;
+			expect(outcome).toBeInstanceOf(Error);
+			const freshIncoming = protocol === "tcp" ? b.acceptTcp() : b.acceptTrack();
+			const dialing = protocol === "tcp" ? a.dialTcp("bob") : a.dialTrack("bob");
+			const incoming = await freshIncoming;
+			expect(incoming.session).not.toBe(local.session);
+			const remoteFresh = await incoming.accept();
+			const localFresh = await dialing;
+			localFresh.producer.writeFrame(bytes(9));
+			const frame =
+				remoteFresh instanceof socket.TcpStream
+					? await remoteFresh.consumer.readFrame()
+					: await remoteFresh.consumer.ordered().readFrame();
+			expect(frame?.payload).toEqual(bytes(9).payload);
+			await expect(oldReader.readFrame()).rejects.toBeInstanceOf(Error);
+		} finally {
+			a.close();
+			b.close();
+			await fetched;
+		}
+	});
+}
+
+test("a dial-only endpoint refuses incoming requests and answers only its reserved session", async () => {
+	const { origin, a } = setup();
+	await expect(a.dialTcp("alice")).rejects.toBeInstanceOf(Error);
+	const unsupported = await raw(origin, "alice", "tcp/bob/alice/not-a-dial");
+	await expect(unsupported.info()).rejects.toBeInstanceOf(NotFound);
+	unsupported.close();
+});
+
+test("unknown and unaccepted protocols reset without entering the other queue", async () => {
+	const { origin, b } = setup();
+	const hold = new AbortController();
+	const incoming = b.acceptTcp({ signal: hold.signal });
+	const rejected = incoming.catch((error: unknown) => error);
+	for (const protocol of ["track", "quic"]) {
+		const subscriber = await raw(origin, "bob", `${protocol}/alice/bob/session-${protocol}`);
+		await expect(subscriber.info()).rejects.toBeInstanceOf(Error);
+		subscriber.close();
+	}
+	hold.abort();
+	expect(await rejected).toBeInstanceOf(Error);
+});
+
+test("reject refuses one dial and leaves another independent session usable", async () => {
+	const { a, b } = setup();
+	const incoming = b.acceptTcp();
+	const refused = a.dialTcp("bob");
+	const refusal = refused.catch((error: unknown) => error);
+	(await incoming).reject();
+	expect(await refusal).toBeInstanceOf(NotFound);
+	const again = b.acceptTcp();
+	const dialing = a.dialTcp("bob");
+	const remote = await (await again).accept();
+	const local = await dialing;
+	local.producer.writeFrame(bytes(42));
+	expect((await remote.consumer.readFrame())?.payload).toEqual(bytes(42).payload);
+});
+
+test("cancelled dials leave queues and cannot be accepted later", async () => {
+	const clock = time();
+	const { a, b } = setup();
+	const next = b.acceptTcp();
+	const cancel = new AbortController();
+	const reason = new Error("gave up");
+	const dialing = a.dialTcp("bob", { signal: cancel.signal });
+	const failure = dialing.catch((error: unknown) => error);
+	const incoming = await next;
+	cancel.abort(reason);
+	expect(await failure).toBe(reason);
+	await expect(incoming.accept()).rejects.toBeInstanceOf(Error);
+	// Queue a dial after the application stopped pulling, then abandon it.
+	const pending = new AbortController();
+	const dropped = a.dialTcp("bob", { signal: pending.signal });
+	const observed = dropped.catch((error: unknown) => error);
+	await clock.advance(Nano.zero);
+	pending.abort();
+	expect(await observed).toBeInstanceOf(Error);
+	const newIncoming = b.acceptTcp();
+	const fresh = a.dialTcp("bob");
+	const accepted = await newIncoming;
+	expect(accepted.session).not.toBe(incoming.session);
+	await Promise.all([accepted.accept(), fresh]);
+});
+
+test("dial and accept cancellation before announcement release their routing holds", async () => {
+	const clock = time();
+	const { origin, a, b } = setup();
+	const cancel = new AbortController();
+	const dialing = a.dialTcp("later", { signal: cancel.signal });
+	const failure = dialing.catch((error: unknown) => error);
+	await clock.advance(Nano.fromSecond(Second(3600)));
+	cancel.abort();
+	expect(await failure).toBeInstanceOf(Error);
+	const next = b.acceptTcp();
+	const subscriber = await raw(origin, "bob", "tcp/absent/bob/never-announced");
+	const accepted = (await next).accept();
+	const acceptanceFailure = accepted.catch((error: unknown) => error);
+	await clock.advance(Nano.fromSecond(Second(3600)));
+	subscriber.close();
+	expect(await acceptanceFailure).toBeInstanceOf(Error);
+});
+
+test("a dial waits for the peer to announce, without an arbitrary timeout", async () => {
+	const clock = time();
+	const { origin, a } = setup();
+	const dialing = a.dialTcp("later");
+	await clock.advance(Nano.fromSecond(Second(3600)));
+	const later = new socket.Endpoint(origin, Path.from("room"), "later");
+	const incoming = await later.acceptTcp();
+	const remote = await incoming.accept();
+	const local = await dialing;
+	local.producer.writeFrame(bytes(1));
+	expect((await remote.consumer.readFrame())?.payload).toEqual(bytes(1).payload);
+});
+
+test("accept waits for a delayed dialer announcement only while its original dial stays open", async () => {
+	const clock = time();
+	const { origin, b } = setup();
+	const next = b.acceptTrack();
+	const subscriber = await raw(origin, "bob", "track/late/bob/delayed-announcement");
+	const incoming = await next;
+	const acceptance = incoming.accept();
+	await clock.advance(Nano.fromSecond(Second(3600)));
+	const route = origin.route(Path.from("room/.socket/late"), { hidden: true });
+	const answer = hooks.reserveUnlistedTrack(route.broadcast, "track/late/bob/delayed-announcement");
+	route.announce();
+	await clock.advance(Nano.zero);
+	expect(answer.demand().wanted.peek()).toBeDefined();
+	const producer = answer.accept({ maxAge: null });
+	const remote = await acceptance;
+	producer.writeFrame(bytes(3));
+	expect((await remote.consumer.ordered().readFrame())?.payload).toEqual(bytes(3).payload);
+	subscriber.close();
+});
+
+test("forged and replayed dials cannot pass return routability", async () => {
+	const { origin, a, b } = setup();
+	for (const name of ["tcp/alice/bob/forged", "tcp/alice/someone-else/replayed"]) {
+		const cancel = new AbortController();
+		const wait = b.acceptTcp({ signal: cancel.signal });
+		void wait.catch(() => {});
+		const subscriber = await raw(origin, "bob", name);
+		const refusal = subscriber.info().catch((error: unknown) => error);
+		if (name.includes("/bob/")) await expect((await wait).accept()).rejects.toBeInstanceOf(NotFound);
+		else cancel.abort();
+		expect(await refusal).toBeInstanceOf(NotFound);
+		subscriber.close();
+	}
+	a.close();
+});
+
+test("session names are absent from listings while reserved and established", async () => {
+	const { origin, a, b } = setup();
+	const next = b.acceptTcp();
+	const dialing = a.dialTcp("bob");
+	const incoming = await next;
+	for (const id of ["alice", "bob"]) {
+		const listing = (await broadcast(origin, id)).tracks();
+		expect(await listing.next()).toEqual({ kind: "synced" });
+		listing.close();
+	}
+	const remote = await incoming.accept();
+	await dialing;
+	for (const id of ["alice", "bob"]) {
+		const listing = (await broadcast(origin, id)).tracks();
+		expect(await listing.next()).toEqual({ kind: "synced" });
+		listing.close();
+	}
+	expect(remote.session).toBe(incoming.session);
+});
+
+test("TCP RST, reader cancellation, and endpoint lifetime reset both halves", async () => {
+	for (const action of ["abort", "reader", "endpoint"] as const) {
+		const { a, local, remote } = await tcp();
+		const reset = new StreamError(StreamCode(70));
+		if (action === "abort") local.producer.abort(reset);
+		if (action === "reader") local.consumer.close();
+		if (action === "endpoint") a.close();
+		await expect(remote.consumer.readFrame()).rejects.toBeInstanceOf(Error);
+		expect(await remote.producer.closed).toBeInstanceOf(Error);
+	}
+});
+
+test("track reset and endpoint close fail peers and leave no open accepts", async () => {
+	const { a, b, local, remote } = await track();
+	local.producer.abort(new StreamError(StreamCode(71)));
+	await expect(remote.consumer.ordered().readFrame()).rejects.toBeInstanceOf(Error);
+	expect(await remote.producer.closed).toBeInstanceOf(Error);
+	const pending = b.acceptTcp();
+	const failure = pending.catch((error: unknown) => error);
+	b.close();
+	a.close();
+	expect(await failure).toBeInstanceOf(Error);
+});
+
+test("a second TCP group resets the session even after the first FIN", async () => {
+	for (const initial of [0n, 2n]) {
+		const { origin, b } = setup();
+		const route = origin.route(Path.from("room/.socket/raw"));
+		const name = `tcp/raw/bob/second-${initial}`;
+		const answer = hooks.reserveUnlistedTrack(route.broadcast, name);
+		const next = b.acceptTcp();
+		const subscriber = await raw(origin, "bob", name);
+		const acceptance = (await next).accept();
+		// Drive the accept's return subscription before publishing the first half.
+		const clock = time();
+		await clock.advance(Nano.zero);
+		const producer = answer.accept();
+		const stream = await acceptance;
+		const group = producer.createGroup(initial);
+		group.writeFrame(bytes(1));
+		group.finish();
+		if (initial === 0n) {
+			expect((await stream.consumer.readFrame())?.payload).toEqual(bytes(1).payload);
+			expect(await stream.consumer.readFrame()).toBeUndefined();
+			producer.createGroup(1n).finish();
+		}
+		expect(await stream.producer.closed).toBeInstanceOf(ProtocolViolation);
+		subscriber.close();
+	}
+});
+
+for (const dropped of [false, true]) {
+	test(`TCP fails when its only group ${dropped ? "is dropped" : "never arrives"}`, async () => {
+		const { origin, b } = setup();
+		const route = origin.route(Path.from("room/.socket/raw"));
+		const name = `tcp/raw/bob/missing-${dropped}`;
+		const answer = hooks.reserveUnlistedTrack(route.broadcast, name);
+		const next = b.acceptTcp();
+		const subscriber = await raw(origin, "bob", name);
+		const acceptance = (await next).accept();
+		const clock = time();
+		await clock.advance(Nano.zero);
+		const producer = answer.accept();
+		const stream = await acceptance;
+		const reading = stream.consumer.readFrame();
+		if (dropped) hooks.dropTrackGroups(producer, 0n, 1n, new NotFound("TCP group unavailable"));
+		producer.finish();
+		await expect(reading).rejects.toBeInstanceOf(NotFound);
+		expect(await stream.producer.closed).toBeInstanceOf(NotFound);
+		subscriber.close();
+	});
+}
+
+test("an empty TCP group still delivers a clean FIN", async () => {
+	const { local, remote } = await tcp();
+	local.producer.finish();
+	remote.producer.finish();
+	expect(await remote.consumer.readFrame()).toBeUndefined();
+	expect(await local.consumer.readFrame()).toBeUndefined();
+});
+
+test("unpaced TCP eviction is an error, never a skipped frame or clean FIN", async () => {
+	const clock = time();
+	const { local, remote } = await tcp();
+	// The local group's bounded tail is 32 MiB. Every payload is a distinct frame identity.
+	const payload = new Uint8Array(1024 * 1024);
+	for (let i = 0; i < 32; i++) {
+		local.producer.writeFrame({ payload });
+		await clock.advance(Nano.zero);
+	}
+	local.producer.finish();
+	await expect(remote.consumer.readFrame()).rejects.toMatchObject({ code: StreamCode.Evicted });
+});
+
+test("endpoint ids refuse separators, and close is idempotent", async () => {
+	const { origin, a } = setup();
+	for (const id of ["", "a/b", "a\\b"]) {
+		expect(() => new socket.Endpoint(origin, Path.from("room"), id)).toThrow();
+		await expect(a.dialTcp(id)).rejects.toBeInstanceOf(Error);
+	}
+	a.close();
+	a.close();
+	await expect(a.acceptTcp()).rejects.toBeInstanceOf(Error);
+	await expect(a.dialTrack("bob")).rejects.toBeInstanceOf(Error);
+});
+
+for (const protocol of ["tcp", "track"] as const) {
+	const alpn = Lite.ALPN_07_WIP;
+	test(`socket ${protocol} preserves an early answer burst over ${alpn}`, async () => {
+		const clock = time();
+		const ao = new Origin.Producer();
+		const bo = new Origin.Producer();
+		origins.add(ao);
+		origins.add(bo);
+		const a = new socket.Endpoint(ao, Path.from("room"), "alice");
+		const route = bo.route(Path.from("room/.socket/bob"), { hidden: true });
+		const requested = wireOf(route.broadcast).requested();
+		route.announce();
+		const pair = createMockTransportPair(alpn);
+		const url = new URL("https://localhost/socket");
+		const [client, server] = await Promise.all([
+			connect({ url, transport: pair.client, publish: ao.consume(), consume: ao }),
+			acceptConnection({ url, transport: pair.server, publish: bo.consume(), consume: bo }),
+		]);
+		let returning: Track.Subscriber | undefined;
+		let drained: Promise<void> | undefined;
+		const following = bo.follow(Path.from("room/.socket/alice"));
+		try {
+			const dialing = protocol === "tcp" ? a.dialTcp("bob") : a.dialTrack("bob");
+			void dialing.catch(() => {});
+			const request = await requested;
+			if (!request) throw new Error("missing dial");
+			let caller = following.active.peek();
+			while (!caller) {
+				await following.active.changed();
+				caller = following.active.peek();
+			}
+			returning = caller.track(request.name).subscribe({
+				order: "ascending",
+				delay: { max: null },
+				ranges: protocol === "track" ? [{ start: { absolute: 0n } }] : undefined,
+			});
+			await returning.info();
+			// The raw peer commits metadata only after writing its entire half, so
+			// SUBSCRIBE_OK carries the burst's last position, without a timing race.
+			hooks.keepRequest(request);
+			const staged = hooks.stageRequest(request, { maxAge: null });
+			if (protocol === "tcp") {
+				const group = staged.producer.createGroup(0n);
+				for (let i = 1; i <= 3; i++) group.writeFrame(bytes(i));
+				group.finish();
+			} else {
+				for (let i = 1; i <= 3; i++) staged.producer.writeFrame(bytes(i));
+			}
+			staged.producer.finish();
+			staged.commit();
+			await clock.advance(Nano.zero);
+			const local = await dialing;
+			const reader = local instanceof socket.TcpStream ? local.consumer : local.consumer.ordered();
+			const received: number[] = [];
+			let completed = false;
+			let failure: unknown;
+			drained = (async () => {
+				for (let frame = await reader.readFrame(); frame; frame = await reader.readFrame())
+					received.push(...frame.payload);
+			})().then(
+				() => {
+					completed = true;
+				},
+				(error) => {
+					failure = error;
+				},
+			);
+			await clock.advance(Nano.zero);
+			expect(failure).toBeUndefined();
+			expect(received).toEqual([1, 2, 3]);
+			expect(completed).toBe(true);
+			local.producer.finish();
+		} finally {
+			returning?.close();
+			following.close();
+			a.close();
+			route.broadcast.close();
+			client.abort();
+			server.abort();
+			await drained;
+		}
+	});
+}
+
+for (const alpn of [Lite.ALPN_07_WIP, Ietf.ALPN.DRAFT_18, Ietf.ALPN.DRAFT_20, Ietf.ALPN.DRAFT_22]) {
+	for (const protocol of ["tcp", "track"] as const) {
+		test(`socket ${protocol} refusal reaches a routed dialer over ${alpn}`, async () => {
+			const clock = time();
+			const ao = new Origin.Producer();
+			const bo = new Origin.Producer();
+			origins.add(ao);
+			origins.add(bo);
+			const a = new socket.Endpoint(ao, Path.from("room"), "alice");
+			const b = new socket.Endpoint(bo, Path.from("room"), "bob");
+			const pair = createMockTransportPair(alpn);
+			const url = new URL("https://localhost/socket");
+			const [client, server] = await Promise.all([
+				connect({ url, transport: pair.client, publish: ao.consume(), consume: ao }),
+				acceptConnection({ url, transport: pair.server, publish: bo.consume(), consume: bo }),
+			]);
+			let outcome: unknown;
+			const next = protocol === "tcp" ? b.acceptTcp() : b.acceptTrack();
+			const dialing = protocol === "tcp" ? a.dialTcp("bob") : a.dialTrack("bob");
+			const settled = dialing.then(
+				(stream) => {
+					outcome = stream;
+				},
+				(error) => {
+					outcome = error;
+				},
+			);
+			try {
+				(await next).reject();
+				await clock.advance(Nano.zero);
+				expect(outcome).toBeInstanceOf(Error);
+			} finally {
+				a.close();
+				b.close();
+				client.abort();
+				server.abort();
+				await settled;
+			}
+		});
+	}
+}
+
+for (const alpn of [Lite.ALPN_07_WIP, Ietf.ALPN.DRAFT_18, Ietf.ALPN.DRAFT_20, Ietf.ALPN.DRAFT_22]) {
+	for (const protocol of ["tcp", "track"] as const) {
+		test(`pending socket ${protocol} acceptance over ${alpn} has no arbitrary deadline`, async () => {
+			const clock = time();
+			const ao = new Origin.Producer();
+			const bo = new Origin.Producer();
+			origins.add(ao);
+			origins.add(bo);
+			const a = new socket.Endpoint(ao, Path.from("room"), "alice");
+			const b = new socket.Endpoint(bo, Path.from("room"), "bob");
+			const pair = createMockTransportPair(alpn);
+			const url = new URL("https://localhost/socket");
+			const [client, server] = await Promise.all([
+				connect({ url, transport: pair.client, publish: ao.consume(), consume: ao }),
+				acceptConnection({ url, transport: pair.server, publish: bo.consume(), consume: bo }),
+			]);
+			const next = protocol === "tcp" ? b.acceptTcp() : b.acceptTrack();
+			let outcome: unknown;
+			const dialing = protocol === "tcp" ? a.dialTcp("bob") : a.dialTrack("bob");
+			const settled = dialing.then(
+				(value) => {
+					outcome = value;
+				},
+				(error) => {
+					outcome = error;
+				},
+			);
+			try {
+				const incoming = await next;
+				await clock.advance(Nano.fromSecond(Second(3600)));
+				expect(outcome).toBeUndefined();
+				const remote = await incoming.accept();
+				const local = await dialing;
+				local.producer.writeFrame(bytes(7));
+				const frame =
+					remote instanceof socket.TcpStream
+						? await remote.consumer.readFrame()
+						: await remote.consumer.ordered().readFrame();
+				expect(frame?.payload).toEqual(bytes(7).payload);
+			} finally {
+				a.close();
+				b.close();
+				client.abort();
+				server.abort();
+				await settled;
+			}
+		});
+	}
+}
+
+// A moq-lite client session before 07 never carries the endpoint's hidden broadcast, so its peer
+// could never find it. Its dials and accepts fail as unsupported instead of waiting, as in Rust.
+test("a socket endpoint behind a lite-06 client fails its dials and accepts, not the server's", async () => {
+	const clock = time();
+	const ao = new Origin.Producer();
+	const bo = new Origin.Producer();
+	origins.add(ao);
+	origins.add(bo);
+	const a = new socket.Endpoint(ao, Path.from("room"), "alice");
+	const b = new socket.Endpoint(bo, Path.from("room"), "bob");
+	// Already waiting before the session attaches, as when an endpoint's client reconnects.
+	const waiting = a.dialTcp("bob").then(
+		() => undefined,
+		(error: unknown) => error,
+	);
+	const pair = createMockTransportPair(Lite.ALPN_06);
+	const url = new URL("https://localhost/socket");
+	const [client, server] = await Promise.all([
+		connect({ url, transport: pair.client, publish: ao.consume(), consume: ao }),
+		acceptConnection({ url, transport: pair.server, publish: bo.consume(), consume: bo }),
+	]);
+	let heard = false;
+	const next = b.acceptTcp().then(
+		() => {
+			heard = true;
+		},
+		() => {},
+	);
+	try {
+		const unsupported = /unreachable behind a moq-lite hop before 07/;
+		expect(((await waiting) as Error).message).toMatch(unsupported);
+		await expect(a.dialTcp("bob")).rejects.toThrow(unsupported);
+		await expect(a.dialTrack("bob")).rejects.toThrow(unsupported);
+		await expect(a.acceptTcp()).rejects.toThrow(unsupported);
+		await expect(a.acceptTrack()).rejects.toThrow(unsupported);
+		// The server's endpoint keeps accepting, and never heard a dial it can't answer.
+		await clock.advance(Nano.fromSecond(Second(3600)));
+		expect(heard).toBe(false);
+
+		// The session's end releases the endpoint: an accept waits again.
+		client.abort();
+		await client.closed;
+		let accepted: unknown;
+		const accepting = a.acceptTcp().then(
+			(value) => {
+				accepted = value;
+			},
+			(error: unknown) => {
+				accepted = error;
+			},
+		);
+		await clock.advance(Nano.zero);
+		expect(accepted).toBeUndefined();
+		a.close();
+		await accepting;
+	} finally {
+		client.abort();
+		server.abort();
+		a.close();
+		b.close();
+		await next;
+	}
+});
diff --git a/js/net/src/socket.ts b/js/net/src/socket.ts
new file mode 100644
index 00000000000..db76e74bdd7
--- /dev/null
+++ b/js/net/src/socket.ts
@@ -0,0 +1,620 @@
+/**
+ * Point-to-point sessions over one hidden broadcast per endpoint.
+ *
+ * Sessions use the existing MoQ wire and need lite-07 (currently an explicit
+ * `moq-lite-07-wip` offer) or moq-transport on every hop. While the endpoint's origin
+ * has a moq-lite client session before 07, dials and accepts fail as unsupported.
+ * Their track names are secrets and are never listed. See the socket concept page.
+ *
+ * @module
+ */
+import { type Dispose, type GetPromise, type Getter, Once, Signal } from "@moq/signals";
+import { NotFound, ProtocolViolation, StreamCode, StreamError } from "./error.ts";
+import * as Group from "./group.ts";
+import { hooks, SOCKET } from "./internal.ts";
+import type * as Origin from "./origin.ts";
+import * as Path from "./path.ts";
+import type * as Track from "./track.ts";
+import { untilAborted } from "./util/abort.ts";
+import { isUnrequested as abandoned } from "./util/demand.ts";
+import { fromBytes } from "./util/hex.ts";
+import { wireOf } from "./wire.ts";
+
+type Protocol = "tcp" | "track";
+type Stream = TcpStream | TrackStream;
+const reliable: Track.Subscription = {
+	order: "ascending",
+	delay: { max: null },
+};
+const cancelled = () => new StreamError(StreamCode.Cancel, { message: "socket operation cancelled" });
+const ended = () => new StreamError(StreamCode.SessionClosed, { message: "socket endpoint closed" });
+// Unsupported has no registered stream code, as in Rust: it maps to Internal.
+const unreachable = () => new Error("socket endpoint is unreachable behind a moq-lite hop before 07");
+
+function segment(id: string): void {
+	if (!id || id.includes("/") || id.includes("\\")) throw new TypeError("socket id must be one plain segment");
+}
+
+function endpointPath(prefix: Path.Valid, id: string): Path.Valid {
+	segment(id);
+	return Path.encode(Path.from(prefix, SOCKET, id));
+}
+
+function parse(name: string): { protocol: string; dialer: string; acceptor: string; session: string } | undefined {
+	const parts = name.split("/");
+	if (parts.length !== 4 || parts.some((part) => !part || part.includes("\\"))) return;
+	const [protocol, dialer, acceptor, session] = parts;
+	return { protocol, dialer, acceptor, session };
+}
+
+// A cancellable signal wait removes its subscriptions even if the value never changes.
+function waitFor<T>(value: Getter<T>, ready: (value: T) => boolean, signal: AbortSignal): Promise<T> {
+	return new Promise((resolve, reject) => {
+		let dispose: Dispose = () => {};
+		const finish = () => {
+			dispose();
+			signal.removeEventListener("abort", abort);
+		};
+		const abort = () => {
+			finish();
+			reject(signal.reason);
+		};
+		const check = () => {
+			const current = value.peek();
+			if (!ready(current)) return;
+			finish();
+			resolve(current);
+		};
+		if (signal.aborted) return abort();
+		dispose = value.subscribe(check);
+		signal.addEventListener("abort", abort, { once: true });
+		check();
+	});
+}
+
+/** Cancellation for a pending dial or accept; aborting after it resolves has no effect. */
+export interface Options {
+	/** Abandon this operation with the signal's reason. */
+	signal?: AbortSignal;
+}
+
+let makeTcp: (parts: Parts, producer: Group.Producer, consumer: Group.Consumer) => TcpStream;
+let makeTrack: (parts: Parts) => TrackStream;
+let makeIncoming: <S extends Stream>(endpoint: Endpoint, protocol: Protocol, request: Track.Request) => Incoming<S>;
+let accept: (
+	endpoint: Endpoint,
+	protocol: Protocol,
+	request: Track.Request,
+	info: Track.InfoInit,
+	options?: Options,
+) => Promise<Stream>;
+
+/** A TCP session's one group each way; finish is FIN, and abort is RST. */
+export class TcpStream {
+	/** This side's writes, as frames in group zero. */
+	readonly producer: Group.Producer;
+	/** The peer's writes in order; a reader falling behind the unpaced JS tail fails with eviction. */
+	readonly consumer: Group.Consumer;
+	/** The peer endpoint's id. */
+	readonly peer: string;
+	/** The fresh, secret session id chosen by the dialer. */
+	readonly session: string;
+
+	private constructor(parts: Parts, producer: Group.Producer, consumer: Group.Consumer) {
+		this.producer = producer;
+		this.consumer = consumer;
+		this.peer = parts.peer;
+		this.session = parts.session;
+	}
+	static {
+		makeTcp = (parts, producer, consumer) => new TcpStream(parts, producer, consumer);
+	}
+}
+
+/** A track session whose ascending reader skips unavailable groups, with no default publisher max age. */
+export class TrackStream {
+	/** This side's track; write groups as independent messages. */
+	readonly producer: Track.Producer;
+	/** The peer's subscribed track; ordered() skips groups that are refused, dropped, or evicted. */
+	readonly consumer: Track.Subscriber;
+	/** The peer endpoint's id, verified by accepting the dial. */
+	readonly peer: string;
+	/** The fresh, secret session id chosen by the dialer. */
+	readonly session: string;
+
+	private constructor(parts: Parts) {
+		this.producer = parts.producer;
+		this.consumer = parts.consumer;
+		this.peer = parts.peer;
+		this.session = parts.session;
+	}
+	static {
+		makeTrack = (parts) => new TrackStream(parts);
+	}
+}
+
+interface Parts {
+	producer: Track.Producer;
+	consumer: Track.Subscriber;
+	peer: string;
+	session: string;
+}
+
+/** An unverified incoming request to accept (checking its original dial is still open) or reject. */
+export class Incoming<S extends TcpStream | TrackStream> {
+	/** The id the dialer claims; accept verifies that endpoint really dialed this session. */
+	readonly peer: string;
+	/** The claimed session id; only accept verifies that its original dial is still open. */
+	readonly session: string;
+	#endpoint: Endpoint;
+	#protocol: Protocol;
+	#request?: Track.Request;
+
+	private constructor(endpoint: Endpoint, protocol: Protocol, request: Track.Request) {
+		const name = parse(request.name);
+		if (!name) throw new Error("invalid incoming socket name");
+		this.peer = name.dialer;
+		this.session = name.session;
+		this.#endpoint = endpoint;
+		this.#protocol = protocol;
+		this.#request = request;
+	}
+	static {
+		makeIncoming = (endpoint, protocol, request) => new Incoming(endpoint, protocol, request);
+	}
+
+	/** Accept while the original dial stays open; track accepts may describe their outgoing half. */
+	accept(
+		...args: S extends TcpStream ? [options?: Options] : [info?: Track.InfoInit, options?: Options]
+	): Promise<S> {
+		const request = this.#request;
+		this.#request = undefined;
+		if (!request) return Promise.reject(cancelled());
+		const [info, options] =
+			this.#protocol === "tcp"
+				? [{}, args[0] as Options | undefined]
+				: [(args[0] as Track.InfoInit) ?? { maxAge: null }, args[1]];
+		return accept(this.#endpoint, this.#protocol, request, info, options) as Promise<S>;
+	}
+
+	/** Refuse this dial as not found; idempotent. */
+	reject(): void {
+		this.#request?.reject(new NotFound("socket session"));
+		this.#request = undefined;
+	}
+}
+
+class Queue {
+	listening = false;
+	dials = new Signal(new Map<Track.Request, Dispose>());
+	close(): void {
+		for (const [request, dispose] of this.dials.peek()) {
+			dispose();
+			request.reject(ended());
+		}
+		this.dials.mutate((dials) => dials.clear());
+	}
+}
+
+/**
+ * Announces one endpoint, dials peers under the same prefix, and accepts each protocol separately.
+ *
+ * Every hop between two endpoints must carry hidden broadcasts: moq-lite-07 or moq-transport.
+ * While the origin has a moq-lite client session before 07, whose peer never hears this
+ * endpoint, dials and accepts fail as unsupported. Nothing tells a dialer that its peer sits
+ * behind such a hop, so a dial to it waits as for a peer not announced yet.
+ */
+export class Endpoint {
+	/** This endpoint's id, a single plain segment. */
+	readonly id: string;
+	/** The shared prefix containing the endpoints. */
+	readonly prefix: Path.Valid;
+	/** Settles when the endpoint closes. */
+	get closed(): GetPromise<Error | null> {
+		return this.#closed;
+	}
+	#closed = new Once<Error | null>();
+	#abort = new AbortController();
+	#origin: Origin.Producer;
+	#route: Origin.Route;
+	#queues = { tcp: new Queue(), track: new Queue() };
+	#serving = false;
+	#sessions = new Set<Session>();
+	#unclose: Dispose;
+	#withheld: Getter<number>;
+
+	/** Publish this endpoint on origin, which must also reach its peers. */
+	constructor(origin: Origin.Producer, prefix: Path.Valid, id: string) {
+		this.id = id;
+		this.prefix = Path.from(prefix);
+		this.#origin = origin;
+		this.#withheld = hooks.hiddenWithheld(origin);
+		this.#route = origin.route(endpointPath(this.prefix, id));
+		this.#unclose = hooks.onClosed(this.#route.broadcast, () => this.close());
+	}
+
+	static {
+		accept = (endpoint, protocol, request, info, options) => endpoint.#accept(protocol, request, info, options);
+	}
+
+	/** Dial a TCP session; waits for the peer's announcement and acceptance until cancelled. */
+	dialTcp(peer: string, options?: Options): Promise<TcpStream> {
+		return this.#dial("tcp", peer, {}, options) as Promise<TcpStream>;
+	}
+	/** Dial a track session; omitted info keeps every message with no publisher max age. */
+	dialTrack(peer: string, info: Track.InfoInit = { maxAge: null }, options?: Options): Promise<TrackStream> {
+		return this.#dial("track", peer, info, options) as Promise<TrackStream>;
+	}
+	/** Take the next TCP dial; the first call starts queueing TCP dials until close. */
+	acceptTcp(options?: Options): Promise<Incoming<TcpStream>> {
+		return this.#next<TcpStream>("tcp", options);
+	}
+	/** Take the next track dial; its queue is independent of TCP's. */
+	acceptTrack(options?: Options): Promise<Incoming<TrackStream>> {
+		return this.#next<TrackStream>("track", options);
+	}
+
+	async #next<S extends Stream>(protocol: Protocol, options?: Options): Promise<Incoming<S>> {
+		const abort = new AbortController();
+		const signal = AbortSignal.any([this.#signal(options), abort.signal]);
+		const unwatch = this.#reachable(abort);
+		try {
+			signal.throwIfAborted();
+			const queue = this.#queues[protocol];
+			queue.listening = true;
+			if (!this.#serving) {
+				this.#serving = true;
+				void this.#serve();
+			}
+			for (;;) {
+				await waitFor(queue.dials, (dials) => dials.size > 0, signal);
+				signal.throwIfAborted();
+				const first = queue.dials.peek().entries().next().value;
+				if (!first) continue;
+				const [request, dispose] = first;
+				dispose();
+				queue.dials.mutate((dials) => dials.delete(request));
+				if (!abandoned(request)) return makeIncoming<S>(this, protocol, request);
+				request.reject(cancelled());
+			}
+		} finally {
+			unwatch();
+		}
+	}
+
+	// Abort with unsupported while a session withholds this endpoint from its peer, until disposed.
+	#reachable(abort: AbortController): Dispose {
+		const check = () => {
+			if (this.#withheld.peek() > 0) abort.abort(unreachable());
+		};
+		const unwatch = this.#withheld.subscribe(check);
+		check();
+		return unwatch;
+	}
+
+	async #serve(): Promise<void> {
+		try {
+			for (;;) {
+				const request = await wireOf(this.#route.broadcast).requested();
+				if (!request) return;
+				const name = parse(request.name);
+				if (!name || name.acceptor !== this.id || name.dialer === this.id) {
+					request.reject(new NotFound("socket session"));
+					continue;
+				}
+				if ((name.protocol !== "tcp" && name.protocol !== "track") || !this.#queues[name.protocol].listening) {
+					// Unsupported has no registered stream code, as in Rust: it maps to Internal.
+					request.reject(new Error("socket protocol is unsupported"));
+					continue;
+				}
+				const queue = this.#queues[name.protocol];
+				const demand = request.demand();
+				const prune = () => {
+					if (!abandoned(request)) return;
+					queue.dials.peek().get(request)?.();
+					queue.dials.mutate((dials) => dials.delete(request));
+					request.reject(cancelled());
+				};
+				const stop = hooks.requestWanted(request).subscribe(prune);
+				const release = hooks.demandReleased(demand).subscribe(prune);
+				queue.dials.mutate((dials) =>
+					dials.set(request, () => {
+						stop();
+						release();
+					}),
+				);
+				prune();
+			}
+		} catch (error) {
+			this.#end(error instanceof Error ? error : new Error(String(error)));
+		}
+	}
+
+	#signal(options?: Options): AbortSignal {
+		return options?.signal ? AbortSignal.any([this.#abort.signal, options.signal]) : this.#abort.signal;
+	}
+
+	async #remote(
+		protocol: Protocol,
+		peer: string,
+		name: string,
+		signal: AbortSignal,
+		hold: (following: Origin.Following) => void,
+	): Promise<{ consumer: Track.Subscriber; peer: GetPromise<Error | null> }> {
+		const following = this.#origin.follow(endpointPath(this.prefix, peer));
+		hold(following);
+		const abort = new AbortController();
+		const stop = following.closed.subscribe(() => abort.abort(following.closed.peek() ?? ended()));
+		if (following.closed.peek() !== undefined) abort.abort(following.closed.peek() ?? ended());
+		const pending = AbortSignal.any([signal, abort.signal]);
+		try {
+			const broadcast = await waitFor(following.active, (active) => active !== undefined, pending);
+			if (!broadcast) throw ended();
+			return {
+				consumer: broadcast.track(name).subscribe({
+					...reliable,
+					ranges: protocol === "track" ? [{ start: { absolute: 0n } }] : undefined,
+				}),
+				peer: broadcast.closed,
+			};
+		} finally {
+			stop();
+		}
+	}
+
+	async #dial(protocol: Protocol, peer: string, info: Track.InfoInit, options?: Options): Promise<Stream> {
+		segment(peer);
+		if (peer === this.id) throw new Error("dialing the same socket endpoint is unsupported");
+		const abort = new AbortController();
+		const signal = AbortSignal.any([this.#signal(options), abort.signal]);
+		signal.throwIfAborted();
+		const session = fromBytes(crypto.getRandomValues(new Uint8Array(16)));
+		const name = `${protocol}/${this.id}/${peer}/${session}`;
+		const answer = hooks.reserveUnlistedTrack(this.#route.broadcast, name);
+		let following: Origin.Following | undefined;
+		let consumer: Track.Subscriber | undefined;
+		let producer: Track.Producer | undefined;
+		let stop: Dispose = () => {};
+		const unreached = this.#reachable(abort);
+		try {
+			const remote = await this.#remote(protocol, peer, name, signal, (value) => {
+				following = value;
+			});
+			consumer = remote.consumer;
+			stop = hooks.watchSubscriberError(consumer, (error) => abort.abort(error));
+			const serving = waitFor(hooks.requestWanted(answer), (wanted) => wanted, signal).then(() => {
+				producer = answer.accept(info);
+			});
+			await untilAborted(Promise.all([serving, consumer.info()]), signal);
+			signal.throwIfAborted();
+			if (!producer || !following) throw cancelled();
+			return this.#open(protocol, { producer, consumer, peer, session }, following, remote.peer);
+		} catch (error) {
+			answer.reject(error instanceof Error ? error : cancelled());
+			consumer?.close();
+			following?.close();
+			throw error;
+		} finally {
+			stop();
+			unreached();
+			abort.abort(cancelled());
+		}
+	}
+
+	async #accept(
+		protocol: Protocol,
+		request: Track.Request,
+		info: Track.InfoInit,
+		options?: Options,
+	): Promise<Stream> {
+		const name = parse(request.name);
+		if (!name) throw cancelled();
+		const abort = new AbortController();
+		const signal = AbortSignal.any([this.#signal(options), abort.signal]);
+		const demand = request.demand();
+		const check = () => {
+			if (abandoned(request)) abort.abort(cancelled());
+		};
+		const stop = hooks.requestWanted(request).subscribe(check);
+		const release = hooks.demandReleased(demand).subscribe(check);
+		const unreached = this.#reachable(abort);
+		let following: Origin.Following | undefined;
+		let consumer: Track.Subscriber | undefined;
+		let stopError: Dispose = () => {};
+		try {
+			check();
+			signal.throwIfAborted();
+			const remote = await this.#remote(protocol, name.dialer, request.name, signal, (value) => {
+				following = value;
+			});
+			consumer = remote.consumer;
+			stopError = hooks.watchSubscriberError(consumer, (error) => abort.abort(error));
+			await untilAborted(consumer.info(), signal);
+			signal.throwIfAborted();
+			if (!following) throw cancelled();
+			hooks.keepRequest(request);
+			return this.#open(
+				protocol,
+				{ producer: request.accept(info), consumer, peer: name.dialer, session: name.session },
+				following,
+				remote.peer,
+			);
+		} catch (error) {
+			request.reject(error instanceof Error ? error : cancelled());
+			consumer?.close();
+			following?.close();
+			throw error;
+		} finally {
+			stop();
+			release();
+			unreached();
+			stopError();
+		}
+	}
+
+	#open(protocol: Protocol, parts: Parts, following: Origin.Following, peer: GetPromise<Error | null>): Stream {
+		this.#abort.signal.throwIfAborted();
+		if (following.active.peek()?.closed !== peer) throw ended();
+		const session = new Session(parts, following, peer, () => this.#sessions.delete(session));
+		this.#sessions.add(session);
+		try {
+			return protocol === "tcp" ? session.tcp() : session.track();
+		} catch (error) {
+			session.reset(error instanceof Error ? error : cancelled());
+			throw error;
+		}
+	}
+
+	/** Reset every held session, cancel pending operations, and retract the endpoint; idempotent. */
+	close(): void {
+		this.#end(null);
+	}
+
+	#end(error: Error | null): void {
+		if (this.#closed.peek() !== undefined) return;
+		this.#closed.set(error);
+		this.#unclose();
+		this.#abort.abort(error ?? ended());
+		for (const queue of Object.values(this.#queues)) queue.close();
+		for (const session of this.#sessions) session.reset(ended());
+		this.#route.broadcast.close();
+	}
+}
+
+// Owns the routing hold, monitors both halves, and ends the TCP copy on protocol violations.
+class Session {
+	#parts: Parts;
+	#following: Origin.Following;
+	#peer: GetPromise<Error | null>;
+	#done: Dispose;
+	#abort = new AbortController();
+	#stops: Dispose[] = [];
+	#local?: Group.Producer;
+	#outgoing?: Group.Producer;
+	#sent = false;
+	#received = false;
+	constructor(parts: Parts, following: Origin.Following, peer: GetPromise<Error | null>, done: Dispose) {
+		this.#parts = parts;
+		this.#following = following;
+		this.#peer = peer;
+		this.#done = done;
+	}
+
+	#hold(stop: Dispose): void {
+		if (this.#abort.signal.aborted) stop();
+		else this.#stops.push(stop);
+	}
+
+	#monitor(): void {
+		// A socket reset ends the session even when a generic routed reader would recover.
+		this.#hold(hooks.watchSubscriberError(this.#parts.consumer, (error) => this.reset(error)));
+		const check = () => {
+			if (this.#following.active.peek()?.closed !== this.#peer) this.reset(ended());
+		};
+		this.#hold(this.#following.active.subscribe(check));
+		check();
+	}
+
+	#watch(value: GetPromise<Error | null>, done: () => void): void {
+		const check = (error: Error | null | undefined) => {
+			if (error === undefined) return;
+			if (error) this.reset(error);
+			else {
+				done();
+				this.#complete();
+			}
+		};
+		this.#hold(value.subscribe(check));
+		check(value.peek());
+	}
+
+	track(): TrackStream {
+		this.#monitor();
+		this.#watch(this.#parts.producer.closed, () => {
+			this.#sent = true;
+		});
+		this.#watch(this.#parts.consumer.closed, () => {
+			this.#received = true;
+		});
+		return makeTrack(this.#parts);
+	}
+
+	tcp(): TcpStream {
+		const { producer, consumer } = this.#parts;
+		const outgoing = producer.createGroup(0n);
+		const local = new Group.Producer(0n);
+		const incoming = local.consume();
+		this.#local = local;
+		this.#outgoing = outgoing;
+		this.#monitor();
+		this.#watch(outgoing.closed, () => {
+			producer.finish();
+			this.#sent = true;
+		});
+		this.#watch(producer.closed, () => {});
+		this.#watch(consumer.closed, () => {});
+		const check = () => {
+			if (!local.demand().wanted.peek() && !this.#received) this.reset(cancelled());
+		};
+		this.#hold(local.demand().wanted.subscribe(check));
+		void this.#copy().catch((error) => this.reset(error instanceof Error ? error : cancelled()));
+		void this.#groups().catch((error) => this.reset(error instanceof Error ? error : cancelled()));
+		return makeTcp(this.#parts, outgoing, incoming);
+	}
+
+	async #copy(): Promise<void> {
+		const ordered = this.#parts.consumer.ordered();
+		const group = await ordered.nextGroup();
+		// Even an empty TCP half publishes group 0. The ordered cursor skips lost
+		// groups, so reaching track end without it is loss, not a clean FIN.
+		if (!group) throw new NotFound("TCP session group");
+		try {
+			if (group.sequence !== 0n) throw new ProtocolViolation("second group on a TCP session");
+			for (;;) {
+				const frame = await group.readFrame();
+				if (!frame) break;
+				this.#local?.writeFrame({ payload: frame.payload });
+			}
+		} finally {
+			group.close();
+		}
+		if (this.#abort.signal.aborted) return;
+		this.#received = true;
+		this.#local?.finish();
+		this.#complete();
+	}
+
+	async #groups(): Promise<void> {
+		for (;;) {
+			const largest = await this.#parts.consumer.largest();
+			if (!largest) return;
+			if (largest.group > 0n) throw new ProtocolViolation("second group on a TCP session");
+		}
+	}
+
+	#complete(): void {
+		if (this.#sent && this.#received) this.#close(false);
+	}
+
+	reset(error: Error): void {
+		if (this.#abort.signal.aborted) return;
+		this.#outgoing?.abort(error);
+		this.#local?.abort(error);
+		this.#parts.producer.abort(error);
+		this.#parts.consumer.close(error);
+		this.#close(true);
+	}
+
+	#close(reset: boolean): void {
+		if (this.#abort.signal.aborted) return;
+		this.#abort.abort();
+		for (const stop of this.#stops) stop();
+		this.#stops.length = 0;
+		// A settled end retains its cache for existing readers, while releasing the
+		// broadcast's unlisted reservation instead of accumulating completed sessions.
+		this.#parts.producer.close();
+		if (reset || this.#local) this.#parts.consumer.close();
+		this.#following.close();
+		this.#done();
+	}
+}
diff --git a/js/net/src/track.ts b/js/net/src/track.ts
index d497cc5ebd6..cdd2f1945ee 100644
--- a/js/net/src/track.ts
+++ b/js/net/src/track.ts
@@ -5,7 +5,7 @@
  */
 
 import { Instant, Milli, Nano, now, sleepUntil } from "@moq/clock";
-import { type Dispose, type GetPromise, type Getter, Once, Signal } from "@moq/signals";
+import { Derived, type Dispose, type GetPromise, type Getter, Once, Signal } from "@moq/signals";
 import { Delivered } from "./delivered.ts";
 import {
 	GroupTooLarge,
@@ -476,17 +476,33 @@ export class Request {
 
 	#producer: Producer;
 	#pending: Set<Request>;
+	#lookups?: TrackRequestOptions["lookups"];
+	#wanted?: Getter<boolean>;
 
 	private constructor(options: TrackRequestOptions) {
 		this.name = options.name;
 		this.#producer = options.producer;
 		this.#pending = options.pending;
+		this.#lookups = options.lookups;
 		this.#pending.add(this);
 	}
 
 	static {
 		hooks.makeRequest = (options) => new Request(options);
 		hooks.stageRequest = (request, info) => request.#stage(info);
+		hooks.requestWanted = (request) => {
+			const wanted = request.#producer.demand().wanted;
+			request.#wanted ??= request.#lookups
+				? new Derived(
+						[wanted, request.#lookups.pending],
+						(group, lookups) => group !== undefined || lookups > 0,
+					)
+				: new Derived([wanted], (group) => group !== undefined);
+			return request.#wanted;
+		};
+		hooks.keepRequest = (request) => {
+			if (request.#lookups) request.#lookups.opened = false;
+		};
 	}
 
 	/** Watch the subscribers waiting for this request. */
@@ -536,6 +552,12 @@ export class Request {
 	}
 }
 
+/** Options for {@link Consumer.info}. */
+export interface InfoOptions {
+	/** Abandons the lookup, rejecting with the signal's reason; aborting after it resolves has no effect. */
+	signal?: AbortSignal;
+}
+
 /** Options for {@link Consumer.fetchGroup}. */
 export interface FetchGroupOptions {
 	/** Delivery priority for the fetch stream. Defaults to `0`. */
@@ -587,9 +609,19 @@ export class Consumer {
 		return this.#broadcast.subscribe(this.name, options);
 	}
 
-	/** Fetch the track's immutable publisher properties without subscribing. */
-	info(): Promise<Info> {
-		return this.#broadcast.resolveTrackInfo(this.name);
+	/**
+	 * Fetch the track's immutable publisher properties without subscribing. It waits for as long
+	 * as the publisher takes to answer: abort `options.signal` to give up.
+	 */
+	info(options?: InfoOptions): Promise<Info> {
+		const signal = options?.signal;
+		if (!signal) return this.#broadcast.resolveTrackInfo(this.name);
+		if (signal.aborted) return Promise.reject(signal.reason);
+		// Held only until the answer, so the signal abandons the lookup but never keeps the track.
+		const answered = new AbortController();
+		return this.#broadcast
+			.resolveTrackInfo(this.name, AbortSignal.any([signal, answered.signal]))
+			.finally(() => answered.abort());
 	}
 
 	/** Fetch a single group by sequence without holding a live subscription. */
@@ -2899,6 +2931,15 @@ export class Subscriber {
 			});
 			return subscriber;
 		};
+		hooks.watchSubscriberError = (subscriber, fn) => {
+			if (subscriber.#resume) return subscriber.#resume.watchError(fn);
+			const check = (error: Error | null | undefined) => {
+				if (error instanceof Error) fn(error);
+			};
+			const stop = subscriber.closed.subscribe(check);
+			check(subscriber.closed.peek());
+			return stop;
+		};
 		hooks.latestSequence = (subscriber) =>
 			subscriber.#resume ? subscriber.#resume.latest() : subscriber.#state.latest;
 		hooks.bufferedLargest = (subscriber) => subscriber.#bufferedLargest();
diff --git a/js/net/src/util/deadline.ts b/js/net/src/util/deadline.ts
index cfc810f3260..284e3791e7e 100644
--- a/js/net/src/util/deadline.ts
+++ b/js/net/src/util/deadline.ts
@@ -1,10 +1,10 @@
-import { Milli, Nano, sleep } from "@moq/clock";
+import { type Milli, Nano, sleep } from "@moq/clock";
 import { race } from "@moq/signals";
 import { controlTimeout, error } from "../error.ts";
 import type { Stream } from "../stream.ts";
 import { TimeoutError } from "./timeout.ts";
 
-/** Milliseconds a request may go unanswered once none of its streams waits to open. @internal */
+/** Milliseconds an advertisement may go unanswered while none of its streams waits to open. @internal */
 export const REQUEST_TIMEOUT_MS = 10_000;
 
 /** What a deadline failure resets: a stream, or whatever owns one. @internal */
@@ -13,10 +13,9 @@ export interface Abortable {
 }
 
 /**
- * One fatal deadline for a request, including every stream its setup creates.
- *
- * An open waiting for the peer's stream credit is waiting its turn, not the peer stalling, so
- * the deadline only runs while none of the request's streams waits to open. @internal
+ * Owns a request's setup streams and optionally bounds its answer. Track requests take no
+ * budget: their publisher may hold the answer until demand, cancellation, or the session
+ * ends it. A budget runs only while none of the request's streams waits to open. @internal
  */
 export class Deadline {
 	/** Creates still waiting on credit: a fetch opens its TRACK stream alongside. */
@@ -27,7 +26,10 @@ export class Deadline {
 	#owners: Abortable[] = [];
 	#failure?: Error;
 
-	constructor() {
+	#budget?: Milli;
+
+	constructor(budget?: Milli) {
+		this.#budget = budget;
 		this.#rearm();
 	}
 
@@ -76,11 +78,13 @@ export class Deadline {
 		await write();
 	}
 
-	/** Wait for the first answer under the request's single deadline. */
+	/** Wait for the first answer, within the budget if one was given. */
 	async wait<T>(answer: Promise<T>): Promise<T> {
+		const budget = this.#budget;
+		if (budget === undefined) return answer;
 		const done = new AbortController();
 		try {
-			return (await race([answer, this.#expire(done.signal)])) as T;
+			return (await race([answer, this.#expire(budget, done.signal)])) as T;
 		} catch (cause) {
 			const failure = cause instanceof TimeoutError ? controlTimeout(cause) : error(cause);
 			this.#failure = failure;
@@ -95,8 +99,8 @@ export class Deadline {
 	}
 
 	/** Reject once the request goes the whole budget with none of its streams waiting to open. */
-	async #expire(done: AbortSignal): Promise<never> {
-		const budget = Nano.fromMilli(Milli(REQUEST_TIMEOUT_MS));
+	async #expire(limit: Milli, done: AbortSignal): Promise<never> {
+		const budget = Nano.fromMilli(limit);
 		const answered = new Promise<void>((resolve) =>
 			done.addEventListener("abort", () => resolve(), { once: true }),
 		);
@@ -116,7 +120,7 @@ export class Deadline {
 			// Answered: the waiting is over, and nothing is left to reject.
 			if (why === undefined) return new Promise<never>(() => {});
 			if (why === "expired" && !done.aborted) {
-				throw new TimeoutError(`request timed out after ${REQUEST_TIMEOUT_MS}ms`);
+				throw new TimeoutError(`request timed out after ${this.#budget}ms`);
 			}
 		}
 	}
diff --git a/js/net/src/util/demand.ts b/js/net/src/util/demand.ts
index 4f9a2384604..e9d37a12a8f 100644
--- a/js/net/src/util/demand.ts
+++ b/js/net/src/util/demand.ts
@@ -1,6 +1,6 @@
 import { Signal } from "@moq/signals";
 import { hooks } from "../internal.ts";
-import type { Demand } from "../track.ts";
+import type { Demand, Request } from "../track.ts";
 
 /** Resolve once no subscriber wants the track, or it closed. */
 export async function unwanted(demand: Demand): Promise<void> {
@@ -23,6 +23,18 @@ export async function abandoned(demand: Demand): Promise<void> {
 	}
 }
 
+/** Resolve once neither a subscriber nor an info lookup wants the request, or its track closed. */
+export async function unrequested(request: Request): Promise<void> {
+	const wanted = hooks.requestWanted(request);
+	const released = hooks.demandReleased(request.demand());
+	while (!isUnrequested(request)) await Signal.race(wanted, released);
+}
+
+/** Whether neither a subscriber nor an info lookup wants the request, or its track closed. */
+export function isUnrequested(request: Request): boolean {
+	return !hooks.requestWanted(request).peek() || hooks.demandReleased(request.demand()).peek() !== undefined;
+}
+
 /** Whether no subscriber wants the track now, or it closed. */
 export function isAbandoned(demand: Demand): boolean {
 	return hooks.demandReleased(demand).peek() !== undefined || demand.wanted.peek() === undefined;
diff --git a/py/moq-rs/README.md b/py/moq-rs/README.md
index bede3ee40b8..e3bd133b9d1 100644
--- a/py/moq-rs/README.md
+++ b/py/moq-rs/README.md
@@ -178,7 +178,7 @@ client = moq.Client(
   - Async iterator yielding `TrackRequest`
 - **`TrackProducer` / `GroupProducer`**. Write raw payloads with no codec parsing.
   - `.write_frame(payload, timestamp=None)` writes a payload with optional capture time.
-  - `await .ready(size)` (`GroupProducer`) waits until a frame of `size` bytes fits a window ahead of the fastest reader. Await it before each write for backpressure; a writer that doesn't sheds the front of the group instead.
+  - `await .ready(size)` (`GroupProducer`) waits until a frame of `size` bytes fits a window ahead of the fastest reader. Await it before each write for backpressure. A writer that doesn't wait sheds the front of the group instead.
   - `.create_group(sequence)` creates a sparse or replayed group at an explicit sequence.
   - `.finish()` ends at the live edge; the handle remains so `.abort(error_code)` can still run.
   - `.finish_at(final_sequence)` declares the first group that will never be produced while leaving lower groups writable.
diff --git a/quest/m0/test-flakes-2/reload-close-drain.md b/quest/m0/test-flakes-2/reload-close-drain.md
index 2c31824b64e..0eed3b88f9f 100644
--- a/quest/m0/test-flakes-2/reload-close-drain.md
+++ b/quest/m0/test-flakes-2/reload-close-drain.md
@@ -20,6 +20,12 @@ session` shares its held-FIN fixture (`holdFins`), and `a URL change connects
 the replacement while the old session drains until …` waits out a drain
 deadline. Check them for the same race.
 
+The gated `just ci origin/main` on the JS socket branch reproduced this on
+2026-11-05: `fin.closed` was already true after advancing 999 ms, where the
+assertion expected false. The standalone full `js/net` run passed this case.
+[moq-dev/moq#7884](https://github.com/moq-dev/moq/pull/7884) quarantines it
+with every assertion retained; restore it when this quest fixes the race.
+
 Reproduce first: run `reload.test.ts` together with the rest of `js/net` under
 CPU contention and `--rerun-each`, as the epic's earlier JS fixes did
 ([moq-dev/moq#7658](https://github.com/moq-dev/moq/pull/7658) fixed
diff --git a/quest/m1/socket/README.md b/quest/m1/socket/README.md
index 7fb41850115..97212731d29 100644
--- a/quest/m1/socket/README.md
+++ b/quest/m1/socket/README.md
@@ -188,7 +188,6 @@ announce-watch-request pairing remains in `rs/moq-boy`, `js/moq-boy`, or
 
 ## Required
 
-- [JS sockets](/quest/m1/socket/js.md) - the same surface in `@moq/net`, interoperating with Rust
 - [moq-boy on sockets](/quest/m1/socket/boy.md) - viewers dial the emulator's endpoint and send commands and receive latency on their session
 - [CARLA on sockets](/quest/m1/socket/carla.md) - drivers dial the truck's endpoint and send control and receive acks on their session
 
diff --git a/quest/m1/socket/boy.md b/quest/m1/socket/boy.md
index b7c484b96ce..e875f5f1a92 100644
--- a/quest/m1/socket/boy.md
+++ b/quest/m1/socket/boy.md
@@ -35,7 +35,3 @@ See the [epic](/quest/m1/socket/README.md) for the convention.
   `demo/viewer/**`.
 - Update `doc/bin/demo.md` and the boy README or CHANGELOG where they describe
   the viewer path.
-
-## Required
-
-- [JS sockets](/quest/m1/socket/js.md) - the viewer's dial
diff --git a/quest/m1/socket/carla.md b/quest/m1/socket/carla.md
index d605acc33cb..37e63c5f47c 100644
--- a/quest/m1/socket/carla.md
+++ b/quest/m1/socket/carla.md
@@ -39,7 +39,3 @@ See the [epic](/quest/m1/socket/README.md) for the convention.
   make that counter moot, add a `MoqBroadcastConsumer::instance()` accessor
   (and its Python wrapper) and key the lease on the real instance. Options
   shown: m0; ✅ m1, in this quest; m2.
-
-## Required
-
-- [JS sockets](/quest/m1/socket/js.md) - the driver's dial
diff --git a/quest/m1/socket/js.md b/quest/m1/socket/js.md
deleted file mode 100644
index 16671a7e8b2..00000000000
--- a/quest/m1/socket/js.md
+++ /dev/null
@@ -1,30 +0,0 @@
-# [S] JS sockets
-
-## Goal
-
-`@moq/net` exports `socket` with the same `Endpoint`, `TcpStream`, and
-`TrackStream` surface as Rust, and a Rust endpoint and a JS endpoint dial and
-accept sessions in both protocols with each other through a relay, carrying
-data both ways.
-
-## Plan
-
-Follow `doc/concept/socket.md` and mirror the Rust surface
-(`rs/moq-net/src/model/socket.rs`): an `Endpoint` announcing
-`<prefix>/.socket/<id>`; `dialTcp(peer)` / `acceptTcp()` and
-`dialTrack(peer)` / `acceptTrack()` in JS's casing, each landing in its
-protocol's queue; an incoming dial to accept or reject; a `TcpStream` with a
-group `producer` and `consumer` (one group each way: frames are writes, finish
-is FIN, abort is RST, and a second group resets the session); and a
-`TrackStream` with a track `producer` and a reliably subscribed `consumer`.
-Both carry `peer` and `session`, and no message methods of their own. Session
-tracks are `<protocol>/<dialer>/<acceptor>/<session>` in both endpoints, served only on
-request so no listing names them; an unknown or unaccepted protocol is reset
-as unsupported. JS reads without fastest-reader pacing until
-[JS fastest-reader pacing](/quest/m4/js-fastest-reader.md), so a JS `tcp`
-reader that falls a group tail behind fails with an eviction error; say so in
-the docs. As in Rust, dials and accepts fail as unsupported while the
-endpoint's connection is moq-lite before 07, which never carries its hidden
-broadcast, instead of waiting forever; test it against a lite-06 connection.
-Add the Rust/JS pairs to `just test interop`, and document the export in
-`doc/lib/js/net.md`.
diff --git a/quest/m3/stream/js.md b/quest/m3/stream/js.md
index c729b1c5e3b..c920db58ed4 100644
--- a/quest/m3/stream/js.md
+++ b/quest/m3/stream/js.md
@@ -13,5 +13,4 @@ the Rust/JS pair to `just test interop`.
 
 ## Required
 
-- [JS sockets](/quest/m1/socket/js.md) - the socket each stream is a bi track on
 - [Rust byte streams](/quest/m3/stream/rust.md) - the reference surface
diff --git a/rs/moq-cli/Cargo.toml b/rs/moq-cli/Cargo.toml
index cbcbdff05b3..740a9d9586b 100644
--- a/rs/moq-cli/Cargo.toml
+++ b/rs/moq-cli/Cargo.toml
@@ -181,6 +181,10 @@ harness = false
 name = "interop-tail"
 path = "../../test/interop/clients/rust/tail.rs"
 
+[[example]]
+name = "interop-socket-js"
+path = "../../test/interop/clients/rust/socket-js.rs"
+
 [[example]]
 name = "interop-catalog"
 path = "../../test/interop/clients/rust/catalog.rs"
diff --git a/sh/gh/nightly.sh b/sh/gh/nightly.sh
index 5a4fe03313c..e2cef86c86c 100755
--- a/sh/gh/nightly.sh
+++ b/sh/gh/nightly.sh
@@ -158,7 +158,7 @@ case "$1" in
         done
         ;;
     js)
-        for benchmark in broadcasts requests fills fetch forward reader frames drift ledger bandwidth replay varint lite-varint track resume priority subscribe-drop refresh observed compression datagrams; do
+        for benchmark in broadcasts requests fills fetch forward reader frames drift ledger bandwidth replay varint lite-varint track resume priority subscribe-drop refresh observed compression datagrams socket; do
             javascript "$benchmark" just js bench "$benchmark"
         done
         javascript catalog just js catalog-bench
diff --git a/test/interop/README.md b/test/interop/README.md
index 2d0596d428d..3c0733c558f 100644
--- a/test/interop/README.md
+++ b/test/interop/README.md
@@ -83,6 +83,12 @@ head with a joining FETCH before draft 22 and a fill from it.
 `--tail` runs the FETCH round, the late joins, and the five finite-tail lanes. The
 wire-compat lanes, which swap in released relays and clients, skip them.
 
+Socket lanes cross Rust and native JS in both dial directions under Node and Bun,
+using `tcp` and `track` through the relay. They verify both peers' bytes, FIN, RST,
+rejection, and separate rooted publish grants. Each pins moq-lite-07-wip; moq-net endpoints use lite to talk to each other,
+and older moq-lite hops do not carry hidden endpoints. These lanes
+run in the normal in-tree test when native JS is selected. `just test interop --sockets` runs them alone.
+
 On lite-07, Node and Bun also replace tracks in a claimed broadcast through the
 relay over WebSocket and WebTransport. Pre-connected readers subscribe immediately
 after each replacement while an existing reader resumes. The case also repeats the
diff --git a/test/interop/clients/js-native/socket.ts b/test/interop/clients/js-native/socket.ts
new file mode 100644
index 00000000000..e0a3ae01cfe
--- /dev/null
+++ b/test/interop/clients/js-native/socket.ts
@@ -0,0 +1,105 @@
+/** Socket convention interop over an authenticated relay, with a harness-owned drain acknowledgment. */
+import assert from "node:assert/strict";
+import { createInterface } from "node:readline";
+import * as Moq from "@moq/net";
+import { install } from "@moq/web-transport";
+
+install();
+console.debug = console.error;
+console.info = console.error;
+const [role, address, prefix, protocol, version] = process.argv.slice(2);
+assert(
+	address &&
+		prefix !== undefined &&
+		(role === "dial" || role === "accept") &&
+		(protocol === "tcp" || protocol === "track") &&
+		version,
+);
+const origin = new Moq.Origin.Producer();
+const endpoint = new Moq.socket.Endpoint(origin, Moq.Path.from(prefix), role === "dial" ? "dialer" : "acceptor");
+const next = role === "accept" ? (protocol === "tcp" ? endpoint.acceptTcp() : endpoint.acceptTrack()) : undefined;
+const connection = await Moq.Connection.connect({
+	url: new URL(address),
+	versions: [version],
+	websocket: { enabled: false },
+	publish: origin.consume(),
+	consume: origin,
+});
+const lines = createInterface({ input: process.stdin });
+const commands = lines[Symbol.asyncIterator]();
+// Every Incoming is a claim: a pipelined request can outlive its refused metadata.
+// Verify each new incoming once; a failed caller's dial still fails the harness.
+async function accepted(): Promise<Moq.socket.TcpStream | Moq.socket.TrackStream> {
+	for (;;) {
+		const incoming: Moq.socket.Incoming<Moq.socket.TcpStream> | Moq.socket.Incoming<Moq.socket.TrackStream> =
+			await (protocol === "tcp" ? endpoint.acceptTcp() : endpoint.acceptTrack());
+		try {
+			return await incoming.accept();
+		} catch {
+			/* The claimed original dial was canceled or no longer answers. */
+		}
+	}
+}
+
+try {
+	if (role === "accept") process.stdout.write("socket ready\n");
+	// Refuse before opening data sessions, so the probe is independent of late
+	// unverified queries for a completed half.
+	if (next) {
+		(await next).reject();
+	} else {
+		await assert.rejects(protocol === "tcp" ? endpoint.dialTcp("acceptor") : endpoint.dialTrack("acceptor"));
+	}
+	const stream = next
+		? await accepted()
+		: protocol === "tcp"
+			? await endpoint.dialTcp("acceptor")
+			: await endpoint.dialTrack("acceptor");
+	assert.equal(stream.peer, role === "dial" ? "acceptor" : "dialer");
+	assert.match(stream.session, /^[0-9a-f]{32}$/);
+	const own = role === "dial" ? 16 : 32;
+	const peer = role === "dial" ? 32 : 16;
+	if (stream instanceof Moq.socket.TcpStream) {
+		// Exchange a request and reply before FIN, then drain both independent halves.
+		for (let i = 0; i < 3; i++) stream.producer.writeFrame({ payload: new Uint8Array([own + i]) });
+		stream.producer.finish();
+		for (let i = 0; i < 3; i++)
+			assert.deepEqual((await stream.consumer.readFrame())?.payload, new Uint8Array([peer + i]));
+		assert.equal(await stream.consumer.readFrame(), undefined);
+	} else {
+		// Exchange each independent message as a request and reply.
+		const reader = stream.consumer.ordered();
+		for (let i = 0; i < 3; i++) {
+			if (role === "dial") stream.producer.writeFrame({ payload: new Uint8Array([own + i]) });
+			const frame = await reader.readFrame();
+			assert.equal(frame?.group, BigInt(i));
+			assert.deepEqual(frame?.payload, new Uint8Array([peer + i]));
+			if (role === "accept") stream.producer.writeFrame({ payload: new Uint8Array([own + i]) });
+		}
+		stream.producer.finish();
+		assert.equal(await reader.readFrame(), undefined);
+	}
+	const second = next
+		? await accepted()
+		: protocol === "tcp"
+			? await endpoint.dialTcp("acceptor")
+			: await endpoint.dialTrack("acceptor");
+	const resetReader = second instanceof Moq.socket.TcpStream ? second.consumer : second.consumer.ordered();
+	if (role === "dial") {
+		second.producer.writeFrame({ payload: new Uint8Array([48]) });
+		await assert.rejects(resetReader.readFrame());
+	} else {
+		assert.deepEqual((await resetReader.readFrame())?.payload, new Uint8Array([48]));
+		second.producer.abort(new Moq.Error.Stream(Moq.StreamCode(70)));
+	}
+	console.error(`socket verified ${protocol} ${role}`);
+	if (role === "accept") assert.equal((await commands.next()).value, "socket drained");
+} finally {
+	lines.close();
+	endpoint.close();
+	try {
+		await connection.close();
+	} finally {
+		origin.close();
+	}
+}
diff --git a/test/interop/clients/rust/socket-js.rs b/test/interop/clients/rust/socket-js.rs
new file mode 100644
index 00000000000..b0817b19441
--- /dev/null
+++ b/test/interop/clients/rust/socket-js.rs
@@ -0,0 +1,186 @@
+//! Socket convention interop through a relay, with a harness-owned drain acknowledgment.
+use anyhow::{Context, ensure};
+use moq_tokio::moq_net;
+use tokio::io::AsyncBufReadExt;
+
+#[tokio::main(flavor = "current_thread")]
+async fn main() -> anyhow::Result<()> {
+	let args: Vec<_> = std::env::args().collect();
+	ensure!(
+		args.len() == 6,
+		"usage: interop-socket-js dial|accept URL PREFIX tcp|track VERSION"
+	);
+	let dial = match args[1].as_str() {
+		"dial" => true,
+		"accept" => false,
+		_ => anyhow::bail!("unknown role"),
+	};
+	let tcp = match args[4].as_str() {
+		"tcp" => true,
+		"track" => false,
+		_ => anyhow::bail!("unknown protocol"),
+	};
+	let mut config = moq_tokio::connect::Config::default();
+	config.version.push(args[5].parse().map_err(anyhow::Error::msg)?);
+	config.websocket.enabled = Some(false);
+	let client = config.init(Default::default())?.with_reconnect(false);
+	let origin = moq_tokio::origin::spawn();
+	let endpoint = moq_net::socket::Endpoint::new(&origin, args[3].as_str(), if dial { "dialer" } else { "acceptor" })?;
+	if !dial {
+		let waiter = kio::Waiter::noop();
+		if tcp {
+			ensure!(endpoint.poll_accept_tcp(&waiter).is_pending());
+		} else {
+			ensure!(endpoint.poll_accept_track(&waiter).is_pending());
+		}
+	}
+	let connection = client
+		.clone()
+		.with_publisher(&origin)
+		.with_subscriber(origin.clone())
+		.connect(args[2].parse::<url::Url>()?)
+		.established()
+		.await?;
+	if !dial {
+		println!("socket ready");
+	}
+	// Probe refusal before data sessions can generate late queries for closed halves.
+	if dial {
+		if tcp {
+			ensure!(endpoint.dial_tcp("acceptor")?.await.is_err(), "rejected dial connected");
+		} else {
+			ensure!(
+				endpoint.dial_track("acceptor", None)?.await.is_err(),
+				"rejected dial connected"
+			);
+		}
+	} else if tcp {
+		endpoint.accept_tcp().await?.reject();
+	} else {
+		endpoint.accept_track().await?.reject();
+	}
+	let own: u8 = if dial { 16 } else { 32 };
+	let peer: u8 = if dial { 32 } else { 16 };
+	let _hold: Box<dyn std::any::Any> = if tcp {
+		let mut stream = if dial {
+			endpoint.dial_tcp("acceptor")?.await?
+		} else {
+			accepted_tcp(&endpoint).await?
+		};
+		ensure!(stream.peer() == if dial { "acceptor" } else { "dialer" });
+		ensure!(stream.session().len() == 32);
+		for i in 0..3 {
+			stream.producer.write_frame(None, vec![own + i])?;
+		}
+		stream.producer.finish()?;
+		for i in 0..3 {
+			let frame = stream.consumer.read_frame().await?.context("short TCP half")?;
+			ensure!(frame.payload.as_ref() == [peer + i], "wrong TCP frame");
+		}
+		ensure!(stream.consumer.read_frame().await?.is_none(), "extra TCP frame");
+		Box::new(stream)
+	} else {
+		let mut stream = if dial {
+			endpoint.dial_track("acceptor", None)?.await?
+		} else {
+			accepted_track(&endpoint).await?
+		};
+		ensure!(stream.peer() == if dial { "acceptor" } else { "dialer" });
+		ensure!(stream.session().len() == 32);
+		let mut reader = stream.consumer.ordered();
+		for i in 0..3 {
+			if dial {
+				stream.producer.write_frame(None, vec![own + i])?;
+			}
+			let mut group = reader.next_group().await?.context("short track half")?;
+			ensure!(group.sequence == u64::from(i), "wrong group sequence");
+			let frame = group.read_frame().await?.context("empty track message")?;
+			ensure!(frame.payload.as_ref() == [peer + i], "wrong track frame");
+			ensure!(group.read_frame().await?.is_none(), "extra frame in track message");
+			if !dial {
+				stream.producer.write_frame(None, vec![own + i])?;
+			}
+		}
+		stream.producer.finish()?;
+		ensure!(reader.next_group().await?.is_none(), "extra track frame");
+		Box::new((stream.producer, reader))
+	};
+	eprintln!("socket data verified {} {}", args[4], args[1]);
+	if tcp {
+		let mut reset = if dial {
+			endpoint.dial_tcp("acceptor")?.await?
+		} else {
+			accepted_tcp(&endpoint).await?
+		};
+		if dial {
+			reset.producer.write_frame(None, vec![48])?;
+			ensure!(reset.consumer.read_frame().await.is_err(), "TCP RST became FIN");
+			eprintln!("socket reset verified tcp dial");
+		} else {
+			ensure!(
+				reset
+					.consumer
+					.read_frame()
+					.await?
+					.context("missing reset signal")?
+					.payload
+					.as_ref() == [48]
+			);
+			reset.producer.abort(moq_net::Error::App(6))?;
+		}
+	} else {
+		let mut reset = if dial {
+			endpoint.dial_track("acceptor", None)?.await?
+		} else {
+			accepted_track(&endpoint).await?
+		};
+		let mut reader = reset.consumer.ordered();
+		if dial {
+			reset.producer.write_frame(None, vec![48])?;
+			ensure!(reader.next_group().await.is_err(), "track RST became FIN");
+			eprintln!("socket reset verified track dial");
+		} else {
+			let mut group = reader.next_group().await?.context("missing reset signal")?;
+			ensure!(
+				group
+					.read_frame()
+					.await?
+					.context("empty reset signal")?
+					.payload
+					.as_ref() == [48]
+			);
+			reset.producer.abort(moq_net::Error::App(6))?;
+		}
+	}
+	eprintln!("socket verified {} {}", args[4], args[1]);
+	if !dial {
+		let mut lines = tokio::io::BufReader::new(tokio::io::stdin()).lines();
+		ensure!(
+			lines.next_line().await?.as_deref() == Some("socket drained"),
+			"peer did not drain"
+		);
+	}
+	endpoint.close();
+	let _ = connection.close().await;
+	client.close().await;
+	Ok(())
+}
+
+// An Incoming's claimed original dial can disappear before verification.
+async fn accepted_tcp(endpoint: &moq_net::socket::Endpoint) -> anyhow::Result<moq_net::socket::TcpStream> {
+	loop {
+		let incoming = endpoint.accept_tcp().await?;
+		if let Ok(stream) = incoming.accept().await {
+			return Ok(stream);
+		}
+	}
+}
+
+async fn accepted_track(endpoint: &moq_net::socket::Endpoint) -> anyhow::Result<moq_net::socket::TrackStream> {
+	loop {
+		let incoming = endpoint.accept_track().await?;
+		if let Ok(stream) = incoming.accept(None).await {
+			return Ok(stream);
+		}
+	}
+}
diff --git a/test/interop/interop.sh b/test/interop/interop.sh
index 08bc6baa5da..a306a9cf400 100755
--- a/test/interop/interop.sh
+++ b/test/interop/interop.sh
@@ -76,6 +76,7 @@ MEDIA_CASES=""
 MEDIA_ENGINES="chromium"
 MEDIA_PUBLISHER="chromium"
 TAIL_ONLY=0
+SOCKET_ONLY=0
 FINISH_ONLY=0
 # The versions the matrix runs on, one pass each. `auto` leaves every client its defaults,
 # except the clients the harness reads a grant from, which offer $AUTH_VERSION alone. Any other
@@ -130,6 +131,11 @@ while [[ $# -gt 0 ]]; do
             TAIL_ONLY=1
             shift
             ;;
+        --sockets)
+            SOCKET_ONLY=1
+            TAIL_ONLY=1
+            shift
+            ;;
         --versions)
             require_value "$@"
             VERSIONS="$2"
@@ -176,6 +182,11 @@ if [[ -n "$MEDIA_CASES" && "$MEDIA" -ne 1 ]]; then
     exit 2
 fi
 
+if [[ "$SOCKET_ONLY" -eq 1 && "$VERSIONS" != auto ]]; then
+    echo "error: --sockets pins moq-lite-07-wip; omit --versions" >&2
+    exit 2
+fi
+
 # Numeric guards so a fat-fingered --timeout / INTEROP_PORT fails clearly here
 # instead of surfacing later as a cryptic `timeout` or relay-bind error.
 [[ "$TIMEOUT" =~ ^[0-9]+(\.[0-9]+)?$ ]] || {
@@ -455,6 +466,9 @@ media_publisher() {
     esac
 }
 
+# shellcheck source-path=SCRIPTDIR source=socket.sh
+source "$INTEROP_DIR/socket.sh"
+
 # Record every case this run will reach as `not run`, before any build, so one the run
 # never reaches still shows in the report. Mirrors the dispatch at the end of this file.
 plan_cases() {
@@ -467,6 +481,10 @@ plan_cases() {
         for sub in "${SUB_LIST[@]}"; do record "not run" case="no publisher" publisher=none subscriber="$sub"; done
         return
     fi
+    if [[ "$SOCKET_ONLY" -eq 1 ]]; then
+        plan_js_sockets
+        return
+    fi
     for VERSION in "${VERSION_LIST[@]}"; do plan_pass; done
     VERSION=auto
 }
@@ -528,6 +546,7 @@ plan_pass() {
         fi
     done
     [[ "$VERSION" == auto ]] || return 0
+    plan_js_sockets
     for runtime in js-native-node js-native-bun; do
         needs "$runtime" || continue
         for version in "${COMPRESS_VERSIONS[@]}"; do
@@ -634,7 +653,7 @@ build_relay_cli() {
         INTEROP_SUB_MOQ="$HARNESS_RUN/bin/moq-sub"
     fi
     if [[ "$build_examples" -eq 1 && "$MEDIA" -eq 0 ]]; then
-        local example args=() examples=(interop-socket interop-tail interop-catalog interop-audio interop-hls interop-control interop-goaway interop-goaway-client interop-finish)
+        local example args=() examples=(interop-socket interop-tail interop-socket-js interop-catalog interop-audio interop-hls interop-control interop-goaway interop-goaway-client interop-finish)
         for example in "${examples[@]}"; do args+=(--example "$example"); done
         (cd "$WORKSPACE" && cargo build --locked ${flag[@]+"${flag[@]}"} -p moq-cli "${args[@]}")
         for example in "${examples[@]}"; do
@@ -2556,6 +2575,7 @@ run_tails() {
     done
     # The compress, compressed catalog, and drop lanes pin their own versions.
     [[ "$VERSION" == auto ]] || return 0
+    run_js_sockets
     for runtime in js-native-node js-native-bun; do
         needs "$runtime" || continue
         run_replacement_case "$runtime" websocket
@@ -2599,6 +2619,8 @@ elif [[ "$NEGATIVE" -eq 1 ]]; then
     # no data), proving the harness can actually report failure.
     echo "=== negative control: subscribers expect NO data ==="
     run_round "none" "interop-missing-$$-$RANDOM.hang" "" nothing "$(relay_next_line)"
+elif [[ "$SOCKET_ONLY" -eq 1 ]]; then
+    run_js_sockets
 else
     for VERSION in "${VERSION_LIST[@]}"; do
         LOGS="$HARNESS_RUN"
diff --git a/test/interop/socket.sh b/test/interop/socket.sh
new file mode 100644
index 00000000000..42fd013e36c
--- /dev/null
+++ b/test/interop/socket.sh
@@ -0,0 +1,91 @@
+# Socket pairs use the relay and signed endpoint grants prepared by interop.sh.
+# shellcheck shell=bash
+# shellcheck disable=SC2034 # overall is the interop runner's shared verdict.
+
+# shellcheck disable=SC2329 # called by harness_spawn
+run_socket_client() {
+    local runtime="$1"
+    shift
+    case "$runtime" in
+        rust) timeout -k 3 "$TIMEOUT" "$EXAMPLES/interop-socket-js" "$@" ;;
+        js-native-node) (cd "$CLIENTS/js-native" && timeout -k 3 "$TIMEOUT" node --import tsx socket.ts "$@") ;;
+        js-native-bun) (cd "$CLIENTS/js-native" && timeout -k 3 "$TIMEOUT" bun socket.ts "$@") ;;
+    esac
+}
+
+# shellcheck disable=SC2329 # called by harness_spawn
+run_socket_acceptor() {
+    local events="$1" ack="$2"
+    shift 2
+    run_socket_client "$@" <"$ack" >"$events" 8>&- 9>&-
+}
+
+run_socket_pair() {
+    local dialer="$1" acceptor="$2" protocol="$3" version="$4" started=$SECONDS from pid dial_pid ready
+    local name="socket-$protocol-$dialer-$acceptor-$version" prefix="socket-$protocol-$dialer-$acceptor-$version-$$-$RANDOM"
+    local events="$LOGS/socket-events" ack="$LOGS/socket-ack"
+    local cell=(case="socket $protocol" publisher="$dialer" subscriber="$acceptor" version="$version" log="$LOGS/$name-dial.log")
+    if is_broken "$dialer" || is_broken "$acceptor"; then
+        record fail "${cell[@]}" detail="client unavailable"
+        overall=1
+        return
+    fi
+    mkfifo "$events" "$ack"
+    exec 8<>"$events" 9<>"$ack"
+    from=$(relay_next_line)
+    # Grant each peer only its own route and the shared socket subtree.
+    harness_spawn "$name-accept" "$LOGS/$name-accept.log" run_socket_acceptor "$events" "$ack" "$acceptor" accept \
+        "$(token_url --root "$prefix" --publish '.socket/acceptor' --subscribe '.socket/**')" "$prefix" "$protocol" "$version"
+    pid="$HARNESS_PID"
+    if IFS= read -r -t "$TIMEOUT" ready <&8 && [[ "$ready" == 'socket ready' ]]; then
+        harness_spawn "$name-dial" "$LOGS/$name-dial.log" run_socket_client "$dialer" dial \
+            "$(token_url --root "$prefix" --publish '.socket/dialer' --subscribe '.socket/**')" "$prefix" "$protocol" "$version"
+        dial_pid="$HARNESS_PID"
+        harness_wait "$dial_pid" || true
+        if grep -qx "socket verified $protocol dial" "$LOGS/$name-dial.log"; then
+            printf 'socket drained\n' >&9
+            harness_wait "$pid" || true
+            if grep -qx "socket verified $protocol accept" "$LOGS/$name-accept.log" && check_versions "$name" "$from" "$version"; then
+                echo "  PASS  socket $protocol $dialer -> $acceptor $version"
+                record pass "${cell[@]}" seconds=$((SECONDS - started))
+                exec 8>&- 9>&-
+                rm "$events" "$ack"
+                return
+            fi
+        fi
+    fi
+    echo "  FAIL  socket $protocol $dialer -> $acceptor $version"
+    record fail "${cell[@]}" seconds=$((SECONDS - started)) detail="socket handshake, payload, or FIN failed"
+    overall=1
+    harness_reap "$pid"
+    cat "$LOGS/$name-accept.log"
+    [[ ! -f "$LOGS/$name-dial.log" ]] || cat "$LOGS/$name-dial.log"
+    exec 8>&- 9>&-
+    rm "$events" "$ack"
+}
+
+socket_pairs() {
+    local action="$1" runtime protocol
+    local version=moq-lite-07-wip
+    for runtime in js-native-node js-native-bun; do
+        needs "$runtime" || continue
+        for protocol in tcp track; do
+            "$action" rust "$runtime" "$protocol" "$version"
+            "$action" "$runtime" rust "$protocol" "$version"
+        done
+    done
+}
+
+# shellcheck disable=SC2329 # called by socket_pairs
+plan_socket_pair() {
+    record "not run" case="socket $3" publisher="$1" subscriber="$2" version="$4"
+}
+
+plan_js_sockets() {
+    socket_pairs plan_socket_pair
+}
+
+run_js_sockets() {
+    echo '=== sockets ==='
+    socket_pairs run_socket_pair
+}

From 0672ad56ce29ae168c7122fe6ece20de08cdc12a Mon Sep 17 00:00:00 2001
From: Luke Curley <kixelated@gmail.com>
Date: Fri, 6 Nov 2026 01:56:20 +0000
Subject: [PATCH 36/36] fix(net)!: route a datagram that shares a packet with
 its answer or its end (#7951)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: quest fixer <quest-fixer@localhost>
---
 c/moq/MIGRATE.md                         |   5 +
 dart/moq_ffi/lib/src/moq.dart            |  14 +
 doc/lib/c/index.md                       |   2 +-
 doc/lib/dart/index.md                    |   2 +-
 doc/lib/go/index.md                      |   2 +-
 doc/lib/kt/index.md                      |   2 +-
 doc/lib/py/index.md                      |   2 +-
 doc/lib/swift/index.md                   |   2 +-
 go/wrapper/records.go                    |   4 +
 js/net/api/index.api.md                  |   1 +
 js/net/src/connection/stats.test.ts      |   5 +-
 js/net/src/connection/stats.ts           |   7 +
 js/net/src/lite/connection.ts            |   4 +-
 js/net/src/lite/datagram-tracks.test.ts  | 315 ++++++++++++++-
 js/net/src/lite/subscriber.ts            | 128 +++++-
 py/moq-rs/moq/_records.py                |   3 +
 quest/m1/datagram-tracks/README.md       |   1 -
 quest/m1/datagram-tracks/answer-race.md  |  57 ---
 quest/m2/recut-held.md                   |   1 -
 rs/moq-c/MIGRATE.md                      |   5 +
 rs/moq-c/src/api.rs                      |   9 +
 rs/moq-ffi/src/session.rs                |   6 +
 rs/moq-net/src/client.rs                 |   3 +
 rs/moq-net/src/lite/session.rs           |   5 +
 rs/moq-net/src/lite/subscriber.rs        | 487 +++++++++++++++++++----
 rs/moq-net/src/server.rs                 |   3 +
 rs/moq-net/src/session.rs                |  31 +-
 rs/moq-net/tests/integration/datagram.rs | 148 +++++++
 28 files changed, 1096 insertions(+), 158 deletions(-)
 delete mode 100644 quest/m1/datagram-tracks/answer-race.md

diff --git a/c/moq/MIGRATE.md b/c/moq/MIGRATE.md
index 4326d19c6d0..98cd2db4c41 100644
--- a/c/moq/MIGRATE.md
+++ b/c/moq/MIGRATE.md
@@ -4,6 +4,11 @@ How to update your code for each breaking change, newest first.
 
 ## Unreleased
 
+### `moq_connection_stats` counts unrouted datagrams ([#7951](https://github.com/moq-dev/moq/pull/7951))
+
+`moq_connection_stats` gains `datagrams_unrouted` and `datagrams_unrouted_valid` at its end, which changes its ABI: recompile against the new header.
+`datagrams_unrouted` counts the datagrams received for a subscription with no datagram track, and is valid on versions with datagrams (moq-lite 05 and newer).
+
 ### Socket sessions
 
 The generated socket endpoint, incoming dial, and stream handles now expose TCP group halves and reliably subscribed track halves beside origin. Regenerate bindings and rebuild the matching native library together. Existing callers need no migration. Socket endpoints require lite-07 or moq-transport on every hop; there is no wire change.
diff --git a/dart/moq_ffi/lib/src/moq.dart b/dart/moq_ffi/lib/src/moq.dart
index c3864781f9b..e157887146f 100644
--- a/dart/moq_ffi/lib/src/moq.dart
+++ b/dart/moq_ffi/lib/src/moq.dart
@@ -4160,6 +4160,7 @@ class MoqConnectionStats {
   final int? packetsReceived;
   final int? packetsLost;
   final String? version;
+  final int? datagramsUnrouted;
   MoqConnectionStats({
     this.rtt,
     this.estimatedSendRateBps,
@@ -4170,6 +4171,7 @@ class MoqConnectionStats {
     this.packetsReceived,
     this.packetsLost,
     this.version = null,
+    this.datagramsUnrouted = null,
   });
 }
 
@@ -4225,6 +4227,11 @@ class FfiConverterMoqConnectionStats {
     );
     final version = version_lifted.value;
     new_offset += version_lifted.bytesRead;
+    final datagramsUnrouted_lifted = FfiConverterOptionalUInt64.read(
+      Uint8List.view(buf.buffer, new_offset),
+    );
+    final datagramsUnrouted = datagramsUnrouted_lifted.value;
+    new_offset += datagramsUnrouted_lifted.bytesRead;
     return LiftRetVal(
       MoqConnectionStats(
         rtt: rtt,
@@ -4236,6 +4243,7 @@ class FfiConverterMoqConnectionStats {
         packetsReceived: packetsReceived,
         packetsLost: packetsLost,
         version: version,
+        datagramsUnrouted: datagramsUnrouted,
       ),
       new_offset - buf.offsetInBytes,
     );
@@ -4252,6 +4260,7 @@ class FfiConverterMoqConnectionStats {
         FfiConverterOptionalUInt64.allocationSize(value.packetsReceived) +
         FfiConverterOptionalUInt64.allocationSize(value.packetsLost) +
         FfiConverterOptionalString.allocationSize(value.version) +
+        FfiConverterOptionalUInt64.allocationSize(value.datagramsUnrouted) +
         0;
     final buf = Uint8List(total_length);
     write(value, buf);
@@ -4296,6 +4305,10 @@ class FfiConverterMoqConnectionStats {
       value.version,
       Uint8List.view(buf.buffer, new_offset),
     );
+    new_offset += FfiConverterOptionalUInt64.write(
+      value.datagramsUnrouted,
+      Uint8List.view(buf.buffer, new_offset),
+    );
     return new_offset - buf.offsetInBytes;
   }
 
@@ -4309,6 +4322,7 @@ class FfiConverterMoqConnectionStats {
         FfiConverterOptionalUInt64.allocationSize(value.packetsReceived) +
         FfiConverterOptionalUInt64.allocationSize(value.packetsLost) +
         FfiConverterOptionalString.allocationSize(value.version) +
+        FfiConverterOptionalUInt64.allocationSize(value.datagramsUnrouted) +
         0;
   }
 }
diff --git a/doc/lib/c/index.md b/doc/lib/c/index.md
index 9bd3e9c4f3f..ebb435ee7d7 100644
--- a/doc/lib/c/index.md
+++ b/doc/lib/c/index.md
@@ -120,7 +120,7 @@ inside. The header is the reference: each function carries a doc comment.
 - **JSON values.** `moq_consume_json_value` fills `moq_json_value` with the document and its frame's timestamp. A snapshot consumer's callback fires for each state in order, but a group superseded before it is read is skipped.
 - **JSON windows.** `moq_publish_json_window` publishes a sliding run of records: `moq_publish_json_window_push` appends at the back, `moq_publish_json_window_pop` drops from the front, and `moq_publish_json_window_cut` closes the open group at a natural boundary. The catalog has no window mode, so a reader names the track. `moq_consume_json_window_event` fills `moq_json_window_event` with a push (the record at `start`, in `json`), a pop of `[start, end)`, or a skip of `[start, end)` that this reader joined too late to receive. Set `checkpoint_records` to bound what each new group restates for a window you never pop.
 - **Decoded reads.** `moq_decode_audio` and `moq_decode_video` deliver read ids in order: a frame, a gap where media was lost, or an end where the publisher stopped its encoder. Check `kind` on what `moq_decode_audio_read` or `moq_decode_video_read` writes. Free each id with `moq_decode_audio_read_free` or `moq_decode_video_read_free` promptly: a held video frame holds a decoder buffer, and the decoder stalls. A decoder reads everything the track still holds unless a live player sets `start` to `MOQ_DECODE_START_LATEST`, which joins at the newest group and skips the cached backlog. A decoder setup refusal reports `MOQ_ERROR_UNSUPPORTED_CONFIG` on its terminal callback, so the caller can try another rendition; later peer or decode failures retain their own error codes.
-- **Stats.** `moq_session_stats()` fills `moq_connection_stats` with `rtt_us`, `estimated_send_rate_bps`, and the byte and packet counters (`bytes_sent`, `bytes_received`, `bytes_lost`, `packets_sent`, `packets_received`, `packets_lost`). Each has a `<field>_valid` flag, false when the transport does not report it, which is not the same as zero. `moq_session_snapshot()` adds the negotiated `protocol`. A failed dial or dropped connection reaches the session's `on_state` with its `failure` code, and `moq_error()` gives the reason during that callback. Hold the handle returned by `moq_session_recv_bandwidth()` to request receive estimates. `moq_bandwidth_consumer_peek()` reads the estimate and `moq_bandwidth_consumer_changed()` waits for a change. `moq_bandwidth_consumer_close()` releases demand; the last consumer stops PROBE. Stats snapshots do not request it.
+- **Stats.** `moq_session_stats()` fills `moq_connection_stats` with `rtt_us`, `estimated_send_rate_bps`, and the byte and packet counters (`bytes_sent`, `bytes_received`, `bytes_lost`, `packets_sent`, `packets_received`, `packets_lost`), and `datagrams_unrouted`, the datagrams received for a subscription with no datagram track, reported only on moq-lite 05 and later, which carry datagrams. Each has a `<field>_valid` flag, false when the transport does not report it, which is not the same as zero. `moq_session_snapshot()` adds the negotiated `protocol`. A failed dial or dropped connection reaches the session's `on_state` with its `failure` code, and `moq_error()` gives the reason during that callback. Hold the handle returned by `moq_session_recv_bandwidth()` to request receive estimates. `moq_bandwidth_consumer_peek()` reads the estimate and `moq_bandwidth_consumer_changed()` waits for a change. `moq_bandwidth_consumer_close()` releases demand; the last consumer stops PROBE. Stats snapshots do not request it.
 - **Viewers.** `moq_session_viewers()` returns a handle that divides the receive estimate among the broadcasts you watch, max-min fair by each one's ceiling. `moq_viewers_watch()` returns a viewer claiming up to `max_bps`, the bitrate of the largest rendition you would switch to; `moq_viewer_rate()` reads its share in bits per second, with `present` false while there is no estimate (keep the current rendition), and `moq_viewer_update()` changes the ceiling. Holding a viewer requests the estimate like a `moq_session_recv_bandwidth()` consumer, and `moq_viewer_close()` releases the claim. The session sends the summed ceilings as its PROBE target; `moq_viewers_set_target()` with `present` true overrides that, a `0` target sends none, and `present` false follows the viewers again. `moq_viewers_watch()`, `moq_viewer_update()`, and `moq_viewers_set_target()` return `MOQ_ERROR_OUT_OF_RANGE`, changing nothing, when the ceilings or the target would pass 2^53 - 1 bps, the most a PROBE target carries. `moq_viewers_close()` releases the registry handle; viewers watched through it stay until each is closed.
 - **Demand.** A watcher from `moq_publish_track_demand()` (or the media, video, and audio variants) calls back `MOQ_DEMAND_WANTED` or `MOQ_DEMAND_UNWANTED`, again whenever the wanted group moves. `moq_publish_demand_wanted()` reads that group: start a new one once it passes your largest. Set `refresh` in `moq_track_info` to have a joining subscriber ask for a new group once the newest has grown past `refresh` times its first frame. A producer publishes everything you write, subscribed or not, so a late subscriber can fetch the recent past. Capturing only while the watcher reports `MOQ_DEMAND_WANTED` is an opt-in that saves the encode but leaves nothing from before the first subscriber.
 - **Disabled renditions.** Audio and video consumers and decoders reject a rendition with `enabled: false`. Query the latest catalog with `moq_consume_audio_enabled` or `moq_consume_video_enabled` before selecting a rendition and opening a decoder. Among the video renditions you can decode, prefer the highest `preference`; `0` is the default and `-1` marks a compatibility transcode.
diff --git a/doc/lib/dart/index.md b/doc/lib/dart/index.md
index dff6b40a757..abfc1fe159c 100644
--- a/doc/lib/dart/index.md
+++ b/doc/lib/dart/index.md
@@ -156,7 +156,7 @@ shows which module holds each.
 - **Decoded frames hold decoder buffers.** `dispose()` each frame from a `video.Consumer` promptly rather than waiting for the garbage collector, or the decoder stalls. `resize` is best effort, so read each frame's `width()` and `height()`.
 - **Closing.** `await moq.close()` drains for up to one second and reports its result. `session.shutdown()` requests the drain synchronously; `await session.closed()` waits for its result. `session.cancel(code: 0)` closes at once. Finish or abort live tracks first. Awaiting cancellation of an announcement, grant, or request subscription releases its pending native read. Announcements and grants also release their consumer; server listeners leave their shared server usable. moq-lite-05 and newer wait for the peer to receive finished tails; older Lite versions and IETF wait only for transport ACKs.
 - **Ending cleanly.** When the input ends, finish every track, then call `finish()` on its `CatalogProducer` to finish the catalog, which ends the content. The broadcast stays announced and keeps serving the finished tracks, so a subscriber still catching up can drain them, until `broadcast.close()` or disposing its `MoqRoute` takes it offline. How long to keep it up is yours to decide. A track still open at the close, or released without a finish, ends with `Unroutable` (`Internal` over moq-transport, which has no such code). Readers follow a publisher's runs by announcement, not by that error: see [identity and recovery](/concept/identity).
-- **Stats.** `session.stats()` reports `rtt`, `estimatedSendRateBps`, and the byte and packet counters (`bytesSent`, `bytesReceived`, `bytesLost`, `packetsSent`, `packetsReceived`, `packetsLost`). A field is `null` when the transport does not report it, which is not the same as zero. `version` names the negotiated protocol. Connect returns a connecting session; read its coherent `state()` snapshot and wait with that snapshot's revision to observe first-dial failures and reconnects. Each watcher keeps its own revision. Hold the owned `BandwidthConsumer` returned by `session.recvBandwidth()` to receive bandwidth estimates. `rate()` reads the current estimate in bits per second and `rateChanged()` waits for a new one. Release the consumer or call `cancel()` when finished; releasing the last consumer stops PROBE; the session and stats snapshots do not request it. Client consumers survive reconnects and report no estimate while disconnected.
+- **Stats.** `session.stats()` reports `rtt`, `estimatedSendRateBps`, and the byte and packet counters (`bytesSent`, `bytesReceived`, `bytesLost`, `packetsSent`, `packetsReceived`, `packetsLost`), and `datagramsUnrouted`, the datagrams received for a subscription with no datagram track, reported only on moq-lite 05 and later, which carry datagrams. A field is `null` when the transport does not report it, which is not the same as zero. `version` names the negotiated protocol. Connect returns a connecting session; read its coherent `state()` snapshot and wait with that snapshot's revision to observe first-dial failures and reconnects. Each watcher keeps its own revision. Hold the owned `BandwidthConsumer` returned by `session.recvBandwidth()` to receive bandwidth estimates. `rate()` reads the current estimate in bits per second and `rateChanged()` waits for a new one. Release the consumer or call `cancel()` when finished; releasing the last consumer stops PROBE; the session and stats snapshots do not request it. Client consumers survive reconnects and report no estimate while disconnected.
 - **Viewers.** `client.viewers()` divides the connection's receive estimate among the broadcasts you watch, max-min fair by each one's ceiling. `watch(maxBps: ...)` returns a `Viewer` claiming up to what the largest rendition the player would switch to needs; `rate()` reads its slice in bits per second, `null` while there is no estimate, so hold the current selection. `update(maxBps: ...)` changes the ceiling, such as when the catalog enables or disables a rendition. Holding a viewer requests PROBE, and the session sends the viewers' summed ceilings as the PROBE target; `dispose()` it once the broadcast stops being watched. `setTarget(targetBps: ...)` sends another target, `0` sends none, and `null` follows the viewers again. Ceilings or a target past 2^53 - 1 bps, the most a PROBE target carries, throw `OutOfRangeMoqException`. Client viewers survive reconnects and read `null` while disconnected.
 - **Authorization.** On `moq-lite-07-wip` (opt in with `ConnectOptions(versions: ...)`) and on moq-transport draft-18+ with the [MoQ Auth extension](/draft/moq-auth), listen to `moq.grants().updates()` for the `Grant` the relay sent back and each change, `null` until it answers and while a client session reconnects.
 - **Tokens.** Pass `ConnectOptions(tokens: [...])` instead of putting the credential in the URL. The first is the connection credential, sent in SETUP and, while an offered version can't carry it there (lite before 07), as the URL's `?jwt=`; each other token widens the grant over AUTH. `moq.tokens().set_(tokens: [...])` replaces them before they expire: the next dial presents them, a live AUTH session at once, and after an authorization refusal the session redials only if they changed. `await tokens().answered()` returns once the relay accepts them and throws its refusal with the relay's code. A `?jwt=` already in the URL stays the connection credential, which is how to reach a relay older than this release.
diff --git a/doc/lib/go/index.md b/doc/lib/go/index.md
index 219ac0e1a66..563210798c9 100644
--- a/doc/lib/go/index.md
+++ b/doc/lib/go/index.md
@@ -133,7 +133,7 @@ shows which module holds each.
 - **Decoded frames hold decoder buffers.** `Close` each `VideoDecodedFrame` promptly, or the decoder stalls. `Resize` is best effort, so read each frame's `Width()` and `Height()`.
 - **Closing.** `client.Close()` drains for up to one second and returns an error on failure. `session.Shutdown()` requests that drain immediately; `session.Closed(ctx)` waits for its result, and `session.Cancel(code)` closes at once. Finish or abort live tracks first. moq-lite-05 and newer wait for the peer to receive finished tails; older Lite versions and IETF wait only for transport ACKs.
 - **Ending cleanly.** When the input ends, finish every track, then call `Finish()` on its `media.CatalogProducer` to finish the catalog, which ends the content. The broadcast stays announced and keeps serving the finished tracks, so a subscriber still catching up can drain them, until `broadcast.Close()` takes it offline. How long to keep it up is yours to decide. A track still open at the close, or released without a finish, ends with `Unroutable` (`Internal` over moq-transport, which has no such code). Readers follow a publisher's runs by announcement, not by that error: see [identity and recovery](/concept/identity).
-- **Stats.** `Session().Stats()` reports `RTT`, `EstimatedSendRateBps`, and the byte and packet counters (`BytesSent`, `BytesReceived`, `BytesLost`, `PacketsSent`, `PacketsReceived`, `PacketsLost`). A field is nil when the transport does not report it, which is not the same as zero. `Version` names the negotiated protocol. `Dial` returns a connecting session; read `Session().State()` and wait with `StateChanged(ctx, state.Revision)` to observe first-dial failures and reconnects. Hold the owned `BandwidthConsumer` returned by `Session().RecvBandwidth()` to receive bandwidth estimates. `Rate()` reads the current estimate in bits per second and `RateChanged(ctx)` waits for a new one. Calling `Close()` on the last consumer stops PROBE; the session and stats snapshots do not request it. Client consumers survive reconnects and report no estimate while disconnected.
+- **Stats.** `Session().Stats()` reports `RTT`, `EstimatedSendRateBps`, and the byte and packet counters (`BytesSent`, `BytesReceived`, `BytesLost`, `PacketsSent`, `PacketsReceived`, `PacketsLost`), and `DatagramsUnrouted`, the datagrams received for a subscription with no datagram track, reported only on moq-lite 05 and later, which carry datagrams. A field is nil when the transport does not report it, which is not the same as zero. `Version` names the negotiated protocol. `Dial` returns a connecting session; read `Session().State()` and wait with `StateChanged(ctx, state.Revision)` to observe first-dial failures and reconnects. Hold the owned `BandwidthConsumer` returned by `Session().RecvBandwidth()` to receive bandwidth estimates. `Rate()` reads the current estimate in bits per second and `RateChanged(ctx)` waits for a new one. Calling `Close()` on the last consumer stops PROBE; the session and stats snapshots do not request it. Client consumers survive reconnects and report no estimate while disconnected.
 - **Viewers.** `Session().Viewers()` divides the connection's receive estimate among the broadcasts you watch, max-min fair by each one's ceiling. `Watch(maxBps)` returns a `Viewer` claiming up to what the largest rendition the player would switch to needs; `Rate()` reads its slice in bits per second, nil while there is no estimate, so hold the current selection. `Update(maxBps)` changes the ceiling, such as when the catalog enables or disables a rendition. Holding a viewer requests PROBE, and the session sends the viewers' summed ceilings as the PROBE target; `Close()` it once the broadcast stops being watched, from the goroutine that last used it. `SetTarget(&bps)` sends another target, zero sends none, and nil follows the viewers again. `Watch`, `Update`, and `SetTarget` return `moq.ErrOutOfRange` when the ceilings or the target would pass 2^53 - 1 bps, the most a PROBE target carries. Client viewers survive reconnects and read nil while disconnected.
 - **Authorization.** On `moq-lite-07-wip` (opt in with `ClientConfig.Versions`) and on moq-transport draft-18+ with the [MoQ Auth extension](/draft/moq-auth), `Session().Grants()` returns a `GrantConsumer`: `Grant()` is the `Grant` the relay sent back, nil until it answers and while a client session reconnects, and `Changed(ctx)` waits for the next one. `Close()` it when done.
 - **Tokens.** Set `ClientConfig.Tokens` instead of putting the credential in the URL. The first is the connection credential, sent in SETUP and, while an offered version can't carry it there (lite before 07), as the URL's `?jwt=`; each other token widens the grant over AUTH. `Session().Tokens().Set(...)` replaces a client session's tokens before they expire: the next dial presents them, a live AUTH session at once, and after an authorization refusal the session redials only if they changed. `Answered(ctx)` returns nil once the relay accepts them, or its refusal with the relay's code. A `?jwt=` already in the URL stays the connection credential, which is how to reach a relay older than this release.
diff --git a/doc/lib/kt/index.md b/doc/lib/kt/index.md
index fb5954f5116..d0892470e57 100644
--- a/doc/lib/kt/index.md
+++ b/doc/lib/kt/index.md
@@ -109,7 +109,7 @@ shows which module holds each.
 - **Decoded frames hold decoder buffers.** `close()` each frame from a `dev.moq.video.Consumer` promptly (or `use { }` it), or the decoder stalls. `resize` is best effort, so read each frame's `width()` and `height()`.
 - **Closing.** `moq.shutdown()` requests a drain immediately; suspending `moq.session.closed()` waits up to one second and reports its result. `Moq.close()`, and so `use { }`, cancels at once. Finish or abort live tracks first. moq-lite-05 and newer wait for the peer to receive finished tails; older Lite versions and IETF wait only for transport ACKs.
 - **Ending cleanly.** When the input ends, finish every track, then call `finish()` on its `CatalogProducer` to finish the catalog, which ends the content. The broadcast stays announced and keeps serving the finished tracks, so a subscriber still catching up can drain them, until `broadcast.end()` takes it offline. How long to keep it up is yours to decide. A track still open at the end, or released without a finish, ends with `Unroutable` (`Internal` over moq-transport, which has no such code). Readers follow a publisher's runs by announcement, not by that error: see [identity and recovery](/concept/identity).
-- **Stats.** `session.stats()` reports `rtt`, `estimatedSendRateBps`, and the byte and packet counters (`bytesSent`, `bytesReceived`, `bytesLost`, `packetsSent`, `packetsReceived`, `packetsLost`). A field is `null` when the transport does not report it, which is not the same as zero. `version` names the negotiated protocol. Connect returns a connecting session; read its coherent `state()` snapshot and wait with that snapshot's revision to observe first-dial failures and reconnects. Each watcher keeps its own revision. Hold the owned `BandwidthConsumer` returned by `session.recvBandwidth()` to receive bandwidth estimates. `rate()` reads the current estimate in bits per second and `rateChanged()` waits for a new one. Release the consumer or call `cancel()` when finished; releasing the last consumer stops PROBE; the session and stats snapshots do not request it. Client consumers survive reconnects and report no estimate while disconnected.
+- **Stats.** `session.stats()` reports `rtt`, `estimatedSendRateBps`, and the byte and packet counters (`bytesSent`, `bytesReceived`, `bytesLost`, `packetsSent`, `packetsReceived`, `packetsLost`), and `datagramsUnrouted`, the datagrams received for a subscription with no datagram track, reported only on moq-lite 05 and later, which carry datagrams. A field is `null` when the transport does not report it, which is not the same as zero. `version` names the negotiated protocol. Connect returns a connecting session; read its coherent `state()` snapshot and wait with that snapshot's revision to observe first-dial failures and reconnects. Each watcher keeps its own revision. Hold the owned `BandwidthConsumer` returned by `session.recvBandwidth()` to receive bandwidth estimates. `rate()` reads the current estimate in bits per second and `rateChanged()` waits for a new one. Release the consumer or call `cancel()` when finished; releasing the last consumer stops PROBE; the session and stats snapshots do not request it. Client consumers survive reconnects and report no estimate while disconnected.
 - **Viewers.** `moq.viewers()` divides the connection's receive estimate among the broadcasts you watch, max-min fair by each one's ceiling. `watch(maxBps)` returns a `Viewer` claiming up to what the largest rendition the player would switch to needs; `rate()` reads its slice in bits per second, `null` while there is no estimate, so hold the current selection. `update(maxBps)` changes the ceiling, such as when the catalog enables or disables a rendition. Holding a viewer requests PROBE, and the session sends the viewers' summed ceilings as the PROBE target; `close()` it, or leave `use { }`, once the broadcast stops being watched. `setTarget(bps)` sends another target, `0` sends none, and `null` follows the viewers again. Ceilings or a target past 2^53 - 1 bps, the most a PROBE target carries, throw `MoqException.OutOfRange`. Client viewers survive reconnects and read `null` while disconnected.
 - **Authorization.** On `moq-lite-07-wip` (opt in with `ClientConfig(versions = ...)`) and on moq-transport draft-18+ with the [MoQ Auth extension](/draft/moq-auth), collect `moq.grants().updates()` for the `Grant` the relay sent back and each change, `null` until it answers and while a client session reconnects. Ending the collection cancels the consumer.
 - **Tokens.** Pass `ClientConfig(tokens = listOf(...))` instead of putting the credential in the URL. The first is the connection credential, sent in SETUP and, while an offered version can't carry it there (lite before 07), as the URL's `?jwt=`; each other token widens the grant over AUTH. `moq.tokens().set(listOf(...))` replaces them before they expire: the next dial presents them, a live AUTH session at once, and after an authorization refusal the session redials only if they changed. Suspending `tokens().answered()` returns once the relay accepts them and throws its refusal with the relay's code. A `?jwt=` already in the URL stays the connection credential, which is how to reach a relay older than this release.
diff --git a/doc/lib/py/index.md b/doc/lib/py/index.md
index 156063cd121..64d40be8805 100644
--- a/doc/lib/py/index.md
+++ b/doc/lib/py/index.md
@@ -125,7 +125,7 @@ shows which module holds each.
 - **Decoded frames hold decoder buffers.** Drop each frame from a `moq.video.Consumer` promptly, or the decoder stalls. `resize` is best effort, so read each frame's `width()` and `height()`.
 - **Closing.** `session.shutdown()` requests a drain immediately; `await session.closed()` waits up to one second and reports its result. `cancel(code)` closes at once. Finish or abort live tracks first. moq-lite-05 and newer wait for the peer to receive finished tails; older Lite versions and IETF wait only for transport ACKs.
 - **Ending cleanly.** When the input ends, finish every track, then call `finish()` on its `moq.media.CatalogProducer` to finish the catalog, which ends the content. The broadcast stays announced and keeps serving the finished tracks, so a subscriber still catching up can drain them, until `broadcast.close()` takes it offline. How long to keep it up is yours to decide. A track still open at the close, or released without a finish, ends with `Unroutable` (`Internal` over moq-transport, which has no such code). Readers follow a publisher's runs by announcement, not by that error: see [identity and recovery](/concept/identity).
-- **Stats.** `session.stats()` reports `rtt`, `estimated_send_rate_bps`, and the byte and packet counters (`bytes_sent`, `bytes_received`, `bytes_lost`, `packets_sent`, `packets_received`, `packets_lost`). A field is `None` when the transport does not report it, which is not the same as zero. `version` names the negotiated protocol. Connect returns a connecting session; read its coherent `state()` snapshot and wait with that snapshot's revision to observe first-dial failures and reconnects. Each watcher keeps its own revision. Hold the owned `BandwidthConsumer` returned by `session.recv_bandwidth()` to receive bandwidth estimates. `rate()` reads the current estimate in bits per second and `rate_changed()` waits for a new one. Release the consumer or call `cancel()` when finished; releasing the last consumer stops PROBE; the session and stats snapshots do not request it. Client consumers survive reconnects and report no estimate while disconnected.
+- **Stats.** `session.stats()` reports `rtt`, `estimated_send_rate_bps`, and the byte and packet counters (`bytes_sent`, `bytes_received`, `bytes_lost`, `packets_sent`, `packets_received`, `packets_lost`), and `datagrams_unrouted`, the datagrams received for a subscription with no datagram track, reported only on moq-lite 05 and later, which carry datagrams. A field is `None` when the transport does not report it, which is not the same as zero. `version` names the negotiated protocol. Connect returns a connecting session; read its coherent `state()` snapshot and wait with that snapshot's revision to observe first-dial failures and reconnects. Each watcher keeps its own revision. Hold the owned `BandwidthConsumer` returned by `session.recv_bandwidth()` to receive bandwidth estimates. `rate()` reads the current estimate in bits per second and `rate_changed()` waits for a new one. Release the consumer or call `cancel()` when finished; releasing the last consumer stops PROBE; the session and stats snapshots do not request it. Client consumers survive reconnects and report no estimate while disconnected.
 - **Viewers.** `session.viewers()` divides the receive estimate among the broadcasts you watch. `watch(max_bps)` returns a `Viewer` claiming up to a ceiling, the bitrate of the largest rendition you would switch to; its `rate()` reads that viewer's fair share in bits per second, `None` while there is no estimate (keep the current rendition), and `update(max_bps)` changes the ceiling. Holding a viewer requests the estimate like `recv_bandwidth()`, and dropping it releases the claim. The session sends the summed ceilings as its PROBE target; `set_target(bps)` overrides that, `0` sends none, and `None` follows the viewers again. Ceilings or a target past 2^53 - 1 bps, the most a PROBE target carries, raise `moq.Error.OutOfRange`.
 - **Authorization.** On `moq-lite-07-wip` (opt in with `versions=`) and on moq-transport draft-18+ with the [MoQ Auth extension](/draft/moq-auth), `async for grant in session.grants()` yields the `Grant` the relay sent back and each change, `None` until it answers and while a client session reconnects. `grants().grant()` reads it once; cancelling or leaving an `async with` releases the wait.
 - **Tokens.** Pass `tokens=[...]` instead of putting the credential in the URL. The first is the connection credential, sent in SETUP and, while an offered version can't carry it there (lite before 07), as the URL's `?jwt=`; each other token widens the grant over AUTH. `session.tokens().set([...])` replaces a client session's tokens before they expire: the next dial presents them, a live AUTH session at once, and after an authorization refusal the session redials only if they changed. `await tokens.answered()` returns once the relay accepts them and raises its refusal with the relay's code. A `?jwt=` already in the URL stays the connection credential, which is how to reach a relay older than this release.
diff --git a/doc/lib/swift/index.md b/doc/lib/swift/index.md
index cd8fc07854c..7889493d3f4 100644
--- a/doc/lib/swift/index.md
+++ b/doc/lib/swift/index.md
@@ -107,7 +107,7 @@ shows which module holds each.
 - **Decoded frames hold decoder buffers.** Release each frame from a `Video.Consumer` promptly, or the decoder stalls. `resize` is best effort, so read each frame's `width()` and `height()`.
 - **Closing.** `session.shutdown()` requests a drain immediately; `try await session.closed()` waits up to one second and reports its result. `session.cancel(code:)` closes at once. Finish or abort live tracks first. moq-lite-05 and newer wait for the peer to receive finished tails; older Lite versions and IETF wait only for transport ACKs.
 - **Ending cleanly.** When the input ends, finish every track, then call `try finish()` on its `Media.CatalogProducer` to finish the catalog, which ends the content. The broadcast stays announced and keeps serving the finished tracks, so a subscriber still catching up can drain them, until `broadcast.close()`, or releasing its route, takes it offline. How long to keep it up is yours to decide. A track still open at the close, or released without a finish, ends with `Unroutable` (`Internal` over moq-transport, which has no such code). Readers follow a publisher's runs by announcement, not by that error: see [identity and recovery](/concept/identity).
-- **Stats.** `session.stats()` reports `rtt`, `estimatedSendRateBps`, and the byte and packet counters (`bytesSent`, `bytesReceived`, `bytesLost`, `packetsSent`, `packetsReceived`, `packetsLost`). A field is `nil` when the transport does not report it, which is not the same as zero. `version` names the negotiated protocol. Connect returns a connecting session; read its coherent `state()` snapshot and wait with that snapshot's revision to observe first-dial failures and reconnects. Each watcher keeps its own revision. Hold the owned `BandwidthConsumer` returned by `session.recvBandwidth()` to receive bandwidth estimates. `rate()` reads the current estimate in bits per second and `rateChanged()` waits for a new one. Release the consumer or call `cancel()` when finished; releasing the last consumer stops PROBE; the session and stats snapshots do not request it. Client consumers survive reconnects and report no estimate while disconnected.
+- **Stats.** `session.stats()` reports `rtt`, `estimatedSendRateBps`, and the byte and packet counters (`bytesSent`, `bytesReceived`, `bytesLost`, `packetsSent`, `packetsReceived`, `packetsLost`), and `datagramsUnrouted`, the datagrams received for a subscription with no datagram track, reported only on moq-lite 05 and later, which carry datagrams. A field is `nil` when the transport does not report it, which is not the same as zero. `version` names the negotiated protocol. Connect returns a connecting session; read its coherent `state()` snapshot and wait with that snapshot's revision to observe first-dial failures and reconnects. Each watcher keeps its own revision. Hold the owned `BandwidthConsumer` returned by `session.recvBandwidth()` to receive bandwidth estimates. `rate()` reads the current estimate in bits per second and `rateChanged()` waits for a new one. Release the consumer or call `cancel()` when finished; releasing the last consumer stops PROBE; the session and stats snapshots do not request it. Client consumers survive reconnects and report no estimate while disconnected.
 - **Viewers.** `session.viewers()` divides the receive estimate among the broadcasts you watch. `watch(maxBps:)` returns a `Viewer` claiming up to a ceiling, the bitrate of the largest rendition you would switch to; its `rate()` reads that viewer's fair share in bits per second, `nil` while there is no estimate (keep the current rendition), and `update(maxBps:)` changes the ceiling. Holding a viewer requests the estimate like `recvBandwidth()`, and releasing it releases the claim. The session sends the summed ceilings as its PROBE target; `setTarget(targetBps:)` overrides that, `0` sends none, and `nil` follows the viewers again. `watch`, `update`, and `setTarget` throw `MoqError.OutOfRange` when the ceilings or the target would pass 2^53 - 1 bps, the most a PROBE target carries.
 - **Authorization.** On `moq-lite-07-wip` (opt in with `Client(versions:)`) and on moq-transport draft-18+ with the [MoQ Auth extension](/draft/moq-auth), `for try await grant in session.grants()` yields the `Grant` the relay sent back and each change, `nil` until it answers and while a client session reconnects. Cancelling the iterating task cancels the native wait.
 - **Tokens.** Pass `Client(tokens: [...])` instead of putting the credential in the URL. The first is the connection credential, sent in SETUP and, while an offered version can't carry it there (lite before 07), as the URL's `?jwt=`; each other token widens the grant over AUTH. `try session.tokens()?.set([...])` replaces them before they expire: the next dial presents them, a live AUTH session at once, and after an authorization refusal the session redials only if they changed. `try await tokens.answered()` returns once the relay accepts them and throws its refusal with the relay's code. A `?jwt=` already in the URL stays the connection credential, which is how to reach a relay older than this release.
diff --git a/go/wrapper/records.go b/go/wrapper/records.go
index 3dbf470e4ca..30d7456af97 100644
--- a/go/wrapper/records.go
+++ b/go/wrapper/records.go
@@ -208,6 +208,9 @@ type ConnectionStats struct {
 	PacketsLost          *uint64
 	// Version is the negotiated protocol version, spelled like ClientConfig.Versions.
 	Version *string
+	// DatagramsUnrouted counts datagrams received for a subscription with no datagram
+	// track; nil on a version without datagrams.
+	DatagramsUnrouted *uint64
 }
 
 func connectionStatsFromFFI(s ffi.MoqConnectionStats) ConnectionStats {
@@ -221,6 +224,7 @@ func connectionStatsFromFFI(s ffi.MoqConnectionStats) ConnectionStats {
 		PacketsReceived:      s.PacketsReceived,
 		PacketsLost:          s.PacketsLost,
 		Version:              s.Version,
+		DatagramsUnrouted:    s.DatagramsUnrouted,
 	}
 }
 
diff --git a/js/net/api/index.api.md b/js/net/api/index.api.md
index ac001343255..f065c755d4f 100644
--- a/js/net/api/index.api.md
+++ b/js/net/api/index.api.md
@@ -220,6 +220,7 @@ export namespace Connection {
 		bytesLost?: number;
 		bytesReceived?: number;
 		bytesSent?: number;
+		datagramsUnrouted?: number;
 		estimatedSendRate?: number;
 		packetsLost?: number;
 		packetsReceived?: number;
diff --git a/js/net/src/connection/stats.test.ts b/js/net/src/connection/stats.test.ts
index 87117c84316..3e42174d605 100644
--- a/js/net/src/connection/stats.test.ts
+++ b/js/net/src/connection/stats.test.ts
@@ -76,14 +76,15 @@ test("stats() snapshots the transport on demand", async () => {
 	}
 });
 
-test("stats() is empty on a transport without getStats", async () => {
+test("stats() has no transport counters on a transport without getStats", async () => {
 	const pair = createMockTransportPair(Lite.ALPN_06);
 	// Shadow the mock's getStats to imitate the qmux/WebSocket fallback.
 	(pair.client as unknown as { getStats?: unknown }).getStats = undefined;
 	const url = new URL("https://example.com/");
 	const [client, server] = await Promise.all([connect(url, { transport: pair.client }), accept(pair.server, url)]);
 	try {
-		expect(await client.stats()).toEqual({});
+		// Only the session's own counter, which needs nothing from the transport.
+		expect(await client.stats()).toEqual({ datagramsUnrouted: 0 });
 	} finally {
 		client.abort();
 		server.abort();
diff --git a/js/net/src/connection/stats.ts b/js/net/src/connection/stats.ts
index 25fccbe8578..556860917d3 100644
--- a/js/net/src/connection/stats.ts
+++ b/js/net/src/connection/stats.ts
@@ -53,6 +53,13 @@ export interface Stats {
 
 	/** Packets currently declared lost. The estimate can decrease when a loss proves spurious. */
 	packetsLost?: number;
+
+	/**
+	 * Datagrams received for a subscription with no datagram track: one this session doesn't
+	 * know, has ended, or whose answer it hasn't received. Absent on a version without datagrams:
+	 * moq-transport and moq-lite before 05.
+	 */
+	datagramsUnrouted?: number;
 }
 
 /**
diff --git a/js/net/src/lite/connection.ts b/js/net/src/lite/connection.ts
index 3150fd24f98..60153010cdd 100644
--- a/js/net/src/lite/connection.ts
+++ b/js/net/src/lite/connection.ts
@@ -549,7 +549,9 @@ export class Connection implements Established {
 
 	/** Snapshot the transport's counters; see {@link Established.stats}. */
 	async stats(): Promise<Stats> {
-		return transportStats(this.#quic);
+		const stats = await transportStats(this.#quic);
+		if (hasDatagrams(this.#version)) stats.datagramsUnrouted = this.#subscriber.datagramsUnrouted;
+		return stats;
 	}
 
 	/** Settles with the peer's GOAWAY; see {@link Established.draining}. */
diff --git a/js/net/src/lite/datagram-tracks.test.ts b/js/net/src/lite/datagram-tracks.test.ts
index 88d167a49fa..a79af11067f 100644
--- a/js/net/src/lite/datagram-tracks.test.ts
+++ b/js/net/src/lite/datagram-tracks.test.ts
@@ -1,10 +1,13 @@
-import { expect, test } from "bun:test";
+import { expect, spyOn, test } from "bun:test";
+import { yieldNow } from "@moq/clock";
+import { Signal } from "@moq/signals";
 import { accept, connect } from "../connection/index.ts";
-import { createMockTransportPair } from "../mock.ts";
+import { createMockTransportPair, type MockTransport } from "../mock.ts";
 import { Producer as Origin } from "../origin.ts";
 import * as Path from "../path.ts";
 import { sendOrder } from "../priority.ts";
 import { Timescale, Timestamp } from "../time.ts";
+import { Budget } from "../util/yield.ts";
 import { wireOf } from "../wire.ts";
 import { ALPN_04, ALPN_05, ALPN_06, ALPN_07_WIP } from "./version.ts";
 
@@ -281,3 +284,311 @@ test("lite-06: a request cancelled behind the shared datagram writer sends nothi
 		source.close();
 	}
 });
+
+// A publisher's stream writes, handed to the subscriber `lag` microtasks late: the answer it
+// writes lands after a datagram sent behind it, though in the same host task.
+function lagAnswers(transport: MockTransport, lag: number): void {
+	if (lag === 0) return;
+	const lagging = (writable: WritableStream<Uint8Array>) => {
+		const writer = writable.getWriter();
+		let chain = Promise.resolve();
+		const later = (op: () => Promise<void>) => {
+			// A write the session's close fails is lost, as it would be on the wire.
+			chain = chain
+				.then(async () => {
+					for (let i = 0; i < lag; i++) await Promise.resolve();
+					await op();
+				})
+				.catch(() => {});
+			return chain;
+		};
+		return new WritableStream<Uint8Array>({
+			// Copied: the write resolves now, after which the stream may reuse its buffer.
+			write: (chunk) => {
+				const copy = chunk.slice();
+				void later(() => writer.write(copy));
+			},
+			close: () => later(() => writer.close()),
+			abort: (reason) => writer.abort(reason),
+		});
+	};
+	const incoming = transport.incomingBidirectionalStreams.pipeThrough(
+		new TransformStream<WebTransportBidirectionalStream, WebTransportBidirectionalStream>({
+			transform: (bidi, controller) =>
+				controller.enqueue({
+					readable: bidi.readable,
+					writable: lagging(bidi.writable),
+				} as WebTransportBidirectionalStream),
+		}),
+	);
+	Object.defineProperty(transport, "incomingBidirectionalStreams", { value: incoming });
+}
+
+// A publisher that writes as soon as a subscription reaches it sends the datagram right behind
+// its answer, which may reach the subscriber first, with the track's end too when it finishes at
+// once. The subscriber decodes the answer before it routes the datagram, and routes the datagram
+// before it ends the track.
+for (const alpn of [ALPN_05, ALPN_06, ALPN_07_WIP]) {
+	for (const [lag, finish] of [
+		[0, false],
+		[100, false],
+		[0, true],
+		[100, true],
+	] as const) {
+		test(`${alpn}: a datagram sent right behind its answer arrives (answer ${lag} microtasks late${finish ? ", then the end" : ""})`, async () => {
+			const source = new Origin();
+			const publication = source.route(path, { hidden: true });
+			const datagrams = publication.broadcast.createDatagrams("audio");
+			publication.announce();
+			const pair = createMockTransportPair(alpn);
+			lagAnswers(pair.server, lag);
+			const [client, server] = await Promise.all([
+				connect({ url, transport: pair.client }),
+				accept({ url, transport: pair.server, publish: source.consume() }),
+			]);
+			const remote = wireOf(client).consume(path);
+			const reader = remote.datagrams("audio");
+			// Only the subscription carries this priority: a lite-06 TRACK lookup asks for none.
+			reader.setPriority(5);
+			try {
+				while (datagrams.priority.peek() !== 5) await datagrams.priority.changed();
+				datagrams.append(undefined, Uint8Array.of(1));
+				if (finish) datagrams.finish();
+				await reader.info();
+				if (!finish) datagrams.append(undefined, Uint8Array.of(2));
+				expect((await reader.recv())?.payload).toEqual(Uint8Array.of(1));
+				if (finish) expect(await reader.recv()).toBeUndefined();
+				else expect((await reader.recv())?.payload).toEqual(Uint8Array.of(2));
+				expect((await client.stats()).datagramsUnrouted).toBe(0);
+			} finally {
+				reader.close();
+				remote.close();
+				client.abort();
+				server.abort();
+				source.close();
+			}
+		});
+	}
+}
+
+// A publisher that writes a last datagram and finishes at once sends the datagram right ahead
+// of its track's end. The subscriber routes the datagram before it ends the track.
+for (const alpn of [ALPN_05, ALPN_06, ALPN_07_WIP]) {
+	test(`${alpn}: a datagram sent right before its end arrives`, async () => {
+		const source = new Origin();
+		const publication = source.route(path, { hidden: true });
+		const datagrams = publication.broadcast.createDatagrams("audio");
+		publication.announce();
+		const pair = createMockTransportPair(alpn);
+		const [client, server] = await Promise.all([
+			connect({ url, transport: pair.client }),
+			accept({ url, transport: pair.server, publish: source.consume() }),
+		]);
+		const remote = wireOf(client).consume(path);
+		const reader = remote.datagrams("audio");
+		reader.setPriority(5);
+		try {
+			await reader.info();
+			while (datagrams.priority.peek() !== 5) await datagrams.priority.changed();
+			datagrams.append(undefined, Uint8Array.of(1));
+			datagrams.finish();
+			expect((await reader.recv())?.payload).toEqual(Uint8Array.of(1));
+			expect(await reader.recv()).toBeUndefined();
+			expect((await client.stats()).datagramsUnrouted).toBe(0);
+		} finally {
+			reader.close();
+			remote.close();
+			client.abort();
+			server.abort();
+			source.close();
+		}
+	});
+}
+
+// A burst written right before a track's end can outlast the receive loop's budget, which yields
+// with some of it still queued. The end waits for the loop to read the queue empty.
+for (const alpn of [ALPN_05, ALPN_06, ALPN_07_WIP]) {
+	test(`${alpn}: a burst sent right before its end arrives past a budget yield`, async () => {
+		// As many as a datagram track buffers unread, past two receive budgets.
+		const BURST = 64;
+		const source = new Origin();
+		const publication = source.route(path, { hidden: true });
+		const datagrams = publication.broadcast.createDatagrams("audio");
+		publication.announce();
+		const pair = createMockTransportPair(alpn);
+		const [client, server] = await Promise.all([
+			connect({ url, transport: pair.client }),
+			accept({ url, transport: pair.server, publish: source.consume() }),
+		]);
+		const remote = wireOf(client).consume(path);
+		const reader = remote.datagrams("audio");
+		reader.setPriority(5);
+		// Every budget slice reads as spent, so the receive loop yields a host task every 32 checks.
+		let checks = 0;
+		const budget = spyOn(Budget.prototype, "poll").mockImplementation(() =>
+			++checks % 32 === 0 ? yieldNow() : undefined,
+		);
+		try {
+			await reader.info();
+			while (datagrams.priority.peek() !== 5) await datagrams.priority.changed();
+			for (let i = 0; i < BURST; i++) datagrams.append(undefined, Uint8Array.of(i));
+			datagrams.finish();
+			let count = 0;
+			while ((await reader.recv()) !== undefined) count++;
+			expect(count).toBe(BURST);
+			expect((await client.stats()).datagramsUnrouted).toBe(0);
+		} finally {
+			budget.mockRestore();
+			reader.close();
+			remote.close();
+			client.abort();
+			server.abort();
+			source.close();
+		}
+	});
+}
+
+// A track's end waits a host task for the datagrams received with it. A session close in
+// between finishes the track rather than cutting it off: the publisher already ended it.
+for (const alpn of [ALPN_05, ALPN_06, ALPN_07_WIP]) {
+	test(`${alpn}: a session close right after a datagram track's end keeps the end`, async () => {
+		const source = new Origin();
+		const publication = source.route(path, { hidden: true });
+		const datagrams = publication.broadcast.createDatagrams("audio");
+		publication.announce();
+		const pair = createMockTransportPair(alpn);
+		const [client, server] = await Promise.all([
+			connect({ url, transport: pair.client }),
+			accept({ url, transport: pair.server, publish: source.consume() }),
+		]);
+		const remote = wireOf(client).consume(path);
+		const reader = remote.datagrams("audio");
+		reader.setPriority(5);
+		try {
+			await reader.info();
+			while (datagrams.priority.peek() !== 5) await datagrams.priority.changed();
+			datagrams.finish();
+			// The mock delivers the end in microtasks, all within this host task.
+			for (let i = 0; i < 1000; i++) await Promise.resolve();
+			client.abort();
+			expect(await reader.recv()).toBeUndefined();
+		} finally {
+			reader.close();
+			remote.close();
+			client.abort();
+			server.abort();
+			source.close();
+		}
+	});
+}
+
+// Holds back what the publisher writes on the next request stream it accepts once armed, until
+// released: that subscription's answer stays outstanding while everything else flows.
+function holdNextAnswer(transport: MockTransport): { arm(): void; release(): void } {
+	let armed = false;
+	const release = Promise.withResolvers<void>();
+	const holding = (writable: WritableStream<Uint8Array>) => {
+		const writer = writable.getWriter();
+		let chain = release.promise;
+		// A write the session's close fails is lost, as it would be on the wire.
+		const later = (op: () => Promise<void>) => {
+			chain = chain.then(op).catch(() => {});
+			return chain;
+		};
+		return new WritableStream<Uint8Array>({
+			// Copied: the write resolves now, after which the stream may reuse its buffer.
+			write: (chunk) => {
+				const copy = chunk.slice();
+				void later(() => writer.write(copy));
+			},
+			close: () => void later(() => writer.close()),
+			abort: (reason) => writer.abort(reason),
+		});
+	};
+	const incoming = transport.incomingBidirectionalStreams.pipeThrough(
+		new TransformStream<WebTransportBidirectionalStream, WebTransportBidirectionalStream>({
+			transform: (bidi, controller) => {
+				const held = armed;
+				armed = false;
+				controller.enqueue(
+					held
+						? ({
+								readable: bidi.readable,
+								writable: holding(bidi.writable),
+							} as WebTransportBidirectionalStream)
+						: bidi,
+				);
+			},
+		}),
+	);
+	Object.defineProperty(transport, "incomingBidirectionalStreams", { value: incoming });
+	return {
+		arm: () => {
+			armed = true;
+		},
+		release: () => release.resolve(),
+	};
+}
+
+// Datagrams held for a track still awaiting its answer, more than are held at once, don't hold
+// up an answered track's last datagram, which its end, arriving with it, would otherwise drop.
+test("lite-07: an unanswered track's datagrams don't delay another track's last", async () => {
+	const source = new Origin();
+	const publication = source.route(path, { hidden: true });
+	const b = publication.broadcast.createDatagrams("b");
+	// Answers "a" on demand.
+	const requested = wireOf(publication.broadcast).requestedDatagrams();
+	publication.announce();
+	const pair = createMockTransportPair(ALPN_07_WIP);
+	const hold = holdNextAnswer(pair.server);
+	// Counts the datagrams the publisher sends.
+	const sending = pair.server.datagrams.writable.getWriter();
+	let sent = 0;
+	const sends = new Signal(0);
+	Object.defineProperty(pair.server.datagrams, "writable", {
+		value: new WritableStream<Uint8Array>({
+			write: async (chunk) => {
+				await sending.write(chunk);
+				sends.set(++sent);
+			},
+		}),
+	});
+	const [client, server] = await Promise.all([
+		connect({ url, transport: pair.client }),
+		accept({ url, transport: pair.server, publish: source.consume() }),
+	]);
+	const remote = wireOf(client).consume(path);
+	const readerB = remote.datagrams("b");
+	readerB.setPriority(5);
+	let readerA: ReturnType<typeof remote.datagrams> | undefined;
+	try {
+		await readerB.info();
+		while (b.priority.peek() !== 5) await b.priority.changed();
+		hold.arm();
+		readerA = remote.datagrams("a");
+		const request = await requested;
+		if (!request) throw new Error("the request never reached the handler");
+		const a = request.accept({});
+		for (let i = 0; i < 40; i++) a.append(undefined, Uint8Array.of(i));
+		// "a"'s datagrams reach the subscriber ahead of "b"'s.
+		while (sends.peek() < 40) await sends.changed();
+		b.append(undefined, Uint8Array.of(9));
+		b.finish();
+		expect((await readerB.recv())?.payload).toEqual(Uint8Array.of(9));
+		expect(await readerB.recv()).toBeUndefined();
+		// Those past the cap were dropped at once, without stalling "b".
+		expect((await client.stats()).datagramsUnrouted).toBeGreaterThanOrEqual(8);
+		// "a" stays unanswered past the host task its held datagrams wait, so they drop too.
+		while (((await client.stats()).datagramsUnrouted ?? 0) < 40) await yieldNow();
+		expect((await client.stats()).datagramsUnrouted).toBe(40);
+		hold.release();
+		await readerA.info();
+	} finally {
+		readerA?.close();
+		readerB.close();
+		remote.close();
+		client.abort();
+		server.abort();
+		source.close();
+	}
+});
diff --git a/js/net/src/lite/subscriber.ts b/js/net/src/lite/subscriber.ts
index 5f0a319b5d1..5a2eb95690b 100644
--- a/js/net/src/lite/subscriber.ts
+++ b/js/net/src/lite/subscriber.ts
@@ -1,4 +1,4 @@
-import { Milli } from "@moq/clock";
+import { Milli, yieldNow } from "@moq/clock";
 import { type Dispose, Effect, type GetPromise, type Getter, race, Signal } from "@moq/signals";
 import * as announce from "../announced.ts";
 import type { Grant } from "../auth.ts";
@@ -96,6 +96,10 @@ import {
 // and removals of one name never reaches the announces cap: yield so it cannot starve the host.
 const listingBudget = new Budget();
 const datagramBudget = new Budget();
+// The datagrams held for unanswered subscriptions at once, as many as a Rust pass holds: past it,
+// one is dropped and counted rather than stalling the receive queue, which would hold up other
+// tracks' datagrams behind their ends.
+const HELD_DATAGRAMS = 32;
 
 // Wire ceiling (2^62-1). A draining session stamps it on every live route so any other
 // candidate outranks it, while the route stays selectable as the last path. Matches Rust
@@ -133,6 +137,9 @@ interface Consumed {
 interface DatagramEntry {
 	producer: datagram.Producer;
 	timescale?: Time.Timescale;
+	// Set once the publisher ended the track, while the datagrams received with the end route:
+	// a session close meanwhile finishes it rather than cutting it off.
+	ended?: boolean;
 }
 
 interface SubscribeEntry {
@@ -244,6 +251,16 @@ export class Subscriber {
 	#datagrams = new Map<bigint, DatagramEntry>();
 	#legacyDatagrams = new Map<string, DatagramEntry>();
 	#legacyRequests = new Map<string, datagram.Request>();
+	// Lite-07 datagram requests sent and not yet answered.
+	#unanswered = new Set<bigint>();
+	// Datagrams for a subscription still awaiting its answer, in arrival order, routed a host task
+	// later while the rest go on.
+	#held: { subscribe: bigint; payload: Uint8Array }[] = [];
+	#heldRouted?: Promise<void>;
+	// Set while the receive loop yields to its budget, which may leave datagrams queued.
+	#receiveYield?: Promise<void>;
+	/** Datagrams received for a subscription with no datagram track; see `Stats.datagramsUnrouted`. */
+	datagramsUnrouted = 0;
 	// A SUBSCRIBE sent alongside its TRACK, until its TRACK_INFO lands: settles with the
 	// entry, or `undefined` if it never does.
 	#pending = new Map<bigint, Promise<SubscribeEntry | undefined>>();
@@ -892,6 +909,7 @@ export class Subscriber {
 					{ version: this.version },
 					async (opened) => {
 						stream = opened;
+						this.#unanswered.add(id);
 						await opened.writer.u53(StreamId.Datagrams);
 						await new Datagrams({
 							id,
@@ -910,12 +928,17 @@ export class Subscriber {
 			signal.throwIfAborted();
 			if (!stream) throw new Error("datagram stream was not opened");
 			producer = request.accept(answered);
-			this.#datagrams.set(id, { producer, timescale: answered.timescale });
+			const route: DatagramEntry = { producer, timescale: answered.timescale };
+			this.#datagrams.set(id, route);
+			this.#unanswered.delete(id);
 			const opened = stream;
 			const receiving = producer;
-			// The only thing following DATAGRAMS_INFO is the publisher's FIN.
-			const ended = opened.reader.done().then((done) => {
+			// The only thing following DATAGRAMS_INFO is the publisher's FIN. Its last datagram may
+			// arrive alongside, so the datagrams already received route first.
+			const ended = opened.reader.done().then(async (done) => {
 				if (!done) throw new ProtocolViolation("data after DATAGRAMS_INFO");
+				route.ended = true;
+				await this.#datagramsRouted(id);
 				receiving.finish();
 			});
 			void ended.catch(() => {});
@@ -943,6 +966,7 @@ export class Subscriber {
 			if (legacyKey !== undefined && this.#legacyRequests.get(legacyKey) === request)
 				this.#legacyRequests.delete(legacyKey);
 			grant?.();
+			this.#unanswered.delete(id);
 			this.#datagrams.delete(id);
 			cancel.abort(new StreamError(StreamCode.Cancel));
 			stream?.reader.stop(StreamCode.Cancel);
@@ -1370,6 +1394,11 @@ export class Subscriber {
 			entry.held?.close();
 			entry.datagramDemand?.();
 			if (entry.datagrams) {
+				// The stream track's end is its datagrams' end: those received with it route first.
+				if (entry.end !== undefined && !(hooks.trackReleased(producer).peek() instanceof Error)) {
+					entry.datagrams.ended = true;
+					await this.#datagramsRouted(id);
+				}
 				const closed = hooks.trackReleased(producer).peek();
 				if (closed instanceof Error) entry.datagrams.producer.abort(closed);
 				else if (entry.end !== undefined) entry.datagrams.producer.finish();
@@ -2383,7 +2412,11 @@ export class Subscriber {
 			try {
 				for (;;) {
 					const yielded = datagramBudget.poll();
-					if (yielded !== undefined) await yielded;
+					if (yielded !== undefined) {
+						this.#receiveYield = yielded;
+						await yielded;
+						this.#receiveYield = undefined;
+					}
 					const { value, done } = await reader.read();
 					if (done) break;
 					if (!value) continue;
@@ -2407,24 +2440,92 @@ export class Subscriber {
 		}
 	}
 
-	// Decode one datagram body and hand it to the matching subscription's producer. Drops the
-	// datagram (best-effort) if the subscription is unknown or closed.
+	// Decode one datagram body and hand it to the datagram track it was sent for. A publisher
+	// sends a track's first datagram right behind its answer, which the transport may hand over
+	// first: one for a subscription still awaiting its answer is held a host task, so an answer
+	// already received decodes before it, while other tracks' datagrams go on. One that still
+	// finds no track is dropped and counted.
 	async #routeDatagram(payload: Uint8Array): Promise<void> {
 		if (payload.byteLength > DatagramMessage.MAX_SIZE) return;
+		let unrouted = await this.#deliverDatagram(payload, true);
+		if (unrouted === undefined) return;
+		// Its track may have registered while the decode awaited.
+		if (!this.#isHeld(unrouted) && this.#datagrams.has(unrouted))
+			unrouted = await this.#deliverDatagram(payload, true);
+		if (unrouted === undefined) return;
+		const awaiting = this.#isHeld(unrouted) || this.#unanswered.has(unrouted) || this.#pending.has(unrouted);
+		if (awaiting && this.#held.length < HELD_DATAGRAMS) {
+			this.#held.push({ subscribe: unrouted, payload });
+			this.#heldRouted ??= this.#routeHeld();
+			return;
+		}
+		this.#dropUnrouted(unrouted);
+	}
+
+	// Wait for the datagrams received for `subscribe` so far to route: a host task, then until the
+	// receive loop reads the transport's queue empty rather than yielding to its budget, and those
+	// held for its answer. A peer keeping the queue full delays the end, holding nothing more.
+	async #datagramsRouted(subscribe: bigint): Promise<void> {
+		await yieldNow();
+		for (;;) {
+			const receiveYield = this.#receiveYield;
+			if (receiveYield !== undefined) {
+				await receiveYield;
+				// The loop reads on in microtasks, until the queue empties or its next yield.
+				await yieldNow();
+			} else if (this.#isHeld(subscribe)) {
+				// A held datagram keeps its routing pass running.
+				await this.#heldRouted;
+			} else return;
+		}
+	}
+
+	// Whether a datagram for `subscribe` is held, which later ones wait behind to keep its order.
+	#isHeld(subscribe: bigint): boolean {
+		return this.#held.some((held) => held.subscribe === subscribe);
+	}
+
+	// A host task later, route the datagrams held until now, then any held meanwhile.
+	async #routeHeld(): Promise<void> {
+		await yieldNow();
+		for (let count = this.#held.length; count > 0; count--) {
+			const [{ payload }] = this.#held;
+			try {
+				const unrouted = await this.#deliverDatagram(payload, false);
+				if (unrouted !== undefined) this.#dropUnrouted(unrouted);
+			} catch (err: unknown) {
+				console.debug(`dropping datagram: ${reason(err)}`);
+			}
+			this.#held.shift();
+		}
+		this.#heldRouted = this.#held.length > 0 ? this.#routeHeld() : undefined;
+	}
+
+	#dropUnrouted(subscribe: bigint): void {
+		this.datagramsUnrouted++;
+		console.debug(`dropping datagram for a subscription with no datagram track: id=${subscribe}`);
+	}
+
+	// Deliver one datagram body, returning its Subscribe ID if that subscription has no datagram
+	// track, or, `behindHeld`, has a datagram held.
+	async #deliverDatagram(payload: Uint8Array, behindHeld: boolean): Promise<bigint | undefined> {
 		// Read with the entry it was decoded with: one registered while the decode awaited would
-		// read a datagram parsed with the defaults. An unknown subscription's datagram, or one
-		// whose TRACK_INFO had not landed, which a datagram cannot wait for, is dropped below.
+		// read a datagram parsed with the defaults.
 		let entry: DatagramEntry | undefined;
 		const dg = await DatagramMessage.decode(payload, this.version, (id) => {
 			entry = this.#datagrams.get(id);
 			return { timed: entry?.timescale !== undefined };
 		});
-		if (!dg || !entry || this.#datagrams.get(dg.subscribe) !== entry) return;
+		// Padding, which names no subscription.
+		if (!dg) return undefined;
+		if (!entry || this.#datagrams.get(dg.subscribe) !== entry) return dg.subscribe;
+		if (behindHeld && this.#isHeld(dg.subscribe)) return dg.subscribe;
 		const timestamp =
 			dg.timestamp === undefined || entry.timescale === undefined
 				? undefined
 				: new Time.Timestamp(dg.timestamp, entry.timescale);
 		entry.producer.insert({ sequence: dg.sequence, timestamp, payload: dg.payload });
+		return undefined;
 	}
 
 	/**
@@ -2554,7 +2655,7 @@ export class Subscriber {
 	/**
 	 * Ends every subscribed track, fetch, and setup exchange with `err`, the session's end, which
 	 * defaults to a clean close: they were cut off rather than ended. A track whose publisher
-	 * already ended it finishes instead.
+	 * already ended it finishes instead, datagram tracks included.
 	 */
 	close(err: Error = new SessionError(SessionCode.Cancel)) {
 		this.#closed.abort(err);
@@ -2565,7 +2666,10 @@ export class Subscriber {
 		}
 
 		this.#subscribes.clear();
-		for (const { producer } of this.#datagrams.values()) producer.abort(err);
+		for (const { producer, ended } of this.#datagrams.values()) {
+			if (ended) producer.finish();
+			producer.abort(err);
+		}
 		this.#datagrams.clear();
 		this.#legacyDatagrams.clear();
 
diff --git a/py/moq-rs/moq/_records.py b/py/moq-rs/moq/_records.py
index 1d8b712c5a3..d445a85e38d 100644
--- a/py/moq-rs/moq/_records.py
+++ b/py/moq-rs/moq/_records.py
@@ -448,6 +448,8 @@ class ConnectionStats:
     packets_lost: int | None
     version: str | None = None
     """The negotiated protocol version, spelled like ``Client(versions=...)``."""
+    datagrams_unrouted: int | None = None
+    """Datagrams received for a subscription with no datagram track; ``None`` on a version without datagrams."""
 
     @staticmethod
     def _from_ffi(stats: MoqConnectionStats) -> ConnectionStats:
@@ -461,6 +463,7 @@ def _from_ffi(stats: MoqConnectionStats) -> ConnectionStats:
             packets_received=stats.packets_received,
             packets_lost=stats.packets_lost,
             version=stats.version,
+            datagrams_unrouted=stats.datagrams_unrouted,
         )
 
 
diff --git a/quest/m1/datagram-tracks/README.md b/quest/m1/datagram-tracks/README.md
index def636b5d50..ffde2a0114f 100644
--- a/quest/m1/datagram-tracks/README.md
+++ b/quest/m1/datagram-tracks/README.md
@@ -121,7 +121,6 @@ datagram track on lite-07, direct and through a relay.
 ## Required
 
 - [moq-transport datagram tracks](/quest/m1/datagram-tracks/ietf.md) - Rust and JS map a datagram track to SUBSCRIBE and OBJECT_DATAGRAM with object ID 0, keeping the requested kind
-- [A datagram sent right behind its answer reaches the subscriber](/quest/m1/datagram-tracks/answer-race.md) - receivers decode answers before routing datagrams, and count the ones they still can't route
 
 ## Related
 
diff --git a/quest/m1/datagram-tracks/answer-race.md b/quest/m1/datagram-tracks/answer-race.md
deleted file mode 100644
index d413c2baf1b..00000000000
--- a/quest/m1/datagram-tracks/answer-race.md
+++ /dev/null
@@ -1,57 +0,0 @@
-# [M] A datagram sent right behind its answer reaches the subscriber
-
-## Goal
-
-On lite-05, 06, and 07, in Rust and JS, a datagram that arrives in the same
-receive pass as its subscription's answer (TRACK_INFO on lite-05/06,
-DATAGRAMS_INFO on lite-07) is delivered, not dropped. A datagram the
-receiver still cannot route is logged at debug and counted, never dropped
-silently.
-
-Not in scope: a datagram whose answer is lost and retransmitted. That is
-ordinary datagram loss, and the receiver keeps no buffer for it.
-
-## Plan
-
-Decided 2026-11-05 (maintainer, /quest-import of
-[#7882](https://github.com/moq-dev/moq/issues/7882)):
-
-- ✅ **Decode answers before routing datagrams.** The receiver handles its
-  pending stream answers before it routes datagrams, so a datagram that
-  shares a packet with its answer finds its route. Not chosen: buffering raw
-  datagrams per unanswered subscription and replaying them (state a peer
-  influences, needing a bound), the publisher holding datagrams until its
-  answer is acknowledged (about one RTT of datagrams lost per subscription
-  instead), or accepting the loss with only a log.
-- ✅ **One quest for Rust and JS.** The JS part builds on the paths
-  [JS datagram tracks](https://github.com/moq-dev/moq/pull/7846) introduces.
-- ✅ m1, in the Datagram tracks epic.
-
-Verified on `main` at 246916845a, from the issue's report:
-
-- The issue's second question, the `newest - budget` start rule, no longer
-  applies. Every version and both languages start datagrams live from the
-  request (`rs/moq-net/src/model/datagram.rs`, `js/net/src/track.ts`), so
-  this quest leaves the start rule alone.
-- Rust: `route_datagram` returns `Ok(())` when `datagram_target` finds no
-  route (`rs/moq-net/src/lite/subscriber.rs`). Routes register only once the
-  answer decodes: `register` after DATAGRAMS_INFO on lite-07, and
-  `legacy_datagrams` after TRACK_INFO on lite-05/06. The driver drains up to
-  32 datagrams before polling the source tasks that decode answers, so even a
-  datagram sharing its answer's packet is dropped.
-- The publisher sends datagrams as soon as the answer is written
-  (`rs/moq-net/src/lite/publisher.rs`), so the first live datagram is the one
-  at risk.
-- JS: `#routeDatagram` returns silently on a miss
-  (`js/net/src/lite/subscriber.ts`), and #7846 keeps that.
-- No stats count the drop; `datagrams` in `rs/moq-net/src/stats.rs` counts
-  deliveries only.
-
-Tests: per version, a datagram written in the same packet as its answer
-arrives, and an unroutable one bumps the counter. The integration tests in
-`rs/moq-net/tests/integration/datagram.rs` all wait for `consumer.info()`
-before appending, so add a case that doesn't.
-
-## Closes
-
-- [#7882](https://github.com/moq-dev/moq/issues/7882) - the datagram served at subscribe time is dropped by the receiver when TRACK and SUBSCRIBE are pipelined
diff --git a/quest/m2/recut-held.md b/quest/m2/recut-held.md
index 296a3e42c25..59b0ee3575d 100644
--- a/quest/m2/recut-held.md
+++ b/quest/m2/recut-held.md
@@ -30,7 +30,6 @@ padding probes in [lite07-finalize](/quest/m2/lite07-finalize.md).
 
 ## Required
 
-- [Datagram answer race](/quest/m1/datagram-tracks/answer-race.md) - claim held datagram-tracks
 - [IETF datagram tracks](/quest/m1/datagram-tracks/ietf.md) - claim held datagram-tracks
 - [rind CPU error](/quest/m1/rind/cpu-error.md) - claim held rind
 - [Connect policy](/quest/m1/session-policy/connect.md) - claim held session-policy
diff --git a/rs/moq-c/MIGRATE.md b/rs/moq-c/MIGRATE.md
index 4ea469fb3eb..2f11ec28ba1 100644
--- a/rs/moq-c/MIGRATE.md
+++ b/rs/moq-c/MIGRATE.md
@@ -4,6 +4,11 @@ How to update your code for each breaking change, newest first.
 
 ## Unreleased
 
+### `moq_connection_stats` counts unrouted datagrams ([#7951](https://github.com/moq-dev/moq/pull/7951))
+
+`moq_connection_stats` gains `datagrams_unrouted` and `datagrams_unrouted_valid` at its end, which changes its ABI: recompile against the new header.
+`datagrams_unrouted` counts the datagrams received for a subscription with no datagram track, and is valid on versions with datagrams (moq-lite 05 and newer).
+
 ### Consumers and decoders refuse a disabled rendition ([#7942](https://github.com/moq-dev/moq/pull/7942))
 
 `moq_consume_audio`, `moq_consume_video`, `moq_decode_audio`, and `moq_decode_video` return `MOQ_ERROR_NOT_FOUND` when the catalog snapshot marks the rendition disabled, instead of subscribing and waiting for a re-enable. Check `moq_consume_audio_enabled` or `moq_consume_video_enabled` on the latest snapshot first, and cancel a consumer whose rendition a newer snapshot disables.
diff --git a/rs/moq-c/src/api.rs b/rs/moq-c/src/api.rs
index adb4ae1186a..d8d438b7c50 100644
--- a/rs/moq-c/src/api.rs
+++ b/rs/moq-c/src/api.rs
@@ -1159,6 +1159,12 @@ pub struct moq_connection_stats {
 	pub packets_lost: u64,
 	/// Whether `packets_lost` is available in this sample.
 	pub packets_lost_valid: bool,
+
+	/// Total datagrams received for a subscription with no datagram track: one the session
+	/// doesn't know, has ended, or whose answer it hasn't received.
+	pub datagrams_unrouted: u64,
+	/// Whether `datagrams_unrouted` is available: false on a version without datagrams.
+	pub datagrams_unrouted_valid: bool,
 }
 
 impl From<&moq_net::session::Stats> for moq_connection_stats {
@@ -1177,6 +1183,7 @@ impl From<&moq_net::session::Stats> for moq_connection_stats {
 		let (packets_sent, packets_sent_valid) = split(stats.packets_sent);
 		let (packets_received, packets_received_valid) = split(stats.packets_received);
 		let (packets_lost, packets_lost_valid) = split(stats.packets_lost);
+		let (datagrams_unrouted, datagrams_unrouted_valid) = split(stats.datagrams_unrouted);
 
 		Self {
 			rtt_us,
@@ -1195,6 +1202,8 @@ impl From<&moq_net::session::Stats> for moq_connection_stats {
 			packets_received_valid,
 			packets_lost,
 			packets_lost_valid,
+			datagrams_unrouted,
+			datagrams_unrouted_valid,
 		}
 	}
 }
diff --git a/rs/moq-ffi/src/session.rs b/rs/moq-ffi/src/session.rs
index 035747bfe7a..6f9bceae7a5 100644
--- a/rs/moq-ffi/src/session.rs
+++ b/rs/moq-ffi/src/session.rs
@@ -679,6 +679,11 @@ pub struct MoqConnectionStats {
 	/// connection's version with another's numbers.
 	#[uniffi(default = None)]
 	pub version: Option<String>,
+	/// Total datagrams received for a subscription with no datagram track: one the session
+	/// doesn't know, has ended, or whose answer it hasn't received. `None` on a version
+	/// without datagrams: moq-transport and moq-lite before 05.
+	#[uniffi(default = None)]
+	pub datagrams_unrouted: Option<u64>,
 }
 
 impl MoqConnectionStats {
@@ -693,6 +698,7 @@ impl MoqConnectionStats {
 			packets_received: stats.packets_received,
 			packets_lost: stats.packets_lost,
 			version: version.map(|version| version.to_string()),
+			datagrams_unrouted: stats.datagrams_unrouted,
 		}
 	}
 }
diff --git a/rs/moq-net/src/client.rs b/rs/moq-net/src/client.rs
index 14f107bcfb3..9f694213cf6 100644
--- a/rs/moq-net/src/client.rs
+++ b/rs/moq-net/src/client.rs
@@ -373,6 +373,7 @@ impl Client {
 				bandwidth: self.allocator(),
 				viewers,
 				peer_implementation: start.peer_implementation,
+				datagrams_unrouted: start.datagrams_unrouted,
 			},
 		))
 	}
@@ -463,6 +464,7 @@ impl Client {
 						bandwidth: self.allocator(),
 						viewers: self.viewers(),
 						peer_implementation,
+						datagrams_unrouted: None,
 					},
 				)));
 			}
@@ -564,6 +566,7 @@ impl Client {
 				bandwidth: self.allocator(),
 				viewers,
 				peer_implementation: start.peer_implementation,
+				datagrams_unrouted: start.datagrams_unrouted,
 			},
 		))
 	}
diff --git a/rs/moq-net/src/lite/session.rs b/rs/moq-net/src/lite/session.rs
index fc105f68d68..192568cffc8 100644
--- a/rs/moq-net/src/lite/session.rs
+++ b/rs/moq-net/src/lite/session.rs
@@ -29,6 +29,9 @@ pub(crate) struct SessionStart {
 	pub credential: Option<crate::auth::Credential>,
 	/// The implementation the peer's SETUP advertised, stored on the public [`crate::Session`].
 	pub peer_implementation: crate::setup::PeerImplementation,
+	/// Counts the datagrams the subscriber could route to no datagram track, on a version
+	/// with datagrams.
+	pub datagrams_unrouted: Option<std::sync::Arc<std::sync::atomic::AtomicU64>>,
 }
 
 /// Server: reads the peer's single SETUP message off its Setup Stream before starting
@@ -387,6 +390,7 @@ pub fn start(config: Config) -> Result<SessionStart, Error> {
 	});
 	subscriber.announces = announces;
 	subscriber.viewers = viewers;
+	let datagrams_unrouted = version.has_datagrams().then(|| subscriber.datagrams_unrouted.clone());
 
 	// SendSetup only logs a failure, so refuse a SETUP that cannot encode (one past the
 	// size bound, such as a long implementation or path) here rather than leave the peer waiting.
@@ -431,6 +435,7 @@ pub fn start(config: Config) -> Result<SessionStart, Error> {
 		auth,
 		credential: setup_token,
 		peer_implementation,
+		datagrams_unrouted,
 	})
 }
 
diff --git a/rs/moq-net/src/lite/subscriber.rs b/rs/moq-net/src/lite/subscriber.rs
index 7a7f906b16c..0ac030e46ae 100644
--- a/rs/moq-net/src/lite/subscriber.rs
+++ b/rs/moq-net/src/lite/subscriber.rs
@@ -80,6 +80,12 @@ pub(super) struct Subscriber {
 	/// Lite-05/06: the datagram tracks taking the datagrams of their name's stream track
 	/// subscription, by broadcast and name. One SUBSCRIBE carries both kinds there.
 	legacy_datagrams: Lock<HashMap<(Path, String), DatagramEntry>>,
+	/// The datagram tracks ended, and on lite-05/06 the subscriptions carrying them, while the
+	/// driver routes the datagrams received with their end; see [`Self::end_datagrams`].
+	datagram_ends: Lock<DatagramEnds>,
+	/// Datagrams received for a subscription with no datagram track, which
+	/// [`crate::session::Stats::datagrams_unrouted`] reports.
+	pub(super) datagrams_unrouted: Arc<atomic::AtomicU64>,
 	/// Why this session ended, once it has. A track still waiting on TRACK_INFO has no
 	/// copy in [`Self::subscribes`], so dropping its request reads this instead of
 	/// becoming [`Error::Dropped`].
@@ -151,6 +157,21 @@ struct DatagramEntry {
 	timescale: Option<Timescale>,
 }
 
+/// What the sources ended, applied once the driver read the datagrams queued with it.
+#[derive(Default)]
+struct DatagramEnds {
+	/// Lite-07: the datagram tracks the publisher finished, by Subscribe ID.
+	tracks: Vec<(u64, datagram::Producer)>,
+	/// Lite-05/06: the datagram tracks whose stream track finished, by broadcast and name.
+	shared: Vec<((Path, String), datagram::Producer)>,
+	/// Lite-05/06: the subscriptions finished, by Subscribe ID, with the broadcast and name
+	/// whose datagram track takes their datagrams.
+	subscribes: Vec<(u64, (Path, String))>,
+	/// Closed once these ends apply. Each serve that queued one keeps its stream until then, so
+	/// the peer's stream credit bounds what a datagram flood can leave queued.
+	applied: kio::Producer<()>,
+}
+
 struct TrackEntry {
 	/// Where the subscription's groups go, once its TRACK_INFO says how to read them. A
 	/// SUBSCRIBE sent alongside its TRACK registers before.
@@ -414,6 +435,8 @@ impl Subscriber {
 			subscribes: Default::default(),
 			datagrams: Default::default(),
 			legacy_datagrams: Default::default(),
+			datagram_ends: Default::default(),
+			datagrams_unrouted: Default::default(),
 			ended: Default::default(),
 			next_id: Default::default(),
 			version: config.version,
@@ -860,15 +883,47 @@ impl Subscriber {
 		self.subscribes.lock().remove(&id);
 	}
 
-	/// Decode one datagram body and hand it to the datagram track it was sent for.
+	/// Remove a subscription its publisher finished. On lite-05/06 it keeps routing its
+	/// datagrams to its name's datagram track, which may register meanwhile, until the ends
+	/// apply, which the returned consumer's close reports.
+	fn finish_subscribe(&self, id: u64) -> Option<kio::Consumer<()>> {
+		let removed = self.subscribes.lock().remove(&id);
+		let legacy = removed.and_then(|mut entry| entry.legacy.take())?;
+		let mut ends = self.datagram_ends.lock();
+		ends.subscribes.push((id, legacy));
+		Some(ends.applied.consume())
+	}
+
+	/// Apply the datagram ends the sources read, once the driver routed the datagrams received
+	/// with them: it read the transport's queue empty. A publisher sends a track's last datagram
+	/// right before its end, and a fresh track's answer, first datagram and end can all share a
+	/// receive pass. A peer keeping the queue full delays its tracks' ends, holding nothing more.
+	fn end_datagrams(&self) {
+		let ends = std::mem::take(&mut *self.datagram_ends.lock());
+		for (id, producer) in ends.tracks {
+			self.datagrams.lock().remove(&id);
+			producer.finish();
+		}
+		for (key, producer) in ends.shared {
+			let mut shared = self.legacy_datagrams.lock();
+			if shared.get(&key).is_some_and(|entry| entry.producer.is_clone(&producer)) {
+				shared.remove(&key);
+			}
+			drop(shared);
+			producer.finish();
+		}
+	}
+
+	/// Decode one datagram body and hand it to the datagram track it was sent for, or return
+	/// the Subscribe ID it names when that subscription has no datagram track: one unknown,
+	/// ended, or not yet answered.
 	///
 	/// A datagram track's subscription takes its datagrams. On lite-05/06 a stream track's
-	/// subscription carries its name's datagrams too, which go to that name's datagram track
-	/// while one reads them, and are dropped otherwise, as are an unknown subscription's or
-	/// one not yet answered.
-	fn route_datagram(&self, payload: bytes::Bytes) -> Result<(), Error> {
+	/// subscription carries its name's datagrams too, which go to that name's datagram track.
+	/// Padding and a body past the wire cap name no subscription.
+	fn route_datagram(&self, payload: bytes::Bytes) -> Result<Option<u64>, Error> {
 		if payload.len() > lite::Datagram::MAX_SIZE {
-			return Ok(());
+			return Ok(None);
 		}
 		let mut target = None;
 		let Some(dg) = lite::Datagram::decode(payload, self.version, |id| {
@@ -876,10 +931,10 @@ impl Subscriber {
 			target.as_ref().is_some_and(|(_, timescale)| timescale.is_some())
 		})?
 		else {
-			return Ok(());
+			return Ok(None);
 		};
 		let Some((mut producer, timescale)) = target else {
-			return Ok(());
+			return Ok(Some(dg.subscribe));
 		};
 		let timestamp = dg
 			.timestamp
@@ -891,7 +946,8 @@ impl Subscriber {
 			sequence: dg.sequence,
 			timestamp,
 			payload: dg.payload,
-		})
+		})?;
+		Ok(None)
 	}
 
 	/// The datagram track Subscribe ID `id` delivers to, and its datagrams' timescale.
@@ -899,7 +955,13 @@ impl Subscriber {
 		if let Some(entry) = self.datagrams.lock().get(&id) {
 			return Some((entry.producer.clone(), entry.timescale));
 		}
-		let key = self.subscribes.lock().get(&id)?.legacy.clone()?;
+		let key = match self.subscribes.lock().get(&id) {
+			Some(entry) => entry.legacy.clone()?,
+			None => {
+				let ends = self.datagram_ends.lock();
+				ends.subscribes.iter().find(|(ended, _)| *ended == id)?.1.clone()
+			}
+		};
 		let legacy = self.legacy_datagrams.lock();
 		let entry = legacy.get(&key)?;
 		Some((entry.producer.clone(), entry.timescale))
@@ -1014,6 +1076,7 @@ impl SubscriberDriver {
 		let parked = self.subscriber.park_waits.load(atomic::Ordering::Relaxed);
 		if closed && parked > 0 && self.uni.children.len() == parked {
 			let _ = self.sources.poll(waiter);
+			self.subscriber.end_datagrams();
 			return Poll::Pending;
 		}
 		// Once every remaining stream waits on a SETUP that never arrived, none of
@@ -1027,6 +1090,7 @@ impl SubscriberDriver {
 		// Lite03/04 that FIN is the only end: read it, so the track finishes rather than
 		// aborts. Each source reads its streams once, then retires on the closed session.
 		let _ = self.sources.poll(waiter);
+		self.subscriber.end_datagrams();
 		Poll::Ready(())
 	}
 
@@ -1076,12 +1140,15 @@ impl SubscriberDriver {
 				Poll::Pending => {}
 			}
 		}
-		if let Some(datagrams) = &mut self.datagrams {
-			match datagrams.poll(waiter) {
-				Poll::Ready(Err(err)) => return Poll::Ready(Err(err)),
-				Poll::Ready(Ok(())) => self.datagrams = None,
-				Poll::Pending => {}
-			}
+
+		// Datagrams go around the sources, which decode the answers that register their
+		// routes and the ends that remove them. A publisher sends a track's first datagram
+		// right behind its answer and its last right before its end, often in the same
+		// packet. So the datagrams of known tracks go first, those with no known track wait
+		// for the sources' answers, and the ends the sources read apply after both, once the
+		// datagrams queued with them are read.
+		if let Poll::Ready(Err(err)) = self.poll_datagrams(waiter, true) {
+			return Poll::Ready(Err(err));
 		}
 
 		// Sources minted by the announce half; their completion never ends the
@@ -1091,6 +1158,29 @@ impl SubscriberDriver {
 		}
 		let _ = self.sources.poll(waiter);
 
+		let routed = self.poll_datagrams(waiter, false);
+		// A pass the budget cut short leaves datagrams queued, which may have come with an end:
+		// its ends wait for a later poll's pass to read the queue empty.
+		if self.datagrams.as_ref().is_none_or(|recv| recv.caught_up) {
+			self.subscriber.end_datagrams();
+		}
+		if let Poll::Ready(Err(err)) = routed {
+			return Poll::Ready(Err(err));
+		}
+
+		Poll::Pending
+	}
+
+	/// Route the ready datagrams, see [`DatagramRecv::poll`]; ready only with the error that
+	/// ends the session.
+	fn poll_datagrams(&mut self, waiter: &kio::Waiter, hold: bool) -> Poll<Result<(), Error>> {
+		if let Some(datagrams) = &mut self.datagrams {
+			match datagrams.poll(waiter, hold) {
+				Poll::Ready(Err(err)) => return Poll::Ready(Err(err)),
+				Poll::Ready(Ok(())) => self.datagrams = None,
+				Poll::Pending => {}
+			}
+		}
 		Poll::Pending
 	}
 }
@@ -1734,6 +1824,12 @@ struct DatagramRecv {
 	// A dedicated receive handle: the poll interface takes `&mut self`.
 	recv: Transport,
 	enabled: bool,
+	/// The datagrams with no known track before the sources ran, routed once they have. At
+	/// most one pass's budget, and empty again by the end of each driver poll.
+	held: Vec<bytes::Bytes>,
+	/// Whether the last pass read the transport's queue empty, or the receive ended, rather
+	/// than stopping at its budget.
+	caught_up: bool,
 }
 
 impl DatagramRecv {
@@ -1744,21 +1840,57 @@ impl DatagramRecv {
 			subscriber,
 			recv,
 			enabled,
+			held: Vec::new(),
+			caught_up: true,
 		}
 	}
 
-	fn poll(&mut self, waiter: &kio::Waiter) -> Poll<Result<(), Error>> {
+	/// Route the ready datagrams. With `hold`, before the sources run, keep each with no known
+	/// track: its answer may be among what they decode. The pass after them, in the same
+	/// driver poll, routes those first, then the rest, dropping and counting each that still
+	/// finds no track.
+	fn poll(&mut self, waiter: &kio::Waiter, hold: bool) -> Poll<Result<(), Error>> {
 		if !self.enabled {
 			return Poll::Ready(Ok(()));
 		}
-		// A peer keeping datagrams ready must not hold the session's other tasks.
+		if !hold {
+			for payload in std::mem::take(&mut self.held) {
+				self.route(payload, false);
+			}
+		}
+		// A peer keeping datagrams ready must not hold the session's other tasks, and bounds
+		// what the first pass holds.
 		let mut budget = kio::coop::Budget::new(32);
 		loop {
+			self.caught_up = false;
 			ready!(budget.poll_yield(waiter));
-			let payload = ready!(self.recv.poll_recv_datagram(waiter)).map_err(crate::lite::error::from_transport)?;
-			if let Err(err) = self.subscriber.route_datagram(payload) {
-				tracing::debug!(%err, "dropping datagram");
+			self.caught_up = true;
+			let payload = match ready!(self.recv.poll_recv_datagram(waiter)) {
+				Ok(payload) => payload,
+				Err(err) => {
+					// The session ends without the sources' answers: what is held finds no track.
+					for payload in std::mem::take(&mut self.held) {
+						self.route(payload, false);
+					}
+					return Poll::Ready(Err(crate::lite::error::from_transport(err)));
+				}
+			};
+			self.route(payload, hold);
+		}
+	}
+
+	/// Route one datagram, holding it with `hold` when its track isn't known yet.
+	fn route(&mut self, payload: bytes::Bytes, hold: bool) {
+		match self.subscriber.route_datagram(payload.clone()) {
+			Ok(None) => {}
+			Ok(Some(_)) if hold => self.held.push(payload),
+			Ok(Some(subscribe)) => {
+				self.subscriber
+					.datagrams_unrouted
+					.fetch_add(1, atomic::Ordering::Relaxed);
+				tracing::debug!(subscribe, "dropping datagram for a subscription with no datagram track");
 			}
+			Err(err) => tracing::debug!(%err, "dropping datagram"),
 		}
 	}
 }
@@ -2554,6 +2686,12 @@ enum DatagramState {
 		subscriber: Box<track::Subscriber>,
 		priority: i8,
 	},
+	/// The publisher ended the track: waiting for the end to apply, see
+	/// [`Subscriber::end_datagrams`]. Lite-07 keeps its stream until then.
+	Ending {
+		applied: kio::Consumer<()>,
+		writer: Option<crate::coding::Writer<crate::transport::boxed::SendStream, Version>>,
+	},
 	/// Our side finished: waiting for the publisher to read it.
 	Finish {
 		writer: crate::coding::Writer<crate::transport::boxed::SendStream, Version>,
@@ -2617,13 +2755,21 @@ impl DatagramServe {
 		}
 	}
 
+	/// Yield to the driver once the route is registered, so it routes the datagrams it held
+	/// for this answer before the next pass may read the track's end, which removes the route.
+	/// The answer, the first datagram and the end can share a receive pass.
+	fn poll_routed(waiter: &kio::Waiter) -> Poll<Result<(), Error>> {
+		waiter.waker().wake_by_ref();
+		Poll::Pending
+	}
+
 	fn name(&self) -> &str {
 		match &self.state {
 			DatagramState::Open { request }
 			| DatagramState::Info { request, .. }
 			| DatagramState::Subscribe { request, .. } => request.name(),
 			DatagramState::Live { producer, .. } | DatagramState::Shared { producer, .. } => producer.name(),
-			DatagramState::Finish { .. } | DatagramState::Done => "",
+			DatagramState::Ending { .. } | DatagramState::Finish { .. } | DatagramState::Done => "",
 		}
 	}
 
@@ -2699,6 +2845,7 @@ impl DatagramServe {
 						stream,
 						priority,
 					};
+					return Self::poll_routed(waiter);
 				}
 				DatagramState::Subscribe { subscribing, .. } => {
 					let subscriber = ready!(subscribing.poll_ok(waiter))?;
@@ -2722,6 +2869,7 @@ impl DatagramServe {
 						subscriber: Box::new(subscriber),
 						priority,
 					};
+					return Self::poll_routed(waiter);
 				}
 				DatagramState::Live {
 					producer,
@@ -2736,20 +2884,23 @@ impl DatagramServe {
 						None => None,
 					};
 					if let Some(end) = ended {
-						self.subscriber.datagrams.lock().remove(&self.id);
-						let DatagramState::Live {
-							producer, mut stream, ..
-						} = std::mem::replace(&mut self.state, DatagramState::Done)
+						let DatagramState::Live { producer, stream, .. } =
+							std::mem::replace(&mut self.state, DatagramState::Done)
 						else {
 							unreachable!()
 						};
-						end.inspect_err(|err| producer.clone().abort(err.clone()))?;
-						producer.finish();
-						if stream.writer.finish().is_ok() && version.waits_for_subscriber_fin() {
-							self.state = DatagramState::Finish { writer: stream.writer };
-							continue;
+						if let Err(err) = end {
+							self.subscriber.datagrams.lock().remove(&self.id);
+							producer.abort(err.clone());
+							return Poll::Ready(Err(err));
 						}
-						return Poll::Ready(Ok(()));
+						let mut ends = self.subscriber.datagram_ends.lock();
+						ends.tracks.push((self.id, producer));
+						self.state = DatagramState::Ending {
+							applied: ends.applied.consume(),
+							writer: Some(stream.writer),
+						};
+						continue;
 					}
 					match producer.poll_priority(waiter, Some(*priority)) {
 						Poll::Ready(Some(next)) => {
@@ -2781,9 +2932,14 @@ impl DatagramServe {
 						else {
 							unreachable!()
 						};
-						self.unregister_shared(&producer);
-						producer.finish();
-						return Poll::Ready(Ok(()));
+						let key = (self.path.clone(), producer.name().to_string());
+						let mut ends = self.subscriber.datagram_ends.lock();
+						ends.shared.push((key, producer));
+						self.state = DatagramState::Ending {
+							applied: ends.applied.consume(),
+							writer: None,
+						};
+						continue;
 					}
 					match producer.poll_priority(waiter, Some(*priority)) {
 						Poll::Ready(Some(next)) => {
@@ -2799,6 +2955,16 @@ impl DatagramServe {
 						Poll::Pending => return Poll::Pending,
 					}
 				}
+				DatagramState::Ending { applied, writer } => {
+					ready!(applied.poll_closed(waiter));
+					let Some(mut writer) = writer.take() else {
+						return Poll::Ready(Ok(()));
+					};
+					if writer.finish().is_err() || !version.waits_for_subscriber_fin() {
+						return Poll::Ready(Ok(()));
+					}
+					self.state = DatagramState::Finish { writer };
+				}
 				DatagramState::Finish { writer } => {
 					let _ = ready!(writer.poll_close(waiter));
 					return Poll::Ready(Ok(()));
@@ -2828,9 +2994,10 @@ impl DatagramServe {
 		}
 	}
 
-	/// End the track and the request with `err`, unless it already ended.
+	/// End the track and the request with `err`, unless it already ended. An ended track's
+	/// route goes with its end instead, once the datagrams received with it routed: see
+	/// [`Subscriber::end_datagrams`].
 	fn abort(&mut self, err: Error) {
-		self.subscriber.datagrams.lock().remove(&self.id);
 		match std::mem::replace(&mut self.state, DatagramState::Done) {
 			DatagramState::Open { request } | DatagramState::Subscribe { request, .. } => request.reject(err),
 			DatagramState::Info { request, stream, .. } => {
@@ -2838,6 +3005,7 @@ impl DatagramServe {
 				request.reject(err);
 			}
 			DatagramState::Live { producer, stream, .. } => {
+				self.subscriber.datagrams.lock().remove(&self.id);
 				stream.writer.abort(&err);
 				producer.abort(err);
 			}
@@ -2845,7 +3013,7 @@ impl DatagramServe {
 				self.unregister_shared(&producer);
 				producer.abort(err);
 			}
-			DatagramState::Finish { .. } | DatagramState::Done => {}
+			DatagramState::Ending { .. } | DatagramState::Finish { .. } | DatagramState::Done => {}
 		}
 	}
 }
@@ -2868,10 +3036,12 @@ impl kio::Task for DatagramServe {
 			return Poll::Ready(());
 		}
 		ready!(self.gate.poll_ready(waiter));
-		// Nothing is left to revoke once our side finished, nor on a closed session, whose
-		// end decides how the track ends.
-		if !matches!(self.state, DatagramState::Finish { .. } | DatagramState::Done)
-			&& self.gate.poll_denied(waiter).is_ready()
+		// Nothing is left to revoke once the track ended, nor on a closed session, whose end
+		// decides how the track ends.
+		if !matches!(
+			self.state,
+			DatagramState::Ending { .. } | DatagramState::Finish { .. } | DatagramState::Done
+		) && self.gate.poll_denied(waiter).is_ready()
 			&& self.closed.poll_closed(waiter).is_pending()
 		{
 			tracing::info!(broadcast = %self.subscriber.log_path(&self.path), track = %self.name(), "datagrams no longer authorized");
@@ -3880,7 +4050,7 @@ mod tests {
 				.unwrap();
 		}
 
-		assert!(recv.poll(&kio::Waiter::noop()).is_pending());
+		assert!(recv.poll(&kio::Waiter::noop(), false).is_pending());
 		let other = local.clone();
 		assert!(
 			other.poll_recv_datagram(&kio::Waiter::noop()).is_ready(),
@@ -3888,6 +4058,139 @@ mod tests {
 		);
 	}
 
+	/// Before the sources run, a datagram whose track isn't known yet is held rather than
+	/// dropped, while known tracks' datagrams go on, and the pass after them routes it to a
+	/// track registered in between. One that still finds no track is dropped and counted.
+	#[kio::test]
+	async fn a_datagram_waits_for_the_sources_before_it_is_dropped() {
+		use crate::transport::poll::Session as _;
+
+		let (local, peer) = crate::transport::memory::pair(Default::default());
+		let subscriber = Subscriber::new(SubscriberConfig {
+			runtime: crate::time::sim(),
+			session: crate::driver::Transport::new(local),
+			origin: origin::Config::new(crate::Hop::new(1).unwrap()).produce(),
+			recv_bandwidth: None,
+			version: Version::Lite07,
+			peer_setup: lite::PeerSetup::new(false, crate::transport::Address::Setup),
+			peer_hop: None,
+			cost: None,
+			going_away: Default::default(),
+			auth: crate::auth::Link::new(false),
+		});
+		let mut recv = DatagramRecv::new(subscriber.clone());
+		let send = |subscribe| {
+			let body = lite::Datagram {
+				subscribe,
+				sequence: 0,
+				timestamp: None,
+				payload: bytes::Bytes::from_static(b"x"),
+			};
+			peer.send_datagram(body.encode_bytes(Version::Lite07).unwrap(), Default::default())
+				.unwrap();
+		};
+		let unrouted = || subscriber.datagrams_unrouted.load(atomic::Ordering::Relaxed);
+		let waiter = kio::Waiter::noop();
+
+		send(1);
+		assert!(recv.poll(&waiter, true).is_pending());
+		assert_eq!(recv.held.len(), 1, "dropped before the sources ran");
+		let producer = datagram::Info::default().produce("datagrams");
+		let mut received = producer.consume();
+		subscriber.datagrams.lock().insert(
+			1,
+			DatagramEntry {
+				producer,
+				timescale: None,
+			},
+		);
+		assert!(recv.poll(&waiter, false).is_pending());
+		assert!(matches!(received.poll_recv(&waiter), Poll::Ready(Ok(Some(_)))));
+		assert_eq!(unrouted(), 0);
+
+		// A held datagram doesn't hold up a known track's behind it, which an end the sources
+		// read could otherwise drop.
+		send(2);
+		send(1);
+		assert!(recv.poll(&waiter, true).is_pending());
+		assert!(matches!(received.poll_recv(&waiter), Poll::Ready(Ok(Some(_)))));
+		assert_eq!(recv.held.len(), 1);
+		assert!(recv.poll(&waiter, false).is_pending());
+		assert!(recv.held.is_empty());
+		assert_eq!(unrouted(), 1);
+	}
+
+	/// A track's end waits for the datagrams queued with it, though they outlast a driver
+	/// poll's budget, and applies once a pass reads the queue empty.
+	#[kio::test]
+	async fn an_end_waits_for_the_datagrams_queued_with_it() {
+		use crate::transport::poll::Session as _;
+
+		const QUEUED: u64 = 100;
+		let (local, peer) = crate::transport::memory::pair(Default::default());
+		let subscriber = Subscriber::new(SubscriberConfig {
+			runtime: crate::time::sim(),
+			session: crate::driver::Transport::new(local),
+			origin: origin::Config::new(crate::Hop::new(1).unwrap()).produce(),
+			recv_bandwidth: None,
+			version: Version::Lite07,
+			peer_setup: lite::PeerSetup::new(false, crate::transport::Address::Setup),
+			peer_hop: None,
+			cost: None,
+			going_away: Default::default(),
+			auth: crate::auth::Link::new(false),
+		});
+		let mut driver = SubscriberDriver::new(subscriber.clone(), Vec::new(), false);
+		let producer = datagram::Info::default().produce("datagrams");
+		let mut received = producer.consume();
+		subscriber.datagrams.lock().insert(
+			1,
+			DatagramEntry {
+				producer: producer.clone(),
+				timescale: None,
+			},
+		);
+		for sequence in 0..QUEUED {
+			let body = lite::Datagram {
+				subscribe: 1,
+				sequence,
+				timestamp: None,
+				payload: bytes::Bytes::from_static(b"x"),
+			};
+			peer.send_datagram(body.encode_bytes(Version::Lite07).unwrap(), Default::default())
+				.unwrap();
+		}
+		// As the sources queue an end they read.
+		subscriber.datagram_ends.lock().tracks.push((1, producer));
+
+		let waiter = kio::Waiter::noop();
+		let mut polls = 0;
+		let mut count = 0;
+		while !subscriber.datagram_ends.lock().tracks.is_empty() {
+			assert!(driver.poll(&waiter).is_pending());
+			polls += 1;
+			assert!(polls < 16, "the end never applied");
+			// The track keeps only so many unread.
+			while let Poll::Ready(Ok(Some(_))) = received.poll_recv(&waiter) {
+				count += 1;
+			}
+		}
+		assert!(polls > 1, "one poll read the whole queue");
+		assert!(matches!(received.poll_recv(&waiter), Poll::Ready(Ok(None))));
+		assert_eq!(count, QUEUED);
+		assert_eq!(subscriber.datagrams_unrouted.load(atomic::Ordering::Relaxed), 0);
+	}
+
+	/// Poll `running` as the driver does, which applies the datagram ends queued in its pass.
+	fn poll_run(running: &mut TrackServeRun, waiter: &kio::Waiter) -> Poll<()> {
+		let res = kio::Task::poll(running, waiter);
+		running.serve.subscriber.end_datagrams();
+		match running.state {
+			TrackRunState::Ending { .. } => kio::Task::poll(running, waiter),
+			_ => res,
+		}
+	}
+
 	#[kio::test]
 	async fn padding_is_discarded_only_on_lite07() {
 		for version in [
@@ -4584,7 +4887,7 @@ mod tests {
 				gate,
 				datagrams: None,
 			};
-			kio::wait(|waiter| kio::Task::poll(&mut running, waiter)).await;
+			kio::wait(|waiter| poll_run(&mut running, waiter)).await;
 
 			let end = loop {
 				match reader.recv_group().await {
@@ -4898,7 +5201,7 @@ mod tests {
 			datagrams: None,
 		};
 		assert!(
-			kio::Task::poll(&mut running, &kio::Waiter::noop()).is_ready(),
+			poll_run(&mut running, &kio::Waiter::noop()).is_ready(),
 			"{version:?}: FIN must settle immediately"
 		);
 		if clean {
@@ -5013,11 +5316,11 @@ mod tests {
 			datagrams: None,
 		};
 		assert!(
-			kio::Task::poll(&mut running, &kio::Waiter::noop()).is_pending(),
+			poll_run(&mut running, &kio::Waiter::noop()).is_pending(),
 			"{version:?}: the tail still owes group 0"
 		);
 		crate::transport::poll::Session::close(&session, crate::SessionError::App(7).to_code(), "died");
-		assert!(kio::Task::poll(&mut running, &kio::Waiter::noop()).is_ready());
+		assert!(poll_run(&mut running, &kio::Waiter::noop()).is_ready());
 		let res = reader.recv_group().await.err();
 		assert!(matches!(res, Some(Error::Session(_))), "{version:?}: {res:?}");
 	}
@@ -5168,7 +5471,7 @@ mod tests {
 			if version.has_padding() {
 				// These bytes would name the active subscription without the discriminator.
 				for body in [vec![1], vec![1; 1200], vec![1; 1201]] {
-					subscriber.route_datagram(body.into()).unwrap();
+					assert_eq!(subscriber.route_datagram(body.into()).unwrap(), None);
 					assert!(recv().is_pending());
 				}
 			}
@@ -5183,7 +5486,7 @@ mod tests {
 				.encode_bytes(version)
 				.unwrap()
 			};
-			subscriber.route_datagram(payload(1, 1)).unwrap();
+			assert_eq!(subscriber.route_datagram(payload(1, 1)).unwrap(), None);
 			let Poll::Ready(Ok(Some(datagram))) = recv() else {
 				panic!("{version}: the datagram was not delivered");
 			};
@@ -5193,17 +5496,17 @@ mod tests {
 			let max_payload = 1200 - payload(2, 0).len();
 			let oversized = payload(2, max_payload + 1);
 			assert_eq!(oversized.len(), 1201);
-			subscriber.route_datagram(oversized).unwrap();
+			assert_eq!(subscriber.route_datagram(oversized).unwrap(), None);
 			assert!(recv().is_pending(), "oversized body was delivered");
 			let boundary = payload(3, max_payload);
 			assert_eq!(boundary.len(), 1200);
-			subscriber.route_datagram(boundary).unwrap();
+			assert_eq!(subscriber.route_datagram(boundary).unwrap(), None);
 			assert!(matches!(recv(), Poll::Ready(Ok(Some(datagram))) if datagram.sequence == 3));
 
-			// An unknown subscription's datagram goes nowhere.
+			// An unknown subscription's datagram goes nowhere, and names it.
 			let mut other = payload(4, 1).to_vec();
 			other[usize::from(version.has_padding())] = 2;
-			subscriber.route_datagram(other.into()).unwrap();
+			assert_eq!(subscriber.route_datagram(other.into()).unwrap(), Some(2));
 			assert!(recv().is_pending());
 		}
 	}
@@ -6352,7 +6655,7 @@ mod tests {
 				gate,
 				datagrams: None,
 			};
-			assert!(kio::Task::poll(&mut running, &kio::Waiter::noop()).is_ready());
+			assert!(poll_run(&mut running, &kio::Waiter::noop()).is_ready());
 			let end = reader.recv_group().now_or_never().expect("the track ended").map(|_| ());
 			match reset {
 				false => assert!(matches!(end, Ok(())), "{end:?}"),
@@ -9297,11 +9600,20 @@ impl SharedDatagrams {
 }
 
 impl SharedDatagrams {
-	/// Stop routing to the track and end it with `end`.
+	/// Stop routing to the track and end it with `end`. A clean end waits for the datagrams
+	/// received with it, see [`Subscriber::end_datagrams`].
 	fn end(&mut self, end: Result<(), Error>) {
 		let Some(producer) = self.producer.take() else {
 			return;
 		};
+		let Err(err) = end else {
+			self.subscriber
+				.datagram_ends
+				.lock()
+				.shared
+				.push((self.key.clone(), producer));
+			return;
+		};
 		let mut shared = self.subscriber.legacy_datagrams.lock();
 		if shared
 			.get(&self.key)
@@ -9310,10 +9622,7 @@ impl SharedDatagrams {
 			shared.remove(&self.key);
 		}
 		drop(shared);
-		match end {
-			Ok(()) => producer.finish(),
-			Err(err) => producer.abort(err),
-		}
+		producer.abort(err);
 	}
 }
 
@@ -9346,6 +9655,12 @@ enum TrackRunState {
 		_working: crate::session::Working,
 	},
 	Serve(ServeLoop),
+	/// Lite-05/06: the publisher finished the track, whose subscription keeps its stream until
+	/// the datagram ends apply, see [`Subscriber::end_datagrams`].
+	Ending {
+		applied: kio::Consumer<()>,
+		active: SubStream,
+	},
 	/// Preserve the completion FIN until the publisher acknowledges it. Lite-07 also reads
 	/// on to the publisher's FIN in reply, so dropping our receive half never refuses it.
 	Finish {
@@ -9424,12 +9739,26 @@ impl TrackServeRun {
 				}
 				// Each fetch in flight resets itself as it drops, seeing the same denial.
 			}
-			TrackRunState::Finish { .. } | TrackRunState::Done => {}
+			TrackRunState::Ending { .. } | TrackRunState::Finish { .. } | TrackRunState::Done => {}
 		}
 	}
 }
 
 impl TrackServeRun {
+	/// Finish our side of the subscription, `true` once it waits for the publisher to read it.
+	fn finish_sub(&mut self, mut active: SubStream, finished: bool) -> bool {
+		let version = self.serve.subscriber.version;
+		if active.stream.writer.finish().is_err() || !finished || !version.waits_for_subscriber_fin() {
+			return false;
+		}
+		self.state = TrackRunState::Finish {
+			writer: Some(active.stream.writer),
+			reader: version.keeps_subscribe_open().then_some(active.stream.reader),
+			_working: active._working,
+		};
+		true
+	}
+
 	/// Nobody wants the track anymore (the origin failed over, the reader left): stop
 	/// waiting on a token or a peer that may never answer, which would otherwise hold
 	/// this task, its TRACK stream, and the track for good. Dropping the fetch resets the
@@ -9470,7 +9799,7 @@ impl kio::Task for TrackServeRun {
 		// A finished track only waits for its FIN to be acknowledged: nothing is left to revoke.
 		// Nor on a closed session, whose grants end with it: the session's end decides how
 		// its tracks end.
-		if !matches!(self.state, TrackRunState::Finish { .. })
+		if !matches!(self.state, TrackRunState::Ending { .. } | TrackRunState::Finish { .. })
 			&& self.gate.poll_denied(waiter).is_ready()
 			&& self.serve.subscriber.session.clone().poll_closed(waiter).is_pending()
 		{
@@ -9610,23 +9939,37 @@ impl kio::Task for TrackServeRun {
 						datagrams.end(Err(Error::Cancel));
 					}
 
-					if let Sub::Active(mut active) = serve_loop.sub {
-						self.serve.subscriber.remove_subscribe(active.id);
-						if active.stream.writer.finish().is_ok()
-							&& finished && self.serve.subscriber.version.waits_for_subscriber_fin()
-						{
-							let keeps_open = self.serve.subscriber.version.keeps_subscribe_open();
-							self.state = TrackRunState::Finish {
-								writer: Some(active.stream.writer),
-								reader: keeps_open.then_some(active.stream.reader),
-								_working: active._working,
-							};
+					if let Sub::Active(active) = serve_loop.sub {
+						let applied = match finished {
+							true => self.serve.subscriber.finish_subscribe(active.id),
+							false => {
+								self.serve.subscriber.remove_subscribe(active.id);
+								None
+							}
+						};
+						// The subscription carries its name's datagrams, which end with it.
+						if let Some(applied) = applied {
+							self.state = TrackRunState::Ending { applied, active };
+							continue;
+						}
+						if self.finish_sub(active, finished) {
 							continue;
 						}
 					}
 
 					return Poll::Ready(());
 				}
+				TrackRunState::Ending { applied, .. } => {
+					ready!(applied.poll_closed(waiter));
+					let TrackRunState::Ending { active, .. } = std::mem::replace(&mut self.state, TrackRunState::Done)
+					else {
+						unreachable!()
+					};
+					if self.finish_sub(active, true) {
+						continue;
+					}
+					return Poll::Ready(());
+				}
 				TrackRunState::Finish { writer, reader, .. } => {
 					// Responses after the tail settled change nothing: read past them, yielding
 					// to the session's other tasks while a peer streams them.
diff --git a/rs/moq-net/src/server.rs b/rs/moq-net/src/server.rs
index 07343c53954..fea9d832b0a 100644
--- a/rs/moq-net/src/server.rs
+++ b/rs/moq-net/src/server.rs
@@ -240,6 +240,7 @@ impl Server {
 				bandwidth: crate::bandwidth::Allocator::default(),
 				viewers,
 				peer_implementation: start.peer_implementation,
+				datagrams_unrouted: start.datagrams_unrouted,
 			},
 		))
 	}
@@ -805,6 +806,7 @@ impl PausedIetf {
 				bandwidth: crate::bandwidth::Allocator::default(),
 				viewers: Default::default(),
 				peer_implementation,
+				datagrams_unrouted: None,
 			},
 		))
 	}
@@ -935,6 +937,7 @@ impl NegotiatedStart {
 				bandwidth: crate::bandwidth::Allocator::default(),
 				viewers,
 				peer_implementation: start.peer_implementation,
+				datagrams_unrouted: start.datagrams_unrouted,
 			},
 		))
 	}
diff --git a/rs/moq-net/src/session.rs b/rs/moq-net/src/session.rs
index b5042245e90..d86c9f46f7d 100644
--- a/rs/moq-net/src/session.rs
+++ b/rs/moq-net/src/session.rs
@@ -1,7 +1,10 @@
 //! A MoQ session handle and a snapshot of its connection statistics.
 
 use std::{
-	sync::Arc,
+	sync::{
+		Arc,
+		atomic::{AtomicU64, Ordering},
+	},
 	task::{Poll, ready},
 	time::Duration,
 };
@@ -127,6 +130,11 @@ pub struct Stats {
 	/// Total receive streams evicted because incomplete messages exhausted the receive window.
 	/// A count above zero means the receive window is too small for what the peer sends.
 	pub streams_evicted: Option<u64>,
+
+	/// Total datagrams received for a subscription with no datagram track: one this session
+	/// doesn't know, has ended, or whose answer it hasn't received. `None` on a version without
+	/// datagrams: moq-transport and moq-lite before 05.
+	pub datagrams_unrouted: Option<u64>,
 }
 
 /// The congestion controller's view of the connection, as PROBE reports it.
@@ -194,6 +202,8 @@ pub struct Session {
 	credential: Option<auth::Credential>,
 	/// The subscriptions and fetches the protocol tasks carry.
 	work: Work,
+	/// What [`Stats::datagrams_unrouted`] reads.
+	datagrams_unrouted: Option<Arc<AtomicU64>>,
 }
 
 impl Session {
@@ -275,8 +285,8 @@ impl Session {
 	///
 	/// Cheap and non-blocking: this reads the latest sample the session's
 	/// driver took, and schedules a refresh, so periodic polling observes
-	/// fresh counters (100ms cadence). See [`Stats`] for which
-	/// metrics each backend reports.
+	/// fresh counters (100ms cadence), and reads the session's own counters
+	/// live. See [`Stats`] for which metrics each backend reports.
 	pub fn stats(&self) -> Stats {
 		let mut state = self.stats.lock();
 		// A read is demand: wake the sampler, but only mutate (and so wake)
@@ -284,7 +294,13 @@ impl Session {
 		if !state.demanded {
 			state.demanded = true;
 		}
-		state.sample
+		Stats {
+			datagrams_unrouted: self
+				.datagrams_unrouted
+				.as_ref()
+				.map(|count| count.load(Ordering::Relaxed)),
+			..state.sample
+		}
 	}
 
 	/// Close the transport with an explicit error, instead of waiting for the last
@@ -440,6 +456,9 @@ pub(super) struct Handles {
 	pub peer_target: Option<kio::Consumer<bandwidth::Rate>>,
 	/// What the peer's SETUP advertised as its implementation.
 	pub peer_implementation: crate::setup::PeerImplementation,
+	/// The driver's count of datagrams it routed to no datagram track, for a version that
+	/// carries datagrams.
+	pub datagrams_unrouted: Option<Arc<AtomicU64>>,
 }
 
 impl Session {
@@ -461,6 +480,7 @@ impl Session {
 			viewers,
 			peer_target,
 			peer_implementation,
+			datagrams_unrouted,
 		} = handles;
 		let goaway = Arc::new(goaway);
 		auth.drain_with(goaway.clone());
@@ -534,6 +554,7 @@ impl Session {
 			auth: auth.handle().clone(),
 			credential,
 			work,
+			datagrams_unrouted,
 		};
 		let driver = crate::Driver::new(
 			runtime.clone(),
@@ -934,6 +955,8 @@ fn snapshot<S: crate::transport::poll::Session>(session: &S) -> Stats {
 		packets_received: metrics.packets_received(),
 		packets_lost: metrics.packets_lost(),
 		streams_evicted: metrics.streams_evicted(),
+		// Counted by the protocol, not the transport: filled in by `Session::stats`.
+		datagrams_unrouted: None,
 	}
 }
 
diff --git a/rs/moq-net/tests/integration/datagram.rs b/rs/moq-net/tests/integration/datagram.rs
index b13ca495a41..5d5451f68e6 100644
--- a/rs/moq-net/tests/integration/datagram.rs
+++ b/rs/moq-net/tests/integration/datagram.rs
@@ -566,3 +566,151 @@ async fn moq_transport_has_no_datagram_tracks() {
 		b"frame"
 	);
 }
+
+/// A publisher that answers a datagram request and writes at once sends the datagram right
+/// behind its answer, so both reach the subscriber in one receive pass, with the track's end
+/// too when it finishes at once. The subscriber decodes the answer before it routes the
+/// datagram, and routes the datagram before it ends the track.
+#[kio::test]
+async fn a_datagram_sent_right_behind_its_answer_arrives() {
+	for version in ["moq-lite-05", "moq-lite-06", "moq-lite-07-wip"] {
+		for finish in [false, true] {
+			let chain = Chain::new(&[version]).await;
+			let requests = chain.publication.broadcast().requests();
+			let mut handler = requests.datagrams();
+			let mut consumer = chain.remote().await.datagrams(TRACK).unwrap();
+			let request = kio::clock::timeout(TIMEOUT, handler.requested())
+				.await
+				.unwrap_or_else(|_| panic!("{version}: the request never reached the handler"))
+				.unwrap();
+			let mut producer = request.accept(timed());
+			assert_eq!(producer.append(millis(1), &b"first"[..]).unwrap(), 0, "{version}");
+			if finish {
+				producer.finish();
+			}
+			let datagram = recv(&mut consumer)
+				.await
+				.unwrap_or_else(|err| panic!("{version} finish={finish}: {err:?}"))
+				.unwrap_or_else(|| panic!("{version} finish={finish}: the datagram was dropped"));
+			assert_eq!(datagram.sequence, 0, "{version}");
+			assert_eq!(&datagram.payload[..], b"first", "{version}");
+			if finish {
+				assert!(recv(&mut consumer).await.unwrap().is_none(), "{version}");
+			}
+			// The second node subscribes through the session it accepted.
+			assert_eq!(
+				chain.pairs[0].server.stats().datagrams_unrouted,
+				Some(0),
+				"{version} finish={finish}"
+			);
+		}
+	}
+}
+
+/// A publisher that writes a last datagram and finishes at once sends the datagram right
+/// ahead of its track's end, so both reach the subscriber in one receive pass. The
+/// subscriber routes the datagram before it ends the track.
+#[kio::test]
+async fn a_datagram_sent_right_before_its_end_arrives() {
+	for version in ["moq-lite-05", "moq-lite-06", "moq-lite-07-wip"] {
+		let chain = Chain::new(&[version]).await;
+		let mut producer = chain.publication.broadcast().create_datagrams(TRACK, timed()).unwrap();
+		let mut consumer = chain.consume(&producer, 1).await;
+		producer.append(millis(1), &b"last"[..]).unwrap();
+		producer.finish();
+		let datagram = kio::clock::timeout(TIMEOUT, consumer.recv())
+			.await
+			.unwrap_or_else(|_| panic!("{version}: nothing arrived"))
+			.unwrap_or_else(|err| panic!("{version}: {err:?}"))
+			.unwrap_or_else(|| panic!("{version}: the datagram was dropped"));
+		assert_eq!(&datagram.payload[..], b"last", "{version}");
+		assert!(recv(&mut consumer).await.unwrap().is_none(), "{version}");
+		assert_eq!(chain.pairs[0].server.stats().datagrams_unrouted, Some(0), "{version}");
+	}
+}
+
+/// Lite-05/06: a stream track's subscription carries its name's datagrams, and a publisher
+/// answering the track, writing a datagram and finishing at once sends all three in one
+/// receive pass. The subscriber routes the datagram to the name's datagram track before the
+/// stream track's end removes it.
+#[kio::test]
+async fn a_stream_tracks_datagram_sent_between_its_answer_and_end_arrives() {
+	for version in ["moq-lite-05", "moq-lite-06"] {
+		let chain = Chain::new(&[version]).await;
+		let mut requests = chain.publication.broadcast().requests();
+		let mut handler = requests.datagrams();
+		let remote = chain.remote().await;
+		let mut subscribing = kio::clock::sim::spawn(async move { remote.track(TRACK).unwrap().subscribe(None).await });
+		let stream = kio::clock::timeout(TIMEOUT, requests.requested_track())
+			.await
+			.unwrap_or_else(|_| panic!("{version}: the stream lookup never reached the publisher"))
+			.unwrap();
+		let datagrams = kio::clock::timeout(TIMEOUT, handler.requested())
+			.await
+			.unwrap_or_else(|_| panic!("{version}: the datagram handler was never asked"))
+			.unwrap();
+		let track = stream.accept(moq_net::track::Info::default().with_timescale(Timescale::MILLI));
+		let mut producer = datagrams.accept(timed());
+		producer.append(millis(1), &b"only"[..]).unwrap();
+		producer.finish();
+		track.finish().unwrap();
+		let mut subscriber = (&mut subscribing)
+			.await
+			.expect("subscribe panicked")
+			.unwrap_or_else(|err| panic!("{version}: {err:?}"));
+		assert!(
+			kio::clock::timeout(TIMEOUT, subscriber.recv_group())
+				.await
+				.expect("end timeout")
+				.unwrap()
+				.is_none(),
+			"{version}"
+		);
+		assert_eq!(chain.pairs[0].server.stats().datagrams_unrouted, Some(0), "{version}");
+	}
+}
+
+/// A track's end waits for the subscriber to read the datagrams queued with it, so a flood
+/// that keeps its receive queue full delays the end. Meanwhile the track keeps its stream, and
+/// the session stays busy, so the peer's stream credit bounds the ends a flood can leave queued.
+#[kio::test]
+async fn a_track_ended_under_a_datagram_flood_keeps_its_stream() {
+	use moq_net::transport::poll::Session as _;
+
+	for version in ["moq-lite-05", "moq-lite-06", "moq-lite-07-wip"] {
+		let chain = Chain::new(&[version]).await;
+		let producer = chain.publication.broadcast().create_datagrams(TRACK, timed()).unwrap();
+		let mut consumer = chain.consume(&producer, 1).await;
+		// Each names no subscription, so the subscriber reads and drops it. The queue holds 1024.
+		let flood = || {
+			for _ in 0..512 {
+				let _ = chain.pairs[0]
+					.client_transport
+					.send_datagram(b"x"[..].into(), Default::default());
+			}
+		};
+		flood();
+		producer.finish();
+		for _ in 0..32 {
+			flood();
+			// One turn for the session's tasks, which read at most a budget each.
+			let mut turned = false;
+			kio::wait(|waiter| {
+				if std::mem::replace(&mut turned, true) {
+					return std::task::Poll::Ready(());
+				}
+				waiter.waker().wake_by_ref();
+				std::task::Poll::Pending
+			})
+			.await;
+			assert!(
+				chain.pairs[0].server.poll_idle(&kio::Waiter::noop()).is_pending(),
+				"{version}: the track released its stream before its end applied"
+			);
+		}
+		assert!(recv(&mut consumer).await.unwrap().is_none(), "{version}");
+		kio::clock::timeout(TIMEOUT, chain.pairs[0].server.idle())
+			.await
+			.unwrap_or_else(|_| panic!("{version}: the track never released its stream"));
+	}
+}