diff --git a/quest/m0/agent-disk-budget.md b/quest/m0/agent-disk-budget.md
index cdadd17eb33..162151812f1 100644
--- a/quest/m0/agent-disk-budget.md
+++ b/quest/m0/agent-disk-budget.md
@@ -17,10 +17,10 @@ unknown, or held open by a process. Its design and the read-only classification
 of 2026-11-05 (873 finished checkouts holding about 76.6 GiB of managed targets)
 are in [moq-dev/moq#7960](https://github.com/moq-dev/moq/pull/7960).
 
-Once it is installed, sample `df /` across a busy day, confirm
+Installed 2026-11-06: [kixelated/dotfiles#41](https://github.com/kixelated/dotfiles/pull/41)
+merged at 16:35:00Z, and `worktree-clean.timer` last ran at 16:35:06Z
+(checked 2026-11-06, /quest-unblock).
+
+Now sample `df /` across a busy day, confirm
 `worktree-clean.service`'s journal shows reclaimed targets and no live checkout
 touched, and delete this quest in a PR recording both.
-
-## Waiting
-
-- Maintainer: merge and install [kixelated/dotfiles#41](https://github.com/kixelated/dotfiles/pull/41) on the desktop, since an agent session must not install over the live dotfiles or mass-delete targets; check that `systemctl --user list-timers` lists `worktree-clean.timer` with a last run that postdates the install.
diff --git a/quest/m0/ci/README.md b/quest/m0/ci/README.md
index 0c8b29b8a5f..6ea0d8c2e18 100644
--- a/quest/m0/ci/README.md
+++ b/quest/m0/ci/README.md
@@ -86,8 +86,10 @@ re-enqueues them. Batching and pre-checks are dropped, and the host gate is
 frozen. The landing quest closed 2026-11-04 with busy hours merging a median
 11.0 PRs against the queue baseline's 6.0 (its
 [last version](https://github.com/moq-dev/moq/blob/17a81d6c64/quest/m0/ci/land.md)
-holds the cutover record); a second concurrent entry is a
-[measured trial](/quest/m0/ci/queue-concurrency.md).
+holds the cutover record). Decided 2026-11-06 (maintainer, /quest-unblock):
+✅ drop the trial of a second concurrent entry, which ran out of shared runner
+disk on 2026-11-05; the queue stays at one entry. Not chosen: retrying it after
+[kixelated/nixos#26](https://github.com/kixelated/nixos/pull/26)'s inode fix.
 
 Decided 2026-10-23 (maintainer), to speed up the serial queue: structural
 changes first (concurrent entries, parallel modules, one test build), then a
@@ -175,10 +177,9 @@ The historical samples locate candidates; they are not controlled benchmarks.
 ## Required
 
 - [Read-only pull-request CI](/quest/m0/ci/read-only-secrets.md) - write secrets and publisher identities reach only protected branches and tags, never a pushed branch
+- [Stop publishing to JSR](/quest/m0/ci/jsr-retire.md) - `@moq/*` publishes only to npm and the JSR packages are archived, so no JSR token or OIDC link remains
 - [Verify the R2 Rust cache](/quest/m0/ci/mbx-r2-verify.md) - confirm the hosted Nightly jobs reuse the previous Nightly, then measure restore time and expiry
 - [Verify the Nix runtime cache](/quest/m0/ci/nix-cache-verify.md) - hosted Cache uploads `main`'s relay and CLI, and Smoke's nix channel substitutes them
-- [Record hosted cargo-hakari evidence](/quest/m0/ci/hakari.md) - compare scheduled macOS and Windows cache hits and estimated compiler work saved before and after the workspace-hack
 - [Drop main from the publish Environment](/quest/m0/ci/publish-release-only.md) - the maintainer narrows `publish` to `release` and release tags once no job naming it runs as `main`
 - [Release tags push to nix.moq.dev, and Cachix stops taking writes](/quest/m0/ci/cachix-retire.md) - backport `release-nix.yml` and its Just module to `release`, drop `cachix.yml`, prove a tag substitutes from nix.moq.dev, then revoke the Cachix token (the cache stays for old tags)
 - [Measure the Linux cache effect of native media exclusions](/quest/m0/ci/hakari-followups.md) - scheduled Linux jobs measure cache reuse after unrelated tests stop compiling PipeWire and libclang
-- [Build two queue entries at once if it helps](/quest/m0/ci/queue-concurrency.md) - a measured trial of `maximumEntriesToBuild: 2` against the serial lane's burst latency
diff --git a/quest/m0/ci/hakari-followups.md b/quest/m0/ci/hakari-followups.md
index 2cfaf7e58c7..e28b8895483 100644
--- a/quest/m0/ci/hakari-followups.md
+++ b/quest/m0/ci/hakari-followups.md
@@ -64,21 +64,22 @@ its mbx summaries. The first post-merge run,
 [42050683248](https://github.com/moq-dev/moq/actions/runs/42050683248/job/127325640293),
 cancelled that job at the 60-minute timeout, so it is incomplete evidence.
 
+Checked 2026-11-06 (/quest-unblock): the baseline's 10 summaries total 333 hits and 359 misses
+(48.12%), 401 not looked up, 12 bypassed, 2 remote failures, about 12m28s of
+compiler time avoided. The first complete post-merge run,
+[42236107954](https://github.com/moq-dev/moq/actions/runs/42236107954/job/127954016736)
+(2026-11-06), totals 427 hits and 615 misses (40.98%), 20 not looked up, 4
+bypassed, 5 remote failures, about 12m0s avoided; several builds hit the 5 GiB
+download budget. It failed only on the `moq-uring` socket-queue benchmark's 60 s
+test timeout, as the baseline did.
+
 Public API: none. Wire: none.
 
 ## Waiting
 
-- moq-dev/moq: collect the baseline run 41852517544's and the first two
-  complete post-merge Nightlies' mbx hit rates and available compiler-time
-  fields for `Nightly (Rust benchmark tests)`. No complete post-merge evidence
-  exists yet: the 2026-11-05 run cancelled the job at 60 minutes. If the cache
+- moq-dev/moq: collect a second complete post-merge Nightly's mbx hit rate and
+  compiler-time fields for `Nightly (Rust benchmark tests)`, beside the
+  baseline and 2026-11-06 numbers in the Plan. If the cache
   cost is material, present the measured tradeoff to the maintainer; recommend
   keeping the narrow final exclusions unless the measurements justify another
   design.
-
-## Related
-
-- [Unify dependency features with cargo-hakari](/quest/m0/ci/hakari.md) - owns
-  the separate macOS/Windows evidence and FFI invocation alignment in
-  [moq-dev/moq#7666](https://github.com/moq-dev/moq/pull/7666); do not duplicate
-  those measurements
diff --git a/quest/m0/ci/hakari.md b/quest/m0/ci/hakari.md
deleted file mode 100644
index 8b9841a4873..00000000000
--- a/quest/m0/ci/hakari.md
+++ /dev/null
@@ -1,64 +0,0 @@
-# [S] Record hosted cargo-hakari cache evidence
-
-## Goal
-
-Nightly's hosted macOS and Windows jobs record their mbx cache-hit evidence and
-estimated compiler work saved before and after the workspace-hack.
-
-## Plan
-
-Decided 2026-11-04 (maintainer, /quest-unblock): ✅ accept the mbx cache-hit
-evidence and estimated compiler savings as sufficient. Not chosen: add per-job
-CPU instrumentation and measure CPU totals. The estimates are not measured CPU
-savings.
-
-Decided with the maintainer on 2026-10-25: use cargo-hakari rather than only
-trimming CI's feature permutations.
-[moq-dev/moq#6985](https://github.com/moq-dev/moq/pull/6985) added the path-only
-dev-dependency layout, unifying test, lint, and bench builds. Keep that layout;
-library-only builds do not need the hack.
-
-The remaining FFI invocation alignment landed in
-[moq-dev/moq#7666](https://github.com/moq-dev/moq/pull/7666) (merged
-2026-11-05): default builds use
-`cargo build-ffi` with `openh264`, native builds omit `--target`, and only cross
-builds name a target. Python and Dart host tests retain `testing` for the manual
-clock and leak allocator, with separate target directories so they cannot
-replace the default cdylib. Their third-party feature identities match the
-default host build; the intentional `kio/manual` split affects workspace crates.
-
-Compare the mbx summaries of the last scheduled Nightly before the
-[2026-11-02 merge](https://github.com/moq-dev/moq/commit/8e53bf32185fec578e460ff6ccbe41a80a039a6a)
-with the first two after. Query only scheduled runs on `main`:
-`gh run list --workflow nightly.yml --branch main --event schedule`.
-The baseline is [2026-11-01](https://github.com/moq-dev/moq/actions/runs/41313466339).
-The [2026-11-02 run](https://github.com/moq-dev/moq/actions/runs/41483654426)
-has partial macOS summaries before a websocket-test timeout and no Windows
-compilation (NASM installation returned HTTP 503).
-[2026-11-03](https://github.com/moq-dev/moq/actions/runs/41656613559) completed
-both platform jobs. [2026-11-04](https://github.com/moq-dev/moq/actions/runs/41852517544)
-completed Windows, but cancelled macOS before any step ran. Windows therefore
-has two complete after-runs; macOS has only one. Logs expose object-cache counts
-and estimated compiler work saved, but no measured user/system CPU totals.
-Do not call elapsed time CPU time, or attribute these earlier runs to the FFI
-alignment, which landed only on 2026-11-05.
-
-The 2026-11-04 maintainer decision accepts hosted CI as the strict Nix gate;
-a local namespace-probe skip is expected. The pkg-config and Gradle repairs
-have landed, so neither remains an external prerequisite.
-
-Public API and wire: none.
-
-## Waiting
-
-- moq-dev/moq: inspect the next scheduled Nightly for a second complete macOS
-  after-run. The macOS job cannot give one until
-  [Nightly's macOS platform job passes](/quest/m0/nightly/macos.md) fixes
-  `moq-audio`'s macOS test build: the
-  [2026-11-05 macOS job](https://github.com/moq-dev/moq/actions/runs/42050683248/job/127326015410)
-  failed compiling it (E0277, `rs/moq-audio/src/capture.rs:859`), and the
-  [Nov 4](https://github.com/moq-dev/moq/actions/runs/41852517544/job/126656206251)
-  one was cancelled with no steps. Run
-  `gh run list --repo moq-dev/moq --workflow nightly.yml --event schedule`,
-  inspect the next macOS job and record its mbx summaries alongside Nov 3.
-  This measurement wait outlives the implementation PR; never dispatch Nightly.
diff --git a/quest/m0/ci/jsr-retire.md b/quest/m0/ci/jsr-retire.md
new file mode 100644
index 00000000000..1b48915a2a6
--- /dev/null
+++ b/quest/m0/ci/jsr-retire.md
@@ -0,0 +1,40 @@
+# [S] Stop publishing to JSR
+
+## Goal
+
+`@moq/*` packages publish only to npm. The JS release path no longer
+generates `jsr.json` or runs `deno publish`, no workflow or Environment needs
+a `JSR_TOKEN`, and the `@moq` packages on jsr.io are archived with a pointer
+to npm, so nothing can publish to them again. Deno users import the npm
+packages through `npm:` specifiers.
+
+## Plan
+
+Decided 2026-11-06 (maintainer, /quest-unblock): ✅ drop JSR. Over the
+preceding 30 days `@moq/net` had about 42 JSR downloads against about 341k
+on npm, and `@moq/hang` about 38 against about 306k. `@moq/watch` and
+`@moq/publish` never published there (they set `"jsr": false`), and most JSR
+packages last published in June. Not chosen: keeping JSR behind a `JSR_TOKEN`
+in the `npm` Environment, which was
+[read-only pull-request CI](/quest/m0/ci/read-only-secrets.md)'s step for
+JSR, whose repository OIDC trust cannot require an Environment.
+
+- Remove JSR from `js/common/release.ts`, `js/common/package.ts` (the
+  `jsr.json` generation and the `"jsr": false` opt-out), their tests, the
+  `jsr` field in each `package.json`, and the `JSR_TOKEN` plumbing in
+  `release-js.yml`. Packages publish from `release`, so backport the change
+  there in the same PR, the way other release-workflow changes land.
+- Rewrite doc comments and docs that link `jsr.io` (such as the
+  `@moq/signals` re-export in `js/net/src/index.ts`) to npm.
+- Archiving on jsr.io needs the maintainer's JSR login. Once the backport
+  lands, they archive each `@moq` package with a description pointing to
+  npm; check that `https://api.jsr.io/scopes/moq/packages` lists every
+  package as archived. Archiving also ends the repository's OIDC link, so no
+  separate unlinking is needed.
+
+Public API: none in code; JSR stops receiving new versions. Wire: none.
+
+## Related
+
+- [Read-only pull-request CI](/quest/m0/ci/read-only-secrets.md) - its JSR token step is replaced by this quest
+- [Claim the new @moq npm names](/quest/m3/release/npm-first-publish.md) - claims only npm names once JSR is gone
diff --git a/quest/m0/ci/mbx-r2-verify.md b/quest/m0/ci/mbx-r2-verify.md
index 457d80806ca..9e1ec3bc00f 100644
--- a/quest/m0/ci/mbx-r2-verify.md
+++ b/quest/m0/ci/mbx-r2-verify.md
@@ -36,8 +36,8 @@ self-hosted `moq-queue` runner with mbx's local store, so it neither reads nor
 writes R2.
 
 Decided 2026-10-27 (maintainer): the cross-job miss report moved to
-[unifying dependency features](/quest/m0/ci/hakari.md), which measures its own
-before and after baseline and no longer waits on this quest.
+the cargo-hakari quest, which recorded its own before and after baseline and
+finished 2026-11-06.
 
 The first scheduled Nightly on mbx 1.28.0,
 [40506938673](https://github.com/moq-dev/moq/actions/runs/40506938673)
diff --git a/quest/m0/ci/nix-cache-verify.md b/quest/m0/ci/nix-cache-verify.md
index 467d9aa0ba3..092a1dbe778 100644
--- a/quest/m0/ci/nix-cache-verify.md
+++ b/quest/m0/ci/nix-cache-verify.md
@@ -46,13 +46,22 @@ uploaded both the `moq-cli` and `moq-relay` closures from its
 
 Use the scheduled and push runs; never dispatch Nightly for this evidence.
 
+Checked 2026-11-06 (/quest-unblock): the next scheduled Smoke,
+[42245927828](https://github.com/moq-dev/moq/actions/runs/42245927828)
+(2026-11-06, started 15:45Z), fetched the deps from `nix.moq.dev` but still
+compiled both binaries. Smoke builds `github:moq-dev/moq#...` unpinned, so it
+built main as of 16:28Z (2916531c19), whose Cache run was cancelled, rather
+than its own head. Any Smoke that starts while main is ahead of its last
+completed Runtime upload misses the same way.
+
 ## Waiting
 
-- moq-dev/moq: the next scheduled Smoke run (08:00 UTC) on
-  [moq-dev/moq#7662](https://github.com/moq-dev/moq/pull/7662)'s merge or
-  later, whose `ubuntu-latest / nix` job copies `moq-relay` and `moq` from
-  `https://nix.moq.dev` instead of compiling them. Check with
-  `gh run list --workflow smoke.yml --event schedule`.
+- moq-dev/moq: a scheduled Smoke run (08:00 UTC) whose `ubuntu-latest / nix`
+  job copies `moq-relay` and `moq` from `https://nix.moq.dev` instead of
+  compiling them. Check with `gh run list --workflow smoke.yml --event schedule`,
+  and confirm the main commit it built had a completed Cache
+  `Runtime (ubuntu-24.04)` upload; a miss on a commit without one says nothing
+  about the cache.
 
 ## Related
 
diff --git a/quest/m0/ci/queue-concurrency.md b/quest/m0/ci/queue-concurrency.md
deleted file mode 100644
index 9155f355ac8..00000000000
--- a/quest/m0/ci/queue-concurrency.md
+++ /dev/null
@@ -1,53 +0,0 @@
-# [S] The merge queue builds two entries at once if it measurably helps
-
-## Goal
-
-A measured trial decides whether moq's merge queue builds two entries at once
-(`maximumEntriesToBuild: 2`) or stays at one. Done when the PR records both
-settings' burst p90 enqueue-to-merge latency and median merges per
-never-empty hour over comparable windows, and the maintainer keeps the winner
-in the ruleset.
-
-## Plan
-
-Planned 2026-11-04 with the maintainer. The landing quest
-([last version](https://github.com/moq-dev/moq/blob/17a81d6c64/quest/m0/ci/land.md))
-ran the queue at build concurrency 1 and said to try 2 only with measured
-data. Its performance goal closed on that data (decided 2026-11-04 ✅): over
-2026-11-03 06:47Z to 2026-11-04 06:47Z, the eight hours the queue was never
-empty merged a median of 11.0 PRs against the queue baseline's 6.0.
-
-Why try 2: with a median queue build of 4.4 min, one lane tops out near 13
-merges an hour, and busy hours already run close to that. Bursts of 22-26
-entries on 2026-11-03 pushed p90 enqueue-to-merge to about 58 min (median
-20.6 min), and waiting behind other entries was most of it.
-
-Method: occupancy comes from the PRs' `AddedToMergeQueue`,
-`RemovedFromMergeQueue` and `Merged` timeline events (reconstruct removed and
-unmerged entries too). Compare at least one busy day at each setting, and
-count queue failures per build, since building two means a failure in the
-first entry rebuilds the second. The ruleset change and revert are the
-maintainer's actions (ruleset 2420853); the quest names the setting and
-reports the numbers. The host runner must handle two builds at once without
-the shared mbx cache or `quest gate` admission erasing the gain, so record
-host load during the trial.
-
-The trial started early (decided 2026-11-05, maintainer, /quest-plan): the
-second queue runner `nixos-moq-ci2` landed in
-[kixelated/nixos#24](https://github.com/kixelated/nixos/pull/24), and ruleset
-2420853 went to `max_entries_to_build: 2` at 2026-11-05T15:49:30Z.
-
-It ran out of disk the same day, so the maintainer ended it early
-(decided 2026-11-05, maintainer, /quest-complete; ruleset back to 1 at
-2026-11-05T18:02:15Z, scheduled revert cancelled). At 17:12Z
-`nixos-moq-ci2` failed a merge-group build with `No space left on device`
-under `/var/cache/github-runner-work/moq/moq`
-([job](https://github.com/moq-dev/moq/actions/runs/42072368255/job/127403437474)),
-dropping [moq-dev/moq#7716](https://github.com/moq-dev/moq/pull/7716). Every
-CI runner on `nixos` shares one XFS project quota (project 42000, 667 GiB
-hard; 578 GiB used afterwards), and each moq queue runner keeps its own
-Cargo targets and mbx caches inside it (`modules/ci-runners.nix`: MBX target
-25 GiB, GC 50-80 GiB). Before a retry, size the per-runner caches or the
-quota in kixelated/nixos for two concurrent moq builds, and show the quota's
-headroom with both runners warm. The 15:49Z-18:02Z window is too short and
-too disturbed to compare.
diff --git a/quest/m0/nightly/macos.md b/quest/m0/nightly/macos.md
index d9fe7628bb5..5623f1561a4 100644
--- a/quest/m0/nightly/macos.md
+++ b/quest/m0/nightly/macos.md
@@ -50,8 +50,11 @@ Public API: none. Wire: none.
 
 ## Waiting
 
-- moq-dev/moq: after the capture fix lands, verify a green scheduled macOS job
-  on main and inspect the websocket test's results across a week of scheduled
-  runs. Recommendation: land the reviewed capture fix, then retain this quest
-  until the scheduled evidence is available. A branch dispatch can check the
+- moq-dev/moq: inspect the websocket test's results across a week of
+  scheduled macOS runs on main. The capture fix,
+  [moq-dev/moq#7976](https://github.com/moq-dev/moq/pull/7976), merged
+  2026-11-06; the first scheduled run after it,
+  [42236107954](https://github.com/moq-dev/moq/actions/runs/42236107954/job/127954206481),
+  is green, with `broadcast_websocket_uses_newest_version` passing in 0.031 s
+  (1 of 7 runs). A branch dispatch can check the
   fix but cannot establish the required scheduled-main history.
diff --git a/quest/m2/README.md b/quest/m2/README.md
index a04de05388e..0a1a4f7124e 100644
--- a/quest/m2/README.md
+++ b/quest/m2/README.md
@@ -27,8 +27,9 @@ fixes, the pre-cut audit re-run, and moq-c parity) live under the recurring
 
 Held by open claims: the m1 epics and quests marked below stay where they
 are until their claims merge, and the [probe epic](/quest/m2/probe/README.md)
-stays here while its padding claim is open, so the cut waits on it until the
-[re-cut follow-up](/quest/m2/recut-held.md) moves it to m3.
+stays here while its open claims last, so the cut waits on it until the
+[re-cut follow-up](/quest/m2/recut-held.md) moves it to m3. Its padding and JS
+rung disable quests already moved to m3 on 2026-11-06.
 
 Carried from m1's Plan before the re-cut, where "m1" means the whole pre-cut
 milestone, now m1 and m2:
@@ -85,8 +86,9 @@ and the API-diff tooling. Public routes now wait on cluster routing.
 Added 2026-10-20 (maintainer): the probe target, native probing, and the
 native rung disable moved up from the [m2 probe epic](/quest/m2/probe/README.md),
 so Rust, FFI, and OBS publishers recover a stopped rendition in this release;
-padding and the browser's rung disable stay in m2, with only padding's
-lite-07 stream type here.
+padding and the browser's rung disable stayed in m2, with only padding's
+lite-07 stream type here. Both moved to m3 on 2026-11-06 (maintainer,
+/quest-unblock), parked for a rethink of padding.
 
 Added 2026-10-22 (maintainer, clustering audit): three interim fixes for
 announce churn on today's hop-list mesh, shipping with the next cut from
@@ -186,5 +188,5 @@ quests that require them.
 - [MoQ on rind](/quest/m1/rind/README.md) - every MoQ crate takes its crypto from rind, a pure-Rust graviola fork, so no build compiles C crypto (held in m1 by an open claim)
 - [Rename buffer to lookahead](/quest/m2/watch-lookahead.md) - `<moq-watch>`'s `buffer` becomes `lookahead`, so it is no longer mistaken for a jitter buffer on live streams
 - [Cut readiness](/quest/m2/cut-gate/README.md) - the checks the cut needs that break nothing: main no slower than release, vendored fixes ported, the pre-cut audit re-run, and moq-c at parity
-- [Probe](/quest/m2/probe/README.md) - a session probes up to the bitrate it wants to send or receive, so a stopped simulcast rendition resumes and a viewer up-switches; the browser pads where native sessions retransmit (held in m2 by an open claim; moves to m3)
+- [Probe](/quest/m2/probe/README.md) - a session probes up to the bitrate it wants to send or receive, so a stopped simulcast rendition resumes and a viewer up-switches; browser padding is parked in m3 (held in m2 by open claims; moves to m3)
 - [Finish the milestone re-cut](/quest/m2/recut-held.md) - claim-held epics move to the milestone their kind and priority give them once their claims merge
diff --git a/quest/m2/lite07-finalize.md b/quest/m2/lite07-finalize.md
index c8099055a51..ead69e3533b 100644
--- a/quest/m2/lite07-finalize.md
+++ b/quest/m2/lite07-finalize.md
@@ -73,7 +73,7 @@ parameter, has landed, and the rest is API work that does not block the rename.
 The archive line's TRACKS request (a per-broadcast track listing that
 replaced SUBSCRIBE_ALL) landed in [#6158](https://github.com/moq-dev/moq/pull/6158)
 and [#6167](https://github.com/moq-dev/moq/pull/6167), and the padding stream
-type for the m2 browser [padding probes](/quest/m2/probe/padding.md) landed in
+type for the browser [padding probes](/quest/m3/probe-padding.md) landed in
 [#6233](https://github.com/moq-dev/moq/pull/6233).
 Decided 2026-10-30 (maintainer, on
 [moq-dev/moq#7390](https://github.com/moq-dev/moq/pull/7390)): those probes
diff --git a/quest/m2/probe/README.md b/quest/m2/probe/README.md
index b5729e471e4..fd784e9c2ff 100644
--- a/quest/m2/probe/README.md
+++ b/quest/m2/probe/README.md
@@ -45,7 +45,10 @@ publisher-local padding handle:
   resends in-flight data during BBR3's Startup and one ProbeBW_UP per probe
   wait ([moq-dev/moq#6635](https://github.com/moq-dev/moq/pull/6635)). A browser over WebTransport can't
   reach its controller, so a lowest-priority padding stream on an ALR probe
-  schedule does ([padding](/quest/m2/probe/padding.md)).
+  schedule does ([padding](/quest/m3/probe-padding.md)). Parked 2026-11-06
+  (maintainer, /quest-unblock): the maintainer doubts padding is the right
+  approach, so padding and the [JS rung disable](/quest/m3/probe-rung-disable-js.md),
+  which recovers through it, moved to m3 for a rethink.
 
 Decided with the maintainer on 2026-10-20:
 
@@ -66,7 +69,7 @@ Decided with the maintainer on 2026-10-20:
   native rung recovery needs, and viewer handles, viewer grants, the peer's
   PROBE target, and `Increase` came back here as viewer targets, beside their
   consumers, and landed in [moq-dev/moq#7090](https://github.com/moq-dev/moq/pull/7090).
-  The `js/net` send target moved to [padding](/quest/m2/probe/padding.md), its
+  The `js/net` send target moved to [padding](/quest/m3/probe-padding.md), its
   only sender.
 
 Decided with the maintainer on 2026-11-03, in review of
@@ -98,8 +101,6 @@ This README's own work, once the children land:
 
 - [Browser send estimate](/quest/m2/probe/browser-send-estimate.md) - browser publishers adapt to `getStats()`'s send estimate once Chrome and Safari report one
 - [One page-wide getStats sampling ticker](/quest/m2/probe/stats-ticker.md) - a page's connections share one sampling ticker
-- [Padding probes](/quest/m2/probe/padding.md) - a browser probes with a lowest-priority padding stream on an ALR schedule
-- [JS rung disable](/quest/m2/probe/rung-disable-js.md) - `@moq/publish` applies the native rung rule, recovering through padding
 - [Viewer up-switch](/quest/m2/probe/viewer-upswitch.md) - a viewer capped by its small rendition finds headroom through PROBE and moves up
 
 ## Related
diff --git a/quest/m2/probe/browser-send-estimate.md b/quest/m2/probe/browser-send-estimate.md
index d66e605951f..d9c58207d42 100644
--- a/quest/m2/probe/browser-send-estimate.md
+++ b/quest/m2/probe/browser-send-estimate.md
@@ -37,5 +37,5 @@ Public API: none expected. Wire: none, unless the decision below picks a receive
 ## Related
 
 - [One page-wide getStats sampling ticker](/quest/m2/probe/stats-ticker.md) - shares the `getStats()` sampling this reads
-- [Padding probes](/quest/m2/probe/padding.md) - raises the estimate once one exists
+- [Padding probes](/quest/m3/probe-padding.md) - raises the estimate once one exists
 - [Media stats](/quest/m3/stats/README.md) - its JS stats read PROBE for the downlink
diff --git a/quest/m2/recut-held.md b/quest/m2/recut-held.md
index d9125daf2c9..ed60b8c58d3 100644
--- a/quest/m2/recut-held.md
+++ b/quest/m2/recut-held.md
@@ -25,10 +25,11 @@ Drop-set is a single quest, not an epic, so it has no `Required` entry here:
 when this runs, move it if it still exists and nothing claims it.
 
 Prose that names a held epic's milestone becomes stale when it moves; update
-it in the same PR: datagram tracks in [net-wrap](/quest/m5/net-wrap/README.md), and the browser
-padding probes in [lite07-finalize](/quest/m2/lite07-finalize.md).
+it in the same PR: datagram tracks in [net-wrap](/quest/m5/net-wrap/README.md). The browser
+padding probes already moved to m3 on 2026-11-06.
 
 ## Required
 
 - [Release on leave](/quest/m1/stream-credit/release-on-leave.md) - claim held stream-credit
-- [Probe padding](/quest/m2/probe/padding.md) - claim held probe
+- [Browser send estimate](/quest/m2/probe/browser-send-estimate.md) - claim held probe
+- [One page-wide getStats sampling ticker](/quest/m2/probe/stats-ticker.md) - claim held probe
diff --git a/quest/m3/README.md b/quest/m3/README.md
index e176efdea7e..867805246b1 100644
--- a/quest/m3/README.md
+++ b/quest/m3/README.md
@@ -186,3 +186,5 @@ federation) land.
 - [Bus writes land at a bus position](/quest/m3/bus-positioned-write.md) - callers sync audio to video without copying the bus's private latency
 - [moq-mux imports a regular MP4](/quest/m3/mp4-import.md) - non-fragmented MP4, `moov` first or last
 - [An audio encoder flushes without ending its track](/quest/m3/audio-encode-flush.md) - a clip's last partial frame is heard while the source stays live
+- [Padding probes from the browser](/quest/m3/probe-padding.md) - parked: the maintainer doubts padding is the right way for a browser to probe
+- [JS rung disable](/quest/m3/probe-rung-disable-js.md) - `@moq/publish` applies the native rung rule, recovering through padding; parked with it
diff --git a/quest/m3/audit-compile-time.md b/quest/m3/audit-compile-time.md
index b637863a823..6aab5fa379c 100644
--- a/quest/m3/audit-compile-time.md
+++ b/quest/m3/audit-compile-time.md
@@ -52,7 +52,7 @@ What to check first:
   dev-dependencies (tests, lint, benches), such as the mux test-profile IR
   count. Treat a shift in those rows across it as the hack's, not the code's.
   Keep feature-unification and cross-job cache work with the
-  [hakari quest](/quest/m0/ci/hakari.md), and test work with the
+  [hakari follow-ups](/quest/m0/ci/hakari-followups.md), and test work with the
   [test cost audit](/quest/m3/audit-test-cost.md). Dependency and manifest
   removal belongs to the [dependency audit](/quest/m3/audit-deps.md).
 - Transport-session duplication is fixed by
diff --git a/quest/m3/audit-deps.md b/quest/m3/audit-deps.md
index 6f1f919fa90..01b5e8c20d1 100644
--- a/quest/m3/audit-deps.md
+++ b/quest/m3/audit-deps.md
@@ -82,9 +82,9 @@ Open after the 2026-11-01 removal run:
 Advisories waiting on upstream:
 
 - ashpd 0.13 pulls zbus 5 and the unmaintained zvariant, zvariant_derive, and
-  zbus_names (RUSTSEC-2026-0370, 0371, 0372). Upstream's
-  [zbus 6 port](https://github.com/bilelmoussaoui/ashpd/pull/491) merged on
-  2026-10-25; wait for a stable ashpd release that carries it.
+  zbus_names (RUSTSEC-2026-0370, 0371, 0372). ashpd 0.14.0 (2026-11-05) carries
+  the zbus 6 port; [ashpd uses maintained D-Bus crates](/quest/m4/ashpd-maintained.md)
+  upgrades to it.
 - basic-toml (RUSTSEC-2026-0374) comes through askama_derive's default
   `config` feature in uniffi_bindgen 0.32, which reads its `askama.toml`.
   It only reaches the generator-only uniffi fork and never ships.
diff --git a/quest/m2/probe/padding.md b/quest/m3/probe-padding.md
similarity index 86%
rename from quest/m2/probe/padding.md
rename to quest/m3/probe-padding.md
index a570965d8fe..25a0ec4c82b 100644
--- a/quest/m2/probe/padding.md
+++ b/quest/m3/probe-padding.md
@@ -14,6 +14,13 @@ probe to the larger of their send target and the peer's PROBE target.
 
 ## Plan
 
+Parked 2026-11-06 (maintainer, /quest-unblock): ✅ moved from the m2 probe
+epic to m3, because the maintainer doesn't think padding is the right
+approach. Rethink how a browser raises its estimate before building this; the
+padding overhead budget's denominator was left open for that rethink. Its draft,
+[moq-dev/moq#7390](https://github.com/moq-dev/moq/pull/7390), was closed; its
+send target and ALR schedule remain at `refs/pull/7390/head` (ca3813d7e1).
+
 Decided with the maintainer on 2026-10-17 (see the
 [epic](/quest/m2/probe/README.md)):
 
@@ -54,6 +61,11 @@ Decided with the maintainer on 2026-10-17 (see the
   what it says, and run `just drafts check`.
 - A browser sender can't see whether it is app-limited; settle how to judge
   it from what it sends against the estimate.
+- Decided 2026-11-06 (maintainer, /quest-unblock): ✅ keep `setTarget` on
+  `Handle`, so an app on a pooled `Connection.allocator` can set or clear the
+  target; the last sharer to set it wins, as in Rust. It adds a required member
+  to an exported interface, so the PR is breaking. Not chosen: setting it on
+  the allocator only.
 - Settle how the schedule stays within its overhead budget: how padding's
   share of sent bytes is counted over time, and what a cluster does once it
   would exceed the budget.
diff --git a/quest/m2/probe/rung-disable-js.md b/quest/m3/probe-rung-disable-js.md
similarity index 87%
rename from quest/m2/probe/rung-disable-js.md
rename to quest/m3/probe-rung-disable-js.md
index 0bcc6d6d215..f4aff56c956 100644
--- a/quest/m2/probe/rung-disable-js.md
+++ b/quest/m3/probe-rung-disable-js.md
@@ -12,7 +12,9 @@ lower renditions keep their share instead of every rung degrading together.
 Split from the native rung disable by the
 maintainer on 2026-10-20: the native publishers moved to m1 on native
 probing, while a browser can only probe with
-[padding](/quest/m2/probe/padding.md), which stays in m2.
+[padding](/quest/m3/probe-padding.md). Moved to m3 with padding on 2026-11-06
+(maintainer, /quest-unblock), since it recovers only through padding, which
+the maintainer parked for a rethink.
 
 - Mirror the native quest's rule and constants from `moq_mux::rate`, rather
   than tuning a JS-only one. Its decisions hold here too: catalog state
@@ -34,7 +36,7 @@ Public API: whatever knob `@moq/publish` exposes for the rule. Wire: none.
 
 ## Required
 
-- [Padding probes](/quest/m2/probe/padding.md) - the browser's sender, which raises the estimate so a disabled rung can resume
+- [Padding probes](/quest/m3/probe-padding.md) - the browser's sender, which raises the estimate so a disabled rung can resume
 
 ## Related
 
diff --git a/quest/m3/release/README.md b/quest/m3/release/README.md
index b817c0bbca5..bf5c4893ef4 100644
--- a/quest/m3/release/README.md
+++ b/quest/m3/release/README.md
@@ -31,7 +31,7 @@ production stability proven merely because upstream artifacts published.
 - [API shape review](/quest/m3/release/api-review.md) - every new or changed public API reviewed for a better shape before the cut
 - [Feature review](/quest/m3/release/feature-review.md) - every major work line since the last release judged end to end before the cut
 - [Cargo feature review](/quest/m3/release/feature-flags.md) - defaults stay lean and every remaining feature is scoped to the crate that owns it, before the cut
-- [Claim new npm names](/quest/m3/release/npm-first-publish.md) - a maintainer claims `@moq/clock`, `libav`, and `video` on npm and JSR with trusted publishing, before the cut publishes them
+- [Claim new npm names](/quest/m3/release/npm-first-publish.md) - a maintainer claims `@moq/clock`, `libav`, and `video` on npm with trusted publishing, before the cut publishes them
 - [Cut and publish](/quest/m3/release/cut.md) - independently executable after m2; release-triggered publication
 - [Published assets](/quest/m3/release/assets-release.md) - npm carries hostable worklets
 - [C++ publication](/quest/m3/release/cpp-release.md) - archives and matching OBS plugin publish and install
diff --git a/quest/m3/release/npm-first-publish.md b/quest/m3/release/npm-first-publish.md
index 701d87d44c2..d82dc4de7bd 100644
--- a/quest/m3/release/npm-first-publish.md
+++ b/quest/m3/release/npm-first-publish.md
@@ -1,18 +1,14 @@
-# [XS] Claim the new @moq npm and JSR names
+# [XS] Claim the new @moq npm names
 
 ## Goal
 
-`@moq/clock`, `@moq/libav`, and `@moq/video` exist on npm, and
-the two with JSR packages exist on JSR, each with trusted publishing
-attached to `moq-dev/moq`. The cut's release workflow can then publish
+`@moq/clock`, `@moq/libav`, and `@moq/video` exist on npm, each with trusted
+publishing attached to `moq-dev/moq` and the `npm` Environment. The cut's release workflow can then publish
 their real versions. A maintainer does this by hand. Delete this quest once
 the checks pass:
 
 - `npm view @moq/<name>` resolves for all three, and the package settings show
-  the `moq-dev/moq` trusted publisher.
-- `https://api.jsr.io/scopes/moq/packages/<name>` returns 200 for `clock`
-  and `video`, each linked to the repository. `@moq/libav` sets
-  `"jsr": false`.
+  the `moq-dev/moq` trusted publisher with Environment `npm`.
 
 ## Plan
 
@@ -43,6 +39,10 @@ it clears with the same publication.
 does not publish it. [Watch opts in](/quest/m4/p2p/watch.md) owns its first
 publication, including claiming its names.
 
+Decided 2026-11-06 (maintainer, /quest-unblock): JSR is dropped
+([Stop publishing to JSR](/quest/m0/ci/jsr-retire.md)), so no JSR names are
+claimed.
+
 Public API: none. Wire: none.
 
 ## Related
diff --git a/quest/m4/p2p/watch.md b/quest/m4/p2p/watch.md
index 467e16a4fc1..e40efaed2f6 100644
--- a/quest/m4/p2p/watch.md
+++ b/quest/m4/p2p/watch.md
@@ -12,7 +12,7 @@ the peer goes away, with no visible interruption.
 Publish `@moq/p2p` with its first application consumer in this quest. It is
 currently private and has no release script; the `test/p2p` harness uses its
 workspace source. Before its first workflow publish, a maintainer claims
-`@moq/p2p` on npm and JSR with a placeholder and attaches the `moq-dev/moq`
+`@moq/p2p` on npm with a placeholder and attaches the `moq-dev/moq`
 trusted publisher, as [Claim new npm names](/quest/m3/release/npm-first-publish.md)
 does for the cut's packages.