[kixelated]

Lands the api-shape/net items that still applied on main. The quest file is rewritten to what's left: the route-stream un-hide, now unblocked since moq-dev/moq#8063 merged. The minted-instance item moves to a new quest, quest/m2/instance-provenance.md.

Summary

• Client origin: moq_net::Client::with_origin and moq_tokio::Client::with_origin are gone. Chain .with_publisher(&origin).with_subscriber(origin).
• Versions: Version::{code, from_code} are pub(crate). The relay's version.code() >= 0xff0dad05 check is now Version::has_request_path(). The code scans in moq-cli, moq-tokio and the tests now read the new Version::ALL, which includes the opt-in -wip drafts that Versions::all leaves out.
• Admission: server::{Activity, Active, ActivityState} are renamed {Admission, Admitted, AdmissionState}, with the matching field and method names in moq-tokio, moq-relay, moq-uring and moq-webrtc.
• Refusals: RefusalKind::Lan / Refusals.lan are renamed Membership / membership ("A membership proof was missing or invalid.").
• Mesh: moq_auth::mesh::{PROOF_CONTEXT, proof_message} are private and CHALLENGE_LEN is pub(crate). The signed message format is now written in Proof's docs.
• Datagram priority: datagram::Producer::poll_priority(waiter, last) is replaced by poll_priority_changed(&mut self, waiter) (async priority_changed()). It keeps its own last value, like poll_wanted_changed.
• Reconnect: a new reconnect::Attempt::client(&self, &Client) -> Client sets the URL, puts the token where the client's versions expect it, and attaches the token handle. It replaces Attempt::{url, token}, the versions argument of Reconnect::with_tokens, and the separate with_auth call. Client::url() was added so callers can read the URL back.
• Compression: track::Info's compress: bool / with_compress become compression: Compression / with_compression. Compression is a #[non_exhaustive] enum, None = 0 or Deflate = 1, matching the wire values. The mirrors:
  • @moq/net: Track.Info.compression: "none" | "deflate", optional in InfoInit where it defaults to "none"
  • moq-ffi: MoqTrackInfo.compression: Option<MoqCompression> (DEFLATE)
  • moq-c: moq_track_info.compression takes MOQ_COMPRESSION_NONE or MOQ_COMPRESSION_DEFLATE
  • Bindings: Go, Kotlin and Swift get Compression aliases; Python gets moq.Compression; Dart is regenerated.
• Stats:
  • stats::Handle::refuse takes a #[non_exhaustive] Refusal::new(label, reason) and Handle::session takes a SessionInfo::new(label), so later records can add fields without breaking callers.
  • stats::Registry::report(&mut report, now) takes the drain time explicitly.
• Grant: auth::Grant is #[non_exhaustive]. Build one from Grant::default() or Grant::all() and set its fields.
• Proxy: origin::Consumer::with_proxy is removed; set with_proxy on the origin::Producer instead. The integration harness applied proxy to every test consumer, not just two sites. So the origin helpers in the moq-net and moq-net-tests integration tests now return proxying producers, and the one non-proxy test sets with_proxy(false).
• Demand: group::Demand and group::Producer::demand stay public; their docs now say a paced flight uses them to see its riders leave.
• FFI priority wait: MoqDatagramProducer::priority_changed(last) now polls poll_priority_changed first and compares to last only after it registered, so a stale remembered value on the shared handle can no longer park the wait while the priority differs from last (pullfrog finding).
• Cache cap: group::MAX_CACHE_BYTES is pub(crate). moq-json (MAX_GROUP_BYTES), moq-mux (jitter, container consumer and fMP4 bounds) and the moq-stats bench each keep their own 32 MiB limit. Public docs now say "32 MiB" in place of the private link.

Choices I made without the maintainer:

• moq-ffi's priority_changed(last) keeps its caller-relative last argument, because FFI handles are shared: it waits until the priority differs from the caller's last, not from the shared handle's remembered value.
• The FFI uses Option<MoqCompression>: UniFFI proc-macros can't give an enum-typed record field a default (#[uniffi(default)] generates an invalid Type() in Kotlin). moq-c uses a u32 discriminant checked with Error::InvalidCode.
• Internal code still uses booleans: ietf Properties.compress and JS's lite TrackInfo.compress.
• The stats argument structs are Refusal and SessionInfo. Session is already the guard type, and Admission is the server's.
• Unreleased MIGRATE entries that named compress, with_origin, Activity or MAX_CACHE_BYTES were fixed so they don't describe APIs that never shipped.

Impact

Public API, all breaking (hence !):

Old	New
Client::with_origin(o) (moq-net, moq-tokio)	.with_publisher(&o).with_subscriber(o)
Version::code(), Version::from_code()	Version::has_request_path(), Version::ALL, or parse the ALPN string
server::{Activity, Active, ActivityState}, moq-tokio activity	server::{Admission, Admitted, AdmissionState}, admission
RefusalKind::Lan, Refusals.lan	RefusalKind::Membership, Refusals.membership
datagram::Producer::poll_priority(waiter, last)	poll_priority_changed(waiter) / priority_changed() on a &mut producer
Attempt::url(), Attempt::token(), Reconnect::with_tokens(tokens, versions)	attempt.client(&client), Reconnect::with_tokens(tokens)
Info::compress / with_compress(bool); JS compress: true; FFI compress: true; C .compress = true	Info::compression / with_compression(Compression::Deflate); JS compression: "deflate"; FFI compression: DEFLATE; C .compression = MOQ_COMPRESSION_DEFLATE
Handle::refuse(label, reason), Handle::session(label)	Handle::refuse(Refusal::new(label, reason)), Handle::session(SessionInfo::new(label))
Registry::report(&mut report)	Registry::report(&mut report, Instant::now())
Grant { publish, subscribe, expires } literal	let mut g = Grant::default(); g.publish = ..;
origin::Consumer::with_proxy(true)	origin::Producer::with_proxy(true) before consume()
group::MAX_CACHE_BYTES	your own limit (moq-net still refuses a frame past 32 MiB)

• Wire: unchanged. The Compression values are the TRACK_INFO values the drafts already define.
• Stats wire: the refusals JSON field lan becomes membership, and the Prometheus label reason="lan" becomes reason="membership". No dashboard in the repo reads either; a deployed dashboard filtering on reason="lan" has to switch. Both fields are new since release, so there is no serde alias.

Decisions

Maintainer, 2026-11-08:

• ✅ group::Demand stays public, documented for paced flights (rejected: fold reader demand into Fill::poll_unwanted then make it private; make it private and move the flight test and bench in-crate).
• ✅ Replace "should a route refuse a minted instance" with a typed minted flag (rejected: refuse in route and rewrite the tests; keep accepting it with docs; refuse in Rust only). The ~ prefix is an in-band sentinel in a free-form string: any caller can spoof it, and a real name starting with ~ is ambiguous. A minted instance becomes a flag on Instance that only a session sets (FromStr and random() build named ones), and moq-lite-07 carries the flag beside the instance instead of the prefix, in Rust and JS (Instance.isMinted). Minting and its meaning stay. Planned in the new Minted instances are a typed flag quest (L), which joins Finalize moq-lite-07's Required since it changes lite-07 bytes.

Suggested follow-ups

• Now unblocked by moq-dev/moq#8063: un-hide origin::Consumer::routes, Routes and RouteEvent, and reshape RouteEvent into { kind, announce } (kept in the quest).
• stats::Registry::snapshot still reads Instant::now() itself. Give it the same explicit now if the stats records want deterministic snapshots.

Overlaps

• moq-dev/moq#8063 and moq-dev/moq#8211 merged; main is merged in. feat(net)!: a job's exact route continues its claim's instance #8063 deleted announce_takeover.rs (kept deleted) and added claim_continues.rs, whose origin helper now proxies like the rest.
• moq-dev/moq#8220 shares about 30 files, including stats.rs, reconnect.rs, server.rs, track.rs, group.rs and moq-relay's auth. Whichever lands second will have to rebase through the stats argument structs and the admission rename. It also changes lite-07 (SUBSCRIBE_DROP/SKIP ranges), as the new instance-provenance quest will; they touch different fields, so only textual conflicts are expected.
• The concurrent no-credit-hook and no-sentinels quests: this PR doesn't touch ReceiveWindow, cache_duration, the reconnect timeouts, or the transport credit hook.

Testing

• just check passes on 9596861, after merging main up to 6ba771b.
• An earlier just check under full-host load timed out mesh_withdraw::{random,capped_random}_meshes_retract_once at nextest's 60s kill. Alone they take about 30s here and 26s on main, already past the 30s SLOW mark either way, and they passed in the later runs. It also failed @moq/net's a re-offer dropped again before it opens stays stale at the end once, which main has since quarantined in moq-dev/moq#8333.
• quest check --base origin/main passes.

Models

Size: M

• Writer: Claude Opus 5.5 (high); merge and decisions: Claude Opus 5.5 (medium)
• Reviewer: gpt-6.1-sol (xhigh)
• Implementer: Claude Code, claude-opus-5-5, high effort (iterate, L)

Takeover, 2026-11-08: the quest:active hold taken at 15:46Z had gone quiet since about 18:22Z, and the maintainer approved another session taking the PR over. That session kept the same hold token, merged main three times as it moved, and reran the checks. The conflicts:

• js/hang/src/report.ts: main's schema-input Writer creates its track with compression: "deflate".
• js/net track.Info (moq-dev/moq#8296 made its fields required, with null for absent): compression: Compression is required too, authoredInfo defaults it to "none" and refuses unknown values, main's dropped infoDefaults stays dropped, and main's datagramTrackInfo and new test fixtures say compression: "none".
• rs/moq-cli/src/args.rs and the moq-net integration support/mod.rs: kept Version::ALL and priority_changed() under main's direct moq_net/kio paths (moq-dev/moq#8247).

Review

Rewritten by quest review after each round.

• Reviewer: Codex, gpt-6.1-sol, medium effort
• Session: 01a1be74-91f5-74d3-a8e7-9ba7fbbbb8da, round 2
• Head: 9596861
• Base: origin/main at 6ba771b
• Score: 9/10, No actionable regressions were found in the incremental changes or merge resolutions; builds and tests were not run, as instructed.
• Findings: none

[kixelated]

Automated review by review (OpenAI)

Reviewed head 408f464.

[P2] Preserve an atomic stateless priority wait in the FFI adapter — rs/moq-ffi/src/datagram.rs:163–165. The priority() check and poll_priority_changed() compare against different remembered values. For example, a wait with last=B seeds the producer's prev=B; a change to A completes through the fast path without updating prev. A subsequent wait with last=A can read A, then a consumer changes back to B before poll_priority_changed runs. That poll sees B == prev and parks, although B differs from the caller's last=A. If priority stays B, the binding caller never receives the change. The previous poll_priority(waiter, last) checked and registered against the caller's value atomically. Retain that stateless operation for the shared FFI handle, or use a per-call observer initialized from last; add coverage for a change between the initial read and waiter registration.

Verification: GitHub-only static review of the API migrations, reconnect/auth setup, priority handling, compression/wire/binding conversions, stats/admission changes and cache-limit replacements. No builds or tests were run.

[pullfrog]

Important

The shared-handle priority_changed(last) adapter in moq-ffi can park while the priority differs from last, and four quest plans still tell a future run to use the removed compress spelling.

Reviewed changes

• Client origin — Client::with_origin removed in moq-net and moq-tokio; callers chain .with_publisher(&origin).with_subscriber(origin).
• Versions — Version::{code,from_code} become pub(crate); new Version::ALL (all 10, including opt-in -wip) and Version::has_request_path() replace the relay's code comparison and the CLI/tokio/test scans.
• Admission — server::{Activity, Active, ActivityState} → {Admission, Admitted, AdmissionState}, with the matching fields and methods in moq-tokio, moq-relay, moq-uring and moq-webrtc.
• Refusals — RefusalKind::Lan/Refusals.lan → Membership/membership, through the stats JSON, Prometheus label, tests and docs.
• Reconnect — Attempt::client(&Client) builds each dial's client (target URL, credential via auth::locate, auth handle), replacing Attempt::{url,token} and the versions argument of with_tokens; Client::url() exposes the result.
• Datagram priority — poll_priority(waiter, last) → stateful poll_priority_changed(&mut self, waiter)/priority_changed(), with the stateless form kept crate-private for moq-net's own callers.
• Compression — track::Info.compress → Compression (None = 0, Deflate = 1), mirrored through lite TRACK_INFO, ietf properties, JS, FFI, C and every binding; internal booleans retained where the wire is boolean.
• Stats — Handle::{refuse,session} take new #[non_exhaustive] Refusal/SessionInfo; Registry::report(report, now) takes the drain time.
• Cache/proxy/mesh — group::MAX_CACHE_BYTES privatized with per-crate 32 MiB bounds, origin::Consumer::with_proxy removed in favor of the producer's, mesh proof helpers made private, auth::Grant #[non_exhaustive].

ℹ️ Four quest plans still reference the removed compress spelling

This PR rewrites quest/m2/api-shape/net.md and its epic README, but surviving plans still name APIs this PR removes, so whoever implements them next will write code against a method that no longer exists.

Technical details

# Rename the remaining plans off the removed compress spelling

## Affected sites
- `quest/m5/json-value-diff.md:24` — compression-only variant: "group DEFLATE through the track's `with_compress`".
- `quest/m5/net-wrap/e2ee.md:30` — "`track::Info.compress` is logical."
- `quest/m5/e2ee/README.md:38` — "the catalog owner sets logical `track::Info.compress`".
- `quest/m3/stats/README.md:96` — stats encoding on "one track with `compress: true`".

## Required outcome
- Each site names what landed: `track::Info::compression`, `Compression::Deflate`, or `with_compression(Compression::Deflate)`. No behavioral claim in those plans changes.

## Suggested approach
- Four one-line edits. `quest check` does not validate backticked API names in prose, so CI will not catch this.

  ^{｜ Fix all ➔ ｜ Fix 👍s ➔ ｜ View workflow run ｜ Using deepseek-v4.1-flash-1017 (free via Pullfrog for OSS) ｜ 𝕏}

[kixelated]

Automated review by review (OpenAI)

Reviewed 96e436f incrementally from 408f464, accounting for the merge of main. The prior P2 FFI priority-wait finding is resolved in the current code; no new actionable findings.

In rs/moq-ffi/src/datagram.rs, priority_changed(last) now polls/registers before its final current-priority check. A ready value equal to last is polled again to establish a waiter, and a pending poll is followed by the caller-relative comparison, closing the previously reported missed-wakeup window. Also checked the new claim_continues proxy adaptation and the remaining API/provenance quest changes. Typed minted instances remain planned, not implemented by this update.

Verification limits: static GitHub review only. No builds or tests run; the changed files add no dedicated regression test for the reported priority interleaving.

[pullfrog]

ℹ️ Minor quest and PR-body drift; the new FFI wait and merge adaptation look correct.

Reviewed changes (incremental, 408f464 → 96e436f)

• FFI priority wait — priority_changed(last) now polls poll_priority_changed first, loops when the ready value equals last, and on Pending re-reads priority() after registering. I traced the states: a Ready equal to last can happen at most once before the next poll registers against last; every Pending return leaves a registration against the current value, and a change after the re-read wakes it. The prior missed-wake thread is resolved and the fix is sound.
• Merge of main — kept announce_takeover.rs deleted and adapted claim_continues.rs's origin helper to .with_proxy(true), matching every other integration origin. All 10 claim_continues tests pass.
• Quest split — api-shape/net.md is retitled "moq-net's route stream goes public" for the now-unblocked un-hide; the two ## Waiting decisions are recorded as Decided 2026-11-08; the minted-instance refusal is replaced by the new quest/m2/instance-provenance.md, added to lite07-finalize.md's Required. quest check reports 591 documents ok.

ℹ️ References to update

• quest/m2/instance-provenance.md:79 — the Related entry links "moq-net's remaining surface fixes" to /quest/m2/api-shape/net.md, whose title this commit renamed to "moq-net's route stream goes public". Update the link text so it matches the target's title.
• quest/m2/instance-provenance.md:52-54 — "Readers of the flag" lists model/broadcast.rs / model/track.rs (minted() state). Those minted()s read a track Producer's publication state (Publication::Staged/Published), not Instance::is_minted(), and neither file calls is_minted(). Drop them or note they are unrelated so the implementer follows the instance flag's actual readers.
• Still outstanding from the previous review: four quest plans name the removed compress spelling — quest/m5/json-value-diff.md:24 (with_compress), quest/m5/net-wrap/e2ee.md:30 and quest/m5/e2ee/README.md:38 (track::Info.compress), quest/m3/stats/README.md:96 (compress: true). Name what landed: Info::compression, Compression::Deflate, or with_compression(Compression::Deflate).
• PR body, "Choices I made without the maintainer": "moq-ffi's priority_changed(last) stays stateless ... It checks priority() first, then loops on poll_priority_changed" describes the pre-fix version. The landed adapter calls the stateful poll_priority_changed first and moves the shared handle's remembered value, as the Summary bullet already says. Update or drop the Choice.

Verification — cargo check -p moq-ffi --lib; cargo test -p moq-ffi --lib (318 passed); cargo test -p moq-net --features async --test integration claim_continues (10 passed); quest check --base origin/main --branch quest/m2/api-shape/net (591 documents ok). The full just check/just ci was not run here; the PR body claims both pass. No dedicated regression test covers the priority interleaving, as the prior review also noted.

  ^{｜ Fix it ➔ ｜ View workflow run ｜ Using deepseek-v4.1-flash-1017 (free via Pullfrog for OSS) ｜ 𝕏}

[pullfrog]

ℹ️ The drift fixes are correct and complete for the sites previously named; a few compress references outside that set remain.

Reviewed changes

Incremental review of d350370 (one docs commit on top of 96e436f), which addresses every finding from the previous review. No code changed.

• Quest compression names — quest/m5/json-value-diff.md, quest/m5/net-wrap/e2ee.md (both occurrences), quest/m5/e2ee/README.md and quest/m3/stats/README.md now name the landed API: track::Info.compression, Compression::Deflate or with_compression(Compression::Deflate).
• Provenance quest — quest/m2/instance-provenance.md links the renamed quest as "moq-net's route stream goes public", and model/broadcast.rs / model/track.rs are gone from the flag's reader list, whose minted() is unrelated to Instance::is_minted().

ℹ️ The compress sweep left sites outside the fixed set

The two unmodified MIGRATE files still tell users of the next release to set a field this PR removes, and a few plans that this PR does not touch still name it. The PR body's "Choices" bullet says the unreleased MIGRATE entries were fixed, so these two contradict it.

Technical details

# Finish renaming the track field in prose and migration notes

## Affected sites
- `rs/hang/MIGRATE.md:29-30` (under `## Unreleased`) — "one name with `compress: true` on its `moq_net::track::Info`" and "`Catalog::default_track_info()` sets `compress`". The helper now uses `with_compression(moq_net::track::Compression::Deflate)` (`rs/hang/src/catalog/root.rs:264`).
- `rs/moq-stats/MIGRATE.md:38` (under `## Unreleased`) — "each one track with `compress: true`".
- `quest/m5/net-wrap/e2ee.md:95` — "authenticated logical `compress` flag", in the same file whose line 30 this commit fixed to `track::Info.compression`.
- Untouched plans, lower priority: `quest/m4/track-info-docs.md:19` lists `MoqTrackInfo` fields ending in `compress` (the record now has `compression: Option<MoqCompression>`, `rs/moq-ffi/src/producer.rs:63`); `quest/m5/teleop-robot.md:101`, `quest/m5/teleop-mavlink.md:80`, `quest/m5/e2ee/rust-publish.md:30`, `quest/m5/net-wrap/js.md:21`, `quest/m3/release/migrate-audit.md:44`.

## Required outcome
- Each site names the landed field or setter. No behavioral claim in those documents changes.

## Suggested approach
- One-line edits per site. `quest check` validates links, not backticked API names, so CI will not catch these.

  ^{｜ Fix it ➔ ｜ View workflow run ｜ Using deepseek-v4.1-flash-1017 (free via Pullfrog for OSS) ｜ 𝕏}

[pullfrog]

✅ No new issues found.

Reviewed changes

Incremental review of 43ceded6, the only commit since the prior Pullfrog review. It is docs-only, finishing the compress rename in the two unreleased MIGRATE notes and the quest plans that still named the removed field.

• Migration notes — rs/hang/MIGRATE.md and rs/moq-stats/MIGRATE.md now say with_compression(Compression::Deflate) / Compression::Deflate instead of compress: true, matching Catalog::default_track_info() and the stats track builders.
• Quest plans — quest/m3/release/migrate-audit.md, quest/m4/track-info-docs.md, quest/m5/e2ee/rust-publish.md, quest/m5/net-wrap/js.md, quest/m5/teleop-mavlink.md, and quest/m5/teleop-robot.md now name compression (JS compression: "deflate"), closing the last stale API references.
• Wire flag kept — quest/m5/net-wrap/e2ee.md:95 still says compress, correctly, because that is draft-lcurley-moq-e2ee.md's authenticated wire flag, not the moq-net track field.

  ^{｜ View workflow run ｜ Using deepseek-v4.1-flash-1017 (free via Pullfrog for OSS) ｜ 𝕏}

[pullfrog]

✅ No new issues found.

Reviewed changes

Incremental review of the delta since the prior Pullfrog review at 43ceded6: the branch merged main and resolved the one conflict.

• Merged main — the branch absorbed origin/main at 9a073029b, newer than the f6a0e549 base of the previous review; no other file's patch differs.
• Resolved the conflict — js/hang/src/report.ts keeps main's Writer<T, I> schema handling (#schema, update parsing, Json.Snapshot.Producer({ track })) and applies the PR's compression: "deflate" rename in place of main's compress: true.
• Checked the rename — the merged tree has no stale compress uses of the track field in JS, Rust, bindings, docs, or quests; only the internal lite/ietf booleans the PR intentionally keeps.
• Verified the workspace — bun run check passes for js/hang, js/net, js/publish, js/watch and js/json.

  ^{｜ View workflow run ｜ Using deepseek-v4.1-flash-1017 (free via Pullfrog for OSS) ｜ 𝕏}

[kixelated]

Automated review by review (OpenAI)

Reviewed 9596861 incrementally against the latest published review, accounting for merged main changes.

No new actionable findings in the incremental merge integrations. Checked the required Track.Info compression field, authored defaults and validation, datagram/test fixtures, and the lite publisher's conversion back to the wire boolean. The integration helpers retain Version::ALL and priority_changed() rather than restoring removed APIs. The previously fixed FFI priority-wait path is unchanged by this update.

Verification limits: GitHub-only static source/diff review. No builds or tests were run; author-reported validation was not independently reproduced.