kixelated · Nov 8, 2026 · Nov 8, 2026 · Nov 8, 2026 · Nov 8, 2026 · Nov 8, 2026
diff --git a/quest/m0/README.md b/quest/m0/README.md
@@ -99,6 +99,7 @@ repository.
 - [Browser sources on macOS and Windows](/quest/m0/browser-source.md) - the out-of-process CEF pages Linux has, with shared GPU textures on the other desktops
 - [Web studio](/quest/m0/web.md) - the full studio in wasm on WebGPU and WebCodecs, served from this repository
 - [Virtual camera](/quest/m0/vcam/README.md) - the program or a published scene exposed as a system camera on Linux, Windows, and macOS
+- [Browser sources on the GPU under Mesa Wayland](/quest/m0/cef-headless.md) - shared-texture pages paint on Intel and AMD under GNOME on Wayland, or the failing allocation is found
 - [The Apple signing identity is available](/quest/m0/signing.md) - the Apple credentials packaging and the macOS camera need; Windows ships unsigned
 - [Packaging](/quest/m0/packaging.md) - a signed macOS app, a Windows installer, and a Flatpak for Linux
 - [The persistable portal restore token is pinned](/quest/m0/pin-portal-token.md) - moq-video's restore token, for Wayland sources

diff --git a/quest/m0/cef-headless.md b/quest/m0/cef-headless.md
@@ -0,0 +1,34 @@
+# [S] Browser sources on the GPU under Mesa Wayland
+
+## Goal
+
+Browser sources copied on the GPU (shared DMA-BUF textures) paint on Mesa
+drivers (Intel or AMD) under GNOME on Wayland, as they do on NVIDIA, or the
+allocation that stops them is found and fixed.
+
+## Plan
+
+[moq-dev/studio#59](https://github.com/moq-dev/studio/pull/59) picks the
+display at setup, X11 on Mesa paints since
+[moq-dev/studio#73](https://github.com/moq-dev/studio/pull/73), and
+[moq-dev/studio#107](https://github.com/moq-dev/studio/pull/107) passes over a
+Wayland display with no output. Under a headless sway on nixos2's Intel render
+node (UHD 630, Mesa 26.2.4), the first shared image fails to allocate
+("Unable to allocate frame for first frame capture: OOM?") and the page stays
+`Starting`; the same sway on the NVIDIA node paints, so the harness works.
+
+Rerun `binary(browser)` on nixos2 in GNOME on Wayland with its display on the
+Intel GPU, over ssh with `WAYLAND_DISPLAY=wayland-0`,
+`XDG_RUNTIME_DIR=/run/user/1000`, and `VK_DRIVER_FILES` pointing at Mesa's
+`intel_icd`. If it still fails to allocate, find which allocation fails (a
+debug CEF build, or `chrome://gpu` in a CEF client on the same host) and fix
+it. Surfacing that failure loudly was dropped in #107 (it needs CEF to forward
+`OnStopped`).
+
+Decided 2026-11-07 (maintainer, /quest-unblock): ✅ run this trial before
+nixos2 switches to Windows ([windows-host](/quest/m0/windows-host.md)),
+superseding [moq-dev/studio#105](https://github.com/moq-dev/studio/pull/105)'s
+skip (rejected: keep the skip), with a display on the Intel GPU's own
+motherboard port (rejected: the NVIDIA card's DisplayPort, a hybrid desktop).
+It is on `card1-DP-1`, and GNOME on `wayland-0` lists a `wl_output` named
+`DP-1`.
diff --git a/quest/m0/pin-audio-pan.md b/quest/m0/pin-audio-pan.md
@@ -7,14 +7,7 @@ The `moq` submodule includes a pan on moq-audio's bus `Strip`, from
 
 ## Plan
 
-Once the wait clears, advance it with `just upgrade-moq` in its own PR,
-fixing whatever the new API breaks here.
-
-## Waiting
-
-- moq-dev/moq: the upstream quest above lands. Check: that quest's PR has
-  merged on moq's `main`, deleting its file, and `moq_audio::bus::Strip`
-  there has a pan. A quest file that moved, or went away without its work
-  landing, does not count. The quest itself is planned in
-  [moq-dev/moq#8133](https://github.com/moq-dev/moq/pull/8133), not merged
-  yet.
+The pan landed upstream in
+[moq-dev/moq#8180](https://github.com/moq-dev/moq/pull/8180)
+(`Strip::set_pan` and `Strip::pan` on moq's `main`). Advance the gitlink with
+`just upgrade-moq` in its own PR, fixing whatever the new API breaks here.
diff --git a/quest/m0/signing.md b/quest/m0/signing.md
@@ -18,16 +18,25 @@ Decided 2026-11-06 (maintainer, /quest-unblock):
 - The hang.live 1Password vault holds the Apple material for team
   `D7D5SDDB5Z`: `apple-developer-id` (a Developer ID Application certificate,
   valid until 2027-02-01), `apple-certificate` (`hang.live.p12` and its
-  password), and `apple-api` (an App Store Connect API key). The membership
-  has lapsed, so notarization fails until it is renewed.
-- Once renewed, an agent with the maintainer's `op` session creates the
-  Developer ID profile through the App Store Connect API with that key, and
-  stores everything with `gh secret set` (no secret passes through chat or a
-  file outside `.tmp/`). Confirm the `.p12` holds the Developer ID key, not a
-  distribution one, before storing it. Then delete this quest.
+  password), and `apple-api` (an App Store Connect API key, key ID
+  `7WP7HJXJ4C`; its notes hold the issuer ID).
+- Renewed 2026-11-08, until 2027-11-08 (maintainer, /quest-unblock), after the
+  Account Holder signed the Apple Developer Program License Agreement. The API
+  key authenticates, but minutes after the renewal the notary API still answers
+  `FORBIDDEN.REQUIRED_AGREEMENTS_MISSING_OR_EXPIRED` (see `/business`).
+- Once the notary API accepts the key, an agent with the maintainer's `op`
+  session creates the Developer ID profile through the App Store Connect API
+  with that key, and stores everything with `gh secret set` (no secret passes
+  through chat or a file outside `.tmp/`). Confirm the `.p12` holds the
+  Developer ID key, not a distribution one, before storing it. Then delete
+  this quest.
 
 ## Waiting
 
-- Maintainer: renew the Apple Developer Program membership for team
-  `D7D5SDDB5Z`; only the account holder can pay. Check: `xcrun notarytool
-  history` with the `apple-api` key succeeds.
+- Maintainer: accept any pending agreement at App Store Connect > Business
+  (appstoreconnect.apple.com/business), which the notary API names after the
+  Program License Agreement was signed; only the Account Holder can accept.
+  If none is pending, Apple may still be propagating the signature. Check:
+  `xcrun notarytool history` with the `apple-api` key succeeds (or a GET of
+  `https://appstoreconnect.apple.com/notary/v2/submissions` with a JWT from
+  that key returns 200).
diff --git a/quest/m0/windows-host.md b/quest/m0/windows-host.md
@@ -9,8 +9,12 @@ a camera and a microphone to capture, so Windows quests run on real hardware.
 ## Plan
 
 Decided 2026-11-06 (maintainer, /quest-unblock): nixos2 becomes the Windows
-host. Decided 2026-11-07 (maintainer, /quest-unblock): it no longer waits for
-a Wayland trial on its Intel GPU, which was skipped.
+host, after the Mesa trial on its Intel GPU
+([cef-headless](/quest/m0/cef-headless.md)), which needs NixOS there.
+Decided 2026-11-07 (maintainer, /quest-unblock): the trial runs first after
+all, superseding
+[moq-dev/studio#105](https://github.com/moq-dev/studio/pull/105)'s skip, since
+a display is now on the Intel GPU.
 
 nixos2 already dual-boots: Windows sits on its own partition (`nvme0n1p3`,
 600 GB, last booted 2026-09-14) with firmware entry `Boot0003` (Windows Boot
@@ -33,3 +37,7 @@ Manager); NixOS boots through systemd-boot on `nvme0n1p4`. The switch:
   `C:\ProgramData\ssh\administrators_authorized_keys`, and plug in a USB
   camera and a microphone, which nixos2 lacks. An agent cannot reach Windows
   before sshd runs. Check: `ssh nixos2 ver` prints a Windows version.
+
+## Required
+
+- [Browser sources on the GPU under Mesa Wayland](/quest/m0/cef-headless.md) - the Mesa trial runs on nixos2's Intel GPU first