[kixelated]

Problem

cargo build --release -p moq-studio, as the README's first command runs it, fails to link on Apple Silicon with 111 errors like symbol 'Lvpaes_enc_2x_loop' is already defined. The lock holds two versions of the rind crypto crate: moq-auth and moq-crypto use rind 0.1.12, while rind-rcgen 0.1.14 (via moq-tokio) pulls rind 0.2.0. The release profile's fat LTO with one codegen unit merges both copies' hand-written assembly into one module, where the labels collide. No CI job builds release, so nothing caught it. Found while running capture on a Mac for moq-dev/studio#70.

moq's own lock pins rind-rcgen 0.1.12 and links fine. sh/upgrade-moq.sh resolved the studio's lock on its own, so a crate a moq bump added landed at its newest compatible release rather than the one moq tested. 30 shared crates had drifted: 28 behind moq, and rind-rcgen and rind-jsonwebtoken ahead.

Approach

• upgrade-moq.sh now moves every registry crate both locks hold at semver-compatible versions to moq's version, one cargo update --precise at a time, and fails if Cargo keeps one elsewhere because the studio needs it.
• Cargo.lock is that script's result at the current pin (079a6460f): rind 0.2.0 is gone, and the 30 shared crates match moq's lock.

Impact

Release builds link again. No public API or wire change; dependency versions move to the ones moq's CI tests.

Alternatives

• Pin only rind-rcgen: fixes today's link, but the next just upgrade-moq can drift again unnoticed.
• Build release in CI: catches any cause, but adds a long fat-LTO build to every PR.

Caused by

• moq-dev/studio#69 - its moq bump resolved rind-rcgen at 0.1.14, which needs rind 0.2.0

Decisions

Settled with the maintainer on 2026-11-08 (/quest-iterate on #70):

• Where the fix goes: ✅ its own PR off main (rejected: fold into quest(m0/app-macos): record what the Mac capture run found and waits on #70).
• Guarding against the drift: ✅ align shared crates with moq's lock in upgrade-moq.sh (rejected: pin only; a CI release build).

Validation

• cargo build --release -p moq-studio --features capture (fat LTO) on Apple Silicon: failed with the duplicate symbols before, links after; the binary runs.
• sh/upgrade-moq.sh 079a6460f: leaves no drift from moq's lock, and bun.lock unchanged. Its awk also runs under macOS's /usr/bin/awk.
• just ci: pass (278 tests).

Models

Size: S
Implementer: Claude Code, claude-opus-5-5, high effort

(Written by Claude Opus 5.5 with high)

🤖 Generated with Claude Code

Review

Rewritten by quest review after each round.

• Reviewer: Codex, gpt-6.1-sol, medium effort
• Session: 01a1bf18-b9aa-7fe1-9c16-a83a8889a0f8, round 1
• Head: fcd6b3f
• Base: origin/main at bfc823b
• Score: 9/10, Source inspection found no actionable defects in the lock-alignment logic or its integration; builds, tests, and quest context were not run, as required by the review instructions.
• Findings: none

[pullfrog]

  ^{｜ Review this ➔}

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 47 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 0adfb314-d783-47e0-b384-e44ebf1274cd

Commits

Reviewing files that changed from the base of the PR and between bfc823b and fcd6b3f.

Files ignored due to path filters: 1

• Cargo.lock is excluded by !**/*.lock

Files selected for processing: 1

• sh/upgrade-moq.sh

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[kixelated]

Automated review by review (OpenAI)

Reviewed head: fcd6b3f995040e7c56c492e4a0d80fef34f65c6d
Base: bfc823b0347857ff3572a99a3a56bf3d67d6944d

No actionable findings.

The new alignment step in sh/upgrade-moq.sh:14–45 fits the recorded decision to use moq's tested dependency versions. It runs after Cargo resolves the updated submodule and before the existing JS-lock refresh, leaves different compatibility ranges alone, and lets Cargo reject an unsatisfiable precise version rather than silently accepting drift. The immediate no-progress check also prevents repeatedly issuing the same ineffective update.

Inspecting the lockfiles as inputs to this script confirms 30 shared-version differences in the base and none in the head under the script's grouping. The head contains only rind 0.1.12, with rind-rcgen 0.1.12 matching the pinned moq lock. Generated lockfile changes were not treated as separate findings.

Direction: keep the shared-version alignment in the existing upgrade path and retain the separate upstream-pin workflow.

Verification limits: GitHub-only static review of the full script, callers, manifests, lock inputs, base guidance and history. I did not run quest context, the shell/awk script, Cargo resolution, builds or tests, and did not reproduce the Apple Silicon release link. Check run 778 was still in progress when inspected; the reported local validation was not independently reproduced.