feat(quic)!: bound incomplete messages with receive leases

.config/nextest.toml

@@ -37,6 +37,12 @@ test-group = "io-uring"
 filter = "package(moq-ffi) & test(=bench::benchmark_ffi)"
 slow-timeout = { period = "60s" }
 
+# The receive-window benchmark sweeps a grid twice, once through a bottleneck
+# whose rate bounds how fast a run can go, so it outlasts the hang budget.
+[[profile.default.overrides]]
+filter = "package(moq-tokio) & test(=receive_credit::benchmark_receive_windows)"
+slow-timeout = { period = "60s", terminate-after = 5 }
+
 [test-groups]
 io-uring = { max-threads = 4 }
 

.github/workflows/interop.yml

@@ -65,6 +65,15 @@ jobs:
         run: nix develop --command just test max-age
         shell: bash -leo pipefail {0}
 
+      - name: Receive credit recovery
+        id: receive-credit
+        if: ${{ !cancelled() && steps.setup.outcome == 'success' }}
+        run: nix develop --command just test receive-credit
+        shell: bash -leo pipefail {0}
+        env:
+          # Fail rather than skip the io_uring arm if the runner's kernel lacks it.
+          MOQ_STRICT: 1
+
       - name: Harness regressions
         id: harness
         if: ${{ !cancelled() && steps.setup.outcome == 'success' }}
@@ -196,6 +205,7 @@ jobs:
             "Rust cache": "${{ steps.rust-cache.outcome }}",
             "Playwright Chromium": "${{ steps.setup.outcome }}",
             "Optional publisher retention": "${{ steps.max-age.outcome }}",
+            "Receive credit recovery": "${{ steps.receive-credit.outcome }}",
             "Harness regressions": "${{ steps.harness.outcome }}",
             "Subscription termination interop": "${{ steps.bare-fin.outcome }}",
             "P2P data-channel transport": "${{ steps.p2p.outcome }}",

.github/workflows/release-gate.yml

@@ -112,6 +112,9 @@ jobs:
               - "test/max-age/**"
               - "test/portrait/**"
               - "rs/moq-tokio/tests/integration/max_age.rs"
+              - "test/receive-credit/**"
+              - "rs/moq-tokio/tests/integration/receive_credit.rs"
+              - "rs/moq-uring/tests/integration/receive_credit.rs"
               # The interop job also depends on the recipe that invokes it and the
               # workspace membership that links the JS clients to source.
               - "test/justfile"

doc/bin/relay/config.md

@@ -77,7 +77,7 @@ idle_timeout = "10s"                 # Drop a connection after this long with no
 keep_alive = "3s"                    # Ping interval; "0s" disables it. iroh still pings at least every 5s. Default.
 gso = true                           # UDP segmentation offload. iroh cannot turn it off.
 mtu_discovery = false                # Path MTU discovery. Default.
-receive_window = 67108864            # Whole-connection window, in bytes. Default (64 MiB).
+receive_window = 134217728           # Whole-connection window, in bytes. Default (128 MiB).
 stream_receive_window = 4194304      # Per-stream window, in bytes. Default (4 MiB).
 send_window = 16777216               # Unacknowledged outgoing data, in bytes. Default (16 MiB).
 qlog = "/var/log/moq/qlog"           # Existing directory. Needs the `qlog` build feature.
@@ -96,10 +96,16 @@ QUIC uses the smaller of the two endpoints' values, so this also bounds the
 other end. Keep `keep_alive` under a third of it.
 
 Raise the receive windows when a fat, long path idles below the link rate. The
-64 MiB `receive_window` default carries several Gbps at a 100 ms RTT and bounds
-how much unread data one peer can make the relay buffer. Keep
-`stream_receive_window` well under it so one slow group cannot starve the
-connection.
+128 MiB `receive_window` default carries several Gbps at a 100 ms RTT and bounds
+how much unread data and incomplete messages one peer can make the relay
+buffer. It has to fit the largest message, just over 64 MiB, so a smaller
+value, here or in `[peer.quic]`, is refused at startup. When incomplete
+messages fill the window, the relay cancels the least urgent stream: the
+lowest subscription priority, then the group its subscription would deliver
+last. Over iroh the window bounds only
+unread data, and over WebSocket or TCP nothing bounds incomplete messages.
+`stream_receive_window` only paces one stream: its credit returns as bytes are
+read, whether or not their message is complete.
 
 ## \[session] and \[peer]
 

package.json

@@ -60,6 +60,7 @@
 		"test/interop/clients/js",
 		"test/interop/clients/js-native",
 		"test/drain",
+		"test/receive-credit",
 		"test/video",
 		"test/p2p",
 		"test/qmux",

quest/m1/quic/README.md

@@ -8,8 +8,8 @@ MoQ never negotiates. One core serves the tokio backend, the thread-per-core
 `moq-uring` backend, and qmux; iroh stays on upstream noq. BBR correctness,
 reliable stream resets (#5690), hierarchical send groups (#5711, #5770), one
 `Limits` type for relay peers (#5871), and endpoint sharding (#5688) are on
-`main`. What remains is bounded incomplete-message memory and clean exits
-for connection-blocked writers; per-broadcast
+`main`, and receive leases bound incomplete-message memory (#5878). What
+remains is clean exits for connection-blocked writers; per-broadcast
 fairness gives the crate-private send domains (#5872) their consumer in
 [Broadcast fairness](/quest/m2/broadcast-fairness.md).
 qmux already runs on the shared stream state machine, outside this epic.
@@ -71,7 +71,6 @@ cache limits remain separate; bitrate pacing composes with this memory cap.
 
 ## Required
 
-- [Bound message assembly](/quest/m1/quic/receive-memory.md) - complete headers and frames return credit, and receiver priority cancellation restores progress
 - [Connection-blocked writers end cleanly](/quest/m1/quic/connection-blocked.md) - an ended stream leaves the blocked-writer list, and STOP_SENDING surfaces under exhausted connection credit
 
 ## Related

quest/m1/release-audit/README.md

@@ -113,7 +113,6 @@ child records whether its behavior is new on main or inherited from release.
 
 - [JS subscription ranges](/quest/m1/subscribe-ranges/js.md) - range lists and frame offsets build on the bounds fixed here
 - [OBS video source](/quest/m2/obs-moq-video/source.md) - reproduced inherited timing and EOF defects remain with the decoder replacement owner
-- [Receive memory](/quest/m1/quic/receive-memory.md) - incomplete reliable input remains a separate connection-credit concern
 - [QPACK dependency fix](/quest/m0/web-transport-proto-0.6.3.md) - decoded header expansion is already tracked
 - [Compressed tracks](/quest/m1/compress/README.md) - mid-group widening and application migration have existing owners
 - [Archive consumer](/quest/m1/archive/consumer.md) - current producer and CLI reader still need the new-format roundtrip

quest/m1/release-audit/datagram-memory.md

@@ -45,5 +45,4 @@ with the maintainer before implementing it.
 
 ## Related
 
-- [Reliable receive memory](/quest/m1/quic/receive-memory.md) - parser-held incomplete streams, not completed datagram queues
 - [Compressed tracks](/quest/m1/compress/README.md) - shared compression behavior and fallback

quest/m1/release-audit/webtransport-streams.md

@@ -31,5 +31,4 @@ if affected.
 
 ## Related
 
-- [Receive memory](/quest/m1/quic/receive-memory.md) - classification must preserve connection-credit ownership
 - [QPACK dependency fix](/quest/m0/web-transport-proto-0.6.3.md) - separate decoded-header expansion problem

quest/m1/rs-request-credit.md

@@ -36,10 +36,7 @@ Propose the error variant's name in the PR. Public API: one new `Error`
 variant, and possibly a `transport::poll` session method. Wire: none.
 
 Decided 2026-10-20 (maintainer): the `transport::poll` trait breaks land in
-order, [receive memory](/quest/m1/quic/receive-memory.md) first, then this
-quest, then the send domain in [broadcast fairness](/quest/m2/broadcast-fairness.md), so
+order, this quest on the receive-lease shape from
+[moq-dev/moq#5878](https://github.com/moq-dev/moq/pull/5878), then the send
+domain in [broadcast fairness](/quest/m2/broadcast-fairness.md), so
 implementers rebase on one shape at a time.
-
-## Required
-
-- [Bound message assembly](/quest/m1/quic/receive-memory.md) - lands its `transport::poll` change first; this quest builds its non-waiting open on that shape

quest/m2/README.md

@@ -77,6 +77,7 @@ ranked just below deterministic TS legs, which it requires.
 - [Ordered owed wait](/quest/m2/ordered-owed-wait.md) - an ordered reader waits within max_delay for a missing group only while the track still owes it
 - [lite-05/06 gap judgement](/quest/m2/lite-legacy-gap.md) - a resumed copy on lite-05/06 never reads a descending track's newest group as its start
 - [Unbounded groups](/quest/m2/unbounded-groups/README.md) - groups and frames lose their size caps; the cache sheds parts of a group under pressure and refills the holes in place
+- [Receive pool](/quest/m2/receive-pool.md) - one byte budget per worker covers every connection's receive credit and the cache, billing each frame once
 - [Rust-backed @moq/net](/quest/m2/rs2ts/README.md) - measure browser baselines, complete WASM bindings, and adopt Rust behind @moq/net before the later JS-only stage
 - [Front parking](/quest/m2/origin-front-parks.md) - an unroutable request waits on a front instead of re-asking on every route-table move
 - [Route wakes](/quest/m2/route-wakes.md) - a route change wakes only the fronts it can move, so pool churn stops scaling with served paths

quest/m2/broadcast-fairness.md

@@ -41,7 +41,7 @@ Direction carried over from 2026-09-19, not re-confirmed:
 - The draft would say a relay MAY scope priority to the broadcast on a
   relay-to-relay connection; no carrier is needed on the wire.
 - Decided 2026-10-20 (maintainer): the `transport::poll` trait breaks land in
-  order, [receive memory](/quest/m1/quic/receive-memory.md), then
+  order, receive leases ([moq-dev/moq#5878](https://github.com/moq-dev/moq/pull/5878)), then
   [Rust request credit](/quest/m1/rs-request-credit.md), then the send domain.
 
 Receive ranks, folded in from
@@ -103,4 +103,3 @@ update moves an already-ranked stream.
 ## Related
 
 - [One parked group per subscription](https://github.com/moq-dev/moq/pull/6140) - the parked group each subscription keeps must still yield the next stream by broadcast
-- [Bound incomplete messages](/quest/m1/quic/receive-memory.md) - the receive-side counterpart on the same moq-quic sessions

quest/m2/rate-quic.md

@@ -26,7 +26,7 @@ backpressure the peer cannot ignore, rather than metering and closing.
   flow-control limited (its congestion controller does not back off) and
   queues until [the grant](/quest/m2/rate-grant.md) clamps its encoder.
   Keep rate pacing separate from the connection memory allowance in
-  [message assembly](/quest/m1/quic/receive-memory.md). The memory allowance
+  message assembly (receive leases, [#5878](https://github.com/moq-dev/moq/pull/5878)). The memory allowance
   must fit the largest supported encoded unit even when it takes many rate
   intervals to receive. Limit each grant by both rate allowance and available
   memory backing; do not wait for a whole-message credit release to grant
@@ -95,7 +95,3 @@ pacing alone does not trigger pressure cancellation.
 Decided in the 2026-10-10 receive-memory interview: memory allowance and
 rate pacing are independent bounds. This replaces the earlier assumption
 that a one-second rate window can also be the complete assembly allowance.
-
-## Required
-
-- [Bound message assembly](/quest/m1/quic/receive-memory.md) - separate retained memory from paced outstanding credit