kixelated · Oct 20, 2026 · Oct 20, 2026 · Oct 20, 2026 · Oct 20, 2026 · Oct 20, 2026
diff --git a/quest/m0/audit-quests.md b/quest/m0/audit-quests.md
@@ -47,6 +47,19 @@ Checkpoint, 2026-10-19, against `main` at `2e1ec2ebf`:
   Quests added since the baseline (the resume line, egress held state, and
   the request-behind-its-token race from #5972) were checked only against
   this run's edits, not audited in full.
+- Rechecked against `main` at `9b90cdd56` (#5967) for quests left behind by
+  their own merged PRs. Retired moq-uring on moq-clock (#5926), moving its
+  unmeasured `[vdso]` profile to an m2 perf quest, IETF max age
+  (#5993), the request-behind-its-token race (#5992), and the moq-quic
+  regression net with its last child (#5989). Trimmed the TRACK_STATUS race
+  (#5991) to its deferred upstream report, and recorded what #6006 and #5987
+  left of the C++ package proof and the moq-clock crate migration. Check
+  first, next run: every PR merged from a `quest/...` branch whose quest file
+  still exists.
+- Cause of those leftovers: no quest skill tells the PR that finishes a quest
+  to delete its file, or a partial PR to rewrite it to the remainder, and
+  `/quest-merge` enables auto-merge without checking either. Drafts whose
+  bodies said "the quest remains open" were merged with the quest unchanged.
 
 This run remains open, with no successor, until the unresolved conflicts are
 settled. The unattended instruction was to skip uncertain choices:

diff --git a/quest/m1/README.md b/quest/m1/README.md
@@ -73,8 +73,7 @@ lands before the cut.
 - [Exact timestamps in every binding](/quest/m1/binding-timestamps.md) - bindings carry `{value, scale}` timestamps instead of lossy microseconds
 - [JSON window timestamps](/quest/m1/json-window-timestamps.md) - Rust and JS window consumers return each event's frame timestamp like the snapshot and stream consumers
 - [JavaScript FETCH](/quest/m1/js-fetch.md) - browser publishers answer IETF FETCH through the JS ranges request surface
-- [Subscribing readers never ask TRACK_STATUS](/quest/m1/track-status-race.md) - a reader's subscription lands with its request, and the NOT_SUPPORTED fallback goes away
-- [IETF max age](/quest/m1/ietf-max-age.md) - a moq-transport subscriber sets lite's max age through a timestamp-draft SUBSCRIBE parameter
+- [Report relays that refuse TRACK_STATUS](/quest/m1/track-status-race.md) - moqx and any other relay refusing TRACK_STATUS with an undefined code get an upstream report
 - [IETF fill timeout](/quest/m1/ietf-fill-timeout.md) - native FILL_TIMEOUT bounds upstream waiting on drafts 18-22, alongside local content-age enforcement
 - [Browser follows a renamed track](/quest/m1/browser-rename-check.md) - a real browser keeps playing when `@moq/publish` renames a track after a codec change, while size-only changes keep their identity
 - [Rust identity enforcement](/quest/m1/catalog-identity-rs.md) - `moq-mux` refuses a redefined rendition, and every Rust publisher mints a new rendition name for a decoder identity change and updates everything else in place

diff --git a/quest/m1/auth/README.md b/quest/m1/auth/README.md
@@ -48,8 +48,8 @@ Decisions settled while planning, recorded so review does not relitigate them:
   arrive on `requests()`, a moq-transport request is held to its token's
   grant, an update's token replaces it, and no lite wire changes. Step 2,
   lite requests naming an AUTH stream, is dropped; what it would have closed,
-  a request racing the token it relies on, is
-  [A request right behind its token](/quest/m1/auth/request-race.md). Step 3
+  a request racing the token it relies on, landed as a presenter-side wait in
+  [#5992](https://github.com/moq-dev/moq/pull/5992). Step 3
   sends outgoing request tokens on moq-transport through `Route::auth` as
   `USE_VALUE` ([Live requests follow their auth](/quest/m1/auth/request-update.md));
   lite has nothing to send, since the token already sits in the union.
@@ -97,7 +97,7 @@ Decisions settled while planning, recorded so review does not relitigate them:
   broadcast outside the union aborts the session with `Unauthorized`, naming
   the path. The check runs against the grants in hand once every token the
   session presented is answered, setup, replayed, or app-added alike
-  ([request race](/quest/m1/auth/request-race.md)). The origin is
+  ([#5992](https://github.com/moq-dev/moq/pull/5992)). The origin is
   untouched, so a broadcast shared across sessions (P2P hops, a cluster) is
   refused only where it is refused. Grant shrinkage cancels previously
   authorized work on this session without aborting it or deleting the shared
@@ -146,7 +146,6 @@ because `main` assigned 0x3A to NOT_FETCHABLE first.
 
 - [Live requests follow their auth](/quest/m1/auth/request-update.md) - a route swaps its auth and the session sends the update, keeping the request up
 - [Auth outlives its session](/quest/m1/auth/issuer.md) - one `auth::Handle` spans a connection's sessions, so a route's auth survives a reconnect
-- [A request right behind its token](/quest/m1/auth/request-race.md) - a lite request relying on a just-presented token is admitted, with no auth field on any request
 - [Bindings](/quest/m1/auth/bindings.md) - grants and tokens reach every
   binding through moq-ffi
 - [Token in band](/quest/m1/auth/token-in-band.md) - extra credentials ride

diff --git a/quest/m1/auth/request-race.md b/quest/m1/auth/request-race.md
diff --git a/quest/m1/auth/request-update.md b/quest/m1/auth/request-update.md
@@ -8,7 +8,7 @@ application swaps it, the session sends REQUEST_UPDATE (moq-transport)
 carrying the new auth, and the request stays up. Lite sends nothing: a
 route's auth already sits in the session union through its AUTH stream, so
 lite renews through the union as in
-[A request right behind its token](/quest/m1/auth/request-race.md). The first consumer is a client that keeps a
+[A request right behind its token](https://github.com/moq-dev/moq/pull/5992). The first consumer is a client that keeps a
 PUBLISH_NAMESPACE alive past its credential's expiry by sending
 REQUEST_UPDATE with a fresh token before it expires.
 
@@ -84,4 +84,4 @@ REQUEST_UPDATE.
 
 ## Related
 
-- [A request right behind its token](/quest/m1/auth/request-race.md) - lite renewal through the union
+- [A request right behind its token](https://github.com/moq-dev/moq/pull/5992) - lite renewal through the union
diff --git a/quest/m1/cpp-package-check.md b/quest/m1/cpp-package-check.md
@@ -1,4 +1,4 @@
-# [S] C++ and OBS packages pass their nightly dry run
+# [XS] C++ and OBS packages pass their nightly dry run
 
 ## Goal
 
@@ -8,11 +8,26 @@ checks before the first tag, using locally built release artifacts.
 ## Plan
 
 Extracted from first C++ publication on 2026-10-13 to avoid waiting for a tag
-before validating its build path. Add a local-archive override beside OBS's
-release-download branch so the nightly workflow links the C++ build artifacts.
-Keep publication tag-only. Exercise the installed package and required OBS
-settings/session-report parity through the existing nightly and interop lanes.
-The first publication and released-download proof stay in release execution.
+before validating its build path. Keep publication tag-only. The first
+publication and released-download proof stay in release execution.
 
-Public API: none beyond the binding changes owned by their quests. Wire: none.
+[#6006](https://github.com/moq-dev/moq/pull/6006) landed the build path: each
+packaged archive runs the installed-consumer checks (`just cpp check
+--archive`), and an OBS dry run links the matching checked archive
+(`just obs package --moq-archive`, CMake `MOQ_ARCHIVE_FILE`) instead of a
+release download. It passed on one Linux host locally.
+
+What remains is the proof from a scheduled Nightly on `main` after #6006:
+
+- Its `Release Cpp` job (`.github/workflows/release-cpp.yml` through
+  `nightly.yml`) builds and checks the C++ archive for all four targets, and
+  packages the OBS plugin against the checked archive for the two OBS
+  targets, macOS and Windows. Linux OBS is build-from-source and ships no
+  plugin.
+- Its separate Linux `OBS` lane (`just obs ci`) passes the settings and
+  session-report tests. That lane builds the plugin in-tree, not from the
+  packaged archive.
 
+Fix whatever those runs turn up; delete this quest once both are green.
+
+Public API: none beyond the binding changes owned by their quests. Wire: none.
diff --git a/quest/m1/ietf-max-age.md b/quest/m1/ietf-max-age.md
diff --git a/quest/m1/quic/README.md b/quest/m1/quic/README.md
@@ -63,7 +63,6 @@ cache limits remain separate; bitrate pacing composes with this memory cap.
 
 ## Required
 
-- [Regression net](/quest/m1/quic/coverage/README.md) - benchmarks, fuzzing, characterization tests, and a seeded simulation, so later QUIC changes see every behavior or cost change
 - [Bound message assembly](/quest/m1/quic/receive-memory.md) - complete headers and frames return credit, and receiver priority cancellation restores progress
 - [A reset group keeps its header](/quest/m1/quic/group-reset.md) - a lite
   publisher resets a group with `RESET_STREAM_AT`, so its subscriber drops the