[kixelated]

Problem

Finishes quest/m1/time/wall.md. Public Rust wall times still expose platform-dependent SystemTime, while the ambient clock supplies moq_clock::Wall.

Approach

Migrate wall APIs in hang, mux, HLS, QUIC, relay and tokio, plus the auth claims/grants and the epoch wall view, which the quest's inventory omitted. Update every in-tree consumer. Third-party formatters, serde_with and str0m convert at their boundaries. Per-crate clippy ratchets ban SystemTime wherever that boundary is absent.

Auth and relay share the optional moq_clock::serde::UnixSeconds adapter. It writes the same integer seconds as serde_with's TimestampSeconds<i64> and decodes by saturating to Wall's range. Wall::saturating_add backs it, the certificate expiry, and moq auth sign timestamps.

Decisions

Settled by the maintainer (2026-10-22, recorded in moq-dev/moq#6346 and on this PR):

• ✅ Expiries and auth times saturate: a time past 2554 becomes the last representable Wall, and one before 1970 becomes Wall::UNIX_EPOCH. No representable now compares differently against the saturated value. tls::PeerIdentity::expiry, the auth Claims/Grant/Peer decoders, and moq_relay::auth::request_for stay infallible, and rcgen's default year-4096 certificates are admitted again (the integration fixtures use rcgen's default expiry, as on main).
• ✅ Epoch::time() returns Result<Wall, OutOfRange>, so a limited wall view never invalidates a valid UUIDv7 identity. Epoch bytes, text and the numeric FFI getter keep the full 48-bit range.
• ✅ str0m sender-report dates outside 1970-2554 are refused at the boundary, like presentation walls (catalogs, timelines, HLS). The report is ignored and its track stays on arrival time, rather than ending the WHIP ingest: RFC 3550 lets a sender without a wall clock report NTP time zero (from the Codex review).

Dropped from the earlier draft: the fallible PeerIdentity::expiry, fallible request_for, the auth decode range refusal, and the CLI's 1970-2554 argument limit (--expires/--issued past 2554 now saturate; negatives are still refused, as on main).

Public API and wire impact

Breaking Rust APIs, each covered under How to migrate:

• hang: catalog::Clock::wall_clock, echo::Arrival::{wall,new}.
• moq-mux: Clock::{at,wall_clock}, catalog::Timebase::place.
• moq-hls: playlist/manifest program dates, MPD availability and publish times, export::Renditions::anchor.
• moq-quic: TimeSource::now, TokenLog::check_and_insert.
• moq-relay: session::View::started.
• moq-tokio: tls::PeerIdentity::expiry returns Option<Wall> (saturating).
• moq-auth: Claims::{expires,issued,not_before} and builders, Grant::expires, request::Peer::expires (saturating decode).
• moq-net: Epoch::time returns Result<Wall, OutOfRange>.

Behavior only: moq-rtc ignores a sender report outside the wall range.

Additive: moq-clock gains Wall::saturating_add and an optional serde feature with serde::UnixSeconds.

Wire: none. One JSON value moves: the relay's auth request reports a certificate expiry past 2554 as 18446744074 (the saturated Wall) instead of the certificate's own date. Protocol encodings, drafts, versions, JSON units and integer/null shapes are unchanged. FFI and bindings are unchanged, so no binding, JS or doc sync is needed beyond removing the relay auth doc's range note. JS auth already reads the full numeric range.

How to migrate

PRs no longer write MIGRATE.md, so these notes moved here from each package's ## Unreleased list.

• hang: catalog::Clock::wall_clock and echo::Arrival::{wall,new} use moq_clock::Wall in place of SystemTime. Read the ambient wall with moq_clock::wall(), convert a third-party SystemTime with Wall::try_from, and convert back with SystemTime::from at that API's boundary. Times outside 1970-2554 fail with TimestampOverflow; catalog and echo JSON units are unchanged.
• moq-mux: Clock::{at,wall_clock} and catalog::Timebase::place use moq_clock::Wall in place of SystemTime. Pass moq_clock::wall() for the current wall, use Wall::try_from(system_time)? for a third-party timestamp, and convert returned values with SystemTime::from only at a third-party boundary. The portable wall range is 1970-2554; catalog encodings are unchanged.
• moq-hls: program date times, MPD availability and publish times, and export::Renditions::anchor use moq_clock::Wall instead of SystemTime. Pass moq_clock::wall() for now, convert third-party timestamps with Wall::try_from, and pass wall.into() to formatters that take SystemTime. HLS and DASH text encodings are unchanged.
• moq-quic: TimeSource::now and TokenLog::check_and_insert take or return moq_clock::Wall in place of SystemTime. Custom clocks return moq_clock::wall() or convert third-party timestamps with Wall::try_from. The wall range is 1970-2554; encoded token seconds are unchanged, and out-of-range issue times or expiry arithmetic refuse a token instead of overflowing.
• moq-relay: session::View::started uses moq_clock::Wall instead of SystemTime. Convert with SystemTime::from at a third-party boundary, or measure since Wall::UNIX_EPOCH with saturating_duration_since. The session JSON still carries integer Unix seconds.
• moq-tokio: tls::PeerIdentity::expiry returns Option<moq_clock::Wall> in place of Option<SystemTime>. Convert with SystemTime::from only where a third-party API needs it. A notAfter past 2554, such as rcgen's default year 4096, saturates to the last representable Wall, and one before 1970 to Wall::UNIX_EPOCH.
• moq-auth: Claims::{expires,issued,not_before}, their builder arguments, Grant::expires, and request::Peer::expires use moq_clock::Wall instead of SystemTime. Stamp them with moq_clock::wall(), or use Wall::try_from for third-party timestamps. JWT and auth JSON still encode integer Unix seconds, with the same rounding. Decoding saturates on every platform: a time before 1970 reads as Wall::UNIX_EPOCH and one past 2554 as the last representable Wall, so expiry checks are unchanged. That last Wall encodes as 18446744074, so an auth server now sees a relay's certificate expiry past 2554, such as rcgen's default year 4096, as that value.
• moq-net: Epoch::time returns Result<moq_clock::Wall, moq_clock::OutOfRange> instead of SystemTime. Use epoch.time()? and convert with SystemTime::from only at a third-party API boundary. Every canonical UUIDv7 remains a valid identity, including one whose 48-bit timestamp is later than Wall's year 2554 limit; only its wall-time view fails. Epoch text, ordering, bytes, and protocol acceptance are unchanged.

Quest

Deletes quest/m1/time/wall.md and its link from the API-audit auth names quest. The Controlled time epic's last child is gone, so it is sized [XS] with what remains: move the decisions the m2 quests still cite, then retire it.

Validation

• Merged origin/main (conflicts only in MIGRATE.md files, both sides kept).
• Merged origin/main again: every MIGRATE.md takes main's version (the notes are above), the relay's ACME code moved to acme/client.rs on main and its Failures timestamps were ported to Wall there, and the HLS feed lock and ready import from main were kept.
• just check passes rs lint, quest, drill, Python, Kotlin, Go, Dart, C++ and OBS; Swift skips on Linux. Only the flake check fails, building the unchanged runner image, because this host refuses writing /proc/self/uid_map.
• Workspace cargo clippy --all-targets --all-features -D warnings passes.
• moq-relay, moq-cli and moq-clock pass under nextest (729 tests), including the three mTLS integration tests on rcgen's default year-4096 certificates.
• moq-clock, moq-auth and moq-tokio unit tests pass under nextest, including new saturation tests for Wall::saturating_add, UnixSeconds, Grant, PeerIdentity::expiry (rcgen's 4096 default) and the CLI timestamp parser.
• runtime::tests::paused_runtimes_own_their_anchors fails under plain cargo test because it needs a fresh process; it passes under nextest and is untouched here.

🤖 Generated with Claude Code

(Written by Claude Opus 5.5)

[kixelated]

Maintainer decision from planning in #6346, recorded in quest/m1/time/wall.md. Certificate and auth expiries should saturate instead of refusing:

• A not_after or auth expiry past 2554 becomes the latest representable Wall.
• One before 1970 becomes Wall::UNIX_EPOCH.

With that, tls::PeerIdentity::expiry, auth::request_for, Epoch::time and the auth claims can stay infallible, and rcgen's default year-4096 certificates keep working. No representable now compares differently against the saturated value. Presentation walls (catalogs, timelines, HLS) still refuse out-of-range values. The doc/bin/relay/auth.md and moq-tokio MIGRATE.md text about refusing expiries beyond 2554 should go.

(Written by Claude Opus 5.5)

[coderabbitai]

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 93f89e66-1907-4c03-9f04-80ced2be8c80

Commits

Reviewing files that changed from the base of the PR and between 1a98a3a and ab9d93b.

Files ignored due to path filters: 1

• Cargo.lock is excluded by !**/*.lock

Files selected for processing: 89

• quest/m1/time/README.md
• quest/m1/time/wall.md
• rs/hang/Cargo.toml
• rs/hang/clippy.toml
• rs/hang/src/catalog/clock.rs
• rs/hang/src/catalog/root.rs
• rs/hang/src/echo.rs
• rs/hang/src/snapshot.rs
• rs/moq-audio/src/encode/capture.rs
• rs/moq-auth/Cargo.toml
• rs/moq-auth/clippy.toml
• rs/moq-auth/examples/asymmetric.rs
• rs/moq-auth/examples/basic.rs
• rs/moq-auth/src/claims.rs
• rs/moq-auth/src/client.rs
• rs/moq-auth/src/grant.rs
• rs/moq-auth/src/key.rs
• rs/moq-auth/src/lease.rs
• rs/moq-auth/src/request.rs
• rs/moq-auth/src/serve.rs
• rs/moq-auth/src/set.rs
• rs/moq-auth/src/wire.rs
• rs/moq-bench/clippy.toml
• rs/moq-bench/src/connection.rs
• rs/moq-bench/src/host.rs
• rs/moq-bench/src/stats.rs
• rs/moq-cli/clippy.toml
• rs/moq-cli/src/auth.rs
• rs/moq-cli/src/publish.rs
• rs/moq-clock/Cargo.toml
• rs/moq-clock/src/lib.rs
• rs/moq-clock/src/serde.rs
• rs/moq-clock/src/wall.rs
• rs/moq-ffi/clippy.toml
• rs/moq-ffi/src/origin.rs
• rs/moq-ffi/src/test.rs
• rs/moq-gst/clippy.toml
• rs/moq-gst/src/sink/imp.rs
• rs/moq-gst/src/sink/wall.rs
• rs/moq-hls/clippy.toml
• rs/moq-hls/src/export/mod.rs
• rs/moq-hls/src/export/mpd.rs
• rs/moq-hls/src/export/playlist.rs
• rs/moq-hls/src/export/rendition.rs
• rs/moq-hls/src/export/renditions.rs
• rs/moq-hls/src/export/segments.rs
• rs/moq-mux/clippy.toml
• rs/moq-mux/src/binary.rs
• rs/moq-mux/src/catalog/producer.rs
• rs/moq-mux/src/catalog/timebase.rs
• rs/moq-mux/src/clock.rs
• rs/moq-mux/src/container/flv/import_test.rs
• rs/moq-mux/src/container/fmp4/import_test.rs
• rs/moq-mux/src/container/mkv/import_test.rs
• rs/moq-mux/src/container/ts/export_test.rs
• rs/moq-mux/src/container/ts/import.rs
• rs/moq-mux/src/container/ts/import_test.rs
• rs/moq-mux/src/container/ts/programs.rs
• rs/moq-mux/src/stats.rs
• rs/moq-net/clippy.toml
• rs/moq-net/src/epoch.rs
• rs/moq-quic/Cargo.toml
• rs/moq-quic/README.md
• rs/moq-quic/clippy.toml
• rs/moq-quic/src/bloom_token_log.rs
• rs/moq-quic/src/config/mod.rs
• rs/moq-quic/src/lib.rs
• rs/moq-quic/src/tests/token.rs
• rs/moq-quic/src/tests/util.rs
• rs/moq-quic/src/token.rs
• rs/moq-relay/Cargo.toml
• rs/moq-relay/clippy.toml
• rs/moq-relay/src/acme/client.rs
• rs/moq-relay/src/auth.rs
• rs/moq-relay/src/auth/refresh.rs
• rs/moq-relay/src/session.rs
• rs/moq-relay/tests/integration/auth_lifetime.rs
• rs/moq-relay/tests/integration/refusals.rs
• rs/moq-relay/tests/integration/session_revalidate.rs
• rs/moq-room/clippy.toml
• rs/moq-rtc/clippy.toml
• rs/moq-rtc/src/session.rs
• rs/moq-stats/clippy.toml
• rs/moq-tokio/clippy.toml
• rs/moq-tokio/src/tls.rs
• rs/moq-transcode/Cargo.toml
• rs/moq-transcode/src/catalog.rs
• rs/moq-uring/clippy.toml
• rs/moq-video/src/encode/producer.rs

Files with no reviewable changes: 2

• rs/moq-quic/Cargo.toml
• quest/m1/time/wall.md

Included review availability: This review used your included allowance. Your plan provides up to 4 included reviews per hour; 2 remain after this review.

Walkthrough

The Rust workspace replaces SystemTime with moq_clock::Wall across authentication, token handling, catalog clocks, media timing, and related APIs. The moq-clock crate adds a serde adapter and saturating addition. Timestamp parsing, serialization, and conversion paths add range checks or saturation. Clippy configurations now reject SystemTime in multiple crates.

Priority: Normal

Merge Risk: Minimal · up to ab9d9

No actionable issue remains from this review; the change is ready for normal merge checks.

Pre-merge checks: 4 · 1

Failed checks: 1 inconclusive

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 46.59% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 176 functions across 50 files. (37 skippe…	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks: 4 passed

Check name	Status	Explanation
Title check		The title clearly and concisely describes the primary breaking change: migrating public Rust wall-time APIs to moq_clock::Wall.
Description check		The description is directly related to the changeset and explains the migration scope, behavior decisions, API impact, wire impact, migration steps, and validation results.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 46.59% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 176 functions across 50 files. (37 skipped: 23 unsupported, 14 over the file limit.)

Resolution

Write docstrings for the functions missing them to satisfy the coverage threshold.

Finishing Touches

✨ Simplify code

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Warning

Some tools did not complete. Review the errors below.

🔧 Clippy (1.99.0)

Clippy execution timed out

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-24T11:23:13.588642Z	ab9d93b	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e71d8bd070

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[kixelated]

@codex review

(Written by Claude Opus 5.5)

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Keep it up!

Reviewed commit: 12537bc2d9

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[kixelated]

@codex review

(Written by Claude Opus 5.5)

[kixelated]

@codex review

(Written by Claude Opus 5.5)

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. More of your lovely PRs please.

Reviewed commit: 5b010db10b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[kixelated]

Merging. Uses Wall for public Rust wall times, as the maintainer chose. CI is green, the current head has a non-Grok review, and quest check passes against main.

(Written by Claude Opus 5.5)

[kixelated]

Merged origin/main again to clear the conflict: both rs/hang/MIGRATE.md and rs/moq-auth/MIGRATE.md keep this PR's Wall entry alongside main's new FromStr entries (moq-dev/moq#6471). No code conflicts, and main added no new public SystemTime. just check passes except the runner VM flake image, which can't build in the local sandbox and is unrelated. quest check passes against main, and Codex gave a thumbs-up on this head. Re-queuing.

(Written by Claude Opus 5.5)