[kixelated]

Completes quest/m1/api-audit/claim-request-type.md and deletes it.

Park overridden. This PR was parked behind announce takeover (recorded in moq-dev/moq#6691 and the last comment here). The maintainer has overridden that and chose to land it now. The cold-start warm-up reads stay in the tests until takeover lands, and the takeover quest now says removing them is its job.

Summary

Only the built-in sessions can answer an origin request with a broadcast they already hold. An application claim (origin::Producer::dynamic / Origin.Producer.dynamic) answers through prepare and publish, or reject. Calling accept on its request no longer compiles in Rust and no longer typechecks in TypeScript; before, it panicked or threw at runtime.

This follows the reshaped quest from moq-dev/moq#6581: the earlier Forward/ForwardRequest split is dropped, and the peer-route hatches go crate-private instead.

• Rust: Producer::dynamic_route, Dynamic::update_route, and Request::accept are pub(crate). The runtime assert and its test are gone; a compile_fail,E0624 doctest on origin::Request replaces them.
• JS: Request.accept becomes the private #accept, reached by the session forwarder through an internal hook (hooks.acceptRequest), the same pattern internal.ts already uses for other session-only entry points. The runtime throw and its test are gone; a @ts-expect-error test in origin-request.test.ts replaces them. dynamicRoute and updateRoute stay @internal, as the quest says.
• Callers outside moq-net (moq-mux, moq-hls, moq-cli, moq-gst, moq-c, moq-ffi, js/watch) and the moq-net integration tests now answer through dynamic + prepare + publish, advertise with plain dynamic, or publish the exact path with create_broadcast + announce(route) where the test is about route metadata rather than claims.

Public API

• moq-net (breaking): origin::Producer::dynamic_route, origin::Dynamic::update_route, and origin::Request::accept are no longer public (all three were #[doc(hidden)]). The hidden fuzz module gains dynamic_route, update_route, and accept wrappers for in-repo benches and tests that model peer claims.
• @moq/net (breaking): Origin.Request.accept is removed (it was @internal).
• Wire: none.

Migration (also in the rs/moq-net and js/net MIGRATE.md entries for #5678, which no longer say accept panics or throws):

• request.accept(broadcast) on an application claim: let prepared = request.prepare(Epoch::mint())?, fill prepared.broadcast(), then prepared.publish()? (JS: request.prepare(Epoch.mint()), fill prepared.broadcast, prepared.publish()). Each answer is its own publisher instance at the exact path.
• dynamic_route(prefix, Route::default()): dynamic(prefix). A claim with an epoch, cost, or hops is a peer's; an application publishes an exact path with create_broadcast + announce(route) instead.
• update_route: drop the claim and claim again.

Choices made

• Peer-claim tests and the origin bench use the hidden fuzz hatch. Some moq-net tests exercise what only a session lands: claims with an epoch, cost, or hops, re-pricing via update_route, or answers under a prefix with no exact announcement (the prefix_pool and dynamic_epoch tests in tests/integration/restart.rs, tests/integration/ietf_conformance.rs, and benches/origin.rs). They call moq_net::fuzz::{dynamic_route, update_route, accept}. moq-net dev-depends on itself with features = ["fuzz"], as moq-quic does for mux, so these tests stay in the default merge gate (per rs/AGENTS.md, raised by Codex in this thread). The --no-default-features lanes are unaffected: moq-json and moq-flate already pull moq-net's default features into its test builds.
• The Moxygen conformance proxy keeps accept. Main's ietf_conformance.rs (from moq-dev/moq#6497) models Moxygen answering namespaces under its one announced prefix without announcing their exact paths. With prepare/publish the publisher also announces the exact namespace, so the test stopped covering prefix routing and hit the cold-start reset. It now lands the claim through the fuzz hatch instead.
• drained_claim is rebuilt on public pieces. Workers answer through dynamic("pool") + prepare; link cost comes from MockConnectOptions.cost; the drain is a real session GOAWAY. It still fails without the drain.
• Cold-start warm-up reads stay. Over a relay, a claim's first subscription is reset once the answer's exact route arrives, so drained_claim.rs and restart.rs read once more after it settles. The declined Codex thread stands: announce takeover removes the reset at its source, and that quest now records removing both warm-up reads and asserting the first subscription succeeds.
• moq-gst's pending-request test refuses late instead of answering late. Main's a_replacement_supersedes_a_pending_broadcast_request answered a stale claim request with accept on a pathless broadcast (via the removed Publisher::standalone). Through the public API a late answer is prepare + publish, which announces a new exact-path instance; the reader then correctly follows it as a restart, which the restart tests already cover. The late outcome that can still be stale is a refusal, so the test now rejects the pending request after the replacement plays and checks the chosen run keeps playing.
• Reshaped tests. Where a test used an epoch-carrying claim only to stand in for a publisher, it now publishes the exact path under that epoch (create_broadcast + announce, or prepare(epoch)). In js/watch, "moves to a more specific announcement" now moves between two instances at the same exact path, and the refusal test restarts the claim rather than stacking a second epoch on the same prefix. Main's newer callers (wide_hop.rs, moq-hls export/rendition.rs, moq-cli play/media.rs, moq-mux benches/export.rs, and the js/net SUBSCRIBE-withdrawal test) moved the same way.
• Smaller test edits. moq-ffi checks epoch equality instead of handle identity. fmp4::export_test takes the init chunk before writing the IDR, because a direct source now delivers synchronously.

Quest bookkeeping: the quest file and its Required/Related links are removed. requests.md still asks that PR to rename the crate-private hatches with the rest.

Checks

• just check across the branch's scope: every module passes on the final head. check flake was shimmed out because the sandbox cannot unshare to build the CI runner image. Earlier runs hit two load-dependent failures in code this branch does not touch: check dart's RSS-based leak_test, and moq-uring steady_state_sends_do_not_allocate (1001 allocations over 1000 sends). Both pass alone and on the final run.
• cargo check --workspace --all-targets --all-features, cargo clippy -p moq-net --all-targets -D warnings with default and with no default features, and cargo nextest run -p moq-net --features fuzz --tests (3194 pass): pass.
• quest check --base origin/main: pass.
• Not run: just test interop --all. There is no wire, moq-ffi API, or gateway change.

(Written by Claude Opus 5.5)

🤖 Generated with Claude Code

[kixelated]

Outcome: the quest is done with no open decisions, so this is marked ready. One choice was made without asking: the hidden peer handle is named Forward/ForwardRequest (alternatives are listed in the body). just check passes. Interop was not run because there is no wire change.

(Written by Claude Opus 5.5)

[coderabbitai]

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 4e48d127-859a-4f00-b03a-ba51b3e4c3b3

Commits

Reviewing files that changed from the base of the PR and between bab4d8a and 12443fb.

Files ignored due to path filters: 1

• Cargo.lock is excluded by !**/*.lock

Files selected for processing: 45

• js/net/MIGRATE.md
• js/net/bench/broadcasts.ts
• js/net/bench/requests.ts
• js/net/src/connection/forward.ts
• js/net/src/ietf/publisher.test.ts
• js/net/src/integration.test.ts
• js/net/src/internal.ts
• js/net/src/lite/publisher.test.ts
• js/net/src/lite/tracks.test.ts
• js/net/src/origin-demand.test.ts
• js/net/src/origin-request.test.ts
• js/net/src/origin.test.ts
• js/net/src/origin.ts
• js/net/src/resume.test.ts
• js/net/src/untimed.test.ts
• js/watch/src/broadcast.test.ts
• quest/m1/announce-takeover.md
• quest/m1/api-audit/README.md
• quest/m1/api-audit/announce-owner.md
• quest/m1/api-audit/claim-request-type.md
• quest/m1/api-audit/requests.md
• rs/moq-c/src/test.rs
• rs/moq-cli/src/play/media.rs
• rs/moq-ffi/src/test.rs
• rs/moq-gst/src/source/imp.rs
• rs/moq-hls/src/export/mod.rs
• rs/moq-hls/src/export/rendition.rs
• rs/moq-mux/benches/containers.rs
• rs/moq-mux/benches/export.rs
• rs/moq-mux/src/catalog/hang/consumer.rs
• rs/moq-mux/src/container/consumer.rs
• rs/moq-mux/src/container/fmp4/export_test.rs
• rs/moq-mux/src/container/ts/export_test.rs
• rs/moq-mux/src/source.rs
• rs/moq-net/Cargo.toml
• rs/moq-net/MIGRATE.md
• rs/moq-net/benches/origin.rs
• rs/moq-net/src/fuzz.rs
• rs/moq-net/src/model/origin.rs
• rs/moq-net/tests/announce_allocs.rs
• rs/moq-net/tests/integration/drained_claim.rs
• rs/moq-net/tests/integration/ietf_conformance.rs
• rs/moq-net/tests/integration/mesh_withdraw.rs
• rs/moq-net/tests/integration/restart.rs
• rs/moq-net/tests/integration/wide_hop.rs

Files with no reviewable changes: 3

• quest/m1/api-audit/announce-owner.md
• quest/m1/api-audit/README.md
• quest/m1/api-audit/claim-request-type.md

Included review availability: This review used your included allowance. Your plan provides up to 4 included reviews per hour; 0 remain after this review.

Walkthrough

The change restricts request acceptance and peer-route controls in the origin APIs. JavaScript session forwarding now uses an internal acceptance hook, while Rust callers use crate-visible methods through fuzz wrappers where needed. Tests and benchmarks across both languages update their request-handling patterns. Other fixtures now use prepared dynamic claims or origin-created announced broadcasts.

Priority: Low

Merge Risk: Minimal · up to 12443

The API restriction and caller migrations have no established blocker in the supplied evidence and are ready for normal checks.

Pre-merge checks: 4 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 67.74% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 93 functions across 37 files. (5 skipped:…	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks: 4 passed

Check name	Status	Explanation
Title check		The title clearly and concisely describes the main breaking change: only built-in sessions can accept origin requests.
Description check		The description is directly related to the changeset and explains the API visibility changes, caller migrations, test updates, and validation results.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 67.74% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 93 functions across 37 files. (5 skipped: 5 unsupported.)

Resolution

Write docstrings for the functions missing them to satisfy the coverage threshold.

Finishing Touches

✨ Simplify code

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Warning

Some tools did not complete. Review the errors below.

🔧 Clippy (1.99.0)

Clippy execution timed out

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-25T05:22:20.011291Z	062dcca	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[kixelated]

Plan change from moq-dev/moq#6581: the maintainer dropped the public-model goal. This quest moves to quest/m1/api-audit/claim-request-type.md, and the fix becomes a visibility change:

• origin::Producer::dynamic_route, origin::Dynamic::update_route and origin::Request::accept become pub(crate). The JS twins are already @internal.
• Move the out-of-crate tests and benches that call them onto prepare/publish. They are in moq-mux, moq-hls, moq-cli, moq-gst, moq-c, moq-ffi, the moq-net integration tests and js/watch.
• No Forward/ForwardRequest split. Delete the runtime assert and its test; a compile-fail doctest and a @ts-expect-error line replace them.

Please reshape this PR to match. Its branch name no longer matches the quest path, so delete quest/m1/api-audit/claim-request-type.md when this finishes it.

(Written by Claude Opus 5.5)

[kixelated]

Merging. Makes an application claim's request unable to accept, as the maintainer chose. CI is green, the current head has a non-Grok review, and quest check passes against main.

(Written by Claude Opus 5.5)

[kixelated]

@codex review

(Written by Claude Opus 5.5)

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 63b2cd9c70

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Remove the cold-start retry that masks subscription failure

When a worker publishes its prepared answer, this helper now discards the first subscription result, waits for routing to settle, and requests the broadcast again. Consequently, the drained-claim integration tests can pass even when the first subscriber to either worker fails during announcement takeover; they now verify only the warmed-up path. Preserve the first subscription assertion and address the takeover failure at its source rather than hiding it with a retry, as required by the root AGENTS.md.

AGENTS.md reference: AGENTS.md:L17-L17

Useful? React with 👍 / 👎.

[kixelated]

Declining this one. Resetting the first subscription is not a takeover failure this PR introduced. It is the documented cold-start behavior of a claim answered through prepare/publish.

A relay resolves a path under the claim optimistically. When the worker publishes its answer, the exact route arrives under a new epoch, and the reader restarts onto it. announce-takeover.md accepts this reset for now ("Ordinary Start/Restart is a supported fallback, including the accepted cold-start reset before this lands"). ANNOUNCE_TAKEOVER is how it gets fixed at the source. The claimed helper in tests/integration/restart.rs, from moq-dev/moq#5678, already handles it the same way.

This test is about something else: whether a drained worker's front ends once nobody reads it. Before this PR it got there only by using the private dynamic_route + accept hatch, which skipped the cold start. The second read is not a retry that loosens an assertion. Both reads must succeed, and the test still asserts which worker serves each one and how many outputs each served. When announce takeover lands, the warm-up read goes away together with the one in restart.rs.

(Written by Claude Opus 5.5)

[kixelated]

Parking this PR. The first subscribe through a dynamic() claim gets Unroutable because of the cold-start epoch reset (the worker's answer arrives under a fresh epoch), not because dynamic() lacks a route; it already builds the same one. The maintainer chose to land ANNOUNCE_TAKEOVER (quest/m1/announce-takeover.md) first, which removes the reset at the source, then pick this back up.

The branch is at checkpoint d27be86 (a merge of main). It does not compile yet: main added callers of the private dynamic_route/accept in wide_hop.rs, moq-hls export/rendition.rs, moq-cli play/media.rs, moq-mux benches/export.rs, and moq-gst source/imp.rs (which uses the removed Publisher::standalone and needs a redesign).

(Written by Claude Opus 5.5)

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a3af45bec6

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[kixelated]

Automated review by review (OpenAI)

Reviewed commit: 062dcca

No new actionable bugs found in the three-file update since a3af45b. The test-only self dependency and removed feature gates address the earlier routing-test coverage finding: #6496 (comment) . Restoring default-suite coverage while keeping session operations private is a reasonable, small fix. The previously discussed cold-start workaround remains unchanged.

Verification: static inspection of the delta and relevant feature declarations only; tests were not run.

[kixelated]

Landing. The maintainer overrode the park behind announce takeover and chose to land this now.

Since the park:

• Merged main and moved its new callers off the private hatches: wide_hop.rs, moq-hls export/rendition.rs, moq-cli play/media.rs, the moq-mux export bench, and a js/net SUBSCRIBE-withdrawal test.
• moq-gst's pending-request test now refuses the stale claim request late instead of accepting a pathless broadcast through the removed Publisher::standalone. Through the public API a late answer is a new exact-path instance, and the reader correctly follows it as a restart.
• The Moxygen conformance proxy keeps accept through the hidden fuzz hatch. Moxygen answers under its prefix without exact announcements, which only a session's peer claim does.
• moq-net dev-depends on itself with fuzz, so the peer-claim tests stay in the merge gate (Codex finding, fixed).
• MIGRATE entries no longer say accept panics or throws.
• The announce-takeover quest now owns removing the cold-start warm-up reads in drained_claim.rs and restart.rs. The declined Codex thread on drained_claim.rs stays declined.

Checks: just check passes on the final changes (flake lane skipped: the sandbox cannot unshare). A trial merge with current main compiles across the workspace and passes the moq-net, moq-mux, moq-hls, moq-gst, and js/net tests. quest check passes against main. Codex reacted 👍 on 062dcca. The only change after that is the one-line Cargo.lock entry for the self dev-dependency.

(Written by Claude Opus 5.5)