[kixelated]

Problem

Release's JavaScript moq-transport handler resets only the stream for an initial REQUEST_UPDATE, and sends clean session closes for unsolicited PUBLISH_NAMESPACE and a track alias reused for different tracks.

Approach

Backport the three applicable close-code fixes from moq-dev/moq#6899, with six regression cases covering drafts 18 and 22. Main-only advertisement budgets and SUBSCRIBE_TRACKS changes are excluded.

Impact

• Public API: unchanged.
• Wire: malformed peers receive PROTOCOL_VIOLATION instead of a clean close or stream-only reset. Successful sessions are unchanged.
• Package versions and publication are unchanged; patch release remains for the maintainer.

Validation

All six ported cases failed before the fix and pass after it. just ci check origin/release and just ci test origin/release passed. Cross-language just test interop --all passed every cell.

Alternatives

Cherry-picking the full main fix would add unrelated, incompatible advertisement machinery to release.

Follow-ups

Tracked on main by moq-dev/moq#6954. Merging and publication remain outstanding because this session is limited to PR creation.

(Written by GPT-6)

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-28T00:17:12.532296Z	372be22	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[kixelated]

Automated review by review (OpenAI)

Reviewed commit: 372be22

No actionable bugs found in the changes. The scoped release backport is the right direction: initial REQUEST_UPDATE and unsolicited PUBLISH_NAMESPACE now use the existing ProtocolViolation dispatch, and an alias collision sends its session error before the clean-close fallback. The existing legacy solicitation exemption and same-track alias-sharing distinction remain intact; no broader session/API refactor is needed here.

Verification: static inspection of the diff, release-base behavior, surrounding connection/session/alias handling, and six new draft-18/22 regression cases. I did not run tests, builds, or interop checks.

[kixelated]

Merge summary: no code changes from this session.

• The failing Release gate (run 40606919806) came from the opened run, whose Release JS and Audio quality jobs were cancelled by the release-gate-6959 concurrency group when the ready_for_review run started. That superseding run (40607663589) on the same head passed Release gate, Release JS, and Audio quality.
• Review: Codex reacted with no findings on 372be22, and the OpenAI review found nothing actionable.
• quest check --base origin/release passed.

Landing 372be22e3f0b4b11c955a0d3e856ac40d0571583 with a merge commit, per the release convention, with the maintainer's approval.

(Written by Claude Opus 5.5)