quest: plan follow-ups from the 2026-10-31 /quest-complete merges

quest/m0/README.md

@@ -35,7 +35,8 @@ since cutting segments from first-frame pts waits on nothing in m1.
 - [Backport the joined-head FETCH race fix](/quest/m0/backport-fill-head-race.md) - a `release` relay stops FETCHing a group head its own SUBSCRIBE is bringing, which left live readers hanging
 - [CI cost and latency](/quest/m0/ci/README.md) - cloud CI runs only in a batched merge gate as one `just ci` pass per batch, expensive checks run nightly and gate `release`, caches move to R2, and runners are chosen last
 - [More tests under load](/quest/m0/test-flakes-2/README.md) - load-only and queue failures, one quest per flake, fixed at the cause, since each one fails a whole batch
-- [Backport the dot-segment and auth-redirect refusals](/quest/m0/backport-release-hardening.md) - `release`'s relay refuses dot-segment paths and its auth client refuses redirects
+- [Backport the relay and auth hardening to release](/quest/m0/backport-release-hardening.md) - `release`'s relay refuses dot-segment paths, serves its HTTP routes with main's response hardening, and withdraws advertisements a peer starves of send credit; its auth client refuses redirects
+- [Release's MKV importer bounds what it buffers](/quest/m0/backport-mkv-buffer.md) - on `release`, an MKV input that declares a huge element and trickles its bytes no longer grows the importer's memory without limit
 - [HLS export on a declared grid](/quest/m0/hls-media-grid.md) - the catalog's `hls` field and record tracks go away, and the export numbers segments on `media.join.interval` from media tracks
 - [Agents use quest's worktree hooks](/quest/m0/quest-worktree-hooks.md) - adopt `quest worktree hook` once it's shown to coexist with T3 Code's worktrees
 - [HLS lists contributions](/quest/m0/hls-contributions.md) - an HLS master lists each catalog contribution's renditions, and a contribution's media is subscribed only while players fetch it

quest/m0/backport-mkv-buffer.md

@@ -0,0 +1,58 @@
+# [S] Release's MKV importer bounds what it buffers
+
+## Goal
+
+On `release`, an MKV input that declares a huge element and trickles its
+bytes no longer grows the importer's memory without limit: once the bytes
+held for one incomplete element pass a size bound, the import fails with an
+error. Ordinary files of any total size still import, and the published API
+and supported inputs are unchanged.
+
+## Plan
+
+Decided 2026-10-31 (user, /quest-plan of the follow-ups from the 2026-10-31 /quest-complete run), from [moq-dev/moq#7234](https://github.com/moq-dev/moq/pull/7234).
+
+Backport #7234's MKV unbounded-buffer fix to `release`? ✅ Trimmed
+backport, m0: confirm with the 1 GiB repro on `release`, size bound only.
+
+Why (the recommendation's reasoning, from #7234's Impact): #7234 is a real memory-exhaustion fix, but the full change is a
+rewrite that also refuses inputs `release` accepts today (subtitle tracks,
+CMAF output, video `BlockGroup`s with fields after their `Block`). A size
+bound fixes the exhaustion on `release` without changing what it imports.
+
+- **Confirm first**: port #7234's reproduction,
+  `ignored_payload_does_not_accumulate_under_a_large_metadata_master` (a
+  1 GiB EBML header holding a nearly 1 GiB Void, fed in 1 KiB chunks), onto
+  `release` and show it grows memory there. If it doesn't, report that and
+  stop.
+- **Where it buffers**: `release`'s
+  `rs/moq-mux/src/container/mkv/import.rs:139` builds ebml-iterable's
+  `TagDecoder` to collect the `Ebml`, `Info`, `Tracks`, `TrackEntry`,
+  `Audio`, `Video`, and `BlockGroup` masters whole, and `decode` (`:170`)
+  keeps every byte of an incomplete tag in `self.buffer` until it completes;
+  `SimpleBlock` and ignored binary leaves such as `Void` are held the same
+  way.
+- **The bound**: refuse once the bytes retained for the element in progress
+  exceed a cap, checked in `decode` before appending more. `Segment` and
+  `Cluster` arrive as start and end events and are never held whole, so a
+  large file is unaffected. Do not set ebml-iterable's
+  `max_allowable_tag_size`: it applies to every sized tag including
+  `Segment`, which [moq-dev/moq#7234](https://github.com/moq-dev/moq/pull/7234)
+  (merged) ruled out. Pick the cap from the largest legitimate block `release` can
+  publish (its transport frame limit, if it has one), and name the choice in
+  the PR. The cap applies to every held element, so it must also clear the
+  largest legitimate `Tracks`/`TrackEntry` (CodecPrivate) and `Void`; if one
+  cap can't cover both blocks and metadata, use a cap per element kind, or
+  skip an ignored leaf such as `Void` without holding its bytes.
+- Tests on `release`: the reproduction now fails with the error and
+  bounded memory, a single element just over its cap fails while one just
+  under imports, and an ordinary file larger than the cap still imports.
+- Version bumps stay with a human, per `CONTRIBUTING.md`: this PR bumps
+  nothing.
+
+Public API: none; if refusing needs a new `mkv::Error` variant on
+`release`, report it, since the enum is published. Wire: none.
+
+## Related
+
+- [Backport the relay and auth hardening to release](/quest/m0/backport-release-hardening.md) - other security backports for the same patch release

quest/m0/backport-release-hardening.md

@@ -1,8 +1,8 @@
-# [S] Backport the dot-segment and auth-redirect refusals to release
+# [M] Backport the relay and auth hardening to release
 
 ## Goal
 
-The `release` branch's relay refuses connection paths with `.` or `..` segments before asking the auth server, and `release`'s auth client refuses redirects from the auth server, matching main. The fixes ship in the next patch release a human cuts.
+The `release` branch's relay refuses connection paths with `.` or `..` segments before asking the auth server, and `release`'s auth client refuses redirects from the auth server, matching main. `release`'s relay also serves its HTTP routes with main's response hardening and ops-listener checks, and withdraws a moq-transport advertisement a peer starves of send credit, with the published API unchanged. The fixes ship in the next patch release a human cuts.
 
 ## Plan
 
@@ -13,7 +13,13 @@ Decided 2026-10-30 (maintainer, follow-up planning after the /quest-afk run).
 - Hand-port rather than cherry-pick where `release` lacks main's structure, as [moq-dev/moq#7389](https://github.com/moq-dev/moq/pull/7389) did, with a regression test for each on `release`.
 - Version bumps stay with a human: several backports combine into one patch release, so this PR bumps nothing.
 
-Public API: none. Wire: none.
+Added 2026-10-31 (user, /quest-plan of the follow-ups from the 2026-10-31 /quest-complete run):
+
+- **Relay HTTP hardening:** port [moq-dev/moq#7210](https://github.com/moq-dev/moq/pull/7210) (merged): `/fetch` serves bytes as `application/octet-stream`, `/fetch` and `/announced` send `nosniff` and `private, no-store` (refusals included), and the ops listener refuses any request with `Origin` and any `Host` or URI authority that isn't the accepted socket's destination. `release` has its own `rs/moq-relay/src/fetch.rs` and `internal.rs`; port the behavior and #7210's tests, not its layout.
+- **Withdraw without credit:** port [moq-dev/moq#7414](https://github.com/moq-dev/moq/pull/7414) (merged), keeping `release`'s published API: a withdrawn PUBLISH_NAMESPACE or REQUEST_UPDATE that a peer starves of send credit is reset in both directions instead of pinning the announce loop. Port its zero- and partial-credit withdrawal tests for the drafts `release` speaks.
+- **Landed:** the dot-segment and auth-redirect items above merged into `release` on 2026-11-02 in [moq-dev/moq#7599](https://github.com/moq-dev/moq/pull/7599), which also settles the redirect follow-up that [moq-dev/moq#7298](https://github.com/moq-dev/moq/pull/7298) and [moq-dev/moq#7278](https://github.com/moq-dev/moq/pull/7278) suggested. What remains is the two ports above, then the patch release. [moq-dev/moq#7596](https://github.com/moq-dev/moq/pull/7596) (open) holds this quest's main-side checkpoint.
+
+Public API: none. Wire: none; as on main, a withdrawal resets a partially written request without waiting for peer credit.
 
 ## Related
 

quest/m0/ci/README.md

@@ -163,5 +163,11 @@ The historical samples locate candidates; they are not controlled benchmarks.
 - [Drop main from the publish Environment](/quest/m0/ci/publish-release-only.md) - the maintainer narrows `publish` to `release` and release tags once no job naming it runs as `main`
 - [Binary release publishers run on their tag](/quest/m0/ci/release-tag-publishers.md) - brew, Go and Swift releases stop running through `workflow_run` on main
 - [The queue host keeps the queue's disk](/quest/m0/ci/queue-host-disk.md) - agent sessions can't starve the queue runner of disk, and a crashed runner restarts
+- [The bench comparison builds moq-gst's catalog bench on its base](/quest/m0/ci/bench-base-build.md) - A paired bench comparison that selects `rust/gst/moq-gst/catalog` against `origin/main` builds the base side and reports a comparison, instead of marking it unavailable with "base build failed"
+- [A jq error in the Rust selection fails the run](/quest/m0/ci/check-selection.md) - `just check`'s Rust selection fails the run when one of its jq filters errors, instead of selecting less
+- [Code scanning has no untriaged alert on main](/quest/m0/ci/code-scanning-triage.md) - every open code-scanning alert on `main`'s default branch is either fixed or dismissed with a reason and a comment that names the evidence
+- [The workspace-hack refuses trybuild edges and spares non-media builds](/quest/m0/ci/hakari-followups.md) - `hakari.py` refuses trybuild dev-dependency edges, and non-media Linux test builds stop needing libpipewire and libclang
+- [Pullfrog reviews finish inside their time limit](/quest/m0/ci/pullfrog-timeout.md) - A Pullfrog review of a large PR finishes instead of failing on the action's run limit
+- [Long test runs keep their built binaries](/quest/m0/ci/shared-target.md) - A long `just test interop` or wire-compat run never fails because the binaries it built were removed from the shared Cargo target mid-run, such as by mbx pruning its managed build storage
 - [One nextest pin](/quest/m0/ci/nextest-pin.md) - cargo-nextest's version lives in one place
 - [The flake lane skips hosts that can't map user namespaces](/quest/m0/ci/userns-uid-map.md) - `check flake` skips instead of failing where `/proc/self/uid_map` is unwritable

quest/m0/ci/bench-base-build.md

@@ -0,0 +1,44 @@
+# [S] The bench comparison builds moq-gst's catalog bench on its base
+
+## Goal
+
+A paired bench comparison that selects `rust/gst/moq-gst/catalog` against
+`origin/main` builds the base side and reports a comparison, instead of
+marking it unavailable with "base build failed". Local reviews and gates
+that run `quest` use the build `flake.nix` pins, or say which they ran.
+
+## Plan
+
+Decided 2026-10-31 (user, /quest-plan of the follow-ups from the 2026-10-31 /quest-complete run), from [moq-dev/moq#7347](https://github.com/moq-dev/moq/pull/7347). Milestone: ✅ m0 (user, "all recommended" for quests 1-8).
+
+- **Base build**: #7347's `just ci` bench comparison reported "base build
+  failed" for `rust/gst/moq-gst/catalog` against `origin/main`, from a
+  change that doesn't touch moq-gst. `bench/run.sh:396-405` (at
+  be39188000) builds the base in a detached `git worktree` through
+  `criterion_build_base` (`:330`), and any failure there marks every
+  selected target unavailable without showing why. The bench target
+  (`rs/moq-gst/Cargo.toml:48`, `benches/catalog.rs`) has existed since
+  2026-10-14, so a missing target is not the cause. Check first whether
+  it was the nested-checkout Cargo alias merge Nightly hit: #7347's run
+  predates both [moq-dev/moq#7245](https://github.com/moq-dev/moq/pull/7245),
+  which made those aliases strings, and
+  [moq-dev/moq#7445](https://github.com/moq-dev/moq/pull/7445) (merged),
+  which moved the base worktree out of the checkout to
+  `${TMPDIR:-/tmp}/moq-bench-base.*` (`checkout_base`, `:226`). Nightly's
+  baseline has built since
+  ([moq-dev/moq#7592](https://github.com/moq-dev/moq/pull/7592)). If a
+  comparison on current main builds the base, only the logging below is
+  left. Otherwise look for what the fresh worktree lacks that the checkout
+  has (GStreamer's build environment, a generated or untracked input,
+  submodules), reproducing with the bench command #7347's `just ci` ran,
+  and fix the cause. Either way, have the base build log its error into
+  the run's output.
+- **quest version**: in the same run, the `quest` on the host's PATH was
+  not the build `flake.nix` pinned (then `github:moq-dev/quest/1ef2ca7`,
+  `5e66075` at be39188000, served by the dev shell); the review was rerun
+  with the pinned one. Check which scripts or recipes call `quest` (the
+  gate and `quest review` paths) and make them resolve the pinned build,
+  or fail with a message naming both versions when they differ. Settle on
+  whichever is simpler; the quest binary's own behavior is out of scope.
+
+Public API: none. Wire: none.

quest/m0/ci/check-selection.md

@@ -0,0 +1,36 @@
+# [XS] A jq error in the Rust selection fails the run
+
+## Goal
+
+`just check`'s Rust selection fails the run when one of its jq filters
+errors, instead of logging the error and selecting less.
+
+## Plan
+
+Decided 2026-10-31 (user, /quest-plan of the follow-ups from the 2026-10-31 /quest-complete run), from [moq-dev/moq#7303](https://github.com/moq-dev/moq/pull/7303), [moq-dev/moq#7280](https://github.com/moq-dev/moq/pull/7280), [moq-dev/moq#7304](https://github.com/moq-dev/moq/pull/7304), and [moq-dev/moq#6946](https://github.com/moq-dev/moq/pull/6946). Milestone: ✅ m0 (user, "all recommended" for quests 1-8).
+
+The other two parts of the original quest are gone from main:
+[moq-dev/moq#7473](https://github.com/moq-dev/moq/pull/7473) (merged) moved
+`just rs send-depth` out of the gate into Nightly's Tests matrix
+(`.github/workflows/nightly.yml:355`), which runs it whatever changed, and
+[moq-dev/moq#7475](https://github.com/moq-dev/moq/pull/7475) (merged)
+deleted `test/wasm/uniffi/` and `wasm-baseline` with the rest of WASM.
+
+- **The noise**: #7303's `just check` logged `jq: error ... null cannot be
+  matched` without failing. That message matches what
+  `sh/rs/uring.test.py` (run by `.github/justfile:72`) printed four times
+  from a cargo-metadata fixture without `workspace_root` or `targets`;
+  [moq-dev/moq#7621](https://github.com/moq-dev/moq/pull/7621) (merged)
+  completed the fixture and asserts empty stderr. Confirm a `just check` on
+  current main logs no jq error; if one remains, find and fix its filter.
+- **Failing the run**: `sh/rs/select.sh:9` sets `set -euo pipefail`, but
+  `select_packages` runs as `packages=$(select_packages)` (`:112`, at
+  be39188000), and bash clears `-e` inside a command substitution, so a jq
+  failure in its filters (`:38`, `:64`, `:77`, `:104`) lets the function
+  carry on and print a smaller selection. #7621's "before" run shows it:
+  io_uring selection passed with four jq errors. Make the failure propagate
+  (`shopt -s inherit_errexit`, or checking each `jq` status), check
+  `sh/rs/c-tests.sh:36` for the same pattern, and add a
+  `sh/rs/select.test.py` case where malformed metadata fails selection.
+
+Public API: none. Wire: none.

quest/m0/ci/code-scanning-triage.md

@@ -0,0 +1,51 @@
+# [XS] Code scanning has no untriaged alert on main
+
+## Goal
+
+Every open code-scanning alert on `main`'s default branch is either fixed
+or dismissed with a reason and a comment that names the evidence:
+the `rust/cleartext-logging` alerts
+[58](https://github.com/moq-dev/moq/security/code-scanning/58),
+[59](https://github.com/moq-dev/moq/security/code-scanning/59), and
+[61](https://github.com/moq-dev/moq/security/code-scanning/61), and the
+`rust/hard-coded-cryptographic-value` alerts
+[35](https://github.com/moq-dev/moq/security/code-scanning/35),
+[36](https://github.com/moq-dev/moq/security/code-scanning/36), and
+[64](https://github.com/moq-dev/moq/security/code-scanning/64).
+
+## Plan
+
+Decided 2026-10-31 (user, /quest-plan of the follow-ups from the 2026-10-31 /quest-complete run), from [moq-dev/moq#7362](https://github.com/moq-dev/moq/pull/7362) and [moq-dev/moq#7027](https://github.com/moq-dev/moq/pull/7027). CodeQL: ✅ Dismiss + triage quest. Milestone: ✅ m0 (user: "use recommended for any CI/flakes").
+
+Alerts [67](https://github.com/moq-dev/moq/security/code-scanning/67) and
+[68](https://github.com/moq-dev/moq/security/code-scanning/68) were
+dismissed on 2026-10-31 as "used in tests" (test assertion messages in
+`rs/moq-relay/src/web.rs`'s `mod tests`); follow that precedent, and the
+earlier dismissals 25 to 34. Open alerts, as of 2026-10-31 on `38566f5a84`:
+
+- **58** `rs/moq-auth/src/client.rs:1150` and **61**
+  `rs/moq-rtc/src/lib.rs:434`: both are inside `mod tests` (from
+  `client.rs:497` and `lib.rs:74`). The "secret" is the literal strings
+  `jwt`, `secret`, and `user:pass` in an assertion that proves those never
+  appear in errors or logs. Dismiss as "used in tests".
+- **59** `rs/moq-tokio/src/server.rs:1416`: production code. CodeQL traces
+  `read_certs(...)` / `certs.load_certs(...)` (`rs/moq-tokio/src/tls.rs:211`,
+  `:1364`, `:1546`) into a log. Certificates are public, but confirm the
+  flow cannot carry the private key or its path's contents (for example
+  through a TLS load error's message); fix the log if it can, otherwise
+  dismiss as a false positive with that reasoning. #7027 already judged
+  the `server.rs` cert alert a false positive.
+- **35**, **36** `rs/moq-tokio/src/mdns.rs:778-779`: the test keys
+  `KEY_A`/`KEY_B` inside `mod tests` (from `:775`). Dismiss as "used in
+  tests".
+- **64** `rs/moq-quic/src/varint.rs:142`: the zeroed scratch buffer a
+  varint decodes into, not a key. #7027 judged it a false positive; dismiss
+  as one.
+
+Dismiss through `gh api -X PATCH repos/moq-dev/moq/code-scanning/alerts/<n>`
+with `state=dismissed`, `dismissed_reason` (`false positive` or
+`used in tests`), and `dismissed_comment`, the comment ending in the model
+line. If a fix is needed, it lands in this quest's PR; a dismissal-only finish
+needs no code change, so the PR only deletes this quest.
+
+Public API: none. Wire: none.