quest: unblock m0 and m1 (2026-11-05)

quest/m0/ci/README.md

@@ -180,6 +180,7 @@ The historical samples locate candidates; they are not controlled benchmarks.
 - [Verify the Nix runtime cache](/quest/m0/ci/nix-cache-verify.md) - hosted Cache uploads `main`'s relay and CLI, and Smoke's nix channel substitutes them
 - [Record hosted cargo-hakari evidence](/quest/m0/ci/hakari.md) - compare scheduled macOS and Windows cache hits and estimated compiler work saved before and after the workspace-hack
 - [Drop main from the publish Environment](/quest/m0/ci/publish-release-only.md) - the maintainer narrows `publish` to `release` and release tags once no job naming it runs as `main`
+- [Release tags push to nix.moq.dev, and Cachix stops taking writes](/quest/m0/ci/cachix-retire.md) - backport `release-nix.yml` and its Just module to `release`, drop `cachix.yml`, prove a tag substitutes from nix.moq.dev, then revoke the Cachix token (the cache stays for old tags)
 - [Measure the Linux cache effect of native media exclusions](/quest/m0/ci/hakari-followups.md) - scheduled Linux jobs measure cache reuse after unrelated tests stop compiling PipeWire and libclang
 - [A release merge opens no stale release PR](/quest/m0/ci/release-pr-after-release.md) - `just rs release` publishes before it proposes, so a merged release isn't re-proposed
 - [Build two queue entries at once if it helps](/quest/m0/ci/queue-concurrency.md) - a measured trial of `maximumEntriesToBuild: 2` against the serial lane's burst latency

quest/m0/ci/cachix-retire.md

@@ -0,0 +1,71 @@
+# [S] Release tags push to nix.moq.dev, and Cachix stops taking writes
+
+## Goal
+
+Tags cut from `release` push their Nix packages to nix.moq.dev through
+`release-nix.yml`, and a clean machine substitutes a tagged package from
+there. `release` no longer runs `cachix.yml`, and `CACHIX_AUTH_TOKEN` is
+deleted. Both nix.moq.dev bucket sizes hold under the CI bucket's 30-day
+expiry.
+
+## Plan
+
+Decided 2026-11-05 (maintainer, /quest-unblock): ✅ backport now and retire
+Cachix after the first `release` tag that proves nix.moq.dev, rather than
+waiting for the m2 cut to merge `main` into `release`. Not chosen: retiring it
+at the m2 cut with `CACHIX_AUTH_TOKEN` copied into `publish` meanwhile;
+retiring it at the m2 cut with the token left at repository scope. This
+absorbs [moq-dev/moq#7662](https://github.com/moq-dev/moq/pull/7662)'s m2
+"Release tags substitute from nix.moq.dev" quest, which it had split out
+behind the cut; the backport removes its only reason to wait.
+
+Decided 2026-11-05 (maintainer, /quest-unblock): ✅ revoke the token but keep
+the `kixelated` cache read-only. Older tags' flakes list only
+`kixelated.cachix.org`, so deleting the cache would make `nix run` on them
+build from source. Not chosen: copying the retained release paths to
+nix.moq.dev first (old flakes still only name Cachix); deleting the cache and
+accepting source builds.
+
+Today tags run `release`'s copies of the workflows. `release` still has
+`cachix.yml` and `cache.yml` and no `release-nix.yml`, so every tag so far,
+through `moq-relay-v0.17.12` and `moq-cli-v0.14.12` on 2026-11-03, pushed to
+Cachix and never reached nix.moq.dev. `cachix.yml` names `publish`, which does
+not hold `CACHIX_AUTH_TOKEN`, so it reads the repository copy. That copy is
+what [Keep pull-request CI read-only](/quest/m0/ci/read-only-secrets.md) would
+otherwise have to move.
+
+- Backport to `release`, in one PR the maintainer merges (agents never merge
+  into `release`): `main`'s `release-nix.yml`, the `infra/nix` Just module and
+  its entry in `infra/justfile` (`release` has neither, so `just infra nix
+  push` would fail), any local action it uses, the deletion of
+  `cachix.yml`, and `main`'s `cache.yml` in place of `release`'s, whose
+  dispatch-only `warm` job still runs `cachix push kixelated` with
+  `CACHIX_AUTH_TOKEN` and would fail once the token is gone. Match `release`'s own tag patterns (it still cuts `libmoq-v*`
+  where `main` cuts `moq-c-v*`) and the flake attributes `release` builds; the
+  `cache-write` Environment must admit those tags.
+- On the first `moq-relay-v*` or `moq-cli-v*` tag after the backport, record
+  its `release-nix.yml` pushes from all three legs, then
+  `nix run github:moq-dev/moq/<tag>#moq-relay --accept-flake-config`
+  substituting on a clean machine (`#moq` for a CLI tag), such as a fresh
+  container with only Nix installed.
+- Then the maintainer deletes `CACHIX_AUTH_TOKEN` (a repository secret, so
+  `Maintainer:`), and docs stop naming Cachix as a current cache.
+
+Public API: none. Wire: none.
+
+## Waiting
+
+- Maintainer: record both bucket sizes no earlier than 2026-11-24, a month
+  after the first `cache.yml` push to `nix-ci-moq-dev` on 2026-10-24, against
+  the 30-day expiry in `infra/nix/lifecycle.json`. Sizes need a
+  `wrangler login` to the Cloudflare account, which agents lack. A path
+  expires 30 days after upload even while CI still reads it, and `nix copy`
+  re-uploads it on the next merge. Look for Nightly jobs that fell back to
+  source builds once paths expired (`building '/nix/store/...uniffi-bindgen`
+  in a job log), and refresh on a schedule or switch to a closure-aware
+  collector (niks3) if they recur.
+
+## Related
+
+- [Verify the Nix runtime cache](/quest/m0/ci/nix-cache-verify.md) - the same cache's `main` evidence
+- [Drop main from the publish Environment](/quest/m0/ci/publish-release-only.md) - the other workflow backport to `release` decided in the 2026-11-05 audit

quest/m0/ci/mbx-r2-verify.md

@@ -78,7 +78,10 @@ compilation is "not looked up".
   [Windows job](https://github.com/moq-dev/moq/actions/runs/42050683248/job/127326015447)
   of run 42050683248 set up mbx 1.29.2, and its workspace build, against a
   manifest of 2,604 predictions, reported 846 hits, 224 misses, 168 not looked
-  up and 1,019 prefetched. Windows inheritance pays.
+  up and 1,019 prefetched. Its `Cargo.lock` differed from the previous
+  scheduled run's, so those hits point to an inherited manifest, but the
+  summary does not name the manifest identity it looked up; record that
+  identity from a later Windows job before relying on inheritance.
 - macOS: on 2026-10-28 the build did inherit, prefetching 732 predictions,
   yet hit only 13, with 1565 compilations not looked up. The install order is
   not the cause. Find out why the inherited predictions mostly miss, for

quest/m0/ci/nix-cache-verify.md

@@ -30,10 +30,13 @@ credentials.
 Decided 2026-11-05 (maintainer, /quest-audit,
 [moq-dev/moq#7975](https://github.com/moq-dev/moq/pull/7975)): ✅ keep only
 this `main` evidence in m0 and move the release-tag proof, Cachix retirement,
-and bucket sizes to
-[Release tags substitute from nix.moq.dev](/quest/m2/release-nix-cache.md)
-behind the release cut. Not chosen: moving the whole quest to m2; merging
-`main` into `release` now.
+and bucket sizes to an m2 quest behind the release cut. Not chosen: moving the
+whole quest to m2; merging `main` into `release` now.
+
+Superseded the same day (maintainer, /quest-unblock): the release-tag proof,
+Cachix retirement, and bucket sizes moved to
+[Release tags push to nix.moq.dev](/quest/m0/ci/cachix-retire.md), which
+backports `release-nix.yml` to `release` now instead of waiting for the cut.
 
 Use the scheduled and push runs; never dispatch Nightly for this evidence.
 

quest/m0/ci/publish-release-only.md

@@ -23,10 +23,10 @@ The same PR dropped Cachix from `main` (decided 2026-11-02): Smoke's nix
 channel substitutes from `nix.moq.dev` and no longer pushes, so it names no
 Environment and `CACHIX_AUTH_TOKEN` needs no new home. The alternatives were
 moving the token into `cache-write`, or deleting Cachix everywhere now with a
-`release` backport. `release` keeps its Cachix workflows until the next cut
-merges `main` into it, and
-[Release tags substitute from nix.moq.dev](/quest/m2/release-nix-cache.md) deletes the Cachix
-cache and token once a release tag substitutes from `nix.moq.dev`.
+`release` backport. Changed 2026-11-05 (maintainer, /quest-unblock):
+[Release tags push to nix.moq.dev](/quest/m0/ci/cachix-retire.md) backports
+`release-nix.yml` and drops `cachix.yml` on `release` now, and deletes
+`CACHIX_AUTH_TOKEN` once a release tag substitutes from `nix.moq.dev`.
 
 Decided 2026-11-05 (maintainer, /quest-audit): `publish` still admits
 `main`, so this does not wait for the next cut.
@@ -44,8 +44,11 @@ What remains, in order:
 
 1. Open the backport PR against `release` (agent work).
 2. Once it merges, the maintainer drops `main` from `publish`'s deployment
-   policy and removes `DISCORD_WEBHOOK` and `CACHIX_AUTH_TOKEN` from
-   `publish`. Environment settings need the maintainer's admin access.
+   policy. Environment settings need the maintainer's admin access.
+   `publish` holds neither `DISCORD_WEBHOOK` (it lives in `alert`) nor
+   `CACHIX_AUTH_TOKEN` (a repository secret that
+   [Release tags push to nix.moq.dev](/quest/m0/ci/cachix-retire.md) revokes),
+   so there is nothing to remove from it.
 
 Decided 2026-11-04 (maintainer, /quest-unblock): ✅ cut the combined patch
 release on `release` soon, once [moq-dev/moq#7596](https://github.com/moq-dev/moq/pull/7596)'s

quest/m0/test-flakes-2/p2p-data-channel.md

@@ -19,8 +19,10 @@ channel error just before:
 ERROR:third_party/blink/renderer/modules/peerconnection/rtc_data_channel.cc:867] Send failedINVALID_STATE
 ```
 
-A send on a data channel that was not open (or already closing) failed, and
-the transfer then stalled instead of failing. It timed out once before, in
+The log names neither the channel's sender nor its timing against the
+stall, so this is a correlation to investigate, not a diagnosis: a send on a
+data channel that was not open (or already closing) failed, and the transfer
+stalled instead of failing. It timed out once before, in
 [41668668824](https://github.com/moq-dev/moq/actions/runs/41668668824), and
 passed locally then.
 

quest/m1/README.md

@@ -174,8 +174,6 @@ quests that require them.
 - [TS fidelity and recovery](/quest/m1/ts-reliability/README.md) - both modes have explicit profiles, automated validation, loss tests, and a dedicated guide
 - [WebGPU on Safari](/quest/m1/webgpu-safari.md) - the WebGPU renderer is verified on Safari 26 for macOS and iOS
 - [Remove the moq-e2ee stub](/quest/m1/moq-e2ee-remove.md) - `rs/moq-e2ee` leaves the workspace and release config now that its final release points to moq-crypto
-- [crates.io trusts the workflow](/quest/m1/crates-trusted-publisher.md) - maintainer action: every published crate gets a trusted publisher for `release-rs.yml`
-- [Rust releases publish through OIDC](/quest/m1/release-rs-oidc.md) - release-plz publishes with trusted publishing and `CARGO_REGISTRY_TOKEN` is revoked
 - [Main is no slower than release](/quest/m1/release-perf/README.md) - every benchmark where main is slower than release is fixed or accepted with a reason, checked by a final paired run before the cut
 - [Calibrate the paired nightly benchmarks](/quest/m1/bench-ci.md) - A/A and deliberately slowed Nightly runs set the paired comparison's threshold, so its regression alerts can be trusted
 - [moq-json's table/deltas bench measures the same work every iteration](/quest/m1/bench-json-deltas.md) - the `table/deltas/1%` cases stop flipping between snapshot and delta timings, so their trend history is usable

quest/m1/audio-jitter-target/native-stretch.md

@@ -88,39 +88,19 @@ nightlies on `main` read 160 to 280 ms. So the ceiling stays as it is,
 as `test/audio-quality/budgets.json`'s note budgets startup holds as measured,
 until the seven-nightly calibration below.
 
+Listened 2026-11-05 (maintainer, /quest-unblock): the stretch is inaudible
+in all four runs on `kixtop` at `main` `7e621623a8`, two minutes each of
+`say` speech from `LICENSE-APACHE` over Opus 128 kb/s, the relay at
+`test/audio-quality/relay.toml`, and the shaper's `bursty` profile, seed 7.
+The player's metrics confirm the stretch was active: media per render second
+was 1.0020 (fast, direct) and 1.0018 (fast, shaped) against a 1.002
+publisher, and 0.9981 and 0.9979 against 0.998; the shaped runs raised the
+target delay from 120 to 260 ms. Each direct run stalled once at startup,
+none in steady state. This settles the perceptual check; the calibration and
+bench waits below remain.
+
 ## Waiting
 
-- Maintainer: listen for the stretch on `kixtop` and record whether it is
-  audible. Recommend this check before claiming the perceptual goal;
-  automated amplitude tests cannot decide it.
-  Run it in `~/work/moq` on `kixtop`, with its speakers or headphones as
-  the default output, on `main`, where
-  [moq-dev/moq#7856](https://github.com/moq-dev/moq/pull/7856) landed. The
-  source is
-  macOS's `say` voice reading `LICENSE-APACHE`, about ten minutes of
-  continuous speech, so nothing is downloaded (an archive's speech file
-  returned 403):
-
-  ```bash
-  nix develop
-  mkdir -p .tmp/listen && say -v Samantha -o .tmp/listen/speech.aiff -f LICENSE-APACHE
-  # Terminal 1: the relay, and a shaper in front of it replaying the audio-quality `bursty` path.
-  cargo run -p moq-relay -- test/audio-quality/relay.toml &
-  cargo run -p moq-shaper -- --listen 127.0.0.1:4500 --target 127.0.0.1:4443 --seed 7 --profile bursty
-  # Terminal 2: publish 2 ms/s fast (accelerate); rerun with -readrate 0.998 for 2 ms/s slow (preemptive expand).
-  ffmpeg -hide_banner -v error -readrate 1.002 -stream_loop -1 -i .tmp/listen/speech.aiff \
-    -ac 2 -c:a libopus -b:a 128k -f mp4 -movflags cmaf+separate_moof+delay_moov+skip_trailer -frag_duration 1000 - |
-    cargo run -p moq-cli --features play -- --connect http://127.0.0.1:4443 --broadcast speech.hang import fmp4
-  # Terminal 3: two minutes direct (drift alone), then two through the shaper (the measured expansions).
-  cargo run -p moq-cli --features play -- --connect http://127.0.0.1:4443 --broadcast speech.hang \
-    play --video off --metrics .tmp/listen/drift.ndjson
-  cargo run -p moq-cli --features play -- --connect https://127.0.0.1:4500 \
-    --connect-tls-fingerprint "$(curl -s http://127.0.0.1:4443/certificate.sha256)" \
-    --broadcast speech.hang play --video off --metrics .tmp/listen/bursty.ndjson
-  ```
-
-  Record, for each of the four runs (fast/slow × direct/shaped), whether the
-  stretching is audible, and attach the `.ndjson` files.
 - moq-dev/moq: collect seven scheduled native nightly rows for this
   implementation, then apply the existing calibration rule. Keep the
   current provisional budgets until those artifacts exist.

quest/m1/bench-publish.md

@@ -50,9 +50,9 @@ crate, like CONTRIBUTING's bench-only backport. Otherwise skip it, say so in
 the PR, and moq-bench publishes at the cut.
 
 The first publish goes out by token, so add moq-bench to the
-[crates.io trusted publisher](/quest/m1/crates-trusted-publisher.md)
+[crates.io trusted publisher](/quest/m2/crates-trusted-publisher.md)
 `Waiting` list (done in this planning PR).
 
 ## Related
 
-- [crates.io trusts the workflow](/quest/m1/crates-trusted-publisher.md) - moq-bench needs a trusted publisher after its first publish
+- [crates.io trusts the workflow](/quest/m2/crates-trusted-publisher.md) - moq-bench needs a trusted publisher after its first publish

quest/m1/cluster-routing/routes/README.md

@@ -158,7 +158,9 @@ the bullets below are the contract it carries.
   losing one of two uplinks under one key
   (`scoped_delivery_through_two_uplinks_reaches_one_key`).
 - Decided 2026-11-04 (maintainer): a scoped peer's routing identities are
-  keyed by the route key the peer proves, from a shared key file
+  keyed by the route key the peer proves, so relays configured with the same
+  key file fail over as one; a scoped peer that proves no key, such as one on
+  qmux, gets a per-session key
   ([session integration](/quest/m1/cluster-routing/routes/session.md),
   [Scoped peers prove a route key](/quest/m1/cluster-routing/routes/proof.md)).
   The router takes the key from the caller (`Scope::qualify`).

quest/m1/moq-e2ee-remove.md

@@ -4,15 +4,23 @@
 
 `rs/moq-e2ee` leaves the workspace, along with any release or version config
 that names it, so release-plz stops tracking a crate whose final release is
-out. moq-e2ee 0.0.21, the final no-code release pointing users to moq-crypto,
-is on crates.io (published 2026-11-03).
+out. moq-e2ee 0.0.22, the final no-code release pointing users to
+moq-crypto, is on crates.io.
 
 ## Plan
 
 Decided 2026-11-05 (maintainer, /quest-audit): ✅ retire the stub before
-[Rust releases publish through OIDC](/quest/m1/release-rs-oidc.md), so the
+[Rust releases publish through OIDC](/quest/m2/release-rs-oidc.md), so the
 crate never needs a trusted publisher.
 
+Published 2026-11-05 (maintainer, /quest-unblock, by an agent at the
+maintainer's request): moq-e2ee 0.0.22 from `main`'s stub, with only the
+version raised from 0.0.11 locally, since 0.0.21 on crates.io (2026-11-03) and
+on `release` is still the full implementation. A 0.0.x caret requirement never
+resolves to the next patch, so no dependent upgrades into the stub
+unasked. Not chosen: publishing it through the m2 cut; deleting the crate
+with no final release.
+
 - Delete `rs/moq-e2ee` (the workspace's `rs/*` glob picks it up) and its
   `Cargo.lock` entry.
 - Search release-plz, `version.json`, workflows, and docs for `moq-e2ee` and

quest/m2/README.md

@@ -35,9 +35,10 @@ lite-07; bitrate enforcement is not part of this release.
 - [JS announced coalescing](/quest/m2/js-announced-coalesce.md) - `@moq/net`'s `Announced` keeps one pending event per path, like Rust
 - [An audio track's final flush joins its open group](/quest/m2/audio-flush-group.md) - a zero-`delay.max` subscriber gets the tail, not `Old`
 - [Release execution](/quest/m2/release/README.md) - publication, installed-artifact proof, cleanup, and downstream adoption after m1
-- [Release tags substitute from nix.moq.dev](/quest/m2/release-nix-cache.md) - the first tag after the cut substitutes on a clean machine, bucket sizes hold, and Cachix is retired
 - [Release pull requests read the R2 Rust cache](/quest/m2/mbx-r2-release-cache.md) - a release PR's `Check the cache` step reports effective read-only once the cut brings the cache to `release`
 - [Binary release publishers run on their tag](/quest/m2/release-tag-publishers.md) - brew, Go and Swift releases stop running through `workflow_run` on main, once the cut brings the workflows to `release`
+- [crates.io trusts the workflow](/quest/m2/crates-trusted-publisher.md) - maintainer action: the crates the cut first-publishes by token get a trusted publisher for `release-rs.yml`
+- [Rust releases publish through OIDC](/quest/m2/release-rs-oidc.md) - release-plz publishes with trusted publishing and `CARGO_REGISTRY_TOKEN` is revoked
 - [One policy for oversized container metadata](/quest/m2/import-metadata-policy.md) - fMP4 and MKV refuse or stream huge metadata by one documented rule
 - [Wire fuzz coverage](/quest/m2/wire-fuzz-coverage.md) - the cmsg walks in moq-sock and moq-uring have invariant fuzz targets, and the unsafe peer input reaches runs under Miri
 - [VA-API renderer tests](/quest/m2/vaapi-render-tests.md) - the VA-API renderer, decode, and transcode tests run in `just rs gpu` on AMD and Intel and fail instead of skipping, and hosted CI reports them ignored