kixelated · Nov 6, 2026 · Nov 6, 2026 · Nov 6, 2026 · Nov 6, 2026
diff --git a/quest/m2/cut-gate/README.md b/quest/m2/cut-gate/README.md
@@ -22,7 +22,7 @@ block that cut forever. The release cut's PR re-creates it at this path while
 it shifts the milestones, after removing this path from every `Required`. The
 new gate keeps this Goal and this paragraph, gets a fresh "main is no slower
 than release" child with its Goal and no measurements yet, and takes the
-[vendor sync](/quest/m2/cut-gate/vendor-sync/README.md) questline that this
+[vendor sync](/quest/m3/vendor-sync/README.md) questline that this
 run re-created in m3. The pre-cut audit is a one-time child and does not
 recur. Only `/quest-delete` ends the recurrence.
 
@@ -33,6 +33,5 @@ stays in m1 until its claim merges, so this gate lists it as a blocker; the
 ## Required
 
 - [Pre-cut audit findings](/quest/m2/cut-gate/cut-audit/README.md) - fix the crashes, hostile-input costs, and correctness bugs the 2026-10-24 audit of main found
-- [Vendored code has every upstream fix it needs](/quest/m2/cut-gate/vendor-sync/README.md) - quinn, libv4l-rs, nvidia-video-codec-sdk, rust-media-libs, cros-codecs, and UniFFI generator fixes are ported or planned, once per release cycle
 - [Main is no slower than release](/quest/m1/release-perf/README.md) - every benchmark where main is slower than release is fixed or accepted with a reason (held in m1 by an open claim)
 - [moq-c at parity](/quest/m2/cut-gate/c/README.md) - the hand-written `moq-c` ships at the cut with every binding feature moq-ffi gains
diff --git a/quest/m3/README.md b/quest/m3/README.md
@@ -43,6 +43,7 @@ federation) land.
 - [JS announced coalescing](/quest/m3/js-announced-coalesce.md) - `@moq/net`'s `Announced` keeps one pending event per path, like Rust
 - [An audio track's final flush joins its open group](/quest/m3/audio-flush-group.md) - a zero-`delay.max` subscriber gets the tail, not `Old`
 - [Release execution](/quest/m3/release/README.md) - publication, installed-artifact proof, cleanup, and downstream adoption after m2
+- [Vendored code has every upstream fix it needs](/quest/m3/vendor-sync/README.md) - the next cycle's vendor sync, which the cut moves under the m2 cut gate
 - [Release pull requests read the R2 Rust cache](/quest/m3/mbx-r2-release-cache.md) - after the cut brings the platform Rust cache to `release`
 - [Binary release publishers run on their tag](/quest/m3/release-tag-publishers.md) - after the cut brings the workflows to `release`
 - [crates.io trusts the workflow](/quest/m3/crates-trusted-publisher.md) - maintainer action: the crates the cut first-publishes by token get a trusted publisher for `release-rs.yml`

diff --git a/quest/m3/audit-deps.md b/quest/m3/audit-deps.md
@@ -221,7 +221,7 @@ standalone build, not incremental workspace savings.
 - The QUIC/UDP, RTMP, V4L2, NVIDIA, VA-API, UniFFI and LibAV forks all have
   current transport, gateway, device, binding or codec consumers. Their
   removal would drop behavior or recreate nontrivial platform code;
-  upstream porting stays with [vendor-sync](/quest/m2/cut-gate/vendor-sync/README.md).
+  upstream porting stays with [vendor-sync](/quest/m3/vendor-sync/README.md).
   OpenH264 and device integrations remain opt-in where already gated.
 - Error/primitive derives remain shared infrastructure: `thiserror` is the
   workspace convention; `derive_more` handles existing enum conversions,

diff --git a/quest/m3/ffi-exporter.md b/quest/m3/ffi-exporter.md
@@ -21,7 +21,7 @@ crates.io would commit permanent names to code already slated for
 retirement, and switching moq to it would be churn on the way to the
 exporter. Until the switch, moq keeps building from its pinned
 `kixelated/uniffi-*` forks, checked each release cycle by
-[the vendor sync](/quest/m2/cut-gate/vendor-sync/README.md).
+[the vendor sync](/quest/m3/vendor-sync/README.md).
 Not chosen: publish the fork and switch to it first; decide later.
 
 Carried over from the fork plan, where they still apply to the exporter's

diff --git a/quest/m3/release/cut.md b/quest/m3/release/cut.md
@@ -46,7 +46,7 @@ and adoption quests move to m0, m3's other quests split by kind into m1
 (additive) and m2 (breaking), m4's move to m3, m5 stays, and every link to a
 moved path is rewritten. A recurring cut-gate child that its last run
 re-created in m3, such as the [vendor
-sync](/quest/m2/cut-gate/vendor-sync/README.md), moves under the re-created
+sync](/quest/m3/vendor-sync/README.md), moves under the re-created
 gate instead. That PR also removes this path from every `Required`, which
 releases the audits waiting on it. It then re-creates the [cut
 gate](/quest/m2/cut-gate/README.md) in m2 as that gate's Plan describes, and

diff --git a/quest/m2/cut-gate/vendor-sync/README.md → quest/m3/vendor-sync/README.md b/quest/m2/cut-gate/vendor-sync/README.md → quest/m3/vendor-sync/README.md
@@ -1,4 +1,4 @@
-# [M] Vendored code has every upstream fix it needs
+# Vendored code has every upstream fix it needs
 
 ## Goal
 
@@ -33,7 +33,8 @@ This README's own work, once every child has merged:
 
 1. Scan the tree for code vendored since the last run: new crates or modules
    whose README, Cargo description, or module doc says forked, vendored, or
-   ported from an upstream, and any new `git` dependency or flake input
+   ported from an upstream, any `LICENSE`, `PATENTS`, or `Copyright` notice
+   carried from another project, and any new `git` dependency or flake input
    pointing at a fork. Each one gets a child in the next run, starting from its
    vendored commit. Code whose upstream is gone or frozen (moq-tokio's
    `quic::web`, from moq-dev/noq) is listed in the README it lives in and
@@ -51,45 +52,32 @@ This README's own work, once every child has merged:
 
 Only `/quest-delete` ends the recurrence.
 
-UniFFI recurrence baseline, checked 2026-11-02: all four upstream default
-branches were checked, and all four public advisory lists were empty. Carry
-these checked heads into the next child:
-
-| Upstream | Head checked |
-|---|---|
-| [mozilla/uniffi-rs](https://github.com/mozilla/uniffi-rs) | [`ef9625b6`](https://github.com/mozilla/uniffi-rs/commit/ef9625b68dd51207f55f024a27649e58edb52b09) |
-| [NordSecurity/uniffi-bindgen-go](https://github.com/NordSecurity/uniffi-bindgen-go) | [`0b7fb4ce`](https://github.com/NordSecurity/uniffi-bindgen-go/commit/0b7fb4ceef12021bd7f790cc516fa9133e001813) |
-| [Uniffi-Dart/uniffi-dart](https://github.com/Uniffi-Dart/uniffi-dart) | [`e644a4ad`](https://github.com/Uniffi-Dart/uniffi-dart/commit/e644a4ad980f72697aba211fd30cb4fbd8fc7324) |
-| [livekit/uniffi-bindgen-cpp](https://github.com/livekit/uniffi-bindgen-cpp) | [`20bef754`](https://github.com/livekit/uniffi-bindgen-cpp/commit/20bef754391023df147267482513c35120dee343) |
-
-MoQ exports no foreign-implementable traits, custom types, dollar-bearing
-defaults, or recursive enum graphs. Recheck these uses before importing the
-related upstream fixes. Upstream's parser, JNI backend, mutable bytes, and
-library-mode removal are redesigns outside this sync. Before changing Dart
-fork CI, read its [coverage record](https://github.com/kixelated/uniffi-dart/blob/moq-0.32/README.md#fork-ci-coverage).
-Until the exporter switch, mirror any generator fixes into rust2's maintenance
-fork too and add them to the exporter quest's carried-over list, so the new
-generators retain them. rust2's fork is maintenance-only since 2026-11-02.
-Drop the UniFFI child once
-[the exporter switch](/quest/m3/ffi-exporter.md) lands.
+The 2026-11-05 scan found two new upstreams, each now a child: WebRTC
+(moq-congestion's GoogCC and moq-audio's NetEq time stretch) and SCReAMv2
+(moq-congestion's `scream`). The NetEq and SCReAMv2 ports recorded no upstream
+commit, so their first runs establish one. moq-congestion's Cubic came from
+quinn and stays with the quinn child.
 
 Out of scope: forks moq no longer consumes (moq-dev/quiche, moq-dev/noq,
-kixelated/cros-codecs, kixelated/openh264-rs, kixelated/fflate) and the
+kixelated/cros-codecs, kixelated/openh264-rs, kixelated/fflate, and
+kixelated/goog_cc, now in-tree as moq-congestion's `gcc`), the
 `@kixelated/libavjs-webcodecs-polyfill` npm fork js/hang uses (maintainer,
-2026-10-30: its upstream has not changed since 2025-07).
+2026-10-30: its upstream has not changed since 2025-07), and `@moq/libav`,
+which builds pinned upstream libav.js, ffmpeg, and opus releases unmodified.
 
 Public API: none expected; a ported fix that changes one says so. Wire: QUIC
 behavior follows quinn's fixes.
 
-VAAPI's completed cycle adopted crates.io `moq-vaapi 0.1.1` after
-[the source fix](https://github.com/moq-dev/vaapi/pull/5) and
-[read-only CI](https://github.com/moq-dev/vaapi/pull/6) merged. When re-creating
-the next cycle, always include moq-dev/vaapi even though it is a crates.io
-dependency outside this tree. Restore its Goal of auditing both ChromeOS
-upstreams and publishing/adopting any needed fixes. Carry checked heads and
-dispositions from [VAAPI's Upstream audit](https://github.com/moq-dev/vaapi/blob/v0.1.1/README.md#upstream),
-which records cros-libva `59384456ac2ae78c0c3e5515f41ef1efd9b802cf` and
-cros-codecs `a050c6cde530e563197ee9e3e72ab01f48a0c41f`.
+## Required
+
+- [moq-quic has every quinn fix it needs](/quest/m3/vendor-sync/quinn.md) - moq-quic, moq-sock's `udp`, moq-tokio's driver, and moq-congestion's Cubic and BBR3 carry quinn's fixes
+- [The WebRTC ports have every upstream fix they need](/quest/m3/vendor-sync/webrtc.md) - moq-congestion's GoogCC and moq-audio's NetEq time stretch follow WebRTC's fixes
+- [moq-congestion's SCReAMv2 follows its draft and reference](/quest/m3/vendor-sync/scream.md) - draft revisions and Ericsson's reference fixes are ported or ruled out
+- [moq-rtmp's rml has every upstream fix it needs](/quest/m3/vendor-sync/rml.md) - rust-media-libs fixes to rml_rtmp and rml_amf0 are ported or ruled out
+- [moq-v4l has every libv4l-rs fix it needs](/quest/m3/vendor-sync/v4l.md) - libv4l-rs fixes are ported or ruled out
+- [moq-nvenc has every upstream fix it needs](/quest/m3/vendor-sync/nvenc.md) - nvidia-video-codec-sdk fixes and NVIDIA SDK releases are ported or ruled out
+- [moq-vaapi has every ChromeOS fix it needs](/quest/m3/vendor-sync/vaapi.md) - cros-libva and cros-codecs fixes are ported, released, and adopted
+- [UniFFI generator forks are current](/quest/m3/vendor-sync/uniffi.md) - the four `kixelated/uniffi-*` forks carry the upstream fixes moq's bindings need
 
 ## Related
 

diff --git a/quest/m3/vendor-sync/nvenc.md b/quest/m3/vendor-sync/nvenc.md
@@ -0,0 +1,31 @@
+# [XS] moq-nvenc has every upstream fix it needs
+
+## Goal
+
+moq-nvenc carries every fix
+[ViliamVadocz/nvidia-video-codec-sdk](https://github.com/ViliamVadocz/nvidia-video-codec-sdk)
+has landed since the last check, each ported with its test or recorded as not
+applying, and `rs/moq-nvenc/README.md`'s `Upstream` section names the newest
+upstream commit checked.
+
+## Plan
+
+Recurring child of the [vendor sync](/quest/m3/vendor-sync/README.md), which
+says how each run works and recurs.
+
+Last checked (2026-10-31): upstream `master` at
+[`88c2ca67`](https://github.com/ViliamVadocz/nvidia-video-codec-sdk/commit/88c2ca67406a5087ac117758d0f375d73441c040)
+(2026-03-31), the base of the vendored `dynamic-loading` branch, with no newer
+commits and no published advisories. NVIDIA's Video Codec SDK 13.0 and 13.1
+and its 2026 security bulletins were checked against moq-video's consumers;
+the README records why no header update was needed (API 13.1 would raise the
+minimum driver to 610).
+
+Each run also checks for a Video Codec SDK newer than 13.1, against the
+encoder's low-latency H.264/H.265 NV12 path and the live decoder. Driver
+security fixes belong in the installed driver, which this crate loads but does
+not vendor.
+
+## Required
+
+- [Cut and publish the prepared breaking release](/quest/m3/release/cut.md) - the next cycle starts after the cut
diff --git a/quest/m3/vendor-sync/quinn.md b/quest/m3/vendor-sync/quinn.md
@@ -0,0 +1,49 @@
+# [S] moq-quic has every quinn fix it needs
+
+## Goal
+
+moq-quic, moq-sock's `udp`, moq-tokio's `quic::driver`, and moq-congestion's
+Cubic and BBR3 carry every security and correctness fix quinn has landed since
+the last sync, each ported with its regression test or recorded as not
+applying. The fork ledger in `rs/moq-quic/README.md` says how far upstream was
+checked.
+
+## Plan
+
+Recurring child of the [vendor sync](/quest/m3/vendor-sync/README.md), which
+says how each run works and recurs. Decided 2026-10-27 (maintainer): the hard
+fork never merges upstream, so checking upstream is recurring work.
+
+Last checked (2026-11-03): quinn `main` through
+[`aea1e538`](https://github.com/quinn-rs/quinn/commit/aea1e5384927258887119fa1dc4fe3f23f1182c7)
+and `0.11.x` through
+[`77a51bdc`](https://github.com/quinn-rs/quinn/commit/77a51bdc5dc8b63bfba30429ab79fbb142bc8e2a),
+and [quinn#2481](https://github.com/quinn-rs/quinn/pull/2481)'s BBR3 through
+[`01b8848d`](https://github.com/quinn-rs/quinn/pull/2481/commits/01b8848dcb321eb17ad4d88dd6f84f28f45a0d6a),
+all recorded in `rs/moq-quic/README.md`'s `Upstream` section with every
+disposition. Start there, and record the new heads in the same place.
+
+Learned: a fix missing from the ledger is often already held, since the fork
+reworked the same code (`stop` under `RESET_STREAM_AT`, the stale-accept
+check under `handshake_timeout`, socket setup in `moq_sock::bind`), so check
+the fork's code before porting. A fix to quinn's `Endpoint::client` or
+`server` lands in `moq_sock::bind`, which the driver's test helpers bind
+through. Most of `0.11.x` backports `main`; compare its commits by subject.
+moq-congestion was extracted from moq-quic since the last run, so a
+congestion or pacer fix now lands in `rs/moq-congestion`, while the ledger
+stays in moq-quic's README.
+
+Ruled out: quinn's batched `read_datagrams`
+([`2697de1e`](https://github.com/quinn-rs/quinn/commit/2697de1e1314cb9f98502b7323acd5bdd836b582))
+waits on the [driver lock profile](/quest/m4/perf/quic-lock-contention.md).
+
+Public API: none expected; a ported fix that changes one says so. Wire: QUIC
+behavior follows upstream's fixes.
+
+## Required
+
+- [Cut and publish the prepared breaking release](/quest/m3/release/cut.md) - the next cycle starts after the cut
+
+## Related
+
+- [Dependency audit](/quest/m3/audit-deps.md) - covers crates cargo-deny can see
diff --git a/quest/m3/vendor-sync/rml.md b/quest/m3/vendor-sync/rml.md
@@ -0,0 +1,26 @@
+# [XS] moq-rtmp's rml has every upstream fix it needs
+
+## Goal
+
+moq-rtmp's vendored `rml` module carries every fix
+[KallDrexx/rust-media-libs](https://github.com/KallDrexx/rust-media-libs) has
+landed in rml_rtmp and rml_amf0 since the last check, each ported with its test
+or recorded as not applying, and the module doc in
+`rs/moq-rtmp/src/rml/mod.rs` names the newest upstream commit checked.
+
+## Plan
+
+Recurring child of the [vendor sync](/quest/m3/vendor-sync/README.md), which
+says how each run works and recurs.
+
+Last checked (2026-10-31): upstream `master` through
+[`953fc41d`](https://github.com/KallDrexx/rust-media-libs/commit/953fc41df2369d64e9c677369c706da797592e49)
+(2023-05-31), with every commit's disposition in the module doc and no
+published advisories for rml_rtmp or rml_amf0. Upstream has been dormant since
+that commit, so a run usually only re-checks commits and advisories. Kept
+because RTMP parses untrusted network input and cargo-deny cannot see an
+advisory against the vendored crates.
+
+## Required
+
+- [Cut and publish the prepared breaking release](/quest/m3/release/cut.md) - the next cycle starts after the cut
diff --git a/quest/m3/vendor-sync/scream.md b/quest/m3/vendor-sync/scream.md
@@ -0,0 +1,35 @@
+# [XS] moq-congestion's SCReAMv2 follows its draft and reference
+
+## Goal
+
+moq-congestion's `scream` carries every fix to its queue-delay target path
+from newer revisions of draft-ietf-ccwg-rfc8298bis-screamv2 and from
+[EricssonResearch/scream](https://github.com/EricssonResearch/scream)'s
+`ScreamV2Tx.cpp`, each ported with its test or recorded as not applying, and
+`rs/moq-congestion/src/scream.rs`'s module doc names the draft revision and
+reference commit checked.
+
+## Plan
+
+Recurring child of the [vendor sync](/quest/m3/vendor-sync/README.md), which
+says how each run works and recurs. New in the 2026-11-05 scan.
+
+[moq-dev/moq#7547](https://github.com/moq-dev/moq/pull/7547) (merged
+2026-11-03) ported draft
+[-01](https://www.ietf.org/archive/id/draft-ietf-ccwg-rfc8298bis-screamv2-01.html)
+and checked it against the reference without recording a commit. The
+reference's `master` head then was
+[`4b973bab`](https://github.com/EricssonResearch/scream/commit/4b973babf6555eda56c0d86649f0d16161813cb3)
+(2026-10-27); start there, after confirming the port's constants match it.
+
+Only the queue-delay target path is ported. The L4S path, competing-flow
+compensation, and the draft's media-queue terms were left out on purpose (see
+the [realtime uplink epic](/quest/m3/quic-realtime/README.md)), so a fix
+confined to them does not apply. Keep the PR's two recorded deviations
+(delay backoff counts as congestion; `scl_t` taken after the reduction) unless
+upstream settles them differently. SCReAMv2 is a bake-off candidate; if the
+bake-off deletes it, drop this child.
+
+## Required
+
+- [Cut and publish the prepared breaking release](/quest/m3/release/cut.md) - the next cycle starts after the cut
diff --git a/quest/m3/vendor-sync/uniffi.md b/quest/m3/vendor-sync/uniffi.md
@@ -0,0 +1,52 @@
+# [S] UniFFI generator forks are current
+
+## Goal
+
+moq's UniFFI forks carry every fix their upstreams have landed since the last
+check that moq's generated bindings need, and moq pins the updated forks:
+
+- [kixelated/uniffi-rs](https://github.com/kixelated/uniffi-rs) from
+  [mozilla/uniffi-rs](https://github.com/mozilla/uniffi-rs), pinned in
+  `rs/uniffi-bindgen/Cargo.toml`
+- [kixelated/uniffi-bindgen-go](https://github.com/kixelated/uniffi-bindgen-go)
+  from [NordSecurity/uniffi-bindgen-go](https://github.com/NordSecurity/uniffi-bindgen-go)
+- [kixelated/uniffi-dart](https://github.com/kixelated/uniffi-dart) from
+  [Uniffi-Dart/uniffi-dart](https://github.com/Uniffi-Dart/uniffi-dart)
+- [kixelated/uniffi-bindgen-cpp](https://github.com/kixelated/uniffi-bindgen-cpp)
+  from [livekit/uniffi-bindgen-cpp](https://github.com/livekit/uniffi-bindgen-cpp)
+
+## Plan
+
+Recurring child of the [vendor sync](/quest/m3/vendor-sync/README.md), which
+says how each run works and recurs. Decided 2026-10-30 (maintainer): covered
+only until [the switch to rust2's exporter](/quest/m3/ffi-exporter.md) lands;
+the next run after it drops this child. Until then, mirror any generator fix
+into rust2's maintenance fork too and add it to the exporter quest's
+carried-over list, so the new generators retain it. rust2's fork is
+maintenance-only since 2026-11-02.
+
+A port means a commit on the fork and a pin bump in moq (`flake.nix` and the
+places its "five places" comments name), with regenerated bindings diffed and
+each wrapper's check run. Before changing Dart fork CI, read its
+[coverage record](https://github.com/kixelated/uniffi-dart/blob/moq-0.32/README.md#fork-ci-coverage).
+
+Last checked (2026-11-02), with every public advisory list empty:
+
+| Upstream | Pin | Head checked |
+|---|---|---|
+| mozilla/uniffi-rs | `35209f3f` (base `v0.32.2`) | [`ef9625b6`](https://github.com/mozilla/uniffi-rs/commit/ef9625b68dd51207f55f024a27649e58edb52b09) |
+| NordSecurity/uniffi-bindgen-go | `v0.10.0-kixelated.2+v0.32.0` | [`0b7fb4ce`](https://github.com/NordSecurity/uniffi-bindgen-go/commit/0b7fb4ceef12021bd7f790cc516fa9133e001813) |
+| Uniffi-Dart/uniffi-dart | `v0.3.1-kixelated.7+v0.32.0` | [`e644a4ad`](https://github.com/Uniffi-Dart/uniffi-dart/commit/e644a4ad980f72697aba211fd30cb4fbd8fc7324) |
+| livekit/uniffi-bindgen-cpp | `v0.11.0-kixelated.7+v0.32.2` | [`20bef754`](https://github.com/livekit/uniffi-bindgen-cpp/commit/20bef754391023df147267482513c35120dee343) |
+
+Ruled out unless MoQ starts using the feature: MoQ exports no
+foreign-implementable traits, custom types, dollar-bearing defaults, or
+recursive enum graphs, so fixes to Kotlin Throwable handling, Swift async
+callback concurrency, Dart incoming callback buffers, custom FFI lowering,
+string-default escaping, and recursive or custom types have no consumer;
+recheck these uses before skipping one. Upstream's parser, JNI backend,
+mutable bytes, and library-mode removal are a redesign, not a port.
+
+## Required
+
+- [Cut and publish the prepared breaking release](/quest/m3/release/cut.md) - the next cycle starts after the cut