From 0a48aabcbe0b2530de43dde13187637d83c29903 Mon Sep 17 00:00:00 2001
From: Luke Curley <kixelated@gmail.com>
Date: Mon, 2 Nov 2026 18:48:10 -0800
Subject: [PATCH 1/5] quest: plan follow-ups of the 2026-11-02 quest-complete
 merges

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 quest/m0/README.md          |  9 +++++++++
 quest/m0/app.md             |  5 ++++-
 quest/m0/audio-stall.md     | 21 +++++++++++++++++++++
 quest/m0/browser-popups.md  | 19 +++++++++++++++++++
 quest/m0/browser-profile.md | 24 ++++++++++++++++++++++++
 quest/m0/compose/layout.md  | 11 +++++++++--
 quest/m0/guest-refresh.md   | 16 ++++++++++++++++
 quest/m0/guest-return.md    | 23 +++++++++++++++++++++++
 quest/m0/health-sources.md  | 22 ++++++++++++++++++++++
 quest/m0/outside-edits.md   | 25 +++++++++++++++++++++++++
 quest/m0/pin-readback.md    | 19 +++++++++++++++++++
 quest/m0/scene-editing.md   |  5 +++--
 quest/m0/thread-start.md    | 14 ++++++++++++++
 quest/m0/vcam/linux.md      |  6 ++++++
 14 files changed, 214 insertions(+), 5 deletions(-)
 create mode 100644 quest/m0/audio-stall.md
 create mode 100644 quest/m0/browser-popups.md
 create mode 100644 quest/m0/browser-profile.md
 create mode 100644 quest/m0/guest-refresh.md
 create mode 100644 quest/m0/guest-return.md
 create mode 100644 quest/m0/health-sources.md
 create mode 100644 quest/m0/outside-edits.md
 create mode 100644 quest/m0/pin-readback.md
 create mode 100644 quest/m0/thread-start.md

diff --git a/quest/m0/README.md b/quest/m0/README.md
index ded9baaa..32884750 100644
--- a/quest/m0/README.md
+++ b/quest/m0/README.md
@@ -82,10 +82,14 @@ repository.
 - [Studio on macOS and Windows](/quest/m0/app.md) - the studio runs on macOS and Windows, not only Linux
 - [Viewer-side composition](/quest/m0/compose/README.md) - sources as their own tracks plus a layout track, composed by viewers, with a server-composed program as the fallback
 - [Undo and the scene model](/quest/m0/scene-model.md) - undo history, linked and cloned sources, copy and paste, a downstream keyer, and per-item filters
+- [Worker threads fail loud at startup](/quest/m0/thread-start.md) - a worker that cannot start fails the studio's start instead of logging
+- [Outside edits to the scene file](/quest/m0/outside-edits.md) - autosave reloads or asks instead of overwriting a change made outside the studio
 - [Scene editing](/quest/m0/scene-editing.md) - rename and reorder scenes, and resize the canvas while live through a new rendition
 - [Broadcast sources play in sync](/quest/m0/broadcast-sync.md) - subscribed broadcasts and guests play audio and video on the publisher's timestamps, with `moq play`'s delay
 - [Wayland display and window sources](/quest/m0/wayland-sources.md) - portal-picked sources that reopen without the picker
 - [Live encode control](/quest/m0/encode-control.md) - simulcast rungs that follow the bandwidth grant, live bitrate and resolution, keyframes on request
+- [Health grades source tracks](/quest/m0/health-sources.md) - the Health panel covers each published source track, not only the program
+- [Audio sources report stalls](/quest/m0/audio-stall.md) - a dead microphone or system audio reads stalled like a camera
 - [Relay failover](/quest/m0/failover.md) - the same epoch on two relays, so a relay failure does not drop the stream
 - [Instant replay and DVR](/quest/m0/replay.md) - replays and clips from held groups, and viewer scrubbing through the archive
 - [HTML/CSS overlays](/quest/m0/overlays.md) - script-free HTML and CSS graphics through Blitz natively and the DOM in the browser
@@ -96,10 +100,14 @@ repository.
 - [Destinations](/quest/m0/destinations.md) - RTMP, RTMPS, and WHIP push with per-destination codecs and shared encoders, on a UI-free egress library a hosted service can reuse
 - [Multiple canvases](/quest/m0/multi-canvas.md) - landscape and portrait canvases composite at once from shared sources
 - [Guests](/quest/m0/guests.md) - remote guests and phone cameras join through a moq-room link or QR code and appear as sources
+- [Guest return feed](/quest/m0/guest-return.md) - guests see the program and hear a mix-minus
+- [Guest token refresh](/quest/m0/guest-refresh.md) - a show outlasts the guest link's expiry without new links
 - [Audio mixes](/quest/m0/mixes.md) - per-output mixes, meters, monitoring, and sync offsets
 - [Audio filters](/quest/m0/audio-filters.md) - per-source noise suppression, gate, compressor, limiter, and plugins, configured from the studio
 - [Recording](/quest/m0/recording.md) - each canvas's program, and optionally each source, recorded to disk alongside live outputs
 - [Browser sources](/quest/m0/browser-source.md) - web overlays rendered by out-of-process CEF into the compositor through shared GPU textures
+- [Browser sources keep a profile](/quest/m0/browser-profile.md) - one persistent profile, so logins survive restarts, and a reload action
+- [Browser source popups](/quest/m0/browser-popups.md) - dropdowns and other in-page popups draw and take input
 - [Web studio](/quest/m0/web.md) - the full studio in wasm on WebGPU and WebCodecs, served from this repository
 - [Virtual camera](/quest/m0/vcam/README.md) - a canvas's program exposed as a system camera on Linux, Windows, and macOS
 - [Signing identities are available](/quest/m0/signing.md) - the Apple and Windows code-signing credentials packaging and the macOS camera need
@@ -109,6 +117,7 @@ repository.
 - [moq-audio's filter chain is pinned](/quest/m0/pin-audio-filters.md) - the chain audio filters configure
 - [moq-video's browser backends are pinned](/quest/m0/pin-browser-video.md) - the web studio's video slice and browser composition
 - [moq-audio's browser backends are pinned](/quest/m0/pin-browser-audio.md) - the web studio's audio slice
+- [moq-video's program readback is pinned](/quest/m0/pin-readback.md) - the readback the Linux virtual camera uses
 
 ## Related
 
diff --git a/quest/m0/app.md b/quest/m0/app.md
index 778d3e88..03de5b64 100644
--- a/quest/m0/app.md
+++ b/quest/m0/app.md
@@ -15,7 +15,10 @@ landed.
   there until [Windows capture parity](https://github.com/moq-dev/moq/blob/main/quest/m2/capture-windows.md) adds
   WASAPI loopback, so that quest runs it.
 - Build with `--features capture`, since a default build has image, color,
-  and broadcast sources only.
+  and broadcast sources only. That build fails on macOS today: the Devices
+  panel's listing task holds moq-video's ScreenCaptureKit listing future,
+  which is not `Send`, across a `runtime.spawn` in `rs/moq-studio/src/ui.rs`.
+  Linux CI never builds it.
 
 ## Related
 
diff --git a/quest/m0/audio-stall.md b/quest/m0/audio-stall.md
new file mode 100644
index 00000000..f87e964c
--- /dev/null
+++ b/quest/m0/audio-stall.md
@@ -0,0 +1,21 @@
+# [S] Audio sources report stalls
+
+## Goal
+
+A live audio source (a microphone or system audio) that stops delivering
+samples reads "stalled" in the Sources panel and Health, as a live camera does
+after a second without a picture.
+
+## Plan
+
+Audio capture runs inside the audio bus today, which reports no last-delivery
+time per source, so the stall check video sources have cannot see it. The
+capture Producer/Consumer split that the audio-capture pin brings gives the
+studio its own handle on each capture; read delivery from there rather than
+adding a side channel in the bus. Raised on
+[#5](https://github.com/moq-dev/studio/pull/5).
+
+## Required
+
+- [moq-audio's capture split is pinned](/quest/m0/pin-audio-capture.md) - the
+  per-capture handle this reads
diff --git a/quest/m0/browser-popups.md b/quest/m0/browser-popups.md
new file mode 100644
index 00000000..34a29072
--- /dev/null
+++ b/quest/m0/browser-popups.md
@@ -0,0 +1,19 @@
+# [S] Browser source popups
+
+## Goal
+
+In-page popups of a browser source, such as `<select>` dropdowns, draw on the
+canvas and take input like the rest of the page, on both the GPU import and
+the CPU fallback paths.
+
+## Plan
+
+CEF paints popup widgets separately (`PET_POPUP`) with their own rectangle,
+and the helper drops them today; `README.md` states the limitation, and this
+quest removes that note. `window.open` and `target="_blank"` stay cancelled:
+those are new browsers, not widgets. Raised on
+[#8](https://github.com/moq-dev/studio/pull/8).
+
+## Related
+
+- [Browser sources](/quest/m0/browser-source.md) - the macOS and Windows half
diff --git a/quest/m0/browser-profile.md b/quest/m0/browser-profile.md
new file mode 100644
index 00000000..16c2ea4d
--- /dev/null
+++ b/quest/m0/browser-profile.md
@@ -0,0 +1,24 @@
+# [S] Browser sources keep a profile
+
+## Goal
+
+Browser sources share one persistent browser profile, so cookies and logins
+(an alert service, a chat widget) survive a restart of the source or the
+studio, as in OBS.
+Each browser source also has a reload action that restarts its page without
+editing the source.
+
+## Plan
+
+Decided 2026-11-02 (maintainer): one shared profile for all browser sources,
+not one per source. Each page runs in its own CEF helper process today with a
+fresh temporary profile, and two CEF instances cannot share a profile
+directory, so sharing it means the helpers share one CEF instance or hand the
+profile between them; weigh that against the crash isolation per page that the
+helpers give. Keep the profile beside the studio's other per-user state, not
+beside the scene file, since the scene file is meant to be shared. Raised on
+[#8](https://github.com/moq-dev/studio/pull/8).
+
+## Related
+
+- [Browser sources](/quest/m0/browser-source.md) - the macOS and Windows half
diff --git a/quest/m0/compose/layout.md b/quest/m0/compose/layout.md
index 688fafba..5ac90548 100644
--- a/quest/m0/compose/layout.md
+++ b/quest/m0/compose/layout.md
@@ -17,6 +17,13 @@ tracks and contribution references, never files. A viewer that refuses a
 layout version plays the program instead and says why. A late joiner needs the
 current state, so use the JSON track's snapshot mode.
 
-## Required
+Decided 2026-11-02 (maintainer, follow-up planning after
+[#6](https://github.com/moq-dev/studio/pull/6)): clones and filters travel in
+the layout, with each item naming the source track it shows and the filters
+applied to it. Only a filter that cannot render the same way in every viewer
+is baked into a track of its own. The picture source tracks are enough to
+start; audio source tracks join the layout when they land.
 
-- [Source tracks](/quest/m0/compose/sources.md) - the tracks a layout names
+## Related
+
+- [Source tracks](/quest/m0/compose/sources.md) - the audio source tracks a layout also names once they land
diff --git a/quest/m0/guest-refresh.md b/quest/m0/guest-refresh.md
new file mode 100644
index 00000000..bdbde7af
--- /dev/null
+++ b/quest/m0/guest-refresh.md
@@ -0,0 +1,16 @@
+# [M] Guest token refresh
+
+## Goal
+
+A show can outlast `--guest-expiry`: a joined guest's credential is renewed
+while they stay in the room, without the host sending a new link and without
+the guest reconnecting.
+
+## Plan
+
+A signed guest token cannot be revoked, and the relay ends a session at its
+`exp`, which is why links expire today. Renew over the transport's own
+re-authentication if moq supports it, or land that in moq first; do not invent
+a guest protocol. A host's Remove from scenes should stop renewal, so the
+expiry bounds a removed guest again. Raised on
+[#10](https://github.com/moq-dev/studio/pull/10).
diff --git a/quest/m0/guest-return.md b/quest/m0/guest-return.md
new file mode 100644
index 00000000..78e86254
--- /dev/null
+++ b/quest/m0/guest-return.md
@@ -0,0 +1,23 @@
+# [M] Guest return feed
+
+## Goal
+
+Guests in the studio's room see the program and hear a mix-minus, the program
+audio without their own voice, so they can follow the show without hearing
+themselves back.
+The join page plays it.
+
+## Plan
+
+Decided 2026-11-02 (maintainer): guests get a mix-minus, not the full program,
+so this waits on audio mixes; video and audio land together. Publish into the
+room the studio already owns, under names the room's token scope allows, and
+keep it free of the studio's own credentials. One mix-minus per guest grows
+with the guest count, so bound it by design (the guest roster is already
+bounded to guests the studio signed for). Raised on
+[#10](https://github.com/moq-dev/studio/pull/10).
+
+## Required
+
+- [Audio mixes](/quest/m0/mixes.md) - the per-output mixes a mix-minus is
+  built from
diff --git a/quest/m0/health-sources.md b/quest/m0/health-sources.md
new file mode 100644
index 00000000..95354ead
--- /dev/null
+++ b/quest/m0/health-sources.md
@@ -0,0 +1,22 @@
+# [S] Health grades source tracks
+
+## Goal
+
+The Health panel grades each published source track the way it grades the
+program's: sent rate, viewers reporting, and the worst grade and latency they
+report, so a source someone watches directly is covered too.
+
+## Plan
+
+Source tracks are listed in their own nested catalogs under the studio's
+catalog (see `README.md`, Source tracks), and the health sampler reads only
+the root renditions today. Viewers report per rendition through `.echo`, so
+the per-track table and its causes extend to the source renditions rather than
+adding a second path. Keep the table readable when there are many sources, for
+example grouped by source. Raised on
+[#3](https://github.com/moq-dev/studio/pull/3).
+
+## Related
+
+- [Source tracks](/quest/m0/compose/sources.md) - the audio source tracks this
+  grades once they land
diff --git a/quest/m0/outside-edits.md b/quest/m0/outside-edits.md
new file mode 100644
index 00000000..7254ff92
--- /dev/null
+++ b/quest/m0/outside-edits.md
@@ -0,0 +1,25 @@
+# [S] Outside edits to the scene file
+
+## Goal
+
+Autosave never silently overwrites a change made to the scene file outside the
+studio, by hand or by another studio on the same file.
+When the studio has nothing unsaved, it reloads the outside change without
+asking.
+When both sides changed, autosave pauses and the studio asks whether to keep
+its own version or take the file's; nothing is written until the user picks.
+
+## Plan
+
+Decided 2026-11-02 (maintainer, follow-up planning after
+[#4](https://github.com/moq-dev/studio/pull/4)): the silent reload and the
+keep-mine or take-theirs prompt above. Today the last writer wins, which
+`README.md` documents; that note goes away with this quest.
+
+- Detect a change by what the studio last wrote or read, not by timing, so the
+  studio's own atomic rename never reads as an outside edit.
+- An outside edit that does not parse is refused like File > Reload refuses
+  it: the studio keeps its state, says why, and does not overwrite the file
+  until the user picks.
+- The undo history file follows the scene file: a reload already replays or
+  drops its entries, and "take theirs" goes through that path.
diff --git a/quest/m0/pin-readback.md b/quest/m0/pin-readback.md
new file mode 100644
index 00000000..d3fddb0b
--- /dev/null
+++ b/quest/m0/pin-readback.md
@@ -0,0 +1,19 @@
+# [XS] moq-video's program readback is pinned
+
+## Goal
+
+moq-video exposes its GPU readback (the `render::export` readback route:
+staging buffers, row unpadding, the mapping lifecycle) without an encoder,
+merged on moq's `main` with a moq-side test, and the `moq` gitlink here
+includes it.
+Check with `just upgrade-moq` and a search of `moq/rs/moq-video` for a public
+readback-only constructor.
+
+## Plan
+
+Decided 2026-11-02 (maintainer, on
+[#9](https://github.com/moq-dev/studio/pull/9)): the Linux virtual camera's
+readback lives in moq-video, not in a copy here. The readback is private today
+and reachable only through an encoder probe. Land the public API in
+moq-dev/moq first; no moq quest tracks it yet. Bump the pin in its own PR,
+fixing whatever the bump breaks.
diff --git a/quest/m0/scene-editing.md b/quest/m0/scene-editing.md
index 53f6d103..52f98eca 100644
--- a/quest/m0/scene-editing.md
+++ b/quest/m0/scene-editing.md
@@ -2,8 +2,9 @@
 
 ## Goal
 
-In `moq-studio`, scenes can be renamed and reordered, and the canvas can be
-resized while live, with no restart.
+In `moq-studio`, scenes can be renamed and reordered, the transition's
+settings (such as the fade time) can be edited as undoable steps, and the
+canvas can be resized while live, with no restart.
 
 ## Plan
 
diff --git a/quest/m0/thread-start.md b/quest/m0/thread-start.md
new file mode 100644
index 00000000..76663d02
--- /dev/null
+++ b/quest/m0/thread-start.md
@@ -0,0 +1,14 @@
+# [XS] Worker threads fail loud at startup
+
+## Goal
+
+A studio worker thread (program, audio, source, autosave) that cannot start,
+such as a failed Tokio runtime build, fails the studio's start with that error
+instead of logging it and leaving the feature dead.
+
+## Plan
+
+`engine::clocked` builds each worker's runtime inside the spawned thread and
+only logs a failure, so the caller never learns of it. Build the runtime
+before spawning, or hand the result back, and propagate it to whoever starts
+the worker. Raised on [#4](https://github.com/moq-dev/studio/pull/4).
diff --git a/quest/m0/vcam/linux.md b/quest/m0/vcam/linux.md
index c5c22c6c..d1190d3a 100644
--- a/quest/m0/vcam/linux.md
+++ b/quest/m0/vcam/linux.md
@@ -5,3 +5,9 @@
 The studio publishes a canvas's program as a PipeWire video node that
 PipeWire-aware apps (browsers and conferencing apps) list as a camera. It
 falls back to an existing v4l2loopback device when one is present.
+The studio's Devices panel leaves out its own virtual camera, so picking it
+cannot feed the program back into itself.
+
+## Required
+
+- [moq-video's program readback is pinned](/quest/m0/pin-readback.md) - the readback the camera reads the program through

From 869ab623e621e620001170045a41c6bf2850559d Mon Sep 17 00:00:00 2001
From: Luke Curley <kixelated@gmail.com>
Date: Mon, 2 Nov 2026 19:42:52 -0800
Subject: [PATCH 2/5] quest: leave app.md to the split in #13

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 quest/m0/app.md | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/quest/m0/app.md b/quest/m0/app.md
index 03de5b64..778d3e88 100644
--- a/quest/m0/app.md
+++ b/quest/m0/app.md
@@ -15,10 +15,7 @@ landed.
   there until [Windows capture parity](https://github.com/moq-dev/moq/blob/main/quest/m2/capture-windows.md) adds
   WASAPI loopback, so that quest runs it.
 - Build with `--features capture`, since a default build has image, color,
-  and broadcast sources only. That build fails on macOS today: the Devices
-  panel's listing task holds moq-video's ScreenCaptureKit listing future,
-  which is not `Send`, across a `runtime.spawn` in `rs/moq-studio/src/ui.rs`.
-  Linux CI never builds it.
+  and broadcast sources only.
 
 ## Related
 

From 27d092ca619bc73bd8520c2262599368b292124a Mon Sep 17 00:00:00 2001
From: Luke Curley <kixelated@gmail.com>
Date: Mon, 2 Nov 2026 20:23:30 -0800
Subject: [PATCH 3/5] quest: settle the audio filter contract, guest token
 delivery, and source spawn failures

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 quest/m0/compose/layout.md | 18 +++++++++++-------
 quest/m0/guest-refresh.md  | 11 +++++++----
 quest/m0/thread-start.md   | 14 +++++++++-----
 3 files changed, 27 insertions(+), 16 deletions(-)

diff --git a/quest/m0/compose/layout.md b/quest/m0/compose/layout.md
index e6af823a..e67a922a 100644
--- a/quest/m0/compose/layout.md
+++ b/quest/m0/compose/layout.md
@@ -22,13 +22,17 @@ what it settles on. Until then sources are listed provisionally as
 `dev.moq.studio.sources.<name>` in the studio catalog, each a nested hang
 catalog (decided 2026-11-02, maintainer; `rs/moq-scene/src/publish.rs`).
 
-Clones and filters travel in the layout, not as tracks: a source's track is
-its capture before any filter, and a clone publishes none, so the layout names
-the source a clone shows and the filters each source and item applies
-(decided 2026-11-02, maintainer). Only a filter that cannot render the same
-way in every viewer is baked into a track of its own. The picture source
-tracks are enough to start; audio source tracks join the layout when they
-land.
+Clones and video filters travel in the layout, not as tracks: a picture
+source's track is its capture before any filter, and a clone publishes none,
+so the layout names the source a clone shows and the video filters each
+source and item applies (decided 2026-11-02, maintainer). Only a video filter
+that cannot render the same way in every viewer is baked into a track of its
+own. Audio is the other way round: an audio source's track is published after
+its audio filters ([Audio source tracks](/quest/m0/compose/sources.md)), so
+the layout carries only what is applied after that point, such as gain and
+mute, and never names an audio filter for a viewer to apply again. The
+picture source tracks are enough to start; audio source tracks join the
+layout when they land.
 
 ## Related
 
diff --git a/quest/m0/guest-refresh.md b/quest/m0/guest-refresh.md
index bdbde7af..3f730f30 100644
--- a/quest/m0/guest-refresh.md
+++ b/quest/m0/guest-refresh.md
@@ -9,8 +9,11 @@ the guest reconnecting.
 ## Plan
 
 A signed guest token cannot be revoked, and the relay ends a session at its
-`exp`, which is why links expire today. Renew over the transport's own
-re-authentication if moq supports it, or land that in moq first; do not invent
-a guest protocol. A host's Remove from scenes should stop renewal, so the
-expiry bounds a removed guest again. Raised on
+`exp`, which is why links expire today. The studio holds the room key, so it
+signs each renewed token, and the token has to reach the connected guest
+before `exp` over something the room already provides, such as a track only
+that guest may subscribe to; the join page then re-authenticates with it.
+Renew over the transport's own re-authentication if moq supports it, or land
+that in moq first; do not invent a guest protocol. A host's Remove from scenes
+should stop renewal, so the expiry bounds a removed guest again. Raised on
 [#10](https://github.com/moq-dev/studio/pull/10).
diff --git a/quest/m0/thread-start.md b/quest/m0/thread-start.md
index 76663d02..148ced93 100644
--- a/quest/m0/thread-start.md
+++ b/quest/m0/thread-start.md
@@ -3,12 +3,16 @@
 ## Goal
 
 A studio worker thread (program, audio, source, autosave) that cannot start,
-such as a failed Tokio runtime build, fails the studio's start with that error
-instead of logging it and leaving the feature dead.
+such as a failed thread spawn or Tokio runtime build, reports that error
+instead of logging it and leaving the feature dead. A worker the studio needs
+to run fails the studio's start; a source, which starts and restarts while
+the studio runs, shows the error as that source's failure in the Sources
+panel.
 
 ## Plan
 
 `engine::clocked` builds each worker's runtime inside the spawned thread and
-only logs a failure, so the caller never learns of it. Build the runtime
-before spawning, or hand the result back, and propagate it to whoever starts
-the worker. Raised on [#4](https://github.com/moq-dev/studio/pull/4).
+only logs a failure, and a failed source thread spawn is logged and dropped,
+so the caller never learns of either. Build the runtime before spawning, or
+hand the result back, and propagate it to whoever starts the worker. Raised on
+[#4](https://github.com/moq-dev/studio/pull/4).

From ab88dd250b4d2479022478cbd9365c3ad1ce3501 Mon Sep 17 00:00:00 2001
From: Luke Curley <kixelated@gmail.com>
Date: Mon, 2 Nov 2026 20:34:40 -0800
Subject: [PATCH 4/5] quest: cover the race between the outside-edit check and
 the rename

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 quest/m0/outside-edits.md | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/quest/m0/outside-edits.md b/quest/m0/outside-edits.md
index 7254ff92..f011ee37 100644
--- a/quest/m0/outside-edits.md
+++ b/quest/m0/outside-edits.md
@@ -18,6 +18,10 @@ keep-mine or take-theirs prompt above. Today the last writer wins, which
 
 - Detect a change by what the studio last wrote or read, not by timing, so the
   studio's own atomic rename never reads as an outside edit.
+- Check again right before the autosave's rename, not only before its write,
+  since another studio can write in between. A window remains between that
+  check and the rename; close it with an advisory lock between studios if one
+  works on every platform, or else name the residual race in `README.md`.
 - An outside edit that does not parse is refused like File > Reload refuses
   it: the studio keeps its state, says why, and does not overwrite the file
   until the user picks.

From 0b57207e8fc92087c8bfae704eacf523607e703f Mon Sep 17 00:00:00 2001
From: Luke Curley <kixelated@gmail.com>
Date: Mon, 2 Nov 2026 21:52:34 -0800
Subject: [PATCH 5/5] quest: state the outside-edit contract as best-effort

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 quest/m0/outside-edits.md | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/quest/m0/outside-edits.md b/quest/m0/outside-edits.md
index f011ee37..a9a16d93 100644
--- a/quest/m0/outside-edits.md
+++ b/quest/m0/outside-edits.md
@@ -2,8 +2,9 @@
 
 ## Goal
 
-Autosave never silently overwrites a change made to the scene file outside the
-studio, by hand or by another studio on the same file.
+Autosave does not silently overwrite a change made to the scene file outside
+the studio, by hand or by another studio on the same file, except in the short
+window between its last check and its rename, which `README.md` names.
 When the studio has nothing unsaved, it reloads the outside change without
 asking.
 When both sides changed, autosave pauses and the studio asks whether to keep
@@ -20,8 +21,9 @@ keep-mine or take-theirs prompt above. Today the last writer wins, which
   studio's own atomic rename never reads as an outside edit.
 - Check again right before the autosave's rename, not only before its write,
   since another studio can write in between. A window remains between that
-  check and the rename; close it with an advisory lock between studios if one
-  works on every platform, or else name the residual race in `README.md`.
+  check and the rename. No lock binds an arbitrary editor, so this is
+  best-effort; an advisory lock between studios is worth it only if it works
+  on every platform and removes the studio-to-studio half of the window.
 - An outside edit that does not parse is refused like File > Reload refuses
   it: the studio keeps its state, says why, and does not overwrite the file
   until the user picks.