Merge main into dev

[kixelated]

Summary

dev had not merged main since 9bfb4a480, so it was missing #2748, #2749, #2785, #2801, #2804, #2805, #2809, #2811, #2825, #2827, #2837, #2844 and the releases in between.

Merge with a merge commit, not squash. Squashing collapses both parents and makes the next main merge re-diff everything already landed here.

The substantive decision is slice() in rs/moq-net/src/model/resume.rs, where the two branches disagree about what a takeover boundary means. dev's rule is kept, and #2785 is deliberately reverted on this branch. Reasoning below, since that is a merged main fix being undone, and it will reach main at the next dev merge.

The takeover boundary stays demand (reverting #2785)

main #2785 changed slice() so a takeover boundary never becomes a subscription start: a live-edge subscriber that failed over asked the replacement for the live edge rather than for the boundary. It fixed #2784, where a reconnect replayed 12 seconds of stale media that downstream QoS then dropped.

The diagnosis in #2784 was right; the fix is at the wrong layer.

• start/end are filters, not requests for reliability. They bound what a subscriber is served, not a guarantee it receives all of it. A takeover boundary entering the demand aggregate is therefore not a request to replay an outage, and the ceiling on how much gets replayed belongs to the latency budget rather than to the range.
• A backlog is indistinguishable from congestion. A subscriber receiving a burst after a route change sees exactly what it sees after any stall, and the answer is the same answer: the ordered consumer skips ahead. Special-casing it in resume puts a media policy in the transport.
• main's rule is incompatible with frame-precise splicing. dev's boundaries carry a frame offset and the read cursor is group-granular, so the offset can only reach the replacement as demand. Under main's rule takeover_splices_mid_group and takeover_redelivers_an_incomplete_frame both fail: a track whose current group never rolls (a JSON append log, a catalog with deltas) cannot survive a route change at all.

What that leaves exposed, stated plainly rather than argued away:

#2784's own trigger cannot recur on dev. Its root cause step 1 is origin linger holding the logical broadcast alive across a relay restart; dev removed linger in #2704 and this merge deletes the six linger tests with it, including test_linger_reconnect_splices, the test #2784 names as encoding the behavior. Detaching the last source now closes the broadcast synchronously, so the single-relay repro ends the subscription instead of splicing.

What remains is narrower and real: a preferred route that stalls while still alive, with a standby advancing behind it, leaves the boundary trailing the standby's live edge by more than failover latency, and the takeover requests that gap. moq_mux::container::Consumer drops it for media consumers on its own drift budget, but a relay hop, a moq-json track, or a raw track::Subscriber has no such filter. This branch accepts that exposure. The fix is to enforce Subscription::latency in moq-net itself (capped by Info::latency_max, preferring the moq-lite-05 presentation timestamp and falling back to a creation stamp, applied at both publisher and subscriber), which is a follow-up PR rather than something to bury in a merge. #2784 has a note pointing at it.

Tests updated to match, all of which assert demand rather than delivery:

• resume::test::takeover_after_produced_segment_keeps_live_edge -> ..._resumes_at_the_boundary, keeping its coverage that a below-boundary group from the replacement is filtered.
• takeover_keeps_an_explicit_start and takeover_after_empty_segment_keeps_live_edge are unchanged; both hold under either rule.
• Six origin_impl route/failover/standby/reconnect assertions back to the boundary.
• moq-native::broadcast::broadcast_route_migration, fix(net): keep a live-edge subscriber at the live edge across a takeover #2785's end-to-end regression, now expects ["b2", "b3"]. The subscriber there has a 10s latency tolerance and B holds the continuation of the same content, so skipping b2 was discarding a group the subscriber had asked to wait for.

cluster_diamond_goaway_seamless_failover passes unchanged, which is the property this preserves: a cluster swap loses no group. It asserts completeness for a REAL_TIME subscriber, which is stronger than that budget promises; it holds today because nothing enforces the budget, and it gains an explicit tolerance in the enforcement PR.

Other conflict resolutions worth review

• rs/moq-net/src/model/resume.rs: main's fix(net): surface a dropped resume producer instead of stalling readers forever #2804 hardening (the Snapshot struct, closed -> Error::Dropped after drain, Fetching::poll_latch) grafted onto dev's Position model. The parked-group watch closure moved above the loop, since dev iterates by index for hand_out's &mut self.
• rs/moq-net/src/model/group.rs: Consumer::poll_closed auto-merged onto self.state, which does not exist under dev's ConsumerKind split. Reimplemented per-variant; a spliced group reads as closed without registering, since no single abort empties it and is_aborted can never turn true.
• rs/moq-net/src/ietf/publisher.rs: Target/Namespaces (new in feat(net): announce namespaces unasked, with a SETUP opt-out #2748) retargeted from web_transport_trait::Session to dev's transport::poll::Session, and Target::closed converted to poll_closed. The announce loop destructures Namespaces to split the borrow between the close watch and the route sweep.
• rs/moq-net/src/lite/test_transport.rs: fix(net): surface a dropped resume producer instead of stalling readers forever #2804's open_gate ported to the poll interface with a kio::Park to hold the registration across calls.
• rs/moq-cli: feat(cli): run multiple import/export stages over one connection #2809's multi-stage pipeline meets dev's --cluster-lan. main's Directions { publish, consume } replaces dev's two-variant Direction and is threaded through spawn_server / spawn_serve / cluster::serve, so the LAN mesh can serve both directions. spawn_moq dials via Client::connect rather than publish/consume, which each attach one direction.
• rs/moq-native: feat(native): start dialing before the AAAA answer lands #2749's Happy Eyeballs resolution delay moved into connect.rs alongside refactor(moq-native)!: name the endpoint roles connect and listen #2750's rename, as --connect-resolution-delay with --client-resolution-delay kept as a hidden legacy spelling folded in resolved() (an alias would not carry the env var).

Fixed while reviewing the merge (403acc7)

Two defects the merge itself introduced, both invisible to the conflict list because they auto-merged and compiled:

• container::Producer::with_latency is buffering, not retention. It packs several samples into one moof+mdat; dev renamed it with_buffer. The first resolution substituted track::Info::with_latency_max, which is cache retention, so fetch_media_group_decodes_multiple_cmaf_samples (feat(bindings): fetch and decode a retained media group #2827) and its moq-mux twin kept passing while no longer exercising multi-sample parsing at all.
• The unsolicited announce loop had no ending. On main, Publisher.#broadcasts is a session-owned Signal and Publisher.close() (called from connection.ts) set it to undefined, which is exactly the loop's exit condition. dev borrows the origin instead (feat(js/net)!: route publish and consume through Origins, share one connection per relay #2705), which outlives the session and has neither that method nor its caller, so the merged loop could not be stopped: a closed connection left it parked on a shared origin, waking on an unrelated publish to fail against a dead transport. It now races the session's own closed promise, like the solicited loop does with its stream. Regression test included, verified to fail without the fix.

Public API changes

None beyond what the two branches already carried, except on moq-native, where #2749's knob lands under dev's new names: connect::Config::resolution_delay / resolved_resolution_delay (rather than ClientConfig::*), flag --connect-resolution-delay, env MOQ_CONNECT_RESOLUTION_DELAY. --client-resolution-delay / MOQ_CLIENT_RESOLUTION_DELAY keep working, hidden.

Test plan

• just check: clean, including the wasm32 gate and rustdoc.
• just test: 3142 Rust tests passed, JS 0 fail across every package, 52 Python passed.
• cluster_diamond_goaway_seamless_failover and broadcast_route_migration both pass.
• The JS regression test above mutation-checked: reverting the fix fails it with the announce loop outlived its session.

Cross-package sync

No wire format change, so no draft update. doc/bin/cli.md, doc/bin/relay/config.md, and rs/moq-cli/README.md reconciled: the multi-stage docs from #2809 now use --connect / --listen, and the resolution-delay knob documents its new spelling.

(written by Opus 5)

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 20798fd9d8

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Preserve DNS preference for single-attempt quiche dials

When quiche uses a nonzero --connect-bind port, this limit can select the IPv4 fast-path result before the authoritative all-family lookup finishes. If A resolves more than resolution_delay before AAAA, but the platform would rank a working IPv6 address first and the IPv4 path is broken, the sole IPv4 attempt fails and the later IPv6 result is never tried. Previously this mode waited for the complete resolver result before truncating to its first address; the single-attempt path should likewise wait for that result rather than using the speculative fast lane.

Useful? React with 👍 / 👎.