moq-lite-05: fill Security Considerations and fix reference/changelog nits

[kixelated]

Pre-publish review pass over draft-lcurley-moq-lite.md ahead of tagging moq-lite-05. No wire-format changes; this is documentation correctness, one clarified semantic edge case, and changelog/reference hygiene. Builds clean (make draft-lcurley-moq-lite.txt) with no kramdown-rfc warnings.

What changed

• Security Considerations — replaced the TODO with sections covering bandwidth probing/amplification (the Increase Probe level is bounded by the congestion window), session redirection (GOAWAY URI validation), routing-metadata privacy (Hop ID 0), resource exhaustion, datagram injection, and opaque payloads. Added explicit {#announce-ok} / {#announce-request} heading anchors so the new cross-references resolve.
• RFC9002 reference — changed inline {{!RFC9002}} to [RFC9002] since it's already declared in the YAML normative: block; clears the double-declaration build warning.
• Changelog (moq-lite-05) — added the missing Path SETUP parameter bullet.
• Changelog (moq-lite-04) — corrected the rename bullet to ANNOUNCE_PLEASE -> ANNOUNCE_SUBSCRIBE (the rename to ANNOUNCE_REQUEST actually happened in -05).
• Group sequence encoding — noted that SUBSCRIBE_OK / SUBSCRIBE_END / SUBSCRIBE_DROP carry plain absolute group sequences, not the absolute + 1 form used by Group Start/Group End in SUBSCRIBE, and tightened the SUBSCRIBE_OK comparison prose to decode-before-comparing.
• Expiration edge case — timestamp age is now measured against the first frame timestamp of the latest group that has at least one frame, so an empty latest group no longer makes the measure uncomputable for the whole track.

Reviewer notes

• The only behavioral clarification is the expiration edge case; everything else is editorial or changelog/reference accuracy.
• Worth a sanity check on the Security Considerations wording, since it's new prose rather than a port of existing text.

🤖 Generated with Claude Code

[sourcery-ai]

Sorry @kixelated, you have reached your weekly rate limit of 500000 diff characters.

Please try again later or upgrade to continue using Sourcery

[coderabbitai]

Warning

Review limit reached

@kixelated, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 56 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 3f22d18a-eac4-4fba-8cfd-abd771a7a4bf

📥 Commits

Reviewing files that changed from the base of the PR and between cdb701c and 6fc0d58.

📒 Files selected for processing (1)

• draft-lcurley-moq-lite.md

✨ Finishing Touches

✨ Simplify code

• Create PR with simplified code
• Commit simplified code in branch claude/nice-gauss-6f33a2

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}