Verify each finding against the current code and only fix it if needed.

Inline comments:
In @.github/workflows/dev.yml:
- Around line 18-23: Replace mutable action refs with immutable full commit
SHAs: change actions/checkout@v6 to actions/checkout@<commit-sha>,
DeterminateSystems/nix-installer-action@main,
DeterminateSystems/magic-nix-cache-action@main, and
DeterminateSystems/flake-checker-action@main to their respective full-length
commit SHAs, and add inline comments showing the original tag (e.g., // was `@v6`
or // was `@main`) for clarity; repeat the same SHA-pinning pattern in the other
workflows mentioned (main.yml, cachix.yml, release-js.yml, update-flake.yml).

In `@rs/moq-lite/src/model/track.rs`:
- Around line 204-209: append_finish (and similarly insert_finish) currently
overwrites fin unconditionally and can set an invalid final; change them to
validate and freeze the final boundary by: require that state.max_sequence is
Some(max) (return Err if not), require state.fin.is_none() (return Err if fin
already set), and then set state.fin = Some(max) (don’t accept sequence < max or
allow rewriting fin). Refer to the append_finish and insert_finish methods and
the state.max_sequence/state.fin fields when implementing these checks.
- Around line 74-79: The current logic returns Poll::Ready(None) as soon as
self.fin is set, which can prematurely terminate consumers; update the
Stream/iterator logic that currently checks self.fin (the block returning
Poll::Ready(None) and the similar checks in the methods using self.fin) to only
return Ready(None) when fin is set AND there are no pending groups and no future
groups can still be created (i.e., the internal queue/buffer is empty and
create_group would not accept any sequence < fin). Replace the early Ready(None)
returns with Poll::Pending (or equivalent) in the interim, and keep terminal
None only when self.fin.is_some() && queue.is_empty() && no allowed late
sequences remain so next_group/get_group won't stop early. Ensure the same
change is applied to the other occurrences (the checks around lines referencing
self.fin, create_group, next_group, get_group).

---

Outside diff comments:
In `@rs/moq-lite/src/model/track.rs`:
- Around line 173-181: The current append_group function rejects all appends if
state.fin.is_some(), but it should only close appends once the fin boundary has
passed; change the gating logic to compute now = tokio::time::Instant::now() and
return Err(Error::Closed) only when state.fin.map_or(false, |f| now >= f) (i.e.,
fin exists and now is at-or-after the boundary) instead of state.fin.is_some();
apply the same fix to the other identical fin-check later in the file (the
second occurrence near lines 213-214) so both places use the time comparison
rather than a simple is_some() check.

---

Nitpick comments:
In `@justfile`:
- Around line 371-374: Add a one-line rationale comment immediately above the
cargo semver-checks invocation that explains why --exclude libmoq is needed (for
example: libmoq is a non-published/internal crate or intentionally unstable), so
future readers understand the permanent-looking exclusion; locate the line with
"cargo semver-checks check-release --workspace --exclude libmoq" and insert the
brief explanatory comment above it.

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@rs/moq-lite/src/model/track.rs`:
- Around line 647-648: The async test attribute needs to include start_paused =
true to follow the repo convention; update the #[tokio::test] annotation on the
next_group_finishes_without_waiting_for_gaps test (and the other new async test
referenced around lines 665-666) to #[tokio::test(start_paused = true)] so the
tests run with the tokio time paused and can use simulated time APIs.
- Line 173: The increment of state.max_sequence (sequence =
state.max_sequence.map_or(0, |s| s + 1)) can overflow; in the append_group path
replace the naive +1 with checked_add on state.max_sequence and, if checked_add
returns None (u64::MAX), return an appropriate error from append_group instead
of allowing overflow/wrap. Update any code that uses the resulting sequence
variable (and any state update of max_sequence) to handle the
Result/early-return error and keep the original semantics when checked_add
succeeds.

---

Nitpick comments:
In `@rs/moq-lite/src/model/track.rs`:
- Around line 214-226: The insert_finish method currently allows sequence >
max_sequence and still sets state.fin to max_sequence, which can silently
finalize earlier than the caller expects; change the validation in insert_finish
(function insert_finish, variables sequence, state.max_sequence, and state.fin)
to require an exact match by returning Err(Error::Closed) unless sequence == max
(i.e., replace the current condition that checks sequence < max with a strict
equality check), then set state.fin = Some(max) as before and preserve the
existing error path when fin is already set; also update the doc comment to
state that insert_finish requires the caller to pass the exact final boundary.

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@rs/moq-lite/src/model/broadcast.rs`:
- Around line 185-189: BroadcastDynamic::abort currently only calls
self.state.abort(err) and leaves entries in self.state.requests (so
queued/pending track producers remain alive); to fix, before closing broadcast
state iterate and cancel all pending requests: drain or take ownership of
self.state.requests and for each request call its cancellation method (e.g.,
request.abort(err.clone()) or send the error down its response channel) to
ensure their producers are closed, then call self.state.abort(err); update Error
usage to allow cloning or accept &Error if needed and ensure requests are
removed from state (use drain() or clear()) so no pending producers remain.

Verify each finding against the current code and only fix it if needed.

Outside diff comments:
In `@rs/moq-lite/src/model/broadcast.rs`:
- Around line 348-349: The async test function closed is missing the Tokio test
option to pause time; update its attribute from #[tokio::test] to
#[tokio::test(start_paused = true)] so the test uses a paused clock for
simulated time; locate the closed function declaration in broadcast.rs and
change the attribute above the async fn closed() accordingly.

---

Nitpick comments:
In `@rs/moq-lite/src/model/broadcast.rs`:
- Around line 109-125: Both BroadcastProducer::abort and BroadcastDynamic::abort
duplicate the same cascade logic; extract that repeated sequence (iterating
state.tracks to call weak.abort(...), draining state.requests and calling
request.abort(...), then state.abort(...)) into a single helper method (e.g.,
BroadcastState::cascade_abort or Broadcast::cascade_abort) and call it from both
BroadcastProducer::abort and BroadcastDynamic::abort instead of duplicating the
code; ensure the helper takes &mut self and an Error parameter and uses the
existing weak.abort(err.clone()) and request.abort(err.clone()) calls so
behavior remains identical.

Verify each finding against the current code and only fix it if needed.

Nitpick comments:
In @.github/workflows/semver.yml:
- Around line 11-14: The job in .github/workflows/semver.yml is named "check"
with display name "Check", which duplicates another job and is confusing; rename
the job identifier from check to semver (or similar unique id) and change the
runs-on display name to "Semver Check" (update the job key `check` and the
`name: Check` field) so the workflow uses a distinct job id and a clear UI
label.