diff --git a/.github/workflows/smoke.yml b/.github/workflows/smoke.yml
index 23ac229..9334647 100644
--- a/.github/workflows/smoke.yml
+++ b/.github/workflows/smoke.yml
@@ -178,17 +178,16 @@ jobs:
 
       # ── run the full interop matrix ────────────────────────────────────
       # Publishers: rust, python, and the three browser variants publish today;
-      # go/swift/kotlin/c/gst subscribe only (go's module is also currently broken,
-      # and no moq-gst release has been cut yet, so gst is red until one ships).
+      # go/swift/kotlin/c/gst subscribe only (go builds on Linux against the
+      # published moq-go module; gst resolves the latest moq-gst-v* release).
       # Browser variants: js-vite, js-esbuild (bundlers), js-jsdelivr (CDN).
       # Swift needs the Xcode toolchain, so it's a macOS-only subscriber.
       # --timeout 30 gives headless Chromium cold-start headroom.
       - name: Smoke
         run: |
           browser="js-vite,js-esbuild,js-jsdelivr"
-          # js-native-bun works with moq's @moq/web-transport polyfill; js-native-node
-          # currently fails (the polyfill's napi CJS named-import breaks node's ESM
-          # loader) -- kept to track the upstream fix.
+          # Both run moq's @moq/web-transport polyfill. node briefly failed on the
+          # polyfill's napi CJS named-import; fixed in @moq/web-transport 0.1.2.
           native="js-native-node,js-native-bun"
           # c / c-pkgconfig / c-cmake: same libmoq client built three ways, to
           # exercise the moq.pc and CMake-package consumer paths, not just -I/-L.
diff --git a/README.md b/README.md
index 3b71894..5a04d36 100644
--- a/README.md
+++ b/README.md
@@ -170,10 +170,10 @@ This test tracks the **latest published** packages, so it sometimes runs ahead o
 - **Python publish/subscribe**: working. `moq-rs` 0.2.16 shipped the streaming importer (`publish_media_stream`), so Python now publishes a raw Annex-B broadcast too, verified end-to-end against rust/swift/c subscribers.
 - **Swift / Kotlin / C subscribe**: working, verified end-to-end against the published 0.2.16 / 0.3.0 packages (`moq-dev/moq-swift`, `dev.moq:moq`, `libmoq`). Subscriber-only by choice.
 - **Native JS on bun** (`js-native-bun`): working. `@moq/net` + `@moq/hang` + moq's `@moq/web-transport` polyfill connect via WebTransport and read frames under Bun. (An earlier attempt with `@fails-components/webtransport` crashed Bun; moq's own polyfill is the one to use.)
-- **Native JS on node** (`js-native-node`): red. `@moq/web-transport`'s `src/session.ts` does `import { NapiClient } from "../napi.js"` — a *named* import from a napi-rs CJS module whose exports node's ESM loader can't statically see, so node throws `does not provide an export named 'NapiClient'`. Bun's looser CJS interop accepts it. The fix lives in `@moq/web-transport` (default-import the CJS binding, then destructure); this cell goes green once that ships. Tracked upstream in moq-dev/web-transport.
-- **Go (any role)**: red. The published `moq-dev/moq-go` module is still un-buildable (stuck at v0.2.15): it's missing the generated `moq.h` header (its `moq.go` does `#include <moq.h>`) and the linux static libs, so `go get` + build fails. Tracked upstream in moq-dev/moq's release-go packaging.
-- **GStreamer subscribe** (`gst`): red — but only because no `moq-gst` release has been published yet. The plugin, its packaging (apt/brew/rpm/tarball + nix), and a `gst-inspect` CI check all exist in-tree, but no `moq-gst-v*` tag has been cut, so there's no installable artifact and the cell reports "no moq-gst-v\* release found". The interop itself is verified: built from source (`cargo build -p moq-gst`) and pointed at via `MOQ_GST_PLUGIN_DIR`, `moqsrc` reads a rust-published H.264 broadcast end-to-end. The cell flips green automatically once the first release ships.
-- **Token interop** (`token.sh`): working on **cargo / apt / nix** plus the **`moqdev/moq-token-cli` Docker image** (Linux). The published `moq-token-cli` (crates.io / apt / nix / Docker Hub) and `@moq/token` (npm, under both node and bun) cross-verify every token across `HS256`, `EdDSA`, `ES256`, and `RS256`, and each verifier rejects tampered tokens and the wrong key. The Docker cell (`rust-docker`) proves the image — built `FROM nixos/nix`, so it carries the libiconv the brew bottle leaks — runs cleanly. Subscriber-only languages don't ship token tooling yet, so the matrix is rust (binary + Docker) + the two JS runtimes for now.
-- **Token interop on the Homebrew bottle** (`rust` cells, macOS `brew`): red. The published `moq-dev/tap/moq-token-cli` bottle aborts on launch — it baked in a `/nix/store/…-libiconv/lib/libiconv.2.dylib` rpath from the build sandbox that doesn't exist on a user's Mac (`dyld: Library not loaded`). `token.sh` runs the binary once at startup and marks `rust` unavailable when it won't launch, so the JS cells still report; the row goes green once the bottle is rebuilt without the leaked path. Exactly the packaging break this repo exists to surface. Tracked upstream in moq-dev/moq's Homebrew packaging.
+- **Native JS on node** (`js-native-node`): working. node briefly lagged bun here: `@moq/web-transport`'s `session.ts` did `import { NapiClient } from "../napi.js"` — a *named* import from a napi-rs CJS module whose exports node's ESM loader can't statically see, so node threw `does not provide an export named 'NapiClient'` while Bun's looser CJS interop accepted it. `@moq/web-transport` 0.1.2 shipped the predicted fix (default-import the now-`.cjs` binding, then destructure `NapiClient`), so this cell is green. Exactly the break-then-fix this repo exists to surface.
+- **Go (any role)**: working. The `moq-dev/moq-go` module was un-buildable (stuck at v0.2.15, missing the generated `moq.h` header and the prebuilt static libs, so `go get` + build failed); v0.2.22 now ships `moq.h` plus `libmoq_ffi.a` for linux (amd64/arm64), darwin, and windows, and a `CGO_ENABLED=1 go build` against it links cleanly — verified in a linux/amd64 container, clearing the blocker that kept this cell red. One caveat the matrix doesn't see: building the Go client on **macOS** still fails to link, because the module's darwin cgo `LDFLAGS` omit `-framework CoreServices` (needed by the bundled Rust `notify` crate's FSEvents backend); CI only builds Go on Linux. Tracked upstream in moq-dev/moq's `go/moq/cgo.go`.
+- **GStreamer subscribe** (`gst`): working. The first `moq-gst` releases have now shipped (latest `moq-gst-v0.2.7`, with apt/brew/rpm/tarball + nix artifacts), so the cell resolves the newest tag and downloads the prebuilt plugin instead of reporting "no moq-gst-v\* release found". The published plugin load-checks green — `gst-inspect-1.0 moq` exposes `moqsrc`/`moqsink` against a system GStreamer (verified locally against the 0.2.7 tarball) — and `moqsrc` reads a rust-published H.264 broadcast end-to-end.
+- **Token interop** (`token.sh`): working on **cargo / apt / nix** plus the **`moqdev/moq-token-cli` Docker image** (Linux). The published `moq-token-cli` (crates.io / apt / nix / Docker Hub) and `@moq/token` (npm, under both node and bun) cross-verify every token across `HS256`, `EdDSA`, `ES256`, and `RS256`, and each verifier rejects tampered tokens and the wrong key. The Docker cell (`rust-docker`) proves the image — built `FROM nixos/nix`, so it carries the libiconv the brew bottle used to leak — runs cleanly. Subscriber-only languages don't ship token tooling yet, so the matrix is rust (binary + Docker) + the two JS runtimes for now.
+- **Token interop on the Homebrew bottle** (`rust` cells, macOS `brew`): working. The `moq-dev/tap/moq-token-cli` bottle used to abort on launch — it baked in a `/nix/store/…-libiconv/lib/libiconv.2.dylib` rpath from the build sandbox that doesn't exist on a user's Mac (`dyld: Library not loaded`). The 0.5.31 bottle fixes it: its only `LC_RPATH` is now `/usr/lib`, so `@rpath/libiconv.2.dylib` resolves to the system libiconv and the binary runs (verified locally — `generate --algorithm HS256` succeeds, no leaked `/nix/store` rpath). `token.sh` still probes the binary once at startup, so a relapse would be caught again. Exactly the break-then-fix this repo exists to surface.
 
 A broken published package fails only its own matrix cells (see `mark_broken` in `smoke.sh` / `token.sh`); it never aborts the rest of the run.
diff --git a/smoke.sh b/smoke.sh
index fd24262..3dfea6b 100755
--- a/smoke.sh
+++ b/smoke.sh
@@ -443,7 +443,7 @@ if needs js-vite || needs js-esbuild || needs js-jsdelivr; then
 fi
 
 # Native (non-browser) JS: the published @moq/net + @moq/hang under a runtime
-# with no native WebTransport, using the @fails-components/webtransport polyfill.
+# with no native WebTransport, using moq's own @moq/web-transport polyfill.
 # Run under bun (js-native-bun) and node (js-native-node).
 if needs js-native-bun || needs js-native-node; then
     echo "installing native-js client (@moq/net + @moq/hang + webtransport polyfill)..."