@desklink/react-native 0.5.2 → 0.5.3

package/README.md

@@ -156,7 +156,8 @@ view.
   VP9. Neither platform links a second WebRTC stack.
 - **A sharp, zoomable picture.** In portrait the default is fit-width;
   in landscape it covers the screen below the status bar (as far as the 2.5
-  zoom limit allows). The picture stays undistorted. One finger pans cropped
+  zoom limit allows). The `cover` prop opts portrait into the same
+  coverage, cropping the overflowing sides instead of letterboxing. The picture stays undistorted. One finger pans cropped
   content; pinch to zoom before panning when the whole desktop already fits.
   Pass the screen's safe-area `insets` (for example from
   `react-native-safe-area-context`) so the default starts below the status bar
@@ -230,9 +231,10 @@ view.
   instead of sitting at 44 pt. An app may draw its own keys
   from `modifiers` instead.
 - **Readiness is a rendered frame.** Android marks the first draw; iOS marks
-  the first `RTCView` video-dimensions callback and ignores later ones, so a
-  resize or remount during a reconnect does not read as live. Neither marks
-  a track or ICE connection as live.
+  the first `RTCView` video-dimensions callback and ignores later ones; web
+  marks the first presented frame and ignores later repaints, so a resize,
+  remount, or renegotiation repaint during a reconnect does not read as live.
+  No platform marks a track or ICE connection as live.
 - **Connection states, as they happen.** The session status is `idle`,
   `opening`, `connecting`, `live`, `reconnecting`, `ended` or `failed`. The
   peer's ICE state and the engine's `session.state` both feed it: a
@@ -312,6 +314,15 @@ interface Signaling {
 candidates, state and revocation. Pixels and input do **not** use this
 channel — they are the desktop's own WebRTC session.
 
+`authorize()` must wait for the authenticated carrier to open before returning
+its `Signaling`. When that carrier is gone, reject pending and future requests
+with `code: 'transport'`; do not queue them indefinitely. An adapter may emit
+`{ kind: 'carrier-closed' }` once to notify subscribers of that loss. This is
+not the native peer's `closed` event or an engine revocation. Preserve the
+engine's `session.revoked` code: `transport` indicates path loss; other codes
+(or no code) are final. The demo adapter bounds connection setup to five seconds
+and closes its socket and pending queue when disposed.
+
 ## Shipping on iOS
 
 What the consuming app — not this package — must get right before review.

package/android/src/main/java/expo/modules/desklink/DesklinkModule.kt

@@ -145,6 +145,10 @@ class DesklinkModule : Module() {
         view.setGestures(gestures ?: "desktop")
       }
 
+      Prop("cover") { view: DesktopView, cover: Boolean? ->
+        view.setCover(cover ?: false)
+      }
+
       OnViewDestroys { view: DesktopView -> view.release() }
 
       OnViewDidUpdateProps { view: DesktopView ->

package/android/src/main/java/expo/modules/desklink/DesktopView.kt

@@ -114,6 +114,19 @@ class DesktopView(context: Context, appContext: AppContext) : ExpoView(context,
   private var fitted = true
   private var filling = true
   private var filledScale = 0f
+  /**
+   * Opt-in cover: the picture covers the view in every orientation, cropping
+   * the overflowing axis, instead of fitting the portrait width. Off by
+   * default; the default path below is untouched.
+   */
+  private var cover = false
+
+  fun setCover(value: Boolean) {
+    if (value == cover) return
+    cover = value
+    filledScale = 0f
+    layoutPicture()
+  }
 
   /** What the system covers at each edge (bars, cutout), in pixels: left, top, right, bottom. */
   private var insetLeft = 0f
@@ -459,9 +472,11 @@ class DesktopView(context: Context, appContext: AppContext) : ExpoView(context,
   }
 
   private fun fillScale(): Float {
-    val cover = if (width <= height) safeWidth() / surfaceWidth
-      else max(width.toFloat() / surfaceWidth, (height - insetTop) / surfaceHeight)
-    return max(fitScale(), min(cover, MAX_SCALE))
+    // Portrait fits the width unless the app opted into cover; landscape
+    // covers. Either way the fill never goes below the fit or above the zoom cap.
+    val wide = if (width <= height && !cover) safeWidth() else width.toFloat()
+    val fill = max(wide / surfaceWidth, (height - insetTop) / surfaceHeight)
+    return max(fitScale(), min(fill, MAX_SCALE))
   }
 
   /** Re-derive the placement from `filling`, `fitted`, the zoom limits and the edges. */

package/app.plugin.js

@@ -7,10 +7,233 @@
  * without it.
  *
  *   "plugins": ["@desklink/react-native"]
+ *
+ * The plugin also repairs `expo-modules-jsi` 57.x for Xcode 26 (Swift 6.2).
+ * Two defects, both fatal, both fixed upstream in expo-modules-jsi 58 (SDK 58
+ * is out of scope and the 57 line has no fixed patch release):
+ *
+ * 1. `RuntimeScheduler.h` annotates two C++ constructors with
+ *    `SWIFT_RETURNS_RETAINED`, which Swift 6.2 rejects as a hard error
+ *    ("not returning a SWIFT_SHARED_REFERENCE type"), so no 57-line app
+ *    compiles. Mirrored from 58: private constructors plus static `create`
+ *    factories carrying the annotation, with the Swift call sites moved over.
+ * 2. `JavaScriptRuntime.swift` captures raw JSI pointers through
+ *    `nonisolated(unsafe)` locals into `JavaScriptActor.assumeIsolated`
+ *    closures, which Swift 6.2 rejects ("sending ... risks causing data
+ *    races") now that `assumeIsolated` takes a `sending` closure. Mirrored
+ *    from 58: an `UncheckedSendable` box plus `.value` at the use sites.
+ *
+ * Applied to the installed package at prebuild time, before `pod install`
+ * compiles it. Scoped to the 57 line: other versions skip untouched.
+ */
+const fs = require('fs');
+const path = require('path');
+
+const JSI_HEADER = 'apple/Sources/ExpoModulesJSI-Cxx/include/RuntimeScheduler.h';
+const JSI_SWIFT = 'apple/Sources/ExpoModulesJSI/Runtime/JavaScriptRuntime.swift';
+const JSI_BOX = 'apple/Sources/ExpoModulesJSI/Utilities/UncheckedSendable.swift';
+
+// The exact 57.x constructor block: constructors carrying the annotation that
+// Swift 6.2 rejects. (\u2014 is the em dash in the original comment.)
+const BROKEN_CONSTRUCTORS = `public:
+  /**
+   Constructs a scheduler bound to a host-provided native RuntimeScheduler.
+   \`scheduleTask\` dispatches through \`fn\`, which the host implements against
+   the real react::RuntimeScheduler.
+   */
+  SWIFT_RETURNS_RETAINED RuntimeScheduler(void *scheduler, ScheduleFn fn) noexcept
+      : nativeScheduler(scheduler), scheduleFn(fn) {}
+
+  /**
+   Constructs a no-op scheduler. Scheduled tasks run synchronously on the
+   caller's thread \u2014 intended for standalone runtimes (e.g. tests) that have
+   no React scheduler.
+   */
+  SWIFT_RETURNS_RETAINED RuntimeScheduler() {}`;
+
+// The 58-shaped replacement: unannotated private constructors plus annotated
+// static factories, which every Swift version accepts.
+const FIXED_CONSTRUCTORS = `  RuntimeScheduler(void *scheduler, ScheduleFn fn) noexcept
+      : nativeScheduler(scheduler), scheduleFn(fn) {}
+
+  RuntimeScheduler() noexcept {}
+
+public:
+  // Swift creates instances through the static \`create\` functions below, not
+  // the constructors: \`SWIFT_RETURNS_RETAINED\` on a constructor is a hard
+  // error on Swift 6.2 (Xcode 26), while a static function returning the shared
+  // reference accepts the annotation on every Swift version. This mirrors the
+  // fix Expo ships in expo-modules-jsi 58; the 57 line has no such release.
+
+  /**
+   Creates a scheduler bound to a host-provided native RuntimeScheduler.
+   \`scheduleTask\` dispatches through \`fn\`, which the host implements against
+   the real react::RuntimeScheduler.
+   */
+  static RuntimeScheduler *create(void *scheduler, ScheduleFn fn) noexcept SWIFT_RETURNS_RETAINED {
+    return new RuntimeScheduler(scheduler, fn);
+  }
+
+  /**
+   Creates a no-op scheduler. Scheduled tasks run synchronously on the
+   caller's thread \u2014 intended for standalone runtimes (e.g. tests) that have
+   no React scheduler.
+   */
+  static RuntimeScheduler *create() noexcept SWIFT_RETURNS_RETAINED {
+    return new RuntimeScheduler();
+  }`;
+
+// Verbatim from expo-modules-jsi 58's Utilities/UncheckedSendable.swift: an
+// allocation-free `@unchecked Sendable` box. Swift 6.2 still reports
+// "sending ... risks causing data races" for `nonisolated(unsafe)` locals
+// captured by a `sending` closure, while a captured `Sendable` value passes.
+const UNCHECKED_SENDABLE = `/// Immutable wrapper that makes a non-Sendable value capturable by a \`@Sendable\` closure without compiler enforcement.
+/// Unlike \`NonisolatedUnsafeVar\`, it is a struct, so wrapping a value doesn't allocate.
+///
+/// Use it instead of a \`nonisolated(unsafe) let\` local captured by such a closure: Swift 6.2 still reports
+/// "sending '...' risks causing data races" for those, while a capture of a \`Sendable\` value passes on every version.
+/// The caller is responsible for making sure the value is never accessed concurrently.
+internal struct UncheckedSendable<Value>: @unchecked Sendable {
+  let value: Value
+
+  init(_ value: Value) {
+    self.value = value
+  }
+}
+`;
+
+function countOf(text, snippet) {
+    return text.split(snippet).length - 1;
+}
+
+function replaceOnceOrThrow(text, oldText, newText, what) {
+    if (countOf(text, oldText) !== 1) {
+        throw new Error('[desklink] expo-modules-jsi ' + what + ': expected one match, refusing to patch.');
+    }
+    return text.replace(oldText, newText);
+}
+
+/**
+ * Apply the 58-shaped Xcode 26 fixes to the installed expo-modules-jsi.
+ * Idempotent: a second prebuild (or an upstream-fixed copy) is a no-op.
+ * Scoped to the 57 line; anything else is left untouched. Throws on an
+ * unrecognised 57 layout rather than shipping a guess.
  */
-module.exports = function withDesklinkPointer(config) {
+function patchExpoModulesJsi(projectRoot) {
+    const root = path.join(projectRoot, 'node_modules/expo-modules-jsi');
+    const header = path.join(root, JSI_HEADER);
+    if (!fs.existsSync(header)) {
+        console.log('[desklink] expo-modules-jsi header not installed, skipping Xcode 26 fix');
+        return;
+    }
+    let version = '';
+    try {
+        version = JSON.parse(fs.readFileSync(path.join(root, 'package.json'), 'utf8')).version ?? '';
+    } catch { /* unknown version: the layout checks below decide */ }
+    if (!version.startsWith('57.')) {
+        if (version === '') {
+            throw new Error('[desklink] expo-modules-jsi has no readable version; refusing to patch blind.');
+        }
+        console.log(`[desklink] expo-modules-jsi ${version} is not a 57 release, skipping Xcode 26 fix`);
+        return;
+    }
+    const before = fs.readFileSync(header, 'utf8');
+    if (!before.includes('static RuntimeScheduler *create(')) {
+        if (countOf(before, BROKEN_CONSTRUCTORS) !== 1) {
+            throw new Error(
+                '[desklink] expo-modules-jsi ' + version + ' RuntimeScheduler.h has an unrecognised layout; ' +
+                'refusing to patch. Update this plugin workaround for the installed version.'
+            );
+        }
+        fs.writeFileSync(header, before.replace(BROKEN_CONSTRUCTORS, FIXED_CONSTRUCTORS));
+    }
+
+    // The header's only constructor callers are the Swift file beside it:
+    // point them at the factories. Member accesses (`.Priority(`, `.ScheduleFn`)
+    // never match `RuntimeScheduler(`.
+    const swift = path.join(root, JSI_SWIFT);
+    if (!fs.existsSync(swift)) {
+        throw new Error('[desklink] expo-modules-jsi ' + version + ' ships no ' + JSI_SWIFT + '.');
+    }
+    let swiftText = fs.readFileSync(swift, 'utf8');
+    if (!swiftText.includes('expo.RuntimeScheduler.create(')) {
+        const migrated = swiftText.replace(/expo\.RuntimeScheduler\(/g, 'expo.RuntimeScheduler.create(');
+        if (migrated === swiftText || /expo\.RuntimeScheduler\(/.test(migrated)) {
+            throw new Error('[desklink] expo-modules-jsi JavaScriptRuntime.swift call sites not fully migrated.');
+        }
+        swiftText = migrated;
+    }
+
+    // Capture the JSI pointers through UncheckedSendable instead of
+    // `nonisolated(unsafe)`, which Swift 6.2 rejects at `sending` closures.
+    if (!swiftText.includes('resultPtr.value')) {
+        if (countOf(swiftText, 'nonisolated(unsafe) let resultPtr = resultPtr') !== 3) {
+            throw new Error('[desklink] expo-modules-jsi JavaScriptRuntime.swift pointer captures have an unrecognised layout.');
+        }
+        swiftText = replaceOnceOrThrow(swiftText,
+            'let propertyName = String(cString: propertyName)\n      nonisolated(unsafe) let resultPtr = resultPtr',
+            'let propertyName = String(cString: propertyName)\n      let resultPtr = UncheckedSendable(resultPtr)',
+            'getter capture');
+        swiftText = swiftText.split(
+            '    nonisolated(unsafe) let thisPtr = thisPtr\n' +
+            '    nonisolated(unsafe) let argumentsPtr = argumentsPtr\n' +
+            '    nonisolated(unsafe) let resultPtr = resultPtr').join(
+            '    let thisPtr = UncheckedSendable(thisPtr)\n' +
+            '    let argumentsPtr = UncheckedSendable(argumentsPtr)\n' +
+            '    let resultPtr = UncheckedSendable(resultPtr)');
+        if (countOf(swiftText, 'let thisPtr = UncheckedSendable(thisPtr)') !== 2) {
+            throw new Error('[desklink] expo-modules-jsi JavaScriptRuntime.swift trampoline captures not fully migrated.');
+        }
+        const writes = countOf(swiftText, 'writeJSIValue(to: resultPtr)');
+        if (writes !== 3) {
+            throw new Error('[desklink] expo-modules-jsi JavaScriptRuntime.swift result writes have an unrecognised layout.');
+        }
+        swiftText = swiftText.replace(/writeJSIValue\(to: resultPtr\)/g, 'writeJSIValue(to: resultPtr.value)');
+        swiftText = replaceOnceOrThrow(swiftText,
+            'UnsafeMutablePointer(mutating: thisPtr)', 'UnsafeMutablePointer(mutating: thisPtr.value)',
+            'owning-this use');
+        const starts = countOf(swiftText, 'start: argumentsPtr, count:');
+        if (starts !== 2) {
+            throw new Error('[desklink] expo-modules-jsi JavaScriptRuntime.swift buffer starts have an unrecognised layout.');
+        }
+        swiftText = swiftText.replace(/start: argumentsPtr, count:/g, 'start: argumentsPtr.value, count:');
+        swiftText = replaceOnceOrThrow(swiftText,
+            'JavaScriptUnownedValue(runtime.pointee, thisPtr)', 'JavaScriptUnownedValue(runtime.pointee, thisPtr.value)',
+            'unowned-this use');
+        swiftText = replaceOnceOrThrow(swiftText,
+            'so the `nonisolated(unsafe)` capture is sound.', 'so capturing them through `UncheckedSendable` is sound.',
+            'trampoline comment');
+        fs.writeFileSync(swift, swiftText);
+    }
+
+    const box = path.join(root, JSI_BOX);
+    if (!fs.existsSync(box)) {
+        fs.writeFileSync(box, UNCHECKED_SENDABLE);
+    }
+    console.log('[desklink] patched expo-modules-jsi ' + version + ' for Xcode 26');
+}
+
+function withDesklinkPointer(config) {
     return {
         ...config,
         ios: { ...config.ios, infoPlist: { ...config.ios?.infoPlist, UIApplicationSupportsIndirectInputEvents: true } },
     };
+}
+
+function withExpoJsiSwiftFix(config) {
+    let withDangerousMod;
+    try {
+        withDangerousMod = require('expo/config-plugins').withDangerousMod;
+    } catch {
+        throw new Error('[desklink] expo/config-plugins is required to apply the Xcode 26 patch.');
+    }
+    return withDangerousMod(config, ['ios', async (config) => {
+        patchExpoModulesJsi(config.modRequest.projectRoot);
+        return config;
+    }]);
+}
+
+module.exports = function withDesklink(config) {
+    return withExpoJsiSwiftFix(withDesklinkPointer(config));
 };
+module.exports.patchExpoModulesJsi = patchExpoModulesJsi;

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@desklink/react-native",
-    "version": "0.5.2",
+    "version": "0.5.3",
     "license": "Apache-2.0",
     "description": "Render and drive a desktop session from a React Native app",
     "main": "index.ts",

package/src/DesktopView.ios.spec.tsx

@@ -508,6 +508,7 @@ describe('iOS proof picture bounds', () => {
     it('measures contiguous paper without including the disconnected home indicator', () => {
         for (const density of [1, 3]) {
             const png = { width: 390 * density, height: 844 * density, data: new Uint8Array(390 * 844 * density * density * 4) };
+            const right = (390 * density - 1) / density;
             const paper = (left: number, top: number, right: number, bottom: number) => {
                 for (let y = top * density; y < bottom * density; y++) for (let x = left * density; x < right * density; x++) {
                     const i = (y * png.width + x) * 4;
@@ -516,14 +517,14 @@ describe('iOS proof picture bounds', () => {
             };
             paper(0, 47, 390, 266);
             paper(125, 825, 265, 830);
-            expect(pictureBox(png, 390)).toEqual({ top: 47, left: 0, bottom: 266 });
+            expect(pictureBox(png, 390)).toEqual({ top: 47, left: 0, bottom: 266, right });
             png.data.fill(0);
             paper(0, 203, 390, 642);
             paper(125, 825, 265, 830);
-            expect(pictureBox(png, 390)).toEqual({ top: 203, left: 0, bottom: 642 });
+            expect(pictureBox(png, 390)).toEqual({ top: 203, left: 0, bottom: 642, right });
             png.data.fill(0);
             paper(47, 0, 390, 844);
-            expect(pictureBox(png, 390)).toEqual({ top: 0, left: 47, bottom: 844 });
+            expect(pictureBox(png, 390)).toEqual({ top: 0, left: 47, bottom: 844, right });
         }
     });
 });

package/src/DesktopView.ios.tsx

@@ -67,7 +67,7 @@ function loadRTCView(): React.ComponentType<Record<string, unknown>> | null {
 /** An offset that the edge clamp turns into the desktop's top-left corner. */
 const TOP_LEFT: Point = { x: Infinity, y: Infinity };
 
-export function DesktopView({ sessionId, style, placeholder, accessibilityLabel, keyboardClearance = 0, insets, gestures = 'desktop', onPictureFrame }: DesktopViewProps) {
+export function DesktopView({ sessionId, style, placeholder, accessibilityLabel, keyboardClearance = 0, insets, gestures = 'desktop', cover = false, onPictureFrame }: DesktopViewProps) {
     const [revision, refresh] = React.useReducer((n: number) => n + 1, 0);
     const [bounds, setBounds] = React.useState({ width: 0, height: 0 });
     const [size, setSize] = React.useState(() => getDesktopSize(sessionId) ?? { width: 0, height: 0 });
@@ -145,7 +145,10 @@ export function DesktopView({ sessionId, style, placeholder, accessibilityLabel,
     const visibleBottom = Math.min(top + safeHeight, bounds.height - (keyboardOverlap ? keyboardOverlap + keyboardClearance : 0));
     const visibleHeight = Math.max(1, visibleBottom - top);
     const fit = size.width && size.height ? Math.min(safeWidth / size.width, visibleHeight / size.height) : 1;
-    const defaultScale = bounds.width <= bounds.height
+    // Portrait fits the width unless the app opted into cover, when it covers
+    // like landscape does (as `DesktopView.kt` does); either way the fill never
+    // goes below the fit or above the zoom cap.
+    const defaultScale = bounds.width <= bounds.height && !cover
         ? safeWidth / size.width
         : Math.max(bounds.width / size.width, (bounds.height - top) / size.height);
     const fill = size.width && size.height ? Math.max(fit, Math.min(MAX_SCALE, defaultScale)) : 1;

package/src/DesktopView.tsx

@@ -35,6 +35,11 @@ export interface DesktopViewProps {
      * (one finger scrolls), or a device screen (one finger presses and drags).
      */
     gestures?: GestureProfile;
+    /**
+     * Cover the view in every orientation, cropping the overflowing axis,
+     * instead of fitting the portrait width. Off by default.
+     */
+    cover?: boolean;
     /**
      * Where the picture ended, in the view's own points, whenever it moves.
      * A wide desktop on a tall screen leaves a band under the picture; this is
@@ -53,6 +58,7 @@ interface NativeSurfaceProps {
     /** `insets` as top, left, bottom, right. */
     insets?: number[];
     gestures?: GestureProfile;
+    cover?: boolean;
 }
 
 // The Expo view is resolved at module load; on a platform without it the
@@ -69,7 +75,7 @@ const NativeSurface: React.ComponentType<NativeSurfaceProps> | null = desktopAva
  * belong to the application, which mounts this wherever it wants the desktop
  * to appear.
  */
-export function DesktopView({ sessionId, style, placeholder, accessibilityLabel, keyboardClearance = 0, insets, gestures = 'desktop' }: DesktopViewProps) {
+export function DesktopView({ sessionId, style, placeholder, accessibilityLabel, keyboardClearance = 0, insets, gestures = 'desktop', cover = false }: DesktopViewProps) {
     if (NativeSurface == null || sessionId == null) {
         return (
             <View style={[styles.surface, style]}>
@@ -78,7 +84,7 @@ export function DesktopView({ sessionId, style, placeholder, accessibilityLabel,
         );
     }
     return <NativeSurface style={[styles.surface, style]} sessionId={sessionId} accessible={accessibilityLabel !== undefined} accessibilityLabel={accessibilityLabel} keyboardClearance={keyboardClearance}
-        insets={[insets?.top ?? 0, insets?.left ?? 0, insets?.bottom ?? 0, insets?.right ?? 0]} gestures={gestures} />;
+        insets={[insets?.top ?? 0, insets?.left ?? 0, insets?.bottom ?? 0, insets?.right ?? 0]} gestures={gestures} cover={cover} />;
 }
 
 const styles = StyleSheet.create({

package/src/native.web.ts

@@ -127,6 +127,8 @@ interface WebSession {
     chordsDown: Set<string>;
     /** Re-measure what the keyboard covers; null until a surface is attached. */
     followKeyboard: (() => void) | null;
+    /** Whether the first frame was already reported; renegotiation must not re-mark a stale picture. */
+    presented: boolean;
     /** Candidates that arrived before the offer; applied once it is set. */
     remoteDescriptionSet: boolean;
     pendingCandidates: RTCIceCandidateInit[];
@@ -960,6 +962,7 @@ export const nativeDesklink: NativeDesklinkModule = {
             compositionSent: '',
             composing: false,
             chordsDown: new Set<string>(),
+            presented: false,
             remoteDescriptionSet: false,
             pendingCandidates: [],
             detach: null,
@@ -982,6 +985,12 @@ export const nativeDesklink: NativeDesklinkModule = {
             // track and produce nothing.
             const presented = (): void => {
                 if (sessions.get(id) !== session) return;
+                // Readiness is the first frame. Renegotiation re-fires ontrack
+                // and the compositor repaints the frame it already holds, and a
+                // repaint is not a new frame: a second mark would read a stale
+                // picture as live and reset the recovery budget mid-outage.
+                if (session.presented) return;
+                session.presented = true;
                 video.style.opacity = '1';
                 emit(id, 'presented', {});
             };

package/src/protocol.ts

@@ -103,6 +103,8 @@ export interface CursorSample {
  * the new session corrupts or kills a healthy recovery.
  */
 export type SessionEvent =
+    /** Optional carrier notification, distinct from the native peer's `closed`. */
+    | { kind: 'carrier-closed'; sessionId?: never }
     | { kind: 'description'; description: RtcDescription; sessionId?: string }
     | { kind: 'candidate'; candidate: RtcCandidate; sessionId?: string }
     | ({ kind: 'cursor' } & CursorSample)
@@ -120,10 +122,13 @@ export type SessionEvent =
  * The package calls these and nothing else, so an application can carry them
  * over its existing encrypted request path, a socket, or an in-process bridge.
  * `subscribe` delivers engine notifications until the returned function runs.
+ * The application's authorize() resolves only once this carrier is open.
  */
 export interface Signaling {
     /**
-     * Send one request. A rejection may carry a stable `code` — the engine's or
+     * Send one request. Reject pending and future requests with `code: 'transport'`
+     * once the carrier is gone; never queue requests on a dead carrier.
+     * A rejection may carry a stable `code` — the engine's or
      * the host's own token — which the package reads to classify a refusal, so a
      * refusal is not retried as though it were a network failure.
      */

package/src/useDesktopSession.ts

@@ -804,7 +804,8 @@ export function useDesktopSession(options: DesktopSessionOptions): DesktopSessio
         try {
             authorization = await optionsRef.current.authorize();
         } catch (error) {
-            refuse(error instanceof Error ? error.message : 'the desktop was not authorized', 'permission');
+            const code = (error as { code?: unknown } | null)?.code === 'transport' ? 'transport' : 'permission';
+            refuse(error instanceof Error ? error.message : 'the desktop was not authorized', code);
             return;
         }
         if (token !== generationToken.current) return;
@@ -1023,6 +1024,9 @@ export function useDesktopSession(options: DesktopSessionOptions): DesktopSessio
                         // Readiness is not "a track arrived": it is a frame on screen.
                         return;
                     case 'presented':
+                        // One mark per session: a producer that re-marks (a repaint
+                        // after renegotiation) must not read a stale picture as live.
+                        if (presentedRef.current) return;
                         attempts.current = 0;
                         restartAttempts.current = 0;
                         restartCycles.current = 0;