@voltkit-rtc/client 0.7.0 → 0.7.2

package/src/index.ts

@@ -349,7 +349,11 @@ export interface ClientEvents extends ChatEvents {
   localStreamChanged: (stream: MediaStream | null) => void;
   /** Media stopped arriving but the connection is intact -- the publisher is reconnecting. */
   streamInterrupted: (e: { reason: string }) => void;
-  /** The session ended and will not recover. Nothing further will be emitted. */
+  /**
+   * The session ended and will not recover. Nothing further will be emitted.
+   * Whatever the reason, the camera, microphone, screen, music and recording
+   * are released with it, as close() does.
+   */
   closed: (reason: ClosedReason) => void;
   /**
    * The account behind this session ran out of minutes or reached a usage
@@ -411,6 +415,8 @@ interface Pending {
   resolve: (v: unknown) => void;
   reject: (e: Error) => void;
   timer: ReturnType<typeof setTimeout>;
+  /** The socket it was sent on: only that socket can answer it. */
+  ws: WebSocket;
 }
 
 const RPC_TIMEOUT_MS = 15_000;
@@ -436,6 +442,9 @@ const isLayer = (value: unknown): value is number => Number.isInteger(value) &&
  */
 const VIDEO_START_BITRATE_KBPS = 2000;
 
+/** Why a connect() gave up: close() ran while it was under way, and close wins. */
+const closedWhileConnecting = () => new RpcError('not-connected', 'the session was closed while connecting');
+
 /** Why a publish gave up: unpublish() ran while it was under way, and unpublish wins. */
 const unpublishedWhile = (what: string) => new RpcError('unpublished', `the ${what} was unpublished while it was being published`);
 
@@ -488,6 +497,16 @@ export class StreamClient {
   /** In-app music being published, kept across reconnects so it can be published again. */
   private music: MusicSource | null = null;
   private musicProducerId: string | null = null;
+  /**
+   * Bumped by every publishMusic() and stopMusic(). A music producer still
+   * being made when it changes belongs to a publish that is over: it is
+   * closed, not kept. publishGeneration alone missed stopMusic(), and the
+   * music went out after stopMusic() had returned.
+   */
+  private musicOperation = 0;
+  // Music publishes run one at a time: the server takes one producer per
+  // source, so the next is produced only once the last one is settled.
+  private musicQueue: Promise<unknown> = Promise.resolve();
   private screenStream: MediaStream | null = null;
   private screenMode: ScreenMode = 'detail';
   private screenAudioEnabled = true;
@@ -504,13 +523,23 @@ export class StreamClient {
   private frameRateWarmupSamples = 2;
   /** What each remote producer carries, so a pause can say "music" rather than just "audio". */
   private readonly remoteSources = new Map<string, TrackSource>();
+  /** Identity of each pending/active subscription; cleared on close/reconnect. */
+  private readonly subscriptions = new Map<string, object>();
   /**
    * The layers asked for each remote video, by producerId. A reconnect
    * consumes everything again, and the new consumer would otherwise start at
    * the full picture.
    */
   private readonly preferredLayers = new Map<string, PreferredLayers>();
+  /** endRoom() calls waiting for their reply; a roomClosed that arrives first answers them. */
+  private readonly endRoomWaiters = new Set<() => void>();
   private closedByUs = false;
+  /**
+   * Bumped when the session ends for good: close(), or finish(). A connect()
+   * under way when it did -- the app's, or a reconnect's -- sees the change
+   * after its next await and stops, so a closed session never comes back.
+   */
+  private lifecycle = 0;
   private reconnecting = false;
   private reconnectAttempt = 0;
   /** Set once a connect() has joined and set up. Only such a session is reconnected. */
@@ -539,6 +568,17 @@ export class StreamClient {
   /** When the token held for reconnects expires (unix ms), and the timer that warns before it does. */
   private tokenExpiry: number | null;
   private tokenTimer: ReturnType<typeof setTimeout> | null = null;
+  /**
+   * Bumped whenever the server hands this client a token (its own refresh, a
+   * promotion's). An updateToken() that started before then keeps the token
+   * it was given only if nothing newer arrived while it waited: its reply,
+   * or its fallback once the socket closed, used to replace a promotion's
+   * token, and the reconnect joined with the old one.
+   */
+  private serverTokenRevision = 0;
+  /** updateToken() calls in call order, and the newest one whose token is held: a later call wins over an earlier one answered after it. */
+  private tokenRequests = 0;
+  private tokenRequestHeld = 0;
   /** Whose each received track is and whether it is switched off, by producerId. */
   private readonly remoteInfo = new Map<string, { identity: string; kind: 'audio' | 'video'; paused: boolean }>();
   /** Videos left unconsumed at the fan-out limit, oldest first; consumed as others end. */
@@ -597,10 +637,23 @@ export class StreamClient {
   /** Over for good: the state, then the event that says why. */
   private finish(reason: ClosedReason): void {
     this.closedByUs = true;
+    this.lifecycle += 1;
     this.setState('closed');
     this.emit('closed', reason);
   }
 
+  /**
+   * Over for good without the app asking: finish, then release everything
+   * local as close() does -- camera, microphone, screen, music, recording.
+   * kicked and roomClosed always did; a replaced socket, a close without
+   * roomClosed and a reconnect that gave up left them capturing (and the
+   * recording uploading) after `closed`, until the app called close().
+   */
+  private end(reason: ClosedReason): void {
+    this.finish(reason);
+    this.close();
+  }
+
   private stopTimers(): void {
     if (this.tokenTimer) clearTimeout(this.tokenTimer);
     this.tokenTimer = null;
@@ -624,20 +677,31 @@ export class StreamClient {
   // ------------------------------------------------------------- connection
 
   async connect(): Promise<JoinResult> {
+    const lifecycle = this.lifecycle;
+    const closed = () => lifecycle !== this.lifecycle;
     let result: JoinResult;
     if (this.state === 'idle' || this.state === 'closed') this.setState('connecting');
+    // The socket this call opens. A later connect() replaces it, and this
+    // call's failure must then leave the newer socket, and the state, alone.
+    let socket: WebSocket | null = null;
     try {
-      await this.openSocket();
+      const opening = this.openSocket();
+      socket = this.ws;
+      await opening;
       result = (await this.rpc('join', { token: this.token })) as JoinResult;
       this.joinResult = result;
 
       this.device = this.createDevice();
       await this.device.load({ routerRtpCapabilities: result.routerRtpCapabilities });
+      // close() ran while the Device loaded: going on would set the state
+      // back to connected, and emit joined, after closed.
+      if (closed()) throw closedWhileConnecting();
     } catch (err) {
       // A session that never got going: the app has the error. Left open,
       // the socket would be closed by the server's join deadline instead, and
       // that close would start reconnecting a session that never began.
-      if (!this.joinedOnce) {
+      const superseded = this.ws !== null && this.ws !== socket;
+      if (!this.joinedOnce && !superseded) {
         this.detachSocket();
         if (this.state === 'connecting') this.setState('idle');
       }
@@ -657,6 +721,7 @@ export class StreamClient {
     // decides what may return; reconnecting never turns a blocked device on.
     if (result.role !== 'host' && result.role !== 'cohost' && (this.wasPublishing || this.screenPending)) {
       await this.unpublish();
+      if (closed()) throw closedWhileConnecting();
     }
     const own = result.participants.find((p) => p.identity === result.identity);
     if (own?.muted) this.applyLocalModeration('audio');
@@ -677,16 +742,19 @@ export class StreamClient {
     for (const producerId of this.remoteVideoLayers.keys()) if (!present.has(producerId)) this.remoteVideoLayers.delete(producerId);
 
     // Subscribe to everything already publishing before we announce readiness.
+    // A close() part-way stops it: what is left would only fail, after closed.
     for (const p of result.producers) {
-      await this.consume(p).catch((err) => this.emit('error', err as Error));
+      if (closed()) throw closedWhileConnecting();
+      await this.consume(p).catch((err) => { if (!closed()) this.emit('error', err as Error); });
     }
 
     // Restore our own broadcast. This is what makes an origin failover
     // survivable for the host: it reconnects onto the new origin and the
     // stream comes back on its own.
     if (this.wasPublishing && (result.role === 'host' || result.role === 'cohost')) {
-      await this.republish().catch((err) => this.emit('error', err as Error));
+      await this.republish().catch((err) => { if (!closed()) this.emit('error', err as Error); });
     }
+    if (closed()) throw closedWhileConnecting();
     this.syncNetworkWatch();
     return result;
   }
@@ -735,17 +803,16 @@ export class StreamClient {
           // Another session for this identity is live. Reconnecting would
           // displace it, and it would displace us right back, forever.
           this.emit('error', new RpcError('replaced', 'this identity connected from somewhere else'));
-          // The producers outlive this close until the app calls close(); the
-          // videoLimited sampling must not, or it reports after `closed`.
+          // The videoLimited sampling stops first, or it reports after `closed`.
           this.limitWatch.reset();
-          this.finish('replaced');
+          this.end('replaced');
           return;
         }
         if (ev.code === CLOSE_ENDED) {
           // Normally roomClosed has already ended the session; this covers a
           // close that arrived without it.
           this.limitWatch.reset();
-          this.finish('room-closed');
+          this.end('room-closed');
           return;
         }
         // Before a first successful join the app is still waiting on
@@ -758,16 +825,32 @@ export class StreamClient {
     });
   }
 
-  private detachSocket(): void {
+  private detachSocket(reason = 'superseded', why = 'the connection was replaced'): void {
     const ws = this.ws;
     this.ws = null;
-    if (ws && ws.readyState <= WebSocket.OPEN) {
+    if (!ws) return;
+    if (ws.readyState <= WebSocket.OPEN) {
       try {
-        ws.close(1000, 'superseded');
+        ws.close(1000, reason);
       } catch {
         /* already closing */
       }
     }
+    // Its replies are no longer read, so what waits on it would only wait out
+    // its 15 s timeout: it fails now, as on a close. Never replayed -- the
+    // server may already have acted on it.
+    this.failPending(ws, new RpcError('not-connected', why));
+  }
+
+  /**
+   * A reconnect that ends the session lets go of its socket. A refused join
+   * leaves that socket open (connect() keeps it once a session has joined),
+   * and the session would otherwise report closed with it still attached and
+   * still sending.
+   */
+  private releaseSocket(): void {
+    this.detachSocket('gave up', 'the session has ended');
+    this.failAllPending(new RpcError('not-connected', 'the session has ended'));
   }
 
   /**
@@ -786,7 +869,8 @@ export class StreamClient {
         this.reconnectAttempt += 1;
         if (this.reconnectAttempt > MAX_RECONNECT_ATTEMPTS) {
           this.emit('error', new RpcError('reconnect-gave-up', `gave up after ${MAX_RECONNECT_ATTEMPTS} reconnect attempts`));
-          this.finish('gave-up');
+          this.releaseSocket();
+          this.end('gave-up');
           return;
         }
         const backoff = Math.min(500 * 2 ** (this.reconnectAttempt - 1), 15_000);
@@ -801,12 +885,16 @@ export class StreamClient {
           // for good, with no `closed`.
           if (this.ws) return;
         } catch (err) {
+          // Ended while this attempt was under way -- by close(), or by the
+          // server -- and that has been reported: nothing follows closed.
+          if (this.closedByUs) return;
           this.emit('error', err as Error);
           // Stop on failures a retry cannot resolve (the registry's terminal
           // codes). Hammering a room that has ended produces one error per
           // attempt forever and drowns out whatever actually went wrong.
           if (err instanceof RpcError && isTerminalError(err.code)) {
-            this.finish('gave-up');
+            this.releaseSocket();
+            this.end('gave-up');
             return;
           }
         }
@@ -822,6 +910,7 @@ export class StreamClient {
     // others have already reported themselves and set closedByUs.
     const wasOpen = !this.closedByUs;
     this.closedByUs = true;
+    this.lifecycle += 1;
     this.publishGeneration += 1;
     this.wasPublishing = false;
     this.teardownMedia();
@@ -841,11 +930,16 @@ export class StreamClient {
     const ws = this.ws;
     this.ws = null;
     ws?.close(1000, 'client closed');
+    // Detached first, so the socket's own close handler no longer fails what
+    // was waiting on it: done here, or a join or a request in flight would
+    // wait out its 15 s timeout.
+    this.failAllPending(new RpcError('not-connected', 'the session was closed'));
     this.setState('closed');
     if (wasOpen) this.emit('closed', 'left');
   }
 
   private teardownMedia(): void {
+    this.subscriptions.clear();
     for (const c of this.consumers.values()) c.close();
     this.consumers.clear();
     this.remoteInfo.clear();
@@ -920,17 +1014,27 @@ export class StreamClient {
    * `tokenExpiring`. On a live connection the server checks it like a join
    * token (`bad-token`, or `token-mismatch` for another room or identity; the
    * session then keeps its token); otherwise it is kept for the next join,
-   * which checks it there. Resolves to when it expires (unix ms), when known.
+   * which checks it there. Resolves to when the token now held expires (unix
+   * ms), when known. A newer token that arrives while this waits is kept
+   * instead of this one: the server's (its own refresh, or a promotion's,
+   * which carries the new role) or a later updateToken()'s.
    */
   async updateToken(token: string): Promise<{ expiresAt: number | null }> {
     if (typeof token !== 'string' || token.trim() === '') throw new TypeError('updateToken needs a token');
     if (this.state === 'closed') throw new RpcError('not-connected', 'this session is closed; create a new client');
+    const request = ++this.tokenRequests;
+    const revision = this.serverTokenRevision;
+    const keep = (expiresAt: number | null) => {
+      if (revision === this.serverTokenRevision && request > this.tokenRequestHeld) {
+        this.tokenRequestHeld = request;
+        this.setToken(token, expiresAt);
+      }
+      return { expiresAt: this.tokenExpiry };
+    };
     if (this.state === 'connected' && this.ws?.readyState === WebSocket.OPEN) {
       try {
         const res = (await this.rpc('refreshToken', { token })) as { expiresAt?: unknown } | undefined;
-        const at = typeof res?.expiresAt === 'number' && res.expiresAt > 0 ? res.expiresAt * 1000 : null;
-        this.setToken(token, at);
-        return { expiresAt: this.tokenExpiry };
+        return keep(typeof res?.expiresAt === 'number' && res.expiresAt > 0 ? res.expiresAt * 1000 : null);
       } catch (err) {
         // An older server has no refreshToken, and a socket that dropped
         // during the call is reconnecting: either way keep the token for the
@@ -938,8 +1042,7 @@ export class StreamClient {
         if (!(err instanceof RpcError) || (err.code !== 'unknown-method' && err.code !== 'not-connected')) throw err;
       }
     }
-    this.setToken(token, null);
-    return { expiresAt: this.tokenExpiry };
+    return keep(null);
   }
 
   /** The token reconnects use from now on, with its expiry (read from the token when not given). */
@@ -1003,11 +1106,21 @@ export class StreamClient {
         this.pending.delete(id);
         reject(new RpcError('timeout', `${method} timed out`));
       }, RPC_TIMEOUT_MS);
-      this.pending.set(id, { resolve, reject, timer });
+      this.pending.set(id, { resolve, reject, timer, ws: this.ws });
       this.ws.send(JSON.stringify({ id, method, params }));
     });
   }
 
+  /** Fail what was sent on `ws` and is still waiting. */
+  private failPending(ws: WebSocket, err: Error): void {
+    for (const [id, p] of this.pending) {
+      if (p.ws !== ws) continue;
+      clearTimeout(p.timer);
+      this.pending.delete(id);
+      p.reject(err);
+    }
+  }
+
   private failAllPending(err: Error): void {
     for (const p of this.pending.values()) {
       clearTimeout(p.timer);
@@ -1023,6 +1136,9 @@ export class StreamClient {
     } catch {
       return;
     }
+    // Valid JSON that is not a message object ("null" would throw below) is
+    // ignored like any other frame that is not a message.
+    if (typeof msg !== 'object' || msg === null) return;
 
     if (typeof msg.id === 'number') {
       const p = this.pending.get(msg.id);
@@ -1048,21 +1164,20 @@ export class StreamClient {
         break;
       case 'producerClosed': {
         const { producerId, identity } = data as { producerId: string; identity: string };
+        this.subscriptions.delete(producerId);
         this.preferredLayers.delete(producerId);
         this.receiveQualities.delete(producerId);
         this.remoteVideoLayers.delete(producerId);
         this.skippedVideos.delete(producerId);
         const consumer = this.consumers.get(producerId);
-        if (!consumer) break; // never consumed it, or already cleaned up
-        this.videoSlots.delete(producerId);
-        consumer.close();
+        consumer?.close();
         this.consumers.delete(producerId);
         this.remoteSources.delete(producerId);
         this.remoteInfo.delete(producerId);
-        this.emit('trackEnded', { producerId, identity });
+        if (consumer) this.emit('trackEnded', { producerId, identity });
         // A video slot opened under the fan-out limit: the oldest video left
         // waiting takes it.
-        if (consumer.kind === 'video') void this.consumeSkipped().catch((err) => this.emit('error', err as Error));
+        this.releaseVideoSlot(producerId);
         break;
       }
       case 'producerPaused': {
@@ -1158,13 +1273,19 @@ export class StreamClient {
         // fresh one periodically so a reconnect at any point still works --
         // without this, any disconnect after the token's lifetime is terminal.
         const e = data as { token?: string; role?: Role; expiresAt?: number };
-        if (e.token) this.setToken(e.token, typeof e.expiresAt === 'number' && e.expiresAt > 0 ? e.expiresAt * 1000 : null);
+        if (e.token) {
+          this.serverTokenRevision += 1;
+          this.setToken(e.token, typeof e.expiresAt === 'number' && e.expiresAt > 0 ? e.expiresAt * 1000 : null);
+        }
         break;
       }
       case 'mustReconnect': {
         const e = data as { reason: string; token?: string; retry: boolean };
         // A promotion hands us a fresh token carrying the new role.
-        if (e.token) this.setToken(e.token, null);
+        if (e.token) {
+          this.serverTokenRevision += 1;
+          this.setToken(e.token, null);
+        }
         this.emit('mustReconnect', e);
         if (e.retry) {
           this.teardownMedia();
@@ -1190,6 +1311,10 @@ export class StreamClient {
         this.closedByUs = true;
         this.emit('roomClosed', d as never);
         this.finish('room-closed');
+        // Before close() fails what is pending: an endRoom() this event
+        // answers succeeded.
+        for (const ended of this.endRoomWaiters) ended();
+        this.endRoomWaiters.clear();
         this.close();
         break;
       case 'kicked':
@@ -1923,7 +2048,11 @@ export class StreamClient {
       if (this.screenStream === screen) await this.stopScreen('stopped');
       this.emit('error', err as Error);
     });
-    if (this.music) await this.produceMusic(this.music, generation).catch((err) => this.emit('error', err as Error));
+    if (this.music) {
+      const music = this.music;
+      const operation = this.musicOperation;
+      await this.musicTask(() => this.produceMusic(music, generation, operation)).catch((err) => this.emit('error', err as Error));
+    }
     if (generation !== this.publishGeneration) return;
 
     let stream = this.localStream;
@@ -2134,26 +2263,41 @@ export class StreamClient {
   async publishMusic(input: MusicInput, options?: MusicOptions): Promise<void> {
     if (!this.mediaPermissions.audio) throw new RpcError('media-disabled', 'audio is switched off for this project');
     const generation = this.publishGeneration;
-    if (this.music) await this.stopMusic();
-    const music = new MusicSource(input, options);
-    try {
-      await this.produceMusic(music, generation);
-      // Checked again here: an unpublish() after the producer was kept has
-      // already closed it, and the music must not be remembered for a
-      // reconnect to publish again.
-      if (generation !== this.publishGeneration) throw unpublishedWhile('music');
-    } catch (err) {
-      music.close();
-      throw err;
-    }
-    this.music = music;
-    this.wasPublishing = true;
-    this.emitLocalMedia();
+    // Taken now, in call order: a music publish still under way is over, and
+    // a stopMusic() from here on ends this one.
+    const operation = ++this.musicOperation;
+    await this.musicTask(async () => {
+      if (generation !== this.publishGeneration || operation !== this.musicOperation) throw unpublishedWhile('music');
+      if (this.music) await this.closeMusic();
+      const music = new MusicSource(input, options);
+      try {
+        await this.produceMusic(music, generation, operation);
+        // Checked again here: an unpublish() or stopMusic() after the
+        // producer was kept has already closed it, and the music must not be
+        // remembered for a reconnect to publish again.
+        if (generation !== this.publishGeneration || operation !== this.musicOperation) throw unpublishedWhile('music');
+      } catch (err) {
+        music.close();
+        throw err;
+      }
+      this.music = music;
+      this.wasPublishing = true;
+      this.emitLocalMedia();
+    });
   }
 
-  private async produceMusic(music: MusicSource, generation: number): Promise<void> {
+  private musicTask<T>(task: () => Promise<T>): Promise<T> {
+    const run = this.musicQueue.then(task, task);
+    this.musicQueue = run.catch(() => undefined);
+    return run;
+  }
+
+  private async produceMusic(music: MusicSource, generation: number, operation: number): Promise<void> {
+    // unpublish(), stopMusic() or a newer publishMusic() can run at any wait
+    // below, and wins.
+    const current = () => generation === this.publishGeneration && operation === this.musicOperation;
     const transport = await this.ensureSendTransport();
-    if (generation !== this.publishGeneration) throw unpublishedWhile('music');
+    if (!current()) throw unpublishedWhile('music');
     const producer = await transport.produce({
       track: music.track,
       stopTracks: false,
@@ -2162,7 +2306,14 @@ export class StreamClient {
       codecOptions: { opusStereo: true, opusDtx: false, opusFec: true, opusMaxAverageBitrate: 128_000 },
       appData: { source: 'music' },
     });
-    await this.keepProducer(producer, generation, 'music');
+    if (!current()) {
+      producer.close();
+      await this.rpc('closeProducer', { producerId: producer.id }).catch(() => undefined);
+      throw unpublishedWhile('music');
+    }
+    // Kept and named the music in one step, with no wait between: stopMusic()
+    // finds the music producer by that name.
+    this.producers.set(producer.id, producer);
     this.musicProducerId = producer.id;
     // Music switched off before a reconnect comes back paused here.
     await this.pauseOnServer(producer);
@@ -2193,8 +2344,18 @@ export class StreamClient {
     this.emitLocalMedia();
   }
 
-  /** Stop publishing music. The element or stream it came from is left as it was. */
+  /**
+   * Stop publishing music. The element or stream it came from is left as it
+   * was. A publishMusic() still under way is stopped too: it rejects with
+   * `unpublished` and publishes nothing.
+   */
   async stopMusic(): Promise<void> {
+    this.musicOperation += 1;
+    await this.closeMusic();
+  }
+
+  /** Close the music being published, here and at the server. */
+  private async closeMusic(): Promise<void> {
     const id = this.musicProducerId;
     this.musicProducerId = null;
     this.music?.close();
@@ -2216,8 +2377,9 @@ export class StreamClient {
   }
 
   private async consume(remote: RemoteProducer): Promise<void> {
+    if (this.closedByUs) return;
     if (!this.device) throw new RpcError('not-connected', 'not connected');
-    if (this.consumers.has(remote.producerId)) return;
+    if (this.subscriptions.has(remote.producerId)) return;
     // Your own camera is already local; pulling it back off the SFU wastes a
     // consumer and shows you a delayed copy of yourself.
     if (remote.identity === this.joinResult?.identity) return;
@@ -2236,34 +2398,67 @@ export class StreamClient {
       }
       this.videoSlots.add(remote.producerId);
     }
+    const operation = {};
+    this.subscriptions.set(remote.producerId, operation);
     try {
-      await this.consumeNow(remote);
+      await this.consumeNow(remote, operation);
     } catch (err) {
-      if (!this.consumers.has(remote.producerId)) this.videoSlots.delete(remote.producerId);
+      // A closed producer or replaced session has already released its slot.
+      // Its late failure must neither release a newer slot nor report a ghost error.
+      if (this.subscriptions.get(remote.producerId) !== operation) return;
+      this.subscriptions.delete(remote.producerId);
+      this.consumers.get(remote.producerId)?.close();
+      this.consumers.delete(remote.producerId);
+      this.remoteVideoLayers.delete(remote.producerId);
+      this.remoteSources.delete(remote.producerId);
+      this.remoteInfo.delete(remote.producerId);
+      this.releaseVideoSlot(remote.producerId);
       throw err;
     }
   }
 
+  /**
+   * Free a video slot, and let the oldest video waiting take it -- whatever
+   * freed it: an ended video, or a subscription that failed. Not while
+   * reconnecting: a failure caused by the socket dropping would otherwise
+   * start every waiting video on a dead connection, each failing with
+   * not-connected; the reconnect's join lists them all again anyway.
+   */
+  private releaseVideoSlot(producerId: string): void {
+    if (this.videoSlots.delete(producerId) && !this.closedByUs && this.state !== 'reconnecting') this.consumeSkipped();
+  }
+
   /** The oldest videos left waiting at the fan-out limit take the slots that opened. */
-  private async consumeSkipped(): Promise<void> {
+  private consumeSkipped(): void {
     for (const [producerId, remote] of this.skippedVideos) {
       const limit = this.mediaPermissions.maxVideoSubscriptions;
       if (limit !== null && this.videoSlots.size >= limit) return;
       this.skippedVideos.delete(producerId);
-      await this.consume(remote);
+      // consume reserves synchronously, before its first await. Consecutive
+      // releases cannot admit the same producer or exceed the limit.
+      void this.consume(remote).catch((err) => this.emit('error', err as Error));
     }
   }
 
-  private async consumeNow(remote: RemoteProducer): Promise<void> {
+  private async consumeNow(remote: RemoteProducer, operation: object): Promise<void> {
     if (!this.device) throw new RpcError('not-connected', 'not connected');
+    const device = this.device;
+    const current = (made?: Consumer) => {
+      if (!this.closedByUs && this.subscriptions.get(remote.producerId) === operation) return;
+      made?.close();
+      throw new RpcError('not-connected', 'subscription ended during setup');
+    };
     const transport = await this.ensureRecvTransport();
+    current();
     const params = (await this.rpc('consume', {
       transportId: transport.id,
       producerId: remote.producerId,
-      rtpCapabilities: this.device.rtpCapabilities,
+      rtpCapabilities: device.rtpCapabilities,
     })) as { id: string; producerId: string; kind: 'audio' | 'video'; rtpParameters: never };
 
+    current();
     const consumer = await transport.consume(params);
+    current(consumer);
     this.consumers.set(remote.producerId, consumer);
     this.remoteVideoLayers.set(remote.producerId, remote.videoLayers ?? remote.appData?.videoLayers ?? (params as { videoLayers?: VideoLayer[] }).videoLayers ?? []);
 
@@ -2279,10 +2474,12 @@ export class StreamClient {
     if (layers) {
       await this.rpc('setPreferredLayers', { consumerId: consumer.id, ...layers }).catch((err) => this.emit('error', err as Error));
     }
+    current(consumer);
 
     // The server created it paused. Resume only now that our end exists,
     // otherwise the first frames arrive before there is anything to decode them.
     await this.rpc('resumeConsumer', { consumerId: consumer.id });
+    current(consumer);
 
     const kind = consumer.kind as 'audio' | 'video';
     const source = remote.source ?? defaultSource(kind);
@@ -2424,7 +2621,20 @@ export class StreamClient {
   }
   promote(identity: string, role: Role): Promise<unknown> { return this.rpc('promote', { identity, role }); }
   kick(identity: string, reason?: string): Promise<unknown> { return this.rpc('kick', { identity, reason }); }
-  endRoom(): Promise<unknown> { return this.rpc('endRoom'); }
+  /**
+   * End the room for everyone. The server tells the room it has closed
+   * before it replies, and that roomClosed closes this session, so the reply
+   * may never be read: roomClosed is then the answer, and endRoom() resolves
+   * as the reply would have, with `{ ok: true }`. It still fails when the
+   * server refuses, or the connection drops with neither.
+   */
+  endRoom(): Promise<unknown> {
+    return new Promise((resolve, reject) => {
+      const ended = () => resolve({ ok: true });
+      this.endRoomWaiters.add(ended);
+      this.rpc('endRoom').then(resolve, reject).finally(() => this.endRoomWaiters.delete(ended));
+    });
+  }
   getRoomState(): Promise<unknown> { return this.rpc('getRoomState'); }
 
   // ------------------------------------------------------- slots and metadata