@voltkit-rtc/client 0.7.1 → 0.7.3

package/src/index.ts

@@ -349,7 +349,11 @@ export interface ClientEvents extends ChatEvents {
   localStreamChanged: (stream: MediaStream | null) => void;
   /** Media stopped arriving but the connection is intact -- the publisher is reconnecting. */
   streamInterrupted: (e: { reason: string }) => void;
-  /** The session ended and will not recover. Nothing further will be emitted. */
+  /**
+   * The session ended and will not recover. Nothing further will be emitted.
+   * Whatever the reason, the camera, microphone, screen, music and recording
+   * are released with it, as close() does.
+   */
   closed: (reason: ClosedReason) => void;
   /**
    * The account behind this session ran out of minutes or reached a usage
@@ -411,6 +415,8 @@ interface Pending {
   resolve: (v: unknown) => void;
   reject: (e: Error) => void;
   timer: ReturnType<typeof setTimeout>;
+  /** The socket it was sent on: only that socket can answer it. */
+  ws: WebSocket;
 }
 
 const RPC_TIMEOUT_MS = 15_000;
@@ -440,6 +446,16 @@ const VIDEO_START_BITRATE_KBPS = 2000;
 const closedWhileConnecting = () => new RpcError('not-connected', 'the session was closed while connecting');
 
 /** Why a publish gave up: unpublish() ran while it was under way, and unpublish wins. */
+/**
+ * The constraints that capture again what two publishes captured: each kind
+ * as the later publish asked for it, or as the earlier one did if the later
+ * one did not ask for it.
+ */
+function mergeConstraints(earlier: MediaStreamConstraints | null, later: MediaStreamConstraints): MediaStreamConstraints {
+  if (!earlier) return later;
+  return { ...earlier, ...later, audio: later.audio || earlier.audio, video: later.video || earlier.video };
+}
+
 const unpublishedWhile = (what: string) => new RpcError('unpublished', `the ${what} was unpublished while it was being published`);
 
 /**
@@ -486,11 +502,30 @@ export class StreamClient {
   // broadcaster that reconnects rejoins silently, which is worse than being
   // disconnected: the room looks healthy and shows nothing.
   private wasPublishing = false;
+  /** The deadline of the socket being opened (openSocket). */
+  private openDeadline: ReturnType<typeof setTimeout> | undefined;
+  /**
+   * This client's own moderation per kind: whether a moderator holds it off,
+   * and a revision every decision bumps. A switch-on that was waiting for the
+   * server when a decision arrived does not act on its reply (V072-06).
+   */
+  private forcedOff = { audio: false, video: false };
+  private moderationRevision = { audio: 0, video: 0 };
   private publishConstraints: MediaStreamConstraints | null = null;
   private publishOptions: PublishOptions = {};
   /** In-app music being published, kept across reconnects so it can be published again. */
   private music: MusicSource | null = null;
   private musicProducerId: string | null = null;
+  /**
+   * Bumped by every publishMusic() and stopMusic(). A music producer still
+   * being made when it changes belongs to a publish that is over: it is
+   * closed, not kept. publishGeneration alone missed stopMusic(), and the
+   * music went out after stopMusic() had returned.
+   */
+  private musicOperation = 0;
+  // Music publishes run one at a time: the server takes one producer per
+  // source, so the next is produced only once the last one is settled.
+  private musicQueue: Promise<unknown> = Promise.resolve();
   private screenStream: MediaStream | null = null;
   private screenMode: ScreenMode = 'detail';
   private screenAudioEnabled = true;
@@ -507,6 +542,8 @@ export class StreamClient {
   private frameRateWarmupSamples = 2;
   /** What each remote producer carries, so a pause can say "music" rather than just "audio". */
   private readonly remoteSources = new Map<string, TrackSource>();
+  /** Identity of each pending/active subscription; cleared on close/reconnect. */
+  private readonly subscriptions = new Map<string, object>();
   /**
    * The layers asked for each remote video, by producerId. A reconnect
    * consumes everything again, and the new consumer would otherwise start at
@@ -550,6 +587,17 @@ export class StreamClient {
   /** When the token held for reconnects expires (unix ms), and the timer that warns before it does. */
   private tokenExpiry: number | null;
   private tokenTimer: ReturnType<typeof setTimeout> | null = null;
+  /**
+   * Bumped whenever the server hands this client a token (its own refresh, a
+   * promotion's). An updateToken() that started before then keeps the token
+   * it was given only if nothing newer arrived while it waited: its reply,
+   * or its fallback once the socket closed, used to replace a promotion's
+   * token, and the reconnect joined with the old one.
+   */
+  private serverTokenRevision = 0;
+  /** updateToken() calls in call order, and the newest one whose token is held: a later call wins over an earlier one answered after it. */
+  private tokenRequests = 0;
+  private tokenRequestHeld = 0;
   /** Whose each received track is and whether it is switched off, by producerId. */
   private readonly remoteInfo = new Map<string, { identity: string; kind: 'audio' | 'video'; paused: boolean }>();
   /** Videos left unconsumed at the fan-out limit, oldest first; consumed as others end. */
@@ -613,6 +661,18 @@ export class StreamClient {
     this.emit('closed', reason);
   }
 
+  /**
+   * Over for good without the app asking: finish, then release everything
+   * local as close() does -- camera, microphone, screen, music, recording.
+   * kicked and roomClosed always did; a replaced socket, a close without
+   * roomClosed and a reconnect that gave up left them capturing (and the
+   * recording uploading) after `closed`, until the app called close().
+   */
+  private end(reason: ClosedReason): void {
+    this.finish(reason);
+    this.close();
+  }
+
   private stopTimers(): void {
     if (this.tokenTimer) clearTimeout(this.tokenTimer);
     this.tokenTimer = null;
@@ -640,8 +700,13 @@ export class StreamClient {
     const closed = () => lifecycle !== this.lifecycle;
     let result: JoinResult;
     if (this.state === 'idle' || this.state === 'closed') this.setState('connecting');
+    // The socket this call opens. A later connect() replaces it, and this
+    // call's failure must then leave the newer socket, and the state, alone.
+    let socket: WebSocket | null = null;
     try {
-      await this.openSocket();
+      const opening = this.openSocket();
+      socket = this.ws;
+      await opening;
       result = (await this.rpc('join', { token: this.token })) as JoinResult;
       this.joinResult = result;
 
@@ -654,7 +719,11 @@ export class StreamClient {
       // A session that never got going: the app has the error. Left open,
       // the socket would be closed by the server's join deadline instead, and
       // that close would start reconnecting a session that never began.
-      if (!this.joinedOnce) {
+      const superseded = this.ws !== null && this.ws !== socket;
+      // A reconnect attempt that failed (its join timed out, say) lets its
+      // socket go now too, so nothing it says later reaches the session while
+      // the next attempt waits its backoff (V072-05).
+      if ((!this.joinedOnce || this.reconnecting) && !superseded) {
         this.detachSocket();
         if (this.state === 'connecting') this.setState('idle');
       }
@@ -677,6 +746,8 @@ export class StreamClient {
       if (closed()) throw closedWhileConnecting();
     }
     const own = result.participants.find((p) => p.identity === result.identity);
+    this.moderate('audio', Boolean(own?.muted), true);
+    this.moderate('video', Boolean(own?.videoBlocked), true);
     if (own?.muted) this.applyLocalModeration('audio');
     if (own?.videoBlocked) this.applyLocalModeration('video');
     this.emit('joined', result);
@@ -732,11 +803,22 @@ export class StreamClient {
       const ws = new WebSocket(socketUrl(this.wsUrl, this.token));
       this.ws = ws;
 
+      // Bounded like every request (V072-05): a socket that does not open in
+      // time fails the attempt with `timeout` and is closed, instead of
+      // holding connect() -- or a reconnect attempt -- indefinitely.
+      this.openDeadline = setTimeout(() => {
+        reject(new RpcError('timeout', `the connection did not open in ${RPC_TIMEOUT_MS / 1000} s`));
+        if (this.ws === ws) this.detachSocket('open timed out', 'the connection did not open in time');
+      }, RPC_TIMEOUT_MS);
       const onOpen = () => {
+        clearTimeout(this.openDeadline);
         this.emit('connected');
         resolve();
       };
-      const onError = () => reject(new RpcError('connect-failed', 'websocket failed to open'));
+      const onError = () => {
+        clearTimeout(this.openDeadline);
+        reject(new RpcError('connect-failed', 'websocket failed to open'));
+      };
 
       ws.addEventListener('open', onOpen, { once: true });
       ws.addEventListener('error', onError, { once: true });
@@ -756,17 +838,16 @@ export class StreamClient {
           // Another session for this identity is live. Reconnecting would
           // displace it, and it would displace us right back, forever.
           this.emit('error', new RpcError('replaced', 'this identity connected from somewhere else'));
-          // The producers outlive this close until the app calls close(); the
-          // videoLimited sampling must not, or it reports after `closed`.
+          // The videoLimited sampling stops first, or it reports after `closed`.
           this.limitWatch.reset();
-          this.finish('replaced');
+          this.end('replaced');
           return;
         }
         if (ev.code === CLOSE_ENDED) {
           // Normally roomClosed has already ended the session; this covers a
           // close that arrived without it.
           this.limitWatch.reset();
-          this.finish('room-closed');
+          this.end('room-closed');
           return;
         }
         // Before a first successful join the app is still waiting on
@@ -779,16 +860,22 @@ export class StreamClient {
     });
   }
 
-  private detachSocket(reason = 'superseded'): void {
+  private detachSocket(reason = 'superseded', why = 'the connection was replaced'): void {
+    clearTimeout(this.openDeadline);
     const ws = this.ws;
     this.ws = null;
-    if (ws && ws.readyState <= WebSocket.OPEN) {
+    if (!ws) return;
+    if (ws.readyState <= WebSocket.OPEN) {
       try {
         ws.close(1000, reason);
       } catch {
         /* already closing */
       }
     }
+    // Its replies are no longer read, so what waits on it would only wait out
+    // its 15 s timeout: it fails now, as on a close. Never replayed -- the
+    // server may already have acted on it.
+    this.failPending(ws, new RpcError('not-connected', why));
   }
 
   /**
@@ -798,7 +885,7 @@ export class StreamClient {
    * still sending.
    */
   private releaseSocket(): void {
-    this.detachSocket('gave up');
+    this.detachSocket('gave up', 'the session has ended');
     this.failAllPending(new RpcError('not-connected', 'the session has ended'));
   }
 
@@ -819,7 +906,7 @@ export class StreamClient {
         if (this.reconnectAttempt > MAX_RECONNECT_ATTEMPTS) {
           this.emit('error', new RpcError('reconnect-gave-up', `gave up after ${MAX_RECONNECT_ATTEMPTS} reconnect attempts`));
           this.releaseSocket();
-          this.finish('gave-up');
+          this.end('gave-up');
           return;
         }
         const backoff = Math.min(500 * 2 ** (this.reconnectAttempt - 1), 15_000);
@@ -843,7 +930,7 @@ export class StreamClient {
           // attempt forever and drowns out whatever actually went wrong.
           if (err instanceof RpcError && isTerminalError(err.code)) {
             this.releaseSocket();
-            this.finish('gave-up');
+            this.end('gave-up');
             return;
           }
         }
@@ -888,6 +975,7 @@ export class StreamClient {
   }
 
   private teardownMedia(): void {
+    this.subscriptions.clear();
     for (const c of this.consumers.values()) c.close();
     this.consumers.clear();
     this.remoteInfo.clear();
@@ -962,17 +1050,27 @@ export class StreamClient {
    * `tokenExpiring`. On a live connection the server checks it like a join
    * token (`bad-token`, or `token-mismatch` for another room or identity; the
    * session then keeps its token); otherwise it is kept for the next join,
-   * which checks it there. Resolves to when it expires (unix ms), when known.
+   * which checks it there. Resolves to when the token now held expires (unix
+   * ms), when known. A newer token that arrives while this waits is kept
+   * instead of this one: the server's (its own refresh, or a promotion's,
+   * which carries the new role) or a later updateToken()'s.
    */
   async updateToken(token: string): Promise<{ expiresAt: number | null }> {
     if (typeof token !== 'string' || token.trim() === '') throw new TypeError('updateToken needs a token');
     if (this.state === 'closed') throw new RpcError('not-connected', 'this session is closed; create a new client');
+    const request = ++this.tokenRequests;
+    const revision = this.serverTokenRevision;
+    const keep = (expiresAt: number | null) => {
+      if (revision === this.serverTokenRevision && request > this.tokenRequestHeld) {
+        this.tokenRequestHeld = request;
+        this.setToken(token, expiresAt);
+      }
+      return { expiresAt: this.tokenExpiry };
+    };
     if (this.state === 'connected' && this.ws?.readyState === WebSocket.OPEN) {
       try {
         const res = (await this.rpc('refreshToken', { token })) as { expiresAt?: unknown } | undefined;
-        const at = typeof res?.expiresAt === 'number' && res.expiresAt > 0 ? res.expiresAt * 1000 : null;
-        this.setToken(token, at);
-        return { expiresAt: this.tokenExpiry };
+        return keep(typeof res?.expiresAt === 'number' && res.expiresAt > 0 ? res.expiresAt * 1000 : null);
       } catch (err) {
         // An older server has no refreshToken, and a socket that dropped
         // during the call is reconnecting: either way keep the token for the
@@ -980,8 +1078,7 @@ export class StreamClient {
         if (!(err instanceof RpcError) || (err.code !== 'unknown-method' && err.code !== 'not-connected')) throw err;
       }
     }
-    this.setToken(token, null);
-    return { expiresAt: this.tokenExpiry };
+    return keep(null);
   }
 
   /** The token reconnects use from now on, with its expiry (read from the token when not given). */
@@ -1045,11 +1142,21 @@ export class StreamClient {
         this.pending.delete(id);
         reject(new RpcError('timeout', `${method} timed out`));
       }, RPC_TIMEOUT_MS);
-      this.pending.set(id, { resolve, reject, timer });
+      this.pending.set(id, { resolve, reject, timer, ws: this.ws });
       this.ws.send(JSON.stringify({ id, method, params }));
     });
   }
 
+  /** Fail what was sent on `ws` and is still waiting. */
+  private failPending(ws: WebSocket, err: Error): void {
+    for (const [id, p] of this.pending) {
+      if (p.ws !== ws) continue;
+      clearTimeout(p.timer);
+      this.pending.delete(id);
+      p.reject(err);
+    }
+  }
+
   private failAllPending(err: Error): void {
     for (const p of this.pending.values()) {
       clearTimeout(p.timer);
@@ -1093,21 +1200,20 @@ export class StreamClient {
         break;
       case 'producerClosed': {
         const { producerId, identity } = data as { producerId: string; identity: string };
+        this.subscriptions.delete(producerId);
         this.preferredLayers.delete(producerId);
         this.receiveQualities.delete(producerId);
         this.remoteVideoLayers.delete(producerId);
         this.skippedVideos.delete(producerId);
         const consumer = this.consumers.get(producerId);
-        if (!consumer) break; // never consumed it, or already cleaned up
-        this.videoSlots.delete(producerId);
-        consumer.close();
+        consumer?.close();
         this.consumers.delete(producerId);
         this.remoteSources.delete(producerId);
         this.remoteInfo.delete(producerId);
-        this.emit('trackEnded', { producerId, identity });
+        if (consumer) this.emit('trackEnded', { producerId, identity });
         // A video slot opened under the fan-out limit: the oldest video left
         // waiting takes it.
-        if (consumer.kind === 'video') void this.consumeSkipped().catch((err) => this.emit('error', err as Error));
+        this.releaseVideoSlot(producerId);
         break;
       }
       case 'producerPaused': {
@@ -1133,6 +1239,7 @@ export class StreamClient {
       case 'participantMuted': {
         const wire = data as { identity: string; kind?: 'audio' | 'video' | ''; muted?: boolean; paused?: boolean };
         const e = { identity: wire.identity, kind: wire.kind, paused: wire.paused ?? wire.muted ?? false };
+        if (e.identity && e.identity === this.joinResult?.identity) this.moderate(e.kind, e.paused, true);
         this.updateRoster((list) => list.map((p) =>
           p.identity !== e.identity ? p : { ...p,
             ...(!e.kind || e.kind === 'audio' ? { muted: e.paused } : {}),
@@ -1179,6 +1286,7 @@ export class StreamClient {
         // in-app music: it travels as audio). Reflect it locally; a release
         // changes nothing here -- switching back on is the user's choice.
         const e = data as { by: string; kind?: 'audio' | 'video' | ''; paused: boolean };
+        this.moderate(e.kind, Boolean(e.paused));
         if (e.paused) {
           this.applyLocalModeration(e.kind);
           this.emitLocalMedia();
@@ -1203,13 +1311,19 @@ export class StreamClient {
         // fresh one periodically so a reconnect at any point still works --
         // without this, any disconnect after the token's lifetime is terminal.
         const e = data as { token?: string; role?: Role; expiresAt?: number };
-        if (e.token) this.setToken(e.token, typeof e.expiresAt === 'number' && e.expiresAt > 0 ? e.expiresAt * 1000 : null);
+        if (e.token) {
+          this.serverTokenRevision += 1;
+          this.setToken(e.token, typeof e.expiresAt === 'number' && e.expiresAt > 0 ? e.expiresAt * 1000 : null);
+        }
         break;
       }
       case 'mustReconnect': {
         const e = data as { reason: string; token?: string; retry: boolean };
         // A promotion hands us a fresh token carrying the new role.
-        if (e.token) this.setToken(e.token, null);
+        if (e.token) {
+          this.serverTokenRevision += 1;
+          this.setToken(e.token, null);
+        }
         this.emit('mustReconnect', e);
         if (e.retry) {
           this.teardownMedia();
@@ -1377,9 +1491,26 @@ export class StreamClient {
     // unpublish() ran first: this publish is over before it began, and must
     // leave nothing behind that a reconnect would publish again.
     if (generation !== this.publishGeneration) throw unpublishedWhile('stream');
-    this.localStream = stream;
+    // A second publish adds to the first (the microphone, then the camera):
+    // one local stream carries every live track, so unpublish() and close()
+    // stop them all and a reconnect publishes each again. Replacing it
+    // orphaned the first stream's tracks, still capturing (V072-01).
+    const previous = this.localStream;
+    const merged = previous !== null && previous !== stream && previous.getTracks().some((t) => t.readyState === 'live');
+    if (merged) {
+      const ids = new Set(stream.getTracks().map((t) => t.id));
+      // The new stream's tracks first: of one kind, the newer track is the one
+      // published (as before), and the older one is still stopped with it.
+      this.localStream = new MediaStream([
+        ...stream.getTracks(),
+        ...previous.getTracks().filter((t) => t.readyState === 'live' && !ids.has(t.id)),
+      ]);
+      this.emit('localStreamChanged', this.localStream);
+    } else {
+      this.localStream = stream;
+    }
     this.wasPublishing = true;
-    if (constraints) this.publishConstraints = constraints;
+    if (constraints) this.publishConstraints = merged ? mergeConstraints(this.publishConstraints, constraints) : constraints;
     if (options) {
       this.publishOptions = { ...options };
       this.frameRateFallback = false;
@@ -1972,7 +2103,11 @@ export class StreamClient {
       if (this.screenStream === screen) await this.stopScreen('stopped');
       this.emit('error', err as Error);
     });
-    if (this.music) await this.produceMusic(this.music, generation).catch((err) => this.emit('error', err as Error));
+    if (this.music) {
+      const music = this.music;
+      const operation = this.musicOperation;
+      await this.musicTask(() => this.produceMusic(music, generation, operation)).catch((err) => this.emit('error', err as Error));
+    }
     if (generation !== this.publishGeneration) return;
 
     let stream = this.localStream;
@@ -2183,26 +2318,41 @@ export class StreamClient {
   async publishMusic(input: MusicInput, options?: MusicOptions): Promise<void> {
     if (!this.mediaPermissions.audio) throw new RpcError('media-disabled', 'audio is switched off for this project');
     const generation = this.publishGeneration;
-    if (this.music) await this.stopMusic();
-    const music = new MusicSource(input, options);
-    try {
-      await this.produceMusic(music, generation);
-      // Checked again here: an unpublish() after the producer was kept has
-      // already closed it, and the music must not be remembered for a
-      // reconnect to publish again.
-      if (generation !== this.publishGeneration) throw unpublishedWhile('music');
-    } catch (err) {
-      music.close();
-      throw err;
-    }
-    this.music = music;
-    this.wasPublishing = true;
-    this.emitLocalMedia();
+    // Taken now, in call order: a music publish still under way is over, and
+    // a stopMusic() from here on ends this one.
+    const operation = ++this.musicOperation;
+    await this.musicTask(async () => {
+      if (generation !== this.publishGeneration || operation !== this.musicOperation) throw unpublishedWhile('music');
+      if (this.music) await this.closeMusic();
+      const music = new MusicSource(input, options);
+      try {
+        await this.produceMusic(music, generation, operation);
+        // Checked again here: an unpublish() or stopMusic() after the
+        // producer was kept has already closed it, and the music must not be
+        // remembered for a reconnect to publish again.
+        if (generation !== this.publishGeneration || operation !== this.musicOperation) throw unpublishedWhile('music');
+      } catch (err) {
+        music.close();
+        throw err;
+      }
+      this.music = music;
+      this.wasPublishing = true;
+      this.emitLocalMedia();
+    });
   }
 
-  private async produceMusic(music: MusicSource, generation: number): Promise<void> {
+  private musicTask<T>(task: () => Promise<T>): Promise<T> {
+    const run = this.musicQueue.then(task, task);
+    this.musicQueue = run.catch(() => undefined);
+    return run;
+  }
+
+  private async produceMusic(music: MusicSource, generation: number, operation: number): Promise<void> {
+    // unpublish(), stopMusic() or a newer publishMusic() can run at any wait
+    // below, and wins.
+    const current = () => generation === this.publishGeneration && operation === this.musicOperation;
     const transport = await this.ensureSendTransport();
-    if (generation !== this.publishGeneration) throw unpublishedWhile('music');
+    if (!current()) throw unpublishedWhile('music');
     const producer = await transport.produce({
       track: music.track,
       stopTracks: false,
@@ -2211,7 +2361,14 @@ export class StreamClient {
       codecOptions: { opusStereo: true, opusDtx: false, opusFec: true, opusMaxAverageBitrate: 128_000 },
       appData: { source: 'music' },
     });
-    await this.keepProducer(producer, generation, 'music');
+    if (!current()) {
+      producer.close();
+      await this.rpc('closeProducer', { producerId: producer.id }).catch(() => undefined);
+      throw unpublishedWhile('music');
+    }
+    // Kept and named the music in one step, with no wait between: stopMusic()
+    // finds the music producer by that name.
+    this.producers.set(producer.id, producer);
     this.musicProducerId = producer.id;
     // Music switched off before a reconnect comes back paused here.
     await this.pauseOnServer(producer);
@@ -2242,8 +2399,18 @@ export class StreamClient {
     this.emitLocalMedia();
   }
 
-  /** Stop publishing music. The element or stream it came from is left as it was. */
+  /**
+   * Stop publishing music. The element or stream it came from is left as it
+   * was. A publishMusic() still under way is stopped too: it rejects with
+   * `unpublished` and publishes nothing.
+   */
   async stopMusic(): Promise<void> {
+    this.musicOperation += 1;
+    await this.closeMusic();
+  }
+
+  /** Close the music being published, here and at the server. */
+  private async closeMusic(): Promise<void> {
     const id = this.musicProducerId;
     this.musicProducerId = null;
     this.music?.close();
@@ -2265,8 +2432,9 @@ export class StreamClient {
   }
 
   private async consume(remote: RemoteProducer): Promise<void> {
+    if (this.closedByUs) return;
     if (!this.device) throw new RpcError('not-connected', 'not connected');
-    if (this.consumers.has(remote.producerId)) return;
+    if (this.subscriptions.has(remote.producerId)) return;
     // Your own camera is already local; pulling it back off the SFU wastes a
     // consumer and shows you a delayed copy of yourself.
     if (remote.identity === this.joinResult?.identity) return;
@@ -2285,34 +2453,67 @@ export class StreamClient {
       }
       this.videoSlots.add(remote.producerId);
     }
+    const operation = {};
+    this.subscriptions.set(remote.producerId, operation);
     try {
-      await this.consumeNow(remote);
+      await this.consumeNow(remote, operation);
     } catch (err) {
-      if (!this.consumers.has(remote.producerId)) this.videoSlots.delete(remote.producerId);
+      // A closed producer or replaced session has already released its slot.
+      // Its late failure must neither release a newer slot nor report a ghost error.
+      if (this.subscriptions.get(remote.producerId) !== operation) return;
+      this.subscriptions.delete(remote.producerId);
+      this.consumers.get(remote.producerId)?.close();
+      this.consumers.delete(remote.producerId);
+      this.remoteVideoLayers.delete(remote.producerId);
+      this.remoteSources.delete(remote.producerId);
+      this.remoteInfo.delete(remote.producerId);
+      this.releaseVideoSlot(remote.producerId);
       throw err;
     }
   }
 
+  /**
+   * Free a video slot, and let the oldest video waiting take it -- whatever
+   * freed it: an ended video, or a subscription that failed. Not while
+   * reconnecting: a failure caused by the socket dropping would otherwise
+   * start every waiting video on a dead connection, each failing with
+   * not-connected; the reconnect's join lists them all again anyway.
+   */
+  private releaseVideoSlot(producerId: string): void {
+    if (this.videoSlots.delete(producerId) && !this.closedByUs && this.state !== 'reconnecting') this.consumeSkipped();
+  }
+
   /** The oldest videos left waiting at the fan-out limit take the slots that opened. */
-  private async consumeSkipped(): Promise<void> {
+  private consumeSkipped(): void {
     for (const [producerId, remote] of this.skippedVideos) {
       const limit = this.mediaPermissions.maxVideoSubscriptions;
       if (limit !== null && this.videoSlots.size >= limit) return;
       this.skippedVideos.delete(producerId);
-      await this.consume(remote);
+      // consume reserves synchronously, before its first await. Consecutive
+      // releases cannot admit the same producer or exceed the limit.
+      void this.consume(remote).catch((err) => this.emit('error', err as Error));
     }
   }
 
-  private async consumeNow(remote: RemoteProducer): Promise<void> {
+  private async consumeNow(remote: RemoteProducer, operation: object): Promise<void> {
     if (!this.device) throw new RpcError('not-connected', 'not connected');
+    const device = this.device;
+    const current = (made?: Consumer) => {
+      if (!this.closedByUs && this.subscriptions.get(remote.producerId) === operation) return;
+      made?.close();
+      throw new RpcError('not-connected', 'subscription ended during setup');
+    };
     const transport = await this.ensureRecvTransport();
+    current();
     const params = (await this.rpc('consume', {
       transportId: transport.id,
       producerId: remote.producerId,
-      rtpCapabilities: this.device.rtpCapabilities,
+      rtpCapabilities: device.rtpCapabilities,
     })) as { id: string; producerId: string; kind: 'audio' | 'video'; rtpParameters: never };
 
+    current();
     const consumer = await transport.consume(params);
+    current(consumer);
     this.consumers.set(remote.producerId, consumer);
     this.remoteVideoLayers.set(remote.producerId, remote.videoLayers ?? remote.appData?.videoLayers ?? (params as { videoLayers?: VideoLayer[] }).videoLayers ?? []);
 
@@ -2328,10 +2529,12 @@ export class StreamClient {
     if (layers) {
       await this.rpc('setPreferredLayers', { consumerId: consumer.id, ...layers }).catch((err) => this.emit('error', err as Error));
     }
+    current(consumer);
 
     // The server created it paused. Resume only now that our end exists,
     // otherwise the first frames arrive before there is anything to decode them.
     await this.rpc('resumeConsumer', { consumerId: consumer.id });
+    current(consumer);
 
     const kind = consumer.kind as 'audio' | 'video';
     const source = remote.source ?? defaultSource(kind);
@@ -2396,16 +2599,47 @@ export class StreamClient {
   }
 
   private async setKindEnabled(kind: 'audio' | 'video', enabled: boolean): Promise<void> {
-    for (const producer of this.producers.values()) {
-      // The music has its own switch. Muting the microphone must not stop the song.
-      if (producer.kind !== kind || producer.appData.source !== defaultSource(kind)) continue;
+    const generation = this.publishGeneration;
+    // Unpublished or closed while waiting: nothing is left to switch, and the
+    // call resolves, as it does with nothing published (V072-03).
+    const ended = () => generation !== this.publishGeneration || this.closedByUs;
+    // The music has its own switch. Muting the microphone must not stop the song.
+    const targets = [...this.producers.values()].filter((p) => p.kind === kind && p.appData.source === defaultSource(kind));
+    for (const producer of targets) {
+      if (ended()) return;
+      if (this.producers.get(producer.id) !== producer || producer.closed) continue;
+      const revision = this.moderationRevision[kind];
       if (!enabled) producer.pause();
-      await this.rpc('pauseProducer', { producerId: producer.id, paused: !enabled });
-      if (enabled) producer.resume();
+      try {
+        await this.rpc('pauseProducer', { producerId: producer.id, paused: !enabled });
+      } catch (err) {
+        if (ended()) return;
+        throw err;
+      }
+      if (ended()) return;
+      if (!enabled || this.producers.get(producer.id) !== producer || producer.closed) continue;
+      if (revision !== this.moderationRevision[kind] || this.forcedOff[kind]) {
+        // A moderator decided while this waited: the older request does not
+        // undo it. It stays off here, and the server is told so too, since
+        // which of the two it applied last cannot be known from here.
+        void this.rpc('pauseProducer', { producerId: producer.id, paused: true }).catch(() => undefined);
+        this.emitLocalMedia();
+        throw new RpcError('force-muted', `a moderator changed your ${kind} while this request waited; it stays off`);
+      }
+      producer.resume();
     }
     this.emitLocalMedia();
   }
 
+  /** Record a moderation decision ('' = both kinds). A roster snapshot counts only where it changes what is known. */
+  private moderate(kind: 'audio' | 'video' | '' | undefined, paused: boolean, snapshot = false): void {
+    for (const k of kind ? [kind] : (['audio', 'video'] as const)) {
+      if (snapshot && this.forcedOff[k] === paused) continue;
+      this.forcedOff[k] = paused;
+      this.moderationRevision[k] += 1;
+    }
+  }
+
   /** Stop publishing entirely and release the local devices. */
   async unpublish(): Promise<void> {
     void this.stopRecording().catch(error => this.emit('error', error as Error));